joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b710
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
mov dword [esp + 0xc], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00418990
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
lea esi, [esi]

Function at 0x40b770
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov eax, dword [0x472a80]
test eax, eax
jle 0x40b880
mov edx, dword [0x472a84]
xor ebx, ebx
mov ecx, dword [edx + 0xc]
cmp ecx, esi
ja 0x40b7a1
mov edi, dword [edx + 0x10]
add ecx, dword [edi + 8]
cmp esi, ecx
jb 0x40b81a
add ebx, 1
add edx, 0x14
cmp ebx, eax
jne 0x40b790
mov dword [esp], esi
call fcn.00418af0
test eax, eax
mov edi, eax
je 0x40b8a7
lea esi, [ebx + ebx*4]
mov ebx, dword [0x472a84]
shl esi, 2
add ebx, esi
mov dword [ebx + 0x10], eax
mov dword [ebx], 0
call fcn.00418be0
add eax, dword [edi + 0xc]
mov dword [ebx + 0xc], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [0x472a84]
mov dword [esp + 8], 0x1c
mov eax, dword [eax + esi + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40b887
mov eax, dword [ebp - 0x20]
cmp eax, 0x40
jne 0x40b822
add dword [0x472a80], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 4
je 0x40b813
cmp eax, 0x80
je 0x40b813
cmp eax, 8
je 0x40b813
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x28]
add esi, dword [0x472a84]
mov dword [esi + 4], eax
mov dword [esi + 8], edx
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x40b813
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0040b710
nop
lea esi, [esi]
xor ebx, ebx
jmp 0x40b7ab
mov eax, dword [0x472a84]
mov eax, dword [eax + esi + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0040b710
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0040b710
mov esi, esi
lea edi, [edi]

Function at 0x40c8b0
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x10], 1
mov dword [esp + 8], ebx
pop ebx
jmp fcn.0040c280
Function at 0x40d9e0
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [0x452d24]
cmp dword [ebx + 0x628], 0
jle 0x40dbb2
xor ebp, ebp
jmp 0x40da1b
push edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
inc ebp
cmp ebp, dword [ebx + 0x628]
jge 0x40dbb2
test ebp, ebp
jne 0x40da0e
lea eax, [ebp*4]
add eax, ebp
shl eax, 4
mov edi, dword [ebx + eax + 0x3ac]
push 0x1000
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
je 0x40daf0
mov esi, eax
mov dword [esp], edi
push 0x1000
push 1
call sub.api_ms_win_crt_heap_l1_1_0.dll_calloc
add esp, 8
test eax, eax
je 0x40db26
mov edi, eax
push 0
push 0
push 0
push dword [esp + 0xc]
call fcn.0040cc90
add esp, 0x10
test edx, edx
js 0x40d9fc
push 0x1000
push esi
push dword [esp + 8]
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
add esp, 0xc
cmp eax, 0x1000
jne 0x40d9fc
mov ebx, 0x1000
nop dword [eax]
push 0x1000
push edi
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x40dad3
dec ebx
je 0x40db5c
push 0x1000
push esi
push dword [esp + 8]
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
add esp, 0xc
cmp eax, 0x1000
je 0x40daa0
push edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov ebx, dword [0x452d24]
jmp 0x40da0e
cmp dword [ebx + 0x638], 0
jle 0x40da0e
cmp dword [ebx + 0x684], 0
jne 0x40da0e
cmp dword [ebx + 0x688], 0
jne 0x40da0e
push str._tError:_Malloc_Failed_for_buf___
call sub.api_ms_win_crt_stdio_l1_1_0.dll_puts
jmp 0x40da0b
cmp dword [ebx + 0x638], 0
jle 0x40da05
cmp dword [ebx + 0x684], 0
jne 0x40da05
cmp dword [ebx + 0x688], 0
jne 0x40da05
push str._tError:_Calloc_Failed_for_zero_buf___
call sub.api_ms_win_crt_stdio_l1_1_0.dll_puts
jmp 0x40da02
push edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov ebx, dword [0x452d24]
cmp dword [ebx + 0x638], 0
js 0x40da0e
cmp dword [ebx + 0x684], 0
jne 0x40da0e
cmp dword [ebx + 0x688], 0
jne 0x40da0e
push 0x1000
push str.Info:_Found_all_zeros_in_first__d_blocks_n
call fcn.0040dbd0
add esp, 8
jmp 0x40da0e
mov dword [ebx + 0x644], 1
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40e3d0
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x40e40d
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
xor ebp, ebp
nop word cs:[eax + eax]
mov eax, esi
sub eax, ebp
push eax
push edi
push ebx
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
add esp, 0xc
test eax, eax
js 0x40e411
je 0x40e41f
add edi, eax
add ebp, eax
cmp ebp, esi
jb 0x40e3f0
xor eax, eax
jmp 0x40e424
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, eax
xor eax, eax
sub eax, dword [ecx]
jmp 0x40e424
mov eax, 0xffffffea
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40f190
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
not eax
test ebx, ebx
je 0x40f20e
mov ecx, dword [esp + 0x14]
test bl, 1
jne 0x40f1b3
mov edx, ebx
cmp ebx, 1
jne 0x40f1d2
jmp 0x40f20e
lea edx, [ebx - 1]
mov edi, ebx
movzx ebx, byte [ecx]
xor bl, al
inc ecx
movzx esi, bl
mov ebx, edi
shr eax, 8
xor eax, dword [esi*4 + 0x464aa4]
cmp ebx, 1
je 0x40f20e
xor esi, esi
nop word cs:[eax + eax]
movzx ebx, byte [ecx + esi]
xor bl, al
movzx edi, bl
shr eax, 8
xor eax, dword [edi*4 + 0x464aa4]
movzx ebx, byte [ecx + esi + 1]
xor bl, al
movzx edi, bl
shr eax, 8
xor eax, dword [edi*4 + 0x464aa4]
add esi, 2
cmp edx, esi
jne 0x40f1e0
not eax
pop esi
pop edi
pop ebx
ret

Function at 0x418a10
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x418a48
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x418a3e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x418a4a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x418a30
xor eax, eax
pop ebx
pop esi
ret
Function at 0x41afe0
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
movzx eax, byte [0x472ae0]
test al, al
je 0x41b0e2
push dword [0x472adc]
push dword [0x472ad8]
push esi
push edi
call fcn.0040bc70
add esp, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x1c]
and eax, 2
add eax, 2
push 0
push 0
push 0
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
je 0x41b08e
mov ebx, eax
mov edx, dword [esp + 0xc]
sub edi, edx
sbb esi, 0
mov eax, dword [ebp + 0x1c]
test al, 2
mov eax, 4
mov ecx, 0xf001f
cmove ecx, eax
mov eax, dword [ebp + 0x18]
add eax, edx
push eax
push edi
push esi
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x41b0cc
mov edi, eax
push 0x10
call fcn.0040f250
add esp, 4
mov esi, eax
mov dword [eax], edi
mov eax, dword [ebp + 0x18]
mov dword [esi + 4], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ebx
jmp 0x41b0d5
xor esi, esi
cmp dword [ebp + 0x18], 0
jne 0x41b0d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3ee
jne 0x41b0d5
push 0x10
call fcn.0040f250
add esp, 4
mov esi, eax
mov dword [eax], 0x465c28
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
jmp 0x41b0d5
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x472ae0
call fcn.004227f0
add esp, 4
test eax, eax
je 0x41b004
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0x30], 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x2c]
mov dword [0x472ad8], eax
mov dword [0x472adc], 0
push 0x472ae0
call fcn.00422960
add esp, 4
jmp 0x41b004
Function at 0x428193
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
add esp, 0xffffff80
cmp dword [ebp + 8], 0
jne 0x4281a6
jmp 0x4282da
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004489d8
cmp eax, 1
jne 0x4282d2
mov dword [ebp - 0x77], 0x6f727245
mov dword [ebp - 0x73], 0x6c632072
mov dword [ebp - 0x6f], 0x696e6165
mov dword [ebp - 0x6b], 0x7520676e
mov dword [ebp - 0x67], 0x70732070
mov dword [ebp - 0x63], 0x6b5f6e69
mov dword [ebp - 0x5f], 0x20737965
mov dword [ebp - 0x5b], 0x20726f66
mov dword [ebp - 0x57], 0x65726874
mov dword [ebp - 0x53], 0x206461
lea edx, [ebp - 0x4f]
mov ebx, 0x43
mov eax, 0
mov ecx, edx
and ecx, 1
test ecx, ecx
je 0x42821e
mov byte [edx], al
add edx, 1
sub ebx, 1
mov ecx, edx
and ecx, 2
test ecx, ecx
je 0x428230
mov word [edx], ax
add edx, 2
sub ebx, 2
mov ecx, ebx
shr ecx, 2
mov edi, edx
rep stosd dword es:[edi], eax
mov edx, edi
mov ecx, ebx
and ecx, 2
test ecx, ecx
je 0x42824a
mov word [edx], ax
add edx, 2
and ebx, 1
mov ecx, ebx
test ecx, ecx
je 0x428258
mov byte [edx], al
add edx, 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov dword [esp + 8], 0xa
lea edx, [ebp - 0x77]
add edx, 0x27
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
call eax
mov dword [ebp - 0xc], 0x27
jmp 0x428288
add dword [ebp - 0xc], 1
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
test al, al
je 0x42829f
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
jbe 0x428284
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
ja 0x4282bd
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
mov byte [eax], 0xa
mov eax, dword [ebp - 0xc]
add eax, 1
mov byte [ebp + eax - 0x77], 0
lea eax, [ebp - 0x77]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call eax
sub esp, 4
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x429266
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [esp + 4], 0x4290db
mov dword [esp], 0x472d34
call fcn.0042882d
mov eax, dword [0x471270]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4292ad
mov eax, dword [ebp - 0x20]
jmp 0x4293f8
call fcn.0042809c
mov dword [ebp - 0x20], eax
mov eax, dword [entry3]
test eax, eax
je 0x4292c4
cmp dword [ebp - 0x20], 0
jne 0x4292ce
mov eax, 0
jmp 0x4293f8
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x24], 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x1c], 0xffffffff
mov eax, dword [ebp - 0x20]
lea edx, [eax + 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00428193
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x64], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x20]
lea edi, [eax + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
jne 0x4293a0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x68], 0
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + 0x20]
and edx, 0xffffffcf
or edx, 0x10
mov byte [eax + 0x20], dl
mov eax, dword [0x471270]
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
test eax, eax
jne 0x4293f5
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4294bc
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
call fcn.00429266
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xb4]
mov dword [esp], eax
call fcn.004290fe
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x20]
and eax, 0x30
test al, al
jne 0x429515
mov eax, dword [ebp - 0x14]
add eax, 0x70
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_longjmp
mov eax, dword [0x471270]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x42963f
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x4295a7
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x429564
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00427fb0
mov dword [ebp - 0x10], 0
mov eax, dword [0x471270]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
jmp 0x42963f
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x68], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4295d7
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 4
test eax, eax
je 0x42963f
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00427fb0
mov dword [ebp - 0x10], 0
mov eax, dword [0x471270]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__endthreadex]
call eax
Function at 0x448bc8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], 0x4712a0
call fcn.004489e2
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax]
cmp eax, 0xbab1f0ed
jne 0x448bf4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
test eax, eax
jg 0x448c36
mov dword [esp], 2
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
call eax
mov dword [esp + 0x10], 0x28
mov dword [esp + 0xc], str._buildbot_src_android_mingw_toolchain_mingw_mingw_w64_v6.x_mingw_w64_libraries_winpthreads_src_rwlock.c
mov dword [esp + 8], str.___rwlock_t__rwl___valid__LIFE_RWLOCK______rwlock_t__rwl___busy___0_
mov dword [esp + 4], str.Assertion_failed:___s___file__s__line__d_n
mov dword [esp], eax
call fcn.00418900
mov dword [esp], 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, dword [eax + 4]
sub edx, 1
mov dword [eax + 4], edx
mov dword [esp], 0x4712a0
call fcn.00448a40
mov eax, dword [ebp + 0xc]
leave
ret
Function at 0x401007
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax]
mov eax, dword [eax + 4]
xor esi, esi
cmp dword [0x2afdb04], 0x594
mov dword [ebp - 8], eax
jne 0x40103b
push esi
lea eax, [ebp - 0x438]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x425078]
mov ebx, dword [0x42507c]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], esi
call fcn.00401000
mov eax, dword [0x425080]
add dword [ebp - 0x18], 0x23f
mov dword [ebp - 0x2c], eax
mov eax, dword [0x425084]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, edi
shl eax, 4
cmp dword [0x2afdb04], 0xc
mov dword [ebp - 4], eax
jne 0x4010b3
push esi
lea eax, [ebp - 0x438]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
push esi
lea eax, [ebp - 0x34]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_PurgeComm]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [0x2afdb04]
cmp eax, 0xfa9
jne 0x4010cf
mov dword [0x2afdb00], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010ee
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov dword [0x2afd4b4], esi
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov edx, edi
add eax, edi
shr edx, cl
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov dword [0x2afdafc], 0xf4ea3dee
add edx, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
xor edx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
mov eax, dword [ebp - 8]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
nop
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
shr edx, cl
add edx, ebx
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor dword [ebp - 4], edx
sub edi, dword [ebp - 4]
add dword [ebp - 0x18], 0x61c88647
dec dword [ebp - 0x24]
jne 0x401072
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov dword [eax], edi
pop edi
pop esi
mov dword [eax + 4], ecx
pop ebx
leave
ret 4
Function at 0x404b0a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424b24]
jne 0x404b14
repz ret
jmp fcn.004077c2

Function at 0x4071f0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402ce9
and dword [ebp - 4], 0
cmp dword [0x4293bc], 0
mov ebx, eax
jne 0x4072a1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407352
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407352
push eax
call fcn.00402c77
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4293bc], eax
call esi
push eax
call fcn.00402c77
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4293c0], eax
call esi
push eax
call fcn.00402c77
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4293c4], eax
call esi
push eax
call fcn.00402c77
pop ecx
mov dword [0x4293cc], eax
test eax, eax
je 0x4072a1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402c77
pop ecx
mov dword [0x4293c8], eax
mov eax, dword [0x4293c8]
cmp eax, ebx
je 0x4072f9
cmp dword [0x4293cc], ebx
je 0x4072f9
push eax
call fcn.00402cf2
push dword [0x4293cc]
mov esi, eax
call fcn.00402cf2
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4072f9
test edi, edi
je 0x4072f9
call esi
test eax, eax
je 0x4072f0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4072f0
test byte [ebp - 0xc], 1
jne 0x4072f9
or dword [ebp + 0x10], 0x200000
jmp 0x407332
mov eax, dword [0x4293c0]
cmp eax, ebx
je 0x407332
push eax
call fcn.00402cf2
pop ecx
test eax, eax
je 0x407332
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407332
mov eax, dword [0x4293c4]
cmp eax, ebx
je 0x407332
push eax
call fcn.00402cf2
pop ecx
test eax, eax
je 0x407332
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4293bc]
call fcn.00402cf2
pop ecx
test eax, eax
je 0x407352
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407354
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4012f0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x407008]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0xc], ecx
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x401387
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.hSnap_is_valid__looping_through_processes.._n
call fcn.00402730
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x128
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x401387
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
push dword [esp + 0xc]
lea eax, [esp + 0x38]
push eax
call ebx
add esp, 8
test eax, eax
jne 0x401377
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Found_proccess__n
call fcn.00402730
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x401351
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x13c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00402e0a
mov esp, ebp
pop ebp
ret