joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404eaf
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea eax, [ebp - 0x2c]
xor ebx, ebx
mov dword [ebp - 0x38], edx
push ebx
push 1
push ebx
push ebx
push eax
mov esi, ecx
call edi
test eax, eax
jne 0x404ef5
push 8
push 1
push ebx
push ebx
lea eax, [ebp - 0x2c]
push eax
call edi
test eax, eax
jne 0x404ef5
xor al, al
jmp 0x404fd6
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push 0x8003
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x404f19
push ebx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x404eee
mov eax, dword [esi + 0x10]
push 0x10
pop edi
cmp dword [esi + 0x14], edi
jb 0x404f26
mov esi, dword [esi]
push ebx
push eax
push esi
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x404f41
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x404f0d
push ebx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], edi
push eax
lea eax, [ebp - 0x14]
push eax
push 2
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [ebp - 0x30]
test eax, eax
je 0x404f39
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push ebx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp dword [ebp - 0x34], edi
jne 0x404eee
mov esi, str.0123456789abcdef
lea edi, [ebp - 0x28]
push ebx
push 0x20
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x38]
mov ecx, esi
call fcn.00405026
mov edx, ebx
cmp dword [esi + 0x14], 0x10
jb 0x404f9e
mov ecx, dword [esi]
jmp 0x404fa0
mov ecx, esi
movzx eax, byte [ebp + edx - 0x14]
shr eax, 4
mov al, byte [ebp + eax - 0x28]
mov byte [ecx + ebx], al
cmp dword [esi + 0x14], 0x10
jb 0x404fb9
mov eax, dword [esi]
jmp 0x404fbb
mov eax, esi
movzx ecx, byte [ebp + edx - 0x14]
and ecx, 0xf
mov cl, byte [ebp + ecx - 0x28]
mov byte [eax + ebx + 1], cl
add ebx, 2
inc edx
cmp edx, 0x10
jb 0x404f94
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ec65
mov esp, ebp
pop ebp
ret
Function at 0x407a8c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
mov eax, edx
push edi
mov edi, ecx
cmp dword [0x491294], ebx
jne 0x407ad6
mov esi, ebx
push 8
mov eax, esi
pop ecx
test al, 1
je 0x407ab5
shr eax, 1
xor eax, 0xedb88320
jmp 0x407ab7
shr eax, 1
dec ecx
jne 0x407aa8
mov dword [esi*4 + 0x4912e0], eax
inc esi
cmp esi, 0x100
jl 0x407aa3
mov dword [0x491294], 1
mov eax, edx
add eax, edi
xor ecx, ecx
mov esi, eax
or edx, 0xffffffff
sub esi, edi
cmp edi, eax
cmova esi, ecx
test esi, esi
je 0x407b02
movzx eax, byte [edi]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x4912e0]
inc edi
inc ebx
cmp ebx, esi
jb 0x407aea
pop edi
not edx
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x407fff
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4080c2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x4080c1
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x408053
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x408053
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x408057
xor eax, eax
jmp 0x4080c0
push edi
push ebx
push eax
call fcn.004248e0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
je 0x408085
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov esi, eax
test esi, esi
je 0x4080af
mov ecx, dword [ebp - 4]
lea eax, [esi + 4]
and dword [eax], 0
push eax
push ecx
mov dword [esi], vtable.Gdiplus::Image.0
call dword [sym.imp.gdiplus.dll_GdipLoadImageFromStream]
mov dword [esi + 8], eax
jmp 0x4080b1
xor esi, esi
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4080be
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, esi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4080c7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x4080cf
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4080e2
test al, 0x10
jne 0x4080e2
mov al, 1
ret
xor al, al
ret
Function at 0x40841a
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push 0x264
mov eax, 0x46acab
call fcn.0042a2ac
mov esi, ecx
xor eax, eax
xor ebx, ebx
push 0x208
mov word [ebp - 0x224], ax
lea eax, [ebp - 0x222]
push ebx
push eax
mov dword [ebp - 0x270], ebx
call fcn.0042ccd0
add esp, 0xc
call fcn.004080e5
test al, al
je 0x40851d
lea eax, [ebp - 0x224]
push eax
push ebx
push ebx
push 0x24
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x40847e
push 0x477d20
jmp 0x40853e
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x23c]
call fcn.00403e52
push str._temp
mov edx, eax
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x26c]
call fcn.004059a7
pop ecx
cmp dword [eax + 0x14], 8
jb 0x4084ae
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4084c0
test al, 0x10
je 0x4084c0
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x26c]
call fcn.004041d3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x23c]
push 0
push 1
call fcn.004041d3
test bl, bl
je 0x40851d
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x254]
call fcn.00403e52
xor ebx, ebx
mov edx, eax
inc ebx
mov ecx, esi
push str._temp
mov dword [ebp - 4], ebx
call fcn.004059a7
pop ecx
push 0
push ebx
lea ecx, [ebp - 0x254]
call fcn.004041d3
jmp 0x408545
lea eax, [ebp - 0x224]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x408474
lea eax, [ebp - 0x224]
push eax
mov ecx, esi
call fcn.00403e52
mov eax, esi
call fcn.0042a25b
ret
Function at 0x40854d
Capabilities:
Get common file path

Disassembly:
push 0x2ec
mov eax, 0x46ad0a
call fcn.0042a2ac
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x248], ebx
call fcn.004080e5
test al, al
je 0x4085bd
xor eax, eax
push 0x208
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push ebx
push eax
call fcn.0042ccd0
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
push ebx
push ebx
push 0x1c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ecx, esi
test eax, eax
je 0x4085b4
push 0x477d20
call fcn.00403e52
jmp 0x408769
lea eax, [ebp - 0x220]
push eax
jmp 0x4085aa
mov dword [ebp - 0x23c], ebx
lea eax, [ebp - 0x23c]
mov dword [ebp - 4], ebx
push eax
push 0x4789fc
push 1
push ebx
push 0x46f590
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x408710
mov eax, dword [ebp - 0x23c]
test eax, eax
je 0x408710
mov dword [ebp - 0x240], ebx
lea edx, [ebp - 0x240]
mov byte [ebp - 4], 2
mov ecx, dword [eax]
push edx
push 0x46f540
push eax
call dword [ecx + 0x18]
test eax, eax
js 0x4086e7
mov eax, dword [ebp - 0x240]
test eax, eax
je 0x4086e7
lea edx, [ebp - 0x244]
mov dword [ebp - 0x244], ebx
mov ecx, dword [eax]
push edx
push 0x8000
push eax
call dword [ecx + 0x18]
test eax, eax
jns 0x4086a6
push ecx
push ecx
lea ecx, [ebp - 0x2f8]
call fcn.0040fe2b
lea eax, [ebp - 0x2f8]
mov byte [ebp - 4], 4
test eax, eax
je 0x40866f
mov edx, str.Cant_get_folder_path
lea ecx, [ebp - 0x2e8]
call fcn.00409c8e
lea ecx, [ebp - 0x2f8]
mov byte [ebp - 4], 2
call fcn.0040fba3
push 0x477d20
mov ecx, esi
call fcn.00403e52
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x240]
test eax, eax
je 0x408755
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x408755
push dword [ebp - 0x244]
lea ecx, [ebp - 0x238]
call fcn.00403e52
push dword [ebp - 0x244]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [ebp - 0x238]
mov dword [ebp - 0x244], ebx
push eax
mov ecx, esi
call fcn.00403e83
push ebx
push 1
lea ecx, [ebp - 0x238]
call fcn.004041d3
jmp 0x40868a
push ecx
push ecx
lea ecx, [ebp - 0x2f8]
call fcn.0040fe2b
lea eax, [ebp - 0x2f8]
mov byte [ebp - 4], 3
test eax, eax
je 0x40866f
mov edx, str.Cant_get_path
jmp 0x408664
push ecx
push ecx
lea ecx, [ebp - 0x2f8]
call fcn.0040fe2b
lea eax, [ebp - 0x2f8]
mov byte [ebp - 4], 1
test eax, eax
je 0x40873b
mov edx, str.Cant_get_path_manager
lea ecx, [ebp - 0x2e8]
call fcn.00409c8e
lea ecx, [ebp - 0x2f8]
mov byte [ebp - 4], bl
call fcn.0040fba3
push 0x477d20
mov ecx, esi
call fcn.00403e52
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x23c]
test eax, eax
je 0x408769
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
call fcn.0042a25b
ret
Function at 0x4088cb
Capabilities:
Create process on windows

Disassembly:
push 0x51c
mov eax, 0x46ad95
call fcn.0042a2ac
mov esi, ecx
push esi
lea ecx, [ebp - 0x438]
call fcn.00403e52
lea ecx, [ebp - 0x438]
call fcn.004080c7
mov bl, al
lea ecx, [ebp - 0x438]
neg bl
sbb bl, bl
xor edi, edi
push edi
push 1
call fcn.004041d3
inc bl
jne 0x408a16
push str..torrent
push esi
call fcn.0041fdb4
pop ecx
pop ecx
test eax, eax
jne 0x408a16
push str..tor
push esi
call fcn.0041fdb4
pop ecx
pop ecx
test eax, eax
jne 0x408a16
push str.magnet:
push esi
call fcn.0041fdb4
pop ecx
pop ecx
test eax, eax
jne 0x408a16
push 0x40e
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push edi
push eax
call fcn.0042ccd0
add esp, 0xc
lea eax, [ebp - 0x420]
push esi
push str._select___s_
push 0x208
push eax
call fcn.0040a347
add esp, 0x10
test eax, eax
jns 0x4089c5
push ecx
push ecx
lea ecx, [ebp - 0x528]
call fcn.0040fe2b
lea eax, [ebp - 0x528]
mov dword [ebp - 4], edi
test eax, eax
je 0x4089b4
mov edx, str.Buffer_is_to_small
lea ecx, [ebp - 0x518]
call fcn.00409c8e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x528]
call fcn.0040fba3
jmp 0x408a16
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x474]
push edi
push eax
call fcn.0042ccd0
add esp, 0xc
mov dword [ebp - 0x474], esi
lea eax, [ebp - 0x420]
mov dword [ebp - 0x464], str.explorer.exe
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x474]
mov dword [ebp - 0x468], str.open
push eax
mov dword [ebp - 0x458], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
call fcn.0042a25b
ret

Function at 0x408c61
Capabilities:
Delete file

Disassembly:
push 0x208
mov eax, 0x46ae6a
call fcn.0042a2ac
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x160], ebx
mov edi, ebx
push edi
push ebx
push ebx
push str.ipartner_i__i__i.exe
lea eax, [ebp - 0x114]
push 0x80
push eax
call fcn.0040a347
add esp, 0x18
test eax, eax
js 0x408d63
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x144]
call fcn.00403e52
lea ecx, [ebp - 0x15c]
mov dword [ebp - 4], 1
call fcn.0040841a
lea ecx, [ebp - 0x144]
mov byte [ebp - 4], 2
push ecx
mov edx, eax
lea ecx, [ebp - 0x12c]
call fcn.00408771
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x15c]
call fcn.004041d3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144]
push ebx
push 1
call fcn.004041d3
lea ecx, [ebp - 0x12c]
call fcn.004080c7
test al, al
je 0x408d45
cmp dword [ebp - 0x118], 8
lea eax, [ebp - 0x12c]
cmovae eax, dword [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x408d45
push ebx
push 1
lea ecx, [ebp - 0x12c]
call fcn.004041d3
inc edi
cmp edi, 0x64
jl 0x408c7c
jmp 0x408d9c
lea eax, [ebp - 0x12c]
mov ecx, esi
push eax
call fcn.00403e83
push ebx
push 1
lea ecx, [ebp - 0x12c]
call fcn.004041d3
jmp 0x408da8
push ecx
push ecx
lea ecx, [ebp - 0x214]
call fcn.0040fe2b
lea eax, [ebp - 0x214]
mov dword [ebp - 4], ebx
test eax, eax
je 0x408d8d
mov edx, str.Too_small_buffer
lea ecx, [ebp - 0x204]
call fcn.00409c8e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x214]
call fcn.0040fba3
push 0x477d20
mov ecx, esi
call fcn.00403e52
mov eax, esi
call fcn.0042a25b
ret
Function at 0x4091bd
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46afa6
mov eax, dword fs:[0]
push eax
sub esp, 0x290
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x288], eax
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x2a0]
mov dword fs:[0], eax
push 0x208
xor ebx, ebx
lea eax, [esp + 0x90]
push ebx
push eax
call fcn.0042ccd0
add esp, 0xc
lea eax, [esp + 0x8c]
push 0x103
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40935c
lea eax, [esp + 0x8c]
push eax
lea ecx, [esp + 0x78]
call fcn.00403e52
mov edi, 0x478960
mov esi, eax
push edi
call fcn.0040359e
pop ecx
push eax
push ecx
push edi
mov ecx, esi
call fcn.0040996d
push ebx
push 1
lea ecx, [esp + 0x7c]
mov edi, eax
call fcn.004041d3
cmp edi, 0xffffffff
je 0x40935c
mov esi, ebx
lea eax, [esp + 0x8c]
push eax
lea ecx, [esp + 0x18]
call fcn.00403e52
inc esi
mov dword [esp + 0x2a8], ebx
mov edx, esi
lea ecx, [esp + 0x5c]
call fcn.0040a2f4
push eax
mov edx, 0x478978
mov byte [esp + 0x2ac], 1
lea ecx, [esp + 0x48]
call fcn.00405977
mov byte [esp + 0x2ac], 2
lea ecx, [esp + 0x30]
mov edx, eax
mov dword [esp], str._.exe
call fcn.004059a7
pop ecx
push 0xffffffffffffffff
push ebx
push eax
push 4
push edi
lea ecx, [esp + 0x28]
mov byte [esp + 0x2bc], 3
call fcn.004095af
push ebx
push 1
lea ecx, [esp + 0x34]
call fcn.004041d3
push ebx
push 1
lea ecx, [esp + 0x4c]
call fcn.004041d3
push ebx
push 1
lea ecx, [esp + 0x64]
mov byte [esp + 0x2b0], bl
call fcn.004041d3
lea ecx, [esp + 0x14]
call fcn.004080c7
test al, al
jne 0x40933c
cmp dword [esp + 0x28], 8
lea eax, [esp + 0x14]
push 8
cmovae eax, dword [esp + 0x18]
push eax
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x409382
or dword [esp + 0x2a8], 0xffffffff
lea ecx, [esp + 0x14]
push ebx
push 1
call fcn.004041d3
cmp esi, 0x3e8
jl 0x409273
xor al, al
mov ecx, dword [esp + 0x2a0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x288]
xor ecx, esp
call fcn.0041ec65
mov esp, ebp
pop ebp
ret
push ebx
push 1
lea ecx, [esp + 0x1c]
call fcn.004041d3
mov al, 1
jmp 0x40935e
Function at 0x409392
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0x38
xor ebx, ebx
lea eax, [ebp - 0x3c]
push ebx
push eax
mov esi, edx
mov edi, ecx
call fcn.0042ccd0
add esp, 0xc
mov dword [ebp - 0x40], 0x3c
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x3c], 0x440
jb 0x4093c6
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x30], edi
jb 0x4093d1
mov esi, dword [esi]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x2c], esi
push eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], str.open
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x4093fa
xor al, al
jmp 0x40942e
cmp dword [ebp - 8], ebx
je 0x4093f6
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4093f6
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x4093f6
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409435
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x1c]
push edi
push esi
call fcn.00403e52
lea ecx, [ebp - 0x1c]
call fcn.004080c7
mov bl, al
lea ecx, [ebp - 0x1c]
neg bl
sbb bl, bl
xor edi, edi
push edi
push 1
call fcn.004041d3
inc bl
jne 0x4094db
push edi
push 0x80
push 3
push edi
xor ebx, ebx
inc ebx
push ebx
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4094db
test esi, esi
je 0x4094db
xor eax, eax
mov dword [ebp - 0x24], edi
push edi
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x24]
push eax
push 2
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4094d4
cmp dword [ebp - 0x24], 2
jne 0x4094d4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x20], 0x4d
jne 0x4094ce
cmp byte [ebp - 0x1f], 0x5a
je 0x4094d0
mov ebx, edi
mov al, bl
jmp 0x4094dd
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ec65
mov esp, ebp
pop ebp
ret

Function at 0x40a70e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push 0x38
lea eax, [ebp - 0x38]
mov esi, ecx
push 0
push eax
call fcn.0042ccd0
and dword [ebp - 0x34], 0
lea eax, [ebp - 0x3c]
and dword [ebp - 0x24], 0
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], str.open
push eax
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x28], 0x478a80
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40dfa5
Capabilities:
Get graphical window text

Disassembly:
push 0x24c
mov eax, 0x46b528
call fcn.0042a2ac
mov esi, ecx
mov eax, dword [ebp + 0x14]
xor ebx, ebx
mov dword [ebp - 0x258], ebx
mov byte [eax], 1
mov eax, dword [ebp + 8]
sub eax, ebx
je 0x40e0b5
dec eax
je 0x40e04b
dec eax
jne 0x40e1f8
mov eax, dword [ebp + 0xc]
sub eax, ebx
je 0x40e02a
dec eax
dec eax
jne 0x40e1f8
mov ecx, dword [esi + 0x1c4]
call fcn.00415856
lea eax, [esi + 0xbc]
push eax
lea ecx, [esi + 0xcc]
call fcn.0040f512
push ebx
push 0x12
lea ecx, [esi + 8]
call fcn.0040fa55
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.0040ee4c
jmp 0x40e1f8
mov esi, dword [esi + 0x1c4]
mov dl, 1
mov ecx, 0x47a3f0
mov dword [esi], ebx
call fcn.00405132
mov ecx, dword [esi + 4]
call fcn.00407594
jmp 0x40e1f8
mov eax, dword [ebp + 0xc]
sub eax, ebx
je 0x40e05c
dec eax
je 0x40e080
dec eax
jne 0x40e1f8
cmp dword [ebp + 0xc], 2
mov dl, 1
mov edi, dword [esi + 0x1c4]
je 0x40e09c
mov ecx, 0x47a420
call fcn.00405132
mov ecx, esi
call fcn.0040eacd
jmp 0x40e1f8
mov eax, dword [esi + 0x198]
imul eax, dword [ebp + 0x10]
push ebx
push 0x64
pop ecx
cdq
idiv ecx
add eax, dword [esi + 0x1a0]
jmp 0x40e1bd
mov ecx, 0x47a414
call fcn.00405132
mov ecx, dword [edi + 4]
push 0x47a41c
call fcn.004074fe
jmp 0x40e074
mov eax, dword [ebp + 0xc]
sub eax, ebx
je 0x40e1dd
dec eax
je 0x40e1ac
dec eax
jne 0x40e1f8
mov ecx, dword [esi + 0x1c4]
push 0x47a410
mov ecx, dword [ecx + 4]
call fcn.004074fe
lea ecx, [ebp - 0x254]
call fcn.00408aad
mov dword [ebp - 4], ebx
mov dword [ebp - 0x258], 1
cmp dword [eax + 0x10], ebx
je 0x40e109
call fcn.004094ee
test al, al
jne 0x40e109
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x254]
xor edi, edi
push edi
push 1
call fcn.004041d3
test bl, bl
je 0x40e074
mov eax, dword [esi + 0x194]
mov dword [esi + 0x1a0], eax
xor eax, eax
push 0x208
mov word [ebp - 0x224], ax
lea eax, [ebp - 0x222]
push edi
push eax
call fcn.0042ccd0
add esp, 0xc
lea eax, [ebp - 0x224]
lea ecx, [esi + 8]
push 0x105
push eax
push 0xa
call fcn.0040fa55
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x23c]
call fcn.00403e52
xor ebx, ebx
lea eax, [ebp - 0x23c]
inc ebx
mov dword [ebp - 4], ebx
mov ecx, dword [esi + 0x1c4]
push eax
call fcn.0041576a
push edi
push ebx
lea ecx, [ebp - 0x23c]
call fcn.004041d3
jmp 0x40e1f8
mov eax, dword [esi + 0x194]
imul eax, dword [ebp + 0x10]
push 0x64
pop ecx
push ebx
cdq
idiv ecx
push eax
push 0x402
push 0x12
lea ecx, [esi + 8]
call fcn.0040fa55
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x40e1f8
mov eax, dword [esi + 0x1c4]
mov dl, 1
mov ecx, 0x47a408
mov dword [eax], ebx
call fcn.00405132
mov ecx, esi
call fcn.0040ec8c
xor eax, eax
call fcn.0042a25b
ret 0x10
Function at 0x40e99f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
movdqa xmm0, xmmword [0x47a9f0]
push ebx
push esi
push edi
push 9
mov ebx, ecx
mov dword [ebp - 0x1c], 0x11
pop ecx
movdqu xmmword [ebp - 0x3c], xmm0
lea esi, [ebp - 0x3c]
xor edi, edi
movdqa xmm0, xmmword [0x47aa10]
mov dword [ebp - 0x40], ebx
push 4
movdqu xmmword [ebp - 0x2c], xmm0
pop eax
test ecx, ecx
je 0x40ea14
lea eax, [ebx + 8]
mov ebx, eax
push dword [ebp + 8]
mov ecx, ebx
push dword [esi]
call fcn.0040fa55
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 4
pop eax
add esi, eax
inc edi
cmp edi, 9
jne 0x40e9ec
mov ebx, dword [ebp - 0x40]
movdqa xmm0, xmmword [0x47a9d0]
lea esi, [ebp - 0x18]
xor edi, edi
movdqu xmmword [ebp - 0x18], xmm0
test eax, eax
je 0x40ea4e
push 0
push dword [esi]
lea ecx, [ebx + 8]
call fcn.0040fa55
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 4
pop eax
add esi, eax
inc edi
cmp edi, eax
jne 0x40ea2a
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ec65
mov esp, ebp
pop ebp
ret 4
Function at 0x40ec8c
Capabilities:
Hide graphical window

Disassembly:
push 0x244
mov eax, 0x46b616
call fcn.0042a2ac
mov ebx, ecx
mov dword [ebp - 0x250], ebx
lea eax, [ebx + 0xbc]
mov byte [ebx + 0x1a4], 1
push eax
lea ecx, [ebx + 0xcc]
call fcn.0040f512
push 0
push 0x12
lea ecx, [ebx + 8]
call fcn.0040fa55
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, 0x479494
mov dword [ebx + 0x178], 3
push edi
call fcn.0040359e
pop ecx
push eax
push edi
lea ecx, [ebx + 0x17c]
call fcn.004044a7
push 1
push 0
lea ecx, [ebx + 8]
call fcn.0040fa55
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
lea esi, [ebx + 0xdc]
lea edi, [ebp - 0x224]
movsd dword es:[edi], dword [esi]
push 0x14
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004034f8
mov ebx, dword [ebx + 0x24]
lea edi, [ebp - 0x224]
mov esi, dword [ebp - 0x250]
sub ebx, eax
sub ebx, dword [ebp - 0x21c]
add ebx, dword [ebp - 0x224]
push 0x14
lea esi, [esi + 0xdc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004034f8
mov esi, dword [ebp - 0x250]
lea edi, [ebp - 0x224]
mov ecx, dword [esi + 0x28]
lea edx, [esi + 0xdc]
sub ecx, eax
mov esi, edx
sub ecx, dword [ebp - 0x218]
add ecx, dword [ebp - 0x220]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x218]
lea edi, [ebp - 0x234]
sub eax, dword [ebp - 0x220]
mov esi, edx
add eax, ecx
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x22c]
sub eax, dword [ebp - 0x234]
add eax, ebx
push eax
push ecx
push ebx
push edx
call dword [sym.imp.USER32.dll_SetRect]
mov ebx, dword [ebp - 0x250]
mov ecx, ebx
call fcn.0040f426
test al, al
lea eax, [ebx + 0x54]
je 0x40edd6
cmp dword [eax + 0x14], 8
jb 0x40edc9
mov eax, dword [eax]
push eax
mov eax, 0x4794b8
mov ecx, 0x4795e8
jmp 0x40ede9
cmp dword [eax + 0x14], 8
jb 0x40edde
mov eax, dword [eax]
push eax
mov eax, 0x479718
mov ecx, 0x479848
cmp dword [ebx + 0x64], 0x2e
cmovae eax, ecx
push eax
lea eax, [ebp - 0x214]
push pe_nt_image_headers32
push eax
call fcn.0040a347
add esp, 0x10
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0x24c]
push eax
call fcn.00403e52
xor esi, esi
lea eax, [ebp - 0x24c]
mov dword [ebp - 4], esi
mov ecx, dword [ebx + 0x134]
add ecx, 0x18
cmp ecx, eax
je 0x40ee38
push 0xffffffffffffffff
push esi
push eax
call fcn.00404967
push esi
push 1
lea ecx, [ebp - 0x24c]
call fcn.004041d3
call fcn.0042a25b
ret