joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426070
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x42607c
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x426077
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x426061
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x426069
cmp edx, ebx
jne 0x4261b7
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x426038
add eax, dword [eax + 4]
jmp 0x426025
mov dword [ebp + 0xc], ebx
jmp 0x426087

Function at 0x426090
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x42609f
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4260bd
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x42611b
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x426102
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x42610b
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x426115
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x4260f7
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x426081
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x426168
dec eax
je 0x42615f
sub eax, 3
je 0x426156
mov dword [ebp - 4], 0x40
jmp 0x426185
mov dword [ebp - 4], 4
jmp 0x42616b
mov dword [ebp - 4], 0x20
jmp 0x42616b
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x4261b7
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x426137
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.004259c8
out dx, al
cmp esp, dword es:[edi + edi*8]
jne 0x4261c2
push 1
push esi
call edi
mov eax, esi
jmp 0x4261c3
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret

Function at 0x426639
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ebx
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
jne 0x426601
test ecx, edi
cli
invalid
Function at 0x42f544
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x449928]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00428a0a
mov dword [ebp - 0x14], eax
cmp dword [0x4de960], edi
jne 0x42f635
push 0x800
push edi
push 0x43e4fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x42f5c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x42f715
push 0x43e4fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x42f715
push 0x43e514
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42f715
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x4de960], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x4de964], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x4de968], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4de970], eax
test eax, eax
je 0x42f632
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4de96c], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x42f65a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x42f64d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x42f66f
push 4
pop eax
jmp 0x42f717
cmp dword [ebp - 0x14], edi
je 0x42f66f
push dword [0x4de960]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x42f654
mov eax, dword [0x4de96c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x42f6cd
cmp dword [0x4de970], esi
je 0x42f6cd
push eax
call ebx
push dword [0x4de970]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x42f6cd
test eax, eax
je 0x42f6cd
call ecx
test eax, eax
je 0x42f6c2
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x42f6c2
test byte [ebp - 8], 1
jne 0x42f6cd
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x42f6fd
mov eax, dword [0x4de964]
cmp eax, esi
je 0x42f6fa
push eax
call ebx
test eax, eax
je 0x42f6fa
call eax
mov edi, eax
test edi, edi
je 0x42f6fa
mov eax, dword [0x4de968]
cmp eax, esi
je 0x42f6fa
push eax
call ebx
test eax, eax
je 0x42f6fa
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x4de960]
call ebx
test eax, eax
je 0x42f715
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x42f717
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00424839
leave
ret
Function at 0x78b00307
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x78b0032f
call sym.MSVCR100.dll___doserrno
and dword [eax], 0
call sym.MSVCR100.dll__errno
mov dword [eax], 0x16
call sym.MSVCR100.dll__invalid_parameter_noinfo
or eax, 0xffffffff
pop ebp
ret
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x78b0034c
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.78b47b2a
pop ecx
jmp 0x78b0032a
test byte [ebp + 0xc], 0x80
je 0x78b00357
and eax, 0xfffffffe
jmp 0x78b0035a
or eax, 1
push eax
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
test eax, eax
je 0x78b0033d
xor eax, eax
pop ebp
ret

Function at 0x78b2c16f
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x78b58650], eax
mov dword [0x78b5864c], ecx
mov dword [0x78b58648], edx
mov dword [0x78b58644], ebx
mov dword [0x78b58640], esi
mov dword [0x78b5863c], edi
mov word [0x78b58668], ss
mov word [0x78b5865c], cs
mov word [0x78b58638], ds
mov word [0x78b58634], es
mov word [0x78b58630], fs
mov word [0x78b5862c], gs
pushfd
pop dword [0x78b58660]
mov eax, dword [ebp]
mov dword [0x78b58654], eax
mov eax, dword [ebp + 4]
mov dword [0x78b58658], eax
lea eax, [ebp + 8]
mov dword [0x78b58664], eax
mov eax, dword [ebp - 0x320]
mov dword [0x78b585a0], 0x10001
mov eax, dword [0x78b58658]
mov dword [0x78b58554], eax
mov dword [0x78b58548], 0xc0000409
mov dword [0x78b5854c], 1
mov eax, dword [0x78b54610]
mov dword [ebp - 0x328], eax
mov eax, dword [0x78b553f8]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x78b58598], eax
push 1
call sym.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x78b2c270
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x78b58598], 0
jne 0x78b2c25b
push 1
call sym.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x78b47b2a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x78b47b39
pop dword [ebp - 4]
mov eax, 0x78b47b39
sub dword [ebp - 4], eax
push 0x40
push 0x1000
push 0x5501f
push 0
mov eax, 0x3e74397e
add eax, 0x3a35d80a
add eax, dword [ebp - 4]
call dword [eax]
mov ecx, 0x4ea5
xor ebx, ebx
add ebx, eax
mov edx, 0xf589328e
add edx, 0x832cbb72
add edx, dword [ebp - 4]
mov edi, 0xa976b400
mov esi, dword [edx]
xor esi, edi
mov dword [ebx], esi
add ebx, 4
add edx, 4
loop 0x78b47b89
add eax, 0xa61c3ece
sub eax, 0xa61b1167
xor ebx, ebx
add ebx, eax
add eax, 0xa0ee8056
add eax, 0x5f117faf
mov ecx, 0x7a5e33ad
add ecx, 0xfe4bcc53
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x53f0c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x4c9015
lea edi, [esi - 0xc8015]
mov dword [edi + 0x12a2e8], 0xdff1cbac
push edi
or ebp, 0xffffffff
jmp 0x53f0ea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x53f0f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53f0e0
mov eax, 1
add ebx, ebx
jne 0x53f103
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x53f114
jne 0x53f133
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53f133
dec eax
add ebx, ebx
jne 0x53f120
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x53f0f8
add ebx, ebx
jne 0x53f12f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x53f185
xor ecx, ecx
sub eax, 3
jb 0x53f14b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x53f1ba
sar eax, 1
mov ebp, eax
jmp 0x53f156
add ebx, ebx
jne 0x53f156
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53f124
inc ecx
add ebx, ebx
jne 0x53f164
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53f124
add ebx, ebx
jne 0x53f171
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x53f166
jne 0x53f182
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x53f166
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x53f1a4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x53f196
jmp 0x53f0e6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x53f1a4
add edi, ecx
jmp 0x53f0e6
pop esi
mov edi, esi
mov ecx, 0x395a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x53f1c2
cmp byte [edi], 0x24
jne 0x53f1c2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x53f1c7
lea edi, [esi + 0x138000]
mov eax, dword [edi]
or eax, eax
je 0x53f236
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x13f4ec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x13f53c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x53f1f4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x13f544]
or eax, eax
je 0x53f230
mov dword [ebx], eax
add ebx, 4
jmp 0x53f211
call dword [esi + 0x13f540]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x53f267
cmp al, 0xef
ja 0x53f25a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x53f23c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x53f249
mov ebp, dword [esi + 0x13f548]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x13f2c2]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x53f2b3
sub esp, 0xffffff80
jmp 0x4014c0
Function at 0x47753a
Capabilities:
Parse pe header

Disassembly:
pushal
xor edx, edx
mov esi, dword fs:[edx]
lodsd eax, dword [esi]
cmp eax, 0xffffffff
je 0x47754a
mov esi, eax
jmp 0x477540
mov edi, dword [esi + 4]
and edi, 0xffff0000
cmp word [edi], 0x5a4d
je 0x477562
sub edi, 0x10000
jmp 0x477553
mov ebx, edi
add ebx, dword [ebx + 0x3c]
cmp word [ebx], 0x4550
je 0x477570
jmp 0x477553
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x477576
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
pushal
mov ebx, dword [esp + 0x24]
mov ecx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
add ebx, ecx
mov edi, dword [ebx + 0x20]
add edi, ecx
xor esi, esi
lea edx, [edi + esi*4]
mov edx, dword [edx]
add edx, ecx
xor eax, eax
rol eax, 7
xor al, byte [edx]
inc edx
cmp byte [edx], 0
jne 0x477595
cmp eax, dword [esp + 0x28]
je 0x4775ac
inc esi
cmp esi, dword [ebx + 0x18]
jb 0x47758c
mov edx, dword [ebx + 0x24]
add edx, ecx
movzx edx, word [edx + esi*2]
mov eax, dword [ebx + 0x1c]
add eax, ecx
mov eax, dword [eax + edx*4]
add eax, ecx
mov dword [esp + 0x1c], eax
popal
ret 8

Function at 0x48fc7d
Capabilities:
Parse pe header

Disassembly:
pushal
xor edx, edx
mov esi, dword fs:[edx]
lodsd eax, dword [esi]
cmp eax, 0xffffffff
je 0x48fc8d
mov esi, eax
jmp 0x48fc83
mov edi, dword [esi + 4]
and edi, 0xffff0000
cmp word [edi], 0x5a4d
je 0x48fca5
sub edi, 0x10000
jmp 0x48fc96
mov ebx, edi
add ebx, dword [ebx + 0x3c]
cmp word [ebx], 0x4550
je 0x48fcb3
jmp 0x48fc96
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x48fcb9
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
pushal
mov ebx, dword [esp + 0x24]
mov ecx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
add ebx, ecx
mov edi, dword [ebx + 0x20]
add edi, ecx
xor esi, esi
lea edx, [edi + esi*4]
mov edx, dword [edx]
add edx, ecx
xor eax, eax
rol eax, 7
xor al, byte [edx]
inc edx
cmp byte [edx], 0
jne 0x48fcd8
cmp eax, dword [esp + 0x28]
je 0x48fcef
inc esi
cmp esi, dword [ebx + 0x18]
jb 0x48fccf
mov edx, dword [ebx + 0x24]
add edx, ecx
movzx edx, word [edx + esi*2]
mov eax, dword [ebx + 0x1c]
add eax, ecx
mov eax, dword [eax + edx*4]
add eax, ecx
mov dword [esp + 0x1c], eax
popal
ret 8
Function at 0x100181a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x100181b3
pop dword [ebp - 0x18]
mov eax, 0xcef3d442
add eax, 0x410dad71
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x7e8b1625
add dword [ebp - 0x28], 0xcfc72f26
mov dword [ebp - 0x24], 0x9e624f91
add dword [ebp - 0x24], 0x93d0fcb4
mov dword [ebp - 0x20], 0x21ee8286
add dword [ebp - 0x20], 0x2a5dc1a8
mov dword [ebp - 0x1c], 0xe8b12aed
add dword [ebp - 0x1c], 0x174ed513
lea eax, [ebp - 0x28]
push eax
mov eax, 0x7cfc353e
add eax, 0x9305eb06
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x701aa799
add dword [ebp - 0x28], 0x457c1bd
mov dword [ebp - 0x24], 0xf5da547
add dword [ebp - 0x24], 0x320ebc2e
mov dword [ebp - 0x20], 0x443215a1
sub dword [ebp - 0x20], 0xe0c2a935
mov dword [ebp - 0x1c], 0x87d438ca
add dword [ebp - 0x1c], 0x782bc736
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x3cfebfe9
sub eax, 0x2cfc9fa9
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x344f8
push 0
call eax
mov ecx, 0xa7d45001
sub ecx, 0xa7d41745
mov edx, eax
mov ebx, 0x52610710
add ebx, 0xbda214f0
add ebx, dword [ebp - 0x18]
mov edi, 0xcdd326dd
sub edi, 0x25778bdb
xor dword [ebp - 0x10], 0x95f8b420
mov esi, dword [ebx]
xor dword [ebp - 8], 0x2f072a80
sub esi, edi
xor dword [ebp - 0xc], 0xe479484a
mov dword [edx], esi
sub dword [ebp - 4], ecx
add edx, 4
add ebx, 0xfd2d991
add ebx, 0xf02d2673
loop 0x100182d5
add eax, 0x4c58747
add eax, 0xfb3b4e7c
mov ebx, eax
add eax, 0xc4b4519
add eax, 0xf3b4baec
mov ecx, 0x5545a041
sub ecx, 0x4545a041
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
sub esp, 0x30
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
push esi
push edi
push ebx
push 0
push 1
call ebp
mov esi, eax
test esi, esi
jne 0x401125
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 5
jne 0x4010c2
lea eax, [esp + 0x10]
push eax
push 0
push 0x28
mov dword [esp + 0x20], 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x401071
call esi
cmp eax, 0x3f0
jne 0x4010c2
lea ecx, [esp + 0x10]
push ecx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4010c2
lea edx, [esp + 0x1c]
push edx
push str.SeDebugPrivilege
push 0
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov edi, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x2c]
push ecx
push 0x10
lea edx, [esp + 0x24]
push edx
push 0
push eax
call edi
test eax, eax
jne 0x4010cb
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x30
ret
call esi
cmp eax, 0x514
jne 0x4010e8
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x30
ret
push ebx
push 0
push 1
call ebp
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0x10
lea eax, [esp + 0x34]
push eax
push 0
push ecx
call edi
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
test esi, esi
jne 0x40112b
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x30
ret
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
test eax, eax
jne 0x401144
call edi
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x30
ret
call edi
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x30
ret
Function at 0x401160
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x134
mov eax, dword [0x416040]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push esi
push str.Killing_all_iexplore_instances
call fcn.00401240
add esp, 4
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x4011b1
lea eax, [esp + 8]
push eax
push esi
mov dword [esp + 0x10], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x4011d0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.00403a66
add esp, 0x134
ret
lea ecx, [esp + 0x2c]
push str.iexplore.exe
push ecx
call fcn.00411548
add esp, 8
test eax, eax
jne 0x401207
mov ebx, dword [esp + 0x10]
call section..text
test eax, eax
je 0x4011fa
push str.Process_iexplore.exe_terminated
jmp 0x4011ff
push str.Error_terminate_ghost_process_iexplore.exe_
call fcn.00401240
add esp, 4
lea edx, [esp + 8]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4011d0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x134]
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00403a66
add esp, 0x134
ret
Function at 0x401240
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4117d0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x416040]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [0x4170ac]
mov eax, dword [edx + 0xc]
mov ecx, 0x4170ac
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov dword [esp + 0x3c], 0
movzx ecx, word [esp + 0x2e]
movzx edx, word [esp + 0x2c]
movzx eax, word [esp + 0x2a]
push ecx
movzx ecx, word [esp + 0x2c]
push edx
push eax
push ecx
push str.__02d:_02d:_02d__03d_
lea edi, [esp + 0x2c]
call fcn.00402d40
mov edx, dword [0x4170ac]
mov eax, dword [edx + 0xc]
add esp, 0x14
mov ecx, 0x4170ac
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x3c], 1
mov ebx, dword [esp + 0x44]
push ecx
lea edi, [esp + 0x18]
call fcn.00402550
mov edx, dword [0x417ba8]
mov eax, dword [edx - 0xc]
test eax, eax
je 0x4013b2
mov eax, edi
push eax
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x20]
call fcn.004025d0
lea edx, [esp + 0x18]
push edx
mov ecx, eax
mov byte [esp + 0x48], 2
call fcn.00402690
add esp, 0xc
mov byte [esp + 0x3c], 4
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401342
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [0x417ba8]
push 0x413e9c
push ecx
call fcn.00403c77
mov esi, eax
add esp, 8
test esi, esi
je 0x40138d
mov eax, dword [esp + 0x10]
cmp dword [eax - 4], 1
mov edi, dword [eax - 0xc]
jle 0x40137a
mov edx, edi
push edx
lea eax, [esp + 0x14]
push eax
call fcn.00402a20
mov eax, dword [esp + 0x10]
push esi
push edi
push 1
push eax
call fcn.00403df0
push esi
call fcn.00403ee9
add esp, 0x14
mov byte [esp + 0x3c], 1
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4013b2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x3c], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4013d7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x3c], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4013ff
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x30
ret