joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e5b0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x49bc91
push eax
mov dword fs:[0], esp
sub esp, 0xec
push edi
mov edi, ecx
mov eax, dword [edi + 0x5c]
test eax, eax
jne 0x46e5ed
xor eax, eax
pop edi
mov ecx, dword [esp + 0xec]
mov dword fs:[0], ecx
add esp, 0xf8
ret
push esi
push 0x400
lea ecx, [esp + 0xc]
call fcn.00493218
push 0
push 0x1000
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x10c], 0
call fcn.00492560
lea ecx, [esp + 0x30]
mov byte [esp + 0xfc], 1
push ecx
mov ecx, dword [edi + 0x5c]
call fcn.00467560
lea ecx, [esp + 8]
call fcn.00493487
lea ecx, [esp + 0x30]
call fcn.004926c4
mov edx, dword [esp + 8]
push 0
push 0
lea ecx, [esp + 0x10]
call dword [edx + 0x28]
push 0
push 0x1000
lea eax, [esp + 0x10]
push 1
push eax
lea ecx, [esp + 0x84]
call fcn.00492560
lea ecx, [esp + 0x74]
lea esi, [edi + 0x60]
push ecx
mov ecx, esi
mov byte [esp + 0x100], 2
call fcn.004679d0
lea ecx, [esp + 0x74]
call fcn.004926c4
lea ecx, [esp + 8]
call fcn.00493488
mov eax, dword [edi + 0x5c]
lea edx, [esp + 0xb8]
push edx
push 0x3c
mov eax, dword [eax + 0xc8]
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
lea ecx, [esp + 0xb8]
push ecx
mov ecx, esi
call fcn.00465200
mov edx, dword [edi + 0x5c]
push 0xffffffffffffffff
mov ecx, esi
mov eax, dword [edx + 0xdc]
mov dword [esi + 0xdc], eax
call fcn.00467500
mov ecx, esi
call fcn.004680b0
mov eax, dword [edi + 0x5c]
push 0xffffffffffffffff
mov ecx, esi
mov eax, dword [eax + 0xe0]
mov dword [esi + 0xe0], eax
call fcn.00467500
mov ecx, esi
call fcn.004680b0
mov ecx, dword [edi + 0x5c]
push 0xffffffffffffffff
mov eax, dword [ecx + 0xe4]
mov ecx, esi
mov dword [esi + 0xe4], eax
call fcn.00467500
mov ecx, esi
call fcn.004680b0
mov ecx, dword [edi + 0x5c]
call fcn.004649e0
push eax
mov ecx, esi
call fcn.004649f0
mov ecx, dword [edi + 0x5c]
call fcn.00464fa0
push eax
mov ecx, esi
call fcn.00464f40
mov ecx, dword [edi + 0x5c]
call fcn.004650c0
push eax
mov ecx, esi
call fcn.00465070
mov ecx, dword [edi + 0x5c]
push 0
call fcn.004642c0
push eax
mov ecx, esi
call fcn.004642d0
mov edx, dword [edi + 0x7c]
push 1
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x74]
mov byte [esp + 0xfc], 1
call fcn.0049263c
lea ecx, [esp + 0x30]
mov byte [esp + 0xfc], 0
call fcn.0049263c
lea ecx, [esp + 8]
mov dword [esp + 0xfc], 0xffffffff
call fcn.004932a1
mov ecx, dword [esp + 0xf4]
pop esi
mov eax, 1
pop edi
mov dword fs:[0], ecx
add esp, 0xf8
ret
Function at 0x46fe60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x49beb7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], method.CMenu.virtual_0
mov dword [esi + 4], ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x16c], ebx
call fcn.0048961f
lea ecx, [esi + 0x24]
mov byte [esp + 0x16c], 1
call fcn.0048961f
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 7
mov byte [esp + 0x170], 2
mov dword [esi], method.CMenu.virtual_0
call edi
push 0xe
mov dword [esi + 0x2c], eax
call edi
push 0xf
mov dword [esi + 0x30], eax
call edi
push 4
mov dword [esi + 0x34], eax
call edi
push 0xd
mov dword [esi + 0x38], eax
call edi
push 0x14
mov dword [esi + 0x3c], eax
call edi
push 0x10
mov dword [esi + 0x40], eax
call edi
push 0x11
mov dword [esi + 0x44], eax
call edi
push 0xf
mov dword [esi + 0x48], eax
call edi
push 0x14
mov dword [esi + 0x4c], eax
call edi
push 0x10
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
mov eax, 0x14
mov ecx, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov ecx, 0x55
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0x29
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x20], 0x154
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
lea ecx, [esp + 0xb0]
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov ecx, esi
mov dword [esi + 0x10], eax
mov dword [esi + 8], ebx
call fcn.00470980
mov eax, esi
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret
Function at 0x4709d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x49bf90
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.004954c6
mov edi, dword [eax + 0xc]
xor ebp, ebp
cmp edi, ebp
jne 0x470a03
xor al, al
jmp 0x470b2f
mov ebx, dword [esp + 0x28]
push 0xf1
and ebx, 0xffff
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebp
jne 0x470a25
xor al, al
jmp 0x470b2f
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebp
jne 0x470a38
xor al, al
jmp 0x470b2f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebp
jne 0x470a4c
xor al, al
jmp 0x470b2f
xor eax, eax
xor ecx, ecx
mov ax, word [edi + 2]
push ebp
mov dword [esi + 0x14], eax
xor eax, eax
mov ax, word [edi + 4]
mov edx, dword [esi + 0x14]
mov dword [esi + 0x18], eax
mov cx, word [edi + 6]
push ecx
push 5
push eax
push edx
lea ecx, [esi + 0x1c]
call fcn.004896e4
test eax, eax
jne 0x470a80
xor al, al
jmp 0x470b2f
mov eax, dword [esi + 0x34]
push eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetBkColor]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 0x4cde04
mov dword [esp + 0x20], ebp
call fcn.004954c6
mov eax, dword [eax + 0xc]
push ebx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
lea ecx, [esp + 0x14]
call fcn.00492215
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x10]
push 0xc0c0c0
neg eax
sbb eax, eax
and eax, edx
push eax
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
lea ecx, [esp + 0x10]
call fcn.0049226c
xor ecx, ecx
lea ebx, [edi + 8]
cmp word [edi + 6], cx
jbe 0x470b14
mov ax, word [ebx]
test ax, ax
je 0x470b06
mov edx, ecx
inc ecx
mov dword [esp + 0x28], ecx
push eax
push edx
mov ecx, esi
call fcn.00470b50
mov ecx, dword [esp + 0x28]
xor edx, edx
inc ebp
mov dx, word [edi + 6]
add ebx, 2
cmp ebp, edx
jl 0x470aea
mov dword [esp + 0x10], method.CGdiObject.virtual_0
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 1
call fcn.0049226c
mov al, 1
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4

Function at 0x471090
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x50
push esi
mov esi, dword [esp + 0x58]
push edi
push eax
mov ecx, esi
call fcn.004938c5
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x4710d6
lea ecx, [esp + 8]
push 0x50
push ecx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 8]
push edx
call fcn.0047a018
mov ecx, dword [esp + 0x68]
add esp, 4
pop edi
mov dword [ecx], eax
pop esi
add esp, 0x50
ret 0xc
mov edx, dword [esp + 0x64]
lea ecx, [esp + 8]
mov eax, dword [edx]
push eax
push 0x4e8e04
push ecx
call fcn.0047b611
add esp, 0xc
lea edx, [esp + 8]
push edx
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
add esp, 0x50
ret 0xc
Function at 0x471280
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x4712e6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x4712e6
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x4712c7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x471670
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4716a8
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x472320
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x472369
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x4727e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49c250
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00472390
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00472410
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00472410
lea ecx, [esi + 0xc]
call fcn.0048b3aa
lea ecx, [esi + 0x10]
call fcn.0048b3aa
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004739a0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004739a0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004739a0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0048b41f
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0048b41f
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4747c0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x474863
test eax, eax
jbe 0x474863
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x474863
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x47480e
xor esi, esi
jmp 0x474814
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x47483f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.0040afe0
add esi, eax
push esi
mov ebx, esi
call fcn.0040afe0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x474820
pop ebp
test edi, edi
pop edi
jne 0x474863
test ebx, ebx
je 0x474863
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.0047aa80
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x4749a5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x474abd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x474abd
mov eax, dword [esi + 0x3c]
push eax
call fcn.0048ce32
mov esi, eax
test esi, esi
je 0x474abd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x474abd
mov ecx, esi
call fcn.00474910
cmp edi, eax
jge 0x474abd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x474a43
mov dword [esp + 0x34], 1
jmp 0x474a9e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x474abd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00473e80
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x48d7d5
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x48d80d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0048b87a
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0048b852
jmp 0x48d819
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x48efcc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x48f00e
call fcn.004954c6
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x48f00e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x48f005
xor eax, eax
jmp 0x48f016
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0048f01c
pop edi
pop esi
pop ebx
ret 4

Function at 0x4959f6
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x495a24
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x495a42
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0049595c
jmp 0x495a42
mov eax, dword [esi + 0x14]
test eax, eax
je 0x495a42
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0049595c
test edi, edi
mov eax, edi
jne 0x495a2c
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x452360
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x44a015
lea edi, [esi - 0x49015]
push edi
jmp 0x45237a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x452381
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x452370
mov eax, 1
add ebx, ebx
jne 0x452393
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x452388
jne 0x4523a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x452388
xor ecx, ecx
sub eax, 3
jb 0x4523b8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45242a
mov ebp, eax
add ebx, ebx
jne 0x4523c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4523d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4523f4
inc ecx
add ebx, ebx
jne 0x4523e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4523d5
jne 0x4523f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4523d5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x452414
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x452405
jmp 0x452376
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x452414
add edi, ecx
jmp 0x452376
pop esi
mov edi, esi
mov ecx, 0x502
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x452432
cmp byte [edi], 7
jne 0x452432
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x452437
lea edi, [esi + 0x50000]
mov eax, dword [edi]
or eax, eax
je 0x4524a6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x52000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5203c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x452464
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x52040]
or eax, eax
je 0x4524a0
mov dword [ebx], eax
add ebx, 4
jmp 0x452481
call dword [esi + 0x52050]
mov ebp, dword [esi + 0x52044]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4524da
sub esp, 0xffffff80
jmp 0x40e690
Function at 0x4195ec
Capabilities:
Terminate process

Disassembly:
call fcn.004195f9
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x40102a
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ebx
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xor ebx, ebx
pop ecx
test eax, eax
je 0x401078
push str.Windows_original_main_args:_n
call fcn.004010f9
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
mov esi, ebx
pop ecx
call edi
cmp dword [eax], ebx
jle 0x401078
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argv]
mov eax, dword [eax]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.004010f9
add esp, 0xc
inc esi
call edi
cmp esi, dword [eax]
jl 0x401058
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
mov edi, eax
lea ecx, [edi*4 + 4]
push ecx
call sub.jli.dll_JLI_MemAlloc
pop ecx
pop ecx
mov esi, eax
call sub.jli.dll_JLI_GetStdArgs
mov edx, ebx
test edi, edi
jle 0x4010b2
mov ecx, dword [eax + edx*8]
mov dword [esi + edx*4], ecx
inc edx
cmp edx, edi
jl 0x4010a7
mov ecx, dword [str.java]
mov dword [esi + edx*4], ebx
test ecx, ecx
jne 0x4010c1
mov ecx, dword [esi]
mov eax, dword [section..data]
test eax, eax
jne 0x4010cc
mov eax, dword [esi]
push ebx
push ebx
push ebx
push 1
push ecx
push eax
push 0x4021bc
push 0x4021c0
push 0x40300c
push 2
push 0x403004
push 2
push esi
push edi
call sub.jli.dll_JLI_Launch
add esp, 0x38
pop edi
pop esi
pop ebx
ret
Function at 0x401068
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
mov byte [ebp - 4], 0x43
jmp 0x4010a2
lea eax, [ebp - 3]
mov bl, byte [ebp - 4]
mov byte [eax], bl
mov byte [eax + 1], 0x3a
mov byte [eax + 2], 0
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
jne 0x40109f
push 0
mov al, byte [ebp - 4]
movzx ax, al
push ax
call fcn.00401000
inc byte [ebp - 4]
cmp byte [ebp - 4], 0x5a
jbe 0x401074
leave
ret

Function at 0x4010aa
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9f0
mov dword [ebp - 0x610], 0
mov dword [ebp - 0x20c], 0
push 0
push 0
push 0
push 0
push str.MyAgent
call sub.wininet.dll_InternetOpenA
or eax, eax
je 0x401176
mov dword [ebp - 4], eax
push str.2b603ad7_b91c_4e41_9c2e_676c1546c318
push str.https:__sse.hit.edu.cn_test_api
push str._s_ping_machine_id_s
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_wsprintfA
add esp, 0x10
push 0
push 0x80000000
push 0
push 0
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 4]
call sub.wininet.dll_InternetOpenUrlA
or eax, eax
je 0x40116e
mov dword [ebp - 8], eax
lea eax, [ebp - 0x610]
push eax
push 0x3ff
lea eax, [ebp - 0x60c]
push eax
push dword [ebp - 8]
call sub.wininet.dll_InternetReadFile
cmp dword [ebp - 0x610], 0
jbe 0x401166
mov dword [ebp - 0x20c], 1
lea eax, [ebp - 0x60c]
cmp dword [eax], 0x74697865
jne 0x401166
push 0
call sub.kernel32.dll_ExitProcess
push dword [ebp - 8]
call sub.wininet.dll_InternetCloseHandle
push dword [ebp - 4]
call sub.wininet.dll_InternetCloseHandle
leave
ret

Function at 0x40124d
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push 0x40303c
push 1
push 0
call sub.kernel32.dll_CreateMutexA
or eax, eax
je 0x4012b6
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x4012b6
push 0
push str.FE3E5BBA_6AA2_E7FC_ECD3_8B5ECDB89F8A
call sub.user32.dll_FindWindowA
or eax, eax
je 0x401294
mov dword [ebp - 0x48], eax
push 0
push 0
push 0x10
push dword [ebp - 0x48]
call sub.user32.dll_SendMessageA
jmp 0x4012b6
call sub.user32.dll_GetActiveWindow
mov ecx, eax
push 0x10
push 0x403070
push 0x403040
push ecx
call sub.user32.dll_MessageBoxA
mov eax, 1
leave
ret 0x10
call fcn.004010aa
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0x401178
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
push dword [ebp + 8]
pop dword [ebp - 0x18]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], str.FE3E5BBA_6AA2_E7FC_ECD3_8B5ECDB89F8A
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_RegisterClassA
xor edi, edi
push edi
push dword [ebp + 8]
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push str.FE3E5BBA_6AA2_E7FC_ECD3_8B5ECDB89F8A
push 0
call sub.user32.dll_CreateWindowExA
push 0
push 0
push 0
lea eax, [ebp - 0x44]
push eax
call sub.user32.dll_GetMessageA
cmp eax, 0
je 0x40134b
lea eax, [ebp - 0x44]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x44]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x401323
mov eax, dword [ebp - 0x3c]
leave
ret 0x10
Function at 0x10004680
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100046fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword fs:[0x2c]
mov edi, eax
mov edx, dword [0x1008813c]
mov edx, dword [ecx + edx*4]
mov ecx, dword [0x10088e30]
cmp ecx, dword [edx + 4]
jle 0x100046ed
push 0x10088e30
call fcn.10045e7c
add esp, 4
cmp dword [0x10088e30], esi
jne 0x100046ed
push 0x1006f400
call fcn.1004632a
add esp, 4
push 0x10088e30
call fcn.10045e2b
add esp, 4
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0x10086bc8
test edi, edi
jne 0x10004705
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, 0x10079708
lea ecx, [esp + 8]
call fcn.100042f0
int3

Function at 0x10004920
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
mov esi, dword [ebp + 0x10]
push edi
cmp dword [esi + 4], 0x5b0
jne 0x1000495e
push str.GuildedCapture_message_hook_enter
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [0x10088e60]
mov eax, dword [esi + 0xc]
test ecx, ecx
je 0x10004959
cmp ecx, eax
je 0x1000495e
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
jmp 0x1000495e
mov dword [0x10088e60], eax
cmp dword [esi], 0
je 0x100049bf
call fcn.10024500
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1008813c]
mov edi, dword [esi]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1008950c]
cmp eax, dword [ecx + 4]
jle 0x100049b8
push 0x1008950c
call fcn.10045e7c
add esp, 4
cmp dword [0x1008950c], 0xffffffff
jne 0x100049b8
call fcn.1001b650
push 0x1006faa0
call fcn.1004632a
push 0x1008950c
call fcn.10045e2b
add esp, 8
mov eax, 0x100895c4
xchg dword [eax], edi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
call dword [sym.imp.USER32.dll_CallNextHookEx]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc