joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a890
Capabilities:
Access peb ldr_data
Get process heap force flags
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43051d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x43800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.hgeGUIObject.0
mov dword [edi + 4], 0
mov word [edi + 8], 0
mov byte [edi + 0xa], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov byte [edi + 0x1c], 1
push 0x180
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call sub.hge.dll_hgeCreate
mov dword [0x438bac], eax
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov word [edi + 0x40], 0
mov dword [edi + 0x20], 0xffffffff
mov dword [edi + 0x34], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0x3f800000
mov dword [edi + 0x64], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x30], 0
mov byte [edi + 0x40], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
movss xmm1, dword [ebp + 0xc]
movss xmm0, dword [ebp + 0x10]
mov dword [edi], vtable.Label.0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 4], eax
mov dword [edi + 0x34], 5
mov word [edi + 8], 0x101
mov byte [edi + 0xa], 1
mov eax, dword [ecx + 0xc0c]
mov dword [edi + 0x74], eax
cvttss2si eax, xmm1
mov dword [edi + 0x70], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 4], 0
mov dword [edi + 0x64], 0x3f800000
movss dword [edi + 0x7c], xmm0
mov dword [edi + 0x44], eax
cvttss2si eax, xmm0
movss xmm3, dword [0x4336bc]
mov dword [edi + 0x48], eax
mov eax, ecx
shr eax, 0x10
movzx eax, al
movss dword [edi + 0x78], xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4336c0]
mov eax, ecx
shr eax, 8
movzx eax, al
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
divss xmm2, xmm3
addsd xmm0, qword [eax*8 + 0x4336c0]
movzx eax, cl
cvtpd2ps xmm0, xmm0
movd xmm1, eax
divss xmm0, xmm3
cvtdq2pd xmm1, xmm1
movss dword [ebp + 8], xmm0
shr eax, 0x1f
mulss xmm2, xmm3
addsd xmm1, qword [eax*8 + 0x4336c0]
cvtpd2ps xmm0, xmm1
divss xmm0, xmm3
movss dword [ebp + 0x14], xmm0
movaps xmm0, xmm2
call fcn.0042e6f0
movss xmm0, dword [ebp + 8]
mulss xmm0, dword [0x4336bc]
lea esi, [eax + 0xff00]
shl esi, 8
call fcn.0042e6f0
movss xmm0, dword [ebp + 0x14]
add esi, eax
mulss xmm0, dword [0x4336bc]
shl esi, 8
call fcn.0042e6f0
push dword [ebp + 0x18]
add esi, eax
mov ecx, edi
mov dword [edi + 0x68], esi
call fcn.0041af00
mov byte [edi + 0x6c], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x41d600
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430717
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x43800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi + 4], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi], 0
mov dword [esi + 8], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov ecx, dword [0x438740]
push str.Images_Fake.png
call fcn.00427c70
mov dword [esi + 0x24], eax
mov eax, dword [0x438744]
push 1
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x180]
mov dword [esi + 0x28], eax
mov ecx, dword [0x438740]
push 0x433de4
call fcn.00427c70
mov dword [esi + 4], eax
mov ecx, dword [0x438740]
push 0x433de4
call fcn.00427c70
mov dword [esi + 0x20], eax
mov ecx, dword [0x438740]
push str.Images_MiniMapCoveredPixel.png
call fcn.00427c70
mov dword [esi + 0xc], eax
movss xmm3, dword [0x4336bc]
mov ecx, dword [eax + 0xc]
mov eax, ecx
shr eax, 0x18
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4336c0]
mov eax, ecx
shr eax, 8
movzx eax, al
cvtpd2ps xmm4, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
divss xmm4, xmm3
addsd xmm0, qword [eax*8 + 0x4336c0]
movzx eax, cl
shr ecx, 0x10
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
divss xmm2, xmm3
addsd xmm0, qword [eax*8 + 0x4336c0]
movzx eax, cl
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
divss xmm1, xmm3
addsd xmm0, qword [eax*8 + 0x4336c0]
cvtpd2ps xmm0, xmm0
divss xmm0, xmm3
push 0x8c
movss dword [esi + 0x10], xmm0
movss dword [esi + 0x14], xmm2
movss dword [esi + 0x18], xmm1
movss dword [esi + 0x1c], xmm4
call fcn.0042e5a9
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x41d822
sub esp, 0x10
mov ecx, eax
mov dword [esp + 0xc], 0x43c80000
mov dword [esp + 8], 0x44160000
mov dword [esp + 4], 0
mov dword [esp], 0
push 0
call fcn.00401410
jmp 0x41d824
xor eax, eax
push 0xffffffffffffffff
push 0xff042139
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
mov dword [esi + 0x2c], eax
call fcn.004019a0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41ff90
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [0x43800c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
call fcn.00417a60
lea edx, [ebp - 0x16c]
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x41ffb4
push dword [esi]
lea eax, [ebp - 0x68]
push 0x433650
push eax
call fcn.004174e0
lea edx, [ebp - 0x68]
add esp, 0xc
mov esi, edx
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x41ffe0
lea edi, [ebp - 0x16c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41fff0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x16c]
dec edi
nop dword [eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x420010
mov ax, word [0x433654]
mov word [edi], ax
lea eax, [ebp - 0x68]
push 0xa
push eax
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itoa]
lea edx, [ebp - 0x68]
add esp, 0xc
mov esi, edx
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x420040
lea edi, [ebp - 0x16c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x420050
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x16c]
pop edi
dec ecx
pop esi
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x420070
mov eax, dword [str..sav]
mov dword [ecx], eax
mov al, byte [0x43365c]
mov byte [ecx + 4], al
lea eax, [ebp - 0x16c]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
call fcn.0042e5e7
mov esp, ebp
pop ebp
ret 4
Function at 0x423050
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430a59
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x43800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
push 0x8c
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi], eax
call fcn.0042e5a9
mov edi, eax
add esp, 4
mov dword [ebp + 0xc], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x42312d
mov eax, dword [0x438744]
sub esp, 0x10
mov ecx, dword [eax]
mov dword [esp + 0xc], 0x3f800000
mov dword [esp + 8], 0x3f800000
mov dword [esp + 4], 0
mov dword [esp], 0
push 0
push 0
push str.Images_Fake.png
push eax
call dword [ecx + 0x184]
push eax
mov ecx, edi
call fcn.00401410
jmp 0x42312f
xor eax, eax
push 0x8c
mov dword [ebp - 4], 0xffffffff
mov dword [esi + 0x24], eax
call fcn.0042e5a9
mov edi, eax
add esp, 4
mov dword [ebp + 0xc], edi
mov dword [ebp - 4], 1
test edi, edi
je 0x42319c
mov eax, dword [0x438744]
sub esp, 0x10
mov ecx, dword [eax]
mov dword [esp + 0xc], 0x3f800000
mov dword [esp + 8], 0x3f800000
mov dword [esp + 4], 0
mov dword [esp], 0
push 0
push 0
push str.Images_Fake.png
push eax
call dword [ecx + 0x184]
push eax
mov ecx, edi
call fcn.00401410
mov dword [esi + 0x28], eax
jmp 0x4231a3
mov dword [esi + 0x28], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42f3af
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42f3ee
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42f3ee
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42f3ee
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42f3ee
cmp dword [ecx + 0x74], 0xe
jbe 0x42f3ee
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x401020
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40103b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401072
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x40106e
jmp 0x401060
cmp esi, eax
jae 0x401072
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401060
cmp esi, eax
jb 0x401079
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4044f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push esi
push eax
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esi, eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40452b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40454a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404569
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x404610
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x579699
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5e5e94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 4
call fcn.00461a3b
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40465d
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
mov edi, dword [ebp + 0x14]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x104
or eax, ecx
mov dword [ebp - 0x10], 1
jge 0x404698
push 0x104
mov ecx, esi
call fcn.004013a0
mov eax, dword [esi]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
push edi
push 0x104
push eax
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x4046ce
push ecx
push eax
call fcn.0055faf9
add esp, 8
test eax, eax
js 0x404781
mov ecx, dword [esi]
cmp eax, dword [ecx - 8]
jg 0x404781
mov dword [ecx - 0xc], eax
mov ecx, dword [esi]
mov byte [eax + ecx], 0
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
mov byte [ebp - 4], 3
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404705
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404728
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40474b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0x18]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40476e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00401000
int3
Function at 0x404810
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5796e0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5e5e94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 2
call fcn.00461a3b
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x404856
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
fld dword [ebp + 0x14]
sub esp, 8
fstp qword [esp]
lea ecx, [ebp - 0x10]
push 0x5906ac
push ecx
mov byte [ebp - 4], 3
call fcn.00402fb0
mov esi, dword [ebp - 0x10]
mov eax, dword [esi - 8]
mov edi, dword [ebp + 0x10]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
add esp, 0x10
or eax, ecx
jge 0x4048ad
push 0x104
lea ecx, [ebp - 0x10]
call fcn.004013a0
mov esi, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edi
push 0x104
push esi
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.0055faf9
add esp, 8
test eax, eax
js 0x404994
cmp eax, dword [esi - 8]
jg 0x404994
mov dword [esi - 0xc], eax
push esi
mov byte [eax + esi], 0
call fcn.005600b8
fstp dword [ebp - 0x10]
lea eax, [esi - 0x10]
add esp, 4
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404914
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404937
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40495a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404980
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
fld dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00401000
int3
Function at 0x404ec0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5e5e94]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x10], eax
xor eax, eax
lea edi, [esi + 0x10]
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
call ebx
mov edx, dword [esi + 8]
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0xc], 0
je 0x404fc8
nop
push edi
call ebx
mov edx, dword [esi + 8]
lea eax, [esi + 0x40]
push eax
lea eax, [ebp - 0x1c]
push eax
push 1
lea ecx, [ebp - 0x11]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x404f7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
cmp eax, 0x3e5
je 0x404f56
push str.ReadFile__
jmp 0x404f73
mov ecx, dword [esi + 8]
push 1
lea eax, [ebp - 0x1c]
push eax
lea eax, [esi + 0x40]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x404f7a
push str.GetOverlappedResults___in_ReadFile__
mov ecx, esi
call fcn.00404d80
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [esi + 0x88]
movzx eax, byte [ebp - 0x11]
mov ecx, dword [esi + 0x84]
push edx
mov edx, dword [ecx + 0x20]
push eax
push 0x407
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push edi
call ebx
mov edx, dword [esi + 8]
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0xc], 0
jne 0x404f20
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0055fffe
mov esp, ebp
pop ebp
ret
Function at 0x46280d
Capabilities:
Connect socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_connect]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebp
ret 8

Function at 0x46349e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.00468732
call fcn.004135d0
cmp eax, esi
pop esi
jne 0x4634ba
mov ecx, 0x5e91b0
jmp fcn.0047bd86
ret

Function at 0x46405b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.004749a6
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x464094
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.00463c9d
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x4640f2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x464116
cmp dword [edi + 0x74], 0
jne 0x464116
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.004749a6
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.004640b3
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x46a37a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x46a3c1
call fcn.004749a6
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x46a3c1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x46a3dd
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00469e7f
mov esi, eax
test edi, edi
je 0x46a3db
test ebx, ebx
je 0x46a3db
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x46d1e4
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x589d0a
call fcn.00561d7b
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x46d209
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x46d25b
call fcn.00461a3b
push eax
lea ecx, [ebp - 0x10]
call fcn.00401350
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00561bad
push eax
call fcn.00403a20
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004010d0
mov eax, esi
call fcn.00561e53
ret 8

Function at 0x46f4cb
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0046ee84
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x46f515
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00461935
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.004044a0
jmp 0x46f520
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0047cdcc
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x46f526
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.0046cad6
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x46f563
call fcn.0046ee84
mov dword [esi + 0xc], 1
jmp 0x46f568
call fcn.0046ee84
cmp dword [esi], 0
je 0x46f5b1
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
test eax, eax
jle 0x46f589
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00461935
jmp 0x46f59b
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.00401510
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.004044a0
jmp 0x46f5d5
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x46f5d5
push dword [esi]
push dword [ebp + 8]
call fcn.0047cdcc
pop esi
pop ebp
ret 0xc