joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41efd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0xc]
sub eax, dword [ecx]
push edi
sub eax, 0x10
sar eax, 4
sub eax, ebx
mov dword [esp + 0x34], 1
je 0x41f14e
jmp 0x41f006
mov eax, dword [esp + 0x38]
mov ecx, dword [esi + 0x14]
dec eax
mov dword [esp + 0x38], eax
test ebx, ebx
jle 0x41f072
mov eax, ebx
shl eax, 4
add eax, dword [ecx]
cmp eax, dword [esi + 0xc]
jb 0x41f0b0
lea edx, [esp + 0x3c]
mov edi, ebx
push edx
mov ebx, esi
call fcn.00410a70
add esp, 4
test eax, eax
je 0x41f15a
cmp dword [esp + 0x34], 0
je 0x41f12d
mov ecx, dword [ebp + 0xc]
mov edi, dword [esp + 0x3c]
push ecx
push edi
push 1
push eax
call fcn.0049e390
add esp, 0x10
cmp eax, edi
jne 0x41f12d
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x34], 1
jmp 0x41f138
cmp ebx, 0xfff0b9d8
jle 0x41f084
mov eax, ebx
shl eax, 4
add eax, dword [esi + 0xc]
jmp 0x41f0b0
jne 0x41f08e
mov eax, dword [esi + 0x10]
add eax, 0x28
jmp 0x41f0b0
mov ecx, dword [ecx]
mov eax, 0xfff0b9d8
sub eax, ebx
cmp dword [ecx + 8], 0x16
je 0x41f022
mov ecx, dword [ecx]
movzx edx, byte [ecx + 6]
cmp eax, edx
jg 0x41f022
shl eax, 4
add eax, ecx
cmp eax, 0x4bad78
je 0x41f022
mov eax, dword [eax + 8]
and eax, 0xf
cmp eax, 3
jne 0x41f022
mov eax, ebx
mov ecx, esi
call fcn.00410680
mov edx, esi
test eax, eax
je 0x41f0f4
xor edi, edi
mov eax, ebx
call fcn.00410960
push edx
push eax
mov eax, dword [ebp + 0xc]
push str._lld
push eax
call fcn.0049db2e
jmp 0x41f115
mov eax, dword [ebp + 0x10]
xor ebx, ebx
call fcn.004108d0
mov ecx, dword [ebp + 0xc]
sub esp, 8
fstp qword [esp]
push str._.14g
push ecx
call fcn.0049db2e
mov ebx, dword [ebp + 0x10]
add esp, 0x10
cmp dword [esp + 0x34], 0
je 0x41f130
test eax, eax
jle 0x41f130
mov dword [esp + 0x34], 1
jmp 0x41f138
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x34], 0
inc ebx
cmp dword [esp + 0x38], 0
mov dword [ebp + 0x10], ebx
jne 0x41f002
cmp dword [esp + 0x34], 0
je 0x41f16c
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [str.string]
mov eax, dword [ebp + 0x10]
push edx
push eax
mov eax, esi
call fcn.0040a620
call fcn.00482abe
mov ebx, dword [eax]
mov ecx, dword [esi + 0xc]
mov dword [ecx + 8], 0
add dword [esi + 0xc], 0x10
push ebx
call fcn.00481988
mov edi, eax
add esp, 4
test edi, edi
jne 0x41f198
mov edx, dword [esi + 0xc]
mov dword [edx + 8], eax
jmp 0x41f1ca
mov eax, dword [esi + 0x10]
cmp dword [eax + 0xc], 0
jle 0x41f1aa
push esi
call fcn.0043b130
add esp, 4
push esi
mov esi, edi
call fcn.00437850
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0xc]
mov esi, dword [ebp + 8]
mov dword [ecx], eax
movzx edx, byte [eax + 4]
add esp, 4
or edx, 0x40
mov dword [ecx + 8], edx
mov edi, 0x10
add dword [esi + 0xc], edi
mov ecx, dword [esi + 0xc]
mov eax, ebx
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov dword [ecx + 8], 0x13
add dword [esi + 0xc], edi
lea eax, [edi - 0xd]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x422e40
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
lea edi, [esi + 0x28]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x24]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
push ecx
push 1
push edx
call fcn.0049e390
mov ebx, eax
mov eax, dword [esi + 0x24]
push eax
call fcn.0048d649
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, ebx
pop ebx
ret 8

Function at 0x423690
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4ac678
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
mov eax, dword [0x4d4f10]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x28], esp
push 0xffffffffffffffff
mov dword [esp + 0x54], 0
push 0
lea eax, [esp + 0x60]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push eax
mov byte [ecx + 4], 0
call fcn.00401990
lea esi, [esp + 0x2c]
call fcn.00407a80
mov esi, 8
add esp, 0x1c
cmp dword [eax + 0x18], esi
jb 0x423701
mov eax, dword [eax + 4]
jmp 0x423704
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne bl
cmp dword [esp + 0x28], esi
jb 0x423723
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0047afc0
add esp, 4
xor edx, edx
cmp dword [esp + 0x54], 0x10
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], dx
jb 0x42374e
mov eax, dword [esp + 0x40]
push eax
call fcn.0047afc0
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x423c70
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4ac458
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x4d4f10]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov eax, dword [esp + 0x44]
sub esp, 0x1c
mov esi, esp
xor ebx, ebx
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
mov word [esi + 4], cx
mov ecx, eax
mov dword [esp + 0x30], esp
lea edi, [ecx + 2]
lea ebx, [ebx]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x423cc0
sub ecx, edi
sar ecx, 1
push ecx
call fcn.00407520
lea ecx, [esp + 0x34]
call fcn.00407310
add esp, 0x1c
mov esi, 0x10
mov dword [esp + 0x3c], ebx
cmp dword [eax + 0x18], esi
jb 0x423cf4
mov eax, dword [eax + 4]
jmp 0x423cf7
add eax, 4
mov ecx, eax
call fcn.00423b10
mov bl, al
cmp dword [esp + 0x30], esi
jb 0x423d13
mov edx, dword [esp + 0x1c]
push edx
call fcn.0047afc0
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x30
ret

Function at 0x423ea0
Capabilities:
Get common file path
Get startup folder

Disassembly:
sub esp, 0x418
mov eax, dword [0x4d4f10]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
xor eax, eax
push 0x40e
mov esi, ecx
push eax
lea ecx, [esp + 0x12]
push ecx
mov dword [esp + 0x10], 0
mov word [esp + 0x14], ax
call fcn.0047ecc0
mov eax, dword [esp + 0x42c]
add esp, 0xc
lea edx, [esp + 8]
push edx
push 0
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor ecx, ecx
lea eax, [esp + 8]
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
mov word [esi + 4], cx
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x423f10
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0xc]
call fcn.00407520
mov ecx, dword [esp + 0x418]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0047afcb
add esp, 0x418
ret
Function at 0x423f50
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0xffffffffffffffff
push 0x4ac842
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x4d4f10]
xor eax, esp
mov dword [esp + 0x41c], eax
push esi
push edi
mov eax, dword [0x4d4f10]
xor eax, esp
push eax
lea eax, [esp + 0x42c]
mov dword fs:[0], eax
xor eax, eax
mov esi, ecx
push 0x410
push eax
lea ecx, [esp + 0x1e]
mov dword [esp + 0x14], 0
push ecx
mov dword [esp + 0x1c], esi
mov word [esp + 0x20], ax
call fcn.0047ecc0
lea edi, [esi + 4]
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
add esp, 0xc
mov word [edi], dx
push edx
push 0x1a
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x440], edx
push edx
mov dword [esp + 0x1c], 1
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
setne al
test al, al
je 0x42400e
lea eax, [esp + 0x14]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x423ff5
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x18]
call fcn.00407520
cmp dword [esi + 0x18], 8
jb 0x424018
mov eax, dword [edi]
jmp 0x42401a
mov eax, edi
push eax
push 0x4bcd98
push 0x125
push 8
call fcn.00422dc0
mov ecx, str.d:worktrunkpluginscommon_base_folder.hpp
mov edx, eax
call fcn.00422e80
add esp, 0x10
mov eax, esi
mov ecx, dword [esp + 0x42c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.0047afcb
add esp, 0x42c
ret

Function at 0x424070
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x4d4f10]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0x12]
push ecx
mov dword [esp + 0x10], 0
mov word [esp + 0x14], ax
call fcn.0047ecc0
add esp, 0xc
lea edx, [esp + 8]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
sub esp, 0x1c
mov esi, esp
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
mov word [esi + 4], ax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], esp
lea edx, [eax + 2]
jmp 0x4240e0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4240e0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x28]
call fcn.00407520
mov ecx, edi
call fcn.00407310
mov ecx, dword [esp + 0x230]
add esp, 0x1c
pop esi
xor ecx, esp
mov eax, edi
call fcn.0047afcb
add esp, 0x214
ret

Function at 0x424120
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x4d4f10]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
xor eax, eax
push 0x208
mov esi, ecx
push eax
lea ecx, [esp + 0x12]
push ecx
mov dword [esp + 0x10], 0
mov word [esp + 0x14], ax
call fcn.0047ecc0
add esp, 0xc
lea edx, [esp + 8]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
mov word [esi + 4], ax
lea eax, [esp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x424184
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0xc]
call fcn.00407520
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0047afcb
add esp, 0x214
ret
Function at 0x425980
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4259b8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4259b8
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0xc]
push eax
push esi
call fcn.00424dc0
add esp, 8
mov al, 1
pop esi
pop ecx
ret
xor al, al
pop esi
pop ecx
ret

Function at 0x4259c0
Capabilities:
Set registry value

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push ecx
push edx
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x425a1b
mov ecx, dword [esp + 8]
mov edx, dword [esp]
push esi
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
pop ecx
ret
xor al, al
pop ecx
ret

Function at 0x425a20
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push ecx
push edx
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x425a8f
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x425a51
mov ecx, dword [esp + 0xc]
sub eax, edx
mov edx, dword [esp + 4]
sar eax, 1
add eax, eax
push eax
push esi
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
pop ecx
ret
xor al, al
pop esi
pop ecx
ret

Function at 0x425aa0
Capabilities:
Set registry value

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push ecx
push edx
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x425aff
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push esi
push eax
mov eax, dword [esp + 8]
push ecx
push 3
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
pop ecx
ret
xor al, al
pop ecx
ret
Function at 0x425cd0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x420
mov eax, dword [0x4d4f10]
xor eax, esp
mov dword [esp + 0x41c], eax
mov eax, dword [esp + 0x424]
push esi
mov esi, edx
lea edx, [esp + 4]
push edx
push 0x20019
push 0
push ecx
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x425d7d
push 0x40e
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.0047ecc0
add esp, 0xc
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 8]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push esi
push edx
mov dword [esp + 0x20], 0x410
mov dword [esp + 0x24], 2
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.0047afcb
add esp, 0x420
ret
mov ecx, dword [esp + 0x420]
pop esi
xor ecx, esp
xor al, al
call fcn.0047afcb
add esp, 0x420
ret

Function at 0x425da0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x230
mov eax, dword [0x4d4f10]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
push ebp
push esi
xor ebx, ebx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 0xc]
push eax
mov ebp, 0x22c
push esi
mov dword [esp + 0x14], ebp
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x425df3
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0047afcb
add esp, 0x230
ret
lea ecx, [esp + 0xc]
push ecx
push esi
mov dword [esp + 0x14], ebp
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x425e2f
push edi
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x425e2b
lea eax, [esp + 0xc]
push eax
push esi
mov dword [esp + 0x14], ebp
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x425e06
jmp 0x425e2f
mov ebx, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x238]
pop esi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0047afcb
add esp, 0x230
ret
Function at 0x425e50
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x4abcbb
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x4d4f10]
xor eax, esp
mov dword [esp + 0x254], eax
push ebp
push esi
push edi
mov eax, dword [0x4d4f10]
xor eax, esp
push eax
lea eax, [esp + 0x26c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x27c]
lea ecx, [esp + 0x10]
xor ebp, ebp
push ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ebp
call fcn.0042ba20
push ebp
push 2
mov dword [esp + 0x27c], ebp
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea edx, [esp + 0x34]
mov edi, eax
push edx
mov esi, 0x22c
push edi
mov dword [esp + 0x3c], esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x425ef3
push ebx
lea ecx, [esp + 0x14]
call fcn.0042c7c0
mov eax, dword [esp + 0x1c]
cmp eax, ebp
je 0x425ee9
push eax
call fcn.0047afc0
add esp, 4
mov eax, dword [esp + 0x10]
push eax
jmp 0x425fb7
lea ecx, [esp + 0x34]
push ecx
push edi
mov dword [esp + 0x3c], esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x425f90
mov edx, dword [esp + 0x28]
push edx
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x425f75
mov edx, dword [esp + 0x1c]
cmp edx, ebp
jne 0x425f2a
xor ecx, ecx
jmp 0x425f33
mov ecx, dword [esp + 0x24]
sub ecx, edx
sar ecx, 2
mov eax, dword [esp + 0x20]
mov esi, eax
sub esi, edx
sar esi, 2
cmp esi, ecx
jae 0x425f51
mov ecx, dword [esp + 0x3c]
mov dword [eax], ecx
add eax, 4
mov dword [esp + 0x20], eax
jmp 0x425f75
mov esi, eax
cmp edx, eax
jbe 0x425f5c
call fcn.0047bcaa
mov eax, dword [esp + 0x10]
push esi
push eax
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x20]
call fcn.0042d960
lea ecx, [esp + 0x34]
push ecx
push edi
mov dword [esp + 0x3c], 0x22c
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x425f0a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
lea ecx, [esp + 0x14]
call fcn.0042c7c0
mov eax, dword [esp + 0x1c]
cmp eax, ebp
je 0x425fb2
push eax
call fcn.0047afc0
add esp, 4
mov edx, dword [esp + 0x10]
push edx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
call fcn.0047afc0
mov eax, ebx
add esp, 4
mov ecx, dword [esp + 0x26c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x254]
xor ecx, esp
call fcn.0047afcb
add esp, 0x268
ret
Function at 0x4261d0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x23c
mov eax, dword [0x4d4f10]
xor eax, esp
mov dword [esp + 0x238], eax
mov eax, dword [esp + 0x240]
push ebx
push ebp
push esi
push edi
push 0x228
lea ecx, [esp + 0x1c]
push 0
push ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0x22c
call fcn.0047ecc0
add esp, 0xc
push 0
push 0xf
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea edx, [esp + 0x14]
mov esi, eax
push edx
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4262a6
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x426240
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x3c]
push ecx
call fcn.0047b776
add esp, 8
test eax, eax
jne 0x426297
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x254], eax
je 0x426297
push eax
push 0
push 1
call edi
test eax, eax
jne 0x426292
call ebx
push eax
push str.Open_Process_failed:__d
push 0x2b4
push 8
call fcn.00422dc0
push eax
mov ecx, str.d:workTrunkpluginscommon_base_process.hpp
call fcn.00423150
add esp, 0x14
jmp 0x426297
push 0
push eax
call ebp
lea edx, [esp + 0x14]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x426240
test esi, esi
je 0x4262b1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x248]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov al, 1
call fcn.0047afcb
add esp, 0x23c
ret

Function at 0x42bb70
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4ac5c7
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4d4f10]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [edi], 0x4bd5ac
mov dword [edi + 0x54], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 4]
push esi
mov dword [esp + 0x20], ebx
push edi
mov dword [esp + 0x18], 1
call fcn.0042cac0
mov dword [esp + 0x1c], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
call fcn.0042dc80
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x4d9564]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x42dc80
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4ab39b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4d4f10]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0049d05b
push 4
mov dword [esp + 0x20], 0
call fcn.0047b1f3
mov edi, eax
add esp, 4
test edi, edi
je 0x42dcfe
call fcn.00445424
mov dword [edi], eax
call fcn.00445252
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00445574
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x42dcf3
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.0044559c
jmp 0x42dd00
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x436c10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x88
push esi
push edi
mov edi, eax
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
lea eax, [esp + 0x10]
push eax
push ebx
call fcn.004367d0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
push ebx
mov dword [esp + 0x20], eax
mov esi, eax
call fcn.00436850
add esp, 0x14
add esi, eax
cmp dword [edi + 8], 0x13
jne 0x436d25
mov eax, dword [edi]
mov edi, dword [edi + 4]
test edi, edi
jl 0x436d25
jg 0x436ce3
test eax, eax
jbe 0x436d25
test edi, edi
ja 0x436d25
jb 0x436cf0
cmp eax, 0x80000000
ja 0x436d25
test eax, eax
je 0x436d25
dec eax
xor ecx, ecx
cmp eax, 0x100
jb 0x436d0d
mov edi, edi
shr eax, 8
add ecx, 8
cmp eax, 0x100
jae 0x436d00
movzx eax, byte [eax + 0x4bd8e8]
add eax, ecx
inc dword [esp + eax*4 + 0x10]
lea eax, [esp + eax*4 + 0x10]
mov eax, 1
jmp 0x436d27
xor eax, eax
add dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.00436770
sub esi, dword [esp + 0x14]
mov edx, dword [esp + 0x9c]
inc esi
push esi
push eax
push edx
mov eax, ebx
call fcn.00436a50
add esp, 0x14
pop edi
pop esi
add esp, 0x88
ret

Function at 0x437420
Capabilities:
Encode data using xor

Disassembly:
cmp byte [esi + 6], 0
jne 0x437467
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, eax
shr edx, 5
inc edx
xor ecx, eax
cmp eax, edx
jb 0x43745d
push ebx
push edi
lea ebx, [ebx]
movzx edi, byte [esi + eax + 0xf]
mov ebx, ecx
shl ebx, 5
add edi, ebx
mov ebx, ecx
shr ebx, 2
add edi, ebx
sub eax, edx
xor ecx, edi
cmp eax, edx
jae 0x437440
pop edi
pop ebx
mov dword [esi + 8], ecx
mov byte [esi + 6], 1
mov eax, ecx
ret
mov eax, dword [esi + 8]
ret