joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40485c
Capabilities:
Get graphical window text

Disassembly:
push edi
push dword [esp + 8]
push dword [0x40b33c]
call fcn.004068f0
mov edi, eax
test edi, edi
je 0x4048be
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x404885
push dword [esp + 0xc]
push edi
call eax
jmp 0x4048be
push ebx
push esi
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push dword [esp + 0x14]
mov esi, eax
push esi
call fcn.00407960
mov ebx, eax
lea eax, [esi + 1]
push eax
push ebx
mov byte [ebx], 0
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push ebx
call sub.MSVCRT.dll_strlen
pop ecx
sub esi, eax
push esi
call fcn.00407a90
pop esi
pop ebx
pop edi
ret 8
Function at 0x405f9c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 9
call esi
test al, al
jns 0x40600a
push 0x11
call esi
test al, al
js 0x40600a
push 0x10
call esi
test al, al
js 0x40600a
push 0x12
call esi
test al, al
js 0x40600a
mov esi, dword [sym.imp.USER32.dll_GetFocus]
push 5
lea eax, [ebp - 8]
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetClassNameA]
push 4
lea eax, [ebp - 8]
push str.Rich
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x40600a
push eax
push eax
push 0x44e
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
test ax, 0x800
je 0x40602e
push str.PB_WindowID
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetPropA]
test eax, eax
je 0x40602e
dec eax
push eax
push dword [0x40b344]
call fcn.004068f0
mov eax, dword [eax + 8]
jmp 0x406030
xor eax, eax
pop esi
leave
ret 4

Function at 0x4061f3
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [ebp + 8], 0
je 0x406266
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strncpy
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 4], 0
call sub.MSVCRT.dll_strlen
add esp, 0x10
lea eax, [ebp + eax - 0x108]
jmp 0x406248
lea ecx, [eax - 1]
mov dl, byte [ecx]
cmp dl, 0x20
je 0x406246
cmp dl, 0x5c
je 0x406246
cmp dl, 0x2f
jne 0x406252
mov eax, ecx
lea ecx, [ebp - 0x108]
cmp eax, ecx
ja 0x406232
mov byte [eax], 0
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x406268
xor eax, eax
leave
ret 4

Function at 0x406270
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
cmp dword [esi + 0x14], eax
mov dword [esp + 4], eax
jne 0x4062a5
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4

Function at 0x406530
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
test edi, edi
mov dword [esp + 4], eax
je 0x406589
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x406588
mov eax, dword [esp + 0x10]
mov ecx, dword [0x40b354]
push eax
push ecx
call fcn.004068f0
test eax, eax
je 0x406584
cmp dword [eax + 4], 0
je 0x406572
push esi
push edi
push eax
call fcn.00406590
pop esi
pop edi
pop ecx
ret 0xc
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop esi
pop edi
pop ecx
ret 0xc
Function at 0x406590
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x14], 1
push edi
mov dword [esp + 8], 0
jne 0x4065c5
mov eax, dword [esi + 0xc]
mov ecx, dword [esi]
push 1
push 0
neg eax
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], edx
mov ecx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
cmp ecx, edi
jle 0x40663e
mov eax, dword [esi + 8]
add eax, dword [esi + 4]
sub eax, ecx
mov ecx, edi
sub ecx, 1
je 0x40662b
sub ecx, 1
je 0x406616
sub ecx, 2
je 0x406603
mov ecx, dword [esp + 0x14]
push edi
push ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov ecx, dword [edx]
mov dword [eax], ecx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cx, word [edx]
mov word [eax], cx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cl, byte [edx]
mov byte [eax], cl
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
push esi
call fcn.00406270
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x40666b
mov eax, dword [esp + 0x14]
mov ecx, dword [esi]
push 0
lea edx, [esp + 0xc]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x14]
push edi
push edx
add ecx, eax
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
Function at 0x406bc0
Capabilities:
Encode data using xor
Hash data with crc32
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push esi
or esi, 0xffffffff
test eax, eax
je 0x406d75
push ebx
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 8], ebx
je 0x406d74
mov eax, dword [0x40b00c]
push ebp
push 0x1000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x10], ebp
je 0x406d6c
push edi
nop
push 0
lea ecx, [esp + 0x20]
push ecx
push 0x1000
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x1c]
cmp edx, 8
mov eax, ebp
mov edi, edx
jb 0x406d2e
mov ebp, edx
shr ebp, 3
lea ebx, [ebx]
movzx ebx, byte [eax]
xor ebx, esi
and ebx, 0xff
add eax, 1
mov ecx, esi
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f0]
movzx ebx, byte [eax]
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f0]
movzx ebx, byte [eax + 1]
xor ebx, ecx
and ebx, 0xff
add eax, 1
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f0]
movzx ebx, byte [eax + 1]
xor ebx, ecx
add eax, 1
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f0]
movzx ebx, byte [eax + 1]
xor ebx, ecx
add eax, 1
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f0]
movzx ebx, byte [eax + 1]
xor ebx, ecx
add eax, 1
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f0]
movzx ebx, byte [eax + 1]
add eax, 1
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f0]
movzx ebx, byte [eax + 1]
add eax, 1
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x4090f0]
add eax, 1
sub edi, 8
sub ebp, 1
mov esi, ecx
jne 0x406c50
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
test edi, edi
je 0x406d4f
movzx ecx, byte [eax]
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [ecx*4 + 0x4090f0]
add eax, 1
sub edi, 1
jne 0x406d32
cmp edx, 0x1000
je 0x406c20
mov edx, dword [0x40b00c]
push ebp
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop ebx
mov eax, esi
not eax
pop esi
add esp, 8
ret 4

Function at 0x406d80
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x41db75
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x528b46
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5df390]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esi + 0x30]
xor al, al
mov ecx, dword [esi + 0x2c]
mov edi, edx
rep stosb byte es:[edi], al
push edx
call fcn.0050c82a
pop ecx
and dword [ebp - 4], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x41dbbf
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41edd4
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
call fcn.0041f9be
lea edx, [ebx + 0x60]
xor eax, eax
mov byte [edx + 0x49], al
mov dword [edx + 0x50], 0x10
test al, al
jne 0x41ee05
mov eax, edx
mov byte [edx + 0x49], 1
neg eax
and eax, 0xf
add eax, edx
push 8
mov dword [edx + 0x54], eax
mov esi, 0x5b9910
mov edi, dword [ebx + 0xb4]
mov eax, ebx
pop ecx
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword [ebx], vtable.CryptoPP::SHA256.0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4209b6
Capabilities:
Create thread

Disassembly:
push 0x28
mov eax, 0x52a4aa
call fcn.004e49d2
push str.ConnectionManager::Start
push str._s:_enter
push 1
xor esi, esi
push esi
call fcn.0043a0a0
add esp, 0x10
mov edi, 0x5e8330
mov ecx, edi
push 1
call fcn.004208b6
push ecx
push dword [0x5e8340]
lea ecx, [ebp - 0x2c]
call fcn.0045c8f0
xor ecx, ecx
mov dword [ebp - 4], esi
cmp byte [ebp + 8], cl
movzx eax, byte [0x5e8630]
cmove eax, ecx
sub esp, 0x18
mov ecx, esp
mov byte [0x5e8630], al
call fcn.00458691
call fcn.00456a26
add esp, 0x18
mov dword [0x5e8620], eax
call fcn.004585ce
mov byte [0x5e8625], al
call fcn.00450017
push 0xe1
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x5e8344]
test eax, eax
jne 0x420a9e
cmp dword [0x5e8614], eax
jne 0x420a9e
push 1
mov ecx, edi
call fcn.0042077b
push esi
push esi
push edi
push 0x420b02
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [0x5e8614], eax
test eax, eax
jne 0x420a90
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.Start:_CreateThread_failed___d_
push esi
push esi
call fcn.0043a0a0
add esp, 0x10
mov ecx, edi
push esi
call fcn.0042077b
push str.ConnectionManager::Start
push str._s:_exit
push 1
jmp 0x420aa5
push eax
push str.Invalid_connection_manager_state_in_Start___d_
push esi
push esi
call fcn.0043a0a0
add esp, 0x10
lea ecx, [ebp - 0x2c]
call fcn.0045c98b
call fcn.004e497c
ret 4
Function at 0x42bb24
Capabilities:
Get file version info

Disassembly:
push 0x98
mov eax, 0x52b99d
call fcn.004e49d2
mov ebx, edx
mov edi, ecx
mov dword [ebp - 0x90], edi
mov dword [ebp - 0x84], edi
mov eax, dword fs:[0x2c]
xor esi, esi
mov dword [ebp - 0x94], esi
mov ecx, dword [eax]
mov eax, dword [0x5ea57c]
cmp eax, dword [ecx + 0x139c]
jle 0x42bba8
push 0x5ea57c
call fcn.004e3f82
cmp dword [0x5ea57c], 0xffffffff
pop ecx
jne 0x42bba8
mov dword [ebp - 4], esi
mov dword [0x5ea580], esi
mov dword [0x5ea584], esi
call fcn.00430925
push 0x53b590
mov dword [0x5ea580], eax
call fcn.004e45f2
or dword [ebp - 4], 0xffffffff
mov dword [esp], 0x5ea57c
call fcn.004e3f43
pop ecx
push ebx
lea eax, [ebp - 0x7c]
mov ecx, 0x5ea580
push eax
call fcn.0042f53d
mov esi, dword [ebp - 0x7c]
cmp esi, dword [0x5ea580]
je 0x42bbd4
lea eax, [esi + 0x10]
mov ecx, ebx
push eax
call fcn.004146f4
shr eax, 0x1f
test al, al
je 0x42bbda
mov esi, dword [0x5ea580]
cmp esi, dword [0x5ea580]
je 0x42bbf2
add esi, 0x28
mov ecx, edi
push esi
call fcn.0042669f
jmp 0x42bd24
cmp dword [ebx + 0x14], 0x10
jb 0x42bbfc
mov eax, dword [ebx]
jmp 0x42bbfe
mov eax, ebx
lea ecx, [ebp - 0x98]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov dword [ebp - 0x78], eax
test eax, eax
je 0x42bd18
push eax
call fcn.004e461a
mov esi, eax
mov dword [ebp - 0x84], esi
pop ecx
test esi, esi
jne 0x42bc4b
push str.GetDLLVersion:324:_memory_allocation_failed
lea ecx, [ebp - 0xa4]
call fcn.0040ea4b
push 0x5db478
lea eax, [ebp - 0xa4]
push eax
call fcn.004fda0a
push esi
lea ecx, [ebp - 0x7c]
call fcn.0041ffcf
add esp, 4
mov dword [ebp - 4], 1
cmp dword [ebx + 0x14], 0x10
jb 0x42bc68
mov eax, dword [ebx]
jmp 0x42bc6a
mov eax, ebx
push esi
push dword [ebp - 0x78]
push 0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x42bd0b
and dword [ebp - 0x80], 0
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x88]
push eax
push str.VarFileInfoTranslation
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x42bd0b
mov ecx, dword [ebp - 0x80]
xor esi, esi
test ecx, 0xfffffffc
jbe 0x42bd0b
mov eax, dword [ebp - 0x88]
movzx edx, word [eax + esi*4]
cmp dl, 9
jne 0x42bd01
movzx eax, word [eax + esi*4 + 2]
push eax
push edx
push str.StringFileInfo_04x_04xFileVersion
lea eax, [ebp - 0x74]
push 0x32
push eax
call fcn.00431c6c
and dword [ebp - 0x78], 0
lea eax, [ebp - 0x8c]
and dword [ebp - 0x8c], 0
add esp, 0x14
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x84]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
jne 0x42bd2c
mov ecx, dword [ebp - 0x80]
mov eax, ecx
inc esi
shr eax, 2
cmp esi, eax
jb 0x42bcab
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x7c]
call fcn.004e3e1e
pop ecx
push 0x5ac404
mov ecx, edi
call fcn.00426582
mov eax, edi
call fcn.004e497c
ret
mov edi, dword [ebp - 0x78]
mov ecx, 0x5ea580
push ebx
call fcn.0042f1d6
push edi
mov esi, eax
call fcn.0042655b
pop ecx
push eax
push edi
mov ecx, esi
call fcn.004264e2
push dword [ebp - 0x78]
mov ecx, dword [ebp - 0x90]
call fcn.00426582
push dword [ebp - 0x7c]
call fcn.004e3e1e
mov eax, dword [ebp - 0x90]
pop ecx
jmp 0x42bd26
Function at 0x430a11
Capabilities:
Print debug messages

Disassembly:
push 0xa4
mov eax, 0x52c38e
call fcn.004e49d2
mov edi, edx
mov esi, ecx
push 7
lea ecx, [ebp - 0xb0]
call fcn.004112f7
xor ebx, ebx
lea ecx, [ebp - 0x78]
mov dword [ebp - 4], ebx
call fcn.0045bbdb
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x60]
call fcn.004264be
sub esp, 0x18
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x98], esp
push eax
call fcn.0041140f
push str.timestamp__timestamp
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 3
call fcn.004126d5
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0041163b
push ebx
push 1
lea ecx, [ebp - 0x60]
call fcn.00416ab1
push ebx
push 1
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], bl
call fcn.00427ba9
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x98], esp
push esi
call fcn.004113dd
push 0x5aeef0
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 4
call fcn.004126d5
mov ecx, eax
mov byte [ebp - 4], bl
call fcn.0041163b
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x98], esp
push edi
call fcn.00411451
push str.data
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 5
call fcn.004126d5
mov ecx, eax
call fcn.0041163b
lea ecx, [ebp - 0x48]
call fcn.0041343f
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0041345e
mov byte [ebp - 4], 7
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
mov esi, dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
cmovae eax, dword [ebp - 0x28]
push eax
call esi
push 0x550680
call esi
push ecx
push dword [0x5e8150]
lea ecx, [ebp - 0x94]
call fcn.0045c8f0
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 8
push eax
mov ecx, 0x5e8158
call fcn.0041272d
lea ecx, [ebp - 0x94]
call fcn.0045c98b
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.00416ab1
lea ecx, [ebp - 0x48]
call fcn.0040f5b8
lea ecx, [ebp - 0xb0]
call fcn.0041159b
call fcn.004e497c
ret
Function at 0x459b3a
Capabilities:
Create directory

Disassembly:
push 0x3c
mov eax, 0x531dc6
call fcn.004e49d2
mov esi, edx
mov edi, ecx
cmp esi, 0xa
jle 0x459b72
push esi
push 0x137
push str.GetUniqueTempDir
push str._s:_d___depth_too_large:__d
push 1
push 0
call fcn.0043a0a0
add esp, 0x18
xor al, al
jmp 0x459c73
xor edx, edx
cmp dword [edi + 0x14], 8
mov dword [edi + 0x10], edx
jb 0x459b81
mov eax, dword [edi]
jmp 0x459b83
mov eax, edi
xor ecx, ecx
mov word [eax], cx
xor eax, eax
push 7
pop ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], edx
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], edx
call fcn.004599ec
test al, al
jne 0x459bc1
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 0x140
push str.GetUniqueTempDir
push str._s:_d___GetSysTempPath_failed:__d
jmp 0x459c8f
test esi, esi
jle 0x459c43
push 0x50
pop eax
cdq
idiv esi
cmp eax, ebx
cmovg ebx, eax
and dword [ebp - 0x44], 0
mov dword [ebp - 0x48], ebx
test esi, esi
jle 0x459c43
push ebx
lea ecx, [ebp - 0x40]
call fcn.00459aff
pop ecx
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0042ac92
xor ebx, ebx
lea ecx, [ebp - 0x40]
push ebx
push 1
mov byte [ebp - 4], bl
call fcn.00427ba9
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00446be8
cmp dword [eax + 0x14], 8
jb 0x459c16
mov eax, dword [eax]
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
mov ebx, eax
lea ecx, [ebp - 0x40]
push 0
neg ebx
push 1
sbb bl, bl
call fcn.00427ba9
add bl, 1
jne 0x459c79
mov ebx, dword [ebp - 0x44]
inc ebx
mov dword [ebp - 0x44], ebx
cmp ebx, esi
mov ebx, dword [ebp - 0x48]
jl 0x459bdb
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00446be8
push eax
mov ecx, edi
call fcn.00427b2c
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.00427ba9
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00427ba9
mov al, bl
call fcn.004e497c
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 0x153
push str.GetUniqueTempDir
push str._s:_d___CreateDirectory_failed:__d
push 1
push 0
call fcn.0043a0a0
add esp, 0x18
xor bl, bl
jmp 0x459c65

Function at 0x459f2d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ecx + 0x14], 8
push ebx
push esi
push edi
mov edi, edx
jb 0x459f3e
mov ecx, dword [ecx]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x459f8f
cmp dword [edi + 0x14], 0x10
lea ebx, [edi + 0x10]
jb 0x459f69
mov edi, dword [edi]
push 0
lea eax, [ebp - 4]
push eax
push dword [ebx]
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x459f8f
mov eax, dword [ebp - 4]
cmp eax, dword [ebx]
jne 0x459f8f
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, 1
jmp 0x459fc3
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
cmp esi, 0xffffffff
je 0x459faa
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push edi
push 0x5b6454
push str._s___write_file_failed___d_
push 0
push 0
call fcn.0043a0a0
add esp, 0x14
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45c9fe
Capabilities:
Get common file path

Disassembly:
push 0x244
mov eax, 0x532415
call fcn.004e49d2
push 0x105
lea eax, [ebp - 0x220]
xor esi, esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
test eax, eax
je 0x45caaf
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x250]
call fcn.00426582
push 0x5b76ac
mov edx, eax
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x238]
call fcn.004250a2
or dword [ebp - 4], 0xffffffff
pop ecx
push esi
push 1
lea ecx, [ebp - 0x250]
call fcn.00427ba9
cmp dword [ebp - 0x224], 8
lea eax, [ebp - 0x238]
cmovae eax, dword [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
push esi
push 1
lea ecx, [ebp - 0x238]
mov edi, eax
call fcn.00427ba9
test edi, edi
je 0x45caaf
push str.SetProcessDpiAwareness
push edi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x45caa8
push 2
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov eax, esi
call fcn.004e497c
ret
Function at 0x45cbf0
Capabilities:
Get local ipv4 addresses

Disassembly:
push 0x50
mov eax, 0x532478
call fcn.004e49d2
mov dword [ebp - 0x4c], ecx
mov eax, 0x3a98
xor ebx, ebx
mov dword [ebp - 0x44], eax
push 2
pop edi
push eax
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x50], esi
test esi, esi
je 0x45cd14
lea eax, [ebp - 0x44]
push eax
push esi
push 0
push 0xe
push edi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
mov edi, eax
cmp edi, 0x6f
jne 0x45cc61
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
xor esi, esi
inc ebx
cmp ebx, 3
jge 0x45cce3
mov eax, dword [ebp - 0x44]
jmp 0x45cc09
test edi, edi
jne 0x45cce3
mov eax, esi
mov esi, dword [ebp - 0x4c]
mov dword [ebp - 0x48], eax
mov ebx, dword [eax + 0x10]
test ebx, ebx
je 0x45ccd4
push 2
pop edx
mov ecx, dword [ebx + 0xc]
cmp word [ecx], dx
jne 0x45ccca
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
push 0x16
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x28]
push eax
lea eax, [ecx + 4]
push eax
push edx
call dword [sym.imp.WS2_32.dll_inet_ntop]
test eax, eax
je 0x45ccc7
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.0042738f
and dword [ebp - 4], 0
mov ecx, esi
push eax
call fcn.00424286
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
push 0
push 1
call fcn.00427ba9
push 2
pop edx
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x45cc77
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 8]
mov dword [ebp - 0x48], eax
test eax, eax
jne 0x45cc6d
mov esi, dword [ebp - 0x50]
jmp 0x45ccfa
push edi
push str.GetLocalIPv4Addresses
push str._s___GetAdaptersAddresses_failed___d_
push 0
push 0
call fcn.0043a0a0
add esp, 0x14
test esi, esi
je 0x45cd0e
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
call fcn.004e497c
ret
push str.GetLocalIPv4Addresses
push str._s___HeapAlloc_failed
push 0
push 0
call fcn.0043a0a0
add esp, 0x10
lea ecx, [ebp - 0x5c]
push str.GetLocalIPv4Addresses:2192:_memory_allocation_failed
call fcn.0040ea4b
push 0x5db478
lea eax, [ebp - 0x5c]
push eax
call fcn.004fda0a
int3
Function at 0x4b1640
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_LockResource]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, edi
shr eax, 4
and edi, 0xf
inc eax
mov dword [ebp - 8], 0
movzx ecx, ax
xor esi, esi
mov dword [ebp - 4], 0x409
mov dword [ebp + 8], ecx
movzx eax, word [ebp + esi*4 - 8]
push eax
push ecx
push 6
push dword [0x5eaa58]
call dword [sym.imp.KERNEL32.DLL_FindResourceExW]
test eax, eax
je 0x4b16c5
push eax
push dword [0x5eaa58]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x4b16c5
push eax
call ebx
test eax, eax
je 0x4b16c5
test edi, edi
jle 0x4b16be
mov edx, edi
nop dword [eax + eax]
movzx ecx, word [eax]
lea eax, [eax + ecx*2]
add eax, 2
sub edx, 1
jne 0x4b16b0
movzx ecx, word [eax]
test ecx, ecx
jne 0x4b16d0
inc esi
cmp esi, 2
jae 0x4b16da
mov ecx, dword [ebp + 8]
jmp 0x4b1671
pop edi
pop esi
add eax, 2
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x5ac404
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404db0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x404de7
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405b56
mov esp, ebp
pop ebp
ret
push esi
push 0x208
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 8], 0x208
lea eax, [ebp - 8]
push eax
push esi
push str.shellopencommand
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
push dword [ebp - 0xc]
test eax, eax
je 0x404e46
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405b56
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00405b56
mov esp, ebp
pop ebp
ret