joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c350
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xae4
push ebx
push esi
push edi
call fcn.0043a9f2
mov esi, dword [eax + 8]
push 0x30
lea eax, [ebp - 0x30]
push 0
push eax
call fcn.0052ea80
mov edi, dword [ebp + 8]
mov ebx, dword [sym.imp.USER32.dll_GetClassInfoExW]
add esp, 0xc
lea ecx, [ebp - 0x30]
push ecx
push edi
push 0
mov dword [ebp - 0x30], 0x30
call ebx
test eax, eax
je 0x41c39f
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
lea edx, [ebp - 0x30]
push edx
push edi
push esi
call ebx
test eax, eax
jne 0x41c391
push 0x800
push eax
lea eax, [ebp - 0xae4]
push eax
call fcn.0052ea80
add esp, 0xc
push 0x3ff
lea ecx, [ebp - 0xae4]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push 0x2b4
lea edx, [ebp - 0x2e4]
push 0
push edx
call fcn.0052ea80
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
add esp, 0xc
push 0x100
push 0x2b4
lea eax, [ebp - 0x2e4]
push eax
push 0
lea ecx, [ebp - 0xae4]
push ecx
call ebx
mov edx, dword [ebp - 0x2e4]
push 0x101
push 0x2b4
lea eax, [ebp - 0x2e4]
push eax
push 0
lea ecx, [ebp - 0xae4]
push ecx
mov dword [ebp + 8], edx
call ebx
mov edx, dword [sym.imp.USER32.dll_DefWindowProcW]
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0x2e4]
push 0x7f00
push 0
mov dword [ebp - 0x2c], 0xb
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
lea ecx, [ebp - 0x30]
push ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x10
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], edi
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_RegisterClassExW]
pop edi
pop esi
movzx eax, ax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41fb70
Capabilities:
Check if file exists
Create shortcut via ishelllink
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x180c
call fcn.0052ea50
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x100a]
push ecx
mov word [ebp - 0x100c], ax
call fcn.0052ea80
add esp, 0xc
push 0x400
lea edx, [ebp - 0x100c]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x80a]
push ecx
mov word [ebp - 0x80c], ax
call fcn.0052ea80
add esp, 0xc
lea edx, [ebp - 0xc]
push edx
push 0x10
push 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x80c]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov edx, dword [0x5c20a0]
push edx
lea eax, [ebp - 0x80c]
push eax
mov ecx, eax
push str._s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 4]
push edx
push 0x592818
push 1
push 0
push 0x592b78
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x41fc42
xor eax, eax
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41fccd
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0x592b08
push eax
mov eax, dword [ecx]
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 2
lea edx, [ebp - 0x80c]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [ebp - 0x180a]
push edx
mov word [ebp - 0x180c], cx
call fcn.0052ea80
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
add esp, 0xc
push 2
push 0
push 0x400
lea edx, [ebp - 0x180c]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
lea ecx, [ebp - 0x100c]
push ecx
lea edx, [ebp - 0x180c]
push edx
call fcn.00535b2f
add esp, 8
test eax, eax
je 0x41fd1e
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x100c]
push edx
push eax
mov eax, dword [ecx + 0x50]
call eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push 0x567314
push eax
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0x592b08
push eax
mov eax, dword [ecx]
call eax
test eax, eax
js 0x41fc3c
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 2
lea edx, [ebp - 0x80c]
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x41fd40
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x41fd63
xor eax, eax
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10]
push ecx
push str.SeDebugPrivilege
push 0
mov dword [ebp - 0x14], 1
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [ebp - 4]
push 0
push 0
push 0x10
lea edx, [ebp - 0x14]
push edx
push 0
push eax
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x41fd5d
mov ecx, dword [ebp - 4]
push ecx
call sub.ntdll.dll_ZwClose
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x41fdb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a60c0
push 0x52f148
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
or edi, 0xffffffff
mov dword [ebp + 8], esi
push 0x1c
lea eax, [ebp - 0x48]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_VirtualQuery]
cmp eax, 0x1c
jne 0x41ff1d
cmp esi, 0x70000000
jae 0x41ff1d
cmp dword [ebp - 0x30], 0x1000000
jne 0x41ff15
lea ecx, [ebp - 0x28]
push ecx
push 0x40
mov edx, dword [ebp - 0x3c]
push edx
push esi
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
mov eax, dword [ebp - 0x3c]
push eax
call fcn.0042cd90
mov ebx, eax
mov dword [ebp - 0x2c], ebx
mov ecx, dword [ebp - 0x3c]
push ecx
push esi
push ebx
call fcn.005302f0
add esp, 0x10
xor esi, esi
mov dword [ebp - 0x24], esi
cmp esi, dword [ebp - 0x3c]
jae 0x41fef3
xor ecx, ecx
mov dword [ebp - 0x20], ecx
cmp ecx, dword [ebp + 0x10]
jge 0x41fea3
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0xc]
mov al, byte [ecx + edx]
cmp al, 0xff
jne 0x41fe84
mov dword [ebp - 4], edi
inc ecx
jmp 0x41fe65
lea edx, [ecx + ebx]
cmp byte [edx + esi], al
jne 0x41fe99
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], edi
inc ecx
jmp 0x41fe65
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], edi
cmp dword [ebp - 0x1c], 1
jne 0x41feed
push ebx
call fcn.0042cd9b
add esp, 4
mov eax, dword [ebp + 8]
add eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
inc esi
jmp 0x41fe57
push ebx
call fcn.0042cd9b
add esp, 4
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
mov esi, dword [ebp + 8]
add esi, dword [ebp - 0x3c]
jmp 0x41fdf6
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420380
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a60d0
push 0x52f148
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov eax, dword [ebp + 8]
push eax
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, ebx
jbe 0x420543
mov dword [ebp - 0x4c], ebx
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
or edi, 0xffffffff
nop
push 0x1c
lea ecx, [ebp - 0x4c]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push esi
call dword [sym.imp.KERNEL32.DLL_VirtualQueryEx]
test eax, eax
je 0x42053c
cmp dword [ebp - 0x34], 0x1000000
jne 0x42053c
mov eax, dword [ebp - 0x40]
push eax
call fcn.0042cd90
mov esi, eax
mov dword [ebp - 0x30], esi
mov ecx, dword [ebp - 0x40]
push ecx
push 0
push esi
call fcn.0052ea80
add esp, 0x10
lea edx, [ebp - 0x20]
push edx
push 0x40
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.DLL_VirtualProtectEx]
push 0
mov eax, dword [ebp - 0x40]
push eax
push esi
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.DLL_ReadProcessMemory]
test eax, eax
je 0x42050b
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x40]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.DLL_VirtualProtectEx]
xor edx, edx
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp + 0x10]
cmp edx, eax
jae 0x42050b
xor ecx, ecx
mov dword [ebp - 0x28], ecx
cmp ecx, dword [ebp + 0x10]
jae 0x4204c4
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov al, byte [ecx + eax]
cmp al, 0xff
jne 0x4204a6
mov dword [ebp - 4], edi
inc ecx
jmp 0x420487
lea ebx, [ecx + edx]
cmp byte [ebx + esi], al
jne 0x4204bc
mov ebx, 1
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], edi
inc ecx
jmp 0x420487
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], edi
cmp ebx, 1
jne 0x420505
push esi
call fcn.0042cd9b
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
inc edx
jmp 0x420474
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.DLL_VirtualProtectEx]
push esi
call fcn.0042cd9b
add esp, 4
mov eax, dword [ebp - 0x40]
add dword [ebp + 0x14], eax
mov esi, dword [ebp - 0x1c]
jmp 0x4203e0
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420560
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
mov ebx, dword [ebp + 8]
push edi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jne 0x420582
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [edi + 1]
push esi
push eax
call fcn.0042cd90
add esp, 4
mov esi, eax
push esi
push edi
xor edi, edi
push edi
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x420694
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 4]
push edx
push str.VarFileInfoTranslation
push esi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x420694
push 0x206
lea ecx, [ebp - 0x21a]
xor eax, eax
push edi
push ecx
mov word [ebp - 0x21c], ax
call fcn.0052ea80
mov eax, dword [ebp - 4]
movzx edx, word [eax + 2]
movzx eax, word [eax]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push edx
push eax
lea ecx, [ebp - 0x21c]
push str.StringFileInfo_04X_04XFileDescription
push ecx
call edi
add esp, 0x1c
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x21c]
push ecx
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x420694
push 0x208
lea edx, [ebp - 0x21c]
push 0
push edx
call fcn.0052ea80
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 2]
movzx edx, word [eax]
push ecx
push edx
lea eax, [ebp - 0x21c]
push str.StringFileInfo_04X_04XFileVersion
push eax
call edi
add esp, 0x1c
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x21c]
push eax
push esi
call sub.VERSION.dll_VerQueryValueW
mov ecx, dword [ebp - 8]
push 0x567370
push ecx
call fcn.0052ed87
add esp, 8
test eax, eax
je 0x420694
push esi
call fcn.0042cd9b
add esp, 4
pop esi
pop edi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.0042cd9b
add esp, 4
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420880
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84c
push esi
push edi
xor esi, esi
push esi
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov edi, eax
push 0x820
lea eax, [ebp - 0x848]
push esi
push eax
mov dword [ebp - 8], edi
call fcn.0052ea80
add esp, 0xc
lea ecx, [ebp - 0x84c]
push ecx
push edi
mov dword [ebp - 0x84c], 0x824
call sub.KERNEL32.DLL_Process32FirstW
test eax, eax
je 0x420992
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_OpenProcess]
jmp 0x4208e0
lea edx, [ebp - 0x828]
push edx
call edi
push 0xa
push str.Client.dat
push eax
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x420976
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x844]
lea edx, [ebp - 0x28]
push edx
mov dword [ebp - 0x10], eax
push 0x1f0fff
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x28], 0x18
mov dword [ebp - 0xc], esi
call sub.ntdll.dll_ZwOpenProcess
test eax, eax
je 0x420950
mov ecx, dword [ebp - 0x844]
push ecx
push esi
push 0x1f0fff
call ebx
mov dword [ebp - 4], eax
jmp 0x420953
mov eax, dword [ebp - 4]
cmp eax, esi
je 0x420976
push esi
push eax
call sub.ntdll.dll_ZwTerminateProcess
test eax, eax
je 0x42096d
mov edx, dword [ebp - 4]
push esi
push edx
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov eax, dword [ebp - 4]
push eax
call sub.ntdll.dll_ZwClose
mov edx, dword [ebp - 8]
lea ecx, [ebp - 0x84c]
push ecx
push edx
call sub.KERNEL32.DLL_Process32NextW
test eax, eax
jne 0x4208e0
mov edi, dword [ebp - 8]
pop ebx
push edi
call sub.ntdll.dll_ZwClose
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4209f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x3c]
mov ebx, dword [eax + esi + 0x78]
mov eax, dword [eax + esi + 0x7c]
mov edx, dword [ebx + esi + 0x1c]
push edi
mov edi, dword [ebx + esi + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebx + esi + 0x24]
add edx, esi
add eax, esi
add edi, esi
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
test ecx, 0xffff0000
je 0x420a88
cmp dword [ebx + esi + 0x18], 0
mov dword [ebp + 8], 0
jle 0x420a88
mov edi, edi
mov edx, dword [ebp + 8]
mov eax, dword [edi + edx*4]
add eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x420a68
test dl, dl
je 0x420a64
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x420a68
add eax, 2
add ecx, 2
test dl, dl
jne 0x420a48
xor eax, eax
jmp 0x420a6d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x420b55
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
inc eax
mov dword [ebp + 8], eax
cmp eax, dword [ebx + esi + 0x18]
jl 0x420a40
mov edx, dword [ebp - 4]
mov eax, dword [ebx + esi + 0x10]
cmp ecx, eax
jb 0x420b73
mov edi, dword [ebx + esi + 0x14]
lea edi, [edi + eax - 1]
cmp ecx, edi
ja 0x420b73
sub ecx, eax
mov edi, dword [edx + ecx*4]
add edi, esi
lea ecx, [ebx + esi]
cmp edi, ecx
jb 0x420b6a
mov edx, dword [ebp - 8]
add edx, ebx
add edx, esi
cmp edi, edx
ja 0x420b6a
push 0x63
lea eax, [ebp - 0x6f]
push 0
push eax
mov byte [ebp - 0x70], 0
call fcn.0052ea80
push 0x63
lea ecx, [ebp - 0xd3]
push 0
push ecx
mov byte [ebp - 0xd4], 0
call fcn.0052ea80
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrcpyA]
add esp, 0x18
push edi
lea edx, [ebp - 0x70]
push edx
call ebx
lea eax, [ebp - 0x70]
push 0x2e
push eax
call fcn.00531750
add esp, 8
test eax, eax
je 0x420b6a
mov byte [eax], 0
inc eax
push eax
lea ecx, [ebp - 0xd4]
push ecx
call ebx
push str..dll
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
je 0x420b6a
cmp eax, esi
je 0x420b6a
lea ecx, [ebp - 0xd4]
push ecx
push eax
call fcn.004209f0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
movzx edx, word [eax + ecx*2]
mov eax, dword [ebp - 4]
mov edi, dword [eax + edx*4]
jmp 0x420aa9
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420eb0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
push 0x824
mov edi, eax
call fcn.0042cd61
mov esi, eax
add esp, 4
test esi, esi
je 0x420ee6
push 0x824
push 0
push esi
call fcn.0052ea80
add esp, 0xc
jmp 0x420ee8
xor esi, esi
push esi
push edi
mov dword [esi], 0x824
call sub.KERNEL32.DLL_Process32FirstW
test eax, eax
je 0x420f4c
mov eax, dword [ebp + 8]
push eax
lea ebx, [esi + 0x24]
push ebx
call fcn.00535b2f
add esp, 8
test eax, eax
jne 0x420f1e
mov esi, dword [esi + 8]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
push esi
push edi
call sub.KERNEL32.DLL_Process32NextW
test eax, eax
je 0x420f4c
lea esp, [esp]
mov ecx, dword [ebp + 8]
push ecx
push ebx
call fcn.00535b2f
add esp, 8
test eax, eax
je 0x420f0d
push esi
push edi
call sub.KERNEL32.DLL_Process32NextW
test eax, eax
jne 0x420f30
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4218c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0x10]
mov eax, edx
and eax, 0xfffffff8
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov ecx, eax
push esi
shr ecx, 3
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x4219bf
mov eax, edi
sub eax, ebx
mov dword [ebp - 8], eax
mov dword [ebp + 8], ecx
movzx esi, byte [ebx]
movzx eax, byte [ebx + 1]
movzx ecx, byte [ebx + 2]
movzx edx, byte [ebx + 3]
shl esi, 8
or esi, eax
movzx eax, byte [ebx + 4]
shl esi, 8
or esi, ecx
movzx ecx, byte [ebx + 5]
shl eax, 8
shl esi, 8
or esi, edx
movzx edx, byte [ebx + 6]
or eax, ecx
shl eax, 8
or eax, edx
movzx edx, byte [ebx + 7]
shl eax, 8
or edx, eax
mov eax, dword [ebp - 4]
mov dword [ebp + 0xc], 0xc
add eax, 0x64
mov edi, edi
sub edx, dword [eax + 4]
mov ecx, esi
and ecx, 0x1f
ror edx, cl
sub eax, 8
xor edx, esi
sub esi, dword [eax + 8]
mov ecx, edx
and ecx, 0x1f
ror esi, cl
mov ecx, dword [ebp + 0xc]
dec ecx
mov dword [ebp + 0xc], ecx
xor esi, edx
test ecx, ecx
jne 0x421940
mov eax, dword [ebp - 4]
sub esi, dword [eax + 4]
sub edx, dword [eax + 8]
mov eax, esi
mov esi, dword [ebp - 8]
mov ecx, eax
shr ecx, 0x18
mov byte [edi], cl
mov ecx, eax
shr ecx, 0x10
mov byte [edi + 1], cl
mov byte [edi + 3], al
mov ecx, eax
shr ecx, 8
mov byte [esi + ebx + 2], cl
mov eax, edx
shr eax, 0x18
mov byte [edi + 4], al
mov ecx, edx
mov eax, edx
shr ecx, 0x10
shr eax, 8
mov byte [edi + 5], cl
mov byte [edi + 6], al
mov byte [edi + 7], dl
add ebx, 8
add edi, 8
dec dword [ebp + 8]
jne 0x4218f4
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0xc]
cmp eax, edx
jae 0x4219d9
sub ebx, edi
sub edx, eax
mov esi, edx
lea esp, [esp]
mov cl, byte [ebx + edi]
mov byte [edi], cl
inc edi
dec esi
jne 0x4219d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x426d80
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Get common file path
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x551f88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x804
push ebx
push esi
push edi
mov esi, ecx
push 0x563178
lea ecx, [ebp - 0x10]
call fcn.0040bc20
mov ebx, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x190
mov dword [ebp - 4], 0
call ebx
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x80e]
push ecx
mov word [ebp - 0x810], ax
call fcn.0052ea80
add esp, 0xc
lea edx, [ebp - 0x810]
push edx
push 0x400
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
push 0x564f9c
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
mov ecx, dword [0x5c20a0]
push ecx
push 1
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexW]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x426eae
lea edx, [ebp - 0x810]
push edx
push 0
push str.XBHWND
push str.Login
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
mov esi, eax
test esi, esi
je 0x426f51
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x426f51
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindowAsync]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edi, dword [sym.imp.USER32.dll_SetWindowPos]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
call edi
push 0x64
call ebx
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push esi
call edi
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x426ea6
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov ecx, dword [esi + 0x20]
push ecx
lea edx, [ebp - 0x10]
push 0x5642d0
push edx
call fcn.004041a0
mov eax, dword [ebp - 0x10]
mov edx, dword [eax - 8]
mov ecx, 1
sub ecx, dword [eax - 4]
add esp, 0xc
or edx, ecx
jge 0x426ee2
push 0
lea ecx, [ebp - 0x10]
call fcn.00403d30
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x810]
push ecx
push eax
push str.XBHWND
push str.Login
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringW]
push 1
mov ecx, esi
call fcn.0042fa88
push 0
mov ecx, esi
call fcn.004326cf
mov eax, dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_SetWindowPos]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
call edi
push 0x64
call ebx
mov eax, dword [esi + 0x20]
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push eax
call edi
mov edx, dword [esi + 0x20]
push edx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x426f51
push 9
mov ecx, esi
call fcn.0042fa88
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426f77
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret