joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a47c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x20c]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x218], eax
xor eax, eax
push eax
push 0x1a
push ecx
push eax
mov dword [ebp - 0x210], ebx
call fcn.0045bfd4
lea eax, [ebp - 0x20c]
push eax
call fcn.00491bc7
add esp, 0x14
mov dword [ebp - 0x214], eax
call fcn.00453720
test al, al
je 0x45a4f3
imul edx, dword [eax - 0x26], 0x48
les edi, [edx + 0x150a9b95]
sub al, 0xd3
mov dword [ebx + 0x28658a33], ebp
invalid
cmp dword [ebp - 0x214], 0
je 0x45a5ff
mov esi, 0x5e9bd4
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00491be2
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00491be2
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00491be2
add esp, 0x18
call fcn.00453cc9
test al, al
je 0x45a553
jl 0x45a59b
push esp
invalid
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x45a571
lea eax, [ebp - 0x20c]
push eax
call fcn.0045a078
pop ecx
call fcn.004537ef
test al, al
je 0x45a58e
cwde
scasd eax, dword es:[edi]
cmpsd dword [esi], dword es:[edi]
cwde
cmp dword [ebp - 0xc], edi
mov byte [0x4962074b], al
invalid
call fcn.00453aa1
test al, al
je 0x45a5b3
mov ah, byte [ecx]
add byte [eax + ebx*4], dh
cwde
cmp eax, dword [esp + ebx + 0x4f9bcbd2]
vsubsd xmm3, xmm4, qword [ebp + 0x4f]
xchg ebx, eax
adc esp, dword [ecx - 0x75]
wait
imul esi, dword [edx - 0x17560178], 0xffffffe8
adc dword [edi - 0x3f7b0001], edx
call fcn.00453cc9
test al, al
je 0x45a5d1
dec edx
loopne 0x45a631
rol byte [edx + 0x78], 0x3b
mov cl, 0x8e
or ch, byte [ecx - 0x728c4e38]
adc dword [esi*2 + 0x666c86f0], esp
cmp dword [ebp - 0x20c], 0
cmp word [ebp - 0x20c], 0
jne 0x45a5df
xor eax, eax
jmp 0x45a5ec
lea eax, [ebp - 0x20c]
push eax
call fcn.00491bc7
pop ecx
mov ecx, dword [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00402b90
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047070c
mov esp, ebp
pop ebp
ret
or al, 0x57
Function at 0x45b1c1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x67d57c], 0
push ebx
push esi
push edi
je 0x45b249
call fcn.004537ef
test al, al
je 0x45b1fd
invalid
call fcn.00453aa1
test al, al
je 0x45b222
xor byte [edx - 0x6a], 0xf7
add esp, ebp
mov ah, 0x85
pop dword [ebp + 0x79e672ab]
test eax, 0x851cc88c
and dword [ebp + 0x537dbecd], ebp
xchg byte [ebp - 0x71], cl
call fcn.00453cc9
test al, al
je 0x45b340
and edi, dword [eax]
invalid
call fcn.00453cc9
test al, al
je 0x45b26d
dec ebp
int1
and byte [edi - 0xa], 0x62
scasb al, byte es:[edi]
dec esp
and al, 0x7f
dec eax
cmp dword [eax + 0x62d7f874], edi
inc edx
aaa
mov ch, 0x34
push edi
xchg dword [0x20868e0], ebx
add byte [eax], al
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00483520
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x45b2dd
lea eax, [ebp - 0x20c]
push eax
call fcn.0049007c
lea eax, [ebp - 0x20c]
mov dword [esp], 0x5efed0
push eax
call fcn.004838d6
pop ecx
pop ecx
test eax, eax
jne 0x45b2d6
lea eax, [ebp - 0x20c]
push str.documents_and_settingslocalservice
push eax
call fcn.004838d6
pop ecx
pop ecx
test eax, eax
je 0x45b2dd
mov byte [0x67d57c], 1
call fcn.00453b2b
test al, al
je 0x45b2f8
add dword [edi], esi
adc edi, dword ss:[ebx]
inc edx
test al, 0xe1
inc ebx
push esi
jl 0x45b311
mov ah, 0xf9
sbb ecx, dword [0xf2e83f5c]
test bh, bh
inc dword [eax + eax*8 + 0x335c1b74]
sbb al, 0xd7
call fcn.004537ef
test al, al
je 0x45b31c
pop esp
xor ebx, dword [edi + edx*8]
pop edi
adc al, 0x98
clc
out 0xc1, eax
mov edx, 0x17f83a39
hlt
scasd eax, dword es:[edi]
dec ecx
sbb al, 0xfd
mov ss, word [ebx - 0x76]
fcmovb st(0), st(2)
mov ecx, 0x84cee85c
invalid
call fcn.004537ef
test al, al
je 0x45b340
fimul word [edi - 0x56981977]
adc ch, dl
stosd dword es:[edi], eax
ret
mov ecx, dword [ebp - 4]
mov al, byte [0x67d57c]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0047070c
mov esp, ebp
pop ebp
ret

Function at 0x45b356
Capabilities:
Get common file path

Disassembly:
push pe_nt_image_headers32
mov eax, 0x5e56ef
call fcn.00470bca
mov al, byte [0x67d57d]
test al, al
jne 0x45b41f
push 0x104
xor esi, esi
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.00483520
add esp, 0xc
lea eax, [ebp - 0x114]
xor edi, edi
inc edi
push edi
push 0x1a
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x45b41a
push str.config_systemprofile
lea ecx, [ebp - 0x12c]
call fcn.00406430
lea eax, [ebp - 0x114]
mov dword [ebp - 4], esi
push eax
lea ecx, [ebp - 0x144]
call fcn.00406430
push dword [ebp - 0x11c]
cmp dword [ebp - 0x118], 0x10
lea eax, [ebp - 0x12c]
push esi
cmovae eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x144]
push eax
call fcn.00407ce0
movzx ecx, byte [0x67d57d]
cmp eax, 0xffffffff
push esi
cmovne ecx, edi
mov byte [0x67d57d], cl
lea ecx, [ebp - 0x144]
push edi
call fcn.0040c8c0
push esi
push edi
lea ecx, [ebp - 0x12c]
call fcn.0040c8c0
mov al, byte [0x67d57d]
call fcn.00470b74
ret
Function at 0x45c3e3
Capabilities:
Delete file

Disassembly:
push 0
mov eax, 0x5e5860
call fcn.00470b96
and dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push eax

Function at 0x45c5d4
Capabilities:
Encode data using xor

Disassembly:
push 0x48
mov eax, 0x5e58b0
call fcn.00470bca
mov eax, dword [ebp + 8]
and dword [ebp - 0x54], 0
push 0
mov dword [ebp - 0x48], eax
call fcn.00486e66
mov dword [ebp - 0x50], eax
xor edx, edx
lea eax, [ebp - 0x50]
mov dword [ebp - 0x4c], edx
push eax
call fcn.0048fbbe
pop ecx
pop ecx
mov dword [ebp - 0x44], eax
call fcn.00453a17
test al, al
je 0x45c627
inc dword [eax + eax*8 + 0x57fc1774]
cld
push edi
test byte [edi + 0x66], bl
sbb byte [ebx], dh
salc
push es
test eax, 0x375cf922
push ds
xor dword [edi + ebx*8 + 0x6e], esi
pop ebx
push ss
xchg dword [ebx - 0x8e8118], ebx
inc dword [eax + eax*8 + 0x16111874]
call fcn.004537aa
test al, al
je 0x45c648
adc dword [esi], edx
test eax, 0xf4e66eb7
rcr byte [edx - 0x1a641915], cl
mov ecx, 0xf7f635aa
jg 0x45c60b
rcr dword [esi - 0x63], 0xc6
call fcn.00453834
test al, al
je 0x45c669
push edi
imul eax, dword [ebx], 0xffffffd6
shr esi, 1
jecxz 0x45c660
outsd dx, dword [esi]
push esi
push cs
inc eax
xchg edi, eax
or eax, 0x7fe81ba2
clc
sbb ebp, eax
jg 0x45c65c
push ds
cmp edi, ecx
cmp eax, 0xbc4d8b9e
mov ecx, dword [ebp - 0x44]
lea edi, [ebp - 0x27]
xor eax, eax
mov byte [ebp - 0x28], 0x30
stosd dword es:[edi], eax
mov byte [ebp - 0x1c], 0x30
stosd dword es:[edi], eax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x1b]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
push dword [ecx + 0xc]
mov eax, dword [ecx + 0x10]
inc eax
push eax
mov eax, dword [ecx + 0x14]
add eax, 0x76c
push eax
lea eax, [ebp - 0x1c]
push str._d_.2d_.2d
push eax
call fcn.00408a80
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00491d10
add esp, 0x1c
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x40]
push eax
call fcn.00406430
mov esi, dword [ebp - 0x48]
lea eax, [ebp - 0x40]
and dword [ebp - 4], 0
push eax
push esi
call fcn.0045dd82
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.0040c8c0
mov eax, esi
call fcn.00470b74
ret
Function at 0x45cfad
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x114
mov dword [ebp - 0x124], 1
push esi
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.00483520
add esp, 0xc
mov dword [ebp - 0x118], esi
call fcn.00453bb5
test al, al
je 0x45d004
inc esi
mov esi, 0xddd2ebf1
fcmovnb st(0), st(4)
invalid
call fcn.004538be
test al, al
je 0x45d02c
ljmp 0x9e1e:0x2e4e58ab
call fcn.004536db
test al, al
je 0x45d04b
lcall 0xfe25, 0x6b1f4930
test dword [ebx], ebp
mov dword [ecx], eax
and dword [edx], esp
or ah, ah
lds esp, [ecx - 0x38]
loop 0x45d0a4
push ebx
scasd eax, dword es:[edi]
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x45d168
or byte [ecx], al
add byte [eax], al
cmp dword [ebp - 0x114], 5
jbe 0x45d164
and dword [ebp - 0x11c], 0
push 4
pop eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], eax
lea eax, [ebp - 0x11c]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem_
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45d168
test dword [edi - 0x18000000], edi
sbb ebp, dword [edi + edi*8 - 1]
call fcn.00453cc9
test al, al
je 0x45d0c5
jo 0x45d05c
pop ss
mov esp, 0x9d42b4a4
mov ah, 0x42
popfd
popfd
and dword [ecx], edi
and dword [edi - 0x4e438cf9], ebp
sub dword [eax + ebp*8], 0x75
imul edi, edi, 0xffffffff
call fcn.00453c3f
test al, al
je 0x45d0e9
lcall 0x28c6, 0xbacb1190
leave
xor dh, dh
in eax, dx
shr byte [eax], cl
jns 0x45d0b7
mov bl, 0x83
pushal
inc esp
push es
sub dword [edx], edi
out dx, al
xor byte [ecx], bl
mov byte [esi - 0x18], ah
or al, 0x6b
invalid
call fcn.00453bfa
test al, al
je 0x45d10b
je 0x45d12c
aaa
cld
ljmp 0xb58c
and dword [ebp - 0x120], 0
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x12c]
push eax
push 0
push str.PromptOnSecureDesktop
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45d150
pop edi
add bh, bh
mov ch, 0xe4
invalid
xor ecx, ecx
inc eax
cmp dword [ebp - 0x120], ecx
cmove eax, ecx
mov dword [ebp - 0x124], eax
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x124]
jmp 0x45d16b
xor edi, edi
jmp 0x45d16b
xor edi, edi
inc edi
call fcn.00453b70
test al, al
je 0x45d185
adc eax, 0x646648d6
sub byte [ebx], al
cmp byte cs:[esi], dh
cmp bh, bl
sal dword [ebp - 0x743c1cff], cl
dec ebp
cld
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047070c
mov esp, ebp
pop ebp
ret

Function at 0x45d2cd
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x11c
lea eax, [ebp - 0x120]
Function at 0x45d3eb
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.00483520
add esp, 0xc
mov dword [ebp - 0x120], esi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
call fcn.00453aa1
test al, al
je 0x45d45e
xchg byte [ecx - 0x7d], bh
fcomp dword [ebx]
jp 0x45d4bb
mov esi, 0xb77d1ba1
hlt
call fcn.00453bb5
test al, al
je 0x45d485
push edx
jl 0x45d47d
popal
shl dword [edi - 0x322d3b1], 1
leave
cmp eax, dword [ebx + 0x4b]
dec ecx
fiadd word [esi]
xor eax, 0x6767df5e
add eax, 0xfe830a7f
add bh, byte [edi + 5]

Function at 0x45e63b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push edi
push 0x38
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], 0x3c
push 0
push eax
call fcn.00483520
mov eax, dword [ebp + 8]
add esp, 0xc
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x2c], eax
mov eax, 0x200
lea ecx, [eax + 0x40]
cmovne eax, ecx
xor edi, edi
mov dword [ebp - 0x38], eax
inc edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x28], eax
call fcn.0045d3eb
test eax, eax
mov ecx, str.runas
lea eax, [ebp - 0x3c]
cmovne ecx, dword [ebp - 0x30]
push eax
mov dword [ebp - 0x30], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x45e6ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, edi
cmove eax, ecx
jmp 0x45e6c1
cmp dword [ebp + 0x10], 0
je 0x45e6bf
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x45ed92
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x82c]
push edi
push 0x44
xor ebx, ebx
push ebx
push eax
call fcn.00483520
push 0x10
lea eax, [ebp - 0x7e4]
mov dword [ebp - 0x82c], 0x44
push ebx
push eax
call fcn.00483520
add esp, 0x18
call fcn.00453765
test al, al
je 0x45ee02
into
imul esi, dword [ebp - 0x6e], 0xf2375915
je 0x45edce
mov eax, 0x4f54eedc
mov ah, 0x4b
invalid
push esi
lea eax, [ebp - 0x7d4]
push 0x5eba04
push eax
call fcn.00407e80
add esp, 0xc
lea eax, [ebp - 0x7e4]
push eax
lea eax, [ebp - 0x82c]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0x7d4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x45eec4
push 0xffffffffffffffff
push dword [ebp - 0x7e4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x7e8]
push eax
push dword [ebp - 0x7e4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
call fcn.004538be
test al, al
je 0x45ee87
out dx, eax
xchg esi, eax
mov edx, dword [ebx]
sub dh, byte [ecx]
wait
add dword [ecx], esp
jecxz 0x45ee03
sal ah, 1
cld
cmp al, 0xb9
jp 0x45ee3c
invalid
call fcn.00453765
test al, al
je 0x45eeae
invalid
push dword [ebp - 0x7e4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x7e0]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047070c
mov esp, ebp
pop ebp
ret
Function at 0x45f911
Capabilities:
Get disk information
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa38
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push ebx
push 0x5e9978
mov dword [ebp - 0xa38], eax
call fcn.00402b90
push 0x20a
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00483520
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x105
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
jne 0x45f973
xor al, al
jmp 0x45fb31
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
call ebx
mov esi, eax
test esi, esi
je 0x45f96c
push edi
xor ecx, ecx
lea eax, [esi + 1]
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0047071d
mov edi, eax
pop ecx
test edi, edi
je 0x45f9e8
lea eax, [esi*2 + 2]
push eax
push 0
push edi
call fcn.00483520
add esp, 0xc
push edi
push esi
call ebx
test eax, eax
je 0x45f9e1
mov eax, dword [0x5f04c0]
mov ebx, 0x208
mov dword [ebp - 0xc], eax
mov ax, word [0x5f04c4]
push ebx
mov word [ebp - 8], ax
call fcn.0047071d
mov esi, eax
pop ecx
test esi, esi
jne 0x45f9ef
push edi
call fcn.00470726
pop ecx
xor al, al
jmp 0x45fb30
push ebx
push 0
push esi
call fcn.00483520
add esp, 0xc
mov ebx, edi
mov ax, word [ebx]
push 0x104
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x45fa74
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x45fb1c
push esi
call fcn.00470726
xor eax, eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0047071d
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x45fb1c
push 2
pop eax
push eax
push 0
push esi
call fcn.00483520
add esp, 0xc
lea eax, [ebp - 0xc]
push 1
push esi
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x45fb1c
push esi
call fcn.00491bc7
push eax
mov dword [ebp - 0xa34], eax
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.0048f4fd
add esp, 0x10
test eax, eax
je 0x45faaf
push 2
pop ecx
movzx eax, word [ebx]
add ebx, ecx
test ax, ax
jne 0x45fa98
xor eax, eax
cmp word [ebx], ax
jne 0x45f9fd
jmp 0x45fb1c
push 0x800
xor ebx, ebx
lea eax, [ebp - 0xa18]
push ebx
push eax
call fcn.00483520
mov eax, dword [ebp - 0xa34]
lea ecx, [ebp - 0x218]
lea eax, [ecx + eax*2]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x5ecf50
lea eax, [ebp - 0xa18]
push 0x400
push eax
call fcn.004624c6
add esp, 0x20
lea eax, [ebp - 0xa18]
lea ecx, [ebp - 0xa30]
push eax
call fcn.00404170
mov ecx, dword [ebp - 0xa38]
push eax
call fcn.00404380
push ebx
push 1
lea ecx, [ebp - 0xa30]
call fcn.0041ed70
push edi
call fcn.00470726
pop ecx
test esi, esi
je 0x45fb2e
push esi
call fcn.00470726
pop ecx
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0047070c
mov esp, ebp
pop ebp
ret
Function at 0x45fb41
Capabilities:
Enumerate processes

Disassembly:
push 0x46c
mov eax, 0x5e5b11
call fcn.00470bca
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x230]
xor ebx, ebx
mov dword [ebp - 0x21c], 7
push ebx
xor eax, eax
mov dword [ebp - 0x478], ebx
push 0x5e9978
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
call fcn.00402b90
mov esi, 0x22c
mov dword [ebp - 4], ebx
push esi
lea eax, [ebp - 0x474]
push ebx
push eax
call fcn.00483520
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x45fbbe
push 0x5e9978
mov ecx, edi
call fcn.00404170
jmp 0x45fd54
lea eax, [ebp - 0x474]
mov dword [ebp - 0x474], esi
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x45fd3f
mov esi, dword [ebp + 0xc]
and dword [ebp - 0x238], 0
xor eax, eax
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
cmp word [ebp - 0x450], ax
je 0x45fc0c
lea eax, [ebp - 0x450]
push eax
call fcn.00491bc7
pop ecx
push eax
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x248]
call fcn.00402b90
mov byte [ebp - 4], 1
cmp dword [ebp - 0x46c], esi
je 0x45fc54
push 0
push 1
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0
call fcn.0041ed70
lea eax, [ebp - 0x474]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x45fbdc
jmp 0x45fd3f
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00483520
add esp, 0xc
push dword [ebp - 0x46c]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x45fd30
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
cmp word [ebp - 0x218], 0
jne 0x45fca9
xor eax, eax
jmp 0x45fcb6
lea eax, [ebp - 0x218]
push eax
call fcn.00491bc7
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402b90
push 0x5e9978
lea ecx, [ebp - 0x230]
call fcn.00428850
test eax, eax
jne 0x45fd29
lea eax, [ebp - 0x230]
push eax
push esi
call fcn.0045f911
pop ecx
pop ecx
push 0x5e9978
lea ecx, [ebp - 0x230]
call fcn.00428850
test eax, eax
jne 0x45fd29
cmp word [ebp - 0x450], ax
je 0x45fd16
lea eax, [ebp - 0x450]
push eax
call fcn.00491bc7
pop ecx
push eax
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402b90
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 1
lea ecx, [ebp - 0x248]
call fcn.0041ed70
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.00452f5f
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.0041ed70
mov eax, edi
call fcn.00470b74
ret
Function at 0x45fe41
Capabilities:
Enumerate processes

Disassembly:
push 0x280
mov eax, 0x5e5b7d
call fcn.00470bca
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x28c], ebx
test eax, eax
je 0x46002e
push eax
lea ecx, [ebp - 0x40]
call fcn.00404170
and dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push eax
call fcn.0045dec0
mov edi, 0x22c
lea eax, [ebp - 0x284]
push edi
push 0
push eax
call fcn.00483520
add esp, 0x10
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x28c], esi
cmp esi, 0xffffffff
je 0x46001e
call fcn.00453aa1
test al, al
je 0x45fec3
push cs
leave
or byte [ebp - 0x29bbd030], 0xb1
cdq
lahf
jne 0x45ff23
jmp 0x45fec2
add ecx, dword [ebp - 0x2837b]
dec dword [ecx - 0x28343]
call dword [eax + 0x56]
lea eax, [ebp - 0x284]
mov dword [ebp - 0x284], edi
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x45ff9b
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp word [ebp - 0x260], ax
je 0x45ff02
lea eax, [ebp - 0x260]
push eax
call fcn.00491bc7
pop ecx
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x28]
call fcn.00402b90
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.0045dec0
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.004562f1
test eax, eax
je 0x45ff56
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0045db5f
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x40]
or ebx, 1
call fcn.004562f1
mov byte [ebp - 0x285], 0
test eax, eax
jne 0x45ff5d
mov byte [ebp - 0x285], 1
test bl, 1
je 0x45ff71
push 0
push 1
lea ecx, [ebp - 0x58]
and ebx, 0xfffffffe
call fcn.0041ed70
cmp byte [ebp - 0x285], 0
jne 0x460034
push 0
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0041ed70
lea eax, [ebp - 0x284]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x45fedb
call fcn.00453bb5
test al, al
je 0x45ffcb
push cs
js 0x45ffdd
aaa
movsd dword es:[edi], dword [esi]
mov ebp, 0xb3004ffe
xor bh, cl
ficom word [edx]
jp 0x45ffff
mov bl, 0x30
iretd
cmp ah, byte [0x14f30724]
std
adc byte [eax - 0x2d2e3cf9], al
inc esi
invalid
call fcn.00453651
test al, al
je 0x45ffed
lodsd eax, dword [esi]
inc edi
movsb byte es:[edi], byte [esi]
cld
xor eax, ebx
jecxz 0x45ffec
nop
out 0xce, eax
daa
or al, 0x80
je 0x45ffb5
add byte [esi + edi*2], dl
loop 0x460038
in eax, 0x24
pop ecx
call fcn.00453903
test al, al
je 0x460012
mov ah, 0x50
sbb al, byte [ebx + ebp + 0x7ee147a7]
wait
dec ebp
jmp 0x8585d424
push dword [ebp - 0x28c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.0041ed70
mov eax, esi
call fcn.00470b74
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x27c]
lea ecx, [ebp - 0x28]
push 0
xchg edx, eax
pop esi
add byte [ebx - 0x27b4b], cl
dec dword [ebp + 0x6ad84d]
push 1
call fcn.0041ed70
jmp 0x460020
Function at 0x46004f
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x214], 0
lea eax, [ebp - 0x20c]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0x208
push 0
push eax
call fcn.00483520
add esp, 0xc
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4600d4
lea eax, [ebp - 0x218]
push eax
push 4
lea eax, [ebp - 0x210]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x4600cd
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.00404170
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0047070c
mov esp, ebp
pop ebp
ret