joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418d35
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42ab20]
jne 0x418d3f
repz ret
jmp fcn.0041ca8c

Function at 0x41e310
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42ab20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0041c487
and dword [ebp - 0x14], 0
cmp dword [0x42c558], 0
mov dword [ebp - 0x18], eax
jne 0x41e3c3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41e46b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x424724
push ebx
call edi
test eax, eax
je 0x41e46b
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42c558], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42c55c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42c560], eax
call edi
push eax
call esi
mov dword [0x42c568], eax
test eax, eax
je 0x41e3c3
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42c564], eax
mov eax, dword [0x42c564]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41e41c
cmp dword [0x42c568], ecx
je 0x41e41c
push eax
call esi
push dword [0x42c568]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41e41c
test ebx, ebx
je 0x41e41c
call edi
test eax, eax
je 0x41e413
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41e413
test byte [ebp - 8], 1
jne 0x41e41c
or dword [ebp + 0x10], 0x200000
jmp 0x41e44f
mov eax, dword [0x42c55c]
cmp eax, dword [ebp - 0x18]
je 0x41e44f
push eax
call esi
test eax, eax
je 0x41e44f
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41e44f
mov eax, dword [0x42c560]
cmp eax, dword [ebp - 0x18]
je 0x41e44f
push eax
call esi
test eax, eax
je 0x41e44f
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42c558]
call esi
test eax, eax
je 0x41e46b
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41e46d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418d35
leave
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x5da27664
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x30016669
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x402430
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp dbg.mark_section_writable

Function at 0x402490
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4093a0]
test esi, esi
jle 0x402583
mov edi, dword [0x4093a4]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x4024c4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x40257c
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x4024b0
mov dword [esp], eax
mov esi, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x4025c0
mov esi, dword [0x4093a4]
lea ebx, [ebx + ebx*4]
shl ebx, 2
add esi, ebx
mov dword [esi + 0x10], eax
mov dword [esi], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x4093a4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4025a0
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x402575
sub eax, 4
and eax, 0xfffffffb
je 0x402575
add ebx, dword [0x4093a4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x40258a
add dword [0x4093a0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x4024ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
mov eax, dword [0x4093a4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
Function at 0x402a00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4093b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4093b0]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x402a55
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x402a4e
test esi, esi
je 0x402a4e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402a30
mov dword [esp], 0x4093b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401160
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x41bd9f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push 0x4247e8
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString_1
mov al, byte [esp + 0x30]
mov cl, byte [esp + 0x34]
mov dl, byte [esp + 0x38]
mov ebp, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov byte [esp + 0x10], al
push 0
push 0
lea eax, [esp + 0x18]
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
mov dword [esp + 0x3c], 1
mov byte [esp + 0x29], cl
mov byte [esp + 0x2a], dl
mov byte [esp + 0x2b], 0
call ebp
mov edi, eax
lea ecx, [edi + edi + 2]
push ecx
call sub.MFC42.DLL_operatornew
add esp, 4
mov esi, eax
lea edx, [esp + 0x10]
push edi
push esi
push 0xffffffffffffffff
push edx
push 0
push 0xfde9
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0
call ebx
mov ebp, eax
lea eax, [ebp + 1]
push eax
call sub.MFC42.DLL_operatornew
add esp, 4
mov edi, eax
push 0
push 0
push ebp
push edi
push 0xffffffffffffffff
push esi
push 0
push 0
call ebx
push edi
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::operator_1
push esi
call sub.MFC42.DLL_operatordelete
push edi
call sub.MFC42.DLL_operatordelete
mov esi, dword [esp + 0x34]
add esp, 8
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x18], 1
mov byte [esp + 0x24], 0
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x401e50
Capabilities:
Create directory

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x11c]
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x1c]
mov edx, ecx
mov ecx, 0x40
test edx, edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], eax
rep stosd dword es:[edi], eax
jle 0x401f05
lea ecx, [esp + 0x1c]
lea edi, [esp + 0x1d]
lea ebx, [esp + 0x1e]
sub ecx, esi
lea ebp, [esp + 0x1f]
sub edi, esi
sub ebx, esi
mov dword [esp + 0x14], ecx
sub ebp, esi
mov al, byte [esi]
cmp al, 0x5c
je 0x401eb1
cmp al, 0x2f
je 0x401eb1
mov byte [ecx + esi], al
jmp 0x401ef3
mov byte [ecx + esi], 0x5c
lea eax, [esp + 0x1c]
mov byte [edi + esi], 0x2a
mov byte [ebx + esi], 0x2e
push eax
mov byte [esi + ebp], 0x2a
call fcn.00401e10
add esp, 4
mov byte [edi + esi], 0
test al, al
mov byte [ebx + esi], 0
mov byte [esi + ebp], 0
jne 0x401eef
lea ecx, [esp + 0x1c]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x401f05
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
inc eax
inc esi
cmp eax, edx
mov dword [esp + 0x10], eax
jl 0x401ea2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x401f10
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x200
lea eax, [esp]
push esi
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
push 0x25
push 0x25
push 0x4230c8
push eax
call esi
add esp, 0x10
lea ecx, [esp + 0x104]
lea edx, [esp + 4]
push 0x100
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov eax, dword [esp + 0x208]
lea ecx, [esp + 0x104]
push eax
push ecx
lea edx, [esp + 0xc]
push 0x4230b8
push edx
call esi
lea eax, [esp + 0x14]
push eax
call fcn.00401e50
mov edx, dword [esp + 0x220]
lea ecx, [esp + 0x18]
push ecx
push 0x4230a0
push edx
call esi
add esp, 0x20
pop esi
add esp, 0x200
ret

Function at 0x401f90
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x264
push ebx
push ebp
push esi
mov esi, dword [esp + 0x278]
cmp esi, 3
push edi
jle 0x4020f1
mov ebx, dword [esp + 0x278]
xor edx, edx
xor eax, eax
mov dl, byte [ebx + 1]
mov al, byte [ebx + 2]
shl edx, 8
add edx, eax
lea ebp, [edx + 3]
cmp esi, ebp
jl 0x4020f1
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x30]
cmp edx, 0x40
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x40
jg 0x401fe5
mov ecx, edx
mov edx, ecx
lea esi, [ebx + 3]
lea edi, [esp + 0x30]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x27c]
lea esi, [ebp + 2]
cmp edi, esi
jle 0x4020f1
xor edx, edx
xor eax, eax
mov dl, byte [ebx + ebp]
mov al, byte [ebx + ebp + 1]
shl edx, 8
add edx, eax
lea ebp, [edx + esi]
cmp edi, ebp
jl 0x4020f1
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x10]
cmp edx, 0x20
rep stosd dword es:[edi], eax
mov ecx, 0x20
jg 0x402040
mov ecx, edx
mov edx, ecx
add esi, ebx
lea edi, [esp + 0x10]
lea eax, [esp + 0x174]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x34]
push ecx
call fcn.00401f10
lea edx, [esp + 0x18]
lea eax, [esp + 0x17c]
push edx
push eax
lea ecx, [esp + 0x84]
push 0x4230e4
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edx, [esp + 0x8c]
push edx
call fcn.00401e10
add esp, 0x1c
test al, al
jne 0x4020f1
mov eax, dword [esp + 0x27c]
lea edi, [ebp + 2]
cmp eax, edi
jle 0x4020f1
xor ecx, ecx
xor edx, edx
mov cl, byte [ebx + ebp]
mov dl, byte [ebx + ebp + 1]
mov esi, ecx
shl esi, 8
add esi, edx
lea ecx, [esi + edi]
cmp eax, ecx
jl 0x4020f1
lea edx, [esp + 0x74]
push 0x4230e0
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x4020f1
push ebp
push esi
add edi, ebx
push 1
push edi
call dword [sym.imp.MSVCRT.dll_fwrite]
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x264
ret
Function at 0x4032e0
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x9c
push eax
call esi
test eax, eax
jne 0x40332d
lea ecx, [esp + 8]
mov dword [esp + 8], 0x94
push ecx
call esi
test eax, eax
jne 0x40332d
pop edi
xor ax, ax
pop esi
add esp, 0x9c
ret
mov eax, dword [esp + 0x18]
dec eax
je 0x4033a0
dec eax
jne 0x4033ca
mov eax, dword [esp + 0xc]
cmp eax, 4
jbe 0x4033ca
cmp eax, 5
jne 0x403386
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x403362
pop edi
mov ax, 5
pop esi
add esp, 0x9c
ret
cmp eax, 1
jne 0x403374
pop edi
mov ax, 0x105
pop esi
add esp, 0x9c
ret
cmp eax, 2
jne 0x403367
pop edi
mov ax, 0x205
pop esi
add esp, 0x9c
ret
cmp eax, 6
jne 0x403367
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x403367
pop edi
mov ax, 6
pop esi
add esp, 0x9c
ret
cmp dword [esp + 0xc], 4
jne 0x4033ca
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4033ca
cmp eax, 0xa
jne 0x4033c1
pop edi
mov ax, 0xa04
pop esi
add esp, 0x9c
ret
cmp eax, 0x5a
mov ax, 0x5a04
je 0x4033ce
mov ax, 4
pop edi
pop esi
add esp, 0x9c
ret

Function at 0x4033e0
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
push edi
mov edi, dword [esp + 0x14]
push eax
push 0x423170
push 1
push 0
push 0x423160
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [edi], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jne 0x403440
mov eax, dword [esp + 0xc]
lea edx, [esp + 8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov esi, eax
test esi, esi
jne 0x403440
mov eax, dword [esp + 8]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x40344e
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40345c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
pop edi
pop esi
add esp, 8
ret
Function at 0x403f78
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x41be88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
lea edi, [esi + 4]
mov ecx, edi
mov dword [esp + 0x14], edi
call fcn.00403830
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x20], 0
test eax, eax
je 0x403fb0
mov al, byte [esp + 0xb]
lea ecx, [esp + 0xb]
push 0x41f3a0
push ecx
mov byte [esp + 0x13], al
call sub.MSVCRT.dll__CxxThrowException
lea edx, [esp + 0xc]
push edx
push 4
push esi
push 0x403d10
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov ecx, dword [esp + 0x24]
add esp, 0x18
test eax, eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ecx
jne 0x403ff1
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x10]
push 0x41f2b8
push edx
mov dword [esp + 0x18], eax
call sub.MSVCRT.dll__CxxThrowException
mov ecx, dword [esi + 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x404019
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x10]
push 0x41f2b8
push edx
mov dword [esp + 0x18], eax
call sub.MSVCRT.dll__CxxThrowException
mov eax, dword [esi + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x404041
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x10]
push 0x41f2b8
push ecx
mov dword [esp + 0x18], eax
call sub.MSVCRT.dll__CxxThrowException
mov ecx, edi
mov dword [esi + 0x1c], 1
call fcn.00403840
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x405da0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x408f30
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x34c
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0x88
lea edi, [esp + 0x138]
mov dword [esp + 0x134], 0
push eax
rep stosd dword es:[edi], eax
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, dword [esp + 0x360]
mov esi, eax
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x10]
cmp esi, 0xffffffff
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], 0x128
mov byte [ebx], al
je 0x40900a
lea eax, [esp + 0xc]
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x409003
mov edi, dword [esp + 0x35c]
mov edx, dword [esp + 0x14]
cmp edx, edi
je 0x408fc3
lea ecx, [esp + 0xc]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x408f9b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
add esp, 0x34c
ret
mov ecx, 0x89
xor eax, eax
lea edi, [esp + 0x134]
push edx
rep stosd dword es:[edi], eax
push 8
mov dword [esp + 0x13c], 0x224
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea edx, [esp + 0x134]
push edx
push eax
call sub.KERNEL32.dll_Module32First
lea eax, [esp + 0x254]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
add esp, 0x34c
ret

Function at 0x40a410
Capabilities:
Access peb ldr_data
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x41c628
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0
call sub.MFC42.DLL_CFileFind::CFileFind
lea eax, [esp + 0x34]
push str..htm
lea ecx, [esp + 8]
push eax
push ecx
mov byte [esp + 0x38], 1
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push 0
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 2
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
lea ecx, [esp + 4]
mov byte [esp + 0x2c], 1
sete bl
call sub.MFC42.DLL_CString::CString
test bl, bl
pop ebx
je 0x40a4b5
lea ecx, [esp + 4]
call sub.MFC42.DLL_CFileFind::Close
lea ecx, [esp + 4]
mov byte [esp + 0x28], 0
call fcn.0041b74e
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CFileFind::FindNextFileA
lea edx, [esp + 8]
lea ecx, [esp + 0xc]
push edx
mov esi, eax
call sub.MFC42.DLL_CFileFind::GetFilePath
mov eax, dword [eax]
push eax
call edi
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString
test esi, esi
jne 0x40a4bd
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CFileFind::Close
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0
call fcn.0041b74e
lea ecx, [esp + 0x38]
mov dword [esp + 0x30], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x40a530
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41c650
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x18], 1
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 8]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
and ecx, 0xffff
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x40a5a9
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
cmp edi, ebx
je 0x40a5a9
mov edx, dword [esp + 0x28]
push 0x423118
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x40a5dc
lea ecx, [esp + 0x24]
mov byte [esp + 0x18], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor al, al
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push esi
push ebp
push 1
push edi
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
lea ecx, [esp + 0x24]
mov byte [esp + 0x18], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov al, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret

Function at 0x40a630
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xc]
push 0x100
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
mov dword [esp + 0xc], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, dword [esp + 0x110]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_1
mov eax, esi
pop edi
pop esi
add esp, 0x104
ret
Function at 0x410fa0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41cde8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
xor ebx, ebx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ebx
call fcn.0041b5bc
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ebx
push ecx
mov byte [eax], bl
mov byte [ebp - 4], 1
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
cmp edi, ebx
jne 0x41100c
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0xc]
cmp dword [edx + ebx*4], 0
je 0x411103
push 0x4247e8
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::operator_1
xor esi, esi
movsx eax, word [edi + 0xa]
cmp esi, eax
jge 0x41107b
mov ecx, dword [edi + 0xc]
xor eax, eax
mov edx, dword [ecx + ebx*4]
lea ecx, [ebp - 0x24]
mov al, byte [edx + esi]
push eax
push 0x42433c
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x14]
lea ecx, [ebp + 8]
push edx
push eax
push ecx
call sub.MFC42.DLL_operator_2
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::operator
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString
inc esi
jmp 0x411028
mov edx, dword [ebp - 0x14]
mov eax, dword [edx - 8]
cmp eax, 4
jle 0x4110f7
dec eax
push 0x3a
push eax
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::SetAt
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x24]
push eax
push 0x424338
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push edx
push eax
push ecx
call sub.MFC42.DLL_operator_2
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call sub.MFC42.DLL_CString::operator
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x14]
push edx
lea ecx, [esi + eax]
push 0x4230a0
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edx, dword [ebp - 0x14]
add esp, 0xc
add esi, dword [edx - 8]
mov dword [ebp - 0x18], esi
inc ebx
jmp 0x41100c
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412560
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x20]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x4125bf
push esi
push edi
push 0x28
call sub.MFC42.DLL_operatornew
mov esi, eax
mov ecx, 0xa
xor eax, eax
mov edi, esi
add esp, 4
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, dword [esp + 0x10]
mov dword [esi], eax
mov ecx, dword [ebx + 0x20]
push edx
lea eax, [esi + 8]
push 0x4230a0
push eax
mov dword [esi + 4], ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
push esi
push 0
push 0x40f980
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0x18
pop edi
pop esi
pop ebx
ret 4