joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x401bd7
pop dword [ebp - 0x24]
mov eax, 0x4a42b1b4
sub eax, 0x4a0295dd
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xd14052b7
sub dword [ebp - 0x34], 0x82ee0d6c
mov dword [ebp - 0x30], 0xbdf2277f
sub dword [ebp - 0x30], 0x8bbedb3a
mov dword [ebp - 0x2c], 0x8c458ade
sub dword [ebp - 0x2c], 0x3ff946b0
mov dword [ebp - 0x28], 0x241ba12d
sub dword [ebp - 0x28], 0x241ba12d
lea eax, [ebp - 0x34]
push eax
mov eax, 0xdece94e3
sub eax, 0xde8e2483
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x2932f3d8
sub dword [ebp - 0x34], 0xb4c08a82
mov dword [ebp - 0x30], 0x8050403b
sub dword [ebp - 0x30], 0x3ee3dec6
mov dword [ebp - 0x2c], 0xb7590a4e
sub dword [ebp - 0x2c], 0x53e99de2
mov dword [ebp - 0x28], 0x19238377
sub dword [ebp - 0x28], 0x19238377
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x459511ea
sub eax, 0x4554a0ea
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x38957
push 0
call eax
mov ecx, 0x82297c87
add ecx, 0x7dd6d382
xor esi, esi
add esi, eax
mov edi, 0x410000
add edi, dword [ebp - 0x24]
mov ebx, 0xea73405a
mov edx, dword [edi]
xor dword [ebp - 0x18], edx
xor edx, ebx
xor dword [ebp - 0xc], 0xd5f009df
mov dword [esi], edx
add dword [ebp - 0x18], 0x529aa91b
add esi, 0xadaa6371
add esi, 0x52559c93
add edi, 0xb15f54be
add edi, 0x4ea0ab46
loop 0x401cef
add eax, 0x857a8d81
sub eax, 0x85795a8a
xor ebx, ebx
add ebx, eax
add eax, 0x86789463
sub eax, 0x8678945e
mov ecx, 0xf993eab
sub ecx, 0xf593eab
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x10003380
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
add esp, 4
or eax, 0x1201c
jmp 0x10003373
call 0x10003380
add byte [0x36404039], bh
xor eax, 0x4c48346
pop eax
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x2a0], eax
jmp 0x100033fa
Function at 0x100303d0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ac0d1
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10206370]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0xc], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov eax, dword [eax + 0x24]
mov dword [edx + 0x24], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x28]
mov dword [ecx + 0x28], eax
mov edx, dword [edx + 0x2c]
mov dword [ecx + 0x2c], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x30]
mov dword [eax + 0x30], edx
mov ecx, dword [ecx + 0x34]
mov dword [eax + 0x34], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov eax, dword [eax + 0x3c]
mov dword [edx + 0x3c], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x40]
mov dword [ecx + 0x40], eax
mov edx, dword [edx + 0x44]
mov dword [ecx + 0x44], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x48]
mov dword [eax + 0x48], edx
mov ecx, dword [ecx + 0x4c]
mov dword [eax + 0x4c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
fld qword [eax + 0x50]
fstp qword [edx + 0x50]
mov ecx, dword [ebp + 8]
add ecx, 0x58
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x58
call fcn.1000ac00
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
add edx, 0x5c
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x5c
call fcn.1000ac00
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
add eax, 0x60
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x60
call fcn.1000ac00
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 8]
add ecx, 0x64
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x64
call fcn.1000ac00
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x10031510
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
cmp dword [0x1020b5f4], 1
je 0x10031528
cmp dword [0x1020b5f4], 0
jne 0x10031532
mov eax, dword [0x1020b5f4]
jmp 0x100315fe
mov dword [ebp - 4], 4
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 1
xor eax, eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
push 0x101dafc8
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x1003158d
lea ecx, [ebp - 0x7c]
push ecx
call dword [ebp - 0x4c]
jmp 0x10031597
lea edx, [ebp - 0x7c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x68], 4
ja 0x100315ae
mov dword [0x1020b5f4], 1
mov eax, 1
jmp 0x100315fe
push 0x40
push 0
lea eax, [ebp - 0x48]
push eax
call fcn.101845c0
add esp, 0xc
mov dword [ebp - 0x48], 0x40
lea ecx, [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x100315f2
cmp dword [ebp - 0x3c], 1
ja 0x100315f2
jb 0x100315e1
cmp dword [ebp - 0x40], 0
ja 0x100315f2
mov dword [0x1020b5f4], 1
mov eax, 1
jmp 0x100315fe
mov dword [0x1020b5f4], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100320c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0xffffffff
jne 0x100320f2
xor eax, eax
jmp 0x100321ae
mov dword [ebp - 0x238], 0
push 0x228
push 0
lea eax, [ebp - 0x234]
push eax
call fcn.101845c0
add esp, 0xc
mov dword [ebp - 0x238], 0x22c
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x23c]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x10032144
mov eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x100321ae
mov ecx, dword [ebp - 0x230]
push ecx
push 0
push 0x100
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
je 0x10032185
push 0xffffffffffffffff
push 0xffffffffffffffff
mov edx, dword [ebp - 0x240]
push edx
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov eax, dword [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x23c]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10032144
mov eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret 4
Function at 0x10034390
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101adef6
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24c], ecx
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.101845c0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x21c]
push edx
push 0x101d739c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str...SMLCoreProcSpecial.dat
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10034429
xor eax, eax
jmp 0x10034559
push 0
lea esi, [ebp - 0x22c]
call fcn.100df270
mov dword [ebp - 4], 0
push 0x101d73e8
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x240]
push eax
call fcn.100e558a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x22c]
push ecx
lea ecx, [ebp - 0x240]
call fcn.100e571e
test eax, eax
je 0x10034481
lea eax, [ebp - 0x22c]
call fcn.100e0830
movzx edx, al
test edx, edx
jne 0x100344b7
mov dword [ebp - 0x244], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x240]
call fcn.10014bd0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x22c]
call fcn.100df5f0
mov eax, dword [ebp - 0x244]
jmp 0x10034559
mov eax, dword [ebp - 0x24c]
add eax, 0x108
push eax
mov eax, str.SpecialProc
lea ecx, [ebp - 0x22c]
call fcn.100e0220
push eax
call fcn.10038800
add esp, 8
mov ecx, dword [ebp - 0x24c]
add ecx, 0x128
push ecx
mov eax, str.MergerProc
lea ecx, [ebp - 0x22c]
call fcn.100e0220
push eax
call fcn.10038a00
add esp, 8
mov edx, dword [ebp - 0x24c]
add edx, 0x148
push edx
mov eax, str.IgnoreUserSet
lea ecx, [ebp - 0x22c]
call fcn.100e0220
push eax
call fcn.10038a00
add esp, 8
mov dword [ebp - 0x248], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x240]
call fcn.10014bd0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x22c]
call fcn.100df5f0
mov eax, dword [ebp - 0x248]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret
Function at 0x1003bae0
Capabilities:
Check if file exists
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 0xc], eax
push ebx
push esi
push edi
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x42c], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x21c]
call fcn.1016f880
xor eax, eax
mov word [ebp - 0x428], ax
push 0x206
push 0
lea ecx, [ebp - 0x426]
push ecx
call fcn.101845c0
add esp, 0xc
mov dword [ebp - 8], 0x104
xor edx, edx
mov word [ebp - 0x218], dx
push 0x206
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.101845c0
add esp, 0xc
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x428]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x1003bb7b
jmp 0x1003bc0f
push 0x400
call fcn.100e40de
add esp, 4
test eax, eax
je 0x1003bbd4
push 0x105
xor edi, edi
mov ebx, 0x101d66d8
lea eax, [ebp - 0x21c]
call fcn.1016f8b0
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jne 0x1003bbb4
jmp 0x1003bc0f
push 0x104
lea eax, [ebp - 0x218]
push eax
push SysReAllocStringLen
lea ecx, [ebp - 0x428]
push ecx
call dword [ebp - 0x42c]
jmp 0x1003bc07
push 0xe9
xor edi, edi
mov ebx, str.Shell32.dll
lea eax, [ebp - 0x21c]
call fcn.1016f8b0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1003bbf6
jmp 0x1003bc0f
lea edx, [ebp - 0x218]
push edx
push SysReAllocStringLen
push 0
call dword [ebp - 4]
xor eax, eax
jne 0x1003bb61
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1003bc40
push 0x2010
push 0x30
push 0x30
push 0
lea edx, [ebp - 0x218]
push edx
push 0
call dword [sym.imp.USER32.dll_LoadImageW]
mov dword [ebp - 0x220], eax
cmp dword [ebp + 0xc], 0
je 0x1003bc4f
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
mov ecx, dword [ebp - 0x220]
mov dword [ebp - 0x430], ecx
lea esi, [ebp - 0x21c]
call fcn.1016f890
mov eax, dword [ebp - 0x430]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100404b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x100404b9
xor ecx, ecx
jne 0x100404b9
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shl eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10040500
mov eax, dword [ebp - 0xc]
jmp 0x1004055d
cmp dword [ebp - 4], 1
je 0x10040513
cmp dword [ebp - 4], 2
je 0x10040513
mov eax, 0xd
jmp 0x1004055d
cmp dword [ebp + 0xc], 0
je 0x10040551
cmp dword [ebp - 8], 0
je 0x10040549
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x10040540
mov edx, dword [ebp - 8]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x10040547
mov eax, 0xd
jmp 0x1004055d
jmp 0x10040551
xor edx, edx
mov eax, dword [ebp + 0xc]
mov word [eax], dx
mov ecx, dword [ebp - 8]
shr ecx, 1
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100405c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebp
ret 0x18

Function at 0x10048540
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x21c], 0
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.101845c0
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100485d5
lea eax, [ebp - 0x218]
push eax
push 4
lea ecx, [ebp - 0x214]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x100485d5
push 0x104
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x214]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.PSAPI.DLL_GetModuleFileNameExW
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp + 8]
call fcn.1000b560
mov edx, dword [ebp - 0x21c]
or edx, 1
mov dword [ebp - 0x21c], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret 8
Function at 0x10048660
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100486d2
mov dword [ebp - 8], 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x100486c6
cmp dword [ebp - 0xc], 0
je 0x100486c6
mov dword [ebp - 0x14], 1
jmp 0x100486cd
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
jmp 0x100486d4
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10048710
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10206370]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x21c], 0
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.101845c0
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1004879f
lea eax, [ebp - 0x218]
push eax
push 4
lea ecx, [ebp - 0x214]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x1004879f
push 0x104
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x214]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.PSAPI.DLL_GetModuleFileNameExW
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp + 8]
call fcn.1000b560
mov edx, dword [ebp - 0x21c]
or edx, 1
mov dword [ebp - 0x21c], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1017e01c
mov esp, ebp
pop ebp
ret
Function at 0x100487e0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1054
call fcn.1019a6e0
mov dword [ebp - 0x1008], 0
push 0xffc
push 0
lea eax, [ebp - 0x1004]
push eax
call fcn.101845c0
add esp, 0xc
mov dword [ebp - 0x100c], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x100c]
push ecx
push 0x1000
lea edx, [ebp - 0x1008]
push edx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x1004883f
jmp 0x1004892f
mov eax, dword [ebp - 0x100c]
shr eax, 2
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x101c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.100ad2e0
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1014], edx
mov dword [ebp - 0x1010], eax
mov ecx, dword [ebp - 4]
lea edx, [ebp + ecx*4 - 0x1008]
push edx
lea eax, [ebp - 0x1008]
push eax
mov ecx, dword [ebp - 0x1010]
push ecx
mov edx, dword [ebp - 0x1014]
push edx
mov ecx, dword [ebp + 8]
call fcn.1004aff0
lea eax, [ebp - 0x102c]
push eax
mov ecx, dword [ebp + 8]
call fcn.100be940
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x1024], ecx
mov dword [ebp - 0x1020], edx
push 0x100486e0
lea eax, [ebp - 0x103c]
push eax
mov ecx, dword [ebp + 8]
call fcn.100be940
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x1044]
push eax
mov ecx, dword [ebp + 8]
call fcn.100ad2e0
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x104c]
push eax
call fcn.1004b030
add esp, 0x18
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x1034], ecx
mov dword [ebp - 0x1030], edx
mov eax, dword [ebp - 0x1020]
push eax
mov ecx, dword [ebp - 0x1024]
push ecx
mov edx, dword [ebp - 0x1030]
push edx
mov eax, dword [ebp - 0x1034]
push eax
lea ecx, [ebp - 0x1054]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10035ee0
mov esp, ebp
pop ebp
ret
Function at 0x100500f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101acda8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x10206370]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
jne 0x1005011f
xor eax, eax
jmp 0x10050199
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10050131
xor eax, eax
jmp 0x10050199
cmp dword [ebp + 0xc], 0
je 0x10050191
push 0x101d5c24
lea ecx, [ebp - 0x14]
push ecx
call fcn.100ea5b0
add esp, 8
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
call fcn.1004f530
push eax
call fcn.100500a0
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.100056e0
cmp dword [ebp - 0x10], 0
je 0x10050191
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.100500d0
add esp, 8
jmp 0x10050199
mov eax, dword [ebp + 8]
call fcn.101763a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x100501b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x100501bd
xor eax, eax
jmp 0x100501fb
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100501cf
xor eax, eax
jmp 0x100501fb
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.100ea33b
add esp, 8
test eax, eax
je 0x100501eb
mov eax, 1
jmp 0x100501fb
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100500f0
add esp, 8
pop ebp
ret
Function at 0x10051770
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
cmp dword [ebp + 8], 0
je 0x100517bb
mov eax, dword [ebp + 8]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
add ecx, 2
mov dword [ebp - 0x60], ecx
mov edx, dword [ebp - 0x5c]
mov ax, word [edx]
mov word [ebp - 0x62], ax
add dword [ebp - 0x5c], 2
cmp word [ebp - 0x62], 0
jne 0x1005178b
mov ecx, dword [ebp - 0x5c]
sub ecx, dword [ebp - 0x60]
sar ecx, 1
mov dword [ebp - 0x68], ecx
je 0x100517bb
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100517c2
xor al, al
jmp 0x100518dc
cmp dword [ebp + 0xc], 0
je 0x100517f9
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp - 0x6c]
add ecx, 2
mov dword [ebp - 0x70], ecx
mov edx, dword [ebp - 0x6c]
mov ax, word [edx]
mov word [ebp - 0x72], ax
add dword [ebp - 0x6c], 2
cmp word [ebp - 0x72], 0
jne 0x100517d7
mov ecx, dword [ebp - 0x6c]
sub ecx, dword [ebp - 0x70]
sar ecx, 1
mov dword [ebp - 0x78], ecx
jne 0x10051800
xor al, al
jmp 0x100518dc
push 5
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x101d5340
push 0
call fcn.100e426c
add esp, 0x18
cmp eax, 0x20
jle 0x1005182c
mov al, 1
jmp 0x100518dc
mov dword [ebp - 0x10], 0
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x58], 0
push 0x40
push 0
lea edx, [ebp - 0x54]
push edx
call fcn.101845c0
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
push 0x44
push 0
lea ecx, [ebp - 0x58]
push ecx
call fcn.101845c0
add esp, 0xc
mov dword [ebp - 0x58], 0x44
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100e448e
add esp, 0x28
test eax, eax
je 0x100518ba
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x100518dc
push 5
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x101d534c
push 0
call fcn.100405c0
xor ecx, ecx
cmp eax, 0x20
setg cl
mov al, cl
mov esp, ebp
pop ebp
ret