joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433254
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x45bb80], 0
je 0x4333a3
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x45a11c]
mov edx, dword [edx]
xor al, byte [edx + 0xb4]
je 0x4333a3
mov eax, dword [0x45bb84]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x45bb80]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x433372
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x45bb80]
call fcn.00414320
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x43336a
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1a6], 0
je 0x43336a
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x43336a
mov eax, dword [ebp - 0x14]
call fcn.0043bedc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x43336a
push ebp
call fcn.00433210
pop ecx
test al, al
jne 0x43336a
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa0]
cmp eax, dword [ebp - 0x14]
jne 0x433326
mov eax, dword [ebp - 0x14]
call fcn.0043aa0c
dec eax
jle 0x43336a
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbd
call fcn.00403860
cmp byte [ebp - 1], 0
je 0x43336a
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x43336a
mov edx, dword [ebp - 0x14]
mov eax, dword [0x45bb84]
call fcn.004329dc
inc edi
dec ebx
jne 0x4332b9
mov eax, dword [0x45bb84]
cmp dword [eax + 8], 0
jle 0x43338a
mov eax, dword [0x45bb84]
call fcn.00432a6c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4333a3
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00433078
pop ecx
test al, al
jne 0x4333a3
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4530a4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45324f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x453230
mov dl, 1
mov eax, dword [0x4123d4]
call fcn.00403628
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004043e4
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45321f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00440b38
test al, al
je 0x453212
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x453260
lea eax, [ebp - 0x254]
call fcn.004090c8
push eax
push 0x80000002
call fcn.0040648c
test eax, eax
jne 0x453212
xor eax, eax
push ebp
push 0x45320b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x453298
mov eax, dword [ebp - 0xc]
push eax
call fcn.00406494
test eax, eax
jne 0x4531f4
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404654
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4531f4
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404654
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453212
mov eax, dword [ebp - 0xc]
push eax
call fcn.00406484
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x453115
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00415ec8
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453256
lea eax, [ebp - 0x260]
call fcn.004043e4
ret
Function at 0x70dcefaf
Capabilities:
Parse credit card information

Disassembly:
xor dword [ecx + esi], ebp
xor byte [ecx], dh
xor al, 0x31
cmp byte [ecx], dh
cmp al, 0x31
inc eax
xor dword [ecx + esi + 0x48], eax
xor dword [ecx + esi + 0x50], ecx
xor dword [ecx + esi + 0x58], edx
xor dword [ecx + esi + 0x60], ebx
xor dword [ecx + esi + 0x68], esp
xor dword [ecx + esi + 0x70], ebp
xor dword [ecx + esi + 0x78], esi
xor dword [ecx + esi - 0x80], edi
xor dword [ecx + esi + 0x318c3188], eax
nop
xor dword [ecx + esi + 0x319c3198], edx
mov al, byte [0xa831a431]
xor dword [ecx + esi + 0x31b831b0], ebp
mov esp, 0xd431d031
xor eax, ebx
xor esp, ebx
xor eax, esp
xor esp, esp
xor eax, ebp
xor esp, ebp
xor eax, esi
xor esp, esi
xor eax, edi
xor esp, edi
xor dword [eax], eax
xor al, byte [edx + esi]
or byte [edx], dh
Function at 0x70e2302c
Capabilities:
Check for vm using instruction vpcext

Disassembly:
add byte [ecx], al
add byte [eax], al
add byte [eax + 0x46], al
sub dword [eax], eax
sub byte [esi + 0x29], al
add byte [eax], al
add byte [eax], al
add bl, bh
mov al, byte [0x2e327542]
xor eax, 0x342e342e
xor al, 0x2e
xor al, 0x32
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
xchg ecx, eax
jns 0x70e23013
adc al, byte [eax]
xor al, 0x2e
xor al, 0x32
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
xchg ecx, eax
jns 0x70e23013
adc al, byte [eax]
add byte [eax], al
pop dword [edx]
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax + 0x49], bh
sub dword [eax], eax
pop eax
inc esi
sub dword [eax], eax
add byte [eax], al
add byte [eax], al
sti
mov al, byte [0x2e327542]
Function at 0x59cbb0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c4
push 0x3e
push 0xfd
lea eax, [ebp - 0x2c4]
push eax
push 0x48
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [ebp - 4], eax
mov dword [ebp - 4], 0xb538
lea edx, [ebp - 8]
push edx
push 0x70
push 0x27
push 0xb3
push 0x88
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHChangeNotifyRegister]
mov dword [ebp - 0x10], eax
mov eax, 0x5f
mov esp, ebp
pop ebp
ret

Function at 0x59d35b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x59d39a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x59d39a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x59d39a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x59d39a
cmp dword [ecx + 0x74], 0xe
jbe 0x59d39a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x5a1d39
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x60dc40]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x5a1d84
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.005a1f56
test al, al
jne 0x5a1d7e
sub edx, 2
cmp edx, edi
jne 0x5a1d64
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x5a1da6
lea eax, [edi + 2]
cmp edx, eax
je 0x5a1da6
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.005a1c85
add esp, 0x10
jmp 0x5a1ea0
push esi
lea ecx, [ebp - 0x255]
call fcn.005a1f56
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x5a1de9
push dword [ebp - 0x25c]
jmp 0x5a1d96
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x5a1e26
cmp word [ebp - 0x226], 0
je 0x5a1e47
cmp word [ebp - 0x226], ax
jne 0x5a1e26
cmp word [ebp - 0x224], 0
je 0x5a1e47
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.005a1c85
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x5a1e93
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x5a1e00
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x5a1e7b
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x5a1ea0
push 0x5a1ab5
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.005a4b00
add esp, 0x10
jmp 0x5a1e70
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0059d685
leave
ret
Function at 0x5a39d3
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5d9414
push 0x5d940c
push str.FlsAlloc
push 0x1f
call fcn.005a390e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x5a3a07
push dword [ebp + 8]
mov ecx, esi
call dword [0x5a91b0]
call esi
jmp 0x5a3a0d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x5a3a51
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5d9424
push 0x5d941c
push str.FlsGetValue
push 0x21
call fcn.005a390e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x5a3a88
push dword [ebp + 8]
mov ecx, esi
call dword [0x5a91b0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x5a3a90
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5d942c
push 0x5d9424
push str.FlsSetValue
push 0x22
call fcn.005a390e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x5a3aca
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x5a91b0]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x5a8820
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5a884d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5a884d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40ab60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x40ab91
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x40ab80
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x413810
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448bb8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x45d198]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
push 4
push 0x3000
mov dword [ebp - 0x44], 1
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
mov dword [ebp - 0x20], ecx
mov ecx, dword [esi]
and eax, 0xfffffffc
push eax
push 0
push 0
push ecx
mov dword [ebp + 8], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x34], eax
call fcn.00419930
mov ebx, edx
mov edi, eax
or eax, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x3c], edi
mov ecx, edi
mov dword [ebp - 0x38], ebx
je 0x4138db
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push dword [ebp + 8]
push dword [ebp - 0x20]
push ebx
push edi
push dword [ebp - 0x14]
call fcn.00419c60
test eax, eax
mov eax, dword [ebp + 8]
je 0x4138af
mov ecx, edi
mov edx, ebx
cmp dword [ebp - 0x18], eax
je 0x4138db
push 0x4000
push eax
push ebx
push edi
push dword [ebp - 0x14]
call fcn.00419ad0
xorps xmm0, xmm0
movlpd qword [ebp - 0x3c], xmm0
mov ebx, dword [ebp - 0x38]
mov edi, dword [ebp - 0x3c]
movlpd qword [ebp - 0x24], xmm0
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x10], ebx
or ecx, edx
mov dword [ebp - 4], 0
je 0x41393d
cmp dword [esi + 0x18], 0
mov eax, dword [esi + 4]
push 0
push 0
je 0x413908
push ebx
push edi
push dword [eax + 0xc]
push dword [eax + 8]
push 0
push 0
push dword [esi]
call fcn.00416f00
jmp 0x413919
mov ecx, dword [eax + 8]
push edi
push ecx
push 0
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ebx, eax
test ebx, ebx
je 0x41393d
push dword [esi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41396d
mov eax, dword [esi + 4]
push ebx
mov dword [eax], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
or ecx, 0xffffffff
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
mov eax, edi
mov dword [ebp - 4], 1
or eax, ebx
je 0x4139c7
push 0x4000
push dword [ebp + 8]
push ebx
push edi
push dword [ebp - 0x14]
call fcn.00419ad0
mov edx, dword [ebp - 0x18]
jmp 0x4139c9
cmp dword [esi + 0x18], 0
je 0x4139a4
cmp dword [esi + 0x10], 0
je 0x4139a4
xorps xmm0, xmm0
push ebx
movlpd qword [ebp - 0x2c], xmm0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push 0
push 8
push eax
push ebx
push edi
push dword [esi]
call fcn.00418c00
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
jmp 0x413946
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x1c]
xor ecx, ecx
jmp 0x413943
mov edx, ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4139e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448bb8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x45d198]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
push 4
push 0x3000
mov dword [ebp - 0x44], 1
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
mov dword [ebp - 0x20], ecx
mov ecx, dword [esi]
and eax, 0xfffffff8
push eax
push 0
push 0
push ecx
mov dword [ebp + 8], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x34], eax
call fcn.00419930
mov ebx, edx
mov edi, eax
or eax, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x3c], edi
mov ecx, edi
mov dword [ebp - 0x38], ebx
je 0x413aab
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push dword [ebp + 8]
push dword [ebp - 0x20]
push ebx
push edi
push dword [ebp - 0x14]
call fcn.00419c60
test eax, eax
mov eax, dword [ebp + 8]
je 0x413a7f
mov ecx, edi
mov edx, ebx
cmp dword [ebp - 0x18], eax
je 0x413aab
push 0x4000
push eax
push ebx
push edi
push dword [ebp - 0x14]
call fcn.00419ad0
xorps xmm0, xmm0
movlpd qword [ebp - 0x3c], xmm0
mov ebx, dword [ebp - 0x38]
mov edi, dword [ebp - 0x3c]
movlpd qword [ebp - 0x24], xmm0
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x10], ebx
or ecx, edx
mov dword [ebp - 4], 0
je 0x413b0d
cmp dword [esi + 0x18], 0
mov eax, dword [esi + 4]
push 0
push 0
je 0x413ad8
push ebx
push edi
push dword [eax + 0xc]
push dword [eax + 8]
push 0
push 0
push dword [esi]
call fcn.00416f00
jmp 0x413ae9
mov ecx, dword [eax + 8]
push edi
push ecx
push 0
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ebx, eax
test ebx, ebx
je 0x413b0d
push dword [esi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x413b3d
mov eax, dword [esi + 4]
push ebx
mov dword [eax], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
or ecx, 0xffffffff
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
mov eax, edi
mov dword [ebp - 4], 1
or eax, ebx
je 0x413b97
push 0x4000
push dword [ebp + 8]
push ebx
push edi
push dword [ebp - 0x14]
call fcn.00419ad0
mov edx, dword [ebp - 0x18]
jmp 0x413b99
cmp dword [esi + 0x18], 0
je 0x413b74
cmp dword [esi + 0x10], 0
je 0x413b74
xorps xmm0, xmm0
push ebx
movlpd qword [ebp - 0x2c], xmm0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push 0
push 8
push eax
push ebx
push edi
push dword [esi]
call fcn.00418c00
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
jmp 0x413b16
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x1c]
xor ecx, ecx
jmp 0x413b13
mov edx, ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x419740
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4495ab
mov eax, dword fs:[0]
push eax
sub esp, 0x454
mov eax, dword [0x45d198]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push 0x44f668
push str.kernel32.dll
push ebx
mov dword [ebp - 0x460], ebx
mov dword [ebp - 0x45c], 0
call fcn.00417930
push edx
push eax
push ebx
call fcn.00417b50
mov ecx, dword [0x45fbd8]
mov dword [ebp - 0x458], eax
or eax, edx
mov dword [ebp - 0x454], edx
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x44c], 0xffffffff
mov dword [ebp - 0x448], ecx
jne 0x41988c
test ebx, ebx
mov eax, ebx
cmove eax, dword [0x45fbd4]
push eax
call dword [0x44b404]
push eax
push 0x18
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x419852
push 0x424
lea eax, [ebp - 0x434]
mov dword [ebp - 0x438], 0x428
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x438]
push eax
push esi
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x41984b
lea eax, [ebp - 0x418]
push str.kernel32.dll
push eax
call sub.msvcrt.dll__wcsicmp
add esp, 8
test eax, eax
je 0x4198af
lea eax, [ebp - 0x438]
push eax
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x419822
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movlpd qword [ebp - 0x440], xmm0
mov eax, dword [ebp - 0x440]
mov edx, dword [ebp - 0x43c]
push 0x44f668
push edx
push eax
push ebx
call fcn.00417e60
mov dword [ebp - 0x458], eax
mov dword [ebp - 0x454], edx
mov dword [ebp - 0x448], 0
cmp dword [edi + 0x14], 8
mov dword [ebp - 4], 0
jb 0x41989b
mov edi, dword [edi]
push edi
lea ecx, [ebp - 0x460]
call fcn.00412690
or eax, edx
je 0x4198bf
mov bl, 1
jmp 0x4198c1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x41c]
cdq
jmp 0x419869
xor bl, bl
mov esi, dword [ebp - 0x45c]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x419907
mov edx, dword [esi + 8]
mov eax, edx
mov ecx, dword [esi + 0xc]
or eax, ecx
mov dword [ebp - 4], 1
je 0x4198fc
cmp dword [esi], 0
je 0x4198fc
push 0x4000
push dword [esi + 0x10]
push ecx
push edx
push dword [esi + 4]
call fcn.00419ad0
push 0x18
push esi
call fcn.0043733f
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00437548
mov esp, ebp
pop ebp
ret
Function at 0x41c330
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0x14]
sub esp, 0x40
push ebx
push esi
push edi
test ecx, ecx
jle 0x41c358
mov eax, dword [ebp + 0x14]
lea edx, [ebp + 0x1c]
dec ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp + 0x10], ecx
mov dword [ebp - 0xc], eax
jmp 0x41c360
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
test ecx, ecx
jle 0x41c379
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x14], eax
jmp 0x41c381
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
test ecx, ecx
jle 0x41c39a
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x1c], eax
jmp 0x41c3a2
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
test ecx, ecx
jle 0x41c3bb
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x24], eax
jmp 0x41c3c3
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov eax, edx
mov dword [ebp - 4], 0
cdq
xorps xmm0, xmm0
mov dword [ebp - 0x40], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
movlpd qword [ebp - 0x38], xmm0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call 0x41c404
add dword [esp], 5
retf

Function at 0x423003
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x438a10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x45d198]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x438a37
mov ecx, 5
int 0x29
push 2
call fcn.0043831d
push 0x50
lea eax, [ebp - 0x320]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x2cc
lea eax, [ebp - 0x2d0]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x320]
add esp, 0x1c
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], edi
mov word [ebp - 0x208], ss
mov word [ebp - 0x214], cs
mov word [ebp - 0x238], ds
mov word [ebp - 0x23c], es
mov word [ebp - 0x240], fs
mov word [ebp - 0x244], gs
pushfd
pop dword [ebp - 0x210]
mov eax, dword [ebp + 4]
mov dword [ebp - 0x218], eax
lea eax, [ebp + 4]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x2d0], 0x10001
mov eax, dword [eax - 4]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 4]
mov dword [ebp - 0x320], 0xc0000417
mov dword [ebp - 0x31c], 1
mov dword [ebp - 0x314], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x438b42
test esi, esi
jne 0x438b42
push 2
call fcn.0043831d
add esp, 4
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00437548
mov esp, ebp
pop ebp
ret

Function at 0x441e60
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xa4]
shl ecx, 0x10
or ecx, dword [eax + 0xa8]
cmp ecx, 0x60000
jae 0x441e8a
mov eax, 2
pop ebp
ret
push esi
call fcn.00441d90
mov esi, eax
mov eax, dword [ebp + 8]
mov edx, dword [esi + 0x70]
mov ecx, edx
and cl, 2
movzx ecx, cl
neg ecx
sbb ecx, ecx
inc eax
cmp eax, 3
ja case.default.0x441eaa
jmp dword [eax*4 + 0x441ee0]
or edx, 2
lea eax, [ecx + 2]
mov dword [esi + 0x70], edx
pop esi
pop ebp
ret
and edx, 0xfffffffd
mov dword [esi + 0x70], edx
lea eax, [ecx + 2]
pop esi
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0x16
call fcn.004389b0
or eax, 0xffffffff
pop esi
pop ebp
ret