joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4468b0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x50e018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 0
push 3
push 0
push 3
push 0
push str..PhysicalDrive0
mov dword [ebp - 0x12c], str.qemu
mov dword [ebp - 0x128], str.virtual
mov dword [ebp - 0x124], str.vmware
mov dword [ebp - 0x120], str.vbox
mov dword [ebp - 0x11c], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x114], esi
cmp esi, 0xffffffff
je 0x446a22
xor eax, eax
mov dword [ebp - 0x110], eax
push 0x80
push eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x104]
push eax
mov dword [ebp - 0x118], 0
call sub.MSVCR100.dll_memset
push 0x80
lea ecx, [ebp - 0x84]
push 0
push ecx
call sub.MSVCR100.dll_memset
add esp, 0x18
push 0
lea edx, [ebp - 0x118]
push edx
push 0x80
lea eax, [ebp - 0x104]
push eax
push 0xc
lea ecx, [ebp - 0x110]
push ecx
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x446a1b
mov edx, dword [ebp - 0xf4]
mov al, byte [ebp + edx - 0x104]
lea edx, [ebp + edx - 0x104]
test al, al
je 0x4469ca
lea ecx, [ebp - 0x84]
jmp 0x4469c0
inc edx
mov byte [ecx], al
mov al, byte [edx]
inc ecx
test al, al
jne 0x4469c0
lea eax, [ebp - 0x84]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4469d3
sub eax, edx
push eax
lea edx, [ebp - 0x84]
push edx
call dword [sym.imp.USER32.dll_CharLowerBuffA]
mov edi, dword [sym.imp.MSVCR100.dll_strstr]
xor esi, esi
mov eax, dword [ebp + esi*4 - 0x12c]
cmp byte [eax], 0
je 0x446a0f
push eax
lea eax, [ebp - 0x84]
push eax
call edi
add esp, 8
test eax, eax
jne 0x446a34
inc esi
cmp esi, 4
jb 0x4469f2
mov esi, dword [ebp - 0x114]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a665a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.004a665a
mov esp, ebp
pop ebp
ret
Function at 0x4474d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4389
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
mov eax, dword [0x50e018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
lea eax, [ebp - 0x20]
push eax
push 1
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov dword [ebp - 4], ebx
push connect
mov dword [ebp - 0x14], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x447616
mov eax, 4
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x20]
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push str.SecureProtocols
push ecx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x447616
test byte [ebp - 0x10], 8
je 0x447588
push 1
push str.12345
mov ecx, esi
call fcn.0040e4c0
push 1
push 0x4eac2c
mov ecx, esi
call fcn.0040e4c0
test byte [ebp - 0x10], 0x20
je 0x4475aa
push 1
push 0x4ec8b4
mov ecx, esi
call fcn.0040e4c0
push 1
push 0x4eac2c
mov ecx, esi
call fcn.0040e4c0
test byte [ebp - 0x10], 0x80
je 0x4475cc
push 1
push 0x4ec8b8
mov ecx, esi
call fcn.0040e4c0
push 1
push 0x4eac2c
mov ecx, esi
call fcn.0040e4c0
test dword [ebp - 0x10], 0x200
je 0x4475f1
push 1
push 0x4ec8bc
mov ecx, esi
call fcn.0040e4c0
push 1
push 0x4eac2c
mov ecx, esi
call fcn.0040e4c0
test dword [ebp - 0x10], 0x800
je 0x447616
push 1
push 0x4ec8c0
mov ecx, esi
call fcn.0040e4c0
push 1
push 0x4eac2c
mov ecx, esi
call fcn.0040e4c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4479d0
Capabilities:
Hash data with md5

Disassembly:
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x449530
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [ebp + 0x1c], 0x10
jae 0x449542
lea eax, [ebp + 8]
push esi
push 0
push 0
push 3
push 0
push 1
push 8
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x44956f
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x1c], 0x10
pop esi
jb 0x449583
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, edi
pop edi
pop ebp
ret 0x1c
Function at 0x44d7b0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x50e018]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x44d8b3
push ebx
push esi
push 0x104
call fcn.004a64f8
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 4
mov esi, eax
push edi
push esi
call ebx
push 0x4eba44
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x144]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x148], eax
cmp eax, 0xffffffff
je 0x44d8a0
lea ebx, [ebx]
push 0x4e457c
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x44d87b
push 0x4eba48
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x44d87b
push edi
push esi
call ebx
lea eax, [ebp - 0x118]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
test byte [ebp - 0x144], 0x10
je 0x44d874
push 1
push esi
call fcn.0044d7b0
add esp, 8
jmp 0x44d87b
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp - 0x148]
lea ecx, [ebp - 0x144]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x44d820
mov eax, dword [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004a665a
mov esp, ebp
pop ebp
ret
Function at 0x450390
Capabilities:
Write file on windows

Disassembly:
cmp dword [eax + 0x10], 0
jne 0x450399
xor eax, eax
ret
cmp dword [eax + 0x14], 0x10
jb 0x4503a1
mov eax, dword [eax]
push esi
push 0x4ec11c
push eax
call dword [sym.imp.MSVCR100.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x4503b9
pop esi
ret
cmp dword [edi + 0x14], 0x10
mov ecx, dword [edi + 0x10]
jb 0x4503c6
mov eax, dword [edi]
jmp 0x4503c8
mov eax, edi
push esi
push ecx
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 0x14
mov eax, 1
pop esi
ret

Function at 0x4503f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.004cbac0
mov eax, dword [0x50e018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0
jne 0x450420
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a665a
mov esp, ebp
pop ebp
ret
cmp dword [eax + 0x14], 0x10
jb 0x450428
mov eax, dword [eax]
push esi
push 0x4eca24
push eax
call dword [sym.imp.MSVCR100.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x45044d
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a665a
mov esp, ebp
pop ebp
ret
push edi
push 0xfff
lea eax, [ebp - 0x1003]
push 0
push eax
mov byte [ebp - 0x1004], 0
call sub.MSVCR100.dll_memset
mov edi, dword [sym.imp.MSVCR100.dll_fread]
push esi
push 0x1000
lea ecx, [ebp - 0x1004]
push 1
push ecx
call edi
add esp, 0x1c
test eax, eax
je 0x4504c0
push eax
lea edx, [ebp - 0x1004]
push edx
mov ecx, ebx
call fcn.0040e4c0
push 0x1000
lea eax, [ebp - 0x1004]
push 0
push eax
call sub.MSVCR100.dll_memset
push esi
push 0x1000
lea ecx, [ebp - 0x1004]
push 1
push ecx
call edi
add esp, 0x1c
test eax, eax
jne 0x450486
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.004a665a
mov esp, ebp
pop ebp
ret
Function at 0x4504e0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4192
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x50e018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x84], eax
cmp dword [ecx + 0x14], 0x10
mov byte [ebp - 0x20], al
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov word [ebp - 0x13], ax
mov byte [ebp - 0x11], al
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x68], eax
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x88], edi
mov dword [ebp - 0x78], 0x67452301
mov dword [ebp - 0x74], 0xefcdab89
mov dword [ebp - 0x70], 0x98badcfe
mov dword [ebp - 0x6c], 0x10325476
jb 0x450558
mov ecx, dword [ecx]
push ecx
lea ecx, [ebp - 0x78]
call fcn.00447a00
add esp, 4
lea esi, [ebp - 0x78]
lea ebx, [ebp - 0x20]
call fcn.00447ac0
xor ebx, ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 0x84], 1
lea ebx, [ebx]
movzx esi, byte [ebp + ebx - 0x20]
mov eax, esi
shr eax, 4
mov cl, byte [eax + str.0123456789abcdef]
mov byte [ebp - 0x80], cl
mov ecx, dword [edi + 0x14]
cmp ecx, 0x10
jb 0x4505af
mov edx, dword [edi]
jmp 0x4505b1
mov edx, edi
mov eax, dword [edi + 0x10]
add eax, edx
cmp ecx, 0x10
jb 0x4505bf
mov ecx, dword [edi]
jmp 0x4505c1
mov ecx, edi
test eax, eax
je 0x4505c7
sub eax, ecx
mov edx, dword [ebp - 0x80]
push edx
push 1
push eax
mov ecx, edi
call fcn.00450e30
mov ecx, dword [edi + 0x14]
and esi, 0xf
mov al, byte [esi + str.0123456789abcdef]
mov byte [ebp - 0x7c], al
cmp ecx, 0x10
jb 0x4505ed
mov edx, dword [edi]
jmp 0x4505ef
mov edx, edi
mov eax, dword [edi + 0x10]
add eax, edx
cmp ecx, 0x10
jb 0x4505fd
mov ecx, dword [edi]
jmp 0x4505ff
mov ecx, edi
test eax, eax
je 0x450605
sub eax, ecx
mov ecx, dword [ebp - 0x7c]
push ecx
push 1
push eax
mov ecx, edi
call fcn.00450e30
inc ebx
cmp ebx, 0x10
jl 0x450590
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a665a
mov esp, ebp
pop ebp
ret
Function at 0x4511d0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf6b8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x50e018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x451211
cmp eax, 0x80010106
jne 0x45129f
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea ebx, [edi + 0xc]
push ebx
push 0x4e3c34
push 1
push 0
push 0x4e3d04
call dword [sym.imp.ole32.dll_CoCreateInstance]
push str.ROOTCIMV2
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
jne 0x45125f
push 0x8007000e
call fcn.0040e9b0
add edi, 8
push edi
push 0
push 0
push 0
push 0
push 0
mov dword [ebp - 4], 0
mov eax, dword [ebx]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push 0
push esi
push eax
call edx
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [edi]
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x455250
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4089
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x50e018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 1
xor edi, edi
jmp 0x4552a0
movzx eax, byte [edi + 0x50f660]
mov cl, byte [eax + 0x50f520]
mov byte [ebp - 0x14], cl
mov ecx, dword [esi + 0x14]
cmp ecx, 0x10
jb 0x4552bc
mov edx, dword [esi]
jmp 0x4552be
mov edx, esi
mov eax, dword [esi + 0x10]
add eax, edx
cmp ecx, 0x10
jb 0x4552cc
mov ecx, dword [esi]
jmp 0x4552ce
mov ecx, esi
cmp eax, ebx
jne 0x4552d6
xor eax, eax
jmp 0x4552d8
sub eax, ecx
mov edx, dword [ebp - 0x14]
push edx
push 1
push eax
mov ecx, esi
call fcn.00450e30
inc edi
cmp edi, 0xe
jb 0x4552a0
mov edi, dword [esi + 0x14]
mov ecx, dword [esi + 0x10]
cmp edi, 0x10
jb 0x4552fb
mov eax, dword [esi]
jmp 0x4552fd
mov eax, esi
lea edx, [eax + ecx]
xor ecx, ecx
cmp eax, edx
jae 0x455318
movzx ebx, byte [eax]
imul ecx, ecx, 0x1000193
inc eax
xor ecx, ebx
cmp eax, edx
jb 0x455306
xor ebx, ebx
mov dword [ebp - 0x14], ecx
mov dword [esi + 0x10], ebx
cmp edi, 0x10
jb 0x455327
mov eax, dword [esi]
jmp 0x455329
mov eax, esi
mov byte [eax], 0
mov ebx, 3
movzx edi, byte [ebp + ebx - 0x14]
mov eax, edi
shr eax, 4
mov cl, byte [eax + str.0123456789abcdef]
mov byte [ebp - 0x18], cl
mov ecx, dword [esi + 0x14]
cmp ecx, 0x10
jb 0x455350
mov edx, dword [esi]
jmp 0x455352
mov edx, esi
mov eax, dword [esi + 0x10]
add eax, edx
cmp ecx, 0x10
jb 0x455360
mov ecx, dword [esi]
jmp 0x455362
mov ecx, esi
test eax, eax
je 0x455368
sub eax, ecx
mov edx, dword [ebp - 0x18]
push edx
push 1
push eax
mov ecx, esi
call fcn.00450e30
mov ecx, dword [esi + 0x14]
and edi, 0xf
mov al, byte [edi + str.0123456789abcdef]
mov byte [ebp - 0x1c], al
cmp ecx, 0x10
jb 0x45538e
mov edx, dword [esi]
jmp 0x455390
mov edx, esi
mov eax, dword [esi + 0x10]
add eax, edx
cmp ecx, 0x10
jb 0x45539e
mov ecx, dword [esi]
jmp 0x4553a0
mov ecx, esi
test eax, eax
je 0x4553a6
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
push ecx
push 1
push eax
mov ecx, esi
call fcn.00450e30
dec ebx
jns 0x455331
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x457070
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4042
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x50e018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x228
lea eax, [ebp - 0x238]
push 0
mov dword [ebp - 0x240], 0
push eax
mov dword [ebp - 0x244], esi
mov dword [ebp - 0x23c], 0x22c
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [ebp - 0x23c]
mov edi, eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
xor edx, edx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], dx
mov dword [ebp - 4], edx
mov dword [ebp - 0x240], 1
test eax, eax
je 0x45715e
lea ebx, [ebx]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x234]
je 0x45712f
lea ecx, [ebp - 0x23c]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x457110
jmp 0x45715e
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
jmp 0x457140
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x457140
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x218]
push edx
mov ecx, esi
call fcn.00411070
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a665a
mov esp, ebp
pop ebp
ret
Function at 0x457580
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d2948
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x50e018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x5130dc]
test eax, eax
jne 0x45763b
lea esi, [eax + 8]
cmp dword [0x50f940], eax
jne 0x457607
lea ebx, [ebp - 0x2c]
call fcn.00457190
push eax
mov ecx, 0x50f930
mov dword [ebp - 4], 0
call fcn.0041c0c0
cmp dword [ebp - 0x18], esi
jb 0x4575ee
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, dword [0x5130dc]
xor ecx, ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], cx
cmp dword [0x50f944], esi
jb 0x457634
mov ecx, dword [0x50f930]
test ecx, ecx
je 0x45762d
test eax, eax
jne 0x45763b
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x5130dc], eax
test eax, eax
jne 0x45763b
xor al, al
jmp 0x4577c4
mov ecx, 0x50f930
jmp 0x457619
cmp dword [0x5130f0], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jne 0x457660
push str.ServerBeginCapDump
push eax
call esi
mov dword [0x5130f0], eax
test eax, eax
je 0x45762d
mov eax, dword [0x5130dc]
cmp dword [0x5130ec], 0
jne 0x45767f
push str.ClientBeginCapDump
push eax
call esi
mov dword [0x5130ec], eax
test eax, eax
je 0x45762d
mov eax, dword [0x5130dc]
cmp dword [0x5130f4], 0
jne 0x45769e
push str.StopCaptureDump
push eax
call esi
mov dword [0x5130f4], eax
test eax, eax
je 0x45762d
mov eax, dword [0x5130dc]
cmp dword [0x5130f8], 0
jne 0x4576b9
push str.InitLogging
push eax
call esi
mov dword [0x5130f8], eax
mov eax, dword [0x5130dc]
cmp dword [0x5130fc], 0
jne 0x4576d4
push str.BrLogInfo
push eax
call esi
mov dword [0x5130fc], eax
mov eax, dword [0x5130dc]
cmp dword [0x513100], 0
jne 0x4576ef
push str.BrLogWarn
push eax
call esi
mov dword [0x513100], eax
mov eax, dword [0x5130dc]
cmp dword [0x513104], 0
jne 0x45770a
push str.BrLogError
push eax
call esi
mov dword [0x513104], eax
mov eax, dword [0x5130dc]
cmp dword [0x513108], 0
jne 0x457725
push str.BrLogInfo_If
push eax
call esi
mov dword [0x513108], eax
mov eax, dword [0x5130dc]
cmp dword [0x51310c], 0
jne 0x457740
push str.BrLogWarn_If
push eax
call esi
mov dword [0x51310c], eax
mov eax, dword [0x5130dc]
cmp dword [0x513110], 0
jne 0x45775b
push str.BrLogError_If
push eax
call esi
mov dword [0x513110], eax
mov eax, dword [0x5130dc]
cmp dword [0x513114], 0
jne 0x457776
push str.BrLogTrace_If
push eax
call esi
mov dword [0x513114], eax
mov eax, dword [0x5130dc]
cmp dword [0x513118], 0
jne 0x457791
push str.BrLogVerbose_If
push eax
call esi
mov dword [0x513118], eax
mov eax, dword [0x5130dc]
cmp dword [0x51311c], 0
jne 0x4577ac
push str.GetLogVerboseLevel
push eax
call esi
mov dword [0x51311c], eax
mov eax, dword [0x5130dc]
cmp dword [0x513120], 0
jne 0x4577c2
push str.SetLogVerboseLevel
push eax
call esi
mov dword [0x513120], eax
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a665a
mov esp, ebp
pop ebp
ret
Function at 0x459e90
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x50e018]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x459eb9
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a665a
mov esp, ebp
pop ebp
ret
push esi
push 0x228
lea eax, [ebp - 0x22c]
push 0
push eax
mov dword [ebp - 0x230], 0x22c
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x459f04
lea ecx, [ebp - 0x230]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x459f15
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a665a
mov esp, ebp
pop ebp
ret
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
xor bl, bl
nop
mov edx, dword [ebp + 8]
cmp dword [ebp - 0x228], edx
je 0x459f3b
lea eax, [ebp - 0x230]
push eax
push esi
call edi
test eax, eax
jne 0x459f20
jmp 0x459f3d
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
mov al, bl
pop ebx
xor ecx, ebp
pop esi
call fcn.004a665a
mov esp, ebp
pop ebp
ret
Function at 0x459f60
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cfc48
mov eax, dword fs:[0]
push eax
sub esp, 0x338
mov eax, dword [0x50e018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
push 0x228
lea eax, [ebp - 0x33c]
push esi
mov dword [ebp - 4], esi
push eax
mov dword [ebp - 0x340], 0x22c
call sub.MSVCR100.dll_memset
add esp, 0xc
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x459fdc
cmp dword [ebp + 0x1c], 0x10
jb 0x459fd5
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
jmp 0x45a0b1
lea edx, [ebp - 0x340]
push edx
push edi
mov dword [ebp - 0x344], esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x45a015
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x1c], 0x10
jb 0x459fd5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
jmp 0x45a0b1
mov esi, dword [sym.imp.MSVCR100.dll__wcsicmp]
jmp 0x45a020
cmp dword [ebp + 0x1c], 0x10
mov eax, dword [ebp + 8]
jae 0x45a02c
lea eax, [ebp + 8]
push 3
push eax
lea edx, [ebp - 0x114]
lea ecx, [ebp - 0x110]
push edx
mov dword [ebp - 0x114], ecx
call fcn.00435190
mov eax, dword [ebp - 0x114]
push eax
lea ecx, [ebp - 0x31c]
push ecx
call esi
add esp, 8
test eax, eax
mov eax, dword [ebp - 0x114]
lea edx, [ebp - 0x110]
sete bl
cmp eax, edx
je 0x45a079
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
test bl, bl
jne 0x45a0cd
lea eax, [ebp - 0x340]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x45a020
mov esi, dword [ebp - 0x344]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x1c], 0x10
jb 0x45a0af
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a665a
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x338]
jmp 0x45a095