joyce8/EMBER2024-capa huggingface dataset:
Function at 0x95ed20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x95ed58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x95ed60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x95ed94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x95ed94
push eax
push esi
call fcn.0096120b
add esp, 8
pop esi
ret 0x10

Function at 0x95eda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x95ee22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x95ee15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x977320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00960dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x95edda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x95ee30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x95eec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x95eeb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x977320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00960dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x95eeab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x95ee6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x95f000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x95f131
push esi
call fcn.00962145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00951080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x95f131
push 0
push ebp
call fcn.009513a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00951260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x95f08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.009512f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x95f121
push 0x977918
push edi
call fcn.009603f0
push eax
push ebx
push esi
call fcn.0095ef60
push 0x9778f8
push edi
call fcn.009603f0
push eax
push ebx
push esi
call fcn.0095ef60
push 0x9778d8
push edi
call fcn.009603f0
push eax
push ebx
push esi
call fcn.0095ef60
push 0x9778c0
push edi
call fcn.009603f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.0095ef60
push 0x9778a0
push edi
call fcn.009603f0
push eax
push ebx
push esi
call fcn.0095ef60
push 0x977888
push edi
call fcn.009603f0
push eax
push ebx
push esi
call fcn.0095ef60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x9601b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00960140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00960140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00960140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00960140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x960bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x960c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x97287c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x960c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x960c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x401040
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x70
mov eax, dword [0x453810]
xor eax, esp
mov dword [esp + 0x6c], eax
mov eax, dword [0x45827c]
test eax, eax
je 0x4011c9
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 8]
push ecx
push 8
push str.MMCARC00
push eax
call esi
mov eax, dword [0x45827c]
push 0
lea edx, [esp + 8]
push edx
push 4
push 0x457e74
push eax
call esi
mov eax, dword [0x45827c]
push 0
lea ecx, [esp + 8]
push ecx
push 4
lea edx, [esp + 0x14]
push edx
push eax
mov dword [esp + 0x1c], 2
call esi
mov ecx, dword [section..data]
push ecx
lea edx, [esp + 0x10]
push str.A_7.7X
push edx
call fcn.0042acb4
mov edx, dword [0x45827c]
add esp, 0xc
push 0
lea eax, [esp + 8]
push eax
push 8
lea ecx, [esp + 0x18]
push ecx
push edx
call esi
mov ecx, dword [0x45827c]
push 0
lea eax, [esp + 8]
push eax
push 3
push 0x458a50
push ecx
call esi
mov ecx, dword [0x45827c]
xor eax, eax
push eax
lea edx, [esp + 8]
push edx
mov dword [esp + 0x14], eax
mov byte [esp + 0x18], al
push 5
lea eax, [esp + 0x18]
push eax
push ecx
call esi
mov eax, dword [0x45827c]
push 0
lea edx, [esp + 8]
push edx
push 8
push str.MMCARC00
push eax
call esi
mov edx, dword [0x45827c]
push 0
lea ecx, [esp + 8]
push ecx
push 4
push 0x457e74
push edx
call esi
mov dword [esp + 8], 2
push 0
mov edx, dword [0x45827c]
lea eax, [esp + 8]
push eax
push 4
lea ecx, [esp + 0x14]
push ecx
push edx
call esi
mov eax, dword [section..data]
push eax
lea ecx, [esp + 0x10]
push str.A_7.7X
push ecx
call fcn.0042acb4
mov ecx, dword [0x45827c]
add esp, 0xc
push 0
lea edx, [esp + 8]
push edx
push 8
lea eax, [esp + 0x18]
push eax
push ecx
call esi
mov eax, dword [0x45827c]
push 0
lea edx, [esp + 8]
push edx
push 3
push 0x458a50
push eax
call esi
xor eax, eax
push eax
lea ecx, [esp + 8]
push ecx
push 5
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], al
mov eax, dword [0x45827c]
lea edx, [esp + 0x18]
push edx
push eax
mov byte [esp + 0x23], 0x55
mov byte [esp + 0x24], 0xaa
call esi
pop esi
mov ecx, dword [esp + 0x6c]
xor ecx, esp
call fcn.0042ad70
add esp, 0x70
ret
Function at 0x4011e0
Capabilities:
Move file

Disassembly:
mov eax, dword [0x458268]
mov eax, dword [eax*4 + 0x45826c]
mov edx, 0x457a88
sub esp, 0x20
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4011f6
mov eax, 0x457a88
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401208
sub eax, edx
cmp byte [eax + 0x457a87], 0x5c
je 0x401234
push edi
mov edi, 0x457a88
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401221
mov cx, word [0x442718]
mov word [edi], cx
pop edi
mov eax, 0x457a88
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401240
sub eax, edx
cmp dword [0x451018], 1
push esi
mov esi, eax
jne 0x4012f2
mov ecx, dword [0x458e60]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
push ecx
call fcn.0040ba60
mov ecx, dword [0x458edc]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.0040ba60
mov edx, dword [esp + 0x1c]
movzx eax, byte [esp + 0x20]
movzx ecx, byte [esp + 0x21]
push 0x458a50
push 0x45cf7c
push edx
movzx edx, byte [esp + 0x32]
push eax
movzx eax, byte [esp + 0x35]
push ecx
movzx ecx, byte [esp + 0x38]
push edx
mov edx, dword [esp + 0x44]
push eax
movzx eax, byte [esp + 0x4c]
push ecx
movzx ecx, byte [esp + 0x51]
push edx
movzx edx, byte [esp + 0x5a]
push eax
movzx eax, byte [esp + 0x5d]
push ecx
movzx ecx, byte [esp + 0x60]
push edx
mov edx, dword [0x458e48]
push eax
push ecx
push edx
lea eax, [esi + 0x457a88]
push str.A_7.7X__2.2d_2.2d_2.2d_2.2d_2.2d_4.4d__2.2d_2.2d_2.2d_2.2d_2.2d_4.4d__s._3.3s
push eax
call fcn.0042acb4
add esp, 0x5c
jmp 0x401324
mov ecx, dword [0x458edc]
mov edx, dword [0x458e60]
mov eax, dword [0x458e48]
push 0x458a50
push 0x45cf7c
push ecx
push edx
push eax
lea ecx, [esi + 0x457a88]
push str.A_7.7X__8.8X__8.8X__s._3.3s
push ecx
call fcn.0042acb4
add esp, 0x1c
push 0x457a88
push 0x454f90
call dword [sym.imp.KERNEL32.dll_MoveFileA]
pop esi
add esp, 0x20
ret
Function at 0x401340
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x6c
mov eax, dword [0x453810]
xor eax, esp
mov dword [esp + 0x68], eax
mov eax, dword [0x45827c]
test eax, eax
je 0x40138f
mov ecx, dword [0x457e70]
test ecx, ecx
jle 0x40137a
push 0
lea edx, [esp + 4]
push edx
push ecx
push 0x455378
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [0x45827c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x458e64], 0
je 0x40138f
call fcn.004011e0
mov eax, dword [0x458268]
cmp eax, 0xffffffff
je 0x4014ae
mov eax, dword [eax*4 + 0x45826c]
mov edx, 0x454f90
sub edx, eax
jmp 0x4013b0
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4013b0
mov eax, 0x454f90
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4013c2
sub eax, edx
cmp byte [eax + 0x454f8f], 0x5c
je 0x4013f2
push edi
mov edi, 0x454f90
dec edi
jmp 0x4013e0
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4013e0
mov ax, word [0x442718]
mov word [edi], ax
pop edi
mov eax, 0x454f90
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401400
mov ecx, dword [section..data]
push 0x458a50
push ecx
sub eax, edx
lea edx, [eax + 0x454f90]
push str.A_7.7X._3.3s
push edx
call fcn.0042acb4
add esp, 0x10
push 0
push 0
push 1
push 0
push 1
push 0x40000000
push 0x454f90
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x45827c], eax
test eax, eax
je 0x40149a
call fcn.00401040
mov eax, dword [section..data]
mov ecx, dword [0x458edc]
mov dword [0x458e48], eax
inc eax
push eax
lea edx, [esp + 8]
push 0x442734
push edx
mov dword [0x458e60], ecx
mov dword [section..data], eax
call fcn.0042acb4
add esp, 0xc
push 0x458a60
lea eax, [esp + 8]
push eax
push str.CURRENTFILENUM
push str.WORK
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov dword [0x454f8c], 0
mov dword [0x457e70], 0
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.0042ad70
add esp, 0x6c
ret
Function at 0x402a30
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push edi
cmp dword [esi + 0xca0], ebp
jne 0x402b54
mov eax, dword [esi + 0xc4c]
test eax, eax
jg 0x402a55
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
cmp dword [esi + 0xc20], ebp
ja 0x402a97
mov dword [esi + 0xc20], eax
cmp eax, 0x3e8
jbe 0x402a74
mov dword [esi + 0xc20], 0x3e8
xor edi, edi
cmp dword [esi + 0xc20], edi
jbe 0x402a97
mov edi, edi
mov ecx, esi
call fcn.00402870
mov byte [esi + edi + 0x838], al
inc edi
cmp edi, dword [esi + 0xc20]
jb 0x402a80
mov ecx, dword [esi + 0xc20]
mov edx, dword [esi + 0xc68]
lea eax, [esi + 0xc8c]
push eax
lea edi, [esi + 0xca4]
push edi
push ecx
lea ebx, [esi + 0x838]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x402af9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x402ae0
push str.err1_r_n
call fcn.0042aec0
add esp, 4
jmp 0x402b54
push str.Wait_r_n
mov dword [esi + 0xca0], 1
call fcn.0042aec0
add esp, 4
jmp 0x402b54
push str.Immidiately_r_n
call fcn.0042aec0
mov eax, dword [esi + 0xc20]
mov ecx, dword [edi]
add esp, 4
cmp eax, ecx
jne 0x402b1a
mov dword [esi + 0xc20], ebp
jmp 0x402b43
sub eax, ecx
mov dword [esi + 0xc20], eax
xor eax, eax
test ecx, ecx
jbe 0x402b43
jmp 0x402b30
mov ecx, dword [edi]
add ecx, eax
mov dl, byte [ecx + esi + 0x838]
mov byte [ebx + eax], dl
inc eax
cmp eax, dword [edi]
jb 0x402b30
mov eax, dword [esi + 0xc6c]
add dword [esi + 0xc5c], eax
mov ebp, 1
xor ebx, ebx
cmp dword [esi + 0xca0], ebx
je 0x402c02
mov ecx, dword [esi + 0xc9c]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esi + 0xca8], eax
cmp eax, ebx
jne 0x402c02
mov eax, dword [esi + 0xc68]
push ebx
lea edi, [esi + 0xca4]
push edi
lea edx, [esi + 0xc8c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x402c02
push str.Completed__r_n
call fcn.0042aec0
mov eax, dword [esi + 0xc20]
mov ecx, dword [edi]
add esp, 4
cmp eax, ecx
jne 0x402bcf
pop edi
mov dword [esi + 0xc20], ebx
mov ebp, 1
mov dword [esi + 0xca0], ebx
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
sub eax, ecx
mov dword [esi + 0xc20], eax
xor eax, eax
cmp ecx, ebx
jbe 0x402bf7
lea ecx, [ecx]
mov ecx, dword [edi]
add ecx, eax
mov dl, byte [ecx + esi + 0x838]
mov byte [esi + eax + 0x838], dl
inc eax
cmp eax, dword [edi]
jb 0x402be0
mov ebp, 1
mov dword [esi + 0xca0], ebx
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
Function at 0x402a32
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push edi
cmp dword [esi + 0xca0], ebp
jne 0x402b54
mov eax, dword [esi + 0xc4c]
test eax, eax
jg 0x402a55
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
cmp dword [esi + 0xc20], ebp
ja 0x402a97
mov dword [esi + 0xc20], eax
cmp eax, 0x3e8
jbe 0x402a74
mov dword [esi + 0xc20], 0x3e8
xor edi, edi
cmp dword [esi + 0xc20], edi
jbe 0x402a97
mov edi, edi
mov ecx, esi
call fcn.00402870
mov byte [esi + edi + 0x838], al
inc edi
cmp edi, dword [esi + 0xc20]
jb 0x402a80
mov ecx, dword [esi + 0xc20]
mov edx, dword [esi + 0xc68]
lea eax, [esi + 0xc8c]
push eax
lea edi, [esi + 0xca4]
push edi
push ecx
lea ebx, [esi + 0x838]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x402af9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x402ae0
push str.err1_r_n
call fcn.0042aec0
add esp, 4
jmp 0x402b54
push str.Wait_r_n
mov dword [esi + 0xca0], 1
call fcn.0042aec0
add esp, 4
jmp 0x402b54
push str.Immidiately_r_n
call fcn.0042aec0
mov eax, dword [esi + 0xc20]
mov ecx, dword [edi]
add esp, 4
cmp eax, ecx
jne 0x402b1a
mov dword [esi + 0xc20], ebp
jmp 0x402b43
sub eax, ecx
mov dword [esi + 0xc20], eax
xor eax, eax
test ecx, ecx
jbe 0x402b43
jmp 0x402b30
mov ecx, dword [edi]
add ecx, eax
mov dl, byte [ecx + esi + 0x838]
mov byte [ebx + eax], dl
inc eax
cmp eax, dword [edi]
jb 0x402b30
mov eax, dword [esi + 0xc6c]
add dword [esi + 0xc5c], eax
mov ebp, 1
xor ebx, ebx
cmp dword [esi + 0xca0], ebx
je 0x402c02
mov ecx, dword [esi + 0xc9c]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esi + 0xca8], eax
cmp eax, ebx
jne 0x402c02
mov eax, dword [esi + 0xc68]
push ebx
lea edi, [esi + 0xca4]
push edi
lea edx, [esi + 0xc8c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x402c02
push str.Completed__r_n
call fcn.0042aec0
mov eax, dword [esi + 0xc20]
mov ecx, dword [edi]
add esp, 4
cmp eax, ecx
jne 0x402bcf
pop edi
mov dword [esi + 0xc20], ebx
mov ebp, 1
mov dword [esi + 0xca0], ebx
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
sub eax, ecx
mov dword [esi + 0xc20], eax
xor eax, eax
cmp ecx, ebx
jbe 0x402bf7
lea ecx, [ecx]
mov ecx, dword [edi]
add ecx, eax
mov dl, byte [ecx + esi + 0x838]
mov byte [esi + eax + 0x838], dl
inc eax
cmp eax, dword [edi]
jb 0x402be0
mov ebp, 1
mov dword [esi + 0xca0], ebx
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret

Function at 0x404325
Capabilities:
Read file on windows

Disassembly:
push 0x800
push 0
push 0x458f98
call fcn.0042b3f0
mov eax, dword [esp + 0x10]
add esp, 0xc
push 0
push 0
push 3
push 0
push 0
push SysReAllocString
push eax
mov dword [0x458f90], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x458f94], eax
test eax, eax
je 0x404381
push 0
lea ecx, [esp + 8]
push ecx
push 0x800
push 0x458f98
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [0x458f94]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret
Function at 0x404390
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [0x458f90]
push 0
push 0
push 4
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x458f94], eax
test eax, eax
je 0x4043da
push 0
lea ecx, [esp + 4]
push ecx
push 0x800
push 0x458f98
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [0x458f94]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret

Function at 0x407ff0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x6c
mov eax, dword [0x453810]
xor eax, esp
mov dword [esp + 0x68], eax
mov eax, dword [0x459fe4]
test eax, eax
je 0x408031
mov ecx, dword [0x459fe8]
test ecx, ecx
jle 0x40802a
push 0
lea edx, [esp + 4]
push edx
push ecx
push 0x459ff0
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [0x459fe4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00407eb0
test eax, eax
jne 0x408077
mov eax, dword [0x451d78]
inc eax
push eax
mov dword [0x451d78], eax
lea eax, [esp + 8]
push 0x442734
push eax
call fcn.0042acb4
add esp, 0xc
push 0x45caf0
lea ecx, [esp + 8]
push ecx
push str.CURRENTFILENUM
push str.WORK
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
call fcn.00407d40
call fcn.00407d80
call fcn.00407e10
mov dword [0x45c704], 0
mov dword [0x459fe8], 0
call fcn.00407d60
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.0042ad70
add esp, 0x6c
ret

Function at 0x408390
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 4], 2
je 0x40839e
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esi + 0x4e3c]
cmp eax, dword [esi + 0x4e40]
jne 0x4083c4
test eax, eax
je 0x4083c4
mov dword [esi + 0x4e3c], 0
mov dword [esi + 0x4e40], 0
mov ecx, dword [esi + 0x4e3c]
mov eax, dword [esi + 0x4e34]
sub eax, ecx
test eax, eax
jle 0x4083f1
push 0
push eax
mov eax, dword [esi + 8]
lea ecx, [ecx + esi + 0x14]
push ecx
push eax
call sub.WS2_32.dll_recv
test eax, eax
jle 0x4083f1
add dword [esi + 0x4e3c], eax
xor eax, eax
pop esi
ret

Function at 0x408400
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 4], 2
je 0x40840e
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esi + 0x4e44]
push edi
xor edi, edi
cmp eax, edi
je 0x40845a
mov ecx, dword [esi + 0x4e48]
cmp eax, ecx
je 0x40844e
sub eax, ecx
push edi
push eax
mov eax, dword [esi + 8]
lea ecx, [ecx + esi + 0x2724]
push ecx
push eax
call sub.WS2_32.dll_send
add dword [esi + 0x4e48], eax
mov eax, dword [esi + 0x4e48]
cmp dword [esi + 0x4e44], eax
jne 0x40845a
mov dword [esi + 0x4e48], edi
mov dword [esi + 0x4e44], edi
pop edi
xor eax, eax
pop esi
ret
Function at 0x40a1b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40a1c9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40a204
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x40a200
lea ebx, [ebx]
cmp esi, eax
jae 0x40a204
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x40a1f0
cmp esi, eax
jb 0x40a20a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x40ca44
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x40ca68
cmp dword [edi + 0x54], 0
jne 0x40ca68
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0041a23e
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0040ca05
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41233b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x412382
call fcn.0041a23e
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x412382
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x41239e
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00411eb5
mov esi, eax
test edi, edi
je 0x41239c
test ebx, ebx
je 0x41239c
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4131a4
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x440354
call fcn.0042c0bd
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x4131c9
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x41320f
lea ecx, [ebp - 0x10]
call fcn.00409560
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00412a87
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00406c10
mov eax, esi
call fcn.0042c195
ret 8