joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4027a0
Capabilities:
Get hostname

Disassembly:
sub esp, 0x100
mov edx, ecx
or ecx, 0xffffffff
xor eax, eax
push ebp
push esi
lea ebp, [edx + 0x834]
push edi
mov edi, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, ecx
cmp eax, 1
jge 0x4027d0
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x100
ret
cmp eax, 2
jle 0x40287e
mov cl, byte [ebp]
cmp cl, 0x28
jne 0x4027ef
push ebx
mov bl, byte [eax + edx + 0x833]
cmp bl, 0x29
pop ebx
je 0x402802
cmp cl, 0x5b
jne 0x40287e
cmp byte [eax + edx + 0x833], 0x5d
jne 0x40287e
lea ecx, [eax - 2]
lea esi, [edx + 0x835]
mov edx, ecx
lea edi, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x452198
and ecx, 3
push 0x452198
rep movsb byte es:[edi], byte [esi]
mov byte [esp + eax + 0x12], 0
lea eax, [esp + 0x14]
push eax
call fcn.004258a0
lea ecx, [esp + 0x18]
push str.local
push ecx
call fcn.00421a60
add esp, 0x14
test eax, eax
jne 0x40287e
lea edx, [esp + 0xc]
push 0x100
push edx
call sub.WSOCK32.dll_gethostname
test eax, eax
jne 0x40287e
lea edi, [esp + 0xc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x100
ret
Function at 0x406550
Capabilities:
Create directory

Disassembly:
sub esp, 0x344
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x358]
test edi, edi
je 0x40662f
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edx, ecx
cmp edx, 1
jl 0x40662f
mov eax, dword [esp + 0x35c]
inc edx
cmp eax, edx
mov dword [esp + 0x10], edx
mov ebp, eax
jge 0x40662f
mov bl, byte [esp + ebp + 0x14]
lea esi, [esp + ebp + 0x14]
cmp bl, 0x5c
je 0x4065cb
cmp bl, 0x2f
je 0x4065cb
test bl, bl
jne 0x40662a
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
mov byte [esi], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x406621
cmp byte [esp + ecx + 0x13], 0x3a
je 0x406621
lea ecx, [esp + 0x214]
lea edx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
test eax, eax
je 0x40660c
cmp eax, 0xffffffff
je 0x40660c
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40661d
lea eax, [esp + 0x14]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x40663f
mov edx, dword [esp + 0x10]
mov byte [esi], bl
mov al, byte [esi + 1]
test al, al
je 0x40662f
inc ebp
cmp ebp, edx
jl 0x4065b5
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x344
ret
mov byte [esi], bl
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x344
ret
Function at 0x406b80
Capabilities:
Check os version

Disassembly:
sub esp, 0x11c
push ebx
mov ebx, dword [esp + 0x128]
push ebp
push esi
test ebx, ebx
push edi
je 0x406b98
mov byte [ebx], 0
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x1c], 5
jb 0x406bd6
mov ecx, dword [esp + 0x130]
lea edx, [esp + 0xac]
push ecx
push str..Global_s
push edx
jmp 0x406beb
mov eax, dword [esp + 0x130]
lea ecx, [esp + 0xac]
push eax
push str.._s
push ecx
call fcn.0041b383
add esp, 0xc
lea edx, [esp + 0xac]
push 0
push 0x80
push 3
push 0
push 3
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
test ebp, ebp
je 0x406d0c
cmp ebp, 0xffffffff
je 0x406d0c
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x18]
push 4
push ecx
push 0
push 0
push 1
push ebp
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x406c7a
test ebx, ebx
je 0x406c66
mov edi, str.InvalidResponse
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x11c
ret
cmp dword [esp + 0x14], 4
je 0x406cbb
test ebx, ebx
je 0x406ca7
mov edi, str.InvalidResponse
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x11c
ret
cmp dword [esp + 0x10], 0x137
je 0x406cff
test ebx, ebx
je 0x406ceb
mov edi, str.InvalidResponse
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x11c
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x11c
ret
test ebx, ebx
je 0x406d32
mov edi, str.OpenFailed
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x11c
ret
Function at 0x407190
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x404
push ebx
push ebp
mov ebp, dword [esp + 0x410]
push esi
test ebp, ebp
push edi
je 0x4071a9
mov byte [ebp], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, eax
or ecx, 0xffffffff
mov edi, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
call fcn.00432401
lea edx, [esp + 0x18]
push 0x452648
push edx
call fcn.00425980
mov edx, eax
add esp, 0xc
test edx, edx
jne 0x407219
lea eax, [esp + 0x14]
push str._update
push eax
call fcn.00425980
mov edx, eax
add esp, 8
test edx, edx
jne 0x407219
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x404
ret
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x10], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test ebp, ebp
rep movsb byte es:[edi], byte [esi]
je 0x407266
lea edi, [edx + 7]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x404
ret

Function at 0x4072e0
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x200
lea eax, [esp]
push ebx
push esi
push edi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xfffffffe
mov cl, byte [esp + ecx + 0xc]
cmp cl, 0x5c
je 0x407322
cmp cl, 0x2f
je 0x407322
lea edx, [esp + 0xc]
mov edi, str.wdsysmsg.exe
jmp 0x40732b
lea edx, [esp + 0xc]
mov edi, 0x452544
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call esi
push 0
lea ecx, [esp + 0x10]
push 0
push ecx
call fcn.00408380
add esp, 0xc
test eax, eax
jle 0x407384
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0xc]
push edx
call esi
pop edi
pop esi
pop ebx
add esp, 0x200
ret
Function at 0x407760
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x210
lea eax, [esp]
push esi
push eax
push 0x448110
push 1
push 0
push 0x448100
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jl 0x407826
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x21c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [esp + 0x220]
test eax, eax
je 0x4077b2
mov ecx, dword [esp + 4]
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x2c]
mov ecx, dword [esp + 0x224]
test ecx, ecx
je 0x4077c8
mov eax, dword [esp + 4]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
push 0x448120
mov ecx, dword [eax]
push eax
call dword [ecx]
mov esi, eax
test esi, esi
jl 0x40781c
mov ecx, dword [esp + 0x218]
lea eax, [esp + 0xc]
push 0x104
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push 1
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
mov esi, eax
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
test esi, esi
setge al
pop esi
add esp, 0x210
ret
Function at 0x407840
Capabilities:
Copy file
Delete file
Get common file path

Disassembly:
sub esp, 0x400
lea eax, [esp]
push ebx
push ebp
push esi
push edi
push eax
push 0x104
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xfffffffe
mov cl, byte [esp + ecx + 0x10]
cmp cl, 0x5c
je 0x407885
cmp cl, 0x2f
je 0x407885
lea edx, [esp + 0x10]
mov edi, str.wdupdate.tmp
jmp 0x40788e
lea edx, [esp + 0x10]
mov edi, 0x452328
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jne 0x40798a
mov eax, dword [esp + 0x420]
mov ecx, dword [esp + 0x41c]
mov edx, dword [esp + 0x418]
push eax
push ecx
lea eax, [esp + 0x18]
push edx
push eax
call fcn.00407760
add esp, 0x10
test eax, eax
je 0x407979
call dword [sym.imp.ole32.dll_CoUninitialize]
mov esi, dword [esp + 0x414]
lea ecx, [esp + 0x210]
push ecx
lea edx, [esp + 0x14]
push esi
push edx
push str.CopyFile
call fcn.004040e0
add esp, 0x10
test eax, eax
je 0x407951
lea eax, [esp + 0x210]
push str.true
push eax
call fcn.00421a60
add esp, 8
test eax, eax
jne 0x407939
mov ebx, 1
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x400
ret
push 0
lea edx, [esp + 0x14]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x400
ret
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x400
ret
Function at 0x408110
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x11c
push ebx
mov ebx, dword [esp + 0x124]
push esi
push edi
test ebx, ebx
jne 0x408128
lea ebx, [esp + 0x10]
mov edi, dword [esp + 0x130]
mov dword [ebx], 0xffffffff
test edi, edi
jne 0x40813d
lea edi, [esp + 0x10]
lea eax, [esp + 0xc]
mov dword [edi], 0xffffffff
push eax
push 0x4553f8
call fcn.0042c490
add esp, 8
mov dword [ebx], eax
test eax, eax
jge 0x408168
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x11c
ret
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40826a
lea ecx, [esp + 0x24]
push ecx
call fcn.004014b0
add esp, 4
test eax, eax
jne 0x408194
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x11c
ret
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4081b3
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x11c
ret
test al, 1
je 0x4081cd
and al, 0xfe
push eax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x40826a
push 0
lea ecx, [esp + 0x28]
push 0
push ecx
call fcn.00407460
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4081f3
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x11c
ret
lea edx, [esp + 0x14]
push 0
push edx
push 0x408280
push esi
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 1
call fcn.00407ee0
push esi
call fcn.0041b490
mov eax, dword [esp + 0x2c]
add esp, 0x14
test eax, eax
jge 0x408245
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x11c
ret
mov ecx, dword [esp + 0xc]
mov dword [edi], eax
test ecx, ecx
je 0x40826a
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x40826a
cmp eax, dword [ebx]
je 0x40826a
pop edi
pop esi
mov eax, 2
pop ebx
add esp, 0x11c
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x11c
ret
Function at 0x4087e0
Capabilities:
Timestomp file

Disassembly:
sub esp, 0x28
push ebx
push esi
mov esi, dword [esp + 0x38]
push esi
call fcn.00426600
add esp, 4
test eax, eax
je 0x408931
push 4
lea eax, [esp + 0x14]
push esi
push eax
call fcn.0041c580
lea ecx, [esp + 0x1c]
xor ebx, ebx
push ecx
mov byte [esp + 0x24], bl
call fcn.0041b485
mov word [esp + 0x30], ax
lea edx, [esi + 4]
push 2
lea eax, [esp + 0x24]
push edx
push eax
call fcn.0041c580
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2e], bl
push ecx
call fcn.0041b485
mov word [esp + 0x42], ax
lea edx, [esi + 6]
push 2
lea eax, [esp + 0x34]
push edx
push eax
call fcn.0041c580
lea ecx, [esp + 0x3c]
mov byte [esp + 0x3e], bl
push ecx
call fcn.0041b485
mov word [esp + 0x56], ax
lea edx, [esi + 9]
push 2
lea eax, [esp + 0x44]
push edx
push eax
call fcn.0041c580
lea ecx, [esp + 0x4c]
mov byte [esp + 0x4e], bl
push ecx
call fcn.0041b485
add esp, 0x40
mov word [esp + 0x28], ax
lea edx, [esi + 0xb]
lea eax, [esp + 0x10]
push 2
push edx
push eax
call fcn.0041c580
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1e], bl
push ecx
call fcn.0041b485
add esi, 0xd
push 2
lea edx, [esp + 0x24]
push esi
push edx
mov word [esp + 0x46], ax
call fcn.0041c580
lea eax, [esp + 0x2c]
mov byte [esp + 0x2e], bl
push eax
call fcn.0041b485
add esp, 0x20
lea ecx, [esp + 8]
lea edx, [esp + 0x20]
mov word [esp + 0x2c], ax
push ecx
push edx
mov word [esp + 0x36], bx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x408931
mov eax, dword [esp + 0x34]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, ebx
je 0x408931
cmp esi, 0xffffffff
je 0x408931
lea ecx, [esp + 8]
lea edx, [esp + 8]
push ecx
lea eax, [esp + 0xc]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
push esi
jne 0x408939
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop ebx
add esp, 0x28
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, 1
pop ebx
add esp, 0x28
ret
Function at 0x408a80
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x400
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp]
push ebx
push esi
push edi
mov edi, 0x4528ec
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.RegSvr32
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x414]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x418]
push esi
call fcn.00421a60
add esp, 8
test eax, eax
jne 0x408b03
lea edx, [esp + 0xc]
mov edi, str.___s
jmp 0x408b1e
push str.UnRegSvr32
push esi
call fcn.00421a60
add esp, 8
test eax, eax
jne 0x408b43
lea edx, [esp + 0xc]
mov edi, str.___u__s
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 5
lea eax, [esp + 0x10]
push 0
push eax
push str.regsvr32.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x20
pop edi
cmp ecx, eax
pop esi
sbb eax, eax
pop ebx
neg eax
add esp, 0x400
ret

Function at 0x408b80
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x200
push ebx
push esi
mov esi, dword [esp + 0x20c]
xor ebx, ebx
push edi
push ebx
push ebx
push esi
call fcn.00408380
add esp, 0xc
test eax, eax
jle 0x408c2d
mov edi, dword [esp + 0x214]
lea eax, [esp + 0xc]
push eax
push edi
push esi
push str.Exec
call fcn.004040e0
add esp, 0x10
test eax, eax
je 0x408c10
lea ecx, [esp + 0xc]
push str.true
push ecx
call fcn.00421a60
add esp, 8
test eax, eax
jne 0x408be9
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x200
ret
push 5
push 0
push edi
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jbe 0x408c2d
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x200
ret
push 5
push 0
push edi
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
mov eax, 1
ja 0x408c2f
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x200
ret
Function at 0x40baa0
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
sub esp, 0x4c
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 0x1c]
push 5
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, dword [sym.imp.USER32.dll_GetFocus]
mov esi, eax
call edi
cmp eax, dword [ebx + 0x1c]
je 0x40bbe1
call edi
cmp eax, esi
je 0x40bbe1
mov edi, dword [ebx + 0x4c]
test edi, edi
je 0x40bbe1
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 1
mov dword [esp + 0x10], ecx
jl 0x40bbe1
mov edx, dword [ebx + 0x1c]
lea ecx, [esp + 0xe]
push 2
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edi, [esp + 0xe]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x40bbe1
test esi, esi
je 0x40bb3b
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40bb3b
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x40bb3b
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
test ebx, ebx
jne 0x40bb43
xor eax, eax
jmp 0x40bb46
mov eax, dword [ebx + 0x1c]
push ebp
push 0
push 0
push 0x31
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x20]
push ecx
push 0x3c
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
lea edx, [esp + 0x20]
mov byte [esp + 0x34], 1
push edx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov esi, dword [esp + 0x60]
mov ebp, dword [sym.imp.GDI32.dll_SelectObject]
mov edi, eax
push edi
push esi
call ebp
mov dword [esp + 0x60], eax
mov eax, dword [ebx + 0x50]
push eax
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
push 1
push esi
mov dword [esp + 0x20], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x4c]
push 0x24
push ecx
push edx
push eax
push esi
call dword [sym.imp.USER32.dll_DrawTextA]
mov ecx, dword [esp + 0x60]
push ecx
push esi
call ebp
mov edx, dword [esp + 0x18]
push edx
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [esp + 0x1c]
push eax
push esi
call dword [sym.imp.GDI32.dll_SetBkMode]
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x4c
ret 8
Function at 0x40c870
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x4c
push ebx
mov ebx, ecx
push esi
push edi
test ebx, ebx
jne 0x40c880
xor esi, esi
jmp 0x40c883
mov esi, dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, esi
jne 0x40c898
mov eax, dword [ebx + 0x44]
test eax, eax
je 0x40c975
mov edi, dword [ebx + 0x40]
test edi, edi
je 0x40c975
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 1
mov dword [esp + 0x10], ecx
jl 0x40c975
lea eax, [esp + 0xe]
push 2
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edi, [esp + 0xe]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x40c975
push ebp
push eax
push eax
push 0x31
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x20]
push ecx
push 0x3c
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
lea edx, [esp + 0x20]
mov byte [esp + 0x34], 1
push edx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov esi, dword [esp + 0x60]
mov ebp, dword [sym.imp.GDI32.dll_SelectObject]
mov edi, eax
push edi
push esi
call ebp
mov dword [esp + 0x60], eax
mov eax, dword [ebx + 0x48]
push eax
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
push 1
push esi
mov dword [esp + 0x20], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x40]
push 0x24
push ecx
push edx
push eax
push esi
call dword [sym.imp.USER32.dll_DrawTextA]
mov ecx, dword [esp + 0x60]
push ecx
push esi
call ebp
mov edx, dword [esp + 0x18]
push edx
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [esp + 0x1c]
push eax
push esi
call dword [sym.imp.GDI32.dll_SetBkMode]
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x4c
ret 8

Function at 0x40f1e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
push str.Binary
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40f22e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x40f22e
mov ecx, dword [esp + 0x18]
push ecx
push ebx
push eax
call fcn.00426e26
add esp, 0xc
test eax, eax
jne 0x40f230
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x4131e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x441fbb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x258
lea ecx, [esp + 0x30]
call fcn.004100a0
mov ecx, dword [0x458054]
mov edx, dword [esp + 0x26c]
xor eax, eax
push 0xc
mov dword [esp + 0x264], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
lea eax, [esp + 4]
mov dword [esp + 4], 1
push eax
mov eax, dword [esp + 0x270]
push ecx
push edx
push eax
lea ecx, [esp + 0x44]
call fcn.004104a0
lea ecx, [esp + 0x30]
mov dword [esp + 0x260], 0xffffffff
call fcn.004100c0
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
add esp, 0x264
ret