joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b2a0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x18
push ebx
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
mov dword [esp + 0x18], ebx
test ebx, ebx
jne 0x43b2d2
or eax, 0xffffffff
pop ebx
add esp, 0x18
ret 0x10
mov eax, dword [esp + 4]
xor ecx, ecx
inc eax
mov edx, 4
mul edx
push ebp
push esi
seto cl
neg ecx
or ecx, eax
push edi
push ecx
call fcn.0043b3bf
mov ecx, dword [esp + 0x14]
add esp, 4
mov dword [esp + 0x14], 0
mov ebp, eax
mov dword [esp + 0x20], ebp
test ecx, ecx
je 0x43b36c
mov eax, ebx
sub eax, ebp
mov dword [esp + 0x1c], eax
mov ebx, dword [eax + ebp]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
push esi
call fcn.0043b3bf
add esp, 4
mov edi, eax
push 0
push 0
push esi
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [esp + 0x14]
lea ebp, [ebp + 4]
inc eax
mov dword [ebp - 4], edi
mov ecx, dword [esp + 0x10]
cmp eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
jne 0x43b311
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
push ebx
mov dword [ebp + ecx*4], 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebp
push dword [esp + 0x14]
call fcn.00417790
xor esi, esi
add esp, 8
mov edi, eax
cmp dword [esp + 0x10], esi
je 0x43b3aa
mov ecx, dword [ebp + esi*4]
test ecx, ecx
je 0x43b3aa
push ecx
call fcn.0043b3c8
inc esi
add esp, 4
cmp esi, dword [esp + 0x10]
jne 0x43b392
push ebp
call fcn.0043b3c8
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
Function at 0x401420
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49f638
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4c9860]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x4c9860]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.00401330
mov edx, eax
mov ecx, esi
mov dword [esp + 0x38], 0
call fcn.0042c680
cmp dword [esp + 0x24], 0x10
jb 0x40148c
push dword [esp + 0x10]
call fcn.0047cf40
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0047cf45
mov esp, ebp
pop ebp
ret

Function at 0x401590
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49f638
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4c9860]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x4c9860]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.004014b0
mov edx, eax
mov ecx, esi
mov dword [esp + 0x38], 0
call fcn.0042c680
cmp dword [esp + 0x24], 0x10
jb 0x4015fc
push dword [esp + 0x10]
call fcn.0047cf40
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0047cf45
mov esp, ebp
pop ebp
ret

Function at 0x4019e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 4]
mov edi, ecx
cmp eax, 0x203
ja 0x401abc
je 0x401ad6
cmp eax, 0x100
je 0x401a51
cmp eax, 0x201
jne case.0x401a7a.14
cmp dword [edi + 0x68], 1
movsx eax, word [esi + 0xc]
mov dword [esp + 0x10], eax
movsx eax, word [esi + 0xe]
mov dword [esp + 0x14], eax
je case.0x401a7a.14
lea eax, [esp + 0x10]
push eax
lea ecx, [edi - 0x28]
call fcn.004022c0
push esi
push dword [edi - 0x24]
call dword [sym.imp.USER32.dll_IsDialogMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0xd4], 0
mov ebx, dword [esi + 8]
je case.0x401a7a.14
push ebx
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
cmp cx, ax
jle case.0x401a7a.14
add ebx, 0xfffffff4
cmp ebx, 0x4e
ja case.0x401a7a.14
movzx eax, byte [ebx + 0x401af0]
jmp dword [eax*4 + 0x401ae4]
mov eax, dword [edi + 0xd4]
push esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
cmp cx, ax
jle case.0x401a7a.14
mov eax, dword [edi + 0xd4]
push esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 0x205
je 0x401ad6
push esi
push dword [edi - 0x24]
call dword [sym.imp.USER32.dll_IsDialogMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4026f0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f8c0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4c9860]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
call fcn.004439c0
mov dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0
je 0x40274e
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
sete al
test al, al
jne 0x4027ba
lea ecx, [ebp - 0x44]
call fcn.0043b450
mov edi, eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
cmp eax, edi
je 0x402791
cmp dword [ebp - 0x18], 8
jb 0x402774
push dword [ebp - 0x2c]
call fcn.0047cf40
add esp, 4
xor eax, eax
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
call fcn.0040c240
mov byte [ebp - 4], 0
cmp dword [ebp - 0x30], 8
jb 0x4027a6
push dword [ebp - 0x44]
call fcn.0047cf40
add esp, 4
xor eax, eax
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], 0
mov word [ebp - 0x44], ax
cmp dword [esi + 0x14], 8
jb 0x4027c2
mov esi, dword [esi]
cmp dword [ebp - 0x18], 8
push 0xa
push 0x4b33dc
push esi
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
push 0x4b2b54
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 8
jb 0x4027fb
push dword [ebp - 0x2c]
call fcn.0047cf40
add esp, 4
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0047cf45
mov esp, ebp
pop ebp
ret 4
Function at 0x41b130
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a0600
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4c9860]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push 0
push 0x4ab815
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
call fcn.0042be50
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], 0
call fcn.0046bb10
mov byte [esp + 0x30], 2
cmp dword [esp + 0x20], 0x10
jb 0x41b1ac
push dword [esp + 0xc]
call fcn.0047cf40
add esp, 4
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
call fcn.0046c3a0
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call fcn.0046bd80
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x41bcb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a2280
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4c9860]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
mov eax, dword [0x4c9860]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
lea ecx, [esp + 0x20]
call fcn.0041bbb0
lea ecx, [esp + 8]
mov dword [esp + 0x48], 0
call fcn.00450180
mov byte [esp + 0x48], 1
cmp dword [esp + 0x1c], 8
push dword [esp + 0x18]
lea eax, [esp + 0xc]
cmovae eax, dword [esp + 0xc]
push eax
push dword [esp + 0x38]
push ecx
lea ecx, [esp + 0x30]
call fcn.00423b50
test eax, eax
sete bl
cmp dword [esp + 0x1c], 8
jb 0x41bd3d
push dword [esp + 8]
call fcn.0047cf40
add esp, 4
xor eax, eax
cmp dword [esp + 0x34], 8
mov dword [esp + 0x1c], 7
mov dword [esp + 0x18], 0
mov word [esp + 8], ax
jb 0x41bd67
push dword [esp + 0x20]
call fcn.0047cf40
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0047cf45
mov esp, ebp
pop ebp
ret
Function at 0x41c950
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a2ac0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4c9860]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x28]
call fcn.004439c0
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
je 0x41c9aa
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
sete al
test al, al
jne 0x41ca16
lea ecx, [ebp - 0x40]
call fcn.0043b450
mov esi, eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
cmp eax, esi
je 0x41c9ed
cmp dword [ebp - 0x14], 8
jb 0x41c9d0
push dword [ebp - 0x28]
call fcn.0047cf40
add esp, 4
xor eax, eax
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.0040c240
mov byte [ebp - 4], 0
cmp dword [ebp - 0x2c], 8
jb 0x41ca02
push dword [ebp - 0x40]
call fcn.0047cf40
add esp, 4
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
cmp dword [ebp - 0x14], 8
push 0xa
push 0x4b33dc
push str.http:__www.fanqianbb.com_spage_download.htm
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0x4b2b54
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 8
jb 0x41ca53
push dword [ebp - 0x28]
call fcn.0047cf40
add esp, 4
xor eax, eax
mov word [ebp - 0x28], ax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047cf45
mov esp, ebp
pop ebp
ret
Function at 0x41f340
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a00b8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4c9860]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x4c9860]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x41f494
cmp byte [ebx + 0x45], 0
je 0x41f494
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x41f3a0
xor al, al
jmp 0x41f496
mov ecx, 0xf
mov byte [esp + 0x18], 0
xorps xmm0, xmm0
movq qword [esp + 0x18], xmm0
lea eax, [esp + 0x18]
cmp ecx, 0x10
cmovae eax, dword [esp + 0x18]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], 8
mov byte [eax + 8], 0
mov dword [esp + 0x40], 0
jmp 0x41f3e0
cmp dword [esp + 0x2c], 0x10
mov ecx, dword [ebx + 0x40]
lea eax, [esp + 0x14]
mov edx, dword [ecx]
push eax
mov eax, dword [esp + 0x2c]
lea edi, [esp + 0x1c]
cmovae edi, dword [esp + 0x1c]
lea esi, [esp + 0x1c]
cmovae esi, dword [esp + 0x1c]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x41f421
dec eax
je 0x41f425
sub eax, 2
je 0x41f47b
xor bl, bl
jmp 0x41f47d
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp ecx, 0x10
lea eax, [esp + 0x18]
cmovae eax, edx
sub esi, eax
je 0x41f45c
push dword [ebx + 0x50]
cmp ecx, 0x10
push esi
lea eax, [esp + 0x20]
cmovae eax, edx
push 1
push eax
call fcn.0047ec25
add esp, 0x10
cmp esi, eax
jne 0x41f41d
cmp byte [ebx + 0x45], 0
je 0x41f47b
test esi, esi
jne 0x41f3e0
push esi
push 8
lea ecx, [esp + 0x20]
call fcn.0041ee60
jmp 0x41f3e0
mov bl, 1
cmp dword [esp + 0x2c], 0x10
jb 0x41f490
push dword [esp + 0x18]
call fcn.0047cf40
add esp, 4
mov al, bl
jmp 0x41f496
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0047cf45
mov esp, ebp
pop ebp
ret
Function at 0x422b10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49fd7f
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4c9860]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], 0
mov dword [edi], 0x4b38cc
mov dword [edi + 0x70], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov eax, dword [edi]
mov dword [ebp - 0x10], 1
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov esi, dword [eax + 4]
add esi, edi
mov ecx, esi
call fcn.004273a0
lea eax, [ebp - 0x14]
lea ebx, [edi + 0x10]
push eax
mov ecx, esi
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], 0
call fcn.00427770
push eax
mov dword [ebp - 4], 2
call fcn.00427650
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
add esp, 4
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x422bda
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x422bda
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx]
mov ecx, dword [ebp - 0x18]
push 0x20
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
call eax
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], al
jne 0x422bff
mov eax, dword [esi + 0xc]
or eax, 4
push 0
push eax
mov ecx, esi
call fcn.00427fe0
mov dword [ebp - 4], 3
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ecx + edi - 4], eax
mov ecx, ebx
call fcn.00423f20
lea eax, [ebx + 4]
mov dword [ebx + 0xc], eax
lea eax, [ebx + 0x14]
mov dword [ebx + 0x1c], eax
lea eax, [ebx + 0x18]
mov dword [ebx + 0x20], eax
lea eax, [ebx + 0x24]
mov dword [ebx + 0x2c], eax
mov dword [ebx], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [ebx + 0x4c], 0
mov byte [ebx + 0x45], 0
lea ecx, [ebx + 8]
mov dword [ebx + 0x10], ecx
lea eax, [ebx + 0x28]
mov dword [ebx + 0x30], eax
mov dword [ecx], 0
mov eax, dword [ebx + 0x20]
mov dword [eax], 0
mov eax, dword [ebx + 0x30]
mov dword [eax], 0
mov eax, dword [ebx + 0xc]
mov dword [eax], 0
mov eax, dword [ebx + 0x1c]
mov dword [eax], 0
mov eax, dword [ebx + 0x2c]
mov dword [eax], 0
mov eax, dword [0x4ce9e4]
mov dword [ebx + 0x48], eax
mov dword [ebx + 0x50], 0
mov dword [ebx + 0x40], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x429c90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x429ca5
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
jmp 0x429cb0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x429cb0
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x429d30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x429d49
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
nop
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x429d55
sub eax, edi
sar eax, 1
lea ecx, [eax + 1]
lea edx, [edx + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x429d50
mov eax, dword [ebp - 4]
push esi
push ebx
push 7
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42af70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a2756
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x4c9860]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
push 0x60
push 0
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x42b01c
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x42b01c
call fcn.0040a1f0
mov esi, eax
jmp 0x42b10c
push dword [ebp - 0x420]
push dword [ebp - 0x41c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x42b03f
call fcn.0040a1f0
jmp 0x42b0ff
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x41c], ebx
test ebx, ebx
jne 0x42b05d
call fcn.0040a1f0
jmp 0x42b0ff
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x420], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x42b07e
mov esi, 0x8007000e
jmp 0x42b101
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.004295a0
jmp 0x42b0a8
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
jne 0x42b0bf
mov esi, 0x8007000e
jmp 0x42b101
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x42b0df
call fcn.0040a1f0
jmp 0x42b0ff
mov eax, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor edx, edx
mov word [eax + ecx*2], dx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x42c]
call fcn.0042ae10
mov esi, eax
test edi, edi
je 0x42b10c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x42b130
lea ecx, [ebp - 0x418]
call fcn.00429550
jmp 0x42b130
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0047cf45
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42f8d0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a378b
mov eax, dword fs:[0]
push eax
sub esp, 0x47c
mov eax, dword [0x4c9860]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, edx
mov dword [ebp - 0x46c], edi
mov eax, ecx
mov dword [ebp - 0x474], eax
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x480], edi
xor esi, esi
mov dword [ebp - 0x478], esi
cmp dword [eax + 0x10], esi
je 0x42f963
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x470], ebx
cmp ebx, 0xffffffff
je 0x42f963
mov dword [ebp - 0x468], 0x22c
lea eax, [ebp - 0x468]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x42f973
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x42f9b8
mov ebx, dword [ebp - 0x470]
mov edi, dword [ebp - 0x46c]
lea eax, [ebp - 0x468]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x42f9af
lea eax, [ebp - 0x444]
push eax
mov ecx, dword [ebp - 0x474]
call fcn.0040bc60
push eax
call fcn.0047f8fe
add esp, 8
test eax, eax
jne 0x42f973
cmp dword [edi + 0x10], eax
jne 0x42f9d4
mov esi, dword [ebp - 0x460]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0047cf45
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x460]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x42f96d
xor eax, eax
mov word [ebp - 0x220], ax
push 0x206
push eax
lea eax, [ebp - 0x21e]
push eax
call fcn.004821a0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0
push edi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x42f96d
mov dword [ebp - 4], 0
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x238]
call fcn.0040c1d0
mov byte [ebp - 4], 1
push 0
push dword [ebp - 0x46c]
mov ecx, eax
call fcn.00402b00
cmp eax, 0xffffffff
sete bl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x238]
call fcn.0040c340
test bl, bl
je 0x42fa79
mov dword [ebp - 4], 0xffffffff
jmp 0x42f967
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x460]
mov dword [ebp - 0x478], esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42f967
Function at 0x42fad0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
push 0x40
lea eax, [ebp - 0x5c]
xorps xmm0, xmm0
push 0
push eax
mov ebx, edx
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x10], xmm0
mov dword [ebp - 8], 0
call fcn.004821a0
xor eax, eax
mov word [ebp - 0x30], ax
mov eax, dword [0x4cca28]
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 1
neg ecx
or ecx, eax
push ecx
call fcn.0047923b
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x42fb40
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4cca28]
inc eax
push eax
push 0
push edi
call fcn.004821a0
cmp dword [0x4cca2c], 8
mov eax, 0x4cca18
cmovae eax, dword [0x4cca18]
push eax
push 0x4b3f90
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp + 8]
add esp, 0x18
cmp dword [ecx + 0x10], 0
mov byte [ebp - 1], 1
ja 0x42fb83
xor esi, esi
jmp 0x42fb8a
call fcn.0040bc60
mov esi, eax
cmp dword [ebx + 0x10], 0
ja 0x42fb94
xor eax, eax
jmp 0x42fb9b
mov ecx, ebx
call fcn.0040bc60
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x60]
push ecx
push esi
push 0
push 0x20
push 1
push 0
push 0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, eax
neg ebx
sbb bl, bl
and bl, byte [ebp - 1]
call esi
push dword [ebp - 0x10]
mov dword [ebp - 0x14], 0
call esi
push edi
mov dword [ebp - 0x10], 0
call fcn.0047d6b1
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4305d0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a3a48
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4c9860]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ecx + 0x10], 0
jne 0x430603
xor al, al
jmp 0x430677
mov edx, ecx
push str._MUTEX
lea ecx, [ebp - 0x28]
call fcn.00421050
add esp, 4
mov dword [ebp - 4], 0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x430647
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x430647
mov bl, 1
jmp 0x430649
xor bl, bl
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 8
jb 0x430661
push dword [ebp - 0x28]
call fcn.0047cf40
add esp, 4
xor eax, eax
mov word [ebp - 0x28], ax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047cf45
mov esp, ebp
pop ebp
ret