joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413320
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x1834
call fcn.004473e0
push esi
push edi
push str.Psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x413344
pop edi
pop esi
add esp, 0x1834
ret
xor esi, esi
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x840]
mov dword [esp + 0x83c], esi
mov dword [esp + 0x14], esi
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
lea ecx, [esp + 0x83c]
push eax
push 0x1000
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x413385
pop edi
pop esi
add esp, 0x1834
ret
mov eax, dword [esp + 0x14]
mov dword [esp + 8], esi
shr eax, 2
je 0x413433
push ebx
push ebp
mov ebp, dword [esp + 0x1848]
lea ebx, [esp + 0x844]
mov dword [esp + 0x14], eax
mov edx, dword [ebx]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x41341f
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
push eax
push 4
push ecx
push esi
mov dword [esp + 0x28], edi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x41341f
mov word [esp + 0x24], di
mov ecx, 0x207
xor eax, eax
lea edi, [esp + 0x26]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x24]
push 0x820
push edx
push eax
push esi
call sub.PSAPI.DLL_GetModuleBaseNameW
mov eax, dword [ebp]
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x41341f
inc dword [esp + 0x10]
mov eax, dword [esp + 0x14]
add ebx, 4
dec eax
mov dword [esp + 0x14], eax
jne 0x4133aa
pop ebp
pop ebx
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0x1834
ret
Function at 0x413520
Capabilities:
Create thread
Resume thread

Disassembly:
mov eax, 0x2214
call fcn.004473e0
push esi
mov esi, dword [esp + 0x221c]
test esi, esi
push edi
je 0x4136ae
cmp word [esi], 0
je 0x4136ae
mov ecx, 0x885
xor eax, eax
lea edi, [esp + 8]
mov edx, 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
lea eax, [esp + 8]
sub esi, ecx
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x41357f
mov cx, word [esi + eax]
test cx, cx
je 0x41357f
mov word [eax], cx
add eax, 2
dec edx
jne 0x413561
jmp 0x413583
test edx, edx
jne 0x413586
sub eax, 2
mov esi, dword [esp + 0x2228]
mov word [eax], 0
test esi, esi
mov dword [esp + 0x2218], 0
je 0x4135e6
cmp word [esi], 0
je 0x4135e6
lea ecx, [esp + 0x210]
mov edx, 0x1000
lea eax, [esp + 0x210]
sub esi, ecx
lea ecx, [edx + 0x7fffeffe]
test ecx, ecx
je 0x4135da
mov cx, word [esi + eax]
test cx, cx
je 0x4135da
mov word [eax], cx
add eax, 2
dec edx
jne 0x4135bc
jmp 0x4135de
test edx, edx
jne 0x4135e1
sub eax, 2
mov word [eax], 0
mov edx, dword [esp + 0x2224]
mov esi, dword [esp + 0x222c]
push 0
lea eax, [esp + 0xc]
push 4
push eax
push 0x413440
push 0
push 0
mov dword [esp + 0x2228], edx
mov dword [esp + 0x222c], esi
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov edi, eax
add esp, 0x18
test edi, edi
je 0x4136ae
test esi, esi
je 0x413634
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push ebx
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x3e8
push edi
call ebp
mov esi, dword [esp + 0x2238]
cmp esi, 0x64
jbe 0x413693
sub esi, 0x64
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
mov eax, dword [esp + 0x2220]
test eax, eax
jne 0x41367c
push esi
push edi
call ebp
mov eax, dword [esp + 0x2220]
test eax, eax
je 0x4136a5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub ebx, eax
add esi, ebx
je 0x413693
mov ecx, dword [esp + 0x2220]
push esi
push ecx
call ebp
mov eax, dword [esp + 0x2220]
test eax, eax
je 0x4136a5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x2214
ret
Function at 0x413ac0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, dword [esp + 0x1c]
xor ebx, ebx
cmp esi, ebx
jne 0x413ad7
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
push ebx
push esi
call dword [sym.imp.MSVCRT.dll__waccess]
add esp, 8
test eax, eax
je 0x413aee
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
xor eax, eax
push edi
mov dword [esp + 0xd], eax
push 0x465008
mov dword [esp + 0x15], eax
push esi
mov dword [esp + 0x1d], eax
mov byte [esp + 0x14], bl
mov word [esp + 0x21], ax
mov byte [esp + 0x23], al
call dword [sym.imp.MSVCRT.dll__wfopen]
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x413b39
push edi
push 2
lea ecx, [esp + 0x14]
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
lea edx, [esp + 0xc]
push 0x465734
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
pop edi
jne 0x413b59
push esi
call fcn.00447976
add esp, 4
mov ebx, eax
mov eax, ebx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x413b70
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push 0xffffffffffffffff
push 0x44d620
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
lea eax, [esp + 0x10]
push edi
push eax
call fcn.00411960
add esp, 4
push str.update360sandbox.exe
lea ecx, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x2c], 0
call fcn.00409a80
mov eax, dword [esp + 0x14]
mov ecx, dword [0x463294]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov dword [esp + 0x20], 0xffffffff
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x413be8
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x413be8
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.0044737a
add esp, 4
mov ecx, dword [esp + 0xc]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push ecx
call edi
test eax, eax
mov eax, dword [esp + 0xc]
jne 0x413c29
mov ecx, dword [0x463294]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x413d31
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x413d31
mov eax, dword [esp + 0xc]
add eax, 0xfffffff4
push eax
jmp 0x413d29
mov edx, dword [0x463294]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x413c50
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x413c50
mov edx, dword [esp + 0xc]
lea eax, [edx - 0xc]
push eax
call fcn.0044737a
add esp, 4
lea eax, [esp + 0x10]
push eax
call fcn.00411960
add esp, 4
lea ecx, [esp + 0x10]
push str.ShieldStart.exe
lea edx, [esp + 0xc]
push ecx
push edx
mov dword [esp + 0x2c], 1
call fcn.00409a80
mov eax, dword [esp + 8]
push eax
call edi
test eax, eax
jne 0x413ccc
mov eax, dword [esp + 8]
mov edx, dword [0x463294]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x413caf
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x413caf
mov edx, dword [esp + 8]
add edx, 0xfffffff4
push edx
call fcn.0044737a
add esp, 4
mov eax, dword [esp + 0x10]
mov edx, dword [0x463294]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x413d31
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x413d31
jmp 0x413d21
mov eax, dword [esp + 8]
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov eax, dword [esp + 8]
mov edx, dword [0x463294]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x413d06
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x413d06
mov edx, dword [esp + 8]
add edx, 0xfffffff4
push edx
call fcn.0044737a
add esp, 4
mov eax, dword [esp + 0x10]
mov edx, dword [0x463294]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x413d31
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x413d31
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.0044737a
add esp, 4
mov ecx, dword [esp + 0x18]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x413d50
Capabilities:
Check if file exists
Get common file path

Disassembly:
sub esp, 0x824
push ebx
push esi
lea eax, [esp + 8]
push edi
xor esi, esi
push eax
mov dword [esp + 0x10], esi
call dword [sym.imp.MSVCRT.dll_time]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x62e]
mov word [esp + 0x62c], si
mov ebx, dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x628]
push ecx
push 0x4657d4
push 0x103
push edx
stosw word es:[edi], ax
call ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x432]
mov word [esp + 0x430], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x22]
mov word [esp + 0x20], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x22a]
mov word [esp + 0x228], si
rep stosd dword es:[edi], eax
add esp, 0x10
stosw word es:[edi], ax
push esi
lea eax, [esp + 0x21c]
push 0x1a
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x413e80
lea ecx, [esp + 0x218]
lea edx, [esp + 0x10]
push ecx
push str._s360se_
push 0x103
push edx
call ebx
add esp, 0x10
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x413e3f
lea ecx, [esp + 0x10]
push ecx
call fcn.0040f210
add esp, 4
lea edx, [esp + 0x10]
push str.seup.ini
push edx
push 0x4634d4
lea eax, [esp + 0x42c]
push 0x103
push eax
call ebx
add esp, 0x14
lea ecx, [esp + 0x420]
lea edx, [esp + 0x628]
push ecx
push edx
push str.LastCheckUpdate
push str.Main
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
pop edi
pop esi
pop ebx
add esp, 0x824
ret
Function at 0x413e90
Capabilities:
Check if file exists
Get common file path
Read .ini file

Disassembly:
sub esp, 0x61c
push ebx
push esi
lea eax, [esp + 8]
push edi
xor esi, esi
push eax
mov dword [esp + 0x10], esi
call dword [sym.imp.MSVCRT.dll_time]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x21e]
mov word [esp + 0x21c], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x426]
mov word [esp + 0x424], si
add esp, 4
rep stosd dword es:[edi], eax
push esi
lea ecx, [esp + 0x424]
push 0x1a
push ecx
push esi
stosw word es:[edi], ax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edi, dword [sym.imp.MSVCRT.dll__snwprintf]
lea edx, [esp + 0x420]
push edx
push str._s360se_
lea eax, [esp + 0x18]
push 0x103
push eax
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
call ebx
test eax, eax
jne 0x413f47
lea edx, [esp + 0x10]
push edx
call fcn.0040f210
add esp, 4
lea eax, [esp + 0x10]
push str.seup.ini
push eax
push 0x4634d4
lea ecx, [esp + 0x224]
push 0x103
push ecx
call edi
add esp, 0x14
lea edx, [esp + 0x218]
push edx
call ebx
test eax, eax
jne 0x413f85
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x61c
ret
lea eax, [esp + 0x218]
push eax
push esi
push str.LastCheckUpdate
push str.Main
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [esp + 0xc]
sub ecx, eax
js 0x413fae
cmp ecx, 0x15180
jle 0x413fcc
lea ecx, [esp + 0x218]
push ecx
push esi
push str.LastCheckUpdate
push str.Main
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov esi, 1
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x61c
ret
Function at 0x413fe0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x44d641
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
lea eax, [esp + 8]
push esi
push eax
call fcn.00411770
mov esi, dword [eax]
mov cl, byte [esp + 0xf]
xor ebx, ebx
push esi
mov dword [esp + 0x40], ebx
mov byte [esp + 0x18], cl
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 8
lea ecx, [esp + 0x10]
push eax
push esi
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::assign_unsigned_short_int_const___unsigned_int_]
mov eax, dword [esp + 0xc]
mov ecx, dword [0x463294]
mov byte [esp + 0x38], 2
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x41406a
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x41406a
mov eax, dword [esp + 0xc]
add eax, 0xfffffff4
push eax
call fcn.0044737a
add esp, 4
lea ecx, [esp + 0x10]
push str.360se360SE.ini
lea edx, [esp + 0x24]
push ecx
push edx
call sub.MSVCP60.dll_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int_____cdecl_std::operator_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const___unsigned_short_int_const__
mov eax, dword [esp + 0x30]
add esp, 0xc
cmp eax, ebx
jne 0x41408e
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push eax
push ebx
push str.NotJoinPrivate
push str.option
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [esp + 0x24]
mov esi, eax
neg esi
sbb esi, esi
inc esi
cmp ecx, ebx
je 0x4140cd
mov al, byte [ecx - 1]
cmp al, bl
je 0x4140c1
cmp al, 0xff
je 0x4140c1
dec al
mov byte [ecx - 1], al
jmp 0x4140cd
add ecx, 0xfffffffe
push ecx
call fcn.0044737a
add esp, 4
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], ebx
cmp ecx, ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
je 0x414110
mov al, byte [ecx - 1]
cmp al, bl
je 0x414104
cmp al, 0xff
je 0x414104
dec al
mov byte [ecx - 1], al
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret
add ecx, 0xfffffffe
push ecx
call fcn.0044737a
add esp, 4
mov ecx, dword [esp + 0x30]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret
Function at 0x414450
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ecx
lea eax, [esp]
push 0
push eax
mov dword [esp + 8], 0
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
jne 0x41446c
pop ecx
ret
mov al, byte [esp]
test al, 0x20
je 0x414478
xor eax, eax
pop ecx
ret
test al, 7
jne 0x414480
xor eax, eax
pop ecx
ret
mov eax, 1
pop ecx
ret
Function at 0x414780
Capabilities:
Get common file path

Disassembly:
sub esp, 0x114
cmp word [0x4d9ce0], 0
jne 0x4147d6
push edi
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov dword [esp + 4], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 1
push 0x1a
push 0x4d9ce0
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.360SE
push 0x4d9ce0
call dword [sym.imp.MSVCRT.dll_wcscat]
add esp, 8
pop edi
mov ecx, dword [esp + 0x120]
push esi
mov esi, dword [esp + 0x11c]
push ecx
push 0x4d9ce0
push 0x465844
push 0x104
push esi
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov ecx, dword [esp + 0x134]
add esp, 0x14
cmp eax, ecx
jl 0x41481d
mov word [esi + ecx*2 - 2], 0
xor eax, eax
pop esi
add esp, 0x114
ret 0xc
push 0
push esi
call dword [sym.imp.MSVCRT.dll__waccess]
add esp, 8
test eax, eax
je 0x414840
push esi
call fcn.0040f210
add esp, 4
pop esi
add esp, 0x114
ret 0xc
mov eax, 1
pop esi
add esp, 0x114
ret 0xc

Function at 0x414850
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push esi
mov esi, dword [esp + 0x210]
push 1
push 0x1a
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x414886
push str.360SE360se.ini
push esi
call dword [sym.imp.MSVCRT.dll_wcscat]
add esp, 8
pop esi
add esp, 0x208
ret
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea edx, [esp + 8]
push 0x104
push edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push str..ini
push esi
call dword [sym.imp.MSVCRT.dll_wcscat]
add esp, 8
pop edi
pop esi
add esp, 0x208
ret
Function at 0x417d30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44d871
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov al, byte [esp + 0x30]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 8], al
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov edx, dword [esp + 0x38]
lea ecx, [esp + 8]
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x38], ebx
call fcn.00417e40
test al, al
jne 0x417dc7
mov ecx, dword [esp + 0xc]
cmp ecx, ebx
je 0x417db2
mov al, byte [ecx - 1]
cmp al, bl
je 0x417da8
cmp al, 0xff
je 0x417da8
dec al
pop esi
mov byte [ecx - 1], al
xor al, al
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
dec ecx
push ecx
call fcn.0044737a
add esp, 4
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
push eax
call fcn.0041be00
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
push ecx
mov ecx, esi
call fcn.00418c40
mov ecx, eax
call fcn.0041c2d0
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], bl
call fcn.0041c150
mov ecx, dword [esp + 0xc]
cmp ecx, ebx
je 0x417e1e
mov al, byte [ecx - 1]
cmp al, bl
je 0x417e14
cmp al, 0xff
je 0x417e14
dec al
mov byte [ecx - 1], al
jmp 0x417e1e
dec ecx
push ecx
call fcn.0044737a
add esp, 4
mov ecx, dword [esp + 0x28]
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x4189e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x44d95b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov al, byte [esp + 0x34]
push ebx
xor ebx, ebx
push esi
push edi
mov esi, ecx
mov byte [esp + 0x18], al
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x34], ebx
mov edx, dword [ecx]
mov dword [esp + 0xc], edx
mov edx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov eax, dword [ecx + 4]
mov dword [esp + 0x10], eax
mov ecx, dword [ecx + 8]
mov dword [esp + 0x14], ecx
mov eax, dword [edx]
mov ecx, dword [esp + 0x3c]
push eax
push ebx
push ecx
lea ecx, [esp + 0x24]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
mov eax, dword [esi + 0x5c]
mov edx, dword [esp + 0x44]
add esi, 0x30
cmp eax, ebx
mov dword [esp + 0x28], edx
je 0x418adf
mov eax, dword [esi + 0x1c]
mov edx, dword [esi + 0x18]
cmp eax, edx
je 0x418adf
lea ecx, [eax + 0x20]
cmp ecx, edx
jne 0x418a9c
mov dword [esp + 0x40], eax
mov dword [esi + 0x1c], ecx
mov dword [esp + 0x3c], eax
cmp eax, ebx
mov byte [esp + 0x34], 2
je 0x418a8f
lea ecx, [esp + 0xc]
push ecx
mov ecx, eax
call fcn.0041b4a0
mov ecx, esi
mov byte [esp + 0x34], bl
call fcn.0041a570
jmp 0x418b0a
mov edi, eax
mov dword [esi + 0x1c], ecx
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], edi
cmp edi, ebx
mov byte [esp + 0x34], 3
je 0x418b0a
mov eax, dword [esp + 0xc]
mov edx, edi
mov dword [edx], eax
mov ecx, dword [esp + 0x10]
mov dword [edx + 4], ecx
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
lea ecx, [edi + 0xc]
mov dword [edx + 8], eax
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov edx, dword [esp + 0x28]
mov dword [edi + 0x1c], edx
jmp 0x418b0a
mov ecx, esi
call fcn.0041a570
mov ecx, dword [esi + 0x1c]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x3c], ecx
lea eax, [ecx + 0x20]
mov dword [esi + 0x1c], eax
cmp ecx, ebx
mov byte [esp + 0x34], 1
je 0x418b0a
lea edx, [esp + 0xc]
push edx
call fcn.0041b4a0
mov edx, dword [esi + 0x2c]
mov eax, dword [esp + 0x1c]
inc edx
cmp eax, ebx
mov dword [esi + 0x2c], edx
je 0x418b36
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x418b2d
cmp al, 0xff
je 0x418b2d
dec al
mov byte [ecx], al
jmp 0x418b36
push ecx
call fcn.0044737a
add esp, 4
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc
Function at 0x421670
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44df70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov al, byte [esp + 0x30]
push ebx
push esi
xor esi, esi
push edi
mov ebx, ecx
mov byte [esp + 0xc], al
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0xc]
push ecx
push edx
mov ecx, ebx
mov dword [esp + 0x3c], esi
call fcn.00421730
mov al, byte [esp + 0x3c]
mov dword [esp + 0x20], esi
mov byte [esp + 0x1c], al
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov eax, dword [esp + 0x10]
mov byte [esp + 0x34], 1
cmp eax, esi
jne 0x4216dd
xor edi, edi
jmp 0x4216e6
mov edi, dword [esp + 0x14]
sub edi, eax
sar edi, 2
cmp edi, esi
jle 0x421709
push ebp
mov ebp, dword [esp + 0x44]
jmp 0x4216f5
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + esi*4]
push ebp
push ecx
mov ecx, ebx
call fcn.004219c0
inc esi
cmp esi, edi
jl 0x4216f1
xor esi, esi
pop ebp
push esi
call fcn.0044737a
mov edx, dword [esp + 0x14]
push edx
call fcn.0044737a
mov ecx, dword [esp + 0x34]
add esp, 8
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret 8
Function at 0x421d60
Capabilities:
Enumerate process modules

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
push edi
xor edi, edi
push eax
push edi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, edi
je 0x421db8
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push ecx
push 4
push edx
push esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], edi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x421db8
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push eax
push ecx
push edx
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x421db8
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc

Function at 0x422490
Capabilities:
Hash data with md5

Disassembly:
push esi
xor eax, eax
lea esi, [ecx + 0x5c]
push 0x40
push eax
push esi
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
call fcn.00423010
mov byte [esi], 0x80
pop esi
ret