joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4219be
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x481c70]
je 0x4219d9
inc edi
cmp edi, 0x17
jb 0x4219ca
cmp edi, 0x17
jae 0x421b59
push ebp
push 3
call fcn.0042a46e
cmp eax, 1
pop ecx
je 0x421b25
push 3
call fcn.0042a46e
test eax, eax
pop ecx
jne 0x421a0d
cmp dword [0x481110], 1
je 0x421b25
cmp ebx, 0xfc
je 0x421b58
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x483a00
push ebp
call fcn.0041f277
add esp, 0xc
test eax, eax
je 0x421a43
push esi
push esi
push esi
push esi
push esi
call fcn.00416131
add esp, 0x14
push 0x104
mov esi, 0x483a19
push esi
push 0
mov byte [0x483b1d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x421a87
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0041f277
add esp, 0xc
test eax, eax
je 0x421a87
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00416131
add esp, 0x14
push esi
call fcn.00415fa0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x421acc
push esi
call fcn.00415fa0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x483d14
push 0x46c6d4
sub ecx, eax
push ecx
push eax
call fcn.00427df6
add esp, 0x14
test eax, eax
je 0x421acc
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00416131
add esp, 0x14
jmp 0x421ace
xor esi, esi
push 0x46c6d0
push ebx
push ebp
call fcn.00427d3d
add esp, 0xc
test eax, eax
je 0x421aee
push esi
push esi
push esi
push esi
push esi
call fcn.00416131
add esp, 0x14
push dword [edi*8 + 0x481c74]
push ebx
push ebp
call fcn.00427d3d
add esp, 0xc
test eax, eax
je 0x421b10
push esi
push esi
push esi
push esi
push esi
call fcn.00416131
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0042a2b1
add esp, 0xc
jmp 0x421b58
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x421b58
cmp ebp, 0xffffffff
je 0x421b58
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x481c74]
push dword [esi]
call fcn.00415fa0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x42a2b1
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00420781
xor ebx, ebx
cmp dword [0x483fac], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x42a387
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x42a467
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x42a467
push eax
call fcn.00420713
mov dword [esp], 0x46d880
push edi
mov dword [0x483fac], eax
call esi
push eax
call fcn.00420713
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x483fb0], eax
call esi
push eax
call fcn.00420713
mov dword [0x483fb4], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0041db60
test eax, eax
pop ecx
pop ecx
je 0x42a355
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00416131
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x42a387
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00420713
cmp eax, ebx
pop ecx
mov dword [0x483fbc], eax
je 0x42a387
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00420713
pop ecx
mov dword [0x483fb8], eax
mov eax, dword [0x483fb8]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x42a40c
cmp dword [0x483fbc], ecx
je 0x42a40c
push eax
call fcn.0042078a
push dword [0x483fbc]
mov esi, eax
call fcn.0042078a
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x42a40c
cmp edi, ebx
je 0x42a40c
call esi
cmp eax, ebx
je 0x42a3d9
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42a3d9
test byte [ebp - 0x18], 1
jne 0x42a40c
lea eax, [ebp - 0x10]
push eax
call fcn.0041db97
test eax, eax
pop ecx
je 0x42a3f4
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00416131
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x42a403
or dword [ebp + 0x10], 0x200000
jmp 0x42a447
or dword [ebp + 0x10], 0x40000
jmp 0x42a447
mov eax, dword [0x483fb0]
cmp eax, dword [ebp - 8]
je 0x42a447
push eax
call fcn.0042078a
cmp eax, ebx
pop ecx
je 0x42a447
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x42a447
mov eax, dword [0x483fb4]
cmp eax, dword [ebp - 8]
je 0x42a447
push eax
call fcn.0042078a
cmp eax, ebx
pop ecx
je 0x42a447
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x483fac]
call fcn.0042078a
cmp eax, ebx
pop ecx
je 0x42a467
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42a469
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42c0c0
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 0x64], eax
push esi
push edi
mov dword [ebp - 0x84], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
cmp dword [eax], 0xffffffff
je 0x42c0f2
mov ecx, dword [ebp + 0xc]
cmp dword [ecx], 0xffffffff
jne 0x42c0f9
xor eax, eax
jmp 0x42c19f
push 0x10
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.00415680
add esp, 0xc
push 0x44
push 0
lea eax, [ebp - 0x60]
push eax
call fcn.00415680
add esp, 0xc
mov dword [ebp - 0x60], 0x44
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [ebp - 0x28], eax
mov word [ebp - 0x30], 0
mov ecx, dword [ebp - 0x34]
or ecx, 0x101
mov dword [ebp - 0x34], ecx
mov ecx, 7
mov esi, str.ipconfig__all
lea edi, [ebp - 0x80]
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea ecx, [ebp - 0x80]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42c188
xor eax, eax
jmp 0x42c19f
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
mov ecx, dword [ebp - 0x64]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret 8

Function at 0x42c320
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax + 4], 0
je 0x42c339
mov eax, 1
jmp 0x42c37d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
push str.iphlpapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx + 4], 0
jne 0x42c378
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x1c]
or ecx, 1
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x1c], ecx
xor eax, eax
jmp 0x42c37d
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x42e680
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42e6b1
xor eax, eax
jmp 0x42e866
mov dword [ebp - 8], 0
push 0
push 0
push 0x2000000
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x42e6ef
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x42e866
mov dword [ebp - 0x42c], 0x418
mov byte [ebp - 0x428], 0
push 0x417
push 0
lea edx, [ebp - 0x427]
push edx
call fcn.00415680
add esp, 0xc
mov eax, dword [ebp - 8]
mov dword [ebp - 0x440], eax
lea ecx, [ebp - 0x428]
mov dword [ebp - 0x43c], ecx
mov dword [ebp - 0x438], 0x418
push 0
push 0
lea edx, [ebp - 0x440]
push edx
push 0x42e590
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0
jne 0x42e779
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x42e866
push 0x32
mov edx, dword [ebp - 0x430]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x102
jne 0x42e7cb
push 0
mov eax, dword [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 0x430]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x42e866
mov ecx, dword [ebp - 0x430]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x434], 0
jne 0x42e864
lea ecx, [ebp - 0x428]
mov dword [ebp - 0x444], ecx
mov edx, dword [ebp - 0x444]
movzx eax, word [edx]
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], eax
jbe 0x42e85e
mov edx, dword [ebp - 0x444]
movzx eax, word [edx]
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov edx, dword [ebp - 0x444]
movzx eax, word [edx]
push eax
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.00415c30
add esp, 0xc
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov eax, dword [ebp + 0x10]
mov word [eax + edx*2], 0
mov eax, 1
jmp 0x42e866
xor eax, eax
jmp 0x42e866
xor eax, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x42e880
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0x450
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42e8b4
xor eax, eax
jmp 0x42ea94
mov dword [ebp - 8], 0
push 0
push 0
push 0x2000000
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x42e8f2
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x42ea94
mov dword [ebp - 0x21c], 0
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0x208
lea eax, [ebp - 0x218]
push eax
push 1
mov ecx, dword [ebp - 8]
push ecx
call dword [0x48bd10]
mov dword [ebp - 0x224], eax
lea edx, [ebp - 0x218]
mov dword [ebp - 0x220], edx
cmp dword [ebp - 0x224], 0
jne 0x42e947
mov eax, dword [ebp - 0x220]
movzx ecx, word [eax]
test ecx, ecx
jne 0x42e962
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x42ea94
mov ecx, dword [ebp + 0x14]
shl ecx, 1
movzx ecx, cx
mov edx, dword [ebp - 0x220]
movzx eax, word [edx]
cdq
sub eax, edx
sar eax, 1
cmp ecx, eax
jle 0x42ea7a
mov dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0x220]
movzx eax, word [eax]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x22c], eax
mov ecx, dword [ebp - 0x220]
movzx edx, word [ecx]
push edx
mov eax, dword [ebp - 0x220]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.00415c30
add esp, 0xc
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp + 0x10]
mov word [ecx + eax*2], 0
push 0x104
push 0x5c
mov edx, dword [ebp + 0x10]
push edx
call fcn.00410b10
add esp, 8
add eax, 2
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00414cf4
add esp, 0xc
lea ecx, [ebp - 0x218]
push ecx
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0
je 0x42ea7a
push 1
push 0
push 0
push 4
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
je 0x42ea6d
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x230]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetMappedFileNameW
test eax, eax
jbe 0x42ea60
mov dword [ebp - 0x21c], 1
mov eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x42f6a0
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x424], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
push 0
push 0x100411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42f78c
push 0x104
lea edx, [ebp - 0x418]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
jbe 0x42f782
push 0x104
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x418]
push edx
mov ecx, dword [ebp - 0x424]
add ecx, 4
call fcn.00462ce0
test eax, eax
je 0x42f782
mov ecx, dword [ebp + 8]
add ecx, 0x10
call fcn.00401220
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.004159fc
add esp, 8
test eax, eax
jne 0x42f782
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x420], eax
mov edx, dword [0x4821a0]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x420]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x41c], 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret 4
Function at 0x42fa60
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x468a90
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x254], ecx
mov eax, dword [0x46e024]
mov dword [ebp - 0x224], eax
mov cx, word [0x46e028]
mov word [ebp - 0x220], cx
lea ecx, [ebp - 0x248]
call fcn.00401190
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x228], edx
push 4
push str.___
mov eax, dword [ebp - 0x228]
push eax
call fcn.00416366
add esp, 0xc
test eax, eax
je 0x42fb13
push 4
push 0x46e038
mov ecx, dword [ebp - 0x228]
push ecx
call fcn.00416366
add esp, 0xc
test eax, eax
je 0x42fb13
push 4
push str.._
mov edx, dword [ebp - 0x228]
push edx
call fcn.00416366
add esp, 0xc
test eax, eax
jne 0x42fb22
mov eax, dword [ebp - 0x228]
add eax, 8
mov dword [ebp - 0x228], eax
mov ecx, dword [ebp - 0x228]
mov dx, word [ecx]
mov word [ebp - 0x224], dx
mov dword [ebp - 0x22c], 0
push 0x104
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x224]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x42fbbd
lea edx, [ebp - 0x21c]
push edx
lea ecx, [ebp - 0x248]
call fcn.00403bf0
mov eax, dword [ebp - 0x228]
add eax, 4
push eax
lea ecx, [ebp - 0x248]
call fcn.00403c10
mov ecx, dword [ebp + 0x14]
push ecx
lea ecx, [ebp - 0x248]
call fcn.00402490
push eax
lea ecx, [ebp - 0x248]
call fcn.00401220
push eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x254]
mov ecx, dword [ecx + 0x2e4]
call fcn.00464750
mov dword [ebp - 0x22c], eax
jmp 0x42fbc7
mov dword [ebp - 0x24c], 0
mov edx, dword [ebp - 0x22c]
mov dword [ebp - 0x250], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.00401200
mov eax, dword [ebp - 0x250]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42fe10
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x43c], ecx
mov eax, dword [ebp + 8]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x42fe44
xor eax, eax
jmp 0x42fefe
mov dword [ebp - 0x438], 0
push 0x424
push 0
lea ecx, [ebp - 0x434]
push ecx
call fcn.00415680
add esp, 0xc
mov dword [ebp - 0x438], 0x428
lea edx, [ebp - 0x438]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
jne 0x42fe90
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x42fefe
mov dword [ebp - 8], 1
mov edx, dword [ebp - 0x43c]
cmp dword [edx + 0x2e0], 0
je 0x42feb9
mov eax, dword [ebp - 0x43c]
mov ecx, dword [eax + 0x2e0]
cmp dword [ecx], 0
je 0x42feb9
jmp 0x42feef
push 0
lea edx, [ebp - 0x218]
push edx
mov eax, dword [ebp - 0x424]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x43c]
call fcn.0042fa60
mov dword [ebp - 8], eax
lea edx, [ebp - 0x438]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x42fe97
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret 4
Function at 0x42ff10
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x244], ecx
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x42ff42
xor eax, eax
jmp 0x430065
mov dword [ebp - 0x240], 0
push 0x228
push 0
lea eax, [ebp - 0x23c]
push eax
call fcn.00415680
add esp, 0xc
mov dword [ebp - 0x240], 0x22c
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x42ff91
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x430065
mov dword [ebp - 8], 1
mov ecx, dword [ebp - 0x244]
cmp dword [ecx + 0x2e0], 0
je 0x42ffbd
mov edx, dword [ebp - 0x244]
mov eax, dword [edx + 0x2e0]
cmp dword [eax], 0
je 0x42ffbd
jmp 0x430056
cmp dword [ebp - 0x238], 0
jne 0x42ffc8
jmp 0x43003e
mov ecx, dword [ebp - 0x238]
push ecx
mov ecx, dword [ebp - 0x244]
call fcn.0042fe10
test eax, eax
je 0x42fff0
cmp dword [ebp - 8], 0
je 0x42fff0
mov dword [ebp - 0x248], 1
jmp 0x42fffa
mov dword [ebp - 0x248], 0
mov edx, dword [ebp - 0x248]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x238]
push eax
mov ecx, dword [ebp - 0x244]
call fcn.0042fc10
test eax, eax
je 0x43002b
cmp dword [ebp - 8], 0
je 0x43002b
mov dword [ebp - 0x24c], 1
jmp 0x430035
mov dword [ebp - 0x24c], 0
mov ecx, dword [ebp - 0x24c]
mov dword [ebp - 8], ecx
lea edx, [ebp - 0x240]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x42ff98
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x430110
Capabilities:
Query environment variable
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
mov ecx, 0xf
mov esi, str.TencentLogsCrashMd5File.txt
lea edi, [ebp - 0x50]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x104
lea eax, [ebp - 0x260]
push eax
push str.appdata
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x430156
jmp 0x430259
push 0x1f
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x260]
push edx
call fcn.00419164
add esp, 0xc
push 0x46e0e0
lea eax, [ebp - 0x260]
push eax
call fcn.00414e0d
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x43018d
jmp 0x430259
push 2
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00416cbe
add esp, 0xc
mov edx, dword [ebp - 0xc]
push edx
call fcn.00419339
add esp, 4
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jne 0x4301d7
mov byte [ebp - 0x264], 0xff
mov byte [ebp - 0x263], 0xfe
mov eax, dword [ebp - 0xc]
push eax
push 1
push 2
lea ecx, [ebp - 0x264]
push ecx
call fcn.004150b3
add esp, 0x10
push 0x800
call fcn.004141a6
add esp, 4
mov dword [ebp - 0x268], eax
mov edx, dword [ebp - 0x268]
mov dword [ebp - 8], edx
push 0x800
push 0
mov eax, dword [ebp - 8]
push eax
call fcn.00415680
add esp, 0xc
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x400
mov ecx, dword [ebp - 8]
push ecx
call fcn.00419042
add esp, 0x10
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.004193a7
add esp, 8
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00414e92
add esp, 4
mov edx, dword [ebp - 8]
mov dword [ebp - 0x26c], edx
mov eax, dword [ebp - 0x26c]
push eax
call fcn.00416122
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x4324f0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x482dc0], 0
jne 0x432504
mov eax, dword [0x482dbc]
jmp 0x432541
mov dword [0x482dc0], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43253c
push str._DisableMemPool
mov eax, dword [ebp - 4]
push eax
call fcn.00416647
add esp, 8
test eax, eax
je 0x43253c
mov dword [0x482dbc], 0
mov eax, dword [0x482dbc]
mov esp, ebp
pop ebp
ret

Function at 0x433100
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0
lea ecx, [ebp - 8]
push ecx
push 0x47a78c
push 1
push 0
push 0x47a77c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x433149
jmp 0x43317d
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ecx + 0x1c]
call eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x433168
jmp 0x43317d
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [eax + 0x1c]
call edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x433191
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ecx + 8]
call eax
cmp dword [ebp - 8], 0
je 0x4331a5
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [edx + 8]
call ecx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret