joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b630
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0xc
push edi
push str.KaseyaLangXlateListSema
push 0
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 0xc
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 1
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
test edi, edi
jne 0x43b678
push str.ERROR:_Failed_to_create_list_mutex_in_unloadLangXml___n
call fcn.0043b270
add esp, 4
xor eax, eax
pop edi
add esp, 0xc
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x1388
push edi
call esi
cmp eax, 0x80
jne 0x43b696
push 0x1388
push edi
call esi
test eax, eax
je 0x43b6b6
push str.ERROR:_Failed_to_obtain_list_mutex_in_unloadLangXml___n
call fcn.0043b270
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop edi
add esp, 0xc
ret
mov esi, dword [0x4ccb04]
test esi, esi
je 0x43b6d1
mov eax, esi
mov esi, dword [esi]
push eax
call fcn.0045932f
add esp, 4
test esi, esi
jne 0x43b6c0
push edi
mov dword [0x4ccb04], 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop edi
add esp, 0xc
ret

Function at 0x43b700
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x1c]
push edi
xor edi, edi
cmp ebx, edi
jne 0x43b718
pop edi
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret
push ebp
push str.KaseyaLangXlateListSema
push edi
lea eax, [esp + 0x14]
push eax
mov dword [ebx], edi
mov dword [esp + 0x18], 0xc
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], 1
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebp, eax
cmp ebp, edi
jne 0x43b75c
push str.ERROR:_Failed_to_create_list_mutex_in_getLangXlateStr___n
call fcn.0043b270
add esp, 4
pop ebp
mov eax, edi
pop edi
pop ebx
add esp, 0xc
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x1388
push ebp
call esi
cmp eax, 0x80
jne 0x43b77a
push 0x1388
push ebp
call esi
test eax, eax
je 0x43b79c
push str.ERROR:_Failed_to_obtain_list_mutex_in_getLangXlateStr___n
call fcn.0043b270
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
add esp, 0xc
ret
mov esi, dword [0x4ccb04]
test esi, esi
je 0x43b7bb
mov eax, dword [esp + 0x20]
lea ebx, [ebx]
cmp dword [esi + 4], eax
je 0x43b7d6
mov esi, dword [esi]
test esi, esi
jne 0x43b7b0
or edi, 0xffffffff
push ebp
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
add esp, 0xc
ret
mov eax, dword [esi + 8]
test eax, eax
je 0x43b7bb
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43b7e0
sub eax, edx
lea edi, [eax + 1]
push edi
push 1
call fcn.00459dd1
add esp, 8
test eax, eax
mov dword [ebx], eax
je 0x43b82e
mov ecx, dword [esp + 0x24]
cmp ecx, 1
jl 0x43b81d
cmp ecx, edi
jg 0x43b81d
dec ecx
push ecx
mov ecx, dword [esi + 8]
push ecx
push eax
call fcn.00458f80
add esp, 0xc
xor edi, edi
jmp 0x43b7be
mov edx, dword [esi + 8]
mov cl, byte [edx]
inc edx
mov byte [eax], cl
inc eax
test cl, cl
jne 0x43b820
xor edi, edi
jmp 0x43b7be
mov edi, 0x4099
jmp 0x43b7be
Function at 0x43c0e0
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x214
push ebx
push esi
push edi
push str.KaseyaStatisticLogByPeriodSema
xor ebx, ebx
push ebx
lea eax, [esp + 0x18]
mov edi, 1
push eax
mov dword [esp + 0x1c], 0xc
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
cmp esi, ebx
mov dword [esp + 0xc], esi
jne 0x43c145
lea ecx, [esp + 0x20]
push str.ERROR:_Failed_to_create_mutex_in_buildStatLogByStatPeriod__._n
push ecx
call fcn.00458ee7
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x28], edi
call fcn.0043e010
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x214
ret
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x43c183
lea eax, [esp + 0x20]
push str.ERROR:_Failed_to_obtain_mutex_in_buildStatLogByStatPeriod__._n
push eax
call fcn.00458ee7
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x28], edi
call fcn.0043e010
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
add esp, 0x214
ret
mov edi, dword [0x4ccb0c]
cmp edi, ebx
push ebp
mov ebp, dword [esp + 0x228]
je 0x43c1d5
lea esi, [ebp + 0x14]
lea eax, [edi + 0xc]
jmp 0x43c1a0
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x43c1c4
test cl, cl
je 0x43c1c0
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x43c1c4
add eax, 2
add esi, 2
test cl, cl
jne 0x43c1a0
xor eax, eax
jmp 0x43c1c9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x43c228
mov ebx, edi
mov edi, dword [edi]
test edi, edi
jne 0x43c195
push 0x114
call fcn.00459619
mov esi, eax
add esp, 4
test esi, esi
jne 0x43c211
push 0x114
lea edx, [esp + 0x28]
push str.Failed_to_allocate__d_bytes_for_the_firewall_log_table._n
push edx
call fcn.00458ee7
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x30], 1
call fcn.0043e010
add esp, 0x10
xor eax, eax
test ebx, ebx
mov ecx, 0x45
mov edi, esi
rep stosd dword es:[edi], eax
jne 0x43c263
mov dword [0x4ccb0c], esi
jmp 0x43c265
test edi, edi
je 0x43c1d5
mov eax, dword [ebp + 8]
test eax, eax
jne 0x43c24b
mov eax, dword [ebp + 4]
add dword [edi + 4], eax
js 0x43c242
mov eax, dword [ebp + 4]
test eax, eax
jge 0x43c2a8
mov dword [edi + 4], 0x7fffffff
jmp 0x43c2a8
mov ecx, dword [ebp + 4]
add dword [edi + 8], ecx
js 0x43c25a
mov eax, dword [ebp + 4]
test eax, eax
jge 0x43c2a8
mov dword [edi + 8], 0x7fffffff
jmp 0x43c2a8
mov dword [ebx], esi
lea eax, [ebp + 0x14]
lea edx, [esi + 0xc]
sub edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x43c270
mov eax, dword [ebp + 8]
test eax, eax
mov eax, dword [ebp + 4]
jne 0x43c294
test eax, eax
mov dword [esi + 4], eax
jge 0x43c2a2
mov dword [esi + 4], 0x7fffffff
jmp 0x43c2a2
test eax, eax
mov dword [esi + 8], eax
jge 0x43c2a2
mov dword [esi + 8], 0x7fffffff
mov dword [esi], 0
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x214
ret
Function at 0x43ee00
Capabilities:
Query service status

Disassembly:
sub esp, 0x1c
push edi
mov edi, edx
xor edx, edx
test eax, eax
mov dword [esp + 8], edx
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
mov dword [esp + 4], 0
mov dword [esp + 0x1c], edx
je 0x43eefe
test ecx, ecx
je 0x43eefe
test edi, edi
je 0x43eefe
push esi
push 4
push ecx
push eax
mov dword [edi], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x43ee95
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x43ee88
cmp eax, 0x7b
je 0x43ee7b
cmp eax, 0x424
je 0x43ee7b
mov edi, 0xffffff9d
pop esi
mov eax, edi
pop edi
add esp, 0x1c
ret
mov edi, 0xfffffffe
pop esi
mov eax, edi
pop edi
add esp, 0x1c
ret
mov edi, 0xfffffffd
pop esi
mov eax, edi
pop edi
add esp, 0x1c
ret
lea eax, [esp + 8]
push eax
push esi
mov dword [esp + 0x14], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x43eee7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x43eed3
cmp eax, 0x41b
je 0x43eed3
push esi
mov edi, 0xffffff9d
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov eax, edi
pop edi
add esp, 0x1c
ret
push esi
mov edi, 0xfffffffd
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov eax, edi
pop edi
add esp, 0x1c
ret
mov ecx, dword [esp + 0xc]
mov dword [edi], ecx
push esi
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov eax, edi
pop edi
add esp, 0x1c
ret
or eax, 0xffffffff
pop edi
add esp, 0x1c
ret

Function at 0x43f120
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
push str.KaseyaMonitorListSema
push 0
lea eax, [esp + 0x14]
push eax
or edi, 0xffffffff
mov dword [esp + 0x18], 0xc
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 1
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, eax
test ebx, ebx
jne 0x43f167
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR:_Failed_to_create_list_mutex_in_cleanupMonSetProc__._Code:__d_n
jmp 0x43f199
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x1388
push ebx
call esi
mov edi, eax
cmp edi, 0x80
jne 0x43f189
push 0x1388
push ebx
call esi
mov edi, eax
test edi, edi
je 0x43f1a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR:_Failed_to_obtain_list_mutex_in_cleanupMonSetProc__._Code:__d_n
call fcn.0043ed20
add esp, 8
mov esi, dword [0x4cd0cc]
test esi, esi
je 0x43f1c2
jmp 0x43f1b0
mov eax, esi
mov esi, dword [esi + 4]
push eax
call fcn.0043ec60
add esp, 4
test esi, esi
jne 0x43f1b0
test edi, edi
mov dword [0x4cd0cc], 0
jne 0x43f1d7
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test ebx, ebx
je 0x43f1e2
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x443020
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x914
push esi
mov esi, dword [esp + 0x91c]
xor edx, edx
test esi, esi
je 0x44313c
push edi
mov edi, dword [esp + 0x924]
test edi, edi
je case.0x44305a.5
mov ecx, dword [edi + 0x114]
lea eax, [ecx - 1]
cmp eax, 5
ja case.0x44305a.5
jmp dword [eax*4 + 0x443144]
mov eax, dword [edi + 0x224]
jmp 0x44307d
mov eax, dword [edi + 0x124]
mov edx, dword [edi + 0x120]
jmp 0x44307d
mov eax, dword [edi + 0x120]
push edx
push eax
push ecx
push esi
lea eax, [esp + 0x28]
push str._skms__d__d__d.dat
push eax
call fcn.00458ee7
add esp, 0x18
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je case.0x44305a.5
lea edx, [esp + 0x10]
push edx
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x4430e4
lea eax, [edi + 0x10c]
push eax
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jle 0x443134
push 0
lea edx, [esp + 0xc]
push edx
push 0x800
lea eax, [esp + 0x128]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x443134
mov eax, dword [esp + 8]
test eax, eax
jbe 0x443134
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x120]
push str._lu_
push edx
call fcn.00458f3f
add esp, 0xc
cmp eax, 1
jne 0x443134
mov eax, dword [esp + 0xc]
mov dword [edi + 0x29c], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
add esp, 0x914
ret

Function at 0x443160
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0xc
push ebx
push str.KaseyaMonitorListSema
push 0
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 0xc
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 1
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, eax
test ebx, ebx
jne 0x4431ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR:_Failed_to_create_list_mutex_in_RefreshAlarmState__._Code:__d_n
call fcn.0043ed20
add esp, 8
pop ebx
add esp, 0xc
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x32
push ebx
call esi
cmp eax, 0x80
jne 0x4431c5
push 0x32
push ebx
call esi
test eax, eax
je 0x4431e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR:_Failed_to_obtain_list_mutex_in_RefreshAlarmState__._Code:__d_n
call fcn.0043ed20
add esp, 8
pop esi
pop ebx
add esp, 0xc
ret
mov esi, dword [0x4cd0cc]
test esi, esi
je 0x443250
push edi
mov edi, edi
mov edi, dword [esi + 0x2a0]
cmp edi, 0x270f
je case.0x44320e.5
mov eax, dword [esi + 0x114]
lea ecx, [eax - 1]
xor edx, edx
cmp ecx, 5
ja case.0x44320e.5
jmp dword [ecx*4 + 0x443270]
mov eax, dword [esi + 0x224]
jmp 0x44322d
mov eax, dword [esi + 0x124]
jmp 0x44322d
mov eax, dword [esi + 0x120]
mov edx, eax
test eax, eax
je case.0x44320e.5
cmp dword [esi + 0x288], 0
je case.0x44320e.5
push edi
push edx
push eax
push ecx
mov ecx, 0x4cc4cc
call fcn.0042e500
mov esi, dword [esi + 4]
test esi, esi
jne 0x4431f0
pop edi
push ebx
mov dword [0x4cc4fc], 1
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x445570
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x27c
push edi
lea eax, [esp + 0x78]
push 0x104
push eax
call fcn.00443290
mov edi, dword [esp + 0x28c]
mov ecx, dword [esp + 0x290]
lea eax, [edi + ecx]
add esp, 8
cmp edi, eax
mov dword [esp + 8], eax
jae 0x445718
push ebx
push ebp
push esi
lea esp, [esp]
cmp byte [edi], 0
je 0x445715
mov eax, edi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4455c0
sub eax, edx
push 0x2c
push edi
lea ebp, [eax + 1]
xor ebx, ebx
call fcn.004590c0
mov esi, eax
add esp, 8
test esi, esi
je 0x445707
inc esi
push esi
call fcn.0045a28a
add esp, 4
test eax, eax
mov dword [esp + 0x10], eax
jl 0x445707
cmp eax, 5
jg 0x445707
push 0x2c
push esi
call fcn.004590c0
mov esi, eax
add esp, 8
test esi, esi
je 0x445707
inc esi
push esi
call fcn.0045a28a
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
add esp, 4
cmp eax, 3
jne 0x445675
push 0x2c
push esi
call fcn.004590c0
add esp, 8
test eax, eax
je 0x445707
inc eax
push 0x2c
push eax
call fcn.004590c0
add esp, 8
test eax, eax
je 0x445707
inc eax
push 0x2c
push eax
call fcn.004590c0
add esp, 8
test eax, eax
je 0x445707
inc eax
push eax
call fcn.0045a28a
add esp, 4
mov ebx, eax
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
push ebx
push edx
inc eax
push eax
lea ecx, [esp + 0x90]
push ecx
lea edx, [esp + 0x198]
push str._skms__d__d__d.dat
push edx
call fcn.00458ee7
add esp, 0x18
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [esp + 0x1a0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x445707
mov ecx, dword [esp + 0x298]
push ecx
lea edx, [esp + 0x24]
push str._lu_
push edx
call fcn.00458ee7
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 0xc
push 0
lea ecx, [esp + 0x1c]
push ecx
push eax
lea edx, [esp + 0x2c]
push edx
push esi
call ebx
push 0
lea eax, [esp + 0x1c]
push eax
push ebp
push edi
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
add edi, ebp
cmp edi, eax
jb 0x4455b0
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x27c
ret
Function at 0x445720
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
lea eax, [esp - 0x554]
sub esp, 0x554
push eax
call fcn.0045a1c9
mov eax, dword [esp + 4]
mov ecx, dword [0x4cd0f0]
add esp, 4
cmp eax, ecx
jg 0x445753
mov ecx, dword [esp + 0x558]
test ecx, ecx
je 0x445883
push edi
lea ecx, [esp + 0x148]
add eax, 0xe10
push 0x104
push ecx
mov dword [0x4cd0f0], eax
call fcn.00443290
push str.kms_.dat
lea edx, [esp + 0x154]
push edx
lea eax, [esp + 0x25c]
push str._s_s
push eax
call fcn.00458ee7
add esp, 0x18
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x250]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x445882
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
push esi
nop
mov esi, dword [0x4cd0cc]
test esi, esi
je 0x44583c
lea ebx, [ebx]
mov ecx, dword [esi + 0x114]
lea eax, [ecx - 1]
xor edx, edx
cmp eax, 5
ja case.0x4457e0.5
jmp dword [eax*4 + 0x44588c]
mov eax, dword [esi + 0x224]
jmp 0x445803
mov eax, dword [esi + 0x124]
mov edx, dword [esi + 0x120]
jmp 0x445803
mov eax, dword [esi + 0x120]
test eax, eax
je case.0x4457e0.5
push edx
push eax
push ecx
lea eax, [esp + 0x46c]
push str.kms__d__d__d.dat
push eax
call fcn.00458ee7
lea ecx, [esp + 0x474]
push ecx
lea edx, [esp + 0x58]
push edx
call fcn.0045ba9a
add esp, 0x1c
test eax, eax
je 0x445868
mov esi, dword [esi + 4]
test esi, esi
jne 0x4457d0
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x158]
push ecx
lea edx, [esp + 0x364]
push str._s_s
push edx
call fcn.00458ee7
add esp, 0x10
lea eax, [esp + 0x35c]
push eax
call ebx
lea ecx, [esp + 0x14]
push ecx
push edi
call ebp
test eax, eax
jne 0x4457c0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x554
ret
Function at 0x446250
Capabilities:
Check os version

Disassembly:
mov al, byte [0x4cd500]
sub esp, 0x9c
test al, al
jne 0x4462b6
lea eax, [esp]
push eax
mov dword [esp + 4], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x446294
cmp dword [esp + 4], 5
jb 0x446294
mov ecx, dword [str.Global_]
mov edx, dword [0x46bbcc]
mov dword [0x4cd500], ecx
mov dword [0x4cd504], edx
push esi
push edi
mov edi, 0x4cd500
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4462a0
mov ecx, 8
mov esi, str.AgentmonUserTaskAppMsgQueueSema
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, 0x4cd500
add esp, 0x9c
ret

Function at 0x4462d0
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x20
xor ecx, ecx
mov dword [esp + 0xd], ecx
mov dword [esp + 0x11], ecx
push ebx
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0x19], ecx
push edi
lea edx, [esp + 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 0x21], ecx
push edx
lea eax, [esp + 0xc]
xor ebx, ebx
mov word [esp + 0x29], cx
push eax
mov dword [esp + 0x10], ebx
mov byte [esp + 0x1c], bl
mov byte [esp + 0x2f], cl
call fcn.004322a0
add esp, 8
call fcn.00446250
push eax
push ebx
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
cmp edi, ebx
jne 0x44633a
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop ebx
add esp, 0x20
ret
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x446354
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
add esp, 0x20
ret
mov eax, dword [0x4cd4fc]
cmp eax, ebx
je 0x44636a
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [0x4cd4fc], ebx
mov eax, dword [0x4cd4f8]
cmp eax, ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x446383
push eax
call esi
mov dword [0x4cd4f8], ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call esi
pop esi
pop edi
pop ebx
add esp, 0x20
ret
Function at 0x4463a0
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x20
xor ecx, ecx
mov dword [esp + 0xd], ecx
mov dword [esp + 0x11], ecx
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 0x15], ecx
push esi
lea edx, [esp + 0x10]
mov dword [esp + 0xc], eax
mov byte [esp + 0x10], al
mov dword [esp + 0x1d], ecx
push edx
lea eax, [esp + 8]
mov word [esp + 0x25], cx
push eax
mov dword [esp + 0xc], 0
mov byte [esp + 0x2b], cl
call fcn.004322a0
add esp, 8
call fcn.00446250
push eax
push 0
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
jne 0x44640b
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
add esp, 0x20
ret
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x44645b
mov eax, dword [0x4cd4fc]
test eax, eax
je 0x446454
lea edx, [eax + 4]
push edx
push eax
add eax, 0x10
push 0x20000
push eax
call fcn.00447b40
mov eax, dword [0x4cd4fc]
lea ecx, [eax + 0xc]
push ecx
lea edx, [eax + 8]
push edx
add eax, 0x20010
push 0x20000
push eax
call fcn.00447b40
add esp, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
add esp, 0x20
ret

Function at 0x446970
Capabilities:
Check os version

Disassembly:
sub esp, 0x1c0
xor ecx, ecx
mov dword [esp + 0xd], ecx
mov dword [esp + 0x11], ecx
push ebp
mov dword [esp + 0x19], ecx
xor eax, eax
mov dword [esp + 0x1d], ecx
push edi
mov dword [esp + 0xc], eax
lea edx, [esp + 0x12c]
mov word [esp + 0x25], cx
push edx
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], eax
mov byte [esp + 0x18], al
mov byte [esp + 0x2b], cl
xor ebp, ebp
mov byte [esp + 0x2c], 0
mov dword [esp + 0x130], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4469ea
cmp dword [esp + 0x130], 5
jb 0x4469ea
mov eax, dword [str.Global_]
mov ecx, dword [0x46bbcc]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
lea edi, [esp + 0x28]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4469f0
push esi
mov ecx, 7
mov esi, str.KaseyaAgentUserTaskAppMapObj
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x2c]
push edx
push 0
push 0xf001f
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
test eax, eax
mov dword [0x4cd4f8], eax
pop esi
jne 0x446a59
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.004322a0
add esp, 8
lea edx, [esp + 0x28]
push edx
push 0x40010
push 0
push 4
lea eax, [esp + 0x18]
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [0x4cd4f8], eax
mov ebp, 1
push 0
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
mov dword [0x4cd4fc], edi
jne 0x446a80
pop edi
or eax, 0xffffffff
pop ebp
add esp, 0x1c0
ret
xor eax, eax
test ebp, ebp
mov ecx, 0x10004
rep stosd dword es:[edi], eax
je 0x446a92
call fcn.004463a0
pop edi
xor eax, eax
pop ebp
add esp, 0x1c0
ret
Function at 0x447820
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x10]
lea eax, [esp + 4]
push ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
call fcn.00447560
add esp, 4
cmp eax, 0xffffffec
mov dword [esp + 4], eax
jl 0x44785e
test eax, eax
jg 0x44785e
mov eax, 1
add esp, 0xc
ret
push esi
push edi
lea edx, [esp + 8]
push edx
push 0x446fc0
call dword [sym.imp.USER32.dll_EnumWindows]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
mov eax, dword [esp + 0x10]
je 0x447896
xor esi, esi
test eax, eax
jne 0x447896
cmp esi, 0x19
jge 0x447896
push 0xa
call edi
mov eax, dword [esp + 0x10]
inc esi
test eax, eax
je 0x447884
test eax, eax
mov ecx, dword [esp + 0x1c]
mov dword [ecx], eax
jne 0x4478b6
push 0x1f4
mov dword [esp + 0xc], eax
call edi
pop edi
mov eax, 2
pop esi
add esp, 0xc
ret
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret

Function at 0x4478c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
push ebx
push esi
xor ebx, ebx
push edi
xor eax, eax
mov ecx, 0x42
lea edi, [esp + 0x19]
mov byte [esp + 0x18], bl
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
cmp eax, ebx
mov dword [esp + 0x14], ebx
je 0x447a27
cmp byte [eax], 0
je 0x447a27
push 0x104
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00458f80
lea eax, [esp + 0x24]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x447914
sub eax, edx
mov cl, byte [esp + eax + 0x14]
cmp cl, 0x2e
lea eax, [esp + eax + 0x18]
jne 0x447949
mov cl, byte [eax - 3]
or cl, 0x20
cmp cl, 0x65
jne 0x447949
mov dl, byte [eax - 2]
or dl, 0x20
cmp dl, 0x78
jne 0x447949
mov al, byte [eax - 1]
or al, 0x20
cmp al, cl
je 0x447969
lea edi, [esp + 0x18]
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x447950
mov ecx, dword [str..exe]
mov dl, byte [0x47c760]
mov dword [edi], ecx
mov byte [edi + 4], dl
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00447820
add esp, 8
cmp eax, ebx
mov dword [esp + 0x10], eax
jne 0x4479e0
mov esi, dword [esp + 0x14]
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
push ebx
push 0xf060
push 0x112
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x32
call ebx
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4479bd
push 0
push 0
push 0x10
push esi
call edi
push 0x32
call ebx
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x447a1c
push 0
push 0
push 2
push esi
call edi
push 0x32
call ebx
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x447a1c
lea edx, [esp + 0x18]
push edx
call fcn.00447560
add esp, 4
cmp eax, ebx
jbe 0x447a1c
push eax
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x447a1c
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret