joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4283c4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x28c
mov ebp, dword [esp + 0x2b0]
mov eax, dword [esp + 0x2a8]
mov eax, dword [eax + 0x2c]
test eax, eax
je 0x428756
mov edx, dword [esp + 0x2a4]
mov eax, dword [edx]
lea edx, [eax - 7]
cmp edx, 1
jbe 0x428ded
lea edx, [eax - 9]
cmp edx, 1
jbe 0x428e0a
mov edx, dword [esp + 0x2a8]
mov edx, dword [edx + 4]
mov dword [esp + 0x48], edx
mov ecx, dword [esp + 0x2a8]
mov edx, dword [ecx + 0x28]
mov edx, dword [edx + 0x4c]
mov dword [esp + 0x58], edx
cmp eax, 6
je 0x428761
cmp eax, 2
jne 0x428472
mov eax, dword [esp + 0x48]
mov ecx, dword [eax + 0xd4]
test ecx, ecx
jle 0x428472
mov eax, dword [esp + 0x48]
mov ebx, dword [eax + 0xd8]
mov eax, dword [esp + 0x2a4]
mov edx, dword [eax + 0x34]
cmp dword [ebx], edx
je 0x429349
xor eax, eax
jmp 0x42846d
cmp dword [ebx + eax*4], edx
je 0x429349
inc eax
cmp eax, ecx
jne 0x428464
mov edx, dword [esp + 0x2a0]
mov eax, dword [edx + 0xbb8]
inc eax
cmp eax, 0x1d
jg 0x42878f
mov edx, dword [esp + 0x2a0]
mov dword [edx + 0xbb8], eax
lea eax, [eax + eax*2]
shl eax, 5
add eax, dword [esp + 0x2a0]
mov dword [esp + 0x4c], eax
mov ecx, 0x18
mov edi, eax
mov esi, dword [esp + 0x2a4]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 0x4c]
mov eax, dword [edx]
mov eax, dword [eax*4 + 0x5ff440]
test al, 1
jne 0x428e3f
test al, 2
je 0x428dd2
mov eax, dword [esp + 0x4c]
mov eax, dword [eax + 0x34]
mov dword [esp + 0x3c], eax
mov ecx, dword [esp + 0x2a0]
mov eax, dword [ecx + 0xbb8]
mov edx, dword [esp + 0x3c]
mov dword [ecx + eax*4 + 0xb40], edx
lea ecx, [esp + 0x80]
mov dword [esp + 0x30], ecx
mov ecx, 0xc
xor eax, eax
mov edi, dword [esp + 0x30]
rep stosb byte es:[edi], al
mov edx, dword [esp + 0x4c]
mov eax, dword [edx]
cmp eax, 0x23
je 0x428dbd
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x88], eax
lea edx, [esp + 0x80]
mov dword [esp + 4], edx
mov ecx, dword [esp + 0x58]
mov dword [esp], ecx
call dword [ecx + 0x2c]
test eax, eax
je 0x429446
mov eax, dword [eax + 0xc]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x88]
test eax, eax
je 0x42933c
mov dword [esp + 0x88], 0
lea eax, [esp + 0x80]
mov dword [esp + 4], eax
mov edx, dword [esp + 0x58]
mov dword [esp], edx
call dword [edx + 0x2c]
test eax, eax
je 0x42933c
mov eax, dword [eax + 0xc]
mov dword [esp + 0x60], eax
lea ecx, [esp + 0xd8]
mov dword [esp], ecx
mov eax, dword [0x68bb7c]
call dword [eax + 0x1f0]
mov eax, dword [esp + 0x2ac]
test eax, eax
jle 0x42942a
lea eax, [esp + 0x8c]
mov dword [esp + 0x5c], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x40], 5
mov dword [esp + 0x34], 0
mov edx, dword [esp + 0x2a0]
add edx, 0xbbc
mov dword [esp + 0x50], edx
jmp 0x4286c6
mov ecx, dword [eax + 0xc]
lea eax, [esp + 0x78]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov edx, dword [esp + 0x2a0]
mov eax, dword [esp + 0x48]
call fcn.004250a8
invalid
Function at 0x48486c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebp, dword [esp + 0x74]
mov edx, dword [ebp + 0xa4]
mov dword [esp + 0x28], edx
mov eax, dword [ebp]
mov edi, dword [eax + 0x20]
mov eax, dword [0x68bb7c]
call dword [eax + 0x2b4]
mov dword [esp + 0x2c], eax
mov dword [esp + 4], 0x88
mov dword [esp], 0x68b600
mov eax, dword [0x68bb7c]
call dword [eax + 0x4cc]
mov ebx, eax
inc dword [eax]
test byte [ebp + 0x8b], 0x20
jne 0x4849f4
mov dword [esp], ebp
call fcn.004cd1f8
mov esi, eax
test eax, eax
jne 0x4849e8
mov ebp, dword [ebp]
test ebp, ebp
je 0x4849e8
test edi, edi
je 0x484a38
lea eax, [esp + 0x34]
mov dword [esp + 8], eax
lea eax, [esp + 0x30]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.0041c9b4
mov eax, dword [esp + 0x30]
mov dword [esp + 0x40], eax
mov edx, dword [esp + 0x34]
mov dword [esp + 0x44], edx
add edx, dword [edi + 0x44]
mov dword [esp + 0x4c], edx
add eax, dword [edi + 0x40]
mov dword [esp + 0x48], eax
mov dword [esp], 0
mov eax, dword [0x68bb7c]
call dword [eax + 0x3ac]
mov dword [esp], 0x17
call sub.USER32.dll_GetSystemMetrics
push edi
test eax, eax
je 0x484a18
mov dword [esp], 1
call sub.USER32.dll_GetAsyncKeyState
push ecx
test ax, ax
js 0x484a2e
xor eax, eax
lea edx, [esp + 0x40]
mov dword [esp + 0x18], edx
mov edx, dword [ebx + 8]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0
mov edx, dword [esp + 0x7c]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x78]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov edx, dword [esp + 0x28]
mov dword [esp], edx
call sub.USER32.dll_TrackPopupMenu
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov eax, dword [0x68bb7c]
call dword [eax + 0x3ac]
lea eax, [esp + 0x38]
mov dword [esp], eax
call sub.USER32.dll_GetCursorPos
push edi
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.00481ce0
mov ebp, dword [ebx]
test ebp, ebp
je 0x4849dc
mov dword [ebx], 0
mov eax, esi
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
dec dword [ebx]
mov eax, esi
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebp
mov dword [esp], fcn.00483758
mov eax, dword [0x68bb7c]
call dword [eax + 0x148]
mov dword [esp], ebp
call fcn.00483758
jmp 0x4848c1
mov dword [esp], 2
call sub.USER32.dll_GetAsyncKeyState
push edx
test ax, ax
jns 0x484959
mov eax, 2
jmp 0x48495b
mov eax, dword [esp + 0x7c]
sub eax, 0x32
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x7c]
add eax, 0x32
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x78]
sub eax, 0x32
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x78]
add eax, 0x32
mov dword [esp + 0x48], eax
jmp 0x48491c
Function at 0x4fc2d4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebp, dword [esp + 0x70]
mov ebx, dword [esp + 0x7c]
mov dword [esp], ebx
call fcn.004fe628
mov edx, dword [ebx]
mov esi, dword [ebx + 8]
dec esi
test ebp, ebp
je 0x4fc410
mov ecx, dword [esp + 0x74]
test ecx, ecx
je 0x4fc424
mov eax, dword [esp + 0x78]
test eax, eax
js 0x4fc3e0
mov eax, 3
mov ecx, esi
mov esi, edx
jmp 0x4fc33c
lea eax, [eax + eax + 1]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004fe6f8
mov esi, dword [ebx]
add esi, edi
mov ecx, edi
not ecx
add ecx, dword [ebx + 4]
mov eax, 2
lea edx, [esp + 0x4c]
mov dword [esp + 0x24], edx
lea edx, [esp + 0x48]
mov dword [esp + 0x20], edx
lea edx, [esp + 0x44]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], esi
lea edx, [esp + 0x40]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0x78]
mov dword [esp + 8], edx
mov eax, dword [esp + 0x74]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x14]
mov dword [esp], eax
mov dword [esp + 0x3c], ecx
call dword [ebp + 8]
mov edi, dword [esp + 0x48]
add edi, esi
sub edi, dword [ebx]
cmp eax, 0xfffffffc
mov ecx, dword [esp + 0x3c]
jne 0x4fc3c4
mov eax, dword [esp + 0x44]
add dword [esp + 0x74], eax
sub dword [esp + 0x78], eax
mov eax, dword [ebx + 4]
test eax, eax
jne 0x4fc31c
mov dword [esp + 4], ecx
mov dword [esp], ebx
call fcn.004fe6f8
mov eax, dword [ebx + 4]
jmp 0x4fc31c
cmp dword [ebp + 0x10], 2
je 0x4fc3fc
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.004fe6f8
mov eax, dword [ebx]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
mov ecx, 0xffffffff
mov edi, dword [esp + 0x74]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x78], ecx
jmp 0x4fc311
lea eax, [edi + 1]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004fe6f8
jmp 0x4fc3ca
mov ebp, dword [0x68b8fc]
mov ecx, dword [esp + 0x74]
test ecx, ecx
jne 0x4fc305
nop
mov dword [esp + 0x78], 0
jmp 0x4fc311

Function at 0x4fe768
Capabilities:
Hash data using murmur3

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, dword [esp + 0x20]
mov eax, dword [ebx]
lea esi, [ebx + 0xc]
cmp eax, esi
je 0x4fe782
mov dword [esp], eax
call fcn.004ee144
mov dword [ebx], esi
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0xc8
add edi, 0x1e96cf82
invalid
inc edi
push esp
cli

Function at 0x4fecdc
Capabilities:
Hash data using murmur3

Disassembly:
pop edi
add byte [edi + 9], cl
add eax, 0x5f790b

Function at 0x4fef14
Capabilities:
Hash data using murmur3

Disassembly:
push ecx
add eax, 0xc081d6f7
cmc
lodsd eax, dword [esi]
xor dh, byte [esi - 0x18]
push 0xf7fff3c0
fimul word [esi - 0x7f]
call 0x981071b9

Function at 0x4ff150
Capabilities:
Hash data using murmur3

Disassembly:
jl 0x4ff1b1
add cl, al
mov dword [edx], 0xc7c1def7
or eax, dword [ecx - 9]
fsubp st(0)
or al, 0xec
int1
inc dword [edi - 0x83afc0d]
fidiv dword [ebx]
iretd
xor eax, 0x5f7d5f
Function at 0x4ff218
Capabilities:
Hash data using murmur3

Disassembly:
add eax, dword [0x5f7e2b]
xor edx, 0xd83e277f
xor dword [0x5f7b34], esi
inc edx
xor esi, dword [0x5f7f33]
xor edi, eax
rol edx, 0x10
or dword [0x5f7860], edi
rol esi, 0x11
neg esi
xor ecx, dword [0x5f7f91]
sub ecx, dword [0x5f7d1e]
neg esi
ror esi, 0x11
ror edx, 0x10
xor edi, eax
dec edx
xor edx, 0xd83e277f
not esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
sub edx, esp
or ebx, dword [0x5f7f24]
xor edi, dword [0x5f7c57]
call fcn.0042f538
not esi
sub eax, dword [0x5f7ce3]
dec ecx
rol edi, 0x15
dec edx
xchg eax, edx
and dword [0x5f79f0], eax
add esi, ebp
or eax, dword [0x5f7cc1]
xor edx, 0x18720666
xchg ecx, esi
inc ecx
xor eax, dword [0x5f7e77]
add ecx, eax
add dword [0x5f7aff], edi
xor ecx, edi
sub ebx, ebp
add ebx, ebp
xor ecx, edi
xor dword [0x5f7928], edi
sub ecx, eax
dec ecx
xchg ecx, esi
xor edx, 0x18720666
sub esi, ebp
add dword [0x5f78de], eax
xchg eax, edx
inc edx
ror edi, 0x15
inc ecx
not esi
call fcn.00450cd0
add edx, esp
push ebx
xor ecx, 0x7c710b6a
xor edx, dword [0x5f7d11]
inc edi
inc esi
xchg edi, esi
xor ecx, dword [0x5f7ee5]
xchg edi, esi
dec edx
or esi, dword [0x5f7d19]
ror edi, 0xe
xor eax, ebp
xor ecx, edi
call fcn.0051a7cf
xor edi, 0x75f3fa19
or edi, dword [0x5f7ea6]
xor edi, 0x75f3fa19
xor ecx, edi
xor eax, ebp
rol edi, 0xe
inc edx
xchg edi, esi
xchg edi, esi
dec esi
dec edi
xor ecx, 0x7c710b6a
mov ecx, 0x26fe970a
not eax
xor edi, dword [0x5f7ee3]
add edx, 0xf1a8ca08
sub ebx, edi
xchg ecx, esi
sub ecx, 0xa8206ac4
inc edx
rol edi, 0x17
not ecx
and dword [0x5f7960], ecx
call fcn.00576c83
call fcn.0049787a
call fcn.0041d238
not ecx
ror edi, 0x17
dec edx
add ecx, 0xa8206ac4
xchg ecx, esi
add ebx, edi
sub edx, 0xf1a8ca08
not eax
or ecx, 0x29f0959e
inc ecx
xor esi, 0x1c922c55
sub eax, 0xab0668cf
add dword [0x5f7888], esi
xor ecx, dword [0x5f7d3c]
call fcn.00508aeb
xor eax, 0x4f265415
and dword [0x5f7b75], ebx
add esi, 0xa1432a02
add ecx, dword [0x5f7da3]
inc esi
inc ebx
add dword [0x5f7bd3], esi
or edi, dword [0x5f7cb7]
xchg ebx, esi
ror edx, 9
not edi
rol eax, 2
sub dword [0x5f7a55], eax
call fcn.004b1783
call fcn.00522984
or dword [0x5f7a3b], edi
ror eax, 2
not edi
rol edx, 9
xchg ebx, esi
and dword [0x5f7ba5], esi
dec ebx
dec esi
sub esi, 0xa1432a02
inc ebx
mov eax, dword [0x78a21531]
pop edi
add byte [ecx + 0x265415f0], al
dec edi
xor dword [0x5f7821], ebx
add eax, 0xab0668cf
xor esi, 0x1c922c55
dec ecx
invalid
int1
sahf
Function at 0x4ff400
Capabilities:
Hash data using murmur3

Disassembly:
add eax, dword [0x5f7e2b]
xor edx, 0xd83e277f
xor dword [0x5f7b34], esi
inc edx
xor esi, dword [0x5f7f33]
xor edi, eax
rol edx, 0x10
or dword [0x5f7860], edi
rol esi, 0x11
neg esi
xor ecx, dword [0x5f7f91]
sub ecx, dword [0x5f7d1e]
neg esi
ror esi, 0x11
ror edx, 0x10
xor edi, eax
dec edx
xor edx, 0xd83e277f
not esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
sub edx, esp
or ebx, dword [0x5f7f24]
xor edi, dword [0x5f7c57]
call fcn.0042f538
not esi
sub eax, dword [0x5f7ce3]
dec ecx
rol edi, 0x15
dec edx
xchg eax, edx
and dword [0x5f79f0], eax
add esi, ebp
or eax, dword [0x5f7cc1]
xor edx, 0x18720666
xchg ecx, esi
inc ecx
xor eax, dword [0x5f7e77]
add ecx, eax
add dword [0x5f7aff], edi
xor ecx, edi
sub ebx, ebp
add ebx, ebp
xor ecx, edi
xor dword [0x5f7928], edi
sub ecx, eax
dec ecx
xchg ecx, esi
xor edx, 0x18720666
sub esi, ebp
add dword [0x5f78de], eax
xchg eax, edx
inc edx
ror edi, 0x15
inc ecx
not esi
call fcn.00450cd0
add edx, esp
push ebx
xor ecx, 0x7c710b6a
xor edx, dword [0x5f7d11]
inc edi
inc esi
xchg edi, esi
xor ecx, dword [0x5f7ee5]
xchg edi, esi
dec edx
or esi, dword [0x5f7d19]
ror edi, 0xe
xor eax, ebp
xor ecx, edi
call fcn.0051a7cf
xor edi, 0x75f3fa19
or edi, dword [0x5f7ea6]
xor edi, 0x75f3fa19
xor ecx, edi
xor eax, ebp
rol edi, 0xe
inc edx
xchg edi, esi
xchg edi, esi
dec esi
dec edi
xor ecx, 0x7c710b6a
mov ecx, 0x26fe970a
not eax
xor edi, dword [0x5f7ee3]
add edx, 0xf1a8ca08
sub ebx, edi
xchg ecx, esi
sub ecx, 0xa8206ac4
inc edx
rol edi, 0x17
not ecx
and dword [0x5f7960], ecx
call fcn.00576c83
call fcn.0049787a
call fcn.0041d238
not ecx
ror edi, 0x17
dec edx
add ecx, 0xa8206ac4
xchg ecx, esi
add ebx, edi
sub edx, 0xf1a8ca08
not eax
or ecx, 0x29f0959e
inc ecx
xor esi, 0x1c922c55
sub eax, 0xab0668cf
add dword [0x5f7888], esi
xor ecx, dword [0x5f7d3c]
call fcn.00508aeb
xor eax, 0x4f265415
and dword [0x5f7b75], ebx
add esi, 0xa1432a02
add ecx, dword [0x5f7da3]
inc esi
inc ebx
add dword [0x5f7bd3], esi
or edi, dword [0x5f7cb7]
xchg ebx, esi
ror edx, 9
not edi
rol eax, 2
sub dword [0x5f7a55], eax
call fcn.004b1783
call fcn.00522984
or dword [0x5f7a3b], edi
ror eax, 2
not edi
rol edx, 9
xchg ebx, esi
and dword [0x5f7ba5], esi
dec ebx
dec esi
sub esi, 0xa1432a02
inc ebx
mov eax, dword [0x78a21531]
pop edi
add byte [ecx + 0x265415f0], al
dec edi
xor dword [0x5f7821], ebx
add eax, 0xab0668cf
xor esi, 0x1c922c55
dec ecx
invalid
int1
sahf
Function at 0x57fa78
Capabilities:
Create thread

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [esp + 0x50]
mov ebx, dword [esp + 0x58]
call fcn.0057f834
mov dword [esp], 0xa0
call fcn.004edfec
mov ebp, eax
mov ecx, 0xa0
xor eax, eax
mov edi, ebp
rep stosb byte es:[edi], al
mov dword [ebp + 0xc], ebx
mov dword [ebp], esi
mov dword [ebp + 0x1c], 1
mov dword [ebp + 0x20], 0xa
call fcn.004eeae0
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x30], 0x1000
mov dword [ebp + 0x34], 0x1000
mov dword [esp + 8], ebp
mov dword [esp + 4], str.file_x
mov eax, dword [esp + 0x54]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebp
mov eax, dword [esp + 0x54]
mov dword [esp + 4], eax
mov dword [esp], str.serial
call fcn.004d6a3c
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x34]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x30]
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.KERNEL32.dll_SetupComm
sub esp, 0xc
mov dword [esp + 4], 0xf
mov dword [esp], esi
call sub.KERNEL32.dll_PurgeComm
sub esp, 8
mov dword [esp + 4], 0x68c9d8
mov dword [esp], esi
call sub.KERNEL32.dll_SetCommTimeouts
sub esp, 8
lea eax, [ebp + 0x68]
mov dword [esp], eax
call sub.KERNEL32.dll_InitializeCriticalSection
push ecx
test bl, 2
jne 0x57fc9c
and ebx, 4
je 0x57fc4a
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.KERNEL32.dll_CreateEventA
sub esp, 0x10
mov dword [ebp + 0x60], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.KERNEL32.dll_CreateEventA
sub esp, 0x10
mov dword [ebp + 0x80], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateEventA
sub esp, 0x10
mov dword [ebp + 0x84], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateEventA
sub esp, 0x10
mov dword [ebp + 0x88], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x57f39c
mov dword [esp + 4], 0x100
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
mov dword [ebp + 0x64], eax
mov dword [esp + 0xc], 0x62e836
mov dword [esp + 8], 0x62e83b
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.004dc05c
ret
cmc
inc edi
inc esp
and al, 0xc
dec eax
call 0x451efcd9
and al, 8
dec ebp
call 0x45e2fce1
or byte [ecx - 0x38fbdbbc], cl
add al, 0x24
add byte [eax], al
add byte [eax], al
call fcn.004dc05c
mov eax, dword [ebp + 8]
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.KERNEL32.dll_CreateEventA
sub esp, 0x10
mov dword [ebp + 0x4c], eax
jmp 0x57fb5a
Function at 0x10001d10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x1002c018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x238], eax
xor eax, eax
push esi
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], eax
push edi
mov ecx, 0x3d69ba48
lea eax, [ebp - 0x218]
mov dword [ebp - 0x244], 0
call fcn.1001a100
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
test eax, eax
sete al
test al, al
je 0x10001dc3
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, 0x1002489c
sub edi, 0x7e80af00
lea esi, [ebp - 0x230]
call fcn.1001a180
lea edx, [ebp - 0x108]
push edx
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x234], eax
jmp 0x10001df1
mov ecx, 0x3d69ba48
lea eax, [ebp - 0x218]
call fcn.1001a100
push eax
call esi
mov dword [ebp - 0x234], eax
xor eax, eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], eax
mov word [ebp - 0x210], ax
cmp dword [ebp - 0x234], 0
jne 0x10001e28
mov edx, dword [ebp - 0x244]
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 0x23c]
mov dword [ebx], edx
mov dword [ebx + 4], eax
pop edi
mov dword [ebx + 8], ecx
mov eax, ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001dae2
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 0x238]
push edx
call esi
mov edi, 0x4bddd6e5
lea esi, [ebp - 0x230]
mov dword [ebp - 0x238], eax
call fcn.1001a1c0
push eax
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x238]
push 0xc
lea ecx, [ebp - 0x244]
mov esi, eax
xor eax, eax
push ecx
push edx
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], eax
mov byte [ebp - 0x21c], al
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov eax, dword [ebp - 0x244]
mov ecx, dword [ebp - 0x240]
mov edx, dword [ebp - 0x23c]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [ebx + 8], edx
mov eax, ebx
pop esi
call fcn.1001dae2
mov esp, ebp
pop ebp
ret 4

Function at 0x10002cc0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
mov edi, dword [esi]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push esi
call ebx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 8]
push edx
push eax
push 4
push esi
mov dword [esi], ecx
call ebx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10002d10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10028b80
push 0x1001e129
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1002c018]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, ecx
mov edi, edx
mov dword [ebp - 4], 0
push 0xa
call dword [sym.imp.MSVCR100.dll_malloc]
add esp, 4
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0xa
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 0x20]
push ecx
push 0x40
push 0xa
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [edi]
mov dword [esi], edx
mov al, byte [edi + 4]
mov byte [esi + 4], al
add esi, 5
mov byte [esi], 0xe9
mov ecx, edi
sub ecx, esi
mov dword [esi + 1], ecx
lea edx, [ebp - 0x1c]
push edx
push 0x40
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [edi], 0xe9
sub ebx, edi
sub ebx, 5
mov dword [edi + 1], ebx
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 5
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [esi - 5]
jmp 0x10002dd9
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10002e00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [esi + 5]
push ebx
push eax
call dword [sym.imp.MSVCR100.dll_malloc]
add esp, 4
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 0x40
lea eax, [esi + 5]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 8]
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [esi + 5]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push edi
push ebx
call sub.MSVCR100.dll_memcpy
add esp, 0xc
lea edx, [ebp - 4]
push edx
add ebx, esi
push 0x40
mov eax, edi
sub eax, ebx
push esi
lea ecx, [eax + esi - 5]
push edi
mov byte [ebx], 0xe9
mov dword [ebx + 1], ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
lea eax, [ebp - 4]
push eax
push ecx
push esi
push edi
mov byte [edi], 0xe9
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, ebx
sub eax, esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002ea0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push esi
push edi
call ebx
mov ecx, dword [ebp + 8]
push esi
push ecx
push edi
call dword [sym.imp.MSVCR100.dll_memmove]
mov eax, dword [ebp - 4]
add esp, 0xc
lea edx, [ebp - 8]
push edx
push eax
push esi
push edi
call ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10002ef0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x1002c018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10002f36
push str.Error:_Unable_to_create_toolhelp_snapshot_
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001dae2
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x130]
push eax
push esi
mov dword [ebp - 0x130], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x10002f24
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
jmp 0x10002f60
mov ecx, edi
lea eax, [ebp - 0x10c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10002f88
test dl, dl
je 0x10002f84
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10002f88
add eax, 2
add ecx, 2
test dl, dl
jne 0x10002f68
xor eax, eax
jmp 0x10002f8d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10002faf
lea ecx, [ebp - 0x130]
push ecx
push esi
call ebx
test eax, eax
jne 0x10002f60
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001dae2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x128]
pop esi
xor ecx, ebp
pop ebx
call fcn.1001dae2
mov esp, ebp
pop ebp
ret