joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3e83700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.03e8378f
jae 0x3e8370e
xor ecx, ecx
call fcn.03e8378f
jae 0x3e8373d
xor eax, eax
call fcn.03e8378f
jae 0x3e8374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.03e8378f
adc al, al
jae 0x3e8372f
jne 0x3e83779
stosb byte es:[edi], al
jmp 0x3e83711
call fcn.03e8379b
sub ecx, ebx
jne 0x3e83756
call fcn.03e83799
jmp 0x3e83775
lodsb al, byte [esi]
shr eax, 1
je 0x3e83783
adc ecx, ecx
jmp 0x3e83772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.03e83799
cmp eax, 0x7d00
jae 0x3e83772
cmp ah, 5
jae 0x3e83773
cmp eax, 0x7f
ja 0x3e83774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x3e83711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x5773700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0577378f
jae 0x577370e
xor ecx, ecx
call fcn.0577378f
jae 0x577373d
xor eax, eax
call fcn.0577378f
jae 0x577374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0577378f
adc al, al
jae 0x577372f
jne 0x5773779
stosb byte es:[edi], al
jmp 0x5773711
call fcn.0577379b
sub ecx, ebx
jne 0x5773756
call fcn.05773799
jmp 0x5773775
lodsb al, byte [esi]
shr eax, 1
je 0x5773783
adc ecx, ecx
jmp 0x5773772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.05773799
cmp eax, 0x7d00
jae 0x5773772
cmp ah, 5
jae 0x5773773
cmp eax, 0x7f
ja 0x5773774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5773711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8

Function at 0x578ea1c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
push esi
push edi
xor ecx, ecx
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x100]
lodsb al, byte [esi]
or al, al
je 0x578ea45
inc ecx
test cl, 3
je 0x578ea42
shl eax, 8
jmp 0x578ea32
stosd dword es:[edi], eax
jmp 0x578ea32
mov al, 0x80
push ecx
inc ecx
test cl, 3
je 0x578ea53
shl eax, 8
jmp 0x578ea48
stosd dword es:[edi], eax
xor eax, eax
jmp 0x578ea5c
stosd dword es:[edi], eax
add ecx, 4
cmp ecx, 0x3c
jb 0x578ea58
pop eax
shl eax, 3
stosd dword es:[edi], eax
sub ecx, 0xc
mov eax, dword [edi - 0x3c]
push ecx
mov ecx, eax
mov edx, eax
ror eax, 7
ror ecx, 0x12
shr edx, 3
xor eax, ecx
xor eax, edx
push eax
mov eax, dword [edi - 8]
mov ecx, eax
mov edx, eax
ror eax, 0x11
ror ecx, 0x13
shr edx, 0xa
xor eax, ecx
xor eax, edx
add dword [esp], eax
pop eax
add eax, dword [edi - 0x40]
pop ecx
add eax, dword [edi - 0x1c]
stosd dword es:[edi], eax
loop 0x578ea69
call int.0578eac6
out 9, al
push 0xffffffffffffff85
scasb al, byte es:[edi]
mov ebx, 0x3c6ef372
cmp dh, ch
dec edi
movsd dword es:[edi], dword [esi]
jg 0x578eb0a
push cs
push ecx
mov word [eax + 5], gs
wait
stosd dword es:[edi], eax
fld dword [ebx - 0x1f32e6e1]
pop ebx
invalid
Function at 0x401120
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f188
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x44db90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x10], eax
xor eax, eax
mov dword [esi + 0x14], edx
mov edx, dword [ebp + 0xc]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0xc], ecx
mov dword [esi + 8], edx
mov dword [esi + 4], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [ebp - 4], eax
push ecx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x60], ecx
push eax
mov ecx, esi
mov dword [esi], vtable.TrButton.0
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x28], 1
mov dword [esi + 0x20], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x64], eax
call fcn.004011d0
mov eax, dword [esi + 0x40]
mov dword [esi + 0x3c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x404090
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43ef5b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x44db90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.00414322
push 4
mov dword [ebp - 4], 0
call fcn.00428a5c
mov edi, eax
add esp, 4
test edi, edi
je 0x40410c
call fcn.004145d5
mov dword [edi], eax
call fcn.0041448f
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.004143c4
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x404102
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.004143ec
jmp 0x40410e
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x407550
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push esi
mov ecx, 0x44f3ec
call fcn.00413fd7
mov ebx, eax
mov dword [ebp - 4], 1
test ebx, ebx
je 0x407604
test esi, esi
jne 0x407604
mov eax, dword [ebp + 8]
shr eax, 4
inc eax
push esi
movzx ecx, ax
push ecx
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov edi, eax
test edi, edi
je 0x4075e8
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4075e2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4075e2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
add eax, esi
and ecx, 0xf
jbe 0x4075d1
cmp esi, eax
jae 0x4075d5
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4075c3
cmp esi, eax
jb 0x4075d9
xor eax, eax
jmp 0x4075e2
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
mov esi, eax
test eax, eax
jne 0x40760d
mov edi, dword [ebp - 4]
push edi
mov ecx, 0x44f3ec
call fcn.00413fd7
mov ebx, eax
inc edi
mov dword [ebp - 4], edi
test ebx, ebx
jne 0x407575
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4076f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x407708
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40773a
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x407736
cmp esi, eax
jae 0x40773a
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x407728
cmp esi, eax
jb 0x407740
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x408ce0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 8
push esi
push edi
push 0
mov dword [eax], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [ebp + 0xc]
movzx edx, word [ebp + 8]
push ecx
mov esi, eax
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x408d17
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
jne 0x408d3a
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
push esi
push eax
call fcn.0042af30
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ebx, dword [ebp - 4]
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov esi, eax
test esi, esi
je 0x408d98
lea ecx, [ebp + 8]
push ecx
push ebx
mov dword [esi], vtable.Gdiplus::Bitmap.0
mov dword [ebp + 8], 0
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromStream]
mov edx, dword [ebp + 8]
mov dword [esi + 8], eax
mov dword [esi + 4], edx
jmp 0x408d9a
xor esi, esi
mov eax, dword [ebp + 0x10]
push edi
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408dd0
Capabilities:
Extract resource via kernel32 functions
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43fdc8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x44db90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x446908
mov esi, eax
push 0xa7
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x408f1e
push 0xa7
lea edi, [ebp - 0x1c]
call fcn.004026a0
add esp, 4
lea ecx, [ebp - 0x18]
push 0x445db4
push ecx
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00401df0
push eax
lea edx, [ebp - 0x14]
push edx
mov ebx, 0x445da4
mov byte [ebp - 4], 1
call fcn.00409580
push eax
lea eax, [ebp - 0x10]
push eax
mov ebx, 0x446908
mov byte [ebp - 4], 2
call fcn.00409580
mov eax, dword [eax]
add esp, 0x18
push 0
push 0x445d9c
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408e9e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408ec1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408ee4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408f0a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push esi
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push esi
push 0
push 4
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push 0
push 0
push 0
mov ebx, eax
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, dword [ebp - 0x1c]
push esi
push edx
push eax
mov dword [ebp - 0x18], eax
call fcn.0042af30
mov eax, dword [ebp - 0x18]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
push edi
call esi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409990
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f1c5
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x44db90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
xor edi, edi
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x14], ecx
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0xc], edx
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov dword [esi + 0x34], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [ebp - 4], edi
mov dword [esi], vtable.TrImage.0
push 0x18
mov dword [esi + 0x48], edi
call fcn.00428a5c
add esp, 4
cmp eax, edi
je 0x409a3b
mov dword [esi + 0x44], eax
mov dword [eax], eax
mov eax, dword [esi + 0x44]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x44]
mov dword [eax + 8], eax
mov ecx, dword [esi + 0x44]
mov byte [ecx + 0x14], 1
mov edx, dword [esi + 0x44]
mov byte [edx + 0x15], 1
mov dword [esi + 0x28], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ebp + 0x10]
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp + 0x10], edi
call fcn.00428bb5
push 0x449f58
lea ecx, [ebp - 0x18]
push ecx
mov dword [ebp - 0x18], vtable.std::bad_alloc.0
call fcn.0042ae28
int3
Function at 0x4109d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440478
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x44db90]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 9
xor ebx, ebx
push str.iTeleport
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.00407a40
lea edx, [ebp - 0x2c]
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.0040d750
mov esi, eax
cmp dword [esi + 0x10], ebx
je 0x410a48
cmp dword [ebp - 0x18], 0x10
jb 0x410a3e
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00428a42
add esp, 4
mov eax, 1
jmp 0x410b96
mov eax, 1
mov dword [esi], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], 2
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x34]
cmp eax, ebx
jne 0x410a70
xor eax, eax
jmp 0x410a87
mov ecx, dword [eax + 0x1c]
push 0x40
push 0x1000
push 0x1000
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0x2f
push str.F3_0F_10_86_9C_00_00_00_F3_0F_10_8E_50_02_00_00
lea ecx, [esi + 0x2c]
mov dword [esi + 4], eax
call fcn.00407a40
push 0x17
push str.F3_0F_10_86_9C_00_00_00
lea ecx, [esi + 0x48]
call fcn.00407a40
mov edx, dword [esi + 4]
push 0x26
add edx, 0x100
push str.89_35_00symbol_F3_0F_10_86_9C_00_00_00
lea ecx, [esi + 0x64]
mov dword [edi + 0x58], edx
call fcn.00407a40
mov eax, dword [edi + 0x58]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x30], esp
push 8
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push str.00symbol
mov byte [ecx], bl
call fcn.00407a40
lea ecx, [esi + 0x64]
call fcn.00401c20
push ebx
push ebx
push ebx
push 1
mov esi, 1
push esi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x30], esp
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x2c]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push edx
mov byte [ecx], bl
call fcn.00407ee0
mov edx, esi
mov ecx, edi
call fcn.0040bd70
cmp eax, ebx
je 0x410b7f
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [edi + 0x58]
cmp eax, 0x10000
jbe 0x410b69
mov edx, dword [edi + 0x34]
push ebx
push 4
lea ecx, [ebp - 0x30]
push ecx
push eax
mov dword [ebp - 0x30], eax
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x30]
add eax, dword [0x44f3b0]
lea ecx, [eax + 4]
mov dword [edi + 0x5c], eax
add eax, 8
mov dword [edi + 0x60], ecx
mov dword [edi + 0x64], eax
cmp dword [ebp - 0x18], 0x10
jb 0x410b7b
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00428a42
add esp, 4
mov eax, esi
jmp 0x410b96
cmp dword [ebp - 0x18], 0x10
mov dword [edi + 0x58], ebx
jb 0x410b94
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00428a42
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00428a4d
mov esp, ebp
pop ebp
ret
Function at 0x411640
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f773
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x44db90]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], ebx
jne 0x4116a5
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41169e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x4117fc
push 0x228
lea ecx, [ebp - 0x238]
push ebx
push ecx
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x23c], 0x22c
call fcn.0042ad40
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
add esp, 0xc
mov ecx, section..data
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0x244], edi
push ebx
push 2
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x411724
lea eax, [edi - 0x10]
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411715
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
jmp 0x411682
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], ebx
jl 0x411748
push 0x445ee4
push eax
call fcn.00429407
add esp, 8
cmp eax, ebx
je 0x411748
sub eax, dword [ebp + 8]
sar eax, 1
cmp eax, 0xffffffff
jne 0x411759
push 4
push 0x446598
lea ebx, [ebp + 8]
call fcn.00409850
xor ebx, ebx
lea ecx, [ebp - 0x23c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4117aa
jmp 0x411770
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x218]
push eax
call fcn.00429c85
add esp, 8
test eax, eax
jne 0x411798
mov ecx, dword [ebp - 0x234]
mov dword [ebp - 0x240], ecx
cmp dword [ebp + 0xc], ebx
je 0x4117aa
lea edx, [ebp - 0x23c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x411770
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [edi - 0x10]
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4117d0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4117f6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00428a4d
mov esp, ebp
pop ebp
ret
Function at 0x411820
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43ff0e
mov eax, dword fs:[0]
push eax
sub esp, 0x444
mov eax, dword [0x44db90]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0x450], ebx
mov dword [ebp - 4], ebx
mov eax, dword [section..data]
mov edx, dword [eax + 0xc]
mov ecx, section..data
call edx
add eax, 0x10
mov dword [ebp - 0x440], eax
mov byte [ebp - 4], 1
push 0x444b60
lea eax, [ebp - 0x440]
push eax
mov dword [ebp - 0x44c], ebx
mov dword [ebp - 0x448], ebx
mov dword [ebp - 0x444], ebx
call fcn.00407380
mov byte [ebp - 4], 2
test edi, edi
jne 0x4118f6
mov eax, dword [ebp - 0x444]
mov edi, dword [ebp - 0x440]
mov ecx, dword [ebp - 0x44c]
mov edx, dword [ebp - 0x448]
mov dword [esi + 8], eax
add edi, 0xfffffff0
mov eax, edi
mov dword [esi], ecx
mov dword [esi + 4], edx
call fcn.00402210
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], bl
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4119d3
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
jmp 0x4119d3
push edi
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [ebp - 0x43c]
mov ebx, eax
push ecx
push ebx
mov dword [ebp - 0x43c], 0x428
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x41197f
mov edi, dword [sym.imp.KERNEL32.dll_Module32NextW]
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x41c]
push edx
push eax
call fcn.00429c85
add esp, 8
test eax, eax
je 0x41194a
lea ecx, [ebp - 0x43c]
push ecx
push ebx
call edi
test eax, eax
jne 0x411923
jmp 0x41197f
mov edx, dword [ebp - 0x428]
mov eax, dword [ebp - 0x424]
mov ecx, dword [ebp - 0x420]
mov dword [ebp - 0x44c], edx
lea edx, [ebp - 0x21c]
lea edi, [ebp - 0x440]
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x444], ecx
call fcn.00407430
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x448]
mov edi, dword [ebp - 0x440]
mov edx, dword [ebp - 0x44c]
mov ecx, dword [ebp - 0x444]
mov dword [esi + 4], eax
add edi, 0xfffffff0
mov eax, edi
mov dword [esi], edx
mov dword [esi + 8], ecx
call fcn.00402210
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 0
lea edx, [edi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x4119d3
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4119f9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00428a4d
mov esp, ebp
pop ebp
ret