joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433945
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.004338c1
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x433ab4
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x433ab4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x433a69
jg 0x4339a1
test eax, eax
je 0x433a5f
push 1
push 0x1000
call fcn.00427ac4
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4339c4
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x433a56
push 0x8000
push ebx
call fcn.0041fa00
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x4339ed
jg 0x4339e8
cmp ecx, 0x1000
jb 0x4339ed
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004278a8
add esp, 0x10
cmp eax, 0xffffffff
je 0x433a32
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4339e8
jl 0x433a19
test ecx, ecx
jne 0x4339da
push dword [ebp - 0xc]
push ebx
call fcn.0041fa00
push esi
call fcn.00423e82
add esp, 0xc
xor ebx, ebx
jmp 0x433ac2
cmp byte [edi + 0x24], 0
je 0x433a49
cmp dword [edi + 0x20], 5
jne 0x433a49
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x433a54
mov ebx, dword [edi + 0x18]
jmp 0x433a56
xor ebx, ebx
push esi
call fcn.00423e82
pop ecx
jmp 0x433ac2
test ecx, ecx
jg 0x433a2b
jl 0x433a69
test eax, eax
jae 0x433a2b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00427d67
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x433a89
cmp byte [edi + 0x1c], 0
je 0x433a2b
jmp 0x433aba
push ebx
call fcn.0042b728
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x433a2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x433ac2
cmp byte [edi + 0x1c], 0
je 0x433abf
mov ebx, dword [edi + 0x18]
jmp 0x433ac2
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00427d67
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x435080
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4350ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4350ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4011a4
Capabilities:
Check for peb beingdebugged flag

Disassembly:
jmp 0x40ec70
push 0xffffffffffffffff
push 0x58e480
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
xor eax, eax
push esi
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x5a46d8
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], eax
push ecx
push eax
push eax
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CGdiObject::Attach
mov esi, dword [esp + 0x30]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call sub.MFC42.DLL_CDC::SelectObject_3
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
mov dword [esp + 0x3c], eax
mov ecx, esi
lea eax, [edi + 2]
push eax
lea eax, [esp + 0x1c]
push ebx
push eax
call sub.MFC42.DLL_CDC::MoveTo
lea eax, [edi + 5]
mov ecx, esi
push eax
push ebx
call sub.MFC42.DLL_CDC::LineTo
lea ebp, [edi + 3]
lea eax, [ebx + 1]
push ebp
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
lea eax, [edi + 6]
mov ecx, esi
push eax
lea eax, [ebx + 1]
push eax
call sub.MFC42.DLL_CDC::LineTo
lea eax, [edi + 4]
lea ecx, [ebx + 2]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
lea eax, [edi + 7]
mov ecx, esi
push eax
lea eax, [ebx + 2]
push eax
call sub.MFC42.DLL_CDC::LineTo
lea eax, [ebx + 3]
push ebp
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
lea eax, [edi + 6]
mov ecx, esi
push eax
lea eax, [ebx + 3]
push eax
call sub.MFC42.DLL_CDC::LineTo
lea eax, [edi + 2]
lea ecx, [ebx + 4]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
lea eax, [edi + 5]
mov ecx, esi
push eax
lea eax, [ebx + 4]
push eax
call sub.MFC42.DLL_CDC::LineTo
lea ecx, [edi + 1]
lea eax, [ebx + 5]
push ecx
lea edx, [esp + 0x1c]
push eax
push edx
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
lea eax, [edi + 4]
mov ecx, esi
push eax
lea eax, [ebx + 5]
push eax
call sub.MFC42.DLL_CDC::LineTo
add ebx, 6
push edi
lea eax, [esp + 0x1c]
push ebx
push eax
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
push ebp
push ebx
mov ecx, esi
call sub.MFC42.DLL_CDC::LineTo
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CDC::SelectObject_3
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [esp + 0x10], 0x5a46a8
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 1
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x4012e9
Capabilities:
Connect socket

Disassembly:
jmp 0x419b30
sub esp, 0x30
push ebx
push ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [esp + 8], eax
jne 0x419b63
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401e1f
add esp, 4
or eax, 0xffffffff
pop ebp
pop ebx
add esp, 0x30
ret
mov ebx, dword [esp + 0x3c]
mov ebp, dword [sym.imp.WS2_32.dll_WSAEventSelect]
push 0x10
push eax
push ebx
call ebp
cmp eax, 0xffffffff
jne 0x419b9b
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.00401e1f
add esp, 4
or eax, 0xffffffff
pop ebp
pop ebx
add esp, 0x30
ret
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
push esi
push edi
push 0
push 0
push 0
push 0
push ecx
push edx
push ebx
call dword [sym.imp.WS2_32.dll_WSAConnect]
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call edi
cmp esi, 0xffffffff
jne 0x419c33
cmp eax, 0x2733
jne 0x419c33
mov eax, dword [esp + 0x50]
push 1
push eax
lea ecx, [esp + 0x18]
push 1
push ecx
push 1
call dword [sym.imp.WS2_32.dll_WSAWaitForMultipleEvents]
test eax, eax
je 0x419bf5
call edi
push eax
call fcn.00401e1f
add esp, 4
or esi, esi
jmp 0x419c33
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push eax
push ebx
call dword [sym.imp.WS2_32.dll_WSAEnumNetworkEvents]
cmp eax, 0xffffffff
jne 0x419c1b
call edi
push eax
call fcn.00401e1f
add esp, 4
or esi, 0xffffffff
jmp 0x419c33
mov eax, dword [esp + 0x28]
test eax, eax
je 0x419c31
push eax
call fcn.00401e1f
add esp, 4
or esi, 0xffffffff
jmp 0x419c33
xor esi, esi
mov ecx, dword [esp + 0x10]
push 0
push ecx
push ebx
call ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret

Function at 0x4013d9
Capabilities:
Get common file path

Disassembly:
jmp 0x4280c0
mov eax, 0x1004
call fcn.00454250
mov al, byte [0x63b248]
push ebx
mov ebx, 1
push esi
test bl, al
mov dword [esp + 8], 0
jne 0x428103
mov dl, al
mov ecx, 0x63b244
or dl, bl
mov byte [0x63b248], dl
call sub.MFC42.DLL_CString::CString_3
push 0x4281d0
call fcn.0045423e
add esp, 4
mov eax, dword [0x63b244]
push 0x639dc4
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
jne 0x428169
push edi
push ebx
lea ecx, [esp + 0x14]
push 0x1a
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov edi, 0x627838
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x63b244
call sub.MFC42.DLL_CString::operator
pop edi
mov esi, dword [esp + 0x1010]
push 0x63b244
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov eax, esi
pop esi
pop ebx
add esp, 0x1004
ret
Function at 0x4013ed
Capabilities:
Read file on windows

Disassembly:
jmp 0x406bd0
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x58dc58
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push 0x65
call sub.MFC42.DLL_CWnd::GetDlgItem
mov ebp, eax
test ebp, ebp
je 0x406d0b
mov eax, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x10]
push eax
push ecx
lea ecx, [esi + 0x60]
call sub.MFC42.DLL_CListCtrl::GetItemText
add esi, 0x1a4
push eax
lea edx, [esp + 0x24]
push esi
push edx
mov dword [esp + 0x24], 0
call sub.MFC42.DLL_operator_3
push str..txt
push eax
lea eax, [esp + 0x10]
mov byte [esp + 0x20], 1
push eax
call sub.MFC42.DLL_operator_4
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], 3
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 8]
push 0x6279b4
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x406ca5
push 0x639dc4
mov ecx, ebp
call sub.MFC42.DLL_CWnd::SetWindowTextA
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop esi
pop ebp
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 4
push ebx
push edi
push 2
push 0
push esi
call dword [sym.imp.MSVCRT.dll_fseek]
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
push esi
mov ebx, eax
call dword [sym.imp.MSVCRT.dll_rewind]
lea edx, [ebx + 1]
push edx
call sub.MFC42.DLL_operatornew
push esi
mov edi, eax
push ebx
push 1
push edi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x28
mov ecx, ebp
mov byte [edi + ebx], 0
push edi
call sub.MFC42.DLL_CWnd::SetWindowTextA
push edi
call dword [sym.imp.MSVCRT.dll_free]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 8
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop ebx
mov ecx, dword [esp + 0x10]
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x401415
Capabilities:
Read .ini file

Disassembly:
jmp 0x4201e0
push 0xffffffffffffffff
push 0x58f738
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x198
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x14], esi
push eax
push edi
push str.ShowFirstMacro
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov eax, dword [esi + 0xc]
xor ebp, ebp
cmp eax, edi
jle 0x42047a
mov ebx, 1
jmp 0x420236
mov esi, dword [esp + 0x14]
xor edi, edi
lea ecx, [esp + 0x18]
call fcn.00468ae0
lea ecx, [esp + 0xdc]
mov dword [esp + 0x1b0], edi
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0xe0]
mov byte [esp + 0x1b0], bl
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0xe4]
mov byte [esp + 0x1b0], 2
call fcn.00401181
mov dword [esp + 0xe4], 0x5a5050
mov dword [esp + 0xf8], edi
lea ecx, [esp + 0xfc]
mov byte [esp + 0x1b0], 3
call sub.MFC42.DLL_CStringArray::CStringArray
lea ecx, [esp + 0x110]
mov byte [esp + 0x1b0], 4
call fcn.00401bf9
mov dword [esp + 0x110], 0x5a5038
lea ecx, [esp + 0x164]
mov byte [esp + 0x1b0], 5
call sub.MFC42.DLL_CStringArray::CStringArray
lea ecx, [esp + 0x178]
mov byte [esp + 0x1b0], 6
call sub.MFC42.DLL_CStringArray::CStringArray
push 0xa
lea ecx, [esp + 0x190]
mov byte [esp + 0x1b4], 7
call fcn.00401a28
mov dword [esp + 0xd8], edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x124]
mov dword [esp + 0x18c], 0x5a5020
mov dword [esp + 0x18], 0x5a4fdc
mov dword [esp + 0x2c], ebx
rep stosd dword es:[edi], eax
push ecx
lea ecx, [esi + 4]
mov eax, esp
mov dword [esp + 0x14], esp
push ebp
push eax
mov dword [esp + 0x1bc], 8
call fcn.0040114f
lea ecx, [esp + 0x1c]
call fcn.0046cbf0
push ecx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x14], esp
mov edi, esp
push 0x10
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
test esi, esi
je 0x42039d
mov dword [esi + 4], 0
mov dword [esi + 8], ebx
mov dword [esi], 0x5a4f50
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1b4], 0xa
call dword [edx + 0x1c]
mov dword [esi + 0xc], eax
mov dword [esi + 4], 2
jmp 0x42039f
xor esi, esi
mov ecx, dword [esp + 0x1bc]
mov byte [esp + 0x1b4], 8
mov dword [edi], esi
call fcn.00460340
lea ecx, [esp + 0x18c]
mov dword [esp + 0x1b0], 0x12
call fcn.0040113b
lea ecx, [esp + 0x178]
mov byte [esp + 0x1b0], 0x11
call fcn.00453e6a
lea ecx, [esp + 0x164]
mov byte [esp + 0x1b0], 0x10
call fcn.00453e6a
lea ecx, [esp + 0x110]
mov byte [esp + 0x1b0], 0xf
call fcn.00401cad
lea ecx, [esp + 0xfc]
mov byte [esp + 0x1b0], 0xe
call fcn.00453e6a
lea ecx, [esp + 0xe4]
mov byte [esp + 0x1b0], 0xd
call fcn.00402225
lea ecx, [esp + 0xe0]
mov byte [esp + 0x1b0], 0xc
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xdc]
mov byte [esp + 0x1b0], 0xb
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 0x1b0], 0xffffffff
call fcn.004021a8
mov eax, dword [esp + 0x14]
inc ebp
cmp ebp, dword [eax + 0xc]
jl 0x420230
mov ecx, dword [esp + 0x1a8]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x1a4
ret 4
Function at 0x401451
Capabilities:
Delete file

Disassembly:
jmp 0x420de0
push 0xffffffffffffffff
push 0x58f810
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x28]
push ebp
push esi
push edi
lea eax, [esp + 0x34]
push ebx
mov esi, ecx
push eax
call fcn.00402112
mov ecx, esp
mov dword [esp + 0x18], esp
push str.plugin.zip
push eax
push ecx
mov dword [esp + 0x40], 0
call sub.MFC42.DLL_operator_4
mov ecx, esi
call fcn.004020c2
or edi, 0xffffffff
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], edi
call sub.MFC42.DLL_CString::CString
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x639dc4
call sub.MFC42.DLL_CString::CString_1
push ecx
mov dword [esp + 0x38], 1
mov edx, esp
mov dword [esp + 0x28], esp
push str.plugin
push 0x63aea8
push edx
call sub.MFC42.DLL_operator_4
lea eax, [esp + 0x40]
mov byte [esp + 0x38], 2
push eax
call fcn.00402112
mov ecx, esp
mov dword [esp + 0x30], esp
push str.plugin.zip
push eax
push ecx
mov byte [esp + 0x48], 3
call sub.MFC42.DLL_operator_4
mov byte [esp + 0x3c], 4
call fcn.00472090
add esp, 0x10
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], edi
call sub.MFC42.DLL_CString::CString
lea edx, [esp + 0x10]
push edx
call fcn.00402112
add esp, 4
push str.plugin.zip
push eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x34], 5
push eax
call sub.MFC42.DLL_operator_4
mov eax, dword [eax]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
call ebp
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], edi
call sub.MFC42.DLL_CString::CString
push ebx
lea ecx, [esp + 0x38]
push ecx
call fcn.00402112
mov edx, esp
mov dword [esp + 0x28], esp
push str.mymacro.zip
push eax
push edx
mov dword [esp + 0x40], 6
call sub.MFC42.DLL_operator_4
mov ecx, esi
call fcn.004020c2
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], edi
call sub.MFC42.DLL_CString::CString
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x639dc4
call sub.MFC42.DLL_CString::CString_1
push ecx
mov dword [esp + 0x38], 7
mov eax, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00402112
lea ecx, [esp + 0x44]
mov byte [esp + 0x3c], 8
push ecx
call fcn.00402112
add esp, 4
mov byte [esp + 0x3c], 9
mov edx, esp
mov dword [esp + 0x20], esp
push str.mymacro.zip
push eax
push edx
call sub.MFC42.DLL_operator_4
mov byte [esp + 0x3c], 0xa
call fcn.00472090
add esp, 0x10
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], edi
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x18]
push eax
call fcn.00402112
add esp, 4
push str.mymacro.zip
lea ecx, [esp + 0x18]
push eax
push ecx
mov dword [esp + 0x38], 0xb
call sub.MFC42.DLL_operator_4
mov eax, dword [eax]
push eax
call ebp
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], edi
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 4
Function at 0x40146a
Capabilities:
Read file via mapping

Disassembly:
jmp 0x42a7d0
mov eax, dword [ecx + 0xcc]
push 4
push 0
push 0
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x42a7f9
mov ecx, dword [esp + 4]
push eax
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
ret 4

Function at 0x4014d8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x410f60
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
and esi, 0xffff
push 2
push esi
call sub.MFC42.DLL_AfxFindResourceHandle
mov ebp, dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
push 2
push esi
push ebx
call ebp
mov edi, eax
test edi, edi
jne 0x410f9d
xor ebx, ebx
push 2
push esi
push ebx
call ebp
mov edi, eax
test edi, edi
jne 0x410f9d
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x410fae
pop edi
pop esi
pop ebp
pop ebx
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x410fbe
pop edi
pop esi
pop ebp
pop ebx
ret
push eax
call fcn.004010dc
add esp, 4
cmp ax, 0x10
je 0x410fd4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0
push edi
push ebx
call sub.MFC42.DLL_AfxLoadSysColorBitmap
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x401672
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x414420
push 0xffffffffffffffff
push 0x58e90b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x5a4734
mov eax, dword [esi + 0x30]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x1c], 1
je 0x4144b0
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 0x20]
mov ecx, edx
push ebx
sub eax, ecx
mov ecx, dword [esi + 0x28]
mov ebx, edi
sub ecx, ebx
mov ebx, dword [esi + 0x1c]
cmp esi, ebp
je 0x414477
mov ebp, dword [esi + 4]
push 0xcc0020
push edx
push edi
push ebp
push eax
mov eax, dword [ebx + 4]
push ecx
push edx
push edi
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 0x18]
pop ebx
test eax, eax
jne 0x4144a1
mov ecx, dword [esi + 4]
push eax
push ecx
call sub.MFC42.DLL_CDC::SelectGdiObject
jmp 0x4144b6
mov eax, dword [eax + 4]
mov ecx, dword [esi + 4]
push eax
push ecx
call sub.MFC42.DLL_CDC::SelectGdiObject
jmp 0x4144b6
mov dword [esi + 8], ebp
mov dword [esi + 4], ebp
lea edi, [esi + 0x10]
mov dword [esp + 0x10], edi
mov dword [edi], 0x5a46a8
mov ecx, edi
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, esi
mov dword [edi], 0x5a42c0
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CDC::CDC
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x401677
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
jmp 0x4039f0
push 0xffffffffffffffff
push 0x58d73f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0045387c
xor ebx, ebx
lea ecx, [esi + 0x40]
mov dword [esp + 0x30], ebx
call sub.MFC42.DLL_CString::CString_3
lea edi, [esi + 0x44]
mov byte [esp + 0x30], 1
mov ecx, edi
mov dword [esp + 0x14], edi
call sub.MFC42.DLL_CString::CString_3
lea ecx, [edi + 4]
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_CString::CString_3
mov al, byte [esp + 0xf]
mov cl, byte [esp + 0xf]
mov byte [edi + 0xc], al
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov byte [edi + 0x1c], cl
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x34], ebx
mov ecx, 0x11
mov eax, 0xa
mov dword [esi + 0x7c], 0x5a42a8
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ecx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], 0x5a4290
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ecx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb0], eax
mov byte [esp + 0x30], 5
mov dword [esi], 0x5a41a8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call sub.MFC42.DLL_CWnd::FromHandle
push ebx
push ebx
lea edx, [esp + 0x20]
push eax
push edx
push ebx
push 0x639dc4
push ebx
mov ecx, esi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
call sub.MFC42.DLL_CWnd::Create
push ebx
call dword [sym.imp.MSVCRT.dll_time]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 8
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x20]
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x4017c1
Capabilities:
Access peb ldr_data
Delete registry key

Disassembly:
jmp 0x41e220
push 0xffffffffffffffff
push 0x58f268
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
call sub.MFC42.DLL_COleObjectFactory::UnregisterAll
call sub.MFC42.DLL_COleObjectFactory::RevokeAll
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esp + 0x4b]
mov ecx, dword [esp + 0x4a]
mov edx, dword [esp + 0x49]
and eax, 0xff
push eax
mov eax, dword [esp + 0x4c]
and ecx, 0xff
and edx, 0xff
push ecx
mov ecx, dword [esp + 0x4f]
and eax, 0xff
push edx
mov edx, dword [esp + 0x52]
push eax
mov eax, dword [esp + 0x55]
and ecx, 0xff
and edx, 0xff
push ecx
mov ecx, dword [esp + 0x58]
and eax, 0xff
push edx
mov edx, dword [esp + 0x5a]
push eax
mov eax, dword [esp + 0x5c]
and ecx, 0xff
and edx, 0xffff
push ecx
mov ecx, dword [esp + 0x5c]
and eax, 0xffff
push edx
push eax
push ecx
lea edx, [esp + 0x30]
push str._08X__04X__04x__02X_02X__02X_02X_02X_02X_02X_02X
push edx
mov dword [esp + 0x68], 0
call sub.MFC42.DLL_CString::Format
add esp, 0x34
lea ecx, [esp]
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esp + 4]
lea ecx, [esp]
push eax
push str.CLSID_s_
push ecx
mov byte [esp + 0x40], 1
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push closesocket
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x48], esp
push 0x639dc4
call sub.MFC42.DLL_CString::CString_1
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
mov byte [esp + 0x48], 2
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x1c]
mov byte [esp + 0x44], 1
call fcn.004bb3e0
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push 0x20006
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0xc]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
lea ecx, [esp + 0xc]
call fcn.004bb560
lea ecx, [esp]
mov byte [esp + 0x34], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov dword [esp + 0x34], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret