joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454815
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0
push 0x80
push 2
push 0
xor ebx, ebx
inc ebx
push ebx
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 8], esi
cmp esi, 0xffffffff
jne 0x45484b
xor eax, eax
jmp 0x4548fc
call fcn.004524aa
test al, al
je 0x45486c
rcl dl, 0xac
jge 0x454898
and eax, 0xca4f1d11
pop ss
arpl word [esp + edi*2 - 0x2ee45a70], si
mov esi, dword [ebp - 8]
xor ebx, ebx
inc ebx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004523db
test al, al
je 0x4548b1
movsb byte es:[edi], byte [esi]
mov ebp, 0x2dbebb2d
out dx, eax
sub eax, 0xef2dbebb
sahf
aam 0x7c
sbb bh, ah
invalid
call fcn.0045223d
test al, al
je 0x4548cf
outsb dx, byte [esi]
push esp
popfd
lodsd eax, dword [esi]
mov ebp, 0x363a146
loopne 0x45491d
sahf
clc
rep lodsb al, byte [esi]
and al, 0xe3
in eax, 0xc9
xchg esi, eax
dec edi
call fcn.00452396
test al, al
je 0x4548ea
test eax, 0x235a0eb6
and al, 0xad
add edx, dword [esp + eax - 0x21f79e8f]
dec ecx
and al, 0xee
cld
cmp dword [ebp - 8], 0
je 0x4548f8
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 4]
je 0x4548fa
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov word [edx + ecx*2], ax
jmp 0x454940
pop ebp
ret 0xc

Function at 0x4558b8
Capabilities:
Encode data using xor

Disassembly:
push 0x40
mov eax, 0x5e2008
call fcn.0046dcda
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
mov ebx, dword [ebp + 8]
and dword [ebp - 0x44], 0
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x48], ebx
push eax
mov dword [ebp - 0x4c], ebx
call fcn.004559dd
pop ecx
pop ecx
xor esi, esi
mov ecx, ebx
inc esi
push 0x5e6948
mov dword [ebp - 4], esi
call fcn.004041e0
mov dword [ebp - 0x44], esi
call fcn.004524aa
test al, al
je 0x455917
xchg esi, eax
inc esp
dec edx
invalid
mov esi, 0x5e8848
push esi
call fcn.0048ece7
pop ecx
push eax
push 0xffffffffffffffff
push esi
lea ecx, [ebp - 0x28]
call fcn.00438190
cmp eax, 0xffffffff
jle 0x455959
push eax
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00419930
push eax
mov ecx, ebx
call fcn.004043f0
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.0041edb0
jmp 0x45596c
lea eax, [ebp - 0x28]
cmp ebx, eax
je 0x45596c
push 0xffffffffffffffff
push 0
push eax
mov ecx, ebx
call fcn.004029b0
call fcn.004523db
test al, al
je 0x455990
dec ecx
invalid
call fcn.0045223d
test al, al
je 0x4559ae
mov bl, 0xd
aaa
cmpsb byte [esi], byte es:[edi]
xor esi, dword [ecx - 0x240e1911]
mov edx, 0x292ff32b
jl 0x455999
nop
cmp eax, 0xe3e8a609
leave
invalid
call fcn.00452396
test al, al
je 0x4559c9
mov byte [0x383e385e], al
adc dword [ebx + 0x33], eax
push ecx
wait
stosb byte es:[edi], al
xlatb
cmp dh, byte [0x9725cbb1]
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.0041edb0
mov eax, ebx
call fcn.0046dc84
ret
Function at 0x45862d
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2018
call fcn.0046d940
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x200c], edi
mov dword [ebp - 0x2008], eax
call fcn.004584b9
test eax, eax
je 0x4587d7
invalid
xor ebx, ebx
push ebx
call fcn.00483f86
mov dword [ebp - 0x2018], eax
lea eax, [ebp - 0x2018]
push eax
mov dword [ebp - 0x2014], edx
call fcn.0048ccde
pop ecx
pop ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push dword [ebp - 0x2008]
mov ecx, dword [esi + 0x10]
push eax
push dword [esi]
mov eax, dword [esi + 0x14]
inc ecx
push dword [esi + 4]
add eax, 0x76c
push dword [esi + 8]
push dword [esi + 0xc]
push ecx
push eax
lea eax, [ebp - 0x2004]
push str.__d__d__d__d__d__d___d_:_s
push eax
call fcn.004582ea
add esp, 0x28
call fcn.0045230c
test al, al
je 0x4586e5
jnp 0x458657
pop ds
xchg dword [ebp - 0x49c7f8a7], eax
inc esi
mov bl, 0x5c
push edx
cwde
lds ebp, [esp + edi*2]
add al, 0x8b
mov ebp, 0xffffdff4
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor esi, esi
inc esi
test eax, eax
cmovne ebx, esi
mov dword [ebp - 0x200c], ebx
call fcn.00452579
test al, al
je 0x458716
lodsb al, byte [esi]
and al, byte [edx]
lcall 0x1ca7, 0x2e31d1c3
dec ecx
outsd dx, dword [esi]
and ebp, ebp
or byte [edx], bl
xor esi, esi
inc esi
push 0x5eb294
push edi
call fcn.0048d819
mov ebx, eax
mov dword [ebp - 0x2010], ebx
pop ecx
pop ecx
test ebx, ebx
je 0x4587d7
cmp dword [ebp - 0x200c], 0
jne 0x458759
push ebx
push 2
lea eax, [ebp - 0x200c]
mov dword [ebp - 0x200c], 0xfeff
push esi
push eax
call fcn.0048ec2b
add esp, 0x10
call fcn.004524aa
test al, al
je 0x45877a
cmp byte [0x820c1076], dl
inc ebp
ror byte [edx - 0x5d5b6d12], 1
inc esp
daa
mov dword [0x9d8b29bc], eax
invalid
lea eax, [ebp - 0x2004]
push eax
call fcn.0048ece7
push ebx
add eax, eax
push eax
lea eax, [ebp - 0x2004]
push 1
push eax
call fcn.0048ec2b
push ebx
push 2
lea eax, [ebp - 0x2008]
mov dword [ebp - 0x2008], 0xd
push 1
push eax
call fcn.0048ec2b
push ebx
push 2
lea eax, [ebp - 0x2008]
mov dword [ebp - 0x2008], 0xa
push 1
push eax
call fcn.0048ec2b
push ebx
call fcn.0048d617
add esp, 0x38
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046d81d
mov esp, ebp
pop ebp
ret
Function at 0x459033
Capabilities:
Authenticate hmac
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x20c]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x218], eax
xor eax, eax
push eax
push 0x1a
push ecx
push eax
mov dword [ebp - 0x210], ebx
call fcn.0045a156
lea eax, [ebp - 0x20c]
push eax
call fcn.0048ece7
add esp, 0x14
mov dword [ebp - 0x214], eax
call fcn.0045205a
test al, al
je 0x4590aa
invalid
scasd eax, dword es:[edi]
sahf
jp 0x4590a1
fucomp st(4)
mov esp, 0xd9fabc2e
rol al, 0x16
mov eax, 0x2e68bfb2
jmp 0x459071
adc byte [ebx - 0xf6274ba], ch
std
invalid
cmp dword [ebp - 0x214], 0
je 0x4591b6
mov esi, 0x5e6ba4
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0048ed02
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0048ed02
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0048ed02
add esp, 0x18
call fcn.00452603
test al, al
je 0x45910a
enter 0x2db, 0x5c
imul esi, dword [edx], 0xffffffb5
xor dword [esi], edx
test edi, ecx
invalid
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x459128
lea eax, [ebp - 0x20c]
push eax
call fcn.00458c2f
pop ecx
call fcn.00452129
test al, al
je 0x459145
in eax, dx
xchg ebp, eax
inc edi
out dx, al
mov byte [0x66286d41], al
push 0x5041438e
jmp 0x4591aa
call fcn.004523db
test al, al
je 0x45916a
lahf
salc
pop ebp
invalid
call fcn.00452603
test al, al
je 0x459188
sti
dec ebx
insd dword es:[edi], dx
adc dh, 0xfc
dec ebp
mov byte [ebx + 0x61], bh
not byte [edi - 0x41a89767]
stosd dword es:[edi], eax
stc
mov esi, 0xbd836606
hlt
cmp word [ebp - 0x20c], 0
jne 0x459196
xor eax, eax
jmp 0x4591a3
lea eax, [ebp - 0x20c]
push eax
call fcn.0048ece7
pop ecx
mov ecx, dword [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00402ad0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046d81d
mov esp, ebp
pop ebp
ret
Function at 0x45a156
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call fcn.00459412
xor edi, edi
inc edi
test al, al
je 0x45a1f3
call fcn.0045216e
test al, al
je 0x45a192
outsb dx, byte [esi]
movsb byte es:[edi], byte [esi]
Function at 0x45b322
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.00480640
add esp, 0xc
mov dword [ebp - 0x120], esi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
call fcn.004523db
test al, al
je 0x45b395
je 0x45b3ce
pop esi
add al, ch
jo 0x45b372
invalid
inc dword [eax + eax*8 + 0x1d061d74]
test dword [esi + 0x5c1d8ae8], edi
popal
sal byte [esi + 0x77], 1
out 0x41, al
push es
sbb eax, 0x8ae8be85
sbb eax, 0x76d0615c
ja 0x45b36b
inc ecx
invalid
call fcn.004524ef
test al, al
je 0x45b3bc
xchg ecx, eax
fbld tbyte [ecx + 0xf]
rol eax, cl
into
mov dword [0x5c52c084], eax
imul eax, ebp, 0x73
sub al, 0x34
invalid
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x118]
call fcn.0045209f
test al, al
je 0x45b3f0
sal byte [edi + ebx + 0x1a], 0x70
push eax
sbb dh, byte [eax + 0x50]
jp 0x45b427
sar dword [eax + 0x24dba851], 1
pushfd
mov esi, 0xe10987e7
cwde
adc dword [ebx + 0x2ecd2991], eax
lahf
imul edi, dword [ebp - 0x6d0c180], 0x7f05ff83
or al, byte [ebx + 0x57f02fe]
cmp edi, 5
jg 0x45b3ff
cmp esi, 2
jg 0x45b3ff
xor eax, eax
inc eax
jmp 0x45b401
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046d81d
mov esp, ebp
pop ebp
ret
invalid

Function at 0x45c261
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x38
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], 0x3c
push 0
push eax
call fcn.00480640
mov eax, dword [ebp + 8]
add esp, 0xc
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x2c], eax
mov eax, 0x200
mov dword [ebp - 0x20], 1
lea ecx, [eax + 0x40]
cmovne eax, ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
call fcn.0045b322
test eax, eax
mov ecx, str.runas
lea eax, [ebp - 0x3c]
cmovne ecx, dword [ebp - 0x30]
push eax
mov dword [ebp - 0x30], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x45c2ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x45c2e3
cmp dword [ebp + 0x10], 0
je 0x45c2e0
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
inc eax
mov esp, ebp
pop ebp
ret
Function at 0x45d532
Capabilities:
Get disk information
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa38
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push ebx
push 0x5e6948
mov dword [ebp - 0xa38], eax
call fcn.00402ad0
push 0x20a
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00480640
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x105
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
jne 0x45d594
xor al, al
jmp 0x45d752
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
call ebx
mov esi, eax
test esi, esi
je 0x45d58d
push edi
xor ecx, ecx
lea eax, [esi + 1]
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046d82e
mov edi, eax
pop ecx
test edi, edi
je 0x45d609
lea eax, [esi*2 + 2]
push eax
push 0
push edi
call fcn.00480640
add esp, 0xc
push edi
push esi
call ebx
test eax, eax
je 0x45d602
mov eax, dword [0x5ecf98]
mov ebx, 0x208
mov dword [ebp - 0xc], eax
mov ax, word [0x5ecf9c]
push ebx
mov word [ebp - 8], ax
call fcn.0046d82e
mov esi, eax
pop ecx
test esi, esi
jne 0x45d610
push edi
call fcn.0046d837
pop ecx
xor al, al
jmp 0x45d751
push ebx
push 0
push esi
call fcn.00480640
add esp, 0xc
mov ebx, edi
mov ax, word [ebx]
push 0x104
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x45d695
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x45d73d
push esi
call fcn.0046d837
xor eax, eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046d82e
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x45d73d
push 2
pop eax
push eax
push 0
push esi
call fcn.00480640
add esp, 0xc
lea eax, [ebp - 0xc]
push 1
push esi
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x45d73d
push esi
call fcn.0048ece7
push eax
mov dword [ebp - 0xa34], eax
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.0048c61d
add esp, 0x10
test eax, eax
je 0x45d6d0
push 2
pop ecx
movzx eax, word [ebx]
add ebx, ecx
test ax, ax
jne 0x45d6b9
xor eax, eax
cmp word [ebx], ax
jne 0x45d61e
jmp 0x45d73d
push 0x800
xor ebx, ebx
lea eax, [ebp - 0xa18]
push ebx
push eax
call fcn.00480640
mov eax, dword [ebp - 0xa34]
lea ecx, [ebp - 0x218]
lea eax, [ecx + eax*2]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x5e9d50
lea eax, [ebp - 0xa18]
push 0x400
push eax
call fcn.0046013d
add esp, 0x20
lea eax, [ebp - 0xa18]
lea ecx, [ebp - 0xa30]
push eax
call fcn.004041e0
mov ecx, dword [ebp - 0xa38]
push eax
call fcn.004043f0
push ebx
push 1
lea ecx, [ebp - 0xa30]
call fcn.0041edb0
push edi
call fcn.0046d837
pop ecx
test esi, esi
je 0x45d74f
push esi
call fcn.0046d837
pop ecx
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0046d81d
mov esp, ebp
pop ebp
ret
Function at 0x45d762
Capabilities:
Enumerate processes

Disassembly:
push 0x46c
mov eax, 0x5e28f1
call fcn.0046dcda
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x230]
xor ebx, ebx
mov dword [ebp - 0x21c], 7
push ebx
xor eax, eax
mov dword [ebp - 0x478], ebx
push 0x5e6948
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
call fcn.00402ad0
mov esi, 0x22c
mov dword [ebp - 4], ebx
push esi
lea eax, [ebp - 0x474]
push ebx
push eax
call fcn.00480640
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x45d7df
push 0x5e6948
mov ecx, edi
call fcn.004041e0
jmp 0x45d975
lea eax, [ebp - 0x474]
mov dword [ebp - 0x474], esi
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x45d960
mov esi, dword [ebp + 0xc]
and dword [ebp - 0x238], 0
xor eax, eax
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
cmp word [ebp - 0x450], ax
je 0x45d82d
lea eax, [ebp - 0x450]
push eax
call fcn.0048ece7
pop ecx
push eax
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x248]
call fcn.00402ad0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x46c], esi
je 0x45d875
push 0
push 1
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0
call fcn.0041edb0
lea eax, [ebp - 0x474]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x45d7fd
jmp 0x45d960
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00480640
add esp, 0xc
push dword [ebp - 0x46c]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x45d951
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
cmp word [ebp - 0x218], 0
jne 0x45d8ca
xor eax, eax
jmp 0x45d8d7
lea eax, [ebp - 0x218]
push eax
call fcn.0048ece7
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402ad0
push 0x5e6948
lea ecx, [ebp - 0x230]
call fcn.004287e0
test eax, eax
jne 0x45d94a
lea eax, [ebp - 0x230]
push eax
push esi
call fcn.0045d532
pop ecx
pop ecx
push 0x5e6948
lea ecx, [ebp - 0x230]
call fcn.004287e0
test eax, eax
jne 0x45d94a
cmp word [ebp - 0x450], ax
je 0x45d937
lea eax, [ebp - 0x450]
push eax
call fcn.0048ece7
pop ecx
push eax
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402ad0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 1
lea ecx, [ebp - 0x248]
call fcn.0041edb0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.00452e72
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.0041edb0
mov eax, edi
call fcn.0046dc84
ret
Function at 0x45da62
Capabilities:
Enumerate processes

Disassembly:
push 0x280
mov eax, 0x5e26d7
call fcn.0046dcda
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x28c], ebx
test eax, eax
je 0x45dc4f
push eax
lea ecx, [ebp - 0x40]
call fcn.004041e0
and dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push eax
call fcn.0045bc25
mov edi, 0x22c
lea eax, [ebp - 0x284]
push edi
push 0
push eax
call fcn.00480640
add esp, 0x10
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x28c], esi
cmp esi, 0xffffffff
je 0x45dc3f
call fcn.004523db
test al, al
je 0x45dae4
out 0x68, al
stosb byte es:[edi], al
sal dword [ebx + 0x2b], 1
loopne 0x45db5b
xchg ecx, eax
adc byte [0x9f3aeaba], dl
inc edi
lea eax, [ebp - 0x284]
mov dword [ebp - 0x284], edi
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x45dbbc
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp word [ebp - 0x260], ax
je 0x45db23
lea eax, [ebp - 0x260]
push eax
call fcn.0048ece7
pop ecx
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x28]
call fcn.00402ad0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.0045bc25
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00454c66
test eax, eax
je 0x45db77
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0045689a
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x40]
or ebx, 1
call fcn.00454c66
mov byte [ebp - 0x285], 0
test eax, eax
jne 0x45db7e
invalid
add eax, ebp
cli
jo 0x45db6a
invalid
inc esi
test dword [ebx - 3], edi
invalid
mov byte [ebp - 0x285], 1
test bl, 1
je 0x45db92
push 0
push 1
lea ecx, [ebp - 0x58]
and ebx, 0xfffffffe
call fcn.0041edb0
cmp byte [ebp - 0x285], 0
jne 0x45dc55
push 0
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0041edb0
lea eax, [ebp - 0x284]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x45dafc
call fcn.004524ef
test al, al
je 0x45dbec
out dx, al
add byte [0x8304fa7f], 0xfd
aam 0x52
fnsave dword [esi]
dec ebp
jno 0x45db66
and bl, byte [0x5813f8d9]
cli
loop 0x45dc27
inc ecx
scasb al, byte es:[edi]
out dx, al
in al, 0x2e
dec ebp
push edx
call fcn.00451f8b
test al, al
je 0x45dc0e
std
out 0x83, al
wait
in eax, dx
outsb dx, byte [esi]
wait
mov ecx, 0x1d67b05e
invalid
call fcn.0045223d
test al, al
je 0x45dc33
push ebx
sar byte [edi + 0x32], cl
jbe 0x45dc1b
mov cl, 0xcf
cmpsb byte [esi], byte es:[edi]
dec edx
mov byte [0x293f642a], al
pop edx
in eax, dx
daa
inc ebp
push esp
pop edx
loopne 0x45dbe5
cmc
or eax, eax
jl 0x45dc33
push dword [ebp - 0x28c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ch, 0x74
std
invalid
xor esi, esi
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.0041edb0
mov eax, esi
call fcn.0046dc84
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x27c]
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.0041edb0
jmp 0x45dc41
Function at 0x45dc70
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x214], 0
lea eax, [ebp - 0x20c]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0x208
push 0
push eax
call fcn.00480640
add esp, 0xc
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x45dcf5
lea eax, [ebp - 0x218]
push eax
push 4
lea eax, [ebp - 0x210]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x45dcee
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.004041e0
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0046d81d
mov esp, ebp
pop ebp
ret
Function at 0x464481
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
push str.kernel32.dll
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
call fcn.004524ef
test al, al
je 0x4644b4
popal
pop esi
add byte [ecx - 0x1faf17fa], cl
invalid
lcall 0xbec8, 0xe3b4c7d
jmp 0x46fdf065
call fcn.004521f8
test al, al
je 0x4644dc
push 0x11c46142
jb 0x464495
clc
invalid
call fcn.00452015
test al, al
je 0x4644fb
inc ecx
sub eax, 0x42205f2b
mov ah, 2
shr byte [esp + ecx*8], 1
dec esi
cmp eax, 0x8b35aeeb
add byte [ecx - 0x6b], 0xc7
jns 0x464487
mov ebx, dword [ebp - 4]
pop ebp
cld
cmp dword [ebx], 0
jne 0x46450a
xor eax, eax
jmp 0x4645d4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5eceb4
push dword [ebx]
call esi
push str.IsWow64Process
push dword [ebx]
mov dword [ebx + 8], eax
call esi
push str.Wow64DisableWow64FsRedirection
push dword [ebx]
mov dword [ebx + 0xc], eax
call esi
push str.Wow64RevertWow64FsRedirection
push dword [ebx]
mov dword [ebx + 0x18], eax
call esi
push 0x5eddfc
push dword [ebx]
mov dword [ebx + 0x14], eax
call esi
push str.advapi32.dll
mov dword [ebx + 0x10], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx + 4], eax
call fcn.004521f8
test al, al
je 0x46457e
sub dl, byte [edi + 0x7348dad2]
pop edi
rcr byte [esi], 1
or al, 0xa9
sbb bl, byte [edi + esi + 0x4947c18f]
fisubr word [esi + 0x38]
cwde
call 0xd2433420
call fcn.0045209f
test al, al
je 0x4645a5
mov dh, 0x4b
int1
xor byte [ebp + 0x71], 0x53
xchg esi, eax
sub byte [eax], 0x4b
cmp dword [eax + 0x63f05dd8], ebp
push edi
mov esi, 0x1bb194c6
or esi, dword [ecx - 0x1c]
mov dl, 0x37
mov dl, 0xc4
mov esi, dword [ebp - 4]
cmp dword [esi + 4], 0
je 0x464503
mov ebx, str.Wow64RevertWow64FsRedirection
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push dword [esi + 4]
mov dword [esi + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x1c], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46497c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x4649a4
xor al, al
jmp 0x464a71
call fcn.00452420
test al, al
je 0x4649cd
bound edi, qword [eax + 1]
sbb cl, dh
inc edi
sar al, 1
push ds
test dword [ebx - 0x32], 0xdfa1669c
insd dword es:[edi], dx
aam 0x3b
aas
setne byte [edi + 0x32]
add ah, byte [esi]
mov edx, 0x5d8b0a00
cld
call fcn.004521f8
test al, al
je 0x4649f6
jbe 0x4649f1
xchg ecx, eax
ror byte [ecx + 0x4b258796], 1
retf 0x5179
mov ch, 0x33
mov ah, byte [ecx - 0x3d]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x18]
push eax
mov dword [ecx], eax
call fcn.0046d82e
mov esi, eax
mov dword [ebp - 8], esi
pop ecx
test esi, esi
je 0x46499d
call fcn.00452579
test al, al
je 0x464a4b
mov ch, 0xb7
stc
adc dword [bx + 0x7e], edi
rcl dword [0xae5a41aa], cl
jge 0x464a93
adc ebx, 0x7a02a9b1
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [ebp + 0x18]
push dword [ecx]
push eax
push esi
call fcn.0047f350
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
adc eax, sym.imp.ole32.dll_CoInitializeEx