joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405561
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ch, 0xfc
add byte [eax], al
add bh, bh
mov ah, 0x24
xchg esp, eax
add byte [eax], al
add al, ch
cmp dh, 0xff
call dword [ebp - 0x77]
inc ebx
or bh, bh
jne 0x4054ea
push dword [esp + 0xa0]
call fcn.0040533b
push ebp
mov dword [ebx + 0x18], eax
push dword [ebp + 0xf0]
push dword [esp + 0xac]
call fcn.0040533b
push ebp
mov dword [ebx + 0x60], eax
push dword [ebp + 0x124]
and al, 1
add byte [eax], al
push dword [esp + 0xb8]
call fcn.0040533b
add esp, 0x48
mov dword [ebx + 4], eax
push ebp
push dword [ebp + 0x1c]
push esi
call fcn.0040533b
push ebp
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x20], ebp
push dword [ebp + 0xa0]
push dword [esp + 0x88]
call fcn.0040533b
push ebp
mov dword [ebx], eax
push dword [ebp + 0x118]
push dword [esp + 0x94]
call fcn.0040533b
mov dword [ebx + 0x28], eax
mov eax, dword [esp + 0x98]
push ebp
mov dword [ebx + 0x2c], eax
push dword [ebp + 0xb0]
push esi
call fcn.0040533b
mov dword [ebx + 0x50], eax
push ebp
push dword [ebp + 0xdc]
push dword [esp + 0xac]
add byte [eax], al
call fcn.0040533b
push ebp
mov dword [ebx + 0x34], eax
push dword [ebp]
push dword [esp + 0xb8]
call fcn.0040533b
add esp, 0x48
mov dword [ebx + 0x40], eax
push ebp
push dword [ebp + 0x10]
push esi
call fcn.0040533b
push ebp
mov dword [ebx + 0x10], eax
push dword [ebp + 0x54]
push dword [esp + 0x88]
call fcn.0040533b
mov dword [ebx + 0x44], edi
mov edi, dword [esp + 0x8c]
push ebp
mov dword [ebx + 0x3c], eax
push dword [ebp + 0xe8]
push edi
call fcn.0040533b
push ebp
mov dword [ebx + 0x58], eax
push dword [ebp + 0x40]
push edi
call fcn.0040533b
push ebp
mov dword [ebx + 0x4c], eax
push dword [ebp + 0x3c]
push edi
call fcn.0040533b
push ebp
push 0x80e96588
push edi
mov dword [ebx + 0xc], eax
call fcn.0040533b
add esp, 0x48
mov dword [ebx + 0x6c], eax
push 0
push ebx
call fcn.0040681a
mov esi, eax
push esi
push ebp
push ebx
call fcn.00405e4b
push esi
push ebx
call fcn.004062d3
push ebp
push dword [ebp + 0x7c]
mov esi, eax
push esi
call fcn.0040533b
push ebp
push dword [ebp + 0x4c]
mov dword [esp + 0x84], eax
push esi
call fcn.0040533b
push ebp
push dword [ebp + 0xe4]
mov dword [esp + 0xa8], eax
push esi
call fcn.0040533b
add esp, 0x40
mov dword [esp + 0x68], eax
push ebp
push dword [ebp + 0x88]

Function at 0x40563f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
call fcn.0040533b
push ebp
push dword [ebp + 0xac]
mov dword [esp + 0x70], eax
push esi
call fcn.0040533b
mov dword [esp + 0x78], eax
push ebp
push dword [ebp + 0x104]
push esi
call fcn.0040533b
push ebp
push dword [ebp + 0x90]
mov dword [esp + 0x7c], eax
push esi

Function at 0x405673
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.0040533b
push ebp
push dword [ebp + 0x100]
mov dword [esp + 0x90], eax
push esi
call fcn.0040533b
push 0
push ebx
mov dword [esp + 0xa8], eax
call fcn.0040681a
add esp, 0x44
inc esp
mov esi, eax
push esi
push ebp
push ebx
call fcn.00405dfb
push esi
push ebx
call fcn.004062d3
push ebp
push dword [ebp + 0x48]
mov esi, eax
push esi
mov dword [esp + 0x4c], esi
call fcn.0040533b
push ebp
mov dword [ebx + 0x24], eax
Function at 0x40569d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.0040533b
push ebp
push dword [ebp + 0x100]
mov dword [esp + 0x90], eax
push esi
call fcn.0040533b
push 0
push ebx
mov dword [esp + 0xa8], eax
call fcn.0040681a
add esp, 0x44
inc esp
mov esi, eax
push esi
push ebp
push ebx
call fcn.00405dfb
push esi
push ebx
call fcn.004062d3
push ebp
push dword [ebp + 0x48]
mov esi, eax
push esi
mov dword [esp + 0x4c], esi
call fcn.0040533b
push ebp
mov dword [ebx + 0x24], eax
Function at 0x405aeb
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
jmp 0x405af2
dec eax
test al, 3
jne 0x405af1
xor ecx, ecx
test eax, eax
je 0x405b10
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
xor dword [ecx + edx], esi
add ecx, 4
cmp ecx, eax
jb 0x405b05
pop esi
ret

Function at 0x4061c8
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
push esi
mov esi, dword [eax + 0xc]
add esi, 0xc
mov esi, dword [esi]
cmp dword [esi + 0x30], 0
je 0x4061d5
cmp dword [esp + 8], 0
je 0x4061f3
push dword [esi + 0x30]
call fcn.004065a4
pop ecx
cmp dword [esp + 8], eax
jne 0x4061d5
mov eax, dword [esi + 0x18]
pop esi
ret

Function at 0x4067cd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov eax, ecx
shr eax, 0x18
mov byte [ebp + 0x10], al
mov eax, ecx
shr eax, 0x10
push esi
mov byte [ebp + 0x11], al
xor esi, esi
mov eax, ecx
mov byte [ebp + 0x13], cl
shr eax, 8
mov edx, esi
mov byte [ebp + 0x12], al
cmp dword [ebp + 0xc], edx
jbe 0x406817
push edi
mov edi, dword [ebp + 8]
mov al, byte [ebp + esi + 0x10]
xor ecx, ecx
xor byte [edx + edi], al
inc edx
cmp esi, 3
lea eax, [esi + 1]
cmovne ecx, eax
mov esi, ecx
cmp edx, dword [ebp + 0xc]
jb 0x4067fc
pop edi
pop esi
pop ebp
ret
Function at 0x40aace
Capabilities:
Check if file exists

Disassembly:
push 0x50
mov eax, 0x4c8075
call fcn.00496d1f
mov edi, ecx
lea eax, [ebp - 0x58]
push eax
call fcn.00426dcd
mov dword [esp], 0x4d3930
xor ebx, ebx
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 4], ebx
push eax
call fcn.00401c6d
push 0x4d3ca4
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.00401c6d
add esp, 0x18
lea ecx, [ebp - 0x40]
call fcn.00404061
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 4
call fcn.00404061
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40abb8
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x40ab52
call fcn.0045963c
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x40abb8
push 0x558
call fcn.004969e8
pop ecx
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 5
test eax, eax
je 0x40ab71
mov ecx, eax
call fcn.0041dcae
jmp 0x40ab73
mov eax, ebx
mov ecx, dword [edi + 8]
mov byte [ebp - 4], 4
mov dword [edi + 8], eax
test ecx, ecx
je 0x40ab8b
mov eax, dword [ecx]
push 1
call dword [eax + 0x14]
mov eax, dword [edi + 8]
test eax, eax
je 0x40abb8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, dword [edi + 8]
mov esi, eax
push ebx
push ebx
push ebx
mov edx, dword [edi]
mov ecx, edi
push ebx
push ebx
push 0x80
push 0x86000000
call dword [edx]
push eax
push esi
mov ecx, edi
call fcn.0045fb3e
lea ecx, [ebp - 0x28]
call fcn.00404061
call fcn.00496cc9
ret

Function at 0x40fa36
Capabilities:
Create process on windows

Disassembly:
push 0x240
mov eax, 0x4c86a0
call fcn.00496d1f
push str.IsWow64Process
xor edi, edi
push 0x4d357c
mov dword [ebp - 0x24c], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40fa7a
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
lea eax, [ebp - 0x230]
push eax
call fcn.004268d5
mov dword [esp], 0x208
lea eax, [ebp - 0x218]
push edi
push eax
mov dword [ebp - 4], edi
call fcn.0049f230
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push 0x4d2db0
lea eax, [ebp - 0x218]
push 0x103
push eax
call fcn.00404609
add esp, 0x1c
lea eax, [ebp - 0x218]
cmp dword [ebp - 0x24c], 0
je 0x40fb20
push str.Netmproxy64.exe
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.004022ea
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 1
push eax
call fcn.0042b8f7
mov ecx, eax
call fcn.0042b716
lea ecx, [ebp - 0x248]
mov bl, al
call fcn.00404061
test bl, bl
jmp 0x40fb3b
push str.Netmproxy.exe
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call fcn.0042ce2c
pop ecx
test eax, eax
je 0x40fb54
push 1
push edi
push str._typeInstall
lea eax, [ebp - 0x218]
push eax
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x230]
call fcn.00404061
call fcn.00496cc9
ret

Function at 0x410d2f
Capabilities:
Query or enumerate registry value

Disassembly:
call fcn.0041f0d6
mov ecx, eax
jmp fcn.0041f15e
Function at 0x41353a
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0xc4
mov eax, 0x4c8f9b
call fcn.00496d1f
mov edi, ecx
push 1
call fcn.004125d7
xor esi, esi
mov ecx, edi
push esi
call fcn.00412583
push esi
mov ecx, edi
call fcn.004125f6
push esi
call fcn.0041f0d6
mov ecx, eax
call fcn.0041f358
mov ecx, edi
call fcn.004101c8
lea eax, [ebp - 0xd0]
push eax
call fcn.00426dcd
mov dword [esp], 0x4d3930
push eax
lea eax, [ebp - 0xb8]
mov dword [ebp - 4], esi
push eax
call fcn.00401c6d
push 0x4d3ca4
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.00401c6d
add esp, 0x18
lea ecx, [ebp - 0xb8]
call fcn.00404061
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 4
call fcn.00404061
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4135f3
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [ebp + 8], 0
mov esi, 0x4d29a1
push esi
je 0x4136a3
lea ecx, [ebp - 0xa0]
call fcn.00402297
push esi
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 5
call fcn.00402297
push esi
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 6
call fcn.00402297
push esi
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 7
call fcn.00402297
push 0x4d2bac
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 8
call fcn.00402297
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 9
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x40]
push eax
push 0x1b
push 0x18
push 4
call fcn.00426073
add esp, 0x20
lea ecx, [ebp - 0x40]
call fcn.0040403b
lea ecx, [ebp - 0x58]
call fcn.0040403b
lea ecx, [ebp - 0x70]
call fcn.0040403b
lea ecx, [ebp - 0x88]
call fcn.0040403b
lea ecx, [ebp - 0xa0]
jmp 0x41373e
lea ecx, [ebp - 0x40]
call fcn.00402297
push esi
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xa
call fcn.00402297
push esi
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0xb
call fcn.00402297
push esi
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0xc
call fcn.00402297
push 0x4d3c9c
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0xd
call fcn.00402297
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0xa0]
push eax
push 0x1b
push 0x18
push 4
call fcn.00426073
add esp, 0x20
lea ecx, [ebp - 0xa0]
call fcn.0040403b
lea ecx, [ebp - 0x88]
call fcn.0040403b
lea ecx, [ebp - 0x70]
call fcn.0040403b
lea ecx, [ebp - 0x58]
call fcn.0040403b
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 4
call fcn.0040403b
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x413753
call fcn.0040ac4f
lea ecx, [ebp - 0x28]
call fcn.00404061
call fcn.00496cc9
ret 4
Function at 0x4142ec
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x50c7b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x41436e
cmp byte [esi + 0x3d], 0
je 0x41436e
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x414340
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x414344
sub eax, 1
je 0x414348
dec eax
sub eax, 1
je 0x41436e
xor al, al
jmp 0x414370
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x414365
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004ab82e
add esp, 0x10
cmp edi, eax
jne 0x414340
cmp byte [esi + 0x3d], 0
sete al
jmp 0x414370
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00496ca3
leave
ret

Function at 0x415561
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x50c7b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x415587
xor eax, eax
jmp 0x415649
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x4155b0
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x4155b0
dec dword [edx]
mov eax, ebx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x415649
cmp dword [esi + 0x4c], 0
je 0x415647
mov ecx, esi
call fcn.0041495d
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x4155dc
push dword [esi + 0x4c]
push eax
call fcn.0040d0bb
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x415647
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x2c]
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x415647
cmp eax, 1
jle 0x415616
cmp eax, 3
jne 0x415647
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x4155ce
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x415639
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call fcn.004ab82e
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x415647
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
mov eax, ebx
jne 0x415649
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00496ca3
leave
ret 4
Function at 0x415dfe
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x415e20
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00415edc
jmp 0x415ed7
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x415e41
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x415e43
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x415ecb
jg 0x415e56
test esi, esi
je 0x415ecb
test ecx, ecx
jl 0x415e98
jg 0x415e60
test eax, eax
je 0x415e98
cmp ebx, ecx
jg 0x415e72
jl 0x415e6a
cmp esi, eax
jae 0x415e72
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.0049e730
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x415e9e
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x415ecb
jg 0x415ea8
test esi, esi
je 0x415ecb
cmp dword [edi + 0x4c], 0
je 0x415ecb
mov ecx, edi
call fcn.0041495d
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call fcn.004aa078
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
leave
ret 0xc

Function at 0x415fab
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x415fcd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041607f
jmp 0x41607a
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x415fee
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x415ff0
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x41606e
jg 0x416003
test esi, esi
je 0x41606e
test ecx, ecx
jl 0x416047
jg 0x41600d
test eax, eax
je 0x416047
cmp edi, ecx
jg 0x41601f
jl 0x416017
cmp esi, eax
jae 0x41601f
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.0049e730
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x41604a
mov edx, dword [ebp + 8]
test edi, edi
jl 0x41606e
jg 0x416054
test esi, esi
je 0x41606e
cmp dword [ebx + 0x4c], 0
je 0x41606e
push dword [ebx + 0x4c]
push esi
push 1
push edx
call fcn.004ab82e
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x41db4d
Capabilities:
Find taskbar

Disassembly:
push ebx
push esi
xor ebx, ebx
push ebx
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41db95
push ebx
push str.TrayNotifyWnd
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
call esi
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41db95
push 0
push str.Q360SeNetmNewsIconWnd
push 0
push ebx
call esi
jmp 0x41db97
xor eax, eax
pop esi
pop ebx
ret

Function at 0x41dee8
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x4d5ac8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push dword [ebp + 0xc]
movzx ecx, word [ebp + 8]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x41df6f
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
xor eax, eax
push eax
push 0x80
push 2
push eax
push eax
push 0x40000000
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41df6f
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, dword [ebp - 4]
sete al
jmp 0x41df71
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41eccb
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 8], ebx
test eax, eax
je 0x41eddd
cmp word [eax], bx
je 0x41eddd
push esi
push edi
push 0x4d37c4
push eax
call fcn.004a9d27
mov esi, eax
mov edi, ebx
pop ecx
pop ecx
test esi, esi
je 0x41ed3d
push esi
call fcn.004a9e86
push eax
call fcn.004aab92
pop ecx
pop ecx
mov ebx, eax
push ebx
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x41ed34
push esi
push 1
push ebx
push eax
call fcn.004aa078
add esp, 0x10
push esi
call fcn.004a9e06
pop ecx
xor ebx, ebx
mov dword [ebp + 8], ebx
test edi, edi
je 0x41edd6
lea eax, [ebp + 8]
push eax
push 1
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x41edbb
cmp dword [ebp + 8], eax
je 0x41edc8
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x41ed8f
mov eax, dword [ebp + 8]
lea ecx, [ebp - 4]
push ecx
push eax
mov dword [esi], vtable.Gdiplus::Bitmap.0
mov dword [ebp - 4], ebx
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov dword [esi + 8], eax
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
jmp 0x41ed91
mov esi, ebx
test esi, esi
je 0x41edbb
mov eax, dword [esi + 8]
mov dword [esi + 8], ebx
test eax, eax
jne 0x41edb3
push ebx
lea eax, [ebp - 8]
push eax
push dword [esi + 4]
call sub.gdiplus.dll_GdipCreateHBITMAPFromBitmap
test eax, eax
je 0x41edb3
mov dword [esi + 8], eax
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x41edc8
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 8]
pop edi
pop esi
jmp 0x41eddf
xor eax, eax
pop ebx
leave
ret
Function at 0x41ede2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 0xc]
sub esp, 0x10
cmp dword [ebp + 0x10], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
jne 0x41edff
push 0x83e
jmp 0x41ee02
push dword [ebp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
xor edi, edi
mov dword [ebp - 4], eax
mov ebx, edi
test eax, eax
je 0x41ee6f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x41ee6f
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push 0x22
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, dword [ebp - 0xc]
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x41ee68
test eax, eax
je 0x41ee68
push dword [ebp - 0x10]
push eax
push ecx
call fcn.0049e730
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov dword [ebp - 8], edi
mov dword [ebp + 0x10], edi
test ebx, ebx
je 0x41ef0e
lea eax, [ebp + 0x10]
push eax
push 1
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x41eef0
cmp dword [ebp + 0x10], edi
je 0x41eefd
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x41eec4
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
mov dword [esi], vtable.Gdiplus::Bitmap.0
mov dword [ebp - 4], edi
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov dword [esi + 8], eax
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
jmp 0x41eec6
mov esi, edi
test esi, esi
je 0x41eef0
mov eax, dword [esi + 8]
mov dword [esi + 8], edi
test eax, eax
jne 0x41eee8
push edi
lea eax, [ebp - 8]
push eax
push dword [esi + 4]
call sub.gdiplus.dll_GdipCreateHBITMAPFromBitmap
test eax, eax
je 0x41eee8
mov dword [esi + 8], eax
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41eefd
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edi, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret