joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440273
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0x548f60]
push ebx
mov ebx, ecx
test eax, eax
jne 0x4402df
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp ebx, eax
jne 0x44028d
xor eax, eax
pop ebx
ret
push esi
push edi
push 8
pop esi
push esi
call fcn.004e0c29
mov edi, eax
pop ecx
test edi, edi
je 0x4402ba
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x4402cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call fcn.004e03e4
pop ecx
and dword [0x548f40], 0
mov eax, esi
mov dword [0x548f60], esi
jmp 0x4402dd
mov eax, dword [0x548f44]
mov dword [edi], eax
xor eax, eax
mov dword [edi + 4], ebx
mov dword [0x548f44], edi
pop edi
pop esi
pop ebx
ret
Function at 0x440569
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x543720]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x548f5c], eax
je 0x440594
mov eax, 0x10dd
jmp 0x44068a
mov eax, dword [0x548f60]
test eax, eax
jne 0x44068a
mov eax, 0x40e680
test eax, eax
jne 0x4405b2
push 0x57
pop eax
jmp 0x44068a
test ebx, ebx
jne 0x4405ba
push 6
jmp 0x4405ac
cmp dword [ebx], 0
jne 0x4405d2
push 6
pop eax
mov dword [0x548f60], eax
mov dword [0x548f40], ebx
jmp 0x44068a
push esi
push edi
push 0x18
call fcn.004e0c29
mov esi, eax
pop ecx
test esi, esi
jne 0x4405ea
push 8
pop edi
jmp 0x44066f
mov ecx, dword [ebx]
call fcn.0043fe8d
mov ecx, 0x40e680
mov edi, eax
call fcn.0043fe8d
movzx ecx, byte [edi + 0x36]
mov edx, eax
mov eax, dword [edi + 0x40]
sub eax, ecx
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x440663
cmp ecx, 0x1e
ja 0x440663
cmp dword [edi + 0x44], edx
jne 0x440663
and dword [ebp - 8], 0
lea edx, [ebp - 8]
push edx
push 0x40
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x440639
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x44066f
mov eax, dword [ebp - 0xc]
mov dword [esi + 0xc], eax
mov dword [esi + 4], 1
mov dword [esi + 8], ebx
mov dword [esi + 0x10], edi
mov eax, dword [ebp - 8]
mov dword [esi + 0x14], eax
mov eax, dword [0x548f50]
mov dword [esi], eax
xor eax, eax
mov dword [0x548f50], esi
jmp 0x440688
cmp dword [0x548f58], 0
push 9
pop edi
jne 0x440675
mov dword [0x548f60], edi
test esi, esi
je 0x440680
push esi
call fcn.004e03e4
pop ecx
mov dword [0x548f40], ebx
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004e03e9
mov esp, ebp
pop ebp
ret
Function at 0x452150
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50a178
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x543720]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea eax, [ebx + 0x28]
mov dword [ebp - 0x1c], eax
push eax
mov dword [ebp - 0x18], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov eax, dword [ebx + 0x20]
sub eax, dword [ebx + 0x1c]
test eax, 0xfffffffc
je 0x45224e
mov edx, dword [ebx + 0x20]
mov eax, edx
mov ecx, dword [ebx + 0x1c]
sub eax, ecx
mov byte [ebp - 0x14], 0
push dword [ebp - 0x14]
sar eax, 2
push eax
call fcn.004523b0
mov eax, dword [ebx + 0x1c]
add esp, 8
mov eax, dword [eax]
mov esi, dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, esi
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
jb 0x4521fb
mov ecx, dword [ebx + 0x1c]
mov eax, dword [ecx]
mov edi, dword [eax + 8]
mov esi, dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, esi
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
jbe 0x452233
mov eax, dword [ebx + 0x1c]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
sub eax, 0x6a94b199
push eax
push 0x7ea
push dword [ebx + 0xc]
call esi
mov eax, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x20]
lea edx, [eax + 4]
sub ecx, edx
and ecx, 0xfffffffc
push ecx
push edx
push eax
call fcn.004e0400
add esp, 0xc
add dword [ebx + 0x20], 0xfffffffc
mov eax, dword [ebx + 0x20]
sub eax, dword [ebx + 0x1c]
test eax, 0xfffffffc
je 0x45224e
push 0
push 0
push 0x7e9
push dword [ebx + 0xc]
call esi
lea eax, [ebx + 0x28]
mov dword [ebp - 4], 0xffffffff
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e03e9
mov esp, ebp
pop ebp
ret
Function at 0x452280
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50a178
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x543720]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea eax, [ebx + 0x28]
mov dword [ebp - 0x1c], eax
push eax
mov dword [ebp - 0x18], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov eax, dword [ebx + 0x20]
sub eax, dword [ebx + 0x1c]
test eax, 0xfffffffc
je 0x452381
mov edx, dword [ebx + 0x20]
mov eax, edx
mov ecx, dword [ebx + 0x1c]
sub eax, ecx
mov byte [ebp - 0x14], 0
push dword [ebp - 0x14]
sar eax, 2
push eax
call fcn.004523b0
mov eax, dword [ebx + 0x1c]
add esp, 8
mov eax, dword [eax]
mov esi, dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, esi
jb 0x452345
mov ecx, dword [ebx + 0x1c]
mov eax, dword [ecx]
mov edi, dword [eax + 8]
mov esi, dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, esi
ja 0x452345
mov ecx, dword [ebx + 0x1c]
mov eax, dword [ecx]
mov edi, dword [eax + 4]
mov esi, dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
lea ecx, [esi + edi]
sub ecx, eax
push ecx
push 0x64
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x452381
mov eax, dword [ebx + 0x1c]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
sub eax, 0x6a94b199
push eax
push 0x7ea
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x20]
lea edx, [eax + 4]
sub ecx, edx
and ecx, 0xfffffffc
push ecx
push edx
push eax
call fcn.004e0400
add esp, 0xc
add dword [ebx + 0x20], 0xfffffffc
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e03e9
mov esp, ebp
pop ebp
ret

Function at 0x4529a0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x543720]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x4529e5
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x4529da
cmp dword [ebp - 8], 0x103
jne 0x4529e5
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esi + 8]
push eax
push 4
push esi
push 0x452a30
push 0
push 0
call fcn.004e2ee1
xor ebx, ebx
mov dword [esi + 4], eax
add esp, 0x18
test eax, eax
setne bl
test ebx, ebx
je 0x452a12
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.004e03e9
mov esp, ebp
pop ebp
ret
Function at 0x453560
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
mov ecx, 0x5a4d
mov dword [ebp - 4], eax
cmp word [eax], cx
je 0x45357b
xor eax, eax
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [eax + 0x3c]
add ebx, eax
cmp dword [ebx], 0x4550
je 0x453590
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x2000
push dword [ebx + 0x50]
push dword [ebx + 0x34]
call edi
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
jne 0x4535ca
push 4
push 0x2000
push dword [ebx + 0x50]
push eax
call edi
mov esi, eax
mov dword [ebp - 8], eax
test esi, esi
je 0x45369b
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
push 4
push 0x1000
mov dword [edi + 4], esi
mov dword [edi + 0xc], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
push dword [ebx + 0x50]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebp - 4]
mov eax, dword [ebx + 0x54]
push 4
push 0x1000
add eax, dword [ecx + 0x3c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebx + 0x54]
mov esi, eax
mov eax, dword [ebp - 4]
add ecx, dword [eax + 0x3c]
push ecx
push eax
push esi
call fcn.004e4510
mov ecx, dword [ebp - 4]
mov edx, ebx
push edi
mov eax, dword [ecx + 0x3c]
add eax, esi
mov esi, dword [ebp - 8]
mov dword [edi], eax
mov dword [eax + 0x34], esi
call fcn.004531f0
mov edx, esi
add esp, 0x10
sub edx, dword [ebx + 0x34]
je 0x45365a
mov ecx, edi
call fcn.00453380
mov ecx, edi
call fcn.00453420
test eax, eax
je 0x453694
mov ecx, edi
call fcn.004532a0
mov eax, dword [edi]
mov eax, dword [eax + 0x28]
test eax, eax
je 0x45368b
add eax, esi
je 0x453694
push 0
push 1
push esi
call eax
test eax, eax
je 0x453694
mov dword [edi + 0x10], 1
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.00453760
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x453810
Capabilities:
Get system information on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x543720]
xor eax, ebp
mov dword [ebp - 4], eax
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
push str.GetNativeSystemInfo
push str.kernel32.dll
movdqa xmmword [ebp - 0x40], xmm0
movdqa xmmword [ebp - 0x30], xmm0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45386a
lea ecx, [ebp - 0x40]
push ecx
call eax
jmp 0x453874
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x40]
cmp ax, 6
je 0x45389c
cmp ax, 0xa
je 0x45389c
cmp ax, 9
je 0x45389c
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e03e9
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.004e03e9
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x454210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x543720]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x244], eax
mov esi, reloc.WS2_32.dll_bind
push edi
cmp ecx, 1
jne 0x454248
mov esi, accept
jmp 0x45425c
cmp ecx, 2
jne 0x454254
mov esi, reloc.WS2_32.dll_accept
jmp 0x45425c
cmp ecx, 3
mov eax, esi
cmove esi, eax
cmp dword [ebp + 0xc], 0x40
mov ecx, 0x20119
mov eax, 0x20019
mov dword [ebp - 0x238], ebx
cmove eax, ecx
mov dword [ebp - 0x248], eax
call fcn.00406080
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x240], eax
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x4542be
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x4f676552
push eax
push ecx
mov dword [ebp - 0x18], 0x4b6e6570
mov dword [ebp - 0x14], 0x78457965
mov word [ebp - 0x10], 0x41
call edi
mov ecx, dword [ebp - 0x240]
mov dword [ecx + 0x2c], eax
mov eax, ecx
mov eax, dword [eax + 0x2c]
lea ecx, [ebp - 0x238]
push ecx
push dword [ebp - 0x248]
push 0
push dword [ebp - 0x23c]
push esi
call eax
test eax, eax
je 0x4542f0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004e03e9
mov esp, ebp
pop ebp
ret
push 0x208
lea eax, [ebp - 0x22b]
mov dword [ebp - 0x230], 0x208
push 0
push eax
mov byte [ebp - 0x22c], bl
call fcn.004e4b60
mov eax, dword [ebp - 0x238]
add esp, 0xc
mov dword [ebp - 0x234], 1
mov dword [ebp - 0x23c], eax
call fcn.00406080
mov esi, eax
mov eax, dword [esi + 4]
test eax, eax
je 0x454354
movdqa xmm0, xmmword [0x52e760]
lea ecx, [ebp - 0x1c]
push ecx
push eax
movdqu xmmword [ebp - 0x1c], xmm0
mov byte [ebp - 0xc], bl
call edi
mov dword [esi + 0x30], eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x234]
push eax
mov eax, dword [esi + 0x30]
push 0
push dword [ebp - 0x244]
push dword [ebp - 0x23c]
call eax
test eax, eax
jne 0x4543ce
lea ebx, [eax + 1]
cmp dword [ebp + 0x10], eax
je 0x4543ce
lea eax, [ebp - 0x22c]
mov dl, 0x22
push eax
mov ecx, eax
call fcn.004541c0
add esp, 4
call fcn.00409f40
mov esi, eax
mov eax, dword [esi + 4]
test eax, eax
je 0x4543c0
movdqa xmm0, xmmword [str.PathFileExistsA]
lea ecx, [ebp - 0x1c]
push ecx
push eax
movdqu xmmword [ebp - 0x1c], xmm0
call edi
mov dword [esi + 0x18], eax
lea eax, [ebp - 0x22c]
push eax
mov eax, dword [esi + 0x18]
call eax
mov ebx, eax
mov edi, dword [ebp - 0x238]
test edi, edi
je 0x45440f
call fcn.00406080
mov esi, eax
mov eax, dword [esi + 4]
test eax, eax
je 0x454409
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x43676552
push ecx
push eax
mov dword [ebp - 0x14], 0x65736f6c
mov dword [ebp - 0x10], 0x79654b
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x34]
push edi
call eax
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e03e9
mov esp, ebp
pop ebp
ret
Function at 0x455aa0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x543720]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x23c], 0
test edi, edi
jne 0x455ad9
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e03e9
mov esp, ebp
pop ebp
ret
push 0x228
lea eax, [ebp - 0x234]
mov dword [ebp - 0x238], 0x22c
push 0
push eax
call fcn.004e4b60
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x455ac6
lea eax, [ebp - 0x238]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x455b50
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
lea eax, [ebp - 0x214]
push edi
push eax
call fcn.004e27d7
add esp, 8
test eax, eax
je 0x455b46
lea eax, [ebp - 0x238]
push eax
push esi
call ebx
test eax, eax
jne 0x455b22
jmp 0x455b50
mov dword [ebp - 0x23c], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x23c]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004e03e9
mov esp, ebp
pop ebp
ret

Function at 0x455b70
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50a39b
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x543720]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x455bb8
xor eax, eax
jmp 0x455c53
lea eax, [ebp - 0x240]
mov dword [ebp - 0x240], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x455bb1
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
lea ebx, [ebx]
lea edx, [ebp - 0x21c]
lea ecx, [ebp - 0x258]
call fcn.004538f0
push eax
mov ecx, ebx
mov dword [ebp - 4], 0
call fcn.00404b70
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x244], 0x10
jb 0x455c1e
push dword [ebp - 0x258]
call fcn.004e03e4
add esp, 4
lea eax, [ebp - 0x240]
mov dword [ebp - 0x244], 0xf
push eax
push esi
mov dword [ebp - 0x248], 0
mov byte [ebp - 0x258], 0
call edi
test eax, eax
jne 0x455be0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e03e9
mov esp, ebp
pop ebp
ret
Function at 0x455c70
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x543720]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x124
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x130], pe_nt_image_headers32
push 0
push eax
mov ebx, ecx
call fcn.004e4b60
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x455cfa
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x455cf3
mov edi, dword [sym.imp.KERNEL32.dll_Process32Next]
lea eax, [ebp - 0x10c]
push ebx
push eax
call fcn.004e26fb
add esp, 8
test eax, eax
je 0x455d0d
lea eax, [ebp - 0x130]
push eax
push esi
call edi
test eax, eax
jne 0x455cd1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e03e9
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e03e9
mov esp, ebp
pop ebp
ret

Function at 0x455d30
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x534
mov eax, dword [0x543720]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x455e4c
cmp byte [esi], 0
je 0x455e4c
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
nop
push 0x400
lea eax, [ebp - 0x408]
push 0
push eax
call fcn.004e4b60
add esp, 0xc
push 0x3b
push esi
call fcn.004e21a0
add esp, 8
mov dword [ebp - 0x534], eax
test eax, eax
je 0x455e4c
mov edi, eax
sub edi, esi
cmp edi, 0x3ff
jg 0x455e4c
push edi
lea eax, [ebp - 0x408]
push esi
push eax
call fcn.004e4510
add esp, 0xc
cmp edi, 0x400
jae 0x455e7c
push 0x124
lea eax, [ebp - 0x52c]
mov byte [ebp + edi - 0x408], 0
push 0
push eax
mov dword [ebp - 0x530], pe_nt_image_headers32
call fcn.004e4b60
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x455e3f
lea eax, [ebp - 0x530]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x455e38
jmp 0x455e10
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x50c]
push eax
call fcn.004e26fb
add esp, 8
test eax, eax
je 0x455e5f
lea eax, [ebp - 0x530]
push eax
push esi
call ebx
test eax, eax
jne 0x455e10
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x534]
inc esi
jne 0x455d60
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e03e9
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e03e9
mov esp, ebp
pop ebp
ret
call fcn.004e34a5
int3
Function at 0x455f70
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50a3e9
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x543720]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x24], edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov byte [edi], 0
mov dword [ebp - 4], 0
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], 1
test ebx, ebx
je 0x456110
mov al, byte [edx]
dec ebx
mov byte [ebp + esi - 0x14], al
inc edx
mov ah, byte [ebp - 0x12]
inc esi
mov ch, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov dword [ebp - 0x20], edx
mov byte [ebp - 0xe], ah
mov byte [ebp + 0xb], ch
mov byte [ebp - 0xd], cl
cmp esi, 3
jne 0x45605c
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, ch
shl cl, 4
shr al, 4
add cl, al
mov al, ah
mov byte [ebp - 0x17], cl
mov cl, ch
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, ah
and al, 0x3f
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], al
xor esi, esi
lea ecx, [ecx]
movzx eax, byte [ebp + esi - 0x18]
mov ecx, 0x544ba0
push eax
call fcn.00442ea0
mov ecx, edi
movzx eax, byte [eax]
push eax
call fcn.00442e80
inc esi
cmp esi, 4
jl 0x456030
mov edx, dword [ebp - 0x20]
xor esi, esi
mov ch, byte [ebp + 0xb]
mov cl, byte [ebp - 0xd]
test ebx, ebx
jne 0x455fd7
mov dword [ebp + 8], esi
test esi, esi
je 0x456110
mov eax, esi
cmp esi, 3
jge 0x456096
cmp eax, 3
jae 0x456091
mov byte [ebp + eax - 0x14], 0
inc eax
cmp eax, 3
jl 0x456079
mov dl, byte [ebp - 0x12]
mov ch, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
jmp 0x456099
call fcn.004e34a5
mov dl, byte [ebp - 0xe]
mov al, cl
xor ebx, ebx
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov al, ch
shr al, 4
and ch, 0xf
shl cl, 4
add cl, al
shl ch, 2
mov al, dl
mov byte [ebp - 0x17], cl
shr al, 6
and dl, 0x3f
add ch, al
mov byte [ebp - 0x15], dl
lea eax, [esi + 1]
mov byte [ebp - 0x16], ch
mov dword [ebp - 0x20], eax
test eax, eax
jle 0x4560f8
mov esi, eax
movzx eax, byte [ebp + ebx - 0x18]
mov ecx, 0x544ba0
push eax
call fcn.00442ea0
mov ecx, edi
movzx eax, byte [eax]
push eax
call fcn.00442e80
inc ebx
cmp ebx, esi
jl 0x4560d5
mov esi, dword [ebp + 8]
cmp esi, 3
jge 0x456110
mov ebx, 3
sub ebx, esi
push 0x3d
mov ecx, edi
call fcn.00442e80
dec ebx
jne 0x456104
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x456320
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50a471
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x543720]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
cmp dword [edx + 0x14], 0x10
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x34], edi
jb 0x456369
mov edx, dword [edx]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00455f70
add esp, 4
mov dword [ebp - 4], 1
xor ebx, ebx
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4563ab
cmp eax, ebx
jbe 0x4563ea
cmp dword [ebp - 0x18], 0x10
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
cmovae edx, dword [ebp - 0x2c]
cmovae ecx, dword [ebp - 0x2c]
mov al, byte [edx + ebx]
xor al, 0x6b
mov byte [ecx + ebx], al
inc ebx
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
ja 0x456389
cmp dword [ebp - 0x18], 0x10
lea edx, [ebp - 0x2c]
push eax
cmovae edx, dword [ebp - 0x2c]
mov ecx, edi
call fcn.00455f70
add esp, 4
xor esi, esi
mov dword [ebp - 0x30], 1
cmp dword [edi + 0x10], esi
jbe 0x45640f
nop
push esi
mov ecx, edi
call fcn.00442ea0
push esi
mov ecx, edi
cmp byte [eax], 0x2b
jne 0x4563f4
call fcn.00442ea0
mov byte [eax], 0x5f
jmp 0x456409
push str.invalid_string_position
call fcn.004df6ab
call fcn.00442ea0
cmp byte [eax], 0x2f
jne 0x456409
push esi
mov ecx, edi
call fcn.00442ea0
mov byte [eax], 0x2d
inc esi
cmp esi, dword [edi + 0x10]
jb 0x4563d0
mov byte [ebp - 4], 0
cmp dword [ebp - 0x18], 0x10
jb 0x456424
push dword [ebp - 0x2c]
call fcn.004e03e4
add esp, 4
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004e03e9
mov esp, ebp
pop ebp
ret