joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f09
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0x20
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
ret

Function at 0x401f20
Capabilities:
Accept command line arguments

Disassembly:
push edi
push esi
push 0x1f4
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push edi
call sub.MSVCRT.dll_strcpy
cmp byte [edi], 0x22
pop esi
pop ecx
jne 0x401f44
inc edi
xor eax, eax
cmp byte [eax + edi], 0x22
jne 0x401f50
and byte [eax + edi], 0
inc eax
cmp eax, 0x1f3
jl 0x401f46
xor esi, esi
push edi
call sub.MSVCRT.dll_strlen
pop ecx
sub eax, 4
or eax, eax
jle 0x401fe4
mov cl, byte [esi + edi]
cmp cl, 0x2e
jne 0x401fd5
mov al, byte [esi + edi + 1]
cmp al, 0x65
je 0x401f7c
cmp al, 0x45
jne 0x401fa0
mov al, byte [esi + edi + 2]
cmp al, 0x78
je 0x401f88
cmp al, 0x58
jne 0x401fa0
mov al, byte [esi + edi + 3]
cmp al, 0x65
je 0x401f94
cmp al, 0x45
jne 0x401fa0
mov al, byte [esi + edi + 4]
cmp al, 0x20
je 0x401fe4
or al, al
je 0x401fe4
cmp cl, 0x2e
jne 0x401fd5
mov al, byte [esi + edi + 1]
cmp al, 0x73
je 0x401fb1
cmp al, 0x53
jne 0x401fd5
mov al, byte [esi + edi + 2]
cmp al, 0x63
je 0x401fbd
cmp al, 0x43
jne 0x401fd5
mov al, byte [esi + edi + 3]
cmp al, 0x72
je 0x401fc9
cmp al, 0x52
jne 0x401fd5
mov al, byte [esi + edi + 4]
cmp al, 0x20
je 0x401fe4
or al, al
je 0x401fe4
push edi
inc esi
call sub.MSVCRT.dll_strlen
pop ecx
sub eax, 4
cmp esi, eax
jl 0x401f68
push edi
call sub.MSVCRT.dll_strlen
sub eax, 4
cmp esi, eax
pop ecx
jl 0x40200b
push edi
push dword [esp + 0x10]
call sub.MSVCRT.dll_strcpy
push edi
push dword [esp + 0x1c]
call sub.MSVCRT.dll_strcpy
sub esp, 0xfffffff0
jmp 0x402042
push ebx
mov ebx, dword [esp + 0x10]
push edi
push ebx
call sub.MSVCRT.dll_strcpy
add esi, 3
pop eax
lea eax, [esi + ebx]
pop ecx
mov byte [eax + 1], 0
js 0x402035
lea ecx, [esi + 1]
mov edx, edi
sub edx, ebx
mov bl, byte [edx + eax]
mov byte [eax], bl
dec eax
dec ecx
jne 0x40202c
push edi
push dword [esp + 0x18]
call sub.MSVCRT.dll_strcpy
pop ebx
pop ecx
pop ebx
dec edi
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
pop esi
pop edi
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x40b540
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x40b528
xor edi, edi
nop
jmp 0x40b53c
movzx ecx, word [edx + 0x26]
nop
jmp 0x40b54b
mov esi, dword [edx + 0x28]
nop
jmp 0x40b55d
xor eax, eax
jmp 0x40b56d
lodsb al, byte [esi]
nop
jmp 0x40b57f
cmp al, 0x61
nop
jmp 0x40b593
jl 0x40b5b9
jmp 0x40b5a5
sub al, 0x20
nop
jmp 0x40b5b9
nop
jmp 0x40b5c7
ror edi, 0xd
add edi, eax
nop
dec ecx
jne 0x40b55d
nop
nop
push edx
nop
push edi
jmp 0x40b5e7
mov edx, dword [edx + 0x10]
mov eax, dword [edx + 0x3c]
add eax, edx
jmp 0x40b5ff
mov eax, dword [eax + 0x78]
nop
test eax, eax
nop
je 0x40b7d2
nop
nop
add eax, edx
jmp 0x40b61c
mov ecx, dword [eax + 0x18]
push eax
mov ebx, dword [eax + 0x20]
nop
jmp 0x40b62f
add ebx, edx
nop
jmp 0x40b63c
test ecx, ecx
nop
je 0x40b7d0
nop
dec ecx
nop
jmp 0x40b654
xor edi, edi
jmp 0x40b666
mov esi, dword [ebx + ecx*4]
jmp 0x40b679
add esi, edx
nop
nop
jmp 0x40b688
xor eax, eax
nop
ror edi, 0xd
nop
lodsb al, byte [esi]
jmp 0x40b69e
add edi, eax
cmp al, ah
nop
jmp 0x40b6b4
jne 0x40b67c
jmp 0x40b6cb
nop
jmp 0x40b6d6
add edi, dword [ebp - 8]
nop
cmp edi, dword [ebp + 0x24]
jmp 0x40b6e9
jne 0x40b631
jmp 0x40b6fa
pop eax
nop
mov ebx, dword [eax + 0x24]
nop
add ebx, edx
nop
jmp 0x40b717
mov cx, word [ebx + ecx*2]
jmp 0x40b72a
mov ebx, dword [eax + 0x1c]
nop
jmp 0x40b742
add ebx, edx
nop
mov eax, dword [ebx + ecx*4]
nop
jmp 0x40b75a
add eax, edx
nop
jmp 0x40b76b
mov dword [esp + 0x24], eax
nop
pop ebx
pop ebx
jmp 0x40b77f
popal
jmp 0x40b792
pop ecx
nop
jmp 0x40b7a8
pop edx
jmp 0x40b7bc
push ecx
nop
jmp eax
nop
pop eax
pop edi
jmp 0x40b7e5
pop edx
nop
mov edx, dword [edx]
jmp 0x40b518

Function at 0x10013a4
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov esi, ecx
mov eax, dword [esi + 0x248]
mov edi, 0xfffff758
and eax, edi
or eax, dword [ebp + 8]
push eax
lea eax, [esi + 0x274]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x10013e4
mov eax, dword [esi + 0x248]
and eax, edi
or eax, dword [ebp + 8]
mov dword [esi + 0x248], eax
mov al, 1
jmp 0x10013f5
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10013f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
xor al, al
pop edi
pop esi
pop ebp
ret 8
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..00cfg
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x4c3c2253
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x45935b84
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401691
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x40169f
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
cmp esi, 8
push edi
not eax
mov ecx, 0xff
jl 0x401789
mov edi, esi
shr edi, 3
mov ebx, edi
neg ebx
lea esi, [esi + ebx*8]
mov dword [ebp + 0x10], esi
movzx ebx, byte [edx]
mov esi, eax
and esi, ecx
xor esi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [esi*4 + 0x406190]
xor eax, ebx
inc edx
mov esi, eax
movzx ebx, byte [edx]
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x406190]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x406190]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x406190]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x406190]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x406190]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x406190]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x406190]
xor eax, esi
inc edx
dec edi
jne 0x4016c7
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x4017a6
movzx ebx, byte [edx]
mov edi, eax
and edi, ecx
xor edi, ebx
shr eax, 8
mov edi, dword [edi*4 + 0x406190]
xor eax, edi
inc edx
dec esi
jne 0x40178d
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x402ea0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
push ebx
push esi
mov esi, 0x400
push edi
lea eax, [ebp - 0x824]
push esi
xor ebx, ebx
push eax
push ebx
call dword [fcn.00406048]
lea eax, [ebp - 0x424]
push esi
push eax
call dword [fcn.0040604c]
lea eax, [ebp - 0x424]
push eax
call fcn.00403720
cmp byte [ebp + eax - 0x425], 0x5c
pop ecx
je 0x402efa
lea eax, [ebp - 0x424]
push 0x40ade4
push eax
call fcn.00403640
pop ecx
pop ecx
lea eax, [ebp - 0x424]
push 0x40afd4
push eax
call fcn.00403640
pop ecx
lea eax, [ebp - 0x424]
pop ecx
push ebx
push eax
lea eax, [ebp - 0x824]
push eax
call dword [fcn.00406058]
lea eax, [ebp - 0x424]
push 0x40afc8
push eax
call fcn.00403640
pop ecx
lea eax, [ebp - 4]
pop ecx
mov esi, 0x40af98
push eax
mov edi, 0x80000002
push esi
push edi
call dword [fcn.00406004]
lea eax, [ebp - 0x424]
push eax
call fcn.00403720
pop ecx
push eax
lea eax, [ebp - 0x424]
push eax
push 1
push ebx
push 0x40af90
push dword [ebp - 4]
call dword [fcn.00406010]
push dword [ebp - 4]
call dword [fcn.0040600c]
mov ebx, 0x40af88
push ebx
push esi
push edi
call fcn.00402e72
push ebx
mov ebx, 0x80000001
push esi
push ebx
call fcn.00402e72
push 0x40af7c
push esi
push edi
call fcn.00402e72
push 0x40af7c
push esi
push ebx
call fcn.00402e72
add esp, 0x30
push 0x40af40
push 0x80000000
call dword [fcn.00406000]
push 0x40af34
push esi
push edi
call fcn.00402e72
push 0x40af34
push esi
push ebx
call fcn.00402e72
push 0x40af2c
push esi
push edi
call fcn.00402e72
push 0x40af2c
push 0x40aef4
push edi
call fcn.00402e72
push 0x40aee8
push esi
push edi
call fcn.00402e72
push 0x40aedc
push esi
push edi
call fcn.00402e72
add esp, 0x48
push 0x40aecc
push esi
push ebx
call fcn.00402e72
push 0x40aec4
push esi
push ebx
call fcn.00402e72
push 0x40aebc
push esi
push edi
call fcn.00402e72
push 0x40aeb8
push esi
push ebx
call fcn.00402e72
push 0x40aeb0
push esi
push edi
call fcn.00402e72
add esp, 0x3c
push 0x40ae78
push ebx
call dword [fcn.00406000]
push 0x40ae4c
push edi
call dword [fcn.00406000]
push 0x40ae34
push esi
push ebx
call fcn.00402e72
push 0x40ae34
push esi
push edi
call fcn.00402e72
add esp, 0x18
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42b224
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x438e80]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0042b1b9
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004162c0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x42b273
cmp dword [ebp - 0x1c], 5
jb 0x42b28b
jmp 0x42b287
cmp dword [ebp - 0x10], 1
jne 0x42b28b
cmp dword [ebp - 0x1c], 4
ja 0x42b287
jne 0x42b28b
cmp dword [ebp - 0x18], 0
jbe 0x42b28b
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4327a4
call fcn.0042b08d
test eax, eax
jge 0x42b2ac
mov byte [0x43a368], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00416063
add ebp, 0x78
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x431072
nop
mov ebx, 0x40915c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x246f74be
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x431060
nop
nop
nop
nop
mov eax, section..rsrc
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x6c5b2cb1
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4310c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x408937
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x4085d8
call fcn.0040895d
mov esi, 0x6a2dd08b
mov esi, 0x59165051
xor dword [eax], ebx
inc eax
cmp eax, edi
jne fcn.00408937
mov esi, edx
ret
Function at 0x402850
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4519ed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5c000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5c21a8], 0x2c
jl 0x4028a8
push 0x5c21ac
call fcn.00436ad0
mov ecx, dword [0x5c21a4]
add esp, 4
test ecx, ecx
je 0x40289a
mov eax, dword [ecx]
mov dword [0x5c21a4], eax
mov dword [0x5c21ac], 1
test ecx, ecx
jne 0x4028bf
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4028e4
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00402dc0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00440fc0
int3

Function at 0x402980
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x451a55
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5c000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x5c21a8], 0x2c
jl 0x4029dd
push 0x5c21ac
call fcn.00436ad0
mov edi, dword [0x5c21a4]
add esp, 4
test edi, edi
je 0x4029cf
mov eax, dword [edi]
mov dword [0x5c21a4], eax
mov dword [0x5c21ac], 1
test edi, edi
jne 0x4029f4
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x402a51
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.00402dc0
mov byte [ebp - 4], 1
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CWString.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.004031d0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00440fc0
int3
Function at 0x402f60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x451b75
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5c000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5c21a8], 0x1c
jl 0x402fb8
push 0x5c21ac
call fcn.00436ad0
mov ecx, dword [0x5c21a4]
add esp, 4
test ecx, ecx
je 0x402faa
mov eax, dword [ecx]
mov dword [0x5c21a4], eax
mov dword [0x5c21ac], 1
test ecx, ecx
jne 0x402fcf
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40302b
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolMem.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x18], 0x40
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00440fc0
int3

Function at 0x4030e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x451bed
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5c000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5c21a8], 0x1c
jl 0x40313b
push 0x5c21ac
call fcn.00436ad0
mov ecx, dword [0x5c21a4]
add esp, 4
test ecx, ecx
je 0x40312d
mov eax, dword [ecx]
mov dword [0x5c21a4], eax
mov dword [0x5c21ac], 1
test ecx, ecx
jne 0x403152
push 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x403179
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
push esi
call fcn.00403040
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00440fc0
int3

Function at 0x403700
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4519ed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5c000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5c21a8], 0xc
jl 0x403758
push 0x5c21ac
call fcn.00436ad0
mov ecx, dword [0x5c21a4]
add esp, 4
test ecx, ecx
je 0x40374a
mov eax, dword [ecx]
mov dword [0x5c21a4], eax
mov dword [0x5c21ac], 1
test ecx, ecx
jne 0x40376f
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4037a5
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00440fc0
int3
Function at 0x4037b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x451cc5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5c000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x5c21a8], 0xc
jl 0x40380b
push 0x5c21ac
call fcn.00436ad0
mov ecx, dword [0x5c21a4]
add esp, 4
test ecx, ecx
je 0x4037fd
mov eax, dword [ecx]
mov dword [0x5c21a4], eax
mov dword [0x5c21ac], 1
test ecx, ecx
jne 0x403822
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40386f
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ecx], vtable.CVolObject.0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [ecx], vtable.CVolObject.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00440fc0
int3
Function at 0x40aff0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x452420
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x5c000c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [0x5c0ca8]
xor eax, eax
test ecx, ecx
je 0x40b032
cmp word [ecx], ax
sete al
jmp 0x40b03c
cmp dword [0x5c0cc0], 2
setle al
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40b053
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
jmp 0x40b192
lea ecx, [ebp - 0x268]
call fcn.00402dc0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x238]
push 0x228
push 0
push eax
call fcn.0043e870
add esp, 0xc
mov dword [ebp - 0x23c], 0x22c
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x40b17e
lea eax, [ebp - 0x23c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x40b17b
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop word [eax + eax]
xor ecx, ecx
mov dword [ebp - 0x25c], ecx
mov eax, dword [ebp - 0x24c]
test eax, eax
je 0x40b0e8
push eax
mov eax, dword [ebp - 0x258]
lea ecx, [ebp - 0x258]
call dword [eax + 0xc]
mov ecx, dword [ebp - 0x25c]
xor edx, edx
xor esi, esi
mov dword [ebp - 0x24c], edx
mov dword [ebp - 0x244], esi
mov dword [ebp - 0x248], edx
cmp word [ebp - 0x218], dx
je 0x40b12b
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x258]
call fcn.004360b0
mov esi, dword [ebp - 0x244]
mov edx, dword [ebp - 0x24c]
mov ecx, dword [ebp - 0x25c]
test ecx, ecx
jne 0x40b139
test esi, esi
mov ecx, 0x5ade04
cmovne ecx, edx
mov eax, dword [0x5c0ca8]
test eax, eax
jne 0x40b155
cmp dword [0x5c0cc0], 0
mov eax, 0x5ade04
cmovne eax, dword [0x5c0cb8]
push ecx
push eax
call fcn.00441077
add esp, 8
test eax, eax
je 0x40b1d0
lea eax, [ebp - 0x23c]
push eax
push edi
call ebx
test eax, eax
jne 0x40b0c0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call ebx
mov dword [ebp - 4], 0xffffffff
xor esi, esi
lea ecx, [ebp - 0x268]
call fcn.00402ac0
push esi
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov esi, eax
call ebx
xor eax, eax
test esi, esi
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043cd82
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call ebx
mov esi, dword [ebp - 0x234]
mov dword [ebp - 4], 0xffffffff
jmp 0x40b187