joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449c10
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4871a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0047a747
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.0047fddd
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.004812f9
test eax, eax
je 0x449d2c
mov ecx, dword [esp + 0x3c]
call fcn.0047fe0a
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x449cf0
push edi
mov ecx, esi
call fcn.0047d473
mov ecx, esi
call fcn.00449e90
cmp dword [esp + 0x38], 1
jne 0x449d25
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0047d5ae
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x44c740
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x44c773
push esi
call fcn.0044f850
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44c76c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x44c7f9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x44c7e2
mov eax, dword [esi + 8]
test eax, eax
je 0x44c797
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44c7de
cmp eax, 2
je 0x44c7e2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44c78a
cmp eax, 3
je 0x44c7bd
cmp eax, 1
jne 0x44c78a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44c78a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44c78a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0044c820
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x44c808
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0044c820
add esp, 4
pop esi
ret

Function at 0x458350
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x4583f3
test eax, eax
jbe 0x4583f3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x4583f3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x45839e
xor esi, esi
jmp 0x4583a4
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x4583cf
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.0045a340
add esi, eax
push esi
mov ebx, esi
call fcn.0045a340
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x4583b0
pop ebp
test edi, edi
pop edi
jne 0x4583f3
test ebx, ebx
je 0x4583f3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.00469690
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x458535
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x45864d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45864d
mov eax, dword [esi + 0x3c]
push eax
call fcn.0047ab99
mov esi, eax
test esi, esi
je 0x45864d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x45864d
mov ecx, esi
call fcn.004584a0
cmp edi, eax
jge 0x45864d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x4585d3
mov dword [esp + 0x34], 1
jmp 0x45862e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x45864d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00457a80
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x45bbcd
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x487788
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [esp + 0x28]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edx, dword [esi + 0x40]
test edx, edx
setne bl
inc ebx
test eax, eax
je 0x45bbe3
or bh, 0x80
lea ecx, [esp + 0xc]
call fcn.00460f40
mov edx, dword [esp + 0x30]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x28], 0
push ecx
push edx
lea ecx, [esp + 0x14]
call fcn.00461200
lea eax, [esp + 0xc]
push ebx
push eax
mov ecx, esi
call fcn.0045bc50
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0xc], 0x494218
call fcn.00461140
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 8
Function at 0x460af0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x13c]
push edi
test eax, eax
jle 0x460b3c
mov eax, dword [ebx + 0x140]
test eax, eax
jle 0x460b3c
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
lea edi, [ebx + 0x150]
mov eax, dword [edi]
test eax, eax
je 0x460b26
push eax
call ebp
test ax, ax
jl 0x460b34
inc esi
add edi, 4
cmp esi, 6
jb 0x460b18
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
mov ecx, ebx
call fcn.004607f0
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x463380
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x4633e0
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x4633e0
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x4633e0
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x4633e0
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x4633f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x47b53d
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x47b575
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004795f1
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004795c9
jmp 0x47b581
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x47cc30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x47cc72
call fcn.004828eb
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x47cc72
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x47cc69
xor eax, eax
jmp 0x47cc7a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0047cc80
pop edi
pop esi
pop ebx
ret 4

Function at 0x482e1b
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x482e49
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x482e67
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00482d81
jmp 0x482e67
mov eax, dword [esi + 0x14]
test eax, eax
je 0x482e67
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00482d81
test edi, edi
mov eax, edi
jne 0x482e51
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x11b34
Capabilities:
Hash data using crc32b

Disassembly:
xor ecx, ecx
mov eax, ecx
push 8
shl eax, 0x18
pop edx
test eax, eax
jns 0x11b4b
add eax, eax
xor eax, 0x4c11db7
jmp 0x11b4d
shl eax, 1
dec edx
jne 0x11b3e
mov dword [ecx*4 + 0x11f40], eax
inc ecx
cmp ecx, 0x100
jl 0x11b36
ret

Function at 0x11b66
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [0x11f44], 0
jne 0x11b79
call fcn.00011b34
mov edx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jbe 0x11ba7
mov ecx, dword [ebp + 8]
push ebx
push edi
mov eax, dword [ecx]
movzx ebx, byte [edx]
mov edi, eax
shr edi, 0x18
xor edi, ebx
shl eax, 8
xor eax, dword [edi*4 + 0x11f40]
inc edx
dec esi
mov dword [ecx], eax
jne 0x11b89
pop edi
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x401260
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x414044]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push 0x118
xor esi, esi
lea eax, [esp + 0xc]
push esi
push eax
call fcn.0040b3e0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x401339
mov eax, dword [esp + 8]
cmp eax, 5
jne 0x401305
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x4012de
cmp word [esp + 0x118], 4
jb 0x401339
mov esi, 1
mov eax, esi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.00404b06
add esp, 0x120
ret
cmp eax, 2
jae 0x4012e8
cmp eax, 1
jne 0x401339
mov esi, 3
mov eax, esi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.00404b06
add esp, 0x120
ret
cmp eax, 6
jne 0x401339
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x40132f
mov esi, 4
mov eax, esi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.00404b06
add esp, 0x120
ret
cmp eax, 1
jne 0x401339
mov esi, 5
mov ecx, dword [esp + 0x120]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00404b06
add esp, 0x120
ret
Function at 0x4016b0
Capabilities:
Get mac address on windows

Disassembly:
sub esp, 0x3c
mov eax, dword [0x414044]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x40]
push ebx
push ebp
push esi
mov esi, edx
mov dword [esp + 0x18], eax
xor eax, eax
xor edx, edx
push 0x288
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], 0xffffffff
mov word [esp + 0x28], dx
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov dword [esp + 0x3a], eax
mov dword [esp + 0x3e], eax
mov dword [esp + 0x42], eax
mov word [esp + 0x46], ax
xor ebx, ebx
call fcn.00405142
mov ebp, eax
add esp, 4
lea eax, [esp + 0x10]
push eax
push ebp
mov dword [esp + 0x18], 0x288
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x401743
push ebp
call fcn.004052b7
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00405142
add esp, 8
mov ebp, eax
lea edx, [esp + 0x10]
push edx
push ebp
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x401827
mov eax, ebp
mov dword [esp + 0x14], ebp
test ebp, ebp
je 0x401827
push edi
jmp 0x401774
mov eax, dword [esp + 0x18]
inc dword [esp + 0x10]
test esi, esi
je 0x40178f
mov ecx, dword [eax + 0x194]
mov dword [esi], ecx
mov dx, word [eax + 0x198]
mov word [esi + 4], dx
lea edi, [eax + 0x1ac]
test edi, edi
je 0x401814
lea esp, [esp]
lea edx, [edi + 4]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4017a8
sub eax, esi
mov ecx, eax
cmp ecx, 0x10
jle 0x4017bd
mov ecx, 0x10
xor eax, eax
test ecx, ecx
jl 0x4017dd
cmp eax, ecx
jne 0x4017ce
xor esi, esi
mov word [esp + eax*2 + 0x28], si
movsx si, byte [edx + eax]
mov word [esp + eax*2 + 0x28], si
inc eax
cmp eax, ecx
jle 0x4017c5
lea eax, [esp + 0x28]
push eax
call fcn.00401160
add esp, 4
test eax, eax
je 0x401805
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + ebx*4]
lea ecx, [esp + 0x28]
push ecx
push 0x10
push eax
call fcn.00404b41
add esp, 0xc
mov edi, dword [edi]
inc ebx
test edi, edi
jne 0x4017a0
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x24]
test ebx, ebx
jg 0x401826
mov eax, dword [eax]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x401770
pop edi
mov ecx, dword [esp + 0x1c]
mov dword [ecx], ebx
test ebp, ebp
je 0x40183a
push ebp
call fcn.004052b7
add esp, 4
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0xc]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00404b06
add esp, 0x3c
ret
Function at 0x4018c0
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x314
mov eax, dword [0x414044]
xor eax, esp
mov dword [esp + 0x310], eax
lea eax, [esp + 4]
push eax
push 0x104
mov dword [esp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x412c08
lea ecx, [esp + 8]
push 0x104
push ecx
call fcn.00405eab
add esp, 0xc
push 0x104
lea edx, [esp + 0x10c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x108]
push eax
lea ecx, [esp + 0x210]
push 0x104
push ecx
call fcn.00404c4b
lea edx, [esp + 0x218]
push 0x5c
push edx
call fcn.00405350
add esp, 0x14
test eax, eax
je 0x40194b
mov byte [eax], 0
push ebx
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401a47
mov eax, 0x4150f0
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401980
sub eax, edx
push esi
push edi
mov edi, eax
lea eax, [esp + 0x114]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401997
sub eax, edx
mov ecx, eax
lea eax, [esp + 0x10]
lea esi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4019b0
sub eax, esi
lea edx, [eax + ecx*2]
add edx, ecx
lea edi, [edx + edi + 0x32]
push edi
call fcn.00404d1d
push edi
mov esi, eax
push 0
push esi
call fcn.0040b3e0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x22c]
push ecx
lea edx, [esp + 0x12c]
push edx
mov eax, edx
push eax
push 0x4150f0
push edi
push esi
call fcn.00404c2d
mov eax, esi
add esp, 0x2c
lea ecx, [eax + 1]
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401a00
push 0
sub eax, ecx
lea ecx, [esp + 0x10]
push ecx
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
lea edx, [esp + 0x1c]
push edx
push 0x412c18
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
test esi, esi
je 0x401a45
push esi
call fcn.004050e8
add esp, 4
pop edi
pop esi
mov ecx, dword [esp + 0x314]
pop ebx
xor ecx, esp
call fcn.00404b06
add esp, 0x314
ret
Function at 0x401a60
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x474
mov eax, dword [0x414044]
xor eax, esp
mov dword [esp + 0x46c], eax
push 0x44
lea eax, [esp + 0x14]
push 0
push eax
call fcn.0040b3e0
xor ecx, ecx
xor eax, eax
push 0x206
push ecx
lea edx, [esp + 0x276]
push edx
mov dword [esp + 0x28], 0x44
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov word [esp + 0x278], cx
call fcn.0040b3e0
push 0x103
push esi
lea eax, [esp + 0x280]
push 0x104
push eax
call fcn.0040537d
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x8a]
push edx
mov word [esp + 0x8c], cx
call fcn.0040b3e0
push 0x103
push edi
lea eax, [esp + 0x94]
push 0x104
push eax
call fcn.0040537d
add esp, 0x44
lea ecx, [esp]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x60]
push eax
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [esp + 0x280]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
jne 0x401b4d
xor eax, eax
mov ecx, dword [esp + 0x46c]
xor ecx, esp
call fcn.00404b06
add esp, 0x474
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x46c]
xor ecx, esp
call fcn.00404b06
add esp, 0x474
ret
Function at 0x401c00
Capabilities:
Get common file path
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x834
mov eax, dword [0x414044]
xor eax, esp
mov dword [esp + 0x82c], eax
push ebx
push ebp
push esi
push edi
xor edi, edi
push 0x206
lea ecx, [esp + 0x226]
xor eax, eax
push edi
push ecx
mov dword [esp + 0x20], edi
mov word [esp + 0x22c], ax
call fcn.0040b3e0
add esp, 0xc
push 0x206
lea eax, [esp + 0x1e]
xor edx, edx
push edi
push eax
mov word [esp + 0x24], dx
call fcn.0040b3e0
add esp, 0xc
push 0x206
lea edx, [esp + 0x636]
xor ecx, ecx
push edi
push edx
mov word [esp + 0x63c], cx
call fcn.0040b3e0
add esp, 0xc
push 0x206
lea ecx, [esp + 0x42e]
xor eax, eax
push edi
push ecx
mov word [esp + 0x434], ax
call fcn.0040b3e0
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0xc
call ebp
mov edx, eax
mov eax, 0x10624dd3
mul edx
mov eax, edx
xor edx, edx
shr eax, 6
mov ecx, 0x3e8
div ecx
push edx
lea edx, [esp + 0x42c]
push 0x412c24
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x104
lea eax, [esp + 0x224]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x18]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x634]
push 0x104
push eax
call fcn.00404b41
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x224]
push edx
call fcn.0040520c
add esp, 8
test eax, eax
je 0x401d32
mov dword [esp + 0x14], 1
jmp 0x401e70
lea eax, [esp + 0x220]
push 0x5c
push eax
call fcn.00404b15
add esp, 8
test eax, eax
je 0x401e70
lea ecx, [esp + 0x428]
push ecx
lea edx, [esp + 0x1c]
push 0x104
push edx
call fcn.00405450
add esp, 0xc
push 0x412c3c
lea eax, [esp + 0x224]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x1c], edi
call fcn.004055aa
add esp, 0xc
test eax, eax
je 0x401d8f
xor eax, eax
jmp 0x401e74
mov edx, dword [esp + 0x10]
push 2
push edi
push edx
call fcn.00405687
mov eax, dword [esp + 0x1c]
add esp, 0xc
push eax
call fcn.004058a9
mov ecx, dword [esp + 0x14]
add esp, 4
push edi
push edi
push ecx
mov esi, eax
call fcn.00405687
lea edx, [esi + 0x32000]
add esp, 0xc
push edx
call fcn.00405142
add esp, 4
mov edi, eax
mov eax, dword [esp + 0x10]
push eax
push 1
push esi
push edi
call fcn.00405bb7
mov ecx, dword [esp + 0x20]
push ecx
call fcn.00405c4b
add esp, 0x14
lea ebx, [edi + esi]
push 0x19000
lea edx, [ebx + 0x19000]
push edx
push ebx
call fcn.0040be10
add esp, 0xc
push 0x412c44
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.004055aa
add esp, 0xc
test eax, eax
jne 0x401d88
call ebp
xor edx, edx
mov ecx, 0xc350
div ecx
mov eax, dword [esp + 0x10]
push eax
push 1
add edx, esi
push edx
push edi
call fcn.00405e29
mov ecx, dword [esp + 0x20]
push ecx
push 1
push 0x23e
add ebx, 0xfffffdc2
push ebx
call fcn.00405e29
mov edx, dword [esp + 0x30]
push edx
call fcn.00405c4b
add esp, 0x24
lea edi, [esp + 0x630]
lea esi, [esp + 0x18]
call fcn.00401a60
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x83c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00404b06
add esp, 0x834
ret
Function at 0x4024c0
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
sub esp, 0x228
mov eax, dword [0x414044]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x2a]
push ecx
mov word [esp + 0x2c], ax
call fcn.0040b3e0
xor eax, eax
add esp, 0xc
mov byte [esp + 0x10], 0
mov dword [esp + 0x11], eax
mov dword [esp + 0x15], eax
mov dword [esp + 0x19], eax
mov word [esp + 0x1d], ax
mov byte [esp + 0x1f], al
cmp dword [0x41749c], eax
jbe 0x4025d4
cmp word [0x4174a0], ax
jbe 0x4025d4
lea esi, [esp + 0x10]
call fcn.004010e0
movzx ebx, word [0x4174a0]
lea esi, [esp + 0x20]
call fcn.00401000
push 0x412cc8
mov edx, esi
push 0x104
push edx
call fcn.00405450
add esp, 0xc
push 0x412ccc
mov eax, esi
push 0x104
push eax
call fcn.00405450
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0xc
push ebx
lea ecx, [esp + 0x14]
call fcn.004025f0
add esp, 4
lea ecx, [esp + 0x20]
push ecx
call esi
cmp eax, 0xffffffff
jne 0x4025a0
push 0x2bac
mov ecx, 0x412cec
call fcn.004025f0
add esp, 4
lea edx, [esp + 0x20]
push edx
call esi
cmp eax, 0xffffffff
jne 0x4025b5
push 0x1d4c0
call edi
jmp 0x402575
push 0xbb8
call edi
push 1
push 0
push 0x412c20
lea eax, [esp + 0x2c]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00404b06
add esp, 0x228
ret

Function at 0x403e70
Capabilities:
Hash data using sha1
Read file on windows

Disassembly:
mov eax, 0x1068
call fcn.00410070
mov eax, dword [0x414044]
xor eax, esp
mov dword [esp + 0x1064], eax
push ebx
push ebp
push esi
push 2
xor ebp, ebp
mov ebx, ecx
push ebp
push edi
mov dword [esp + 0x1c], ebx
call fcn.00405687
push edi
call fcn.004058a9
push ebp
push ebp
push edi
mov dword [esp + 0x28], eax
call fcn.00405687
push edi
push 0x1000
lea eax, [esp + 0x94]
push 1
push eax
mov dword [esp + 0x44], ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x48], 0x67452301
mov dword [esp + 0x4c], 0xefcdab89
mov dword [esp + 0x50], 0x98badcfe
mov dword [esp + 0x54], 0x10325476
mov dword [esp + 0x58], 0xc3d2e1f0
call fcn.00405bb7
mov esi, eax
add esp, 0x2c
test esi, esi
jbe 0x403f33
lea esp, [esp]
lea ecx, [esp + 0x70]
push esi
push ecx
lea ebx, [esp + 0x1c]
call fcn.00403ce0
push edi
push 0x1000
lea edx, [esp + 0x80]
push 1
push edx
add ebp, esi
call fcn.00405bb7
mov esi, eax
add esp, 0x18
test esi, esi
ja 0x403f00
mov ebx, dword [esp + 0x10]
push ebx
lea esi, [esp + 0x18]
call fcn.00403d80
push edi
call fcn.00405c4b
add esp, 8
cmp ebp, dword [esp + 0xc]
jae 0x403f74
xor eax, eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
pop esi
mov dword [ebx + 0xc], eax
pop ebp
mov dword [ebx + 0x10], eax
pop ebx
mov ecx, dword [esp + 0x1064]
xor ecx, esp
call fcn.00404b06
add esp, 0x1068
ret
mov ecx, dword [esp + 0x1070]
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00404b06
add esp, 0x1068
ret