joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a078d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4e52d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004972ef
and dword [ebp - 0x14], 0
cmp dword [0x4ea2d4], 0
mov dword [ebp - 0x18], eax
jne 0x4a0840
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4a08e8
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4baebc
push ebx
call edi
test eax, eax
je 0x4a08e8
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4ea2d4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4ea2d8], eax
call edi
push eax
call esi
push 0x4bae7c
push ebx
mov dword [0x4ea2dc], eax
call edi
push eax
call esi
mov dword [0x4ea2e4], eax
test eax, eax
je 0x4a0840
push 0x4bae64
push ebx
call edi
push eax
call esi
mov dword [0x4ea2e0], eax
mov eax, dword [0x4ea2e0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4a0899
cmp dword [0x4ea2e4], ecx
je 0x4a0899
push eax
call esi
push dword [0x4ea2e4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4a0899
test ebx, ebx
je 0x4a0899
call edi
test eax, eax
je 0x4a0890
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4a0890
test byte [ebp - 8], 1
jne 0x4a0899
or dword [ebp + 0x10], 0x200000
jmp 0x4a08cc
mov eax, dword [0x4ea2d8]
cmp eax, dword [ebp - 0x18]
je 0x4a08cc
push eax
call esi
test eax, eax
je 0x4a08cc
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4a08cc
mov eax, dword [0x4ea2dc]
cmp eax, dword [ebp - 0x18]
je 0x4a08cc
push eax
call esi
test eax, eax
je 0x4a08cc
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4ea2d4]
call esi
test eax, eax
je 0x4a08e8
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4a08ea
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004912db
leave
ret
Function at 0x10010e1
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push 0x100109c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x1001123
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100107c
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call fcn.010010c8
jmp 0x1001143
push 0x1001074
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1001141
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001050
jmp 0x1001105
call eax
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0xdb92f8
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdb9302
pushal
call 0xdb9308
pop ebp
sub ebp, 0x10
sub ebp, 0x9b92f8
jmp 0xdb931e
mov eax, 0x9b92f8
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c5
mov edx, 0xb22795f6
xor byte [eax], dl
inc eax
dec ecx
jne 0xdb9335
jmp 0xdb9348
jge 0xdb9385
jge 0xdb93cb
retf 0xf6f6
or bh, byte [edi - 0xe]
rcr byte [esi - 0x929691e], cl
sahf
adc al, ah
invalid
adc eax, 0xf31eebfd
div dh
neg byte [edi]
sal dh, 0xf6
idiv byte [ebx - 0x6e]
ror byte [edx], cl
jg 0xdb9372
sar byte [ebx - 0x66], cl
sal dh, cl
jge 0xdb9412
invalid
sal dl, cl
div dh
div dh
neg byte [esi - 0x929691e]
sahf
adc al, ah
invalid
les ecx, [ebp - 0x2d25080a]
cmpsd dword [esi], dword es:[edi]
push ds
div dh
neg byte [edi]
mov bl, 0xf4
div dh
mov dword [0x8309aba2], eax
cli
or dword [ebx - 0x971e102], eax
div dh
jge 0xdb9442
invalid
daa
lds esp, [esi*2 - 0x6410ce2]
jb 0xdb93ca
div dh
idiv cl
stc
jle 0xdb93d6
div dh
not byte [eax + 0x76cfea7d]
or eax, 0xec72f91e
div dh
div byte [esi + 0xd]
pop ds
stc
jb 0xdb9415
jge 0xdb9408
iretd
div dh
not byte [eax - 0x2cf6f289]
stc
jb 0xdb941c
div dh
div byte [edi + 0x9093a1f]
or edi, ebx
mov edx, 0x3775f7cf
fistp qword [edx + 0x3775f7cf]
jne 0xdb9469
pop ds
dec ebx
or dword [ecx], ecx
or edi, ebx
mov byte [0x3775f4cf], al
invalid
xor al, 0xfa
mul byte [ebx - 0x5e5fe583]
mov dword [0x7dfa837d], eax
mov edi, esi
or al, byte [esi + esi*2 + 0x7c]
invalid
Function at 0x10001000
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2fc
push ebx
push esi
push edi
lea edi, [ebp - 0x2fc]
mov ecx, 0xbf
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x10069140]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x48], 0
push 0x31
push 0
lea eax, [ebp - 0x47]
push eax
call fcn.1000e210
add esp, 0xc
cmp dword [ebp + 8], 0
jne 0x10001049
xor eax, eax
jmp 0x1000116c
mov esi, esp
mov eax, dword [ebp + 8]
push eax
push 0
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp esi, esp
call fcn.1000e050
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10001073
xor eax, eax
jmp 0x1000116c
mov esi, esp
push str.LoadLibraryA
mov edi, esp
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp edi, esp
call fcn.1000e050
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.1000e050
mov dword [ebp - 0x60], eax
mov esi, esp
push 4
push 0x3000
mov eax, dword [ebp + 0xc]
push eax
call fcn.1000dfb0
add esp, 4
add eax, 1
push eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
cmp esi, esp
call fcn.1000e050
mov dword [ebp - 0x54], eax
mov esi, esp
push 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.1000dfb0
add esp, 4
add eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x54]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp esi, esp
call fcn.1000e050
mov esi, esp
push 0
push 0
mov eax, dword [ebp - 0x54]
push eax
mov ecx, dword [ebp - 0x60]
push ecx
push 0
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
cmp esi, esp
call fcn.1000e050
mov eax, dword [ebp + 0xc]
push eax
push str._s_tried_to_be_loaded__n
lea ecx, [ebp - 0x168]
push ecx
call fcn.1000dc20
add esp, 0xc
mov esi, esp
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1000e050
mov esi, esp
push 0xc000
push 0
mov eax, dword [ebp - 0x54]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
cmp esi, esp
call fcn.1000e050
mov eax, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x1000119c]
call fcn.1000e080
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000e040
add esp, 0x2fc
cmp ebp, esp
call fcn.1000e050
mov esp, ebp
pop ebp
ret
Function at 0x100011e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
push ebx
push esi
push edi
lea edi, [ebp - 0xe4]
mov ecx, 0x39
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp esi, esp
call fcn.1000e050
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000121d
jmp 0x10001267
mov esi, esp
push str.DbgBreakPoint
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.1000e050
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10001240
jmp 0x10001267
mov esi, esp
lea eax, [ebp - 0x20]
push eax
push 0x40
push 1
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1000e050
test eax, eax
jne 0x10001261
jmp 0x10001267
mov eax, dword [ebp - 0x14]
mov byte [eax], 0xc3
push edx
mov ecx, ebp
push eax
lea edx, [0x1000128c]
call fcn.1000e080
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xe4
cmp ebp, esp
call fcn.1000e050
mov esp, ebp
pop ebp
ret
Function at 0x10002d50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
push ebx
push esi
push edi
lea edi, [ebp - 0xf0]
mov ecx, 0x3c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1000e050
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
sub eax, 5
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov byte [eax], 0xe9
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 1], ecx
mov dword [ebp - 0x2c], 5
jmp 0x10002db8
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp + 0x10]
jae 0x10002dcb
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x2c]
mov byte [eax], 0x90
jmp 0x10002daf
mov esi, esp
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1000e050
push edx
mov ecx, ebp
push eax
lea edx, [0x10002e10]
call fcn.1000e080
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xf0
cmp ebp, esp
call fcn.1000e050
mov esp, ebp
pop ebp
ret

Function at 0x10002f10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0xd8]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
push 0x40
push 0x3000
mov eax, dword [ebp + 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.1000e050
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.10010220
add esp, 0x10
mov eax, dword [ebp + 8]
sub eax, dword [ebp - 8]
sub eax, 5
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp + 0x10]
mov byte [eax], 0xe9
mov eax, dword [ebp - 8]
add eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 1], ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10002d50
add esp, 0xc
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.1000e050
mov esp, ebp
pop ebp
ret

Function at 0x10003cc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
lea edi, [ebp - 0x100]
mov ecx, 0x40
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
cmp esi, esp
call fcn.1000e050
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x10003d21
mov esi, esp
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.1000e050
mov esi, esp
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edx
mov ecx, ebp
push eax
lea edx, [0x10003d48]
call fcn.1000e080
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0x100
cmp ebp, esp
call fcn.1000e050
mov esp, ebp
pop ebp
ret
Function at 0x10009190
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push ebx
push esi
push edi
lea edi, [ebp - 0xc4]
mov ecx, 0x31
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 1
je 0x100091c5
jmp 0x10009259
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
cmp esi, esp
call fcn.1000e050
mov esi, esp
push 0
push 0
push 0
push 0x10008ff0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.1000e050
mov esi, esp
push 0
push 0
push 0
push 0x10003ae0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.1000e050
mov esi, esp
push 0
push 0
push 0
push 0x10008e10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.1000e050
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1000e050
mov esi, esp
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.1000e050
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0xc4
cmp ebp, esp
call fcn.1000e050
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000e040
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10069140]
jne 0x1000e04a
repz ret
jmp fcn.10015a50
Function at 0x448e70
Capabilities:
Check if file exists
Get file attributes
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x448e8d
mov eax, 0xfffffff5
pop esi
pop ebp
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x50b634], eax
test eax, eax
jne 0x448ea7
mov eax, 0xfffffff4
pop esi
pop ebp
ret 4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DD_btn
push eax
call esi
push str.DD_whl
push dword [0x50b634]
mov dword [0x50b618], eax
call esi
push str.DD_key
push dword [0x50b634]
mov dword [0x50b61c], eax
call esi
push str.DD_mov
push dword [0x50b634]
mov dword [0x50b620], eax
call esi
push str.DD_str
push dword [0x50b634]
mov dword [0x50b624], eax
call esi
push str.DD_todc
push dword [0x50b634]
mov dword [0x50b628], eax
call esi
push str.DD_movR
push dword [0x50b634]
mov dword [0x50b62c], eax
call esi
mov ecx, dword [0x50b618]
mov dword [0x50b630], eax
test ecx, ecx
je 0x448f72
cmp dword [0x50b61c], 0
je 0x448f72
cmp dword [0x50b620], 0
je 0x448f72
cmp dword [0x50b624], 0
je 0x448f72
cmp dword [0x50b628], 0
je 0x448f72
cmp dword [0x50b62c], 0
je 0x448f72
test eax, eax
je 0x448f72
push 0
call ecx
neg eax
pop esi
sbb eax, eax
and eax, 2
dec eax
pop ebp
ret 4
mov eax, 0xfffffff3
pop esi
pop ebp
ret 4

Function at 0x44a940
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c7c6f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x502014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0
call fcn.00459980
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [ebp - 4], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [ebp - 4], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
test eax, eax
je 0x44a9f1
push eax
push esi
call fcn.0045ca50
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.00459d10
int3
Function at 0x4600c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c9f48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xbc
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x4600ec
jmp 0x460196
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xc0]
push ecx
call fcn.00460960
add esp, 8
mov dword [ebp - 0xc4], eax
mov edx, dword [ebp - 0xc4]
mov dword [ebp - 0xc8], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xc8]
push eax
push str._F__pid
lea ecx, [ebp - 0x28]
push ecx
call fcn.00457cc0
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xc0]
call fcn.00448fc0
push 0x3c
push 0
lea eax, [ebp - 0x64]
push eax
call fcn.0047b390
add esp, 0xc
mov dword [ebp - 0x64], 0x3c
mov dword [ebp - 0x60], 0x40
mov dword [ebp - 0x58], 0x4f7b50
mov dword [ebp - 0x54], str.taskkill
mov dword [ebp - 0x48], 0xa
lea ecx, [ebp - 0x28]
call fcn.00448f80
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00448fc0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4601b0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c9f6d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x170
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0x24]
call fcn.00460840
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4601ff
push str.CreateToolhelp32Snapshot_Error__n
call fcn.004488d0
add esp, 4
mov dword [ebp - 0x138], 0x128
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.KERNEL32.dll_Process32First
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
je 0x46026b
lea ecx, [ebp + 8]
call fcn.00448f80
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.00496b60
add esp, 8
test eax, eax
jne 0x460253
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp + 0x24]
call fcn.00460930
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.KERNEL32.dll_Process32Next
mov dword [ebp - 0x13c], eax
jmp 0x46021f
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00448fc0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4602a0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c9f6d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x17c
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x46030b
push str.CreateToolhelp32Snapshot_Error__n
call fcn.004488d0
add esp, 4
mov dword [ebp - 0x180], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00448fc0
mov eax, dword [ebp - 0x180]
jmp 0x4603b4
mov dword [ebp - 0x138], 0x128
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.KERNEL32.dll_Process32First
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
je 0x46038b
lea ecx, [ebp + 8]
call fcn.00448f80
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.00496b60
add esp, 8
test eax, eax
jne 0x460373
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x184], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00448fc0
mov eax, dword [ebp - 0x184]
jmp 0x4603b4
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.KERNEL32.dll_Process32Next
mov dword [ebp - 0x13c], eax
jmp 0x46032b
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x188], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00448fc0
mov eax, dword [ebp - 0x188]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4603d0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov ecx, dword [ebp + 0xc]
call fcn.00460840
push 0x28
push 0
push 0x503b20
call fcn.0047b390
add esp, 0xc
mov dword [0x503b48], 0
mov eax, dword [ebp + 8]
push eax
push 0x460040
call dword [sym.imp.USER32.dll_EnumWindows]
mov dword [ebp - 4], 0
jmp 0x46041d
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xa
jae 0x460447
mov eax, dword [ebp - 4]
cmp dword [eax*4 + 0x503b20], 0
jne 0x460432
jmp 0x460447
mov eax, dword [ebp - 4]
lea ecx, [eax*4 + 0x503b20]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00460930
jmp 0x460414
mov ecx, dword [ebp + 0xc]
call fcn.00454dc0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46c850
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push 2
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.00493570
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x46c87f
mov eax, 0xfffffffd
jmp 0x46c950
mov eax, dword [ebp + 8]
push eax
call fcn.004a0250
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x46c89e
mov eax, 0xfffffffd
jmp 0x46c950
cmp dword [ebp - 0xc], 0
jne 0x46c8ab
xor eax, eax
jmp 0x46c950
push 0x4d752f
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
call fcn.004c5450
add esp, 8
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
jne 0x46c8d5
mov eax, 0xfffffffe
jmp 0x46c950
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xc]
mov byte [eax], 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.00493570
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push 1
mov edx, dword [ebp - 0x10]
push edx
call fcn.00492bc0
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
je 0x46c928
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
push ecx
call fcn.0045db40
add esp, 4
mov eax, 0xfffffffd
jmp 0x46c950
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0046c620
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x64]
push ecx
call fcn.0045db40
add esp, 4
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x470c10
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x288
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x470c29
mov al, 1
jmp 0x470d30
mov eax, dword [ebp + 8]
push eax
call fcn.00496bf0
add esp, 4
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0x200
jl 0x470c4e
mov al, 2
jmp 0x470d30
push 0x200
push 0
lea eax, [ebp - 0x200]
push eax
call fcn.0047b390
add esp, 0xc
mov dword [ebp - 0x204], 0
jmp 0x470c7f
mov eax, dword [ebp - 0x204]
add eax, 1
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
cmp eax, dword [ebp - 0x208]
jge 0x470d0a
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x204]
movsx ecx, byte [eax]
cmp ecx, 0x5c
je 0x470caf
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x204]
movsx ecx, byte [eax]
cmp ecx, 0x2f
jne 0x470ced
push 0
lea eax, [ebp - 0x200]
push eax
call fcn.00490bf0
add esp, 8
test eax, eax
je 0x470cd3
push 0
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x204]
mov ecx, dword [ebp - 0x204]
mov dl, byte [eax]
mov byte [ebp + ecx - 0x200], dl
jmp 0x470d05
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x204]
mov ecx, dword [ebp - 0x204]
mov dl, byte [eax]
mov byte [ebp + ecx - 0x200], dl
jmp 0x470c70
push 0
lea eax, [ebp - 0x200]
push eax
call fcn.00490bf0
add esp, 8
test eax, eax
je 0x470d2e
push 0
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x471a90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x471ad0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x28], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47ead0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.0047e6f0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x47eb02
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x4d6204]
call dword [ebp - 8]
jmp 0x47eb0c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret

Function at 0x4b425f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c67b0

Function at 0x4b4275
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b3c60