joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f5690
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c0cad
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
lea ecx, [esi + 4]
push edi
call dword [eax + 0x1c]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x3c]
mov ecx, eax
mov dword [ebp - 0x14], eax
mov edx, dword [eax]
call dword [edx + 0x24]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4f57a5
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x3c]
mov edx, dword [esi]
mov ecx, esi
mov edi, eax
call dword [edx + 0x3c]
mov edx, dword [edi]
mov ecx, edi
mov ebx, eax
call dword [edx + 0x24]
mov edx, dword [ebx]
mov edi, eax
mov ecx, ebx
add edi, edi
call dword [edx + 0x20]
add eax, edi
lea ecx, [esi + 8]
push eax
call fcn.004f3010
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp - 0x10]
cmp edi, ebx
ja 0x4f571f
push edi
push dword [ebp + 8]
push dword [esi + 0x14]
call fcn.005854c0
add esp, 0xc
jmp 0x4f573e
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x3c]
push edi
push dword [ebp + 8]
mov ecx, eax
mov edx, dword [eax]
push dword [esi + 0x14]
call dword [edx + 0x30]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
call dword [eax + 0x20]
mov edi, eax
mov ecx, ebx
sub ecx, edi
push ecx
mov ecx, dword [esi + 0x14]
add ecx, edi
push 0
push ecx
call fcn.00585a40
xor ecx, ecx
add esp, 0xc
mov dword [ebp + 8], ecx
test ebx, ebx
je 0x4f5792
lea esp, [esp]
mov eax, dword [esi + 0x14]
mov bl, byte [ecx + eax]
mov ecx, esi
mov eax, dword [esi]
xor bl, 0x5c
call dword [eax + 0x3c]
mov edi, dword [esi + 0x14]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x24]
mov ecx, dword [ebp + 8]
add eax, edi
mov byte [eax + ecx], bl
mov eax, dword [esi + 0x14]
xor byte [ecx + eax], 0x36
inc ecx
mov dword [ebp + 8], ecx
cmp ecx, dword [ebp - 0x10]
jb 0x4f5760
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push str.HMAC:_can_only_be_used_with_a_block_based_hash_function
lea ecx, [ebp - 0x2c]
call fcn.004471f0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x54]
call fcn.004680a0
push 0x614a74
lea eax, [ebp - 0x54]
push eax
call fcn.0058544f
int3
Function at 0x4f9785
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
jmp 0x4f9798
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x4f983f
mov eax, dword [ebp - 8]
mov al, byte [eax + str.cw]
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
shl eax, 1
movzx ecx, byte [ebp - 1]
sar ecx, 7
and ecx, 1
imul ecx, ecx, 0x11b
xor eax, ecx
movzx ecx, byte [ebp - 1]
xor eax, ecx
movzx ecx, byte [ebp - 1]
shl ecx, 8
or eax, ecx
movzx ecx, byte [ebp - 1]
shl ecx, 0x10
or eax, ecx
movzx ecx, byte [ebp - 1]
shl ecx, 1
movzx edx, byte [ebp - 1]
sar edx, 7
and edx, 1
imul edx, edx, 0x11b
xor ecx, edx
shl ecx, 0x18
or eax, ecx
mov dword [ebp - 0x10], eax
and dword [ebp - 0xc], 0
jmp 0x4f980e
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jge 0x4f983a
mov eax, dword [ebp - 0xc]
shl eax, 8
add eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov dword [eax*4 + 0x6d42b0], ecx
mov eax, dword [ebp - 0x10]
shl eax, 0x18
mov ecx, dword [ebp - 0x10]
shr ecx, 8
or ecx, eax
mov dword [ebp - 0x10], ecx
jmp 0x4f9807
jmp 0x4f9791
mov byte [0x6d42ad], 1
leave
ret
Function at 0x4f9848
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
and dword [ebp - 8], 0
jmp 0x4f985c
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x4f9a59
mov eax, dword [ebp - 8]
mov al, byte [eax + 0x5e0200]
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
shl eax, 3
movzx ecx, byte [ebp - 1]
sar ecx, 5
and ecx, 1
imul ecx, ecx, 0x11b
xor eax, ecx
movzx ecx, byte [ebp - 1]
sar ecx, 5
and ecx, 2
imul ecx, ecx, 0x11b
xor eax, ecx
movzx ecx, byte [ebp - 1]
sar ecx, 5
and ecx, 4
imul ecx, ecx, 0x11b
xor eax, ecx
movzx ecx, byte [ebp - 1]
shl ecx, 1
movzx edx, byte [ebp - 1]
sar edx, 7
and edx, 1
imul edx, edx, 0x11b
xor ecx, edx
xor eax, ecx
movzx ecx, byte [ebp - 1]
xor eax, ecx
movzx ecx, byte [ebp - 1]
shl ecx, 3
movzx edx, byte [ebp - 1]
sar edx, 5
and edx, 1
imul edx, edx, 0x11b
xor ecx, edx
movzx edx, byte [ebp - 1]
sar edx, 5
and edx, 2
imul edx, edx, 0x11b
xor ecx, edx
movzx edx, byte [ebp - 1]
sar edx, 5
and edx, 4
imul edx, edx, 0x11b
xor ecx, edx
movzx edx, byte [ebp - 1]
shl edx, 2
movzx esi, byte [ebp - 1]
sar esi, 6
and esi, 1
imul esi, esi, 0x11b
xor edx, esi
movzx esi, byte [ebp - 1]
sar esi, 6
and esi, 2
imul esi, esi, 0x11b
xor edx, esi
xor ecx, edx
movzx edx, byte [ebp - 1]
xor ecx, edx
shl ecx, 8
or eax, ecx
movzx ecx, byte [ebp - 1]
shl ecx, 3
movzx edx, byte [ebp - 1]
sar edx, 5
and edx, 1
imul edx, edx, 0x11b
xor ecx, edx
movzx edx, byte [ebp - 1]
sar edx, 5
and edx, 2
imul edx, edx, 0x11b
xor ecx, edx
movzx edx, byte [ebp - 1]
sar edx, 5
and edx, 4
imul edx, edx, 0x11b
xor ecx, edx
movzx edx, byte [ebp - 1]
xor ecx, edx
shl ecx, 0x10
or eax, ecx
movzx ecx, byte [ebp - 1]
shl ecx, 3
movzx edx, byte [ebp - 1]
sar edx, 5
and edx, 1
imul edx, edx, 0x11b
xor ecx, edx
movzx edx, byte [ebp - 1]
sar edx, 5
and edx, 2
imul edx, edx, 0x11b
xor ecx, edx
movzx edx, byte [ebp - 1]
sar edx, 5
and edx, 4
imul edx, edx, 0x11b
xor ecx, edx
movzx edx, byte [ebp - 1]
shl edx, 2
movzx esi, byte [ebp - 1]
sar esi, 6
and esi, 1
imul esi, esi, 0x11b
xor edx, esi
movzx esi, byte [ebp - 1]
sar esi, 6
and esi, 2
imul esi, esi, 0x11b
xor edx, esi
xor ecx, edx
movzx edx, byte [ebp - 1]
shl edx, 1
movzx esi, byte [ebp - 1]
sar esi, 7
and esi, 1
imul esi, esi, 0x11b
xor edx, esi
xor ecx, edx
shl ecx, 0x18
or eax, ecx
mov dword [ebp - 0x10], eax
and dword [ebp - 0xc], 0
jmp 0x4f9a28
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jge 0x4f9a54
mov eax, dword [ebp - 0xc]
shl eax, 8
add eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov dword [eax*4 + 0x6d52b0], ecx
mov eax, dword [ebp - 0x10]
shl eax, 0x18
mov ecx, dword [ebp - 0x10]
shr ecx, 8
or ecx, eax
mov dword [ebp - 0x10], ecx
jmp 0x4f9a21
jmp 0x4f9855
mov byte [0x6d42ac], 1
pop esi
leave
ret
Function at 0x508880
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c22de
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
lea eax, [esi + 0x18]
mov dword [ebp - 4], 0
mov dword [eax], vtable.CryptoPP::FilterPutSpaceHelper.0
mov dword [ebp - 0x14], eax
mov dword [eax + 8], 0xffffffff
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x3c]
mov dword [eax], vtable.CryptoPP::HashFilter.0
mov eax, dword [ebp + 8]
push 0x6ad138
mov dword [esi], vtable.CryptoPP::HashFilter.2.0
mov dword [esi + 4], vtable.CryptoPP::HashFilter.1.0
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
call fcn.00447260
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 2
push 0x6ad138
call fcn.00447260
mov byte [ebp - 4], 3
mov ecx, dword [esi + 0x2c]
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [esi + 0x34], eax
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x508947
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0xc], eax
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 0x18

Function at 0x50eba0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5b7a6d
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov esi, ecx
push 0xf0000000
push 1
push 0
push 0
push esi
mov dword [esi], 0
call edi
test eax, eax
jne 0x50ec09
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 8
push 1
push 0
push str.Crypto_RNG
push esi
mov ebx, eax
call edi
test eax, eax
jne 0x50ec09
push 0x28
push 1
push eax
push str.Crypto_RNG
push esi
call edi
test eax, eax
je 0x50ec1c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.CryptAcquireContext
lea ecx, [ebp - 0x24]
call fcn.004471f0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x4c]
call fcn.0050e8f0
push 0x615420
lea eax, [ebp - 0x4c]
push eax
call fcn.0058544f
int3
Function at 0x520aa0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x520ab3
test al, 0x10
jne 0x520ab3
mov al, 1
ret
xor al, al
ret
Function at 0x523f50
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword fs:[0x2c]
push ebx
push ebp
mov ebp, ecx
mov edx, dword [eax]
mov eax, dword [0x6d8f6c]
push esi
mov esi, dword [esp + 0x18]
mov ebx, dword [ebp]
push edi
mov edi, dword [esp + 0x18]
cmp eax, dword [edx + 4]
jg 0x523fa1
test esi, esi
je 0x523f96
mov ecx, dword [0x6d8f70]
mov al, byte [edi]
lea edi, [edi + 1]
xor al, bl
shr ebx, 8
movzx eax, al
xor ebx, dword [ecx + eax*4]
sub esi, 1
jne 0x523f81
pop edi
pop esi
mov dword [ebp], ebx
pop ebp
pop ebx
pop ecx
ret 8
push 0x6d8f6c
call fcn.00583a10
add esp, 4
cmp dword [0x6d8f6c], 0xffffffff
jne 0x523f77
call fcn.00525250
push 0x6d8f6c
mov dword [0x6d8f70], eax
call fcn.005839c6
add esp, 4
jmp 0x523f77

Function at 0x525250
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0x2c]
sub esp, 0x408
mov ecx, dword [eax]
mov eax, dword [0x6d8f74]
push ebx
push ebp
push esi
push edi
cmp eax, dword [ecx + 4]
jg 0x525282
pop edi
mov eax, 0x6d8f78
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 0x6d8f74
call fcn.00583a10
add esp, 4
cmp dword [0x6d8f74], 0xffffffff
jne 0x525275
xor ebx, ebx
jmp 0x5252a0
push ecx
mov dl, 1
mov ecx, ebx
xor esi, esi
call fcn.00525a20
movzx eax, ax
lea ecx, [esi + 8]
add esp, 4
mov dword [esp + 0x14], eax
mov dx, ax
jmp 0x5252c0
movzx eax, dx
shl eax, 0x1f
xor eax, esi
shr dx, 1
mov esi, eax
add eax, eax
sar esi, 0x1f
and esi, 0x4c11db7
xor esi, eax
sub ecx, 1
jne 0x5252c0
mov ecx, esi
call fcn.005256f0
mov esi, 0x80
movzx edi, bx
mov ebp, eax
mov dword [esp + 0x14], esi
mov edx, 1
mov cx, si
jmp 0x525300
or esi, edx
movzx esi, si
mov eax, esi
and eax, edi
movzx eax, ax
cmp ax, cx
je 0x525318
cmp ax, dx
jne 0x52531a
jmp 0x525318
xor edi, esi
shr cx, 1
add edx, edx
mov word [esp + 0x14], cx
cmp cx, dx
jbe 0x52532f
mov esi, dword [esp + 0x14]
jmp 0x525300
movzx eax, di
inc ebx
mov dword [esp + eax*4 + 0x18], ebp
mov ebp, 0x100
cmp bx, bp
jb 0x5252a0
mov ecx, ebp
lea esi, [esp + 0x18]
mov edi, 0x6d8f78
rep movsd dword es:[edi], dword [esi]
push 0x6d8f74
call fcn.005839c6
add esp, 4
jmp 0x525275

Function at 0x525a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
test dl, dl
je 0x525a74
push esi
movzx esi, cx
mov edx, 1
mov ecx, 0x80
push edi
mov dword [esp + 8], ecx
mov ax, cx
jmp 0x525a40
or ecx, edx
movzx edi, cx
mov ecx, edi
and ecx, esi
movzx ecx, cx
cmp cx, ax
je 0x525a56
cmp cx, dx
jne 0x525a58
xor esi, edi
shr ax, 1
add edx, edx
mov word [esp + 8], ax
cmp ax, dx
jbe 0x525a6d
mov ecx, dword [esp + 8]
jmp 0x525a40
pop edi
movzx eax, si
pop esi
pop ecx
ret
movzx eax, cx
pop ecx
ret
Function at 0x525f30
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c5195
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
push edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], 0x4000
push eax
push ecx
push 0
push 1
push 2
mov edi, edx
mov dword [ebp - 0x14], 0xffffffff
call dword [sym.imp.MPR.dll_WNetOpenEnumW]
test eax, eax
jne 0x526144
push dword [ebp - 0x10]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
je 0x526144
push ebx
nop
push dword [ebp - 0x10]
push 0
push esi
call fcn.00585a40
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.MPR.dll_WNetEnumResourceW]
test eax, eax
jne 0x52611e
xor ebx, ebx
cmp dword [ebp - 0x14], ebx
jbe 0x525f90
mov eax, dword [ebp - 0x18]
mov esi, eax
cmp dword [esi], 2
jne 0x5260f5
cmp dword [eax + 4], 1
jne 0x5260f5
mov edx, dword [eax + 0x14]
xor eax, eax
mov dword [ebp - 0x38], 0
mov word [ebp - 0x38], ax
mov eax, edx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 7
lea ecx, [eax + 2]
mov dword [ebp - 0x20], ecx
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x526000
sub eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x38]
sar eax, 1
push eax
push edx
call fcn.004496e0
mov dword [ebp - 4], 0
mov eax, dword [edi + 4]
cmp eax, dword [edi + 8]
je 0x526036
lea eax, [ebp - 0x38]
mov ecx, edi
push eax
call fcn.004513a0
jmp 0x526042
lea ecx, [ebp - 0x38]
push ecx
push eax
mov ecx, edi
call fcn.00451410
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
cmp ecx, 8
jb 0x526083
mov edx, dword [ebp - 0x38]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x526079
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x526156
push ecx
push edx
call fcn.00583877
add esp, 8
push 0x6d38ec
mov dword [ebp - 0x20], 0x6d38ec
call fcn.00571f54
add esp, 4
test eax, eax
jne 0x52615b
mov dword [ebp - 4], 1
mov edx, dword [edi + 4]
mov eax, edx
sub eax, dword [edi]
sar eax, 3
imul ecx, eax, 0xaaaaaaab
mov eax, dword [0x6d38e4]
sub eax, dword [0x6d38e0]
sar eax, 3
imul eax, eax, 0xaaaaaaab
cmp ecx, eax
jb 0x5260e1
cmp edi, 0x6d38e0
je 0x5260e1
push dword [ebp - 0x20]
push edx
push dword [edi]
call fcn.0052b180
push 0x6d38ec
mov dword [ebp - 4], 0xffffffff
call fcn.00571f79
add esp, 4
test dword [esi + 0xc], 2
je 0x526107
mov edx, edi
mov ecx, esi
call fcn.00525f30
mov eax, dword [ebp - 0x18]
inc ebx
add esi, 0x20
cmp ebx, dword [ebp - 0x14]
jb 0x525fc4
mov esi, eax
jmp 0x525f90
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0x1c]
call dword [sym.imp.MPR.dll_WNetCloseEnum]
neg eax
pop ebx
sbb eax, eax
pop edi
inc eax
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.00591c98
push eax
call fcn.00570e47
int3
Function at 0x528190
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5c544d
push eax
mov dword fs:[0], esp
lea eax, [ebp - 0x34]
sub esp, 0x230
push ebx
push esi
push edi
push eax
call fcn.005268f0
cmp dword [eax + 0x14], 8
jb 0x5281c2
mov eax, dword [eax]
push eax
push str.New_Folder
push str.Folder
push 0x104
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.SHELL32.dll_PathMakeUniqueName]
mov ecx, dword [ebp - 0x20]
cmp ecx, 8
jb 0x528219
mov edx, dword [ebp - 0x34]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x52820f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5283b8
push ecx
push edx
call fcn.00583877
add esp, 8
push 0
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x34]
push 0xa
xor eax, eax
mov dword [ebp - 0x34], 0
push str.New_Folder
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
call fcn.004496e0
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 1
push eax
push 0
lea ecx, [ebp - 0x18]
call fcn.00451410
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x20]
cmp ecx, 8
jb 0x5282be
mov edx, dword [ebp - 0x34]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x5282b4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5283bd
push ecx
push edx
call fcn.00583877
add esp, 8
sub esp, 0xc
lea eax, [ebp - 0x18]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.004eb8d0
sub esp, 0x18
mov byte [ebp - 4], 2
mov esi, esp
push 6
push str.create
push esi
mov dword [esi], 0
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 6
call fcn.005854c0
add esp, 0xc
mov byte [esi + 6], 0
mov byte [ebp - 4], 0
call fcn.00526240
mov edi, dword [ebp - 0x18]
add esp, 0x24
test edi, edi
je 0x5283a7
mov ebx, dword [ebp - 0x14]
mov esi, edi
cmp esi, ebx
je 0x52836f
mov ecx, dword [esi + 0x14]
cmp ecx, 8
jb 0x528355
mov eax, dword [esi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x52834b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5283bd
mov eax, edx
push ecx
push eax
call fcn.00583877
add esp, 8
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
add esi, 0x18
cmp esi, ebx
jne 0x528320
mov eax, dword [ebp - 0x10]
sub eax, edi
sar eax, 3
imul eax, eax, 0xaaaaaaab
lea ecx, [eax + eax*2]
mov eax, edi
shl ecx, 3
cmp ecx, 0x1000
jb 0x52839d
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5283bd
push ecx
push edi
call fcn.00583877
add esp, 8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00591c98
call fcn.00591c98
int3
Function at 0x528bf0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c5535
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
lea eax, [ebp - 0x24]
push eax
call fcn.005268f0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x3c]
push dword [ebp + 8]
mov edx, eax
call fcn.0044ce40
add esp, 4
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
cmp ecx, 8
jb 0x528c6c
mov edx, dword [ebp - 0x24]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x528c62
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x528dfb
push ecx
push edx
call fcn.00583877
add esp, 8
xor eax, eax
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x28], 8
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x3c]
cmovae eax, dword [ebp - 0x3c]
push eax
mov dword [ebp - 0x10], 7
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x528c9e
lea ecx, [ebp - 0x3c]
call fcn.005286c0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 3
push eax
push 0
lea ecx, [ebp - 0x18]
call fcn.0045f770
sub esp, 0xc
lea eax, [ebp - 0x18]
mov ecx, esp
mov dword [ebp + 8], esp
push eax
call fcn.004eb8d0
sub esp, 0x18
mov byte [ebp - 4], 4
mov esi, esp
push 6
push str.delete
push esi
mov dword [esi], 0
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 6
call fcn.005854c0
add esp, 0xc
mov byte [esi + 6], 0
mov byte [ebp - 4], 3
call fcn.00526240
mov ebx, dword [ebp - 0x18]
add esp, 0x24
test ebx, ebx
je 0x528db2
mov edi, dword [ebp - 0x14]
mov esi, ebx
cmp esi, edi
je 0x528d7a
mov ecx, dword [esi + 0x14]
cmp ecx, 8
jb 0x528d60
mov eax, dword [esi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x528d56
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x528e00
mov eax, edx
push ecx
push eax
call fcn.00583877
add esp, 8
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
add esi, 0x18
cmp esi, edi
jne 0x528d27
mov eax, dword [ebp - 0x10]
sub eax, ebx
sar eax, 3
imul eax, eax, 0xaaaaaaab
lea ecx, [eax + eax*2]
mov eax, ebx
shl ecx, 3
cmp ecx, 0x1000
jb 0x528da8
mov ebx, dword [eax - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x528e00
push ecx
push ebx
call fcn.00583877
add esp, 8
mov ecx, dword [ebp - 0x28]
cmp ecx, 8
jb 0x528de8
mov edx, dword [ebp - 0x3c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x528dde
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x528e00
push ecx
push edx
call fcn.00583877
add esp, 8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.00591c98
call fcn.00591c98
int3
Function at 0x52a760
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c57d5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x270
push ebx
push esi
push edi
xor ebx, ebx
xor esi, esi
xor edi, edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x38]
push 0xc
xor eax, eax
mov dword [ebp - 0x38], edi
push str.explorer.exe
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
call fcn.004496e0
push edi
push 2
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [ebp - 0x27c]
mov dword [ebp - 0x20], eax
push ecx
push eax
mov dword [ebp - 0x27c], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov edx, dword [ebp - 0x38]
test eax, eax
je 0x52a8eb
jmp 0x52a7f0
lea eax, [ebp - 0x258]
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x40], 0
lea edx, [eax + 2]
mov dword [ebp - 0x3c], 7
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x52a810
sub eax, edx
lea ecx, [ebp - 0x50]
sar eax, 1
push eax
lea eax, [ebp - 0x258]
push eax
call fcn.004496e0
cmp dword [ebp - 0x24], 8
lea edx, [ebp - 0x38]
mov ebx, dword [ebp - 0x50]
lea ecx, [ebp - 0x50]
cmovae edx, dword [ebp - 0x38]
cmp dword [ebp - 0x3c], 8
mov eax, dword [ebp - 0x40]
cmovae ecx, ebx
cmp eax, dword [ebp - 0x28]
jne 0x52a860
push eax
call fcn.00450520
add esp, 4
mov byte [ebp - 0xd], 1
test eax, eax
je 0x52a864
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0x3c]
cmp eax, 8
jb 0x52a89b
lea ecx, [eax*2 + 2]
mov eax, ebx
cmp ecx, 0x1000
jb 0x52a891
mov ebx, dword [eax - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x52a95e
push ecx
push ebx
call fcn.00583877
add esp, 8
cmp byte [ebp - 0xd], 0
je 0x52a8cb
cmp esi, edi
je 0x52a8b5
mov eax, dword [ebp - 0x274]
mov dword [esi], eax
add esi, 4
mov dword [ebp - 0x18], esi
jmp 0x52a8cb
lea eax, [ebp - 0x274]
push eax
push esi
lea ecx, [ebp - 0x1c]
call fcn.00467460
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x27c]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x52a7f0
mov ebx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x38]
mov esi, dword [ebx]
mov eax, dword [ebp - 0x24]
cmp eax, 8
jb 0x52a91e
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x52a914
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x52a95e
push ecx
push edx
call fcn.00583877
add esp, 8
test ebx, ebx
je 0x52a94b
sub edi, ebx
mov eax, ebx
and edi, 0xfffffffc
cmp edi, 0x1000
jb 0x52a941
mov ebx, dword [eax - 4]
add edi, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x52a95e
push edi
push ebx
call fcn.00583877
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.00591c98
int3
Function at 0x52a970
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c57fd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 8]
je 0x52a9e6
push esi
mov esi, dword [ebp + 8]
mov ecx, edi
push esi
mov dword [ebp - 0x10], edi
call fcn.00446f20
lea eax, [esi + 0x18]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 0x18]
call fcn.00446f20
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], ecx
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x3c]
pop esi
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], ecx
add dword [ebx + 4], 0x40
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push dword [ebp + 8]
push edi
call fcn.0052b3d0
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4