joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470298
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
push esi
push edi
mov dword [ebp - 4], ecx
lea eax, [ebx + 0x3c]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x10
mov esi, edx
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add eax, dword [ebp - 4]
mov dword [edx], eax
cmp eax, dword [ebp - 0xc]
ja 0x4702f8
mov ecx, dword [ebp - 4]
push ecx
push esi
mov eax, dword [ebp - 0x10]
add eax, ebx
add eax, 0x28
push eax
call fcn.0046ee70
add esp, 0xc
mov edx, dword [ebp - 4]
add dword [ebx + 0x38], edx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx], eax
xor eax, eax
jmp 0x470409
cmp esi, edi
jne 0x470306
mov eax, 0x1001
jmp 0x470409
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x10]
push ecx
push esi
mov eax, dword [ebp - 0x10]
add eax, ebx
add eax, 0x28
push eax
call fcn.0046ee70
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x10]
add esi, edx
add esp, 0xc
sub dword [ebp - 4], ecx
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.00471300
mov ecx, dword [ebx + 0x18]
xor ecx, dword [ebx + 0x28]
mov dword [edi], ecx
mov eax, dword [ebx + 0x1c]
xor eax, dword [ebx + 0x2c]
mov dword [edi + 4], eax
mov edx, dword [ebx + 0x20]
xor edx, dword [ebx + 0x30]
mov dword [edi + 8], edx
mov ecx, dword [ebx + 0x24]
xor ecx, dword [ebx + 0x34]
mov dword [edi + 0xc], ecx
mov eax, dword [ebx + 0x28]
mov dword [ebx + 0x18], eax
mov edx, dword [ebx + 0x2c]
mov dword [ebx + 0x1c], edx
mov ecx, dword [ebx + 0x30]
mov dword [ebx + 0x20], ecx
mov eax, dword [ebx + 0x34]
mov dword [ebx + 0x24], eax
add edi, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jbe 0x4703df
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.00471300
mov ecx, dword [ebx + 0x18]
xor ecx, dword [esi]
mov dword [edi], ecx
mov eax, dword [ebx + 0x1c]
xor eax, dword [esi + 4]
mov dword [edi + 4], eax
mov edx, dword [ebx + 0x20]
xor edx, dword [esi + 8]
mov dword [edi + 8], edx
mov ecx, dword [ebx + 0x24]
xor ecx, dword [esi + 0xc]
mov dword [edi + 0xc], ecx
mov eax, dword [esi]
mov dword [ebx + 0x18], eax
mov edx, dword [esi + 4]
mov dword [ebx + 0x1c], edx
mov ecx, dword [esi + 8]
mov dword [ebx + 0x20], ecx
mov eax, dword [esi + 0xc]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sub dword [ebp - 4], edx
add esi, eax
mov ecx, dword [ebp - 4]
add edi, eax
cmp ecx, dword [ebp - 0xc]
ja 0x470386
mov eax, dword [ebp - 4]
lea edx, [ebx + 0x28]
push eax
push esi
push edx
call fcn.0046ee70
add esp, 0xc
mov ecx, dword [ebx + 0x38]
and ecx, 0xf0000000
add ecx, dword [ebp - 4]
mov dword [ebx + 0x38], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
sub dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4705b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
mov dword [esp], ecx
mov edi, edx
mov edx, dword [esp]
mov esi, dword [ebx + 0x38]
lea eax, [ebx + 0x3c]
mov dword [edx], esi
lea edx, [ebx + 0x18]
call fcn.00471300
xor ecx, ecx
mov edx, edi
lea eax, [ebx + 0x28]
cmp esi, ecx
jbe 0x4705e7
mov bl, byte [eax]
inc ecx
xor bl, byte [eax - 0x10]
inc eax
mov byte [edx], bl
inc edx
cmp esi, ecx
ja 0x4705d9
mov eax, dword [esp]
mov dword [eax], esi
xor eax, eax
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4782f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x478382
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
cmp byte [esi + 0x30], 0
jne 0x478337
lea edx, [ebp - 8]
mov eax, dword [ebx]
call fcn.00409330
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00404d24
lea edx, [ebp - 0xc]
mov eax, dword [esi + 0x34]
call fcn.0040962c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebx]
call fcn.004052e4
mov esi, eax
push ebx
mov ecx, esi
sub ecx, 1
jno 0x47835b
call fcn.00403e80
mov eax, dword [ebx]
mov edx, 1
call fcn.00405200
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x478389
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404cf4
ret
Function at 0x47e06c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, dword [ebp + 8]
mov eax, ebx
call fcn.00404cd0
lea eax, [ebp - 0x105]
xor ecx, ecx
mov edx, 0x105
call fcn.004036d0
push 0
push edi
lea eax, [ebp - 0x105]
push eax
push esi
call sub.shell32.dll_SHGetSpecialFolderPathA
mov edx, ebx
lea eax, [ebp - 0x105]
call fcn.0040a318
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x47f334
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x47f343
add esp, 0xfffffff0
call fcn.0040427c
mov ebx, edx
mov edi, eax
xor edx, edx
mov eax, edi
call fcn.0047e6f8
push 0x47f4e8
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
mov dword [edi + 0xc8], esi
test esi, esi
jne 0x47f37c
mov ecx, 0x47f4fc
mov dl, 1
mov eax, dword [0x4085e8]
call fcn.0040d96c
call fcn.004046e4
push 0x47f514
mov eax, dword [edi + 0xc8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0xd0], eax
push 0x47f524
mov eax, dword [edi + 0xc8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0xd4], eax
push 0x47f538
mov eax, dword [edi + 0xc8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0xd8], eax
push 0x47f540
mov eax, dword [edi + 0xc8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0xdc], eax
push 0x47f550
mov eax, dword [edi + 0xc8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0xe0], eax
push 0x47f55c
mov eax, dword [edi + 0xc8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0xe4], eax
cmp dword [edi + 0xd0], 0
jne 0x47f425
mov ecx, 0x47f574
mov dl, 1
mov eax, dword [0x4085e8]
call fcn.0040d96c
call fcn.004046e4
cmp dword [edi + 0xd4], 0
jne 0x47f444
mov ecx, 0x47f574
mov dl, 1
mov eax, dword [0x4085e8]
call fcn.0040d96c
call fcn.004046e4
cmp dword [edi + 0xd8], 0
jne 0x47f463
mov ecx, 0x47f574
mov dl, 1
mov eax, dword [0x4085e8]
call fcn.0040d96c
call fcn.004046e4
cmp dword [edi + 0xdc], 0
jne 0x47f482
mov ecx, 0x47f574
mov dl, 1
mov eax, dword [0x4085e8]
call fcn.0040d96c
call fcn.004046e4
cmp dword [edi + 0xe0], 0
jne 0x47f4a1
mov ecx, 0x47f574
mov dl, 1
mov eax, dword [0x4085e8]
call fcn.0040d96c
call fcn.004046e4
cmp dword [edi + 0xe4], 0
jne 0x47f4c0
mov ecx, 0x47f574
mov dl, 1
mov eax, dword [0x4085e8]
call fcn.0040d96c
call fcn.004046e4
call dword [edi + 0xd0]
mov dword [edi + 0xcc], eax
mov eax, edi
test bl, bl
je 0x47f4e1
call fcn.004042d4
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x47f7e4
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x47f7f3
add esp, 0xfffffff0
call fcn.0040427c
mov ebx, edx
mov edi, eax
mov dl, 1
mov eax, dword [0x47f2dc]
call fcn.0047f334
mov dword [edi + 0x28], eax
mov eax, dword [0x4b9440]
call fcn.004051a0
push eax
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
mov dword [edi + 4], esi
test esi, esi
jne 0x47f835
mov ecx, 0x47f920
mov dl, 1
mov eax, dword [0x4085e8]
call fcn.0040d96c
call fcn.004046e4
push 0x47f928
mov eax, dword [edi + 4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x4c], eax
push 0x47f938
mov eax, dword [edi + 4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x50], eax
push 0x47f954
mov eax, dword [edi + 4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x54], eax
push 0x47f96c
mov eax, dword [edi + 4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x58], eax
push 0x47f984
mov eax, dword [edi + 4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x5c], eax
cmp dword [edi + 0x4c], 0
jne 0x47f8a6
mov ecx, 0x47f9a0
mov dl, 1
mov eax, dword [0x4085e8]
call fcn.0040d96c
call fcn.004046e4
cmp dword [edi + 0x50], 0
jne 0x47f8c2
mov ecx, 0x47f9a0
mov dl, 1
mov eax, dword [0x4085e8]
call fcn.0040d96c
call fcn.004046e4
cmp dword [edi + 0x54], 0
jne 0x47f8de
mov ecx, 0x47f9a0
mov dl, 1
mov eax, dword [0x4085e8]
call fcn.0040d96c
call fcn.004046e4
cmp dword [edi + 0x5c], 0
jne 0x47f8fa
mov ecx, 0x47f9a0
mov dl, 1
mov eax, dword [0x4085e8]
call fcn.0040d96c
call fcn.004046e4
mov eax, edi
test bl, bl
je 0x47f90f
call fcn.004042d4
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x480900
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x418960]
call fcn.004057f8
xor eax, eax
push ebp
push 0x480a44
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4b9444], 0
jne 0x480953
mov ecx, dword [0x4ba12c]
mov dl, 1
mov eax, dword [0x4085e8]
call fcn.0040da28
call fcn.004046e4
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.004036d0
mov eax, ebx
call fcn.00405594
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x480a54
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406ae0
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.004055a4
test eax, eax
jle 0x4809eb
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4809e4
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404f68
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404f50
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00409538
test eax, eax
jne 0x4809e4
mov ebx, 0x15
jmp 0x4809f0
mov ebx, 0x10
jmp 0x4809f0
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4b9444]
call fcn.00480858
mov eax, dword [ebp - 8]
call fcn.00480858
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406af8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480a4b
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404cf4
lea eax, [ebp - 0x10]
mov edx, dword [0x418960]
call fcn.004058c8
ret

Function at 0x484eb8
Capabilities:
Hide graphical window

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov eax, ebx
call fcn.00484958
test byte [ebx + 0x23d], 4
jne 0x484f4d
mov edx, esp
mov eax, ebx
call fcn.00442d18
push esp
mov eax, ebx
call fcn.00449ac4
push eax
push 0
mov eax, ebx
test eax, eax
je 0x484eed
sub eax, 0xfffffd9c
push eax
push 0
push 0xfffffffffffffffb
mov eax, dword [ebx + 0x218]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
cmp dword [ebx + 0x22c], 0
jne 0x484f1e
mov ecx, dword [0x4ba39c]
mov dl, 1
mov eax, dword [0x480518]
call fcn.0040da28
call fcn.004046e4
mov eax, ebx
call fcn.004854c0
cmp byte [ebx + 0x57], 0
jne 0x484f54
mov eax, ebx
call fcn.00449cc8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x484f54
push 0
mov eax, ebx
call fcn.00449cc8
push eax
call sub.user32.dll_ShowWindow
jmp 0x484f54
mov eax, ebx
call fcn.00446c30
add esp, 0x10
pop ebx
ret
Function at 0x48c3b4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x48c3e2
mov eax, ebx
call fcn.0048ce68
cmp dword [ebx + 0x40], 0
je 0x48c3db
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x48c453
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x48c445
cmp dword [ebx + 8], 0
je 0x48c404
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x48c416
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x48c445
cmp dword [ebx + 8], 0
je 0x48c3f7
cmp eax, 3
je 0x48c429
dec eax
jne 0x48c3f7
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x48c3f7
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x48c3f7
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x48c471
cmp dword [ebx + 0x14], 0xcc
je 0x48c471
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0048c47c
pop ebx
ret

Function at 0x49cda0
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405190
mov eax, dword [ebp - 8]
call fcn.00405190
xor eax, eax
push ebp
push 0x49ce74
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x14
mov dword [ebp - 0x20], 0x14
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 3
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x40], 3
mov dword [ebp - 0x38], 2
mov eax, dword [ebp - 8]
call fcn.004051a0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], 3
mov eax, 0x49ce80
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.004051a0
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0xc], eax
push ebx
lea eax, [ebp - 0x20]
push eax
push 0x4b
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetSetOptionA
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ce7b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404cf4
ret
Function at 0x49ce88
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405190
mov eax, dword [ebp - 8]
call fcn.00405190
mov eax, dword [ebp - 0xc]
call fcn.00405190
mov eax, dword [ebp + 0xc]
call fcn.00405190
xor eax, eax
push ebp
push 0x49cfac
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x14
mov dword [ebp - 0x24], 0x14
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x3c], 2
mov eax, dword [ebp - 8]
call fcn.004051a0
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], 3
mov eax, 0x49cfbc
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.004051a0
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x10], eax
push 0
push 0
push 3
mov eax, dword [ebp + 0xc]
call fcn.004051a0
push eax
mov eax, dword [ebp - 0xc]
call fcn.004051a0
push eax
mov eax, dword [ebp + 8]
cmp eax, 0xffff
jbe 0x49cf56
call fcn.00403e78
push eax
push esi
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetConnectA
push ebx
lea eax, [ebp - 0x24]
push eax
push 0x4b
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionA
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49cfb3
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404cf4
lea eax, [ebp + 0xc]
call fcn.00404cd0
ret

Function at 0x4a0c60
Capabilities:
Get geographical location

Disassembly:
add esp, 0xfffffff4
mov eax, esp
xor ecx, ecx
mov edx, 0xa
call fcn.004036d0
push 0xa
lea eax, [esp + 4]
push eax
push 0xd
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
cmp byte [esp], 0x31
jne 0x4a0c8e
mov al, 1
jmp 0x4a0c90
xor eax, eax
add esp, 0xc
ret
Function at 0x414789
Capabilities:
Enumerate process modules

Disassembly:
push ebp
push ebx
mov edx, 0x10e
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x414790
call fcn.0042ee70
mov edx, dword [esp + 0x448]
lea ecx, [esp]
call fcn.00419000
mov dword [0x4b5001], 0x4000096
mov dword [0x4b5001], 0x400009a
push dword [esp + 0x444]
push 0x18
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 0x42c], eax
mov dword [0x4b5001], 0x400009b
cmp dword [esp + 0x42c], 0
je 0x41490d
mov dword [0x4b5001], 0x400009c
lea ebp, [esp + 4]
mov dword [ebp], 0x428
mov dword [0x4b5001], 0x400009d
lea eax, [esp + 4]
push eax
push dword [esp + 0x430]
call sub.KERNEL32.dll_Module32FirstW
mov dword [esp + 0x430], eax
mov dword [0x4b5001], 0x400009e
cmp dword [esp + 0x430], 0
je 0x4148f7
mov dword [0x4b5001], 0x400009f
push edx
call fcn.0042ecd0
pop edx
push eax
push 1
push 1
push dword [esp + 0xc]
push edx
call fcn.0042ecd0
pop edx
push eax
push edx
call fcn.0042ecd0
pop edx
push eax
lea ebp, [esp + 0x1c]
lea eax, [ebp + 0x20]
push eax
call fcn.0042dd70
call fcn.004192b2
add dword [esp], edx
call fcn.0042cd80
call fcn.00419290
and eax, eax
je 0x4148bc
mov dword [0x4b5001], 0x40000a0
lea ebp, [esp + 4]
push dword [ebp + 0x14]
pop eax
mov dword [esp + 0x434], eax
mov dword [0x4b5001], 0x40000a1
jmp 0x4148f7
mov dword [0x4b5001], 0x40000a2
mov dword [0x4b5001], 0x40000a3
lea eax, [esp + 4]
push eax
push dword [esp + 0x430]
call sub.KERNEL32.dll_Module32NextW
mov dword [esp + 0x430], eax
mov dword [0x4b5001], 0x40000a4
jmp 0x41482c
mov dword [0x4b5001], 0x40000a5
push dword [esp + 0x42c]
call sub.KERNEL32.dll_CloseHandle
mov dword [0x4b5001], 0x40000a6
mov dword [0x4b5001], 0x40000a8
mov eax, dword [esp + 0x434]
jmp 0x414936
push dword [esp]
call fcn.0042eed0
add esp, 0x438
pop ebx
pop ebp
ret 8
Function at 0x4157d0
Capabilities:
Get system information on windows

Disassembly:
push ebp
push ebx
mov edx, 0xd
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4157d7
call fcn.0042ee70
mov dword [0x4b5001], 0x400007f
mov dword [0x4b5001], 0x4000081
mov dword [esp + 0x30], 0
mov dword [0x4b5001], 0x4000083
lea eax, [esp + 0xc]
push eax
call sub.KERNEL32.dll_GetNativeSystemInfo
mov dword [0x4b5001], 0x4000084
lea ebp, [esp + 0xc]
movsx ebx, word [ebp]
cmp ebx, 9
jne 0x415909
mov dword [0x4b5001], 0x4000085
mov eax, str.IsWow64Process
push eax
mov eax, str.kernel32.dll
push eax
call fcn.004156d8
mov dword [esp], eax
mov dword [0x4b5001], 0x4000086
cmp dword [esp], 0
je 0x4158ff
mov dword [0x4b5001], 0x4000087
push dword [esp + 0x40]
push 0
push 0x400
call sub.KERNEL32.dll_OpenProcess
mov dword [esp + 8], eax
mov dword [0x4b5001], 0x4000088
cmp dword [esp + 8], 0
je 0x4158f5
mov dword [0x4b5001], 0x4000089
lea eax, [esp + 4]
push eax
push dword [esp + 0xc]
push dword [esp + 8]
call fcn.0041c0f5
mov dword [0x4b5001], 0x400008a
push dword [esp + 8]
call sub.KERNEL32.dll_CloseHandle
mov dword [0x4b5001], 0x400008b
mov ebx, dword [esp + 4]
and ebx, ebx
jne 0x4158eb
mov dword [0x4b5001], 0x400008c
mov dword [esp + 0x30], 1
mov dword [0x4b5001], 0x400008d
mov dword [0x4b5001], 0x400008e
mov dword [0x4b5001], 0x400008f
mov dword [0x4b5001], 0x4000090
mov dword [0x4b5001], 0x4000092
mov eax, dword [esp + 0x30]
jmp 0x41592f
add esp, 0x34
pop ebx
pop ebp
ret 4

Function at 0x415b5a
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
push ebx
mov edx, 0xd
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x415b61
call fcn.0042ee70
mov dword [0x4b5001], 0x171
mov dword [0x4b5001], 0x172
mov byte [esp], 0
mov dword [0x4b5001], 0x174
lea eax, [esp + 4]
push eax
push 0x28
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.ADVAPI32.DLL_OpenProcessToken
and eax, eax
je 0x415ca1
mov dword [0x4b5001], 0x175
lea eax, [esp + 8]
mov dword [0x4b5001], 0x177
lea eax, [esp + 8]
push eax
mov eax, str.SeDebugPrivilege
push eax
push 0
call sub.ADVAPI32.DLL_LookupPrivilegeValueW
and eax, eax
je 0x415c84
mov dword [0x4b5001], 0x178
lea eax, [esp + 0x10]
mov dword [0x4b5001], 0x17b
lea ebp, [esp + 0x10]
mov dword [ebp], 1
mov dword [0x4b5001], 0x17c
lea ebp, [esp + 8]
push dword [ebp]
lea ebp, [esp + 0x14]
push ebp
pop ebp
pop eax
mov dword [ebp + 4], eax
mov dword [0x4b5001], 0x17d
lea ebp, [esp + 8]
push dword [ebp + 4]
lea ebp, [esp + 0x14]
push ebp
pop ebp
pop eax
mov dword [ebp + 8], eax
mov dword [0x4b5001], 0x17e
push ebp
pop ebp
mov dword [ebp + 0xc], 2
mov dword [0x4b5001], 0x180
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x24]
push eax
push 0x10
lea eax, [esp + 0x1c]
push eax
push 0
push dword [esp + 0x18]
call sub.ADVAPI32.DLL_AdjustTokenPrivileges
push eax
pop eax
mov byte [esp], al
mov dword [0x4b5001], 0x181
mov dword [0x4b5001], 0x182
push dword [esp + 4]
call sub.KERNEL32.dll_CloseHandle
mov dword [0x4b5001], 0x183
mov dword [0x4b5001], 0x184
movsx eax, byte [esp]
movsx eax, al
jmp 0x415cca
add esp, 0x34
pop ebx
pop ebp
ret
Function at 0x416b37
Capabilities:
Get graphical window text

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
call fcn.0042ee70
mov edx, dword [esp + 0x14]
lea ecx, [esp]
call fcn.00419000
mov dword [0x4b5001], 0x3b7
mov dword [0x4b5001], 0x3b9
push 5
call sub.USER32.DLL_GetDesktopWindow
push eax
call sub.USER32.DLL_GetWindow
mov dword [esp + 4], eax
mov dword [0x4b5001], 0x3ba
cmp dword [esp + 4], 0
je 0x416c92
mov dword [0x4b5001], 0x3bb
push edx
call fcn.0042ecd0
pop edx
push eax
push edx
call fcn.0042ecd0
pop edx
push eax
push dword [esp + 0xc]
call sub.USER32.DLL_GetWindowTextLengthW
mov ebx, eax
add ebx, 2
push ebx
call fcn.0042d6b0
lea eax, [esp + 0xc]
push eax
call fcn.0042ed70
mov dword [0x4b5001], 0x3bc
push dword [esp + 8]
call fcn.0042ce60
push eax
push dword [esp + 0xc]
push dword [esp + 0xc]
call sub.USER32.DLL_GetWindowTextW
mov dword [0x4b5001], 0x3bd
push edx
call fcn.0042ecd0
pop edx
push eax
push edx
call fcn.0042ecd0
pop edx
push eax
push edx
call fcn.0042ecd0
pop edx
push eax
push dword [esp + 0xc]
call fcn.0042d7f0
call fcn.0042ee00
push edx
call fcn.0042ecd0
pop edx
push eax
push edx
call fcn.0042ecd0
pop edx
push eax
push dword [esp + 0x18]
call fcn.0042d7f0
call fcn.004192b2
add dword [esp], edx
call fcn.004192b2
add dword [esp + 4], edx
call fcn.0042ce00
call fcn.00419290
and eax, eax
je 0x416c5d
mov dword [0x4b5001], 0x3be
mov eax, 1
jmp 0x416cac
mov dword [0x4b5001], 0x3bf
mov dword [0x4b5001], 0x3c0
push 2
push dword [esp + 8]
call sub.USER32.DLL_GetWindow
mov dword [esp + 4], eax
mov dword [0x4b5001], 0x3c1
jmp 0x416b76
mov dword [0x4b5001], 0x3c2
xor eax, eax
jmp 0x416cac
push dword [esp]
call fcn.0042eed0
push dword [esp + 8]
call fcn.0042eed0
add esp, 0xc
pop ebx
ret 4