joyce8/EMBER2024-capa huggingface dataset:
Function at 0x495760
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x2ec
mov eax, dword [0x4f3bd0]
xor eax, esp
mov dword [esp + 0x2e8], eax
push edi
mov edi, dword [esp + 0x2f4]
mov dword [esp + 0x18], edi
test edi, edi
je 0x495961
cmp dword [esp + 0x2f8], 0
je 0x495961
push 0x64
lea eax, [esp + 0x20]
push 0
push eax
call fcn.00475420
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push 8
push 0
push 0x4cc1b0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x495928
mov ecx, dword [esp + 4]
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x100]
push eax
push ebx
mov esi, 0x104
push ecx
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x49591b
lea ebx, [ebx]
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push 1
push 0
lea eax, [esp + 0xf8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4958e9
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x1f4]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0
push 0x4d790c
push edx
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4958de
push 0x64
push eax
lea eax, [esp + 0x90]
push eax
call fcn.00475420
lea ecx, [esp + 0x1fc]
push 0x64
push ecx
lea edi, [esp + 0x9c]
call fcn.00495650
add esp, 0x14
test eax, eax
je 0x4958de
cmp byte [esp + 0x24], 0
je 0x4958a2
lea edx, [esp + 0x24]
push edx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jge 0x4958de
lea eax, [esp + 0x24]
lea esi, [esp + 0x88]
mov ecx, eax
mov edx, 0x64
sub esi, ecx
lea ecx, [edx + 0x7fffff9a]
test ecx, ecx
je 0x4958d1
mov cl, byte [esi + eax]
test cl, cl
je 0x4958d1
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x4958b6
jmp 0x4958d5
test edx, edx
jne 0x4958d6
dec eax
mov byte [eax], 0
mov esi, 0x104
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0xc]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x100]
push ecx
inc ebx
push ebx
push edx
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x495800
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
cmp byte [esp + 0x1c], 0
je 0x495961
mov edx, dword [esp + 0x2f8]
lea ecx, [esp + 0x1c]
push ecx
push edx
push edi
call fcn.0040b480
xor ecx, ecx
test eax, eax
setge cl
pop edi
mov eax, ecx
mov ecx, dword [esp + 0x2e8]
xor ecx, esp
call fcn.0047549a
add esp, 0x2ec
ret
mov ecx, dword [esp + 0x2ec]
pop edi
xor ecx, esp
xor eax, eax
call fcn.0047549a
add esp, 0x2ec
ret
Function at 0x495d00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x50c
mov eax, dword [0x4f3bd0]
xor eax, esp
mov dword [esp + 0x508], eax
push ebp
mov ebp, dword [esp + 0x514]
test edi, edi
je 0x495e7d
cmp ebp, 0x20
jb 0x495e7d
push 0x400
lea eax, [esp + 0x110]
push 0
push eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0x400
call fcn.00475420
add esp, 0xc
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x110]
push edx
lea eax, [esp + 0x10]
push eax
push 0x4cc20c
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x495e7d
lea eax, [esp + 0x10c]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x495d90
sub eax, edx
cmp eax, 0x40
jne 0x495e7d
push ebx
lea edx, [eax + 0x40]
push esi
lea eax, [esp + 0x14]
lea esi, [esp + 0x114]
mov ecx, eax
sub esi, ecx
lea ecx, [edx - 0x60]
test ecx, ecx
je 0x495dce
mov cl, byte [esi + eax]
test cl, cl
je 0x495dce
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x495db6
jmp 0x495dd2
test edx, edx
jne 0x495dd3
dec eax
mov byte [eax], 0
lea eax, [esp + 0x94]
lea edx, [esp + 0x134]
mov ecx, eax
mov esi, 0x80
sub edx, ecx
lea ecx, [ecx]
lea ecx, [esi + 0x7fffff7e]
test ecx, ecx
je 0x495e0b
mov cl, byte [edx + eax]
test cl, cl
je 0x495e0b
mov byte [eax], cl
inc eax
sub esi, 1
jne 0x495df0
jmp 0x495e0f
test esi, esi
jne 0x495e10
dec eax
push 0x400
lea edx, [esp + 0x118]
push 0
push edx
mov byte [eax], 0
call fcn.00475420
push 0x400
lea ebx, [esp + 0x124]
lea ecx, [esp + 0x24]
call fcn.00494dd0
add esp, 0x10
lea eax, [esp + 0x94]
push eax
mov ecx, ebx
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
pop esi
pop ebx
test eax, eax
jne 0x495e7d
lea edx, [esp + 0xc]
push edx
push ebp
push edi
call fcn.0040b480
neg eax
sbb eax, eax
inc eax
pop ebp
mov ecx, dword [esp + 0x508]
xor ecx, esp
call fcn.0047549a
add esp, 0x50c
ret
mov ecx, dword [esp + 0x50c]
pop ebp
xor ecx, esp
xor eax, eax
call fcn.0047549a
add esp, 0x50c
ret
Function at 0x495ea0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x290
mov eax, dword [0x4f3bd0]
xor eax, esp
mov dword [esp + 0x28c], eax
push ebx
push esi
push 0x80
lea eax, [esp + 0x14]
push 0
push eax
call fcn.00475420
push 0x80
lea ebx, [esp + 0x20]
mov ecx, edi
call fcn.00494dd0
lea eax, [esp + 0x1a0]
mov edx, edi
mov ecx, eax
add esp, 0x10
mov esi, 0x104
sub edx, ecx
lea esp, [esp]
lea ecx, [esi + 0x7ffffefa]
test ecx, ecx
je 0x495f0b
mov cl, byte [edx + eax]
test cl, cl
je 0x495f0b
mov byte [eax], cl
inc eax
sub esi, 1
jne 0x495ef0
jmp 0x495f0f
test esi, esi
jne 0x495f10
dec eax
lea edx, [esp + 0x10]
push edx
mov byte [eax], 0
push 0x104
lea eax, [esp + 0x198]
push eax
call fcn.0042fa60
push 0xff
lea ecx, [esp + 0x95]
push 0
push ecx
mov dword [esp + 0x18], 1
mov byte [esp + 0x9c], 0
call fcn.00475420
add esp, 0xc
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x94]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0x4cc20c
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0x100
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
jne 0x495feb
mov ecx, edi
lea eax, [esp + 0x90]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x495fb3
test dl, dl
je 0x495faf
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x495fb3
add eax, 2
add ecx, 2
test dl, dl
jne 0x495f93
xor eax, eax
jmp 0x495fb8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x495feb
lea eax, [esp + 0x90]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x495fc6
sub eax, edx
push eax
lea edx, [esp + 0x94]
push edx
push 1
push str.mid_old
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call esi
lea eax, [esp + 0x190]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x495ff5
sub eax, edx
push eax
lea eax, [esp + 0x194]
push eax
push 1
push 0x4cc20c
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov ecx, dword [esp + 0x294]
pop esi
pop ebx
xor ecx, esp
call fcn.0047549a
add esp, 0x290
ret
Function at 0x498d90
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x498dc2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
ret
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor eax, eax
ret

Function at 0x498ef0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
xor edi, edi
cmp dword [esi + 0x1e0], edi
je 0x498f39
push 1
push esi
call fcn.00498b40
mov eax, dword [esi + 0x16c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esi + 0x1e0]
push edx
push eax
push esi
call ecx
push 0
push esi
mov edi, eax
call fcn.00498b40
add esp, 0x24
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [esp + 0x10]
test eax, eax
jl 0x498f79
cmp eax, 2
jg 0x498f79
mov edx, dword [esi + 0x168]
push edx
push 1
lea eax, [eax + eax*2 + 0x4cc714]
push 2
push eax
call fcn.004773ef
mov ecx, dword [esi + 0x168]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
push ecx
push 1
push edx
push eax
call fcn.004773ef
add esp, 0x20
mov eax, edi
pop edi
pop esi
ret

Function at 0x499380
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [ebx + 0x350]
push ebp
mov ebp, dword [ebx + eax*4 + 0x1a8]
push esi
lea esi, [eax + 0x1d]
shl esi, 4
add esi, ebx
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [ecx + 0x40], 3
je 0x49941f
cmp dword [ebx + eax*4 + 0x1c0], 0x4990f0
jne 0x49941f
cmp dword [esi], 0
je 0x4993ba
test edi, edi
je 0x49941f
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
call fcn.004970e0
add esp, 0x14
cmp eax, 0xffffffff
je 0x49941f
test al, 1
je 0x49941f
cmp dword [esi], 0
jne 0x499401
mov edx, dword [ebx]
mov eax, dword [edx + 0x508]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x4f5150]
mov edi, dword [esi + 4]
xor ecx, ecx
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
cmp eax, ecx
je 0x49941c
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x49941f
add dword [esi + 8], eax
pop edi
pop esi
pop ebp
ret
mov dword [esi + 4], ecx
pop edi
pop esi
pop ebp
ret
Function at 0x499430
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [ebx + eax*4 + 0x1a8]
push edi
call fcn.00499380
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push 0
push eax
push ecx
push esi
call dword [sym.imp.WS2_32.dll_send]
mov edi, dword [esp + 0x20]
mov esi, eax
mov dword [edi], 0
cmp esi, 0xffffffff
jne 0x4994b2
push ebp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebp, eax
cmp ebp, 0x2733
jne 0x499489
pop ebp
mov dword [edi], 0x51
pop edi
pop esi
xor eax, eax
pop ebx
ret
push ebp
push ebx
call fcn.004a72d0
mov edx, dword [ebx]
push eax
push str.Send_failure:__s
push edx
call fcn.00499010
mov eax, dword [ebx]
mov dword [eax + 0x998], ebp
add esp, 0x14
mov dword [edi], 0x37
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x49b1a0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + eax]
mov ebx, 0x1505
cmp esi, edi
jae 0x49b190
movzx eax, byte [esi]
push eax
call fcn.0049ba90
mov edx, ebx
shl edx, 5
movsx ecx, al
add edx, ebx
xor ecx, edx
inc esi
add esp, 4
mov ebx, ecx
cmp esi, edi
jb 0x49b171
pop edi
pop esi
movzx eax, bl
pop ebx
ret
push ecx
push esi
mov esi, eax
test esi, esi
je 0x49b1cf
mov ecx, esi
call fcn.0049aff0
test eax, eax
jne 0x49b1cf
lea eax, [esp + 4]
push eax
call fcn.0049b100
add esp, 4
mov ecx, eax
mov eax, dword [esp + 4]
pop esi
add esp, 4
jmp 0x49b160
xor eax, eax
pop esi
pop ecx
ret
Function at 0x49bff0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebp
push esi
push str.kernel32
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x49c00a
pop esi
pop ebp
pop ecx
ret
push ebx
push edi
push str.LoadLibraryExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, dword [esp + 0x18]
mov edi, eax
push 0x4ccd18
push ebx
mov dword [esp + 0x18], edi
call fcn.004ac81a
add esp, 8
test eax, eax
je 0x49c056
test edi, edi
je 0x49c047
push 8
push 0
push ebx
call edi
pop edi
pop ebx
pop esi
mov ebp, eax
pop ebp
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
pop ebx
pop esi
mov ebp, eax
pop ebp
pop ecx
ret
test edi, edi
je 0x49c07c
push str.AddDllDirectory
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49c07c
push 0x800
push 0
push ebx
call edi
pop edi
pop ebx
pop esi
mov ebp, eax
pop ebp
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, eax
test edi, edi
je 0x49c130
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x49c095
sub eax, edx
lea eax, [eax + edi + 1]
push eax
call dword [0x4f5150]
mov esi, eax
add esp, 4
test esi, esi
je 0x49c126
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x49c126
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x49c0c3
sub eax, edx
mov ecx, 0x5c
mov word [eax + esi], cx
mov eax, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x49c0e0
sub eax, edx
lea edx, [eax + esi]
mov ecx, ebx
sub edx, ebx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x49c0f0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x49c11d
push 8
push 0
push esi
call eax
push esi
mov ebp, eax
call dword [0x4f5154]
add esp, 4
pop edi
pop ebx
pop esi
mov eax, ebp
pop ebp
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
push esi
call dword [0x4f5154]
add esp, 4
pop edi
pop ebx
pop esi
mov eax, ebp
pop ebp
pop ecx
ret
Function at 0x49fea0
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0x14
push esi
push 0
push ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 4
mov dword [esp + 0x1c], esi
call fcn.00475420
mov eax, dword [esp + 0x2c]
add esp, 0xc
push 0xf0000000
push eax
push 0
push 0
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x49ff80
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 4]
lea edx, [esp]
push edx
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x49ff61
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp]
push 0
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x49ff61
mov ecx, dword [esp]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push 0
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 4
push ecx
call ebp
test eax, eax
je 0x49ff60
cmp esi, dword [esp + 0xc]
jb 0x49ff60
mov eax, dword [esp + 4]
push 0
lea edx, [esp + 0x18]
push edx
push ebx
push 2
push eax
call ebp
pop ebp
mov eax, dword [esp]
test eax, eax
je 0x49ff6f
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 4]
test eax, eax
je 0x49ff80
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
add esp, 0x14
ret
Function at 0x4a1bf0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x4f3bd0]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.00490632
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x4a1c55
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x4a1c55
lea edx, [esp]
push edx
call dword [0x4f515c]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047549a
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.0047549a
add esp, 0x108
ret
jmp 0x4a1bf0

Function at 0x4a1c70
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x4f3bd0]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.00490632
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x4a1c55
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x4a1c55
lea edx, [esp]
push edx
call dword [0x4f515c]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047549a
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.0047549a
add esp, 0x108
ret
jmp 0x4a1bf0
Function at 0x4af1e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4af211
call fcn.0047eb2f
mov dword [eax], esi
call fcn.0047eb1c
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00476701
add esp, 0x14
push 0x16
pop eax
jmp 0x4af266
test dword [ebp + 0xc], 0xfffffff9
jne 0x4af1ed
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4af23e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0047eb42
pop ecx
call fcn.0047eb1c
mov eax, dword [eax]
jmp 0x4af266
test al, 0x10
jne 0x4af264
test al, 1
je 0x4af264
test byte [ebp + 0xc], 2
je 0x4af264
call fcn.0047eb2f
mov dword [eax], 5
call fcn.0047eb1c
mov dword [eax], 0xd
jmp 0x4af235
xor eax, eax
pop esi
pop ebp
ret
Function at 0x401000
Capabilities:
Enumerate processes

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
push 0
push 2
mov dword [edi], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push edi
push eax
mov dword [esp + 0x20], eax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x401070
mov ebx, dword [esp + 0x14]
lea ebp, [edi + 0x24]
lea ecx, [ecx]
mov esi, ebx
mov eax, ebp
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401058
test cl, cl
je 0x401054
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401058
add eax, 2
add esi, 2
test cl, cl
jne 0x401034
xor eax, eax
jmp 0x40105d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x401077
mov eax, dword [esp + 0x18]
push edi
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401030
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret
Function at 0x401080
Capabilities:
Enumerate threads
Log keystrokes via polling
Resume thread
Suspend thread
Terminate process

Disassembly:
sub esp, 0x140
lea eax, [esp]
push eax
push 0x408478
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x4010b6
push 0
push str.Error
push str.Could_not_find_dll
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebp
push esi
push 0x408328
push str.hl.exe
call section..text
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
test al, al
jne 0x401107
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
lea ebx, [ebx]
push 0x23
call esi
test ax, ax
jne 0x401183
push 0xa
call ebp
push 0x408328
push str.hl.exe
call section..text
add esp, 8
test al, al
je 0x4010e0
push edi
jmp 0x401110
mov edi, dword [0x408330]
push 0
push 4
mov dword [0x408454], 0x1c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
push 0x408454
push esi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x401157
lea ebx, [ebx]
cmp dword [0x408460], edi
je 0x40118b
push 0x408454
push esi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x401140
mov eax, dword [0x408594]
inc eax
cmp eax, 0x64
mov dword [0x408594], eax
jl 0x401110
push 0
push str.Error
push str.Could_not_aquire_thread_instructions
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x408330]
mov ecx, dword [0x40845c]
push eax
push 0
push 0x1f0fff
mov dword [0x408584], eax
mov dword [0x408588], ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, dword [0x408580]
push edx
mov dword [0x40857c], eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0xa
call ebp
push 0x40857c
push 0x408478
call fcn.00401920
add esp, 8
test eax, eax
jne 0x4011fe
push eax
mov eax, dword [0x40857c]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
push str.Error
push str.Could_not_inject_dll
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40120b
mov ecx, dword [0x408580]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [0x408580]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [0x40857c]
push eax
call esi
pop edi
pop esi
pop ebp
add esp, 0x140
ret
Function at 0x4013b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x464
push ebx
push esi
push edi
call fcn.00401970
test eax, eax
je 0x40158f
push 0
push 2
call dword [0x408f44]
mov esi, eax
xor eax, eax
cmp esi, 0xffffffff
je 0x4015b3
mov ecx, 0x4a
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x20]
push eax
push esi
mov dword [esp + 0x28], 0x128
call dword [0x408f34]
lea ecx, [esp + 0x20]
push ecx
push esi
mov byte [esp + 0x378], 0
call dword [0x408f3c]
test eax, eax
je 0x401450
lea ebx, [ebx]
mov edx, dword [esp + 0x28]
cmp edx, dword [ebp + 8]
jne 0x401440
xor eax, eax
jmp 0x401430
mov cl, byte [esp + eax + 0x44]
mov byte [esp + eax + 0x370], cl
inc eax
test cl, cl
jne 0x401430
lea eax, [esp + 0x20]
push eax
push esi
call dword [0x408f3c]
test eax, eax
jne 0x401420
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0x370]
test al, al
je 0x40158f
mov ecx, dword [ebp + 8]
push ecx
push 8
call dword [0x408f44]
mov esi, eax
xor eax, eax
cmp esi, 0xffffffff
je 0x4015b3
mov ecx, 0x89
lea edi, [esp + 0x148]
rep stosd dword es:[edi], eax
xor edx, edx
lea eax, [esp + 0x148]
mov ebx, edx
push eax
mov edi, edx
push esi
mov dword [esp + 0x150], 0x224
mov dword [esp + 0x24], edx
call dword [0x408f40]
lea ecx, [esp + 0x370]
push ecx
lea edx, [esp + 0x26c]
push edx
call fcn.00405628
add esp, 8
test eax, eax
jne 0x4014db
mov ebx, dword [esp + 0x15c]
mov edi, dword [esp + 0x160]
lea eax, [esp + 0x148]
push eax
push esi
call dword [0x408f38]
test eax, eax
je 0x40152d
mov edi, edi
lea ecx, [esp + 0x370]
push ecx
lea edx, [esp + 0x26c]
push edx
call fcn.00405628
add esp, 8
test eax, eax
jne 0x40151a
mov ebx, dword [esp + 0x15c]
mov edi, dword [esp + 0x160]
lea eax, [esp + 0x148]
push eax
push esi
call dword [0x408f38]
test eax, eax
jne 0x4014f0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x40158f
cmp edi, 0x2000
jb 0x401545
mov edi, 0x2000
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0x10
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
mov dword [esp + 0x10], eax
je 0x40158f
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x40158f
mov edx, dword [esp + 0x10]
push 0x408598
push edi
push esi
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x401588
cmp word [esi], 0x5a4d
je 0x401598
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
push esi
jne 0x401589
mov edi, dword [eax + esi + 0x28]
add edi, ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret