joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416790
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov dword [eax + 0xa8], 0
mov ecx, dword [ebp - 0x28]
cmp dword [ecx + 0xb0], 0
je 0x416901
mov ecx, dword [ebp - 0x28]
call fcn.00418da0
test eax, eax
je 0x4168d5
mov ecx, dword [ebp - 0x28]
call fcn.00418d70
test eax, eax
jne 0x4167f1
mov edx, dword [ebp - 0x28]
mov dword [edx + 0xa8], 1
mov eax, dword [ebp - 0x28]
mov dword [eax + 0xb4], 1
jmp 0x4168d3
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
push str.InstallReboot_QDCCB_For_CheckTool
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x41688e
mov ecx, dword [ebp - 0x28]
add ecx, 0x7c
call fcn.004023b0
push str.NEED_RESTART
mov ecx, dword [ebp - 0x28]
add ecx, 0x7c
call fcn.0041a560
push 0x4542e0
mov ecx, dword [ebp - 0x28]
add ecx, 0x7c
call fcn.0041a560
push 0
push 0
push 0xbba
mov ecx, dword [ebp - 0x28]
call fcn.0041a5f0
mov eax, dword [ebp - 0x28]
mov dword [eax + 0x98], 3
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 0x9c], 0
xor eax, eax
jmp 0x4169c7
mov ecx, dword [ebp - 0x28]
call fcn.00418be0
test eax, eax
je 0x4168c6
mov ecx, dword [ebp - 0x28]
call fcn.00418c80
test eax, eax
je 0x4168c6
mov ecx, dword [ebp - 0x28]
call fcn.00418910
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x4168c4
mov edx, dword [ebp - 0x28]
mov dword [edx + 0xa8], 1
jmp 0x4168d3
mov eax, dword [ebp - 0x28]
mov dword [eax + 0xa8], 1
jmp 0x4168fc
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 0x94], 0
mov edx, dword [ebp - 0x28]
mov dword [edx + 0xa8], 1
mov eax, dword [ebp - 0x28]
mov dword [eax + 0xb4], 1
jmp 0x4169c2
push 0x4542e4
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 0xa0]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
push 0x4542f4
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
push 0x454300
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
push 0x454314
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 0xa0]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x28]
add ecx, 0xbc
call fcn.00407110
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x41698c
mov ecx, dword [ebp - 0x28]
add ecx, 0xbc
call fcn.00407650
cmp dword [ebp - 0x20], 0
jne 0x4169b5
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0xb8], 0
jne 0x4169b3
call dword [ebp - 0x1c]
cmp eax, 1
jne 0x4169b3
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 0xa8], 1
jmp 0x4169c2
mov edx, dword [ebp - 0x28]
mov dword [edx + 0xa8], 1
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x417400
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x417435
push 0
push 0
push 0x454434
mov ecx, dword [ebp - 0x18]
call fcn.0041fa57
xor eax, eax
jmp 0x4174b4
lea ecx, [ebp - 0x10]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
push 0
push 0
push 0
lea edx, [ebp - 0x14]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x417489
push 0
push 0
push 0x454464
mov ecx, dword [ebp - 0x18]
call fcn.0041fa57
xor eax, eax
jmp 0x4174b4
push 0x80020003
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x4174af
push 0
push 0
push 0x454480
mov ecx, dword [ebp - 0x18]
call fcn.0041fa57
xor eax, eax
jmp 0x4174b4
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x417520
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c8ab
mov eax, dword fs:[0]
push eax
sub esp, 0x17c
mov eax, dword [0x463444]
xor eax, ebp
mov dword [ebp - 0x70], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x188], ecx
lea ecx, [ebp - 0x180]
call fcn.00402f10
mov dword [ebp - 4], 0
mov byte [ebp - 0x17c], 0
push 0x103
push 0
lea eax, [ebp - 0x17b]
push eax
call fcn.0043b290
add esp, 0xc
mov dword [ebp - 0x14], 0x104
lea ecx, [ebp - 0x10]
push ecx
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4175d7
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x17c]
push eax
push 0
push 0
push 0x4544d4
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4175d7
lea edx, [ebp - 0x17c]
push edx
lea ecx, [ebp - 0x180]
call fcn.00402e90
lea ecx, [ebp - 0x180]
call fcn.00401bc0
movzx eax, al
test eax, eax
je 0x41762b
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0
push 0x4544e4
mov ecx, dword [ebp - 0x188]
call fcn.0041fa57
mov dword [ebp - 0x184], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x180]
call fcn.00402f30
mov eax, dword [ebp - 0x184]
jmp 0x4176a6
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x44
push 0
lea eax, [ebp - 0x6c]
push eax
call fcn.0043b290
add esp, 0xc
mov dword [ebp - 0x6c], 0x44
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
push str.Internet_ExplorerIEXPLORE.EXE_http:__www.qdccb.com_
lea ecx, [ebp - 0x180]
call fcn.004066d0
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x6c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x180]
call fcn.00402c70
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x180]
call fcn.00402f30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x70]
xor ecx, ebp
call fcn.004381fb
mov esp, ebp
pop ebp
ret
Function at 0x4176c0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
push 0x454550
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x41771e
push 0x454560
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x41771c
push 0x454570
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
jmp 0x41775c
push str.SCHANNEL.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x41775c
push str.SslEmptyCacheA
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x41775c
push str.SslEmptyCacheW
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
push str.WININET.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x417782
push str.IncrementUrlCacheHeaderData
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 8], 0
je 0x4177a0
push 0
push 0
call dword [ebp - 8]
cmp dword [ebp - 0xc], 0
je 0x41779e
lea edx, [ebp - 4]
push edx
push 0xe
call dword [ebp - 0xc]
jmp 0x4177bc
cmp dword [ebp - 0x10], 0
je 0x4177bc
push 0
push 0
call dword [ebp - 0x10]
cmp dword [ebp - 0xc], 0
je 0x4177bc
lea eax, [ebp - 4]
push eax
push 0xe
call dword [ebp - 0xc]
cmp dword [ebp - 0x18], 0
je 0x4177cc
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x14], 0
je 0x4177dc
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esp, ebp
pop ebp
ret
Function at 0x4177e0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x417819
mov eax, 1
jmp 0x417909
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x24], 0
jmp 0x417832
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x14
jge 0x417863
push 0x16
push str.ngslotd
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x41785f
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x417861
jmp 0x417863
jmp 0x417829
cmp dword [ebp - 0x20], 0
jne 0x417873
mov eax, 1
jmp 0x417909
mov byte [ebp - 0x25], 0
mov dword [ebp - 0x1c], 0
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x24], 0
jmp 0x4178a4
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x64
jge 0x4178e2
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4178d6
cmp dword [ebp - 0x18], 4
je 0x4178ce
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41789b
mov byte [ebp - 0x25], 1
jmp 0x4178e2
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41789b
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx edx, byte [ebp - 0x25]
test edx, edx
jne 0x417907
mov eax, 1
jmp 0x417909
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x417e00
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x463444]
xor eax, ebp
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x24], 0
mov byte [ebp - 0x138], 0
push 0x103
push 0
lea eax, [ebp - 0x137]
push eax
call fcn.0043b290
add esp, 0xc
mov dword [ebp - 0x28], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
jne 0x417e6d
xor al, al
jmp 0x417fc2
mov dword [ebp - 0x140], 0
jmp 0x417e88
mov ecx, dword [ebp - 0x140]
add ecx, 1
mov dword [ebp - 0x140], ecx
cmp dword [ebp - 0x140], 0x14
jge 0x417ebf
push 0x14
push 0x454698
mov edx, dword [ebp - 0x13c]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x417ebb
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x417ebd
jmp 0x417ebf
jmp 0x417e79
cmp dword [ebp - 0x24], 0
jne 0x417ed9
mov eax, dword [ebp - 0x13c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x417fc2
push 0
push 0
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x417f12
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x13c]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x417fc2
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], 0
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
mov edx, 1
test edx, edx
je 0x417f9c
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x417f79
cmp dword [ebp - 0x18], 4
je 0x417f75
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], 0xc8
jle 0x417f69
jmp 0x417f9c
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x417f34
jmp 0x417f9c
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xc8
jle 0x417f8d
jmp 0x417f9c
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x417f34
cmp dword [ebp - 0x20], 0xc8
jle 0x417fa9
xor al, al
jmp 0x417fc2
mov ecx, dword [ebp - 0x13c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.004381fb
mov esp, ebp
pop ebp
ret
Function at 0x418330
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x41838e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
xor al, al
jmp 0x418438
push 0xf01ff
push str.ngSlotD
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x4183c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x418438
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x418422
cmp dword [ebp - 0x18], 1
jne 0x4183de
jmp 0x418422
lea edx, [ebp - 0x1c]
push edx
push 1
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x418422
mov dword [ebp - 0x2c], 1
cmp dword [ebp - 0x18], 3
jne 0x418422
cmp dword [ebp - 0x2c], 0x258
jle 0x41840a
jmp 0x418422
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x4183f9
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x418e70
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
call fcn.004054d0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x418e8e
xor al, al
jmp 0x418f6d
mov eax, dword [ebp + 0xc]
push eax
movzx ecx, word [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x418f67
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x418f61
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x418f5b
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
push 0
push 0
push 2
push 0
push 1
push 0xc0000000
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x418f4b
push 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x418f3b
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x418f6d
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x418f6d
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x418f6d
xor al, al
jmp 0x418f6d
xor al, al
jmp 0x418f6d
xor al, al
jmp 0x418f6d
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4237ab
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x4237f2
call fcn.0041c928
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4237f2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x42380e
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00423325
mov esi, eax
test edi, edi
je 0x42380c
test ebx, ebx
je 0x42380c
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4245ff
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x44acac
call fcn.0043ac21
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x424624
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x42466a
lea ecx, [ebp - 0x10]
call fcn.00402f10
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004125c0
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00403130
mov eax, esi
call fcn.0043acf9
ret 8

Function at 0x42d9ed
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x42da35
call fcn.0041c928
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x42da35
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x42da78
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x42da61
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x42da61
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x42da75
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x42ed1d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x42ed41
cmp dword [edi + 0x54], 0
jne 0x42ed41
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0041c928
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0042ecde
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4381fb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x463444]
jne 0x438205
repz ret
jmp fcn.0043ce3f

Function at 0x4398dd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x43990e
call fcn.0043afe1
mov dword [eax], esi
call fcn.0043afce
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.004394c7
add esp, 0x14
push 0x16
pop eax
jmp 0x439963
test dword [ebp + 0xc], 0xfffffff9
jne 0x4398ea
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x43993b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0043aff4
pop ecx
call fcn.0043afce
mov eax, dword [eax]
jmp 0x439963
test al, 0x10
jne 0x439961
test al, 1
je 0x439961
test byte [ebp + 0xc], 2
je 0x439961
call fcn.0043afe1
mov dword [eax], 5
call fcn.0043afce
mov dword [eax], 0xd
jmp 0x439932
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4469cd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00440344
and dword [ebp - 4], 0
cmp dword [0x476770], 0
mov ebx, eax
jne 0x446a7e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x446b2f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x453168
push edi
call esi
test eax, eax
je 0x446b2f
push eax
call fcn.004402d2
mov dword [esp], 0x453158
push edi
mov dword [0x476770], eax
call esi
push eax
call fcn.004402d2
mov dword [esp], 0x453144
push edi
mov dword [0x476774], eax
call esi
push eax
call fcn.004402d2
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x476778], eax
call esi
push eax
call fcn.004402d2
pop ecx
mov dword [0x476780], eax
test eax, eax
je 0x446a7e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004402d2
pop ecx
mov dword [0x47677c], eax
mov eax, dword [0x47677c]
cmp eax, ebx
je 0x446ad6
cmp dword [0x476780], ebx
je 0x446ad6
push eax
call fcn.0044034d
push dword [0x476780]
mov esi, eax
call fcn.0044034d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x446ad6
test edi, edi
je 0x446ad6
call esi
test eax, eax
je 0x446acd
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x446acd
test byte [ebp - 0xc], 1
jne 0x446ad6
or dword [ebp + 0x10], 0x200000
jmp 0x446b0f
mov eax, dword [0x476774]
cmp eax, ebx
je 0x446b0f
push eax
call fcn.0044034d
pop ecx
test eax, eax
je 0x446b0f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x446b0f
mov eax, dword [0x476778]
cmp eax, ebx
je 0x446b0f
push eax
call fcn.0044034d
pop ecx
test eax, eax
je 0x446b0f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x476770]
call fcn.0044034d
pop ecx
test eax, eax
je 0x446b2f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x446b31
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret