joyce8/EMBER2024-capa huggingface dataset:
Function at 0x843c8a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x184002c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0xc], ebx
mov edi, 1
cmp byte [esi], 0
je 0x843c8e7
push 0
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 5]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x843c8e2
mov byte [esi + 8], 1
mov edi, dword [ebp - 0xc]
jmp 0x843c914
mov ebx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x843c8f8
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x14]
add eax, ebx
push edi
push eax
lea eax, [ebp - 5]
push eax
call fcn.0849d790
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 0xc]
mov dword [esi + 0x1c], eax
cmp edi, 1
jne 0x843c932
movzx eax, byte [ebp - 5]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0849cd1e
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x843c91f
cmp byte [esi + 8], 0
je 0x843c91f
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0849cd1e
mov esp, ebp
pop ebp
ret

Function at 0x843cad0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov dl, byte [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 8]
mov ecx, esi
and ecx, 0xfffd
or ecx, 2
mov eax, ecx
xor eax, 1
imul eax, ecx
mov ecx, dword [edi]
shr eax, 8
xor dl, al
movsx eax, dl
xor eax, ecx
shr ecx, 8
and eax, 0xff
mov eax, dword [eax*4 + 0x10400c40]
xor eax, ecx
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, esi
shr esi, 8
and eax, 0xff
xor esi, dword [eax*4 + 0x10400c40]
mov al, dl
mov dword [edi + 8], esi
pop edi
pop esi
pop ebp
ret
Function at 0x8442380
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x84f7a67
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x184002c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
cmp dword [ebp + 8], 0
mov dword [ebp - 0x10], 0
je 0x84423d4
mov dword [edi], 0x10402adc
mov dword [edi + 0x60], 0x10400858
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [edi]
lea esi, [edi + 4]
push 0
push esi
mov eax, dword [eax + 4]
mov dword [edi + eax], 0x10400898
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.0841dc70
mov eax, dword [edi]
mov dword [ebp - 4], 2
mov eax, dword [eax + 4]
mov dword [edi + eax], str.beD_b
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ecx + edi - 4], eax
mov ecx, esi
call fcn.08408ed0
lea eax, [esi + 4]
mov dword [esi], 0x10402a90
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
lea eax, [esi + 0x14]
mov byte [esi + 0x4c], 0
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov byte [esi + 0x45], 0
mov dword [esi + 0x10], ecx
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov dword [esi + 0x50], 0
mov eax, dword [0x1840434c]
mov dword [esi + 0x48], eax
mov eax, edi
mov dword [esi + 0x40], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x84477b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x84f822b
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x184002c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.0840e590
xor edx, edx
mov ecx, eax
test ecx, ecx
setne dl
test edx, edx
jne 0x84477f8
push 0x80004005
call fcn.0840d910
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x7c], eax
push dword [ebp + 8]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x78], 0x556f5466
sub esp, 0xc
mov dword [ebp - 0x74], 0x51737842
mov ecx, esp
mov dword [ebp - 0x70], 0x31417765
mov dword [ebp - 0x6c], 0x6651324a
mov dword [ebp - 0x68], 0x5a416948
push dword [ebp - 0x14]
mov dword [ebp - 0x64], 0x67417747
push eax
lea eax, [ebp - 0x78]
mov dword [ebp - 0x60], 0x57307849
mov dword [ebp - 0x5c], 0x55497864
mov dword [ebp - 0x58], 0x46636d49
mov dword [ebp - 0x54], 0x2f42484a
mov dword [ebp - 0x50], 0x79686850
mov dword [ebp - 0x4c], 0x7251534d
mov dword [ebp - 0x48], 0x59304242
mov dword [ebp - 0x44], 0x56735350
mov dword [ebp - 0x40], 0x6e6f7848
mov dword [ebp - 0x3c], 0x6d6f5246
mov dword [ebp - 0x38], 0x37565342
mov dword [ebp - 0x34], 0x72415144
mov dword [ebp - 0x30], 0x57306a4a
mov dword [ebp - 0x2c], 0x5a6f434b
mov dword [ebp - 0x28], 0x31347961
mov dword [ebp - 0x24], 0x44674348
mov dword [ebp - 0x20], 0x41556a50
mov dword [ebp - 0x1c], 0x4163414d
mov dword [ebp - 0x18], 0x46424141
push eax
push 0
mov dword [ebp - 4], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
call fcn.08405280
lea eax, [ebp - 0x88]
push eax
call fcn.0844ba20
add esp, 0x10
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
mov byte [ebp - 4], 1
sar eax, 1
jne 0x844790f
push str.invalid_vector_T__subscript
call fcn.0847ecf2
push ecx
lea eax, [ebp - 0x7c]
push eax
call fcn.0844c800
mov eax, dword [ebp - 0x88]
add esp, 0xc
mov byte [ebp - 4], 0
test eax, eax
je 0x8447933
push eax
call fcn.0849b460
add esp, 4
mov esi, dword [ebp - 0x7c]
lea ecx, [ebp - 0x14]
push esi
call fcn.08408480
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 4]
call fcn.0847cf90
mov edx, dword [ebp - 0x14]
or edi, 0xffffffff
add edx, 0xfffffff0
mov byte [ebp - 4], 0
mov eax, edi
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x8447972
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x8447990
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0849cd1e
mov esp, ebp
pop ebp
ret 4
Function at 0x844a850
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x184002c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
push 0xf0000000
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
push dword [esi + 8]
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x844a8e4
lea eax, [ebp - 8]
push eax
push 0
push 0
push dword [esi + 4]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x844a8e4
push 0
push dword [ebp + 0xc]
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x844a8e4
push 0
lea eax, [esi + 0xc]
push eax
push edi
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x844a8e4
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 0xc]
jmp 0x844a8fc
mov eax, dword [ebp - 8]
test eax, eax
je 0x844a8f2
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x844a902
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0849cd1e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x844c090
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x184002c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x48]
push edi
mov edi, dword [ebp + 8]
push 0x44
push 0
push eax
call fcn.0849dde0
add esp, 0xc
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x58], xmm0
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 8
push 0
push 0
push 0
push edi
push 0
test esi, esi
je 0x844c0eb
push esi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x844c0f1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne al
test al, al
je 0x844c13b
mov eax, dword [ebp + 0xc]
xor edi, edi
test eax, eax
je 0x844c119
push eax
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x844c119
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push dword [ebp - 0x58]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x54]
call esi
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0849cd1e
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0849cd1e
mov esp, ebp
pop ebp
ret
Function at 0x844c930
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x84f8798
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x184002c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x14]
mov esi, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
push 0
push 0
push ecx
push 0
push 1
push dword [eax - 0xc]
mov dword [ebp - 4], 0
push eax
call esi
test eax, eax
jne 0x844c998
mov ecx, edi
call fcn.0840e1d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x844ca05
push dword [ebp - 0x14]
call fcn.0847e6ac
push dword [ebp - 0x14]
mov ebx, eax
push 0
push ebx
call fcn.0849dde0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
add esp, 0x10
push 0
push 0
push eax
push ebx
push 1
push dword [ecx - 0xc]
push ecx
call esi
test eax, eax
jne 0x844c9e2
push ebx
call fcn.0849bbc3
add esp, 4
mov ecx, edi
call fcn.0840e1d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x844ca05
mov ecx, dword [ebp - 0x18]
push edi
push dword [ebp - 0x14]
push ebx
call fcn.0844cb40
mov esi, eax
test esi, esi
je 0x844c9fc
mov ecx, edi
call fcn.0840e1d0
push ebx
call fcn.0849bbc3
add esp, 4
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
add edi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x844ca29
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0849cd1e
mov esp, ebp
pop ebp
ret 8
Function at 0x844ca50
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x84f87c8
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x184002c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [eax - 0xc]
test eax, eax
je 0x844cafd
mov edi, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
lea ecx, [ebp - 0x14]
push 0
push 0
push ecx
push 0
push 1
push eax
push dword [ebp + 8]
call edi
test eax, eax
jne 0x844cab9
mov eax, dword [esi]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x844caff
push dword [ebp - 0x14]
mov ecx, esi
call fcn.08422a40
mov eax, dword [esi + 4]
mov ecx, dword [esi]
sub eax, ecx
jne 0x844cad6
push str.invalid_vector_T__subscript
call fcn.0847ecf2
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x14]
push 0
push 0
push edx
push ecx
push 1
push dword [eax - 0xc]
push eax
call edi
test eax, eax
jne 0x844cafd
mov eax, dword [esi]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x844caff
xor esi, esi
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
add edi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x844cb23
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0849cd1e
mov esp, ebp
pop ebp
ret
Function at 0x844cb40
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x84f87fb
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x184002c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], eax
lea eax, [edi + 1]
mov dword [ebp - 0x14], edi
push eax
call fcn.0847e6ac
push dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
push 0
push eax
call fcn.0849dde0
push edi
push esi
push dword [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
push esi
call fcn.0849bbc8
add esp, 0x20
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x14]
push eax
push esi
push 0
push 1
push 0
push dword [ebx + 8]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x844cbde
push esi
call fcn.0849bbc3
mov ecx, dword [ebp - 0x18]
add esp, 4
call fcn.0840e1d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x844cc5d
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x120]
push 0xfde9
push esi
mov byte [esi + eax], 0
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x120], eax
call fcn.0845f0f0
mov edx, dword [ebp - 0x120]
mov dword [ebp - 4], 0
test edx, edx
jne 0x844cc17
xor ecx, ecx
jmp 0x844cc2f
mov ecx, edx
lea edi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x844cc20
sub ecx, edi
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x18]
push edx
call fcn.0840eca0
mov eax, dword [ebp - 0x120]
lea ecx, [ebp - 0x11c]
cmp eax, ecx
je 0x844cc52
push eax
call fcn.0849babc
add esp, 4
push esi
call fcn.0849bbc3
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0849cd1e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x844cc80
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x84f883b
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x184002c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], eax
lea eax, [edi + 1]
mov dword [ebp - 0x14], edi
push eax
call fcn.0847e6ac
push dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
push 0
push eax
call fcn.0849dde0
push edi
push esi
push dword [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
push esi
call fcn.0849bbc8
add esp, 0x20
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x14]
push eax
push esi
push 0
push 1
push 0
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x844cd1e
push esi
call fcn.0849bbc3
mov ecx, dword [ebp - 0x18]
add esp, 4
call fcn.0840e1d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x844cd9d
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x120]
push 0xfde9
push esi
mov byte [esi + eax], 0
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x120], eax
call fcn.0845f0f0
mov edx, dword [ebp - 0x120]
mov dword [ebp - 4], 0
test edx, edx
jne 0x844cd57
xor ecx, ecx
jmp 0x844cd6f
mov ecx, edx
lea edi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x844cd60
sub ecx, edi
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x18]
push edx
call fcn.0840eca0
mov eax, dword [ebp - 0x120]
lea ecx, [ebp - 0x11c]
cmp eax, ecx
je 0x844cd92
push eax
call fcn.0849babc
add esp, 4
push esi
call fcn.0849bbc3
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0849cd1e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x8456500
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x84f8ddb
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x184002c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
push 0
push 0xf
mov dword [ebp - 0x24c], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x240]
mov dword [ebp - 0x248], eax
push ecx
push eax
mov dword [ebp - 0x240], 0x22c
call sub.KERNEL32.dll_Process32FirstW
push ebx
lea ecx, [ebp - 0x244]
mov dword [ebp - 0x244], 0
mov edi, eax
call fcn.08408480
mov ebx, dword [ebp - 0x248]
mov dword [ebp - 4], 0
test edi, edi
je 0x845662d
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x244]
call fcn.0849f192
add esp, 8
test eax, eax
jne 0x8456618
push dword [ebp - 0x238]
push eax
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov dword [ebp - 0x14], edi
test edi, edi
je 0x8456618
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x14]
cmp ecx, eax
jae 0x84565fd
mov ecx, dword [esi]
lea edx, [ebp - 0x14]
cmp ecx, edx
ja 0x84565fd
mov edi, edx
sub edi, ecx
sar edi, 2
cmp eax, dword [esi + 8]
jne 0x84565ed
push 1
mov ecx, esi
call fcn.0847ab30
mov ecx, dword [esi + 4]
mov eax, dword [esi]
test ecx, ecx
je 0x8456614
mov eax, dword [eax + edi*4]
mov dword [ecx], eax
jmp 0x8456614
cmp eax, dword [esi + 8]
jne 0x845660b
push 1
mov ecx, esi
call fcn.0847ab30
mov eax, dword [esi + 4]
test eax, eax
je 0x8456614
mov dword [eax], edi
add dword [esi + 4], 4
lea eax, [ebp - 0x240]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x8456590
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 4]
xor ecx, ecx
sub eax, dword [esi]
mov edi, dword [ebp - 0x244]
sar eax, 2
cmp ecx, eax
mov dword [ebp - 4], 0xffffffff
sbb esi, esi
add edi, 0xfffffff0
neg esi
or ecx, 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x845666b
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0849cd1e
mov esp, ebp
pop ebp
ret
Function at 0x845edb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x84f93eb
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x184002c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov ecx, ebx
call fcn.0840e1d0
call fcn.0840e590
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x845ee04
push 0x80004005
call fcn.0840d910
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x224], esi
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 0x24
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x845ee78
lea ecx, [ebp - 0x224]
call fcn.0840e1d0
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
jmp 0x845ee50
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x845ee50
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x224]
call fcn.08448bb0
mov esi, dword [ebp - 0x224]
push 0
push 0x2000000
push 3
push 0
push 1
push SysReAllocStringLen
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
mov edi, eax
lea eax, [ebp - 0x220]
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x845eebe
push ebx
push dword [ebp - 0x21c]
push dword [ebp - 0x220]
call fcn.0844c180
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x845eee6
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0849cd1e
mov esp, ebp
pop ebp
ret
Function at 0x845f3c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 8], 0
je 0x845f3d7
mov eax, 0x8000ffff
pop esi
mov esp, ebp
pop ebp
ret
push edi
push 0
lea edi, [esi + 0x24]
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x845f402
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x845f3fc
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x845f51b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
mov byte [edi + 0x18], 1
call ebx
mov dword [esi + 0x40], eax
test eax, eax
jne 0x845f439
cmp byte [edi + 0x18], al
je 0x845f42d
push edi
mov byte [edi + 0x18], al
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call fcn.08449890
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
call ebx
mov edi, eax
test edi, edi
jne 0x845f472
call fcn.08449890
push 0x2710
mov ecx, esi
mov edi, eax
call fcn.0846e630
test eax, eax
jns 0x845f518
test edi, edi
pop ebx
cmovns edi, eax
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push edi
mov ecx, esi
call fcn.08447210
mov dword [ebp - 4], eax
test eax, eax
jns 0x845f4a2
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x2710
mov ecx, esi
call fcn.0846e630
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
call ebx
mov ebx, eax
test ebx, ebx
je 0x845f449
push 0
push 0
push ebx
mov ecx, esi
call fcn.08447210
mov edi, eax
test edi, edi
jns 0x845f4e0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x2710
mov ecx, esi
call fcn.0846e630
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x847b030
push 0
push 0
call fcn.084a04be
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x845f449
push 0xffffffffffffffff
push dword [esi + 0x40]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x845f518
call fcn.08449890
mov edi, eax
mov eax, edi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret