joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100cbd65
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov ecx, 0x1010a0d0
call fcn.100cbeb0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor ecx, ecx
mov cx, word [eax + 8]
test ecx, ecx
jne 0x100cbe4f
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
je 0x100cbda6
push 0x2f
push str.ccdata.cpp
call fcn.100b0670
test eax, eax
je 0x100cbda6
int3
xor eax, eax
test eax, eax
jne 0x100cbd8c
push str.COMCTL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100cbe11
push 5
mov ecx, dword [ebp + 0x10]
neg ecx
sbb ecx, ecx
and ecx, 0xe
add ecx, 0x3ee
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x100cbe11
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.1007c5e5
add esp, 0xc
mov ecx, dword [ebp + 8]
call fcn.100acbca
lea edx, [eax + eax + 2]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov ecx, dword [ebp + 8]
call fcn.100acc14
push eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov ax, word [edx]
mov word [ecx + 8], ax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
mov ecx, dword [ebp + 8]
call fcn.1006a387
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dx, word [ecx + 8]
mov word [eax], dx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cx, word [eax]
xor eax, eax
cmp ecx, 0xffff
setne al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100ccfe0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0x10], 0
jne 0x100cd02e
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
test eax, eax
je 0x100cd027
mov eax, dword [ebp + 8]
push eax
push 0x101038e4
call fcn.10051a15
add esp, 8
xor eax, eax
jmp 0x100cd09b
mov eax, 1
jmp 0x100cd09b
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x100cd088
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x100cd088
cmp dword [ebp - 8], 0
jne 0x100cd088
mov eax, 1
jmp 0x100cd09b
mov eax, dword [ebp + 8]
push eax
push str.Warning:_registration_database_update_failed_for_key__s._n
call fcn.10051a15
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1003c500
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x1003ca20
test edx, edx
je 0x1003ca20
call fcn.1003c517
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x1003ca60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.1003c500
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x1003cad1
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x1003ca96
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x1003d3e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp ebp, 0x80
je 0x1003d464
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
cmp ebp, 0xc0
je 0x1003d43c
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
jmp 0x1003d444
mov ecx, eax
mov edx, ebx
not ecx
not edx
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], edx
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
nop
call fcn.1003d469

Function at 0x100491b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101dab00
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1026dbac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], vtable.CryptoPP::FilterWithBufferedInput.0
mov dword [esi + 4], vtable.CryptoPP::FilterWithBufferedInput.1.0
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
cmp eax, ecx
mov edx, dword [esi + 0x34]
mov edi, edx
cmovb ecx, eax
xor al, al
rep stosb byte es:[edi], al
push edx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov ecx, dword [esi + 0xc]
add esp, 4
test ecx, ecx
je 0x10049214
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x10049225
push 0x48
push esi
call fcn.101d7443
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10049650
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101daba1
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x1026dbac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
push 0
mov dword [ebp - 0x10], 0
call fcn.100914c0
mov dword [ebp - 4], 0
mov dword [esi], vtable.CryptoPP::BaseN_Decoder.0
mov dword [esi + 4], vtable.CryptoPP::BaseN_Decoder.1.0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
push dword [ebp + 0x10]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.10091dd0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.1008cc30
mov edi, eax
push 0x14
mov byte [ebp - 4], 3
call fcn.101d6fe4
mov ecx, dword [ebp + 8]
mov ebx, eax
add esp, 4
mov dword [ebp + 0x10], ebx
mov dword [ebp + 8], ebx
mov dword [ebx + 4], str.DecodingLookupArray
mov word [ebx + 8], 1
mov dword [ebx + 0xc], 0
mov dword [ebx], vtable.CryptoPP::AlgorithmParametersTemplate_int_const__.0
mov dword [ebx + 0x10], ecx
mov byte [ebp - 4], 4
mov eax, dword [edi + 4]
mov dword [edi + 4], 0
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0x10], eax
test ecx, ecx
je 0x1004974a
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0xc], eax
mov ecx, dword [edi + 4]
mov dword [ebp + 8], 0
test ecx, ecx
je 0x10049761
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [edi + 4], ebx
mov byte [edi + 8], 1
push edi
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.1008cbb0
mov dword [ebp - 0x10], 1
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x1004978d
mov eax, dword [ecx]
push 1
call dword [eax]
lea eax, [ebp + 0xc]
mov byte [ebp - 4], 2
push eax
push str.Log2Base
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x20], vtable.CryptoPP::NameValuePairs.0
call fcn.1004d120
push eax
mov ecx, esi
call fcn.10090760
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x100497c2
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100497e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101dab00
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1026dbac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
cmp eax, ecx
mov edx, dword [esi + 0x38]
mov edi, edx
cmovb ecx, eax
xor al, al
rep stosb byte es:[edi], al
push edx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov ecx, dword [esi + 0xc]
add esp, 4
test ecx, ecx
je 0x10049837
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x10049848
push 0x3c
push esi
call fcn.101d7443
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1004a870
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1004a89c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x1004a8c4
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x1004a8ca
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x1004a932
jg 0x1004a8e1
test esi, esi
je 0x1004a932
test ecx, ecx
jl 0x1004a92d
jg 0x1004a8eb
test eax, eax
je 0x1004a92d
cmp edi, ecx
jg 0x1004a8ff
jl 0x1004a8f5
cmp esi, eax
jae 0x1004a8ff
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x1004a935
mov ecx, dword [ebp + 8]
jmp 0x1004a93f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x1004a959
jg 0x1004a93f
test esi, esi
je 0x1004a959
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x1004a959
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1004a970
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0x10]
sub esp, 0xc
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
test eax, eax
jg 0x1004a99b
jl 0x1004a98e
test ecx, ecx
jne 0x1004a99b
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x1004a9b7
push eax
push ecx
push dword [ebp + 8]
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov eax, dword [eax]
mov dword [esp + 0x14], eax
test eax, eax
je 0x1004aa09
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [esp + 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x1004aa10
mov edi, dword [ebp + 8]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [esp + 0x18]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x20], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [esp + 0x14]
jmp 0x1004aa13
lea eax, [ebx + 0x2c]
mov dword [esp + 0x10], eax
mov esi, dword [ebp + 8]
cmp dword [ebx + 0x4c], 0
je 0x1004aa86
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x1004aa3d
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x1004aa74
nop word [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x1004aa86
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x1004aa50
test edi, edi
je 0x1004aa86
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1004aed0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1026dbac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1004af00
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d6fbe
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x1004af30
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x1004af30
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d6fbe
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1004b008
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1004af59
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1004af65
movsx eax, bl
jmp 0x1004af9d
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x1004afc7
sub eax, 1
je 0x1004afc7
sub eax, 2
jne 0x1004b008
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d6fbe
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1004afe5
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1004b008
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d6fbe
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101d6fbe
mov esp, ebp
pop ebp
ret 4
Function at 0x1004c3d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1026dbac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1004c48c
cmp byte [esi + 0x3d], 0
je 0x1004c48c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1004c47a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1004c441
sub eax, 1
je 0x1004c445
sub eax, 2
jne 0x1004c47a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d6fbe
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1004c463
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1004c47a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d6fbe
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d6fbe
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.101d6fbe
mov esp, ebp
pop ebp
ret
Function at 0x1004ebe0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [0x1026dbac]
xor eax, esp
mov dword [esp + 0x198], eax
push ebx
push esi
push edi
mov dword [esp + 0x138], str.Fiddler.exe
lea edi, [esp + 0x138]
mov dword [esp + 0x13c], str.Wireshark.exe
mov dword [esp + 0x140], str.Charles.exe
mov dword [esp + 0x144], str.OllyDbg.exe
mov dword [esp + 0x148], str.IDA.exe
mov dword [esp + 0x14c], str.x64dbg.exe
mov dword [esp + 0x150], str.Cheat_Engine.exe
mov dword [esp + 0x154], str.Ghidra.exe
mov dword [esp + 0x158], str.ImmunityDebugger.exe
mov dword [esp + 0x15c], str.Windbg.exe
mov dword [esp + 0x160], str.Radare2.exe
mov dword [esp + 0x164], str.BinaryNinja.exe
mov dword [esp + 0x168], str.Hopper.exe
mov dword [esp + 0x16c], str.dnSpy.exe
mov dword [esp + 0x170], str.ProcMon.exe
mov dword [esp + 0x174], str.Wireshark.exe
mov dword [esp + 0x178], str.Fiddler.exe
mov dword [esp + 0x17c], str.Charles.exe
mov dword [esp + 0x180], str.HTTPDebugger.exe
mov dword [esp + 0x184], str.WireShark.exe
mov dword [esp + 0x188], str.ProcessHacker.exe
mov dword [esp + 0x18c], str.Wireshark.exe
mov dword [esp + 0x190], str.WinDbg.exe
mov dword [esp + 0x194], str.ReClassEx.exe
mov dword [esp + 0x198], str.xAnalyzer.exe
mov ebx, dword [edi]
push 0
push 2
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x1004ed6c
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x128
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_Process32First]
test eax, eax
je 0x1004ed65
lea eax, [esp + 0x34]
push ebx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x1004ed91
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_Process32Next]
test eax, eax
jne 0x1004ed42
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
add edi, 4
lea eax, [esp + 0x19c]
cmp edi, eax
jne 0x1004ed17
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x198]
xor ecx, esp
call fcn.101d6fbe
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [esp + 0x1a4]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.101d6fbe
mov esp, ebp
pop ebp
ret
Function at 0x1004f2e0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov eax, dword [0x1026dbac]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_OpenClipboard]
mov esi, ecx
mov dword [esp + 8], esi
push 0
mov dword [esp + 0xc], esi
call edi
push 0
call edi
test eax, eax
je 0x1004f326
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
jne 0x1004f35b
call dword [sym.imp.USER32.dll_CloseClipboard]
xorps xmm0, xmm0
mov eax, esi
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.101d6fbe
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
mov edx, eax
test edx, edx
je 0x1004f320
mov ecx, edx
mov dword [esp + 0x20], 0
xorps xmm0, xmm0
mov dword [esp + 0x24], 0
movaps xmmword [esp + 0x10], xmm0
lea eax, [ecx + 1]
mov dword [esp + 8], eax
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1004f390
sub ecx, dword [esp + 8]
push ecx
push edx
lea ecx, [esp + 0x18]
call fcn.1004d740
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [esp + 0x3c]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov eax, esi
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 0x14], 0
pop edi
movups xmmword [esi], xmm0
movq xmm0, qword [esp + 0x1c]
movq qword [esi + 0x10], xmm0
pop esi
xor ecx, esp
call fcn.101d6fbe
mov esp, ebp
pop ebp
ret

Function at 0x10051d70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101db41d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1026dbac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 4
call fcn.101d6fe4
mov edx, dword [ebp + 8]
mov dword [ebp + 8], eax
mov dword [eax], edx
lea edi, [esi + 4]
mov dword [ebp - 4], 0
push edi
push 0
push eax
push 0x10051f10
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x10051de1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 6
mov dword [edi], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3