joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov eax, dword [0x5e14a4]
xor eax, esp
mov dword [esp + 0x28], eax
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x40123f
mov eax, dword [esi + 8]
sub eax, ecx
cmp edx, eax
jae 0x40123f
xor eax, eax
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0054df46
add esp, 0x2c
ret
mov dword [esp + 4], edx
fild dword [esp + 4]
push ebp
test edx, edx
jns 0x401252
fadd qword [0x5b87b0]
fmul qword [0x5b87a8]
sub esp, 8
fstp qword [esp]
call fcn.0054e2e0
fnstcw word [esp + 0xe]
add esp, 8
movzx eax, word [esp + 6]
or eax, 0xc00
mov dword [esp + 8], eax
fldcw word [esp + 8]
fistp qword [esp + 8]
mov ebp, dword [esp + 8]
shl ebp, 0xa
fldcw word [esp + 6]
cmp ebp, dword [esi + 0xc]
jae 0x4012a2
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0054df46
add esp, 0x2c
ret
push ebx
push edi
lea eax, [esp + 0x24]
push eax
push 0x5b53b0
mov dword [esp + 0x2c], 0x74726956
mov dword [esp + 0x30], 0x416c6175
mov dword [esp + 0x34], 0x636f6c6c
mov byte [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 4
push 0x1000
push ebp
push 0
call eax
mov edi, eax
mov eax, dword [esi + 4]
test eax, eax
jne 0x4012f1
xor ebx, ebx
jmp 0x4012f6
mov ebx, dword [esi + 8]
sub ebx, eax
push ebx
push eax
push edi
call fcn.005519f0
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
push 0x5b53cc
mov dword [esp + 0x20], 0x74726956
mov dword [esp + 0x24], 0x466c6175
mov dword [esp + 0x28], 0x656572
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [esi + 4]
push 0x8000
push 0
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov ecx, dword [esp + 0x34]
add ebx, edi
mov dword [esi + 4], edi
pop edi
mov dword [esi + 8], ebx
pop ebx
mov dword [esi + 0xc], ebp
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.0054df46
add esp, 0x2c
ret
Function at 0x402bb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [eax + 0x70], 0
mov dword [eax + 0x4c], ecx
jne 0x402bc3
mov dword [eax + 0x70], 1
mov dword [eax + 0x54], ecx
mov edx, ecx
sub edx, dword [eax + 0x54]
cmp edx, 0x2710
jge 0x402bd8
cmp edx, 0xffffd8f0
jge 0x402bdd
mov dword [eax + 0x54], ecx
jmp 0x402be1
test edx, edx
js 0x402bfc
mov edx, dword [eax + 0x50]
add dword [eax + 0x54], edx
push esi
push edi
mov edi, ecx
sub edi, dword [eax + 0x54]
pop edi
pop esi
js 0x402bf7
add edx, ecx
mov dword [eax + 0x54], edx
jmp fcn.004025b0
ret

Function at 0x402cd0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [0x5e14a4]
xor eax, esp
mov dword [esp + 0x198], eax
push edi
xor edi, edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi], vtable.DeHJfsvDa.0
mov dword [esi + 0x38], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov eax, vtable.CBuffer.0
mov dword [esi + 0x2c], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x48], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x4c], eax
lea eax, [esp + 8]
push eax
push 0x202
mov dword [esi + 0x58], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
call dword [sym.imp.WS2_32.dll_WSAStartup]
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
lea ecx, [esi + 0x18]
push ecx
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [esp + 0x19c]
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x14], edi
pop edi
xor ecx, esp
mov dword [esi + 0x64], 0xffffffff
mov eax, esi
call fcn.0054df46
mov esp, ebp
pop ebp
ret

Function at 0x402d80
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x18], 0
push edi
lea edi, [esi + 0x18]
je 0x402ddf
mov eax, dword [esi + 0x64]
push 4
lea edx, [esp + 0xc]
push edx
push 0x80
push 0xffff
push eax
mov dword [esp + 0x1c], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [esi + 0x64]
push ecx
call dword [sym.imp.KERNEL32.dll_CancelIo]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov edx, dword [esi + 0x64]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [esi + 0x64], 0xffffffff
pop edi
pop esi
pop ecx
ret
Function at 0x403300
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov esi, eax
mov dword [esp + 0x14], 0
cmp ebx, 0x40000
jl 0x40335b
mov edi, edi
xor edi, edi
mov eax, dword [ebp + 0x64]
push 0
push 0x40000
push esi
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x40333e
inc edi
cmp edi, 0xf
jl 0x403322
cmp edi, 0xf
je 0x40338c
add dword [esp + 0x14], eax
sub ebx, 0x40000
add esi, 0x40000
cmp ebx, 0x40000
jge 0x403320
test ebx, ebx
jle 0x403382
xor edi, edi
mov ecx, dword [ebp + 0x64]
push 0
push ebx
push esi
push ecx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x403379
inc edi
cmp edi, 0xf
jl 0x403361
cmp edi, 0xf
je 0x40338c
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x18]
je 0x40338f
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x4035b0
Capabilities:
Create thread
Set socket configuration

Disassembly:
sub esp, 8
push ebp
push esi
mov esi, eax
mov eax, dword [esi + 0x198]
xor ebp, ebp
cmp eax, ebp
jne 0x4035cf
mov dword [esi + 0x1b8], 0x598
jmp 0x4035e6
cmp eax, 0x598
jbe 0x4035e0
pop esi
xor eax, eax
pop ebp
add esp, 8
ret 8
mov dword [esi + 0x1b8], eax
push ebx
push edi
mov dword [esi + 0x64], ebp
call fcn.00403710
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, 1
push 0x5ec5b0
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], 5
mov dword [esi + 0x38], ebp
mov dword [esi + 0x3c], eax
call edi
mov dword [esi + 0x48], eax
cmp eax, ebp
jne 0x403623
push 0x5ec5b0
call edi
mov dword [esi + 0x48], eax
mov ecx, dword [esi + 0x40]
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea eax, [esp + 0x14]
push eax
push 0x1001
push 0xffff
mov ebx, 0x40000
push ecx
mov dword [esp + 0x24], ebx
call edi
mov eax, dword [esi + 0x40]
push 4
lea edx, [esp + 0x14]
push edx
push 0x1002
push 0xffff
push eax
mov dword [esp + 0x24], ebx
call edi
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push ecx
push edx
call fcn.004037a0
test eax, eax
je 0x4036bc
lea eax, [esi + 0x58]
push eax
push ebp
push esi
push 0x403930
push ebp
push ebp
call fcn.0054e906
add esp, 0x18
mov dword [esi + 0x54], eax
cmp eax, ebp
je 0x4036ae
mov ecx, dword [esi + 0x2c]
push ecx
mov edi, 1
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, edi
pop edi
pop ebx
pop esi
pop ebp
add esp, 8
ret 8
mov dword [esi + 0x5c], 8
push 0x65f
jmp 0x4036ca
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x5c], 0xb
push eax
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
call ebx
mov dword [esi + 0x30], ebp
mov dword [esi + 0x34], 5
mov dword [esi + 0x38], ebp
mov dword [esi + 0x3c], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, esi
call fcn.00403fd0
push edi
call ebx
mov edi, ebp
mov eax, edi
pop edi
pop ebx
pop esi
pop ebp
add esp, 8
ret 8
Function at 0x4037a0
Capabilities:
Connect socket
Connect udp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x20
mov eax, dword [0x5e14a4]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
mov ebx, dword [esp + 0x28]
push ebp
push 0x11
push 2
xor ebp, ebp
push 2
mov dword [esp + 0x14], ebp
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x40], eax
cmp eax, 0xffffffff
jne 0x4037e3
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0054df46
add esp, 0x20
ret 8
push edi
push ebp
push ebp
lea ecx, [esp + 0x1c]
push ecx
push ebp
push ebp
push 4
lea edx, [esp + 0x28]
push edx
push 0x9800000c
push eax
mov dword [esp + 0x34], ebp
call dword [sym.imp.WS2_32.dll_WSAIoctl]
mov ecx, dword [esi + 0x40]
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea eax, [esp + 0x14]
push eax
push 0xfffffffffffffffb
push 0xffff
push ecx
call edi
mov eax, dword [esi + 0x40]
push 4
lea edx, [esp + 0x14]
push edx
push 4
push 0xffff
push eax
call edi
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
push ebp
push ebp
push ebp
push ebp
push ebx
mov dword [esi + 0x44], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push ebx
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
lea ecx, [ebp + 1]
push ecx
call fcn.00411689
add esp, 4
push 0
push 0
push ebp
mov edi, eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
mov byte [edi + ebp], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
push edi
mov ebx, eax
call fcn.00411694
add esp, 4
pop edi
test ebx, ebx
je 0x4037ce
mov eax, dword [esp + 0x30]
mov edx, 2
push eax
mov word [esp + 0x18], dx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x16], ax
mov ecx, dword [ebx + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov ecx, dword [esi + 0x44]
mov edx, dword [esi + 0x40]
push 0x30
push ecx
push edx
mov dword [esp + 0x24], eax
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x40390b
mov ecx, dword [esi + 0x40]
push 0x10
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x403903
cmp eax, 0xffffffff
jne 0x4038f9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x403903
mov dword [esp + 8], 0
jmp 0x40390b
mov dword [esp + 8], 1
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 8]
pop ebp
pop ebx
xor ecx, esp
call fcn.0054df46
add esp, 0x20
ret 8
Function at 0x403c90
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [eax + 0x14]
push edi
test eax, eax
jne 0x403cb3
mov ecx, dword [esi + 0x44]
mov edx, dword [esi + 0x40]
push 0x23
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x403ccc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, 1
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], 2
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], edi
xor eax, eax
pop edi
ret
lea eax, [esi + 0x19c]
push eax
lea ecx, [esi + 0x1d8]
mov edi, 1
push ecx
mov dword [esi + 0x60], edi
mov ecx, esi
mov eax, esi
mov dword [esi + 0x64], edi
call fcn.00404b60
mov edx, dword [esi + 0x40]
push 0
push 0
push 0
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x403d19
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x403d19
test eax, eax
je 0x403d19
call fcn.004117a7
mov eax, edi
pop edi
ret

Function at 0x403d20
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push edi
mov edi, edi
mov eax, dword [ebx + 0x70]
mov ecx, dword [ebx + 0x40]
push 0
push 0x598
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test edi, edi
jle 0x403de2
cmp edi, 0x10
jne 0x403d78
mov edx, dword [ebx + 0x70]
mov ecx, eax
mov eax, 0x5b5094
sub edx, eax
cmp ecx, 4
jb 0x403e1a
mov esi, dword [edx + eax]
cmp esi, dword [eax]
jne 0x403d78
sub ecx, 4
add eax, 4
jmp 0x403d60
push 0
call ebp
mov ecx, dword [ebx + 0x1c0]
mov edx, dword [ebx + 0x1c8]
mov eax, dword [ebx + 0x70]
lea esi, [ebx + 0x1d8]
cmp edi, 0x18
jl 0x403da2
push ecx
push edi
push eax
mov edi, edx
call fcn.00405070
jmp 0x403dac
cmp edi, 0xc
jne 0x403e10
call fcn.00404f20
cmp eax, 2
jne 0x403d30
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x403dc4
mov eax, 0x4c7
pop edi
mov ecx, 1
mov dword [ebx + 0x3c], ecx
mov dword [ebx + 0x34], 4
pop esi
mov dword [ebx + 0x30], ecx
mov dword [ebx + 0x38], eax
pop ebp
xor eax, eax
pop ebx
ret 4
cmp edi, 0xffffffff
jne 0x403d30
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x403e37
cmp eax, 0x2744
je 0x403d30
cmp eax, 0x2746
je 0x403d30
jmp 0x403dc4
push 0xd
call dword [sym.imp.WS2_32.dll_WSASetLastError]
jmp 0x403db5
pop edi
xor eax, eax
pop esi
mov dword [ebx + 0x30], 1
mov dword [ebx + 0x34], 5
mov dword [ebx + 0x3c], eax
pop ebp
mov dword [ebx + 0x38], eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
Function at 0x403e50
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ebx
push edi
jmp 0x403e60
mov eax, dword [esi + 0x194]
test eax, eax
jle 0x403f8a
lea edi, [esi + 0x160]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [esi + 0x17c]
cmp ebx, dword [esi + 0x180]
je 0x403e9b
mov eax, dword [ebx + 4]
mov dword [esi + 0x17c], eax
mov dword [eax + 8], 0
jmp 0x403ead
test ebx, ebx
je 0x403ead
xor eax, eax
mov dword [esi + 0x17c], eax
mov dword [esi + 0x180], eax
xor eax, eax
cmp ebx, eax
je 0x403ebf
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
dec dword [esi + 0x178]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x403f8a
mov ecx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x18]
push 0
sub eax, ecx
push eax
push ecx
mov ecx, dword [esi + 0x40]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
test edi, edi
jle 0x403f0c
lea eax, [esi + 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub dword [esi + 0x194], edi
lea eax, [esi + 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x403f11
cmp edi, 0xffffffff
je 0x403f37
push ebx
lea edi, [esi + 0x98]
call fcn.00401410
test eax, eax
jne 0x403e60
mov edx, dword [ebx]
push ebx
push eax
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x403e60
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x403f95
lea edi, [esi + 0x160]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x17c]
xor ecx, ecx
cmp eax, ecx
je 0x403f6b
mov dword [eax + 8], ebx
mov ecx, dword [esi + 0x17c]
mov dword [ebx + 4], ecx
jmp 0x403f77
mov dword [ebx + 8], ecx
mov dword [ebx + 4], ecx
mov dword [esi + 0x180], ebx
inc dword [esi + 0x178]
push edi
mov dword [esi + 0x17c], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 1
push ebx
lea edi, [esi + 0x98]
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], 3
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ecx
call fcn.00401410
test eax, eax
jne 0x403fc7
mov edx, dword [ebx]
push ebx
push eax
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403fd0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
mov eax, dword [edi + 0x64]
cmp eax, 3
je 0x4040b7
lea esi, [edi + 0x15c]
push esi
call fcn.00402c80
mov ecx, dword [edi + 0x64]
cmp ecx, 1
je 0x404008
mov edx, dword [edi + 0x64]
test edx, edx
jne 0x4040b1
mov dword [edi + 0x64], 2
mov dword [esi], 0
push edi
mov eax, ebx
call fcn.004041d0
mov eax, dword [edi + 0x60]
test eax, eax
je 0x404044
cmp dword [edi + 0x3c], 0
je 0x40403d
mov ecx, dword [edi + 0x40]
push 0
push 0x10
push 0x5b5094
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov dword [edi + 0x60], 0
cmp dword [edi + 0x30], 0
je 0x40406c
mov edx, dword [edi + 0x48]
push edx
call fcn.00406740
mov eax, dword [edi + 4]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
lea ecx, [edi + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov eax, dword [edi + 0x44]
test eax, eax
je 0x404081
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov dword [edi + 0x44], 0
mov eax, dword [edi + 0x40]
cmp eax, 0xffffffff
je 0x4040a3
push 1
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
mov edx, dword [edi + 0x40]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [edi + 0x40], 0xffffffff
call fcn.004040d0
pop edi
pop esi
mov eax, 1
pop ebx
ret
mov dword [esi], 0
push 0x139f
mov dword [edi + 0x5c], 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x404520
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x5b5100
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x5b511c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0
lea edi, [esi + 0x18]
push edi
mov dword [esi + 0x14], eax
call ebp
xor eax, eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov word [esi + 0x28], ax
mov edx, dword [esi + 0x64]
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
mov word [esi + 0x28], 0xca
cmp edx, 3
je 0x404582
mov eax, esi
call fcn.00403fd0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push eax
push ecx
mov eax, esi
call fcn.004035b0
mov ebx, dword [esp + 0x1c]
push 0x1770
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4045c4
cmp eax, 0x102
je 0x4045b3
cmp eax, 0xffffffff
jne 0x4045ba
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 8
push 1
push edi
call ebp
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea edx, [esp + 0x10]
push edx
push 0
push esi
push 0x404600
push 0
push 0
call fcn.0054e906
add esp, 0x18
pop edi
mov dword [esi + 0x268], eax
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 8
Function at 0x4062a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x57e3c8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x5e14a4]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea esi, [edi + 0x108c]
mov ecx, esi
call fcn.0043adbc
xor ebx, ebx
cmp dword [0x5ec5a8], ebx
mov dword [esp + 0x14], 0
setne bl
mov dword [esp + 0x10], vtable.CBitmap.0
add ebx, 0xb1
mov dword [esp + 0x38], 0
call fcn.0043c0c2
mov eax, dword [eax + 0xc]
movzx ecx, bx
push ecx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapW]
push eax
lea ecx, [esp + 0x14]
call fcn.0044913e
test eax, eax
je 0x4063d3
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push 0x18
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [0x5ec5a8]
mov ecx, dword [esp + 0x20]
neg eax
sbb eax, eax
and eax, 0x14
push 0
add eax, 4
push 0
or eax, 1
push eax
push ecx
push 0x10
mov ecx, esi
call fcn.0043aeff
mov edx, dword [esp + 0x14]
mov eax, dword [edi + 0x1090]
push 0xff
push edx
push eax
call fcn.0043c0c2
mov eax, dword [eax + 0x78]
mov ecx, dword [eax]
call fcn.00406ee0
test esi, esi
je 0x40637e
mov esi, dword [esi + 4]
mov ecx, dword [edi + 0x1038]
push esi
push 0
push 0x1109
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
call fcn.0043addb
lea ecx, [edi + 0x350]
call fcn.0042264a
mov edx, dword [edi + 0x350]
mov edx, dword [edx + 0x32c]
xor eax, eax
cmp dword [0x5ec5a8], eax
push 0
push 0
setne al
push 1
push 0
push 0
lea ecx, [edi + 0x350]
add eax, 0xab
push eax
call edx
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], vtable.CBitmap.0
call fcn.00407310
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x407da0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x57e3c8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x5e14a4]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea ecx, [edi + 0x3cc]
call fcn.0042264a
mov eax, dword [edi + 0x3cc]
mov edx, dword [eax + 0x32c]
xor ecx, ecx
cmp dword [0x5ec5a8], ecx
push 0
push 0
setne cl
push 1
push 0
push 0
add ecx, 0xa9
push ecx
lea ecx, [edi + 0x3cc]
call edx
lea esi, [edi + 0x3c4]
mov ecx, esi
call fcn.0043adbc
xor ebx, ebx
cmp dword [0x5ec5a8], ebx
mov dword [esp + 0x14], 0
setne bl
mov dword [esp + 0x10], vtable.CBitmap.0
add ebx, 0xaf
mov dword [esp + 0x38], 0
call fcn.0043c0c2
mov eax, dword [eax + 0xc]
movzx ecx, bx
push ecx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapW]
push eax
lea ecx, [esp + 0x14]
call fcn.0044913e
test eax, eax
je 0x407ed0
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push 0x18
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [0x5ec5a8]
mov ecx, dword [esp + 0x20]
neg eax
sbb eax, eax
and eax, 0x14
push 0
add eax, 4
push 0
or eax, 1
push eax
push ecx
push 0x10
mov ecx, esi
call fcn.0043aeff
mov edx, dword [esp + 0x14]
mov eax, dword [edi + 0x3c8]
push 0xff00ff
push edx
push eax
call fcn.0043c0c2
mov eax, dword [eax + 0x78]
mov ecx, dword [eax]
call fcn.00406ee0
test esi, esi
je 0x407eb5
mov esi, dword [esi + 4]
mov ecx, dword [edi + 0x370]
push esi
push 0
push 0x1109
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
call fcn.0043addb
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], vtable.CBitmap.0
call fcn.00407310
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x4081b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
push edi
mov esi, eax
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push str.Console
push SysReAllocStringLen
mov dword [esp + 0x20], 3
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4080b7
mov eax, dword [esp + 0x10]
lea ecx, [esp + 8]
push ecx
push 0
lea edx, [esp + 0x14]
push edx
push 0
push 0x5b4aa8
push eax
call edi
cmp dword [esp + 8], 0xa
jbe 0x4081a1
push 0x7d0
push 0
push str.0:db0:lk0:hs0:ld0:ll0:hb0:pj61.4_.4202:zb0.1:bb
call fcn.0054fb10
mov eax, dword [esp + 0x1c]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push str.0:db0:lk0:hs0:ld0:ll0:hb0:pj61.4_.4202:zb0.1:bb
lea edx, [esp + 0x14]
push edx
push 0
push str.IpDate
push eax
call edi
push 0
lea ecx, [esi + 0x1e]
push ecx
push 0x5b4ac8
call fcn.00407f30
push 0
lea edx, [esi + 0x21c]
push edx
push 0x5b4ad0
call fcn.00407f30
lea eax, [esi + 0x258]
push eax
push 0
push 0x5b4ad8
call fcn.00407f30
push 0
lea ecx, [esi + 0x25c]
push ecx
push 0x5b4ae0
call fcn.00407f30
push 0
lea edx, [esi + 0x45a]
push edx
push 0x5b4ae8
call fcn.00407f30
lea eax, [esi + 0x498]
push eax
push 0
push 0x5b4af0
call fcn.00407f30
add esp, 0x48
push 0
lea ecx, [esi + 0x49c]
push ecx
push 0x5b4af8
call fcn.00407f30
push 0
lea edx, [esi + 0x69a]
push edx
push 0x5b4b00
call fcn.00407f30
add esi, 0x6d8
push esi
push 0
push 0x5b4b08
call fcn.00407f30
add esp, 0x24
pop edi
pop esi
add esp, 0xc
ret
cmp byte [0x5ec5b4], 0
jne 0x408288
push str.0:db0:lk0:hs0:ld0:ll0:hb0:pj61.4_.4202:zb0.1:bb
mov byte [0x5ec5b4], 1
call fcn.0054eef4
push 0x12a0
push 0
push 0x5ea788
call fcn.0054fb10
push 0
push 0x5ea7a6
push 0x5b4b10
call fcn.00407f30
push 0
push 0x5ea9a4
push 0x5b4b18
call fcn.00407f30
push 0x5ea9e0
push 0
push 0x5b4b20
call fcn.00407f30
push 0
push 0x5ea9e4
push 0x5b4b28
call fcn.00407f30
add esp, 0x40
push 0
push 0x5eabe2
push 0x5b4b30
call fcn.00407f30
push 0x5eac20
push 0
push 0x5b4b38
call fcn.00407f30
push 0
push 0x5eac24
push 0x5b4b40
call fcn.00407f30
push 0
push 0x5eae22
push 0x5b4b48
call fcn.00407f30
push 0x5eae60
push 0
push 0x5b4b50
call fcn.00407f30
add esp, 0x3c
mov eax, 0x5ea788
jmp 0x408060
ret