joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f59b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x42f5bf
cmp dword [edi + 0x74], 0
jne 0x42f5bf
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.0042cb3b
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0042f55c
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x435ed5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x435f1c
call fcn.0042cb3b
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x435f1c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x435f38
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004359d5
mov esi, eax
test edi, edi
je 0x435f36
test ebx, ebx
je 0x435f36
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x436341
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x53bce7
call fcn.00520473
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x436366
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x4363b8
call fcn.0042aa6c
push eax
lea ecx, [ebp - 0x10]
call fcn.004014e0
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0051fddc
push eax
call fcn.00401050
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004011b0
mov eax, esi
call fcn.0052054b
ret 8

Function at 0x437d31
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.004379d5
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x437d7b
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0042a96d
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0040f0d0
jmp 0x437d86
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0043e299
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x437e22
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.00435fe1
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x437e5f
call fcn.004379d5
mov dword [esi + 0xc], 1
jmp 0x437e64
call fcn.004379d5
cmp dword [esi], 0
je 0x437ead
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x437e85
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0042a96d
jmp 0x437e97
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.00401840
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0040f0d0
jmp 0x437ed1
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x437ed1
push dword [esi]
push dword [ebp + 8]
call fcn.0043e299
pop esi
pop ebp
ret 0xc

Function at 0x439585
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], ecx
call fcn.0042cb3b
mov esi, dword [eax + 0xc]
test esi, esi
jne 0x43959f
xor eax, eax
jmp 0x4395e8
push ebx
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x4395e7
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebx
push esi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.00439523
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop ebx
pop esi
leave
ret 4

Function at 0x43c87c
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5a6a30]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x43c8b1
xor eax, eax
jmp 0x43c904
lea eax, [ebp - 0x210]
push eax
call fcn.005205a7
cmp word [ebp + eax*2 - 0x212], 0x5c
pop ecx
je 0x43c8e2
push 0x5457b4
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.0051f22b
add esp, 0xc
test eax, eax
jne 0x43c8ad
push edi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.0051f22b
add esp, 0xc
test eax, eax
jne 0x43c8ad
lea eax, [ebp - 0x210]
push eax
call fcn.0042b7be
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0051e701
leave
ret

Function at 0x46e926
Capabilities:
Contain obfuscated stackstrings

Disassembly:
rol esi, cl
inc ebp
stc
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
invalid
invalid
Function at 0x46eb0d
Capabilities:
Inspect section memory permissions

Disassembly:
jle 0x46eb4b
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x46ed82
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x46eb38
cmp dword [eax + 0xc], ebx
je 0x46ebdb
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.0046e593
std
invalid
invalid
call fcn.0046e593
enter 0xffffffffffff8f6c, 0x51
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x46ec47
add eax, esi
cmp dword [eax], ebx
je 0x46ec47
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x46ec42
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x46ec2c
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x46ec34
cmp edx, ebx
jne 0x46ed82
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x46ec03
add eax, dword [eax + 4]
jmp 0x46ebf0
mov dword [ebp + 0xc], ebx
jmp 0x46ec52
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x46ec6a
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x46ec88
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x46ece6
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x46eccd
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x46ecd6
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x46ece0
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x46ecc2
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x46ec4c
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x46ed33
dec eax
je 0x46ed2a
sub eax, 3
je 0x46ed21
invalid
mov dword [ebp - 4], 0x40
jmp 0x46ed50
mov dword [ebp - 4], 4
jmp 0x46ed36
mov dword [ebp - 4], 0x20
jmp 0x46ed36
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x46ed82
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x46ed02
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0046e593
rol byte [ebx + 0x75ffc248], 0x14
push 1
push esi
call edi
mov eax, esi
jmp 0x46ed8e
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x46eb62
Capabilities:
Inspect section memory permissions

Disassembly:
add al, 0x75
or dword [ecx], edi
pop eax
or al, 0xf
test byte [ebx - 0x75000000], ah
js 0x46eb47
test byte [ebx], bl
add al, byte [eax]
add byte [ebx + 0x488bbc45], cl
adc byte [ebx - 0x723cc500], cl
cmp al, 0x31
jne 0x46eb7b
mov dword [ebp + 0x10], edi
jmp 0x46eb80
add eax, esi
mov dword [ebp + 0x10], eax
call fcn.0046e593
or al, bl
je 0x46eb2c
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x46ebc9
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x46eba4
and eax, 0xffff
push eax
jmp 0x46eba8
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0046e558
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x46ed82
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x46eb89
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
jmp 0x46eb2a
Function at 0x46eccf
Capabilities:
Inspect section memory permissions

Disassembly:
jle 0x46eb4b
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x46ed82
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x46eb38
cmp dword [eax + 0xc], ebx
je 0x46ebdb
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.0046e593
std
invalid
invalid
call fcn.0046e593
enter 0xffffffffffff8f6c, 0x51
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x46ec47
add eax, esi
cmp dword [eax], ebx
je 0x46ec47
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x46ec42
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x46ec2c
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x46ec34
cmp edx, ebx
jne 0x46ed82
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x46ec03
add eax, dword [eax + 4]
jmp 0x46ebf0
mov dword [ebp + 0xc], ebx
jmp 0x46ec52
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x46ec6a
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x46ec88
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x46ece6
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x46eccd
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x46ecd6
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x46ece0
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x46ecc2
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x46ec4c
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x46ed33
dec eax
je 0x46ed2a
sub eax, 3
je 0x46ed21
invalid
mov dword [ebp - 4], 0x40
jmp 0x46ed50
mov dword [ebp - 4], 4
jmp 0x46ed36
mov dword [ebp - 4], 0x20
jmp 0x46ed36
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x46ed82
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x46ed02
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0046e593
rol byte [ebx + 0x75ffc248], 0x14
push 1
push esi
call edi
mov eax, esi
jmp 0x46ed8e
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x470766
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.0046e593
push eax
sti
pop edx
dec esp

Function at 0x4aa79f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x4aa7b9
call fcn.0042cb3b
mov esi, dword [eax + 0xc]
push dword [0x5ac164]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4aa7d7
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x4aa7cf
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x4aa804
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x4aa7d1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.004aa6cd
mov esi, eax
jmp 0x4aa7f6

Function at 0x4fa834
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.00434493
call fcn.0042b844
cmp eax, esi
pop esi
jne 0x4fa850
mov ecx, 0x5aa0d0
jmp fcn.0043d4c5
ret

Function at 0x4fe1d7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x4fe1ef
mov edi, dword [esi + 0xc]
jmp 0x4fe22f
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4fe208
call fcn.00438212
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4fe21d
call fcn.00438212
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4fe22f
call fcn.00438212
call fcn.0042cb3b
cmp dword [eax + 0x3c], 0
je 0x4fe244
push edi
mov ecx, ebx
call fcn.004fd001
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004fe0f1
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x4fe262
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4fe26e
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x51e701
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5a6a30]
jne 0x51e70b
repz ret
jmp fcn.0052693c
Function at 0x52f4c8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5a6a30]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0052474b
and dword [ebp - 0x14], 0
cmp dword [0x5ae7d4], 0
mov dword [ebp - 0x18], eax
jne 0x52f57b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x52f623
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x583f48
push ebx
call edi
test eax, eax
je 0x52f623
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x583f38
push ebx
mov dword [0x5ae7d4], eax
call edi
push eax
call esi
push 0x583f24
push ebx
mov dword [0x5ae7d8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x5ae7dc], eax
call edi
push eax
call esi
mov dword [0x5ae7e4], eax
test eax, eax
je 0x52f57b
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x5ae7e0], eax
mov eax, dword [0x5ae7e0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x52f5d4
cmp dword [0x5ae7e4], ecx
je 0x52f5d4
push eax
call esi
push dword [0x5ae7e4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x52f5d4
test ebx, ebx
je 0x52f5d4
call edi
test eax, eax
je 0x52f5cb
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x52f5cb
test byte [ebp - 8], 1
jne 0x52f5d4
or dword [ebp + 0x10], 0x200000
jmp 0x52f607
mov eax, dword [0x5ae7d8]
cmp eax, dword [ebp - 0x18]
je 0x52f607
push eax
call esi
test eax, eax
je 0x52f607
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x52f607
mov eax, dword [0x5ae7dc]
cmp eax, dword [ebp - 0x18]
je 0x52f607
push eax
call esi
test eax, eax
je 0x52f607
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x5ae7d4]
call esi
test eax, eax
je 0x52f623
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x52f625
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051e701
leave
ret
Function at 0x10001e00
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov esi, 0xe
inc esi
cmp esi, 0x16
jle 0x10001e1c
cmp esi, 0xd3
jge 0x10001e1c
inc esi
add esi, 0x31
cmp esi, 0x72
jl 0x10001e0d
inc esi
cmp esi, 3
jl 0x10001e2d
add esi, 2
cmp esi, 0xf7
jle 0x10001e3a
mov esi, 0x1c
mov edi, dword [esp + 0x1c]
test edi, edi
jle 0x10001ee0
mov ebx, dword [esp + 0x14]
inc esi
cmp esi, 0x23
jle 0x10001e59
cmp esi, 0xf0
jge 0x10001e59
inc esi
push 0
push edi
push ebp
push ebx
call sub.WS2_32.dll_send
inc esi
cmp esi, 0x18
jle 0x10001e72
cmp esi, 0xef
jge 0x10001e72
inc esi
inc esi
cmp esi, 0x1f
jle 0x10001e81
cmp esi, 0xc9
jge 0x10001e81
inc esi
cmp eax, 0xffffffff
je 0x10001ee9
inc esi
cmp esi, 0x11
jl 0x10001e8f
add esi, 2
cmp esi, 0xd9
jle 0x10001e9c
mov esi, 0x1b
add ebp, eax
dec esi
cmp esi, 0xef
jge 0x10001ea8
inc esi
inc esi
cmp esi, 0x38
jle 0x10001eb7
cmp esi, 0xfa
jge 0x10001eb7
inc esi
sub edi, eax
inc esi
cmp esi, 0xf
jl 0x10001ec2
add esi, 2
cmp esi, 0xe5
jle 0x10001ecf
mov esi, 0x17
dec esi
cmp esi, 0xc
jge 0x10001ed6
inc esi
test edi, edi
jg 0x10001e4a
jmp 0x10001ee4
mov eax, dword [esp + 0x18]
cmp eax, 0xffffffff
jne 0x10001ef0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x100027b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, 0x39
inc esi
cmp esi, 0x52
jle 0x100027c8
cmp esi, 0xed
jge 0x100027c8
inc esi
add esi, 0x2b
cmp esi, 0x9c
jl 0x100027b9
mov eax, dword [esp + 0x1c]
xor ebp, ebp
dec eax
test eax, eax
mov dword [esp + 0x1c], eax
jle 0x10002866
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
inc esi
cmp esi, 3
jl 0x100027f7
add esi, 2
cmp esi, 0xef
jle 0x10002804
mov esi, 0x19
push 0
push 1
push edi
push ebx
call sub.WS2_32.dll_recv
inc esi
cmp esi, 0xb
jl 0x10002818
add esi, 2
cmp esi, 0xac
jle 0x10002825
mov esi, 0x1f
dec esi
cmp esi, 0x72
jge 0x1000282c
inc esi
cmp eax, 0xffffffff
je 0x1000287b
dec esi
cmp esi, 0x40
jge 0x10002838
inc esi
cmp byte [edi], 0xa
je 0x10002866
mov esi, 0x46
inc esi
cmp esi, 0x1d
jle 0x10002851
cmp esi, 0xd9
jge 0x10002851
inc esi
add esi, 0x25
cmp esi, 0xb0
jl 0x10002842
mov eax, dword [esp + 0x1c]
inc ebp
inc edi
cmp ebp, eax
jl 0x100027ee
inc esi
cmp esi, 0x4b
jle 0x10002875
cmp esi, 0xf7
jge 0x10002875
inc esi
cmp ebp, dword [esp + 0x1c]
jne 0x10002882
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov ecx, dword [esp + 0x18]
inc esi
mov eax, 0x5c
mov byte [ecx + ebp + 1], 0
inc eax
cmp eax, 7
jle 0x1000289f
cmp eax, 0xd4
jge 0x1000289f
inc eax
add eax, 0xd
cmp eax, 0x86
jl 0x10002891
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x100028c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [esp + 8]
inc ecx
cmp ecx, 0x5a
jle 0x100028d3
cmp ecx, 0xed
jge 0x100028d3
inc ecx
inc ecx
cmp ecx, 0x32
jle 0x100028e2
cmp ecx, 0xd8
jge 0x100028e2
inc ecx
inc ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
cmp ecx, 0x2c
push edi
jle 0x100028f8
cmp ecx, 0xc9
jge 0x100028f8
inc ecx
mov eax, dword [esp + 0x18]
inc ecx
cmp ecx, 1
mov esi, eax
jl 0x10002907
add ecx, 2
cmp ecx, 0xd9
jle 0x10002914
mov ecx, 0x14
test eax, eax
jle 0x10002a08
mov edi, dword [esp + 0x10]
push 0
push esi
push ebx
dec ecx
push edi
call sub.WS2_32.dll_recv
cmp eax, 0xffffffff
je 0x10002a1c
mov ecx, 0x1e
inc ecx
cmp ecx, 0x26
jle 0x10002948
cmp ecx, 0xf9
jge 0x10002948
inc ecx
add ecx, 0x2b
cmp ecx, 0x67
jl 0x10002939
dec ecx
cmp ecx, 0xd3
jge 0x1000295a
inc ecx
test eax, eax
je 0x10002a08
inc ecx
cmp ecx, 3
jl 0x1000296b
add ecx, 2
add ebx, eax
mov ecx, 1
inc ecx
cmp ecx, 0x4c
jle 0x10002981
cmp ecx, 0xf8
jge 0x10002981
inc ecx
add ecx, 0x1b
cmp ecx, 0x69
jl 0x10002972
sub esi, eax
mov ecx, 0x62
inc ecx
cmp ecx, 0x55
jle 0x1000299f
cmp ecx, 0xe4
jge 0x1000299f
inc ecx
add ecx, 0x25
cmp ecx, 0x8d
jl 0x10002990
test esi, esi
je 0x100029ea
mov eax, 0x1f
inc eax
cmp eax, 0x2a
jle 0x100029c1
cmp eax, 0xdc
jge 0x100029c1
inc eax
add eax, 0x12
cmp eax, 0x8e
jl 0x100029b3
mov ecx, 0x49
inc ecx
cmp ecx, 0x62
jle 0x100029df
cmp ecx, 0xe4
jge 0x100029df
inc ecx
add ecx, 0x27
cmp ecx, 0xaf
jl 0x100029d0
inc ecx
cmp ecx, 8
jl 0x100029f3
add ecx, 2
cmp ecx, 0xf9
jle 0x10002a00
mov ecx, 0x25
test esi, esi
jg 0x10002920
inc ecx
cmp ecx, 5
jl 0x10002a11
add ecx, 2
xor eax, eax
pop edi
test esi, esi
pop esi
pop ebx
sete al
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x10002b00
Capabilities:
Delete file
Get common file path

Disassembly:
mov edx, dword [esp - 0x204]
sub esp, 0x204
inc edx
cmp edx, 0xc
jl 0x10002b16
add edx, 2
cmp edx, 0xc0
jle 0x10002b23
mov edx, 0x25
inc edx
cmp edx, 0xb
jle 0x10002b32
cmp edx, 0xd7
jge 0x10002b32
inc edx
mov al, byte [0x10008724]
push edi
mov byte [esp + 8], al
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
inc edx
cmp edx, 2
stosb byte es:[edi], al
jl 0x10002b55
add edx, 2
lea ecx, [esp + 8]
push ecx
push 0x1ff
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, dword [esp + 0x214]
lea edx, [esp + 8]
push edi
push 0
push str.tmp_
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x10002b8b
pop edi
add esp, 0x204
ret
mov eax, 0x54
inc eax
cmp eax, 0x3f
jle 0x10002b9e
cmp eax, 0xdc
jge 0x10002b9e
inc eax
add eax, 0x2c
cmp eax, 0xbc
jl 0x10002b90
push esi
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, 0x47
inc esi
cmp esi, 0x4e
jle 0x10002bc4
cmp esi, 0xd8
jge 0x10002bc4
inc esi
add esi, 0xb
cmp esi, 0xa9
jl 0x10002bb5
inc esi
cmp esi, 0xb
jl 0x10002bd8
add esi, 2
cmp esi, 0xdb
jle 0x10002be5
mov esi, 0x1d
mov eax, dword [esp + 0x214]
mov ecx, dword [esp + 0x210]
push eax
push ecx
push edi
call fcn.10003040
add esp, 0xc
inc esi
test eax, eax
pop esi
jne 0x10002c0c
pop edi
add esp, 0x204
ret
mov eax, 0x29
inc eax
cmp eax, 8
jle 0x10002c1f
cmp eax, 0xda
jge 0x10002c1f
inc eax
add eax, 0x16
cmp eax, 0x9f
jl 0x10002c11
mov eax, edi
pop edi
add esp, 0x204
ret