joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4085b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x4b8914]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x4085dc
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00471528
mov esp, ebp
pop ebp
ret
push edi
push 0x1ff
lea eax, [ebp - 0x203]
push 0
push eax
mov byte [ebp - 0x204], 0
call fcn.00473a10
push esi
lea ecx, [ebp - 0x204]
push 0x200
push ecx
call fcn.00474194
add esp, 0x18
cmp byte [ebp - 0x204], 0
lea edx, [ebp - 0x204]
je 0x408688
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x204]
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408630
sub eax, esi
mov ecx, edx
lea esi, [ebp - 0x204]
sub ecx, esi
cmp ecx, eax
jge 0x408688
push 0x5c
push edx
call fcn.00473d10
mov esi, eax
lea edx, [ebp - 0x204]
add esp, 8
cmp esi, edx
jbe 0x408664
cmp byte [esi - 1], 0x3a
je 0x4086c0
lea eax, [ebp - 0x204]
cmp esi, eax
jne 0x40869a
cmp byte [esi + 1], 0x5c
jne 0x40869a
push 0x5c
add esi, 2
push esi
call fcn.00473d10
mov esi, eax
add esp, 8
test esi, esi
jne 0x4086c0
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00471528
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x4086df
push 0
lea ecx, [ebp - 0x204]
push ecx
mov byte [esi], 0
call edi
test eax, eax
jne 0x4086bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40871f
mov byte [esi], 0x5c
cmp byte [esi + 1], 0
lea edx, [esi + 1]
jne 0x408621
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00471528
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x204]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4086e8
sub eax, edx
cmp byte [ebp + eax - 0x205], 0x3a
je 0x408688
push 0
lea edx, [ebp - 0x204]
push edx
call edi
test eax, eax
jne 0x408688
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x408688
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor al, al
pop esi
call fcn.00471528
mov esp, ebp
pop ebp
ret

Function at 0x408b90
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add ecx, 4
pop ebp
jmp fcn.00408a60
Function at 0x408d40
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48cd38
mov eax, dword fs:[0]
push eax
sub esp, 0x348
mov eax, dword [0x4b8914]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x1ff
lea eax, [ebp - 0x20f]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x210], bl
call fcn.00473a10
push edi
push str._s
lea ecx, [ebp - 0x210]
push 0x200
push ecx
call fcn.00473771
push 0x13c
lea edx, [ebp - 0x34c]
push ebx
push edx
mov dword [ebp - 0x350], ebx
call fcn.00473a10
add esp, 0x28
lea eax, [ebp - 0x350]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x408dff
mov ecx, dword [ebp + 0x20]
mov dword [ebp - 4], eax
cmp ecx, ebx
je 0x408df8
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne al
movzx eax, al
push eax
call edx
xor al, al
jmp 0x408f18
lea eax, [ebp - 0x350]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x408eee
mov ebx, dword [ebp + 0xc]
jmp 0x408e20
lea ecx, [ebp - 0x324]
push 0x494abc
push ecx
call fcn.0047f12a
add esp, 8
test eax, eax
je 0x408ed8
lea edx, [ebp - 0x324]
push 0x494ab8
push edx
call fcn.0047f12a
add esp, 8
test eax, eax
je 0x408ed8
test dword [ebp - 0x350], 0x10104
jne 0x408ed8
lea eax, [ebp - 0x324]
push eax
push edi
push 0x494ab0
lea ecx, [ebp - 0x210]
push 0x200
push ecx
call fcn.00473771
add esp, 0x14
test byte [ebp - 0x350], 0x10
je 0x408eb8
test bl, bl
je 0x408ed8
sub esp, 0x18
lea edx, [ebp + 0x10]
mov ecx, esp
mov dword [ebp - 0x354], esp
push edx
call fcn.004089f0
lea eax, [ebp - 0x210]
push ebx
push eax
call fcn.00408d40
add esp, 0x20
jmp 0x408ed4
mov ecx, dword [ebp + 0x20]
test ecx, ecx
je 0x408f34
mov edx, dword [ecx]
mov edx, dword [edx + 4]
lea eax, [ebp - 0x350]
push eax
lea eax, [ebp - 0x210]
push eax
call edx
test al, al
je 0x408eee
lea eax, [ebp - 0x350]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x408e20
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x20]
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x408f16
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne al
movzx eax, al
push eax
call edx
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00471528
mov esp, ebp
pop ebp
ret
call fcn.0048c9a0
int3
Function at 0x40ab50
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
xor eax, eax
push ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0x24], 9
mov al, 1
je 0x40ab8b
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40abe0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e9a8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4b8914]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
mov dword [ebp - 0x10], ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
push ebx
push 1
mov dword [ebp - 0x10], ebx
call edi
test eax, eax
jne 0x40acaa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x40acaa
mov ecx, dword [ebp - 0x10]
inc ecx
push 0x4bb4c8
push ecx
call fcn.00475b17
mov esi, eax
add esp, 8
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x40ac96
mov edx, dword [ebp - 0x10]
inc edx
push edx
push ebx
push esi
call fcn.00473a10
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push esi
push 1
call edi
test eax, eax
je 0x40ac96
mov edi, dword [ebp + 8]
push esi
mov ecx, edi
call fcn.00401035
push esi
call fcn.00471f65
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
cmp esi, ebx
je 0x40acaa
push esi
call fcn.00471f65
add esp, 4
mov esi, dword [ebp + 8]
push ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
push 0x495d69
mov ecx, esi
mov byte [esi], bl
call fcn.004010b2
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ace0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e9a8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4b8914]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
mov edi, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push eax
push ebx
mov dword [ebp - 0x10], ebx
call edi
test eax, eax
jne 0x40ada0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40ada0
mov ecx, dword [ebp - 0x10]
inc ecx
push 0x4bb4c8
push ecx
call fcn.00475b17
mov esi, eax
add esp, 8
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x40ad8c
mov edx, dword [ebp - 0x10]
inc edx
push edx
push ebx
push esi
call fcn.00473a10
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push esi
call edi
test eax, eax
je 0x40ad8c
mov edi, dword [ebp + 8]
push esi
mov ecx, edi
call fcn.00401035
push esi
call fcn.00471f65
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
cmp esi, ebx
je 0x40ada0
push esi
call fcn.00471f65
add esp, 4
mov esi, dword [ebp + 8]
push ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
push 0x495d69
mov ecx, esi
mov byte [esi], bl
call fcn.004010b2
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40add0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4b8914]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov dword [ebp - 0x10c], 0
mov byte [ebp - 0x108], 0
call fcn.00473a10
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push str._SystemDrive_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x108]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ae40
sub eax, edx
push eax
lea edx, [ebp - 0x108]
push edx
mov ecx, esi
call fcn.004010b2
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00471528
mov esp, ebp
pop ebp
ret

Function at 0x40ae70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4b8914]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov dword [ebp - 0x10c], 0
mov byte [ebp - 0x108], 0
call fcn.00473a10
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x108]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40aee0
sub eax, edx
push eax
lea edx, [ebp - 0x108]
push edx
mov ecx, esi
call fcn.004010b2
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00471528
mov esp, ebp
pop ebp
ret
Function at 0x40af10
Capabilities:
Get system information on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d06b
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x4b8914]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x113]
push ebx
push eax
mov dword [ebp - 0x140], ebx
mov byte [ebp - 0x114], bl
call fcn.00473a10
xor eax, eax
add esp, 0xc
lea ecx, [ebp - 0x138]
push ecx
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0x138], 9
push 0x103
jne 0x40afe5
lea edx, [ebp - 0x114]
push edx
push str._ProgramFiles_x86__
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x40b019
push 0x104
push str.Internet_Exploreriexplore.exe
push 0x104
lea eax, [ebp - 0x114]
push eax
jmp 0x40b011
lea ecx, [ebp - 0x114]
push ecx
push str._ProgramFiles_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x40b019
push 0x104
push str.Internet_Exploreriexplore.exe
push 0x104
lea edx, [ebp - 0x114]
push edx
call fcn.00475a57
add esp, 0x10
lea eax, [ebp - 0x114]
mov dword [ebp - 0x11c], 0xf
mov dword [ebp - 0x120], ebx
mov byte [ebp - 0x130], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40b038
sub eax, edx
push eax
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x130]
call fcn.004010b2
lea ecx, [ebp - 0x130]
push ecx
mov dword [ebp - 4], ebx
call fcn.0040f530
add esp, 4
cmp dword [ebp - 0x11c], 0x10
mov byte [ebp - 0x139], al
mov dword [ebp - 4], 0xffffffff
jb 0x40b08b
mov edx, dword [ebp - 0x130]
push edx
call fcn.00471f65
add esp, 4
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
cmp byte [ebp - 0x139], bl
je 0x40b0bb
lea eax, [ebp - 0x114]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40b0a8
sub eax, edx
push eax
lea eax, [ebp - 0x114]
push eax
jmp 0x40b0c1
push ebx
push 0x495d69
mov ecx, esi
call fcn.004010b2
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00471528
mov esp, ebp
pop ebp
ret
Function at 0x40b0f0
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d0b9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4b8914]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 5
push edi
push ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 1
call sub.WTSAPI32.dll_WTSQuerySessionInformationA
cmp eax, ebx
je 0x40b18f
mov edx, dword [ebp - 0x10]
cmp edx, ebx
je 0x40b18f
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40b160
sub eax, edi
push eax
push edx
mov ecx, esi
call fcn.004010b2
mov edx, dword [ebp - 0x10]
push edx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.UBASE::OsSessionUserName
push str.__s__WTSQuerySessionInformationA_failed__SessionId:_d_LastError:_d
call fcn.004190e0
add esp, 0x10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40b1c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d102
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x4b8914]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x118], ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov dword [ebp - 0x11c], esi
mov byte [esi], bl
push 0x103
lea eax, [ebp - 0x113]
push ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x118], 1
mov byte [ebp - 0x114], bl
call fcn.00473a10
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x40b277
lea eax, [ebp - 0x114]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40b251
sub eax, edx
push eax
lea edx, [ebp - 0x114]
push edx
mov ecx, esi
call fcn.00402719
push 9
push str.System32
mov ecx, esi
call fcn.00402719
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00471528
mov esp, ebp
pop ebp
ret
Function at 0x40b2a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d102
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x4b8914]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x118], ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov dword [ebp - 0x11c], esi
mov byte [esi], bl
push 0x103
lea eax, [ebp - 0x113]
push ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x118], 1
mov byte [ebp - 0x114], bl
call fcn.00473a10
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x40b357
lea eax, [ebp - 0x114]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40b331
sub eax, edx
push eax
lea edx, [ebp - 0x114]
push edx
mov ecx, esi
call fcn.00402719
push 9
push str.SysWOW64
mov ecx, esi
call fcn.00402719
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00471528
mov esp, ebp
pop ebp
ret
Function at 0x40cf60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
xor eax, eax
push 0x40
push eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x10], 0
call fcn.00473a10
mov cx, word [ebp + 0xc]
mov word [ebp - 0x24], cx
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x54], 0x44
test ecx, ecx
jne 0x40cfa7
lea ecx, [ebp - 0x10]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
jb 0x40cfb2
mov eax, dword [eax]
push ecx
lea edx, [ebp - 0x54]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40cfd6
xor al, al
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40cfe7
push eax
call esi
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x40cff1
push eax
call esi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40d4f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d5eb
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4b8914]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 8]
mov dword [esi + 8], edx
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x10], ecx
push 0xffffffffffffffff
lea ecx, [esi + 0x14]
push 0
lea edx, [edi + 0x14]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push edx
mov byte [ecx], 0
call fcn.00401127
push 0xffffffffffffffff
lea ecx, [esi + 0x30]
push 0
lea eax, [edi + 0x30]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov dword [ebp - 4], 0
mov byte [ecx], 0
call fcn.00401127
mov ecx, dword [edi + 0x4c]
mov dword [esi + 0x4c], ecx
mov dx, word [edi + 0x50]
mov word [esi + 0x50], dx
mov eax, dword [edi + 0x54]
mov dword [esi + 0x54], eax
mov ecx, dword [edi + 0x58]
mov dword [esi + 0x58], ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40d630
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x4b8914]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
push edi
mov edi, dword [esi]
cmp edi, ecx
je 0x40d670
mov eax, ecx
sub eax, ecx
sar eax, 2
lea ebx, [eax*4]
push ebx
push ecx
push edi
call fcn.00471a30
add esp, 0xc
add ebx, edi
mov dword [esi + 4], ebx
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
mov dword [ebp - 0x130], ebx
cmp ebx, 0xffffffff
jne 0x40d6b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateToolhelp32Snapshot_failed__LastError:_d
push str.UBASE::PsEnumProcessId
push 2
call fcn.004191b0
add esp, 0x10
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00471528
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x12c]
push eax
push ebx
mov dword [ebp - 0x12c], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40d7bd
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x124]
cmp ecx, eax
jae 0x40d747
mov edx, dword [esi]
cmp edx, ecx
ja 0x40d747
mov edi, ecx
mov ecx, dword [esi + 8]
sub edi, edx
sar edi, 2
cmp eax, ecx
jne 0x40d737
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x40d7b3
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x40d737
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x40d721
xor ecx, ecx
jmp 0x40d723
add ecx, edx
cmp ecx, eax
jae 0x40d729
mov ecx, eax
push ecx
mov ecx, esi
call fcn.0040d370
mov ebx, dword [ebp - 0x130]
mov eax, dword [esi + 4]
test eax, eax
je 0x40d798
mov edx, dword [esi]
mov ecx, dword [edx + edi*4]
mov dword [eax], ecx
jmp 0x40d798
mov ecx, dword [esi + 8]
cmp eax, ecx
jne 0x40d789
mov edx, dword [esi]
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x40d7b3
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x40d789
mov edx, ecx
shr edx, 1
mov edi, 0x3fffffff
sub edi, edx
cmp edi, ecx
jae 0x40d779
xor ecx, ecx
jmp 0x40d77b
add ecx, edx
cmp ecx, eax
jae 0x40d781
mov ecx, eax
push ecx
mov ecx, esi
call fcn.0040d370
mov eax, dword [esi + 4]
test eax, eax
je 0x40d798
mov edx, dword [ebp - 0x124]
mov dword [eax], edx
add dword [esi + 4], 4
lea eax, [ebp - 0x12c]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40d6d3
jmp 0x40d7d8
push str.vector_T__too_long
call fcn.0048c078
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Process32First_failed__LastError:_d
push str.UBASE::PsEnumProcessId
push 2
call fcn.004191b0
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi]
xor eax, eax
cmp ecx, dword [esi + 4]
mov ecx, dword [ebp - 4]
pop edi
setne al
pop esi
xor ecx, ebp
pop ebx
call fcn.00471528
mov esp, ebp
pop ebp
ret
Function at 0x40d950
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d61b
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x4b8914]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov esi, dword [eax]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x13c], eax
cmp esi, ecx
je 0x40d9b7
mov eax, ecx
sub eax, ecx
sar eax, 2
lea ebx, [eax*4]
push ebx
push ecx
push esi
call fcn.00471a30
mov eax, dword [ebp - 0x13c]
add esp, 0xc
add ebx, esi
mov dword [eax + 4], ebx
xor ebx, ebx
cmp dword [edi + 0x10], ebx
jne 0x40d9d9
push str.WildCard_is_empty
push str.UBASE::PsFastFindProcessByName
push 2
call fcn.004191b0
add esp, 0xc
xor al, al
jmp 0x40db00
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x140], esi
cmp esi, 0xffffffff
jne 0x40da10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateToolhelp32Snapshot_failed__LastError:_d
push str.UBASE::PsFastFindProcessByName
push 2
call fcn.004191b0
add esp, 0x10
xor al, al
jmp 0x40db00
lea ecx, [ebp - 0x138]
push ecx
push esi
mov dword [ebp - 0x138], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40dace
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x144], esp
push 0xffffffffffffffff
push ebx
mov esi, 0xf
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], ebx
push edi
mov byte [ecx], bl
call fcn.00401127
sub esp, 0x1c
mov ecx, esp
mov dword [ecx + 0x14], esi
lea eax, [ebp - 0x114]
mov dword [ecx + 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x148], esp
mov byte [ecx], bl
lea esi, [eax + 1]
nop
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x40da70
sub eax, esi
push eax
lea edx, [ebp - 0x114]
push edx
call fcn.004010b2
mov dword [ebp - 4], 0xffffffff
call fcn.00411e50
add esp, 0x38
cmp al, bl
je 0x40daab
mov ecx, dword [ebp - 0x13c]
lea eax, [ebp - 0x130]
push eax
call fcn.0040d5c0
mov edx, dword [ebp - 0x140]
lea ecx, [ebp - 0x138]
push ecx
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40da2f
mov esi, dword [ebp - 0x140]
jmp 0x40dae9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Process32First_failed__LastError:_d
push str.UBASE::PsFastFindProcessByName
push 2
call fcn.004191b0
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x13c]
mov ecx, dword [eax]
xor edx, edx
cmp ecx, dword [eax + 4]
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00471528
mov esp, ebp
pop ebp
ret