joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434320
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x5898bc]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x88], 0x4f0053
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x88]
mov eax, 0x591fc8
mov dword [ebp - 0x84], 0x540046
push edi
mov dword [ebp - 0x80], 0x410057
mov edx, 0x41
mov dword [ebp - 0x7c], 0x450052
sub esi, eax
mov dword [ebp - 0x78], 0x4d005c
mov dword [ebp - 0x74], 0x630069
mov dword [ebp - 0x70], 0x6f0072
mov dword [ebp - 0x6c], 0x6f0073
mov dword [ebp - 0x68], 0x740066
mov dword [ebp - 0x64], 0x57005c
mov dword [ebp - 0x60], 0x6e0069
mov dword [ebp - 0x5c], 0x6f0064
mov dword [ebp - 0x58], 0x730077
mov dword [ebp - 0x54], 0x43005c
mov dword [ebp - 0x50], 0x720075
mov dword [ebp - 0x4c], 0x650072
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x650056
mov dword [ebp - 0x40], 0x730072
mov dword [ebp - 0x3c], 0x6f0069
mov dword [ebp - 0x38], 0x5c006e
mov dword [ebp - 0x34], 0x700041
mov dword [ebp - 0x30], 0x200070
mov dword [ebp - 0x2c], 0x610050
mov dword [ebp - 0x28], 0x680074
mov dword [ebp - 0x24], 0x5c0073
mov dword [ebp - 0x20], 0x360033
mov dword [ebp - 0x1c], 0x770030
mov dword [ebp - 0x18], 0x610070
mov dword [ebp - 0x14], 0x700070
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
lea ecx, [edx + 0x7fffffbd]
test ecx, ecx
je 0x434452
movzx ecx, word [esi + eax]
test cx, cx
je 0x434452
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x434434
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00498678
mov esp, ebp
pop ebp
ret
Function at 0x4348d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x5898bc]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x88], 0x4f0053
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x88]
mov eax, 0x5921a8
mov dword [ebp - 0x84], 0x540046
push edi
mov dword [ebp - 0x80], 0x410057
mov edx, 0x41
mov dword [ebp - 0x7c], 0x450052
sub esi, eax
mov dword [ebp - 0x78], 0x4d005c
mov dword [ebp - 0x74], 0x630069
mov dword [ebp - 0x70], 0x6f0072
mov dword [ebp - 0x6c], 0x6f0073
mov dword [ebp - 0x68], 0x740066
mov dword [ebp - 0x64], 0x57005c
mov dword [ebp - 0x60], 0x6e0069
mov dword [ebp - 0x5c], 0x6f0064
mov dword [ebp - 0x58], 0x730077
mov dword [ebp - 0x54], 0x43005c
mov dword [ebp - 0x50], 0x720075
mov dword [ebp - 0x4c], 0x650072
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x650056
mov dword [ebp - 0x40], 0x730072
mov dword [ebp - 0x3c], 0x6f0069
mov dword [ebp - 0x38], 0x5c006e
mov dword [ebp - 0x34], 0x700041
mov dword [ebp - 0x30], 0x200070
mov dword [ebp - 0x2c], 0x610050
mov dword [ebp - 0x28], 0x680074
mov dword [ebp - 0x24], 0x5c0073
mov dword [ebp - 0x20], 0x360033
mov dword [ebp - 0x1c], 0x770030
mov dword [ebp - 0x18], 0x610070
mov dword [ebp - 0x14], 0x700070
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
lea ecx, [edx + 0x7fffffbd]
test ecx, ecx
je 0x434a02
movzx ecx, word [esi + eax]
test cx, cx
je 0x434a02
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4349e4
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00498678
mov esp, ebp
pop ebp
ret
Function at 0x4351a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52835d
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x5898bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x22c], edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x220], 0
call fcn.0042e030
mov ecx, eax
call fcn.00422550
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0040b110
add esp, 4
lea esi, [eax + 0x10]
mov dword [ebp - 0x230], esi
mov dword [ebp - 4], 1
call fcn.0042e030
mov ecx, eax
call fcn.004229c0
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0040b110
add eax, 0x10
add esp, 4
mov dword [edi], eax
cmp dword [eax - 0xc], 0
mov dword [ebp - 0x220], 1
jne 0x43530e
lea ecx, [ebp - 0x219]
call fcn.00433f70
test eax, eax
je 0x43530e
cmp dword [esi - 0xc], 0
jl 0x43530e
push eax
push esi
call fcn.004b2b73
add esp, 8
test eax, eax
je 0x43530e
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x43530e
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004b2720
add esp, 0xc
mov dword [ebp - 0x228], 1
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 0x104
lea ecx, [ebp - 0x219]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x228]
push eax
push str.VendorID
call fcn.004347f0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x43530e
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4352f0
sub eax, edx
mov ecx, edi
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0040a830
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x43532a
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00498678
mov esp, ebp
pop ebp
ret 4
Function at 0x436d30
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x528687
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x5898bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ecx + 0x1c], 0
je 0x436f67
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004b2720
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0049c990
call fcn.004097e0
mov ecx, eax
test ecx, ecx
je 0x436f81
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x428]
call fcn.0040afe0
test al, al
jne 0x436df2
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x436dd0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x428]
call fcn.0040a830
mov dword [ebp - 4], 1
call fcn.004097e0
mov ecx, eax
test ecx, ecx
je 0x436f8b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x424], eax
push str.miniby3
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 2
call fcn.0040afe0
test al, al
jne 0x436e40
push 7
push str.miniby3
lea ecx, [ebp - 0x424]
call fcn.0040a830
lea eax, [ebp - 0x428]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x430]
push eax
call fcn.00479500
add esp, 0xc
mov edx, dword [ebp - 0x424]
or esi, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x436e85
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x428]
mov eax, esi
mov byte [ebp - 4], 6
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x436ea6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004b2720
add esp, 0xc
mov dword [ebp - 0x438], 1
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x104
lea ecx, [ebp - 0x429]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x438]
push eax
push 0x53ec84
call fcn.00433100
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x436f45
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x436f45
push str.config.set
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x430]
push str.mini_external
push str.general
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov edx, dword [ebp - 0x430]
add edx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x436f67
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00498678
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00408fc0
push 0x80004005
call fcn.00408fc0
int3
Function at 0x4385f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x5898bc]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x88], 0x4f0053
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x88]
mov eax, 0x592298
mov dword [ebp - 0x84], 0x540046
push edi
mov dword [ebp - 0x80], 0x410057
mov edx, 0x41
mov dword [ebp - 0x7c], 0x450052
sub esi, eax
mov dword [ebp - 0x78], 0x4d005c
mov dword [ebp - 0x74], 0x630069
mov dword [ebp - 0x70], 0x6f0072
mov dword [ebp - 0x6c], 0x6f0073
mov dword [ebp - 0x68], 0x740066
mov dword [ebp - 0x64], 0x57005c
mov dword [ebp - 0x60], 0x6e0069
mov dword [ebp - 0x5c], 0x6f0064
mov dword [ebp - 0x58], 0x730077
mov dword [ebp - 0x54], 0x43005c
mov dword [ebp - 0x50], 0x720075
mov dword [ebp - 0x4c], 0x650072
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x650056
mov dword [ebp - 0x40], 0x730072
mov dword [ebp - 0x3c], 0x6f0069
mov dword [ebp - 0x38], 0x5c006e
mov dword [ebp - 0x34], 0x700041
mov dword [ebp - 0x30], 0x200070
mov dword [ebp - 0x2c], 0x610050
mov dword [ebp - 0x28], 0x680074
mov dword [ebp - 0x24], 0x5c0073
mov dword [ebp - 0x20], 0x360033
mov dword [ebp - 0x1c], 0x770030
mov dword [ebp - 0x18], 0x610070
mov dword [ebp - 0x14], 0x700070
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
lea ecx, [edx + 0x7fffffbd]
test ecx, ecx
je 0x438722
movzx ecx, word [esi + eax]
test cx, cx
je 0x438722
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x438704
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00498678
mov esp, ebp
pop ebp
ret

Function at 0x438e20
Capabilities:
Check if file exists
Create thread
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5898bc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.0042e030
mov ecx, eax
call fcn.00422550
call fcn.0042e250
mov ecx, eax
call fcn.004378b0
test eax, eax
je 0x438f1e
call fcn.0042e250
mov ecx, eax
call fcn.00435b30
test eax, eax
je 0x438f1e
push 0
push 0
push esi
push 0x438d40
push 0
push 0
call fcn.004d12cd
push 0x208
mov dword [esi + 8], eax
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004b2720
add esp, 0x24
mov dword [ebp - 0x218], 1
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x104
lea ecx, [ebp - 0x20d]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0x53ec84
call fcn.00438270
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x438f1e
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x438f1e
push str.config.set
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
push 0x53ec60
push str.games
push str.install_config
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00498678
mov esp, ebp
pop ebp
ret
Function at 0x43d020
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x529250
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5898bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esi + 0x74]
push 0
push 0x58ad5c
push 0x58ad40
mov eax, dword [edx]
push 0
push 0x3ea
push edx
call dword [eax + 0xf0]
push eax
call fcn.004b4730
add esp, 0x14
mov ecx, dword [eax]
push 0
push 0x58ad80
push 0x58ad40
push 0
push 0x3ed
push eax
call dword [ecx + 0xf0]
push eax
call fcn.004b4730
mov edx, dword [esi + 0x74]
add esp, 0x14
mov ebx, eax
mov ecx, dword [edx]
push 0
push 0x58ada4
push 0x58ad40
push 0
push 0x3e9
push edx
call dword [ecx + 0xf0]
push eax
call fcn.004b4730
add esp, 0x14
mov ecx, ebx
mov edi, eax
call fcn.004961f0
sub esp, 0x28
mov dword [ebp - 0x10], esp
test eax, eax
je 0x43d0ed
mov ecx, esp
mov dword [ecx + 0x24], 0
push 0
push 0
mov dword [ebp - 4], 0
push str.install_tick_agreement
jmp 0x43d106
mov eax, esp
mov dword [eax + 0x24], 0
push 0
push 0
mov dword [ebp - 4], 1
push str.install_untick_agreement
call fcn.0041dbd0
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
call fcn.00417290
mov ecx, ebx
call fcn.004961f0
push dword [0x58d56c]
neg eax
sbb eax, eax
and eax, 0xffffffe8
add eax, 0x113
push eax
call fcn.0043b450
mov ecx, eax
call fcn.00491eb0
push eax
mov ecx, edi
call fcn.00495ab0
mov eax, dword [edi]
push 0
push edi
call dword [eax + 0x74]
cmp byte [esi + 0x18c], 0
jne 0x43d178
push 1
push 0
push 0
push str.http:__www.shanhutech.cn_index_user_agreement
push 0x53ec60
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [esi + 0x18c], 1
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43e3f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x529428
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5898bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea ecx, [esi + 0xa8]
call fcn.00429690
mov ecx, 0x59166c
call fcn.0040eb80
push str.quit
call fcn.0043a240
add esp, 4
lea ecx, [esi + 0x8c]
call fcn.004397b0
test eax, eax
jne 0x43e486
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x10], esp
mov dword [eax + 0x24], 0
push 1
push 0
push str.install_r_fail
mov dword [ebp - 4], 0
call fcn.0041dbd0
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
call fcn.00417290
mov eax, dword [esi + 0x9c]
lea ecx, [esi + 0x9c]
call dword [eax + 0xc]
push str.quit_finish
call fcn.0043a240
add esp, 4
xor esi, esi
call fcn.0042e030
mov ecx, eax
call fcn.004242a0
test eax, eax
mov ecx, 1
cmovne esi, ecx
call fcn.00448f40
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
call fcn.00448f40
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push str.Post_quit_msg.
call fcn.0043a240
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x441ed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x5898bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x592490
mov dword [ebp - 0x94], 0x740068
lea esi, [ebp - 0x94]
mov dword [ebp - 0x90], 0x700074
push edi
mov dword [ebp - 0x8c], 0x2f003a
mov edx, 0x48
mov dword [ebp - 0x88], 0x63002f
sub esi, eax
mov dword [ebp - 0x84], 0x6e0064
mov dword [ebp - 0x80], 0x61002d
mov dword [ebp - 0x7c], 0x69006c
mov dword [ebp - 0x78], 0x66002d
mov dword [ebp - 0x74], 0x6c0069
mov dword [ebp - 0x70], 0x2d0065
mov dword [ebp - 0x6c], 0x680073
mov dword [ebp - 0x68], 0x69006c
mov dword [ebp - 0x64], 0x650076
mov dword [ebp - 0x60], 0x7a0062
mov dword [ebp - 0x5c], 0x73002e
mov dword [ebp - 0x58], 0x610068
mov dword [ebp - 0x54], 0x68006e
mov dword [ebp - 0x50], 0x740075
mov dword [ebp - 0x4c], 0x630065
mov dword [ebp - 0x48], 0x2e0068
mov dword [ebp - 0x44], 0x6e0063
mov dword [ebp - 0x40], 0x62002f
mov dword [ebp - 0x3c], 0x7a0069
mov dword [ebp - 0x38], 0x690068
mov dword [ebp - 0x34], 0x70002f
mov dword [ebp - 0x30], 0x2f0063
mov dword [ebp - 0x2c], 0x360033
mov dword [ebp - 0x28], 0x770030
mov dword [ebp - 0x24], str.dCP5
mov dword [ebp - 0x20], 0x70006c
mov dword [ebp - 0x1c], 0x700061
mov dword [ebp - 0x18], 0x720065
mov dword [ebp - 0x14], 0x78002d
mov dword [ebp - 0x10], 0x2e0070
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
lea ecx, [edx + 0x7fffffb6]
test ecx, ecx
je 0x442021
movzx ecx, word [esi + eax]
test cx, cx
je 0x442021
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x442003
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00498678
mov esp, ebp
pop ebp
ret
Function at 0x445ed0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5898bc]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x445f48
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 2
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x18]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00498678
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00498678
mov esp, ebp
pop ebp
ret
Function at 0x4467e0
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x569cd0
push 0x4b48f0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x2a14
call fcn.00498ae0
mov eax, dword [0x5898bc]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2a2c], esi
test esi, esi
je 0x4469b4
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x446836
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
ja 0x4469b4
mov dword [ebp - 4], 0
call fcn.00445ed0
mov dword [ebp - 4], 0xfffffffe
jmp 0x44687c
push 0x800
push 0
lea eax, [ebp - 0xa24]
push eax
call fcn.004b2720
mov dword [ebp - 0x2a28], 0
push 0x2000
push 0
lea eax, [ebp - 0x2a24]
push eax
call fcn.004b2720
add esp, 0x18
lea eax, [ebp - 0x2a28]
push eax
push 0x800
lea eax, [ebp - 0x2a24]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x4469b4
push 0x104
push esi
lea eax, [ebp - 0x224]
push eax
call fcn.004cea33
lea eax, [ebp - 0x224]
push eax
call fcn.004cf37d
add esp, 0x10
xor edi, edi
cmp dword [ebp - 0x2a28], edi
jbe 0x4469b4
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x400
lea eax, [ebp - 0xa24]
push eax
push dword [ebp + edi*4 - 0x2a24]
call fcn.00446000
add esp, 0xc
test eax, eax
je 0x4469a7
lea eax, [ebp - 0xa24]
push eax
call fcn.004cf37d
add esp, 4
lea ecx, [ebp - 0xa24]
lea eax, [ebp - 0x224]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x446968
test dx, dx
je 0x446964
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x446968
add eax, 4
add ecx, 4
test dx, dx
jne 0x446942
xor eax, eax
jmp 0x44696d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4469a7
push dword [ebp + edi*4 - 0x2a24]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x446993
push 0
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xa24]
push eax
push str.Kill_process:__s
call fcn.0044a720
add esp, 8
inc edi
cmp edi, dword [ebp - 0x2a28]
jb 0x446904
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00498678
mov esp, ebp
pop ebp
ret 4
Function at 0x4469e0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x569d10
push 0x4b48f0
mov eax, dword fs:[0]
push eax
sub esp, 0x848
mov eax, dword [0x5898bc]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 4], 0
test esi, esi
je 0x446b54
cmp word [esi], 0
je 0x446b54
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x446a40
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
ja 0x446b54
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x446b54
push 0x800
push 0
lea eax, [ebp - 0x81c]
push eax
call fcn.004b2720
push esi
push str.__s_
push 0x3ff
lea eax, [ebp - 0x81c]
push eax
call fcn.0040c480
push 0x3c
push 0
lea eax, [ebp - 0x858]
push eax
call fcn.004b2720
add esp, 0x28
mov dword [ebp - 0x858], 0x3c
lea eax, [ebp - 0x81c]
mov dword [ebp - 0x848], eax
mov dword [ebp - 0x84c], 0x53ec60
mov dword [ebp - 0x844], ebx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x83c], eax
mov dword [ebp - 0x854], 0x440
cmp dword [ebp + 0x14], 0
je 0x446af3
push esi
call fcn.0046ef00
add esp, 4
test eax, eax
je 0x446b54
lea eax, [ebp - 0x858]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, eax
test esi, esi
je 0x446b1b
cmp dword [ebp + 0x18], 0
je 0x446b1b
push dword [ebp + 0x20]
push dword [ebp - 0x820]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test edi, edi
je 0x446b30
test esi, esi
je 0x446b40
push edi
push dword [ebp - 0x820]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test esi, esi
je 0x446b40
push dword [ebp - 0x820]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x446b5d
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00498678
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x446b80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x446b9c
pop edi
pop ebp
ret 4
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
pop ebp
ret 4
Function at 0x448480
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x5898bc]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x88], 0x4f0053
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x88]
mov eax, 0x592778
mov dword [ebp - 0x84], 0x540046
push edi
mov dword [ebp - 0x80], 0x410057
mov edx, 0x41
mov dword [ebp - 0x7c], 0x450052
sub esi, eax
mov dword [ebp - 0x78], 0x4d005c
mov dword [ebp - 0x74], 0x630069
mov dword [ebp - 0x70], 0x6f0072
mov dword [ebp - 0x6c], 0x6f0073
mov dword [ebp - 0x68], 0x740066
mov dword [ebp - 0x64], 0x57005c
mov dword [ebp - 0x60], 0x6e0069
mov dword [ebp - 0x5c], 0x6f0064
mov dword [ebp - 0x58], 0x730077
mov dword [ebp - 0x54], 0x43005c
mov dword [ebp - 0x50], 0x720075
mov dword [ebp - 0x4c], 0x650072
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x650056
mov dword [ebp - 0x40], 0x730072
mov dword [ebp - 0x3c], 0x6f0069
mov dword [ebp - 0x38], 0x5c006e
mov dword [ebp - 0x34], 0x700041
mov dword [ebp - 0x30], 0x200070
mov dword [ebp - 0x2c], 0x610050
mov dword [ebp - 0x28], 0x680074
mov dword [ebp - 0x24], 0x5c0073
mov dword [ebp - 0x20], 0x360033
mov dword [ebp - 0x1c], 0x770030
mov dword [ebp - 0x18], 0x610070
mov dword [ebp - 0x14], 0x700070
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
lea ecx, [edx + 0x7fffffbd]
test ecx, ecx
je 0x4485b2
movzx ecx, word [esi + eax]
test cx, cx
je 0x4485b2
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x448594
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00498678
mov esp, ebp
pop ebp
ret