joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45898e
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov eax, 0x4a0967
call fcn.0049e6bc
sub esp, 0x828
push ebx
push esi
xor ebx, ebx
push edi
mov edi, ecx
mov dword [ebp - 0x34], ebx
push 0x4bba97
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], ebx
call fcn.0041ee3b
push ebx
push ebx
push ebx
push ebx
mov byte [ebp - 4], 1
push str.Testing
mov dword [ebp - 0x14], ebx
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ebx, eax
test ebx, ebx
jne 0x4589e5
push 0x4cae08
mov ecx, edi
call fcn.0041eeaf
jmp 0x458a9c
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
xor ecx, ecx
push ecx
push SysReAllocStringLen
push ecx
push ecx
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov esi, eax
test esi, esi
jne 0x458a16
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x4cade4
jmp 0x4589d9
push 0x800
lea eax, [ebp - 0x834]
push 0
push eax
call fcn.00438560
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push 0x800
lea eax, [ebp - 0x834]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax - 0x834], 0
cmp byte [ebp - 0x834], 0
jne 0x458a5b
xor eax, eax
jmp 0x458a68
lea eax, [ebp - 0x834]
push eax
call fcn.004380e0
pop ecx
push eax
lea eax, [ebp - 0x834]
push eax
lea ecx, [ebp - 0x30]
call fcn.00425250
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebx
call esi
sub esp, 0x18
lea eax, [ebp - 0x30]
mov ecx, esp
push eax
call fcn.00421f0c
mov ecx, edi
call fcn.0045d9ed
add esp, 0x18
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.0041f358
push 0
push 1
lea ecx, [ebp + 8]
call fcn.0041f6b8
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x458ac7
Capabilities:
Check internet connectivity via wininet
Create http request
Get http content length
Read data from internet
Receive data

Disassembly:
mov eax, 0x4a0994
call fcn.0049e6bc
mov eax, 0x1088
call fcn.00442250
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
mov dword [ebp - 0x40], esi
push esi
lea eax, [ebp - 0x20]
mov dword [ebp - 4], esi
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
xor eax, eax
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x3c], ax
push esi
mov byte [ebp - 4], 1
test byte [ebp - 0x20], 4
push esi
push esi
jne 0x458b19
push 4
push 0x4cadac
jmp 0x458b1f
push esi
push 0x4cad8c
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x458b49
push 0x4cad9c
mov ecx, ebx
call fcn.0041eeaf
push esi
push 1
lea ecx, [ebp - 0x3c]
call fcn.0041f6b8
push esi
jmp 0x458c7f
cmp dword [ebp + 0x1c], 8
lea edi, [ebp - 0x78]
push 8
pop ecx
push 0
mov esi, 0x4cadc0
lea eax, [ebp - 0x78]
rep movsd dword es:[edi], dword [esi]
push 0x84000100
lea esi, [ebp + 8]
cmovae esi, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x78]
push eax
push esi
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov esi, eax
test esi, esi
jne 0x458b99
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x4cade0
jmp 0x458c6a
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x24]
push 0
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x24], 4
push eax
push 0x20000005
push esi
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
neg eax
sbb eax, eax
and dword [ebp - 0x14], eax
jmp 0x458c24
cmp dword [ebp - 0x18], 0
je 0x458c9c
lea eax, [ebp - 0x1094]
push eax
lea ecx, [ebp - 0x58]
call fcn.0041ee3b
push 0xfde9
lea edx, [ebp - 0x58]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x90]
call fcn.0045ddba
pop ecx
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 3
call fcn.00423219
push 0
push 1
lea ecx, [ebp - 0x90]
call fcn.0041f6b8
push 0
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.0041f358
push 0x1000
lea eax, [ebp - 0x1094]
push 0
push eax
call fcn.00438560
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push 0x400
lea eax, [ebp - 0x1094]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x458bc3
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push edi
call esi
push 0x4cadbc
mov ecx, ebx
call fcn.0041eeaf
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.0041f6b8
push 0
push 1
lea ecx, [ebp + 8]
call fcn.0041f6b8
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push edi
call esi
lea eax, [ebp - 0x3c]
mov ecx, ebx
push eax
call fcn.004231cd
jmp 0x458c71
Function at 0x458cb5
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov eax, 0x4a09ae
call fcn.0049e6bc
sub esp, 0x260
lea eax, [ebp - 0x14]
push ebx
push esi
push edi
push eax
push 0x1a
xor ebx, ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x458da6
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push 7
pop edi
xor eax, eax
mov dword [ebp - 0x18], edi
mov esi, str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBarLegendOnline.lnk
mov dword [ebp - 0x1c], ebx
push esi
mov word [ebp - 0x2c], ax
call fcn.00438238
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.0041fba8
mov dword [ebp - 4], ebx
xor eax, eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
mov word [ebp - 0x44], ax
cmp word [ebp - 0x26c], ax
jne 0x458d30
mov eax, ebx
jmp 0x458d3d
lea eax, [ebp - 0x26c]
push eax
call fcn.00438238
pop ecx
push eax
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x44]
call fcn.0041fba8
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x5c]
call fcn.0042338a
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x44]
call fcn.0041f6b8
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.0041f6b8
push dword [ebp - 0x14]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp - 0x48], 8
lea eax, [ebp - 0x5c]
push ebx
cmovae eax, dword [ebp - 0x5c]
push ebx
push ebx
push eax
push str.taskbarunpin
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ebx
push 1
lea ecx, [ebp - 0x5c]
call fcn.0041f6b8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x458db7
Capabilities:
Create directory

Disassembly:
mov eax, 0x4a09fb
call fcn.0049e6bc
sub esp, 0x88
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push edi
mov dword [ebp - 0x14], ebx
xor edi, edi
inc edi
mov dword [ebp - 4], edi
cmp dword [ebp + 0x30], ebx
jne 0x458deb
push 0x4bba96
call fcn.0041ee3b
jmp 0x458f31
push 0x4cabc4
lea ecx, [ebp - 0x78]
call fcn.0041ee3b
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.00424e9a
sub esp, 0x18
mov byte [ebp - 4], 3
lea eax, [ebp - 0x78]
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
call fcn.00421f0c
sub esp, 0x18
mov byte [ebp - 4], 4
lea eax, [ebp + 0x20]
mov ecx, esp
push eax
call fcn.00421f0c
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.0045b964
add esp, 0x30
lea eax, [ebp + 8]
lea ecx, [ebp - 0x48]
push eax
call fcn.00421f0c
mov edi, ebx
mov byte [ebp - 4], 5
cmp dword [ebp - 0x20], edi
jle 0x458ef7
push edi
lea ecx, [ebp - 0x30]
call fcn.00424f48
cmp dword [eax + 0x10], 0
je 0x458ef7
push 0x4caca4
lea ecx, [ebp - 0x60]
call fcn.0041ee3b
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 6
push eax
push edi
lea ecx, [ebp - 0x30]
call fcn.00424f48
mov edx, eax
lea ecx, [ebp - 0x90]
call fcn.0045bbfb
pop ecx
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 7
call fcn.004251aa
push ebx
push 1
lea ecx, [ebp - 0x90]
call fcn.0041f358
push ebx
push 1
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 5
call fcn.0041f358
cmp dword [ebp - 0x34], 0x10
lea eax, [ebp - 0x48]
push ebx
cmovae eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x4caca8
call fcn.004380e0
pop ecx
push eax
push 0x4caca8
lea ecx, [ebp - 0x48]
call fcn.00425250
inc edi
cmp edi, dword [ebp - 0x20]
jl 0x458e55
lea eax, [ebp + 0x20]
mov ecx, esi
push eax
lea edx, [ebp + 8]
call fcn.00425e5b
pop ecx
xor edi, edi
lea ecx, [ebp - 0x48]
push ebx
inc edi
push edi
call fcn.0041f358
lea ecx, [ebp - 0x30]
call fcn.00425835
push dword [ebp - 0x30]
call fcn.00435bbf
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x30], ebx
call fcn.0041f358
push ebx
push edi
lea ecx, [ebp + 8]
call fcn.0041f358
push ebx
push edi
lea ecx, [ebp + 0x20]
call fcn.0041f358
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4595d1
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x4a0b43
call fcn.0049e6bc
sub esp, 0x650
push ebx
push esi
push edi
mov esi, ecx
mov edi, 0x208
lea eax, [ebp - 0x24c]
xor ebx, ebx
push edi
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00438560
push edi
lea eax, [ebp - 0x65c]
push ebx
push eax
call fcn.00438560
push 0xc
lea eax, [ebp - 0x65c]
push 0x4caa70
push eax
call fcn.00435be0
push edi
lea eax, [ebp - 0x454]
push ebx
push eax
call fcn.00438560
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp + 8]
mov eax, dword [ebp + 0x18]
cmovae ecx, dword [ebp + 8]
add eax, eax
push eax
push ecx
lea eax, [ebp - 0x454]
push eax
call fcn.00435be0
add esp, 0x3c
cmp dword [esi + 0x14], 8
jb 0x459656
mov esi, dword [esi]
lea eax, [ebp - 0x454]
push eax
push 0x104
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x65c]
push eax
push esi
push 0x4caa44
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jne 0x459687
mov bl, 1
jmp 0x45970b
push 7
pop edi
xor eax, eax
mov dword [ebp - 0x2c], edi
mov esi, 0x4caa54
mov dword [ebp - 0x30], ebx
push esi
mov word [ebp - 0x40], ax
call fcn.00438238
pop ecx
push eax
push esi
lea ecx, [ebp - 0x40]
call fcn.0041fba8
mov byte [ebp - 4], 1
xor eax, eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
cmp word [ebp - 0x24c], ax
jne 0x4596c9
mov eax, ebx
jmp 0x4596d6
lea eax, [ebp - 0x24c]
push eax
call fcn.00438238
pop ecx
push eax
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x28]
call fcn.0041fba8
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.00425e23
push 0
push 1
lea ecx, [ebp - 0x28]
mov bl, al
call fcn.0041f6b8
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.0041f6b8
push 0
push 1
lea ecx, [ebp + 8]
call fcn.0041f6b8
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45972a
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x4a0b55
call fcn.0049e6bc
sub esp, 0x61c
push ebx
push esi
xor eax, eax
mov esi, edx
push edi
mov edi, ecx
mov dword [ebp - 0x10], eax
mov ebx, 0x208
mov dword [ebp - 4], eax
push ebx
push eax
lea eax, [ebp - 0x628]
push eax
call fcn.00438560
push ebx
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00438560
push 0xc
lea eax, [ebp - 0x420]
push 0x4caa2c
push eax
call fcn.00435be0
push ebx
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00438560
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp + 8]
mov eax, dword [ebp + 0x18]
cmovae ecx, dword [ebp + 8]
add eax, eax
push eax
push ecx
lea eax, [ebp - 0x218]
push eax
call fcn.00435be0
add esp, 0x3c
cmp dword [esi + 0x14], 8
jb 0x4597b6
mov esi, dword [esi]
lea eax, [ebp - 0x218]
push eax
push 0x104
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x420]
push eax
push esi
push 0x4caa60
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x628]
mov ecx, edi
push eax
call fcn.0041eeaf
push 0
push 1
lea ecx, [ebp + 8]
call fcn.0041f6b8
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x459809
Capabilities:
Get file version info

Disassembly:
mov eax, 0x4a0b80
call fcn.0049e6bc
sub esp, 0x430
and dword [ebp - 0x18], 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x20], edi
xor ebx, ebx
inc ebx
push str.1.0.0.0
mov dword [ebp - 4], ebx
call fcn.0041eeaf
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 0
cmovae eax, dword [ebp + 8]
push eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0x34
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
je 0x4598f4
push ebx
call fcn.00434eee
cmp dword [ebp + 0x1c], 8
mov esi, eax
pop ecx
push esi
push ebx
lea ecx, [ebp + 8]
cmovae ecx, dword [ebp + 8]
push 0
push ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4598ed
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x4caa40
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4598ed
mov ecx, dword [ebp - 0x1c]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
lea eax, [ebp - 0x43c]
push str._d._d._d._d
push eax
call fcn.00425e3f
lea eax, [ebp - 0x43c]
mov ecx, esp
push eax
call fcn.0041ee3b
lea ecx, [ebp - 0x3c]
call fcn.0045d9ed
add esp, 0x18
mov ecx, edi
push eax
call fcn.0041eed4
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.0041f6b8
push esi
call fcn.00435bbf
pop ecx
push 0
push 1
lea ecx, [ebp + 8]
call fcn.0041f6b8
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45993b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x4a0ba2
call fcn.0049e6bc
mov eax, 0x1040
call fcn.00442250
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], eax
push 0xffc
push eax
mov dword [ebp - 0x104c], eax
lea eax, [ebp - 0x1048]
push eax
call fcn.00438560
mov edi, dword [0x52e140]
add esp, 0xc
push 0x10
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x4599af
push 0x4caa14
mov ecx, esi
call fcn.0041eeaf
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.0041f6b8
mov eax, esi
jmp 0x459aef
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebx
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
lea eax, [ebp - 0x104c]
push ebx
push esi
push eax
call fcn.00435be0
and dword [ebp - 0x1c], 0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x2c], ax
push 7
pop edi
mov dword [ebp - 0x18], edi
xor esi, esi
mov byte [ebp - 4], 1
push 0x2a
pop eax
test ebx, ebx
jle 0x459a3f
movzx ecx, word [ebp + esi*2 - 0x104c]
mov dword [ebp - 0x14], eax
test cx, cx
movzx edx, ax
mov eax, ecx
cmovne edx, eax
xor eax, eax
mov word [ebp - 0x14], dx
mov word [ebp - 0x12], ax
test dx, dx
je 0x459a27
lea eax, [ebp - 0x14]
push eax
call fcn.00438238
pop ecx
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004232bf
inc esi
push 0x2a
pop eax
cmp esi, ebx
jl 0x4599f8
mov edi, dword [ebp - 0x18]
cmp dword [ebp + 0x1c], 8
lea esi, [ebp + 8]
cmovae esi, dword [ebp + 8]
xor ebx, ebx
cmp word [esi], bx
jne 0x459a55
mov eax, ebx
jmp 0x459a5f
push esi
call fcn.00438238
mov edi, dword [ebp - 0x18]
pop ecx
push eax
push ebx
push esi
lea ecx, [ebp - 0x2c]
call fcn.0042207e
mov ecx, dword [ebp + 0x18]
inc ecx
push 0x2a
add ecx, eax
pop esi
cmp edi, 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
cmp word [eax + ecx*2], si
jne 0x459a86
inc ecx
jmp 0x459a73
mov edx, ecx
cmp edi, 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
cmp word [eax + edx*2], si
je 0x459a9b
inc edx
jmp 0x459a88
xor eax, eax
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x3c], ebx
mov word [ebp - 0x4c], ax
sub edx, ecx
mov byte [ebp - 4], 2
push edx
push ecx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x4c]
call fcn.0041ef03
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x4c]
push eax
call fcn.004231cd
push ebx
push 1
lea ecx, [ebp - 0x4c]
call fcn.0041f6b8
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.0041f6b8
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.0041f6b8
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x459c75
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x4a0c0e
call fcn.0049e6bc
sub esp, 0xe0
push ebx
push esi
push edi
mov bl, dl
mov bh, cl
xor edi, edi
mov dword [ebp - 4], 1
push edi
lea edx, [ebp + 8]
lea ecx, [ebp - 0xa4]
call fcn.0045ddba
pop ecx
push edi
lea edx, [ebp + 0x20]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x8c]
call fcn.0045ddba
pop ecx
push 0x3c
pop esi
push 0x38
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 3
push edi
push eax
mov dword [ebp - 0x74], esi
call fcn.00438560
add esp, 0xc
lea eax, [ebp - 0x74]
push esi
push edi
push eax
call fcn.00438560
xor eax, eax
mov dword [ebp - 0x74], esi
add esp, 0xc
mov dword [ebp - 0x6c], edi
test bl, bl
mov dword [ebp - 0x70], 0x40
mov dword [ebp - 0x68], 0x4caa08
setne al
cmp dword [ebp - 0x90], 8
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0xa4]
cmovae eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x78], 8
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x8c]
cmovae eax, dword [ebp - 0x8c]
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x459d56
test bh, bh
je 0x459d46
push 0xffffffffffffffff
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov edi, eax
jmp 0x459e46
push 0x44
pop esi
push esi
lea eax, [ebp - 0xec]
push edi
push eax
call fcn.00438560
mov eax, 0x1f4
mov dword [ebp - 0xec], esi
mov dword [ebp - 0xcc], eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0xc8], eax
add esp, 0xc
xor eax, eax
mov word [ebp - 0xbc], ax
lea eax, [ebp + 8]
push eax
call fcn.00421f0c
mov byte [ebp - 4], 4
or edi, 0xffffffff
cmp dword [ebp + 0x30], 0
jbe 0x459dc8
mov esi, 0x4ca9f4
push esi
call fcn.004380e0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00425250
push edi
push 0
lea eax, [ebp + 0x20]
push eax
lea ecx, [ebp - 0x28]
call fcn.004251aa
mov eax, dword [ebp - 0x18]
inc eax
push eax
call fcn.00434eee
cmp dword [ebp - 0x14], 0x10
mov esi, eax
pop ecx
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push ecx
mov ecx, dword [ebp - 0x18]
inc ecx
push ecx
push esi
call fcn.00439458
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xec]
push eax
xor eax, eax
push eax
push eax
push 0x100
push eax
push eax
push eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push esi
test eax, eax
jne 0x459e1b
call fcn.00435bbf
pop ecx
jmp 0x459e3a
call fcn.00435bbf
pop ecx
test bh, bh
je 0x459e37
push 0x32
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x459e25
mov edi, dword [ebp - 0x30]
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.0041f358
push 0
push 1
lea ecx, [ebp - 0x8c]
call fcn.0041f6b8
push 0
push 1
lea ecx, [ebp - 0xa4]
call fcn.0041f6b8
push 0
push 1
lea ecx, [ebp + 8]
call fcn.0041f358
push 0
push 1
lea ecx, [ebp + 0x20]
call fcn.0041f358
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x459e8f
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov eax, 0x4a0c30
call fcn.0049e6bc
sub esp, 0x260
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.00425bc4
mov dword [ebp - 0x18], eax
push 0x228
lea eax, [ebp - 0x268]
mov byte [ebp - 4], 1
push edi
push eax
mov dword [ebp - 0x26c], edi
call fcn.00438560
add esp, 0xc
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x45a031
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x26c], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x459ff3
push 8
pop ebx
xor eax, eax
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x24], edi
mov word [ebp - 0x34], ax
cmp word [ebp - 0x248], ax
jne 0x459f28
mov eax, edi
jmp 0x459f35
lea eax, [ebp - 0x248]
push eax
call fcn.00438238
pop ecx
push eax
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x34]
call fcn.0041fba8
mov byte [ebp - 4], 2
lea ecx, [ebp + 8]
cmp dword [ebp + 0x1c], ebx
lea edx, [ebp + 8]
mov eax, dword [ebp + 0x18]
cmovae ecx, dword [ebp + 8]
cmovae edx, dword [ebp + 8]
push edx
mov edx, 0x439679
lea eax, [ecx + eax*2]
lea ecx, [ebp + 8]
cmovae ecx, dword [ebp + 8]
push eax
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00425dba
cmp dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x34]
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x34]
cmovae ecx, dword [ebp - 0x34]
cmovae edx, dword [ebp - 0x34]
push edx
mov edx, 0x439679
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x34]
cmovae ecx, dword [ebp - 0x34]
push eax
push ecx
lea ecx, [ebp - 0x38]
call fcn.00425dba
add esp, 0x18
lea edx, [ebp + 8]
lea ecx, [ebp - 0x34]
call fcn.00425e23
test al, al
je 0x459fce
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x18]
call fcn.004250e2
mov ecx, dword [ebp - 0x264]
mov dword [eax], ecx
push edi
push 1
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.0041f6b8
lea eax, [ebp - 0x26c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x459f0b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx]
mov dword [ebp - 0x1c], eax
cmp eax, ecx
je 0x45a031
push dword [eax + 0x10]
push edi
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x45a021
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [ebp - 0x1c]
call fcn.0042138e
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x18]
jne 0x45a006
lea ecx, [ebp - 0x18]
call fcn.00425133
push edi
push 1
lea ecx, [ebp + 8]
call fcn.0041f6b8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45a2e4
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1294
call fcn.00442250
mov eax, dword [0x530018]
push ebx
push esi
xor ebx, ebx
mov dword [esp + 0x10], ebx
push edi
mov edi, ecx
test al, 1
jne 0x45a331
or eax, 1
mov dword [0x530014], 0xf
push 0x4a9eb0
mov dword [0x530018], eax
mov dword [0x530010], ebx
mov byte [0x530000], bl
call fcn.0043837c
pop ecx
cmp dword [0x530010], ebx
je 0x45a343
push 0x530000
jmp 0x45a43e
lea eax, [esp + 0xc]
mov dword [esp + 0xc], ebx
push eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x45a3ff
push dword [esp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [esp + 0x10], esi
test esi, esi
je 0x45a3f2
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x45a3d4
mov ecx, dword [esi + 0x190]
lea eax, [ecx + ebx]
cmp eax, 0x1000
jae 0x45a3c2
push ecx
lea eax, [esi + 0x194]
push eax
lea eax, [esp + 0x2a8]
add eax, ebx
push eax
call fcn.00435be0
add ebx, dword [esi + 0x190]
add esp, 0xc
mov esi, dword [esi]
test esi, esi
jne 0x45a38c
mov esi, dword [esp + 0x10]
add esi, 8
push esi
call fcn.0041a2f2
pop ecx
push eax
push esi
jmp 0x45a431
push esi
add eax, 0xf0000000
push ebx
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x10]
jmp 0x45a404
mov esi, 0x4ca9e4
push esi
call fcn.004380e0
jmp 0x45a3cf
add eax, 0xe0000000
test eax, eax
je 0x45a40f
mov esi, 0x4ca9ec
jmp 0x45a3f7
cmp byte [esp + 0x2a0], bl
je 0x45a428
lea eax, [esp + 0x2a0]
push eax
call fcn.004380e0
pop ecx
mov ebx, eax
push ebx
lea eax, [esp + 0x2a4]
push eax
mov esi, 0x530000
mov ecx, esi
call fcn.0041f9e0
push esi
mov ecx, edi
call fcn.00421f0c
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret