joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a6c5
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0
je 0x40a73d
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcslen
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea eax, [ecx + eax*2]
jmp 0x40a71e
movzx ecx, word [eax - 2]
cmp ecx, 0x20
je 0x40a71b
cmp ecx, 0x5c
je 0x40a71b
cmp ecx, 0x2f
jne 0x40a728
add eax, 0xfffffffe
lea ecx, [ebp - 0x20c]
cmp eax, ecx
ja 0x40a708
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
jmp 0x40a73f
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x40a745
Capabilities:
Set file attributes

Disassembly:
xor eax, eax
cmp dword [esp + 4], eax
je 0x40a753
jmp dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
ret 8

Function at 0x40a7b9
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x40a7e2
test byte [esp + 8], 2
je 0x40a7d6
push pe_nt_image_headers32
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
jmp 0x40a7e4
xor eax, eax
ret 8

Function at 0x40aa40
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x40aa7c
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4

Function at 0x40ae80
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x40af74
cmp word [edx], 0
je 0x40af74
mov ecx, dword [esp + 0x10]
push esi
cmp ecx, 0x19
jne 0x40af0d
mov esi, dword [esp + 0xc]
mov ecx, edx
push edi
cmp dword [esi + 4], 0
lea edi, [ecx + 2]
je 0x40aee0
jmp 0x40aec0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40aec0
sub ecx, edi
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.0040b020
pop edi
pop esi
pop ecx
ret 0xc
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40aee0
sub ecx, edi
lea eax, [esp + 8]
push 0
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
cmp ecx, 2
lea ecx, [esp + 0x10]
setne al
push ecx
dec eax
and eax, 0xfde9
push edx
push eax
call fcn.0040b130
mov esi, eax
test esi, esi
je 0x40af6b
mov eax, dword [esp + 0xc]
cmp dword [eax + 4], 0
je 0x40af48
push dword [esp + 0x10]
push esi
push eax
call fcn.0040b020
mov dword [esp + 4], eax
jmp 0x40af5c
push 0
lea ecx, [esp + 8]
push ecx
push dword [esp + 0x18]
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push esi
push 0
push dword [0x418010]
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc
Function at 0x40afb0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
mov dword [esp + 4], 0
test esi, esi
je 0x40b015
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x40b00d
push dword [esp + 0x10]
push dword [0x418724]
call fcn.0040d459
test eax, eax
je 0x40b003
cmp dword [eax + 4], 0
je 0x40aff2
push edi
push esi
push eax
call fcn.0040b020
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea ecx, [esp + 0xc]
push ecx
push edi
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
pop edi
xor eax, eax
pop esi
pop ecx
ret 0xc
xor eax, eax
pop esi
pop ecx
ret 0xc

Function at 0x40b020
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp dword [esi + 0x1c], 0
jne 0x40b127
cmp dword [esi + 0x14], 1
jne 0x40b06b
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0xc]
push 1
neg eax
cdq
push ecx
push eax
push dword [esi]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
push edi
mov edi, dword [esp + 0x20]
cmp eax, edi
jle 0x40b0e8
mov ecx, dword [esi + 8]
add ecx, dword [esi + 4]
sub ecx, eax
mov eax, edi
dec eax
je 0x40b0d3
dec eax
je 0x40b0bc
sub eax, 2
je 0x40b0a7
push edi
push dword [esp + 0x20]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov ax, word [eax]
mov word [ecx], ax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov al, byte [eax]
mov byte [ecx], al
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
push esi
call fcn.0040aa40
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x40b115
push 0
lea eax, [esp + 0xc]
push eax
push edi
push dword [esp + 0x28]
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0xc
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
push edi
push dword [esp + 0x20]
add ecx, eax
jmp 0x40b091
xor eax, eax
pop esi
add esp, 0xc
ret 0xc

Function at 0x40b311
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
and dword [ecx + 0x18], 0
and dword [ecx + 0x14], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [ecx + 0x5c], eax
ret
Function at 0x40c870
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x40d2e8
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push dword [0x418618]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x40d349
push esi
push dword [0x418614]
push 8
push dword [0x418010]
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
push edi
push dword [0x418618]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
mov esi, dword [0x418610]
jmp 0x40d339
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40d337
mov eax, dword [esi + 8]
add eax, edi
push eax
call ecx
pop ecx
mov esi, dword [esi]
test esi, esi
jne 0x40d327
push edi
push 0x40d286
call fcn.00412082
pop esi
mov eax, dword [esp + 8]
add eax, edi
pop edi
ret 4

Function at 0x40d353
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ecx, esi
push edi
and ecx, 3
je 0x40d369
push 4
pop eax
sub eax, ecx
add esi, eax
mov eax, dword [0x418614]
mov ebx, dword [sym.imp.KERNEL32.DLL_TlsSetValue]
test eax, eax
jne 0x40d3a0
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
push esi
push 8
push dword [0x418010]
mov dword [0x418618], eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
push eax
push dword [0x418618]
call ebx
mov eax, dword [0x418614]
mov edi, eax
add eax, esi
push eax
push dword [0x418618]
mov dword [0x418614], eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
push eax
push 8
push dword [0x418010]
call dword [sym.imp.KERNEL32.DLL_HeapReAlloc]
mov ebp, eax
push ebp
push dword [0x418618]
call ebx
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
test esi, esi
jne 0x40d3e0
test ebx, ebx
je 0x40d401
push 0x14
push 0x418610
call fcn.0040db72
pop ecx
pop ecx
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], ebx
test esi, esi
je 0x40d401
lea ecx, [edi + ebp]
push ecx
call esi
pop ecx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x40dec0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x417178]
push eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
sub edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x40df06
mov ecx, dword [ebp - 4]
add ecx, 0xa
push ecx
push 0
mov edx, dword [0x418728]
push edx
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
jmp 0x40df27
mov edx, dword [ebp - 4]
add edx, 0xa
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0x418728]
push edx
call dword [sym.imp.KERNEL32.DLL_HeapReAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
shr edx, 1
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.0040e3a0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 8], edx
mov esp, ebp
pop ebp
ret 8

Function at 0x40e080
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x417178]
push eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
add edx, 2
mov eax, dword [ebp - 4]
mov dword [eax + 8], edx
mov esp, ebp
pop ebp
ret

Function at 0x40e0b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x417178]
push eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov edx, dword [ebp - 4]
add eax, dword [edx + 8]
mov esp, ebp
pop ebp
ret

Function at 0x40e1e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x417178]
push eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx]
jb 0x40e21e
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
cmp dword [ebp + 8], ecx
ja 0x40e21e
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
sub ecx, dword [eax]
add ecx, 1
mov eax, ecx
jmp 0x40e220
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x40e230
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x417178]
push eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x40e260
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x417178]
push eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0xffffffff
jne 0x40e284
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
lea eax, [ecx + edx*2]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
sub edx, 4
cmp dword [ebp - 8], edx
jl 0x40e2d4
mov eax, dword [ebp - 8]
add eax, 0x4000
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
add eax, 0xa
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x418728]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapReAlloc]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x40e31c
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0x100000
jle 0x40e31c
cmp dword [ebp - 8], 0x100000
jge 0x40e2f0
mov dword [ebp - 8], 0x100000
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
add eax, 0xa
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x418728]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapReAlloc]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx*2]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8

Function at 0x40e3f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x417178]
push eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
shl ecx, 1
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
sub eax, ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov esp, ebp
pop ebp
ret 4

Function at 0x40e740
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x417178]
push eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x412082
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x418680], 0
push ebx
push esi
mov esi, 0x418688
jne 0x4120ae
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
push esi
mov dword [0x4186a0], eax
call dword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
mov dword [0x418680], 1
push dword [0x4186a0]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x41214b
push 0x14
push 8
push dword [0x418010]
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412175
push esi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov eax, dword [0x418684]
test eax, eax
je 0x4120f0
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x418684], ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.DLL_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41217a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_RegisterWaitForSingleObject]
push ebx
push dword [0x4186a0]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418010]
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
test eax, eax
je 0x412175
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8
Function at 0x405dcf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x405e12
push 6
call fcn.00441ec5
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x405e3c
push 6
call fcn.00441ec5
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
mov eax, 0
sete al
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x405e70
push 6
call fcn.00441ec5
add esp, 4
mov eax, dword [ebp - 8]
jmp 0x405e78
mov esp, ebp
pop ebp
ret 4
Function at 0x406b19
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push pe_nt_image_headers32
push 1
mov ebx, 0x184
call fcn.00443e50
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x406b5e
push ebx
call fcn.00441ebf
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push pe_nt_image_headers32
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x406b8c
push 6
call fcn.00441ec5
add esp, 4
mov eax, dword [ebp - 4]
test eax, eax
je 0x406ba8
push eax
mov ebx, eax
call fcn.0040117e
inc eax
push eax
call fcn.00441eb9
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x406bad
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x406bbe
push ebx
call fcn.00441ebf
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x406bc5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x14], 1
jne 0x406be4
mov dword [ebp + 0x14], 0
jmp 0x406c01
cmp dword [ebp + 0x14], 2
jne 0x406bfa
mov dword [ebp + 0x14], 7
jmp 0x406c01
mov dword [ebp + 0x14], 1
mov dword [ebp - 4], esp
push dword [ebp + 0x14]
push 0x44f226
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x406c3c
push 6
call fcn.00441ec5
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jne 0x406c58
mov eax, 0
jmp 0x406c62
mov eax, 1
jmp 0x406c62
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40a609
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 0
jne 0x40a624
call fcn.0040a694
mov dword [ebp + 8], eax
mov dword [ebp - 4], esp
push dword [ebp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x40a650
push 6
call fcn.00441ec5
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40a67a
push 6
call fcn.00441ec5
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
mov eax, 0
sete al
jmp 0x40a68e
mov esp, ebp
pop ebp
ret 8
Function at 0x4123b8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
push 1
push 0x44f226
push 0x44f226
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4123fe
push 6
call fcn.00441ec5
add esp, 4
mov esp, ebp
pop ebp
ret 4

Function at 0x4139d1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push pe_nt_image_headers32
push 1
mov ebx, 0x184
call fcn.00443e50
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x413a16
push ebx
call fcn.00441ebf
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push pe_nt_image_headers32
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x413a41
push 6
call fcn.00441ec5
add esp, 4
push 0x44f267
push dword [ebp - 4]
mov ecx, 2
call fcn.004011e9
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x413a61
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x413a72
push ebx
call fcn.00441ebf
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x414c54
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 2
jne 0x414d9c
mov dword [ebp - 8], esp
push str.Comet_Thread
push dword [ebp + 8]
call dword [0x4536fd]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x414c95
push 6
call fcn.00441ec5
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x414ceb
mov dword [ebp - 8], esp
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x414cc9
push 6
call fcn.00441ec5
add esp, 4
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x414ceb
push 6
call fcn.00441ec5
add esp, 4
mov dword [ebp - 8], esp
push str.Comet_Image
push dword [ebp + 8]
call dword [0x4536fd]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x414d12
push 6
call fcn.00441ec5
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x414d41
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.gdiplus.dll_GdipDisposeImage]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x414d41
push 6
call fcn.00441ec5
add esp, 4
mov dword [ebp - 8], esp
push str.Comet_Stream
push dword [ebp + 8]
call dword [0x4536fd]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x414d68
push 6
call fcn.00441ec5
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x414d97
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x414d97
push 6
call fcn.00441ec5
add esp, 4
jmp 0x414e63
cmp dword [ebp + 0xc], 0x201
jne 0x414e63
mov dword [ebp - 8], esp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x453701]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x414dd4
push 6
call fcn.00441ec5
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push str.CometHitMove
push dword [ebp + 8]
call dword [0x4536fd]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x414dfe
push 6
call fcn.00441ec5
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x414e5b
mov dword [ebp - 8], esp
call dword [0x453705]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x414e2a
push 6
call fcn.00441ec5
add esp, 4
mov dword [ebp - 8], esp
push 0
push 2
push 0xa1
push dword [ebp + 8]
call dword [0x453709]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x414e5b
push 6
call fcn.00441ec5
add esp, 4
mov eax, dword [ebp - 4]
jmp 0x414e93
mov dword [ebp - 8], esp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x453701]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x414e8e
push 6
call fcn.00441ec5
add esp, 4
jmp 0x414e93
mov esp, ebp
pop ebp
ret 0x10