joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4440de
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x44410c
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x444113
cmp ebx, dword [eax + 4]
jae 0x444113
xor eax, eax
jmp 0x444303
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x444124
xor eax, eax
inc eax
jmp 0x444302
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x44413a
cmp ecx, edx
jae 0x44427f
cmp dword [eax + 4], 0
je 0x444143
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x44412b
cmp dword [ebp + 8], 0
je 0x444165
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x44427f
cmp eax, esi
jae 0x44427f
mov eax, dword [0x470420]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x44418a
cmp dword [esi*4 + 0x470428], edi
je 0x444283
inc esi
cmp esi, eax
jl 0x444178
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4442ff
cmp dword [ebp - 8], 0x1000000
jne 0x4442ff
test byte [ebp - 0xc], 0xcc
je 0x444208
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x4442ff
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4442ff
cmp word [eax + 0x18], 0x10b
jne 0x4442ff
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x4442ff
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x444208
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x444208
test byte [ecx + 0x27], 0x80
jne 0x44427f
push 1
push 0x470468
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x44411c
mov ecx, dword [0x470420]
test ecx, ecx
mov edx, ecx
jle 0x44423c
lea eax, [ecx*4 + 0x470424]
cmp dword [eax], edi
je 0x44423c
dec edx
sub eax, 4
test edx, edx
jg 0x444230
test edx, edx
jne 0x44426d
push 0xf
pop ebx
cmp ecx, ebx
jg 0x444249
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x444261
lea eax, [edx*4 + 0x470428]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x44424f
cmp ecx, 0x10
jge 0x44426d
inc ecx
mov dword [0x470420], ecx
push 0
push 0x470468
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x44411c
xor eax, eax
jmp 0x444302
test esi, esi
jle 0x44411c
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x470468
call ebx
test eax, eax
jne 0x44411c
cmp dword [esi*4 + 0x470428], edi
je 0x4442d9
mov eax, dword [0x470420]
lea esi, [eax - 1]
test esi, esi
jl 0x4442c7
cmp dword [esi*4 + 0x470428], edi
je 0x4442c3
dec esi
jns 0x4442b7
test esi, esi
jge 0x4442d7
cmp eax, 0x10
jge 0x4442d2
inc eax
mov dword [0x470420], eax
lea esi, [eax - 1]
jmp 0x4442d9
je 0x4442f1
xor ecx, ecx
test esi, esi
jl 0x4442f1
lea eax, [ecx*4 + 0x470428]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x4442df
push 0
push 0x470468
call ebx
jmp 0x44411c
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x444999
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x4449b2
or eax, 0xffffffff
jmp 0x444a13
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x444a0f
push 0x3d
push esi
call fcn.00444b6e
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x444a0f
cmp esi, eax
je 0x444a0f
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x470234]
sete cl
cmp eax, dword [0x470238]
mov dword [ebp - 8], ecx
jne 0x4449f5
mov edi, eax
call fcn.00444938
mov dword [0x470234], eax
cmp eax, ebx
jne 0x444a4e
cmp dword [ebp + 0xc], ebx
je 0x444a17
cmp dword [0x47023c], ebx
je 0x444a17
call fcn.004409a6
test eax, eax
je 0x444a4e
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x444a20
xor eax, eax
jmp 0x444a12
push 4
call fcn.0043a21b
cmp eax, ebx
pop ecx
mov dword [0x470234], eax
je 0x444a0f
mov dword [eax], ebx
cmp dword [0x47023c], ebx
jne 0x444a4e
push 4
call fcn.0043a21b
cmp eax, ebx
pop ecx
mov dword [0x47023c], eax
je 0x444a0f
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x470234]
call fcn.004448eb
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x444aaf
cmp dword [esi], ebx
je 0x444aaf
lea esi, [esi + edi*4]
push dword [esi]
call fcn.0043a38f
cmp dword [ebp - 8], ebx
pop ecx
jne 0x444a92
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x444af0
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x444a89
mov eax, edi
shl eax, 2
push eax
push dword [0x470234]
call fcn.0043a22d
cmp eax, ebx
pop ecx
pop ecx
je 0x444af0
jmp 0x444aeb
cmp dword [ebp - 8], ebx
jne 0x444b5b
cmp edi, ebx
jge 0x444abe
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x470234]
call fcn.0043a22d
cmp eax, ebx
pop ecx
pop ecx
je 0x444a0f
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x470234], eax
cmp dword [ebp + 0xc], ebx
je 0x444b45
push dword [ebp - 4]
call fcn.0043be50
inc eax
inc eax
push eax
call fcn.0043a21b
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x444b45
push dword [ebp - 4]
push esi
call fcn.00440a80
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x444b3e
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.0043a38f
pop ecx
cmp dword [ebp - 8], ebx
je 0x444b53
push dword [ebp - 4]
call fcn.0043a38f
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x444a12
push dword [ebp - 4]
call fcn.0043a38f
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x444a1c
Function at 0x44501b
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00438fc0
mov eax, dword [0x46f3a0]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, dword [0x4706cc]
mov dword [ebp - 4], eax
jae 0x44515e
mov eax, ebx
sar eax, 5
mov eax, dword [eax*4 + 0x4706e0]
mov ecx, ebx
and ecx, 0x1f
test byte [eax + ecx*8 + 4], 1
je 0x44515e
push 1
push esi
push ebx
call fcn.0043eead
add esp, 0xc
cmp eax, 0xffffffff
mov dword [ebp - 0x1008], eax
je 0x445168
push 2
push esi
push ebx
call fcn.0043eead
add esp, 0xc
cmp eax, 0xffffffff
je 0x445168
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x445108
push 0x1000
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.004412c0
push 0x8000
push ebx
call fcn.0044545a
add esp, 0x14
mov dword [ebp + 8], eax
mov eax, 0x1000
cmp edi, eax
jge 0x4450c7
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push ebx
call fcn.0043c2a4
add esp, 0xc
cmp eax, 0xffffffff
je 0x4450e5
sub edi, eax
test edi, edi
jg 0x4450bc
jmp 0x4450fb
cmp dword [0x47020c], 5
jne 0x4450f8
mov dword [0x470208], 0xd
or esi, 0xffffffff
push dword [ebp + 8]
push ebx
call fcn.0044545a
pop ecx
pop ecx
jmp 0x445148
jge 0x445148
push 0
push dword [ebp + 0xc]
push ebx
call fcn.0043eead
push ebx
call fcn.00441829
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, 0xffffffff
jne 0x445148
mov dword [0x470208], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x47020c], eax
push 0
push dword [ebp - 0x1008]
push ebx
call fcn.0043eead
add esp, 0xc
mov eax, esi
pop edi
jmp 0x44516b
mov dword [0x470208], 9
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0043c1c4
leave
ret
Function at 0x505d30
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00506a70
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00506a70
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x505d90
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x50a070]
test esi, esi
jle 0x505eb0
mov eax, dword [0x50a074]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x505dc4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x505e47
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x505db0
mov dword [esp], ebx
call fcn.00506780
mov edi, eax
test eax, eax
je 0x505ed7
mov eax, dword [0x50a074]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.005068c0
mov edx, dword [0x50a074]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x505eb7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x505e40
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x505e50
add dword [0x50a070], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x50a074]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x505e40
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00505d30
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x505dce
mov eax, dword [0x50a074]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00505d30
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00505d30
lea esi, [esi]
nop
Function at 0x5063f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x50a08c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x50a084]
sub esp, 4
test ebx, ebx
je 0x506445
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x50643e
test esi, esi
je 0x50643e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x506420
mov dword [esp], 0x50a08c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x506780
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x5067a5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x5067b0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x5067a5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x5067f8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x5067ee
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x5067fa
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x5067e0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x98a68c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x98a6b3
call fcn.0092cbf8
mov dword [eax], esi
call fcn.0092cbe5
push 0x16
pop esi
mov dword [eax], esi
call fcn.0092d83a
mov eax, esi
jmp 0x98a708
test dword [ebp + 0xc], 0xfffffff9
jne 0x98a699
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x98a6e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0092cc0b
pop ecx
call fcn.0092cbe5
mov eax, dword [eax]
jmp 0x98a708
test al, 0x10
jne 0x98a706
test al, 1
je 0x98a706
test byte [ebp + 0xc], 2
je 0x98a706
call fcn.0092cbf8
mov dword [eax], 5
call fcn.0092cbe5
mov dword [eax], 0xd
jmp 0x98a6d7
xor eax, eax
pop esi
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x46ec10ae
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x44ce75cd
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x418010
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x18
mov eax, dword [0x634038]
mov edx, dword [0x63403c]
mov dword [esp + 0x14], 0
push esi
lea ecx, [eax + eax]
push edi
or ecx, edx
lea edx, [esp + 0x10]
mov dword [esp + 0x18], ecx
push edx
fild qword [esp + 0x1c]
push 0x20019
push 0
mov esi, 0x190
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
fadd qword [0x634050]
push 0x80000001
mov edi, esi
fstp qword [0x634050]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4180de
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0xc]
push ebp
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
mov ebp, 4
push str.Browse_For_Folder_Width
push eax
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], ebp
call ebx
test eax, eax
jne 0x4180a4
mov edi, dword [esp + 0x1c]
xor esi, esi
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push str.Browse_For_Folder_Height
push ecx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], ebp
call ebx
pop ebp
pop ebx
test eax, eax
jne 0x4180d3
or esi, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, edi
mov eax, esi
pop edi
pop esi
add esp, 0x18
ret

Function at 0x62ad55
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x634410
cmp edx, dword [eax]
je 0x62ad77
add eax, 8
inc ecx
cmp eax, 0x6344a0
jl 0x62ad68
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x634410]
jne 0x62aea5
mov eax, dword [0x638da0]
cmp eax, 1
je 0x62ae7f
test eax, eax
jne 0x62ada8
cmp dword [0x634338], 1
je 0x62ae7f
cmp edx, 0xfc
je 0x62aea5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x62addf
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0062b740
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0062bbd0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x62ae22
lea eax, [ebp - 0x1a4]
push eax
call fcn.0062bbd0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x630a4c
push edi
call fcn.0062daa0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0062b740
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0062b750
lea eax, [ebp - 0xa0]
push 0x630a2c
push eax
call fcn.0062b750
push dword [esi + 0x634414]
lea eax, [ebp - 0xa0]
push eax
call fcn.0062b750
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062da14
add esp, 0x2c
pop edi
jmp 0x62aea5
lea eax, [ebp + 8]
lea esi, [esi + 0x634414]
push 0
push eax
push dword [esi]
call fcn.0062bbd0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x404b11
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0
push 0xf
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x404bb5
push esi
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x404b75
test dl, dl
je 0x404b71
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x404b75
add eax, 2
add ecx, 2
test dl, dl
jne 0x404b55
xor eax, eax
jmp 0x404b7a
sbb eax, eax
or eax, 1
test eax, eax
jne 0x404ba3
push dword [ebp - 0x124]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x404ba3
push 9
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x12c]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x404b4c
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00404ff5
leave
ret
Function at 0x405690
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
shr edx, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], 0
jmp 0x4056c3
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0xc]
jae 0x40571e
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
shl eax, 1
mov dword [ebp - 0x10], eax
cmp dword [0x4d5f514], 0x95
jne 0x40570b
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
lea ecx, [edx + ecx*4]
mov edx, dword [ebp + 8]
call fcn.00405520
jmp 0x4056ba
mov esp, ebp
pop ebp
ret 4
Function at 0x40c2f6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e3e0]
jne 0x40c300
repz ret
jmp fcn.004134cc

Function at 0x41a031
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004104ac
and dword [ebp - 4], 0
cmp dword [0x430a6c], 0
mov ebx, eax
jne 0x41a0e2
push 0x403614
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41a193
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403608
push edi
call esi
test eax, eax
je 0x41a193
push eax
call fcn.0041043a
mov dword [esp], 0x4035f8
push edi
mov dword [0x430a6c], eax
call esi
push eax
call fcn.0041043a
mov dword [esp], 0x4035e4
push edi
mov dword [0x430a70], eax
call esi
push eax
call fcn.0041043a
mov dword [esp], 0x4035c8
push edi
mov dword [0x430a74], eax
call esi
push eax
call fcn.0041043a
pop ecx
mov dword [0x430a7c], eax
test eax, eax
je 0x41a0e2
push 0x4035b0
push edi
call esi
push eax
call fcn.0041043a
pop ecx
mov dword [0x430a78], eax
mov eax, dword [0x430a78]
cmp eax, ebx
je 0x41a13a
cmp dword [0x430a7c], ebx
je 0x41a13a
push eax
call fcn.004104b5
push dword [0x430a7c]
mov esi, eax
call fcn.004104b5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41a13a
test edi, edi
je 0x41a13a
call esi
test eax, eax
je 0x41a131
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41a131
test byte [ebp - 0xc], 1
jne 0x41a13a
or dword [ebp + 0x10], 0x200000
jmp 0x41a173
mov eax, dword [0x430a70]
cmp eax, ebx
je 0x41a173
push eax
call fcn.004104b5
pop ecx
test eax, eax
je 0x41a173
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41a173
mov eax, dword [0x430a74]
cmp eax, ebx
je 0x41a173
push eax
call fcn.004104b5
pop ecx
test eax, eax
je 0x41a173
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x430a6c]
call fcn.004104b5
pop ecx
test eax, eax
je 0x41a193
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41a195
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001271
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x100220f0
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, ecx
mov eax, dword [esi + 0x1c]
push str.SymInitialize
push eax
call edi
mov ecx, dword [esi + 0x1c]
push str.SymFromAddr
push ecx
mov dword [esi], eax
call edi
mov edx, dword [esi + 0x1c]
push str.SymCleanup
push edx
mov dword [esi + 8], eax
call edi
mov dword [esi + 4], eax
mov eax, dword [esi + 0x1c]
push str.SymGetOptions
push eax
call edi
mov ecx, dword [esi + 0x1c]
push str.SymSetOptions
push ecx
mov dword [esi + 0xc], eax
call edi
mov edx, dword [esi + 0x1c]
push str.SymGetModuleInfo64
push edx
mov dword [esi + 0x10], eax
call edi
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x1c]
push str.StackWalk64
push eax
call edi
pop edi
mov dword [esi + 0x18], eax
pop esi
ret

Function at 0x100013ac
Capabilities:
Inspect section memory permissions

Disassembly:
jmp 0x10018d10
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10018cff
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10018d1d
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
add dword [eax], eax
add byte [ebp + 0xf8c784], cl
add byte [eax], al
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10018d7b
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10018d62
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10018d6b
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10018d75
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10018d57
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10018ce1
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10018dc8
dec eax
je 0x10018dbf
sub eax, 3
je 0x10018db6
mov dword [ebp - 4], 0x40
jmp 0x10018de5
mov dword [ebp - 4], 4
jmp 0x10018dcb
mov dword [ebp - 4], 0x20
jmp 0x10018dcb
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x10018e17
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10018d97
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.10018628
mov ebp, 0xff921694
jne 0x10018e22
push 1
push esi
call edi
mov eax, esi
jmp 0x10018e23
rcr byte [edi + 0x5e], 0x5b