joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431cf5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x636148]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x63bc00], 0
push ebx
push esi
push edi
je 0x431d57
call fcn.004364ca
test al, al
je 0x431d2e
pop ebx
pop esi
pop esi
push esi
pop eax
push esi
push eax
pop edx
push ecx
pop ecx
pop ebx
push edi
push ebx
pop ebx
push esi
pop esp
pop ebp
call fcn.0043684b
test al, al
je 0x431e9c
pop edi
pop ecx
pop ebx
pop edx
pop esi
pop ebp
push esi
push edi
pop edi
push edi
pop edx
push ebx
push esi
pop eax
pop ebp
push ebp
push edi
push ebx
pop esi
pop edi
push ecx
push eax
pop ebx
jmp 0x431e9c
call fcn.0043650f
test al, al
je 0x431d7e
push edi
push edi
push ebp
pop edi
push esi
pop ebx
pop ecx
push ecx
push edi
push esp
pop ecx
pop esi
pop esp
push esi
pop esi
push ecx
push esi
pop edi
pop esi
pop ebp
push edx
push eax
pop edx
pop edx
push edi
push edx
push edi
push esi
pop ebp
pop esi
call fcn.00436737
test al, al
je 0x431d9b
push esp
pop esp
push esp
pop edx
push edx
pop edi
pop edi
pop eax
push ebx
push ecx
pop ecx
push ebx
push ebx
pop edi
pop ebp
pop ebx
push ecx
push edi
pop ebp
push edi
call fcn.004366ad
test al, al
je 0x431dc3
pop esi
pop esp
pop edi
push edx
push ecx
push edi
push edi
pop ecx
push eax
push ebx
push ebp
push eax
push eax
pop ebx
push esp
pop ecx
push esp
pop ecx
pop ebx
push esp
pop edx
pop edx
push ecx
pop edi
pop edi
push ebp
pop esi
pop esi
push ebx
pop eax
pop esi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0044b370
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x431e33
lea eax, [ebp - 0x20c]
push eax
call fcn.00457ee8
lea eax, [ebp - 0x20c]
mov dword [esp], 0x5b03dc
push eax
call fcn.0044b57d
pop ecx
pop ecx
test eax, eax
jne 0x431e2c
lea eax, [ebp - 0x20c]
push str.documents_and_settingslocalservice
push eax
call fcn.0044b57d
pop ecx
pop ecx
test eax, eax
je 0x431e33
mov byte [0x63bc00], 1
call fcn.0043625d
test al, al
je 0x431e5a
push ebp
pop ebp
pop edi
push edx
pop ebx
push esi
pop ecx
pop edi
pop edi
pop esp
pop eax
push ecx
push ecx
pop esi
push edi
push edx
push esi
pop esp
push eax
pop ebp
push edi
push esi
pop ecx
pop ebp
pop eax
push esp
pop ecx
pop edi
pop eax
pop esp
call fcn.0043618e
test al, al
je 0x431e77
pop esi
pop ebx
pop ecx
pop edx
pop edx
push eax
pop ebp
pop ebp
push esi
push ebp
push ebx
pop edx
push edx
push esp
pop edx
push edi
pop ebx
pop edx
pop ecx
push ecx
call fcn.00436806
test al, al
je 0x431e9c
push eax
pop edi
pop edi
pop ecx
push edx
pop edx
push eax
push esi
pop esi
pop eax
push esi
push edx
push edi
push ebp
pop esi
push esi
pop ecx
push ebp
pop esp
push edx
push ecx
pop edi
pop esp
pop edi
pop ebp
push ebp
push ecx
push esi
mov ecx, dword [ebp - 4]
mov al, byte [0x63bc00]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0042cd1d
mov esp, ebp
pop ebp
ret
Function at 0x431eb2
Capabilities:
Get common file path

Disassembly:
push 0x138
mov eax, 0x5abc41
call fcn.0042d04a
mov al, byte [0x63bc01]
test al, al
jne 0x431f7b
push 0x104
xor esi, esi
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.0044b370
add esp, 0xc
lea eax, [ebp - 0x114]
xor edi, edi
inc edi
push edi
push 0x1a
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x431f76
push str.config_systemprofile
lea ecx, [ebp - 0x12c]
call fcn.00402f70
lea eax, [ebp - 0x114]
mov dword [ebp - 4], esi
push eax
lea ecx, [ebp - 0x144]
call fcn.00402f70
push dword [ebp - 0x11c]
cmp dword [ebp - 0x118], 0x10
lea eax, [ebp - 0x12c]
push esi
cmovae eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x144]
push eax
call fcn.0040caf0
movzx ecx, byte [0x63bc01]
cmp eax, 0xffffffff
push esi
cmovne ecx, edi
mov byte [0x63bc01], cl
lea ecx, [ebp - 0x144]
push edi
call fcn.00403190
push esi
push edi
lea ecx, [ebp - 0x12c]
call fcn.00403190
mov al, byte [0x63bc01]
call fcn.0042cff4
ret
Function at 0x4343d3
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call fcn.00436104
test al, al
je 0x434402
push ecx
push esi
pop esi
pop esi
pop ebx
pop ebp
pop ebp
push ebx
pop ecx
push ebp
pop esp
push esp
push esi
push esp
pop edi
pop ebp
pop ecx
pop edi
pop esi
push edi
push ecx
push ebp
pop esi
pop esp
xor ebx, ebx
push dword [ebp + 8]
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x434435
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
xor ecx, ecx
inc ecx
test eax, eax
push esi
cmovne ebx, ecx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004363b6
test al, al
je 0x434457
push eax
push esp
push edx
push edi
pop edx
pop esp
pop edi
push eax
push ebx
push esp
pop esi
pop ecx
pop ebx
push esp
push edi
push ebp
push edx
pop ebp
push esp
push ecx
pop edi
push edi
pop ecx
push ecx
pop ebx
call fcn.00436440
test al, al
je 0x434476
pop eax
pop edx
push esi
pop ebp
pop ebp
pop ebp
push eax
pop ebp
push edi
pop eax
pop ecx
push edx
push ebp
pop esp
pop eax
pop ecx
pop ebp
pop ecx
pop ebp
pop esi
pop ebp
push eax
call fcn.00436668
test al, al
je 0x434492
push esi
push ecx
push esi
push edi
push esp
pop edx
push esi
push ebp
pop ecx
pop eax
pop ebx
pop edi
push ebx
push esi
push esp
pop esi
pop edx
push esp
pop edx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x436024
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x636148]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.0044b370
add esp, 0xc
mov dword [ebp - 0x120], esi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
call fcn.0043677c
test al, al
je 0x436099
pop eax
pop ebx
push edx
pop ebx
pop ebp
push eax
pop esp
pop esp
pop ecx
pop esi
push edx
pop ecx
push esp
push edx
push ebx
pop ebx
pop ebp
push eax
pop edi
pop esp
push esp
pop ebp
pop esi
push eax
pop ecx
pop edi
push edx
pop edx
push esi
pop ebp
push edi
mov eax, dword [ebp - 0x11c]
mov ebx, dword [ebp - 0x118]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], ebx
call fcn.004364ca
test al, al
je 0x4360de
pop edx
push edx
pop eax
push edi
push edi
pop edx
push ecx
push edx
push edi
push esp
push ecx
pop esi
push esi
pop esp
pop esi
push ebx
pop ebx
pop eax
pop edi
push ebp
pop eax
pop esi
pop esp
push esi
pop ebp
pop edx
push ebp
pop esp
pop ecx
push eax
mov ebx, dword [ebp - 0x124]
cmp dword [ebp - 0x128], 5
jg 0x4360f1
cmp ebx, 2
jg 0x4360f1
xor eax, eax
inc eax
jmp 0x4360f3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042cd1d
mov esp, ebp
pop ebp
ret
Function at 0x436afc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
and dword [ebp - 4], 0
call fcn.004708a0
mov edi, eax
test edi, edi
je 0x436b3c
push 0x5b4198
lea eax, [ebp - 4]
push ebx
push eax
call fcn.0045862e
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x436b46
push edi
call fcn.00470860
pop ecx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x2a
push edi
call fcn.00470900
push dword [ebp + 8]
push 0x2712
push edi
call fcn.00470900
push 1
push 0x34
push edi
mov esi, eax
call fcn.00470900
push 0x1e
push 0xd
push edi
call fcn.00470900
push 1
push 0x63
push edi
call fcn.00470900
push 0x493e0
push 0x9b
push edi
call fcn.00470900
add esp, 0x48
test esi, esi
je 0x436ba7
push dword [ebp - 4]
call fcn.004583fe
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x436b35
push 0x4373eb
push 0x4e2b
push edi
call fcn.00470900
add esp, 0xc
test eax, eax
jne 0x436b95
push eax
push 0x40
push edi
call fcn.00470900
push 0
push 0x51
push edi
call fcn.00470900
push dword [ebp - 4]
push 0x2711
push edi
call fcn.00470900
add esp, 0x24
test eax, eax
jne 0x436b95
push edi
call fcn.004708e0
mov esi, eax
pop ecx
test esi, esi
je 0x436c26
push dword [ebp - 4]
call fcn.004583fe
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call fcn.00470e70
pop ecx
push eax
push str.curl_easy_perform___failed:__s_n
push 2
call fcn.00458304
pop ecx
push eax
call fcn.00420ef0
add esp, 0xc
or esi, 0xffffffff
jmp 0x436c57
or dword [ebp - 8], 0xffffffff
lea eax, [ebp - 8]
push eax
push 0x200002
push edi
call fcn.00470880
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x436c4b
cmp dword [ebp - 8], 0xc8
je 0x436c4e
push 0x16
pop esi
push dword [ebp - 4]
call fcn.004583fe
pop ecx
push edi
call fcn.00470860
pop ecx
mov eax, esi
jmp 0x436b3f
Function at 0x438ce2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 8], esi
cmp esi, 0xffffffff
je 0x438dd6
call fcn.0043677c
test al, al
je 0x438d38
pop ecx
pop esi
push edx
push ebx
push edx
pop ebp
push ecx
push eax
pop ebp
pop edx
push eax
push ebx
pop ebx
push esi
push ecx
push edx
pop edx
push ecx
push eax
push ecx
pop ecx
pop edx
push ebp
push eax
pop esi
mov esi, dword [ebp - 8]
call fcn.00436668
test al, al
je 0x438d5b
push esp
push esp
push ecx
pop edi
push ebp
push edx
pop edx
push esp
push edi
push esp
pop ebp
pop ebx
pop ecx
pop edx
pop ebp
push eax
push edx
push esp
pop ecx
push esp
pop esp
push ecx
push esi
push esi
push esi
push ebx
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 4]
and dword [ebp - 4], 0
push 0
push eax
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004364ca
test al, al
je 0x438da0
pop eax
push edx
push ebx
pop edx
pop ebp
pop ebx
push edx
pop esp
pop eax
push ecx
push edx
pop ecx
push esp
push ebp
push eax
push eax
pop ebp
push ebp
push eax
push edi
push ebp
push edi
push ebx
pop edx
push eax
push edx
call fcn.00436440
test al, al
je 0x438dc6
pop esp
push esi
pop ebp
pop eax
push eax
push ebx
pop ebp
pop ebx
pop esp
pop esi
pop edx
push esi
pop ebp
push edx
pop ebx
pop edi
pop ebx
push ebx
push eax
pop edx
push eax
push eax
pop esp
pop esi
push edx
pop ecx
mov edi, dword [ebp + 0x10]
cmp dword [ebp - 8], 0
je 0x438dd6
cmp edi, dword [ebp - 4]
jne 0x438dd6
xor eax, eax
inc eax
jmp 0x438dd8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43a385
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x43a404
push ebx
push edi
xor edi, edi
push 0x5b4360
mov dword [ebp + 8], edi
call fcn.00459860
mov ebx, dword [ebp + 0xc]
mov edx, edi
pop ecx
test ebx, ebx
je 0x43a3c1
mov cl, byte [edi + 0x5b4360]
xor byte [edx + esi], cl
inc edi
xor ecx, ecx
cmp edi, eax
cmovge edi, ecx
inc edx
cmp edx, ebx
jb 0x43a3ab
cmp ebx, 1
jle 0x43a3f8
cmp byte [esi], 0x37
jne 0x43a3f8
mov al, byte [esi + 1]
cmp al, 0x7a
je 0x43a3d6
cmp al, 0x5a
jne 0x43a3f8
lea eax, [ebp + 8]
push eax
push ebx
push esi
call fcn.00423040
test eax, eax
je 0x43a3f8
mov edx, dword [ebp + 8]
test edx, edx
je 0x43a3f8
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
jmp 0x43a402
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x43aee2
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x43aef6
xor eax, eax
jmp 0x43b034
mov eax, ebx
shl eax, 3
push 6
pop ecx
cdq
idiv ecx
mov edx, ebx
imul ecx, eax, 6
shl edx, 3
push 3
sub edx, ecx
dec edx
pop ecx
sub edx, 1
je 0x43af1f
dec edx
sub edx, 1
jne 0x43af21
add eax, 2
jmp 0x43af21
add eax, ecx
push esi
mov esi, dword [ebp + 0x14]
inc eax
cmp dword [esi], eax
jge 0x43af34
push 0xfffffffffffffff0
mov dword [esi], eax
pop eax
jmp 0x43b033
mov eax, ebx
cdq
idiv ecx
xor ecx, ecx
imul eax, eax, 3
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
jle 0x43afca
dec eax
mov ebx, dword [ebp + 8]
xor edx, edx
push 3
pop ecx
div ecx
inc eax
imul ecx, eax, 3
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
movzx ecx, byte [ebx]
movzx edx, byte [ebx + 1]
mov eax, ecx
movzx esi, byte [ebx + 2]
add ebx, 3
shr eax, 2
shl ecx, 4
mov al, byte [eax + 0x5b43f8]
mov byte [edi], al
mov eax, edx
shr eax, 4
add eax, ecx
and eax, 0x3f
mov al, byte [eax + 0x5b43f8]
mov byte [edi + 1], al
mov eax, esi
shr eax, 6
and esi, 0x3f
lea eax, [eax + edx*4]
and eax, 0x3f
mov al, byte [eax + 0x5b43f8]
mov byte [edi + 2], al
mov al, byte [esi + 0x5b43f8]
mov byte [edi + 3], al
add edi, 4
sub dword [ebp - 4], 1
jne 0x43af5f
mov esi, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
jmp 0x43afcd
mov eax, dword [ebp + 8]
cmp ecx, ebx
jge 0x43b026
movzx edx, byte [eax]
inc ecx
mov dword [ebp + 0xc], ecx
cmp ecx, ebx
jge 0x43afe2
movzx ecx, byte [eax + 1]
jmp 0x43afe4
xor ecx, ecx
mov eax, edx
shl edx, 4
shr eax, 2
mov al, byte [eax + 0x5b43f8]
mov byte [edi], al
mov eax, ecx
shr eax, 4
add eax, edx
and eax, 0x3f
mov al, byte [eax + 0x5b43f8]
mov byte [edi + 1], al
cmp dword [ebp + 0xc], ebx
jge 0x43b01b
and ecx, 0xf
mov al, byte [ecx*4 + 0x5b43f8]
mov byte [edi + 2], al
jmp 0x43b01f
mov byte [edi + 2], 0x3d
mov byte [edi + 3], 0x3d
add edi, 4
mov eax, edi
sub eax, dword [ebp + 0x10]
mov dword [esi], eax
xor eax, eax
mov byte [edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43b0e7
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
push str.kernel32.dll
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
call fcn.00436440
test al, al
je 0x43b120
pop ebx
push ebp
push esp
pop edi
push ebp
pop eax
pop ebx
pop ecx
pop ebp
push eax
pop esp
pop ebp
pop ebx
push ecx
push ebx
pop esp
pop eax
pop ebp
pop eax
push ebx
push ebx
pop ecx
push esp
call fcn.00436371
test al, al
je 0x43b140
push ebx
push ecx
push ecx
pop esp
push esi
pop edx
push esi
pop edx
pop ecx
pop ebp
push edx
pop ebx
pop ecx
pop esp
push ebx
push eax
pop esp
push ebx
push edx
push esp
pop ebp
push esp
push esi
call fcn.004362a2
test al, al
je 0x43b15d
push ebx
push ebx
pop ecx
pop esp
pop ebx
pop ebp
push esi
push edi
pop ecx
push esp
pop esp
push ebp
push eax
pop edx
push ebp
pop ebx
push ebp
push eax
push edi
push eax
call fcn.004362e7
test al, al
je 0x43b17c
push esp
pop ebp
push edi
pop ecx
push ebx
pop ecx
push eax
pop ebp
push ecx
push edi
pop edi
push ebp
push esp
push ebx
pop ebx
pop ebp
pop esi
push edi
pop edi
push edi
push esi
pop ecx
call fcn.0043684b
test al, al
je 0x43b19c
pop esi
push ebx
push ebx
push esp
push ebx
push eax
push ebp
push esi
pop ebx
push edx
push eax
pop esp
pop ebx
pop eax
push ebp
push esp
pop edi
push ecx
pop ecx
push ebp
pop eax
push ecx
pop ecx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x43b1ab
xor eax, eax
jmp 0x43b268
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5b4004
push dword [ebx]
call esi
push str.IsWow64Process
push dword [ebx]
mov dword [ebx + 8], eax
call esi
push str.Wow64DisableWow64FsRedirection
push dword [ebx]
mov dword [ebx + 0xc], eax
call esi
push str.Wow64RevertWow64FsRedirection
push dword [ebx]
mov dword [ebx + 0x18], eax
call esi
push str.GetSystemWow64DirectoryW
push dword [ebx]
mov dword [ebx + 0x14], eax
call esi
push str.advapi32.dll
mov dword [ebx + 0x10], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx + 4], eax
call fcn.00436485
test al, al
je 0x43b218
push ebx
pop eax
pop edx
pop ebp
pop edi
push edi
pop edi
push eax
push esp
push edi
pop esi
pop ebx
pop esi
pop eax
push ebp
pop ebx
push esi
push ecx
pop edx
pop ebx
call fcn.00436485
test al, al
je 0x43b239
push esi
push edx
push edi
push eax
pop esi
push edx
push esp
pop esp
push edx
pop edi
pop edi
push ebp
pop edx
pop eax
push ecx
pop ebx
push ecx
pop ecx
push eax
pop esi
push ebx
push ebp
pop esp
push ebx
mov esi, dword [ebp - 4]
cmp dword [esi + 4], 0
je 0x43b1a4
mov ebx, str.Wow64RevertWow64FsRedirection
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push dword [esi + 4]
mov dword [esi + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x1c], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43ea5d
Capabilities:
Enumerate processes

Disassembly:
push 0x280
mov eax, 0x5acaca
call fcn.0042d04a
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x28c], ebx
test eax, eax
je 0x43ec4b
push eax
lea ecx, [ebp - 0x40]
call fcn.00402d70
and dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push eax
call fcn.004407f4
mov dword [esp], 0x22c
lea eax, [ebp - 0x284]
push 0
push eax
call fcn.0044b370
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 0x28c], edi
cmp edi, 0xffffffff
je 0x43ec3b
call fcn.004364ca
test al, al
je 0x43eae0
pop ebp
push ecx
push ebp
push esi
pop ecx
push ebp
pop ebp
push ebp
push edi
push edx
push edx
pop esi
push ecx
pop esi
push ebx
push edx
lea eax, [ebp - 0x284]
mov dword [ebp - 0x284], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x43ebbc
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp word [ebp - 0x260], ax
je 0x43eb23
lea eax, [ebp - 0x260]
push eax
call fcn.00459845
pop ecx
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x28]
call fcn.00403090
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.004407f4
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00429cbd
test eax, eax
je 0x43eb77
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00440299
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x40]
or ebx, 1
call fcn.00429cbd
mov byte [ebp - 0x285], 0
test eax, eax
jne 0x43eb7e
mov byte [ebp - 0x285], 1
test bl, 1
je 0x43eb92
push 0
push 1
lea ecx, [ebp - 0x58]
and ebx, 0xfffffffe
call fcn.00402fd0
cmp byte [ebp - 0x285], 0
jne 0x43ec51
push 0
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.00402fd0
lea eax, [ebp - 0x284]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x43eafc
call fcn.00436371
test al, al
je 0x43ebe7
pop esp
pop esi
pop ecx
pop edx
pop edx
push ebx
push edx
push ebp
pop ecx
pop ebp
pop eax
pop esi
push ebx
pop esp
pop eax
push ebp
push esi
push esp
pop eax
push esi
push ebx
push eax
push esp
pop ecx
pop edi
push ebx
call fcn.004363fb
test al, al
je 0x43ec06
push eax
pop esi
pop edx
push ebp
pop ebx
push ebx
pop eax
push ebx
push ebx
push eax
push edx
push esp
pop ecx
pop esi
push ebx
pop edi
push ebx
push ebx
push esp
pop ebp
pop esi
pop esp
call fcn.0043650f
test al, al
je 0x43ec2f
push edi
push eax
pop ebx
pop ebx
push esp
pop ecx
push esi
pop eax
push edx
pop ecx
pop edi
push esp
pop esp
pop edx
push ebx
pop edx
push esi
pop ebx
push ecx
push eax
pop edi
pop eax
pop eax
pop edi
pop esi
push ebx
pop ecx
push ebp
push edx
pop ebp
push ebp
push ebp
push dword [ebp - 0x28c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.00402fd0
mov eax, esi
call fcn.0042cff4
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x27c]
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.00402fd0
jmp 0x43ec3d
Function at 0x43ed05
Capabilities:
Enumerate processes

Disassembly:
push 0x268
mov eax, 0x5acb02
call fcn.0042d04a
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x26c]
and dword [ebp - 0x270], 0
push 0x22c
push 0
push eax
call fcn.0044b370
add esp, 0xc
lea ecx, [ebp - 0x40]
push esi
call fcn.00402d70
and dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push eax
call fcn.004407f4
pop ecx
call fcn.0043677c
test al, al
je 0x43ed6d
pop ecx
pop esi
push edx
push ebx
push edx
pop ebp
push ecx
push eax
pop ebp
pop edx
push eax
push ebx
pop ebx
push esi
push ecx
push edx
pop edx
push ecx
push eax
push ecx
pop ecx
pop edx
push ebp
push eax
pop esi
call fcn.00436668
test al, al
je 0x43ed90
push esp
push esp
push ecx
pop edi
push ebp
push edx
pop edx
push esp
push edi
push esp
pop ebp
pop ebx
pop ecx
pop edx
pop ebp
push eax
push edx
push esp
pop ecx
push esp
pop esp
push ecx
push esi
push esi
push esi
push ebx
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x274], eax
cmp eax, 0xffffffff
jne 0x43edab
xor ebx, ebx
jmp 0x43eebd
lea ecx, [ebp - 0x26c]
mov dword [ebp - 0x26c], 0x22c
push ecx
push eax
call sub.KERNEL32.dll_Process32FirstW
jmp 0x43eea3
call fcn.004362e7
test al, al
je 0x43ede4
pop esi
push edi
pop ecx
pop eax
pop eax
push esp
push ecx
pop eax
push edi
pop esi
pop ebp
pop edi
pop esi
push eax
push edx
pop eax
pop ebx
pop edi
pop ecx
pop esp
call fcn.004362e7
test al, al
je 0x43ee03
pop ebp
push ecx
push edi
push ebp
pop ebx
pop edi
pop edx
push esp
pop ebp
push esp
push edi
pop edi
pop eax
push esi
push edi
pop edi
push edi
pop esi
pop ebp
pop edi
pop edi
pop eax
call fcn.00436599
test al, al
je 0x43ee2c
push edx
pop esp
pop ecx
pop esp
pop esi
pop ecx
pop edi
pop ebp
push edi
pop esi
pop eax
push eax
pop ebp
push ecx
push eax
push ebp
push ecx
push esi
pop eax
pop eax
push ecx
push ebp
push esi
push ebx
pop ebp
push ecx
push ebp
pop eax
pop esp
push esp
push esp
pop eax
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp word [ebp - 0x248], ax
je 0x43ee53
lea eax, [ebp - 0x248]
push eax
call fcn.00459845
pop ecx
push eax
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x28]
call fcn.00403090
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.004407f4
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00429cbd
lea ecx, [ebp - 0x28]
push 0
push 1
test eax, eax
je 0x43eed1
mov byte [ebp - 4], 0
call fcn.00402fd0
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 0x274]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x43edc7
mov ebx, dword [ebp - 0x270]
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.00402fd0
mov eax, ebx
call fcn.0042cff4
ret
xor ebx, ebx
inc ebx
call fcn.00402fd0
jmp 0x43eeb1