joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e6c6
Capabilities:
Create process on windows

Disassembly:
push 0xc
mov eax, 0x44e2ce
call fcn.0044b85f
mov eax, dword [section..data]
mov ecx, section..data
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x10], edi
xor esi, esi
mov dword [ebp - 4], esi
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x49c]
push 0x2f
push eax
call fcn.0043a11a
pop ecx
pop ecx
cmp eax, esi
je 0x40e7bf
sub eax, dword [ebx + 0x49c]
sar eax, 1
cmp eax, 0xffffffff
je 0x40e7bf
lea ecx, [eax - 1]
lea edx, [ebp + 8]
lea eax, [ebx + 0x49c]
mov dword [ebp - 0x18], ecx
call fcn.0040e861
push 0x22
xor eax, eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.0040e7ee
mov eax, dword [ebp + 8]
mov edi, dword [eax - 0xc]
mov dword [ebp - 0x14], edi
inc edi
push edi
lea esi, [ebp + 8]
call fcn.0040503f
mov edx, dword [ebp - 0x14]
push 0x22
pop ecx
mov word [eax + edx*2], cx
test edi, edi
js 0x40e7b5
mov esi, dword [ebp + 8]
cmp edi, dword [esi - 8]
jg 0x40e7b5
mov edx, dword [ebp - 0x18]
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebx + 0x49c]
call fcn.0040e843
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.004068ad
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.0040507e
mov edi, dword [ebp - 0x10]
push 5
push 0
push edi
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [esi - 0x10]
call fcn.0040507e
jmp 0x40e7d5
push 0x80070057
call fcn.004050e3
push 5
push esi
push esi
push dword [ebx + 0x49c]
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [edi - 0x10]
call fcn.0040507e
call fcn.0044b8fe
ret 4

Function at 0x40fafc
Capabilities:
Create process on windows
Hide graphical window
Terminate process

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
sub eax, 0x3e8
push esi
mov esi, ecx
je 0x40fb2f
dec eax
dec eax
je 0x40fb2f
sub eax, 0x7cf
jne 0x40fb61
push 5
push eax
push eax
push str.http:__www.itools.cn_redirect_uninstfb.htm
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40fb61
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [esi + 0x444]
test esi, esi
je 0x40fb4d
push ebx
mov ebx, esi
call fcn.0041484b
pop ebx
call fcn.0040fb68
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x40fb68
Capabilities:
Delete file
Get common file path

Disassembly:
push 0x210
mov eax, 0x44f667
call fcn.0044b8c8
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
xor esi, esi
lea eax, [ebp - 0x216]
push esi
push eax
call fcn.00437620
add esp, 0xc
push 1
push 0x1a
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40fc02
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x218]
call fcn.00404da4
push str.ThinkSkyiTools
lea eax, [ebp - 0x21c]
push eax
mov dword [ebp - 4], esi
call fcn.00406d0a
mov esi, dword [ebp - 0x21c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x40fbed
mov ecx, esi
call fcn.0041db90
jmp 0x40fbf4
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
call fcn.0040507e
call fcn.0044b912
ret

Function at 0x40fce9
Capabilities:
Initialize winsock library

Disassembly:
push 0x19c
mov eax, 0x44d670
call fcn.0044b8c8
xor ecx, ecx
mov dword [edi], vtable.ILite.0
mov dword [ebp - 0x1a8], edi
mov dword [edi + 4], ecx
mov dword [ebp - 4], ecx
push 0xf
mov dword [edi], vtable.CHttpAgent.0
pop ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x30], ecx
mov byte [edi + 0x20], cl
mov dword [edi + 0x50], ebx
mov dword [edi + 0x4c], ecx
mov byte [edi + 0x3c], cl
mov dword [edi + 0x6c], ebx
mov dword [edi + 0x68], ecx
mov byte [edi + 0x58], cl
mov dword [edi + 0x88], ebx
mov dword [edi + 0x84], ecx
mov byte [edi + 0x74], cl
mov dword [edi + 0xa4], ebx
mov dword [edi + 0xa0], ecx
mov byte [edi + 0x90], cl
mov dword [edi + 0xc0], ebx
mov dword [edi + 0xbc], ecx
mov byte [edi + 0xac], cl
mov dword [edi + 0xdc], ebx
mov dword [edi + 0xd8], ecx
mov byte [edi + 0xc8], cl
mov dword [edi + 0xf8], ebx
mov dword [edi + 0xf4], ecx
mov byte [edi + 0xe4], cl
lea esi, [edi + 0x100]
mov byte [ebp - 4], 8
call fcn.00412ff4
mov dword [edi + 0x124], ebx
xor ebx, ebx
mov dword [edi + 0x120], ebx
mov byte [edi + 0x110], bl
lea esi, [edi + 0x12c]
mov byte [ebp - 4], 0xa
call fcn.00412ff4
or dword [edi + 0xc], 0xffffffff
push 0x190
lea eax, [ebp - 0x1a4]
push ebx
push eax
mov dword [edi + 0x10], 0x1e
mov dword [edi + 0x14], 0x1000
mov dword [edi + 0x18], ebx
call fcn.00437620
add esp, 0xc
lea eax, [ebp - 0x1a4]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov eax, edi
call fcn.0044b912
ret
Function at 0x40ff36
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x463140]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x110], eax
mov eax, dword [esi + 0xc]
push edi
mov dword [ebp - 0x104], eax
xor edi, edi
lea eax, [ebp - 0x110]
push eax
push edi
lea eax, [ebp - 0x108]
push eax
push edi
push edi
mov dword [ebp - 0x10c], edi
mov dword [ebp - 0x108], 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x40ffad
lea eax, [ebp - 0x108]
push eax
push dword [esi + 0xc]
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x40ffad
push edi
push dword [ebp + 8]
push ebx
push dword [esi + 0xc]
call dword [sym.imp.WS2_32.dll_send]
jmp 0x40ffb0
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00437608
leave
ret 4

Function at 0x40ffbf
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x463140]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x110], eax
mov eax, dword [esi + 0xc]
push edi
mov dword [ebp - 0x104], eax
xor edi, edi
lea eax, [ebp - 0x110]
push eax
push edi
push edi
lea eax, [ebp - 0x108]
push eax
push edi
mov dword [ebp - 0x10c], edi
mov dword [ebp - 0x108], 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x410036
lea eax, [ebp - 0x108]
push eax
push dword [esi + 0xc]
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x410036
push edi
push dword [ebp + 8]
push ebx
push dword [esi + 0xc]
call dword [sym.imp.WS2_32.dll_recv]
jmp 0x410039
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00437608
leave
ret 4
Function at 0x410048
Capabilities:
Create tcp socket

Disassembly:
push 4
mov eax, 0x44e29b
call fcn.0044b85f
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [esi]
call dword [eax + 0x6c]
push 0x10
lea ebx, [esi + 0xe4]
xor ecx, ecx
pop edx
mov dword [ebx + 0x10], ecx
cmp dword [ebx + 0x14], edx
jb 0x410075
mov eax, dword [ebx]
jmp 0x410077
mov eax, ebx
mov byte [eax], cl
lea eax, [esi + 0x110]
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], edx
jb 0x410089
mov eax, dword [eax]
mov byte [eax], cl
lea eax, [esi + 0xac]
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], edx
jb 0x41009b
mov eax, dword [eax]
mov byte [eax], cl
lea eax, [esi + 0xc8]
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], edx
jb 0x4100ad
mov eax, dword [eax]
lea edi, [esi + 0x100]
mov byte [eax], cl
call fcn.00413176
lea edi, [esi + 0x12c]
call fcn.00413176
xor eax, eax
cmp dword [ebp + 8], eax
je 0x41025b
mov edi, dword [ebp + 0x10]
cmp edi, eax
je 0x41025b
cmp dword [ebp + 0x14], eax
je 0x41025b
cmp dword [ebp + 0x18], eax
je 0x41025b
push dword [ebp + 8]
call fcn.00439ae0
pop ecx
test eax, eax
je 0x41025b
push edi
call fcn.00439ae0
pop ecx
test eax, eax
je 0x41025b
push dword [ebp + 0x14]
call fcn.00439ae0
pop ecx
test eax, eax
je 0x41025b
push dword [ebp + 0x18]
call fcn.00439ae0
pop ecx
test eax, eax
je 0x41025b
mov ax, word [ebp + 0xc]
push dword [ebp + 8]
mov word [esi + 8], ax
call fcn.00439ae0
pop ecx
mov ecx, dword [ebp + 8]
add esi, 0x90
call fcn.004012c4
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x18], 0
push edi
je 0x4101f5
call fcn.00439ae0
pop ecx
mov ecx, edi
mov esi, ebx
call fcn.004012c4
mov esi, str._http:__
push esi
call fcn.00439ae0
pop ecx
mov edi, eax
push esi
mov eax, ebx
call fcn.004069a3
push dword [ebp + 8]
push ebx
call fcn.00412faa
mov eax, dword [section..data]
mov ecx, section..data
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
movzx eax, word [ebp + 0xc]
and dword [ebp - 4], 0
push eax
lea eax, [ebp + 8]
push str.:_ld
push eax
call fcn.00413a3b
add esp, 0xc
push dword [ebp + 8]
push ebx
call fcn.00412faa
push dword [ebp + 0x14]
push ebx
call fcn.00412faa
mov esi, 0x4583a4
push esi
call fcn.00439ae0
pop ecx
mov edi, eax
push esi
mov eax, ebx
call fcn.004069a3
push dword [ebp + 0x18]
push ebx
call fcn.00412faa
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.0040507e
jmp 0x41023d
call fcn.00439ae0
pop ecx
mov ecx, edi
mov esi, ebx
call fcn.004012c4
mov esi, 0x4583a4
push esi
call fcn.00439ae0
pop ecx
mov edi, eax
push esi
mov eax, ebx
call fcn.004069a3
push dword [ebp + 0x14]
push ebx
call fcn.00412faa
push esi
call fcn.00439ae0
pop ecx
mov edi, eax
push esi
mov eax, ebx
call fcn.004069a3
push dword [ebp + 0x18]
push ebx
call fcn.00412faa
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
jmp 0x41025d
xor eax, eax
call fcn.0044b8fe
ret 0x14
Function at 0x410560
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x463140]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [esi + 0xc], 0xffffffff
jne 0x41057d
xor eax, eax
jmp 0x41064b
cmp dword [esi + 0x18], 0
push edi
lea edi, [esi + 0x20]
jne 0x41058d
lea edi, [esi + 0x90]
cmp dword [edi + 0x14], 0x10
jb 0x410595
mov edi, dword [edi]
push ebx
push edi
call fcn.00439ae0
mov ebx, eax
pop ecx
test ebx, ebx
je 0x410643
movsx eax, byte [edi]
push eax
call fcn.0043a8c4
pop ecx
test eax, eax
jne 0x4105c5
movsx eax, byte [ebx + edi - 1]
push eax
call fcn.0043a8c4
pop ecx
test eax, eax
je 0x4105df
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x410643
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edi, eax
push 2
pop eax
push edi
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp dword [esi + 0x18], 0
mov dword [ebp - 0x10], eax
je 0x4105fc
movzx eax, word [esi + 0x1c]
jmp 0x410600
movzx eax, word [esi + 8]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0xc]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x41063c
lea eax, [ebp - 0x18]
push eax
push 0x8004667e
push dword [esi + 0xc]
xor edi, edi
inc edi
mov dword [ebp - 0x18], edi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x410647
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x6c]
xor eax, eax
jmp 0x410649
mov eax, edi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00437608
leave
ret
Function at 0x4122b8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44d056
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x463140]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push esi
push edi
mov eax, dword [0x463140]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], edi
cmp esi, ebx
jne 0x412329
xor eax, eax
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.00437608
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ecx]
call dword [eax + 0x58]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
cmp edx, ebx
jg 0x412340
jl 0x412307
cmp eax, ebx
jbe 0x412307
push edi
push edx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call esi
add esp, 0x24
test eax, eax
je 0x412307
mov dword [esp + 0x30], ebx
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
mov dword [esp + 0x60], ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, edi
call esi
mov dword [esp + 0x2c], eax
jmp 0x4123f8
call esi
mov ecx, eax
sub ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x44]
add edi, eax
cmp ecx, ebx
jbe 0x41239a
imul eax, eax, 0x3e8
xor edx, edx
div ecx
mov dword [esp + 0x30], eax
cmp dword [esp + 0x48], 0x10
mov ecx, dword [esp + 0x34]
jae 0x4123a9
lea ecx, [esp + 0x34]
push dword [esp + 0x20]
xor eax, eax
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push eax
push edi
push dword [esp + 0x58]
mov eax, edi
push ecx
imul eax, eax, 0x64
push dword [esp + 0x4c]
push dword [esp + 0x38]
push dword [esp + 0x38]
push ebx
push eax
call fcn.00445250
push eax
call dword [esp + 0x48]
add esp, 0x24
test eax, eax
je 0x41241f
call esi
mov dword [esp + 0x2c], eax
xor eax, eax
cmp eax, dword [esp + 0x18]
jg 0x41240e
jl 0x4123f8
cmp edi, dword [esp + 0x14]
jae 0x41240e
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx]
lea edx, [esp + 0x34]
push edx
call dword [eax + 0x50]
test eax, eax
jne 0x41237a
cmp ebx, dword [esp + 0x18]
jl 0x412433
jg 0x41241c
cmp edi, dword [esp + 0x14]
jb 0x412433
xor ebx, ebx
inc ebx
push 1
xor edi, edi
lea esi, [esp + 0x38]
call fcn.00401614
mov eax, ebx
jmp 0x412309
push dword [esp + 0x20]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push ebx
push edi
push ebx
push ebx
push ebx
push 0xffffffffffffffff
call dword [esp + 0x48]
add esp, 0x24
jmp 0x41241f
Function at 0x414404
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
call fcn.00428e70
movzx eax, word [ebp + 8]
sub eax, 0x11d1
je 0x41442f
dec eax
dec eax
jne 0x41447d
push 1
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x41447d
xor edi, edi
cmp dword [esi + 0x450], edi
je 0x41447d
cmp dword [esi + 0x44c], 5
jne 0x41445a
push 1
push edi
push edi
push str.http:__itools.cn_dl_itools3
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push edi
jmp 0x414427
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push edi
push dword [esi + 4]
call ebx
mov esi, dword [esi + 0x450]
push 5
push dword [esi + 4]
call ebx
push edi
mov edi, esi
call fcn.004067ae
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret 8

Function at 0x415426
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44fa3a
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x463140]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [section..data]
mov ecx, section..data
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
xor ebx, ebx
mov dword [esp + 0x30], ebx
mov eax, 0x458bc8
cmp dword [ebp + 0x18], ebx
jne 0x41547a
mov eax, 0x458bcc
push eax
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
call fcn.00416016
push eax
lea eax, [esp + 0x24]
push 0x458bd0
push eax
call fcn.00404457
fldz
fstp qword [esp + 0x30]
mov dword [esp + 0x38], ebx
push ebx
lea eax, [esp + 0x34]
mov byte [esp + 0x50], 1
mov esi, dword [esp + 0x30]
push eax
push esi
mov ecx, str.stat2.itools.hk
call fcn.0041559a
add esp, 0x28
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], bl
call fcn.00418190
lea eax, [esi - 0x10]
call fcn.0040507e
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4158ed
Capabilities:
Check os version
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x463140]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x40
xor ebx, ebx
push ebx
push esi
call fcn.00437620
mov edi, 0x114
push edi
lea eax, [ebp - 0x118]
push ebx
push eax
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x58], ebx
call fcn.00437620
add esp, 0x18
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x108]
push 2
pop ecx
sub eax, ecx
je 0x415957
xor eax, eax
inc eax
jmp 0x41596f
cmp dword [ebp - 0x114], 6
jae 0x41596c
cmp dword [ebp - 0x110], ecx
jae 0x41596c
mov eax, ecx
jmp 0x41596f
push 3
pop eax
mov dword [esi + 0x40], eax
sub eax, ecx
je 0x415995
dec eax
jne 0x4159df
push str.GetSystemFirmwareTable
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x58], eax
jmp 0x4159df
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x4d1790
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, esi
pop ebx
call fcn.00437608
leave
ret

Function at 0x415cd3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push edi
push str.devicephysicalmemory
lea eax, [ebp - 0x20]
push eax
call dword [esi + 0x50]
push 0x18
pop ebx
push ebx
xor edi, edi
lea eax, [ebp - 0x38]
push edi
push eax
call fcn.00437620
lea eax, [ebp - 0x20]
add esp, 0xc
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
push eax
push 4
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x2c], 0x40
mov dword [ebp - 4], edi
call dword [esi + 0x44]
test eax, eax
jns 0x415d26
xor eax, eax
pop edi
pop ebx
leave
ret 8
push 0x24
lea eax, [ebp - 0x5c]
push edi
push eax
call fcn.00437620
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp + 8]
mov eax, ecx
xor edx, edx
div dword [ebp - 0x58]
mov eax, dword [ebp + 0xc]
push 2
push edi
push 1
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x18]
push ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], edi
mov ebx, edx
add eax, ebx
push eax
push edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [esi + 0x48]
test eax, eax
jns 0x415d88
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x415d20
mov edi, dword [ebp - 0xc]
push edi
call fcn.0043803c
mov ecx, dword [ebp - 8]
sub edi, ebx
push edi
add ecx, ebx
push ecx
push eax
mov dword [ebp + 8], eax
call fcn.004376a0
add esp, 0x10
jmp loc.004cea40
Function at 0x416945
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
push edi
xor edi, edi
mov esi, str..pipeABA4DB3C_3202_459E_B500_049D4B882225
jmp 0x41697a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x4169d7
push 0x3e8
push esi
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x4169d7
push edi
push edi
push 3
push edi
push edi
push 0xc0000000
push esi
call ebx
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x41695d
push edi
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 2
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x4169d7
mov esi, 0x4565c8
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
lea ecx, [ebp - 0xc]
push ecx
lea eax, [eax + eax + 2]
push eax
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4169d7
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4179cc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
test ebx, ebx
je 0x417b46
push esi
lea ecx, [ebp - 0x14]
mov dword [esi + 0xc], ebx
call fcn.0041795c
cmp byte [ebx + 0x161], 0
mov dword [ebp - 4], 0x50000080
je 0x4179fd
mov dword [ebp - 4], 0x500000a0
cmp dword [ebx + 0x138], 0
je 0x417a0d
or dword [ebp - 4], 0x200004
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push edi
push dword [ebx + 0x154]
mov edi, dword [ebp - 8]
sub edi, dword [ebp - 0x10]
push eax
push dword [ebp - 0x10]
mov eax, dword [ebx]
push dword [ebp - 0x14]
mov ecx, ebx
push 0
push 0x458fb0
call dword [eax + pe_nt_image_headers32]
push 0x456c24
push dword [ebp - 4]
mov ecx, eax
mov edx, edi
mov eax, esi
call fcn.00420c60
mov eax, dword [esi + 0xc]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [eax + 0x16c]
push 0x30
push dword [esi + 4]
call edi
mov eax, dword [esi + 0xc]
push 0
push dword [eax + 0x15c]
push 0xc5
push dword [esi + 4]
call edi
mov eax, dword [esi + 0xc]
cmp byte [eax + 0x161], 0
je 0x417a98
movzx eax, word [eax + 0x162]
push 0
push eax
push 0xcc
push dword [esi + 4]
call edi
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
lea edx, [ebp - 4]
push edx
call dword [eax + 0x15c]
push dword [eax]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.0040507e
push 0
push 0
push 0xb9
push dword [esi + 4]
call edi
push 0
push 3
push 0xd3
push dword [esi + 4]
call edi
mov eax, dword [esi + 0xc]
xor ecx, ecx
cmp byte [eax + 0x14], 1
sete cl
push ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [esi + 0xc]
xor ecx, ecx
cmp byte [eax + 0x160], 1
push 0
sete cl
push ecx
push 0xcf
push dword [esi + 4]
call edi
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [ebx + 0x164]
or ecx, eax
push ecx
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 4
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [esi + 0x14], 1
pop edi
leave
ret

Function at 0x417ba6
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x463140]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [esi + 0xc], 0
push ebx
push edi
jne 0x417bc0
xor eax, eax
jmp 0x417c00
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.004453c0
mov ebx, esp
test ebx, ebx
je 0x417bbc
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [esi + 0xc]
push ebx
call fcn.00417cb6
push 0
push 0
push 0x10
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp + 8]
lea esp, [ebp - 0xc]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00437608
leave
ret 4