joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b510
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x44b532
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x61]
inc eax
xor byte [edx], cl
cmp eax, 3
jb 0x44b520
mov byte [esi + 4], 0
mov eax, esi
pop esi
ret
Function at 0x44dd90
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
push edi
mov edi, ecx
cmp byte [esi + 0x4a], 0
je 0x44ddb2
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax - 0x61]
inc eax
xor byte [edx], cl
cmp eax, 0x49
jb 0x44dda0
mov byte [esi + 0x4a], 0
mov edx, esi
mov ecx, edi
call fcn.00461af0
mov eax, edi
pop edi
pop esi
ret

Function at 0x44ddc0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
push edi
mov edi, ecx
cmp byte [esi + 0x15], 0
je 0x44dde2
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax - 0x61]
inc eax
xor byte [edx], cl
cmp eax, 0x14
jb 0x44ddd0
mov byte [esi + 0x15], 0
mov edx, esi
mov ecx, edi
call fcn.00461af0
mov eax, edi
pop edi
pop esi
ret
Function at 0x450bf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cb09d
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x659bc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 4], 0
call fcn.00492990
mov edi, eax
xorps xmm0, xmm0
test edi, edi
jne 0x450c9f
push 4
movups xmmword [esi], xmm0
push str.null
mov ecx, esi
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
call fcn.00462fd0
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0xf
jbe 0x450c82
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x450c78
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x450dd9
push ecx
push edx
call fcn.005c6ee7
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b67
mov esp, ebp
pop ebp
ret
movups xmmword [ebp - 0x28], xmm0
xor ecx, ecx
mov dword [ebp - 0x18], 0
movaps xmm0, xmmword [0x64a720]
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x38], 0x9ddfd9d8
mov dword [ebp - 0x34], 0x99dcc4d2
mov dword [ebp - 0x30], 0x95899686
mov word [ebp - 0x2c], 0x100
nop dword [eax]
lea eax, [ecx - 0x61]
xor byte [ebp + ecx - 0x48], al
inc ecx
cmp ecx, 0x1c
jb 0x450ce0
lea eax, [ebp - 0x48]
mov byte [ebp - 0x2b], 0
push eax
push 0x2712
push edi
call fcn.00496750
push 0
push 0x40
push edi
call fcn.00496750
push 0
push 0x51
push edi
call fcn.00496750
cmp dword [ebp + 0x1c], 0xf
lea eax, [ebp + 8]
cmova eax, dword [ebp + 8]
push eax
push 0x271f
push edi
call fcn.00496750
push 0x450b90
push 0x4e2b
push edi
call fcn.00496750
lea eax, [ebp - 0x28]
push eax
push 0x2711
push edi
call fcn.00496750
add esp, 0x48
push edi
call fcn.00492a30
add esp, 4
test eax, eax
je 0x450d70
push 0x10
push 0
push eax
call fcn.004933f0
add esp, 4
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp + 0x1c]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [ebp - 0x28]
mov byte [ebp - 0x28], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
cmp ecx, 0xf
jbe 0x450c82
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x450c78
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x450c78
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x451570
Capabilities:
Delete file
Delete service
Modify service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x659bc0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [0xeb49a8]
mov cl, byte [edi]
test cl, cl
je 0x451594
mov word [edi + 0x54], 0
cmp byte [edi + 0x54], 0
je 0x4515b0
test cl, cl
jne 0x4515b0
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c6b67
mov esp, ebp
pop ebp
ret
push ebx
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
je 0x4516ed
cmp byte [edi + 0x55], 0
mov ecx, 0x20
mov eax, 0x10020
cmovne eax, ecx
mov ecx, eax
or ecx, 2
cmp byte [edi + 0x56], 0
cmove ecx, eax
cmp dword [edi + 0x48], 0xf
lea eax, [edi + 0x34]
jbe 0x4515ef
mov eax, dword [eax]
push ecx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x451618
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c6b67
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x4516e1
cmp byte [edi + 0x56], 0
je 0x451656
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
je 0x4516e1
cmp byte [edi + 0x55], 0
je 0x451680
cmp byte [edi], 0
jne 0x451680
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
pop ebx
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c6b67
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x24], eax
call esi
push ebx
call esi
cmp byte [edi + 0x57], 0
je 0x4516c9
cmp byte [edi], 0
je 0x4516c9
add edi, 4
cmp dword [edi + 0x14], 0xf
jbe 0x4516ac
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop ebx
test eax, eax
pop edi
setne al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c6b67
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x24], 0
pop ebx
pop edi
setne al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c6b67
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
mov ecx, dword [ebp - 4]
xor al, al
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.005c6b67
mov esp, ebp
pop ebp
ret
Function at 0x451d10
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cb1e0
mov eax, dword fs:[0]
push eax
sub esp, 0x164
mov eax, dword [0x659bc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push 0x124
mov dword [ebp - 0x140], eax
lea eax, [ebp - 0x134]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x138], 0x128
lea eax, [ebp - 0x138]
push eax
push dword [ebp - 0x140]
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x451ef2
nop dword [eax + eax]
push 0xa
xorps xmm0, xmm0
mov dword [ebp - 0x160], 0
push str.dumper.exe
lea ecx, [ebp - 0x170]
mov dword [ebp - 0x15c], 0
movups xmmword [ebp - 0x170], xmm0
call fcn.00462fd0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x114]
xorps xmm0, xmm0
mov dword [ebp - 0x148], 0
movups xmmword [ebp - 0x158], xmm0
mov dword [ebp - 0x144], 0
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x451df0
sub eax, edx
lea ecx, [ebp - 0x158]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.00462fd0
cmp dword [ebp - 0x15c], 0xf
lea ecx, [ebp - 0x170]
push dword [ebp - 0x160]
mov esi, dword [ebp - 0x170]
lea eax, [ebp - 0x158]
mov edi, dword [ebp - 0x158]
cmova ecx, esi
cmp dword [ebp - 0x144], 0xf
push ecx
push dword [ebp - 0x148]
cmova eax, edi
seta byte [ebp - 0x139]
push eax
call fcn.0046a790
add esp, 0x10
mov byte [ebp - 0x13a], al
cmp byte [ebp - 0x139], 0
je 0x451e93
mov ecx, dword [ebp - 0x144]
mov eax, edi
inc ecx
cmp ecx, 0x1000
jb 0x451e89
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x451f12
push ecx
push edi
call fcn.005c6ee7
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x15c]
cmp eax, 0xf
jbe 0x451ecc
lea ecx, [eax + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x451ec2
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x451f12
push ecx
push esi
call fcn.005c6ee7
add esp, 8
cmp byte [ebp - 0x13a], 0
jne 0x451f18
lea eax, [ebp - 0x138]
push eax
push dword [ebp - 0x140]
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x451d90
xor esi, esi
push dword [ebp - 0x140]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x451f20
push esi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
jmp 0x451f22
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov esi, dword [ebp - 0x130]
jmp 0x451ef2
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b67
mov esp, ebp
pop ebp
ret
Function at 0x451f40
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x659bc0]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
push edi
xor esi, esi
xor edi, edi
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [esp + 0x10], 0x128
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32First]
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x451fe7
mov eax, 0x640df0
lea ecx, [esp + 0x34]
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x451fc0
test dl, dl
je 0x451fbc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x451fc0
add ecx, 2
add eax, 2
test dl, dl
jne 0x451fa0
xor eax, eax
jmp 0x451fc5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x451fd7
mov eax, dword [esp + 0x24]
cmp eax, esi
jle 0x451fd7
mov edi, dword [esp + 0x18]
mov esi, eax
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x451f90
mov ecx, dword [esp + 0x13c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005c6b67
mov esp, ebp
pop ebp
ret

Function at 0x452100
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cb25d
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x659bc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, bind
mov ecx, dword [ebp + 0x18]
sub eax, ecx
cmp eax, 3
jb 0x452215
cmp dword [ebp + 0x1c], 0xf
lea eax, [ebp + 8]
push ecx
cmova eax, dword [ebp + 8]
push eax
push 3
push 0x640e08
push ecx
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
call fcn.00464880
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0
cmova eax, dword [ebp - 0x28]
push 0
push eax
push str.cmd.exe
push 0x640ac8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x4521b4
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4521aa
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4521ec
push ecx
push edx
call fcn.005c6ee7
add esp, 8
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp ecx, 0xf
jbe 0x4521fc
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4521f2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4521f2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.005c6ee7
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b67
mov esp, ebp
pop ebp
ret
call fcn.00447140
int3
Function at 0x452220
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x659bc0]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
lea eax, [esp + 8]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x45226d
lea eax, [esp + 0xc]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x45227f
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005c6b67
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0x10
mov dword [esp + 0x24], eax
lea eax, [esp + 0x20]
push eax
push 0
push dword [esp + 0x1c]
mov dword [esp + 0x2c], 1
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [esp + 8]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
xor ecx, esp
call fcn.005c6b67
mov esp, ebp
pop ebp
ret
Function at 0x456d70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cb6dd
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x659bc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 3
push 0x641390
push 0
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0
call fcn.00460a00
cmp dword [ebp + 0x1c], 0xf
lea eax, [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x50], 0x3c
cmova eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x50]
push eax
movlpd qword [ebp - 0x2c], xmm0
movlpd qword [ebp - 0x24], xmm0
movlpd qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x4c], 0x40
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], str.cmd.exe
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x456e1c
or esi, 0xffffffff
jmp 0x456e40
push 0xffffffffffffffff
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0xf
jbe 0x456e76
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x456e6c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x456e6c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.005c6ee7
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b67
mov esp, ebp
pop ebp
ret
Function at 0x457180
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cb7ae
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x659bc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x60], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 0
movaps xmm0, xmmword [0x64a6e0]
movups xmmword [ebp - 0x5c], xmm0
push 0
movaps xmm0, xmmword [0x64a6f0]
movups xmmword [ebp - 0x4c], xmm0
push 0x6407d5
movaps xmm0, xmmword [0x64a700]
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x2c], 0x7a797877
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0x33323130
movups xmmword [esi], xmm0
mov dword [ebp - 0x24], 0x37363534
mov word [ebp - 0x20], 0x3938
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00462fd0
mov dword [ebp - 4], 0
xor edi, edi
mov dword [ebp - 0x18], 1
nop dword [eax]
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov ecx, 0x3e
idiv ecx
mov ecx, dword [esi + 0x10]
mov al, byte [ebp + edx - 0x5c]
mov byte [ebp - 0x14], al
cmp ecx, 0x7fffffff
je 0x457331
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x45725e
mov eax, dword [esi]
push 1
lea edx, [ebp - 0x14]
push edx
push ecx
push eax
push ecx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x78]
call fcn.00464880
or dword [ebp - 0x18], 2
lea eax, [ebp - 0x78]
cmp esi, eax
je 0x4572d4
mov ecx, dword [esi + 0x14]
cmp ecx, 0xf
jbe 0x4572b0
mov eax, dword [esi]
inc ecx
cmp ecx, 0x1000
jb 0x4572a6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45732b
mov eax, edx
push ecx
push eax
call fcn.005c6ee7
add esp, 8
movups xmm0, xmmword [ebp - 0x78]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x68]
movq qword [esi + 0x10], xmm0
jmp 0x457304
mov ecx, dword [ebp - 0x64]
cmp ecx, 0xf
jbe 0x457304
mov edx, dword [ebp - 0x78]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4572fa
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45732b
push ecx
push edx
call fcn.005c6ee7
add esp, 8
inc edi
cmp edi, 0x20
jl 0x457230
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b67
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
call fcn.00447140
int3
Function at 0x45b180
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x264
mov eax, dword [0x659bc0]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push esi
push edi
call fcn.00451f40
mov ebx, dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor esi, esi
push esi
push 2
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
call ebx
mov edi, eax
mov dword [esp + 0x18], 0x128
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x45b23b
mov ecx, str.ProjectTitan.exe
lea eax, [esp + 0x3c]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x45b210
test dl, dl
je 0x45b20c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x45b210
add eax, 2
add ecx, 2
test dl, dl
jne 0x45b1f0
xor eax, eax
jmp 0x45b215
sbb eax, eax
or eax, 1
test eax, eax
jne 0x45b22b
mov eax, dword [esp + 0x2c]
cmp eax, esi
jle 0x45b22b
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x45b1e1
xor edi, edi
xor esi, esi
push edi
push 2
call ebx
mov ebx, eax
mov dword [esp + 0x140], 0x128
lea eax, [esp + 0x140]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32First]
lea eax, [esp + 0x140]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x45b2e0
nop dword [eax]
nop word [eax + eax]
mov eax, 0x640df0
lea ecx, [esp + 0x164]
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x45b2b0
test dl, dl
je 0x45b2ac
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x45b2b0
add ecx, 2
add eax, 2
test dl, dl
jne 0x45b290
xor eax, eax
jmp 0x45b2b5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x45b2cd
mov eax, dword [esp + 0x154]
cmp eax, edi
jle 0x45b2cd
mov esi, dword [esp + 0x148]
mov edi, eax
lea eax, [esp + 0x140]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x45b280
mov eax, dword [esp + 0x10]
test eax, eax
je 0x45b2ed
cmp eax, 1
jne 0x45b2fd
mov eax, dword [esp + 0x14]
test eax, eax
je 0x45b2fb
cmp eax, 1
cmovne esi, eax
mov eax, esi
mov ecx, dword [esp + 0x26c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005c6b67
mov esp, ebp
pop ebp
ret
Function at 0x45d050
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x45d07c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x45d0a4
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x45d0aa
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x45d112
jg 0x45d0c1
test esi, esi
je 0x45d112
test ecx, ecx
jl 0x45d10d
jg 0x45d0cb
test eax, eax
je 0x45d10d
cmp edi, ecx
jg 0x45d0df
jl 0x45d0d5
cmp esi, eax
jae 0x45d0df
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x45d115
mov ecx, dword [ebp + 8]
jmp 0x45d11f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x45d139
jg 0x45d11f
test esi, esi
je 0x45d139
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x45d139
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45d150
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x45d17c
jl 0x45d170
test ecx, ecx
jne 0x45d17c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x45d195
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x45d1e3
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x45d1e9
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x45d1e9
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x45d256
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x45d212
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x45d244
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x45d256
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x45d220
test edi, edi
je 0x45d256
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc