joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439440
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x48ab23
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0047e7e6
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.00483e7e
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.004853d6
test eax, eax
je 0x43955c
mov ecx, dword [esp + 0x3c]
call fcn.00483eab
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x439520
push edi
mov ecx, esi
call fcn.00481515
mov ecx, esi
call fcn.004396c0
cmp dword [esp + 0x38], 1
jne 0x439555
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00481650
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x43bf80
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43bfb3
push esi
call fcn.0043f090
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43bfac
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43c039
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43c022
mov eax, dword [esi + 8]
test eax, eax
je 0x43bfd7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43c01e
cmp eax, 2
je 0x43c022
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43bfca
cmp eax, 3
je 0x43bffd
cmp eax, 1
jne 0x43bfca
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43bfca
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43bfca
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043c060
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43c048
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043c060
add esp, 4
pop esi
ret
Function at 0x451030
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x13c]
push edi
test eax, eax
jle 0x45107c
mov eax, dword [ebx + 0x140]
test eax, eax
jle 0x45107c
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
lea edi, [ebx + 0x150]
mov eax, dword [edi]
test eax, eax
je 0x451066
push eax
call ebp
test ax, ax
jl 0x451074
inc esi
add edi, 4
cmp esi, 6
jb 0x451058
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
mov ecx, ebx
call fcn.00450d30
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4540d0
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x454130
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x454130
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x454130
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x454130
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x454140
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x45f120
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x45f12b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x45f22e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x4e5718]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4e5718]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4e5718]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4e5718]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4e5718]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4e5718]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4e5718]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4e5718]
xor eax, edx
inc ecx
dec edi
jne 0x45f146
pop edi
test esi, esi
je 0x45f250
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4e5718]
xor eax, edx
inc ecx
dec esi
jne 0x45f232
pop esi
pop ebx
not eax
ret
Function at 0x4643e8
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48b7b9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.00466ea0
lea edi, [esi + 0x108]
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], edi
lea ecx, [edi + 0xc]
mov dword [edi], 0x4e5f40
call fcn.0047bc16
lea ecx, [edi + 0x14]
mov byte [esp + 0x18], 1
call fcn.0047bc16
lea ecx, [edi + 0x1c]
mov byte [esp + 0x18], 2
call fcn.00466ac0
lea ecx, [edi + 0x30]
mov byte [esp + 0x18], 3
call fcn.00466ac0
lea ecx, [edi + 0x50]
mov byte [esp + 0x18], 4
call fcn.0047bc16
lea ecx, [edi + 0x58]
mov byte [esp + 0x18], 5
call fcn.0047bc16
lea ecx, [edi + 0x60]
mov byte [esp + 0x18], 6
call fcn.00466ac0
lea ecx, [edi + 0x74]
mov byte [esp + 0x18], 7
call fcn.00466ac0
mov dword [edi], 0x4e5f38
lea ecx, [esi + 0x264]
mov byte [esp + 0x18], 8
call fcn.00466ea0
lea ecx, [esi + 0x360]
mov byte [esp + 0x18], 9
call fcn.00466ea0
lea ecx, [esi + 0x45c]
mov byte [esp + 0x18], 0xa
call fcn.00466ea0
lea ecx, [esi + 0x558]
mov byte [esp + 0x18], 0xb
call fcn.00466ea0
lea ecx, [esi + 0x654]
mov byte [esp + 0x18], 0xc
call fcn.00466ea0
mov ecx, esi
mov byte [esp + 0x18], 0xd
mov dword [esi], method.CWnd.virtual_0
call fcn.00464710
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4645d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48b8cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], method.CWnd.virtual_0
lea ecx, [esi + 0x654]
mov dword [esp + 0x18], 5
call fcn.00467070
lea ecx, [esi + 0x558]
mov byte [esp + 0x18], 4
call fcn.00467070
lea ecx, [esi + 0x45c]
mov byte [esp + 0x18], 3
call fcn.00467070
lea ecx, [esi + 0x360]
mov byte [esp + 0x18], 2
call fcn.00467070
lea ecx, [esi + 0x264]
mov byte [esp + 0x18], 1
call fcn.00467070
lea edi, [esi + 0x108]
mov dword [esp + 0xc], edi
lea ecx, [edi + 0x74]
mov byte [esp + 0x18], 0xc
mov dword [ecx], 0x4e5f48
call fcn.00466cc0
lea ecx, [edi + 0x60]
mov byte [esp + 0x18], 0xb
mov dword [ecx], 0x4e5f48
call fcn.00466cc0
lea ecx, [edi + 0x58]
mov byte [esp + 0x18], 0xa
call fcn.0047bc3f
lea ecx, [edi + 0x50]
mov byte [esp + 0x18], 9
call fcn.0047bc3f
lea ecx, [edi + 0x30]
mov byte [esp + 0x18], 8
mov dword [ecx], 0x4e5f48
call fcn.00466cc0
lea ecx, [edi + 0x1c]
mov byte [esp + 0x18], 7
mov dword [ecx], 0x4e5f48
call fcn.00466cc0
lea ecx, [edi + 0x14]
mov byte [esp + 0x18], 6
call fcn.0047bc3f
lea ecx, [edi + 0xc]
mov byte [esp + 0x18], 0
call fcn.0047bc3f
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.00467070
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x469c10
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x469cb3
test eax, eax
jbe 0x469cb3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x469cb3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x469c5e
xor esi, esi
jmp 0x469c64
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x469c8f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.0046bb20
add esi, eax
push esi
mov ebx, esi
call fcn.0046bb20
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x469c70
pop ebp
test edi, edi
pop edi
jne 0x469cb3
test ebx, ebx
je 0x469cb3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.0046dfa0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x469df5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x469f0d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x469f0d
mov eax, dword [esi + 0x3c]
push eax
call fcn.0047ec38
mov esi, eax
test esi, esi
je 0x469f0d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x469f0d
mov ecx, esi
call fcn.00469d60
cmp edi, eax
jge 0x469f0d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x469e93
mov dword [esp + 0x34], 1
jmp 0x469eee
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x469f0d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00469310
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x47f5db
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x47f613
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0047d692
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0047d66a
jmp 0x47f61f
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x480cd2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x480d14
call fcn.0048694c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x480d14
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x480d0b
xor eax, eax
jmp 0x480d1c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00480d22
pop edi
pop esi
pop ebx
ret 4

Function at 0x486e7c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x486eaa
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x486ec8
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00486de2
jmp 0x486ec8
mov eax, dword [esi + 0x14]
test eax, eax
je 0x486ec8
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00486de2
test edi, edi
mov eax, edi
jne 0x486eb2
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4010b0
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push esi
push eax
push 0x28
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x401138
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
lea ecx, [esp + 0xc]
push ecx
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x401125
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x20], 2
call edi
mov edx, dword [esp + 8]
push esi
push esi
lea ecx, [esp + 0x1c]
push 0x10
push ecx
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov esi, eax
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
add esp, 0x1c
ret
mov eax, esi
pop esi
add esp, 0x1c
ret

Function at 0x401140
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
test esi, esi
jle 0x401162
mov dl, byte [esp + 0x10]
mov ecx, dword [esp + 8]
push ebx
mov bl, byte [eax + ecx]
xor bl, dl
mov byte [eax + ecx], bl
inc eax
cmp eax, esi
jl 0x401154
pop ebx
pop esi
ret

Function at 0x401170
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40118e
xor eax, eax
pop esi
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x4011a2
pop esi
add esp, 0x10
ret
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
test eax, eax
jne 0x4011b2
pop esi
add esp, 0x10
ret
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
push eax
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_htons]
lea ecx, [esp + 4]
push 0x10
push ecx
push esi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_connect]
inc eax
neg eax
sbb eax, eax
and eax, esi
pop esi
add esp, 0x10
ret
Function at 0x401610
Capabilities:
Hide graphical window
Initialize winsock library

Disassembly:
sub esp, 0x1a0
push ebx
xor eax, eax
xor ecx, ecx
push esi
push edi
mov dword [0x40d718], eax
mov dword [0x40d710], ecx
push 0x98
lea edx, [esp + 0x18]
mov word [0x40d71c], ax
mov word [0x40d714], cx
mov bl, 0xc9
push 6
push edx
mov byte [0x40d71e], al
mov byte [0x40d716], cl
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], 0xaa
mov byte [esp + 0x23], 0xa8
mov byte [esp + 0x24], 0xa9
mov byte [esp + 0x25], 0xa9
call fcn.00401140
mov eax, dword [esp + 0x20]
mov cx, word [esp + 0x24]
push 0x98
lea edx, [esp + 0x1c]
push 6
push edx
mov dword [0x40d718], eax
mov word [0x40d71c], cx
mov byte [esp + 0x24], bl
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], 0xaa
mov byte [esp + 0x27], 0xa8
mov byte [esp + 0x28], 0xa9
mov byte [esp + 0x29], 0xaa
call fcn.00401140
mov eax, dword [esp + 0x24]
mov cx, word [esp + 0x28]
mov dx, word [str.258aaa]
add esp, 0x18
mov dword [0x40d710], eax
mov al, byte [0x40b042]
push 0x7530
mov word [0x40d714], cx
mov word [0x40d72c], dx
mov byte [0x40d72e], al
mov dword [0x40d6f8], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [esp + 0x1b0]
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0xc8
push 1
push esi
call edi
push 0
push 0xc8
push 2
push esi
call edi
push 0
push 0xa
push 3
push esi
call edi
lea ecx, [esp + 0x1c]
push ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
pop edi
pop esi
test eax, eax
pop ebx
jne 0x40175b
mov ax, word [esp + 0x10]
cmp al, 2
jne 0x401755
xor edx, edx
mov dl, ah
cmp dl, al
je 0x40175b
call dword [sym.imp.WS2_32.dll_WSACleanup]
add esp, 0x1a0
ret
Function at 0x401e60
Capabilities:
Create thread
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x408d68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
mov edi, dword [esp + 0x34]
push 0x3e9
push edi
call esi
mov ebx, eax
push 0x3eb
push edi
mov dword [esp + 0x18], ebx
call esi
mov ebp, dword [sym.imp.USER32.dll_GetWindowTextA]
mov esi, eax
mov ecx, 0x41
xor eax, eax
mov edi, 0x40d834
push 0x104
rep stosd dword es:[edi], eax
mov ecx, 8
mov edi, 0x40d938
push 0x40d834
push ebx
rep stosd dword es:[edi], eax
call ebp
mov edi, 0x40d834
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 6
jbe 0x401fe2
push 0x20
push 0x40d938
push esi
call ebp
mov al, byte [esp + 0x34]
mov edi, 0x40d938
mov byte [esp + 0x14], al
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
lea ecx, [esp + 0x18]
push ebp
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call fcn.00403510
test al, al
je 0x401f48
mov edi, dword [esp + 0x18]
mov ecx, ebp
mov edx, ecx
mov esi, 0x40d938
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], ebp
mov byte [eax + ebp], bl
mov edx, dword [0x40d708]
lea ecx, [esp + 0x14]
push ecx
push 1
push edx
mov ecx, 0x40d700
mov dword [esp + 0x38], ebx
call fcn.00403700
mov eax, dword [0x40d6f8]
inc eax
cmp eax, 2
mov dword [0x40d6f8], eax
jne 0x401f86
mov eax, dword [esp + 0x34]
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x40d6f8], ebx
push ebx
push ebx
push ebx
push 0x401e40
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10]
push 0x40d958
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [esp + 0x18]
cmp ecx, ebx
je 0x401fe2
mov al, byte [ecx - 1]
cmp al, bl
je 0x401fd8
cmp al, 0xff
je 0x401fd8
pop edi
dec al
pop esi
pop ebp
mov byte [ecx - 1], al
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
dec ecx
push ecx
call fcn.00403d30
add esp, 4
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x402120
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
cmp esi, 0xfc
jle 0x40215a
cmp edi, 0x14
jge 0x40215a
mov eax, dword [0x40d730]
test eax, eax
je 0x40215f
push 0
push ebp
call ebx
xor eax, eax
mov dword [0x40d730], eax
jmp 0x40215f
mov eax, dword [0x40d730]
cmp esi, 0xd4
jle 0x402192
cmp esi, 0x112
jge 0x402192
cmp edi, 0xc3
jle 0x402192
xor ecx, ecx
cmp edi, 0xd7
setl cl
test eax, ecx
je 0x402192
push 0
push ebp
call ebx
xor eax, eax
mov dword [0x40d730], eax
cmp esi, 0x87
jle 0x4021cc
cmp esi, 0xc6
jge 0x4021cc
cmp edi, 0xc3
jle 0x4021cc
xor edx, edx
cmp edi, 0xd7
setl dl
test eax, edx
je 0x4021cc
push ebp
call fcn.00401e60
add esp, 4
mov dword [0x40d730], 0
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x401130
Capabilities:
Read file via mapping

Disassembly:
push 0xffffffffffffffff
push 0x423ac8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push edi
mov esi, ecx
call fcn.00420478
mov edi, dword [eax + 0x10]
push str.CInstanceChecker_MMF_
lea ecx, [esp + 0xc]
call fcn.004187a9
push edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0
call fcn.00418a3d
mov eax, dword [esp + 8]
push eax
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
test eax, eax
mov dword [esi + 0xc], eax
jne 0x4011d5
mov ecx, dword [esp + 8]
push ecx
push 4
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 4
push 0
push 0
push 6
push eax
mov dword [0x431128], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
lea edx, [esi + 4]
push 1
push edx
lea ecx, [esp + 0x14]
mov edi, eax
call fcn.00402cd0
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea ecx, [esp + 0xc]
call fcn.00402d0c
mov ecx, dword [esi + 0xc]
xor eax, eax
test ecx, ecx
setne al
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x20], 0xffffffff
call fcn.0041873b
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x401210
Capabilities:
Read file via mapping

Disassembly:
push 0xffffffffffffffff
push 0x423af0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebp
push esi
push edi
mov esi, ecx
push 4
push 0
mov eax, dword [esi + 0xc]
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
lea ecx, [esi + 4]
push 1
push ecx
lea ecx, [esp + 0x18]
mov ebp, eax
call fcn.00402cd0
mov edx, dword [0x42f214]
mov dword [esp + 0x24], 0
mov dword [esp + 0xc], edx
push 0xe000
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 1
call fcn.00418b5e
mov eax, dword [esp + 0xc]
push eax
push str.32770
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, eax
test edi, edi
je 0x40129b
push 9
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push ebp
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esi + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0xc]
mov dword [esi + 0xc], 0
mov byte [esp + 0x24], 0
call fcn.0041873b
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.00402d0c
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x401de0
Capabilities:
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
ret 4