joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407e5f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c0c50]
jne 0x407e69
repz ret
jmp fcn.0040c59d

Function at 0x40b2f0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406090
and dword [ebp - 4], 0
cmp dword [0x4ca620], 0
mov ebx, eax
jne 0x40b3a1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b452
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b452
push eax
call fcn.0040601e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4ca620], eax
call esi
push eax
call fcn.0040601e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4ca624], eax
call esi
push eax
call fcn.0040601e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4ca628], eax
call esi
push eax
call fcn.0040601e
pop ecx
mov dword [0x4ca630], eax
test eax, eax
je 0x40b3a1
push 0x4bcf10
push edi
call esi
push eax
call fcn.0040601e
pop ecx
mov dword [0x4ca62c], eax
mov eax, dword [0x4ca62c]
cmp eax, ebx
je 0x40b3f9
cmp dword [0x4ca630], ebx
je 0x40b3f9
push eax
call fcn.00406099
push dword [0x4ca630]
mov esi, eax
call fcn.00406099
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b3f9
test edi, edi
je 0x40b3f9
call esi
test eax, eax
je 0x40b3f0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b3f0
test byte [ebp - 0xc], 1
jne 0x40b3f9
or dword [ebp + 0x10], 0x200000
jmp 0x40b432
mov eax, dword [0x4ca624]
cmp eax, ebx
je 0x40b432
push eax
call fcn.00406099
pop ecx
test eax, eax
je 0x40b432
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b432
mov eax, dword [0x4ca628]
cmp eax, ebx
je 0x40b432
push eax
call fcn.00406099
pop ecx
test eax, eax
je 0x40b432
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4ca620]
call fcn.00406099
pop ecx
test eax, eax
je 0x40b452
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b454
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403a50
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x496d50]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x1c], 8
mov dword [ebx + 0x14], edi
mov dword [ebx + 0x10], edi
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
jae 0x403a97
lea eax, [ebp + 8]
push 0x473130
push eax
lea eax, [ebp - 0x408]
push eax
call fcn.0044fd24
add esp, 0xc
test eax, eax
je 0x403ace
sub esp, 0x1c
mov edi, esp
mov ecx, 7
lea esi, [ebp + 8]
push str._s_cant_be_opened_n
rep movsd dword es:[edi], dword [esi]
call fcn.0044fd6b
add esp, 0x20
jmp 0x403b35
mov ecx, dword [ebp - 0x408]
push ecx
push 0x400
lea edx, [ebp - 0x404]
push 1
push edx
call fcn.00450072
add esp, 0x10
cmp eax, edi
je 0x403b1f
nop
lea ecx, [ebp - 0x404]
push ecx
mov esi, ebx
call fcn.004038b0
mov edx, dword [ebp - 0x408]
push edx
push 0x400
lea eax, [ebp - 0x404]
push 1
push eax
call fcn.00450072
add esp, 0x10
cmp eax, edi
jne 0x403af0
mov ecx, ebx
call fcn.00403960
mov ecx, dword [ebp - 0x408]
push ecx
call fcn.004500fc
add esp, 4
cmp dword [ebp + 0x1c], 8
jb 0x403b47
mov edx, dword [ebp + 8]
push edx
call fcn.0044e60d
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
lea eax, [ebx + 0x68]
xor ecx, ebp
pop ebx
call fcn.0044e488
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x419b30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x419b86
mov edx, dword [ebp + 8]
push 4
push edx
push 3
push eax
mov eax, dword [ebp - 4]
push str.EditFlags
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x419b90
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x42bd90
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46c39b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x496d50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
lea eax, [ebp - 0x218]
mov edi, edx
push eax
xor ebx, ebx
push edi
mov esi, ecx
mov dword [ebp - 0x238], ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, ebx
jne 0x42bf00
cmp dword [ebp + 0xc], ebx
je 0x42bee9
xor ecx, ecx
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], ebx
mov word [ebp - 0x234], cx
push 0x43
push str.There_was_a_problem_retrieving_the_necessary_environment_variable:
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], ebx
call fcn.00401740
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x42be21
sub eax, edx
sar eax, 1
push eax
mov eax, edi
lea esi, [ebp - 0x234]
call fcn.00412040
push 0x17
mov eax, str.._Rkill_has_terminated_
call fcn.00412040
push str._doesnt_exist__Rkill_Terminated_
push ecx
push edi
push 0x49ae58
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 8
mov esi, eax
push esi
call fcn.0042ee30
mov edx, dword [esi]
mov eax, dword [edx + 4]
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x42be94
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x42be94
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x42beb3
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x42beac
or eax, 4
push ebx
push eax
call fcn.00402d10
mov edx, dword [ebp + 8]
cmp dword [edx + 0x354], ebx
jne 0x42bee2
cmp dword [ebp - 0x220], 8
mov eax, dword [ebp - 0x234]
jae 0x42bed3
lea eax, [ebp - 0x234]
push 0x40
push str.Rkill_Error
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call fcn.004516a6
xor eax, eax
push ebx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
mov word [esi], ax
push 0x473064
jmp 0x42bf17
xor ecx, ecx
push eax
lea edx, [ebp - 0x218]
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
mov word [esi], cx
push edx
mov ecx, esi
call fcn.00401740
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044e488
mov esp, ebp
pop ebp
ret
Function at 0x465b57
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x496d50]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0045903e
and dword [ebp - 0x14], 0
cmp dword [0x49beb4], 0
mov dword [ebp - 0x18], eax
jne 0x465c0a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x465cb2
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x472b24
push ebx
call edi
test eax, eax
je 0x465cb2
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x49beb4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x49beb8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x49bebc], eax
call edi
push eax
call esi
mov dword [0x49bec4], eax
test eax, eax
je 0x465c0a
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x49bec0], eax
mov eax, dword [0x49bec0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x465c63
cmp dword [0x49bec4], ecx
je 0x465c63
push eax
call esi
push dword [0x49bec4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x465c63
test ebx, ebx
je 0x465c63
call edi
test eax, eax
je 0x465c5a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x465c5a
test byte [ebp - 8], 1
jne 0x465c63
or dword [ebp + 0x10], 0x200000
jmp 0x465c96
mov eax, dword [0x49beb8]
cmp eax, dword [ebp - 0x18]
je 0x465c96
push eax
call esi
test eax, eax
je 0x465c96
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x465c96
mov eax, dword [0x49bebc]
cmp eax, dword [ebp - 0x18]
je 0x465c96
push eax
call esi
test eax, eax
je 0x465c96
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x49beb4]
call esi
test eax, eax
je 0x465cb2
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x465cb4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044e488
leave
ret
Function at 0x401508
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push esi
push edi
push 0x11
xor eax, eax
pop ecx
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x10]
mov dword [ebp - 0x54], 0x44
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x28], 1
push eax
push 0x104
mov word [ebp - 0x24], 5
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x25c]
push eax
call esi
xor edi, edi
cmp word [ebp + eax*2 - 0x25e], 0x5c
jne 0x401577
lea eax, [ebp - 0x25c]
push eax
call esi
mov word [ebp + eax*2 - 0x25e], di
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x25c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 5
pop edi
neg eax
sbb eax, eax
pop esi
inc eax
leave
ret

Function at 0x4015a5
Capabilities:
Read file on windows

Disassembly:
push esi
push 0x403064
push dword [esp + 0xc]
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
pop ecx
test esi, esi
pop ecx
jne 0x4015bf
pop esi
ret
push edi
push 0
push 0x194b39
push esi
call dword [sym.imp.MSVCRT.dll_fseek]
mov edi, dword [esp + 0x1c]
push 0xc
pop ecx
xor eax, eax
push esi
push 0x30
rep stosd dword es:[edi], eax
push 1
pop edi
push edi
push dword [esp + 0x28]
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x1c
cmp eax, 0x30
je 0x4015f4
xor edi, edi
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
mov eax, edi
pop edi
pop esi
ret

Function at 0x401601
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
call dword [sym.imp.MSVCRT.dll_malloc]
mov ecx, esi
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
push 0
push dword [esp + 0x1c]
shr ecx, 2
push dword [esp + 0x1c]
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0x10
cmp eax, 0xffffffff
je 0x401652
push dword [esp + 0x10]
push esi
push 1
push ebx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, esi
je 0x40165e
push ebx
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
xor eax, eax
jmp 0x401660
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x405036
Capabilities:
Create thread

Disassembly:
push 0x24
mov eax, 0x4812e9
call fcn.00462fb8
mov esi, ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x30]
call fcn.0045c6d3
xor ebx, ebx
push ebx
push 0x4b3bb0
push 0x4b3b98
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.00466c69
add esp, 0x14
lea ecx, [ebp - 0x30]
mov edi, eax
lea eax, [ebp - 0x24]
push eax
call fcn.0045c75b
mov ecx, dword [ebp - 0x24]
dec ecx
dec ecx
je 0x405209
dec ecx
je 0x4051dd
dec ecx
je 0x4051a2
dec ecx
je 0x40516d
dec ecx
je 0x4050c2
dec ecx
je 0x4050b8
dec ecx
jne 0x405273
push 0x4b6210
lea ecx, [ebp - 0x30]
call fcn.0045c75b
jmp 0x405273
call fcn.00405b32
jmp 0x405273
push 0x4b99dc
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
push 0x4b6200
lea ecx, [ebp - 0x30]
call fcn.0045c75b
push 0x4b6204
lea ecx, [ebp - 0x30]
call fcn.0045c75b
push 0x4b6208
lea ecx, [ebp - 0x30]
call fcn.0045c75b
push 0x4b620c
lea ecx, [ebp - 0x30]
call fcn.0045c75b
push 0x4b6210
lea ecx, [ebp - 0x30]
call fcn.0045c75b
mov eax, dword [0x4b6224]
test eax, eax
je 0x405124
push eax
call fcn.0040e9f1
pop ecx
mov dword [0x4b6224], ebx
cmp dword [0x4b621c], ebx
jne 0x40515d
push 1
call fcn.0046273d
mov dword [esp], 0x4b61fc
push ebx
push edi
push 0x405294
push ebx
mov dword [0x4b621c], eax
push ebx
mov byte [eax], 1
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
mov dword [0x4b62ac], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0x4b99dc
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
jmp 0x405273
lea eax, [ebp - 0xd]
mov byte [ebp - 0xd], bl
push eax
lea ecx, [ebp - 0x30]
call fcn.0045c745
xor eax, eax
cmp byte [ebp - 0xd], 1
sete al
mov dword [0x4b9a98], eax
test eax, eax
je 0x405198
call fcn.0045ce86
jmp 0x405273
call fcn.0045d865
jmp 0x405273
lea ecx, [ebp - 0x20]
call fcn.0045c6ec
push 4
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.0045c7e9
lea eax, [ebp - 0x20]
push eax
call fcn.0045d076
pop ecx
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
call fcn.00403510
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], bl
call fcn.0045c702
jmp 0x405273
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x30]
call fcn.0045c75b
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x30]
call fcn.0045c75b
cmp dword [ebp - 0x1c], ebx
sete al
movzx eax, al
push eax
push dword [ebp - 0x18]
call fcn.0045d81a
jmp 0x40523d
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x30]
call fcn.0045c75b
lea ecx, [ebp - 0x30]
cmp dword [ebp - 0x1c], ebx
jne 0x405241
lea eax, [ebp - 0x18]
push eax
call fcn.0045c75b
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x30]
call fcn.0045c75b
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.0045d7f8
pop ecx
pop ecx
jmp 0x405273
lea eax, [ebp - 0x1c]
push eax
call fcn.0045c75b
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x30]
call fcn.0045c75b
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x30]
call fcn.0045c75b
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.0045ceda
add esp, 0xc
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.00403477
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0045c6f6
call fcn.00462f86
ret 8
Function at 0x45b764
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x481a66
call fcn.00462feb
mov esi, ecx
mov dword [ebp - 0x30], esi
mov edi, dword [ebp + 8]
or ebx, 0xffffffff
cmp edi, ebx
jne 0x45b786
xor eax, eax
jmp 0x45b8e0
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x45b7b0
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x45b7b0
dec dword [edx]
mov edx, dword [esi + 0x20]
mov eax, dword [ebp + 8]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], al
jmp 0x45b8e0
cmp dword [esi + 0x50], 0
je 0x45b8de
mov ecx, esi
call fcn.00459f7d
xor ecx, ecx
cmp dword [esi + 0x40], ecx
jne 0x45b7dd
push dword [esi + 0x50]
push edi
call fcn.004592ee
test al, al
pop ecx
pop ecx
cmovne ebx, edi
jmp 0x45b8de
mov eax, dword [ebp + 8]
push ecx
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x28], cl
lea ecx, [ebp - 0x28]
push 8
mov byte [ebp - 0x2c], al
mov dword [ebp - 0x14], 0xf
call fcn.00408f12
and dword [ebp - 4], 0
lea eax, [esi + 0x48]
mov dword [ebp - 0x40], eax
mov edi, dword [ebp - 0x14]
mov esi, dword [esi + 0x40]
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
cmp edi, 0x10
lea edx, [ebp - 0x28]
mov edi, dword [esi]
cmovae ecx, dword [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
add eax, ecx
push eax
push edx
lea eax, [ebp - 0x38]
mov ecx, esi
push eax
lea eax, [ebp - 0x2b]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x40]
call dword [edi + 0x1c]
test eax, eax
js 0x45b8d2
cmp eax, 1
jg 0x45b8b7
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
cmp edi, 0x10
mov edx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x30]
cmovae eax, ecx
sub edx, eax
mov dword [ebp - 0x3c], edx
je 0x45b888
push dword [esi + 0x50]
cmp edi, 0x10
lea eax, [ebp - 0x28]
push edx
cmovae eax, ecx
push 1
push eax
call fcn.004656fe
mov edx, dword [ebp - 0x3c]
add esp, 0x10
cmp edx, eax
jne 0x45b8d2
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x2c]
mov byte [esi + 0x45], 1
cmp dword [ebp - 0x38], eax
jne 0x45b8b2
test edx, edx
jne 0x45b808
cmp dword [ebp - 0x18], 0x20
jae 0x45b8d2
push edx
push 8
lea ecx, [ebp - 0x28]
call fcn.0045a02c
jmp 0x45b805
mov ebx, dword [ebp + 8]
jmp 0x45b8d2
cmp eax, 3
jne 0x45b8d2
mov eax, dword [ebp - 0x30]
push dword [eax + 0x50]
push dword [ebp - 0x2c]
call fcn.004592ee
test al, al
pop ecx
cmovne ebx, dword [ebp + 8]
pop ecx
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00401334
mov eax, ebx
call fcn.00462f9a
ret 4

Function at 0x45c534
Capabilities:
Create thread
Resume thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x4b9b3d], 0
jne 0x45c57b
mov eax, dword [0x4b9a74]
test eax, eax
je 0x45c553
push 1
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
lea eax, [ebp - 4]
push eax
push 4
xor eax, eax
push eax
push 0x45c57f
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
cmp dword [ebp - 4], 0
mov dword [0x4b9a74], eax
jbe 0x45c57b
push eax
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov esp, ebp
pop ebp
ret
Function at 0x45c923
Capabilities:
Terminate process
Terminate thread

Disassembly:
cmp byte [0x4b9b3e], 0
je 0x45c94f
push 0
push dword [0x4b9a88]
mov byte [0x4b9a84], 0
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push 0
push dword [0x4b9a8c]
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
ret

Function at 0x45c950
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x4b9b3e], 0
je 0x45c9c8
push ebx
push esi
push 0xc
mov byte [0x4b9a84], 1
call fcn.0046273d
mov esi, eax
xor ebx, ebx
pop ecx
test esi, esi
je 0x45c980
push edi
mov edi, esi
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
jmp 0x45c982
mov esi, ebx
cmp byte [ebp + 8], bl
jne 0x45c998
push esi
call fcn.0045c9ca
pop ecx
push ebx
push ebx
push esi
push 0x45cb8a
jmp 0x45c9ab
mov eax, dword [ebp + 0xc]
push ebx
push ebx
mov dword [esi], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [esi + 8], eax
push 0x45cb44
mov esi, dword [sym.imp.KERNEL32.DLL_CreateThread]
push ebx
push ebx
call esi
push ebx
push ebx
push ebx
push 0x45caab
push ebx
push ebx
call esi
pop esi
mov dword [0x4b9a8c], eax
pop ebx
pop ebp
ret

Function at 0x45c9ca
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4b26f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
push 0x1fc
push eax
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x202]
push eax
call fcn.004653c0
add esp, 0xc
call fcn.00406d75
mov esi, eax
mov dword [ebp - 0x208], esi
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push eax
push esi
lea eax, [ebp - 0x204]
push str.__s___i
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
lea edi, [ebp - 0x218]
stosd dword es:[edi], eax
push 0x44
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x25c]
pop edi
push edi
push 0
push eax
call fcn.004653c0
add esp, 0x1c
mov dword [ebp - 0x25c], edi
lea eax, [ebp - 0x218]
xor edi, edi
push eax
lea eax, [ebp - 0x25c]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x204]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
push 0x10
call fcn.0046273d
pop ecx
test eax, eax
je 0x45ca93
mov edi, eax
lea esi, [ebp - 0x218]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x208]
jmp 0x45ca95
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
mov dword [ebx], esi
xor ecx, ebp
pop esi
mov dword [ebx + 4], eax
pop ebx
call fcn.00462f14
mov esp, ebp
pop ebp
ret
Function at 0x45cadf
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
push 0x44
pop esi
push esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x54]
xor edi, edi
push edi
push eax
call fcn.004653c0
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x10]
add esp, 0xc
mov dword [ebp - 0x54], esi
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebx]
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
push 0x10
call fcn.0046273d
pop ecx
test eax, eax
je 0x45cb38
mov edi, eax
lea esi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x45cb3a
mov eax, edi
pop edi
pop esi
mov dword [ebx + 4], eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45cbe0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [0x4b26f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x434]
push esi
push edi
xor esi, esi
push 0x228
push esi
push eax
mov dword [ebp - 0x438], esi
call fcn.004653c0
add esp, 0xc
push esi
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x45cd07
lea eax, [ebp - 0x438]
mov dword [ebp - 0x438], 0x22c
push eax
push edi
call sub.KERNEL32.DLL_Process32FirstW
test eax, eax
je 0x45cd00
call fcn.00406d75
mov esi, eax
mov ecx, ebx
push esi
call fcn.0045c8e0
push esi
call fcn.0040e9f1
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop ecx
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004653c0
add esp, 0xc
lea eax, [ebp - 0x414]
mov ecx, ebx
push eax
call fcn.0045c8e0
push dword [ebp - 0x430]
mov ecx, ebx
call fcn.0045c7e9
push dword [ebp - 0x430]
push 0
push 0x410
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov dword [ebp - 0x43c], eax
test eax, eax
je 0x45ccd6
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 0
push eax
call sub.PSAPI.DLL_GetModuleFileNameExW
push dword [ebp - 0x43c]
call esi
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.0045c8e0
lea eax, [ebp - 0x438]
push eax
push edi
call sub.KERNEL32.DLL_Process32NextW
test eax, eax
jne 0x45cc64
push edi
call esi
mov al, 1
jmp 0x45cd09
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00462f14
mov esp, ebp
pop ebp
ret

Function at 0x45cd1a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov edi, eax
test edi, edi
jne 0x45cd40
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor al, al
jmp 0x45cd60
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp + 0xc]
and dword [ecx], 0
cmp esi, 1
pop esi
sete al
pop edi
pop ebp
ret
Function at 0x45ce86
Capabilities:
Create thread
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
push edi
push edi
push 0x45d894
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
push edi
push edi
push 0x45d8c7
push 0xe
mov dword [0x4b9aa0], eax
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x4b9aa4], eax
cmp dword [0x4b9aa0], edi
je 0x45ced5
lea eax, [ebp - 4]
push eax
push edi
push edi
push 0x45ce28
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [0x4b9acc], eax
pop edi
mov esp, ebp
pop ebp
ret