joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e3c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 0xc], ecx
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
jne 0x43e3fd
mov eax, dword [ebp - 4]
add eax, 4
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x43edc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
je 0x43e40f
mov dword [ebp - 8], 1
jmp 0x43e416
mov dword [ebp - 8], 0
mov al, byte [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x4444f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x57f7a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x80c], ecx
mov eax, dword [ebp - 0x80c]
cmp dword [eax], 0
jne 0x44453c
mov ecx, dword [ebp + 8]
call fcn.004075d0
push eax
push 0x5565b0
push 0xd9
push 0x5565f0
call fcn.00439030
add esp, 0x10
or eax, 0xffffffff
jmp 0x4445c1
mov ecx, dword [ebp + 8]
call fcn.00407460
mov dword [ebp - 0x810], 0x800
lea edx, [ebp - 0x810]
push edx
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0x814]
push ecx
push 0
mov ecx, dword [ebp + 8]
call fcn.004075d0
push eax
mov edx, dword [ebp - 0x80c]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x808], eax
cmp dword [ebp - 0x808], 0
jne 0x44459d
lea ecx, [ebp - 0x804]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.004058b0
jmp 0x4445bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.read_reg_lastError___d
push 0xec
push str.utility::RegKeyEx::RegRead
call fcn.00439030
add esp, 0x10
mov eax, dword [ebp - 0x808]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ea604
mov esp, ebp
pop ebp
ret 8

Function at 0x4448f0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.004075d0
push eax
mov ecx, dword [ebp + 8]
call fcn.004075d0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x444919
mov al, 1
jmp 0x444956
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
movzx edx, byte [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.004075d0
push eax
mov ecx, dword [ebp + 8]
call fcn.004075d0
push eax
push str.copy_file_from____s___to____s___flag___d_failed__error___d.
push 0x103
push str.utility::ufile::copyFile
call fcn.00439030
add esp, 0x1c
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x445070
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x57f7a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x22c], 0
xor eax, eax
mov word [ebp - 0x210], ax
push 0x208
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.004f31f0
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x228]
call fcn.00407570
lea ecx, [ebp - 0x228]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004073f0
mov edx, dword [ebp - 0x22c]
or edx, 1
mov dword [ebp - 0x22c], edx
lea ecx, [ebp - 0x228]
call fcn.00407e10
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ea604
mov esp, ebp
pop ebp
ret

Function at 0x446070
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x3c], 0
push 0x38
push 0
lea eax, [ebp - 0x38]
push eax
call fcn.004f31f0
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x440
mov dword [ebp - 0x30], 0x5573a4
mov ecx, dword [ebp + 8]
call fcn.004075d0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], 5
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x4460e1
push 5
push 0
mov ecx, dword [ebp + 8]
call fcn.004075d0
push eax
push 0x55747c
push 0x557498
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret
Function at 0x4460f0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52bb5b
mov eax, dword fs:[0]
push eax
sub esp, 0x44c
mov eax, dword [0x57f7a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x557970
lea ecx, [ebp - 0x440]
call fcn.00407570
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x440]
call fcn.00413390
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea ecx, [ebp - 0x440]
call fcn.004075d0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x444], 0xffffffff
jne 0x446198
mov dword [ebp - 0x450], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x440]
call fcn.00407e10
mov eax, dword [ebp - 0x450]
jmp 0x446272
mov byte [ebp - 0x410], 0
push 0x3ff
push 0
lea ecx, [ebp - 0x40f]
push ecx
call fcn.004f31f0
add esp, 0xc
lea edx, [ebp - 0x410]
mov dword [ebp - 0x454], edx
mov eax, dword [ebp - 0x454]
mov dword [eax + 4], 0x400
mov dword [ebp - 0x44c], 0
mov dword [ebp - 0x41c], 8
mov dword [ebp - 0x418], 0
mov byte [ebp - 0x420], 0
push 0
lea ecx, [ebp - 0x44c]
push ecx
push 0xc
lea edx, [ebp - 0x428]
push edx
push 0xc
lea eax, [ebp - 0x41c]
push eax
push 0x2d1400
mov ecx, dword [ebp - 0x444]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
movzx edx, byte [ebp - 0x420]
cmp edx, 1
jne 0x446250
mov dword [ebp - 0x448], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x440]
call fcn.00407e10
mov eax, dword [ebp - 0x448]
jmp 0x446272
mov dword [ebp - 0x458], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x440]
call fcn.00407e10
mov eax, dword [ebp - 0x458]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ea604
mov esp, ebp
pop ebp
ret
Function at 0x446290
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52bb98
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x57f7a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x555e2a
lea ecx, [ebp - 0x28]
call fcn.0040e5e0
mov dword [ebp - 4], 0
mov dword [ebp - 0x40], 0x34
push 0
mov ecx, dword [ebp + 8]
call fcn.004075d0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x4463c2
mov dword [ebp - 0x2c], 0
cmp dword [ebp - 0x2c], 0
jne 0x446315
mov eax, dword [ebp - 0x34]
push eax
call fcn.0049d11c
add esp, 4
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x2c], ecx
jmp 0x4462f8
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x34]
push eax
push 0
mov ecx, dword [ebp + 8]
call fcn.004075d0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4463b0
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x30]
push edx
push 0x557b30
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x4463b0
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0xc]
and edx, 0xffff
movzx eax, dx
push eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0xc]
shr edx, 0x10
and edx, 0xffff
movzx eax, dx
push eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 8]
and edx, 0xffff
movzx eax, dx
push eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 8]
shr edx, 0x10
and edx, 0xffff
movzx eax, dx
push eax
push str._d._d._d._d
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.004f0fca
add esp, 0x18
mov edx, dword [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x28]
call fcn.00414e40
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
push ecx
call fcn.004db8b0
add esp, 4
lea edx, [ebp - 0x28]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.0043d350
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040eaf0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ea604
mov esp, ebp
pop ebp
ret
Function at 0x446d10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52bc18
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x57f7a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movzx eax, byte [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.004075d0
push eax
mov ecx, dword [ebp + 8]
call fcn.004075d0
push eax
push str.createProcess_filename____s___param____s___show___d
push 0xed
push str.utility::process::create
call fcn.00439030
add esp, 0x18
mov ecx, dword [ebp + 8]
push ecx
mov edx, 0x558894
lea ecx, [ebp - 0x58]
call fcn.00414440
add esp, 4
mov dword [ebp - 0x68], eax
mov edx, dword [ebp - 0x68]
mov dword [ebp - 0x64], edx
mov dword [ebp - 4], 0
push 0x558890
mov eax, dword [ebp - 0x64]
push eax
lea ecx, [ebp - 0x28]
push ecx
call fcn.00414100
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
call fcn.00407e10
mov ecx, dword [ebp + 0xc]
call fcn.00407460
movzx edx, al
test edx, edx
jne 0x446df6
mov eax, dword [ebp + 0xc]
push eax
mov edx, 0x558898
lea ecx, [ebp - 0x40]
call fcn.00414440
add esp, 4
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x80], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x80]
push edx
lea ecx, [ebp - 0x28]
call fcn.0040a660
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.00407e10
mov dword [ebp - 0xc8], 0
push 0x40
push 0
lea eax, [ebp - 0xc4]
push eax
call fcn.004f31f0
add esp, 0xc
mov dword [ebp - 0xc8], 0x44
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0x9c], 1
movzx ecx, byte [ebp + 0x10]
test ecx, ecx
je 0x446e56
mov dword [ebp - 0x5c], 5
jmp 0x446e5d
mov dword [ebp - 0x5c], 0
mov dx, word [ebp - 0x5c]
mov word [ebp - 0x98], dx
xor eax, eax
mov word [ebp - 0x96], ax
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x7c], 0
xor ecx, ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], ecx
lea edx, [ebp - 0x7c]
push edx
lea eax, [ebp - 0xc8]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.004075d0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x446ef2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x5588b8
push 0x100
push 0x55889c
call fcn.00439030
add esp, 0x10
mov dword [ebp - 0x60], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00407e10
mov eax, dword [ebp - 0x60]
jmp 0x446f28
mov ecx, dword [ebp - 0x78]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x14], 0
je 0x446f0a
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x74]
mov dword [edx], eax
mov ecx, dword [ebp - 0x7c]
mov dword [ebp - 0x84], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00407e10
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ea604
mov esp, ebp
pop ebp
ret
Function at 0x446f50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push eax
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x446f96
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.kill32_h_is_null_pid___d_error___d
push 0x10f
push 0x558954
call fcn.00439030
add esp, 0x14
xor al, al
jmp 0x446fea
push 0xffffffffffffffff
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x446fcd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp + 8]
push eax
push str.kill32_progress_failed_pid___d_lasterror___d
push 0x115
push str.utility::process::kill32
call fcn.00439030
add esp, 0x14
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc], 0
je 0x446fe3
mov byte [ebp - 1], 1
jmp 0x446fe7
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x446ff0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52bc58
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x57f7a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x58]
call fcn.00447d20
mov dword [ebp - 4], 0
push str.tskill.exe
lea ecx, [ebp - 0x28]
call fcn.00407570
mov byte [ebp - 4], 1
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x40]
call fcn.0041af20
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x48], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 0xc]
push ecx
push 0
mov edx, dword [ebp - 0x48]
push edx
lea eax, [ebp - 0x28]
push eax
call fcn.00446c00
add esp, 0x10
mov byte [ebp - 0x41], al
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.00407e10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00407e10
movzx ecx, byte [ebp - 0x41]
test ecx, ecx
jne 0x4470de
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.tskill.exe_error_lastError___d
push 0x198
push str.utility::process::kill
call fcn.00439030
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4470de
cmp dword [ebp + 0xc], 0xffffffff
jne 0x4470c5
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4470cf
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 8]
push eax
call fcn.00446f50
add esp, 4
mov byte [ebp - 0x41], al
mov cl, byte [ebp - 0x41]
mov byte [ebp - 0x42], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00447cf0
mov al, byte [ebp - 0x42]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ea604
mov esp, ebp
pop ebp
ret
Function at 0x447110
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52bc88
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x57f7a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x447183
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x264]
push eax
push 0x559110
push 0x200
push 0x559168
call fcn.00439030
add esp, 0x10
jmp 0x447245
mov dword [ebp - 0x258], 0x22c
lea ecx, [ebp - 0x258]
push ecx
mov edx, dword [ebp - 0x25c]
push edx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x4471de
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x260]
push eax
push 0x559188
push 0x20d
push str.utility::process::enumProcess
call fcn.00439030
add esp, 0x10
mov ecx, dword [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x447245
lea ecx, [ebp - 0x2c]
call fcn.00447260
mov dword [ebp - 4], 0
lea edx, [ebp - 0x234]
push edx
lea ecx, [ebp - 0x2c]
call fcn.004058b0
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00447590
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00447280
lea edx, [ebp - 0x258]
push edx
mov eax, dword [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4471de
mov ecx, dword [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ea604
mov esp, ebp
pop ebp
ret
Function at 0x4472a0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x57f7a0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xffffffff
jne 0x4472fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x23c]
push eax
push str.create_tool_help_snapshot_failed__err___d
push 0x223
push 0x5590bc
call fcn.00439030
add esp, 0x10
jmp 0x4473a6
mov dword [ebp - 0x230], 0x22c
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x447356
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x238], eax
mov eax, dword [ebp - 0x238]
push eax
push str.process32First_failed__err___d
push 0x230
push str.utility::process::getProcessRunningMac
call fcn.00439030
add esp, 0x10
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4473a6
lea edx, [ebp - 0x228]
push edx
lea edx, [ebp - 0x20c]
lea ecx, [ebp - 0x24c]
call fcn.004143f0
add esp, 4
push eax
lea eax, [ebp - 0x244]
push eax
mov ecx, dword [ebp + 8]
call fcn.00414410
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x447356
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ea604
mov esp, ebp
pop ebp
ret

Function at 0x447d20
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0
push str.GetNativeSystemInfo
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x447d6f
lea eax, [ebp - 0x2c]
push eax
call dword [ebp - 8]
jmp 0x447d79
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx edx, word [ebp - 0x2c]
cmp edx, 9
je 0x447d8b
movzx eax, word [ebp - 0x2c]
cmp eax, 6
jne 0x447dda
push str.Wow64DisableWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
push str.Wow64RevertWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x447dda
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x447e30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x447e44
xor al, al
jmp 0x447e88
mov ecx, dword [ebp - 4]
mov byte [ecx + 0xc], 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0x447f30
push 0
push 0
call fcn.004eb543
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x447e90
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x447ee5
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x102
jne 0x447ece
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x447f06
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov eax, dword [ebp - 4]
mov edx, dword [edx]
mov ecx, dword [eax]
mov eax, dword [edx]
call eax
mov ecx, dword [ebp - 4]
mov dword [ecx], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
je 0x447f26
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0
mov esp, ebp
pop ebp
ret 4
Function at 0x44c3d0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52c362
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x57f7a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
mov dword [esi], 0x560fc8
mov dword [esi + 0x70], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
push 0
push 0
lea edi, [esi + 0x10]
mov dword [ebp - 4], 0
push edi
mov dword [ebp - 0x10], 1
call fcn.004455a0
mov dword [ebp - 4], 1
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ecx + esi - 4], eax
mov ecx, edi
call fcn.00417160
lea eax, [edi + 4]
mov dword [edi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [edi + 0xc], eax
lea ecx, [edi + 8]
lea eax, [edi + 0x14]
mov byte [edi + 0x4c], 0
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov byte [edi + 0x45], 0
mov dword [edi + 0x10], ecx
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, dword [0x589340]
mov dword [edi + 0x50], 0
mov dword [edi + 0x48], eax
mov dword [edi + 0x40], 0
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 2
cmp dword [ecx + 0x14], 8
jb 0x44c4db
mov ecx, dword [ecx]
mov eax, dword [ebp + 0xc]
push 0x40
or eax, 1
push eax
push ecx
mov ecx, edi
call fcn.004170a0
test eax, eax
jne 0x44c50f
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + esi + 0xc]
add ecx, esi
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x44c507
or eax, 4
push 0
push eax
call fcn.00417c00
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x44f780
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ecx
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x58c980], ecx
inc eax
cmp eax, 0x100
jb 0x44f783
cmp eax, 0x800
jae 0x44f853
nop
mov edx, dword [eax*4 + 0x58c580]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x58c980]
mov dword [eax*4 + 0x58c980], edx
inc eax
cmp eax, 0x800
jb 0x44f830
mov dword [0x58e980], 0x4513c0
mov dword [0x58c968], 0x4513c0
mov dword [0x58e984], 0x451460
call fcn.00451670
mov ecx, dword [0x58c968]
test eax, eax
mov edx, 0x451460
cmove ecx, edx
mov dword [0x58c968], ecx
pop ecx
ret