joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427390
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x28], 0x4f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x28]
mov eax, 0x4dc848
mov dword [ebp - 0x24], 0x540046
mov dword [ebp - 0x20], 0x410057
mov edx, 0x12
mov dword [ebp - 0x1c], 0x450052
sub esi, eax
mov dword [ebp - 0x18], 0x4c005c
mov dword [ebp - 0x14], 0x640075
mov dword [ebp - 0x10], 0x730061
mov dword [ebp - 0xc], 0x690068
nop
lea ecx, [edx + 0x7fffffec]
test ecx, ecx
je 0x42740e
movzx ecx, word [esi + eax]
test cx, cx
je 0x42740e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4273f0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc848
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret

Function at 0x427430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x4dc990
mov dword [ebp - 0x28], 0x6f0043
lea esi, [ebp - 0x28]
mov dword [ebp - 0x24], 0x70006d
mov dword [ebp - 0x20], 0x740075
mov edx, 0x13
mov dword [ebp - 0x1c], 0x720065
sub esi, eax
mov dword [ebp - 0x18], 0x54005a
mov dword [ebp - 0x14], 0x610072
mov dword [ebp - 0x10], 0x2e0079
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop
lea ecx, [edx + 0x7fffffeb]
test ecx, ecx
je 0x4274ae
movzx ecx, word [esi + eax]
test cx, cx
je 0x4274ae
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x427490
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc990
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret

Function at 0x4274d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x28], 0x4f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x28]
mov eax, 0x4dc800
mov dword [ebp - 0x24], 0x540046
mov dword [ebp - 0x20], 0x410057
mov edx, 0x12
mov dword [ebp - 0x1c], 0x450052
sub esi, eax
mov dword [ebp - 0x18], 0x4c005c
mov dword [ebp - 0x14], 0x640075
mov dword [ebp - 0x10], 0x730061
mov dword [ebp - 0xc], 0x690068
nop
lea ecx, [edx + 0x7fffffec]
test ecx, ecx
je 0x42754e
movzx ecx, word [esi + eax]
test cx, cx
je 0x42754e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x427530
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc800
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret
Function at 0x4275f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x28], 0x4f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x28]
mov eax, 0x4dc8bc
mov dword [ebp - 0x24], 0x540046
mov dword [ebp - 0x20], 0x410057
mov edx, 0x12
mov dword [ebp - 0x1c], 0x450052
sub esi, eax
mov dword [ebp - 0x18], 0x4c005c
mov dword [ebp - 0x14], 0x640075
mov dword [ebp - 0x10], 0x730061
mov dword [ebp - 0xc], 0x690068
nop
lea ecx, [edx + 0x7fffffec]
test ecx, ecx
je 0x42766e
movzx ecx, word [esi + eax]
test cx, cx
je 0x42766e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x427650
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc8bc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret

Function at 0x427690
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x28], 0x4f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x28]
mov eax, 0x4dc934
mov dword [ebp - 0x24], 0x540046
mov dword [ebp - 0x20], 0x410057
mov edx, 0x12
mov dword [ebp - 0x1c], 0x450052
sub esi, eax
mov dword [ebp - 0x18], 0x4c005c
mov dword [ebp - 0x14], 0x640075
mov dword [ebp - 0x10], 0x730061
mov dword [ebp - 0xc], 0x690068
nop
lea ecx, [edx + 0x7fffffec]
test ecx, ecx
je 0x42770e
movzx ecx, word [esi + eax]
test cx, cx
je 0x42770e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4276f0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc934
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret

Function at 0x427730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x650053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x1c]
mov eax, 0x4dc730
mov dword [ebp - 0x18], 0x750074
mov dword [ebp - 0x14], 0x200070
mov edx, 0xc
mov dword [ebp - 0x10], str.EUE
sub esi, eax
mov dword [ebp - 0xc], 0x680074
nop dword [eax]
lea ecx, [edx + 0x7ffffff2]
test ecx, ecx
je 0x42779e
movzx ecx, word [esi + eax]
test cx, cx
je 0x42779e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x427780
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc730
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret
Function at 0x4277c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x28], 0x4f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x28]
mov eax, 0x4dc904
mov dword [ebp - 0x24], 0x540046
mov dword [ebp - 0x20], 0x410057
mov edx, 0x12
mov dword [ebp - 0x1c], 0x450052
sub esi, eax
mov dword [ebp - 0x18], 0x4c005c
mov dword [ebp - 0x14], 0x640075
mov dword [ebp - 0x10], 0x730061
mov dword [ebp - 0xc], 0x690068
nop
lea ecx, [edx + 0x7fffffec]
test ecx, ecx
je 0x42783e
movzx ecx, word [esi + eax]
test cx, cx
je 0x42783e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x427820
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc904
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret

Function at 0x4278e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x28], 0x4f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x28]
mov eax, 0x4dc958
mov dword [ebp - 0x24], 0x540046
mov dword [ebp - 0x20], 0x410057
mov edx, 0x12
mov dword [ebp - 0x1c], 0x450052
sub esi, eax
mov dword [ebp - 0x18], 0x4c005c
mov dword [ebp - 0x14], 0x640075
mov dword [ebp - 0x10], 0x730061
mov dword [ebp - 0xc], 0x690068
nop
lea ecx, [edx + 0x7fffffec]
test ecx, ecx
je 0x42795e
movzx ecx, word [esi + eax]
test cx, cx
je 0x42795e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x427940
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc958
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret

Function at 0x427980
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x4dc7e4
mov dword [ebp - 0x1c], 0x6e0049
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x740073
mov dword [ebp - 0x14], 0x6c0061
mov edx, 0xd
mov dword [ebp - 0x10], 0x44006c
sub esi, eax
mov dword [ebp - 0xc], 0x740061
mov dword [ebp - 8], 0x65
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x4279ee
movzx ecx, word [esi + eax]
test cx, cx
je 0x4279ee
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4279d0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc7e4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret
Function at 0x427a10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x28], 0x4f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x28]
mov eax, 0x4dc7c0
mov dword [ebp - 0x24], 0x540046
mov dword [ebp - 0x20], 0x410057
mov edx, 0x12
mov dword [ebp - 0x1c], 0x450052
sub esi, eax
mov dword [ebp - 0x18], 0x4c005c
mov dword [ebp - 0x14], 0x640075
mov dword [ebp - 0x10], 0x730061
mov dword [ebp - 0xc], 0x690068
nop
lea ecx, [edx + 0x7fffffec]
test ecx, ecx
je 0x427a8e
movzx ecx, word [esi + eax]
test cx, cx
je 0x427a8e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x427a70
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc7c0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret

Function at 0x427ab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x28], 0x4f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x28]
mov eax, 0x4dc758
mov dword [ebp - 0x24], 0x540046
mov dword [ebp - 0x20], 0x410057
mov edx, 0x12
mov dword [ebp - 0x1c], 0x450052
sub esi, eax
mov dword [ebp - 0x18], 0x4c005c
mov dword [ebp - 0x14], 0x640075
mov dword [ebp - 0x10], 0x730061
mov dword [ebp - 0xc], 0x690068
nop
lea ecx, [edx + 0x7fffffec]
test ecx, ecx
je 0x427b2e
movzx ecx, word [esi + eax]
test cx, cx
je 0x427b2e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x427b10
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc758
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret

Function at 0x427be0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x28], 0x690046
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x28]
mov eax, 0x4dc824
mov dword [ebp - 0x24], 0x730072
mov dword [ebp - 0x20], 0x490074
mov edx, 0x12
mov dword [ebp - 0x1c], 0x73006e
sub esi, eax
mov dword [ebp - 0x18], 0x610074
mov dword [ebp - 0x14], 0x6c006c
mov dword [ebp - 0x10], 0x610044
mov dword [ebp - 0xc], 0x650074
nop
lea ecx, [edx + 0x7fffffec]
test ecx, ecx
je 0x427c5e
movzx ecx, word [esi + eax]
test cx, cx
je 0x427c5e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x427c40
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc824
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret
Function at 0x427c80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x6c006f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x1c]
mov eax, 0x4dc8a4
mov dword [ebp - 0x18], 0x760064
mov dword [ebp - 0x14], 0x720065
mov edx, 0xc
mov dword [ebp - 0x10], 0x690073
sub esi, eax
mov dword [ebp - 0xc], 0x6e006f
nop dword [eax]
lea ecx, [edx + 0x7ffffff2]
test ecx, ecx
je 0x427cee
movzx ecx, word [esi + eax]
test cx, cx
je 0x427cee
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x427cd0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x4dc8a4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret

Function at 0x427d10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x4dc698
mov dword [ebp - 0x68], 0x64006c
lea esi, [ebp - 0x68]
mov dword [ebp - 0x64], 0x690073
push edi
mov dword [ebp - 0x60], 0x73006e
mov edx, 0x33
mov dword [ebp - 0x5c], 0x610074
sub esi, eax
mov dword [ebp - 0x58], 0x6c006c
mov dword [ebp - 0x54], 0x720065
mov dword [ebp - 0x50], 0x44003a
mov dword [ebp - 0x4c], 0x390038
mov dword [ebp - 0x48], 0x340036
mov dword [ebp - 0x44], 0x460035
mov dword [ebp - 0x40], 0x2d0043
mov dword [ebp - 0x3c], 0x390043
mov dword [ebp - 0x38], 0x300030
mov dword [ebp - 0x34], 0x34002d
mov dword [ebp - 0x30], 0x440031
mov dword [ebp - 0x2c], 0x2d0041
mov dword [ebp - 0x28], 0x450042
mov dword [ebp - 0x24], 0x410039
mov dword [ebp - 0x20], 0x46002d
mov dword [ebp - 0x1c], 0x320044
mov dword [ebp - 0x18], 0x440033
mov dword [ebp - 0x14], 0x390032
mov dword [ebp - 0x10], 0x330035
mov dword [ebp - 0xc], 0x410041
mov dword [ebp - 8], 0x36
lea ecx, [edx + 0x7fffffcb]
test ecx, ecx
je 0x427dff
movzx ecx, word [esi + eax]
test cx, cx
je 0x427dff
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x427de1
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x4dc698
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret
Function at 0x428cc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x38], 0x330051
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x38]
mov eax, 0x4dc9bc
mov dword [ebp - 0x34], 0x300036
push edi
mov dword [ebp - 0x30], 0x6f0043
mov edx, 0x1a
mov dword [ebp - 0x2c], 0x70006d
sub esi, eax
mov dword [ebp - 0x28], 0x740075
mov dword [ebp - 0x24], 0x720065
mov dword [ebp - 0x20], 0x53005a
mov dword [ebp - 0x1c], 0x740065
mov dword [ebp - 0x18], 0x700075
mov dword [ebp - 0x14], 0x75004d
mov dword [ebp - 0x10], 0x650074
mov dword [ebp - 0xc], 0x740078
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffe4]
test ecx, ecx
je 0x428d5e
movzx ecx, word [esi + eax]
test cx, cx
je 0x428d5e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x428d40
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
mov word [ecx], ax
mov eax, 0x4dc9bc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret

Function at 0x428d80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x4dc9f0
mov dword [ebp - 0x30], 0x6f0043
lea esi, [ebp - 0x30]
mov dword [ebp - 0x2c], 0x70006d
push edi
mov dword [ebp - 0x28], 0x740075
mov edx, 0x17
mov dword [ebp - 0x24], 0x720065
sub esi, eax
mov dword [ebp - 0x20], 0x53005a
mov dword [ebp - 0x1c], 0x740065
mov dword [ebp - 0x18], 0x700075
mov dword [ebp - 0x14], 0x61004d
mov dword [ebp - 0x10], 0x6e0069
mov dword [ebp - 0xc], 0x6e0057
mov dword [ebp - 8], 0x64
nop
lea ecx, [edx + 0x7fffffe7]
test ecx, ecx
je 0x428e0e
movzx ecx, word [esi + eax]
test cx, cx
je 0x428e0e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x428df0
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
mov word [ecx], ax
mov eax, 0x4dc9f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret

Function at 0x428e30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x4dca20
mov dword [ebp - 0x38], 0x6f0043
lea esi, [ebp - 0x38]
mov dword [ebp - 0x34], 0x70006d
push edi
mov dword [ebp - 0x30], 0x740075
mov edx, 0x1b
mov dword [ebp - 0x2c], 0x720065
sub esi, eax
mov dword [ebp - 0x28], 0x53005a
mov dword [ebp - 0x24], 0x740065
mov dword [ebp - 0x20], 0x700075
mov dword [ebp - 0x1c], 0x650044
mov dword [ebp - 0x18], 0x6b0073
mov dword [ebp - 0x14], 0x6f0074
mov dword [ebp - 0x10], 0x540070
mov dword [ebp - 0xc], 0x700069
mov dword [ebp - 8], 0x73
nop dword [eax]
lea ecx, [edx + 0x7fffffe3]
test ecx, ecx
je 0x428ece
movzx ecx, word [esi + eax]
test cx, cx
je 0x428ece
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x428eb0
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x4dca20
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret
Function at 0x429000
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x800
lea eax, [ebp - 0x804]
mov edi, ecx
push 0
push eax
call fcn.004693b0
add esp, 0xc
lea eax, [ebp - 0x804]
push 0x400
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea ecx, [ebp - 0x805]
call fcn.00428d80
lea ecx, [ebp - 0x805]
mov esi, eax
call fcn.00428cc0
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x80c], eax
test eax, eax
je 0x42915b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x429124
push dword [ebp - 0x80c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push esi
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov esi, eax
test esi, esi
je 0x429112
lea ecx, [ebp - 0x805]
call fcn.00428e30
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
movzx eax, ax
test ax, ax
je 0x4290e5
push eax
call dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
push 0
push 0
push 0x8c88
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x42915b
push esi
call dword [sym.imp.USER32.dll_IsIconic]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x4290fb
push 9
push esi
call edi
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x42910b
push 5
push esi
call edi
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret
lea esi, [edi + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [edi + 8]
lea ecx, [edi + 4]
cmp dword [ecx + 8], edx
je 0x429147
mov eax, dword [ebp - 0x80c]
mov dword [edx], eax
add dword [ecx + 4], 4
jmp 0x429154
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00428960
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0043a373
mov esp, ebp
pop ebp
ret
Function at 0x42d550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x4dca58
mov dword [ebp - 0x28], 0x720044
lea esi, [ebp - 0x28]
mov dword [ebp - 0x24], 0x4d0076
push edi
mov dword [ebp - 0x20], 0x720067
mov edx, 0x13
mov dword [ebp - 0x1c], 0x44005c
sub esi, eax
mov dword [ebp - 0x18], 0x760072
mov dword [ebp - 0x14], 0x67004d
mov dword [ebp - 0x10], 0x2e0072
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
lea ecx, [edx + 0x7fffffeb]
test ecx, ecx
je 0x42d5cf
movzx ecx, word [esi + eax]
test cx, cx
je 0x42d5cf
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x42d5b1
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x4dca58
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret

Function at 0x42d600
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4d61d4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x42d678
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 2
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x18]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret
Function at 0x42de50
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4cc080
push 0x469770
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x2a14
call fcn.0043a680
mov eax, dword [0x4d61d4]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2a2c], esi
test esi, esi
je 0x42e01e
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42dea6
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
ja 0x42e01e
mov dword [ebp - 4], 0
call fcn.0042d600
mov dword [ebp - 4], 0xfffffffe
jmp 0x42deec
push 0x800
push 0
lea eax, [ebp - 0xa24]
push eax
call fcn.004693b0
mov dword [ebp - 0x2a28], 0
push 0x2000
push 0
lea eax, [ebp - 0x2a24]
push eax
call fcn.004693b0
add esp, 0x18
lea eax, [ebp - 0x2a28]
push eax
push 0x800
lea eax, [ebp - 0x2a24]
push eax
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
je 0x42e01e
push 0x104
push esi
push 0x104
lea eax, [ebp - 0x224]
push eax
call fcn.00470433
push 0x104
lea eax, [ebp - 0x224]
push eax
call fcn.0047368d
add esp, 0x18
xor edi, edi
cmp dword [ebp - 0x2a28], edi
jbe 0x42e01e
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
push 0x400
lea eax, [ebp - 0xa24]
push eax
push dword [ebp + edi*4 - 0x2a24]
call fcn.0042d690
add esp, 0xc
test eax, eax
je 0x42e011
push 0x400
lea eax, [ebp - 0xa24]
push eax
call fcn.0047368d
add esp, 8
lea ecx, [ebp - 0xa24]
lea eax, [ebp - 0x224]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42dfe6
test dx, dx
je 0x42dfe2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42dfe6
add eax, 4
add ecx, 4
test dx, dx
jne 0x42dfc0
xor eax, eax
jmp 0x42dfeb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x42e011
push dword [ebp + edi*4 - 0x2a24]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x42e011
push 0
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [ebp - 0x2a28]
jb 0x42df80
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0043a373
mov esp, ebp
pop ebp
ret 4

Function at 0x42e040
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x42e05c
pop edi
pop ebp
ret 4
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
pop ebp
ret 4