joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4039fa
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x64
cmp dword [ebp + 8], 0
je 0x403a29
mov eax, dword [0x41ac80]
test eax, eax
je 0x403a1a
mov dword [esp], eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push ecx
mov dword [0x41ac80], 0
jmp 0x403ae0
cmp dword [0x41ac80], 0
je 0x403a44
mov dword [esp], 0
call fcn.004085c1
push edx
jmp 0x403ae0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x42adc0]
jbe 0x403ae0
cmp dword [0x42ae04], 0
je 0x403a97
test byte [0x42ad2c], 1
je 0x403ae0
lea ebx, [ebp - 0x48]
call fcn.00403928
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], str....__d__
call dword [sym.imp.USER32.dll_wsprintfA]
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.00406ebc
jmp 0x403ade
mov eax, dword [0x42ae08]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x40395a
mov dword [esp + 8], 0
mov dword [esp + 4], 0x6f
mov dword [esp], eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
sub esp, 0x14
mov dword [0x41ac80], eax
mov dword [esp + 4], 5
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push eax
push eax
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x403ae5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0xc]
sub esp, 0x34
mov ebx, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [0x40a014]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x403b26
xor eax, eax
cmp dword [ebp - 0xc], ebx
sete al
mov ebx, dword [ebp - 4]
leave
ret 8
Function at 0x403b5f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
add ebx, dword [0x426d58]
sub ebx, dword [0x426d5c]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x1f4
mov dword [0x42adc0], eax
test ebx, ebx
jle 0x403d2d
mov eax, dword [0x426d54]
lea edi, [ebp - 0x1c]
mov dword [esp], eax
call fcn.00403b2d
mov eax, dword [0x426d5c]
push ecx
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [0x40a010]
mov dword [esp], eax
call esi
mov dword [0x426d4c], ebx
sub esp, 0x10
mov dword [0x426d48], 0
mov dword [ebp - 0x2c], esi
mov ebx, dword [0x426d50]
sub ebx, dword [0x426d54]
mov eax, 0x4000
mov dword [esp], 0x422cc0
cmp ebx, 0x4000
cmovg ebx, eax
mov dword [esp + 4], ebx
call fcn.00403ae5
test eax, eax
push edx
push edx
je 0x403d3d
add dword [0x426d54], ebx
mov dword [0x426cd8], 0x422cc0
mov dword [0x426cdc], ebx
cmp dword [0x42ad40], 0
je 0x403c60
cmp dword [0x42ad18], 0
jne 0x403c60
mov eax, dword [0x426d5c]
sub eax, dword [0x426d58]
sub eax, dword [ebp + 8]
mov dword [esp], 0
add eax, dword [0x426d4c]
mov dword [0x426d48], eax
call fcn.004039fa
mov ecx, 0x426cc0
mov dword [0x426ce0], 0x41acc0
mov dword [0x426ce4], 0x8000
call fcn.004086b5
test eax, eax
js 0x403ce4
mov esi, dword [0x426ce0]
sub esi, 0x41acc0
je 0x403cd7
mov eax, dword [0x40a010]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], 0x41acc0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x403ceb
cmp esi, dword [ebp - 0x1c]
jne 0x403ceb
add dword [0x426d5c], esi
cmp dword [0x426cdc], 0
jne 0x403c29
jmp 0x403cf2
test ebx, ebx
je 0x403ce4
cmp dword [0x426cdc], 0
je 0x403cf2
mov eax, 0xfffffffd
jmp 0x403d40
mov eax, 0xfffffffe
jmp 0x403d40
mov edx, dword [0x426d58]
mov eax, edx
sub eax, dword [0x426d5c]
add eax, dword [ebp + 8]
test eax, eax
jg 0x403bdf
mov eax, dword [0x40a010]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [ebp - 0x2c]
sub esp, 0x10
mov dword [esp], 1
call fcn.004039fa
xor eax, eax
jmp 0x403d40
or eax, 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
Function at 0x403d4a
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
test eax, eax
js 0x403d8a
add eax, dword [0x42adb8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [0x426d58], eax
mov dword [esp + 4], eax
mov eax, dword [0x40a010]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
mov dword [esp], 4
call fcn.00403b5f
test eax, eax
push ecx
mov edx, eax
js 0x403eed
lea eax, [ebp - 0x20]
lea esi, [ebp - 0x24]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 4
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [esp + 4], eax
mov eax, dword [0x40a010]
mov dword [esp + 0xc], esi
mov dword [esp], eax
call ebx
sub esp, 0x14
test eax, eax
je 0x403ea0
cmp dword [ebp - 0x24], 4
jne 0x403ea0
mov eax, dword [ebp - 0x20]
add dword [0x426d58], 4
mov dword [esp], eax
call fcn.00403b5f
test eax, eax
push edx
mov edi, eax
mov edx, eax
js 0x403eed
cmp dword [ebp + 0x10], 0
jne 0x403eb2
mov dword [ebp - 0x2c], ebx
jmp 0x403e5c
cmp ebx, dword [ebp - 0x24]
jne 0x403ea0
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x422cc0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x403ea7
cmp dword [ebp - 0x1c], ebx
jne 0x403ea7
mov eax, dword [ebp - 0x24]
sub dword [ebp - 0x20], eax
add dword [0x426d58], eax
add edi, eax
mov eax, dword [ebp - 0x20]
test eax, eax
jle 0x403eae
mov edx, 0x4000
cmp eax, 0x4000
mov dword [esp + 0x10], 0
mov ebx, edx
mov dword [esp + 0xc], esi
mov dword [esp + 4], 0x422cc0
cmovle ebx, eax
mov eax, dword [0x40a010]
mov dword [esp + 8], ebx
mov dword [esp], eax
call dword [ebp - 0x2c]
sub esp, 0x14
test eax, eax
jne 0x403e12
mov edx, 0xfffffffd
jmp 0x403eed
mov edx, 0xfffffffe
jmp 0x403eed
mov edx, edi
jmp 0x403eed
mov eax, dword [ebp - 0x20]
cmp dword [ebp + 0x14], eax
cmovle eax, dword [ebp + 0x14]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [0x40a010]
mov dword [esp], eax
call ebx
sub esp, 0x14
test eax, eax
je 0x403ea0
mov edx, dword [ebp - 0x24]
add dword [0x426d58], edx
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
Function at 0x40759c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [0x42a840], 0x44
lea eax, [ebp - 0x18]
mov dword [esp + 0x20], 0x42a840
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor edx, edx
sub esp, 0x28
test eax, eax
je 0x407618
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x18]
push eax
mov eax, edx
leave
ret 4

Function at 0x40786a
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
push edx
je 0x407895
and eax, 0xfffffffe
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push eax
push eax
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x40789c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
push edx
mov edx, 0
cmove eax, edx
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x4078f8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea edi, [ebp - 0x1c]
mov esi, 0x65
sub esp, 0x2c
mov ebx, dword [ebp + 8]
dec esi
je 0x40794f
mov dword [ebp - 0x1c], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x1a
xor edx, edx
mov dword [esp + 0xc], ebx
div ecx
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 0
mov dword [esp + 4], edi
add byte [ebp - 0x1a], dl
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
sub esp, 0x10
test eax, eax
je 0x40790c
mov eax, ebx
jmp 0x407954
mov byte [ebx], 0
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x40795e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea edx, [ebp - 0x14]
sub esp, 0x34
cmp dword [ebp + 0x18], 1
mov ebx, dword [ebp + 0x14]
mov byte [ebx], 0
mov dword [esp + 0x10], edx
sbb eax, eax
mov dword [esp + 8], 0
xor al, al
add eax, 0x20119
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
jne 0x407a00
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x400
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 0
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
test eax, eax
jne 0x4079e9
mov eax, dword [ebp - 0xc]
dec eax
cmp eax, 1
jbe 0x4079ec
mov byte [ebx], 0
mov eax, dword [ebp - 0x14]
mov byte [ebx + 0x3ff], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
mov ebx, dword [ebp - 4]
leave
ret 0x14
Function at 0x407f84
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [esp], 0x42a040
mov dword [esp + 4], eax
call fcn.00407ada
push ebx
push ebx
mov dword [esp], 0x42a040
call fcn.00407759
test eax, eax
push esi
mov ebx, eax
jne 0x407fb8
xor eax, eax
jmp 0x40802e
mov dword [esp], eax
call fcn.00407b5d
test byte [0x42adc4], 0x80
push ecx
je 0x407fd4
mov al, byte [ebx]
cmp al, 0x5c
je 0x407fb4
test al, al
je 0x407fb4
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
sub ebx, 0x42a040
mov dword [esp], 0x42a040
call esi
push ecx
cmp eax, ebx
mov dword [esp], 0x42a040
jle 0x408013
call fcn.00407f4c
test eax, eax
push edx
je 0x408004
test byte [eax], 0x10
je 0x407fb4
mov dword [esp], 0x42a040
call fcn.004076f2
push eax
jmp 0x407fe0
call fcn.00407b18
push eax
mov dword [esp], 0x42a040
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
inc eax
push edx
setne al
movzx eax, al
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 4
Function at 0x408610
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42a8c4], 0
push ebp
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
je 0x40862d
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
jmp 0x40865b
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
and eax, 1
neg eax
shr esi, 1
and eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x408636
mov dword [ecx*4 + 0x42a8c0], eax
inc ecx
cmp ecx, 0x100
jne 0x40862f
jmp 0x408621
cmp edx, ebx
je 0x408674
inc edx
mov cl, al
shr eax, 8
xor cl, byte [edx - 1]
movzx ecx, cl
xor eax, dword [ecx*4 + 0x42a8c0]
jmp 0x40865b
pop ebx
not eax
pop esi
pop ebp
ret 0xc
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x4010b0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
xor eax, eax
push esi
mov esi, ecx
push edi
mov ecx, 0x1369e
lea edi, [esi + 0x10]
mov dword [esi], 0x4032e0
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor edi, edi
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0xc], eax
mov dword [esi + 0x4da8c], edi
mov dword [esi + 4], edi
mov dword [esi + 8], 0xffffffff
mov eax, esi
pop edi
pop esi
add esp, 0x190
ret

Function at 0x4010b8
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
xor eax, eax
push esi
mov esi, ecx
push edi
mov ecx, 0x1369e
lea edi, [esi + 0x10]
mov dword [esi], 0x4032e0
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor edi, edi
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0xc], eax
mov dword [esi + 0x4da8c], edi
mov dword [esi + 4], edi
mov dword [esi + 8], 0xffffffff
mov eax, esi
pop edi
pop esi
add esp, 0x190
ret
Function at 0x4011d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402d20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x140
push ebx
push esi
push edi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x10], esp
push eax
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
mov ebx, ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov cl, byte [0x4055d0]
mov al, 1
test al, cl
jne 0x401233
or cl, al
mov byte [0x4055d0], cl
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4055cc], eax
cmp dword [0x4055dc], 8
jle 0x401273
mov dword [0x4055dc], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x4055cc]
mov edx, eax
sub edx, ecx
mov dword [0x4055cc], eax
mov dword [ebp - 0x14], edx
fild dword [ebp - 0x14]
fmul dword [0x4032e8]
fdivr dword [0x4032e4]
fstp dword [0x4055c8]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.worinimahuorong
call esi
call dword [sym.imp.USER32.dll_GetInputState]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
push 0
push 0
lea eax, [ebp - 0x48]
push 0
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x14c]
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x14c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x4da78
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov dword [ebp - 0x14], eax
jne 0x4012f7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x405030]
add ebx, 0x4da90
push edx
push ebx
push eax
call fcn.00401160
add esp, 0xc
push str.worinimahuorong1
call esi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.VirtualProtect
push str.KERNEL32.dll
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.worinimahuorong2
mov dword [ebp - 0x1c], eax
call esi
push str.CreateThread
push str.KERNEL32.dll
call edi
push eax
call ebx
push str.shibushizheli__zhe_SB_huorong_yeshi_meishui_l
call esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
lea eax, [ebp - 0x20]
push 0x403770
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0x44
call sub.MSVCRT.dll__CxxThrowException
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x28]
push 0x403770
push ecx
mov byte [ebp - 4], 2
mov dword [ebp - 0x28], 0x44
call sub.MSVCRT.dll__CxxThrowException
mov dword [ebp - 0x10], esp
lea edx, [ebp - 0x18]
push 0x403770
push edx
mov byte [ebp - 4], 4
mov dword [ebp - 0x18], 0x44
call sub.MSVCRT.dll__CxxThrowException
mov eax, 0x4013f0
ret
Function at 0x401980
Capabilities:
Enumerate threads

Disassembly:
push 0xffffffffffffffff
push 0x402d88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov al, byte [esp + 0x44]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [esp + 0xc], ebx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
push ebx
push 4
mov dword [esp + 0x4c], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [esp + 0x20]
mov esi, eax
push ecx
push esi
mov dword [esp + 0x28], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x401a08
mov edi, dword [esp + 0x50]
cmp dword [esp + 0x2c], edi
jne 0x4019f9
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x28]
push edx
push 1
push eax
lea ecx, [esp + 0x1c]
call fcn.004025c0
lea ecx, [esp + 0x20]
push ecx
push esi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x4019de
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x4c]
mov ecx, dword [esp + 0x14]
mov dl, byte [esp + 0x10]
cmp ecx, ebx
mov byte [esi], dl
jne 0x401a25
xor eax, eax
jmp 0x401a2e
mov eax, dword [esp + 0x18]
sub eax, ecx
sar eax, 2
cmp eax, ebx
jge 0x401a34
xor eax, eax
shl eax, 2
push eax
call sub.MFC42.DLL_operatornew
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
add esp, 4
cmp ecx, edx
mov dword [esi + 4], eax
je 0x401a65
cmp eax, ebx
je 0x401a57
mov edi, dword [ecx]
mov dword [eax], edi
add ecx, 4
add eax, 4
cmp ecx, edx
jne 0x401a4f
mov ecx, dword [esp + 0x14]
push ecx
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
call sub.MFC42.DLL_operatordelete
mov ecx, dword [esp + 0x40]
add esp, 4
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x3c
ret

Function at 0x401b30
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push ebx
push ebp
push esi
xor ebp, ebp
push edi
push ebp
push 2
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x401b9b
mov edi, dword [esp + 0x13c]
mov ebx, dword [sym.imp.MSVCRT.dll__mbsicmp]
lea ecx, [esp + 0x34]
push edi
push ecx
call ebx
add esp, 8
test eax, eax
je 0x401b97
lea edx, [esp + 0x10]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x401b9b
lea eax, [esp + 0x34]
push edi
push eax
call ebx
add esp, 8
test eax, eax
jne 0x401b79
mov ebp, dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x128
ret
Function at 0x40959a
Capabilities:
Enumerate process modules

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x416fe0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x40217c
push 0x4021a8
call fcn.004155fc
pop ecx
pop ecx
push 0
push 0x18
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x409666
lea eax, [ebp - 0x430]
mov dword [ebp - 0x430], 0x428
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
jmp 0x40963e
cmp edi, 1
jne 0x409626
lea eax, [ebp - 0x410]
push pe_nt_image_headers32
push eax
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcslwr_s]
pop ecx
pop ecx
test eax, eax
jne 0x409626
lea eax, [ebp - 0x410]
push 0x4021b0
push eax
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x40964c
lea eax, [ebp - 0x430]
mov dword [ebp - 0x430], 0x428
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32NextW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4095f1
jmp 0x40965f
lea eax, [ebp - 0x210]
push eax
push 0x4021cc
call fcn.004155fc
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x40216c
push esi
call fcn.004155fc
mov dword [esp], 0x4021e8
call fcn.004155fc
push esi
call fcn.004155fc
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00414880
leave
ret
Function at 0x409b6e
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x416fe0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov word [ebp - 0x25c], pe_nt_image_headers32
xor ebx, ebx
push 0x5c
push edi
mov dword [ebp - 0x268], ebx
mov dword [ebp - 0x264], ebx
mov dword [ebp - 0x260], ebx
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsrchr]
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x409bdc
push 0x2f
push edi
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsrchr]
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x409bdc
push 0x3a
push edi
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsrchr]
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x409bdc
mov esi, ebx
jmp 0x409be0
sub esi, edi
sar esi, 1
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
test ebx, ebx
je 0x409cbe
cmp ebx, 0xffffffff
je 0x409cbe
push esi
push edi
lea ecx, [ebp - 0x268]
call fcn.0040d7d3
mov edi, eax
test edi, edi
js 0x409cdc
test esi, esi
je 0x409c83
push 0x404070
lea ecx, [ebp - 0x268]
call fcn.0040d748
mov edi, eax
test edi, edi
js 0x409cdc
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x268]
call fcn.0040d748
mov edi, eax
test edi, edi
js 0x409cdc
cmp dword [ebp - 0x260], 0
mov ecx, 0x406580
je 0x409c66
mov ecx, dword [ebp - 0x268]
call fcn.004099e6
test al, al
je 0x409caa
push esi
lea ecx, [ebp - 0x268]
call fcn.0040d706
mov edi, eax
test edi, edi
js 0x409cdc
jmp 0x409c92
lea ecx, [ebp - 0x22c]
call fcn.004099e6
test al, al
je 0x409cb5
lea eax, [ebp - 0x258]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x409c18
jmp 0x409cdc
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor ebx, ebx
jmp 0x409ce8
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x409cd7
push edi
push 0x404040
push 0xc
push 2
call sub.api_ms_win_crt_private_l1_1_0.dll__o___acrt_iob_func
pop ecx
push eax
call fcn.0040db7d
add esp, 0x10
mov edi, 0x80004005
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
test edi, edi
sete bl
lea ecx, [ebp - 0x268]
call fcn.00409290
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00414880
leave
ret

Function at 0x40d0ee
Capabilities:
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], bl
inc ebx
mov byte [ebp - 0xb], bl
cmp dword [0x416fa8], ebx
jb 0x40d158
mov ecx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x18]
call fcn.0040da81
test eax, eax
js 0x40d158
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x18]
sub eax, dword [ebp - 0x18]
sar eax, 1
push eax
call fcn.0040d706
test eax, eax
js 0x40d158
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x40d158
lea eax, [ebp - 0x18]
mov ecx, 0x416968
push eax
call fcn.0040d6b3
test eax, eax
jns 0x40d15a
xor ebx, ebx
lea ecx, [ebp - 0x18]
call fcn.00409290
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x414d0a
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x414d47
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x414d40
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x414d4c
add edx, 0x28
cmp edx, esi
jne 0x414d31
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x414d49