joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402718
Capabilities:
Encode data using xor

Disassembly:
or esi, dword [edx - 0x5a5a5a68]
call 0x5ab1082a
pop edx
pop edx
mov dl, 0x1c
mov cl, 0xa5
movsd dword es:[edi], dword [esi]
rcr dword [ebp - 0x2ec16595], cl
pop edx
int1
loop 0x40263a
pop edx
pop edx
pop edx
mov dl, 0x6e
mov cl, 0xa5
movsd dword es:[edi], dword [esi]
rcr dword [ebp - 0x5a49944e], cl
movsd dword es:[edi], dword [esi]
or dh, cl
loop 0x402664
pop edx
pop edx
pop edx
mov dl, 0x7b
mov cl, 0xa5
movsd dword es:[edi], dword [esi]
rcr dword [ebp + 0x61da5f02], cl
push ds
pop edx
rcr dword [edx - 0xf], 1
loop 0x402683
pop edx
pop edx
pop edx
mov dl, 0x56
mov cl, 0xa5
movsd dword es:[edi], dword [esi]
rcr dword [ebp - 0x4df56595], cl
in al, 0xb6
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
int1
call 0xe2d9f97b
push edx
pop edx
pop edx
pop edx
mov dl, 0xa9
mov al, 0xa5
movsd dword es:[edi], dword [esi]
shl dword [edx - 0x21], 1
movsd dword es:[edi], dword [esi]
das
pop eax
rol dword [edx - 0x53], cl
pop esi
jle 0x402690
pop edx
pop edx
pop edx
das
dec eax
loop 0x402690
pop edx
pop edx
pop edx
mov dl, 0x82
mov al, 0xa5
movsd dword es:[edi], dword [esi]
rcr dword [ebp - 0x5a5d004e], cl
movsd dword es:[edi], dword [esi]
int1
mov dl, 0x29
mov dword [0x4cb2a5a5], eax
cmpsd dword [esi], dword es:[edi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dl, 7
cmpsd dword [esi], dword es:[edi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dl, 0x46
movsb byte es:[edi], byte [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add ebx, edi
xchg ebx, eax
push edi
push edi
imul ebx, dword [edx + 0x5a5a4ab2], 0x5a
aad 0x5a
fstp dword [esi - 0x58804d8a]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov bl, 0xda
mov byte [0x901a5a5], al
invalid
pop edx
fistp dword [ecx + 0x5a1e0b59]
or dword [esi], edi
movsd dword es:[edi], dword [esi]
push 0x3e
sar dword [edx - 0x23], cl
jp 0x40266f
pop edx
psrlq mm7, qword [edi + 0xd0c0b09]
rol dword [edi], 1
push esi
shr dword [edi], 1
dec edx
rcr dword [ecx], 1
push edx
rcr esp, cl
loop 0x402701
pop edx
pop edx
rol esp, cl
sahf
pop edx
pop edx
pop edx
xlatb
sub dword [esi - 0x18], edx
pop ebx
loop 0x4026f8
pop edx
pop edx
pop edx
mov dl, 4
mov al, 0xa5
movsd dword es:[edi], dword [esi]
rcr dword [ebp + 0x5a5a53e3], cl
pop edx
cmpsb byte [esi], byte es:[edi]
test eax, 0x59a6bff
add al, 3
add dword [edi], eax
cdq
cdq
xlatb
sbb bl, byte [edx - 0x3d]
lea eax, [eax]
mov edx, eax
call 0x4026df
pop eax
sub eax, 0x44514f
mov esi, 0x443b88
mov ecx, 0x445144
sub ecx, esi
add esi, eax
mov edi, esi
cld
lodsb al, byte [esi]
xor al, 0x5a
pop edx
stosb byte es:[edi], al
dec ecx
jne 0x4026f6
test edx, edx
je 0x402712
mov eax, 8
call fcn.0040111c
mov edx, dword [esp + 0x28]
mov dword [eax], edx
inc ecx
jmp 0x4025c4
xor eax, eax
jmp 0x4026d8
Function at 0xd25433
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov dword [esp], ecx
mov esi, edx
mov edi, eax
mov eax, dword [esp]
inc eax
cmp eax, 5
jge 0xd25450
xor eax, eax
jmp 0xd254d8
mov cl, byte [esi]
and cl, 0xff
and ecx, 0xff
mov eax, ecx
mov ebx, 9
cdq
idiv ebx
mov dword [esp + 4], edx
mov eax, ecx
mov ecx, 9
cdq
idiv ecx
mov ecx, eax
mov eax, ecx
mov ebx, 5
cdq
idiv ebx
mov dword [esp + 8], edx
mov eax, ecx
mov ecx, 5
cdq
idiv ecx
mov dword [esp + 0xc], eax
xor ebx, ebx
xor eax, eax
mov ecx, eax
shl ecx, 3
lea edx, [eax + 1]
mov dl, byte [esi + edx]
and dl, 0xff
and edx, 0xff
shl edx, cl
add ebx, edx
inc eax
cmp eax, 4
jne 0xd25495
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, edi
call fcn.00d24f5f
test al, al
jne 0xd254cf
xor eax, eax
jmp 0xd254d8
mov edx, ebx
mov eax, edi
call fcn.00d24f0f
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000e373
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000e3b2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000e3b2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000e3b2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000e3b2
cmp dword [ecx + 0x74], 0xe
jbe 0x1000e3b2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001102f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100110cc
push ebx
push esi
call fcn.10010ff8
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10010f8c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10011079
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100110cb
push edi
push eax
call fcn.10011fea
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10011099
call fcn.1000fad4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100110ca
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10010f8c
add esp, 0x20
test eax, eax
jne 0x100110b8
push edi
call fcn.1000fad4
jmp 0x100110c0
push ebx
call fcn.1000fad4
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10011339
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10018888
push 0x10018880
push str.FlsAlloc
push 0x1f
call fcn.10011255
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001136d
push dword [ebp + 8]
mov ecx, esi
call dword [0x10017150]
call esi
jmp 0x10011373
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100113b7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10018898
push 0x10018890
push str.FlsGetValue
push 0x21
call fcn.10011255
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100113ee
push dword [ebp + 8]
mov ecx, esi
call dword [0x10017150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100113f6
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100188a0
push 0x10018898
push str.FlsSetValue
push 0x22
call fcn.10011255
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10011430
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10017150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10016ab0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10016add
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10016add
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x100252c0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x100252fb
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x100252e2
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x100252f3
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x100252fd
inc edi
add eax, 0x28
cmp edi, esi
jb 0x100252d8
xor eax, eax
pop edi
pop esi
ret

Function at 0x100254fb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.10025280
cwde
jge 0x10025555
sbb al, 0x8d
inc ebp
test al, 0x50
call fcn.10025290
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.10025245
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x1002556e
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.10025280
mov ebx, 0x8d0cde91
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x100256a3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10025290
push eax
push esi
push dword [ebp + 8]
call fcn.10025245
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10025280
xor dl, byte gs:[0x7c9d88bd]
invalid

Function at 0x10025727
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
push ss
Function at 0x1002579b
Capabilities:
Inspect section memory permissions

Disassembly:
je 0x10025a79
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.100251f1
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x100257f0
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.100251f1
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x100257bd
call fcn.10025280
lcall 0x3c7e, 0x8be6f968
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x10025a6f
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x10025825
cmp dword [eax + 0xc], ebx
je 0x100258c8
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.10025280
invalid
add byte [eax], al
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x10]
mov eax, dword [eax]
cmp eax, ebx
lea edi, [ecx + esi]
jne 0x10025868
mov dword [ebp + 0x10], edi
jmp 0x1002586d
add eax, esi
mov dword [ebp + 0x10], eax
call fcn.10025280
out 0x7e, eax
push ebp
mov eax, dword ss:[ebp + 0x10]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x100258b6
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x10025891
and eax, 0xffff
push eax
jmp 0x10025895
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10025245
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x10025a6f
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x10025876
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
jmp 0x10025817
call fcn.10025280
ja 0x10025852
dec esp
pushal
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x10025934
add eax, esi
cmp dword [eax], ebx
je 0x10025934
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x1002592f
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x10025919
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x10025921
cmp edx, ebx
jne 0x10025a6f
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x100258f0
add eax, dword [eax + 4]
jmp 0x100258dd
mov dword [ebp + 0xc], ebx
jmp 0x1002593f
Function at 0x100259a2
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10025957
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10025975
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x100259d3
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x100259ba
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x100259c3
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x100259cd
invalid
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x100259af
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10025939
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x100259c7
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10025957
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10025975
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x100259d3
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x100259ba
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x100259c3
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x100259cd
invalid
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x100259af
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10025939
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x100274ed
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10094653
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push edi
mov eax, dword [0x100ae210]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [0x100aee70]
mov ecx, 0x100aee70
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, esi
mov dword [esp + 0x30], ebx
call fcn.1002605c
test al, al
je 0x1002757a
mov dword [esp + 0x14], ebx
push esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 1
call fcn.10025349
push dword [esp + 0x14]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
lea eax, [esp + 0x10]
jne 0x1002756e
push esi
push 0x10005158
jmp 0x100275c2
push dword [esp + 0x14]
push esi
push 0x100051f8
jmp 0x100275d7
cmp esi, 0x80004004
jne 0x10027597
push 0x100052a8
push 0x22
pop ebx
lea eax, [esp + 0x14]
call fcn.10078bdc
xor ebx, ebx
jmp 0x100275ee
mov dword [esp + 0x14], ebx
push esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 2
call fcn.10025349
push dword [esp + 0x14]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
lea eax, [esp + 0x10]
jne 0x100275cd
push esi
push 0x100052f0
push eax
call fcn.10078b7a
add esp, 0xc
jmp 0x100275e0
push dword [esp + 0x14]
push esi
push 0x10005370
push eax
call fcn.10078b7a
add esp, 0x10
mov byte [esp + 0x30], bl
push dword [esp + 0x14]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0x10004a58
lea eax, [esp + 0x1c]
push eax
call fcn.1005833e
mov byte [esp + 0x30], 3
mov eax, dword [edi]
or eax, dword [edi + 4]
je 0x1002764d
push ebx
call fcn.1007b76c
pop ecx
mov ecx, dword [edi]
mov edi, dword [edi + 4]
sub eax, ecx
sbb edx, edi
lea ecx, [esp + 0x14]
lea ebx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
call 0x1002723a
lea edi, [esp + 0x18]
mov byte [esp + 0x30], 4
call fcn.100584b9
mov byte [esp + 0x30], 3
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.10078f0e
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
lea edi, [esp + 0x18]
call fcn.10058c24
mov ecx, dword [ebp + 8]
mov byte [esp + 0x30], 5
push dword [eax]
mov edx, dword [ecx]
call dword [edx + 0x4c]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.10078f0e
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.10078f0e
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
call fcn.10078f0e
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100356a3
Capabilities:
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1009625f
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x100ae210]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push dword [ebp + 0x10]
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push 0x10005e9c
push eax
call fcn.1005833e
lea eax, [esp + 0x1c]
push eax
call fcn.1006988c
and dword [esp + 0x34], 0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x24], esp
mov esi, esp
call fcn.10078eab
add eax, 0x10
mov dword [esi], eax
lea eax, [esp + 0x18]
push eax
call fcn.1002a8cc
mov byte [esp + 0x30], 2
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.10078f0e
push dword [ebp + 8]
lea eax, [esp + 0x14]
push eax
call fcn.100357e5
push dword [ebp + 0x10]
mov bl, al
push ecx
mov eax, esp
mov dword [esp + 0x24], esp
push 0x10009498
push eax
call fcn.1005833e
lea eax, [esp + 0x24]
push eax
call fcn.1006988c
mov byte [esp + 0x34], 3
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x28], esp
mov esi, esp
call fcn.10078eab
add eax, 0x10
mov dword [esi], eax
lea eax, [esp + 0x20]
push eax
call fcn.1002a8cc
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, eax
mov eax, dword [esp + 0x10]
cmp eax, dword [esi]
je 0x10035795
push eax
call edi
mov eax, dword [esi]
mov dword [esp + 0x10], eax
and dword [esi], 0
push dword [esp + 0x18]
call edi
mov byte [esp + 0x30], 2
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
call fcn.10078f0e
push dword [ebp + 0xc]
lea eax, [esp + 0x14]
push eax
call fcn.100357e5
test bl, bl
jne 0x100357c1
test al, al
je 0x100357c3
mov bl, 1
push dword [esp + 0x10]
call edi
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10045238
Capabilities:
Enumerate processes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x100ae210]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x100452bd
push 0x228
lea eax, [ebp - 0x22c]
push edi
push eax
call fcn.1007e770
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
push esi
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x100452a9
mov eax, dword [ebp - 0x228]
cmp eax, dword [ebp + 8]
je 0x100452b0
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x10045290
jmp 0x100452b6
mov edi, dword [ebp - 0x218]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.1007b091
leave
ret 4
Function at 0x1004531e
Capabilities:
Delete file

Disassembly:
push 4
mov eax, 0x1008fa12
call fcn.10086e1a
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.10078eab
lea edi, [eax + 0x10]
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 0xc]
push 0x1001ab18
xor ebx, ebx
mov eax, esi
mov byte [ebp - 4], 1
call fcn.10078bdc
mov eax, dword [esi]
mov edx, dword [eax - 8]
xor ecx, ecx
inc ecx
sub ecx, dword [eax - 4]
mov eax, 0x208
sub edx, eax
or ecx, edx
jge 0x10045371
mov ecx, esi
call fcn.10078d3a
push dword [esi]
xor ebx, ebx
push ebx
push 0x10015c78
push edi
call fcn.1004530d
test eax, eax
jne 0x1004538f
lea eax, [edi - 0x10]
call fcn.10078f0e
jmp 0x100453ad
or eax, 0xffffffff
call fcn.10078afc
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
lea eax, [edi - 0x10]
je 0x10045388
call fcn.10078f0e
mov bl, 1
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.10078f0e
mov al, bl
call fcn.10086f06
ret 8

Function at 0x10045531
Capabilities:
Enumerate gui resources

Disassembly:
push 0x30
mov eax, 0x10095a4a
call fcn.10086e1a
push 0x1000c9f4
lea eax, [ebp - 0x14]
push eax
call fcn.1005833e
and dword [ebp - 4], 0
mov edi, 0x1000ca50
push edi
lea eax, [ebp - 0x20]
push eax
call fcn.1005833e
mov byte [ebp - 4], 1
lea eax, [ebp - 0x14]
push 0x1000ca08
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], esi
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 8]
mov edi, ebx
call fcn.1005b6dd
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
push eax
push 0x100457ae
mov dword [ebp - 0x30], esi
call dword [sym.imp.USER32.dll_EnumWindows]
lea eax, [ebp - 0x2c]
lea edi, [ebp - 0x3c]
mov byte [ebp - 4], 3
call fcn.10045740
push ebx
push dword [ebp + 8]
lea edi, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.1004565a
mov eax, dword [esi]
xor edi, edi
mov ecx, esi
cmp dword [ebx + 4], edi
jne 0x10045602
push 0x1000ca60
push 2
call dword [eax + 4]
lea edi, [ebp - 0x2c]
call fcn.1005b6dd
lea edi, [ebp - 0x3c]
call fcn.1005b6dd
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0
call fcn.1002395e
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.10078f0e
xor eax, eax
call fcn.10086f06
ret 4
push 0x1000ca8c
push 2
call dword [eax + 4]
call fcn.100454e9
mov eax, dword [eax]
mov edx, dword [esi]
push eax
push 2
mov ecx, esi
call dword [edx + 4]
mov eax, dword [ebx + 4]
test eax, eax
jle 0x100455d0
and dword [ebp + 8], edi
test edi, edi
js 0x1004564f
cmp edi, eax
jge 0x1004564f
mov eax, dword [ebx]
add eax, dword [ebp + 8]
mov edx, dword [esi]
mov eax, dword [eax + 0x10]
push eax
push 2
mov ecx, esi
call dword [edx + 4]
mov eax, dword [ebx + 4]
add dword [ebp + 8], 0x14
inc edi
cmp edi, eax
jl 0x10045627
jmp 0x100455d0
call fcn.100778c8
int3