joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425cc0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x432f2e
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24c], 0
mov ecx, dword [ebp + 8]
call fcn.00402540
mov ecx, dword [ebp + 0xc]
call fcn.0040ba60
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0xffffffff
jne 0x425d24
xor eax, eax
jmp 0x425e43
mov dword [ebp - 0x244], 0x22c
lea eax, [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x248]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x425d59
mov edx, dword [ebp - 0x248]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x425e43
mov eax, dword [ebp - 0x23c]
push eax
call fcn.00425690
add esp, 4
test eax, eax
je 0x425e15
push 0x438368
lea ecx, [ebp - 0x220]
push ecx
call fcn.0040dd62
add esp, 8
test eax, eax
jne 0x425dc2
push 0x43837c
lea ecx, [ebp - 0x268]
call fcn.00401260
mov dword [ebp - 4], 0
lea edx, [ebp - 0x268]
push edx
mov ecx, dword [ebp + 8]
call fcn.004024c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x268]
call fcn.004012a0
jmp 0x425dfc
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x284]
call fcn.00401260
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x284]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004024c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x284]
call fcn.004012a0
lea edx, [ebp - 0x23c]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.004025a0
mov dword [ebp - 0x24c], 1
lea eax, [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x248]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x425d59
mov edx, dword [ebp - 0x248]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret

Function at 0x4274c0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
jmp 0x4274d8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x100
jae 0x42752b
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
jmp 0x4274f9
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 8
jge 0x42751c
mov eax, dword [ebp - 8]
shr eax, 1
mov ecx, dword [ebp - 8]
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
xor eax, ecx
mov dword [ebp - 8], eax
jmp 0x4274f0
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [edx*4 + 0x4424c0], eax
jmp 0x4274cf
mov esp, ebp
pop ebp
ret
Function at 0x427ea0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0x10], 0
jne 0x427eb0
xor eax, eax
jmp 0x427f23
mov dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0x1000000
jbe 0x427ec9
mov dword [ebp - 0x14], 0x1000000
jmp 0x427ecf
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 0
push 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0xc]
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp - 0xc]
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
cmp dword [ebp - 8], 0
jne 0x427f1a
jmp 0x427f20
cmp dword [ebp + 0x10], 0
ja 0x427eb7
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x427f30
Capabilities:
Check if file exists
Create directory
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
push eax
call fcn.0040dc46
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x428057
xor edx, edx
mov word [ebp - 0x210], dx
push 0x1fe
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.0040dc60
add esp, 0xc
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00427c90
add esp, 8
test eax, eax
je 0x427fd1
lea eax, [ebp - 0x210]
push eax
call fcn.00427f30
add esp, 4
test eax, eax
je 0x427fc5
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x42805c
xor eax, eax
jmp 0x42805c
xor edx, edx
mov word [ebp - 0x418], dx
push 0x1fe
push 0
lea eax, [ebp - 0x416]
push eax
call fcn.0040dc60
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 0x43e160
push 0x200
push 0x100
lea edx, [ebp - 0x418]
push edx
call fcn.0040d6a3
add esp, 0x14
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 1
je 0x428043
cmp dword [ebp - 0x214], 0
je 0x428043
mov dword [ebp - 0x41c], 1
jmp 0x42804d
mov dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x41c]
jmp 0x42805c
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret
Function at 0x4284a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x43e174
push 0x92
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], 0
jne 0x4284f7
or eax, 0xffffffff
jmp 0x42851b
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.00428330
add esp, 0xc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x42c2b0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 0xc], eax
push 0
mov eax, dword [ebp + 8]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
jne 0x42c2e4
xor eax, eax
jmp 0x42c42f
mov ecx, dword [ebp - 0x224]
push ecx
call fcn.0040c676
add esp, 4
mov dword [ebp - 0x228], eax
mov edx, dword [ebp - 0x228]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x224]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x42c33b
mov eax, dword [ebp - 8]
mov dword [ebp - 0x22c], eax
mov ecx, dword [ebp - 0x22c]
push ecx
call fcn.0040dcda
add esp, 4
xor eax, eax
jmp 0x42c42f
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x21c]
push eax
push str.VarFileInfoTranslation
mov ecx, dword [ebp - 8]
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x42c37a
mov edx, dword [ebp - 8]
mov dword [ebp - 0x230], edx
mov eax, dword [ebp - 0x230]
push eax
call fcn.0040dcda
add esp, 4
xor eax, eax
jmp 0x42c42f
mov ecx, dword [ebp - 0x21c]
movzx edx, byte [ecx + 2]
push edx
mov eax, dword [ebp - 0x21c]
movzx ecx, byte [eax + 3]
push ecx
mov edx, dword [ebp - 0x21c]
movzx eax, byte [edx]
push eax
mov ecx, dword [ebp - 0x21c]
movzx edx, byte [ecx + 1]
push edx
push str.StringFileInfo_02x_02x_02x_02xProductName
push 0x208
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.0040d6a3
add esp, 0x20
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x42c3fe
mov edx, dword [ebp - 8]
mov dword [ebp - 0x234], edx
mov eax, dword [ebp - 0x234]
push eax
call fcn.0040dcda
add esp, 4
xor eax, eax
jmp 0x42c42f
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040cf98
add esp, 0xc
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x238], ecx
mov edx, dword [ebp - 0x238]
push edx
call fcn.0040dcda
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret

Function at 0x42c440
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x4388e4
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 4]
push eax
push 0x4388f8
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 8], eax
push str.test_qq_
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x42c490
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [0x43e198], 0xffffffff
jne 0x42c4fb
push 0x11c
push 0
lea eax, [ebp - 0x128]
push eax
call fcn.0040dc60
add esp, 0xc
mov dword [ebp - 0x128], 0x11c
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 0x124], 6
jb 0x42c4f1
mov dword [0x43e198], 1
jmp 0x42c4fb
mov dword [0x43e198], 0
mov eax, dword [0x43e198]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret

Function at 0x42c510
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 0
mov eax, dword [ebp + 8]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42c531
xor eax, eax
jmp 0x42c5d0
mov ecx, dword [ebp - 4]
push ecx
call fcn.0040c676
add esp, 4
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x42c573
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0040dcda
add esp, 4
xor eax, eax
jmp 0x42c5d0
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 8]
push eax
push 0x4388c4
mov ecx, dword [ebp - 0xc]
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x42c5a3
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0040dcda
add esp, 4
xor eax, eax
jmp 0x42c5d0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.0040dcda
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x42c5e0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 8], eax
mov ax, word [0x438890]
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.0040dc60
add esp, 0xc
push 0x104
lea edx, [ebp - 0x210]
push edx
mov eax, dword [0x43f550]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x214], 0
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jbe 0x42c6fe
mov eax, dword [ebp - 4]
push eax
call fcn.0040da60
add esp, 4
mov dword [ebp - 0x218], eax
mov ecx, dword [ebp - 0x218]
push ecx
mov edx, dword [ebp - 4]
push edx
push 0
lea eax, [ebp - 0x210]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x42c689
jmp 0x42c6ef
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x220], 0
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x21c]
push edx
push 0x438894
mov eax, dword [ebp - 0x218]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x42c6c9
cmp dword [ebp - 0x21c], 0
jne 0x42c6cb
jmp 0x42c6ef
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x21c]
mov eax, dword [edx + 0x10]
mov dword [ecx], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x21c]
mov eax, dword [edx + 0x14]
mov dword [ecx], eax
xor ecx, ecx
jne 0x42c66a
mov edx, dword [ebp - 0x218]
push edx
call fcn.0040d983
add esp, 4
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret
Function at 0x42c710
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1658
call fcn.0041b550
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0xffffffff
jne 0x42c746
xor eax, eax
jmp 0x42c8c2
mov dword [ebp - 0x238], 0x22c
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp - 0x23c]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x42c77b
mov edx, dword [ebp - 0x23c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x42c8c2
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x42c898
cmp dword [ebp + 0xc], 0
je 0x42c884
xor edx, edx
mov word [ebp - 0x448], dx
push 0x206
push 0
lea eax, [ebp - 0x446]
push eax
call fcn.0040dc60
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x1658], cx
push 0x206
push 0
lea edx, [ebp - 0x1656]
push edx
call fcn.0040dc60
add esp, 0xc
mov eax, dword [ebp - 0x230]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x450]
push ecx
push 0x1000
lea edx, [ebp - 0x1450]
push edx
mov eax, dword [ebp - 0x44c]
push eax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x42c882
push 0x208
lea ecx, [ebp - 0x1658]
push ecx
mov edx, dword [ebp - 0x1450]
push edx
mov eax, dword [ebp - 0x44c]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x42c882
push 0x103
lea ecx, [ebp - 0x448]
push ecx
lea edx, [ebp - 0x1658]
push edx
call fcn.0042c2b0
add esp, 0xc
lea eax, [ebp - 0x448]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040dd62
add esp, 8
test eax, eax
jne 0x42c882
mov edx, dword [ebp - 0x23c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x42c8c2
jmp 0x42c898
mov eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x42c8c2
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x23c]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x42c77b
mov eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret
Function at 0x42cc50
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x11c
push 0
lea eax, [ebp - 0x128]
push eax
call fcn.0040dc60
add esp, 0xc
mov dword [ebp - 0x128], 0x11c
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42cce1
mov dword [ebp - 0x128], 0x114
lea edx, [ebp - 0x128]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x42cce1
push 0xa
mov eax, dword [ebp + 8]
push eax
call fcn.00424ea0
add esp, 8
push 0x10
push 0x438920
push 0x438948
mov ecx, dword [ebp + 8]
push ecx
call fcn.00424e40
add esp, 0x10
xor eax, eax
jmp 0x42cdec
mov edx, dword [ebp - 0x118]
mov dword [ebp - 0x130], edx
cmp dword [ebp - 0x130], 2
je 0x42ccfb
jmp 0x42cdbd
cmp dword [ebp - 0x124], 4
ja 0x42cd31
push 0xa
mov eax, dword [ebp + 8]
push eax
call fcn.00424ea0
add esp, 8
push 0x10
push 0x438970
push 0x438998
mov ecx, dword [ebp + 8]
push ecx
call fcn.00424e40
add esp, 0x10
xor eax, eax
jmp 0x42cdec
cmp dword [ebp - 0x124], 5
jne 0x42cd76
cmp dword [ebp - 0x120], 0
jne 0x42cd76
movzx edx, word [ebp - 0x14]
cmp edx, 2
jge 0x42cd76
push 0xa
mov eax, dword [ebp + 8]
push eax
call fcn.00424ea0
add esp, 8
push 0x10
push 0x438a2c
push 0x438a58
mov ecx, dword [ebp + 8]
push ecx
call fcn.00424e40
add esp, 0x10
xor eax, eax
jmp 0x42cdec
call fcn.0042c440
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jne 0x42cdb4
push 0xa
mov edx, dword [ebp + 8]
push edx
call fcn.00424ea0
add esp, 8
push 0x10
push 0x438aec
push 0x438b14
mov eax, dword [ebp + 8]
push eax
call fcn.00424e40
add esp, 0x10
xor eax, eax
jmp 0x42cdec
mov eax, 1
jmp 0x42cdec
push 0xa
mov ecx, dword [ebp + 8]
push ecx
call fcn.00424ea0
add esp, 8
push 0x10
push 0x438b54
push 0x438b80
mov edx, dword [ebp + 8]
push edx
call fcn.00424e40
add esp, 0x10
xor eax, eax
jmp 0x42cdec
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret

Function at 0x42e150
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x43f578]
mov dword [ebp - 4], eax
push 0x500000
push 0
push 0x401
push 0x414
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x404
push 0x414
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x402
push 0x414
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x4401ec], 0
push 0x42dab0
push 0x32
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0
push 0
push 0x42df40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret

Function at 0x42e920
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0x42e5b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x42edf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea ecx, [ebp - 8]
call fcn.0040bb80
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040ba30
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
jmp 0x42ee1f
lea ecx, [ebp - 8]
call fcn.0040bf00
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040bae0
push eax
lea ecx, [ebp - 8]
call fcn.0040aa00
movzx ecx, al
test ecx, ecx
je 0x42ee6a
lea ecx, [ebp - 8]
call fcn.0040bba0
mov edx, dword [eax]
push edx
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x42ee68
push 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x42ee17
mov esp, ebp
pop ebp
ret

Function at 0x42ef20
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x432da4
mov eax, dword fs:[0]
push eax
sub esp, 0x468
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x249], 0
mov ecx, dword [ebp + 8]
call fcn.0040ba60
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0xffffffff
jne 0x42ef7d
mov al, byte [ebp - 0x249]
jmp 0x42f0ac
mov dword [ebp - 0x244], 0x22c
lea eax, [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x248]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x42efb6
mov edx, dword [ebp - 0x248]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x249]
jmp 0x42f0ac
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x474]
push ecx
call fcn.0040e005
add esp, 8
lea edx, [ebp - 0x474]
push edx
call fcn.0040d24e
add esp, 4
push eax
lea ecx, [ebp - 0x268]
call fcn.00401260
mov dword [ebp - 4], 0
push 0x438760
lea ecx, [ebp - 0x268]
call fcn.004023b0
test eax, eax
je 0x42f03e
push 0x43877c
lea ecx, [ebp - 0x268]
call fcn.004023b0
test eax, eax
je 0x42f03e
push 0x438798
lea ecx, [ebp - 0x268]
call fcn.004023b0
test eax, eax
je 0x42f03e
push 0x4387bc
lea ecx, [ebp - 0x268]
call fcn.004023b0
test eax, eax
jne 0x42f060
mov eax, dword [ebp - 0x23c]
push eax
call fcn.00425510
add esp, 4
test eax, eax
je 0x42f060
lea ecx, [ebp - 0x23c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004025a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x268]
call fcn.004012a0
lea edx, [ebp - 0x244]
push edx
mov eax, dword [ebp - 0x248]
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x42efb6
mov ecx, dword [ebp - 0x248]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
call fcn.0040bc20
test eax, eax
jne 0x42f0aa
xor al, al
jmp 0x42f0ac
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret
Function at 0x42f690
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0x10]
push eax
call fcn.0042ce10
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [0x43f550], ecx
call fcn.00420f50
mov edx, dword [0x43f550]
push edx
call fcn.004212b0
add esp, 4
call fcn.004209a0
push 0
call fcn.0042cc50
add esp, 4
test eax, eax
jne 0x42f6d9
xor eax, eax
jmp 0x42f7bd
mov dword [ebp - 4], 0
push str._TXTenpay0824
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x42f71c
push 0x30
push 0x438f24
push 0x438f4c
push 0
call fcn.00424c80
add esp, 0x10
xor eax, eax
jmp 0x42f7bd
call fcn.0042c8d0
test eax, eax
jne 0x42f744
push 0x44
push 0x438f78
push 0x438fa0
push 0
call fcn.00424c80
add esp, 0x10
cmp eax, 7
jne 0x42f744
xor eax, eax
jmp 0x42f7bd
call fcn.004253c0
call fcn.004252f0
push 0x6d
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov dword [ebp - 8], eax
push 0
push 0
push 0
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x42f79d
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x42f79b
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x42f75d
call fcn.004252e0
call fcn.0041fb50
call fcn.00421290
call fcn.0041f4e0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x50414b
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.005041ca
jae 0x504157
xor ecx, ecx
call fcn.005041ca
jae 0x504181
xor eax, eax
call fcn.005041ca
jae 0x504192
mov al, 0x10
call fcn.005041ca
adc al, al
jae 0x504173
jne 0x5041bf
stosb byte es:[edi], al
jmp 0x504158
call fcn.005041d6
dec ecx
loop 0x50419e
mov eax, ebp
call fcn.005041d4
jmp 0x5041c0
lodsb al, byte [esi]
shr eax, 1
je 0x5041e6
adc ecx, 2
mov ebp, eax
jmp 0x5041c0
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.005041d4
cmp eax, 0x7d00
jae 0x5041be
cmp eax, 0x500
jae 0x5041bf
cmp eax, 0x7f
ja 0x5041c0
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x504158
pop ebp
ret 8