joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412510
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [esp + 0x10]
test al, al
push esi
push edi
je 0x41254a
mov edi, dword [esp + 0x10]
test edi, edi
je 0x412576
mov al, byte [esp + 0x14]
mov esi, dword [esp + 0xc]
lea ebx, [ebx]
mov cl, byte [esi]
mov dl, cl
xor dl, al
mov al, cl
shl al, 7
shr cl, 1
mov byte [esi], dl
inc esi
or al, cl
dec edi
jne 0x412530
pop edi
mov eax, esi
pop esi
ret
mov esi, dword [esp + 0x10]
test esi, esi
mov eax, dword [esp + 0xc]
je 0x41257a
mov cl, byte [esp + 0x14]
lea ebx, [ebx]
mov dl, byte [eax]
xor dl, cl
mov cl, dl
mov byte [eax], dl
shl dl, 7
shr cl, 1
inc eax
or cl, dl
dec esi
jne 0x412560
pop edi
pop esi
ret
mov eax, dword [esp + 0xc]
pop edi
pop esi
ret

Function at 0x412850
Capabilities:
Get system information on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44d8e2
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push 0xfffffffffffffffe
push 0xffffffffffffffff
push 0x45d328
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 0xfffffffe
jne 0x412957
mov dword [esp + 0xc], 0x5745e0
xor esi, esi
push 0x5745e0
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [0x5745e4]
cmp edx, esi
je 0x4128c3
lea eax, [esp + 4]
push 4
push eax
mov dword [esp + 0xc], edx
call fcn.004029e0
mov edx, dword [0x5745e4]
movsx eax, ax
add esp, 8
inc eax
jmp 0x4128c5
xor eax, eax
mov ecx, dword [0x5745fc]
dec eax
cmp ecx, esi
mov word [0x57461c], ax
je 0x4128fb
mov dword [esp + 8], ecx
lea ecx, [esp + 8]
push 4
push ecx
call fcn.004029e0
mov ecx, dword [0x5745fc]
mov edx, dword [0x5745e4]
movsx eax, ax
add esp, 8
inc eax
jmp 0x4128fd
xor eax, eax
dec eax
mov dword [0x57460c], edx
dec edx
mov word [0x57461e], ax
mov eax, dword [0x5745ec]
mov dword [0x574614], edx
mov edx, dword [0x5745e8]
mov dword [0x574610], ecx
dec ecx
push 0x4126e0
mov dword [0x574604], edx
mov dword [0x574608], eax
mov dword [0x574618], ecx
call fcn.00440e5c
add esp, 4
mov dword [0x45d328], esi
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
cmp dword [0x45d328], 0xffffffff
jne 0x412973
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call esi
cmp dword [0x45d328], 0xffffffff
je 0x412966
mov ecx, dword [esp + 0x10]
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x412f10
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x44d918
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x2c]
mov eax, dword [esi + 0x10]
test eax, eax
sete bl
test bl, bl
push edi
mov byte [esp + 0x10], bl
je 0x412f55
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, eax
mov dword [esp + 0xc], edi
jmp 0x412f62
mov edi, eax
push eax
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
test edi, edi
mov dword [esp + 0x1c], 0
jne 0x412f8d
test bl, bl
je 0x412f79
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
test byte [esp + 0x38], 1
mov dword [esi + 0x10], edi
je 0x412fd3
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x2c]
push eax
mov eax, dword [esp + 0x28]
and ecx, 0xfffffffb
push ecx
push esi
push 0x413050
push edx
push eax
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov esi, eax
add esp, 0x18
test esi, esi
je 0x41300b
mov eax, dword [esp + 0x34]
test eax, eax
je 0x413002
mov ecx, dword [esp + 0x2c]
mov dword [eax], ecx
jmp 0x413002
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x412fdf
lea eax, [esp + 0x34]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x2c]
and edx, 0xfffffffb
push edx
push esi
push 0x413190
push eax
push ecx
call dword [esp + 0x54]
mov esi, eax
test esi, esi
je 0x41300b
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test bl, bl
je 0x413016
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x416340
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44daa8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x579738]
mov edx, dword fs:[0x2c]
push esi
mov esi, dword [edx + eax*4]
push edi
mov edi, dword [esi + 4]
mov dword [esp + 8], edi
mov edx, dword [esp + 0x1c]
push 0
lea eax, [ecx + 0x30]
push eax
push edx
add ecx, 0x10
mov dword [esp + 0x20], 0
call fcn.004134d0
mov ecx, dword [esp + 0xc]
mov dword [esi + 4], edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x4163b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44dac8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x579738]
mov edx, dword fs:[0x2c]
push esi
mov esi, dword [edx + eax*4]
push edi
mov edi, dword [esi + 4]
mov dword [esp + 8], edi
mov edx, dword [esp + 0x20]
lea eax, [ecx + 0x30]
push eax
mov eax, dword [esp + 0x20]
push edx
push eax
add ecx, 0x10
mov dword [esp + 0x20], 0
call fcn.004137e0
mov ecx, dword [esp + 0xc]
mov dword [esi + 4], edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x417670
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0xc]
push 0
push 0
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x4176d8
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push 0
lea edx, [esp + 0x10]
push edx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4176d8
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4176c1
mov ecx, dword [esp + 0xc]
pop edi
mov dword [eax], ecx
mov eax, 1
pop esi
ret
mov edx, dword [esp + 0xc]
xor eax, eax
cmp edx, esi
sete al
test eax, eax
je 0x4176d8
pop edi
mov eax, 1
pop esi
ret
pop edi
xor eax, eax
pop esi
ret

Function at 0x419980
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x44ddc8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
push ebx
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x10], ebx
mov byte [esp + 0x14], bl
mov ecx, 0xf
mov esi, 0x454340
lea edi, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
push ebx
push 0x4d
lea eax, [esp + 0x38]
push 0x3e
push eax
mov dword [esp + 0x88], ebx
movsw word es:[edi], word [esi]
call fcn.00412510
mov word [eax], bx
mov ecx, 5
mov esi, 0x454380
lea edi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
push ebx
push 0x4d
lea ecx, [esp + 0x30]
push 0x16
push ecx
movsw word es:[edi], word [esi]
call fcn.00412510
add esp, 0x20
push ebx
push 0x101
lea edx, [esp + 0x38]
push edx
push 0x80000002
lea ecx, [esp + 0x20]
mov word [eax], bx
call fcn.0040fe60
test eax, eax
je 0x419a39
mov ecx, dword [esp + 0x80]
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x14]
push ecx
push 0x25
lea edx, [esp + 0x24]
push edx
push eax
call fcn.0040fff0
add esp, 0x14
test al, al
jne 0x419a3d
mov dword [esp + 0xc], ebx
mov esi, dword [esp + 0xc]
xor eax, eax
mov ecx, 0xf
lea edi, [esp + 0x30]
rep stosd dword es:[edi], eax
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
stosw word es:[edi], ax
cmp byte [esp + 0x14], bl
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov word [esp + 0x2c], cx
je 0x419a80
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x419a80
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x70]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x70
ret
Function at 0x41b790
Capabilities:
Set console window title

Disassembly:
mov eax, dword [0x45d910]
test eax, eax
je 0x41b79e
call fcn.0041ba90
mov eax, dword [0x45d910]
test eax, eax
push esi
push edi
mov edi, dword [0x576178]
je 0x41b7b4
call fcn.0041ba90
mov esi, dword [0x57617c]
push 1
push 0x41b850
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
je 0x41b841
call fcn.00404a50
test al, al
je 0x41b841
push str._Kiwilla_0.0.1
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov eax, dword [esp + 0xc]
push 0x454648
push 0x45d8d0
push eax
push esi
call fcn.00404ab0
add esp, 0x10
test al, al
je 0x41b841
push 0x50
push 0x18
push esi
call fcn.00404c50
add esp, 0xc
test eax, eax
je 0x41b841
push 0x18
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleMode]
call edi
push 0
push esi
call edi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
push 0
push esi
call fcn.00404be0
push 0x17
push 0
push esi
call fcn.00404c20
add esp, 0x14
pop edi
mov al, 1
pop esi
ret
pop edi
xor al, al
pop esi
ret

Function at 0x41bf80
Capabilities:
Manipulate console buffer

Disassembly:
push ecx
mov ax, word [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
test edi, edi
mov word [esp + 4], 0
mov word [esp + 6], ax
je 0x41bfcc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
push esi
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
mov eax, dword [0x5771c8]
lea ecx, [esp + 0x18]
push ecx
push edx
push 0x50
push esi
push eax
call ebx
add esi, 0xa4
inc word [esp + 0xe]
dec edi
jne 0x41bfa7
pop esi
pop ebx
pop edi
pop ecx
ret

Function at 0x41d560
Capabilities:
Get storage device properties

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44e2c8
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push 0x45d2f8
call fcn.004127b0
add esp, 4
test al, al
je 0x41d635
mov dword [esp + 4], 0
mov eax, dword [0x578828]
push eax
mov dword [esp + 0x2c], 0
call fcn.00409e10
mov esi, eax
add esp, 4
test esi, esi
je 0x41d620
push 0
lea ecx, [esp + 8]
push ecx
push 0xc
lea edx, [esp + 0x20]
push edx
push 0xc
lea eax, [esp + 0x1c]
push eax
push 0x2d1400
push esi
mov dword [esp + 0x28], 7
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x41d614
mov dl, byte [esp + 0x1c]
xor ecx, ecx
test dl, dl
setne cl
cmp esi, 0xffffffff
push edi
mov edi, ecx
je 0x41d601
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
cmp esi, 0xffffffff
je 0x41d620
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffffff9c
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
mov ecx, dword [esp + 0x20]
or eax, 0xffffffff
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x41fca0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov ecx, esi
shr ecx, 2
xor eax, eax
test ecx, ecx
je 0x41fcc9
mov edx, ecx
mov ecx, dword [esp + 8]
xor eax, dword [ecx]
add ecx, 4
rol eax, 8
imul eax, eax, 0x165667b1
dec edx
jne 0x41fcb6
jmp 0x41fccd
mov ecx, dword [esp + 8]
and esi, 3
mov edx, esi
dec edx
pop esi
je 0x41fcee
dec edx
je 0x41fce5
dec edx
jne 0x41fcf3
movsx edx, byte [ecx]
shl edx, 0x10
xor eax, edx
inc ecx
movsx edx, byte [ecx]
shl edx, 8
xor eax, edx
inc ecx
movsx ecx, byte [ecx]
xor eax, ecx
ret
Function at 0x423780
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 0x578148
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [0x578148]
mov ecx, dword [0x578590]
mov dword [ecx + 0x34], eax
mov ecx, dword [ebp + 8]
mov edx, dword [0x57814c]
mov eax, dword [0x578590]
push ecx
mov dword [eax + 0x38], edx
call fcn.00421fc0
push 0x2d
mov edi, eax
call fcn.00427dd0
add esp, 8
push 1
push eax
mov ecx, 0x576188
call fcn.0040c190
mov edx, dword [0x578824]
push 1
push edx
mov ecx, 0x576188
call fcn.0040c190
push 0x40b880
mov ecx, 0x576188
call fcn.0040ba90
push 0
push 0x2e
call fcn.00427dd0
add esp, 4
push eax
call fcn.0041ba50
add esp, 8
push 1
call fcn.004095f0
push eax
call fcn.0041ba50
push 0x2f
call fcn.00427dd0
push 0
push eax
call fcn.0041ba50
add esp, 0x14
push 1
call fcn.00409600
push eax
call fcn.0041ba50
mov eax, dword [0x578590]
add eax, 0x30
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.0042a1a0
push 0x30
call fcn.00427dd0
add esp, 0x14
push 1
push eax
mov ecx, 0x576188
call fcn.0040c190
mov edx, dword [ebp - 0x10]
push 1
push edx
mov ecx, 0x576188
call fcn.0040c190
push 0x40b880
mov ecx, 0x576188
call fcn.0040ba90
push 0x31
call fcn.00427dd0
push 0
push eax
call fcn.0041ba50
mov eax, dword [ebp - 8]
push 1
push eax
call fcn.0041ba50
call fcn.0042a410
mov ecx, dword [0x5776b0]
mov esi, dword [ecx - 8]
push str._Kiwilla_0.0.1
call dword [sym.imp.MSVCRT.dll_wcslen]
lea eax, [esi + eax*2 - 0x41]
add eax, 3
add esp, 0x18
and eax, 0xfffffffc
call fcn.00440ed0
mov edx, dword [0x5776b0]
mov esi, esp
add edx, 0x42
push edx
push str._Kiwilla_0.0.1
push str._s_s
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov eax, dword [0x45d820]
test eax, eax
je 0x4238f6
call fcn.00419540
mov eax, dword [0x5760c4]
test eax, eax
je 0x42390e
push 1
push str.Using_custom_article_injection_file.
call fcn.0041ba50
add esp, 8
mov eax, dword [0x45d824]
test eax, eax
je 0x42391c
call fcn.00419600
mov eax, dword [0x5760d8]
test eax, eax
je 0x423934
push 1
push str.Using_custom_article_Kiwilla.js_file.
call fcn.0041ba50
add esp, 8
mov al, byte [0x578845]
test al, al
je 0x423955
mov al, byte [0x578858]
test al, al
je 0x423955
push 1
push str.Master_process.
call fcn.0041ba50
add esp, 8
mov eax, dword [0x574450]
test eax, eax
jne 0x423968
push 6
call fcn.00432bb0
add esp, 4
mov al, byte [0x578845]
test al, al
mov byte [0x578144], 1
jne 0x42397d
call fcn.0041c010
push 1
call fcn.00419e80
add esp, 4
call fcn.00423a40
mov eax, edi
lea esp, [ebp - 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4239e0
Capabilities:
Set console window title

Disassembly:
sub esp, 0x100
push esi
call fcn.00419e60
cmp eax, 3
jne 0x423a38
push 0x60
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
mov esi, eax
test esi, esi
je 0x423a38
mov eax, dword [0x578150]
test eax, eax
je 0x423a11
mov esi, eax
jmp 0x423a17
mov dword [0x578150], esi
push 0x3f
call fcn.00427dd0
push eax
lea ecx, [esp + esi*2 + 0xc]
push ecx
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 0xc
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
pop esi
add esp, 0x100
ret

Function at 0x423a40
Capabilities:
Set console window title

Disassembly:
mov eax, dword [0x57886c]
mov eax, dword [eax + 0xc]
sub esp, 0x100
test al, 1
push esi
mov dword [0x578888], eax
je 0x423ac3
call fcn.00419e70
push 1
push 0x3e
call fcn.00427dd0
add esp, 4
push eax
call fcn.0041ba50
add esp, 8
call fcn.00419e60
cmp eax, 3
jne 0x423ac3
push 0x60
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
mov esi, eax
test esi, esi
je 0x423ac3
mov eax, dword [0x578150]
test eax, eax
je 0x423a9c
mov esi, eax
jmp 0x423aa2
mov dword [0x578150], esi
push 0x3f
call fcn.00427dd0
push eax
lea edx, [esp + esi*2 + 0xc]
push edx
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
pop esi
add esp, 0x100
ret
Function at 0x427830
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x44e83b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x248
mov eax, dword [0x45e664]
mov ecx, dword [0x45e668]
push edi
mov dx, word [esp + 0x25c]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
xor eax, eax
mov ecx, 0x84
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
push 0x105
stosw word es:[edi], ax
xor edi, edi
lea eax, [esp + 0x3c]
push eax
push edi
push edi
push edi
push edi
push edi
lea ecx, [esp + 0x4c]
push ecx
mov word [esp + 0x50], dx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x4279c0
cmp word [esp + 0x38], 0x4b
jne 0x4279c0
mov eax, 0x69
cmp word [esp + 0x3a], ax
jne 0x4279c0
cmp word [esp + 0x3c], 0x77
jne 0x4279c0
cmp word [esp + 0x3e], ax
jne 0x4279c0
mov eax, 0x6c
cmp word [esp + 0x40], ax
jne 0x4279c0
cmp word [esp + 0x42], ax
jne 0x4279c0
cmp word [esp + 0x44], 0x61
jne 0x4279c0
push ebx
lea edx, [esp + 0x3a]
push str.KiwillaInstanceData
push edx
call dword [sym.imp.MSVCRT.dll_wcscpy]
lea eax, [esp + 0x3c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], edi
mov byte [esp + 0x38], 0
mov edx, dword [esp + 0x26c]
lea ecx, [esp + 0x10]
push ecx
push edi
push edi
push 0x1000
push edx
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x278], edi
call fcn.0040a490
add esp, 0x20
mov ebx, eax
mov al, byte [esp + 0x30]
neg ebx
sbb bl, bl
inc bl
test al, al
mov dword [esp + 0x258], 0xffffffff
je 0x42796f
lea ecx, [esp + 0x20]
call fcn.00411260
test bl, bl
pop ebx
je 0x4279c0
cmp dword [esp + 8], 0x42
jb 0x4279a8
mov eax, dword [esp + 4]
cmp dword [eax], 0x4c4c574b
jne 0x4279a8
cmp dword [eax + 4], 1
jne 0x4279a8
mov eax, 1
pop edi
mov ecx, dword [esp + 0x248]
mov dword fs:[0], ecx
add esp, 0x254
ret
xor eax, eax
pop edi
mov ecx, dword [esp + 0x248]
mov dword fs:[0], ecx
add esp, 0x254
ret
mov ecx, dword [esp + 0x24c]
xor al, al
pop edi
mov dword fs:[0], ecx
add esp, 0x254
ret
Function at 0x4279e0
Capabilities:
Timestomp file

Disassembly:
push 0xffffffffffffffff
push 0x44e860
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 8], ebx
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x54], ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], ebx
mov byte [esp + 0x38], bl
push ebx
push 0x20000000
push 3
push 7
push 0x100
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x20]
mov byte [esp + 0x6c], 1
call fcn.00417760
mov byte [esp + 0x5c], al
cmp byte [esp + 0x38], bl
mov byte [esp + 0x54], bl
je 0x427a57
lea ecx, [esp + 0x28]
call fcn.00411260
cmp byte [esp + 0x5c], bl
je 0x427acb
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ecx, dword [esp + 8]
push ebx
lea eax, [esp + 0x14]
push eax
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov eax, dword [esp + 8]
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x427acb
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x44]
mov dword [esi + 8], eax
mov eax, dword [esp + 8]
cmp eax, ebx
mov dword [esi], ecx
mov dword [esi + 4], edx
je 0x427ab6
cmp eax, 0xffffffff
je 0x427ab6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
add esp, 0x50
ret 4
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x427adf
cmp eax, 0xffffffff
je 0x427adf
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x4c]
pop esi
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x50
ret 4

Function at 0x427d00
Capabilities:
Identify system language via api

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
cmp eax, 0x444
jg 0x427d2f
cmp eax, 0x442
jge case.0x427d28.1049
sub eax, 0x419
cmp eax, 0x27
ja case.0x427d28.1050
movzx eax, byte [eax + 0x427d5c]
jmp dword [eax*4 + 0x427d54]
cmp eax, 0x819
jg 0x427d44
je case.0x427d28.1049
sub eax, 0x46d
je case.0x427d28.1049
sub eax, 0x18
jmp 0x427d49
cmp eax, 0x843
je case.0x427d28.1049
xor al, al
ret
mov al, 1
ret
Function at 0x429960
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [0x45d0f4]
test eax, eax
push ebx
push esi
mov esi, ecx
je 0x429972
call fcn.004101a0
mov al, byte [0x574448]
neg al
sbb eax, eax
and eax, 0x574428
je 0x429a0f
mov bl, byte [esp + 0xc]
xor ecx, ecx
mov cl, bl
push edi
push str.GlobalKiwillaMutex
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
mov eax, dword [esi + 4]
test eax, eax
je 0x4299b1
cmp eax, 0xffffffff
je 0x4299b1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], edi
test edi, edi
pop edi
je 0x429a0f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4299da
test bl, bl
mov al, 1
je 0x4299cf
mov byte [esi + 8], al
mov dword [esi], 0
pop esi
pop ebx
ret 4
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x429a1c
cmp eax, 0x80
je 0x429a05
cmp eax, 0x102
jne 0x429a0f
mov dword [esi], 0
pop esi
mov al, 1
pop ebx
ret 4
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [esi], 0xfffffffd
pop esi
xor al, al
pop ebx
ret 4
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [esi], 0xfffffffe
pop esi
xor al, al
pop ebx
ret 4

Function at 0x429ea0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x44e988
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004067e0
xor ebx, ebx
mov dword [esi + 0x28], ebx
mov dword [esi], 0x453930
lea edi, [esi + 0x2c]
mov dword [edi], ebx
mov dword [edi + 4], ebx
cmp dword [0x45c6e8], ebx
mov dword [esp + 0x18], ebx
je 0x429ee8
call fcn.00407620
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
mov dword [esi + 0x3c], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x40], ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x34], eax
mov dword [esi + 8], eax
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 0x2c]
or eax, 0xffffffff
mov dword [esi + 0x28], edi
mov dword [edi], esi
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x48], ebx
mov dword [esi + 0x38], ecx
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x10]
pop edi
mov dword [esi + 0x44], edx
mov dword [esi], 0x454474
mov word [esi + 4], 3
mov word [esi + 6], 7
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x1c
Function at 0x42a620
Capabilities:
Get system information on windows

Disassembly:
mov eax, dword [0x5788a8]
sub esp, 0x24
push edi
xor edi, edi
test eax, eax
jne 0x42a694
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x20]
lea ecx, [eax - 1]
test eax, ecx
mov dword [0x5788a4], eax
jne 0x42a6b7
mov ecx, dword [esp + 8]
lea edx, [ecx - 1]
test ecx, edx
jne 0x42a6b7
mov dword [0x5788b0], eax
mov dword [0x5788ac], ecx
mov dword [0x5788b4], 0x40000
mov dword [0x5788b8], 0x200000
mov dword [0x5788bc], 5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, 0x55555550
and eax, 0xfffffff8
or eax, 8
mov dword [0x5788a8], eax
mov ecx, dword [esp + 0x2c]
push esi
mov esi, dword [0x5788ac]
mov eax, 0xfffffdf8
sub eax, esi
cmp ecx, eax
jae 0x42a6fd
test ecx, ecx
mov eax, dword [0x5788b0]
jne 0x42a6bd
mov ecx, eax
jmp 0x42a6c3
jmp dword [sym.imp.MSVCRT.dll_abort]
add ecx, 0x208
lea esi, [eax + ecx - 1]
dec eax
push 4
not eax
and esi, eax
push 0x3000
push esi
push 0
call fcn.0040e940
add esp, 0x10
test eax, eax
je 0x42a6fd
cmp eax, 0xffffffff
je 0x42a6fd
push esi
push eax
call fcn.0042a710
mov edi, eax
add esp, 8
mov dword [edi + 0x1cc], 1
pop esi
mov eax, edi
pop edi
add esp, 0x24
ret