joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10041740
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1006b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10041770
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049dd9
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x100417a0
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x100417a0
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049dd9
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x10041875
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100417c9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100417d5
movsx eax, bl
jmp 0x1004180c
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x10041875
cmp eax, 1
jle 0x10041836
cmp eax, 3
jne 0x10041875
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049dd9
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10041854
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10041875
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x10041875
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049dd9
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10049dd9
mov esp, ebp
pop ebp
ret 4
Function at 0x10045170
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1006b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1004522c
cmp byte [esi + 0x3d], 0
je 0x1004522c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1004521a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x100451e1
sub eax, 1
je 0x100451e5
sub eax, 2
jne 0x1004521a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049dd9
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10045203
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1004521a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049dd9
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049dd9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.10049dd9
mov esp, ebp
pop ebp
ret
Function at 0x10049b70
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100530ed
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x1006b00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x84]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push eax
mov byte [ebp - 0x84], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x67452301
mov dword [ebp - 0x34], 0xefcdab89
mov dword [ebp - 0x30], 0x98badcfe
mov dword [ebp - 0x2c], 0x10325476
call fcn.10049a10
cmp byte [ebp - 0x84], 0
jne 0x10049cc1
xor edx, edx
lea ecx, [ebp - 0x3f]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x18], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x17], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x16], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x15], al
add edx, 4
cmp edx, 8
jb 0x10049c05
mov edx, dword [ebp - 0x40]
mov ecx, 0x78
shr edx, 3
mov eax, 0x38
and edx, 0x3f
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovae eax, ecx
lea ecx, [ebp - 0x84]
push eax
push 0x1006b6e0
call fcn.10049a10
push 8
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x84]
call fcn.10049a10
xor edx, edx
lea ecx, [ebp - 0x37]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x28], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x27], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x26], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x25], al
add edx, 4
cmp edx, 0x10
jb 0x10049c74
push 0x40
lea eax, [ebp - 0x83]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
mov byte [ebp - 0x84], 1
add esp, 0xc
movq qword [ebp - 0x40], xmm0
push esi
lea ecx, [ebp - 0x84]
call fcn.10049ac0
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x10049d03
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10049cf9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10049cf9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1004a628
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10049dd9
mov esp, ebp
pop ebp
ret
Function at 0x406e95
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [eax], 0x20000000
mov dword [ebp - 4], edi
jne 0x406fdc
push ebx
push esi
push 4
pop esi
add eax, esi
mov ecx, dword [eax]
cmp ecx, 0x40020000
jne 0x406f3b
add eax, esi
mov ecx, dword [eax]
xor edx, edx
cmp ecx, 0x40000001
je 0x406ee5
cmp ecx, 0x40010001
je 0x406ee5
cmp ecx, 0x40020001
je 0x406ee5
cmp ecx, 0x40030001
jne 0x406ef0
shr ecx, 0x10
and ecx, 0xf
inc ecx
mov edx, ecx
add eax, esi
cmp dword [eax], 0x40050002
jne 0x406f02
inc edx
mov dword [ebp - 4], 0x1000
add eax, esi
mov ecx, edx
sub ecx, edi
je 0x406f35
dec ecx
je 0x406f2f
dec ecx
je 0x406f29
dec ecx
je 0x406f23
dec ecx
je 0x406f1d
dec ecx
jne 0x406f48
or dword [ebp - 4], 0xe
jmp 0x406f48
or dword [ebp - 4], 0xc
jmp 0x406f48
or dword [ebp - 4], 0xa
jmp 0x406f48
or dword [ebp - 4], 8
jmp 0x406f48
or dword [ebp - 4], 6
jmp 0x406f48
or dword [ebp - 4], 2
jmp 0x406f48
cmp ecx, 0x40030000
jne 0x406f48
mov dword [ebp - 4], esi
add eax, esi
cmp dword [eax], 0x40020003
push 0x10
pop ecx
jne 0x406f58
or dword [ebp - 4], ecx
add eax, esi
cmp dword [eax], 0x40000004
jne 0x406f66
or dword [ebp - 4], 0x20
add eax, esi
cmp dword [eax], 0x40040005
jne 0x406f74
or dword [ebp - 4], 0x40
add eax, esi
cmp dword [eax], 0x40040006
jne 0x406f82
or byte [ebp - 4], 0x80
add eax, esi
push 7
pop esi
mov edx, dword [eax]
mov ebx, esi
or ebx, 0x40000000
cmp ebx, edx
jne 0x406f97
push 3
jmp 0x406fc2
mov ebx, esi
or ebx, 0x40010000
cmp ebx, edx
je 0x406fc8
mov ebx, esi
or ebx, 0x40020000
cmp ebx, edx
jne 0x406fb4
xor edx, edx
inc edx
jmp 0x406fc3
mov ebx, esi
or ebx, 0x40030000
cmp ebx, edx
jne 0x406fd4
push 2
pop edx
shl edx, cl
or dword [ebp - 4], edx
add eax, 4
inc edi
inc ecx
inc ecx
inc esi
cmp ecx, 0x20
jb 0x406f85
shl edi, 8
or dword [ebp - 4], edi
pop esi
pop ebx
cmp dword [eax], 0xffffffff
pop edi
je 0x406fe9
mov eax, 0x8876086c
jmp 0x406ff3
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
xor eax, eax
leave
ret 8

Function at 0x41040c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x6220c0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x410464
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x410464
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x410464
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret
Function at 0x41048d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push 0x6220c0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x4104fb
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push str.DisableMMX
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4104f2
cmp dword [ebp - 0xc], 4
jne 0x4104f2
cmp dword [ebp - 0x10], edi
je 0x4104f2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x69245c], edi
xor eax, eax
jmp 0x410523
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x69245c], edi
jge 0x41051e
mov dword [0x69245c], edi
call fcn.00410468
test eax, eax
je 0x41051e
emms
mov dword [0x69245c], 1
mov eax, dword [0x69245c]
pop edi
leave
ret

Function at 0x410603
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
push ebx
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
xor bl, bl
and byte [ebp + 0x73], bl
push eax
mov dword [ebp - 0x24], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x41063a
inc bl
mov byte [ebp + 0x73], 1
cmp dword [ebp - 0x14], 1
jne 0x41065c
cmp dword [ebp - 0x20], 4
ja 0x410666
jne 0x410656
cmp dword [ebp - 0x1c], 0xa
jb 0x410656
cmp word [ebp - 0x18], 0x55d
jae 0x410666
mov byte [ebp + 0x73], 1
jmp 0x410666
cmp dword [ebp - 0x14], 2
jne 0x41067c
test bl, bl
je 0x410697
mov eax, dword [ebp + 0x7c]
sub eax, 6
je 0x410687
dec eax
je 0x410680
sub eax, 3
jne 0x41067c
cmp byte [ebp + 0x73], 0
je 0x4106a8
xor eax, eax
jmp 0x4106b0
call fcn.00410526
jmp 0x4106b0
cmp byte [ebp + 0x73], 0
jne 0x41067c
call fcn.0041055e
and eax, 4
jmp 0x4106b0
cmp dword [ebp + 0x7c], 0xa
je 0x4106a8
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
jmp 0x4106b0
call fcn.0041055e
and eax, 8
pop edi
pop ebx
add ebp, 0x74
leave
ret
Function at 0x42dbb3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x42dbc1
xor eax, eax
pop ebp
ret
cmp dword [ebp + 0x10], 8
push esi
mov esi, dword [ebp + 8]
not esi
mov ecx, 0xff
jb 0x42dc95
mov eax, dword [ebp + 0x10]
push ebx
shr eax, 3
push edi
xor ebx, ebx
mov bl, byte [edx]
mov edi, esi
shr edi, 8
sub dword [ebp + 0x10], 8
xor ebx, esi
and ebx, ecx
mov esi, dword [ebx*4 + 0x6246d8]
xor ebx, ebx
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x6246d8]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x6246d8]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x6246d8]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x6246d8]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x6246d8]
shr esi, 8
xor edi, esi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x6246d8]
shr edi, 8
xor esi, edi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x6246d8]
shr esi, 8
xor esi, edi
inc edx
dec eax
jne 0x42dbde
pop edi
pop ebx
cmp dword [ebp + 0x10], 0
je 0x42dcb5
xor eax, eax
mov al, byte [edx]
xor eax, esi
and eax, ecx
mov eax, dword [eax*4 + 0x6246d8]
shr esi, 8
xor esi, eax
inc edx
dec dword [ebp + 0x10]
jne 0x42dc9b
mov eax, esi
not eax
pop esi
pop ebp
ret
Function at 0x4401f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
lea eax, [ebp - 4]
mov ebx, ecx
push eax
push 1
call dword [sym.imp.DevIL.dll_ilGenImages]
push dword [ebp - 4]
call dword [sym.imp.DevIL.dll_ilBindImage]
push 0x600
call dword [sym.imp.DevIL.dll_ilEnable]
push 0x602
call dword [sym.imp.DevIL.dll_ilOriginFunc]
mov edi, dword [ebp + 8]
push edi
push 0
call dword [sym.imp.DevIL.dll_ilLoad]
test al, al
jne 0x440246
mov eax, dword [ebp + 0xc]
pop edi
pop ebx
mov dword [eax], 2
xor al, al
mov esp, ebp
pop ebp
ret 8
push esi
mov esi, dword [sym.imp.DevIL.dll_ilGetInteger]
push 0xde4
call esi
cmp eax, 0x40
je 0x44026d
mov eax, dword [ebp + 0xc]
pop esi
pop edi
pop ebx
mov dword [eax], 3
xor al, al
mov esp, ebp
pop ebp
ret 8
push 0xde5
call esi
cmp eax, 0x80
je 0x44028f
mov eax, dword [ebp + 0xc]
pop esi
pop edi
pop ebx
mov dword [eax], 4
xor al, al
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 4]
push eax
push 1
call dword [sym.imp.DevIL.dll_ilDeleteImages]
call dword [sym.imp.DevIL.dll_ilShutDown]
push 0x646ec4
push edi
call fcn.005afd8b
mov esi, eax
add esp, 8
test esi, esi
jne 0x4402be
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 2
push 2
push 0
push esi
call fcn.005b0549
push esi
call fcn.005b0c6d
push 0
push 0
push esi
mov dword [ebx + 0x394], eax
call fcn.005b0549
push dword [ebx + 0x394]
call fcn.00569ca5
push esi
push 1
push dword [ebx + 0x394]
mov dword [ebx + 0x39c], eax
push eax
call fcn.005b0e76
push esi
call fcn.005b01f6
push edi
call fcn.004c44c0
add esp, 0x38
mov dword [ebx + 0x398], eax
mov al, 1
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4479a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp ecx, edx
mov eax, edx
cmovbe eax, ecx
cmovbe ecx, edx
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
mov dword [ebp - 4], ecx
xor eax, eax
nop dword [eax + eax]
movzx ecx, byte [edx]
inc edx
imul eax, eax, 0x1000193
xor eax, ecx
lea ecx, [ebp]
cmp edx, ecx
jb 0x4479c0
mov esp, ebp
pop ebp
ret
Function at 0x44bb90
Capabilities:
Access peb ldr_data
Create directory
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6039a4
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x6963c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [0x6e6e44], edi
mov dword [ebp - 4], 0
lea esi, [edi + 4]
mov dword [edi], vtable.CGuildMarkManager.0
mov dword [ebp - 0x10], esi
push 0x18
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00569c41
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov byte [ebp - 4], 1
lea esi, [edi + 0xc]
mov dword [ebp - 0x10], esi
push 0x18
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00569c41
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
add edi, 0x14
mov byte [ebp - 4], 2
mov dword [ebp - 0x10], edi
push 0x14
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.00569c41
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
xorps xmm0, xmm0
movups xmmword [eax + 0x1c], xmm0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0xf
mov byte [eax + 0x1c], 0
lea esi, [eax + 0x34]
mov byte [ebp - 4], 4
mov dword [ebp - 0x10], esi
push 0x24
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00569c41
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
push str.mark
mov byte [ebp - 4], 5
call fcn.005b8d1b
add esp, 0x14
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00449280
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, 0x1900
jb 0x44bcb7
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44d8f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044d900

Function at 0x44d900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi + 0x20]
mov byte [edi + 0x20], al
lea ecx, [edi + 0x18]
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [edi + 0x40], eax
mov eax, dword [esi + 0x44]
mov dword [edi + 0x44], eax
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
mov eax, dword [esi + 0x4c]
mov dword [edi + 0x4c], eax
mov eax, dword [esi + 0x50]
mov dword [edi + 0x50], eax
mov eax, dword [esi + 0x54]
mov dword [edi + 0x54], eax
lea eax, [esi + 0x18]
push eax
call fcn.0043d860
mov eax, dword [esi + 0x58]
mov dword [edi + 0x58], eax
mov eax, dword [esi + 0x5c]
mov dword [edi + 0x5c], eax
mov eax, dword [esi + 0x60]
mov dword [edi + 0x60], eax
mov eax, dword [esi + 0x64]
mov dword [edi + 0x64], eax
mov eax, dword [esi + 0x68]
mov dword [edi + 0x68], eax
mov eax, dword [esi + 0x6c]
mov dword [edi + 0x6c], eax
mov eax, dword [esi + 0x70]
mov dword [edi + 0x70], eax
mov ax, word [esi + 0x74]
mov word [edi + 0x74], ax
movzx eax, byte [esi + 0x76]
mov byte [edi + 0x76], al
mov eax, dword [esi + 0x78]
mov dword [edi + 0x78], eax
mov eax, dword [esi + 0x7c]
mov dword [edi + 0x7c], eax
mov eax, dword [esi + 0x80]
mov dword [edi + 0x80], eax
cmp edi, esi
je 0x44d9d4
cmp dword [esi + 0x14], 0xf
mov eax, dword [esi + 0x10]
jbe 0x44d9cb
mov esi, dword [esi]
push eax
push esi
mov ecx, edi
call fcn.0043d3e0
pop edi
pop esi
pop ebp
ret 4
Function at 0x44ebe0
Capabilities:
Enumerate process modules

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x603bad
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x250
mov eax, dword [0x6963c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x260], edx
mov dword [ebp - 0x25c], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x44edaf
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
call fcn.004c3780
push 0x220
lea eax, [ebp - 0x254]
push 0
push eax
call fcn.005a5b00
add esp, 0x10
mov dword [ebp - 0x258], 0x224
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x44ecf7
mov edi, dword [sym.imp.KERNEL32.dll_Module32Next]
nop dword [eax + eax]
cmp dword [ebp - 0x18], 0xf
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x138]
cmova edx, dword [ebp - 0x2c]
call fcn.0044eb90
test eax, eax
jne 0x44ed32
push 0x220
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.005a5b00
add esp, 0xc
mov dword [ebp - 0x258], 0x224
lea eax, [ebp - 0x258]
push eax
push esi
call edi
test eax, eax
jne 0x44ecb0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xf
jbe 0x44edaf
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x44eda5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44edcf
jmp 0x44eda5
lea edx, [ebp - 0x138]
lea edi, [edx + 1]
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x44ed40
mov ecx, dword [ebp - 0x25c]
lea eax, [ebp - 0x138]
sub edx, edi
push edx
push eax
call fcn.0043d3e0
mov ecx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x244]
push esi
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xf
jbe 0x44eda1
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x44ed97
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44edcf
push ecx
push edx
call fcn.00569c33
add esp, 8
mov al, 1
jmp 0x44edb1
push ecx
push edx
call fcn.00569c33
add esp, 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00569c25
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.005afb50
int3