joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a892
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
and word [ebp - 0x210], 0
push ebx
push esi
mov ebx, 0x81
push edi
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 4]
mov esi, 0x41540c
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 8]
push eax
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360se_3.exe
push 0x80000002
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0x104
call dword [0x40d260]
lea eax, [ebp - 0x210]
push eax
call dword [0x40d258]
test eax, eax
je 0x40a9b4
and word [ebp - 0x620], 0
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x61e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.360seURL
push str._s_shellopencommand
lea eax, [ebp - 0x620]
push 0x103
push eax
call dword [0x40d21c]
and word [ebp - 0x418], 0
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x416]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x418]
push 0x104
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.0040a53e
lea eax, [ebp - 0x418]
mov edi, 0x80000000
push eax
lea eax, [ebp - 0x620]
push esi
push eax
push edi
call fcn.0040a559
add esp, 0x2c
test eax, eax
je 0x40a9b4
call fcn.0040a5d5
test eax, eax
push str.360seURL
je 0x40a9a1
push str.Progid
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push 0x80000001
jmp 0x40a9a8
push esi
push str..html
push edi
call fcn.0040a559
add esp, 0x10
test eax, eax
jne 0x40a9b8
xor eax, eax
jmp 0x40a9bb
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a9de
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
and word [ebp - 0x424], 0
push ebx
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x422]
mov esi, dword [0x40d260]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0xc]
mov ebx, 0x41540c
push eax
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360chrome.exe
push 0x80000002
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x103
call esi
test eax, eax
jne 0x40ac2c
cmp word [ebp - 0x424], ax
je 0x40ac2c
and word [ebp - 0x62c], ax
mov ecx, 0x81
lea edi, [ebp - 0x62a]
mov dword [ebp - 8], 0x103
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.360ChromeURL_shellopencommand
push 0x80000000
call esi
test eax, eax
jne 0x40aace
cmp word [ebp - 0x62c], ax
je 0x40aace
lea eax, [ebp - 0x62c]
push eax
call fcn.0040a9c0
lea eax, [ebp - 0x424]
push eax
call fcn.0040a9c0
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x62c]
push eax
call dword [0x40d218]
add esp, 0x10
test eax, eax
je 0x40ac2c
call fcn.0040a5d5
test eax, eax
je 0x40aba4
and word [ebp - 0x21c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x21a]
rep stosd dword es:[edi], eax
push 1
mov dword [ebp - 0x14], 0x103
stosw word es:[edi], ax
pop ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x10]
push eax
push str.Progid
push str.SoftwareMicrosoftWindows_shellAssociationsUrlAssociationshttpUserChoice
push 0x80000001
mov dword [ebp - 0x10], ebx
call esi
test eax, eax
jne 0x40ac27
cmp word [ebp - 0x21c], ax
je 0x40ac27
mov edi, dword [0x40d1d4]
mov esi, str.360ChromeURL
lea eax, [ebp - 0x21c]
push esi
push eax
call edi
pop ecx
test eax, eax
pop ecx
jne 0x40ab59
mov dword [ebp - 4], ebx
jmp 0x40ac27
lea eax, [ebp - 0x21c]
push esi
push eax
call dword [0x40d218]
pop ecx
test eax, eax
pop ecx
je 0x40ac27
lea eax, [ebp - 0x21c]
push 0x2e
push eax
call dword [0x40d1c0]
pop ecx
test eax, eax
pop ecx
je 0x40ac27
and word [eax], 0
lea eax, [ebp - 0x21c]
push esi
push eax
call edi
pop ecx
test eax, eax
pop ecx
jne 0x40ac27
jmp 0x40ab51
and word [ebp - 0x21c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x21a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x103
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.SoftwareClasseshttp_shellopencommand
push 0x80000001
call esi
test eax, eax
jne 0x40ac27
cmp word [ebp - 0x21c], ax
je 0x40ac27
lea eax, [ebp - 0x21c]
push eax
call fcn.0040a9c0
lea eax, [ebp - 0x424]
push eax
call fcn.0040a9c0
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [0x40d218]
add esp, 0x10
test eax, eax
je 0x40ac27
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
jmp 0x40ac2e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b109
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x40b121
xor eax, eax
jmp 0x40b1cd
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
mov word [ebp - 0x208], si
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
push 0x1a
push eax
push esi
call dword [0x40d244]
lea eax, [ebp - 0x208]
push str.360se360se.ini
push eax
call dword [0x40d25c]
lea eax, [ebp - 0x208]
push eax
push esi
push str.NotJoinPrivate
push str.Option
call dword [0x40d164]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x40e]
mov word [ebp - 0x410], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp + 8]
lea eax, [edi + 0x20c]
cmp eax, esi
je 0x40b1c3
cmp word [eax], si
je 0x40b1c3
lea ecx, [ebp - 0x410]
push esi
push ecx
push esi
push esi
push esi
push 0x7d0
push 1
push esi
push 1
push 0x414328
push esi
push eax
call fcn.004064aa
add esp, 0x30
mov ecx, edi
call fcn.0040b006
xor eax, eax
pop edi
pop esi
leave
ret 4
Function at 0x40b597
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
movzx eax, word [ecx + 0x14]
push edi
lea esi, [eax + ecx + 0x18]
cmp ebx, dword [esi + 0xc]
lea edx, [esi + 0xc]
jae 0x40b5b8
mov eax, ebx
jmp 0x40b5f7
movzx edi, word [ecx + 6]
xor eax, eax
test edi, edi
jbe 0x40b5f4
mov dword [ebp + 0xc], edx
lea edx, [eax + 1]
cmp edx, edi
mov dword [ebp - 4], edx
jne 0x40b5d4
mov edx, dword [ecx + 0x50]
jmp 0x40b5da
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x28]
mov dword [ebp + 0x10], edx
mov edx, dword [ebp + 0xc]
cmp ebx, dword [edx]
jb 0x40b5e9
cmp ebx, dword [ebp + 0x10]
jb 0x40b5fc
mov eax, dword [ebp - 4]
add dword [ebp + 0xc], 0x28
cmp eax, edi
jb 0x40b5c5
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
lea eax, [eax + eax*4]
lea ecx, [esi + eax*8]
mov eax, dword [esi + eax*8 + 0x14]
sub eax, dword [ecx + 0xc]
add eax, ebx
jmp 0x40b5f7

Function at 0x40b896
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x8902c0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00890410
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x8902e6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8902d2
add dl, dl
jne 0x8902f1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x890344
xor eax, eax
add dl, dl
jne 0x8902fe
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8903e5
add dl, dl
jne 0x89030d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x890318
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x890323
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x89032e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x89033a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x8902dd
mov eax, 1
add dl, dl
jne 0x890352
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x89035d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x890349
sub eax, ebx
mov ebx, 1
jne 0x890390
mov ecx, 1
add dl, dl
jne 0x890376
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x890381
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x89036d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8902dd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x8903a7
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8903b2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x89039e
cmp eax, 0x7d00
jae 0x8903d5
cmp eax, 0x500
jb 0x8903d0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8902dd
cmp eax, 0x7f
ja 0x8903d8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8902dd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x890406
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x8902dd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x41c1a0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov eax, dword [0x464ba0]
test eax, eax
je 0x41c288
push esi
mov esi, dword [esp + 0x14]
test esi, esi
push edi
je 0x41c216
mov eax, dword [0x46b06c]
test eax, eax
je 0x41c1c9
mov eax, dword [0x46b058]
test eax, eax
je 0x41c216
mov eax, dword [0x469f94]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0x40
push 0x1000
push 0x1000
push 0
push eax
call edi
mov ecx, dword [0x469f94]
push 0x20
push 0x1000
push esi
push 0
push ecx
mov dword [0x469b70], eax
call edi
mov dword [0x469fb8], eax
mov dword [0x46b06c], 1
mov dword [0x46b058], 0
mov edx, dword [esp + 0x10]
mov eax, dword [0x469b70]
mov ecx, dword [0x469f94]
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0x1000
push edx
push eax
push ecx
call edi
test esi, esi
je 0x41c252
mov edx, dword [esp + 0x14]
mov eax, dword [0x469fb8]
mov ecx, dword [0x469f94]
push 0
push esi
push edx
push eax
push ecx
call edi
mov edx, dword [0x469fb8]
mov eax, dword [0x469b70]
mov ecx, dword [0x469f94]
push 0
push 0
push edx
push eax
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
ret

Function at 0x41c8b0
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x41c8cf
add esp, 0x14
ret
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp]
push 0
push 0
lea edx, [esp + 0xc]
push 0
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41c919
xor eax, eax
add esp, 0x14
ret
push 0
push 0xc
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
add esp, 0x14
ret
Function at 0x4404b0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.00430a00
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x44057b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x44057b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x44052e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x440539
or bh, 8
and edi, 0x8000000
je 0x440554
mov eax, dword [0x475f5c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x44057b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x440950
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x44097b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x44099f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x4409ba
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20

Function at 0x443e14
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x443e4c
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00446a9f
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00446a77
jmp 0x443e58
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x443e5c
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
push 0x4740f0
mov ecx, edi
call fcn.004467a8
cmp dword [esi + 0x34], 0
push dword [esp + 0xc]
jne 0x443eaf
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x443ec2
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, edi
call fcn.00446a9f
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, edi
call fcn.00446a77
jmp 0x443ec2
mov ecx, esi
call fcn.00445b52
test eax, eax
je 0x443ec2
push edi
mov ecx, eax
call fcn.00443e14
mov eax, dword [edi]
pop edi
pop esi
mov eax, dword [eax - 8]
ret 8

Function at 0x445457
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x445499
call fcn.0044c9dd
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x445499
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x445490
xor eax, eax
jmp 0x4454a1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004454a7
pop edi
pop esi
pop ebx
ret 4

Function at 0x44afab
Capabilities:
Create http request

Disassembly:
mov eax, 0x451864
call fcn.00430bd8
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x44afe3
call fcn.0044c9dd
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x44b008
push eax
push dword [esi + 4]
call fcn.0044bbeb
jmp 0x44b014
push esi
push eax
mov ecx, 0x4740f8
call fcn.0044b025
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x18
Function at 0x44b2d6
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x4518c3
call fcn.00430bd8
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00448282
mov eax, dword [ebp + 0x18]
lea ebx, [esi + 0x24]
mov dword [esi + 0x1c], eax
mov eax, dword [0x4651a0]
xor edi, edi
mov dword [ebx], eax
mov dword [ebp - 4], edi
push dword [ebp + 0x10]
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
mov dword [esi], vtable.CInternetFile.0
call fcn.004467a8
push dword [ebp + 0x14]
mov ecx, ebx
call fcn.004467a8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x18

Function at 0x44d19c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x44d1ca
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x44d1e8
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0044d102
jmp 0x44d1e8
mov eax, dword [esi + 0x14]
test eax, eax
je 0x44d1e8
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0044d102
test edi, edi
mov eax, edi
jne 0x44d1d2
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x40115f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esp
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [esp + 0x2c], 1
je 0x401178
movzx esi, word [esp + 0x30]
xor eax, eax
mov edi, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x402660], eax
mov dword [ebp - 0x4c], 0x30
call fcn.0040114f
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x44], 0x401050
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], str.Lyrik
mov dword [ebp - 0x20], eax
call fcn.00401142
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
test eax, eax
je 0x40124c
mov eax, 0x80000000
push edi
push dword [ebp - 0x38]
push edi
push edi
push eax
push eax
push eax
push eax
push 0x80
push str.Dindom
push str.Lyrik
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push eax
mov dword [0x402668], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x402668]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x40124c
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x401230
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4012a3
Capabilities:
Hide graphical window

Disassembly:
push ebp
push 0x10000
push 0x1000
push 1
call dword [sym.imp.KERNEL32.DLL_HeapCreate]
mov dword [0x403df4], eax
push 0x64
push 8
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ecx, 0x30
push eax
mov dword [eax], ecx
add eax, 0x4c
mov ebp, eax
mov eax, 0x400000
mov dword [0x403df0], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], 0x4011a6
mov dword [ebp - 0x24], 0x403011
call dword [sym.imp.USER32.DLL_RegisterClassExA]
xor eax, eax
push eax
push dword [0x403df0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push 0x403006
push 0x403011
push eax
call dword [sym.imp.USER32.DLL_CreateWindowExA]
mov dword [0x403df8], eax
push eax
push 0
push eax
call dword [sym.imp.USER32.DLL_ShowWindow]
call dword [sym.imp.USER32.DLL_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.DLL_GetMessageA]
test eax, eax
je 0x40136d
mov edi, dword [sym.imp.USER32.DLL_DispatchMessageA]
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.DLL_GetMessageA]
test eax, eax
jne 0x401354
mov eax, dword [0x403df4]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapDestroy]
pop ebp
ret 0x10
Function at 0x402da0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
test ebx, ebx
je 0x402e90
mov edx, dword [esp + 0x48]
test edx, edx
je 0x402ec0
mov eax, dword [esp + 0x48]
mov dword [esp], str._n_n_s
mov dword [esp + 4], eax
call sym._printf
cmp ebx, 0x14
jle 0x402de0
mov ebx, 0x14
lea edi, [esp + 0x1a]
mov dword [esp + 0x1a], 0x58585858
mov dword [esp + 0x1e], 0x58585858
mov dword [esp + 0x22], 0x58585858
mov dword [esp + 0x26], 0x58585858
mov dword [esp + 0x2a], 0x58585858
mov byte [esp + ebx + 0x1a], 0
mov dword [esp + 4], edi
mov dword [esp], str._n_s
call sym._printf
test esi, esi
mov dword [0x4500e0], esi
mov dword [0x4500e4], ebx
jle 0x402e90
mov dword [0x4500ec], 1
mov dword [0x4500e8], esi
mov eax, dword [0x4500e4]
mov dword [esp + 4], 0x58
mov dword [esp], edi
imul eax, esi
cdq
idiv dword [0x4500e0]
lea ebx, [eax + 1]
mov dword [esp + 8], ebx
call sym._memset
mov byte [esp + ebx + 0x1a], 0
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], str._r_s__d____b_b_b
call sym._printf
sub dword [0x4500e8], 1
add esp, 0x30
xor eax, eax
pop ebx
pop esi
pop edi
ret
mov eax, dword [0x4500ec]
test eax, eax
je 0x402e87
mov esi, dword [0x4500e8]
lea edi, [esp + 0x1a]
test esi, esi
jg 0x402e41
mov dword [esp], str._r_______r
call sym._printf
add esp, 0x30
xor eax, eax
pop ebx
pop esi
pop edi
ret
mov dword [esp], 0x4452dd
call sym._puts
jmp 0x402dd6