joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405370
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x318
mov eax, dword [0x43701c]
xor eax, esp
mov dword [esp + 0x314], eax
push esi
push edi
xor edi, edi
push 0x206
lea eax, [esp + 0x11a]
push edi
push eax
mov esi, ecx
mov word [esp + 0x120], di
call fcn.00426e3a
mov eax, 8
add esp, 0xc
cmp dword [esi + 0x18], eax
jb 0x4053b7
mov esi, dword [esi + 4]
jmp 0x4053ba
add esi, 4
cmp dword [0x437778], eax
mov eax, dword [0x437764]
jae 0x4053cc
mov eax, 0x437764
push esi
push eax
lea ecx, [esp + 0x11c]
push str._s_s
push ecx
mov edx, 0x104
call fcn.00409e00
add esp, 0x10
lea edx, [esp + 8]
push edx
push 0x20219
push edi
lea eax, [esp + 0x120]
push eax
push 0x80000002
mov dword [esp + 0x1c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40542a
pop edi
mov eax, 0xe00c0012
pop esi
mov ecx, dword [esp + 0x314]
xor ecx, esp
call fcn.00426a3b
add esp, 0x318
ret
push 0xfe
lea ecx, [esp + 0x1a]
push edi
push ecx
mov dword [esp + 0x18], edi
mov word [esp + 0x20], di
call fcn.00426e3a
add esp, 0xc
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push ecx
push edi
push str.Name
push edx
mov dword [esp + 0x28], 0xfe
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, edi
jne 0x405497
cmp dword [esp + 0xc], 1
jne 0x405497
push str..Pipe_
mov ecx, ebx
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
call dword [0x42f0fc]
jmp 0x40549c
mov esi, 0xe00c001f
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x31c]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.00426a3b
add esp, 0x318
ret

Function at 0x405990
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
xor esi, esi
test edi, edi
je 0x4059d1
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
mov ecx, edi
sub ecx, esi
push ecx
mov ecx, dword [eax + 0x1c]
lea edx, [esi + ebp]
push edx
push ecx
mov dword [esp + 0x28], 0
call ebx
test eax, eax
je 0x4059d9
add esi, dword [esp + 0x14]
cmp edi, esi
jne 0x4059a3
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
pop esi
pop ebp
mov eax, 0xe00c0009
pop ebx
ret 8

Function at 0x4059f0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
xor esi, esi
test edi, edi
je 0x405a31
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
mov ecx, edi
sub ecx, esi
push ecx
mov ecx, dword [eax + 0x1c]
lea edx, [esi + ebp]
push edx
push ecx
mov dword [esp + 0x28], 0
call ebx
test eax, eax
je 0x405a39
add esi, dword [esp + 0x14]
cmp edi, esi
jne 0x405a03
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
pop esi
pop ebp
mov eax, 0xe00c000b
pop ebx
ret 8
Function at 0x406260
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x42d7c8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x43701c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
lea edi, [esp + 0x14]
call fcn.00401200
push eax
lea eax, [esp + 0x14]
push eax
mov ebx, str.recommendctrl.config
mov dword [esp + 0x28], 0
call fcn.004023f0
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4062d2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
push ecx
push 1
push str.Enable
push str.OpenDaohangNoTtraySwitch
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40630b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x424c90
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x42d062
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x43701c]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push edi
mov eax, dword [0x43701c]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0x228], edi
mov dword [esp + 0xc], edi
mov eax, dword [0x43729c]
mov edx, dword [eax + 0xc]
mov ecx, 0x43729c
mov dword [esp + 0x10], esi
call edx
add eax, 0x10
mov dword [esi], eax
push 0x206
lea eax, [esp + 0x1a]
mov dword [esp + 0x22c], edi
push edi
push eax
mov dword [esp + 0x18], 1
mov word [esp + 0x20], di
call fcn.00426e3a
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x14]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x424d30
sub eax, edx
sar eax, 1
lea edx, [esp + 0x14]
mov ebx, eax
push edx
mov eax, esi
call fcn.004018a0
mov eax, esi
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00426a3b
add esp, 0x220
ret

Function at 0x42693a
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x43701c]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00426879
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00426e3a
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x426989
cmp dword [ebp - 0x1c], 5
jb 0x4269a1
jmp 0x42699d
cmp dword [ebp - 0x10], 1
jne 0x4269a1
cmp dword [ebp - 0x1c], 4
ja 0x42699d
jne 0x4269a1
cmp dword [ebp - 0x18], 0
jbe 0x4269a1
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x42f398
call fcn.0042672c
test eax, eax
jge 0x4269c2
mov byte [0x43769c], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00426a3b
add ebp, 0x78
leave
ret

Function at 0x430003
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x74595cd0
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x2f097d55
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x7ffe53d3
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword fs:[0x30]
nop
and bh, 0xff
cld
pushal
inc eax
popal
cld
pushal
inc eax
popal
cld
push edx
cdq
pop edx
clc
pushal
inc eax
popal
stc
add eax, 0
stc
add eax, 0
stc
add eax, 0
clc
pushal
inc eax
popal
cld
lea esp, [esp]
nop
push edx
cdq
pop edx
nop
pushal
inc eax
popal
nop
add eax, 0
nop
lea esp, [esp]
cld
push edx
cdq
pop edx
clc
pushal
inc eax
popal
cld
lea esp, [esp]
cld
and bh, 0xff
clc
lea esp, [esp]
cld
lea esp, [esp]
stc
lea esp, [esp]
cld
pushal
inc eax
popal
cld
push edx
cdq
pop edx
stc
nop
call 0x7ffe543c
pop edx
stc
lea esp, [esp]
clc
lea esp, [esp]
xor dx, dx
stc
add edx, 0xd5e0
lea esp, [esp]
nop
stc
cld
xor ecx, ecx
pushal
inc eax
popal
clc
lea esp, [esp]
mov cl, 0x1e
nop
and bh, 0xff
cld
nop
stc
nop
xor byte [ecx + edx], 0x4a
loop 0x7ffe5468
add al, 0
clc
push dword fs:[0x24]
stc
pop dword [edx + 0xa]
push edx
cdq
pop edx
nop
mov cl, 0xff
cld
cld
stc
push edx
loop 0x7ffe5485
nop
mov dword [edx + 0x11], 0xffffacbb
push edx
cdq
pop edx
nop
mov ecx, dword [eax + 0x2c]
add eax, 0
cld
nop
mov dword [edx + 0x1b], ecx
cld
mov dword [edx + 0x100], ecx
push edx
cdq
pop edx
cld
push edx
cdq
pop edx
stc
mov dword [eax + 0x2c], esp
cld
push 0
push 0
clc
push edx
cdq
pop edx
stc
cld
cld
cld
push 0
push 0
push 0x30
inc esi
dec esi
cld
push 0x20
cld
nop
push 0
stc
cld
push 0
cld
push edx
cdq
pop edx
pushal
inc eax
popal
add edx, 0xffff7f32
nop
nop
push edx
push edx
push edx
cdq
pop edx
stc
cld
push 0
cld
cld
call dword [edx + 0x8211]
cld
pushal
inc eax
popal
nop
add esp, 0x3f8
push edx
cdq
pop edx
clc
nop
xor eax, eax
clc
lea esp, [esp]
stc
cld
cld
inc eax
stc
ret 0xc
Function at 0x401530
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401545
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401584
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x401580
lea ebx, [ebx]
cmp esi, edx
jae 0x401584
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x401570
cmp esi, edx
jb 0x401589
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x402470
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, 0x588d80
push esi
push edi
cmp eax, 2
jne 0x4024e3
push 0x88
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_LoadBitmapW]
push 0x10
mov edi, eax
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov esi, eax
test esi, esi
je 0x4024d2
lea eax, [ebp - 8]
push eax
push 0
push edi
mov dword [esi], vtable.Gdiplus::Bitmap.0
mov dword [ebp - 8], 0
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromHBITMAP]
mov dword [esi + 8], eax
mov eax, dword [ebp - 8]
push edi
mov dword [esi + 4], eax
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push edi
xor esi, esi
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x4024f3
call fcn.00408ec8
mov ebx, dword [eax + 0xc]
push 0x588d80
push 0x88
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
push esi
push eax
call fcn.0052fed0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0
push ebx
mov dword [ebp - 4], 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov edi, dword [ebp - 4]
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov esi, eax
test esi, esi
je 0x40257f
lea eax, [ebp - 8]
push eax
push edi
mov dword [esi], vtable.Gdiplus::Bitmap.0
mov dword [ebp - 8], 0
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromStream]
mov dword [esi + 8], eax
mov eax, dword [ebp - 8]
mov dword [esi + 4], eax
jmp 0x402581
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4027d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004091a1
Function at 0x4043d0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x40], 0
je 0x40446c
lea eax, [edi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4043fa
mov eax, dword [edi + 0x30]
push eax
push 0
mov ecx, edi
call fcn.00404690
mov esi, dword [edi + 0xc]
dec esi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
js 0x40444a
test esi, esi
js 0x404475
cmp esi, dword [edi + 0xc]
jge 0x404475
mov eax, dword [edi + 8]
mov ebx, dword [eax + esi*4]
lea eax, [esp + 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0xc], 0x103
jne 0x40443e
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
dec esi
jns 0x404410
push dword [edi + 0x40]
call ebx
lea esi, [edi + 0x14]
push esi
mov dword [edi + 0x40], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push dword [edi + 0x3c]
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push 0
push 1
push 0xc000008c
call dword [sym.imp.KERNEL32.dll_RaiseException]
Function at 0x405020
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x554728
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x5ad218]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
lea ebx, [eax*2 + 2]
push ebx
call fcn.004062b4
mov esi, eax
mov dword [ebp - 0x18], esi
push 0xffffffffffffffff
mov dword [ebp - 4], 0
push dword [edi]
lea eax, [ebp - 0x14]
push ebx
push esi
push eax
mov dword [ebp - 0x14], 0
call fcn.0052cdaa
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
mov eax, dword [eax - 0xc]
lea eax, [eax*2 + 2]
push eax
mov dword [ebp + 0xc], eax
call fcn.004062b4
push 0xffffffffffffffff
push dword [ebx]
mov edi, eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.0052cdaa
mov eax, dword [ebp + 0x10]
xorps xmm0, xmm0
movq qword [ebp - 0x30], xmm0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
add esp, 0x30
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x38]
push eax
push edi
movq qword [ebp - 0x38], xmm0
push esi
mov dword [ebp + 8], 0
movq qword [ebp - 0x28], xmm0
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x34], 0
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x405196
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp + 8]
mov dword [eax + 0x190], 0xffffffff
test ebx, ebx
je 0x405167
lea ecx, [ecx]
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x190], ecx
cmp ecx, 0xffffffff
je 0x405196
push dword [ebx + 0x10]
push dword [ebx + 0x18]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x405164
mov eax, dword [ebp - 0x10]
push dword [eax + 0x190]
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x190], 0xffffffff
mov ebx, dword [ebx + 0x1c]
test ebx, ebx
jne 0x405110
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x190]
cmp eax, 0xffffffff
je 0x405196
push 1
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
push dword [ebx + 0x190]
cmp eax, 0xffffffff
jne 0x4051c4
call dword [sym.imp.WS2_32.dll_closesocket]
xor ebx, ebx
push edi
call fcn.004062bd
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004062bd
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call dword [sym.imp.WS2_32.dll_closesocket]
mov ebx, 1
jmp 0x405198
Function at 0x405200
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5548eb
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5ad218]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x14
call fcn.00406287
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x405259
push 0
push 0
push 0
push 0
push 1
push 0x588d58
mov ecx, esi
call fcn.004076f5
jmp 0x40525b
xor esi, esi
mov dword [ebp - 4], 0xffffffff
push 0x194
mov dword [edi], esi
call fcn.00406287
mov esi, eax
add esp, 4
test esi, esi
je 0x405292
push esi
push 0x202
mov dword [esi + 0x190], 0xffffffff
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [edi + 4], esi
jmp 0x405299
mov dword [edi + 4], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40750e
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x54536d
call fcn.0052d17d
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push dword [ebp + 0x1c]
mov edi, dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.004075ef
and dword [ebp - 4], 0
mov dword [ebx], vtable.CHttpConnection.0
call fcn.00407091
push eax
lea ecx, [ebx + 0x18]
call fcn.00401a00
push dword [ebp + 0xc]
lea ecx, [ebx + 0x18]
mov byte [ebp - 4], 1
call fcn.004035f0
push dword [ebx + 8]
push 0
push 3
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [edi + 8]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [ebx + 4], eax
test eax, eax
jne 0x407584
push eax
push dword [ebx + 8]
call fcn.00407b81
push dword [ebx + 0xc]
mov ecx, 0x5ae904
push eax
call fcn.00408538
mov eax, ebx
call fcn.0052d14b
ret 0x18

Function at 0x4076f5
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x40771e
call fcn.00408ec8
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 8], eax
test eax, eax
je 0x40774b
push esi
push eax
mov ecx, 0x5ae904
call fcn.00408538
mov eax, esi
pop esi
pop ebp
ret 0x18
push 0
push dword [esi + 4]
call fcn.00407b81
int3

Function at 0x4091fd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.00408ec8
mov ebx, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x409234
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.00409253
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x40c4bc
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x54f50a
call fcn.0052d17d
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x6c], esi
jne 0x40c4e2
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x40c536
call fcn.00407091
push eax
lea ecx, [ebp - 0x10]
call fcn.00401a00
mov ecx, dword [edi + 0x6c]
lea edx, [ebp - 0x10]
mov eax, dword [ecx]
push edx
mov dword [ebp - 4], esi
call dword [eax + 0x8c]
mov edi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push edi
call fcn.0052cf6f
push eax
call fcn.004015d0
add esp, 0x14
test edi, edi
je 0x40c529
push edi
call fcn.0052cf56
pop ecx
mov esi, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401bc0
mov eax, esi
call fcn.0052d14b
ret 8
Function at 0x40de45
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5ad218]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5b0634]
push esi
push edi
mov edi, dword [ebp + 8]
test eax, eax
jne 0x40de91
push 0x557f20
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40deae
push str.SetDefaultDllDirectories
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov dword [0x5b0634], eax
jmp 0x40de9a
push eax
call dword [sym.imp.KERNEL32.dll_DecodePointer]
mov esi, eax
test esi, esi
je 0x40deae
push 0x800
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x40df1b
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x40dec9
xor eax, eax
jmp 0x40df1b
lea eax, [ebp - 0x210]
push eax
call fcn.0052cf56
cmp word [ebp + eax*2 - 0x212], 0x5c
pop ecx
je 0x40defa
push 0x557f58
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.0052df65
add esp, 0xc
test eax, eax
jne 0x40dec5
push edi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.0052df65
add esp, 0xc
test eax, eax
jne 0x40dec5
lea eax, [ebp - 0x210]
push eax
call fcn.00412b72
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0052bb2e
leave
ret

Function at 0x40e6f4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov esi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], esi
je 0x40e739
call fcn.00408ec8
mov ebx, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40e739
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x40e755
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0041fdab
mov ebx, eax
test edi, edi
je 0x40e753
test esi, esi
je 0x40e753
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]

Function at 0x40e75c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov dword [ebp - 0xb0], 0x9227cd4
mov dword [ebp - 0xb4], 0xc2fbf138
mov dword [ebp - 0x110], 0x65789bc3
mov byte [ebp - 0x28], 0x77
ja 0x40e74e
inc ebp
fldcw word [ecx - 0x3a]
inc ebp
fisubr dword [esi - 0x3a]
inc ebp
fld xword [ecx - 0x3a]
inc ebp
fsubr qword [esi - 0x3a]
inc ebp
frstor dword [ebp - 0x3a]
inc ebp
fidiv word [esi + eax*8 + 0x45]
fild word [eax]
mov dword [ebp - 0x78], 0x522dc7a5