joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418579
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x49180a
call fcn.00474ec1
xor ebx, ebx
cmp dword [esi + 0x44], ebx
je 0x418669
cmp byte [esi + 0x49], bl
je 0x418669
mov eax, dword [esi]
push 0xffffffffffffffff
mov ecx, esi
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x4185ae
xor al, al
jmp 0x41866b
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.0040ec56
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x41860c
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [esi + 0x44]
mov edi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [esi + 0x4c]
push eax
call dword [edi + 0x18]
sub eax, 0
je 0x418611
dec eax
je 0x418615
dec eax
dec eax
je 0x418665
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401524
mov al, bl
jmp 0x41866b
mov edx, dword [ebp - 0x2c]
jmp 0x4185d7
mov byte [esi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x418621
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x418647
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x418634
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call fcn.00471378
add esp, 0x10
cmp edi, eax
jne 0x4185fa
cmp byte [esi + 0x49], 0
je 0x418665
test edi, edi
jne 0x4185c9
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.0040e1fe
jmp 0x4185c9
mov bl, 1
jmp 0x4185fc
mov al, 1
call fcn.00474f44
ret

Function at 0x41a81f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41a876
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x41a868
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x41a864
cmp edi, eax
jae 0x41a868
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x41a856
cmp edi, eax
jb 0x41a86c
xor eax, eax
jmp 0x41a875
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x41ac13
Capabilities:
Delete file

Disassembly:
push 4
mov eax, 0x490997
call fcn.00474e58
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 3
mov ecx, dword [ebx]
xor esi, esi
cmp ecx, esi
je 0x41ac38
mov eax, dword [ecx]
push 1
call dword [eax + 0x2c]
dec dword [0x4bfbf8]
mov dword [ebx], esi
mov dword [ebx + 4], esi
jne 0x41ac95
push 0x4bfb48
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [0x4bfbfc], esi
mov esi, dword [0x4c0290]
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
cmp eax, esi
je 0x41ac95
mov eax, dword [ebp - 0x10]
mov edi, dword [eax + 0x28]
test edi, edi
je 0x41ac88
push 0
push 1
lea ecx, [edi + 0x28]
call fcn.0040bba0
push edi
call fcn.0046d5a8
mov esi, dword [0x4c0290]
pop ecx
lea eax, [ebp - 0x10]
call fcn.0043b7b9
cmp dword [ebp - 0x10], esi
jne 0x41ac65
lea esi, [ebx + 0x24]
mov eax, dword [esi + 4]
sub eax, dword [esi]
push 0x1c
cdq
pop ecx
idiv ecx
test eax, eax
jle 0x41acd6
xor edi, edi
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
add eax, edi
push eax
call fcn.0045772c
pop ecx
test al, al
je 0x41acce
mov eax, dword [esi]
add eax, edi
cmp dword [eax + 0x14], 8
jb 0x41acc7
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add edi, 0x1c
dec dword [ebp - 0x10]
jne 0x41acac
lea eax, [ebx + 0x44]
push eax
mov byte [ebp - 4], 2
call fcn.0041abde
call fcn.0040bc6e
lea esi, [ebx + 0x14]
call fcn.0040bc6e
mov eax, dword [ebx + 0x10]
sub eax, 0x10
call fcn.00404bd4
call fcn.00474f30
ret 4
Function at 0x41ad03
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x49094e
call fcn.00474e58
mov esi, ecx
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp + 0xc]
push 0x1c
cdq
pop ecx
idiv ecx
and dword [esi + 0xbc], 0
mov ebx, eax
mov eax, dword [ebp + 0x20]
sub eax, dword [ebp + 0x1c]
cdq
idiv ecx
cmp ebx, eax
jne 0x41ade7
test ebx, ebx
je 0x41ade7
and dword [ebp - 0x10], 0
test ebx, ebx
jle 0x41ad78
push dword [ebp - 0x10]
lea eax, [ebp + 0xc]
call fcn.0040a9d2
cmp dword [eax + 0x10], 0
je 0x41add9
push dword [ebp - 0x10]
lea eax, [ebp + 0x1c]
call fcn.0040a9d2
cmp dword [eax + 0x10], 0
je 0x41ade0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x41ad4e
push dword [ebp + 8]
lea eax, [esi + 0x10]
push eax
call fcn.00417456
push dword [ebp + 0x10]
lea eax, [esi + 0x14]
push dword [ebp + 0xc]
call fcn.004190b6
push dword [ebp + 0x20]
lea eax, [esi + 0x24]
push dword [ebp + 0x1c]
call fcn.004190b6
mov eax, dword [ebp + 0x2c]
mov dword [esi + 0x34], eax
mov eax, dword [ebp + 0x34]
mov dword [esi + 0x54], eax
mov eax, dword [ebp + 0x30]
mov dword [esi + 0x38], eax
mov eax, dword [ebp + 0x38]
mov dword [esi + 0x58], eax
mov eax, dword [ebp + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [ebp + 0x40]
mov dword [esi + 0x40], eax
lea esi, [ebp + 0xc]
call fcn.0040bc6e
lea esi, [ebp + 0x1c]
call fcn.0040bc6e
xor eax, eax
inc eax
jmp 0x41ae0c
push str.Downloader_:_Empty_String_For_From__
jmp 0x41adec
push str.Downloader_:_Empty_String_for_To_
jmp 0x41adec
push str.Downloader_:_NULL_the_Source_or_and__Destination__
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add esi, 0x10
call fcn.0041747f
lea esi, [ebp + 0xc]
call fcn.0040bc6e
lea esi, [ebp + 0x1c]
call fcn.0040bc6e
xor eax, eax
call fcn.00474f30
ret 0x3c

Function at 0x41af74
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov ebx, ecx
call fcn.00458a5b
cmp dword [ebx + 0x6c], edx
jb 0x41af9f
ja 0x41af91
cmp dword [ebx + 0x68], eax
jbe 0x41af9f
mov ecx, dword [ebx + 0x68]
sub ecx, eax
je 0x41af9f
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebx]
xor edi, edi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov esi, dword [ebx + 0xc0]
xor ecx, ecx
cmp eax, edi
setge cl
mov dword [ebx + 0x70], eax
mov dword [esp + 0xc], ecx
cmp esi, edi
je 0x41afdb
cmp eax, edi
jge 0x41afdb
push edi
push edi
push edi
push 1
mov edi, eax
call fcn.0041aab4
xor edi, edi
cmp dword [esp + 0xc], edi
jne 0x41b025
mov esi, ebx
call fcn.0041bcb7
test eax, eax
jne 0x41b025
test byte [ebp + 0x14], 1
je 0x41b015
push 0x22
push dword [ebp + 0x10]
mov eax, ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041b032
mov dword [esp + 0xc], eax
cmp eax, edi
jne 0x41b025
call fcn.0041bcb7
test eax, eax
jne 0x41b025
test byte [ebp + 0x14], 0x20
jne 0x41b025
push 0x1f4
jmp 0x41af99
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41b23a
Capabilities:
Create bits job
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x48d201
call fcn.00474e58
xor ebx, ebx
cmp byte [esi + 0x8c], bl
jne 0x41b321
push ebx
push ebx
mov byte [esi + 0x8c], 1
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov edi, eax
cmp edi, ebx
jl 0x41b321
push ebx
push ebx
push ebx
push 3
push 2
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0x18], eax
cmp eax, ebx
jge 0x41b2fe
mov eax, dword [section..data]
mov ecx, section..data
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], vtable._com_error.0
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0041a95a
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push str.Downloader_BITS_::InitializeBITS::CoInitializeSecurity_:_Error__0x_X____s
call fcn.00418ebf
add esp, 0xc
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0041a934
mov edi, dword [ebp - 0x14]
cmp dword [edi - 4], 1
jle 0x41b2ef
push dword [edi - 0xc]
lea eax, [ebp - 0x14]
push eax
call fcn.00418cc4
mov edi, dword [ebp - 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [edi - 0x10]
call fcn.00404bd4
lea edi, [esi + 8]
push edi
push 0x49e9d8
push 4
push ebx
push 0x49e9c8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x41b321
mov dword [edi], ebx
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
cmp dword [esi + 8], ebx
setne al
call fcn.00474f30
ret

Function at 0x41cd6f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41cdd3
cmp dword [ebp + 0xc], 1
je 0x41cdab
cmp dword [ebp + 0xc], 2
je 0x41cdab
push 0xd
pop eax
jmp 0x41cdd3
mov eax, dword [ebp - 4]
test edi, edi
je 0x41cdcd
test eax, eax
je 0x41cdc8
test al, 1
jne 0x41cda6
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x41cdcd
jmp 0x41cda6
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x41fab4
Capabilities:
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49081f
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4b9e20]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push esi
mov eax, dword [0x4b9e20]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
xor ebx, ebx
xor esi, esi
cmp dword [edi + 0x13c], ebx
jle 0x41fbf9
mov dword [esp + 0x10], ebx
cmp dword [0x4bfb94], ebx
je 0x41fb6a
push 1
cmp esi, ebx
jl 0x41fc8f
cmp esi, dword [edi + 0x13c]
jge 0x41fc8f
mov ecx, dword [edi + 0x138]
add ecx, dword [esp + 0x14]
lea eax, [esp + 0x38]
push eax
call fcn.00456a76
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
push str.Deleting_file
push ecx
mov dword [esp + 0x8c], ebx
call fcn.0040fae8
add esp, 0xc
mov ecx, 0x4bfcf0
call fcn.004437f6
or dword [esp + 0x60], 0xffffffff
push ebx
push 1
lea ecx, [esp + 0x3c]
call fcn.00401524
cmp esi, ebx
jl 0x41fc8f
cmp esi, dword [edi + 0x13c]
jge 0x41fc8f
mov eax, dword [edi + 0x138]
add eax, dword [esp + 0x10]
cmp dword [eax + 0x14], 8
jb 0x41fb90
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x41fbc2
cmp esi, dword [edi + 0x13c]
jge 0x41fc8f
mov eax, dword [edi + 0x138]
add eax, dword [esp + 0x10]
cmp dword [eax + 0x14], 8
jb 0x41fbb9
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x41fbe7
cmp esi, dword [edi + 0x13c]
jge 0x41fc8f
mov eax, dword [edi + 0x138]
add eax, dword [esp + 0x10]
cmp dword [eax + 0x14], 8
jb 0x41fbe0
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add dword [esp + 0x10], 0x1c
inc esi
cmp esi, dword [edi + 0x13c]
jl 0x41fafe
cmp byte [edi + 0x28], bl
je 0x41fc67
lea eax, [edi + 0x1e4]
push eax
lea ecx, [esp + 0x1c]
call fcn.0040a49c
mov esi, 0x49c6b8
push esi
mov dword [esp + 0x64], 1
call fcn.0046faa4
pop ecx
push esi
mov ebx, eax
lea esi, [esp + 0x1c]
call fcn.0040ce4a
mov esi, str.apn_pip_local_
push esi
call fcn.0046faa4
pop ecx
push esi
mov ebx, eax
lea esi, [esp + 0x1c]
call fcn.0040ce4a
cmp dword [esp + 0x2c], 8
mov eax, dword [esp + 0x18]
jae 0x41fc53
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.0040bba0
lea esi, [edi + 0x138]
call fcn.004387fc
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.0046d5b3
mov esp, ebp
pop ebp
ret
push ebx
push ebx
push 1
push 0xc000008c
call dword [sym.imp.KERNEL32.dll_RaiseException]
Function at 0x4209aa
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4b9e20]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [esi + 0x28], 0
push ebx
push edi
je 0x420aa2
cmp byte [esi + 0x220], 0
jne 0x4209df
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x420aa2
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0xda
push dword [esi + 4]
call edi
push 0xd8
push dword [esi + 4]
mov ebx, eax
call edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push dword [esi + 4]
mov dword [ebp - 0x24], eax
call edi
push 0
push ebx
call edi
lea eax, [ebp - 0x20]
push eax
push esi
lea ecx, [esi + 0x72c]
call fcn.004205bc
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.0040bba0
push 5
push dword [ebp - 0x24]
call edi
mov eax, 0x49c8ac
push eax
push eax
push dword [esi + 0x234]
call dword [sym.imp.UxTheme.dll_SetWindowTheme]
lea ecx, [esi + 0x72c]
mov ebx, esi
call fcn.00420704
lea ecx, [esi + 0x72c]
call fcn.00420778
push 5
push dword [esi + 0x234]
call edi
push esi
lea ecx, [esi + 0x72c]
call fcn.004207ec
push 0
push dword [0x4bcdc4]
push 0x402
push dword [esi + 0x234]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x3e8
push 0x80
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0046d5b3
leave
ret
Function at 0x42a3ae
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [0x4bfb94], 0
push ebx
push esi
push edi
mov esi, eax
mov edi, 0x4bfcf0
je 0x42a3e1
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 4], esp
push str.ExecuteAllOfferFiles__...
call fcn.00409f78
mov ecx, edi
call fcn.004437f6
mov ebx, esi
call fcn.00436870
xor ebx, ebx
cmp dword [esi + 0x10a4], 0xffffffff
jne 0x42a40f
lea eax, [esi + 0x728]
push eax
push ebx
push esi
push 0x42e4d3
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x10a4], eax
mov esi, dword [esi + 0x10a4]
cmp esi, ebx
jne 0x42a452
cmp dword [0x4bfb94], ebx
je 0x42a43c
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp + 8], esp
push str.Create_thread_failed_in_ExecuteAllOfferFiles__
call fcn.00409f78
mov ecx, edi
call fcn.004437f6
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0x493e0
push eax
call fcn.0044fb3f
xor al, al
jmp 0x42a4a2
cmp byte [ebp + 8], bl
je 0x42a4a0
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x42a47d
cmp dword [0x4bfb94], ebx
je 0x42a4a0
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp + 8], esp
push str.Wait_on_execution_thread_success
jmp 0x42a494
cmp dword [0x4bfb94], ebx
je 0x42a4a0
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp + 8], esp
push str.Wait_on_execution_thread_failure
call fcn.00409f78
mov ecx, edi
call fcn.004437f6
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x42a4a9
Capabilities:
Create process on windows

Disassembly:
push 0xe8
mov eax, 0x4907b2
call fcn.00474ec1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp + 0x48]
xor ebx, ebx
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], ebx
xor esi, esi
inc esi
mov dword [ebp - 4], esi
cmp dword [0x4bfb94], ebx
je 0x42a500
push esi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x8c], esp
push str.SuccessCheck__...
call fcn.00409f78
mov ecx, 0x4bfcf0
call fcn.004437f6
cmp dword [ebp + 0x38], ebx
jbe 0x42a657
push 0x40
lea eax, [ebp - 0xf0]
push ebx
push eax
mov dword [ebp - 0xf4], 0x44
call fcn.0046fc60
add esp, 0xc
lea eax, [ebp - 0x84]
push 0x49c8ac
push eax
lea edi, [ebp + 0xc]
call fcn.0040fa7f
lea ecx, [ebp + 0x28]
push ecx
lea ecx, [ebp - 0x68]
push ecx
mov byte [ebp - 4], 2
mov ecx, eax
mov dword [ebp - 0x8c], esi
call fcn.00419056
add esp, 0x10
push 3
pop ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x8c], ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.0040a4f5
mov dword [ebp - 4], 5
push ebx
push esi
lea ecx, [ebp - 0x68]
call fcn.0040bba0
push ebx
push esi
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 8
call fcn.0040bba0
cmp dword [ebp - 0x1c], 8
mov ecx, dword [ebp - 0x30]
jae 0x42a598
lea ecx, [ebp - 0x30]
cmp dword [ebp + 0x20], 8
mov eax, dword [ebp + 0xc]
jae 0x42a5a4
lea eax, [ebp + 0xc]
lea edx, [ebp - 0xa8]
push edx
lea edx, [ebp - 0xf4]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x42a68b
mov edi, dword [ebp - 0x94]
lea eax, [ebp + 0xc]
add edi, 0xca4
push eax
mov ecx, edi
call fcn.0043dee8
push eax
push edi
lea esi, [ebp - 0x98]
call fcn.0043d378
push 0xffffffffffffffff
push dword [ebp - 0xa8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp + 0xc]
push eax
push edi
call fcn.00438a62
push dword [ebp - 0x90]
push dword [ebp - 0xa8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x42a632
push 0x49c1ae
lea ecx, [ebp - 0x4c]
call fcn.00409f78
push ebx
push 1
lea ecx, [ebp - 0x4c]
call fcn.00401524
xor esi, esi
inc esi
push dword [ebp - 0xa8]
call fcn.004577ca
pop ecx
push dword [ebp - 0xa4]
call fcn.004577ca
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x30]
call fcn.0040bba0
mov eax, dword [ebp + 0x44]
mov ecx, dword [ebp - 0x90]
cmp eax, dword [ecx]
push ebx
push esi
lea ecx, [ebp + 0xc]
sete byte [ebp - 0x85]
call fcn.0040bba0
push ebx
push esi
lea ecx, [ebp + 0x28]
call fcn.0040bba0
mov al, byte [ebp - 0x85]
call fcn.00474f44
ret 0x44
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x42a635
Function at 0x42db31
Capabilities:
Terminate process

Disassembly:
push ecx
mov eax, dword [esi + 0x1080]
push ebx
push edi
test eax, eax
js 0x42db6d
cmp eax, dword [esi + 0x760]
jge 0x42db6d
imul eax, eax, 0x4a0
add eax, dword [esi + 0x75c]
mov edi, 0x49ea20
push edi
mov ebx, eax
call fcn.0046faa4
pop ecx
push eax
push edi
lea ecx, [ebx + 0x2ec]
call fcn.0040cee2
mov edi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 4
push dword [esi + 0x5c4]
call edi
push 4
push dword [esi + 0x5c8]
call edi
mov ecx, esi
mov dword [esi + 0x1070], 2
mov dword [esi + 0xcc4], 0x17
call fcn.004369f9
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
pop edi
inc eax
pop ebx
pop ecx
ret
Function at 0x431168
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push 0x27c
mov eax, 0x490576
call fcn.00474ec1
cmp dword [0x4bfb94], 0
mov edi, ecx
je 0x4311a3
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x27c], esp
push str.TerminateSubProcesses__...
call fcn.00409f78
mov ecx, 0x4bfcf0
call fcn.004437f6
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [ebp - 0x278]
push ecx
push eax
mov dword [ebp - 0x27c], eax
mov dword [ebp - 0x278], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x43130a
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040a4c4
and dword [ebp - 4], 0
mov eax, dword [edi + 0xca8]
mov esi, dword [eax + 4]
mov dword [ebp - 0x280], eax
mov ebx, eax
jmp 0x43120e
lea ecx, [esi + 0xc]
lea eax, [ebp - 0x2c]
call fcn.0041842f
test al, al
je 0x43120a
mov esi, dword [esi + 8]
jmp 0x43120e
mov ebx, esi
mov esi, dword [esi]
cmp byte [esi + 0x29], 0
je 0x4311f6
mov dword [ebp - 0x288], ebx
cmp ebx, dword [edi + 0xca8]
je 0x431239
lea eax, [ebx + 0xc]
lea ecx, [ebp - 0x2c]
call fcn.0041842f
test al, al
jne 0x431239
lea eax, [ebp - 0x288]
jmp 0x43124b
mov eax, dword [edi + 0xca8]
mov dword [ebp - 0x284], eax
lea eax, [ebp - 0x284]
mov ecx, dword [ebp - 0x280]
cmp dword [eax], ecx
push 0
setne bl
or dword [ebp - 4], 0xffffffff
xor esi, esi
inc esi
push esi
lea ecx, [ebp - 0x2c]
call fcn.0040bba0
test bl, bl
je 0x4312f7
push dword [ebp - 0x270]
xor ebx, ebx
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
je 0x431292
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x4312f7
cmp dword [0x4bfb94], ebx
je 0x4312f7
push str.Process_handle_null
lea ecx, [ebp - 0x48]
call fcn.0040a4c4
lea eax, [ebp - 0x254]
push eax
mov dword [ebp - 4], esi
call fcn.0046faa4
pop ecx
lea ecx, [ebp - 0x254]
push ecx
mov ebx, eax
lea esi, [ebp - 0x48]
call fcn.0040ce4a
push 1
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x280], esp
push eax
mov ecx, esi
call fcn.00456a76
pop ecx
mov ecx, 0x4bfcf0
call fcn.004437f6
or dword [ebp - 4], 0xffffffff
push 0
push 1
mov ecx, esi
call fcn.0040bba0
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x27c]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4311d0
add edi, 0xca4
call fcn.0041c8dc
call fcn.00474f44
ret
Function at 0x4319bb
Capabilities:
Hide graphical window

Disassembly:
push 0xf8
mov eax, 0x494f4f
call fcn.00474ec1
xor ebx, ebx
cmp byte [0x4c05b1], bl
jne 0x431bb8
cmp dword [edi + 0xc18], ebx
je 0x431bb8
cmp byte [ebp + 8], bl
jne 0x4319fc
push ebx
push ebx
push 0x402
push dword [edi + 0x234]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0xc18]
mov byte [eax + 0x460], 1
mov eax, dword [edi + 0xc18]
mov eax, dword [eax + 0x440]
xor ecx, ecx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], ecx
cmp eax, ebx
jle 0x431b38
mov dword [ebp - 0x50], ebx
mov eax, dword [edi + 0xc18]
cmp ecx, ebx
jl 0x431bc0
cmp ecx, dword [eax + 0x440]
jge 0x431bc0
mov eax, dword [eax + 0x43c]
add eax, dword [ebp - 0x50]
je 0x431b21
mov ecx, dword [eax + 0x1f4]
cmp ecx, ebx
je 0x431b21
cmp dword [eax + 0x1f0], 1
jne 0x431a76
push ebx
push dword [ecx]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x431b21
lea esi, [ecx - 4]
cmp esi, ebx
je 0x431b21
lea eax, [ebp - 0x4c]
push eax
mov eax, esi
call fcn.00412e33
lea ecx, [esi + 0x54]
push eax
mov dword [ebp - 4], ebx
call fcn.0040ba5a
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x4c]
call fcn.0040bba0
cmp dword [esi + 0x64], ebx
je 0x431b21
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push ebx
lea ebx, [esi + 0x54]
call fcn.0041e8e4
pop ecx
pop ecx
lea eax, [ebp - 0x104]
push eax
call fcn.00438b03
xor ebx, ebx
lea eax, [ebp - 0xf4]
inc ebx
push eax
lea ecx, [esi + 0x54]
mov dword [ebp - 4], ebx
call fcn.004192d7
pop ecx
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x104]
call fcn.00438b71
mov byte [ebp - 4], 2
call fcn.00412e06
push 0
push ebx
lea ecx, [ebp - 0x30]
call fcn.0040bba0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x104]
call fcn.00409aad
xor ebx, ebx
mov ecx, dword [ebp - 0x54]
add dword [ebp - 0x50], 0x1f8
inc ecx
mov dword [ebp - 0x54], ecx
cmp ecx, dword [ebp - 0x58]
jl 0x431a28
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push dword [edi + 0x520]
call esi
push ebx
push dword [edi + 0x37c]
call esi
push ebx
push dword [edi + 0x524]
call esi
push ebx
push dword [edi + 0x404]
call esi
push ebx
push dword [edi + 0x518]
call esi
push ebx
push dword [edi + 0x26c]
call esi
push ebx
push dword [edi + 0x51c]
call esi
push ebx
push dword [edi + 0x2f4]
call esi
push ebx
mov eax, edi
call fcn.0042a3ae
test al, al
jne 0x431bb1
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push ebx
push 0xd2
push 0x111
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov byte [0x4c05b1], 1
call fcn.00474f44
ret 4
push ebx
push ebx
push 1
push 0xc000008c
call dword [sym.imp.KERNEL32.dll_RaiseException]