joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008b37
Capabilities:
Acquire debug privileges
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
push esi
push edi
push 0x49
xor esi, esi
pop ecx
xor eax, eax
and byte [ebp - 0x240], al
lea edi, [ebp - 0x138]
mov dword [ebp - 0x13c], esi
push 0x40
rep stosd dword es:[edi], eax
pop ecx
lea edi, [ebp - 0x23f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 1
mov dword [ebp - 0x10], esi
pop edi
push edi
push 0x100158e4
call fcn.10008d22
pop ecx
pop ecx
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x10008b95
xor eax, eax
jmp 0x10008d1e
push ebx
push 0x400
push 0x40
mov dword [ebp - 0x13c], 0x128
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
lea eax, [ebp - 0x13c]
push eax
mov dword [ebp - 0xc], ebx
push dword [ebp - 8]
mov byte [ebx], 0x7d
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10008cf8
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [ebp - 0x134]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp dword [ebp - 0x134], 0
mov dword [ebp - 4], eax
je 0x10008ce1
cmp dword [ebp - 0x134], 4
je 0x10008ce1
cmp dword [ebp - 0x134], 8
je 0x10008ce1
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push 4
push ecx
push eax
call fcn.100105ab
lea eax, [ebp - 0x240]
push 0x104
push eax
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.10010599
lea eax, [ebp - 0x118]
push eax
call esi
mov ebx, eax
lea eax, [ebp - 0x240]
push eax
call esi
lea eax, [ebx + eax + 6]
mov ebx, dword [ebp - 0xc]
add eax, edi
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LocalSize]
cmp eax, dword [ebp - 4]
jae 0x10008c73
push 0x42
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov ebx, eax
mov dword [ebp - 0xc], ebx
lea eax, [ebp - 0x134]
push 4
push eax
lea eax, [edi + ebx]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x118]
add edi, 4
push eax
call esi
inc eax
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [edi + ebx]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call esi
lea edi, [edi + eax + 1]
lea eax, [ebp - 0x240]
push eax
call esi
inc eax
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [edi + ebx]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x240]
push eax
call esi
lea edi, [edi + eax + 1]
lea eax, [ebp - 0x13c]
push eax
push dword [ebp - 8]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10008bd2
push 0x42
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
push 0
push 0x100158e4
mov esi, eax
call fcn.10008d22
pop ecx
pop ecx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop ebx
pop edi
pop esi
leave
ret
Function at 0x10008f19
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov al, byte [ebp + 0x20]
mov byte [ebp - 8], al
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push dword [ebp + 0x1c]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push dword [ebp + 0x18]
push eax
push 0x10008eb5
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
leave
ret

Function at 0x10008f7a
Capabilities:
Enumerate processes

Disassembly:
push ebx
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, 0x128
mov ebx, eax
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov esi, eax
push esi
push ebx
mov dword [esi], edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10008fd4
push dword [esp + 0x10]
lea edi, [esi + 0x24]
push edi
call dword [sym.imp.MSVCRT.dll__strcmpi]
pop ecx
pop ecx
jmp 0x10008fcb
push esi
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x10008fd4
push dword [esp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x10008fb5
mov eax, dword [esi + 8]
jmp 0x10008fd6
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x10009186
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push ebx
push esi
push 0x10015c80
push 0x10015c74
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor esi, esi
pop ebx
mov dword [ebp - 0x10], eax
push esi
push esi
push esi
push esi
push 0x10015c4c
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0xc], ebx
call dword [0x100173b8]
cmp eax, esi
mov dword [ebp - 0x14], eax
je 0x100091e8
push esi
push 0x80000000
push esi
push esi
push dword [ebp + 8]
push eax
call dword [0x100173b0]
cmp eax, esi
mov dword [ebp - 8], eax
jne 0x100091ef
xor al, al
jmp 0x10009289
push edi
push esi
push esi
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x10009270
mov edi, 0x400
push edi
lea eax, [ebp - 0x418]
push esi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x418]
push edi
push eax
push dword [ebp - 8]
call dword [ebp - 0x10]
cmp ebx, esi
je 0x10009243
cmp word [ebp - 0x418], 0x5a4d
jne 0x10009264
lea eax, [ebp - 0x18]
push esi
push eax
lea eax, [ebp - 0x418]
push dword [ebp - 4]
xor ebx, ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 4], esi
jbe 0x10009267
jmp 0x10009211
mov dword [ebp - 0xc], esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 8]
mov edi, dword [0x100173b4]
call edi
push dword [ebp - 0x14]
call edi
xor eax, eax
cmp dword [ebp - 0xc], esi
pop edi
setne al
pop esi
pop ebx
leave
ret
Function at 0x1000993b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x100108b6
call fcn.1000fed4
sub esp, 0x18
push ebx
push esi
mov esi, ecx
call fcn.100092df
test al, al
je 0x100099cf
push 0x18
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
xor ebx, ebx
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x10009974
call fcn.1000952a
mov ecx, eax
jmp 0x10009976
xor ecx, ecx
mov eax, dword [esi + 0x20]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
mov dword [esi + 0x14], ecx
je 0x1000998f
mov edx, dword [esi + 0x24]
cmp edx, ebx
je 0x1000998f
push edx
push eax
jmp 0x100099c3
push 0x120
push 0x160
call fcn.1000935e
cmp al, bl
mov byte [ebp - 0xd], al
jne 0x100099d3
mov ecx, dword [esi + 0x14]
push 0x90
push 0xb0
call fcn.1000935e
cmp al, bl
mov byte [ebp - 0xd], al
jne 0x100099d3
mov ecx, dword [esi + 0x14]
push ebx
push ebx
call fcn.1000935e
cmp al, bl
mov byte [ebp - 0xd], al
jne 0x100099d3
xor al, al
jmp 0x10009a51
push edi
mov dword [ebp - 0x24], 0x3336324d
mov dword [ebp - 0x20], 0x32335649
mov dword [ebp - 0x1c], 0x3234504d
mov dword [ebp - 0x18], 0x64697663
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x24]
push 0x78
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x10009a0d
mov dword [eax], 0x100112d8
mov dword [eax + 0x48], ebx
jmp 0x10009a0f
xor eax, eax
push dword [edi]
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x18], eax
push dword [ecx + 8]
mov ecx, eax
call fcn.10009a5f
test al, al
jne 0x10009a43
mov ecx, dword [esi + 0x18]
cmp ecx, ebx
je 0x10009a32
mov eax, dword [ecx]
push 1
call dword [eax]
inc dword [ebp - 0x14]
add edi, 4
cmp dword [ebp - 0x14], 4
mov dword [esi + 0x18], ebx
jb 0x100099f6
jmp 0x10009a4d
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x24]
mov dword [esi + 0x1c], eax
mov al, byte [ebp - 0xd]
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x401160
Capabilities:
Create directory
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44c
mov eax, dword [0x41a004]
xor eax, esp
mov dword [esp + 0x448], eax
push ebx
push esi
mov ebx, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x4013b4
test edi, edi
je 0x4013b4
push edi
call fcn.00405a2f
push 0x104
lea eax, [esp + 0x350]
push 0
push eax
call fcn.004034c0
push 0x104
lea eax, [esp + 0x254]
push 0
push eax
call fcn.004034c0
push 0x104
lea eax, [esp + 0x158]
push 0
push eax
call fcn.004034c0
push ebx
lea eax, [esp + 0x374]
push 0x104
push eax
call fcn.00405972
push str..
lea eax, [esp + 0x380]
push 0x104
push eax
call fcn.004059cc
add esp, 0x40
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x34c]
push eax
call fcn.004056ac
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
je 0x40139a
push ebx
lea eax, [esp + 0x244]
push 0x104
push eax
call fcn.00405972
push 0x418040
lea eax, [esp + 0x250]
push 0x104
push eax
call fcn.004059cc
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x25c]
push 0x104
push eax
call fcn.004059cc
push edi
lea eax, [esp + 0x160]
push 0x104
push eax
call fcn.00405972
push 0x418040
lea eax, [esp + 0x16c]
push 0x104
push eax
call fcn.004059cc
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x178]
push 0x104
push eax
call fcn.004059cc
add esp, 0x48
test byte [esp + 0x10], 0x10
jne 0x4012de
lea eax, [esp + 0x138]
push eax
call fcn.00405734
lea eax, [esp + 0x13c]
push eax
lea eax, [esp + 0x248]
push eax
call fcn.004058c4
add esp, 0xc
test eax, eax
je 0x401361
jmp 0x40135c
mov ecx, 0x418044
lea eax, [esp + 0x34]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401307
test dl, dl
je 0x401303
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401307
add eax, 2
add ecx, 2
test dl, dl
jne 0x4012e7
xor eax, eax
jmp 0x40130c
sbb eax, eax
or eax, 1
test eax, eax
je 0x401361
mov eax, 0x418048
lea ecx, [esp + 0x34]
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x401340
test dl, dl
je 0x40133c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x401340
add ecx, 2
add eax, 2
test dl, dl
jne 0x401320
xor eax, eax
jmp 0x401345
sbb eax, eax
or eax, 1
test eax, eax
je 0x401361
lea edx, [esp + 0x138]
lea ecx, [esp + 0x240]
call fcn.00401160
cmp eax, 1
jne 0x4013b7
lea eax, [esp + 0x10]
push eax
push esi
call fcn.004056c7
add esp, 8
test eax, eax
je 0x401220
push esi
call fcn.00405686
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x448]
xor ecx, esp
call fcn.00402085
mov esp, ebp
pop ebp
ret
mov eax, 0xfffffffd
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x448]
xor ecx, esp
call fcn.00402085
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
mov ecx, dword [esp + 0x454]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00402085
mov esp, ebp
pop ebp
ret
Function at 0x406af4
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x406b33
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x406b33
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x406b33
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x406b33
cmp dword [ecx + 0x74], 0xe
jbe 0x406b33
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x408739
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x414548
push 0x414540
push str.FlsAlloc
push 0x1f
call fcn.004085f8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40876d
push dword [ebp + 8]
mov ecx, esi
call dword [0x413148]
call esi
jmp 0x408773
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4087b7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x414558
push 0x414550
push str.FlsGetValue
push 0x21
call fcn.004085f8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4087ee
push dword [ebp + 8]
mov ecx, esi
call dword [0x413148]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4087f6
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x414560
push 0x414558
push str.FlsSetValue
push 0x22
call fcn.004085f8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408830
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x413148]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40ac59
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40acf6
push ebx
push esi
call fcn.0040ac22
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00407e30
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40aca3
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40acf5
push edi
push eax
call fcn.00407c2c
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40acc3
call fcn.00407bf2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40acf4
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00407e30
add esp, 0x20
test eax, eax
jne 0x40ace2
push edi
call fcn.00407bf2
jmp 0x40acea
push ebx
call fcn.00407bf2
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40acf9
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x40ad0a
pop esi
ret
push ebx
push edi
push esi
call fcn.0040ac22
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00407c2c
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x40ad32
push ebx
push esi
push edi
call fcn.00404920
add esp, 0xc
push 0
call fcn.00407bf2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x40b48f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040afaa
Function at 0x4066dc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x14], 0x14
mov dword [ebp - 0x18], 0xe0
mov dword [ebp - 8], 0
mov dword [ebp - 0x24], 0x800f56a9
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0xc], 1
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x406720
mov eax, dword [ebp - 8]
jmp 0x40683b
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
je 0x406736
mov eax, dword [ebp - 8]
jmp 0x40683b
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x20], ecx
jmp 0x406767
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x20]
cmp dword [eax], 0x4550
je 0x40677d
mov eax, dword [ebp - 8]
jmp 0x40683b
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx ecx, word [eax]
cmp ecx, 0x10b
je 0x4067d1
mov edx, dword [ebp - 0x10]
movzx eax, word [edx]
cmp eax, 0x20b
je 0x4067d1
jmp 0x4067cc
mov eax, dword [ebp - 8]
jmp 0x40683b
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
jmp 0x4067ea
cmp dword [ebp + 0xc], 0
je 0x4067f8
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
cmp dword [ebp + 0x10], 0
je 0x406806
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
cmp dword [ebp + 0x14], 0
je 0x406838
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
jmp 0x406836
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x403880
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4306f6
mov eax, dword fs:[0]
push eax
sub esp, 0x450
mov eax, dword [0x439178]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x450], ecx
mov dword [ebp - 0x44c], 0
push 0x434c48
lea ecx, [ebp - 0x22c]
call fcn.004047a0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0
je 0x4039cc
mov ecx, dword [ebp - 0x450]
call fcn.00403810
test eax, eax
je 0x40398d
push 0x105
lea ecx, [ebp - 0x43c]
push ecx
mov edx, dword [ebp - 0x228]
push edx
call sub.PSAPI.DLL_GetProcessImageFileNameW
mov dword [ebp - 0x440], eax
push ecx
mov ecx, esp
mov dword [ebp - 0x444], esp
lea eax, [ebp - 0x43c]
push eax
call fcn.004047a0
mov dword [ebp - 0x454], eax
lea ecx, [ebp - 0x448]
push ecx
mov ecx, dword [ebp - 0x450]
call fcn.00403560
mov dword [ebp - 0x458], eax
mov edx, dword [ebp - 0x458]
mov dword [ebp - 0x45c], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x45c]
push eax
lea ecx, [ebp - 0x22c]
call fcn.00404840
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x448]
call fcn.00404820
jmp 0x4039bf
push 0x105
lea ecx, [ebp - 0x224]
push ecx
push 0
mov edx, dword [ebp - 0x228]
push edx
call sub.PSAPI.DLL_GetModuleFileNameExW
mov dword [ebp - 0x440], eax
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x22c]
call fcn.00404860
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x22c]
push edx
mov ecx, dword [ebp + 8]
call fcn.00404780
mov eax, dword [ebp - 0x44c]
or eax, 1
mov dword [ebp - 0x44c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.00404820
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041765d
mov esp, ebp
pop ebp
ret 8
Function at 0x403ab0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4303b0
mov eax, dword fs:[0]
push eax
sub esp, 0x284
mov eax, dword [0x439178]
xor eax, ebp
mov dword [ebp - 0x38], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x290], ecx
lea ecx, [ebp - 0x24]
call fcn.00404c80
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00404db0
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x10], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x403b47
mov dword [ebp - 0x274], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00403fc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00404cb0
mov eax, dword [ebp - 0x274]
jmp 0x403c71
mov dword [ebp - 0x26c], 0x22c
lea eax, [ebp - 0x26c]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0
jne 0x403baa
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x278], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00403fc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00404cb0
mov eax, dword [ebp - 0x278]
jmp 0x403c71
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x30]
call fcn.00404de0
mov ecx, dword [ebp - 0x254]
mov dword [eax], ecx
lea edx, [ebp - 0x26c]
push edx
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x403baa
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x34], 0xa
lea edx, [ebp - 0x288]
push edx
lea ecx, [ebp - 0x30]
call fcn.00404eb0
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x280]
push ecx
lea ecx, [ebp - 0x30]
call fcn.00404ee0
mov ecx, eax
call fcn.00404f70
movzx edx, al
test edx, edx
je 0x403c46
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
sub ecx, 1
mov dword [ebp - 0x34], ecx
test eax, eax
je 0x403c46
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x30]
call fcn.00404de0
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00404d40
jmp 0x403be6
mov dword [ebp - 0x28c], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00403fc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00404cb0
mov eax, dword [ebp - 0x28c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x38]
xor ecx, ebp
call fcn.0041765d
mov esp, ebp
pop ebp
ret 4
Function at 0x403c90
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43036b
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x439178]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x258], ecx
mov dword [ebp - 0x254], 0
lea ecx, [ebp - 0x24c]
call fcn.00404760
mov dword [ebp - 4], 0
mov dword [ebp - 0x250], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x403d31
lea eax, [ebp - 0x24c]
push eax
mov ecx, dword [ebp + 8]
call fcn.00404780
mov ecx, dword [ebp - 0x254]
or ecx, 1
mov dword [ebp - 0x254], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24c]
call fcn.00404820
mov eax, dword [ebp + 8]
jmp 0x403e10
mov dword [ebp - 0x244], 0x22c
lea edx, [ebp - 0x244]
push edx
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
jne 0x403d99
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x24c]
push edx
mov ecx, dword [ebp + 8]
call fcn.00404780
mov eax, dword [ebp - 0x254]
or eax, 1
mov dword [ebp - 0x254], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24c]
call fcn.00404820
mov eax, dword [ebp + 8]
jmp 0x403e10
mov ecx, dword [ebp - 0x23c]
cmp ecx, dword [ebp + 0xc]
jne 0x403db8
lea edx, [ebp - 0x220]
push edx
lea ecx, [ebp - 0x24c]
call fcn.00404860
jmp 0x403dcc
lea eax, [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x403d99
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x24c]
push eax
mov ecx, dword [ebp + 8]
call fcn.00404780
mov ecx, dword [ebp - 0x254]
or ecx, 1
mov dword [ebp - 0x254], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24c]
call fcn.00404820
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041765d
mov esp, ebp
pop ebp
ret 8