joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402a35
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push dword [0x41ac80]
call sub.USER32.dll_GetDC
mov dword [ebp - 0x14], eax
push dword [0x41ac88]
push dword [ebp - 0x14]
call sub.GDI32.dll_SelectObject
mov dword [ebp - 0x1c], eax
push dword [ebp + 8]
call sub.KERNEL32.DLL_lstrlenA
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x18]
push dword [ebp + 8]
push dword [ebp - 0x14]
call sub.GDI32.dll_GetTextExtentPoint32A
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
call sub.GDI32.dll_SelectObject
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
push dword [ebp - 8]
pop dword [ebp - 0x24]
push dword [ebp - 4]
pop dword [ebp - 0x20]
lea eax, [ebp - 0x10]
push eax
call sub.USER32.dll_GetCursorPos
push dword [ebp + 8]
push 0xffffffffffffffeb
push dword [0x41ac80]
call sub.USER32.dll_SetWindowLongA
add dword [ebp - 0x10], 8
add dword [ebp - 0xc], 8
add dword [ebp - 8], 2
add dword [ebp - 4], 2
push 1
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [0x41ac80]
call sub.USER32.dll_MoveWindow
push 4
push dword [0x41ac80]
call sub.USER32.dll_ShowWindow
push 0
push 0
push dword [0x41ac80]
call sub.USER32.dll_InvalidateRect
push dword [0x41ac80]
call sub.USER32.dll_UpdateWindow
push dword [ebp - 0x14]
push dword [0x41ac80]
call sub.USER32.dll_ReleaseDC
leave
ret 4

Function at 0x4034ab
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
cmp dword [0x41916e], 0
jne 0x4034be
leave
ret 4
lea eax, [ebp - 0x18]
push eax
push dword [0x419004]
call sub.USER32.dll_GetWindowRect
push 5
call sub.USER32.dll_GetSystemMetrics
cmp dword [ebp + 8], 1
jne 0x4034dd
add dword [ebp - 0x14], eax
mov dword [ebp - 4], eax
push 4
call sub.USER32.dll_GetSystemMetrics
sub eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
sub dword [ebp - 8], 2
push dword [ebp - 0xc]
push dword [ebp - 8]
call main
add dword [ebp - 0x14], eax
cmp dword [ebp + 8], 0
jne 0x40350e
mov eax, dword [ebp - 0xc]
sub dword [ebp - 0x14], eax
push dword [ebp - 8]
pop dword [ebp - 0xc]
push 6
call sub.USER32.dll_GetSystemMetrics
sub dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
sub dword [ebp - 0x10], eax
push dword [ebp - 0x10]
pop dword [ebp - 0x18]
push dword [ebp - 8]
pop dword [ebp - 0x10]
cmp dword [ebp + 8], 0
jne 0x403599
mov eax, 0
or eax, 0x80000000
push 0
push dword [section..data]
push 0
push dword [0x419004]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push eax
push 0x419181
push 0x41917a
push 0
call sub.USER32.dll_CreateWindowExA
mov dword [0x41ac78], eax
push 0x403986
push 0xfffffffffffffffc
push dword [0x41ac78]
call sub.USER32.dll_SetWindowLongA
mov dword [0x41ac7c], eax
push 4
push dword [0x41ac78]
call sub.USER32.dll_ShowWindow
jmp 0x4035b2
push 1
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [0x41ac78]
call sub.USER32.dll_MoveWindow
leave
ret 4
Function at 0x408463
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ebx
push dword [0x4193a2]
call fcn.0040683f
push dword [0x4192fd]
call fcn.0040683f
push dword [0x4192f9]
call fcn.0040683f
push dword [0x419382]
call fcn.0040683f
push 0x7f00
push 0
call sub.USER32.dll_LoadCursorA
push eax
call sub.USER32.dll_SetCursor
mov dword [0x41936a], 1
mov dword [0x41936e], 0
mov dword [0x4194ef], 0
push 0x401273
push 0xfffffffffffffffc
push dword [0x419004]
call sub.USER32.dll_SetWindowLongA
push dword [0x4193bf]
push dword [0x4193a2]
call sub.GDI32.dll_SetStretchBltMode
push dword [0x4192f1]
push dword [0x4192f5]
call fcn.00402e49
push dword [0x4193d3]
push dword [0x4193a2]
call sub.GDI32.dll_SelectObject
push eax
call sub.GDI32.dll_DeleteObject
push dword [0x4193a2]
call sub.GDI32.dll_DeleteDC
call sub.USER32.dll_GetForegroundWindow
cmp eax, dword [0x419004]
je 0x40855b
mov dword [0x4194eb], 0
mov dword [0x4194e7], 0
cmp dword [0x419376], 5
jb 0x40855b
cmp dword [0x419376], 7
ja 0x40855b
push 0
push 0x408981
call sub.USER32.dll_EnumWindows
push dword [0x419004]
call fcn.00402b17
cmp dword [0x4194fb], 1
jne 0x40857e
call fcn.00403451
mov dword [0x4194fb], 0
cmp dword [0x419503], 1
jne 0x40859a
cmp dword [0x419507], 0
jne 0x40859a
mov dword [0x419507], 1
cmp dword [0x419297], 0
jne 0x408606
mov dword [0x41929b], 0
mov eax, dword [0x4194e7]
cmp dword [0x4194eb], eax
jae 0x4085e8
mov ebx, dword [0x4194eb]
shl ebx, 4
push dword [ebx + 0x41b6a3]
push dword [ebx + 0x41b69f]
push dword [ebx + 0x41b69b]
push dword [ebx + 0x41b697]
call sub.USER32.dll_SendMessageA
inc dword [0x4194eb]
jmp 0x408626
cmp dword [0x4194eb], eax
jne 0x408626
mov dword [0x4194eb], 0
mov dword [0x4194e7], 0
jmp 0x408626
mov eax, 0x3e8
mul dword [0x41923b]
mov dword [ebp - 4], eax
push 0
push dword [ebp - 4]
push 5
push dword [0x419004]
call sub.USER32.dll_SetTimer
pop ebx
leave
ret
Function at 0x40b009
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push esi
push 0xffffffffffffffeb
push dword [ebp + 8]
call sub.USER32.dll_GetWindowLongA
mov esi, eax
cmp dword [esi + 0x1c], 0
je 0x40b032
push 0x4000
push dword [esi + 0x20]
push dword [esi + 0x1c]
call sub.KERNEL32.DLL_VirtualFree
push dword [ebp + 8]
call sub.USER32.dll_GetWindowTextLengthA
or eax, eax
je 0x40b066
inc eax
mov dword [esi + 0x20], eax
push 4
push 0x1000
push dword [esi + 0x20]
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [esi + 0x1c], eax
push dword [esi + 0x1c]
push dword [esi + 0x20]
push 0xd
push dword [ebp + 8]
call sub.USER32.dll_SendMessageA
push dword [esi]
call sub.GDI32.dll_DeleteObject
push dword [esi + 4]
call sub.GDI32.dll_DeleteObject
mov dword [esi + 0x18], 0
mov dword [esi + 0x30], 1
push 0
push 0
push 0xce
push dword [ebp + 8]
call sub.USER32.dll_SendMessageA
mov dword [esi + 0x24], eax
push 0
push 0xffffffffffffffff
push 0xbb
push dword [ebp + 8]
call sub.USER32.dll_SendMessageA
mov dword [esi + 0x28], eax
push 0
push eax
push 0xd6
push dword [ebp + 8]
call sub.USER32.dll_SendMessageA
mov ax, 1
push eax
push 0
push 0xd7
push dword [ebp + 8]
call sub.USER32.dll_SendMessageA
and eax, 0xffff
sub eax, dword [esi + 0x28]
mov dword [esi + 0x28], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call sub.USER32.dll_GetClientRect
mov eax, dword [ebp - 0xc]
inc eax
shl eax, 0x10
and dword [ebp - 8], 0xffff
dec dword [ebp - 8]
or eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push 0
push 0xd7
push dword [ebp + 8]
call sub.USER32.dll_SendMessageA
and eax, 0xffff
add eax, dword [esi + 0x24]
mov dword [esi + 0x2c], eax
push dword [ebp + 8]
call sub.USER32.dll_DestroyWindow
pop esi
leave
ret 4
Function at 0x40c053
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push esi
push 0xffffffffffffffeb
push dword [ebp + 8]
call sub.USER32.dll_GetWindowLongA
mov esi, eax
cmp dword [esi + 0x1c], 0
je 0x40c07c
push 0x4000
push dword [esi + 0x20]
push dword [esi + 0x1c]
call sub.KERNEL32.DLL_VirtualFree
push dword [ebp + 8]
call sub.USER32.dll_GetWindowTextLengthA
or eax, eax
je 0x40c0b0
inc eax
mov dword [esi + 0x20], eax
push 4
push 0x1000
push dword [esi + 0x20]
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [esi + 0x1c], eax
push dword [esi + 0x1c]
push dword [esi + 0x20]
push 0xd
push dword [ebp + 8]
call sub.USER32.dll_SendMessageA
push dword [esi]
call sub.GDI32.dll_DeleteObject
push dword [esi + 4]
call sub.GDI32.dll_DeleteObject
mov dword [esi + 0x18], 0
mov dword [esi + 0x28], 1
push 0
push 0
push 0x147
push dword [ebp + 8]
call sub.USER32.dll_SendMessageA
mov dword [esi + 0x24], eax
push dword [ebp + 8]
call sub.USER32.dll_DestroyWindow
pop esi
leave
ret 4
Function at 0x40dae3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
push esi
mov byte [ebp - 0x404], 0
push dword [ebp + 8]
lea eax, [ebp - 0x404]
push eax
call sub.KERNEL32.DLL_lstrcatA
push 0x41915e
lea eax, [ebp - 0x404]
push eax
push 1
call fcn.0040f888
mov dword [ebp - 4], eax
lea eax, [ebp - 0x404]
push eax
call fcn.0040f93c
cmp dword [ebp - 4], 0
jbe 0x40db3e
cmp dword [ebp - 4], eax
jne 0x40db37
mov eax, 0x41914f
jmp 0x40db43
mov eax, 0x419156
jmp 0x40db43
mov eax, 0x41915e
push eax
lea eax, [ebp - 0x404]
push eax
call sub.KERNEL32.DLL_lstrcatA
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push eax
call sub.KERNEL32.DLL_lstrcatA
push 1
push 0
push 0
lea eax, [ebp - 0x404]
push eax
push 0x409889
push dword [0x419004]
call sub.SHELL32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x40db88
mov eax, 0
jmp 0x40dbaa
push dword [0x41acd0]
push 0xf
call fcn.00404f76
push 0
push 0
push eax
push dword [0x419004]
call sub.USER32.dll_MessageBoxA
mov eax, 1
pop esi
leave
ret 8
Function at 0x40e19d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
mov dword [ebp - 4], 0
lea eax, [ebp - 0x204]
push eax
push 0x200
call sub.KERNEL32.DLL_GetTempPathA
push dword [ebp + 8]
lea eax, [ebp - 0x204]
push eax
call sub.KERNEL32.DLL_lstrcatA
mov eax, dword [ebp + 0xc]
inc dword [eax]
inc dword [ebp - 4]
push dword [eax]
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x404]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x404]
push eax
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
je 0x40e216
leave
ret 8
cmp dword [ebp - 4], 0xa
jae 0x40e21e
jmp 0x40e1cd
leave
ret 8

Function at 0x40e222
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
lea eax, [ebp - 0x200]
push eax
push 0x200
call sub.KERNEL32.DLL_GetTempPathA
push dword [ebp + 8]
lea eax, [ebp - 0x200]
push eax
call sub.KERNEL32.DLL_lstrcatA
push dword [ebp + 0xc]
lea eax, [ebp - 0x200]
push eax
push dword [ebp + 0x10]
call sub.USER32.dll_wsprintfA
add esp, 0xc
leave
ret 0xc

Function at 0x40e264
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
lea eax, [ebp - 0x204]
push eax
push 0x200
call sub.KERNEL32.DLL_GetTempPathA
push dword [ebp + 8]
lea eax, [ebp - 0x204]
push eax
call sub.KERNEL32.DLL_lstrcatA
mov eax, dword [0x419d64]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40e29f
leave
ret 8
push dword [ebp - 4]
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x404]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
call sub.KERNEL32.DLL_DeleteFileA
dec dword [ebp - 4]
jmp 0x40e295

Function at 0x40e85f
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
push 0x75
lea eax, [ebp - 0x85]
push eax
push dword [ebp + 8]
call fcn.0040f9d0
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
je 0x40e92a
mov dword [ebp - 0x79], eax
cmp byte [ebp - 0x39], 0
jne 0x40e8df
push dword [ebp - 0x85]
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
jne 0x40e8d6
push dword [ebp - 0x85]
call sub.WSOCK32.dll_gethostbyname
or eax, eax
jne 0x40e8ca
push 0x75
push dword [ebp + 8]
lea eax, [ebp - 0x85]
push eax
call fcn.0040f9d0
leave
ret 4
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
jmp 0x40e8d9
mov dword [ebp - 0xc], eax
mov word [ebp - 0x10], 2
push dword [ebp - 0x81]
call sub.WSOCK32.dll_htons
mov word [ebp - 0xe], ax
push 0x31
push dword [ebp - 0x6d]
push dword [ebp - 0x7d]
push dword [ebp - 0x79]
call sub.WSOCK32.dll_WSAAsyncSelect
or eax, eax
jne 0x40e931
push 0x10
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x79]
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x40e928
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x40e928
mov dword [ebp - 0x75], 0
jmp 0x40e931
mov dword [ebp - 0x75], 0
push 0x75
push dword [ebp + 8]
lea eax, [ebp - 0x85]
push eax
call fcn.0040f9d0
leave
ret 4
Function at 0x40e946
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push 0x75
lea eax, [ebp - 0x75]
push eax
push dword [ebp + 8]
call fcn.0040f9d0
push dword [ebp - 0x28]
call sub.KERNEL32.DLL_lstrlenA
push 0
push eax
push dword [ebp - 0x28]
push dword [ebp - 0x69]
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
je 0x40e9b7
mov dword [ebp - 0x3b], 0
mov byte [ebp - 0x37], 0
mov byte [ebp - 0x36], 0
mov byte [ebp - 0x35], 0
mov word [ebp - 0x3d], 0
push 0x200
push dword [ebp - 0x24]
call sub.KERNEL32.DLL_RtlZeroMemory
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x30], 0
mov byte [ebp - 0x2f], 0
mov byte [ebp - 0x2e], 0
mov dword [ebp - 0x2d], 0
jmp 0x40e9be
mov dword [ebp - 0x65], 0
mov dword [ebp - 0x14], 0
push 0x75
push dword [ebp + 8]
lea eax, [ebp - 0x75]
push eax
call fcn.0040f9d0
leave
ret 4

Function at 0x40e9d7
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push 0x75
lea eax, [ebp - 0x75]
push eax
push dword [ebp + 8]
call fcn.0040f9d0
lea eax, [ebp - 0x45]
push eax
push 0x4004667f
push dword [ebp - 0x69]
call sub.WSOCK32.dll_ioctlsocket
push dword [ebp - 0x45]
push 0x42
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 0x59], eax
push eax
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 0x55], eax
push 0
push dword [ebp - 0x45]
push dword [ebp - 0x55]
push dword [ebp - 0x69]
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
je 0x40ea7f
mov dword [ebp - 0x45], eax
cmp byte [ebp - 0x37], 0
jne 0x40ea3b
lea eax, [ebp - 0x75]
push eax
call fcn.0040eddf
jmp 0x40ea6d
cmp byte [ebp - 0x2e], 0
je 0x40ea4d
cmp byte [ebp - 0x2e], 1
jne 0x40ea64
cmp byte [ebp - 0x30], 1
jne 0x40ea64
cmp dword [ebp - 4], 2
jne 0x40ea6d
push dword [ebp - 0x45]
push dword [ebp - 0x55]
lea eax, [ebp - 0x75]
push eax
call fcn.0040f2ab
jmp 0x40ea6d
lea eax, [ebp - 0x75]
push eax
call fcn.0040ed54
push dword [ebp - 0x55]
call sub.KERNEL32.DLL_GlobalUnlock
push dword [ebp - 0x59]
call sub.KERNEL32.DLL_GlobalFree
jmp 0x40ea86
mov dword [ebp - 0x65], 0
push 0x75
push dword [ebp + 8]
lea eax, [ebp - 0x75]
push eax
call fcn.0040f9d0
leave
ret 4
Function at 0x40eddf
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb88
push edi
push esi
push 0x75
lea eax, [ebp - 0x475]
push eax
push dword [ebp + 8]
call fcn.0040f9d0
lea edi, [ebp - 0x400]
add edi, dword [ebp - 0x43b]
mov esi, dword [ebp - 0x455]
jmp 0x40f00b
cmp byte [esi], 0xa
jne 0x40effe
cmp byte [esi - 2], 0xa
jne 0x40effe
mov cl, byte [esi]
mov byte [edi], cl
inc esi
inc edi
mov byte [edi], 0
mov byte [ebp - 0x437], 1
mov dword [ebp - 0x449], esi
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x475]
push eax
call fcn.0040ec30
lea eax, [ebp - 0x414]
push eax
call fcn.0040f318
mov word [ebp - 0x43d], ax
cmp byte [ebp - 0x414], 0x33
jne 0x40ef23
mov byte [ebp - 0x435], 1
lea eax, [ebp - 0x400]
push eax
call sub.USER32.dll_CharLowerA
lea eax, [ebp - 0x400]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ecx, eax
lea edi, [ebp - 0x400]
mov al, 0x6c
repne scasb al, byte es:[edi]
push edi
push ecx
dec edi
mov esi, str.location:
mov ecx, 9
repe cmpsb byte [esi], byte es:[edi]
mov esi, edi
pop ecx
pop edi
jne 0x40ee95
push 0x200
lea eax, [ebp - 0x200]
push eax
call sub.KERNEL32.DLL_RtlZeroMemory
mov edi, esi
lea esi, [ebp - 0x200]
cmp byte [edi], 0x20
jne 0x40eed6
mov al, 0x20
mov ecx, 0x200
repe scasb al, byte es:[edi]
dec edi
jmp 0x40eede
mov al, byte [edi]
mov byte [esi], al
inc edi
inc esi
cmp byte [edi], 0
je 0x40eeed
cmp byte [edi], 0xd
je 0x40eeed
cmp byte [edi], 0xa
jne 0x40eed8
lea eax, [ebp - 0x475]
push eax
call fcn.0040ea98
lea eax, [ebp - 0x200]
push eax
pop dword [ebp - 0x418]
lea eax, [ebp - 0x475]
push eax
call fcn.0040ead2
lea eax, [ebp - 0x475]
push eax
call fcn.0040e85f
jmp 0x40effa
cmp word [ebp - 0x43d], 0xcc
je 0x40ef37
cmp byte [ebp - 0x414], 0x34
jne 0x40ef48
lea eax, [ebp - 0x475]
push eax
call fcn.0040ea98
jmp 0x40effa
cmp byte [ebp - 0x414], 0x32
je 0x40ef5e
cmp byte [ebp - 0x414], 0x35
jne 0x40efee
push str.multipart_
lea eax, [ebp - 0x400]
push eax
call fcn.0040f02a
cmp eax, 0
jbe 0x40ef90
mov byte [ebp - 0x42f], 1
mov byte [ebp - 0x42e], 1
lea eax, [ebp - 0x475]
push eax
call fcn.0040ed54
jmp 0x40effa
push str.accept_ranges:
lea eax, [ebp - 0x400]
push eax
call fcn.0040f02a
cmp eax, 0
ja 0x40efb1
cmp word [ebp - 0x43d], 0xce
jne 0x40efba
mov byte [ebp - 0x42f], 1
jmp 0x40efd7
push str.Content_Range:
lea eax, [ebp - 0x400]
push eax
call fcn.0040f02a
cmp eax, 0
jbe 0x40efd7
mov byte [ebp - 0x42f], 1
cmp dword [ebp - 0x404], 2
jne 0x40efec
lea eax, [ebp - 0x475]
push eax
call fcn.0040f1e6
jmp 0x40effa
lea eax, [ebp - 0x475]
push eax
call fcn.0040ea98
jmp 0x40f013
mov cl, byte [esi]
mov byte [edi], cl
inc edi
inc esi
inc dword [ebp - 0x43b]
dec eax
or eax, eax
jne 0x40ee12
push 0x75
push dword [ebp + 8]
lea eax, [ebp - 0x475]
push eax
call fcn.0040f9d0
pop esi
pop edi
leave
ret 4
Function at 0x40f215
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x30]
sub ecx, eax
push ecx
push dword [esi + 0x2c]
push dword [ebp + 8]
call fcn.0040f2ab
cmp eax, 1
jne 0x40f2a6
push eax
lea eax, [esi + 0x30]
push eax
push 0x4004667f
push dword [esi + 0xc]
call sub.WSOCK32.dll_ioctlsocket
pop eax
cmp dword [esi + 0x30], 0
je 0x40f295
push 0x42
push dword [esi + 0x30]
push dword [esi + 0x1c]
call sub.KERNEL32.DLL_GlobalReAlloc
mov dword [esi + 0x1c], eax
push eax
call sub.KERNEL32.DLL_GlobalLock
mov dword [esi + 0x20], eax
push 0
push dword [esi + 0x30]
push dword [esi + 0x20]
push dword [esi + 0xc]
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x40f286
mov eax, 0
jmp 0x40f295
mov dword [esi + 0x30], eax
push eax
push dword [esi + 0x20]
push dword [ebp + 8]
call fcn.0040f2ab
cmp eax, 1
jne 0x40f2a6
cmp byte [esi + 0x3f], 1
jne 0x40f2a6
push esi
call fcn.0040ea98
pop esi
leave
ret 4

Function at 0x40f2ab
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x28], 0
je 0x40f2cf
mov eax, dword [ebp + 0x10]
add eax, dword [esi + 0x34]
cmp eax, dword [esi + 0x28]
jbe 0x40f2cf
mov eax, dword [esi + 0x28]
sub eax, dword [esi + 0x34]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x10]
add eax, dword [esi + 0x34]
cmp eax, dword [esi + 0x28]
jne 0x40f2e1
mov dword [esi + 0x6d], 1
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 0x65]
call sub.KERNEL32.DLL_WriteFile
push eax
cmp eax, 1
jne 0x40f312
mov eax, dword [ebp - 4]
add dword [esi + 0x34], eax
add dword [esi + 0x48], eax
cmp dword [esi + 0x69], 0
je 0x40f312
push dword [ebp + 8]
call fcn.0040e4b3
pop eax
pop esi
leave
ret 0xc
Function at 0x4154fe
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x41cc0c], 0
push esi
push edi
jne 0x415566
push 0x419e84
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
test esi, esi
je 0x415566
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push esi
mov edi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov esi, eax
test esi, esi
je 0x415566
push esi
call dword [sym.imp.KERNEL32.DLL_LockResource]
test eax, eax
je 0x41555f
push edi
push eax
push dword [ebp + 0xc]
call fcn.004154da
add esp, 0xc
cmp eax, dword [0x417350]
jne 0x41556b
push esi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov eax, dword [0x417350]
pop edi
pop esi
pop ebp
ret

Function at 0x41556f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [0x41cc0c], 0
mov eax, dword [ebp + 8]
push esi
mov esi, dword [0x417350]
jne 0x4156ac
test eax, eax
je 0x41559c
cmp byte [eax], 0
jne 0x4156ac
push ebx
mov ebx, 0x105
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push ebx
push eax
push dword [0x41cc04]
call edi
test eax, eax
je 0x4155e0
lea eax, [ebp - 0x108]
push eax
call fcn.00415337
and byte [eax], 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push eax
call fcn.004156ba
add esp, 0xc
mov esi, eax
cmp esi, dword [0x417350]
jne 0x4156a6
lea eax, [ebp - 0x108]
push ebx
push eax
push 0
call edi
test eax, eax
je 0x41561f
lea eax, [ebp - 0x108]
push eax
call fcn.00415337
and byte [eax], 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push eax
call fcn.004156ba
add esp, 0xc
mov esi, eax
cmp esi, dword [0x417350]
jne 0x4156a6
mov edi, dword [ebp + 0xc]
push edi
push 0x419e90
call fcn.004156ba
mov esi, eax
pop ecx
cmp esi, dword [0x417350]
pop ecx
jne 0x4156a6
lea eax, [ebp - 0x108]
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
test eax, eax
je 0x415664
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.004156ba
pop ecx
mov esi, eax
pop ecx
cmp esi, dword [0x417350]
jne 0x4156a6
lea eax, [ebp - 0x108]
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
test eax, eax
je 0x41568f
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.004156ba
pop ecx
mov esi, eax
pop ecx
cmp esi, dword [0x417350]
jne 0x4156a6
push edi
push str.PATH
call fcn.00415863
pop ecx
mov esi, eax
pop ecx
pop edi
mov eax, esi
pop ebx
jmp 0x4156b7
push dword [ebp + 0xc]
push eax
call fcn.004156ba
pop ecx
pop ecx
pop esi
leave
ret
Function at 0x4165c7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 4
lea eax, [ebp + 8]
push esi
push eax
call fcn.004151f6
mov eax, dword [ebp + 8]
push 4
lea edi, [eax + esi]
lea eax, [edi + 0x3c]
push eax
lea eax, [ebp - 4]
push eax
call fcn.004151f6
mov eax, dword [ebp - 4]
push 4
add eax, edi
push eax
lea eax, [ebp - 8]
push eax
call fcn.004151f6
add esp, 0x24
cmp dword [ebp - 8], 0x4550
je 0x416620
push str.PELD:_peGetProcAddress:_invalid_instance_handle_or_corrupt_memory_image
call fcn.00415e67
jmp 0x4166e2
mov eax, dword [ebp - 4]
push 8
lea eax, [eax + edi + 0x78]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004151f6
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov ebx, 0x10000
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0xc], eax
mov dword [ebp + 8], ecx
jb 0x416652
push str.PELD:_peGetProcAddress:_export_section___64K
jmp 0x416616
push eax
call fcn.00415094
mov esi, eax
pop ecx
test esi, esi
jne 0x416666
push str.PELD:_peGetProcAddress:_picosMalloc_error
jmp 0x416616
mov eax, dword [ebp + 8]
push dword [ebp - 0xc]
add eax, edi
push eax
push esi
call fcn.004151f6
mov ecx, dword [ebp + 0xc]
add esp, 0xc
cmp ecx, ebx
jae 0x416685
sub cx, word [esi + 0x10]
jmp 0x4166d3
mov eax, esi
xor ebx, ebx
sub eax, dword [ebp + 8]
add dword [esi + 0x20], eax
cmp dword [esi + 0x18], ebx
jbe 0x4166bc
xor eax, eax
jmp 0x41669b
mov ecx, dword [ebp + 0xc]
mov edx, dword [esi + 0x20]
mov eax, dword [edx + eax*4]
sub eax, dword [ebp + 8]
add eax, esi
push eax
push ecx
call fcn.00414f16
pop ecx
test eax, eax
pop ecx
je 0x4166bc
inc ebx
movzx eax, bx
cmp eax, dword [esi + 0x18]
jb 0x416698
movzx eax, bx
cmp eax, dword [esi + 0x18]
jae 0x4166db
mov ecx, esi
sub ecx, dword [ebp + 8]
add dword [esi + 0x24], ecx
mov ecx, dword [esi + 0x24]
mov cx, word [ecx + eax*2]
movzx eax, cx
cmp eax, dword [esi + 0x14]
jb 0x4166e6
push esi
call fcn.004150da
pop ecx
xor eax, eax
jmp 0x4166fe
mov ecx, esi
push esi
sub ecx, dword [ebp + 8]
add dword [esi + 0x1c], ecx
mov ecx, dword [esi + 0x1c]
mov ebx, dword [ecx + eax*4]
call fcn.004150da
pop ecx
lea eax, [ebx + edi]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43522c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
mov edi, dword [ebp + 8]
mov eax, dword [edi]
or eax, dword [edi + 4]
je 0x43527f
mov ecx, 8
mov esi, 0x13cee4d1
sub ebx, ebx
sub eax, eax
mov al, byte [edi]
inc edi
mul esi
rol ebx, 5
xor ebx, eax
dec ecx
jne 0x435248
test ebx, ebx
jne 0x43525d
mov ebx, esi
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
shr ecx, 2
je 0x435270
xor dword [edi], ebx
add edi, 4
dec ecx
jne 0x435268
mov ecx, dword [ebp + 0x10]
and cl, 3
je 0x43527f
xor byte [edi], bl
inc edi
dec cl
jne 0x435278
pop ebx
pop edi
pop esi
leave
ret