joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409bcb
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41f8d0
push 0x41c160
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x20]
push eax
push 0x20006
push ebx
push dword [ebp + 0xc]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x409c24
or dword [ebp - 4], 0xffffffff
push 0xfffffffffffffffe
pop eax
jmp 0x409d3e
mov dword [ebp - 4], 1
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x409c69
push esi
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
call edi
pop ecx
test eax, eax
je 0x409c6f
push esi
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push ebx
push 0x425980
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x409c6f
push 0xfffffffffffffffd
jmp 0x409cfb
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
cmp esi, ebx
je 0x409caa
push esi
call edi
pop ecx
test eax, eax
je 0x409caa
lea ebx, [esi + 0x208]
push ebx
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push 0
push 0x425970
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x409ca8
push 0xfffffffffffffffc
jmp 0x409cfb
xor ebx, ebx
mov eax, dword [esi + 0x71c]
cmp eax, ebx
je 0x409cd8
push eax
lea eax, [esi + 0x618]
push eax
push 3
push ebx
push 0x425950
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x409cd8
push 0xfffffffffffffffb
jmp 0x409cfb
push 4
add esi, 0x720
push esi
push 4
push ebx
push 0x42592c
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x409d0d
push 0xfffffffffffffffa
pop esi
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
call sub.MSVCRT.dll__local_unwind2
pop ecx
pop ecx
mov eax, esi
jmp 0x409d3e
mov dword [ebp - 4], ebx
call fcn.00409d1f
or dword [ebp - 4], 0xffffffff
xor eax, eax
jmp 0x409d3e
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40b019
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
push esi
push edi
push 0x7f
xor esi, esi
pop ecx
xor eax, eax
lea edi, [ebp - 0x23e]
mov word [ebp - 0x240], si
rep stosd dword es:[edi], eax
or dword [ebp - 4], 0xffffffff
push 0x425790
stosw word es:[edi], ax
lea eax, [ebp - 0x240]
push 0x425c5c
push eax
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], 0x425c54
call dword [sym.imp.MSVCRT.dll_swprintf]
lea eax, [ebp - 0x240]
add esp, 0xc
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], esi
call fcn.00403112
test eax, eax
je 0x40b093
mov dword [ebp - 0x34], 0x425c48
mov dword [ebp - 0x24], 1
jmp 0x40b09d
mov dword [ebp - 0x34], 0x4256fc
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x40]
mov dword [ebp - 0x20], esi
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop edi
pop esi
test eax, eax
je 0x40b0c8
push 0xffffffffffffffff
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 4]
leave
ret

Function at 0x40b0cd
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
push esi
push edi
push 0x7f
xor esi, esi
pop ecx
xor eax, eax
lea edi, [ebp - 0x23e]
mov word [ebp - 0x240], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x3c
lea eax, [ebp - 0x40]
pop edi
mov dword [ebp - 4], esi
push edi
push esi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x240]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], esi
push 0x425790
push 0x425c6c
push eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], 0x425c54
call dword [sym.imp.MSVCRT.dll_swprintf]
lea eax, [ebp - 0x240]
add esp, 0xc
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], esi
call fcn.00403112
test eax, eax
je 0x40b153
mov dword [ebp - 0x34], 0x425c48
mov dword [ebp - 0x24], 1
jmp 0x40b15d
mov dword [ebp - 0x34], 0x4256fc
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x40]
mov dword [ebp - 0x20], esi
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop edi
pop esi
test eax, eax
je 0x40b188
push 0xffffffffffffffff
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 4]
leave
ret
Function at 0x40b18d
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x65c
or dword [ebp - 4], 0xffffffff
push esi
push edi
mov esi, 0x208
xor edi, edi
push esi
lea eax, [ebp - 0x65c]
push edi
push eax
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x454]
push edi
push eax
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x24c]
push edi
push eax
call sub.MSVCRT.dll_memset
add esp, 0x24
lea eax, [ebp - 0x454]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 0x24c]
push eax
push 0x425c94
call fcn.00412d66
lea eax, [ebp - 0x24c]
push 0x428044
push eax
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 0x14
test eax, eax
jne 0x40b229
push 0x425c80
lea eax, [ebp - 0x24c]
push esi
push eax
call fcn.004129a4
add esp, 0xc
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x454]
push eax
push 0x424450
lea eax, [ebp - 0x65c]
push esi
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
call fcn.00403112
test eax, eax
mov dword [ebp - 0x38], 0x425c48
jne 0x40b271
mov dword [ebp - 0x38], 0x4256fc
lea eax, [ebp - 0x65c]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop edi
pop esi
test eax, eax
je 0x40b2b2
push 0xffffffffffffffff
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 4]
leave
ret
Function at 0x40b2ba
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x66c
push esi
push edi
push 0x44
xor edi, edi
pop esi
lea eax, [ebp - 0x5c]
push esi
push edi
push eax
mov dword [ebp - 4], 4
call sub.MSVCRT.dll_memset
push 0x10
lea eax, [ebp - 0x18]
push edi
push eax
mov dword [ebp - 0x5c], esi
call sub.MSVCRT.dll_memset
mov esi, 0x208
lea eax, [ebp - 0x66c]
push esi
push edi
push eax
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x464]
push edi
push eax
call sub.MSVCRT.dll_memset
add esp, 0x30
lea eax, [ebp - 0x464]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [0x428794]
cmp eax, 2
jne 0x40b335
mov dword [ebp - 8], 0x425d6c
jmp 0x40b341
cmp eax, 1
jne 0x40b341
mov dword [ebp - 8], 0x425d58
push dword [ebp - 8]
lea eax, [ebp - 0x66c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x425d38
push 0x425d0c
push esi
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
push eax
call esi
add esp, 0x20
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x464]
push eax
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x66c]
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40b3d2
push 0x7f
mov word [ebp - 0x25c], di
pop ecx
lea edi, [ebp - 0x25a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x425cbc
lea eax, [ebp - 0x25c]
push 0x100
push eax
call esi
lea eax, [ebp - 0x25c]
push eax
call fcn.0040dc3e
add esp, 0x14
push 4
pop eax
jmp 0x40b3fd
push 0xffffffffffffffff
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x14]
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 0xc
Function at 0x40b403
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
lea eax, [ebp - 4]
push edi
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x40b45e
lea eax, [esi + esi]
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x40b45e
push edi
push esi
push dword [ebp - 4]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40b456
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x4240b8
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x40b466
push edi
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40b4b4
push 0x34
lea eax, [ebp - 0x40]
push 0
push eax
call sub.MSVCRT.dll_memset
push 0x34
lea eax, [ebp - 0x40]
push dword [ebp - 8]
push eax
call sub.MSVCRT.dll_memcpy
push edi
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [ebp - 0x34]
add esp, 0x1c
movzx ecx, ax
shr eax, 0x10
push ecx
push eax
mov eax, dword [ebp - 0x38]
movzx ecx, ax
shr eax, 0x10
push ecx
push eax
push 0x425d7c
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.dll_swprintf]
add esp, 0x18
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x40b55a
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x864
push ebx
push esi
push edi
push 4
pop esi
xor ebx, ebx
push 0x44
lea eax, [ebp - 0x5c]
pop edi
mov dword [ebp - 8], esi
push edi
push ebx
push eax
mov dword [ebp - 4], ebx
call sub.MSVCRT.dll_memset
push 0x10
lea eax, [ebp - 0x18]
push ebx
push eax
mov dword [ebp - 0x5c], edi
call sub.MSVCRT.dll_memset
add esp, 0x18
lea eax, [ebp - 0x464]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp byte [0x429dc8], bl
je 0x40b5b4
mov dword [ebp - 4], 0x425d6c
jmp 0x40b5ca
mov eax, dword [0x428794]
cmp eax, 2
je 0x40b5ab
cmp eax, 1
jne 0x40b5cf
mov dword [ebp - 4], 0x425d58
cmp dword [ebp - 4], ebx
jne 0x40b60e
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0x25a]
mov word [ebp - 0x25c], bx
push 0x425e38
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x25c]
push 0x100
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea eax, [ebp - 0x25c]
push eax
call fcn.0040dc3e
add esp, 0x10
mov dword [ebp - 8], esi
push dword [ebp - 4]
lea eax, [ebp - 0x864]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x425d38
push 0x425e0c
push eax
call dword [sym.imp.MSVCRT.dll_swprintf]
add esp, 0x1c
lea eax, [ebp - 0x864]
push eax
push 0x425dcc
push 7
call fcn.0040148c
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x464]
push eax
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x864]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40b6b5
push 0x7f
lea edi, [ebp - 0x25a]
pop ecx
mov word [ebp - 0x25c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x425d94
lea eax, [ebp - 0x25c]
push 0x100
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea eax, [ebp - 0x25c]
push eax
call fcn.0040dc3e
add esp, 0x14
mov eax, esi
jmp 0x40b6e0
push 0xffffffffffffffff
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x14]
call esi
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40bd9c
Capabilities:
Accept command line arguments
Check mutex on windows

Disassembly:
mov eax, 0x41d044
call fcn.0041c284
sub esp, 0x224
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push edi
push 0x428990
call esi
push 0x429218
call esi
push 0x429250
call esi
lea ecx, [ebp - 0x30]
call fcn.0040997a
xor ebx, ebx
push 0x724
mov esi, 0x429270
push ebx
push esi
mov dword [ebp - 4], ebx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x30]
push 0x4252f4
push esi
call fcn.00409a0e
push 0x7f
mov esi, dword [ebp + 8]
pop ecx
xor eax, eax
lea edi, [ebp - 0x22e]
mov word [ebp - 0x230], bx
rep stosd dword es:[edi], eax
mov dword [0x4289a8], esi
stosw word es:[edi], ax
call section..text
push ebx
call fcn.00401123
mov dword [esp], 0x4260b8
push 7
call fcn.0040148c
pop ecx
pop ecx
call fcn.00402ee1
cmp ax, 0x409
mov word [0x428fe0], ax
je 0x40be62
push eax
call fcn.00402ff5
cmp eax, ebx
pop ecx
mov dword [0x428fe4], eax
jne 0x40be68
push 0x42608c
push 4
call fcn.0040148c
pop ecx
pop ecx
mov dword [0x428fe4], esi
call fcn.0041004a
mov dword [0x428fdc], eax
call fcn.0040e0e4
push 0x426050
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
je 0x40bed2
cmp eax, 5
je 0x40beb1
cmp eax, 0xb7
je 0x40beb1
push eax
push 0x426020
push 3
call fcn.0040148c
add esp, 0xc
jmp 0x40bf39
lea eax, [ebp - 0x230]
push 0x100
push eax
push 0x5d
push dword [0x428fe4]
call dword [sym.imp.USER32.dll_LoadStringW]
call fcn.0040c8dc
jmp 0x40bf39
cmp esi, ebx
je 0x40bee9
call fcn.00403112
test eax, eax
je 0x40bee9
push 6
push esi
call fcn.00415d3b
pop ecx
pop ecx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
cmp edi, ebx
jne 0x40bf0d
push 0x425fec
call fcn.0040dc3e
pop ecx
jmp 0x40bf39
cmp dword [ebp - 0x10], 1
jle 0x40bf20
push edi
push dword [ebp - 0x10]
call fcn.004049c1
pop ecx
pop ecx
jmp 0x40bf32
push ebx
push 0x428044
push ebx
push dword [0x4289a8]
call fcn.0040c21f
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
je 0x40bf4d
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call edi
push 0x429230
call fcn.00402302
call fcn.0040115d
call fcn.00410094
mov esi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [0x428fdc], ebx
mov dword [esp], 0x428990
call esi
push 0x429218
call esi
push 0x429250
call esi
mov eax, dword [0x428970]
cmp eax, ebx
je 0x40bfa4
push eax
call edi
push 0xffffffffffffffff
push dword [0x428970]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [0x428970], ebx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x30], 0x41f864
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 1
call fcn.0040a156
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00409919
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x40c173
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov edi, 0x428988
mov esi, 0x428690
xor ebx, ebx
push edi
push esi
mov byte [0x429238], bl
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x40c20a
mov eax, dword [0x428790]
cmp eax, ebx
jbe 0x40c20a
cmp eax, 0x10000
jae 0x40c20a
push edi
call fcn.0040477f
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x40c20a
push edi
push 0x4287dc
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x40c20a
push ebx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x40ae56
push ebx
push ebx
call esi
test eax, eax
jne 0x40c1ec
push 0x426140
push 3
call fcn.0040148c
jmp 0x40c216
push ebx
push ebx
push 0x429268
push 0x40b6e5
push ebx
push ebx
mov dword [0x429268], 2
call esi
xor eax, eax
jmp 0x40c21b
push 0x10
push 0x426118
call fcn.0040f17a
pop ecx
or eax, 0xffffffff
pop ecx
pop edi
pop esi
pop ebx
ret
Function at 0x40c941
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
or dword [ebp - 4], 0xffffffff
push ebx
push esi
push edi
xor edi, edi
mov esi, 0x4263c8
push edi
push 0x40000000
push 3
push edi
push edi
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40c992
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40c9c8
cmp eax, 0xe7
jne 0x40c9c8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x40c9c8
jmp 0x40c955
push edi
lea eax, [ebp - 8]
push edi
push eax
push ebx
mov dword [ebp - 8], 2
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x40c9c8
lea eax, [ebp - 0xc]
push edi
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40c9c8
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], edi
mov dword [eax], edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40e0e4
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
mov edx, 0x81
push edi
xor esi, esi
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x206]
mov word [ebp - 0x208], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x40e]
mov word [ebp - 0x410], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
lea eax, [ebp - 0x410]
push 0x1a
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x40e13e
or eax, 0xffffffff
jmp 0x40e1ca
push 0x4240e4
lea eax, [ebp - 0x410]
push 0x4240d0
push eax
lea eax, [ebp - 0x208]
push 0x4240bc
push eax
call dword [sym.imp.MSVCRT.dll_swprintf]
add esp, 0x14
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40e186
lea eax, [ebp - 0x208]
push eax
call fcn.004031c5
test eax, eax
pop ecx
je 0x40e136
mov esi, 0x104
push 0x4240b8
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.00412a5e
push 0x426950
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.00412a5e
add esp, 0x18
lea eax, [ebp - 0x208]
mov ecx, 0x429000
push eax
call fcn.00416323
neg al
sbb eax, eax
neg eax
dec eax
pop edi
pop esi
leave
ret
Function at 0x40ed43
Capabilities:
Initialize winsock library
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a0
and byte [ebp - 0x110], 0
push esi
push edi
push 0x3f
pop ecx
xor eax, eax
lea edi, [ebp - 0x10f]
mov esi, 0x428690
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x110]
push esi
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
lea eax, [ebp - 0x2a0]
pop ecx
push eax
push 0x202
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x40ed96
xor al, al
jmp 0x40ee26
push esi
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov edi, eax
cmp edi, 0xffffffff
je 0x40edb4
push 0x426bd4
push 7
call fcn.0040148c
pop ecx
pop ecx
jmp 0x40edf5
push esi
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x40eddf
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 0xc]
push eax
call sub.MSVCRT.dll_memcpy
mov edi, dword [ebp - 0xc]
add esp, 0xc
push 0x426b98
jmp 0x40eda9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x426b14
push 3
call fcn.0040148c
add esp, 0xc
call dword [sym.imp.WSOCK32.dll_WSACleanup]
push 0x4252bc
mov ecx, 0x429000
call fcn.004194a0
add eax, 0x8fc
push eax
call dword [sym.imp.MSVCRT.dll_wcscmp]
pop ecx
test eax, eax
pop ecx
je 0x40ee20
mov al, 1
jmp 0x40ee26
cmp dword [ebp + 8], edi
sete al
pop edi
pop esi
leave
ret

Function at 0x40f352
Capabilities:
Create process on windows

Disassembly:
push esi
push 0x429998
call fcn.0040108a
mov esi, eax
pop ecx
test esi, esi
je 0x40f383
push 5
push 0
push esi
push 0x426d84
push 0x4256fc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push esi
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
pop esi
ret

Function at 0x410211
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x2c]
test eax, eax
je 0x41028d
push 0x429
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x41028d
push esi
lea ecx, [ebp - 0x18]
push edi
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub esi, eax
add eax, 2
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
sub edi, ecx
push dword [ebx + 0x2c]
add ecx, 2
sub esi, 6
sub edi, 0xa
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
push 0
push edi
push esi
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MoveWindow]
push 5
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x410357
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
mov dword [ebp - 4], ecx
je 0x4104aa
and word [ebp - 0x254], 0
push 0xa
lea esi, [ebx + 0x38]
pop ecx
lea edi, [ebp - 0x2c]
push 0x7f
rep movsd dword es:[edi], dword [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0x252]
mov dword [ebp - 0x18], 0x200
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x254]
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x113e
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
and word [ebp - 0x454], 0
push 0xa
lea esi, [ebx + 0x10]
pop ecx
lea edi, [ebp - 0x54]
push 0x7f
rep movsd dword es:[edi], dword [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0x452]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x454]
mov dword [ebp - 0x40], 0x200
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0x113e
mov dword [ebp - 0x54], 7
push dword [ebx]
call esi
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x4104aa
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x4104aa
lea ebx, [ecx + 2]
lea edi, [eax + 2]
mov ax, word [ebx]
cmp word [edi], ax
je 0x410461
mov ecx, dword [ebp - 4]
movsx eax, ax
push eax
call fcn.00410320
test eax, eax
je 0x410448
mov ecx, dword [ebp - 4]
push eax
call fcn.00410211
movsx eax, word [edi]
mov ecx, dword [ebp - 4]
push eax
call fcn.00410320
test eax, eax
je 0x410461
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov bx, word [ebx]
mov eax, 0xa0
cmp bx, ax
jne 0x41048a
mov ecx, dword [ebp - 4]
push eax
call fcn.00410320
test eax, eax
je 0x4104aa
push dword [ebp - 0x1c]
push 0
push 0x4c8
push eax
call esi
jmp 0x4104aa
mov eax, 0x9f
cmp bx, ax
jne 0x4104aa
mov ecx, dword [ebp - 4]
push eax
call fcn.00410320
test eax, eax
je 0x4104aa
mov ecx, dword [ebp - 4]
push eax
call fcn.004122df
pop edi
pop esi
pop ebx
leave
ret 4