joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b340
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c591d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4ff140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x14]
push eax
call fcn.0046b850
add esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x46ad40
mov ecx, dword [ebp - 0x10]
add ecx, 4
push ecx
push 0
lea ecx, [ebp - 0x14]
call fcn.00416e80
push eax
mov edx, dword [ebp - 0x18]
push edx
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0
je 0x46b3c9
lea ecx, [ebp - 0x14]
call fcn.00470ef0
nop
jmp 0x46b3db
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0
push 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0046c830
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x46b400
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c591d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4ff140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x14]
push eax
call fcn.0046b850
add esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x46adf0
mov ecx, dword [ebp - 0x10]
add ecx, 4
push ecx
push 0
lea ecx, [ebp - 0x14]
call fcn.00416e80
push eax
mov edx, dword [ebp - 0x18]
push edx
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0
je 0x46b489
lea ecx, [ebp - 0x14]
call fcn.00470ef0
nop
jmp 0x46b49b
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0
push 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0046c830
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46dfc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c5f7d
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4ff140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
push 0x4e92a8
push 0
lea ecx, [ebp + 8]
call fcn.00409910
push 0x3c
push 0
lea eax, [ebp - 0x54]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x54], 0x3c
mov dword [ebp - 0x50], 0x40
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], str.cmd.exe
lea ecx, [ebp + 8]
call fcn.004065a0
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x54]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x46e077
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00406760
mov eax, dword [ebp - 0x10]
jmp 0x46e0b4
push 0xffffffffffffffff
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00406760
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x46e0d0
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c4ecd
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x4ff140]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
push eax
push str.___output
lea ecx, [ebp + 8]
push ecx
push str.curl.exe___url
lea edx, [ebp - 0x58]
push edx
call fcn.00407a60
add esp, 0xc
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x60]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.00407b90
add esp, 0xc
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x68], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x68]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.00407be0
add esp, 0xc
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x40]
call fcn.00406760
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x58]
call fcn.00406760
nop
lea ecx, [ebp - 0x28]
call fcn.004065a0
mov dword [ebp - 0x6c], eax
push str._echo_off
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
mov eax, dword [ebp - 0x6c]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00406760
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00406760
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x20]
call fcn.00406760
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c170f
mov esp, ebp
pop ebp
ret
Function at 0x46e220
Capabilities:
Open clipboard
Read clipboard data
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c5fbe
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x4ff140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x46e268
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x46e282
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x46e29e
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00406800
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x18]
or edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x46e4c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c601d
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4ff140]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.004701f0
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x18], 0xf9
mov byte [ebp - 0x17], 0xff
mov byte [ebp - 0x16], 0x5f
mov byte [ebp - 0x15], 0x5e
mov byte [ebp - 0x14], 0x5b
mov byte [ebp - 0x13], 0xc3
mov byte [ebp - 0x12], 0xe9
lea ecx, [ebp - 0x3c]
call fcn.00426870
mov dword [ebp - 4], 0
mov byte [ebp - 0x1c], 0xc2
mov byte [ebp - 0x1b], 8
mov byte [ebp - 0x1a], 0
push 0xfffffff
push 0
lea ecx, [ebp - 0x3c]
push ecx
push 7
lea edx, [ebp - 0x18]
push edx
call fcn.004711f0
add esp, 0x14
lea ecx, [ebp - 0x3c]
call fcn.004299f0
test eax, eax
je 0x46e5db
push 0
lea ecx, [ebp - 0x3c]
call fcn.00426e10
mov eax, dword [eax]
add eax, 6
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x2c]
push ecx
push 0x40
push 3
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 3
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
mov ecx, dword [ebp - 0x2c]
push ecx
push 3
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00478840
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
push ecx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00426c80
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c170f
mov esp, ebp
pop ebp
ret

Function at 0x46e610
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
push str.ConsoleWindowClass
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
mov esp, ebp
pop ebp
ret
Function at 0x46f610
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c61d5
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4ff140]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
push 0x4e8f40
lea ecx, [ebp - 0x28]
push ecx
call fcn.00407a60
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.004065a0
mov dword [ebp - 0x2c], eax
push 0
push 0
mov edx, dword [ebp - 0x2c]
push edx
push 0x4e8f44
push 0x4e8f4c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00406760
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00406760
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c170f
mov esp, ebp
pop ebp
ret

Function at 0x46fe00
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x4ff140]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x144], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 0x13c]
push ecx
call sub.KERNEL32.dll_Process32First
nop
lea edx, [ebp - 0x12c]
push edx
mov eax, dword [ebp - 0x13c]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x46ff2e
mov dword [ebp - 0x138], 0x4e8e6c
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x134], ecx
mov edx, dword [ebp - 0x134]
mov al, byte [edx]
mov byte [ebp - 0x12d], al
mov ecx, dword [ebp - 0x138]
cmp al, byte [ecx]
jne 0x46fee3
cmp byte [ebp - 0x12d], 0
je 0x46fed7
mov edx, dword [ebp - 0x134]
mov al, byte [edx + 1]
mov byte [ebp - 0x12e], al
mov ecx, dword [ebp - 0x138]
cmp al, byte [ecx + 1]
jne 0x46fee3
add dword [ebp - 0x134], 2
add dword [ebp - 0x138], 2
cmp byte [ebp - 0x12e], 0
jne 0x46fe85
mov dword [ebp - 0x140], 0
jmp 0x46feee
sbb edx, edx
or edx, 1
mov dword [ebp - 0x140], edx
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jne 0x46ff29
mov ecx, dword [ebp - 0x118]
cmp ecx, dword [ebp - 0x144]
jle 0x46ff29
mov edx, dword [ebp - 0x118]
mov dword [ebp - 0x144], edx
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x148], eax
jmp 0x46fe54
mov eax, dword [ebp - 0x148]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c170f
mov esp, ebp
pop ebp
ret
Function at 0x46ff50
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x4ff140]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x144], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 0x13c]
push ecx
call sub.KERNEL32.dll_Process32First
nop
lea edx, [ebp - 0x12c]
push edx
mov eax, dword [ebp - 0x13c]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x47007e
mov dword [ebp - 0x138], 0x4e8e54
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x134], ecx
mov edx, dword [ebp - 0x134]
mov al, byte [edx]
mov byte [ebp - 0x12d], al
mov ecx, dword [ebp - 0x138]
cmp al, byte [ecx]
jne 0x470033
cmp byte [ebp - 0x12d], 0
je 0x470027
mov edx, dword [ebp - 0x134]
mov al, byte [edx + 1]
mov byte [ebp - 0x12e], al
mov ecx, dword [ebp - 0x138]
cmp al, byte [ecx + 1]
jne 0x470033
add dword [ebp - 0x134], 2
add dword [ebp - 0x138], 2
cmp byte [ebp - 0x12e], 0
jne 0x46ffd5
mov dword [ebp - 0x140], 0
jmp 0x47003e
sbb edx, edx
or edx, 1
mov dword [ebp - 0x140], edx
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jne 0x470079
mov ecx, dword [ebp - 0x118]
cmp ecx, dword [ebp - 0x144]
jle 0x470079
mov edx, dword [ebp - 0x118]
mov dword [ebp - 0x144], edx
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x148], eax
jmp 0x46ffa4
mov eax, dword [ebp - 0x148]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c170f
mov esp, ebp
pop ebp
ret

Function at 0x4700a0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x4ff140]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x144], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 0x13c]
push ecx
call sub.KERNEL32.dll_Process32First
nop
lea edx, [ebp - 0x12c]
push edx
mov eax, dword [ebp - 0x13c]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4701ce
mov dword [ebp - 0x138], 0x4e8e38
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x134], ecx
mov edx, dword [ebp - 0x134]
mov al, byte [edx]
mov byte [ebp - 0x12d], al
mov ecx, dword [ebp - 0x138]
cmp al, byte [ecx]
jne 0x470183
cmp byte [ebp - 0x12d], 0
je 0x470177
mov edx, dword [ebp - 0x134]
mov al, byte [edx + 1]
mov byte [ebp - 0x12e], al
mov ecx, dword [ebp - 0x138]
cmp al, byte [ecx + 1]
jne 0x470183
add dword [ebp - 0x134], 2
add dword [ebp - 0x138], 2
cmp byte [ebp - 0x12e], 0
jne 0x470125
mov dword [ebp - 0x140], 0
jmp 0x47018e
sbb edx, edx
or edx, 1
mov dword [ebp - 0x140], edx
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jne 0x4701c9
mov ecx, dword [ebp - 0x118]
cmp ecx, dword [ebp - 0x144]
jle 0x4701c9
mov edx, dword [ebp - 0x118]
mov dword [ebp - 0x144], edx
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x148], eax
jmp 0x4700f4
mov eax, dword [ebp - 0x148]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c170f
mov esp, ebp
pop ebp
ret
Function at 0x470a90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c5f7d
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4ff140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
push 0x4e4238
push 0
lea ecx, [ebp + 8]
call fcn.00409910
push 0x3c
push 0
lea eax, [ebp - 0x54]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x54], 0x3c
mov dword [ebp - 0x50], 0x40
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0x4e423c
lea ecx, [ebp + 8]
call fcn.004065a0
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x54]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x470b47
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00406760
mov eax, dword [ebp - 0x10]
jmp 0x470b84
push 0xffffffffffffffff
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00406760
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x478520
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
mov eax, dword [0x4ff140]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x154], 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x168], eax
lea eax, [ebp - 0x154]
push eax
mov ecx, dword [ebp - 0x168]
push ecx
call sub.KERNEL32.dll_Process32First
cmp eax, 1
jne 0x478692
lea edx, [ebp - 0x154]
push edx
mov eax, dword [ebp - 0x168]
push eax
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
jne 0x478692
mov dword [ebp - 0x160], str.aow_exe.exe
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x15c], ecx
mov edx, dword [ebp - 0x15c]
mov al, byte [edx]
mov byte [ebp - 0x155], al
mov ecx, dword [ebp - 0x160]
cmp al, byte [ecx]
jne 0x478602
cmp byte [ebp - 0x155], 0
je 0x4785f6
mov edx, dword [ebp - 0x15c]
mov al, byte [edx + 1]
mov byte [ebp - 0x156], al
mov ecx, dword [ebp - 0x160]
cmp al, byte [ecx + 1]
jne 0x478602
add dword [ebp - 0x15c], 2
add dword [ebp - 0x160], 2
cmp byte [ebp - 0x156], 0
jne 0x4785a4
mov dword [ebp - 0x16c], 0
jmp 0x47860d
sbb edx, edx
or edx, 1
mov dword [ebp - 0x16c], edx
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0
jne 0x47868d
mov ecx, dword [ebp - 0x14c]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0
jne 0x47864a
jmp 0x478572
push 0x28
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x164]
push eax
call sub.KERNEL32.dll_K32GetProcessMemoryInfo
test eax, eax
je 0x47867f
cmp dword [ebp - 0x20], 0x11e1a300
jbe 0x47867f
mov ecx, dword [ebp - 0x14c]
mov dword [ebp - 0x170], ecx
mov eax, dword [ebp - 0x170]
jmp 0x4786a0
mov edx, dword [ebp - 0x164]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x478572
mov eax, dword [ebp - 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c170f
mov esp, ebp
pop ebp
ret
Function at 0x4786b0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
mov eax, dword [0x4ff140]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x154], 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x168], eax
lea eax, [ebp - 0x154]
push eax
mov ecx, dword [ebp - 0x168]
push ecx
call sub.KERNEL32.dll_Process32First
cmp eax, 1
jne 0x478822
lea edx, [ebp - 0x154]
push edx
mov eax, dword [ebp - 0x168]
push eax
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
jne 0x478822
mov dword [ebp - 0x160], str.AndroidProcess.exe
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x15c], ecx
mov edx, dword [ebp - 0x15c]
mov al, byte [edx]
mov byte [ebp - 0x155], al
mov ecx, dword [ebp - 0x160]
cmp al, byte [ecx]
jne 0x478792
cmp byte [ebp - 0x155], 0
je 0x478786
mov edx, dword [ebp - 0x15c]
mov al, byte [edx + 1]
mov byte [ebp - 0x156], al
mov ecx, dword [ebp - 0x160]
cmp al, byte [ecx + 1]
jne 0x478792
add dword [ebp - 0x15c], 2
add dword [ebp - 0x160], 2
cmp byte [ebp - 0x156], 0
jne 0x478734
mov dword [ebp - 0x16c], 0
jmp 0x47879d
sbb edx, edx
or edx, 1
mov dword [ebp - 0x16c], edx
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0
jne 0x47881d
mov ecx, dword [ebp - 0x14c]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0
jne 0x4787da
jmp 0x478702
push 0x28
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x164]
push eax
call sub.KERNEL32.dll_K32GetProcessMemoryInfo
test eax, eax
je 0x47880f
cmp dword [ebp - 0x20], 0x11e1a300
jbe 0x47880f
mov ecx, dword [ebp - 0x14c]
mov dword [ebp - 0x170], ecx
mov eax, dword [ebp - 0x170]
jmp 0x478830
mov edx, dword [ebp - 0x164]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x478702
mov eax, dword [ebp - 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c170f
mov esp, ebp
pop ebp
ret
Function at 0x481810
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
sub esp, 0x18
mov eax, dword [0x4ff140]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
test esi, esi
je 0x4818db
lea eax, [esp + 4]
push eax
push esi
push 2
call fcn.0049ca10
add esp, 0xc
test eax, eax
jne 0x4818db
lea eax, [esp + 8]
push eax
push esi
push 0x17
call fcn.0049ca10
add esp, 0xc
test eax, eax
jne 0x4818db
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x481864
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.0049c9e0
add esp, 0xc
test eax, eax
je 0x481898
sub eax, esi
push eax
push 0x2e
push esi
call fcn.0049c9e0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x48189a
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x4818c6
mov al, byte [esi]
push eax
call fcn.0048fbe0
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x4818a8
pop edi
movzx eax, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004c170f
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
xor eax, eax
pop esi
xor ecx, esp
call fcn.004c170f
add esp, 0x18
ret