joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4086d0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x830
push ebx
push esi
push edi
xor bl, bl
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x3d]
mov byte [esp + 0x3c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x3c]
push 0x400
push eax
call fcn.00408390
xor ecx, ecx
mov eax, dword [0x40dae0]
mov dword [esp + 0x35], ecx
xor edx, edx
mov dword [esp + 0x39], ecx
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
mov dword [esp + 0x3d], ecx
mov dword [esp + 0x25], edx
add esp, 8
mov word [esp + 0x39], cx
mov dword [esp + 0x21], edx
mov byte [esp + 0x3b], cl
mov dword [esp + 0x25], edx
push eax
lea ecx, [esp + 0x20]
mov word [esp + 0x2d], dx
push 0x40d3a0
push ecx
mov byte [esp + 0x38], bl
mov byte [esp + 0x28], bl
mov byte [esp + 0x37], dl
call esi
lea edx, [esp + 0x38]
push 0x10
lea eax, [esp + 0x2c]
push edx
push eax
push 0x40d3b0
call fcn.004083e0
xor ecx, ecx
lea edx, [esp + 0x28]
mov dword [esp + 0x29], ecx
push 0x10
mov dword [esp + 0x31], ecx
push edx
mov dword [esp + 0x39], ecx
lea eax, [esp + 0x50]
mov word [esp + 0x3d], cx
push 0x40d998
push eax
mov byte [esp + 0x38], bl
mov byte [esp + 0x47], cl
call fcn.004083e0
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x468]
add esp, 0x2c
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
lea edx, [esp + 0x3c]
push ecx
push edx
lea eax, [esp + 0x444]
push 0x40d98c
push eax
call esi
mov edx, dword [esp + 0x85c]
mov eax, dword [esp + 0x858]
add esp, 0x10
lea ecx, [esp + 0x43c]
push ecx
mov ecx, dword [esp + 0x848]
push edx
push eax
push 0x40da10
push ecx
mov edx, dword [esp + 0x854]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
pop edi
pop esi
pop ebx
add esp, 0x830
ret

Function at 0x408820
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push esi
mov esi, ecx
push 0x40d9e4
mov dword [esi + 0x14], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 0xc], eax
jne 0x40885e
push eax
push 0x40d084
push 0x40d9cc
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, esi
pop esi
add esp, 0x190
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40d9bc
push eax
call edi
mov dword [esi], eax
mov eax, dword [esi + 0xc]
push 0x40d9ac
push eax
call edi
mov ecx, dword [esi + 0xc]
push 0x40d99c
push ecx
mov dword [esi + 4], eax
call edi
mov ecx, dword [esi]
mov dword [esi + 8], eax
test ecx, ecx
pop edi
je 0x4088ff
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4088ff
test eax, eax
je 0x4088ff
lea edx, [esp + 4]
push edx
push 0x101
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x4088cb
call dword [sym.imp.WSOCK32.dll_WSACleanup]
mov eax, dword [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop esi
add esp, 0x190
ret
cmp word [esp + 4], 0x101
je 0x4088ee
call dword [sym.imp.WSOCK32.dll_WSACleanup]
mov ecx, dword [esi + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop esi
add esp, 0x190
ret
mov dword [esi + 0x14], 1
mov eax, esi
pop esi
add esp, 0x190
ret
mov edx, dword [esi + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop esi
add esp, 0x190
ret
Function at 0x408940
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x24
mov eax, dword [esp + 0x28]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [esp + 0x38], eax
call dword [esi]
xor edi, edi
mov dword [esi + 0x10], eax
mov byte [esp + 0x10], 0xff
mov byte [esp + 0x11], 0
mov byte [esp + 0x12], 0
mov byte [esp + 0x13], 0
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], edi
xor ebp, ebp
mov ebx, 4
mov eax, dword [esp + 0x38]
push 0x320
lea ecx, [esp + 0x1c]
push 0x1c
lea edx, [esp + 0x18]
push ecx
mov ecx, dword [esi + 0x10]
push edx
push 0
push 0
push eax
push ecx
call dword [esi + 8]
mov ecx, dword [esp + 0x20]
add ebp, eax
add edi, ecx
dec ebx
jne 0x408982
mov eax, edi
cdq
and edx, 3
add eax, edx
mov edx, dword [esi + 0x10]
mov edi, eax
push edx
sar edi, 2
call dword [esi + 4]
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x4089fb
cmp ebp, 4
jne 0x4089e3
cmp edi, 0x64
jge 0x4089e3
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x24
ret 4
xor eax, eax
cmp edi, 0x12c
pop edi
pop esi
setge al
pop ebp
add eax, 2
pop ebx
add esp, 0x24
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x24
ret 4
Function at 0x403918
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4e1008], 0x8088405
inc edx
mov dword [ebx + 0x4e1008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cad4
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cb05
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41caed
add dl, dl
jne 0x41cb10
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cb61
xor eax, eax
add dl, dl
jne 0x41cb1d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cbfe
add dl, dl
jne 0x41cb2c
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cb37
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cb42
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cb4d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cb57
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cafc
mov eax, 1
add dl, dl
jne 0x41cb6f
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cb7a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cb66
sub eax, ebx
mov ebx, 1
jne 0x41cbad
mov ecx, 1
add dl, dl
jne 0x41cb93
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cb9e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cb8a
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cafc
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cbc4
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cbcf
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cbbb
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cafc
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41cc1f
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cafc
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41e370
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x4d0981
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00405060
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41e3ab
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41e3c4
lea eax, [ebp - 0xc]
mov edx, dword [0x4e2db8]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.004050c0
jmp 0x41e3d7
lea eax, [ebp - 0xc]
mov edx, dword [0x4e2db8]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.004050c0
lea eax, [ebp - 0xc]
mov edx, ebx
sar edx, 1
jns 0x41e3e3
adc edx, 0
mov edx, dword [edx*4 + 0x4e18f8]
call fcn.004052b0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0xc]
call fcn.00405294
push eax
call fcn.00406ecc
mov esi, eax
cmp esi, 0xffffffff
je 0x41e553
mov eax, 0x40
call fcn.004035bc
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.004070cc
test eax, eax
je 0x41e546
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41e546
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00407104
mov eax, edi
call fcn.004035ec
mov eax, 0x18
call fcn.004035bc
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.004070cc
test eax, eax
je 0x41e546
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41e546
add eax, 4
cmp byte [ebp - 1], 0
je 0x41e4ea
cmp word [eax], 0x8664
jne 0x41e4ea
mov eax, edi
call fcn.004035ec
mov eax, 0xf0
call fcn.004035bc
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.004070cc
test eax, eax
je 0x41e546
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x41e546
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.0040509c
jmp 0x41e546
cmp byte [ebp - 1], 0
jne 0x41e546
cmp word [eax], 0x14c
jb 0x41e546
cmp word [eax], 0x150
ja 0x41e546
mov eax, edi
call fcn.004035ec
mov eax, 0xe0
call fcn.004035bc
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.004070cc
test eax, eax
je 0x41e546
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x41e546
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.0040509c
mov eax, edi
call fcn.004035ec
push esi
call fcn.00406e84
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.004053c0
jne 0x41e56b
inc ebx
cmp ebx, 0x19
jne 0x41e39d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d0988
lea eax, [ebp - 0xc]
call fcn.00405060
ret
Function at 0x41e828
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
xor ebx, ebx
push 0
push 0
push 0
push edi
call fcn.00407104
push 0
lea eax, [ebp - 4]
push eax
push 0x40
push esi
push edi
call fcn.004070cc
test eax, eax
je 0x41e8c5
cmp word [esi], 0x5a4d
jne 0x41e8c5
push 0
push 0
mov eax, dword [esi + 0x3c]
push eax
push edi
call fcn.00407104
push 0
lea eax, [ebp - 4]
push eax
push 0x18
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.004070cc
test eax, eax
je 0x41e8c5
cmp dword [ebp - 0x1c], 0x4550
jne 0x41e8c5
lea edx, [ebp - 0x18]
mov ecx, 0x14
mov eax, dword [ebp + 0xc]
call fcn.004071c8
mov ax, word [ebp - 0x18]
cmp ax, 0x14c
jb 0x41e8c5
cmp ax, 0x150
ja 0x41e8c5
push 0
lea eax, [ebp - 4]
push eax
push 0xe0
mov eax, dword [ebp + 8]
push eax
push edi
call fcn.004070cc
test eax, eax
je 0x41e8c5
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42426c
Capabilities:
Parse pe header

Disassembly:
push ebx
xor ecx, ecx
test edx, edx
je 0x424294
mov ebx, edx
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x424294
add ebx, dword [eax + 0x3c]
mov eax, ebx
cmp dword [eax], 0x4550
jne 0x424294
cmp word [eax + 0x18], 0x20b
sete cl
mov eax, ecx
pop ebx
ret

Function at 0x424298
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, edx
xor ebx, ebx
test esi, esi
je 0x4242f4
mov edi, esi
push 0x40
push edi
call fcn.0040708c
test eax, eax
jne 0x4242f4
cmp word [edi], 0x5a4d
jne 0x4242f4
mov eax, dword [edi + 0x3c]
test eax, eax
jle 0x4242f4
cmp eax, 0x10000
jge 0x4242f4
add esi, eax
push 0x120
push esi
call fcn.0040708c
test eax, eax
jne 0x4242f4
cmp dword [esi], 0x4550
jne 0x4242f4
mov ax, word [esi + 0x18]
cmp ax, 0x10b
je 0x4242f2
cmp ax, 0x20b
jne 0x4242f4
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4013b0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], 0
mov byte [ebp - 9], 0
call sub.KERNEL32.dll_GetCurrentProcess
lea edx, [ebp - 0x1c]
mov dword [esp + 8], edx
mov dword [esp + 4], 8
mov dword [esp], eax
call sub.ADVAPI32.DLL_OpenProcessToken
sub esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
setne al
test al, al
je 0x40152a
mov dword [esp], 0x400
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x20]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x400
mov edx, dword [ebp - 0x18]
mov dword [esp + 8], edx
mov dword [esp + 4], 2
mov dword [esp], eax
call sub.ADVAPI32.DLL_GetTokenInformation
sub esp, 0x14
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
cmp dword [ebp - 0x14], 0
je 0x40151f
mov byte [ebp - 0x2a], 0
mov byte [ebp - 0x29], 0
mov byte [ebp - 0x28], 0
mov byte [ebp - 0x27], 0
mov byte [ebp - 0x26], 0
mov byte [ebp - 0x25], 5
lea eax, [ebp - 0x24]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x220
mov dword [esp + 8], 0x20
mov dword [esp + 4], 2
lea eax, [ebp - 0x2a]
mov dword [esp], eax
call sub.ADVAPI32.DLL_AllocateAndInitializeSid
sub esp, 0x2c
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x401511
mov dword [ebp - 0x10], 0
jmp 0x401502
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
mov edx, dword [eax + edx*8 + 4]
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ADVAPI32.DLL_EqualSid
sub esp, 8
test eax, eax
setne al
test al, al
je 0x4014ff
mov byte [ebp - 9], 1
jmp 0x401511
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x10]
seta al
test al, al
jne 0x4014d4
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.ADVAPI32.DLL_FreeSid
sub esp, 4
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call fcn.005a0e48
mov al, byte [ebp - 9]
jmp 0x401539
leave
ret
Function at 0x40163f
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x420
mov word [ebp - 0x414], 0
mov dword [esp + 8], 0x200
lea eax, [ebp - 0x414]
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleFileNameW
sub esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x4016d9
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0xc], eax
jmp 0x4016ba
mov eax, dword [ebp - 0xc]
mov ax, word [ebp + eax*2 - 0x414]
cmp ax, 0x2f
je 0x4016a8
mov eax, dword [ebp - 0xc]
mov ax, word [ebp + eax*2 - 0x414]
cmp ax, 0x5c
jne 0x4016b7
mov eax, dword [ebp - 0xc]
mov word [ebp + eax*2 - 0x414], 0
jmp 0x4016c6
dec dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
not eax
shr eax, 0x1f
test al, al
jne 0x401686
lea eax, [ebp - 0x414]
mov dword [esp], eax
call sub.KERNEL32.dll_SetCurrentDirectoryW
sub esp, 4
test eax, eax
call fcn.004013b0
xor eax, 1
test al, al
je 0x401738
mov dword [esp], 0x5fe064
call fcn.00416e84
mov dword [esp], eax
call fcn.004169d8
mov ebx, eax
mov dword [esp], str.You_must_run_this_app_as_Administrator.
call fcn.00416e84
mov dword [esp], eax
call fcn.004169d8
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.USER32.dll_MessageBoxW
sub esp, 0x10
mov eax, 0xffffffff
jmp 0x4017ce
call fcn.0040153b
test eax, eax
sete al
test al, al
je 0x401796
mov dword [esp], 0x5fe064
call fcn.00416e84
mov dword [esp], eax
call fcn.004169d8
mov ebx, eax
mov dword [esp], str.You_must_install_iTunes_for_this_program_to_work.
call fcn.00416e84
mov dword [esp], eax
call fcn.004169d8
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.USER32.dll_MessageBoxW
sub esp, 0x10
mov eax, 0xffffffff
jmp 0x4017ce
mov dword [esp], 0x18
call fcn.005eddd8
mov ebx, eax
mov dword [esp + 4], 0
lea eax, [ebp + 8]
mov dword [esp], eax
mov ecx, ebx
call fcn.004036a4
sub esp, 8
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x14]
mov ecx, eax
call fcn.004045e6
mov eax, 0
jmp 0x4017e6
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 0x10

Function at 0x402758
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x40273a
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], edx
leave
ret
Function at 0x4027c2
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov dword [ebp - 0x24c], ecx
jmp 0x40292b
mov dword [esp + 8], 0x22c
mov dword [esp + 4], 0
lea eax, [ebp - 0x240]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x240], 0x22c
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x402832
mov dword [esp], 0x7d0
call sub.KERNEL32.dll_Sleep
sub esp, 4
jmp 0x40292b
lea eax, [ebp - 0x240]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_Process32FirstW
sub esp, 8
mov dword [ebp - 0xc], eax
jmp 0x4028ff
mov dword [esp + 4], str.iTunesHelper.exe
lea eax, [ebp - 0x240]
add eax, 0x24
mov dword [esp], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x40288c
mov dword [esp + 4], str.iTunes.exe
lea eax, [ebp - 0x240]
add eax, 0x24
mov dword [esp], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402890
mov al, 1
jmp 0x402892
mov al, 0
test al, al
je 0x4028e4
mov eax, dword [ebp - 0x238]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sub.KERNEL32.dll_OpenProcess
sub esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x4028e4
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_TerminateProcess
sub esp, 8
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
lea eax, [ebp - 0x240]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_Process32NextW
sub esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
setne al
test al, al
jne 0x402852
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [esp], 0x7d0
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov eax, dword [ebp - 0x24c]
mov eax, dword [eax]
mov eax, dword [eax]
test eax, eax
setne al
test al, al
jne 0x4027d6
mov eax, 0
jmp 0x402951
leave
ret 4

Function at 0x402972
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x402955
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], edx
leave
ret

Function at 0x402b90
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004169d8
mov edx, eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.USER32.dll_SetWindowTextW
sub esp, 8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
sub esp, 8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov dword [esp + 4], 5
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
sub esp, 8
leave
ret 4
Function at 0x405660
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], 0x14
call sub.msvcrt.dll_malloc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4056aa
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x11
mov dword [esp + 4], 1
mov dword [esp], str.Allocation_Error_n
call sub.msvcrt.dll_fwrite
mov eax, 0
jmp 0x4056c8
mov dword [esp + 8], 0x14
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x4063e7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov dword [esp + 4], 0x5feed4
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40641a
mov eax, 0xffffffff
jmp 0x4064c8
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_ftell
mov dword [ebp - 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x10]
je 0x4064aa
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.005a0ec8
mov eax, 0xffffffff
jmp 0x4064c8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.005a0ec8
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x14]
mov dword [eax], edx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov eax, dword [ebp - 0x18]
leave
ret

Function at 0x4064ca
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov dword [esp + 4], 0x5fef40
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4064fa
mov eax, 0xffffffff
jmp 0x406546
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0x10]
je 0x406538
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.005a0ec8
mov eax, 0xffffffff
jmp 0x406546
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.005a0ec8
mov eax, dword [ebp - 0x10]
leave
ret
Function at 0x406548
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2028
call fcn.00597828
sub esp, eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [esp + 4], 0x5feed4
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4065aa
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.could_not_open_source_file__s_for_reading_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, 0xffffffff
jmp 0x4066a5
mov dword [esp + 4], 0x5fef40
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x406678
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str.could_not_open_target_file__s_for_writing_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.005a0ec8
mov eax, 0xffffffff
jmp 0x4066a5
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x2000
mov dword [esp + 4], 1
lea eax, [ebp - 0x2018]
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x406679
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
lea eax, [ebp - 0x2018]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x14]
je 0x406679
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.005a0ec8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.005a0ec8
mov eax, 0xffffffff
jmp 0x4066a5
nop
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
and eax, 0x10
test eax, eax
je 0x4065fe
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.005a0ec8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.005a0ec8
mov eax, 0
leave
ret