joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4058f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b2ff0
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x4db040]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
push 0
push 0
push 0x4c4594
call fcn.004a20c4
mov dword [esp + 0xc], eax
push 0x4c44f8
mov dword [esp + 0x1c], 0
mov edx, dword [eax]
push 0x4c45a4
mov ecx, eax
mov eax, dword [edx + 0x60]
push 0x4c45ac
call eax
push 0
push 0
push 0x4c45b0
call fcn.004a20c4
mov dword [esp + 8], eax
mov byte [esp + 0x18], 1
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx]
push 0
push eax
mov eax, dword [edx + 0x30]
call eax
mov ecx, dword [esp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x38]
push 0x4c45bc
call eax
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0x20]
mov edx, dword [ecx]
mov edx, dword [edx + 0x48]
push eax
push 0x4c45c0
call edx
push 0
push 0
push 0x4c45b0
call fcn.004a20c4
mov ecx, dword [esp + 8]
mov esi, eax
mov eax, dword [ecx]
mov edx, dword [eax + 0x30]
push 0
push esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x38]
push 0x4c45c4
mov ecx, esi
call edx
mov ecx, dword [esp + 0x24]
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push ecx
push 0x4c45c8
mov ecx, esi
call edx
mov ecx, dword [esp + 0x28]
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push ecx
push 0x4c45c0
mov ecx, esi
call edx
push 0
lea eax, [esp + 0xc]
push eax
mov byte [esp + 0x20], 0
call fcn.004a20be
test eax, eax
je 0x405a00
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 4]
call eax
push 0
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x20], 0xffffffff
call fcn.004a20be
test eax, eax
je 0x405a21
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
Function at 0x4173e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b2ff0
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x4db040]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
push 0
push 0
push 0x4c4594
call fcn.004a20c4
mov dword [esp + 0xc], eax
push 0x4c44f8
mov dword [esp + 0x1c], 0
mov edx, dword [eax]
push 0x4c45a4
mov ecx, eax
mov eax, dword [edx + 0x60]
push 0x4c45ac
call eax
push 0
push 0
push 0x4c45b0
call fcn.004a20c4
mov dword [esp + 8], eax
mov byte [esp + 0x18], 1
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx]
push 0
push eax
mov eax, dword [edx + 0x30]
call eax
mov ecx, dword [esp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x38]
push 0x4c45bc
call eax
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0x20]
mov edx, dword [ecx]
mov edx, dword [edx + 0x48]
push eax
push 0x4c45c0
call edx
push 0
push 0
push 0x4c45b0
call fcn.004a20c4
mov ecx, dword [esp + 8]
mov esi, eax
mov eax, dword [ecx]
mov edx, dword [eax + 0x30]
push 0
push esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x38]
push 0x4c5a74
mov ecx, esi
call edx
mov ecx, dword [esp + 0x24]
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push ecx
push 0x4c45c8
mov ecx, esi
call edx
mov ecx, dword [esp + 0x28]
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push ecx
push 0x4c45c0
mov ecx, esi
call edx
mov ecx, dword [esp + 0x2c]
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push ecx
push 0x4c5a7c
mov ecx, esi
call edx
push 0
lea eax, [esp + 0xc]
push eax
mov byte [esp + 0x20], 0
call fcn.004a20be
test eax, eax
je 0x417503
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 4]
call eax
push 0
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x20], 0xffffffff
call fcn.004a20be
test eax, eax
je 0x417524
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
Function at 0x443b10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4c18d0
mov eax, dword fs:[0]
push eax
sub esp, 0x80
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4db040]
xor eax, esp
push eax
lea eax, [esp + 0x94]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xac]
mov esi, dword [ebp + 0x10]
cmp dword [ebp + 0xc], esi
jbe 0x443b51
call fcn.004a35b4
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp]
cmp edi, dword [ebp + 0x10]
jbe 0x443b61
call fcn.004a35b4
mov eax, dword [ebp]
push esi
push ebx
push edi
push eax
lea ebx, [esp + 0x28]
mov esi, ebp
call fcn.00443240
mov eax, dword [esp + 0xa8]
mov ecx, dword [eax + 0x14]
xor esi, esi
cmp dword [eax + 0x18], 0x10
jb 0x443b8c
add eax, 4
mov eax, dword [eax]
jmp 0x443b8f
add eax, 4
mov ebx, dword [esp + 0xa4]
push ecx
push eax
push ebx
xor eax, eax
call fcn.004172d0
mov edi, eax
cmp edi, 0xffffffff
je 0x443c80
jmp 0x443bb0
mov eax, edi
sub eax, esi
mov ecx, esi
push eax
lea esi, [esp + 0x5c]
mov edx, ebx
call fcn.00405c60
xor ecx, ecx
mov dword [esp + 0x9c], ecx
push 0xffffffffffffffff
push ecx
mov dword [esp + 0x3c], ecx
mov byte [esp + 0x2c], cl
mov esi, 0xf
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x44], esi
call fcn.00406960
lea ecx, [esp + 0x20]
push ecx
mov ebx, ebp
mov byte [esp + 0xa0], 1
call fcn.00443a70
mov ebx, 0x10
cmp dword [esp + 0x38], ebx
jb 0x443c15
mov edx, dword [esp + 0x24]
push edx
call fcn.004a21e6
add esp, 4
xor eax, eax
mov dword [esp + 0x9c], 0xffffffff
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], eax
mov byte [esp + 0x24], al
cmp dword [esp + 0x70], ebx
jb 0x443c41
mov eax, dword [esp + 0x5c]
push eax
call fcn.004a21e6
add esp, 4
mov eax, dword [esp + 0xa8]
mov ecx, dword [eax + 0x14]
lea esi, [ecx + edi]
cmp dword [eax + 0x18], ebx
jb 0x443c5a
add eax, 4
mov eax, dword [eax]
jmp 0x443c5d
add eax, 4
push ecx
mov ecx, dword [esp + 0xa8]
push eax
push ecx
mov eax, esi
call fcn.004172d0
mov ebx, dword [esp + 0xa4]
mov edi, eax
cmp edi, 0xffffffff
jne 0x443bb0
cmp esi, dword [ebx + 0x14]
jae 0x443d17
mov ecx, esi
push 0xffffffffffffffff
lea esi, [esp + 0x78]
mov edx, ebx
call fcn.00405c60
push 0xffffffffffffffff
mov dword [esp + 0xa0], 2
push 0
mov esi, 0xf
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 0x60], esi
mov dword [esp + 0x5c], 0
mov byte [esp + 0x4c], 0
call fcn.00406960
lea edx, [esp + 0x3c]
push edx
mov ebx, ebp
mov byte [esp + 0xa0], 3
call fcn.00443a70
mov edi, 0x10
cmp dword [esp + 0x54], edi
jb 0x443cf3
mov eax, dword [esp + 0x40]
push eax
call fcn.004a21e6
add esp, 4
xor eax, eax
mov dword [esp + 0x54], esi
mov dword [esp + 0x50], eax
mov byte [esp + 0x40], al
cmp dword [esp + 0x8c], edi
jb 0x443d17
mov ecx, dword [esp + 0x78]
push ecx
call fcn.004a21e6
add esp, 4
mov ecx, dword [esp + 0x94]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8c
ret 0xc
Function at 0x465800
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4bdb46
mov eax, dword fs:[0]
push eax
sub esp, 0x1f4
mov eax, dword [0x4db040]
xor eax, esp
mov dword [esp + 0x1ec], eax
push esi
push edi
mov eax, dword [0x4db040]
xor eax, esp
push eax
lea eax, [esp + 0x200]
mov dword fs:[0], eax
push 0x4c6a84
call fcn.00405f30
add esp, 4
push 0x464bf0
call dword [0x4c20c4]
lea eax, [esp + 0x64]
push eax
push 0x202
call dword [0x4c21e0]
push 0x4c6a94
call fcn.004a20d0
test eax, eax
je 0x465889
push 0x4c6aa0
call fcn.00405f30
add esp, 4
xor eax, eax
jmp 0x465a1c
push 0x4c6ac4
call fcn.004a20d0
test eax, eax
je 0x4658ab
push 0x4c6ad0
call fcn.00405f30
add esp, 4
xor eax, eax
jmp 0x465a1c
push 0x4c6af4
call fcn.004a20d0
test eax, eax
je 0x4658cd
push 0x4c6afc
call fcn.00405f30
add esp, 4
xor eax, eax
jmp 0x465a1c
push 0x4c6b1c
call fcn.004a20d0
test eax, eax
je 0x4658ef
push 0x4c6b28
call fcn.00405f30
add esp, 4
xor eax, eax
jmp 0x465a1c
call fcn.00466910
test eax, eax
jne 0x46590c
push 0x4c6b4c
call fcn.00405f30
add esp, 4
xor eax, eax
jmp 0x465a1c
lea ecx, [esp + 0x48]
call fcn.00466c30
lea esi, [esp + 0x48]
call fcn.0040f5e0
push 0
push 0xffffff
push 0x4c45d0
call fcn.004a20c4
push 0
push 0xffffff
push 0x4c5864
call fcn.004a20c4
push 0
push 0x1000000
push 0x4c5864
call fcn.004a20c4
push 0
push 0xffffff
push 0x4c46dc
call fcn.004a20c4
mov esi, eax
call fcn.00466a50
mov edx, dword [esi]
mov edi, eax
mov eax, dword [edx + 0x10]
push edi
mov ecx, esi
call eax
test eax, eax
je 0x465994
push eax
push edi
push 0x4c6b5c
call fcn.00405f30
add esp, 0xc
call fcn.00465a40
xor eax, eax
jmp 0x465a1c
call fcn.00467310
mov edx, dword [eax + 4]
lea ecx, [eax + 4]
mov eax, dword [edx + 4]
call eax
call fcn.0045a5b0
mov edx, dword [eax + 4]
lea ecx, [eax + 4]
mov eax, dword [edx + 4]
call eax
call fcn.004074c0
mov edx, dword [eax + 4]
lea ecx, [eax + 4]
mov eax, dword [edx + 4]
call eax
mov edx, 0x4c44f8
lea esi, [esp + 0x10]
call fcn.00406d90
mov edx, 0x4c44f8
lea esi, [esp + 0x2c]
mov dword [esp + 0x208], 0
call fcn.00406d90
push 0
push 1
push 1
push 1
lea ecx, [esp + 0x20]
mov edi, esi
mov byte [esp + 0x218], 1
call fcn.00466f60
add esp, 0x10
call fcn.0040f5e0
lea esi, [esp + 0x10]
call fcn.0040f5e0
mov eax, 1
mov ecx, dword [esp + 0x200]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x1ec]
xor ecx, esp
call fcn.004a2151
mov esp, ebp
pop ebp
ret

Function at 0x466000
Capabilities:
Get geographical location

Disassembly:
push ecx
push str.REGION_NAME
call fcn.00465e50
add esp, 4
push 0x4c69a8
call fcn.00465e50
add esp, 4
push 0x4c6a94
call fcn.004a20d0
test eax, eax
je 0x466038
push 0x4c6aa0
call fcn.00405f30
add esp, 4
pop ecx
ret
push 0x4c6ac4
call fcn.004a20d0
test eax, eax
je 0x466055
push 0x4c6ad0
call fcn.00405f30
add esp, 4
pop ecx
ret
push 0x4c6af4
call fcn.004a20d0
test eax, eax
je 0x466072
push 0x4c6afc
call fcn.00405f30
add esp, 4
pop ecx
ret
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push eax
call fcn.0047c3f0
add esp, 4
push 0x4c69a8
call fcn.00465fb0
add esp, 4
push str.REGION_NAME
call fcn.00465fb0
add esp, 4
pop ecx
ret
Function at 0x489ad0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4b3298
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x4db040]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor edi, edi
xor eax, eax
push 0xffffffffffffffff
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x3c]
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
call fcn.00466530
mov eax, ebx
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x489b26
sub eax, edx
sar eax, 1
push eax
mov eax, ebx
lea ecx, [esp + 0x10]
call fcn.00489bc0
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0xffffffffffffffff
mov word [esi + 4], cx
push edi
mov ecx, esi
call fcn.00466530
cmp dword [esp + 0x24], 8
jb 0x489b6f
mov edx, dword [esp + 0x10]
push edx
call fcn.004a21e6
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret
Function at 0x48bc80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4b496d
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4db040]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
xor ebx, ebx
mov dword [edi], 0x4c9a44
mov dword [edi + 8], ebx
mov dword [esp + 0x1c], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov eax, dword [esp + 0x28]
push 0xffffffffffffffff
lea ecx, [edi + 0x14]
mov byte [esp + 0x20], 1
push ebx
mov ebp, 0xf
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00406960
mov edx, dword [esp + 0x2c]
push 0xffffffffffffffff
lea ecx, [edi + 0x30]
mov byte [esp + 0x20], 2
push ebx
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00406960
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x38]
mov byte [esp + 0x1c], 3
mov dword [edi + 0x50], ecx
push 0xffffffffffffffff
lea ecx, [edi + 0x54]
mov dword [edi + 0x4c], eax
push ebx
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00406960
mov eax, dword [esp + 0x3c]
push 0xffffffffffffffff
lea ecx, [edi + 0x70]
mov byte [esp + 0x20], 4
push ebx
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00406960
lea ecx, [edi + 0x8c]
mov byte [esp + 0x1c], 5
mov esi, 0x4c44f8
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
mov byte [ecx + 4], bl
lea eax, [esi + 1]
mov dl, byte [esi]
inc esi
cmp dl, bl
jne 0x48bd64
sub esi, eax
push esi
push 0x4c44f8
call fcn.00406c40
mov dword [edi + 0xb4], ebx
mov dword [edi + 0xb8], ebx
lea esi, [edi + 0x130]
mov byte [esp + 0x1c], 8
mov eax, 0x4c44f8
mov dword [esi + 0x18], ebp
mov dword [esi + 0x14], ebx
mov byte [esi + 4], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x48bda0
sub eax, ecx
push eax
push 0x4c44f8
mov ecx, esi
call fcn.00406c40
lea esi, [edi + 0x14c]
mov byte [esp + 0x1c], 9
mov dword [esi + 0x18], ebp
mov eax, 0x4c44f8
mov dword [esi + 0x14], ebx
mov byte [esi + 4], bl
lea ebp, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x48bdd2
sub eax, ebp
push eax
push 0x4c44f8
mov ecx, esi
call fcn.00406c40
mov dword [edi + 0x168], 1
mov dword [edi + 0x16c], ebx
mov dword [edi + 0x188], ebx
lea ecx, [edi + 0x18c]
push ecx
mov byte [esp + 0x20], 0xc
call fcn.00443070
mov byte [esp + 0x1c], 0xd
call fcn.0048c260
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x1c
Function at 0x490e20
Capabilities:
Get geographical location

Disassembly:
push edi
mov edi, eax
push edi
mov edx, 0x4c9a6c
mov ecx, esi
call fcn.0045a250
lea eax, [edi + 4]
push 0x20
push eax
mov edx, 0x4c9c28
mov ecx, esi
call fcn.0048f690
lea ecx, [edi + 0x24]
push 0x20
push ecx
mov edx, 0x4c9c34
mov ecx, esi
call fcn.0048f690
lea edx, [edi + 0x44]
push edx
mov ecx, esi
call fcn.004a15b0
lea eax, [edi + 0xc4]
push eax
mov edx, 0x4c9c50
mov ecx, esi
call fcn.004a0900
lea ecx, [edi + 0xc5]
push ecx
mov edx, 0x4c9c64
mov ecx, esi
call fcn.004a0900
lea edx, [edi + 0xc6]
push edx
mov edx, str.select_tb_region_map.region_id_region_name_text_color_text_size_pos_x_pos_y_from_tb_region_map_left_join_tb_region_on_tb_region_map.region_id__tb_region.region_id_where_parent_id___s_and_text_size___0
mov ecx, esi
call fcn.004a0900
lea eax, [edi + 0xc7]
push eax
mov edx, 0x4c9c84
mov ecx, esi
call fcn.004a0900
lea ecx, [edi + 0xc8]
push ecx
mov edx, 0x4c9c90
mov ecx, esi
call fcn.004a0990
lea edx, [edi + 0xca]
push edx
mov edx, 0x4c6254
mov ecx, esi
call fcn.004a0990
push 0x80
add edi, 0xcc
push edi
mov edx, 0x4c9c9c
mov ecx, esi
call fcn.0048f690
add esp, 0x38
pop edi
ret
Function at 0x402980
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x1c
push esi
push 0x41cdfc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4029b2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
add esp, 0x1c
ret 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x30
push 0
push 0x4220b0
mov dword [0x422118], eax
call fcn.00407e80
call fcn.00403e50
mov eax, dword [0x422120]
push 0x34
push 0
push eax
call fcn.00407e80
add esp, 0x18
mov dword [0x422108], 0x41ce00
mov dword [0x422104], 0x41ce08
call fcn.00402e20
call fcn.00402ec0
test eax, eax
je 0x4029a9
call fcn.00403070
push str.GetForegroundWindow
push 0x41ce2c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x42209c], eax
jne 0x402a3e
push 0x10
push 0x41b51f
push 0x41ce38
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [0x422114]
push 0x402ab0
push 0x12c
push 0
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
push 0
lea edx, [esp + 0x10]
push edx
call esi
test eax, eax
je 0x402aa1
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push edi
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
lea esp, [esp]
lea eax, [esp + 0xc]
push eax
call edi
lea ecx, [esp + 0xc]
push ecx
call ebx
push 0
push 0
push 0
lea edx, [esp + 0x18]
push edx
call esi
test eax, eax
jne 0x402a80
pop edi
pop ebx
mov eax, dword [esp + 0xc]
pop esi
add esp, 0x1c
ret 0x10
Function at 0x402ec0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
mov esi, dword [0x422118]
mov eax, dword [0x422108]
push edi
mov ecx, dword [0x422104]
push 0
mov edi, dword [sym.imp.USER32.dll_CreateWindowExA]
push esi
push 0
push 0
push 0x14
push 0x14
push 0
push 0
push 0x80000000
push eax
push ecx
push 0x80
call edi
test eax, eax
mov dword [0x422114], eax
jne 0x402f0b
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.00403c30
push 0x4220f8
mov eax, 0x403530
mov ecx, esi
mov dword [0x4220f8], 0x41ce44
mov dword [0x4220fc], 1
call fcn.00401000
mov edx, dword [0x422114]
mov eax, dword [0x4220f8]
push 0
push esi
push 0
push edx
push 0x16
push 0x26
push 1
push 0xfb
push 0x50000000
push 0
push eax
push 0
call edi
push 0x4220f0
mov eax, 0x403600
mov ecx, esi
mov dword [0x4220f0], 0x41ce48
mov dword [0x4220f4], 1
call fcn.00401000
mov ecx, dword [0x422114]
mov edx, dword [0x4220f0]
push 0
push esi
push 0
push ecx
push 0x15
push 0x45
push 0xc1
push 0xd1
push 0x50000000
push 0
push edx
push 0
call edi
push 0x4220e8
mov eax, 0x4036f0
mov ecx, esi
mov dword [0x4220e8], 0x41ce4c
mov dword [0x4220ec], 1
call fcn.00401000
mov eax, dword [0x422114]
mov ecx, dword [0x4220e8]
push 0
push esi
push 0
push eax
push 0x15
push 0x45
push 0xc1
push 0x86
push 0x50000000
push 0
push ecx
push 0
call edi
push 0x4220e0
mov eax, 0x403b90
mov ecx, esi
mov dword [0x4220e0], 0x41ce50
call fcn.00401000
mov edx, dword [0x422114]
push 0
push esi
push 0
push edx
push 0x12
push 0x12
push 0x91
push 0x19
push 0x50000000
push 0
mov eax, dword [0x4220e0]
push eax
push 0
call edi
mov ecx, dword [0x422114]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x422114]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x403e50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x20
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x41ce84
push 0xae
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x403fe9
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x403fe9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [esp + 0xc], eax
je 0x403fe9
push ebx
push ebp
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
lea esi, [ebx + 1]
push esi
mov dword [esp + 0x20], ebx
call fcn.00406b64
mov ebp, eax
push esi
mov dword [esp + 0x20], ebp
call fcn.00406b64
push esi
push 0
push ebp
mov edi, eax
call fcn.00407e80
push esi
push 0
push edi
call fcn.00407e80
add esp, 0x20
test ebx, ebx
jle 0x403f00
mov esi, dword [esp + 0x14]
mov eax, ebp
sub esi, ebp
mov ecx, ebx
nop
mov dl, byte [esi + eax]
sub dl, 0x46
mov byte [eax], dl
add eax, 1
sub ecx, 1
jne 0x403ef0
xor esi, esi
xor edx, edx
test ebx, ebx
mov dword [esp + 0x14], esi
jle 0x403fe7
mov dword [esp + 0x10], 0x4220b0
jmp 0x403f20
movzx eax, byte [esi + ebp]
sub eax, 0x42
jne 0x403f33
movzx eax, byte [esi + ebp + 1]
sub eax, 0x4d
je 0x403f41
test eax, eax
mov ecx, 1
jg 0x403f43
or ecx, 0xffffffff
jmp 0x403f43
xor ecx, ecx
test ecx, ecx
jne 0x403fcf
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
mov dword [esp + 0x20], eax
cmp word [esp + 0x20], 0x4d42
mov ax, word [edi + 0xc]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
mov word [esp + 0x2c], ax
je 0x403f75
xor eax, eax
jmp 0x403fb4
mov esi, dword [edi + 0xa]
push str.CreateDIBitmap
push 0x41b504
lea ebx, [edi + 0xe]
add esi, edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push ebx
push esi
push 4
push ebx
push 0
mov ebp, eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebp
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
push ebx
mov dword [ecx], eax
add ecx, 4
push 0
push edi
mov dword [esp + 0x1c], ecx
call fcn.00407e80
add esp, 0xc
xor edx, edx
mov cl, byte [esi + ebp]
add esi, 1
mov byte [edx + edi], cl
add edx, 1
cmp esi, ebx
mov dword [esp + 0x14], esi
jl 0x403f20
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x404280
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push 0x38
lea eax, [esp + 8]
push 0
push eax
call fcn.00407e80
mov ecx, dword [esp + 0x4c]
add esp, 0xc
lea edx, [esp]
push edx
mov dword [esp + 4], 0x3c
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], str.iexplore.exe
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], str.C:Program_FilesInternet_Explorer
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov eax, dword [esp + 0x38]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
add esp, 0x3c
ret 4

Function at 0x404680
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x418807
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x420034]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [edi], 0x41cf6c
mov dword [edi + 0x58], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 8]
push esi
mov dword [esp + 0x20], ebx
push edi
mov dword [esp + 0x18], 1
call fcn.00405550
mov dword [esp + 0x1c], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
call fcn.00405e50
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x42212c]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4