joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c980
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44a2a0
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x45f014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
cmp dword [0x4619bc], 0xffffffff
jne 0x40c9ce
push 0
push dword [0x4619c0]
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x4619bc], eax
lea eax, [ebp - 0x11]
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp + 0x58]
mov byte [ebp - 4], 2
test ecx, ecx
je 0x40c9fb
mov eax, dword [ecx]
lea edx, [ebp - 0x40]
push edx
call dword [eax]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x70]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x4c], 0
push dword [ebp - 0x18]
lea eax, [ebp - 0x12]
mov byte [ebp - 4], 4
push eax
push 0
lea eax, [ebp - 0x12]
push eax
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x70]
call fcn.00403740
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x40ca44
mov edx, dword [ecx]
lea eax, [ebp - 0x40]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x1c], 0
sub esp, 0x28
mov esi, esp
mov dword [ebp - 0x18], esi
mov dword [esi + 0x24], 0
mov ecx, dword [ebp - 0x4c]
mov byte [ebp - 4], 6
test ecx, ecx
je 0x40ca66
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
push dword [ebp + 8]
mov ecx, 0x4619a8
mov byte [ebp - 4], 5
push str.0.0.0.0
call fcn.0040c230
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
je 0x40ca94
mov edx, dword [ecx]
lea eax, [ebp - 0x70]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
lea eax, [ebp - 0x11]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x58]
mov byte [ebp - 4], 7
test ecx, ecx
je 0x40cabd
mov eax, dword [ecx]
lea edx, [ebp - 0x40]
push edx
call dword [eax]
mov dword [ebp - 0x1c], eax
sub esp, 0x28
mov ecx, esp
mov dword [ebp - 0x18], ecx
mov dword [ecx + 0x24], 0
push dword [ebp - 0x18]
lea eax, [ebp - 0x12]
mov byte [ebp - 4], 9
push eax
push 0
lea eax, [ebp - 0x12]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004037d0
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 1
test ecx, ecx
je 0x40cb09
mov edx, dword [ecx]
lea eax, [ebp - 0x40]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x1c], 0
mov ecx, 0x4619a8
call fcn.0040c430
cmp byte [ebp - 0x11], 0
jne 0x40cb2a
mov ecx, dword [ebp + 0x30]
test ecx, ecx
jne 0x40cb25
call fcn.0041cd2a
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [ebp + 0x30]
test ecx, ecx
je 0x40cb49
mov edx, dword [ecx]
lea eax, [ebp + 0xc]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp + 0x30], 0
mov ecx, dword [ebp + 0x58]
test ecx, ecx
je 0x40cb61
mov edx, dword [ecx]
lea eax, [ebp + 0x34]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e7b3
mov esp, ebp
pop ebp
ret
Function at 0x41b8e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x45f014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 0xa
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41b93e
lea eax, [ebp - 8]
push eax
push 1
push 2
push 0
push 0xf01ff
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x41b951
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e7b3
mov esp, ebp
pop ebp
ret 4
push 0x40
lea eax, [ebp - 0x5c]
push 0
push eax
call fcn.00436f50
add esp, 0xc
mov dword [ebp - 0x60], 0x44
xorps xmm0, xmm0
mov dword [ebp - 0x58], str.winsta0default
movups xmmword [ebp - 0x1c], xmm0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
cmp dword [esi + 0x14], 8
jb 0x41b987
mov esi, dword [esi]
push edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
push esi
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
test edi, edi
je 0x41b9be
push dword [ebp - 0x1c]
call esi
push dword [ebp - 0x18]
call esi
push dword [ebp - 8]
call esi
push dword [ebp - 0xc]
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0041e7b3
mov esp, ebp
pop ebp
ret 4
Function at 0x41bd80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b298
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
push edi
mov eax, dword [0x45f014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
movaps xmm0, xmmword [0x44f780]
xor ecx, ecx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x5de2f732
mov dword [ebp - 0x2c], 0x3b1462
mov byte [ebp - 0x28], 1
nop dword [eax + eax]
lea eax, [ecx + 0xd]
xor byte [ebp + ecx - 0x40], al
inc ecx
cmp ecx, 0x17
jb 0x41bdd0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov byte [ebp - 0x28], 0
mov dword [esi + 0x10], 0
jb 0x41be07
mov eax, dword [esi]
jmp 0x41be09
mov eax, esi
mov byte [eax], 0
cmp byte [ebp - 0x40], 0
jne 0x41be16
xor ecx, ecx
jmp 0x41be29
lea ecx, [ebp - 0x40]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41be20
sub ecx, edx
push ecx
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.0040e9c0
movaps xmm0, xmmword [0x44f770]
xor ecx, ecx
mov dword [ebp - 4], 0
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], pe_nt_image_headers32
nop
lea eax, [ecx + 0xd]
xor byte [ebp + ecx - 0x24], al
inc ecx
cmp ecx, 0x10
jb 0x41be50
mov byte [ebp - 0x13], 0
mov dword [esi + 0x2c], 0xf
mov dword [esi + 0x28], 0
mov byte [esi + 0x18], 0
cmp byte [ebp - 0x24], 0
jne 0x41be7d
xor ecx, ecx
jmp 0x41be8c
lea ecx, [ebp - 0x24]
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41be83
sub ecx, edi
push ecx
lea eax, [ebp - 0x24]
push eax
lea ecx, [esi + 0x18]
call fcn.0040e9c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41c7c0
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b361
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x45f014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], edi
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x14], 0xf
cmp dword [edi + 0x14], 0x10
mov dword [edi + 0x10], 0
jb 0x41c821
mov eax, dword [edi]
jmp 0x41c823
mov eax, edi
mov byte [eax], 0
push 0xf0000000
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x30], 1
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x41c92d
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0x8004
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x41c922
push 0
push dword [ebp + 0x10]
push esi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x41c919
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0x14
push 0x14
lea ecx, [ebp - 0x28]
movq qword [ebp - 0x28], xmm0
mov dword [ebp - 0x20], 0
call fcn.00409d00
mov ebx, dword [ebp - 0x28]
lea eax, [ebp - 0x2c]
push 0
push eax
push ebx
push 2
push dword [ebp - 0x18]
mov dword [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x41c911
xor esi, esi
cmp dword [ebp - 0x2c], esi
jbe 0x41c911
movzx eax, byte [ebx + esi]
push eax
lea eax, [ebp - 0x14]
push str._02X
push eax
call fcn.0041cb70
add esp, 0xc
cmp byte [ebp - 0x14], 0
jne 0x41c8f0
xor ecx, ecx
jmp 0x41c8ff
lea ecx, [ebp - 0x14]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41c8f6
sub ecx, edx
push ecx
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.0040e530
inc esi
cmp esi, dword [ebp - 0x2c]
jb 0x41c8d0
lea ecx, [ebp - 0x28]
call fcn.0040e120
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e7b3
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41c950
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x45f014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push edi
mov edi, dword [ebp + 0xc]
push 0xf0000000
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x8004
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x41ca1e
push 0
push dword [ebp + 0x10]
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x41ca1e
xor ecx, ecx
mov dword [ebp - 0x10], 0x14
mov eax, 0x14
add eax, 1
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.00439597
push dword [ebp - 0x10]
mov esi, eax
push 0
push esi
call fcn.00436f50
add esp, 0x10
lea eax, [ebp - 0x10]
push 0
push eax
push esi
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x41ca0a
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
movups xmm0, xmmword [esi]
movups xmmword [edi], xmm0
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
push esi
call fcn.00439592
add esp, 4
push 0
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041e7b3
mov esp, ebp
pop ebp
ret 0xc

Function at 0x420d90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x1029e46b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [esp], dx
jmp 0x102a8687
pushal
call fcn.102a45de
push 0x1bb112a
mov word [esp], 0xd3d9
mov dword [esp + 0xc], eax
pushal
jmp 0x10289384
mov byte [esp], bl
mov word [esp + 0x7c6], 0x69
mov word [esp], 0x1488
mov word [esp + 0x7c8], ax
lea esp, [esp + 0x78]
jge 0x102a4771
mov word [esp + 0x752], 0x77
push 0x2f8272d7
pushal
pushfd
lea esp, [esp + 0x28]
jmp 0x102926ca

Function at 0x102a4b1c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [esp], 0x72
call fcn.1029ac59

Function at 0x102a4b25
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not ch
movzx cx, cl
lea ecx, [esp + 0x14]
pushfd
lea esp, [esp + 4]
call fcn.10003b3a
cwde
lea ecx, [edx + 0x11054e8a]
lea eax, [edx*2 + 0x3842db2f]
lea eax, [esp + 0xba4]
lea ecx, [eax + 0x1173ad48]
setg ch
lea ecx, [esi - 0x3e85e5aa]
mov ch, ah
push eax
push 0xac9caea3
call fcn.102a101d
push 0x853ea77f
mov dword [esp + 0x18], esi
not cx
mov eax, dword [esp + 0x18]
pop ecx
lea ecx, [ebx*4 + 0x5cce4afa]
lea ecx, [ebx + 0x14046b12]
push dword [esp + eax*4 + 0x38]
jmp 0x10287f76
pushal
lea ecx, [edx + 0x4b07bb0a]
push dword [esp + eax*4 + 0x78]
pop dword [esp + 0x3c]
bswap cx
bswap ecx
push dword [esp + 0xc]
lea ecx, [esp + 0x54]
call fcn.102a0d6b
lea esp, [esp + 0xc]
jbe 0x1029199c
mov ah, dh
cwde
jg 0x102887f6
mov dword [esp + 0x14], esi
xchg cx, ax
lea ecx, [eax*8 - 0x2e72bb56]
pushal
mov eax, dword [esp + 0x34]
mov ch, ah
jmp 0x1029d342
Function at 0x402130
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push ebx
push esi
push edi
call fcn.004085f0
push eax
push str._Consent
push str.ROCred.Privacy
push str.Ai4rei.E.Skal
call fcn.004146e0
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
mov dword [esp + 0xc], eax
jne 0x402170
push eax
call fcn.00414700
test al, al
jne 0x4021ec
mov eax, dword [esp + 0xc]
push eax
mov esi, 1
call fcn.00414700
test al, al
je 0x4021a5
mov eax, dword [esp + 0xc]
push eax
call fcn.00414710
test al, al
je 0x402192
mov esi, 3
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00414720
test al, al
je 0x4021aa
or esi, 4
jmp 0x4021aa
mov esi, 7
lea edx, [esp + 0xc]
push edx
push str.http:__ai4rei.net_about_telemetry_
push esi
push ebx
push 0xfffffffffffffffa
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
push eax
call fcn.00414680
test al, al
je 0x402241
mov eax, dword [esp + 0xc]
push eax
call fcn.004085f0
push eax
push str._Consent
push str.ROCred.Privacy
push str.Ai4rei.E.Skal
call fcn.004146b0
test edi, edi
jne 0x402241
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00414700
test al, al
je 0x402241
mov edx, dword [esp + 0xc]
push edx
call fcn.00414710
test al, al
jne 0x402216
mov eax, dword [esp + 0xc]
push eax
call fcn.00414720
test al, al
je 0x402241
lea ecx, [esp + 0x18]
push ecx
push 4
push ebx
push 0x402250
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x402241
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
pop ecx
ret 8
Function at 0x404d40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x38
push ebx
push esi
push str.MediaBackground
call fcn.00408590
mov cl, byte [eax]
xor ebx, ebx
cmp cl, bl
je 0x404e61
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x404e61
mov esi, dword [esp + 0x44]
push edi
mov ecx, 9
xor eax, eax
lea edi, [esp + 0x20]
mov dword [esp + 0x1c], ebx
push 0xfffffffffffffffa
push esi
rep stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0x7f00
push ebx
mov dword [esp + 0x34], eax
mov dword [esp + 0x28], 0x405a30
mov dword [esp + 0x48], str.BackgroundMediaClass
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x2c], 4
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
pop edi
je 0x404e61
lea ecx, [esp + 8]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov al, byte [0x44479c]
test al, 1
jne 0x404e26
mov dl, al
push 0x405ac0
or dl, 1
mov dword [0x4447a4], ebx
mov byte [0x44479c], dl
mov byte [0x4447a8], bl
mov byte [0x4447a9], bl
mov dword [0x4447ac], ebx
mov byte [0x4447b0], bl
mov byte [0x4447b1], bl
mov dword [0x4447a0], 0x437c88
call fcn.0042d5b8
add esp, 4
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
push 0x4447a0
push edx
mov edx, dword [esp + 0x18]
push 0x6b
sub ecx, eax
push esi
push ecx
mov ecx, dword [esp + 0x1c]
sub edx, ecx
push edx
push eax
push ecx
push 0x54000000
push 0x437500
push str.BackgroundMediaClass
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
pop esi
mov al, 1
pop ebx
add esp, 0x38
ret
Function at 0x40bb90
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
push ebx
xor bl, bl
cmp byte [eax], 0x2e
jne 0x40bbe9
lea ecx, [esp + 8]
push ecx
push 1
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40bbe9
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 8]
push eax
push ecx
push 0
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40bbde
mov bl, 1
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
ret 0xc

Function at 0x40bc10
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x74
push ebx
push ebp
push esi
push edi
push str.PolicyNoTrayIcon
call fcn.004085b0
test eax, eax
mov ebp, dword [esp + 0x88]
push 0xfffffffffffffffa
push ebp
sete bl
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov esi, eax
mov ecx, 0x15
xor eax, eax
lea edi, [esp + 0x30]
mov dword [esp + 0x2c], 0x58
push 6
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push ebp
call edi
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push ebp
call edi
test bl, bl
je 0x40bcac
push 1
push esi
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 6
call fcn.0041bc30
push 0x40
mov dword [esp + 0x44], eax
lea eax, [esp + 0x48]
push eax
push 0x3ec
push esi
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0x2c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
push 0x40
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push 0xff
push 0xffffffffffffffff
lea edx, [esp + 0x94]
push 0
push edx
push 1
call edi
test eax, eax
je 0x40bd45
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
push 0
push 0
lea eax, [esp + 0x1c]
push 0
push eax
call esi
test eax, eax
je 0x40bd2c
lea ecx, [esp + 0x10]
push ecx
push ebp
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x40bd19
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push 0
push 0
lea ecx, [esp + 0x1c]
push 0
push ecx
call esi
test eax, eax
jne 0x40bcf3
push 0xff
push 0xffffffffffffffff
lea edx, [esp + 0x94]
push 0
push edx
push 1
call edi
test eax, eax
jne 0x40bce0
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
test bl, bl
je 0x40bd65
lea eax, [esp + 0x2c]
push eax
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 2
push ebp
call esi
push 9
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x74
ret 8
Function at 0x40bd80
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1a44
call fcn.0042d600
push ebx
push ebp
push esi
push edi
push str.LaunchMutex
mov byte [esp + 0x17], 0
call fcn.00408590
mov ebx, eax
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0x1c]
mov dword [esp + 0x18], 0x3c
lea edx, [esp + 0x254]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x1a64]
lea eax, [esp + 0x1a68]
push eax
xor ebp, ebp
push ecx
push edx
mov dword [esp + 0x20], ebp
call dword [sym.imp.USER32.dll_wvsprintfA]
mov esi, dword [esp + 0x1a60]
mov cl, 0x5c
cmp byte [esi], cl
jne 0x40be22
cmp byte [esi + 1], cl
jne 0x40be22
cmp byte [esi + 2], 0x3f
jne 0x40be1b
cmp byte [esi + 3], cl
jne 0x40be22
mov al, byte [esi + 4]
cmp al, 0x55
je 0x40be00
cmp al, 0x75
jne 0x40be22
mov al, byte [esi + 5]
cmp al, 0x4e
je 0x40be0b
cmp al, 0x6e
jne 0x40be22
mov al, byte [esi + 6]
cmp al, 0x43
je 0x40be16
cmp al, 0x63
jne 0x40be22
cmp byte [esi + 7], cl
jne 0x40be22
mov eax, 1
jmp 0x40be24
xor eax, eax
neg al
mov edi, dword [esp + 0x1a58]
lea ecx, [esp + 0x54]
sbb eax, eax
push 0x100
and eax, 0x80
push ecx
or eax, 0x441
push str..exe
mov dword [esp + 0x28], eax
lea eax, [esp + 0x260]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], eax
mov dword [esp + 0x40], 1
call fcn.0040bb90
test al, al
je 0x40be7e
lea edx, [esp + 0x54]
mov dword [esp + 0x40], edx
jmp 0x40be86
mov dword [esp + 0x40], str.exefile
cmp byte [ebx], 0
je 0x40be9a
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40bedd
mov eax, dword [esp + 0x50]
test eax, eax
je 0x40bf86
test byte [esp + 0x1a5c], 1
jne 0x40bed0
push eax
push edi
call fcn.0040bc10
mov eax, dword [esp + 0x50]
push eax
call ebx
mov byte [esp + 0x13], 1
jmp 0x40bf86
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
cmp eax, 0x4c7
je 0x40bf86
push 0
lea ecx, [esp + 0x658]
push 0x400
push ecx
push 0x400
call ebp
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
lea edx, [esp + 0x154]
push 0x100
push edx
push 0x3f3
push 0xfffffffffffffffa
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0x654]
lea ecx, [esp + 0x254]
push eax
push ecx
lea edx, [esp + 0x15c]
push esi
push edx
lea eax, [esp + 0xa64]
push 0x1000
push eax
call fcn.0041c640
add esp, 0x18
lea ecx, [esp + 0xa54]
push 0x10
push ecx
push edi
call fcn.00401100
lea edx, [esp + 0xa54]
push 0x1000
push edx
call fcn.0040bb70
lea eax, [esp + 0x254]
push 0x400
push eax
call fcn.0040bb70
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40bfa3
push eax
call ebx
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a44
ret
Function at 0x411310
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push 0
push ecx
mov dword [esp + 0x1c], eax
push eax
mov eax, dword [esi]
push edx
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41134b
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
pop esi
mov al, 1
mov dword [ecx], edx
pop ebx
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], eax
mov al, bl
pop esi
pop ebx
ret 0x10

Function at 0x411390
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push 0
push ecx
mov dword [esp + 0x1c], eax
push eax
mov eax, dword [esi]
push edx
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4113cb
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
pop esi
mov al, 1
mov dword [ecx], edx
pop ebx
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], eax
mov al, bl
pop esi
pop ebx
ret 0x10

Function at 0x411560
Capabilities:
Get file size

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x14]
lea eax, [esp + 0xc]
push edi
push eax
mov ecx, dword [esi]
xor bl, bl
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4115a3
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
je 0x41159f
call edi
mov dword [esi + 4], eax
pop edi
mov al, bl
pop esi
pop ebx
add esp, 8
ret 8
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
pop edi
pop esi
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov al, 1
pop ebx
add esp, 8
ret 8