joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454ae0
Capabilities:
Check internet connectivity via wininet
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x481630]
push ebx
mov ebx, dword [0x47153c]
xor eax, ebp
push esi
mov esi, ecx
mov dword [esp + 0x128], eax
mov eax, dword [esi + 4]
test eax, eax
push edi
mov dword [esp + 0x10], 0x7530
jne 0x454beb
mov eax, dword [esi + 0x34]
test eax, eax
mov eax, dword [esi + 0x10]
push 0
je 0x454b32
push str._local_
push str.proxy
push 3
jmp 0x454b3a
mov ecx, dword [esi + 0x58]
push 0
push 0
push ecx
push eax
call dword [0x471540]
test eax, eax
mov dword [esi + 4], eax
jne 0x454b68
call dword [0x4712b4]
mov dword [esi + 0x54], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, ebp
call fcn.0045856e
mov esp, ebp
pop ebp
ret
xor edx, edx
mov dword [esp + 0x14], edx
xor eax, eax
mov dword [esp + 0x18], edx
mov byte [esp + 0x20], dl
mov ecx, 0x40
lea edi, [esp + 0x21]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esi + 0x34]
test eax, eax
mov dword [esp + 0x1c], edx
je 0x454bd4
movzx eax, word [esi + 0x30]
mov ecx, dword [esi + 0x2c]
push eax
push ecx
lea edx, [esp + 0x28]
push str._s:_d
push edx
mov dword [esp + 0x24], 3
call dword [0x4713e8]
mov edx, dword [esi + 4]
add esp, 0x10
push 0xc
lea ecx, [esp + 0x18]
push ecx
push 0x26
lea eax, [esp + 0x2c]
push edx
mov dword [esp + 0x28], eax
call ebx
test eax, eax
je 0x454c9f
mov ecx, dword [esi + 4]
push 4
lea eax, [esp + 0x14]
push eax
push 2
push ecx
call ebx
test eax, eax
je 0x454c9f
mov eax, dword [esi + 8]
test eax, eax
jne 0x454cc6
mov eax, dword [esi + 0x1c]
test eax, eax
push 0
push 0
push 3
jne 0x454c18
mov eax, dword [esi + 0x14]
xor edx, edx
mov dx, word [esi + 0x18]
push 0
push 0
push edx
push eax
mov eax, dword [esi + 4]
push eax
jmp 0x454c2f
mov eax, dword [esi + 0x24]
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x14]
push eax
push ecx
xor ecx, ecx
mov cx, word [esi + 0x18]
push ecx
push edx
mov edx, dword [esi + 4]
push edx
call dword [0x471544]
test eax, eax
mov dword [esi + 8], eax
je 0x454c9f
push 0
call dword [0x471548]
test eax, eax
jne 0x454c9f
mov ecx, dword [esi + 8]
push 4
lea eax, [esp + 0x14]
push eax
push 5
push ecx
call ebx
test eax, eax
je 0x454c9f
mov eax, dword [esi + 8]
push 4
lea edx, [esp + 0x14]
push edx
push 6
push eax
call ebx
test eax, eax
je 0x454c9f
mov eax, dword [esi + 0x38]
test eax, eax
je 0x454cc6
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax - 8]
inc ecx
push ecx
mov ecx, dword [esi + 8]
push eax
push 0x2b
push ecx
call ebx
test eax, eax
je 0x454c9f
mov eax, dword [esi + 0x40]
mov ecx, dword [eax - 8]
mov edx, dword [esi + 8]
inc ecx
push ecx
push eax
push 0x2c
push edx
call ebx
test eax, eax
jne 0x454cc6
call dword [0x4712b4]
mov ecx, esi
mov dword [esi + 0x54], eax
call fcn.00454730
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, ebp
call fcn.0045856e
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0045856e
mov esp, ebp
pop ebp
ret
Function at 0x454de0
Capabilities:
Parse url

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x4c]
push edi
mov ebp, ecx
lea eax, [esi + 1]
mov cl, byte [esi]
inc esi
test cl, cl
jne 0x454df0
sub esi, eax
xor eax, eax
mov ecx, 0xf
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
push esi
mov ecx, ebp
mov dword [esp + 0x14], 0x3c
call fcn.004042a0
lea edi, [ebp + 8]
push esi
mov ecx, edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], esi
call fcn.004042a0
lea ebx, [ebp + 0x10]
push esi
mov ecx, ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], esi
call fcn.004042a0
lea ecx, [ebp + 0x14]
push esi
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], esi
call fcn.004042a0
lea ecx, [ebp + 0x18]
push esi
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], esi
call fcn.004042a0
lea ecx, [ebp + 0x1c]
push esi
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], esi
call fcn.004042a0
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x10]
push eax
push 0
push 0
push ecx
mov dword [esp + 0x58], esi
call dword [0x471538]
test eax, eax
mov ecx, ebp
setne byte [esp + 0x50]
call fcn.004043e0
mov edx, dword [ebp]
mov esi, dword [0x471314]
push edx
call esi
mov ecx, dword [ebp]
mov dword [ecx - 8], eax
mov edx, dword [ebp]
mov ecx, edi
mov byte [eax + edx], 0
call fcn.004043e0
mov eax, dword [edi]
push eax
call esi
mov ecx, dword [edi]
mov dword [ecx - 8], eax
mov edx, dword [edi]
mov ecx, ebx
mov byte [eax + edx], 0
call fcn.004043e0
mov eax, dword [ebx]
push eax
call esi
mov ecx, dword [ebx]
mov dword [ecx - 8], eax
mov edx, dword [ebx]
lea edi, [ebp + 0x14]
mov ecx, edi
mov byte [eax + edx], 0
call fcn.004043e0
mov eax, dword [edi]
push eax
call esi
mov ecx, dword [edi]
mov dword [ecx - 8], eax
mov edx, dword [edi]
lea edi, [ebp + 0x18]
mov ecx, edi
mov byte [eax + edx], 0
call fcn.004043e0
mov eax, dword [edi]
push eax
call esi
mov ecx, dword [edi]
mov dword [ecx - 8], eax
mov edx, dword [edi]
lea edi, [ebp + 0x1c]
mov ecx, edi
mov byte [eax + edx], 0
call fcn.004043e0
mov eax, dword [edi]
push eax
call esi
mov ecx, dword [edi]
mov dword [ecx - 8], eax
mov edx, dword [edi]
mov byte [eax + edx], 0
mov eax, dword [esp + 0x1c]
mov cx, word [esp + 0x28]
pop edi
pop esi
mov dword [ebp + 4], eax
mov al, byte [esp + 0x48]
mov word [ebp + 0xc], cx
pop ebp
pop ebx
add esp, 0x3c
ret 4
Function at 0x455140
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47049e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x220
mov eax, dword [0x481630]
push ebx
push esi
mov esi, ecx
xor eax, ebp
mov dword [esi], 0x476c54
mov dword [esp + 0x220], eax
mov eax, dword [0x4810d8]
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 0x10], eax
mov ecx, dword [0x4810d8]
xor ebx, ebx
mov dword [esp + 0x234], ebx
mov dword [esi + 0x14], ecx
mov edx, dword [0x4810d8]
mov dword [esi + 0x20], edx
mov eax, dword [0x4810d8]
mov dword [esi + 0x24], eax
mov ecx, dword [0x4810d8]
mov dword [esi + 0x28], ecx
mov edx, dword [0x4810d8]
mov dword [esi + 0x2c], edx
mov eax, dword [0x4810d8]
mov dword [esi + 0x3c], eax
mov ecx, dword [0x4810d8]
mov dword [esi + 0x40], ecx
mov edx, dword [0x4810d8]
mov dword [esi + 0x4c], edx
xor eax, eax
mov byte [esp + 0x118], bl
mov ecx, 0x40
lea edi, [esp + 0x119]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x118]
push 0x104
push eax
mov byte [esp + 0x23c], 8
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x44], ebx
mov word [esi + 0x18], 0x50
mov word [esi + 0x30], bx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
call fcn.00454390
mov byte [esp + 0x18], bl
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x18]
push 0x104
push ecx
stosb byte es:[edi], al
call fcn.004544b0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x12c]
push eax
push str.Mozilla_4.0__compatible___s___s__Rising_
lea eax, [esi + 0x10]
push eax
call fcn.00405d30
mov ecx, dword [esp + 0x24c]
add esp, 0x20
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x224]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045856e
mov esp, ebp
pop ebp
ret
Function at 0x45d16e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x45d19c
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x45d1a3
cmp ebx, dword [eax + 4]
jae 0x45d1a3
xor eax, eax
jmp 0x45d393
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x45d1b4
xor eax, eax
inc eax
jmp 0x45d392
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x45d1ca
cmp ecx, edx
jae 0x45d30f
cmp dword [eax + 4], 0
je 0x45d1d3
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x45d1bb
cmp dword [ebp + 8], 0
je 0x45d1f5
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x45d30f
cmp eax, esi
jae 0x45d30f
mov eax, dword [0x4840d8]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x45d21a
cmp dword [esi*4 + 0x4840e0], edi
je 0x45d313
inc esi
cmp esi, eax
jl 0x45d208
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x47121c]
test eax, eax
je 0x45d38f
cmp dword [ebp - 8], 0x1000000
jne 0x45d38f
test byte [ebp - 0xc], 0xcc
je 0x45d298
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x45d38f
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x45d38f
cmp word [eax + 0x18], 0x10b
jne 0x45d38f
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x45d38f
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x45d298
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x45d298
test byte [ecx + 0x27], 0x80
jne 0x45d30f
push 1
push 0x484120
call dword [0x471288]
test eax, eax
jne 0x45d1ac
mov ecx, dword [0x4840d8]
test ecx, ecx
mov edx, ecx
jle 0x45d2cc
lea eax, [ecx*4 + 0x4840dc]
cmp dword [eax], edi
je 0x45d2cc
dec edx
sub eax, 4
test edx, edx
jg 0x45d2c0
test edx, edx
jne 0x45d2fd
push 0xf
pop ebx
cmp ecx, ebx
jg 0x45d2d9
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x45d2f1
lea eax, [edx*4 + 0x4840e0]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x45d2df
cmp ecx, 0x10
jge 0x45d2fd
inc ecx
mov dword [0x4840d8], ecx
push 0
push 0x484120
call dword [0x471288]
jmp 0x45d1ac
xor eax, eax
jmp 0x45d392
test esi, esi
jle 0x45d1ac
mov ebx, dword [0x471288]
push 1
push 0x484120
call ebx
test eax, eax
jne 0x45d1ac
cmp dword [esi*4 + 0x4840e0], edi
je 0x45d369
mov eax, dword [0x4840d8]
lea esi, [eax - 1]
test esi, esi
jl 0x45d357
cmp dword [esi*4 + 0x4840e0], edi
je 0x45d353
dec esi
jns 0x45d347
test esi, esi
jge 0x45d367
cmp eax, 0x10
jge 0x45d362
inc eax
mov dword [0x4840d8], eax
lea esi, [eax - 1]
jmp 0x45d369
je 0x45d381
xor ecx, ecx
test esi, esi
jl 0x45d381
lea eax, [ecx*4 + 0x4840e0]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x45d36f
push 0
push 0x484120
call ebx
jmp 0x45d1ac
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401390
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
cdq
sub eax, edx
mov esi, eax
push 1
sar esi, 1
call edi
mov ecx, dword [0x4183c4]
cdq
sub eax, edx
mov edi, eax
lea eax, [esp + 8]
push eax
push ecx
sar edi, 1
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
sub ecx, dword [esp + 8]
push 0x40
push eax
cdq
sub eax, edx
sar eax, 1
sub edi, eax
mov eax, ecx
cdq
push ecx
sub eax, edx
mov edx, dword [0x4183c4]
push edi
sar eax, 1
sub esi, eax
push esi
push 0xffffffffffffffff
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esp + 0x1c]
mov ecx, dword [0x4183c4]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
push ecx
call esi
mov edx, dword [0x4183c4]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [0x4183cc]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [0x4183cc]
and eax, 0xeffbffff
or eax, 0x80
push eax
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov edx, dword [0x4183cc]
push 5
push edx
call esi
mov eax, dword [0x4183cc]
push 0
push eax
call esi
pop edi
pop esi
add esp, 0x10
ret
Function at 0x403030
Capabilities:
Connect to http server
Create http request
Get common file path

Disassembly:
sub esp, 0x234
push ebx
push ebp
push esi
mov esi, dword [esp + 0x244]
xor ebx, ebx
xor ebp, ebp
cmp byte [esi + 1], 0x3a
jne 0x403090
mov al, byte [esi + 2]
cmp al, 0x2f
je 0x403055
cmp al, 0x5c
jne 0x403090
push 0xff
lea eax, [esp + 0x15]
push ebx
push eax
mov byte [esp + 0x1c], bl
call fcn.004050a0
push esi
lea ecx, [esp + 0x20]
push str._s_index.xml
push ecx
call fcn.00405022
lea edx, [esp + 0x28]
push edx
call fcn.00402c90
add esp, 0x1c
pop esi
pop ebp
pop ebx
add esp, 0x234
ret
push 6
push str.ftp:__
push esi
call fcn.00404f64
add esp, 0xc
test eax, eax
jne 0x4031e5
push 0x63
lea eax, [esp + 0x17d]
push ebx
push eax
mov byte [esp + 0x184], bl
call fcn.004050a0
push 0x63
lea ecx, [esp + 0x125]
push ebx
push ecx
mov byte [esp + 0x12c], bl
call fcn.004050a0
push 0x63
lea edx, [esp + 0x1f9]
push ebx
push edx
mov byte [esp + 0x200], bl
call fcn.004050a0
lea eax, [esp + 0x200]
push eax
lea ecx, [esp + 0x13c]
push ecx
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x1a8]
push eax
push esi
mov dword [esp + 0x44], ebx
call fcn.004011f0
add esp, 0x38
cmp eax, 1
jne 0x4031e5
push edi
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetOpenW]
push ebx
push ebx
push 1
lea ecx, [esp + 0x1ec]
push ecx
mov esi, eax
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x128]
push edx
push eax
lea ecx, [esp + 0x194]
push ecx
push esi
call dword [sym.imp.WININET.dll_InternetConnectA]
push 0x103
lea edx, [esp + 0x19]
push ebx
push edx
mov edi, eax
mov byte [esp + 0x20], bl
call fcn.004050a0
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x14]
push ecx
push ebx
push 0x413464
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push ebx
push 0x80
push 2
push ebx
lea eax, [esp + 0x24]
push eax
push 0x413458
push edi
call dword [sym.imp.WININET.dll_FtpGetFileA]
cmp eax, 1
jne 0x4031c1
lea ecx, [esp + 0x14]
push ecx
call fcn.00402c90
add esp, 4
mov ebp, eax
push ebx
push 0x4000000
push 3
push ebx
push 1
push ebx
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
push esi
call edi
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x234
ret
Function at 0x404100
Capabilities:
Create thread

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push 0
push ecx
push 0x404000
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ecx
ret
Function at 0x406140
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x417088]
jne 0x40614a
repz ret
jmp fcn.0040b224

Function at 0x40741e
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x417208]
je 0x407439
inc edi
cmp edi, 0x17
jb 0x40742a
cmp edi, 0x17
jae 0x4075b9
push ebp
push 3
call fcn.0040c966
cmp eax, 1
pop ecx
je 0x407585
push 3
call fcn.0040c966
test eax, eax
pop ecx
jne 0x40746d
cmp dword [0x417084], 1
je 0x407585
cmp ebx, 0xfc
je 0x4075b8
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x418608
push ebp
call fcn.0040c22a
add esp, 0xc
test eax, eax
je 0x4074a3
push esi
push esi
push esi
push esi
push esi
call fcn.00408517
add esp, 0x14
push 0x104
mov esi, 0x418621
push esi
push 0
mov byte [0x418725], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4074e7
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0040c22a
add esp, 0xc
test eax, eax
je 0x4074e7
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00408517
add esp, 0x14
push esi
call fcn.0040c290
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x40752c
push esi
call fcn.0040c290
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x41891c
push 0x413c8c
sub ecx, eax
push ecx
push eax
call fcn.0040c8b3
add esp, 0x14
test eax, eax
je 0x40752c
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00408517
add esp, 0x14
jmp 0x40752e
xor esi, esi
push 0x413c88
push ebx
push ebp
call fcn.0040c842
add esp, 0xc
test eax, eax
je 0x40754e
push esi
push esi
push esi
push esi
push esi
call fcn.00408517
add esp, 0x14
push dword [edi*8 + 0x41720c]
push ebx
push ebp
call fcn.0040c842
add esp, 0xc
test eax, eax
je 0x407570
push esi
push esi
push esi
push esi
push esi
call fcn.00408517
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0040c685
add esp, 0xc
jmp 0x4075b8
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x4075b8
cmp ebp, 0xffffffff
je 0x4075b8
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x41720c]
push dword [esi]
call fcn.0040c290
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x40c685
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00409aa6
xor ebx, ebx
cmp dword [0x418f0c], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x40c75b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x40c83b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40c83b
push eax
call fcn.00409a38
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x418f0c], eax
call esi
push eax
call fcn.00409a38
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x418f10], eax
call esi
push eax
call fcn.00409a38
mov dword [0x418f14], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00405c7e
test eax, eax
pop ecx
pop ecx
je 0x40c729
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00408517
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x40c75b
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00409a38
cmp eax, ebx
pop ecx
mov dword [0x418f1c], eax
je 0x40c75b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00409a38
pop ecx
mov dword [0x418f18], eax
mov eax, dword [0x418f18]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x40c7e0
cmp dword [0x418f1c], ecx
je 0x40c7e0
push eax
call fcn.00409aaf
push dword [0x418f1c]
mov esi, eax
call fcn.00409aaf
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x40c7e0
cmp edi, ebx
je 0x40c7e0
call esi
cmp eax, ebx
je 0x40c7ad
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40c7ad
test byte [ebp - 0x18], 1
jne 0x40c7e0
lea eax, [ebp - 0x10]
push eax
call fcn.00405cb5
test eax, eax
pop ecx
je 0x40c7c8
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00408517
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x40c7d7
or dword [ebp + 0x10], 0x200000
jmp 0x40c81b
or dword [ebp + 0x10], 0x40000
jmp 0x40c81b
mov eax, dword [0x418f10]
cmp eax, dword [ebp - 8]
je 0x40c81b
push eax
call fcn.00409aaf
cmp eax, ebx
pop ecx
je 0x40c81b
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40c81b
mov eax, dword [0x418f14]
cmp eax, dword [ebp - 8]
je 0x40c81b
push eax
call fcn.00409aaf
cmp eax, ebx
pop ecx
je 0x40c81b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x418f0c]
call fcn.00409aaf
cmp eax, ebx
pop ecx
je 0x40c83b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40c83d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4120d8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x412105
call fcn.00407645
mov dword [eax], esi
call fcn.00407632
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00408613
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x4120e1
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x412134
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00407658
pop ecx
call fcn.00407632
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x41215b
test al, 1
je 0x41215b
test byte [esp + 0xc], 2
je 0x41215b
call fcn.00407645
mov dword [eax], 5
call fcn.00407632
mov dword [eax], 0xd
jmp 0x41212b
xor eax, eax
pop esi
ret
Function at 0x606418
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 1]
jge 0x60644d
push word [esp + 4]
jmp 0x606437
mov byte [esp + 4], ah
lea esp, [esp + 2]
mov dword [esp + 8], edx
call fcn.00606479
sub byte [ebx - 0x1e], cl
sbb eax, 0x74ff666c
and al, 4
push word [esp + 4]
mov byte [esp + 4], ah
lea esp, [esp + 2]
mov dword [esp + 8], edx
call fcn.006064bf

Function at 0x606463
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00606494
push 0xf05f7e08
jmp 0x606583
jmp 0x606630
mov ebp, 0xc3e0c017
xchg word [esp + 0x12], di
jmp 0x60661a
xchg ecx, esi
lea esp, [esp + 1]
jmp 0x6066ce
sub esp, 0x15
jbe 0x606588
mov ebp, 0xc3e0c017
xchg word [esp + 0x12], di
xchg ecx, esi
jmp 0x606799
xchg bx, dx
rdtsc
call fcn.006066ab
xor ah, byte [eax + 0x61a05136]
pop ebp
lodsb al, byte [esi]
mov edi, 0x66303186
xchg ebx, edx
xchg bx, dx
rdtsc
lea ebp, [esp + 0x14]
mov dx, ax
mov bh, byte [esp]
call fcn.00606769
and dh, byte [edi + 0x7bb14227]
sub al, byte [edi + 0x1c87f9d9]
and al, 0x8a
add al, 0x24
mov edi, 0xed353e8
jmp 0x6066b3
setns dl
rdtsc
rdtsc
lea ebx, [ebx + 0x11]
mov cx, word [esp]
btc edi, edx
jmp 0x60670a
mov esi, dword [esp + 0x40]
mov ebp, dword [esp]
neg ax
jne 0x60667a
je 0x606664
xchg ebx, ecx
jmp 0x606803
sub esp, 1
lea esp, [esp + 1]
push dword [esp]
ret 4
lea ecx, [esi + esi]
xchg dword [esp], ebx
mov edx, esi
mov bl, 0x81
bsf edx, esi
mov ah, dl
jmp 0x6066f2
lea esp, [esp + 1]
jmp 0x6066ce
sub esp, 0xac
mov edi, esp
call fcn.006067b8
neg esi
push eax
bts edx, edx
jle 0x606847
jg 0x606831
neg dword [ebx - 0x35]
scasb al, byte es:[edi]
pop ebp
fdivr qword [esi]
mov esp, 0x1c43552
or ecx, edi
setnp dl
bt bx, cx
jmp 0x606810
mov ebx, eax
mov dx, ax
push word [esp + 1]
jmp 0x6068c0
mov ebx, eax
mov dx, ax
push word [esp + 1]
lea ecx, [ecx*4]
jmp 0x60687e
cmp ch, cl
jns 0x6068a2
mov bl, bh
lea edx, [edi + ebp]
jmp 0x60688c
lea esp, [esp + 2]
lea esp, [esp + 4]
inc esi
mov dx, bp
jmp 0x606868
sub esi, 0x71dd9692
mov cx, word [esp]
mov ecx, 0x693b9b01
jmp 0x6068a9
mov bl, bh
lea edx, [edi + ebp]
jmp 0x60688c
setl cl
mov ecx, dword [esp]
lea ecx, [esp + esi]
sbb edx, 0xb5952ed6
jmp 0x6068cd
lea ecx, [ecx*4]
lea esp, [esp + 2]
jmp 0x606882
jbe 0x6068e3
dec edx
jmp 0x6068e4
dec edx
xor esi, 0x7c1e341
lea edx, [esi*4]
jmp 0x606be9
mov ch, 0x25
setnp cl
jmp fcn.00606930
add esi, dword [ebp]
mov dl, byte [esp]
jmp 0x606958
lea ebx, [esi*4]
neg bl
jnp 0x606a79
jp 0x606a79

Function at 0x606573
Capabilities:
Execute anti-debugging instructions

Disassembly:
jbe 0x606544
lea esp, [esp + 7]
lea esp, [esp + 1]
jmp 0x606556
lea esp, [esp + 7]
lea esp, [esp + 1]
mov dword [esp + 0x48], edi
jmp 0x606579
mov dword [esp + 0x48], edi
lea esp, [esp + 0x48]
call fcn.006065b4
push dword [esp + 2]
jmp 0x60652e
lea esp, [esp + 0x48]
pushfd
jmp 0x606468

Function at 0x60660d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 3]
xchg dword [esp + 8], eax
call 0x6065b9