joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10025ae3
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push dword [ebp + 8]
mov esi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jne 0x10025b38
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x10025b38
push esi
push 0x115
push str.fileutil.cpp
call fcn.10025ae0
jmp 0x10025bdf
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
jne 0x10025b53
mov esi, 0x8007000e
push esi
push 0x119
jmp 0x10025b29
push edi
push ebx
push dword [ebp - 4]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x10025b8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x10025b8e
push esi
push 0x11d
push str.fileutil.cpp
call fcn.10025ae0
jmp 0x10025bd8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x1002e14c
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x10025bc5
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x10025bc5
push esi
push 0x122
jmp 0x10025b82
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [edx + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov edx, dword [edx + 0xc]
mov dword [ecx], edx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402050
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2020
call fcn.0040dfa0
mov eax, dword [0x418070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x1fff
lea eax, [ebp - 0x200f]
mov dword [ebp - 0x2014], ecx
push 0
push eax
mov edi, edx
mov byte [ebp - 0x201d], 0
mov byte [ebp - 0x2010], 0
call fcn.0040b4a0
add esp, 0xc
mov dword [edi + 0x10], 0
cmp dword [edi + 0x14], 0x10
jb 0x4020a6
mov eax, dword [edi]
jmp 0x4020a8
mov eax, edi
push 0
push 0
push 0
push 1
push 0
mov byte [eax], 0
call dword [0x411118]
mov ebx, eax
test ebx, ebx
jne 0x4020d3
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004023f3
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [0x411114]
lea eax, [ebp - 0x2018]
push 4
push eax
push 2
push ebx
mov dword [ebp - 0x2018], 0x3a98
call esi
push 4
lea eax, [ebp - 0x2018]
push eax
push 5
push ebx
call esi
push 4
lea eax, [ebp - 0x2018]
push eax
push 6
push ebx
call esi
mov eax, dword [ebp - 0x2014]
cmp dword [eax + 0x14], 0x10
jb 0x40211c
mov eax, dword [eax]
push 0
push 0x84000002
push 0
push 0
push eax
push ebx
call dword [0x411120]
mov esi, eax
test esi, esi
je 0x40222b
push 0
lea eax, [ebp - 0x201c]
mov byte [ebp - 0x10], 0
push eax
lea eax, [ebp - 0x10]
mov byte [ebp - 7], 0
push eax
push 0x13
xorps xmm0, xmm0
mov dword [ebp - 0x201c], 0xa
push esi
movq qword [ebp - 0xf], xmm0
call dword [0x41110c]
test eax, eax
je 0x402224
lea eax, [ebp - 0x10]
push eax
call fcn.00403d9d
add esp, 4
cmp eax, 0xc8
jne 0x402224
push 0x2000
lea eax, [ebp - 0x2010]
push 0
push eax
call fcn.0040b4a0
add esp, 0xc
mov dword [ebp - 0x2014], 0
lea eax, [ebp - 0x2014]
push eax
push 0x2000
lea eax, [ebp - 0x2010]
push eax
push esi
call dword [0x411110]
test eax, eax
je 0x40221d
mov eax, dword [ebp - 0x2014]
test eax, eax
je 0x402249
push eax
lea eax, [ebp - 0x2010]
mov ecx, edi
push eax
call fcn.00401f00
push 0x2000
lea eax, [ebp - 0x2010]
push 0
push eax
call fcn.0040b4a0
add esp, 0xc
mov dword [ebp - 0x2014], 0
lea eax, [ebp - 0x2014]
push eax
push 0x2000
lea eax, [ebp - 0x2010]
push eax
push esi
call dword [0x411110]
test eax, eax
jne 0x4021c6
mov byte [ebp - 0x201d], 0
push esi
call dword [0x41111c]
push ebx
call dword [0x41111c]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x201d]
xor ecx, ebp
pop esi
pop edi
pop ebx
call fcn.004023f3
mov esp, ebp
pop ebp
ret
mov byte [ebp - 0x201d], 1
jmp 0x402224
Function at 0x4028f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x402924
push 6
call fcn.00450cac
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x402998
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402946
mov eax, 0x484331
push eax
push 1
mov ebx, 0x25c
call fcn.00457b00
add esp, 0x10
mov dword [ebp - 4], eax
push 0x80000301
push 0
push 0x20
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc4
call fcn.00457b10
add esp, 0x1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x4029a2
mov eax, 0
jmp 0x4029a2
mov esp, ebp
pop ebp
ret 4

Function at 0x4029ef
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push reloc.WS2_32.dll_getsockname
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x9dc
call fcn.00457250
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x402a57
push 6
call fcn.00450cac
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
jne 0x402a95
cmp dword [ebp - 4], 0
je 0x402a90
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x402a90
push 6
call fcn.00450cac
add esp, 4
jmp 0x402a9d
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
cmp dword [ebp - 4], 0
mov eax, 0
setne al
jmp 0x402aae
mov esp, ebp
pop ebp
ret 0x14
Function at 0x402ab4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push 3
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402af1
mov eax, 0x484331
push eax
push 3
mov ebx, 0x270
call fcn.00457b30
add esp, 0x28
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402bd7
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x278
call fcn.00457c10
add esp, 0x10
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402b42
mov eax, 0x484331
push eax
push 1
mov ebx, 0x244
call fcn.00457900
add esp, 0x10
call fcn.00401922
mov dword [ebp - 8], eax
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402b72
mov eax, 0x484331
push eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x402b86
mov eax, 0x484331
push eax
push 2
mov ebx, 0x23c
call fcn.00457910
add esp, 0x1c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402ba9
push ebx
call fcn.00450ca6
add esp, 4
mov dword [ebp - 8], esp
push 5
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WinExec]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x402bd2
push 6
call fcn.00450cac
add esp, 4
jmp 0x402c6a
push dword [ebp + 8]
call fcn.004028f0
and eax, 1
xor eax, 1
test eax, eax
je 0x402c41
call fcn.00401922
mov dword [ebp - 8], eax
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x402c0a
mov eax, 0x484331
push eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x402c1e
mov eax, 0x484331
push eax
push 2
mov ebx, 0x23c
call fcn.00457910
add esp, 0x1c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402c41
push ebx
call fcn.00450ca6
add esp, 4
mov dword [ebp - 8], esp
push 5
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WinExec]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x402c6a
push 6
call fcn.00450cac
add esp, 4
push 0x71f2fa
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x90]
mov esp, ebp
pop ebp
ret 4
Function at 0x406cc6
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
push 8
call fcn.00450ca0
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.00450ca0
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x10], 0
push 0x10
call fcn.00450ca0
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x406d75
push 6
call fcn.00450cac
add esp, 4
mov dword [ebp - 0x1c], eax
push 0x80000301
push 0
push 8
push 0x80000301
push 0
push 0x20
push 2
mov ebx, 0xc8
call fcn.00457330
add esp, 0x1c
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], esp
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
nop
nop
nop
nop
cmp dword [ebp - 0x24], esp
je 0x406dce
push 6
call fcn.00450cac
add esp, 4
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00457390
add esp, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esp
push dword [ebp - 8]
push str.SeDebugPrivilege
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
nop
nop
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x406e19
push 6
call fcn.00450cac
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x406e29
push ebx
call fcn.00450ca6
add esp, 4
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0xc]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 8]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0xc]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov dword [ebp - 0x18], esp
mov eax, 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
push 0x1c
push dword [ebp - 0xc]
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x406ebd
push 6
call fcn.00450cac
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x406ee2
push 6
call fcn.00450cac
add esp, 4
mov eax, dword [ebp - 0x10]
jmp 0x406eea
push eax
mov ebx, dword [ebp - 8]
push ebx
call fcn.00450ca6
add esp, 4
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.00450ca6
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.00450ca6
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x407a2d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x200
push 1
mov ebx, 0x184
call fcn.00457350
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x407a72
push ebx
call fcn.00450ca6
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0x200
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x407a9d
push 6
call fcn.00450cac
add esp, 4
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x407abc
mov eax, 0x484331
push eax
push 2
mov ebx, 0x138
call fcn.00457880
add esp, 0x1c
mov dword [ebp - 8], eax
push 0x80000101
push 0
push 0x5c
push 1
mov ebx, 0x140
call fcn.00457390
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push dword [ebp - 8]
call fcn.004020ae
add esp, 8
cmp eax, 0
mov eax, 0
setne al
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x407b20
push ebx
call fcn.00450ca6
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x407b30
push ebx
call fcn.00450ca6
add esp, 4
push 0x80000101
push 0
push 0x5c
push 1
mov ebx, 0x140
call fcn.00457390
add esp, 0x10
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push dword [ebp - 4]
mov ecx, 2
call fcn.004010e6
add esp, 8
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x407b77
push ebx
call fcn.00450ca6
add esp, 4
cmp dword [ebp - 0x10], 0
je 0x407ba2
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x407b9d
push eax
mov ebx, eax
call fcn.0040107b
inc eax
push eax
call fcn.00450ca0
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x407bbe
mov eax, dword [ebp - 4]
test eax, eax
je 0x407bbe
push eax
mov ebx, eax
call fcn.0040107b
inc eax
push eax
call fcn.00450ca0
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x407bd1
push ebx
call fcn.00450ca6
add esp, 4
mov eax, dword [ebp - 0x1c]
jmp 0x407bd9
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x407bea
push ebx
call fcn.00450ca6
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x40c024
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 1
jne 0x40c0bc
fild dword [ebp + 0x10]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fmul qword [0x4b2057]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fild dword [ebp + 0xc]
fstp qword [ebp - 0x20]
fdiv qword [ebp - 0x20]
fstp qword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
fld qword [ebp - 8]
fsub qword [0x4b2057]
fcomp qword [0x4b1c4f]
fnstsw ax
test ah, 0x41
jne 0x40c09a
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0x40590000
push 1
fld qword [ebp - 8]
call fcn.00401142
push eax
push 0x71f316
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x190]
jmp 0x40c1d4
cmp dword [ebp + 8], 0
je 0x40c0d4
cmp dword [ebp + 8], 0xffffffff
je 0x40c0d4
xor eax, eax
jmp 0x40c0d9
mov eax, 1
test eax, eax
je 0x40c1d4
cmp dword [ebp + 0x14], 3
jne 0x40c1ca
push 0x71f342
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov ebx, dword [0x71f37a]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov ebx, dword [0x71f37a]
mov dword [ebp - 0x10], ebx
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx]
test eax, eax
jne 0x40c124
mov eax, 0x484331
push eax
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x40c13a
mov eax, 0x484331
push eax
push 2
mov ebx, 0x23c
call fcn.00457910
add esp, 0x1c
mov ebx, dword [0x71f37a]
add ebx, 4
mov dword [ebp - 0xc], ebx
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x40c16e
mov eax, 0x484331
push eax
push 1
mov ebx, 0x244
call fcn.00457900
add esp, 0x10
mov ebx, dword [0x71f37a]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
push 5
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WinExec]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40c1b3
push 6
call fcn.00450cac
add esp, 4
push 0x71f2fa
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x90]
jmp 0x40c1d4
mov dword [0x71f362], 1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40e3cf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], esp
push dword [ebp + 8]
push dword [0x71f31e]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40e41c
push 6
call fcn.00450cac
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40e433
mov eax, 0x48440e
jmp 0x40e531
mov dword [ebp - 0x14], esp
push dword [ebp + 8]
push dword [0x71f31e]
call dword [sym.imp.KERNEL32.dll_LoadResource]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40e45b
push 6
call fcn.00450cac
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40e472
mov eax, 0x48440e
jmp 0x40e531
mov dword [ebp - 0x14], esp
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LockResource]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40e494
push 6
call fcn.00450cac
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40e4ab
mov eax, 0x48440e
jmp 0x40e531
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x1bc
call fcn.00457c40
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x40e4de
push ebx
call fcn.00450ca6
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 4]
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x40e4f5
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x40e512
push 6
call fcn.00450cac
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x40e52c
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.00450ca0
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x40e531
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x40e542
push ebx
call fcn.00450ca6
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x40ef26
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ebx, dword [0x71f2fe]
mov dword [ebp - 4], ebx
push 0x484331
mov ebx, dword [ebp - 4]
push dword [ebx]
call fcn.004020ae
add esp, 8
cmp eax, 0
je 0x40eff7
mov ebx, dword [0x71f2fe]
mov dword [ebp - 4], ebx
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00457390
add esp, 0x10
mov dword [ebp - 8], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00457390
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 1
push dword [ebp - 0xc]
push dword [ebp - 8]
mov ebx, dword [ebp - 4]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40efd7
push 6
call fcn.00450cac
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40efe7
push ebx
call fcn.00450ca6
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40eff7
push ebx
call fcn.00450ca6
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x41c6a7
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x41c6d7
push 6
call fcn.00450cac
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x41c6eb
mov esp, ebp
pop ebp
ret 4
Function at 0x41cf33
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
cmp dword [0x71f3c6], 0
je 0x41d176
push dword [ebp + 8]
call fcn.0041d198
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x41cf8b
push ebx
call fcn.00450ca6
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov ebx, dword [0x71f36e]
call fcn.00402e35
xor ecx, ecx
push eax
lea eax, [ebp - 0xc]
mov ebx, eax
pop eax
inc ecx
push ecx
push ebx
mov dword [ebx], ecx
push eax
cmp ecx, eax
jg 0x41d05b
mov ebx, dword [0x71f36e]
call fcn.00402e4e
push ebx
push ecx
mov eax, dword [ebp - 0xc]
dec eax
jns 0x41cfd1
push 4
call fcn.00450cac
add esp, 4
pop ecx
pop ebx
cmp eax, ecx
jl 0x41cfe4
push 1
call fcn.00450cac
add esp, 4
shl eax, 2
add ebx, eax
mov dword [ebp - 0x14], ebx
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebx]
test eax, eax
jne 0x41d013
mov eax, 0x484331
push eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x41d027
mov eax, 0x484331
push eax
push 4
mov ebx, 0x148
call fcn.0045b3e0
add esp, 0x34
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
je 0x41d053
mov dword [ebp - 4], 1
jmp 0x41d05b
pop eax
pop ebx
pop ecx
jmp 0x41cfa3
add esp, 0xc
cmp dword [ebp - 4], 1
jne 0x41d176
cmp dword [0x71f3c6], 0
je 0x41d176
push 0x71f3d6
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00401af0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 0x14]
push dword [0x71f3c6]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x41d0b8
push 6
call fcn.00450cac
add esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x41d167
mov dword [ebp - 0x14], esp
push dword [0x71f3c6]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x41d0ea
push 6
call fcn.00450cac
add esp, 4
mov dword [0x71f3c6], 0
mov dword [0x71f3da], 0
push 0x71c0cf
push dword [ebp - 8]
push 0x71c0ea
mov ecx, 3
call fcn.004010e6
add esp, 0xc
mov dword [ebp - 0x14], eax
push 0x30
mov eax, 0x71c0b4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
push dword [0x71f382]
push 0x71f33e
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x41d157
push ebx
call fcn.00450ca6
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x41d167
push ebx
call fcn.00450ca6
add esp, 4
push 0x71f3d6
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov eax, 1
jmp 0x41d180
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x41d191
push ebx
call fcn.00450ca6
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8
Function at 0x41d198
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x200
push 1
mov ebx, 0x184
call fcn.00457350
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41d1dd
push ebx
call fcn.00450ca6
add esp, 4
pop eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.0040bada
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
push 0x200
push 0xd
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x41d21c
push 6
call fcn.00450cac
add esp, 4
mov eax, dword [ebp - 4]
test eax, eax
je 0x41d238
push eax
mov ebx, eax
call fcn.0040107b
inc eax
push eax
call fcn.00450ca0
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x41d23d
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41d24e
push ebx
call fcn.00450ca6
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4