joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4607a0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x57c5c6
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x5e95e0]
xor eax, esp
mov dword [esp + 0x260], eax
push ebp
push esi
mov eax, dword [0x5e95e0]
xor eax, esp
push eax
lea eax, [esp + 0x274]
mov dword fs:[0], eax
mov eax, dword [esp + 0x284]
mov esi, ecx
push eax
lea ecx, [esp + 0x18]
call fcn.00402390
push 0x5958a8
push eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x288], 0
call fcn.00401ba0
push esi
push eax
lea ecx, [esp + 0x2c]
push ecx
mov byte [esp + 0x294], 1
call fcn.00401ba0
mov eax, dword [eax]
add esp, 0x18
lea edx, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46084e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x27c], 0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x460876
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x27c], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4608a1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp esi, 0xffffffff
je 0x46094e
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ecx, 0x5925cc
lea eax, [esp + 0x48]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4608e6
test dx, dx
je 0x4608e2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4608e6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4608c0
xor eax, eax
jmp 0x4608eb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x46093e
mov ecx, 0x59a8a0
lea eax, [esp + 0x48]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x46091e
test dx, dx
je 0x46091a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x46091e
add eax, 4
add ecx, 4
test dx, dx
jne 0x4608f8
xor eax, eax
jmp 0x460923
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x46093e
test byte [esp + 0x1c], 0x10
jne 0x46093e
mov edx, dword [edi + 8]
lea ecx, [esp + 0x48]
push ecx
push edx
mov ecx, edi
call fcn.005390d4
lea eax, [esp + 0x1c]
push eax
push esi
call ebp
test eax, eax
jne 0x4608b0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x274]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.00552101
add esp, 0x274
ret
Function at 0x460c50
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x18
lea eax, [esp + 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x460cb3
lea ecx, [esp + 0xc]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 4]
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
push 0
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x460cb3
push 0
push 0xd
call dword [sym.imp.USER32.dll_ExitWindowsEx]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x460cf6
push 0
push 0
lea ecx, [esp + 8]
push ecx
push 0x400
push eax
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov edx, dword [esp]
push 0x10
push 0x5a7d50
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [esp]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
add esp, 0x18
ret

Function at 0x460d00
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
mov edi, eax
mov ecx, edi
call fcn.00402160
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x460d84
mov esi, dword [sym.imp.USER32.dll_GetClipboardData]
push ebx
push 0xd
call esi
mov ebx, eax
test ebx, ebx
je 0x460d52
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov esi, eax
cmp esi, ebp
jge 0x460d7d
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
shr esi, 1
sub esi, 1
push esi
push eax
mov ecx, edi
call fcn.004121c0
push ebx
jmp 0x460d77
push 1
call esi
mov esi, eax
test esi, esi
je 0x460d7d
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
cmp eax, ebp
jge 0x460d7d
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
mov ecx, edi
call fcn.004055e0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop ebx
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jle 0x460da8
push 0
push eax
call fcn.00552f60
add esp, 8
test eax, eax
je 0x460da8
sub eax, dword [edi]
sar eax, 1
js 0x460da8
mov esi, eax
call fcn.00401d70
pop edi
pop esi
pop ebp
ret
Function at 0x460db0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
test eax, eax
push ebx
je 0x460e2b
push esi
lea ecx, [eax + eax + 2]
push ecx
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
mov eax, dword [edi]
mov edx, dword [eax - 0xc]
add edx, edx
push edx
push eax
push esi
call fcn.0055cb00
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
mov byte [esi + ecx*2], 0
mov edx, dword [edi]
mov eax, dword [edx - 0xc]
add esp, 0xc
push ebx
mov byte [esi + eax*2 + 1], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
pop esi
je 0x460e2b
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, 1
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x461100
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x57c530
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e95e0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 8]
xor edi, edi
cmp eax, edi
je 0x4612fc
lea ecx, [esp + 0x24]
call fcn.00538d38
lea esi, [esp + 0x24]
mov dword [esp + 0x40], edi
call fcn.00460ed0
xor esi, esi
cmp dword [esp + 0x2c], edi
mov dword [esp + 0x14], edi
jle 0x4612eb
mov eax, dword [ebx + 8]
xor edi, edi
test eax, eax
jle 0x4611d9
test edi, edi
jl 0x461210
cmp edi, eax
jge 0x461210
test esi, esi
mov eax, dword [ebx + 4]
mov ecx, dword [eax + edi*4]
lea eax, [eax + edi*4]
jl 0x461210
cmp esi, dword [esp + 0x2c]
jge 0x461210
test ecx, ecx
mov edx, dword [esp + 0x28]
lea ebp, [edx + esi*4]
je 0x4611b9
mov eax, dword [ebp]
cmp dword [eax - 0xc], 0
jl 0x4611b9
push ecx
push eax
call fcn.00552eeb
add esp, 8
test eax, eax
je 0x4611b9
sub eax, dword [ebp]
sar eax, 1
jns 0x4611c5
mov eax, dword [ebx + 8]
add edi, 1
cmp edi, eax
jl 0x461165
jmp 0x4611d9
push 1
push esi
lea ecx, [esp + 0x2c]
call fcn.00538fd9
sub esi, 1
add dword [esp + 0x14], 1
add esi, 1
cmp esi, dword [esp + 0x2c]
jl 0x46115c
cmp dword [esp + 0x14], 0
jle 0x4612eb
call fcn.004614d0
call fcn.00530e1f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x461215
push 0x80004005
call fcn.00401f70
jmp fcn.00530cad
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebp, [eax + 0x10]
mov dword [esp + 0x14], ebp
xor esi, esi
mov byte [esp + 0x40], 1
cmp dword [esp + 0x2c], esi
jle 0x4612ca
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea esp, [esp]
lea eax, [esi + 1]
push eax
lea ecx, [esp + 0x18]
push 0x5a7d60
push ecx
mov dword [esp + 0x2c], eax
call fcn.00405480
add esp, 0xc
test esi, esi
jl 0x461210
cmp esi, dword [esp + 0x2c]
jge 0x461210
mov eax, dword [esp + 0x28]
mov edx, dword [eax + esi*4]
mov edi, dword [edx - 0xc]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0
push 0xf003f
push 0
push 0x592720
push 0
push 0x5a7c58
push SysReAllocStringLen
mov esi, edx
mov dword [esp + 0x3c], 0
call ebx
test eax, eax
mov ebp, dword [esp + 0x14]
jne 0x4612bc
mov eax, dword [esp + 0x1c]
lea edx, [edi + edi + 2]
push edx
push esi
push 1
push 0
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [esp + 0x20]
cmp esi, dword [esp + 0x2c]
jl 0x461240
lea eax, [ebp - 0x10]
mov byte [esp + 0x40], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4612eb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x40], 0xffffffff
call fcn.00538dd6
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x461310
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x57c4f8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebp
push esi
push edi
mov eax, dword [0x5e95e0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x50]
lea ecx, [esp + 0x18]
call fcn.00538d38
lea ecx, [esp + 0x2c]
mov dword [esp + 0x48], 0
call fcn.00538d38
push 1
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x20]
push ecx
mov byte [esp + 0x54], 1
call fcn.004b9320
mov eax, dword [esp + 0x40]
add esp, 0xc
xor esi, esi
test eax, eax
jle 0x4613a6
test esi, esi
mov ecx, dword [ebp]
jl 0x4613c4
cmp esi, eax
jge 0x4613c4
mov edx, dword [esp + 0x30]
mov eax, dword [edx + esi*4]
push ecx
push eax
call fcn.005522fc
add esp, 8
test eax, eax
je 0x461498
mov eax, dword [esp + 0x34]
add esi, 1
cmp esi, eax
jl 0x461377
mov esi, dword [esp + 0x20]
call fcn.00530e1f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4613c9
push 0x80004005
call fcn.00401f70
jmp fcn.00530cad
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
add esi, 1
push esi
lea ecx, [esp + 0x14]
push 0x5a7d60
push ecx
mov byte [esp + 0x54], 2
call fcn.00405480
mov eax, dword [esp + 0x2c]
mov edi, dword [esp + 0x1c]
add esp, 0xc
xor esi, esi
test eax, eax
jle 0x461426
test esi, esi
jl 0x4613c4
cmp esi, eax
jge 0x4613c4
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + esi*4]
push edi
push eax
call fcn.005522fc
mov eax, dword [esp + 0x28]
add esi, 1
add esp, 8
cmp esi, eax
jl 0x461402
mov esi, dword [ebp]
mov ebp, dword [esi - 0xc]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push 0xf003f
push 0
push 0x592720
push 0
push 0x5a7c58
push SysReAllocStringLen
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x461477
lea edx, [ebp + ebp + 2]
push edx
push esi
push 1
push eax
mov eax, dword [esp + 0x24]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [edi - 0x10]
mov byte [esp + 0x48], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x461498
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x48], 0
call fcn.00538dd6
lea ecx, [esp + 0x18]
mov dword [esp + 0x48], 0xffffffff
call fcn.00538dd6
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x3c
ret
Function at 0x4614d0
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x575740
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x5e95e0]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
lea ecx, [esp + 0xc]
call fcn.00538d38
lea ecx, [esp + 0x20]
mov dword [esp + 0x3c], 0
call fcn.00538d38
push 1
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x14]
push ecx
mov byte [esp + 0x48], 1
call fcn.004b9320
mov eax, dword [esp + 0x20]
add esp, 0xc
xor esi, esi
test eax, eax
jle 0x46155f
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
test esi, esi
jl 0x461590
cmp esi, eax
jge 0x461590
mov edx, dword [esp + 0x10]
mov eax, dword [edx + esi*4]
push eax
push 0x5a7c58
push SysReAllocStringLen
call edi
mov eax, dword [esp + 0x14]
add esi, 1
cmp esi, eax
jl 0x461538
lea ecx, [esp + 0x20]
mov byte [esp + 0x3c], 0
call fcn.00538dd6
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0xffffffff
call fcn.00538dd6
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x34
ret
jmp fcn.00530cad

Function at 0x461750
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 0x10]
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x1c]
call fcn.00402160
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x461813
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
push eax
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push ebp
push edx
call edi
test eax, eax
jne 0x4617fd
mov eax, dword [esp + 8]
add eax, 2
push esi
push eax
call fcn.005308fb
add esp, 4
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
mov eax, dword [esp + 0x18]
push esi
lea edx, [esp + 0x18]
push edx
push 0
push ebp
push eax
call edi
test eax, eax
jne 0x4617f3
mov ecx, dword [esp + 0xc]
mov byte [esi + ecx], al
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x28]
push esi
mov byte [esi + edx + 1], al
call fcn.004021d0
push esi
call fcn.005308f6
add esp, 4
pop esi
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop ebp
add esp, 0xc
ret
xor eax, eax
pop ebp
add esp, 0xc
ret
Function at 0x462930
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x230
mov eax, dword [0x5e95e0]
xor eax, esp
mov dword [esp + 0x22c], eax
push esi
push edi
xor edi, edi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x462970
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.00552101
add esp, 0x230
ret
push 0x228
lea eax, [esp + 0x10]
push 0
push eax
call fcn.00557890
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push esi
mov dword [esp + 0x10], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x4629a0
lea edx, [esp + 0x2c]
push edx
push str.360tray.exe
call fcn.005522fc
add esp, 8
test eax, eax
je 0x4629c7
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4629a0
jmp 0x4629cc
mov edi, 1
mov ecx, dword [esp + 0x234]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.00552101
add esp, 0x230
ret

Function at 0x4629f0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x29c
mov eax, dword [0x5e95e0]
xor eax, esp
mov dword [esp + 0x294], eax
lea eax, [esp]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x462a59
push 0xff
lea ecx, [esp + 0x194]
push ecx
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x462a53
lea edx, [esp + 0x190]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x462a53
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
mov ecx, esi
call fcn.004055e0
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x294]
xor ecx, esp
call fcn.00552101
add esp, 0x29c
ret
Function at 0x462f30
Capabilities:
Get common file path

Disassembly:
sub esp, 0x218
mov eax, dword [0x5e95e0]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
lea eax, [esp + 4]
push eax
push 0x591ba8
push 1
push 0
push 0x591bb8
mov dword [esp + 0x18], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp dword [esp + 4], 0
je 0x462fd9
mov ecx, dword [esi]
cmp dword [ecx - 0xc], 0
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
jne 0x462fa0
push 0
push 0x17
lea edx, [esp + 0x10]
push edx
push 0
call ebx
test eax, eax
je 0x462fa0
mov eax, dword [esp + 4]
push eax
push esi
lea ecx, [esp + 0x10]
push edi
push ecx
call fcn.00462a70
add esp, 0x10
mov edx, dword [esi]
cmp dword [edx - 0xc], 0
jne 0x462fcd
push 0
push 2
lea eax, [esp + 0x10]
push eax
push 0
call ebx
test eax, eax
je 0x462fcd
mov ecx, dword [esp + 4]
push ecx
push esi
lea edx, [esp + 0x10]
push edi
push edx
call fcn.00462a70
add esp, 0x10
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, dword [esp + 0x214]
pop ebx
xor ecx, esp
call fcn.00552101
add esp, 0x218
ret

Function at 0x462ff0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x238
mov eax, dword [0x5e95e0]
xor eax, esp
mov dword [esp + 0x234], eax
mov eax, dword [esp + 0x23c]
push ebp
push esi
xor esi, esi
push esi
push 2
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
cmp ebp, 0xffffffff
je 0x463120
push 0x22c
lea ecx, [esp + 0x14]
push esi
push ecx
call fcn.00557890
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push ebp
mov dword [esp + 0x18], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4630fe
push edi
lea esp, [esp]
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
test eax, eax
jbe 0x463074
cmp dword [esp + 0x1c], eax
je 0x4630f5
test ebx, ebx
je 0x4630b9
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
jl 0x4630b9
lea ecx, [esp + 0x38]
push ecx
push eax
call fcn.00552eeb
add esp, 8
test eax, eax
je 0x4630b9
mov edx, dword [ebx]
sub eax, edx
sar eax, 1
mov esi, eax
js 0x4630b9
lea eax, [esp + 0x38]
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4630a3
sub eax, edi
sar eax, 1
add eax, esi
cmp eax, dword [edx - 0xc]
je 0x4630eb
lea edx, [esp + 0x14]
push edx
push ebp
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x463060
pop edi
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 8]
pop esi
pop ebp
mov ecx, dword [esp + 0x234]
xor ecx, esp
call fcn.00552101
add esp, 0x238
ret
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
mov dword [esp + 0xc], 1
pop edi
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 8]
pop esi
pop ebp
mov ecx, dword [esp + 0x234]
xor ecx, esp
call fcn.00552101
add esp, 0x238
ret
mov ecx, dword [esp + 0x23c]
mov eax, esi
pop esi
pop ebp
xor ecx, esp
call fcn.00552101
add esp, 0x238
ret
Function at 0x4632e0
Capabilities:
Encode data using base64
Terminate process

Disassembly:
sub esp, 0x54
mov eax, dword [0x5e95e0]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push ebp
mov ebp, dword [esp + 0x64]
push esi
push edi
mov ecx, 0x10
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x68]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x463310
sub eax, edx
mov ebx, eax
mov eax, esi
mov dword [esp + 0x18], ebx
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x463326
sub eax, edx
jne 0x46333a
push 0xffffffffffffffff
call fcn.00554548
mov eax, 0x55555556
imul ebx
mov edi, edx
shr edi, 0x1f
add edi, edx
xor ecx, ecx
test edi, edi
jle 0x4633ca
add esi, 2
mov dword [esp + 0x14], edi
movzx ebx, byte [esi]
mov al, byte [esi - 2]
mov dl, byte [esi - 1]
mov byte [esp + 0x13], bl
movzx ebx, al
shr ebx, 2
movzx ebx, byte [esp + ebx + 0x1c]
mov byte [ecx + ebp], bl
shl al, 4
movzx ebx, dl
shr ebx, 4
add ecx, 1
add dl, dl
or eax, ebx
and eax, 0x3f
movzx eax, byte [esp + eax + 0x1c]
mov byte [ecx + ebp], al
movzx eax, byte [esp + 0x13]
add dl, dl
mov ebx, eax
shr ebx, 6
add ecx, 1
and eax, 0x3f
movzx eax, byte [esp + eax + 0x1c]
or edx, ebx
and edx, 0x3f
movzx edx, byte [esp + edx + 0x1c]
mov byte [ecx + ebp], dl
add ecx, 1
mov byte [ecx + ebp], al
add ecx, 1
add esi, 3
sub dword [esp + 0x14], 1
jne 0x463355
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x68]
lea eax, [edi + edi*2]
mov edx, ebx
sub edx, eax
je 0x463449
lea eax, [esi + edi*2]
add edi, eax
cmp edx, 1
mov al, byte [edi]
jne 0x463407
movzx eax, al
mov edx, eax
shr edx, 2
mov dl, byte [esp + edx + 0x1c]
and eax, 3
mov byte [ecx + ebp], dl
shl eax, 4
mov al, byte [esp + eax + 0x1c]
add ecx, 1
mov byte [ecx + ebp], al
add ecx, 1
mov byte [ecx + ebp], 0x3d
jmp 0x46343f
mov dl, byte [edi + 1]
movzx esi, al
shl al, 4
shr esi, 2
mov bl, byte [esp + esi + 0x1c]
movzx edx, dl
mov esi, edx
shr esi, 4
or eax, esi
mov byte [ecx + ebp], bl
and eax, 0x3f
mov al, byte [esp + eax + 0x1c]
add ecx, 1
mov byte [ecx + ebp], al
add ecx, 1
and edx, 0xf
movzx edx, byte [esp + edx*4 + 0x1c]
mov byte [ecx + ebp], dl
add ecx, 1
mov byte [ecx + ebp], 0x3d
add ecx, 1
pop edi
mov byte [ecx + ebp], 0
mov ecx, dword [esp + 0x5c]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00552101
add esp, 0x54
ret

Function at 0x466270
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x5ed560], 0x61
mov eax, 0x5ed560
je 0x46628b
mov edi, edi
xor byte [eax], 0x61
add eax, 1
cmp byte [eax], 0x61
jne 0x466280
mov byte [eax], 0
ret
Function at 0x467a70
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x5e95e0]
xor eax, esp
mov dword [esp + 0x208], eax
push 0
push 5
lea eax, [esp + 8]
push eax
push 0
mov word [esp + 0x10], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x467ac2
lea eax, [esp]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x467aa6
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.00402250
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00552101
add esp, 0x20c
ret

Function at 0x468310
Capabilities:
Hash data using djb2

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, eax
mov al, byte [edi]
xor ebp, ebp
xor edx, edx
test al, al
mov ecx, 0x1505
mov esi, edi
je 0x468348
mov bl, al
lea ebx, [ebx]
mov ebp, ecx
shl ebp, 5
add ebp, ecx
movsx ecx, bl
mov bl, byte [esi + 1]
add esi, 1
add ecx, ebp
test bl, bl
jne 0x468330
mov ebp, edx
test al, al
mov esi, edi
je 0x468364
mov edi, edi
imul edx, edx, 0x1003f
movsx eax, al
add esi, 1
add edx, eax
mov al, byte [esi]
test al, al
jne 0x468350
shr ecx, 2
mov eax, ecx
and ecx, 0x3f
shr eax, 4
and eax, 0x3ffffc0
or eax, ecx
mov ecx, eax
shr ecx, 4
and ecx, 0x3ffc00
and eax, 0x3ff
or ecx, eax
mov eax, ecx
and ecx, 0x3fff
shr eax, 4
and eax, 0x3c000
or eax, ecx
mov ecx, eax
and ecx, 0xffffc000
shl ecx, 4
mov esi, eax
and esi, 0x3c00
or ecx, esi
shl ecx, 4
mov esi, eax
and esi, 0x3c0
or ecx, esi
shl ecx, 4
and eax, 0x3c
or ecx, eax
add ecx, ecx
add ecx, ecx
and edx, 0xf0f0f0f
or ecx, edx
xor ebx, ebx
mov edi, ecx
mov eax, 0xcccccccd
mul edi
shr edx, 3
lea eax, [edx + edx*4]
mov esi, edi
add eax, eax
mov edi, edx
mov edx, ebp
sub esi, eax
and edx, 0x80000001
jns 0x4683f8
dec edx
or edx, 0xfffffffe
inc edx
cmp edx, 1
jne 0x46841e
add esi, esi
mov eax, 0x66666667
imul esi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, eax
neg edx
add edx, edx
add edx, edx
add edx, edx
sub edx, eax
add esi, edx
add ebx, esi
add ebp, 1
test edi, edi
jne 0x4683d4
mov eax, 0x99999999
imul ebx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*4]
lea eax, [ebx + eax*2]
test eax, eax
je 0x468476
mov edx, 0xa
sub edx, eax
and ebp, 0x80000001
mov eax, edx
jns 0x468458
dec ebp
or ebp, 0xfffffffe
inc ebp
cmp ebp, 1
jne 0x468476
mov edx, eax
and edx, 0x80000001
jns 0x46846c
dec edx
or edx, 0xfffffffe
inc edx
cmp edx, 1
jne 0x468474
add eax, 9
sar eax, 1
push ecx
add eax, 0x30
push eax
mov eax, dword [esp + 0x20]
push str.7_c_u
push eax
call fcn.00405480
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret