joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1021de43
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [0x10238198], 0x61d
mov dword [ebp - 4], 0
mov dword [0x10238194], 0x12
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x10238194], 0x1675
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
jne 0x1021dec2
mov eax, dword [ebp - 0x18]
mov dword [0x10238194], 0x1eae
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x1c], eax
je 0x1021dedb
jmp 0x1021df5b
mov eax, dword [ebp - 0x14]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], eax
jl 0x1021de8b
jmp 0x1021dea1
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
mov dx, word [eax + ecx*2 - 0x18]
mov word [ebp - 0x1e], dx
mov ax, word [ebp - 0x1e]
cmp ax, 0x6f
jne 0x1021df5b
mov dword [0x10238194], 0xfffffa07
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x1021df5b
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x1021df5b
mov dword [0x10238194], 0x2aa
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x1021df5b
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x1021df5b
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x24], eax
je 0x1021df6a
xor eax, eax
mov dword [0x10238194], 0x159c
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
add esp, 0x24
pop ebp
ret
Function at 0x1021dfe7
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, dword [0x10238198]
add esi, 0xffffea9b
mov dword [0x10238198], esi
mov dword [0x102381a0], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
xor eax, eax
mov byte [0x102381a4], 0
mov ecx, dword [0x10238194]
add ecx, 0x207
mov dword [0x10238194], ecx
mov dword [0x1023819c], 0
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], eax
jmp 0x1021e079
mov dword [0x10238194], 0x2054
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x10238198]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
jmp 0x1021e079
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov edx, eax
mov bl, dl
add ecx, 0xffffdc66
mov dword [0x10238198], ecx
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], bl
mov eax, dword [0x1023819c]
add eax, 1
mov dword [0x1023819c], eax
cmp eax, 0x100
mov dword [ebp - 0x2c], eax
jl 0x1021e063
xor eax, eax
mov dword [0x10238198], 0x440
mov dword [0x1023819c], 0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov ecx, 0x100
mov dword [0x102381a8], 0
mov edx, dword [0x102381a0]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x34], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x102381a8], edi
mov edx, dword [0x10238194]
add edx, 0xffffed32
mov dword [0x10238194], edx
mov eax, edi
cdq
idiv ecx
mov dword [0x102381a0], edx
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x34]
mov cl, byte [ecx + edi]
mov byte [0x102381a4], cl
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov ecx, dword [0x10238198]
add ecx, 0xfffffe0d
mov dword [0x10238198], ecx
mov ecx, dword [0x10238194]
add ecx, 0x1e4f
mov dword [0x10238194], ecx
mov cl, byte [0x102381a4]
mov edx, dword [0x102381a0]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov edx, dword [0x1023819c]
add edx, 1
mov dword [0x1023819c], edx
cmp edx, 0x100
mov dword [ebp - 0x30], edx
jl 0x1021e0c7
jmp 0x1021e051
Function at 0x1021e51a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov esi, esp
xor eax, eax
mov dword [esi + 0x2c], eax
call fcn.1021e2cd
mov ecx, 0x10
mov dword [esi + 0x28], eax
mov eax, ecx
call fcn.1021cd90
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov ecx, dword [esi + 0x28]
cmp ecx, 0
mov edx, dword [esi + 0x2c]
mov dword [esi + 0x24], eax
mov dword [esi + 0x20], edx
je 0x1021e58b
mov eax, dword [esi + 0x20]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax + 0x3c]
mov dword [esi + 0x18], ecx
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
cmp dword [eax + ecx], 0x4550
je 0x1021e626
jmp 0x1021e696
lea eax, [esi + 0x30]
sub esp, 4
mov ecx, dword [esi + 0x24]
mov dword [esp], ecx
mov dword [esi + 0x14], eax
call fcn.1021e740
add esp, 4
mov dword [esi + 0x10], eax
call fcn.1021de43
xor ecx, ecx
cmp eax, 0
mov dword [esi + 0xc], ecx
jne 0x1021e6b9
mov eax, 0x14e3
lea ecx, [0x1021e4a1]
mov edx, dword [esi + 0x24]
mov edi, dword [edx]
mov dword [esi + 0x84], edi
mov dword [esi + 0x44], 0x111800
mov edi, dword [0x10238180]
mov dword [esi + 0x80], edi
mov edi, dword [0x10238184]
mov dword [esi + 0x3c], edi
mov edi, dword [0x10238188]
mov dword [esi + 0x8c], edi
mov edi, dword [0x1023818c]
mov dword [esi + 0x54], edi
mov edi, dword [0x10238190]
mov dword [esi + 0x60], edi
mov dword [0x10238194], 0x14e3
mov dword [0x10238198], 0x1a56
mov dword [esi + 8], eax
mov dword [esi + 4], ecx
jmp 0x1021e680
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x74], eax
lea eax, [esi + 0x30]
mov dword [0x10238194], 0xa5a
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x18]
mov edi, dword [ecx + edx + 0x50]
mov dword [esi + 0x5c], edi
mov dword [0x10238198], 0x1c0
mov edi, dword [esi + 0x24]
mov ebx, dword [edi + 8]
push ebx
push eax
call fcn.1021da2c
add esp, 8
sub esp, 4
mov ecx, esp
lea edx, [esi + 0x30]
mov dword [ecx], edx
call eax
mov eax, 1
mov dword [0x10238194], 0x20b1
mov dword [esi + 0xc], eax
jmp 0x1021e6b9
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
cmp word [eax], 0x5a4d
mov dword [esi + 0x1c], eax
mov dword [esi], ecx
je 0x1021e56a
mov eax, dword [esi]
add eax, 0xfffff29e
mov ecx, dword [esi + 0x1c]
add ecx, 0xfffff000
and ecx, 0xfffff000
mov dword [0x10238194], eax
mov dword [esi + 8], eax
mov dword [esi + 4], ecx
jmp 0x1021e680
mov eax, dword [esi + 0xc]
mov dword [esi + 0x20], eax
jmp 0x1021e55f
Function at 0x1021e740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x168
mov eax, dword [ebp + 8]
mov dword [0x10238194], 0x239d
mov dword [ebp - 0x130], eax
xor eax, eax
mov ecx, eax
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x138], eax
jmp 0x1021e771
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x134]
lea edx, section..data
imul esi, eax, 0xe0
mov edi, edx
add edi, esi
add edi, 0x98
mov esi, dword [edi]
imul edi, eax, 0xe0
add edx, edi
add edx, 0x94
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
cmp eax, 0x194
mov ecx, edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x138], eax
jne 0x1021e771
lea eax, [0x1022181b]
mov ecx, 0xe
lea edx, [ebp - 0x12c]
mov dword [0x10238194], 0xffeabac9
mov dword [0x10238198], 0x725
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x144], ecx
call fcn.1021edd4
mov dword [0x10238198], 0x295
mov dword [0x10238194], 0x18f0
call fcn.1021f14b
mov dword [esp], eax
mov eax, dword [ebp - 0x140]
mov dword [esp + 4], eax
call fcn.1021efb5
mov ecx, eax
mov dword [0x102381b4], eax
mov eax, esp
mov edx, dword [ebp - 0x13c]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, ecx
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], ecx
mov eax, dword [ebp - 0x150]
mov ecx, dword [ebp - 0x14c]
lea edx, section..data
imul esi, eax, 0xe0
mov edi, edx
add edi, esi
add edi, 0x98
mov esi, dword [edi]
imul edi, eax, 0xe0
mov ebx, edx
add ebx, edi
add ebx, 0x90
mov edi, dword [ebx]
imul ebx, eax, 0xe0
add edx, ebx
add edx, 0x94
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x148]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x15c], edx
call fcn.1021ddc1
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x158]
add eax, ecx
mov edx, dword [ebp - 0x154]
add edx, 1
cmp edx, 0x194
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x150], edx
jne 0x1021e87b
lea eax, [0x10221829]
mov ecx, 0x20
lea edx, [ebp - 0x10c]
mov dword [0x10238194], 0x5de
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x20
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x164], ecx
call fcn.1021dfe7
mov dword [0x10238194], 0x5ee
mov dword [0x10238198], 0xffffe27e
mov eax, dword [ebp - 0x160]
mov dword [esp], eax
mov ecx, dword [ebp - 0x148]
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edx, dword [ebp - 0x13c]
mov dword [esp + 0xc], edx
call fcn.1021db7f
xor eax, eax
mov ecx, dword [ebp - 0x148]
add ecx, 0x112938
mov edx, dword [ebp - 0x130]
mov dword [edx], ecx
mov dword [edx + 4], 0x111800
mov ecx, dword [ebp - 0x148]
add ecx, 0xe7fdb
mov dword [edx + 8], ecx
mov dword [0x10238198], 0x2640
mov dword [edx + 0xc], 0x1f40
mov dword [0x10238194], 0x2587
add esp, 0x168
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4bba6f
Capabilities:
Encode data using xor

Disassembly:
mov ebx, dword [esp + 4]
jmp 0x4bbaf0
lea ecx, [eax*4]
lea ecx, [ecx + ebx]
pushfd
mov ecx, dword [esp + 0x24]
lea esp, [esp + 0x28]
jmp 0x49fcce

Function at 0x4c8f8a
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x4c8f60
mov edx, eax
bsf cx, di
js 0x4c8fad
rdtsc
jmp 0x4c8faf
rdtsc
jmp 0x4c8fee
jmp 0x4c9012
lea ecx, reloc.MSVCRT.dll_strncpy
btr ax, dx
jnp 0x4c8ffc
lea eax, [ebx + ebp]
call fcn.004c90fe
sti
insb byte es:[edi], dx
loop 0x4c8f6c
je 0x4c8faf
stc
fdivr dword [ebx]
adc cl, byte [ebp - 0x9fd117d]
aad 0xf
xor dword [edi], ecx
mov bl, 0xc1
sub esi, 2
not ch
rdtsc
btr ecx, eax
jae 0x4c8fcd
jb 0x4c8fcd
lea eax, [ebx + ebp]
call fcn.004c9028
or bl, byte [esi + 0x67a66b0c]
js 0x4c8fff
arpl word [esi], ax
cmc
inc eax
jbe 0x4c9073
mov dl, byte [edi - 1]
setae cl
mov ecx, 0x17d9ec2d
lea eax, [eax + ecx]
lea eax, [ecx + ebp]
mov ch, byte [esp]
jmp 0x4c8fcf
xchg bh, bh
je 0x4c909b
add dword [edi], ecx
lea ecx, [eax - 1]
invalid
add al, 0x24
mov eax, dword [esp]
xchg dword [esp], ecx
mov ch, byte [esp]
mov cx, 0xf368
sub eax, esi
jmp 0x4c9084

Function at 0x55607a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], bh
neg ebp
xchg word [esp], bp
pop ax
and esi, edx
stc
jmp 0x5560ee
xchg ecx, ebp
lea esp, [esp + 3]
jmp 0x55605a
std
or ch, 0x66
lea ecx, [esi*4]
btc eax, edi
jmp 0x5560c2
mov dh, bl
pop edi
rdtsc
mov cl, byte [esp]
lea ebp, [esi*4]
cpuid
jmp 0x556082
mov bh, 0x84
cld
mov al, 0x51
pushfd
mov edi, edx
mov ecx, esi
jmp 0x556098
sub esp, 0x1a
xchg word [esp], di
bt ax, bp
inc bh
add esp, 0x13
ror edx, 4
jmp 0x556114
mov ch, ah
lea eax, [edi - 0x79]
sub si, di
clc
xchg dl, ch
mov ax, bp
jmp 0x5560b6

Function at 0x5563a6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, 0x1061
mov cx, sp
jmp 0x5563e6
inc edi
mov ax, word [esp + 5]
lea ebp, [ebp - 0x16]
ror ch, 4
neg ah
pop dword [esp]
jmp 0x5563d0
Function at 0x401596
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4015fa
cmp dword [ebp + 0xc], 1
je 0x4015d2
cmp dword [ebp + 0xc], 2
je 0x4015d2
push 0xd
pop eax
jmp 0x4015fa
mov eax, dword [ebp - 4]
test edi, edi
je 0x4015f4
test eax, eax
je 0x4015ef
test al, 1
jne 0x4015cd
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x4015f4
jmp 0x4015cd
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8

Function at 0x4015fe
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8
Function at 0x401ce7
Capabilities:
Create process on windows

Disassembly:
push 0x74
mov eax, 0x4c00ce
call fcn.0049f542
mov esi, str.CSystemCommands::OpenProgram__path
push esi
lea ecx, [ebp - 0x28]
call fcn.00404bd0
push dword [ebp + 8]
lea eax, [ebp - 0x28]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.00401985
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
xor ebx, ebx
push edi
inc ebx
push ebx
lea ecx, [ebp - 0x28]
call fcn.004058b3
push str.CSystemCommands::OpenProgram__params
lea ecx, [ebp - 0x28]
call fcn.00404bd0
push dword [ebp + 0xc]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 4], ebx
call fcn.00401985
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push edi
push ebx
lea ecx, [ebp - 0x28]
call fcn.004058b3
push str.CSystemCommands::OpenProgram__timeout
lea ecx, [ebp - 0x28]
call fcn.00404bd0
push dword [ebp + 0x10]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 4], 2
call fcn.004018c5
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push edi
push ebx
lea ecx, [ebp - 0x28]
call fcn.004058b3
push esi
lea ecx, [ebp - 0x28]
call fcn.00404bd0
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x28]
push esi
push eax
mov dword [ebp - 4], 3
call fcn.00401985
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push edi
push ebx
lea ecx, [ebp - 0x28]
call fcn.004058b3
push 0x38
lea eax, [ebp - 0x7c]
push edi
push eax
mov dword [ebp - 0x80], 0x3c
call fcn.0049f650
mov eax, dword [ebp + 0x14]
add esp, 0xc
cmp dword [eax + 0x18], 8
mov dword [ebp - 0x7c], 0x140
jb 0x401dd9
mov eax, dword [eax + 4]
jmp 0x401ddc
add eax, 4
cmp dword [esi + 0x18], 8
mov dword [ebp - 0x74], eax
jb 0x401ded
mov eax, dword [esi + 4]
mov dword [ebp - 0x70], eax
jmp 0x401df3
add esi, 4
mov dword [ebp - 0x70], esi
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x18], 8
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x64], ebx
jb 0x401e07
mov eax, dword [eax + 4]
jmp 0x401e0a
add eax, 4
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x401e85
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.CSystemCommands::OpenProgram__error
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.00404bd0
lea eax, [ebp - 0x28]
push esi
push eax
mov dword [ebp - 4], 4
call fcn.004018c5
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push edi
push ebx
lea ecx, [ebp - 0x28]
call fcn.004058b3
cmp esi, 0x4c7
jne 0x401e81
push str.CSystemCommands::OpenProgram__user_refused_elevation.
lea ecx, [ebp - 0x44]
call fcn.00404bd0
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 4], 5
call fcn.004017f5
pop ecx
push edi
push ebx
lea ecx, [ebp - 0x44]
call fcn.004058b3
xor al, al
jmp 0x401e98
cmp dword [ebp + 0x10], edi
je 0x401e96
push dword [ebp + 0x10]
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov al, bl
call fcn.0049f61a
ret
Function at 0x402359
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x144
mov eax, dword [0x50e7dc]
xor eax, ebp
mov dword [ebp + 0x74], eax
push edi
push 9
pop ecx
xor eax, eax
push 0x11c
lea edi, [ebp - 0xcc]
push eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xa8]
push eax
call fcn.0049f650
add esp, 0xc
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0xa8], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
pop edi
test eax, eax
je 0x402491
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4023d7
lea ecx, [ebp - 0xcc]
push ecx
call eax
jmp 0x4023e4
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 2
pop ecx
cmp dword [ebp - 0x98], ecx
jne 0x402491
cmp dword [ebp - 0xa4], 4
jbe 0x402491
cmp dword [ebp - 0xa4], 6
jne 0x40244b
xor eax, eax
cmp dword [ebp - 0xa0], eax
jne 0x40241e
cmp byte [ebp + 0x72], 1
setne al
add eax, ecx
jmp 0x402493
inc eax
cmp dword [ebp - 0xa0], eax
jne 0x402436
xor ecx, ecx
cmp byte [ebp + 0x72], al
sete cl
add ecx, 4
mov eax, ecx
jmp 0x402493
cmp dword [ebp - 0xa0], ecx
jne 0x402491
xor ecx, ecx
cmp byte [ebp + 0x72], al
sete cl
add ecx, 6
jmp 0x402432
cmp dword [ebp - 0xa4], 5
jne 0x402491
cmp dword [ebp - 0xa0], ecx
jne 0x402491
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x40246d
xor eax, eax
inc eax
jmp 0x402493
test dword [ebp + 0x70], 0x2000
jne 0x402468
xor eax, eax
inc eax
test dword [ebp + 0x70], 0x8000
jne 0x402493
cmp byte [ebp + 0x72], al
jne 0x402493
cmp word [ebp - 0xcc], 9
jne 0x402493
xor eax, eax
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
call fcn.0049f533
add ebp, 0x78
leave
ret
Function at 0x402cce
Capabilities:
Enumerate processes

Disassembly:
push 0x278
mov eax, 0x4beb65
call fcn.0049f5ab
mov esi, ecx
push str.CSystemCommands::Wait4AllProcesses__start.
lea ecx, [ebp - 0x268]
mov dword [ebp - 0x24c], esi
call fcn.00404bd0
lea eax, [ebp - 0x268]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004017f5
or dword [ebp - 4], 0xffffffff
pop ecx
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0x268]
call fcn.004058b3
cmp esi, ebx
je 0x402e85
mov ecx, 0x4d51f0
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402d50
cmp dx, bx
je 0x402d4c
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402d50
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x402d2a
xor eax, eax
jmp 0x402d55
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x402e85
push ebx
call fcn.004a02ed
mov esi, eax
mov eax, dword [ebp + 8]
mov edi, edx
cdq
add esi, eax
pop ecx
adc edi, edx
push ebx
push 2
mov byte [ebp - 0x241], bl
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x228
mov dword [ebp - 0x248], eax
lea eax, [ebp - 0x23c]
push ebx
push eax
call fcn.0049f650
add esp, 0xc
lea eax, [ebp - 0x240]
push eax
push dword [ebp - 0x248]
mov dword [ebp - 0x240], 0x22c
call sub.KERNEL32.dll_Process32FirstW
push dword [ebp - 0x24c]
lea eax, [ebp - 0x21c]
push eax
call fcn.004a1037
pop ecx
pop ecx
test eax, eax
je 0x402de5
lea eax, [ebp - 0x240]
push eax
push dword [ebp - 0x248]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x402db5
jmp 0x402dec
mov byte [ebp - 0x241], 1
push ebx
call fcn.004a02ed
cmp dword [ebp + 8], ebx
pop ecx
jl 0x402e02
cmp edx, edi
jg 0x402e17
jl 0x402e02
cmp eax, esi
jae 0x402e17
cmp byte [ebp - 0x241], bl
je 0x402e4e
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402d70
push str.CSystemCommands::Wait4AllProcesses__EXIT_ONTIMEOUT.
lea ecx, [ebp - 0x268]
call fcn.00404bd0
lea eax, [ebp - 0x268]
push eax
mov dword [ebp - 4], 2
call fcn.004017f5
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x268]
call fcn.004058b3
xor eax, eax
inc eax
jmp 0x402eb4
push str.CSystemCommands::Wait4AllProcesses__EXIT_ALLPROCCESS_ENDED.
lea ecx, [ebp - 0x284]
call fcn.00404bd0
lea eax, [ebp - 0x284]
push eax
mov dword [ebp - 4], 3
call fcn.004017f5
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x284]
call fcn.004058b3
push 2
pop eax
jmp 0x402eb4
push str.CSystemCommands::Wait4AllProcesses__not_valid_process_name.
lea ecx, [ebp - 0x268]
call fcn.00404bd0
lea eax, [ebp - 0x268]
push eax
mov dword [ebp - 4], edi
call fcn.004017f5
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x268]
call fcn.004058b3
xor eax, eax
call fcn.0049f62e
ret
Function at 0x4031ad
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x50e7dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp edi, ebx
je 0x403269
mov ecx, 0x4d51f0
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4031fc
cmp dx, bx
je 0x4031f8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4031fc
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x4031d6
xor eax, eax
jmp 0x403201
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x403269
push esi
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x228
mov esi, eax
lea eax, [ebp - 0x22c]
push ebx
push eax
call fcn.0049f650
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
push esi
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_Process32FirstW
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.004a1037
pop ecx
pop ecx
test eax, eax
je 0x403262
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40323c
jmp 0x403264
mov bl, 1
mov al, bl
pop esi
jmp 0x40326b
xor al, al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0049f533
leave
ret

Function at 0x403765
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c46f5
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x50e7dc]
xor eax, esp
mov dword [esp + 0x48], eax
push edi
mov eax, dword [0x50e7dc]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
lea ecx, [esp + 0x28]
call fcn.0040857f
and dword [esp + 0x60], 0
lea ecx, [esp + 0x28]
call fcn.0040f462
test eax, eax
jne 0x4037e2
push str.CSystemCommands::CloseAllIEWindows___NOT_host_Browser___Exit
lea ecx, [esp + 0x10]
call fcn.00404bd0
lea eax, [esp + 0xc]
push eax
mov byte [esp + 0x64], 1
call fcn.004017f5
pop ecx
push 0
push 1
lea ecx, [esp + 0x14]
call fcn.004058b3
jmp 0x403805
call fcn.004036fd
push 0
mov edi, eax
call fcn.00403644
pop ecx
push 0
push 0x4035a4
call dword [sym.imp.USER32.dll_EnumWindows]
push edi
call fcn.00403644
pop ecx
lea ecx, [esp + 0x28]
call fcn.004085fe
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0049f533
mov esp, ebp
pop ebp
ret