joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406230
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
call fcn.0040e930
mov edi, eax
lea eax, [esp + 0x14]
push eax
push 0
push dword [esp + 0x18]
mov ecx, dword [edi]
push 0
push 0
push dword [edi + 4]
or ecx, 2
push ecx
call fcn.004c8ea9
mov esi, eax
or eax, 0xffffffff
test esi, esi
cmovs esi, eax
lea ecx, [esi*2 + 2]
push ecx
call fcn.004c4c06
mov ecx, dword [edi]
mov ebx, eax
lea eax, [esp + 0x34]
or ecx, 1
push eax
push 0
push dword [esp + 0x38]
push esi
push ebx
push dword [edi + 4]
push ecx
call fcn.004c8ea9
add esp, 0x3c
xor eax, eax
mov word [ebx + esi*2], ax
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test ebx, ebx
je 0x4062a8
push ebx
call fcn.004c4beb
add esp, 4
pop edi
pop esi
pop ebx
ret

Function at 0x4062b0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x224
mov eax, dword [0x50b0b0]
xor eax, esp
mov dword [esp + 0x220], eax
push esi
mov esi, dword [esp + 0x22c]
lea eax, [esp + 0x1c]
push eax
push 0
push dword [0x50cd38]
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x40637d
lea edx, [esp + 0x1c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 7
lea ecx, [edx + 2]
mov word [esp + 4], ax
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x406303
sub edx, ecx
lea eax, [esp + 0x1c]
sar edx, 1
lea ecx, [esp + 4]
push edx
push eax
call fcn.0040b650
lea eax, [esp + 4]
mov ecx, esi
push eax
call fcn.00404180
mov edx, dword [esp + 0x18]
cmp edx, 8
jb 0x406365
mov ecx, dword [esp + 4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40635b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406396
push edx
push ecx
call fcn.004bf27b
add esp, 8
xor eax, eax
pop esi
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.004bf6e8
add esp, 0x224
ret
mov ecx, dword [esp + 0x224]
or eax, 0xffffffff
pop esi
xor ecx, esp
call fcn.004bf6e8
add esp, 0x224
ret
call fcn.004c4b9a
int3
Function at 0x4063a0
Capabilities:
Get common file path
Get program files directory

Disassembly:
sub esp, 0x224
mov eax, dword [0x50b0b0]
xor eax, esp
mov dword [esp + 0x220], eax
push edi
mov edi, dword [esp + 0x22c]
lea eax, [esp + 0x1c]
push eax
push 0
push dword [0x50cd38]
push 0x2a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x406471
lea edx, [esp + 0x1c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 7
lea ecx, [edx + 2]
mov word [esp + 4], ax
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4063f3
sub edx, ecx
lea eax, [esp + 0x1c]
sar edx, 1
lea ecx, [esp + 4]
push edx
push eax
call fcn.0040b650
lea eax, [esp + 4]
mov ecx, edi
push eax
call fcn.00404180
mov edx, dword [esp + 0x18]
cmp edx, 8
jb 0x406459
mov ecx, dword [esp + 4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40644f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40651e
push edx
push ecx
call fcn.004bf27b
add esp, 8
xor eax, eax
pop edi
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.004bf6e8
add esp, 0x224
ret
lea eax, [esp + 0x1c]
push eax
push 0
push dword [0x50cd38]
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x406505
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 7
lea edx, [ecx + 2]
mov word [esp + 4], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4064a4
sub ecx, edx
lea eax, [esp + 0x1c]
sar ecx, 1
push ecx
push eax
lea ecx, [esp + 0xc]
call fcn.0040b650
lea eax, [esp + 4]
mov ecx, edi
push eax
call fcn.00404180
mov edx, dword [esp + 0x18]
cmp edx, 8
jb 0x406459
mov ecx, dword [esp + 4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40644f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40651e
jmp 0x40644f
mov ecx, dword [esp + 0x224]
or eax, 0xffffffff
pop edi
xor ecx, esp
call fcn.004bf6e8
add esp, 0x224
ret
call fcn.004c4b9a
int3
Function at 0x407700
Capabilities:
Delete directory
Get common file path
Get startup folder

Disassembly:
push ebp
lea ebp, [esp - 0x23c]
sub esp, 0x23c
push 0xffffffffffffffff
push 0x4e6820
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x50b0b0]
xor eax, ebp
mov dword [ebp + 0x238], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp + 0x10], 0
mov dword [ebp + 0x14], 7
mov word [ebp], ax
mov dword [ebp - 4], eax
lea eax, [ebp + 0x30]
push eax
push 0
push dword [0x50cd38]
push 0x17
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x40780a
lea ecx, [ebp + 0x30]
mov dword [ebp + 0x28], eax
mov dword [ebp + 0x2c], 7
lea edx, [ecx + 2]
mov word [ebp + 0x18], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407780
sub ecx, edx
lea eax, [ebp + 0x30]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp + 0x18]
call fcn.0040b650
push 0x4ea7e0
lea eax, [ebp + 0x18]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00401920
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x4077bd
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [ebp - 0x24]
call fcn.00403870
mov edx, dword [ebp + 0x2c]
mov byte [ebp - 4], 0
cmp edx, 8
jb 0x40780a
mov ecx, dword [ebp + 0x18]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407800
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40789c
push edx
push ecx
call fcn.004bf27b
add esp, 8
lea eax, [ebp]
push eax
call fcn.004063a0
add esp, 4
test eax, eax
js 0x407846
push 0x4ea7e0
lea eax, [ebp]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00401a40
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x407837
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [ebp - 0x24]
call fcn.00403870
mov edx, dword [ebp + 0x14]
cmp edx, 8
jb 0x40787c
mov ecx, dword [ebp]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407872
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4078a1
push edx
push ecx
call fcn.004bf27b
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp + 0x238]
xor ecx, ebp
call fcn.004bf6e8
lea esp, [ebp + 0x23c]
pop ebp
ret
call fcn.004c4b9a
call fcn.004c4b9a
int3
Function at 0x44bd70
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
xorps xmm0, xmm0
movlpd qword [esp + 8], xmm0
cmp dword [esi + 0x3c], 0
jne 0x44bd9f
mov eax, dword [esp + 0x18]
pop esi
mov dword [eax], 0
mov dword [eax + 4], 0
xor eax, eax
add esp, 0xc
ret
push ebx
push ebp
push edi
push esi
call fcn.00438980
add esp, 4
test eax, eax
jne 0x44bf57
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x20], eax
movzx ecx, word [esi + 0x4c]
movsx eax, cx
mov edi, dword [esi + eax*4 + 0x78]
mov bl, byte [edi + 5]
test bl, bl
jne 0x44bdda
cmp byte [edi + 2], bl
jne 0x44bde9
movzx eax, word [edi + 0x12]
cdq
add dword [esp + 0x20], eax
adc ebp, edx
mov dword [esp + 0x10], ebp
mov eax, ecx
test bl, bl
je 0x44beba
test cx, cx
je 0x44bf3d
movsx eax, cx
mov ecx, dword [esi + eax*4 + 0x78]
test ecx, ecx
je 0x44be73
mov ecx, dword [ecx + 0x44]
test byte [ecx + 0x18], 0x40
mov ebp, dword [ecx + 0x10]
je 0x44be4f
dec dword [ebp + 0x78]
mov eax, dword [ebp + 0x88]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp + 0x98]
mov edi, dword [ebp + 0x3c]
mov dword [ebp + 0x88], ecx
push dword [ecx + 4]
mov ecx, dword [ecx + 0x14]
mov ebx, dword [edi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.004bfab0
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
add esp, 0x10
jmp 0x44be58
push ecx
call fcn.00465860
add esp, 4
cmp dword [ebp + 0x78], 0
jne 0x44be73
mov eax, dword [ebp + 0xcc]
cmp dword [eax + 0xc], 0
jne 0x44be73
push ebp
call fcn.0043d7a0
add esp, 4
movzx eax, word [esi + 0x4c]
xor edx, edx
and byte [esi + 0x48], 0xf9
mov word [esi + 0x2c], dx
movsx edx, ax
lea ecx, [eax - 1]
mov word [esi + 0x4c], cx
movzx ecx, cx
mov eax, dword [esi + edx*4 + 0x74]
movzx edi, word [esi + edx*2 + 0x4c]
cmp di, word [eax + 0x12]
jae 0x44bdf3
mov ebp, dword [esp + 0x10]
lea eax, [edi + 1]
mov word [esi + edx*2 + 0x4c], ax
movzx ecx, word [esi + 0x4c]
movsx eax, cx
mov edi, dword [esi + eax*4 + 0x78]
mov eax, ecx
cwde
movzx edx, word [esi + eax*2 + 0x4e]
movzx eax, word [edi + 0x12]
cmp edx, eax
jne 0x44beeb
movzx ecx, byte [edi + 6]
add ecx, dword [edi + 0x38]
movzx edx, byte [ecx + 8]
movzx eax, byte [ecx + 9]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xa]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xb]
jmp 0x44bf1e
mov eax, dword [edi + 0x40]
movzx ecx, byte [eax + edx*2 + 1]
movzx eax, byte [eax + edx*2]
shl eax, 8
or ecx, eax
movzx eax, word [edi + 0x14]
and ecx, eax
add ecx, dword [edi + 0x38]
movzx edx, byte [ecx]
movzx eax, byte [ecx + 1]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 2]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 3]
shl edx, 8
or edx, eax
push edx
push esi
call fcn.004387e0
add esp, 8
test eax, eax
je 0x44bdc3
pop edi
pop ebp
pop ebx
pop esi
add esp, 0xc
ret
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push esi
mov dword [eax], ecx
mov ecx, dword [esp + 0x14]
mov dword [eax + 4], ecx
call fcn.00438980
add esp, 4
pop edi
pop ebp
pop ebx
pop esi
add esp, 0xc
ret
Function at 0x44e290
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebp
push esi
mov esi, dword [esp + 0x18]
xor ebp, ebp
mov dword [esp + 0x10], ebp
test esi, esi
je 0x44e404
cmp byte [esi + 9], 0
je 0x44e2bf
inc dword [esi + 0xc]
cmp byte [esi + 0xa], 0
jne 0x44e2bf
push esi
call fcn.00423b80
add esp, 4
mov eax, dword [esi + 4]
push ebx
mov ebx, dword [eax + 8]
mov dword [esp + 0x10], ebx
test ebx, ebx
je 0x44e3ee
push edi
cmp dword [esp + 0x28], 0
je 0x44e313
test byte [ebx + 0x48], 1
jne 0x44e313
mov al, byte [ebx + 0x49]
cmp al, 1
je 0x44e2eb
cmp al, 2
jne 0x44e327
push ebx
call fcn.00444580
mov ebp, eax
add esp, 4
mov dword [esp + 0x18], ebp
test ebp, ebp
je 0x44e327
mov esi, dword [esp + 0x20]
push 0
push ebp
push esi
call fcn.0044e290
add esp, 0xc
jmp 0x44e3ed
push ebx
call fcn.0044b6e0
mov eax, dword [esp + 0x28]
add esp, 4
mov byte [ebx + 0x49], 4
mov dword [ebx + 0x44], eax
xor edi, edi
xor eax, eax
mov dword [esp + 0x10], edi
cmp ax, word [ebx + 0x4c]
jg 0x44e3d6
lea ebp, [ebx + 0x78]
nop dword [eax]
mov ecx, dword [ebp]
test ecx, ecx
je 0x44e3bb
mov ecx, dword [ecx + 0x44]
test byte [ecx + 0x18], 0x40
mov esi, dword [ecx + 0x10]
je 0x44e397
dec dword [esi + 0x78]
mov eax, dword [esi + 0x88]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x98]
mov edi, dword [esi + 0x3c]
mov dword [esi + 0x88], ecx
push dword [ecx + 4]
mov ecx, dword [ecx + 0x14]
mov ebx, dword [edi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.004bfab0
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
mov ebx, dword [esp + 0x24]
add esp, 0x10
mov edi, dword [esp + 0x10]
jmp 0x44e3a0
push ecx
call fcn.00465860
add esp, 4
cmp dword [esi + 0x78], 0
jne 0x44e3bb
mov eax, dword [esi + 0xcc]
cmp dword [eax + 0xc], 0
jne 0x44e3bb
push esi
call fcn.0043d7a0
add esp, 4
mov dword [ebp], 0
inc edi
movsx eax, word [ebx + 0x4c]
add ebp, 4
mov dword [esp + 0x10], edi
cmp edi, eax
jle 0x44e340
mov ebx, dword [ebx + 8]
mov dword [esp + 0x14], ebx
test ebx, ebx
jne 0x44e2d3
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
pop edi
cmp byte [esi + 9], 0
pop ebx
je 0x44e404
add dword [esi + 0xc], 0xffffffff
jne 0x44e404
push esi
call fcn.00486170
add esp, 4
pop esi
mov eax, ebp
pop ebp
add esp, 0xc
ret
Function at 0x44e790
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x3c
mov eax, dword [0x50b0b0]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x4c]
add ecx, ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x20], eax
mov eax, dword [esi]
push edi
mov dword [esp + 0x18], esi
mov eax, dword [eax + 0x10]
mov ebx, dword [eax + ecx*8]
mov eax, 1
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], eax
push eax
push str.sqlite_stat_d
lea eax, [esp + 0x38]
push eax
push 0x18
call fcn.004181f0
mov edi, dword [esi]
xor ebp, ebp
add esp, 0x10
mov dword [esp + 0x20], edi
mov dword [esp + 0x14], 0
cmp dword [edi + 0x14], ebp
jle 0x44e8e7
mov esi, ebp
xor esi, 1
cmp ebp, 2
cmovae esi, ebp
test ebx, ebx
je 0x44e873
mov eax, dword [edi + 0x10]
mov ecx, esi
add ecx, ecx
mov edx, dword [eax + ecx*8]
test edx, edx
je 0x44e8ab
mov bl, byte [ebx]
test bl, bl
je 0x44e857
mov edi, dword [esp + 0x10]
mov al, bl
sub edi, edx
movzx ecx, byte [edx]
mov bl, al
movzx eax, al
mov al, byte [eax + 0x4eb938]
cmp al, byte [ecx + 0x4eb938]
jne 0x44e853
mov al, byte [edi + edx + 1]
inc edx
mov bl, al
test al, al
jne 0x44e832
mov edi, dword [esp + 0x20]
movzx eax, byte [edx]
movzx ecx, byte [eax + 0x4eb938]
movzx eax, bl
movzx eax, byte [eax + 0x4eb938]
sub eax, ecx
jne 0x44e8ab
mov ebx, dword [esp + 0x10]
mov eax, dword [edi + 0x10]
lea ecx, [esp + 0x2c]
add esi, esi
push ecx
lea ecx, [esp + 0x34]
push ecx
mov eax, dword [eax + esi*8 + 0xc]
add eax, 8
push eax
call fcn.0042fc70
add esp, 0xc
test eax, eax
je 0x44e8a3
mov eax, dword [eax + 8]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x44e8c1
jmp 0x44e8af
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x44e8af
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
inc ebp
cmp ebp, dword [edi + 0x14]
jl 0x44e803
test eax, eax
je 0x44e8e3
push dword [esp + 0x24]
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x34]
push dword [esp + 0x2c]
push eax
push ebx
push str.DELETE_FROM__Q._s_WHERE__s_Q
push esi
call fcn.00462680
add esp, 0x18
jmp 0x44e8e7
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x1c], eax
cmp eax, 4
jle 0x44e7d5
mov ecx, dword [esp + 0x48]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004bf6e8
add esp, 0x3c
ret
Function at 0x4588f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebp
push esi
mov esi, dword [esp + 0x14]
xor ebp, ebp
push edi
xor edi, edi
cmp dword [esi + 0x14], edi
jle 0x4589b9
push ebx
mov eax, dword [esi + 0x10]
mov ecx, edi
xor ecx, 1
cmp edi, 2
cmovae ecx, edi
add ecx, ecx
mov edx, dword [eax + ecx*8 + 0xc]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x24]
test edx, edx
je 0x45897d
mov eax, dword [eax + ecx*8]
test eax, eax
je 0x4589a5
mov bl, byte [edx]
test bl, bl
je 0x458965
mov esi, edx
mov cl, bl
sub esi, eax
nop dword [eax + eax]
movzx edx, byte [eax]
mov bl, cl
movzx ecx, cl
mov cl, byte [ecx + 0x4eb938]
cmp cl, byte [edx + 0x4eb938]
jne 0x458961
mov cl, byte [esi + eax + 1]
inc eax
mov bl, cl
test cl, cl
jne 0x458940
mov esi, dword [esp + 0x1c]
movzx eax, byte [eax]
movzx ecx, byte [eax + 0x4eb938]
movzx eax, bl
movzx eax, byte [eax + 0x4eb938]
sub eax, ecx
jne 0x4589a5
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push dword [esp + 0x24]
add eax, 0x18
push eax
call fcn.0042fc70
add esp, 0xc
test eax, eax
je 0x4589a3
mov ebp, dword [eax + 8]
test ebp, ebp
jne 0x4589af
jmp 0x4589a5
xor ebp, ebp
inc edi
cmp edi, dword [esi + 0x14]
jl 0x458908
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret
pop edi
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret

Function at 0x4589d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x10]
xor eax, eax
push edi
xor edi, edi
mov dword [esp + 8], eax
cmp dword [ebp + 0x14], eax
jle 0x458aa9
push ebx
mov ebx, dword [esp + 0x20]
push esi
mov esi, edi
xor esi, 1
cmp edi, 2
cmovae esi, edi
test ebx, ebx
je 0x458a62
mov eax, dword [ebp + 0x10]
mov ecx, esi
add ecx, ecx
mov edx, dword [eax + ecx*8]
test edx, edx
je 0x458a99
mov ecx, dword [esp + 0x24]
mov bl, byte [ecx]
test bl, bl
je 0x458a46
mov ebp, ecx
mov al, bl
sub ebp, edx
movzx ecx, byte [edx]
mov bl, al
movzx eax, al
mov al, byte [eax + 0x4eb938]
cmp al, byte [ecx + 0x4eb938]
jne 0x458a42
mov al, byte [edx + ebp + 1]
inc edx
mov bl, al
test al, al
jne 0x458a21
mov ebp, dword [esp + 0x1c]
movzx eax, byte [edx]
movzx ecx, byte [eax + 0x4eb938]
movzx eax, bl
mov ebx, dword [esp + 0x24]
movzx eax, byte [eax + 0x4eb938]
sub eax, ecx
jne 0x458a99
mov eax, dword [ebp + 0x10]
lea ecx, [esp + 0x14]
add esi, esi
push ecx
push dword [esp + 0x24]
mov eax, dword [eax + esi*8 + 0xc]
add eax, 8
push eax
call fcn.0042fc70
add esp, 0xc
test eax, eax
je 0x458a91
mov eax, dword [eax + 8]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x458aa7
jmp 0x458a9d
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x458a9d
mov eax, dword [esp + 0x10]
inc edi
cmp edi, dword [ebp + 0x14]
jl 0x4589f0
pop esi
pop ebx
pop edi
pop ebp
add esp, 8
ret
Function at 0x47ef60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x18]
movsx eax, word [edi + 0x4c]
mov ecx, dword [edi + 0x20]
movzx edx, word [edi + 0x28]
mov dword [esp + 0x10], ecx
mov eax, dword [edi + eax*4 + 0x78]
mov eax, dword [eax + 0x3c]
sub eax, ecx
lea ecx, [ebx + ebp]
cmp edx, eax
cmovae edx, eax
cmp ecx, edx
ja 0x47efb6
mov ecx, dword [esp + 0x10]
add ecx, ebp
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ecx
xor eax, eax
pop edi
mov ecx, 0x1010
mov word [esi + 8], cx
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, 1
mov word [esi + 8], ax
lea eax, [ebx + 2]
cmp dword [esi + 0x18], eax
jge 0x47efdd
push 0
push eax
push esi
call fcn.0047f060
add esp, 0xc
test eax, eax
je 0x47efe3
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esi + 0x14]
mov dword [esi + 0x10], eax
cmp dword [esp + 0x24], 0
mov eax, dword [esi + 0x10]
je 0x47effd
push 0
push eax
push ebx
push ebp
push edi
call fcn.0041e730
add esp, 0x14
jmp 0x47f009
push eax
push ebx
push ebp
push edi
call fcn.0044c080
add esp, 0x10
mov edi, eax
test edi, edi
jne 0x47f032
mov eax, dword [esi + 0x10]
mov byte [ebx + eax], 0
mov eax, dword [esi + 0x10]
mov byte [eax + ebx + 1], 0
mov eax, 0x210
mov word [esi + 8], ax
mov eax, edi
pop edi
mov dword [esi + 0xc], ebx
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, 0x2460
test word [esi + 8], ax
jne 0x47f043
cmp dword [esi + 0x18], 0
je 0x47f04c
push esi
call fcn.00488d80
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x485830
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
xor eax, eax
mov cl, byte [esi]
test cl, cl
je 0x48585e
nop dword [eax]
movzx ecx, cl
lea esi, [esi + 1]
movzx edx, byte [ecx + 0x4eb938]
lea ecx, [eax*8]
xor edx, ecx
mov cl, byte [esi]
xor eax, edx
test cl, cl
jne 0x485840
pop esi
ret

Function at 0x48a460
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push 0
push 0x14
mov dword [edi], 0
call fcn.00461dd0
mov esi, eax
add esp, 8
test esi, esi
jne 0x48a484
pop edi
lea eax, [esi + 7]
pop esi
ret
cmp dword [0x50a004], 0
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x18]
je 0x48a4bb
lea eax, [esi + 4]
mov dword [esi + 8], ebp
push eax
push 0
push esi
push 0x470b10
push 0
push 0
mov dword [esi + 0xc], ebx
call fcn.004c9aee
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x48a4c8
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x48a4e0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
mov dword [esi + 4], eax
call ebp
add esp, 4
mov dword [esi + 0x10], eax
pop ebp
pop ebx
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
ret
Function at 0x4a9b80
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e84c0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x50b0b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov esi, 0x1000
mov dword [ebp - 4], ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x4a9c34
lea eax, [ebp - 0x30]
push eax
push esi
push edi
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
je 0x4a9c24
mov eax, dword [ebp - 0x30]
cmp esi, eax
jne 0x4a9c67
add esi, esi
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x4a9c24
lea ecx, [ebp - 0x30]
mov edi, eax
push ecx
push esi
push eax
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
jne 0x4a9bf5
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x38]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bf6e8
mov esp, ebp
pop ebp
ret
shr eax, 2
mov dword [ebp - 0x34], 0
test eax, eax
je 0x4a9d46
mov esi, eax
nop dword [eax + eax]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 1
cmp dword [ebp + 0x10], eax
je 0x4a9cb7
lea eax, [ebp - 0x2c]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x4a9cfa
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ecx]
jne 0x4a9cfa
lea eax, [ebp - 0x28]
push eax
push dword [edi]
call fcn.004a9f70
add esp, 8
test al, al
je 0x4a9cfa
push dword [ebp - 0x3c]
lea eax, [ebp - 0x28]
push eax
call fcn.004aa400
add esp, 8
test al, al
je 0x4a9cfa
cmp ebx, dword [ebp - 0x40]
je 0x4a9ced
mov eax, dword [edi]
mov dword [ebx], eax
add ebx, 4
mov dword [ebp - 0x44], ebx
jmp 0x4a9cfa
push edi
push ebx
lea ecx, [ebp - 0x48]
call fcn.004a9950
mov ebx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 0
cmp edx, 8
jb 0x4a9d34
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4a9d2a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a9d5c
push edx
push ecx
call fcn.004bf27b
add esp, 8
mov ecx, dword [ebp - 0x34]
add edi, 4
inc ecx
mov dword [ebp - 0x34], ecx
cmp ecx, esi
jl 0x4a9c80
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x48]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x40]
mov dword [eax + 4], ebx
mov dword [eax + 8], ecx
jmp 0x4a9c4b
call fcn.004c4b9a
int3