joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40152a
Capabilities:
Terminate process

Disassembly:
push 0x64
mov eax, 0x4029c8
call fcn.00402945
push str.Hey_there__n_nThe_code_you_just_executed_is_malware__so_if_you_do_not_wish_to_proceed_executing_this_code__press_No_and_nothing_will_happen._nBut_if_you_insist__press_Yes._nPlease_make_sure_that_you_are_in_a_controlled_environment._n_a_VM_for_example_.
lea ecx, [ebp - 0x70]
call fcn.004016b4
xor ebx, ebx
lea ecx, [ebp - 0x58]
push str.Are_ya_really_sure__nThis_will_render_the_system_unbootable_
mov dword [ebp - 4], ebx
call fcn.004016b4
push str.Warning
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.004016b4
push str.Last_warning
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004016b4
push 7
pop edi
cmp dword [ebp - 0x2c], edi
lea ecx, [ebp - 0x40]
push 0x34
cmova ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x70]
cmp dword [ebp - 0x5c], edi
push ecx
cmova eax, dword [ebp - 0x70]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, edi
je 0x4015e6
cmp dword [ebp - 0x14], edi
lea ecx, [ebp - 0x28]
push 0x44
cmova ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x58]
cmp dword [ebp - 0x44], edi
push ecx
cmova eax, dword [ebp - 0x58]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, edi
je 0x4015e6
lea ecx, [ebp - 0x28]
call fcn.00401664
lea ecx, [ebp - 0x40]
call fcn.00401664
lea ecx, [ebp - 0x58]
call fcn.00401664
lea ecx, [ebp - 0x70]
call fcn.00401664
call fcn.00402903
ret
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x4015ee
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1c8]
sub esp, 0x248
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp + 0x1c4], eax
push 0x104
lea eax, [ebp - 0x44]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x38
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x80], 0x3c
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x74], str.runas
lea eax, [ebp - 0x44]
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [ebp + 0x1c4]
xor ecx, ebp
call fcn.00401a34
add ebp, 0x1c8
leave
ret

Function at 0x4016e6
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x4029fc
call fcn.00402912
mov esi, ecx
push 4
xor ebx, ebx
call fcn.00401a42
mov dword [ebp - 0x10], eax
mov dword [eax], 0x4011e1
lea edi, [esi + 4]
mov dword [ebp - 4], ebx
push edi
push ebx
push eax
push 0x401888
push ebx
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x40172f
mov eax, esi
call fcn.004028ef
ret 4
push 6
mov dword [edi], ebx
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x4018d7
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, 0x270
cmp dword [esi], edi
jne 0x40191f
lea edx, [esi + 8]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x4018e7
jmp 0x40192c
cmp dword [esi], 0x4e0
jb 0x40192c
call fcn.00401966
mov eax, dword [esi]
pop edi
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
pop esi
ret

Function at 0x401966
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, 0xe3
push edi
lea edi, [esi + 0x9c4]
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ecx, eax
lea edi, [edx + 4]
mov ebx, dword [edi]
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub ebp, 1
jne 0x401979
lea edi, [esi + 0xd50]
mov ebp, 0x18c
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ecx, eax
lea edi, [edx + 4]
mov ebx, dword [edi]
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub ebp, 1
jne 0x4019c0
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [esi], ebp
and eax, 0x9908b0df
shr ecx, 1
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
pop esi
pop ebp
pop ebx
ret

Function at 0x402300
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40233f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40233f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40233f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40233f
cmp dword [ecx + 0x74], 0xe
jbe 0x40233f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x43c5b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp byte [0x49d9d8], 0
push esi
je 0x43c64c
cmp byte [0x49d868], 0
je 0x43c64c
sub esp, 0x18
mov esi, esp
sub esp, 0x18
mov ecx, esp
push 0x4a2c88
call fcn.00474480
mov ecx, esi
call fcn.0045aa90
add esp, 0x18
lea ecx, [ebp - 0x1c]
call fcn.0045ae00
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x43c5fe
mov eax, dword [eax]
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov ecx, dword [ebp - 8]
mov dword [0x49d8e4], eax
cmp ecx, 0x10
jb 0x43c647
mov edx, dword [ebp - 0x1c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43c638
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x43c638
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00476ef0
mov eax, dword [0x49d8e4]
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x43c660
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp byte [0x49d9d8], 0
push esi
je 0x43c6fc
cmp byte [0x49d868], 0
je 0x43c6fc
sub esp, 0x18
mov esi, esp
sub esp, 0x18
mov ecx, esp
push 0x49fe44
call fcn.00474480
mov ecx, esi
call fcn.0045aa90
add esp, 0x18
lea ecx, [ebp - 0x1c]
call fcn.0045ae00
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x43c6ae
mov eax, dword [eax]
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov ecx, dword [ebp - 8]
mov dword [0x49d8e4], eax
cmp ecx, 0x10
jb 0x43c6f7
mov edx, dword [ebp - 0x1c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43c6e8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x43c6e8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00476ef0
mov eax, dword [0x49d8e4]
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x43cbb0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47959f
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x49d008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x24], 0
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
mov eax, dword [ecx + 0x1390]
lea esi, [ecx + 8]
mov dword [ebp - 0x14], esi
test al, 1
jne 0x43cc63
or eax, 1
mov dword [ecx + 0x1390], eax
mov dword [ebp - 4], 1
call dword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov ecx, eax
mov dword [esi + 0x1384], 0xffffffff
mov dword [esi + 4], ecx
mov edx, 1
add esi, 8
mov eax, ecx
lea esi, [esi + 4]
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
inc edx
mov dword [esi - 4], ecx
cmp edx, 0x270
jb 0x43cc37
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov dword [esi], 0x270
jmp 0x43cc66
mov dword [ebp - 0x14], esi
mov eax, dword [ecx + 0x1390]
test al, 2
jne 0x43cc8d
or eax, 2
mov dword [ecx + 0x1394], 0
mov dword [ecx + 0x1390], eax
mov dword [ecx + 0x1398], 0x3d
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
mov byte [ebx], 0
mov dword [ebp - 4], 0
mov ecx, ebx
push edi
mov dword [ebp - 0x24], 1
call fcn.00474190
test edi, edi
je 0x43cd96
mov eax, dword [ebp - 0x18]
dec edi
mov dword [ebp - 0x20], edi
mov edi, dword [eax + 0x1398]
mov eax, dword [eax + 0x1394]
sub edi, eax
mov dword [ebp - 0x2c], eax
cmp edi, 0xffffffff
jne 0x43ccf8
mov ecx, esi
call fcn.00476880
mov edx, eax
jmp 0x43cd46
lea esi, [edi + 1]
mov dword [ebp - 0x1c], esi
nop
xor ebx, ebx
xor ecx, ecx
test edi, edi
je 0x43cd15
mov ecx, dword [ebp - 0x14]
call fcn.00476880
mov ebx, eax
or ecx, 0xffffffff
xor edx, edx
mov eax, ecx
div esi
xor edx, edx
mov esi, eax
mov eax, ebx
div dword [ebp - 0x1c]
cmp eax, esi
jb 0x43cd37
xor edx, edx
lea esi, [edi + 1]
mov eax, ecx
div esi
cmp edx, edi
jne 0x43cd00
jmp 0x43cd3a
mov esi, dword [ebp - 0x1c]
mov eax, ebx
xor edx, edx
mov ebx, dword [ebp - 0x28]
div esi
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebx + 0x10]
mov al, byte [edx + eax + str.0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov edx, dword [ebx + 0x14]
mov byte [ebp - 0x10], al
cmp ecx, edx
jae 0x43cd79
lea eax, [ecx + 1]
mov dword [ebx + 0x10], eax
mov eax, ebx
cmp edx, 0x10
jb 0x43cd6c
mov eax, dword [ebx]
mov dl, byte [ebp - 0x10]
mov byte [eax + ecx], dl
mov byte [eax + ecx + 1], 0
jmp 0x43cd8b
push dword [ebp - 0x10]
mov byte [ebp - 0x30], 0
push dword [ebp - 0x30]
push ecx
mov ecx, ebx
call fcn.004759a0
mov edi, dword [ebp - 0x20]
test edi, edi
jne 0x43ccd0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x451060
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47ae4e
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x49d008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [ebp - 4], 0
push ebx
mov dword [ebp - 0x14], 1
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
test eax, eax
jle 0x4511d2
mov edx, dword [edi + 0x10]
lea ecx, [eax + 1]
cmp ecx, edx
ja 0x4510f8
mov dword [edi + 0x10], ecx
mov eax, edi
cmp dword [edi + 0x14], 0x10
jb 0x4510f2
mov eax, dword [edi]
mov byte [eax + ecx], 0
jmp 0x45113c
mov esi, dword [edi + 0x14]
mov ebx, ecx
mov eax, esi
sub ebx, edx
sub eax, edx
cmp ebx, eax
ja 0x451128
mov dword [edi + 0x10], ecx
mov eax, edi
cmp esi, 0x10
jb 0x451113
mov eax, dword [edi]
push ebx
lea esi, [eax + edx]
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov byte [esi + ebx], 0
jmp 0x451139
push ecx
push ebx
mov byte [ebp - 0x18], 0
mov ecx, edi
push dword [ebp - 0x18]
push ebx
call fcn.00475c70
mov ebx, dword [ebp - 0x10]
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x451146
mov eax, dword [edi]
push dword [edi + 0x10]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edx, dword [edi + 0x10]
mov ecx, eax
cmp ecx, edx
ja 0x45117f
mov dword [edi + 0x10], ecx
mov eax, edi
cmp dword [edi + 0x14], 0x10
jb 0x451167
mov eax, dword [edi]
mov byte [eax + ecx], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [edi + 0x14]
mov ebx, ecx
mov eax, esi
sub ebx, edx
sub eax, edx
cmp ebx, eax
ja 0x4511c1
mov dword [edi + 0x10], ecx
mov eax, edi
cmp esi, 0x10
jb 0x45119a
mov eax, dword [edi]
push ebx
lea esi, [eax + edx]
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov byte [esi + ebx], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
push ebx
mov byte [ebp - 0x18], 0
mov ecx, edi
push dword [ebp - 0x18]
push ebx
call fcn.00475c70
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x453700
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47b0cd
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
mov eax, dword [0x49d008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
xor ecx, ecx
mov byte [ebp - 0x48], 0x4a
mov byte [ebp - 0x47], 0x59
mov byte [ebp - 0x46], 0x4b
mov byte [ebp - 0x45], 0x46
mov byte [ebp - 0x44], 0x22
mov byte [ebp - 0x43], 0x74
mov byte [ebp - 0x42], 0x67
mov byte [ebp - 0x41], 0x65
mov byte [ebp - 0x40], 0x71
mov byte [ebp - 0x3f], 0x70
mov byte [ebp - 0x3e], 0x6a
mov byte [ebp - 0x3d], 0x67
mov byte [ebp - 0x3c], 0x65
mov byte [ebp - 0x3b], 0x6b
mov byte [ebp - 0x3a], 0x66
mov byte [ebp - 0x39], 0x71
mov byte [ebp - 0x38], 0x22
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x74
mov byte [ebp - 0x35], 0x67
mov byte [ebp - 0x34], 0x78
mov byte [ebp - 0x33], 0x6b
mov byte [ebp - 0x32], 0x63
mov byte [ebp - 0x31], 0x6f
mov byte [ebp - 0x30], 0x67
mov byte [ebp - 0x2f], 0x70
mov byte [ebp - 0x2e], 0x76
mov byte [ebp - 0x2d], 0x67
mov byte [ebp - 0x2c], 0
mov al, byte [ebp - 0x48]
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x48]
sub al, 2
mov byte [ebp + ecx - 0x48], al
inc ecx
cmp ecx, 0x1c
jb 0x4537b0
sub esp, 0x18
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.00474480
lea ecx, [ebp - 0x28]
call fcn.00448100
lea edx, [ebp - 0x48]
add esp, 0x18
mov esi, eax
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4537e1
sub edx, ecx
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x4537f4
mov ecx, dword [esi]
push edx
mov edx, dword [esi + 0x10]
lea eax, [ebp - 0x48]
push eax
call fcn.00476770
mov ecx, dword [ebp - 0x14]
add esp, 8
mov bl, al
cmp ecx, 0x10
jb 0x45383c
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x453832
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x453832
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00476ef0
add esp, 8
test bl, bl
je 0x453866
movsd xmm0, qword [0x495570]
mov byte [0x49d82b], 1
mov dword [0x49d9f4], 0x47835580
movsd qword [0x49d820], xmm0
call fcn.004517d0
cmp byte [0x49d82b], 0
jne 0x45389a
movss xmm0, dword [0x49d9f4]
ucomiss xmm0, dword [0x4956fc]
lahf
test ah, 0x44
jnp 0x45389a
movsd xmm0, qword [0x49d820]
ucomisd xmm0, qword [0x495570]
lahf
test ah, 0x44
jp 0x4538cb
call fcn.004517d0
push 0x2177
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x2d911904
call fcn.00459850
call fcn.004559b0
push 0
push 0
push 0x10
push dword [0x4a3330]
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x453901
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4538f7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4538f7
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00476ef0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x460fa0
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x49d008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x49d86a], 0
movsd xmm1, qword [0x495570]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
jne 0x460ff0
movsd xmm0, qword [0x49d860]
ucomisd xmm0, xmm1
lahf
test ah, 0x44
jnp 0x460ff0
cmp dword [0x49d804], 1
jne 0x46101c
push 0x1081
call esi
mov ecx, 0x2d911904
call fcn.00459850
call fcn.004559b0
push 0
push 0
push 0x10
push dword [0x4a3330]
call edi
movsd xmm1, qword [0x495570]
cmp byte [0x49d82b], 0
jne 0x46104c
movss xmm0, dword [0x49d9f4]
ucomiss xmm0, dword [0x4956fc]
lahf
test ah, 0x44
jnp 0x46104c
movsd xmm0, qword [0x49d820]
ucomisd xmm0, xmm1
lahf
test ah, 0x44
jp 0x461075
call fcn.004517d0
push 0x1cc4
call esi
mov ecx, 0x2d911904
call fcn.00459850
call fcn.004559b0
push 0
push 0
push 0x10
push dword [0x4a3330]
call edi
cmp byte [0x49d9d8], 0
je 0x461146
cmp byte [0x49d868], 0
je 0x461146
cmp byte [0x49da30], 0
je 0x461146
push dword [0x49da18]
push 0x18
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x461117
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], 0x224
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x461117
mov edi, dword [sym.imp.KERNEL32.dll_Module32Next]
mov ecx, ebx
lea eax, [ebp - 0x208]
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x461100
test dl, dl
je 0x4610fc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x461100
add eax, 2
add ecx, 2
test dl, dl
jne 0x4610e0
xor eax, eax
jmp 0x461105
sbb eax, eax
or eax, 1
test eax, eax
je 0x461128
lea eax, [ebp - 0x228]
push eax
push esi
call edi
test eax, eax
jne 0x4610d3
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00476b4c
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x214]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00476b4c
mov esp, ebp
pop ebp
ret
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x462b20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x49d008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x49d9d8], 0
je 0x462c1c
cmp byte [0x49d868], 0
je 0x462c1c
cmp byte [0x49d82b], 0
jne 0x462b7e
movss xmm0, dword [0x49d9f4]
ucomiss xmm0, dword [0x4956fc]
lahf
test ah, 0x44
jnp 0x462b7e
movsd xmm0, qword [0x49d820]
ucomisd xmm0, qword [0x495570]
lahf
test ah, 0x44
jp 0x462baf
call fcn.004517d0
mov ecx, 0x2d911904
call fcn.00459850
call fcn.004559b0
push 0x1cc2
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0x10
push dword [0x4a3330]
call dword [sym.imp.USER32.dll_PostMessageA]
call fcn.00462850
push 0
push 4
lea eax, [ebp - 8]
push eax
mov eax, dword [0x49d9c8]
add eax, dword [0x49d9a0]
push eax
push dword [0x49d9d0]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x49d8f4]
add eax, dword [ebp - 8]
push eax
push dword [0x49d9d0]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0xc], 0
jne 0x462c0c
call fcn.00462850
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00476b4c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.00476b4c
mov esp, ebp
pop ebp
ret
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x465420
Capabilities:
Execute command
Hide graphical window
Log keystrokes via polling
Terminate process

Disassembly:
push esi
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov esi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
add esp, 8
call esi
and eax, 0x80000001
jns 0x465447
dec eax
or eax, 0xfffffffe
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
ucomisd xmm0, qword [0x495570]
lahf
test ah, 0x44
jnp 0x465489
call esi
and eax, 0x80000001
jns 0x46546b
dec eax
or eax, 0xfffffffe
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
ucomisd xmm0, qword [0x495570]
lahf
test ah, 0x44
jnp 0x4654ba
call esi
pop esi
jmp fcn.00464190
call esi
cdq
mov ecx, 0x14
idiv ecx
movsd xmm0, qword [0x4955b0]
movd xmm1, edx
cvtdq2pd xmm1, xmm1
comisd xmm0, xmm1
jbe 0x4654ba
call esi
cdq
mov ecx, 0x1e
idiv ecx
cmp edx, 0xf
jl 0x4654ba
call esi
pop esi
jmp fcn.00464190
Function at 0x472170
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, 8
lea eax, [edi + 4]
mov edx, eax
nop
mov bl, byte [edx]
lea edx, [edx + 1]
mov ecx, dword [edi]
xor cl, bl
mov byte [edx - 1], cl
sub esi, 1
jne 0x472180
mov byte [edi + 0xc], 0
pop edi
pop esi
pop ebx
ret

Function at 0x4721c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, 6
lea eax, [edi + 4]
mov edx, eax
nop
mov bl, byte [edx]
lea edx, [edx + 1]
mov ecx, dword [edi]
xor cl, bl
mov byte [edx - 1], cl
sub esi, 1
jne 0x4721d0
mov byte [edi + 0xa], 0
pop edi
pop esi
pop ebx
ret

Function at 0x4721f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor edx, edx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 5
jb 0x4721f4
pop esi
mov byte [ecx + 9], 0
lea eax, [ecx + 4]
pop ebx
ret

Function at 0x472260
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor edx, edx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 4
jb 0x472264
pop esi
mov byte [ecx + 8], 0
lea eax, [ecx + 4]
pop ebx
ret

Function at 0x472290
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, 5
lea eax, [edi + 4]
mov edx, eax
nop
mov bl, byte [edx]
lea edx, [edx + 1]
mov ecx, dword [edi]
xor cl, bl
mov byte [edx - 1], cl
sub esi, 1
jne 0x4722a0
mov byte [edi + 9], 0
pop edi
pop esi
pop ebx
ret

Function at 0x472320
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, 3
lea eax, [edi + 4]
mov edx, eax
nop
mov bl, byte [edx]
lea edx, [edx + 1]
mov ecx, dword [edi]
xor cl, bl
mov byte [edx - 1], cl
sub esi, 1
jne 0x472330
mov byte [edi + 7], 0
pop edi
pop esi
pop ebx
ret

Function at 0x472350
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, 4
lea eax, [edi + 4]
mov edx, eax
nop
mov bl, byte [edx]
lea edx, [edx + 1]
mov ecx, dword [edi]
xor cl, bl
mov byte [edx - 1], cl
sub esi, 1
jne 0x472360
mov byte [edi + 8], 0
pop edi
pop esi
pop ebx
ret

Function at 0x4723a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor edx, edx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 3
jb 0x4723a4
pop esi
mov byte [ecx + 7], 0
lea eax, [ecx + 4]
pop ebx
ret

Function at 0x472430
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor edx, edx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 2
jb 0x472434
pop esi
mov byte [ecx + 6], 0
lea eax, [ecx + 4]
pop ebx
ret

Function at 0x4724e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, 2
lea eax, [edi + 4]
mov edx, eax
nop
mov bl, byte [edx]
lea edx, [edx + 1]
mov ecx, dword [edi]
xor cl, bl
mov byte [edx - 1], cl
sub esi, 1
jne 0x4724f0
mov byte [edi + 6], 0
pop edi
pop esi
pop ebx
ret