joyce8/EMBER2024-capa huggingface dataset:
Function at 0x720e93
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.007038d9
add esp, 0xc
test esp, 0x2752
shl eax, 0
jne 0x720ecc
lea esi, [esi + 0x3acf]
lea esi, [esi - 0x3acf]
jae 0x720ec5
mov esp, esp
je 0x720ecc
lcall 0x48ec, 0x45c684fa
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 8], 0x42
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0x11], 0x44
mov byte [ebp - 0xc], 0x4f
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 9], 0x66
test edi, 0x40da
mov ecx, ecx
xor esi, dword [esp]
xor esi, dword [esp]
jns 0x720f1d
mov ecx, ecx
jmp 0x720f18
jmp 0x720f1a
js 0x720f1d
mov edx, 0x80ec4d8a
jmp 0xecbf9727
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
call fcn.0070cc92
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x720fa3
xor eax, eax
jmp 0x721029
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00702f41
mov dword [ebp - 0x18], eax
push 0xe
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.007038d9
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x721027
lea edx, [edx + 0x3efd]
lea edx, [edx - 0x3efd]
lea ecx, [ecx + 0x3b69]
lea ecx, [ecx - 0x3b69]
jno 0x720ff7
jge 0x720fe5
lea ecx, [ecx + 0x1d28]
lea ecx, [ecx - 0x1d28]
lea esp, [esp]
jo 0x720ff7
mov ebp, 0x52e8558b
mov edx, dword [ebp - 0x18]
push edx
call fcn.00723150
add esp, 4
lea eax, [eax]
and edi, 0xffffffff
cmp edi, dword [esp]
add esp, 0
jbe 0x721016
nop
ja 0x721013
ja 0x721016
sub eax, 0x5010458b
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x721029
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x721f76
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.007038d9
add esp, 0xc
test dword [esp], eax
mov edi, edi
test esp, 0x5221
test dword [esp + 4], ecx
jb 0x721fa5
xchg esp, esp
jae 0x721fa5
add eax, 0x53ec45c6
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xb], 0x71
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 7], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x66
mov byte [ebp - 0x12], 0x6a
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 6], 0
jl 0x721fe3
jnp 0x721fef
lea edi, [edi]
jb 0x721fe9
lea edi, [edi]
jp 0x721fef
mov ebp, 0xec4d8ab1
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
call fcn.007116a4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x722079
jmp 0x7220e7
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00702f41
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.007038d9
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x7220e7
xor esp, 0
jl 0x7220b9
pushf
xor ebx, dword [esp]
xor ebx, dword [esp]
std
cld
popf
xchg edx, esi
xchg edx, esi
jae 0x7220b6
jge 0x7220b9
or dword [ebx - 0x17af17bb], 0x108e
mov eax, dword [ebp - 0x18]
push eax
call fcn.00723150
add esp, 4
jle 0x7220c7
xchg esi, esi
inc edi
dec edi
jg 0x7220d4
jno 0x7220cf
jle 0x7220d4
mov ebx, 0x4d8b66cb
adc al, 0x51
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x7220f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.007038d9
add esp, 0xc
jl 0x722112
jge 0x72212b
lea edx, [edx + 0x2026]
lea edx, [edx - 0x2026]
nop
xchg ebx, ecx
xchg ebx, ecx
jb 0x722127
jl 0x72212b
sub eax, 0xf045c6f2
dec esi
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
add edx, 0
xor edi, 0
ror esi, 0xc
ror esi, 0x14
jns 0x722183
pushf
jmp 0x72216d
jno 0x72216f
jle 0x722171
call 0x722176
lea esp, [esp + 4]
popf
xchg ebx, edx
xchg ebx, edx
js 0x722183
add eax, 0x80f04d8a
jmp 0xf0bfa98d
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
shl esp, 0
jnp 0x7221fa
pushf
rol esp, 0
jo 0x7221ef
popf
jno 0x7221f3
mov eax, eax
jno 0x7221f7
jp 0x7221fa
ljmp 0x89ff:0xfeaa93e8
call fcn.0070cc92
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x72220c
xor eax, eax
jmp 0x722248
lea edx, [edx]
jne 0x722225
mov esp, esp
jno 0x722214
lea edx, [edx + 0xb4a]
lea edx, [edx - 0xb4a]
nop
je 0x722225
mov esi, 0xf0458d98
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00702f41
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.007038d9
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7223ea
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.007038d9
add esp, 0xc
jl 0x72240c
js 0x72240e
xchg ecx, eax
xchg ecx, eax
jge 0x722412
jg 0x722423
pushf
ror eax, 0x14
rol eax, 0x14
popf
jns 0x722420
jle 0x722423
add eax, 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.007116a4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x7224eb
xor eax, eax
jmp 0x722568
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00702f41
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.007038d9
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x722515
xor eax, eax
jmp 0x722568
mov edx, edx
jnp 0x722519
shl esp, 0
jg 0x722534
pushf
ror ebx, 7
ror ebx, 0x19
xchg ebx, ebx
shr esp, 0
popf
xchg esp, esp
jns 0x722531
jle 0x722534
mov edx, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.00723150
add esp, 4
xchg edx, edx
xor eax, dword [esp + 8]
xor eax, dword [esp + 8]
mov ecx, ecx
jo 0x72255d
pushf
test esi, 0x7c4
popf
jp 0x72255a
jno 0x72255d
mov esp, 0x510c4d8b
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x722571
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x6f83d8], 1
jne 0x7226a6
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.007038d9
add esp, 0xc
mov esp, esp
cmp esp, 0x353d
rol esp, 0
jle 0x7225aa
jbe 0x7225a6
jg 0x7225aa
mov esp, 0xe845c6ca
dec eax
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
lea ebx, [ebx]
jbe 0x7225e3
jne 0x7225dc
jg 0x7225de
lea ebx, [ebx]
ja 0x7225e3
ljmp 0x1e9:0x80e84d8a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.007116a4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x722650
mov eax, dword [ebp + 8]
jmp 0x722735
nop
cmc
shr edx, 0
test dword [esp], ecx
jl 0x72266b
pushf
clc
clc
jb 0x722660
popf
jne 0x722664
jne 0x722666
je 0x722668
jge 0x72266b
xor eax, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.00702f41
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.007038d9
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x72269c
mov edx, dword [ebp - 8]
mov dword [0x6f83d8], edx
jmp 0x7226a4
mov eax, dword [ebp + 8]
jmp 0x722735
jmp 0x7226ae
mov eax, dword [0x6f83d8]
mov dword [ebp - 8], eax
shl esp, 0
rol edi, 3
ror edi, 3
jl 0x7226b9
jno 0x7226c9
jp 0x7226bd
jge 0x7226bf
jb 0x7226c1
xchg esi, ebx
xchg esi, ebx
jo 0x7226c9
ljmp 0x4d89:0xf84d8b7c
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
sub edi, 0
lea eax, [eax + 0x7af6]
sub eax, 0x7af6
lea eax, [eax + 0x21ec]
lea eax, [eax - 0x21ec]
jg 0x7226f9
lea edi, [edi]
jle 0x7226ef
xchg edx, ebx
xchg edx, ebx
xchg esi, eax
xchg esi, eax
jle 0x7226f9
mov esp, 0xfc558be4
mov edx, dword [ebp - 4]
push edx
call fcn.00723150
add esp, 4
test dword [esp], edx
or esi, esi
jb 0x72272e
pushf
lea edx, [edx + 0x3210]
lea edx, [edx - 0x3210]
lea esi, [esi]
add esp, 0
xor edx, ebx
xor edx, ebx
popf
jb 0x722727
jbe 0x722729
jae 0x72272b
jae 0x72272e
mov ebx, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x7231f2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.007038d9
add esp, 0xc
cmp edi, 0x31b8
jg 0x723213
cmp ebx, dword [esp + 0xc]
xor esi, ebx
xor esi, ebx
jg 0x723234
jmp 0x72321f
lea esi, [esi + 0x2c2d]
lea esi, [esi - 0x2c2d]
mov eax, eax
mov esp, esp
jle 0x723234
add eax, 0x45c6917a
call 0xedb7f883
mov byte gs:[ebp - 0xe], 0x6d
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0xe], 0x6d
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x12], 0x49
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 0xc], 0
call 0x72326d
lea esp, [esp + 4]
jnp 0x723278
jno 0x723275
jp 0x723278
mov ebp, 0x80e84d8a
jmp 0xe8bfba82
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
jo 0x7232e2
xor ecx, edi
xor ecx, edi
jb 0x7232e8
jge 0x7232fc
ja 0x7232ec
lea edx, [edx + 0x2b38]
lea edx, [edx - 0x2b38]
nop
jl 0x7232fc
mov esp, 0xfee3a3e8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.007116a4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x723311
xor eax, eax
jmp 0x7233a8
rol edx, 8
rol edx, 0x18
ja 0x723320
jnp 0x72331b
jg 0x72331d
jbe 0x723320
call 0x525a80b1
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00702f41
mov dword [ebp - 4], eax
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.007038d9
add esp, 0xc
xor edi, 0x495
xor edi, 0x495
js 0x72335c
lea edi, [edi]
ja 0x723352
lea esp, [esp]
mov esi, esi
jns 0x72335c
jmp 0x7df58980
cmp dword [ebp - 4], 0
jne 0x723366
xor eax, eax
jmp 0x7233a8
jle 0x723368
xchg edx, edi
xchg edx, edi
je 0x72336e
jbe 0x723386
pushf
shl esp, 0
nop
xchg edi, edx
xchg edi, edx
popf
jno 0x72337e
lea esp, [esp]
mov esp, esp
ja 0x723386
add eax, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.00723150
add esp, 4
std
cld
jg 0x723396
xchg esi, esi
push edi
pop edi
jle 0x7233a1
jne 0x72339e
jg 0x7233a1
mov esp, 0x5208558b
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x7246c0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x40138c
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x40139e
mov eax, dword [0x47508b]
shl eax, 2
mov dword [0x47508f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.0046982c
pop edx
call fcn.00469790
call fcn.0046986c
push 0
call fcn.0046aca8
pop ecx
push 0x475034
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x475093], eax
push 0
jmp fcn.0046fcec

Function at 0x401b54
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
mov eax, 0x475ee8
call fcn.0046a008
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x168], 0x128
lea edx, [ebp - 0x168]
push edx
push dword [ebp - 0x3c]
call sub.KERNEL32.DLL_Process32First
test eax, eax
setne cl
and ecx, 1
mov byte [ebp - 0x31], cl
mov word [ebp - 0x20], 0x14
mov edx, 0x475487
lea eax, [ebp - 4]
call fcn.00473eac
inc dword [ebp - 0x14]
mov word [ebp - 0x20], 8
cmp byte [ebp - 0x31], 0
je 0x401c78
mov word [ebp - 0x20], 0x20
lea eax, [ebp - 0xc]
call fcn.00401abc
push eax
inc dword [ebp - 0x14]
lea edx, [ebp - 0x144]
lea eax, [ebp - 8]
call fcn.00473eac
inc dword [ebp - 0x14]
mov eax, dword [eax]
pop edx
call fcn.0042102c
lea eax, [ebp - 0xc]
lea edx, [ebp - 4]
call fcn.00474060
push eax
dec dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00473f7c
dec dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00473f7c
pop ecx
test cl, cl
je 0x401c54
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x38], eax
push dword [ebp - 0x38]
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
mov dword [ebp - 0x40], eax
mov word [ebp - 0x20], 8
cmp dword [ebp - 0x40], 0
je 0x401c4b
push 0xfffffffffffffff7
push dword [ebp - 0x40]
call sub.KERNEL32.DLL_TerminateProcess
test eax, eax
jne 0x401c4f
xor edx, edx
jmp 0x401c54
mov edx, 1
lea ecx, [ebp - 0x168]
push ecx
push dword [ebp - 0x3c]
call sub.KERNEL32.DLL_Process32Next
test eax, eax
setne al
and eax, 1
mov byte [ebp - 0x31], al
cmp byte [ebp - 0x31], 0
jne 0x401bbd
push dword [ebp - 0x3c]
call sub.KERNEL32.DLL_CloseHandle
dec dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00473f7c
mov ecx, dword [ebp - 0x30]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x401ff8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push esi
push edi
mov eax, 0x4760f0
call fcn.0046a008
mov word [ebp - 0x2c], 0x14
mov edx, 0x4754c4
lea eax, [ebp - 4]
call fcn.00473eac
inc dword [ebp - 0x20]
mov word [ebp - 0x2c], 8
mov esi, 0x4753c0
lea edi, [ebp - 0xbc]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
push 0x80
lea eax, [ebp - 0xbc]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
mov word [ebp - 0x2c], 0x20
lea edx, [ebp - 0xbc]
lea eax, [ebp - 8]
call fcn.00473eac
mov edx, eax
inc dword [ebp - 0x20]
lea eax, [ebp - 4]
call fcn.00473fac
dec dword [ebp - 0x20]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00473f7c
mov word [ebp - 0x2c], 0x2c
lea eax, [ebp - 0xc]
call fcn.00401abc
push eax
inc dword [ebp - 0x20]
lea eax, [ebp - 4]
call fcn.0040218c
mov edx, eax
lea eax, [ebp - 4]
mov ecx, 1
call fcn.0047426c
lea edx, [ebp - 0xc]
push edx
mov edx, 0x4754c5
lea eax, [ebp - 0x10]
call fcn.00473eac
inc dword [ebp - 0x20]
lea edx, [ebp - 0x10]
pop eax
call fcn.00474078
push eax
dec dword [ebp - 0x20]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00473f7c
dec dword [ebp - 0x20]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00473f7c
pop ecx
test cl, cl
je 0x402142
mov word [ebp - 0x2c], 0x38
lea eax, [ebp - 0x18]
call fcn.00401abc
push eax
inc dword [ebp - 0x20]
mov edx, 0x4754c7
lea eax, [ebp - 0x14]
call fcn.00473eac
inc dword [ebp - 0x20]
lea edx, [ebp - 0x14]
lea eax, [ebp - 4]
pop ecx
call fcn.00473fd4
lea edx, [ebp - 0x18]
lea eax, [ebp - 4]
call fcn.00473fac
dec dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00473f7c
dec dword [ebp - 0x20]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00473f7c
mov word [ebp - 0x2c], 0x44
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.00473fac
mov eax, dword [ebp + 8]
mov word [ebp - 0x2c], 0x50
push eax
dec dword [ebp - 0x20]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00473f7c
pop eax
mov word [ebp - 0x2c], 0x44
inc dword [ebp - 0x20]
mov edx, dword [ebp - 0x3c]
mov dword fs:[0], edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x407650
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
mov dword [ebp - 4], edx
mov dword [ebp - 0x34], eax
mov eax, 0x477c40
call fcn.0046a008
mov dword [ebp - 0x14], 1
lea edx, [ebp - 4]
lea eax, [ebp - 4]
call fcn.00473ee4
inc dword [ebp - 0x14]
mov word [ebp - 0x20], 8
mov byte [ebp - 0x36], 0
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x16c], 0x128
lea edx, [ebp - 0x16c]
push edx
push dword [ebp - 0x40]
call sub.KERNEL32.DLL_Process32First
test eax, eax
setne cl
and ecx, 1
mov byte [ebp - 0x35], cl
cmp byte [ebp - 0x35], 0
je 0x407781
mov word [ebp - 0x20], 0x14
lea eax, [ebp - 0xc]
call fcn.00401abc
push eax
inc dword [ebp - 0x14]
lea edx, [ebp - 0x148]
lea eax, [ebp - 8]
call fcn.00473eac
inc dword [ebp - 0x14]
mov eax, dword [eax]
pop edx
call fcn.0042102c
lea eax, [ebp - 0xc]
lea edx, [ebp - 4]
call fcn.00474060
push eax
dec dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00473f7c
dec dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00473f7c
pop ecx
test cl, cl
je 0x40775d
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x3c]
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
mov dword [ebp - 0x44], eax
mov word [ebp - 0x20], 8
cmp dword [ebp - 0x44], 0
je 0x407750
push 0xfffffffffffffff7
push dword [ebp - 0x44]
call sub.KERNEL32.DLL_TerminateProcess
test eax, eax
jne 0x407754
xor edx, edx
jmp 0x407759
mov edx, 1
mov byte [ebp - 0x36], 1
lea ecx, [ebp - 0x16c]
push ecx
push dword [ebp - 0x40]
call sub.KERNEL32.DLL_Process32Next
test eax, eax
setne al
and eax, 1
mov byte [ebp - 0x35], al
cmp byte [ebp - 0x35], 0
jne 0x4076c2
mov al, byte [ebp - 0x36]
push eax
dec dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00473f7c
pop eax
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret