joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6c144590
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ecx, eax
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x10]
push ebx
lea ebx, [ebp - 0xc]
sub esp, 0x10
movsx esi, byte [eax]
mov eax, edi
sub esi, edi
lea edx, [esi + eax]
inc eax
movzx edx, dl
movzx edx, byte [edx + 0x6c152be0]
mov byte [eax - 1], dl
cmp eax, ebx
jne 0x6c1445a8
movsx edx, byte [ecx + 1]
lea esi, [ecx + 1]
test dl, dl
je 0x6c1445ef
lea esi, [esi]
nop
mov eax, edi
movzx ecx, byte [eax]
inc eax
xor ecx, edx
movzx ecx, byte [ecx + 0x6c152be0]
mov byte [eax - 1], cl
cmp eax, ebx
jne 0x6c1445d2
movsx edx, byte [esi + 1]
inc esi
test dl, dl
jne 0x6c1445d0
mov eax, dword [ebp - 0x10]
add esp, 0x10
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6c146cf0
Capabilities:
Initialize winsock library

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 0x198]
sub esp, 0x1b4
mov dword [esp + 4], eax
mov dword [esp], 0x101
call dword [sym.imp.ws2_32.dll_WSAStartup]
sub esp, 8
test eax, eax
jne 0x6c146d40
mov dword [0x6c147428], 1
mov ecx, dword [ebp - 4]
mov eax, 1
leave
lea esp, [ecx - 4]
ret 0xc
test byte [0x6c1471b4], 2
je 0x6c146d2c
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.WSAStartup_failed:__lu_n
mov dword [esp + 8], str.winsock_startup
mov dword [esp + 4], 0x6c1471b4
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_6
mov ecx, dword [ebp - 4]
mov eax, 1
leave
lea esp, [ecx - 4]
ret 0xc

Function at 0x6c146d80
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 0x80000000
push esi
push ebx
sub esp, 8
mov dword [ebp - 0x10], eax
test eax, eax
je 0x6c146dfb
mov dword [ebp - 0x14], 3
jmp 0x6c146da8
inc dword [ebp - 0x14]
sar dword [ebp - 0x10], 1
je 0x6c146dfb
test byte [ebp - 0x10], 1
je 0x6c146da0
mov eax, dword [ebp - 0x14]
mov edx, 0x80000000
and eax, 0x1f
mov esi, dword [eax*4 + 0x6c153220]
mov eax, edi
xor edi, edi
jmp 0x6c146de6
mov ebx, eax
shr eax, 1
mov ecx, eax
and ebx, 1
shr edx, 1
xor ecx, 0xedb88320
test ebx, ebx
cmovne eax, ecx
test esi, edx
je 0x6c146dd0
lea ecx, [edx - 1]
xor edi, eax
test ecx, esi
jne 0x6c146dd0
inc dword [ebp - 0x14]
sar dword [ebp - 0x10], 1
jne 0x6c146da8
add esp, 8
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x504020
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x3e000
lea edi, [esi - 0xad000]
push edi
jmp 0x50403a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x504041
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x504030
mov eax, 1
add ebx, ebx
jne 0x504053
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x504064
jne 0x504083
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x504083
dec eax
add ebx, ebx
jne 0x504070
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x504048
add ebx, ebx
jne 0x50407f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5040d5
xor ecx, ecx
sub eax, 3
jb 0x50409b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x50410a
sar eax, 1
mov ebp, eax
jmp 0x5040a6
add ebx, ebx
jne 0x5040a6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x504074
inc ecx
add ebx, ebx
jne 0x5040b4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x504074
add ebx, ebx
jne 0x5040c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5040b6
jne 0x5040d2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5040b6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5040f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5040e6
jmp 0x504036
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5040f4
add edi, ecx
jmp 0x504036
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x504112
cmp byte [edi], 0x11
jne 0x504112
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x504117
lea edi, [esi + 0xfd000]
mov eax, dword [edi]
or eax, eax
je 0x50418f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12f314]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12f490]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x504144
mov ecx, edi
jns 0x504173
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12f494]
or eax, eax
je 0x504189
mov dword [ebx], eax
add ebx, 4
jmp 0x504161
call dword [esi + 0x12f4a4]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x5041c0
cmp al, 0xef
ja 0x5041b3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x504195
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x5041a2
mov ebp, dword [esi + 0x12f498]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5041f4
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x43ebb0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x43ebce
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x43ebc3
pop esi
ret

Function at 0x43ed10
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x43eda2
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x43ed94
mov ebp, dword [sym.imp.KERNEL32.DLL_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x43ed8c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x43ed55
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x43ed2a3e
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x5266697c
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4047b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x538038
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x58d140]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebx + 0x44], 0
je 0x404941
cmp byte [ebx + 0x49], 0
je 0x404941
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, ebx
call edx
cmp eax, 0xffffffff
je 0x404935
lea esi, [ebp - 0x2c]
call fcn.004043a0
mov dword [ebp - 4], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x404823
lea edx, [ebp - 0x2c]
mov eax, edx
mov ecx, dword [ebx + 0x44]
mov esi, dword [ecx]
lea edi, [ebp - 0x30]
push edi
mov edi, dword [ebp - 0x1c]
add edi, edx
push edi
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x40485c
dec eax
je 0x404860
sub eax, 2
lea ecx, [ebp - 0x2c]
je 0x40493c
call fcn.00403130
xor al, al
jmp 0x404943
mov byte [ebx + 0x49], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x404870
lea edx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, edx
je 0x40489d
cmp edi, 0x10
jae 0x40487f
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x54]
push ecx
push esi
push 1
push eax
call fcn.0050ee82
add esp, 0x10
cmp esi, eax
jne 0x40492d
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [ebx + 0x49], 0
je 0x404939
test esi, esi
jne 0x404817
mov ecx, dword [ebp - 0x1c]
or edx, 0xffffffff
sub edx, ecx
cmp edx, 8
jbe 0x40495e
lea esi, [ecx + 8]
cmp esi, 0xfffffffe
ja 0x40495e
cmp edi, esi
jae 0x404916
push ecx
push esi
lea ecx, [ebp - 0x2c]
call fcn.00404e00
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
test esi, esi
je 0x404817
mov ecx, eax
cmp edi, 0x10
jae 0x4048f2
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
xor eax, eax
mov dword [ecx + edx], eax
mov dword [ecx + edx + 4], eax
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
jae 0x40490d
lea eax, [ebp - 0x2c]
mov byte [eax + esi], 0
jmp 0x404811
test esi, esi
jne 0x4048e8
mov dword [ebp - 0x1c], esi
cmp edi, 0x10
jae 0x404925
lea eax, [ebp - 0x2c]
mov byte [eax], 0
jmp 0x404811
lea ecx, [ebp - 0x2c]
call fcn.00403130
xor al, al
jmp 0x404943
lea ecx, [ebp - 0x2c]
call fcn.00403130
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050e0a7
mov esp, ebp
pop ebp
ret
push str.string_too_long
call fcn.0052ad1e
int3
Function at 0x404cb0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x537fdb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x58d140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0052abe2
push 4
mov dword [ebp - 4], 0
call fcn.0040e1bd
mov edi, eax
add esp, 4
test edi, edi
je 0x404d2c
call fcn.0052a5b7
mov dword [edi], eax
call fcn.0052a376
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0052a2ab
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x404d22
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0052a2d3
jmp 0x404d2e
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405ac0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x405adb
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x405b12
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x405b0e
jmp 0x405b00
cmp esi, eax
jae 0x405b12
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x405b00
cmp esi, eax
jb 0x405b19
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x407d80
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x58d140]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push esi
push edi
push eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x407dc6
mov edi, str.CreateToolhelp32Snapshot__of_modules_
call fcn.00407ff0
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050e0a7
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x434]
push eax
push esi
mov dword [ebp - 0x434], 0x428
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
jne 0x407e07
mov edi, str.Module32First
call fcn.00407ff0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0050e0a7
mov esp, ebp
pop ebp
ret 4
mov edi, dword [sym.imp.KERNEL32.dll_Module32NextW]
lea ecx, [ecx]
lea ecx, [ebp - 0x414]
push ecx
push str._n_n_____MODULE_NAME:______s
call fcn.0050f77a
lea edx, [ebp - 0x214]
push edx
push str._n_____Executable_______s
call fcn.0050f77a
mov eax, dword [ebp - 0x42c]
push eax
push str._n_____Process_ID______0x_08X
call fcn.0050f77a
mov ecx, dword [ebp - 0x428]
push ecx
push str._n_____Ref_count__g____0x_04X
call fcn.0050f77a
mov edx, dword [ebp - 0x424]
push edx
push str._n_____Ref_count__p____0x_04X
call fcn.0050f77a
mov eax, dword [ebp - 0x420]
push eax
push str._n_____Base_address____0x_08X
call fcn.0050f77a
mov ecx, dword [ebp - 0x41c]
push ecx
push str._n_____Base_size________d
call fcn.0050f77a
add esp, 0x38
lea edx, [ebp - 0x434]
push edx
push esi
call edi
test eax, eax
jne 0x407e10
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0050e0a7
mov esp, ebp
pop ebp
ret 4
Function at 0x407ec0
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x58d140]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x407ef8
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050e0a7
mov esp, ebp
pop ebp
ret 4
push edi
lea eax, [ebp - 0x228]
push eax
push ebx
mov dword [ebp - 0x228], 0x1c
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
jne 0x407f3a
mov edi, 0x5687c8
call fcn.00407ff0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050e0a7
mov esp, ebp
pop ebp
ret 4
mov edi, dword [sym.imp.USER32.dll_GetUserObjectInformationW]
push esi
mov esi, dword [sym.imp.USER32.dll_GetThreadDesktop]
jmp 0x407f50
mov ecx, dword [ebp + 8]
cmp dword [ebp - 0x21c], ecx
jne 0x407fbc
mov edx, dword [ebp - 0x220]
push edx
push str._n_n_____THREAD_ID_______0x_08X
call fcn.0050f77a
mov eax, dword [ebp - 0x218]
push eax
push str._n_____Base_priority____d
call fcn.0050f77a
mov ecx, dword [ebp - 0x214]
push ecx
push str._n_____Delta_priority___d
call fcn.0050f77a
push 0x56819c
call fcn.0050f77a
mov edx, dword [ebp - 0x220]
add esp, 0x1c
push edx
call esi
lea ecx, [ebp - 0x22c]
push ecx
push 0x208
lea edx, [ebp - 0x20c]
push edx
push 2
push eax
call edi
lea eax, [ebp - 0x228]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x407f50
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop esi
pop edi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0050e0a7
mov esp, ebp
pop ebp
ret 4
Function at 0x408090
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x58d140]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
mov byte [ebp - 0x239], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x240], esi
cmp esi, 0xffffffff
jne 0x4080e3
mov edi, str.CreateToolhelp32Snapshot__of_processes_
call fcn.00407ff0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050e0a7
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x238]
push eax
push esi
mov dword [ebp - 0x238], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x408125
mov edi, str.Process32First
call fcn.00407ff0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050e0a7
mov esp, ebp
pop ebp
ret 4
push str._n_n
call fcn.0050f77a
add esp, 4
lea ecx, [ebp - 0x214]
push ecx
push str._nPROCESS_NAME:___s
call fcn.0050f77a
push str._n_______________________________________________________
call fcn.0050f77a
mov edx, dword [ebp + 8]
mov eax, dword [edx]
add esp, 0xc
lea ecx, [ebp - 0x214]
jmp 0x408160
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x408186
test dx, dx
je 0x408182
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x408186
add eax, 4
add ecx, 4
test dx, dx
jne 0x408160
xor eax, eax
jmp 0x40818b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4081b9
mov eax, dword [ebp - 0x230]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x239], 1
mov ecx, dword [ebp - 0x230]
push ecx
xor esi, esi
push esi
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
jne 0x4081e0
mov edi, 0x56847c
call fcn.00407ff0
jmp 0x4081fe
push ebx
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov esi, eax
test esi, esi
jne 0x4081f7
mov edi, 0x568494
call fcn.00407ff0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x230]
push edx
push str._n__Process_ID_________0x_08X
call fcn.0050f77a
mov eax, dword [ebp - 0x224]
push eax
push str._n__Thread_count________d
call fcn.0050f77a
mov ecx, dword [ebp - 0x220]
push ecx
push str._n__Parent_process_ID__0x_08X
call fcn.0050f77a
mov edx, dword [ebp - 0x21c]
push edx
push str._n__Priority_base_______d
call fcn.0050f77a
add esp, 0x20
test esi, esi
je 0x408257
push esi
push str._n__Priority_class______d
call fcn.0050f77a
add esp, 8
mov eax, dword [ebp - 0x230]
push eax
call fcn.00407d80
mov ecx, dword [ebp - 0x230]
push ecx
call fcn.00407ec0
mov eax, dword [ebp - 0x240]
lea edx, [ebp - 0x238]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x408125
mov ecx, dword [ebp - 0x240]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x239]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0050e0a7
mov esp, ebp
pop ebp
ret 4
Function at 0x4082c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push 0x38
lea eax, [ebp - 0x38]
push 0
push eax
xor bl, bl
mov dword [ebp - 0x3c], 0x3c
call fcn.00511130
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x2c], edx
add esp, 0xc
lea edx, [ebp - 0x3c]
push edx
mov dword [ebp - 0x30], str.runas
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x40835d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea ecx, [ebp + 8]
push ecx
push 0
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x408354
mov eax, dword [ebp + 8]
test eax, eax
je 0x408354
push eax
call dword [sym.imp.KERNEL32.dll_LocalLock]
push eax
push 0x5688f0
call fcn.0050f821
mov edx, dword [ebp + 8]
add esp, 8
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x408370
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x58d140]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x44
lea eax, [ebp - 0x68]
push 0
push eax
mov bl, 1
call fcn.00511130
mov eax, dword [esi]
add esp, 0xc
mov dword [ebp - 0x68], 0x44
mov ecx, dword [eax - 0xc]
push ecx
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
test eax, eax
jne 0x4083b0
call fcn.00401580
push edi
lea ecx, [ebp - 0x68]
push ecx
push 0
push 0
push 0x10
push 1
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4083e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xa
lea edx, [ebp - 0x24]
push edx
push eax
call fcn.0052af9e
add esp, 0xc
xor bl, bl
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0050e0a7
mov esp, ebp
pop ebp
ret
Function at 0x4088d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53864b
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x58d140]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [edi]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x430], ecx
mov ecx, dword [eax]
lea eax, [ecx - 0x10]
sub esi, 0x10
mov byte [ebp - 0x41d], 0
cmp eax, esi
je 0x408971
cmp dword [esi + 0xc], 0
lea ebx, [esi + 0xc]
jl 0x408965
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x408965
push eax
call fcn.00401590
mov dword [ebp - 0x428], eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [ebx], eax
dec eax
test eax, eax
jg 0x408958
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ecx, dword [ebp - 0x428]
add ecx, 0x10
mov dword [edi], ecx
jmp 0x408971
mov eax, dword [ecx - 0xc]
push eax
push ecx
mov ecx, edi
call fcn.004014d0
mov edx, dword [ebp - 0x430]
mov eax, dword [edx]
mov ebx, dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov dword [ebp - 0x42c], 0x400
mov ecx, dword [eax - 0xc]
push ecx
push eax
call ebx
xor esi, esi
cmp eax, esi
jne 0x40899b
call fcn.00401580
lea ecx, [ebp - 0x42c]
push ecx
lea edx, [ebp - 0x41c]
push edx
push esi
push esi
push eax
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4089eb
lea eax, [ebp - 0x41c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x4089c6
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x41c]
push ecx
mov ecx, edi
call fcn.004014d0
mov byte [ebp - 0x41d], 1
mov edx, dword [edi]
cmp dword [edx - 0xc], esi
jne 0x408a95
mov eax, dword [ebp - 0x430]
mov eax, dword [eax]
mov dword [ebp - 0x428], esi
mov ecx, dword [eax - 0xc]
push ecx
push eax
call ebx
cmp eax, esi
jne 0x408a14
call fcn.00401580
lea ecx, [ebp - 0x42c]
push ecx
lea edx, [ebp - 0x428]
push edx
push esi
push esi
push eax
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x408a95
mov edx, dword [ebp - 0x428]
push 0xa
lea ecx, [ebp - 0x1c]
push ecx
push edx
call fcn.0052af9e
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x424]
call fcn.004057d0
push eax
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.00401600
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x424]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408a8e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 0x41d], 1
mov al, byte [ebp - 0x41d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050e0a7
mov esp, ebp
pop ebp
ret 8