joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, 8
mov esi, str.QQScreenshot.exe
lea edi, [ebp - 0x254]
rep movsd dword es:[edi], dword [esi]
push 0x228
xor ebx, ebx
lea eax, [ebp - 0x22c]
push ebx
push eax
movsw word es:[edi], word [esi]
call sub.MSVCR100.dll_memset
add esp, 0xc
push ebx
push 2
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [ebp - 0x230]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x401082
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040172f
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x401090
lea ecx, [ebp - 0x20c]
lea eax, [ebp - 0x254]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4010c6
test dx, dx
je 0x4010c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4010c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4010a0
xor eax, eax
jmp 0x4010cb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4010df
lea edx, [ebp - 0x230]
push edx
push esi
call edi
test eax, eax
jne 0x401090
jmp 0x4010e5
mov ebx, dword [ebp - 0x228]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0040172f
mov esp, ebp
pop ebp
ret
Function at 0x401100
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [str.QQ.exe]
mov edx, dword [0x4021b8]
mov ecx, dword [0x4021b4]
push ebx
push esi
mov dword [ebp - 0x238], edx
mov edx, dword [0x4021c4]
mov dword [ebp - 0x240], eax
mov ax, word [0x4021bc]
mov dword [ebp - 0x23c], ecx
mov ecx, dword [str.TIM.exe]
push 0x228
mov dword [ebp - 0x24c], edx
xor ebx, ebx
mov word [ebp - 0x234], ax
mov eax, dword [0x4021c8]
mov dword [ebp - 0x250], ecx
mov ecx, dword [0x4021cc]
lea edx, [ebp - 0x22c]
push ebx
push edx
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x244], ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
push ebx
push 2
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x4011cb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040172f
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x4011e0
lea ecx, [ebp - 0x20c]
lea eax, [ebp - 0x240]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401216
test dx, dx
je 0x401212
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401216
add eax, 4
add ecx, 4
test dx, dx
jne 0x4011f0
xor eax, eax
jmp 0x40121b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x401273
lea ecx, [ebp - 0x20c]
lea eax, [ebp - 0x250]
jmp 0x401230
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401256
test dx, dx
je 0x401252
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401256
add eax, 4
add ecx, 4
test dx, dx
jne 0x401230
xor eax, eax
jmp 0x40125b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x401273
lea ecx, [ebp - 0x230]
push ecx
push esi
call edi
test eax, eax
jne 0x4011e0
jmp 0x401279
mov ebx, dword [ebp - 0x228]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0040172f
mov esp, ebp
pop ebp
ret
Function at 0x4012a0
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
push edi
push eax
push 4
xor edi, edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], 0x1c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
jne 0x401302
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040172f
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Thread32Next]
lea esp, [esp]
mov ecx, dword [ebp + 8]
cmp dword [ebp - 0x14], ecx
je 0x401325
lea edx, [ebp - 0x20]
push edx
push esi
call ebx
test eax, eax
jne 0x401310
jmp 0x401328
mov edi, dword [ebp - 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop ebx
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0040172f
mov esp, ebp
pop ebp
ret

Function at 0x401350
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
cmp eax, ecx
je 0x401391
push esi
mov edx, 0x320033
push edi
movzx esi, word [eax + 0x14]
mov edi, dword [eax + 0x18]
cmp dword [edi + esi - 0xc], edx
je 0x40138c
mov eax, dword [eax]
cmp eax, ecx
jne 0x401373
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [eax + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401680
Capabilities:
Terminate process

Disassembly:
push esi
push 0
push str.5B3838F5_0C81_46D9_A4C0_6EA28CA3E942
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x4016a2
call fcn.00401000
test eax, eax
jne 0x4016c5
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00401100
mov esi, eax
test esi, esi
je 0x4016c5
push esi
call fcn.004012a0
add esp, 4
test eax, eax
je 0x4016c5
push esi
mov ecx, eax
call fcn.004013a0
add esp, 4
xor eax, eax
pop esi
ret

Function at 0x40172f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x401739
repz ret
jmp fcn.00401ae1
Function at 0x405c1c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0x40
lea eax, [edi + 5]
push eax
push ebx
call sub.kernel32.dll_VirtualProtect
jmp 0x405e56
test edi, edi
jle 0x40609b
mov ecx, edi
dec ecx
test ecx, ecx
jl 0x40609b
inc ecx
xor esi, esi
mov eax, ebx
add eax, 5
xor edx, edx
push edx
push eax
mov eax, esi
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov byte [eax], 0x90
inc esi
dec ecx
jne 0x405e6c
jmp 0x40609b
mov byte [ebx], 0xe9
mov edx, ebx
mov eax, edx
add eax, 5
push eax
mov eax, dword [ebp - 4]
pop ecx
sub eax, ecx
inc edx
mov dword [edx], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
add edi, 5
push edi
push ebx
call sub.kernel32.dll_VirtualProtect
jmp 0x4062c5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x409290
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
jmp 0x409498
xor eax, eax
mov al, byte [ebp - 5]
lea eax, [eax + eax*4]
mov edx, dword [ebp - 4]
cmp byte [edx + eax + 0x40], 0xe9
jne 0x409dc1
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 4]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0x4096e4
cmp byte [ebp - 5], 5
je 0x4096f4
cmp byte [ebp - 5], 0xa
jne 0x409948
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov edx, dword [edx + eax*4 + 4]
mov eax, dword [ebp - 4]
call fcn.004087dc
mov dword [ebp - 0x10], eax
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 4]
mov byte [eax], 0xb8
jmp 0x409925
push 4
lea ecx, [ebp - 0x10]
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov edx, dword [edx + eax*4 + 4]
inc edx
mov eax, dword [0x41b1bc]
mov eax, dword [eax]
call fcn.0040409c
jmp 0x409b82
mov dword [ebp - 0x14], 0x41b0b4
jmp 0x409b65
push 5
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov edx, dword [edx + eax*4 + 4]
mov eax, dword [0x41b1bc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
call fcn.0040409c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 5
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 4]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0x409dbb
mov byte [ebp - 6], 1
jmp 0x409dc5
mov byte [ebp - 6], 0
mov al, byte [ebp - 6]
mov esp, ebp
pop ebp
ret

Function at 0x409dcc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
jmp 0x409fcf
xor eax, eax
mov al, byte [ebp - 5]
lea eax, [eax + eax*4]
mov edx, dword [ebp - 4]
cmp byte [edx + eax + 0x40], 0xe9
jne 0x40a477
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 4]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0x40a212
push 5
xor eax, eax
mov al, byte [ebp - 5]
lea eax, [eax + eax*4]
mov edx, dword [ebp - 4]
lea ecx, [edx + eax + 0x40]
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov edx, dword [edx + eax*4 + 4]
mov eax, dword [0x41b1bc]
mov eax, dword [eax]
call fcn.0040409c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 5
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 4]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0x40a471
mov byte [ebp - 6], 1
jmp 0x40a47b
mov byte [ebp - 6], 0
mov al, byte [ebp - 6]
mov esp, ebp
pop ebp
ret
Function at 0x418a3c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x418b62
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00418f45
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
mov eax, dword [0x41b1c0]
mov eax, dword [eax]
call fcn.0040dcc4
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x2c
call fcn.00406974
mov edx, eax
lea eax, [ebp - 0x20]
call fcn.00403740
mov edx, dword [ebp - 0x20]
mov eax, dword [0x41b1bc]
mov eax, dword [eax]
xor ecx, ecx
call fcn.004042ec
mov eax, dword [ebp - 0x1c]
call fcn.004037e4
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, 5
call fcn.00406974
mov edx, eax
lea eax, [ebp - 0x28]
call fcn.00403740
mov edx, dword [ebp - 0x28]
mov eax, dword [0x41b1bc]
mov eax, dword [eax]
xor ecx, ecx
call fcn.004042ec
mov eax, dword [ebp - 0x24]
call fcn.004037e4
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x2b
call fcn.00406974
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.00403740
mov edx, dword [ebp - 0x30]
mov eax, dword [0x41b1bc]
mov eax, dword [eax]
xor ecx, ecx
call fcn.004042ec
mov eax, dword [ebp - 0x2c]
call fcn.004037e4
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.00419010
add esp, 0x20
push 1
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418b69
lea eax, [ebp - 0x30]
mov edx, 6
call fcn.00403660
ret
Function at 0x418ca6
Capabilities:
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
push 0x41b0f0
push dword [ebp + 8]
call sub.msvcrt.dll_fopen
add esp, 8
mov edi, eax
push 2
push 0
push edi
call sub.msvcrt.dll_fseek
add esp, 0xc
push edi
call sub.msvcrt.dll_ftell
pop ecx
mov esi, eax
push esi
call sub.msvcrt.dll_malloc
pop ecx
mov ebx, eax
push 0
push 0
push edi
call sub.msvcrt.dll_fseek
add esp, 0xc
push edi
push esi
push 1
push ebx
call sub.msvcrt.dll_fread
add esp, 0x10
push edi
call sub.msvcrt.dll_fclose
pop ecx
mov eax, ebx
mov edx, dword [eax + 0x3c]
add edx, ebx
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
movzx edi, word [ecx + 6]
mov eax, dword [eax + 0x3c]
add eax, ebx
add eax, 0xf8
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
push dword [edx + 0x78]
push esi
push edi
push dword [ebp - 0xc]
call fcn.00418c68
add esp, 0x10
add eax, ebx
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov dword [ebp - 4], ecx
jmp 0x418dd1
push dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
push dword [eax + 0x20]
push esi
push edi
push dword [ebp - 0xc]
call fcn.00418c68
add esp, 0x10
lea edx, [ebx + eax]
mov ecx, dword [ebp - 4]
push dword [edx + ecx*4]
push esi
push edi
push dword [ebp - 0xc]
call fcn.00418c68
add esp, 0x10
add eax, ebx
push eax
call sub.msvcrt.dll_strcmp
add esp, 8
test eax, eax
jne 0x418dce
mov eax, dword [ebp - 0x10]
push dword [eax + 0x24]
push esi
push edi
push dword [ebp - 0xc]
call fcn.00418c68
add esp, 0x10
lea edx, [ebx + eax]
mov ecx, dword [ebp - 4]
movzx eax, word [edx + ecx*2]
push eax
mov edx, dword [ebp - 0x10]
push dword [edx + 0x1c]
push esi
push edi
push dword [ebp - 0xc]
call fcn.00418c68
add esp, 0x10
lea ecx, [ebx + eax]
pop eax
push dword [ecx + eax*4]
push esi
push edi
push dword [ebp - 0xc]
call fcn.00418c68
add esp, 0x10
mov esi, eax
push ebx
call sub.msvcrt.dll_free
pop ecx
mov eax, esi
jmp 0x418de0
inc dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0x18]
cmp ecx, dword [ebp - 4]
ja 0x418d41
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418de7
Capabilities:
Allocate or change rwx memory
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.00418bcc
add esp, 8
mov ebx, eax
test esi, esi
je 0x418ea2
test edi, edi
je 0x418ea2
push 0x104
lea eax, [ebp - 0x110]
push eax
push esi
call sub.kernel32.dll_GetModuleFileNameA
push edi
lea edx, [ebp - 0x110]
push edx
call fcn.00418ca6
add esp, 8
mov edi, eax
cmp edi, 0xffffffff
je 0x418ea2
push 0x41b0f3
lea ecx, [ebp - 0x110]
push ecx
call sub.msvcrt.dll_fopen
add esp, 8
mov esi, eax
push 0
push edi
push esi
call sub.msvcrt.dll_fseek
add esp, 0xc
push esi
push 5
push 1
lea eax, [ebp - 8]
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
push esi
call sub.msvcrt.dll_fclose
pop ecx
lea edx, [ebp - 0xc]
push edx
push 0x40
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
lea ecx, [ebp - 8]
mov eax, dword [ecx]
mov dword [ebx], eax
mov dl, byte [ebp - 4]
mov byte [ebx + 4], dl
lea ecx, [ebp - 0xc]
push ecx
push dword [ebp - 0xc]
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x418ea9
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x418edc
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
mov dword [ebx], 0x8b55ff8b
mov byte [ebx + 4], 0xec
lea edx, [ebp - 4]
push edx
push dword [ebp - 4]
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
pop ebx
pop ecx
pop ebp
ret

Function at 0x418ee0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x418ef9
mov edi, dword fs:[0x30]
mov eax, dword [edi + 8]
ret
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + 0x1c]
mov dword [ebp - 4], ebx
jmp 0x418f23
push esi
mov eax, dword [ebp - 4]
push dword [eax + 0x20]
call sub.kernel32.dll_lstrcmpiW
test eax, eax
je 0x418f2c
mov edx, dword [ebp - 4]
mov ecx, dword [edx]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x418f0b
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
je 0x418f3d
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 8]
jmp 0x418f3f
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x419010
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
xor ebx, ebx
push 0x200
call sub.msvcrt.dll_malloc
pop ecx
mov esi, eax
push 0
push 0
push 0
push 0
push dword [ebp + 0x1c]
call dword [ebp + 8]
mov dword [ebp - 8], eax
push 0
push dword [ebp + 0x24]
push 0
push 0
push dword [ebp + 0x18]
push dword [ebp - 8]
call dword [ebp + 0xc]
mov edi, eax
jmp 0x419085
push ebx
push dword [ebp - 4]
lea eax, [ebp - 0x208]
push eax
push esi
call fcn.00418fe3
add esp, 0x10
add ebx, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 4], edx
lea ecx, [ebx + 0x200]
push ecx
push esi
call sub.msvcrt.dll_realloc
add esp, 8
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x200
lea edx, [ebp - 0x208]
push edx
push edi
call dword [ebp + 0x10]
cmp dword [ebp - 4], 0
jne 0x419057
push edi
call dword [ebp + 0x14]
push dword [ebp - 8]
call dword [ebp + 0x14]
push 0x41b1a9
push dword [ebp + 0x20]
call sub.msvcrt.dll_fopen
add esp, 8
mov edi, eax
push edi
push 1
push ebx
push esi
call sub.msvcrt.dll_fwrite
add esp, 0x10
push edi
call sub.msvcrt.dll_fclose
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407fbf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4acd70]
jne 0x407fc9
repz ret
jmp fcn.0040c2a2

Function at 0x40a758
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404b77
and dword [ebp - 4], 0
cmp dword [0x4b17f8], 0
mov ebx, eax
jne 0x40a809
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a8ba
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a8ba
push eax
call fcn.00404b05
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4b17f8], eax
call esi
push eax
call fcn.00404b05
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4b17fc], eax
call esi
push eax
call fcn.00404b05
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4b1800], eax
call esi
push eax
call fcn.00404b05
pop ecx
mov dword [0x4b1808], eax
test eax, eax
je 0x40a809
push 0x4a8f28
push edi
call esi
push eax
call fcn.00404b05
pop ecx
mov dword [0x4b1804], eax
mov eax, dword [0x4b1804]
cmp eax, ebx
je 0x40a861
cmp dword [0x4b1808], ebx
je 0x40a861
push eax
call fcn.00404b80
push dword [0x4b1808]
mov esi, eax
call fcn.00404b80
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a861
test edi, edi
je 0x40a861
call esi
test eax, eax
je 0x40a858
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a858
test byte [ebp - 0xc], 1
jne 0x40a861
or dword [ebp + 0x10], 0x200000
jmp 0x40a89a
mov eax, dword [0x4b17fc]
cmp eax, ebx
je 0x40a89a
push eax
call fcn.00404b80
pop ecx
test eax, eax
je 0x40a89a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a89a
mov eax, dword [0x4b1800]
cmp eax, ebx
je 0x40a89a
push eax
call fcn.00404b80
pop ecx
test eax, eax
je 0x40a89a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4b17f8]
call fcn.00404b80
pop ecx
test eax, eax
je 0x40a8ba
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a8bc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40484d
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437d3d
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x404970
push ecx
lea ecx, [esi + 0x18]
call fcn.0042406d
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x404987
push ecx
lea ecx, [esi + 0x24]
call fcn.00423f7d
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4233ad
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x2c71dabe
sbb byte [edi + esi*8], ah
sub bl, bh
mov dword [ebx], esi
enter 0x5b9c, 0xffffffffffffffb2
shl dword [ecx], 1
jp 0x4233c5
mov dword [eax - 0x1dd78928], esp
sub dl, ah
or dl, bh
lds esp, [0xe2ce6ae9]
adc byte [edi + ebp*2 + 0x1c17e246], ah
inc eax
xchg ebp, eax
nop
sbb al, 0x27
pop ecx
pop ss
fcmovb st(0), st(7)
mov esp, 0xf5c61595
or dword [edi + 0x28d0648d], edi
mov byte gs:[edx - 0x5b10cae7], 0x19
js 0x42342e
pushfd
pop edx
lodsb al, byte [esi]
and esp, dword [eax + ecx*8 + 0x70120081]
mov ch, 0xdf
inc ebx
cdq
sbb eax, 0xcb93924
sbb al, ah
ja fcn.004233ad
mov al, byte [0x11b8f6f0]
sub al, 0x52
cdq
aad 0x6a
jnp 0x423480
invalid
inc ecx
sub ebp, ecx
push edx
outsb dx, byte [esi]
xchg edx, eax
push edi
test al, 0x96
stosb byte es:[edi], al
push eax
out 0xf9, al
call 0x563412f0
int1
push ebp
shr byte [ebp - 0x28], cl
cmp byte [edi - 0x743e4b5], ah
movsb byte es:[edi], byte [esi]
je 0x423466
fdivr dword [eax]
cmpsd dword [esi], dword es:[edi]
dec ebx
sbb edi, dword [eax + edi*8 - 0x6bd18b5c]
xchg esp, eax
or eax, 0x435dd9b7
xor edi, dword [ecx - 0x6f]
fldcw word [ebx - 0x78]
mov eax, dword [0xeeec1208]
mov cl, 0xe8
movsb byte es:[edi], byte [esi]
jns 0x42340c
sub dword [ecx + 0x7e07808], eax
nop
js 0x4234aa
sbb al, 0x16
pop ebx
jns 0x423483
push esp
sub dword [ecx - 0x6c], ecx
push esi
sbb ch, byte [eax]
mov dh, 0x93
xchg ebx, eax
in al, dx
aam 0xa6
xchg ebp, eax
lodsb al, byte [esi]
mov ebp, ss
xlatb
enter 0xffffffffffff8903, 0x21
xchg ecx, eax
xchg dword [ebp - 0x36ffb376], ecx
aas
sub byte [edi + 0x7c], dh
ja 0x4234c3
mov ecx, 0xa288ae2a
xor byte [ecx - 0x60835307], 0xa4
mov byte [edx - 0x53064e80], ah
jl 0x42342a
movsb byte es:[edi], byte [esi]
adc byte [edi + 0x2a], al
hlt
xchg ebp, eax
shl dword [ecx], 0x2a
int1
call 0x704640b4
pavgw mm2, qword [ebx + 0x68]
xchg byte [eax + 0x50], dh
cld
pushal
call 0x5ec33b30
xchg ebx, eax
loopne 0x4234c4
invalid
cmp eax, 0xa75ba8b2
pop ebp
fsubr dword [edi + esi*8]
fsubr dword [ebx + 1]
jns 0x4234e6
sbb dh, byte [ebx]
adc eax, 0x4291c81c
popal
push esp
popal
add esp, dword [ebp + 0x67]
cmc
inc edx
lea edx, [esp + ebx*8 + 0x6e]
mov al, byte [0xc1dff55a]
dec eax
pop ss
sbb ch, dl
sub byte [0xf9b462ef], ch
push ax
invalid