joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10011b30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10108350
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x2c], 0
lea edi, [esi + 0x1c]
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], 0
je 0x10011b8f
cmp dword [edi + 0x14], 8
jb 0x10011b79
mov eax, dword [edi]
jmp 0x10011b7b
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
test al, al
jne 0x10011d05
cmp byte [esi + 0x134], 0
je 0x10011c1c
cmp dword [esi + 0x128], 0
je 0x10011c1c
call fcn.10019850
cmp eax, 1
je 0x10011d05
lea esi, [ebp - 0x48]
call fcn.1001c4a0
mov dword [ebp - 0x68], eax
lea esi, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.1001c3b0
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.1000a320
mov ecx, dword [ebp - 0x70]
push 0xffffffffffffffff
add ecx, 0x118
push 0
push ecx
mov ecx, eax
call fcn.1000a320
mov edx, dword [ebp - 0x68]
push 0xffffffffffffffff
push 0
push edx
mov ecx, eax
call fcn.1000a320
mov ecx, esi
call fcn.1000b180
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], 0xffffffff
call fcn.1000b180
jmp 0x10011d05
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x68], reloc.WS2_32.dll_accept
call fcn.1001c4d0
mov dword [ebp - 0x6c], eax
lea esi, [ebp - 0x48]
mov dword [ebp - 4], 2
call fcn.1001c320
mov edx, dword [ebp - 0x6c]
push 0
lea ecx, [ebp - 0x68]
push ecx
mov ecx, eax
lea esi, [ebp - 0x64]
mov byte [ebp - 4], 3
call fcn.10011fc0
push eax
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.10009ca0
mov esi, 8
cmp dword [ebp - 0x50], esi
jb 0x10011c76
mov edx, dword [ebp - 0x64]
push edx
call fcn.10065453
add esp, 4
xor eax, eax
mov dword [ebp - 0x50], 7
mov dword [ebp - 0x54], 0
mov word [ebp - 0x64], ax
cmp dword [ebp - 0x34], esi
jb 0x10011c9b
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.10065453
add esp, 4
xor edx, edx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], 0
mov word [ebp - 0x48], dx
cmp dword [ebp - 0x18], esi
jb 0x10011cc7
mov eax, dword [ebp - 0x2c]
push eax
call fcn.10065453
add esp, 4
mov ecx, dword [ebp - 0x70]
cmp dword [ecx + 0x2c], 0
ja 0x10011d05
push 0x10110018
lea esi, [ebp - 0x2c]
call fcn.10012840
push eax
mov ecx, edi
mov dword [ebp - 4], 5
call fcn.10009ca0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 8
jb 0x10011d05
mov edx, dword [ebp - 0x2c]
push edx
call fcn.10065453
add esp, 4
push 0xffffffffffffffff
push 0
xor eax, eax
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
push edi
mov ecx, ebx
mov word [ebx], ax
call fcn.1000b050
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
Function at 0x10012a20
Capabilities:
Hash data with md5

Disassembly:
mov eax, ecx
xor ecx, ecx
mov byte [eax + 0x68], cl
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x10012a50
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x10013a10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010b26b
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
sub esp, 0x1c
mov ecx, esp
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x4c], esp
push 7
xor eax, eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], ebx
push 0x10125fa0
mov dword [ebp - 0x50], esi
mov word [ecx], ax
call fcn.1000abb0
lea edi, [ebp - 0x2c]
call fcn.10014000
add esp, 0x1c
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], ebx
je 0x10013ace
mov eax, dword [ebp - 0x2c]
mov edi, 8
cmp dword [ebp - 0x18], edi
jae 0x10013a8c
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
cmp al, bl
je 0x10013ace
lea esi, [ebp - 0x2c]
call fcn.1000bca0
call fcn.1000bca0
mov esi, dword [ebp - 0x50]
xor ecx, ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
lea edx, [ebp - 0x2c]
mov word [esi], cx
push edx
mov ecx, esi
call fcn.10009ca0
cmp dword [ebp - 0x18], edi
jmp 0x10013b83
mov edi, dword [0x1013ba54]
cmp edi, ebx
jne 0x10013b09
push 0x138
call fcn.100656b5
add esp, 4
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x10013afc
mov esi, eax
call fcn.10011610
mov esi, dword [ebp - 0x50]
jmp 0x10013afe
xor eax, eax
mov edi, eax
mov byte [ebp - 4], bl
mov dword [0x1013ba54], edi
lea ebx, [ebp - 0x48]
call fcn.10011900
push 1
push 0x1012329c
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.10009ff0
push 3
push 0x10125fb0
mov ecx, ebx
call fcn.10009ff0
mov ecx, ebx
push ecx
call fcn.1000d470
add esp, 4
mov eax, ebx
mov edi, 7
xor edx, edx
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], 0
push eax
mov ecx, esi
mov word [esi], dx
call fcn.10009ca0
mov ebx, 8
cmp dword [ebp - 0x34], ebx
jb 0x10013b70
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.10065453
add esp, 4
xor edx, edx
cmp dword [ebp - 0x18], ebx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], 0
mov word [ebp - 0x48], dx
jb 0x10013b91
mov eax, dword [ebp - 0x2c]
push eax
call fcn.10065453
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
Function at 0x10013bb0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010a5cb
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
sub esp, 0x1c
mov ecx, esp
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x4c], esp
push 7
xor eax, eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], ebx
push 0x10125fa0
mov dword [ebp - 0x50], esi
mov word [ecx], ax
call fcn.1000abb0
lea edi, [ebp - 0x2c]
call fcn.10014000
add esp, 0x1c
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], ebx
je 0x10013c78
mov eax, dword [ebp - 0x2c]
mov edi, 8
cmp dword [ebp - 0x18], edi
jae 0x10013c2c
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
cmp al, bl
je 0x10013c78
lea esi, [ebp - 0x2c]
call fcn.1000bca0
call fcn.1000bca0
mov esi, dword [ebp - 0x50]
xor ecx, ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
lea edx, [ebp - 0x2c]
mov word [esi], cx
push edx
mov ecx, esi
call fcn.10009ca0
cmp dword [ebp - 0x18], edi
jb 0x10013d30
mov eax, dword [ebp - 0x2c]
push eax
jmp 0x10013d28
mov edi, dword [0x1013ba54]
cmp edi, ebx
jne 0x10013cb3
push 0x138
call fcn.100656b5
add esp, 4
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x10013ca6
mov esi, eax
call fcn.10011610
mov esi, dword [ebp - 0x50]
jmp 0x10013ca8
xor eax, eax
mov edi, eax
mov byte [ebp - 4], bl
mov dword [0x1013ba54], edi
lea ebx, [ebp - 0x48]
call fcn.10011900
push 1
push 0x1012329c
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.10009ff0
push 3
push 0x10125fb0
mov ecx, ebx
call fcn.10009ff0
xor ecx, ecx
mov edi, 7
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], 0
mov edx, ebx
mov word [esi], cx
push edx
mov ecx, esi
call fcn.10009ca0
mov ebx, 8
cmp dword [ebp - 0x34], ebx
jb 0x10013d0f
mov eax, dword [ebp - 0x48]
push eax
call fcn.10065453
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], 0
mov word [ebp - 0x48], cx
cmp dword [ebp - 0x18], ebx
jb 0x10013d30
mov edx, dword [ebp - 0x2c]
push edx
call fcn.10065453
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
Function at 0x100146f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101080a8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x40], esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x44], esi
jb 0x10014731
mov eax, dword [eax]
lea edi, [ebp - 0x3c]
push edi
or edx, 0x20019
push edx
xor edi, edi
push edi
push eax
mov eax, dword [ecx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10014754
xor al, al
jmp 0x1001488c
lea ecx, [ebp - 0x34]
push ecx
push edi
lea edx, [ebp - 0x38]
push edx
push edi
mov ecx, ebx
mov dword [esi], edi
mov byte [ebp - 0x2d], 0
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
call fcn.1000b040
push eax
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
je 0x1001478b
cmp eax, edi
jne 0x1001487f
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1006669a
mov ecx, dword [ebp - 0x34]
add esp, 4
mov esi, eax
test ecx, ecx
je 0x100147c7
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
mov edi, esi
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
lea eax, [ebp - 0x34]
push eax
push esi
lea ecx, [ebp - 0x38]
push ecx
xor edi, edi
push edi
mov ecx, ebx
call fcn.1000b040
mov edx, dword [ebp - 0x3c]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x10014872
mov eax, dword [ebp - 0x38]
cmp eax, 1
jne 0x1001481b
mov eax, esi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x10014800
mov ecx, dword [ebp - 0x40]
sub eax, edx
sar eax, 1
push eax
push esi
call fcn.1000abb0
jmp 0x10014866
cmp eax, 7
je 0x10014825
cmp eax, 2
jne 0x10014866
mov eax, dword [ebp - 0x34]
inc eax
shr eax, 1
xor ecx, ecx
push eax
mov word [ebp - 0x2c], cx
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], edi
call fcn.1000abb0
mov ecx, dword [ebp - 0x40]
lea edx, [ebp - 0x2c]
push edx
mov dword [ebp - 4], edi
call fcn.10009ca0
cmp dword [ebp - 0x18], 8
jb 0x10014866
mov eax, dword [ebp - 0x2c]
push eax
call fcn.10065453
add esp, 4
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x38]
mov dword [ecx], edx
mov byte [ebp - 0x2d], 1
cmp esi, edi
je 0x1001487f
push esi
call fcn.100654af
add esp, 4
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0x2d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100148b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], 0
jb 0x100148c6
mov eax, dword [eax]
push 0
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp + 0x18]
push 0
or edx, 0x2001b
push edx
push 0
push 0
push 0
push eax
mov eax, dword [ecx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x100148f4
xor al, al
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x14], 8
mov edx, dword [eax + 0x10]
jb 0x10014902
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 8
jb 0x1001490d
mov ecx, dword [ecx]
push ebx
lea edx, [edx + edx + 2]
push edx
push eax
mov eax, dword [ebp + 0x14]
push eax
push 0
push ecx
mov ecx, dword [ebp - 4]
push ecx
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1001492d
xor bl, bl
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x10014940
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
cmp dword [ecx + 0x14], 8
jb 0x1001494b
mov ecx, dword [ecx]
lea edx, [ebp + 8]
push edx
or eax, 2
push eax
mov eax, dword [ebp + 8]
push 0
push ecx
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1001496c
xor al, al
pop ebp
ret 4
cmp dword [esi + 0x14], 8
push ebx
mov bl, 1
jb 0x10014979
mov eax, dword [esi]
jmp 0x1001497b
mov eax, esi
mov edx, dword [ebp + 8]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x1001498c
xor bl, bl
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
pop ebp
ret 4
Function at 0x10016340
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x460], esi
mov dword [ebp - 0x458], 0
jne 0x10016383
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
push ebx
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x45c], ebx
cmp ebx, 0xffffffff
je 0x100163be
lea eax, [ebp - 0x454]
push eax
push ebx
mov dword [ebp - 0x454], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x100163d1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x454]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x10016539
jmp 0x100163f6
mov esi, dword [ebp - 0x460]
lea edx, [ebp - 0x430]
push edx
mov ecx, esi
call fcn.1000b040
push eax
call fcn.10068f48
add esp, 8
test eax, eax
jne 0x1001651b
cmp dword [edi + 0x10], 0
mov eax, dword [ebp - 0x44c]
je 0x10016533
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1001651b
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x20a]
push edx
mov word [ebp - 0x20c], cx
call fcn.10066620
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x1001651b
xor ecx, ecx
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x214], 7
mov dword [ebp - 0x218], 0
mov word [ebp - 0x228], cx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100164a0
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x20c]
push edx
lea ecx, [ebp - 0x228]
call fcn.1000abb0
cmp dword [edi + 0x14], 8
mov ecx, dword [edi + 0x10]
jb 0x100164cf
mov eax, dword [edi]
jmp 0x100164d1
mov eax, edi
push ecx
push 0
push eax
lea ecx, [ebp - 0x228]
call fcn.10009d20
cmp eax, 0xffffffff
sete bl
cmp dword [ebp - 0x214], 8
jb 0x100164fe
mov eax, dword [ebp - 0x228]
push eax
call fcn.10065453
add esp, 4
test bl, bl
jne 0x10016515
mov ecx, dword [ebp - 0x44c]
push esi
mov dword [ebp - 0x458], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x45c]
lea edx, [ebp - 0x454]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x100163f0
jmp 0x10016539
mov dword [ebp - 0x458], eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x458]
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.1006656c
mov esp, ebp
pop ebp
ret
Function at 0x10016560
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010a518
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10137920]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
xor ebx, ebx
cmp dword [esi + 0x10], ebx
je 0x10016636
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
push esi
mov edx, edi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], ebx
call fcn.100166c0
add esp, 4
test al, al
je 0x10016618
mov edi, dword [ebp - 0x1c]
cmp edi, dword [ebp - 0x18]
je 0x100165f7
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov eax, dword [edi]
test eax, eax
je 0x100165ea
push eax
push 0
push 1
call ebx
mov esi, eax
test esi, esi
je 0x100165ea
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x100165ea
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add edi, 4
cmp edi, dword [ebp - 0x18]
jne 0x100165c3
mov edi, dword [ebp - 0x1c]
xor ebx, ebx
cmp edi, ebx
je 0x10016604
push edi
call fcn.10065453
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push esi
call fcn.10016340
add esp, 8
cmp eax, ebx
ja 0x1001664a
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x10016636
push eax
call fcn.10065453
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10016680
mov bl, al
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10016661
push eax
call fcn.10065453
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10016680
Capabilities:
Terminate process

Disassembly:
test eax, eax
jne 0x10016687
xor al, al
ret
push esi
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x100166a6
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x100166aa
xor al, al
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop esi
ret
Function at 0x10016950
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010a4e6
mov eax, dword fs:[0]
push eax
sub esp, 0x47c
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
push 2
mov edi, ecx
mov dword [ebp - 0x484], ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x488], esi
cmp esi, 0xffffffff
je 0x100169c1
lea eax, [ebp - 0x480]
push eax
push esi
mov dword [ebp - 0x480], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x100169d0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x10016b86
cmp dword [ebp - 0x478], 0xa
jb 0x10016b63
xor ecx, ecx
push ebx
mov word [ebp - 0x250], cx
mov esi, 7
push 0x101134e8
lea ecx, [ebp - 0x250]
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x240], ebx
call fcn.1000abb0
mov dword [ebp - 4], ebx
push ebx
xor edx, edx
push 0x101134e8
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x224], ebx
mov word [ebp - 0x234], dx
call fcn.1000abb0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x45c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10016a53
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x45c]
push ecx
lea ecx, [ebp - 0x250]
call fcn.1000abb0
mov edx, dword [ebp - 0x478]
push edx
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x10016af9
push 0x206
lea ecx, [ebp - 0x216]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x218], ax
call fcn.10066620
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
push ebx
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x10016af2
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10016ad0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x234]
call fcn.1000abb0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x254]
call fcn.100179b0
inc dword [ebp - 0x484]
mov esi, 8
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x220], esi
jb 0x10016b2d
mov ecx, dword [ebp - 0x234]
push ecx
call fcn.10065453
add esp, 4
xor edx, edx
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], ebx
mov word [ebp - 0x234], dx
cmp dword [ebp - 0x23c], esi
jb 0x10016b5d
mov eax, dword [ebp - 0x250]
push eax
call fcn.10065453
add esp, 4
mov esi, dword [ebp - 0x488]
lea ecx, [ebp - 0x480]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x100169d0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x484]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
Function at 0x100172d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
xor eax, eax
push edi
push 0x40
push eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x54]
push eax
call fcn.10066620
movzx ecx, byte [ebp + 0x14]
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
neg ecx
sbb ecx, ecx
and ecx, 5
mov word [ebp - 0x28], cx
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
mov ebx, 1
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x2c], ebx
neg ecx
or ecx, eax
push ecx
call fcn.1006669a
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x10017340
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x10]
add eax, ebx
push eax
push 0
push edi
call fcn.10066620
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x10017359
mov esi, dword [esi]
push esi
push 0x10126064
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp + 0x10]
add esp, 0xc
cmp dword [ecx + 0x10], 0
ja 0x10017376
xor esi, esi
jmp 0x1001737d
call fcn.1000b040
mov esi, eax
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x10], 0
ja 0x1001738a
xor eax, eax
jmp 0x1001738f
call fcn.1000b040
lea ecx, [ebp - 0x10]
push ecx
xor ecx, ecx
cmp byte [ebp + 0x18], cl
lea edx, [ebp - 0x58]
push edx
push esi
push 0
setne cl
push 0x20
push ecx
push 0
push 0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x100173b9
xor bl, bl
jmp 0x10017407
cmp byte [ebp + 0x1c], 0
je 0x100173d5
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100173d5
mov edx, dword [ebp + 0x20]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x100173b5
mov eax, dword [ebp + 0x2c]
test eax, eax
je 0x100173ef
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x100173ef
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x100173b5
mov eax, dword [ebp + 0x24]
test eax, eax
je 0x100173fb
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, dword [ebp + 0x28]
test eax, eax
je 0x10017407
mov edx, dword [ebp - 8]
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [ebp - 0xc]
push ecx
call esi
push edi
call fcn.100654af
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret