joyce8/EMBER2024-capa huggingface dataset:
Function at 0x634da0
Capabilities:
Create thread

Disassembly:
sub esp, 0x20
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
push esi
push edi
lea eax, [esp + 0x10]
push 1
push eax
call fcn.0062d6d0
xor eax, eax
push ecx
mov ecx, esp
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea ecx, [esp + 0x24]
push 0x62d920
push ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
call fcn.0062c8f0
mov esi, eax
add esp, 0x14
mov dword [esp + 0x34], esi
test esi, esi
je 0x634e0e
mov edx, dword [esp + 0x10]
push edx
push esi
call fcn.0062d650
mov edi, dword [esi + 0xc]
add esp, 8
call fcn.0062c500
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x6c]
sub esp, 0xc
mov ecx, esp
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
push edx
lea ecx, [esp + 0x28]
push ecx
call fcn.0062c8f0
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x634e4f
mov edx, dword [esp + 0x14]
push edx
push ebx
call fcn.0062d650
mov edi, dword [ebx + 0xc]
add esp, 8
mov esi, ebx
call fcn.0062c500
mov esi, dword [esp + 0x34]
mov dword [esi + 0x70], ebp
mov edi, dword [ebp + 0xc]
mov dword [ebp + 0x70], esi
call fcn.0062c500
mov eax, dword [ebp + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebp + 0x58]
mov dword [ebx + 0x58], ecx
mov edx, dword [ebp + 0x5c]
push ebx
mov dword [ebx + 0x5c], edx
mov eax, dword [ebp + 0x68]
push 0
push 0x634d40
mov dword [ebx + 0x68], eax
call fcn.007310ef
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x6350c0
Capabilities:
Get token membership

Disassembly:
sub esp, 0x14
mov eax, dword [0x89b044]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
xor ebx, ebx
lea eax, [esp + 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [esp + 0x34]
push ecx
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [esp + 4], eax
cmp eax, ebx
je 0x635139
mov eax, dword [esp + 8]
lea edx, [esp + 4]
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x63512a
mov dword [esp + 4], ebx
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
pop ebx
xor ecx, esp
call fcn.0071fe0b
add esp, 0x14
ret
Function at 0x6351a0
Capabilities:
Check os version

Disassembly:
sub esp, 0x144
mov eax, dword [0x89b044]
xor eax, esp
mov dword [esp + 0x140], eax
mov eax, dword [0x88dd30]
test eax, eax
jl 0x6351db
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.0071fe0b
add esp, 0x144
ret
xor eax, eax
push esi
push 0x11c
push eax
lea edx, [esp + 0x30]
push edx
mov dword [0x88dd30], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call fcn.007202b0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], 0x11c
call esi
test eax, eax
jne 0x63524b
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x2c], 0x114
call esi
test eax, eax
je 0x63529d
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x63529d
lea edx, [esp + 4]
push edx
call eax
mov eax, dword [esp + 4]
cmp ax, 9
je 0x63527d
cmp ax, 6
jne 0x63529d
mov eax, 1
mov dword [0x88dd30], eax
pop esi
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.0071fe0b
add esp, 0x144
ret
mov ecx, dword [esp + 0x144]
pop esi
xor ecx, esp
xor eax, eax
call fcn.0071fe0b
add esp, 0x144
ret
Function at 0x635b60
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x89b044]
xor eax, esp
mov dword [esp + 0x11c], eax
push ebx
mov ebx, dword [esp + 0x130]
push esi
mov esi, dword [esp + 0x12c]
push edi
xor edi, edi
call fcn.00635610
test eax, eax
je 0x635bc9
push str.Windows_10
mov eax, dword [esp + 0x138]
dec eax
push eax
push esi
call fcn.00725750
add esp, 0xc
test eax, eax
je 0x635c5e
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0071fe0b
add esp, 0x120
ret
push 0x118
lea ecx, [esp + 0x14]
push 0
push ecx
call fcn.007202b0
add esp, 0xc
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edi, eax
test edi, edi
je 0x635d6a
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00635150
add esp, 0xc
cmp dword [esp + 0x1c], 2
jne 0x635c5e
mov eax, dword [esp + 0x10]
cmp eax, 4
jbe 0x635c5e
cmp eax, 6
jne 0x635ce7
lea ecx, [eax - 5]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x635caa
cmp eax, ecx
je 0x635caa
cmp eax, 2
jne 0x635c5e
cmp byte [esp + 0x126], cl
jne 0x635c9a
mov eax, dword [esp + 0x134]
push str.Windows_8
dec eax
push eax
push esi
call fcn.00725750
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
and eax, 0x3ff
cmp ax, 4
jne 0x635d36
mov edx, dword [esp + 0x13c]
push str.CHSSimplified
dec edx
push edx
push ebx
call fcn.00725750
add esp, 0xc
test eax, eax
je 0x635d68
jmp 0x635baf
mov ecx, dword [esp + 0x134]
push str.Windows_Server_2012
dec ecx
push ecx
jmp 0x635c55
cmp byte [esp + 0x126], cl
jne 0x635cd4
test eax, eax
jne 0x635cca
mov edx, dword [esp + 0x134]
push str.Vista
dec edx
push edx
jmp 0x635b9e
push str.Windows_7
jmp 0x635b95
mov ecx, dword [esp + 0x134]
push str.Windows_Server_2008
dec ecx
push ecx
jmp 0x635b9e
cmp eax, 5
jne 0x635c5e
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x635d0b
mov edx, dword [esp + 0x134]
push str.Windows_2000
dec edx
push edx
jmp 0x635b9e
cmp eax, 1
jne 0x635d1a
push str.Windows_XP
jmp 0x635b95
cmp eax, 2
jne 0x635c5e
mov ecx, dword [esp + 0x134]
push str.Windows_2003
dec ecx
push ecx
jmp 0x635b9e
cmp ax, 9
jne 0x635d4f
mov eax, dword [esp + 0x13c]
push str.English
dec eax
push eax
jmp 0x635c84
mov ecx, dword [esp + 0x13c]
push str.Unsupport
dec ecx
push ecx
push ebx
call fcn.00725750
add esp, 0xc
xor edi, edi
mov eax, edi
mov ecx, dword [esp + 0x128]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0071fe0b
add esp, 0x120
ret
Function at 0x636430
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x7c4281
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x89b044]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
push 0x830150
push str.svcVersion
xor ebx, ebx
push str.SOFTWAREMicrosoftInternet_Explorer
mov dword [esp + 0x18], ebx
mov esi, dword [esp + 0x30]
push reloc.OLEAUT32.dll_SysReAllocString
push esi
mov dword [esp + 0x30], ebx
call fcn.00618c30
add esp, 0x14
mov eax, dword [esi]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0xc], 1
cmp dword [eax - 0xc], ebx
jne 0x6364e8
push 0x830150
push str.Version
push str.SOFTWAREMicrosoftInternet_Explorer
lea ecx, [esp + 0x1c]
push reloc.OLEAUT32.dll_SysReAllocString
push ecx
call fcn.00618c30
add esp, 0x14
push eax
mov ecx, esi
mov dword [esp + 0x20], 1
call fcn.00404210
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x1c], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x6364e8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x637f00
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x14
push esi
lea eax, [esp + 4]
push eax
push 0x28
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x637f61
lea ecx, [esp + 0xc]
push ecx
push str.SeDebugPrivilege
push esi
mov dword [esp + 0x14], 1
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 4]
push esi
push esi
push 0x10
lea edx, [esp + 0x14]
push edx
push esi
push eax
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [esp + 4]
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x14
ret 4

Function at 0x637f70
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 8]
push esi
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x637f8a
pop esi
ret 8
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret 8
Function at 0x6381f0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x804]
sub esp, 0x804
push 0xfffffffffffffffe
push 0x86d658
push 0x725dd0
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x89b044]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x800], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 0x810]
mov edi, dword [ebp + 0x814]
mov ebx, dword [ebp + 0x824]
mov dword [ebp - 4], 0
test esi, esi
je 0x638347
cmp word [esi], 0
je 0x638347
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x638264
sub eax, edx
sar eax, 1
cmp eax, 0x104
ja 0x638347
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x638347
xor eax, eax
mov word [ebp], ax
push 0x7fe
push eax
lea ecx, [ebp + 2]
push ecx
call fcn.007202b0
push esi
push 0x80a8a0
push 0x3ff
lea edx, [ebp]
push edx
call fcn.00579c80
push 0x3c
push 0
lea eax, [ebp - 0x54]
push eax
call fcn.007202b0
add esp, 0x28
mov dword [ebp - 0x54], 0x3c
lea ecx, [ebp]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], str.open
mov dword [ebp - 0x40], edi
mov edx, dword [ebp + 0x818]
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x50], 0x440
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, eax
test esi, esi
je 0x638312
cmp dword [ebp + 0x820], 0
je 0x638312
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test ebx, ebx
je 0x638325
test esi, esi
je 0x638333
push ebx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test esi, esi
je 0x638333
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x638350
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.0071fe0b
add ebp, 0x804
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x638380
Capabilities:
Enumerate process modules

Disassembly:
push ebp
lea ebp, [esp - 0xa0c]
sub esp, 0xa0c
push 0xfffffffffffffffe
push 0x86d678
push 0x725dd0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x200c
call fcn.00725f60
mov eax, dword [0x89b044]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0xa08], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, dword [ebp + 0xa14]
mov dword [ebp - 0x24], edi
mov esi, dword [ebp + 0xa18]
mov dword [ebp - 0x20], esi
test esi, esi
je 0x638539
mov eax, esi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x6383f0
sub eax, edx
sar eax, 1
cmp eax, 0x104
ja 0x638539
mov dword [ebp - 4], 0
mov eax, dword [edi]
push edi
mov ecx, dword [eax + 4]
call ecx
mov dword [ebp - 4], 0xfffffffe
jmp 0x638438
push 0x800
push 0
lea edx, [ebp]
push edx
call fcn.007202b0
mov dword [ebp - 0x1c], 0
push 0x2000
push 0
lea eax, [ebp - 0x2024]
push eax
call fcn.007202b0
add esp, 0x18
lea ecx, [ebp - 0x1c]
push ecx
push 0x800
lea edx, [ebp - 0x2024]
push edx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x638539
push 0x104
push esi
push 0x104
lea eax, [ebp + 0x800]
push eax
call fcn.00725f8b
push 0x104
lea ecx, [ebp + 0x800]
push ecx
call fcn.0072ca2b
add esp, 0x18
xor esi, esi
cmp dword [ebp - 0x1c], esi
jbe 0x638539
jmp 0x6384c0
push 0x400
lea edx, [ebp]
push edx
mov eax, dword [ebp + esi*4 - 0x2024]
push eax
mov ecx, edi
call fcn.006380e0
test eax, eax
je 0x638533
push 0x400
lea ecx, [ebp]
push ecx
call fcn.0072ca2b
add esp, 8
lea ecx, [ebp]
lea eax, [ebp + 0x800]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x63851c
test dx, dx
je 0x638518
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x63851c
add eax, 4
add ecx, 4
test dx, dx
jne 0x6384f6
xor eax, eax
jmp 0x638521
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x638533
mov edx, dword [ebp + esi*4 - 0x2024]
push edx
push edi
call fcn.00637f70
inc esi
cmp esi, dword [ebp - 0x1c]
jb 0x6384c0
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xa08]
xor ecx, ebp
call fcn.0071fe0b
add ebp, 0xa0c
mov esp, ebp
pop ebp
ret 8
Function at 0x638570
Capabilities:
Enumerate process modules

Disassembly:
push ebp
lea ebp, [esp - 0xa0c]
sub esp, 0xa0c
push 0xfffffffffffffffe
push 0x86d698
push 0x725dd0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x2010
call fcn.00725f60
mov eax, dword [0x89b044]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0xa08], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, dword [ebp + 0xa14]
mov dword [ebp - 0x24], ebx
mov esi, dword [ebp + 0xa18]
mov dword [ebp - 0x28], esi
test esi, esi
je 0x63871d
mov eax, esi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x6385e0
sub eax, edx
sar eax, 1
mov dword [ebp - 0x20], eax
cmp eax, 4
jl 0x63871d
cmp eax, 0x104
jg 0x63871d
mov dword [ebp - 4], 0
mov eax, dword [ebx]
push ebx
mov ecx, dword [eax + 4]
call ecx
mov dword [ebp - 4], 0xfffffffe
jmp 0x638634
push 0x800
push 0
lea edx, [ebp]
push edx
call fcn.007202b0
mov dword [ebp - 0x1c], 0
push 0x2000
push 0
lea eax, [ebp - 0x2028]
push eax
call fcn.007202b0
add esp, 0x18
lea ecx, [ebp - 0x1c]
push ecx
push 0x800
lea edx, [ebp - 0x2028]
push edx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x63871d
push 0x104
push esi
push 0x104
lea eax, [ebp + 0x800]
push eax
call fcn.00725f8b
push 0x104
lea ecx, [ebp + 0x800]
push ecx
call fcn.0072ca2b
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
xor esi, esi
cmp dword [ebp - 0x1c], esi
jbe 0x63871d
jmp 0x6386c0
mov eax, dword [ebp + esi*4 - 0x2028]
cmp edi, eax
je 0x638717
push 0x400
lea edx, [ebp]
push edx
push eax
mov ecx, ebx
call fcn.006380e0
test eax, eax
je 0x638717
push 0x400
lea eax, [ebp]
push eax
call fcn.0072ca2b
mov ecx, dword [ebp - 0x20]
push ecx
lea edx, [ebp]
push edx
lea eax, [ebp + 0x800]
push eax
call fcn.0072d18f
add esp, 0x14
test eax, eax
jne 0x638717
mov ecx, dword [ebp + esi*4 - 0x2028]
push ecx
push ebx
call fcn.00637f70
inc esi
cmp esi, dword [ebp - 0x1c]
jb 0x6386c0
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xa08]
xor ecx, ebp
call fcn.0071fe0b
add ebp, 0xa0c
mov esp, ebp
pop ebp
ret 8
Function at 0x638ad0
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
sub esp, 0x65c
mov eax, dword [0x89b044]
xor eax, esp
mov dword [esp + 0x658], eax
mov eax, dword [esp + 0x660]
push ebx
push ebp
push edi
mov edi, dword [esp + 0x670]
xor ebx, ebx
push ebx
push 2
mov dword [esp + 0x14], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
cmp ebp, 0xffffffff
je 0x638be0
lea ecx, [esp + 0x10]
push ecx
push ebp
mov dword [esp + 0x18], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x638bd9
push esi
lea ebx, [ebx]
mov edx, dword [esp + 0x10]
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.00723690
add esp, 8
test eax, eax
jne 0x638bc5
test edi, edi
je 0x638bbd
cmp word [edi], ax
je 0x638bbd
mov ecx, dword [esp + 0x1c]
push ecx
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x638bc1
lea edx, [esp + 0x240]
push edx
push esi
mov dword [esp + 0x248], 0x428
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x638bb4
nop
lea eax, [esp + 0x460]
push edi
push eax
call fcn.00723690
add esp, 8
test eax, eax
je 0x638bb0
lea ecx, [esp + 0x240]
push ecx
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x638b80
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x638bc1
mov ebx, dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x638bc1
mov ebx, dword [esp + 0x1c]
test ebx, ebx
jne 0x638bd8
lea edx, [esp + 0x14]
push edx
push ebp
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x638b30
pop esi
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x664]
pop edi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0071fe0b
add esp, 0x65c
ret

Function at 0x638f00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esp + 0x10], eax
test ebx, ebx
je 0x638f2a
cmp dword [ebx], 0
jne 0x638f46
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x10]
cmp eax, ebp
jae 0x638f46
push 0xa
push esi
call edi
test eax, eax
je 0x638f4e
cmp eax, 0xffffffff
jne 0x638f21
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x63add0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x23c
mov eax, dword [0x89b044]
xor eax, esp
mov dword [esp + 0x238], eax
push ebp
mov ebp, dword [esp + 0x244]
push esi
push 0
push 2
mov dword [esp + 0x10], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0xc], esi
cmp esi, 0xffffffff
je 0x63ae3b
push 0x228
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.007202b0
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push esi
mov dword [esp + 0x1c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x63ae54
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x238]
xor ecx, esp
call fcn.0071fe0b
add esp, 0x23c
ret
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push ebx
mov dword [esp + 0x14], eax
push edi
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x24]
je 0x63aef0
mov edi, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x10]
jbe 0x63ae7b
call fcn.0071ffb6
mov esi, dword [ebp]
mov edi, edi
mov ebx, dword [ebp + 0x10]
cmp dword [ebp + 0xc], ebx
jbe 0x63ae8d
call fcn.0071ffb6
mov eax, dword [ebp]
test esi, esi
je 0x63ae98
cmp esi, eax
je 0x63ae9d
call fcn.0071ffb6
cmp edi, ebx
je 0x63aeec
test esi, esi
jne 0x63aee4
call fcn.0071ffb6
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x63aeb6
call fcn.0071ffb6
mov eax, dword [edi]
lea ecx, [esp + 0x40]
push ecx
push eax
call fcn.00723690
add esp, 8
test eax, eax
je 0x63af05
test esi, esi
jne 0x63aee8
call fcn.0071ffb6
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x63aedf
call fcn.0071ffb6
add edi, 4
jmp 0x63ae80
mov eax, dword [esi]
jmp 0x63aeac
mov eax, dword [esi]
jmp 0x63aed5
mov esi, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x63ae60
jmp 0x63af11
mov esi, dword [esp + 0x14]
mov dword [esp + 0x10], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x248]
mov eax, dword [esp + 0x10]
pop edi
pop ebx
pop esi
pop ebp
xor ecx, esp
call fcn.0071fe0b
add esp, 0x23c
ret

Function at 0x63cd00
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x7c48b0
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x89b044]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x24]
sub esp, 8
mov edi, esp
mov dword [edi], eax
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
push eax
mov dword [esp + 0x28], 0
call fcn.00405cc0
add esp, 4
add eax, 0x10
push esi
mov dword [edi + 4], eax
call fcn.0063cc40
add esp, 0xc
mov ecx, esi
mov byte [esp + 0x1c], 1
call fcn.00762b20
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x63cd95
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0xc
Function at 0x63e700
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x210
mov eax, dword [0x89b044]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
push edi
mov edi, dword [esp + 0x21c]
mov esi, ecx
cmp dword [esi + 0x10], 0
mov dword [esp + 8], edi
je 0x63e730
xor eax, eax
jmp 0x63e880
test edi, edi
je 0x63e729
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x63e74b
push edi
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
test eax, eax
jne 0x63e729
mov ecx, dword [esi + 0x2c]
sub ecx, dword [esi + 0x28]
mov eax, 0x532ae21d
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
xor edi, edi
add eax, edx
push ebx
mov ebx, 1
je 0x63e87d
push ebp
xor ebp, ebp
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x1e]
push edx
mov word [esp + 0x20], cx
call fcn.007202b0
mov ecx, dword [esi + 0x2c]
sub ecx, dword [esi + 0x28]
mov eax, 0x532ae21d
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
add esp, 0xc
cmp edi, eax
jb 0x63e7ad
call fcn.0071ffb6
mov ecx, dword [esi + 0x28]
mov eax, dword [esp + 0x10]
lea edx, [ecx + ebp + 4]
push edx
push eax
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x14]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x63e7d0
sub eax, edx
sar eax, 1
mov ecx, 0
je 0x63e7fd
cmp word [esp + ecx*2 + 0x14], 0x2f
jne 0x63e7f8
mov edx, 0x5c
mov word [esp + ecx*2 + 0x14], dx
inc ecx
cmp ecx, eax
jb 0x63e7e6
mov ecx, dword [esi + 0x2c]
sub ecx, dword [esi + 0x28]
mov eax, 0x532ae21d
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x63e81d
call fcn.0071ffb6
mov ecx, dword [esi + 0x28]
mov edx, dword [ecx + ebp]
test byte [edx + 0x26], 0x10
je 0x63e838
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
jmp 0x63e856
test ebx, ebx
je 0x63e854
lea ecx, [esp + 0x14]
push ecx
push edi
mov ecx, esi
call fcn.0063e420
test eax, eax
je 0x63e854
mov ebx, 1
jmp 0x63e856
xor ebx, ebx
mov ecx, dword [esi + 0x2c]
sub ecx, dword [esi + 0x28]
mov eax, 0x532ae21d
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
inc edi
add eax, edx
add ebp, 0x314
cmp edi, eax
jb 0x63e773
pop ebp
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
xor ecx, esp
call fcn.0071fe0b
add esp, 0x210
ret 4