joyce8/EMBER2024-capa huggingface dataset:
Function at 0x68965063
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
cdq
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
jmp 0x68965165
jmp 0x68965256
jmp 0x68965347
jmp 0x68965438
jmp 0x68965529
jmp 0x6896561a
jmp 0x6896570b
jmp 0x689657fc
jmp 0x689658ed
jmp 0x689659de
jmp 0x68965acf
jmp 0x68965bc0
jmp 0x68965cb1
jmp 0x68965da2
jmp 0x68965e93
jmp 0x68965f84
jmp 0x68966075
jmp 0x68966166
jmp 0x68966257
jmp 0x68966348
jmp 0x68966439
jmp 0x6896652a
jmp 0x6896661b
jmp 0x6896670c
jmp 0x689667fd
jmp 0x689668ee
jmp 0x689669df
jmp 0x68966ad0
jmp 0x68966bc1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
jmp 0x68966cb8
jmp 0x68966da9
jmp 0x68966e9a
jmp 0x68966f8b
jmp 0x6896707c
jmp 0x6896716d
jmp 0x6896725e
jmp 0x6896734f
jmp 0x68967440
jmp 0x68967531
jmp 0x68967622
jmp 0x68967713
jmp 0x68967804
jmp 0x689678f5
jmp 0x689679e6
jmp 0x68967ad7
jmp 0x68967bc8
jmp 0x68967cb9
jmp 0x68967daa
jmp 0x68967e9b
jmp 0x68967f8c
jmp 0x6896807d
jmp 0x6896816e
jmp 0x6896825f
jmp 0x68968350
jmp 0x68968441
jmp 0x68968532
jmp 0x68968623
jmp 0x68968714
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3c]
mov ecx, eax
mov ebx, eax
sar ebx, 0x1f
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x20], eax
jmp 0x6896881f
jmp 0x68968910
jmp 0x68968a01
jmp 0x68968af2
jmp 0x68968be3
jmp 0x68968cd4
jmp 0x68968dc5
jmp 0x68968eb6
jmp 0x68968fa7
jmp 0x68969098
jmp 0x68969189
jmp 0x6896927a
jmp 0x6896936b
jmp 0x6896945c
jmp 0x6896954d
jmp 0x6896963e
jmp 0x6896972f
jmp 0x68969820
jmp 0x68969911
jmp 0x68969a02
jmp 0x68969af3
jmp 0x68969be4
jmp 0x68969cd5
jmp 0x68969dc6
jmp 0x68969eb7
jmp 0x68969fa8
jmp 0x6896a099
jmp 0x6896a18a
jmp 0x6896a27b
mov eax, dword [ebp - 0x20]
add eax, 0x78
mov dword [ebp - 0x24], eax
jmp 0x6896a375
jmp 0x6896a466
jmp 0x6896a557
jmp 0x6896a648
jmp 0x6896a739
jmp 0x6896a82a
jmp 0x6896a91b
jmp 0x6896aa0c
jmp 0x6896aafd
jmp 0x6896abee
jmp 0x6896acdf
jmp 0x6896add0
jmp 0x6896aec1
jmp 0x6896afb2
jmp 0x6896b0a3
jmp 0x6896b194
jmp 0x6896b285
jmp 0x6896b376
jmp 0x6896b467
jmp 0x6896b558
jmp 0x6896b649
jmp 0x6896b73a
jmp 0x6896b82b
jmp 0x6896b91c
jmp 0x6896ba0d
jmp 0x6896bafe
jmp 0x6896bbef
jmp 0x6896bce0
jmp 0x6896bdd1
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x28], eax
jmp 0x6896bedb
jmp 0x6896bfcc
jmp 0x6896c0bd
jmp 0x6896c1ae
jmp 0x6896c29f
jmp 0x6896c390
jmp 0x6896c481
jmp 0x6896c572
jmp 0x6896c663
jmp 0x6896c754
jmp 0x6896c845
jmp 0x6896c936
jmp 0x6896ca27
Function at 0x689b3d6c
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x69421018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x69421018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x689b3e7d
jmp 0x689b3f6e
jmp 0x689b405f
jmp 0x689b4150
jmp 0x689b4241
jmp 0x689b4332
jmp 0x689b4423
jmp 0x689b4514
jmp 0x689b4605
jmp 0x689b46f6
jmp 0x689b47e7
jmp 0x689b48d8
jmp 0x689b49c9
jmp 0x689b4aba
jmp 0x689b4bab
jmp 0x689b4c9c
jmp 0x689b4d8d
jmp 0x689b4e7e
jmp 0x689b4f6f
jmp 0x689b5060
jmp 0x689b5151
jmp 0x689b5242
jmp 0x689b5333
jmp 0x689b5424
jmp 0x689b5515
jmp 0x689b5606
jmp 0x689b56f7
jmp 0x689b57e8
jmp 0x689b58d9
mov dword [ebp - 0x14], 0
jmp 0x689b59d1
jmp 0x689b5ac2
jmp 0x689b5bb3
jmp 0x689b5ca4
jmp 0x689b5d95
jmp 0x689b5e86
jmp 0x689b5f77
jmp 0x689b6068
jmp 0x689b6159
jmp 0x689b624a
jmp 0x689b633b
jmp 0x689b642c
jmp 0x689b651d
jmp 0x689b660e
jmp 0x689b66ff
jmp 0x689b67f0
jmp 0x689b68e1
jmp 0x689b69d2
jmp 0x689b6ac3
jmp 0x689b6bb4
jmp 0x689b6ca5
jmp 0x689b6d96
jmp 0x689b6e87
jmp 0x689b6f78
jmp 0x689b7069
jmp 0x689b715a
jmp 0x689b724b
jmp 0x689b733c
jmp 0x689b742d
mov dword [ebp - 0x18], 0
jmp 0x689b7525
jmp 0x689b7616
jmp 0x689b7707
jmp 0x689b77f8
jmp 0x689b78e9
jmp 0x689b79da
jmp 0x689b7acb
jmp 0x689b7bbc
jmp 0x689b7cad
jmp 0x689b7d9e
jmp 0x689b7e8f
jmp 0x689b7f80
jmp 0x689b8071
jmp 0x689b8162
jmp 0x689b8253
jmp 0x689b8344
jmp 0x689b8435
jmp 0x689b8526
jmp 0x689b8617
jmp 0x689b8708
jmp 0x689b87f9
jmp 0x689b88ea
jmp 0x689b89db
jmp 0x689b8acc
jmp 0x689b8bbd
jmp 0x689b8cae
jmp 0x689b8d9f
jmp 0x689b8e90
jmp 0x689b8f81
mov dword [ebp - 0x10], 0
jmp 0x689b9079
jmp 0x689b916a
jmp 0x689b925b
jmp 0x689b934c
jmp 0x689b943d
jmp 0x689b952e
jmp 0x689b961f
jmp 0x689b9710
jmp 0x689b9801
jmp 0x689b98f2
jmp 0x689b99e3
jmp 0x689b9ad4
jmp 0x689b9bc5
jmp 0x689b9cb6
jmp 0x689b9da7
jmp 0x689b9e98
jmp 0x689b9f89
jmp 0x689ba07a
jmp 0x689ba16b
jmp 0x689ba25c
jmp 0x689ba34d
jmp 0x689ba43e
jmp 0x689ba52f
jmp 0x689ba620
jmp 0x689ba711
jmp 0x689ba802
jmp 0x689ba8f3
jmp 0x689ba9e4
jmp 0x689baad5
mov dword [ebp - 0x10], 0
jmp 0x689c33aa
jmp 0x689babd2
jmp 0x689bacc3
jmp 0x689badb4
jmp 0x689baea5
jmp 0x689baf96
jmp 0x689bb087
jmp 0x689bb178
jmp 0x689bb269
jmp 0x689bb35a
jmp 0x689bb44b
jmp fcn.689bb53c
mov eax, dword [0x69421018]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x689baae1
nop
leave
ret
Function at 0x5ea363
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
add dword [edi - 0x4ffe7456], ebx
shr byte es:[ebx], 0xa4
and ebp, dword [esi]
adc ch, byte [edi + 0x80493ac]
mov bl, 0xe6
aaa
mov byte [0xb001907d], al
shr byte es:[ebx], 0xa4
and ebp, dword [esi]
adc ch, byte [edi + 0x80497ac]
jmp esi
sbb dword [edx], ebx
wait
inc edi
jle 0x5ea307
add dword [eax - 0x407d9fda], esi
out dx, al
mov esp, 0xbf00a238
pop ss
mov al, 0x23
cli
mov bh, 0xec
lds eax, [ecx]
mov al, 6
fidivr dword [edi + 0x7a4e26b4]
dec esi
jp 0x5ea33b
or dh, byte [edi - 0x40d94ffe]
and al, 0x31
xor esp, dword [edi]
pop ebx
pop eax
cmp dword [edx], eax
cmp ah, byte [esi]
shr byte [ebx], 0x98
jle 0x5ea3f2
add esi, dword [eax - 0xd459fda]
sub dword [edi + 0x3c89194e], edi
dec esi
sbb dword [ecx + 0xb98963c], ecx
mov bh, 2
mov al, 0x26
invalid
cdq
mov al, 0x32
rol byte [ecx], 0x36
jle 0x5ea3b4
add dword [eax + 0x80497ac], esi

Function at 0x5f0bb7
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5f0bd2
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x124b5df7]
pop edx
test eax, eax
je 0x5f0ca4
cmp dword [ebp - 0x2ac], 0x1000
jne 0x5f0c93
test dword [ebp - 0x2a8], 1
jne 0x5f0c93
and dword [ebp - 0x2a8], 0x100
jne 0x5f0c93
push esi
push edx
push 4
push esi
call dword [edx + 0x122d301c]
pop edx
pop esi
test eax, eax
je 0x5f0c36
jmp 0x5f0c93
cmp word [esi], 0x5a4d
jne 0x5f0c93
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x5f0c93
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x122d2ff8]
pop edx
test eax, eax
je 0x5f0c93
lea eax, [ebp - 0x28c]
push eax
call fcn.005f0b13
test eax, eax
jne 0x5f0c8c
jmp 0x5f0c93
mov eax, esi
jmp 0x5f0ca4
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x5f0bd2
pop esi
leave
ret 4
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x401426
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
xor eax, eax
mov edi, eax
mov dword [ebp - 0x4c], 0x30
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], 3
mov dword [0x4041b0], eax
mov eax, edi
mov dword [ebp - 0x44], 0x40132e
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], str.Hall
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
test eax, eax
je 0x4014f0
mov eax, 0x80000000
push edi
push dword [ebp - 0x38]
push edi
push edi
push eax
push eax
push eax
push eax
push 0
push str.moossi
push str.Hall
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push eax
mov dword [0x4041b8], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4041b8]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x4014f0
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x4014d5
mov esp, ebp
pop ebp
ret 0x10
Function at 0x406624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406648
xor eax, eax
test eax, eax
je 0x40665b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40665b
xor ecx, ecx
jmp 0x40665e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406787
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4698ec], 0
push esi
jne 0x4067be
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406798
mov dword [ecx*4 + 0x4698e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406793
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067ef
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4698e8]
xor eax, esi
inc ecx
dec edx
jne 0x4067d1
pop edi
not eax
pop esi
ret 0xc

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x2dcd348f
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x36c5254f
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x413930
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x811c9dc5
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
xor esi, esi
lea edx, [ecx + edi]
cmp ecx, edx
cmova edi, ebx
test edi, edi
je 0x413964
movzx edx, byte [ecx]
lea ecx, [ecx + 1]
xor edx, eax
inc esi
imul eax, edx, 0x1000193
cmp esi, edi
jne 0x413951
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x41be30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
cmp dword [ecx + 0x14], 0x10
mov edi, dword [ecx + 0x10]
jb 0x41be44
mov ecx, dword [ecx]
lea edx, [ecx + edi]
xor ebx, ebx
xor esi, esi
mov eax, 0x811c9dc5
cmp ecx, edx
cmova edi, ebx
test edi, edi
je 0x41be73
nop dword [eax]
movzx edx, byte [ecx]
lea ecx, [ecx + 1]
xor edx, eax
inc esi
imul eax, edx, 0x1000193
cmp esi, edi
jne 0x41be60
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x423d10
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x585d00]
sub esp, 0x10
or eax, dword [0x585d04]
jne 0x423d31
push 0x585d00
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xorps xmm0, xmm0
lea eax, [esp]
push eax
movq qword [esp + 4], xmm0
movq qword [esp + 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ecx, dword [esp]
sub ecx, dword [0x585d00]
mov edx, dword [esp + 4]
sbb edx, dword [0x585d04]
call fcn.004cb990
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
movsd qword [esp], xmm0
call fcn.004cb990
movsd xmm1, qword [esp]
divsd xmm1, xmm0
movaps xmm0, xmm1
mov esp, ebp
pop ebp
ret

Function at 0x423d90
Capabilities:
Create directory

Disassembly:
push ebx
push edi
mov ebx, ecx
push 0x5c
push ebx
call fcn.004e2077
push 0x2f
push ebx
mov edi, eax
call fcn.004e2077
add esp, 0x10
cmp eax, edi
cmova edi, eax
test edi, edi
je 0x423dcf
push esi
movzx esi, word [edi]
xor eax, eax
mov ecx, ebx
mov word [edi], ax
call fcn.00423d90
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov word [edi], si
pop esi
pop edi
mov al, 1
pop ebx
ret

Function at 0x423de0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x515c60
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x56e754]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x423e16
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x423e74
lea ecx, [ebp - 0x40]
call fcn.00424730
mov edi, eax
mov edx, esi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0043a5b0
mov byte [ebp - 4], 1
cmp dword [edi + 0x14], 8
jb 0x423e48
mov edi, dword [edi]
cmp dword [eax + 0x14], 8
jb 0x423e50
mov eax, dword [eax]
push edi
mov edx, eax
mov ecx, str.Couldnt_delete_file__file:__s__lastError:__s_
call fcn.0042de50
add esp, 4
lea ecx, [ebp - 0x28]
call fcn.0041b400
lea ecx, [ebp - 0x40]
call fcn.0041b400
xor al, al
jmp 0x423e76
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ca771
mov esp, ebp
pop ebp
ret
Function at 0x423ea0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, ecx
push edi
push eax
mov dword [ebp - 4], eax
call fcn.004f062f
mov ebx, eax
push 0x5c
push ebx
call fcn.004e2077
push 0x2f
push ebx
mov edi, eax
call fcn.004e2077
add esp, 0x14
cmp eax, edi
cmova edi, eax
test edi, edi
je 0x423eee
push esi
movzx esi, word [edi]
xor eax, eax
mov ecx, ebx
mov word [edi], ax
call fcn.00423d90
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov word [edi], si
pop esi
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call fcn.004ef010
add esp, 4
mov al, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x423f40
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x515cc8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x56e754]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x2c], ebx
cmp dword [0x585d0c], 0
jne 0x423fbd
mov eax, 1
lock xadd dword [0x585d08], eax
inc eax
cmp eax, 1
jne 0x423f9f
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x585d0c], eax
jmp 0x423fbd
cmp dword [0x585d0c], 0
jne 0x423fbd
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
push 0
call esi
cmp dword [0x585d0c], 0
je 0x423fb0
mov ecx, ebx
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x423fd6
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.0041b490
mov dword [ebp - 4], 0
mov eax, dword [0x585d0c]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x28]
push eax
call fcn.0042d240
and eax, dword [0x585d28]
mov ebx, dword [0x585d14]
lea ecx, [eax*8]
mov eax, dword [0x585d1c]
mov edx, dword [ecx + eax]
add ecx, 4
add ecx, eax
mov dword [ebp - 0x30], edx
mov esi, edx
mov dword [ebp - 0x34], ecx
cmp edx, ebx
jne 0x42403d
mov eax, ebx
jmp 0x424041
mov eax, dword [ecx]
mov eax, dword [eax]
cmp esi, eax
je 0x4240b0
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
mov edi, dword [esi + 0x1c]
lea ecx, [esi + 8]
cmovae edx, dword [ebp - 0x28]
mov dword [ebp - 0x38], edi
cmp edi, 8
jb 0x424061
mov ecx, dword [esi + 8]
mov edi, dword [esi + 0x18]
cmp edi, dword [ebp - 0x18]
jne 0x424076
push edi
call fcn.0041ba80
add esp, 4
test eax, eax
je 0x424080
mov esi, dword [esi]
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
jmp 0x424035
cmp dword [ebp - 0x38], 8
lea edx, [esi + 8]
jb 0x42408b
mov edx, dword [edx]
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
cmp eax, edi
jne 0x4240aa
push eax
call fcn.0041ba80
add esp, 4
test eax, eax
je 0x4240ac
mov esi, ebx
cmp esi, ebx
jne 0x4240cd
mov ecx, dword [ebp - 0x2c]
call fcn.00423ea0
push dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov ecx, 0x585d10
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00430640
mov eax, dword [0x585d0c]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea ecx, [ebp - 0x28]
call fcn.0041b400
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ca771
mov esp, ebp
pop ebp
ret
Function at 0x424100
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x55af08
push 0x4e1f20
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x56e754]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, ecx
mov dword [ebp - 4], 0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4241f0
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov eax, 0x4550
cmp word [ecx], ax
jne 0x4241f0
lea eax, [ecx + 0x18]
movzx edx, word [ecx + 6]
mov dword [ebp - 0x24], edx
mov esi, 0x20b
mov edi, 0xe0
mov ecx, 0xf0
cmp word [eax], si
cmove edi, ecx
add edi, eax
mov dword [ebp - 0x1c], edi
xorps xmm0, xmm0
movlpd qword [ebp - 0x30], xmm0
xor ecx, ecx
mov ebx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
mov dword [ebp - 0x20], ecx
cmp ecx, edx
jge 0x4241ca
lea eax, [ecx + ecx*4]
mov edx, dword [edi + eax*8 + 0x14]
xor edi, edi
mov esi, dword [ebp - 0x1c]
add edx, dword [esi + eax*8 + 0x10]
adc edi, edi
cmp edi, ebx
mov esi, dword [ebp - 0x30]
jb 0x4241c1
ja 0x4241b7
cmp edx, esi
jbe 0x4241c1
mov esi, edx
mov dword [ebp - 0x30], esi
mov ebx, edi
mov dword [ebp - 0x2c], ebx
inc ecx
mov edx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x1c]
jmp 0x424191
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov edx, ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x424590
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.004cb9c0
mov eax, dword [0x56e754]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov esi, ecx
mov word [ebp - 0x2008], ax
lea eax, [ebp - 0x2008]
push eax
push 0
push 0
push 0x1a
mov dword [ebp - 0x200c], esi
push 0
mov dword [ebp - 0x200c], esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4245f8
lea ecx, [ebp - 0x2008]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4245e1
sub ecx, edx
sar ecx, 1
cmp ecx, 0xf00
jbe 0x42460e
mov eax, dword [0x54506c]
mov dword [ebp - 0x2008], eax
mov eax, dword [0x545070]
mov dword [ebp - 0x2004], eax
xor eax, eax
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x2008]
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x424630
sub ecx, edx
lea eax, [ebp - 0x2008]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0041b490
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004ca771
mov esp, ebp
pop ebp
ret
Function at 0x424660
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.004cb9c0
mov eax, dword [0x56e754]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov esi, ecx
mov word [ebp - 0x2008], ax
lea eax, [ebp - 0x2008]
push eax
push 0
push 0
push edx
mov dword [ebp - 0x200c], esi
push 0
mov dword [ebp - 0x200c], esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4246c7
lea ecx, [ebp - 0x2008]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4246b0
sub ecx, edx
sar ecx, 1
cmp ecx, 0xf00
jbe 0x4246dd
mov eax, dword [0x54506c]
mov dword [ebp - 0x2008], eax
mov eax, dword [0x545070]
mov dword [ebp - 0x2004], eax
xor eax, eax
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x2008]
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x424700
sub ecx, edx
lea eax, [ebp - 0x2008]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0041b490
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004ca771
mov esp, ebp
pop ebp
ret
Function at 0x4248a0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x515dc0
mov eax, dword fs:[0]
push eax
sub esp, 0x484
mov eax, dword [0x56e754]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x48c], edx
mov ebx, ecx
push 0
push 2
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x254]
push 0x228
push 0
push eax
mov dword [ebp - 0x488], esi
call fcn.004e2e60
add esp, 0xc
mov dword [ebp - 0x258], 0x22c
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x424955
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x28]
call fcn.00424730
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 8
jb 0x42493c
mov eax, dword [eax]
mov edx, eax
mov ecx, str.CreateToolhelp32Snapshot_failed__error:__s_
call fcn.0042e1a0
lea ecx, [ebp - 0x28]
call fcn.0041b400
jmp 0x4249e7
mov ecx, 0x8b
lea esi, [ebp - 0x258]
lea edi, [ebp - 0x484]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0x2c]
test ecx, ecx
je 0x424a24
mov eax, dword [ecx]
lea edx, [ebp - 0x484]
push edx
mov eax, dword [eax + 8]
call eax
test al, al
je 0x4249c0
mov ecx, dword [ebx + 4]
cmp dword [ebx + 8], ecx
je 0x42499b
mov eax, dword [ebp - 0x250]
mov dword [ecx], eax
add dword [ebx + 4], 4
jmp 0x4249aa
lea eax, [ebp - 0x250]
push eax
push ecx
mov ecx, ebx
call fcn.0042f580
mov ecx, dword [ebp - 0x48c]
test ecx, ecx
je 0x4249c0
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
cmp eax, ecx
jae 0x4249db
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x488]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x424955
push dword [ebp - 0x488]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 3
mov ecx, dword [ebp + 0x2c]
test ecx, ecx
je 0x424a06
mov edx, dword [ecx]
lea eax, [ebp + 8]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ca771
mov esp, ebp
pop ebp
ret
call fcn.004b612e
int3