joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bb30
Capabilities:
Delete file

Disassembly:
sub esp, 0x218
mov eax, dword [0x4a3f4c]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push esi
push 0
push 0
mov esi, ecx
mov eax, dword [esi + 0x20]
push 0x1032
push eax
call ebx
test eax, eax
je 0x40bd43
mov ecx, dword [esi + 0x20]
push ebp
push edi
push 2
push 0xffffffffffffffff
push 0x100c
push ecx
call ebx
mov edx, dword [esi + 0x20]
push 2
mov edi, eax
push edi
push 0x100c
push edx
call ebx
mov eax, edi
imul eax, eax, 0x78c
lea ebp, [eax + esi]
lea ecx, [ebp + 0x200bd]
mov eax, ecx
lea ebx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40bba0
sub eax, ebx
jne 0x40bbb2
shl edi, 9
lea ecx, [edi + esi + 0x70]
cmp byte [ebp + 0x202c7], 0
lea eax, [ebp + 0x202c7]
jne 0x40bbe7
push ecx
lea ecx, [esp + 0x120]
push 0x105
push ecx
call fcn.0045cee3
add esp, 0xc
lea edx, [esp + 0x11c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
jmp 0x40bbfd
push eax
lea eax, [esp + 0x120]
push 0x105
push eax
call fcn.0045cee3
add esp, 0xc
lea ecx, [esp + 0x11c]
push ecx
lea edx, [esp + 0x18]
push str._sdxwnd.dxw
push edx
call fcn.0045a121
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
lea eax, [esp + 0x14]
push eax
call edi
push 0x480984
lea ecx, [esp + 0x120]
push ecx
lea edx, [esp + 0x1c]
push 0x480978
push edx
call fcn.0045a121
add esp, 0x10
lea eax, [esp + 0x14]
push eax
call edi
push 0x480970
lea ecx, [esp + 0x120]
push ecx
lea edx, [esp + 0x1c]
push 0x480978
push edx
call fcn.0045a121
add esp, 0x10
lea eax, [esp + 0x14]
push eax
call edi
push 0x480968
lea ecx, [esp + 0x120]
push ecx
lea edx, [esp + 0x1c]
push 0x480978
push edx
call fcn.0045a121
add esp, 0x10
lea eax, [esp + 0x14]
push eax
call edi
push 0x480960
lea ecx, [esp + 0x120]
push ecx
lea edx, [esp + 0x1c]
push 0x480978
push edx
call fcn.0045a121
add esp, 0x10
lea eax, [esp + 0x14]
push eax
call edi
push 0x480958
lea ecx, [esp + 0x120]
push ecx
lea edx, [esp + 0x1c]
push 0x480978
push edx
call fcn.0045a121
add esp, 0x10
lea eax, [esp + 0x14]
push eax
call edi
push str.dxwnd
lea ecx, [esp + 0x120]
push ecx
lea edx, [esp + 0x1c]
push 0x480978
push edx
call fcn.0045a121
add esp, 0x10
lea eax, [esp + 0x14]
push eax
call edi
push str.disasm
lea ecx, [esp + 0x120]
push ecx
push 0x480978
lea edx, [esp + 0x20]
push edx
call fcn.0045a121
add esp, 0x10
lea eax, [esp + 0x14]
push eax
call edi
push 0
push str.DxWnd_Proxy
push str.DxWnd_Proxies_uninstalled
mov ecx, esi
call fcn.00434078
pop edi
pop ebp
mov ecx, dword [esp + 0x21c]
pop esi
pop ebx
xor ecx, esp
call fcn.0045a1dd
add esp, 0x218
ret
Function at 0x40d360
Capabilities:
Check for time delay via gettickcount
Copy file

Disassembly:
sub esp, 0x118
mov eax, dword [0x4a3f4c]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, edi
mov dword [esp + 0x14], eax
mov dword [esp + 8], edi
mov dword [esp + 0xc], 1
cmp dword [0x4a601c], edi
jne 0x40d48c
mov eax, 0x4a6238
call fcn.00408730
test eax, eax
je 0x40d3ff
mov dword [esp + 0xc], edi
xor eax, eax
mov cl, byte [eax + 0x4a6238]
mov byte [esp + eax + 0x18], cl
inc eax
test cl, cl
jne 0x40d3b4
lea eax, [esp + 0x18]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d3d0
mov ecx, dword [str..bak]
sub eax, edx
mov dl, byte [0x480ce8]
lea eax, [esp + eax + 0x14]
mov dword [eax], ecx
mov byte [eax + 4], dl
push edi
lea eax, [esp + 0x1c]
push eax
push 0x4a6238
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push ebx
push ebp
lea ebx, [esi + 0x6c]
lea ebp, [esi + 0x2006c]
lea ebx, [ebx]
cmp byte [ebx + 4], 0
je 0x40d454
cmp dword [ebp + 0x780], 0
jne 0x40d426
cmp dword [esp + 0x14], 0
je 0x40d43f
push edi
push ebp
mov esi, 0x4a6238
mov ecx, ebx
call fcn.0040c220
mov esi, dword [esp + 0x20]
add esp, 8
inc dword [esp + 0x10]
inc edi
add ebp, 0x78c
add ebx, 0x200
cmp edi, 0x100
jl 0x40d410
push edi
mov edi, 0x4a6238
call fcn.004089c0
xor eax, eax
add esp, 4
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push str.SaveConfigFile:__d_updates_in__d_msec_n
call fcn.0041f800
add esp, 0xc
pop ebp
pop ebx
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
xor ecx, esp
call fcn.0045a1dd
add esp, 0x118
ret

Function at 0x40d500
Capabilities:
Check for time delay via gettickcount
Copy file

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x60], 0
je 0x40d52a
push 0x24
push 0xea61
push 0xea7a
call fcn.0041ede0
add esp, 0xc
cmp eax, 6
jne 0x40d52a
mov ecx, esi
pop esi
jmp fcn.0040d360
pop esi
ret
Function at 0x410f70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x477746
mov eax, dword fs:[0]
push eax
sub esp, 0x2f0
mov eax, dword [0x4a3f4c]
xor eax, esp
mov dword [esp + 0x2ec], eax
push ebx
push esi
push edi
mov eax, dword [0x4a3f4c]
xor eax, esp
push eax
lea eax, [esp + 0x300]
mov dword fs:[0], eax
push 0x104
lea eax, [esp + 0x1f9]
push 0
push eax
mov esi, ecx
mov byte [esp + 0x200], 0
call fcn.0045af40
add esp, 0xc
mov ebx, 1
push ebx
push 0
push esi
push 0
push 2
lea ecx, [esp + 0x208]
push ecx
push str..ini
push ebx
lea ecx, [esp + 0x34]
call fcn.00445db1
lea ecx, [esp + 0x14]
mov dword [esp + 0x308], 0
call fcn.00445532
lea ecx, [esp + 0x14]
mov dword [eax + 0xc], str.DxWnd_config__.ini_
call fcn.00445532
lea ecx, [esp + 0x14]
mov dword [eax + 0x30], str.Open_DxWnd_config._file
call fcn.00446599
cmp eax, ebx
jne 0x411101
mov ecx, esi
call fcn.0040d500
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x18]
call fcn.004466c5
mov edi, eax
mov eax, dword [edi]
sub eax, 0x10
cmp dword [eax + 0xc], ebx
mov byte [esp + 0x308], bl
jle 0x41105e
mov eax, dword [eax + 4]
push eax
mov ecx, edi
call fcn.00401940
mov ecx, dword [edi]
mov edx, 0x4a6238
mov al, byte [ecx]
mov byte [edx], al
add ecx, ebx
add edx, ebx
test al, al
jne 0x411065
mov byte [esp + 0x308], al
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411098
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esi + 0x98fbc]
call fcn.0043a003
lea ecx, [esi + 0x98fc4]
call fcn.0043a003
lea ecx, [esi + 0x98fcc]
call fcn.0043a003
mov ecx, dword [esi + 0x20]
push 0
push 0
push 0x1009
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, esi
call fcn.0040ba90
mov edx, dword [esi]
mov eax, dword [edx + 0x164]
mov ecx, esi
call eax
mov ecx, esi
call fcn.0040ba90
lea ecx, [esi + 0x6c]
push ecx
push 0
call sub.dxwnd.dll_Ordinal_1
add esp, 8
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
lea ecx, [esp + 0x14]
mov dword [esp + 0x308], 0xffffffff
call fcn.00445bf9
mov ecx, dword [esp + 0x300]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2ec]
xor ecx, esp
call fcn.0045a1dd
add esp, 0x2fc
ret
Function at 0x411650
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x47780b
mov eax, dword fs:[0]
push eax
mov eax, 0x1354
call fcn.0045d560
mov eax, dword [0x4a3f4c]
xor eax, esp
mov dword [esp + 0x1350], eax
push ebx
push esi
push edi
mov eax, dword [0x4a3f4c]
xor eax, esp
push eax
lea eax, [esp + 0x1364]
mov dword fs:[0], eax
mov edi, ecx
push 0
lea ecx, [esp + 0x14]
call fcn.0042f420
lea eax, [esp + 0xbc4]
push eax
mov dword [esp + 0x1370], 0
call sub.dxwnd.dll_Ordinal_5
add esp, 4
or ebx, 0xffffffff
cmp eax, 2
je 0x4116d7
push 0x30
push 0xea62
push 0xea71
call fcn.0041ede0
add esp, 0xc
jmp 0x4117a3
cmp dword [esp + 0x1374], 0
je 0x41172c
push 0x62
call fcn.00431dfa
movsx ecx, word [esp + 0xbcc]
imul ecx, ecx, 0x78c
push ebx
lea edx, [ecx + edi + 0x2006c]
push edx
mov esi, eax
push 0x30
push esi
push 0
call fcn.0045d2cf
push esi
push 0x41024
push 0xea61
push 0xea72
call fcn.0041ee90
add esp, 0x28
cmp eax, 6
jne 0x4117ae
mov eax, dword [esp + 0xbfc]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x411769
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0xbfc]
push eax
push ecx
push 0x30
push 0xea63
push 0xea73
call fcn.0041ee90
add esp, 0x14
jmp 0x4117ae
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x411794
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x30
push 0xea63
push 0xea74
call fcn.0041ee90
add esp, 0x14
jmp 0x4117ae
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.USER32.dll_ClipCursor]
lea esi, [edi + 0x98c6c]
call fcn.00408870
lea ecx, [esp + 0x10]
mov dword [esp + 0x136c], ebx
call fcn.004106c0
mov ecx, dword [esp + 0x1364]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1350]
xor ecx, esp
call fcn.0045a1dd
add esp, 0x1360
ret 4

Function at 0x411900
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x47788b
mov eax, dword fs:[0]
push eax
sub esp, 0xbb4
push ebx
push esi
push edi
mov eax, dword [0x4a3f4c]
xor eax, esp
push eax
lea eax, [esp + 0xbc4]
mov dword fs:[0], eax
mov edi, ecx
push 0
lea ecx, [esp + 0x14]
call fcn.0042f420
mov eax, dword [edi + 0x20]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x1032
push eax
mov dword [esp + 0xbdc], 0
call ebx
test eax, eax
je 0x4119b3
mov ecx, dword [edi + 0x20]
push 2
push 0xffffffffffffffff
push 0x100c
push ecx
call ebx
mov edx, dword [edi + 0x20]
inc eax
push 2
lea esi, [eax - 1]
push esi
push 0x100c
push edx
call ebx
shl esi, 9
lea eax, [esi + edi + 0x6c]
mov dword [0x4a6100], eax
add eax, 4
push str.._pedump.txt
push eax
call fcn.00420110
add esp, 8
push 1
push 0
push 0
push str..pedump.txt
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x10]
mov dword [esp + 0xbcc], 0xffffffff
call fcn.004106c0
mov ecx, dword [esp + 0xbc4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xbc0
ret
Function at 0x415fa0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x477a56
mov eax, dword fs:[0]
push eax
sub esp, 0xcc0
mov eax, dword [0x4a3f4c]
xor eax, esp
mov dword [esp + 0xcbc], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a3f4c]
xor eax, esp
push eax
lea eax, [esp + 0xcd4]
mov dword fs:[0], eax
mov ebp, ecx
xor ebx, ebx
push ebx
lea ecx, [esp + 0x1c]
call fcn.0042f420
mov dword [esp + 0xcdc], ebx
call fcn.0043ae64
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x41600a
push 0x80004005
call fcn.004017e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x14], esi
mov ecx, dword [ebp + 0x20]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push 0x1032
push ecx
mov byte [esp + 0xcec], 1
call edi
test eax, eax
jne 0x416055
lea eax, [esi - 0x10]
mov byte [esp + 0xcdc], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x41616c
mov ecx, dword [ebp + 0x20]
push 2
push 0xffffffffffffffff
push 0x100c
push ecx
call edi
mov edx, dword [ebp + 0x20]
inc eax
push 2
lea esi, [eax - 1]
push esi
push 0x100c
push edx
call edi
shl esi, 9
lea ecx, [esi + ebp + 0x70]
cmp ecx, ebx
jne 0x416085
xor eax, eax
jmp 0x416099
mov eax, ecx
lea esi, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x416090
sub eax, esi
push eax
push ecx
lea ecx, [esp + 0x1c]
call fcn.00401cf0
mov esi, dword [esp + 0x14]
push 0x5c
push esi
call fcn.0045d007
add esp, 8
cmp eax, ebx
jne 0x41610c
or eax, 0xffffffff
push eax
lea ecx, [esp + 0x18]
call fcn.00411ed0
call fcn.004292a0
test eax, eax
mov eax, str.open
jne 0x4160d7
mov eax, str.explore
mov edi, dword [esp + 0x14]
push 5
push ebx
push ebx
push edi
push eax
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
jg 0x416155
cmp esi, 2
jne 0x416115
push edi
lea ecx, [esp + 0xbd0]
push str.folder___s__does_not_exist
push ecx
call fcn.0045a121
add esp, 0xc
jmp 0x416140
sub eax, esi
jne 0x4160ba
lea eax, [esi - 0x10]
jmp 0x416158
call fcn.004292a0
test eax, eax
mov eax, str.open
jne 0x416128
mov eax, str.explore
push esi
push edi
push eax
lea edx, [esp + 0xbd8]
push str.ShellExecute___s_____s___failed._nerror_d
push edx
call fcn.0045a121
add esp, 0x14
push ebx
push str.error
lea eax, [esp + 0xbd4]
push eax
mov ecx, ebp
call fcn.00434078
lea eax, [edi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [esp + 0xcdc], bl
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416178
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x18]
mov dword [esp + 0xcdc], 0xffffffff
call fcn.004106c0
mov ecx, dword [esp + 0xcd4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xcbc]
xor ecx, esp
call fcn.0045a1dd
add esp, 0xccc
ret
Function at 0x4189d0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x477ca1
mov eax, dword fs:[0]
push eax
sub esp, 0xcc4
mov eax, dword [0x4a3f4c]
xor eax, esp
mov dword [esp + 0xcc0], eax
push ebp
push esi
push edi
mov eax, dword [0x4a3f4c]
xor eax, esp
push eax
lea eax, [esp + 0xcd4]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea ecx, [esp + 0x1c]
call fcn.0042f420
mov dword [esp + 0xcdc], 0
call fcn.0043ae64
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x418a3c
push 0x80004005
call fcn.004017e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x10], edi
mov ecx, dword [esi + 0x20]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x1032
push ecx
mov byte [esp + 0xcec], 1
call ebp
test eax, eax
jne 0x418a89
mov byte [esp + 0xcdc], al
lea eax, [edi - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x418bbf
mov ecx, dword [esi + 0x20]
push 2
push 0xffffffffffffffff
push 0x100c
push ecx
call ebp
mov edx, dword [esi + 0x20]
inc eax
push 2
lea edi, [eax - 1]
push edi
push 0x100c
push edx
call ebp
mov eax, edi
shl eax, 9
add eax, esi
test dword [eax + 0x220], 0x4000000
je 0x418b2d
lea ecx, [esp + 0xbcc]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [esp + 0xbcc]
push edx
lea ecx, [esp + 0x18]
call fcn.004022f0
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0xce0], 2
call fcn.00407090
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0xcdc], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x418b1b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xa
push str.dxwnd.log
lea ecx, [esp + 0x18]
call fcn.00404ff0
jmp 0x418b8f
imul edi, edi, 0x78c
cmp byte [edi + esi + 0x202c7], 0
lea ecx, [edi + esi + 0x202c7]
je 0x418b50
push ecx
lea ecx, [esp + 0x14]
call fcn.00402090
jmp 0x418b81
add eax, 0x70
push eax
lea ecx, [esp + 0x14]
call fcn.00402090
mov esi, dword [esp + 0x10]
push 0x5c
push esi
call fcn.0045d007
add esp, 8
test eax, eax
jne 0x418c06
or eax, 0xffffffff
push eax
lea ecx, [esp + 0x14]
call fcn.00411ed0
push str.dxwnd.log
lea ecx, [esp + 0x14]
call fcn.004050b0
mov esi, dword [esp + 0x10]
push 5
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea eax, [esi - 0x10]
mov byte [esp + 0xcdc], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x418bcb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x18]
mov dword [esp + 0xcdc], 0xffffffff
call fcn.004106c0
mov ecx, dword [esp + 0xcd4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0xcc0]
xor ecx, esp
call fcn.0045a1dd
add esp, 0xcd0
ret
sub eax, esi
jne 0x418b77
lea ecx, [esp + 0x10]
call fcn.00401af0
jmp 0x418bcb
Function at 0x41c000
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push str.extract.ico
call fcn.0045d620
push str.extract.ico
lea eax, [esp + 0x1c]
push 1
push eax
call fcn.004230c0
push 0x481984
push str.extract.ico
call fcn.0045c402
push 2
mov esi, eax
push 0
push esi
call fcn.0045e25e
push esi
call fcn.0045e166
mov edi, eax
push edi
call fcn.0045be8e
push 0
push 0
push esi
mov ebx, eax
call fcn.0045e25e
push esi
push 1
push edi
push ebx
call fcn.0045dfac
lea ecx, [edi + edi + 0x10]
add esp, 0x48
push ecx
call fcn.0045be8e
mov ebp, eax
push edi
push ebp
push ebx
call fcn.0041be70
push ebx
call fcn.0045d47c
push esi
call fcn.0045bfcf
push str.extract.ico
call fcn.0045d620
add esp, 0x1c
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret

Function at 0x41c0d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, dword [esp + 8]
mov eax, ebp
push esi
lea edx, [eax + 1]
jmp 0x41c0e0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41c0e0
sub eax, edx
mov esi, eax
jne 0x41c0f4
pop esi
xor eax, eax
pop ebp
ret 4
push edi
push str.extract.ico
call fcn.0045d620
add esp, 4
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push str.extract.ico
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
test edi, edi
jne 0x41c143
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.extract.ico
push str.CreateFile_failure:_path_s_error_d_n
call fcn.0041f800
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebp
ret 4
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, 0x10
push ebx
push eax
call fcn.0045be8e
mov ebx, eax
push ebp
push ebx
call fcn.0041beb0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x41c190
push str.icon_hex2char_error_n
call fcn.0041f800
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.extract.ico
call fcn.0045d620
add esp, 4
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
ret 4
push 0
lea eax, [esp + 0x18]
push eax
push esi
push ebx
push edi
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call ebx
cmp esi, dword [esp + 0x14]
je 0x41c1e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WriteFile_failure:_error_d_n
call fcn.0041f800
add esp, 8
push edi
call ebx
push str.extract.ico
call fcn.0045d620
add esp, 4
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
ret 4
push 0x50
push 0
push 0
push 1
push str.extract.ico
push 0
call dword [sym.imp.USER32.dll_LoadImageA]
mov esi, eax
test esi, esi
jne 0x41c213
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.de_serialize_error__d_n
call fcn.0041f800
add esp, 8
push str.extract.ico
call fcn.0045d620
add esp, 4
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x41d680
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0
push 0
push 0x482cc4
call edi
mov esi, eax
test esi, esi
jne 0x41d6a7
push str.no_Path____n
call fcn.0041f800
add esp, 4
call fcn.0041d520
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d6b0
sub eax, edx
lea esi, [eax + esi + 2]
push esi
call fcn.0045be8e
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x41d6d9
push str.no_memory____n
call fcn.0041f800
add esp, 4
push esi
push ebx
push 0x482cc4
call edi
mov edi, ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41d6e5
mov ax, word [0x482ca4]
mov word [edi], ax
call fcn.0041d520
mov esi, eax
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d700
mov edi, ebx
sub eax, esi
dec edi
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x41d710
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
push 0x482cc4
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
call fcn.0045d47c
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x41d740
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x248
mov eax, dword [0x4a3f4c]
xor eax, esp
mov dword [esp + 0x244], eax
push ebp
mov dword [0x4a6448], 0
call fcn.0041d520
push eax
push str._sproxy.dll
lea eax, [esp + 0x14c]
push 0x104
push eax
call fcn.0045a19e
add esp, 0x10
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x148]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x41d7c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.FindFirstFile_failed___d__n
call fcn.0041f800
add esp, 8
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.0045a1dd
add esp, 0x248
ret
lea eax, [esp + 0x30]
push eax
push 0
push str.ProxyList__d__s_n
call fcn.0041f800
lea eax, [esp + 0x3c]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d7e0
push esi
sub eax, edx
inc eax
push edi
push eax
call fcn.0045be8e
add esp, 4
mov dword [0x4a6448], eax
lea ecx, [esp + 0x38]
mov edx, eax
mov esi, 1
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x41d805
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea ecx, [esp + 0xc]
push ecx
push ebp
call edi
test eax, eax
je 0x41d877
cmp esi, 0x20
jge 0x41d877
lea edx, [esp + 0x38]
push edx
push esi
push str.ProxyList__d__s_n
call fcn.0041f800
lea eax, [esp + 0x44]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d840
sub eax, edx
inc eax
push eax
call fcn.0045be8e
add esp, 4
mov dword [esi*4 + 0x4a6448], eax
lea ecx, [esp + 0x38]
mov edx, eax
inc esi
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x41d861
lea eax, [esp + 0xc]
push eax
push ebp
call edi
test eax, eax
jne 0x41d821
push esi
push str.ProxyList_elements_d_n
mov dword [esi*4 + 0x4a6448], 0
call fcn.0041f800
add esp, 8
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x250]
pop edi
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.0045a1dd
add esp, 0x248
ret
Function at 0x41e810
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x12c
mov eax, dword [0x4a3f4c]
xor eax, esp
mov dword [esp + 0x128], eax
push esi
push edi
push 0x128
lea eax, [esp + 0xc]
push 0
push eax
call fcn.0045af40
add esp, 0xc
push 0
push 2
mov dword [esp + 0x10], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [esp + 8]
mov esi, eax
push ecx
push esi
call sub.KERNEL32.dll_Process32First
mov edi, dword [esp + 0x138]
test eax, eax
je 0x41e885
cmp dword [esp + 0x20], edi
jne 0x41e876
mov edx, dword [esp + 0x10]
push edx
call fcn.0041e810
add esp, 4
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x41e863
push edi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x41e8a9
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x130]
pop edi
pop esi
xor ecx, esp
call fcn.0045a1dd
add esp, 0x12c
ret

Function at 0x41fe20
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
push edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x41fe58
mov edi, dword [esp + 0x10]
lea ecx, [ecx]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x41fe50
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x41fe5a
inc edx
add eax, 0x28
cmp edx, esi
jb 0x41fe40
xor eax, eax
pop edi
pop esi
pop ebx
ret