joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403964
Capabilities:
Delete file
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x47c
mov esi, eax
mov ebp, edx
mov dword [esp + 0x28], ecx
cmp dword [eax + 0x14], 1
sbb eax, eax
add eax, 2
mov dword [esp + 8], 0x18
mov dword [esp + 4], eax
mov eax, dword [esi + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
sub esp, 0xc
test eax, eax
jne 0x4039a5
xor ebx, ebx
jmp 0x403b01
mov edi, eax
mov dword [esp + 4], eax
mov eax, dword [esi + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push edx
push edx
mov ebx, eax
mov dword [esp + 4], edi
mov eax, dword [esi + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ecx
push ecx
mov dword [esp + 0x2c], eax
lea esi, [esp + 0x60]
mov dword [esp + 4], esi
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push edi
push edi
rdtsc
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], str._sDLL_X.manifest
lea esi, [esp + 0x268]
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll_swprintf]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x100
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x40000000
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
mov edi, eax
cmp eax, 0xffffffff
mov ecx, dword [esp + 0x2c]
jne 0x403a5c
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x403aff
mov dword [esp + 0x10], 0
lea eax, [esp + 0x3c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
xor ebx, ebx
test eax, eax
jne 0x403a8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
test ebx, ebx
jne 0x403b01
lea edi, [esp + 0x44]
mov ecx, 7
mov eax, ebx
rep stosd dword es:[edi], eax
mov dword [esp + 0x40], 0x20
mov dword [esp + 0x48], esi
lea eax, [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateActCtxW]
push ecx
mov dword [ebp], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
mov eax, dword [ebp]
cmp eax, 0xffffffff
je 0x403b01
mov edx, dword [esp + 0x28]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ActivateActCtx]
push edx
push edx
test eax, eax
jne 0x40399e
call edi
mov ebx, eax
mov eax, ebx
add esp, 0x47c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403fc8
Capabilities:
Encrypt data via sspi
Send data
Send data on socket

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x6c
mov ebp, edx
mov dword [esp + 0x1c], ecx
mov esi, dword [edx + 0x74]
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.lua54.dll_lua_pushboolean
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x80]
jae 0x40414f
mov ebx, dword [esp + 0x80]
sub ebx, dword [esp + 0x14]
mov eax, dword [esi + 0x18]
cmp ebx, eax
cmova ebx, eax
mov eax, dword [esi + 0x14]
add eax, dword [esi + 0x10]
add eax, ebx
mov dword [esp + 4], eax
mov dword [esp], 1
call sub.msvcrt.dll_calloc
mov edi, eax
test eax, eax
je 0x404139
mov dword [esp + 8], ebx
mov eax, dword [esp + 0x1c]
add eax, dword [esp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [esi + 0x10]
add eax, edi
mov dword [esp], eax
call sub.msvcrt.dll_memmove
mov eax, dword [esi + 0x10]
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], edi
mov dword [esp + 0x40], 1
mov dword [esp + 0x3c], ebx
lea ecx, [edi + eax]
mov dword [esp + 0x44], ecx
mov ecx, dword [esi + 0x14]
mov dword [esp + 0x4c], 6
mov dword [esp + 0x48], ecx
add ebx, eax
add ebx, edi
mov dword [esp + 0x50], ebx
mov dword [esp + 0x58], 0
mov dword [esp + 0x28], 4
mov dword [esp + 0x24], 0
lea eax, [esp + 0x30]
mov dword [esp + 0x2c], eax
mov dword [esp + 0xc], 0
lea eax, [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp + 0x74]
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.Secur32.dll_EncryptMessage
sub esp, 0x10
test eax, eax
jns 0x4040f1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push eax
jmp 0x404147
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0x3c]
add eax, dword [esp + 0x30]
add eax, dword [esp + 0x48]
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov eax, dword [ebp + 4]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_send]
sub esp, 0x10
cmp eax, 0xffffffff
je 0x404147
add dword [esp + 0x18], eax
mov dword [esp], edi
call sub.msvcrt.dll_free
mov ecx, dword [esi + 0x18]
add dword [esp + 0x14], ecx
jmp 0x403ff8
mov dword [esp], 0
call sub.msvcrt.dll_free
jmp 0x40414f
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esp + 0x18]
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x409234
Capabilities:
Connect to http server

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov edi, eax
mov ebx, edx
mov dword [esp + 0x3c], 0
mov dword [esp], eax
call sub.lua54.dll_lua_gettop
mov dword [esp + 0x2c], eax
mov eax, dword [ebx]
mov dword [esp + 0x24], eax
cmp eax, dword [sym.imp.lua54.dll_THttp]
sete al
movzx eax, al
lea eax, [eax + eax + 1]
mov dword [esp + 0x20], eax
mov eax, dword [sym.imp.lua54.dll_TFtp]
mov dword [esp + 0x28], eax
cmp dword [ebx + 0xc], 0
je 0x409284
mov dword [esp], edi
call fcn.00404f9c
lea eax, [esp + 0x3c]
mov dword [esp + 8], eax
mov dword [esp + 4], 2
mov dword [esp], edi
call fcn.0040a048
mov esi, eax
xor ebp, ebp
test eax, eax
je 0x4093fa
mov edx, dword [eax + 0x14]
test edx, edx
je 0x4092b9
mov eax, dword [eax + 0x10]
call fcn.00413f1c
mov ebp, eax
cmp dword [esp + 0x2c], 2
jle 0x409300
mov ecx, dword [esp + 0x28]
cmp dword [esp + 0x24], ecx
jne 0x409300
mov dword [esp + 8], 0
mov dword [esp + 4], 3
mov dword [esp], edi
call sub.lua54.dll_lua_tolwstring
mov dword [esp + 0x24], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], edi
call sub.lua54.dll_lua_tolwstring
jmp 0x40932c
mov edx, dword [esi + 0x20]
mov dword [esp + 0x24], 0
test edx, edx
je 0x40931b
mov eax, dword [esi + 0x1c]
call fcn.00413f1c
mov dword [esp + 0x24], eax
mov edx, dword [esi + 0x28]
xor edi, edi
test edx, edx
je 0x40932e
mov eax, dword [esi + 0x24]
call fcn.00413f1c
mov edi, eax
cmp dword [esp + 0x20], 1
jne 0x40933d
cmp dword [esi + 0xc], 1
jne 0x40934f
jmp 0x409362
cmp dword [esp + 0x20], 3
jne 0x409362
mov eax, dword [esi + 0xc]
sub eax, 3
cmp eax, 1
jbe 0x409362
mov dword [esp], 0x2ee5
call dword [sym.imp.KERNEL32.dll_SetLastError]
push eax
jmp 0x4093f8
mov eax, dword [sym.imp.lua54.dll_TFtp]
cmp dword [ebx], eax
mov eax, 0x8400000
mov edx, 0
cmovne eax, edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
mov eax, dword [esp + 0x24]
mov dword [esp + 0xc], eax
movzx eax, word [esi + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], ebp
mov eax, dword [ebx + 8]
mov dword [esp], eax
call dword [sym.imp.WININET.DLL_InternetConnectW]
sub esp, 0x20
mov dword [ebx + 0xc], eax
test eax, eax
je 0x4093dc
mov dword [ebx + 0x14], ebp
mov eax, dword [esi + 0xc]
mov dword [ebx + 4], eax
movzx edx, word [esi + 0x18]
mov dword [ebx + 0x20], edx
mov ebp, 1
dec eax
jne 0x4093fa
mov eax, dword [esp + 0x24]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], edi
jmp 0x4093fa
mov dword [esp], ebp
call sub.msvcrt.dll_free
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp], edi
call sub.msvcrt.dll_free
xor ebp, ebp
mov dword [esp], esi
call sub.msvcrt.dll_free
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, ebp
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40973c
Capabilities:
Resolve dns

Disassembly:
push edi
push esi
push ebx
sub esp, 0xd0
mov ebx, dword [esp + 0xe0]
mov edi, dword [esp + 0xe8]
mov dword [esp + 0x14], 0
lea eax, [esp + 0x3c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
movzx eax, di
mov dword [esp + 4], eax
mov eax, dword [esp + 0xe4]
mov dword [esp], eax
call sub.DNSAPI.dll_DnsQuery_A
sub esp, 0x18
test eax, eax
jne 0x40982a
mov edx, dword [esp + 0x3c]
cmp di, 1
jne 0x4097ad
mov eax, dword [edx + 0x18]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push ecx
jmp 0x409806
cmp di, 0x1c
jne 0x409803
lea edi, [esp + 0x50]
mov ecx, 0x20
rep stosd dword es:[edi], eax
mov dword [esp + 8], 0x10
add edx, 0x18
mov dword [esp + 4], edx
lea esi, [esp + 0x40]
mov dword [esp], esi
call sub.msvcrt.dll_memcpy
mov dword [esp + 0xc], pe_nt_image_headers32
lea edi, [esp + 0x50]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], 0x17
call dword [sym.imp.WS2_32.dll_inet_ntop]
sub esp, 0x10
mov dword [esp + 4], edi
jmp 0x40980a
mov eax, dword [edx + 0x18]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.lua54.dll_lua_pushstring
mov dword [esp + 4], 1
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sub.DNSAPI.dll_DnsFree
push edx
push edx
jmp 0x409871
cmp eax, 0x251d
sete cl
cmp eax, 0x25e5
sete dl
or cl, dl
jne 0x409845
cmp eax, 0x232b
jne 0x40984f
mov dword [esp], ebx
call sub.lua54.dll_lua_pushnil
jmp 0x409871
mov dword [esp + 0x2c], eax
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.lua54.dll_lua_pushboolean
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push eax
mov eax, 1
add esp, 0xd0
pop ebx
pop esi
pop edi
ret
Function at 0x40a048
Capabilities:
Parse url

Disassembly:
push esi
push ebx
sub esp, 0x24
mov esi, dword [esp + 0x38]
mov dword [esp + 4], 0x3c
mov dword [esp], 1
call sub.msvcrt.dll_calloc
mov ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.lua54.dll_lua_tolwstring
mov dword [esi], eax
mov dword [ebx], 0x3c
mov dword [ebx + 0x14], 1
mov dword [ebx + 0x20], 1
mov dword [ebx + 0x28], 1
mov dword [ebx + 0x30], 1
mov dword [ebx + 8], 1
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov edx, dword [esp + 0x1c]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.WININET.DLL_InternetCrackUrlW]
sub esp, 0x10
test eax, eax
jne 0x40a0f4
mov dword [esp], 0x2ee5
call dword [sym.imp.KERNEL32.dll_SetLastError]
push eax
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov eax, dword [esi]
mov dword [esp], eax
call sub.msvcrt.dll_free
xor ebx, ebx
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
ret
Function at 0x40a19c
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov eax, 0x104c
call fcn.00402710
sub esp, eax
mov ebx, dword [esp + 0x1060]
mov dword [esp], ebx
call fcn.0040a0fc
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov eax, dword [esp + 0x1064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x40a3b6
mov esi, eax
mov dword [esp + 0x10], 0
lea eax, [esp + 0x3c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1000
lea edi, [esp + 0x40]
mov dword [esp + 4], edi
mov dword [esp], esi
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [esp + 0x28], eax
call eax
sub esp, 0x14
cmp word [esp + 0x40], 0x5a4d
jne 0x40a251
mov edx, dword [esp + 0x7c]
add edx, edi
cmp dword [edx], 0x4550
je 0x40a260
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
jmp 0x40a3b6
lea eax, [edx + 0xf8]
movzx ecx, word [edx + 6]
mov dword [esp + 0x2c], ecx
xor edi, edi
xor ebp, ebp
xor ecx, ecx
cmp dword [esp + 0x2c], edi
jle 0x40a28e
mov edx, dword [eax + 0x14]
cmp edx, ecx
jbe 0x40a288
mov ebp, dword [eax + 0x10]
add ebp, edx
mov ecx, edx
add eax, 0x28
inc edi
jmp 0x40a274
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edx
push edx
mov edi, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
sub edi, ebp
je 0x40a3b6
mov dword [esp], edi
call sub.msvcrt.dll_malloc
mov dword [0x4160a0], eax
mov dword [esp + 0x10], 0
lea ecx, [esp + 0x3c]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], esi
mov eax, dword [esp + 0x28]
call eax
sub esp, 0x14
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov dword [esp + 4], edi
mov eax, dword [0x4160a0]
mov dword [esp], eax
call fcn.0040f89c
mov dword [0x4162e0], eax
test eax, eax
je 0x40a3a9
mov dword [esp + 4], 0x4166f6
mov dword [esp], ebx
call sub.lua54.dll_lua_getglobal
mov dword [esp + 8], 0x4166fe
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call sub.lua54.dll_lua_getfield
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40a908
mov dword [esp], ebx
call sub.lua54.dll_lua_pushcclosure
mov dword [esp + 4], 0xfffffffe
mov dword [esp], ebx
call sub.lua54.dll_luaL_len
add eax, 1
adc edx, 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0xfffffffe
mov dword [esp], ebx
call sub.lua54.dll_lua_rawseti
mov dword [esp + 4], 0xfffffffd
mov dword [esp], ebx
call sub.lua54.dll_lua_settop
mov eax, 1
jmp 0x40a3b8
mov eax, dword [0x4160a0]
mov dword [esp], eax
call sub.msvcrt.dll_free
xor eax, eax
add esp, 0x104c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40c5d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov dword [esp + 0xc], esi
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x3c]
mov ebp, dword [esp + 0x40]
test eax, eax
je 0x40c63c
cmp dword [eax + 0x48], 0
je 0x40c60f
test ebx, ebx
je 0x40c601
test ecx, ecx
je 0x40c60f
test edi, edi
je 0x40c609
test esi, esi
je 0x40c60f
cmp dword [eax + 0x38], 0
jne 0x40c618
mov dword [eax + 0x1c], 0x18
jmp 0x40c63c
mov dword [esp + 0x40], ebp
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], esi
mov edi, dword [esp + 0xc]
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0040c648
xor eax, eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40cb50
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
xor ecx, ecx
test eax, eax
je 0x40cb78
mov ebx, dword [eax + 0x48]
test ebx, ebx
je 0x40cb78
cmp edx, dword [eax + 0x10]
jae 0x40cb78
mov ecx, dword [ebx + 0x10]
mov ecx, dword [ecx + edx*4]
add ecx, dword [ebx]
test ecx, ecx
je 0x40cb80
test esi, esi
jne 0x40cb8d
test eax, eax
je 0x40cb98
mov dword [eax + 0x1c], 0x18
jmp 0x40cb98
mov dword [esp + 0xc], esi
pop ebx
pop esi
jmp fcn.0040b654
xor eax, eax
pop ebx
pop esi
ret
Function at 0x414d08
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov eax, 0x205c
call fcn.00402710
sub esp, eax
mov ebx, dword [esp + 0x2070]
mov ebp, dword [esp + 0x2074]
or esi, 0xffffffff
test ebx, ebx
je 0x414e23
mov dword [esp + 8], 0x2000
mov dword [esp + 4], 0
lea edi, [esp + 0x50]
mov dword [esp], edi
call sub.msvcrt.dll_memset
mov dword [esp + 8], 0x38
mov dword [esp + 4], 0
lea esi, [esp + 0x18]
mov dword [esp], esi
call sub.msvcrt.dll_memset
mov dword [esp + 4], esi
mov dword [esp], ebp
call dword [sym.imp.msvcrt.dll__wstat64]
mov esi, eax
test eax, eax
jne 0x414e17
movzx eax, word [esp + 0x1e]
mov edx, eax
test al, 0x80
jne 0x414d92
or dword [ebx + 0x4e008], 1
shl eax, 0x10
or eax, dword [ebx + 0x4e008]
and dx, 0xf000
mov ecx, eax
or ecx, 0x10
cmp dx, 0x4000
cmove eax, ecx
mov dword [ebx + 0x4e008], eax
mov eax, dword [esp + 0x40]
mov dword [ebx + 0x4e00c], eax
mov dword [esp + 4], 0x417482
mov dword [esp], ebp
call dword [sym.imp.msvcrt.dll__wfopen]
mov ebp, eax
test eax, eax
je 0x414e1e
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x2000
mov dword [esp + 4], 1
mov dword [esp], edi
call sub.msvcrt.dll_fread
test eax, eax
je 0x414e0d
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.004151c0
test eax, eax
jns 0x414dd4
mov esi, 0xfffffff8
mov dword [esp], ebp
call sub.msvcrt.dll_fclose
jmp 0x414e23
mov esi, 0xfffffffd
jmp 0x414e23
mov esi, 0xfffffff0
mov eax, esi
add esp, 0x205c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x415010
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor ecx, ecx
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
jmp fcn.0040841c
Function at 0x415020
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x46c
mov ebx, dword [esp + 0x480]
mov esi, dword [esp + 0x484]
or edx, 0xffffffff
test ebx, ebx
je 0x415133
mov edx, 0xfffffffc
cmp dword [ebx + 0x14], 1
jne 0x415133
mov edx, 0xfffffff6
cmp dword [ebx + 0x10], esi
jbe 0x415133
mov ecx, dword [ebx + 0x48]
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + esi*4]
mov edx, 0xfffffff5
add eax, dword [ecx]
je 0x415133
movzx ebp, word [eax + 0x1c]
lea edi, [eax + 0x2e]
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x415093
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [ebx + 0x5c], 0
mov edx, ebp
mov eax, edi
call fcn.004153f4
mov dword [ebx + 0x5c], eax
mov edx, 0xfffffffe
test eax, eax
je 0x415133
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.0040cb50
mov edx, 0xfffffffd
test eax, eax
je 0x415133
mov dword [ebx + 0x58], esi
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov dword [ebx + 0x68], eax
mov dword [ebx + 0x6c], edx
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [ebx + 0x60], eax
mov dword [ebx + 0x64], edx
mov eax, dword [esp + 0x2c]
mov dword [ebx + 0x70], eax
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [ebx + 0x78], eax
mov dword [ebx + 0x7c], edx
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0xa4], edx
mov ax, word [esp + 0x26]
mov word [ebx + 0xa8], ax
mov eax, dword [esp + 0x44]
mov dword [ebx + 0x4e008], eax
mov eax, dword [esp + 0x28]
mov dword [ebx + 0x4e00c], eax
xor edx, edx
mov eax, edx
add esp, 0x46c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4159c0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00402f10
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00402f10
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
jmp fcn.004014e0
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x410050]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x44
lea eax, [ebp - 0x50]
push 0
push eax
call fcn.00405180
add esp, 0xc
mov dword [ebp - 0x50], 0x44
lea eax, [ebp - 0x60]
xorps xmm0, xmm0
movdqa xmmword [ebp - 0x60], xmm0
push eax
lea eax, [ebp - 0x50]
push eax
push str.HotA_Data
push 0
push 0
push 0
push 0
push 0
push 0
push str.HotA_Datahota_cmped.exe
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00401210
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x40450a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x410050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040279d
mov dword [ebp - 0x14], eax
cmp dword [0x411e08], esi
jne 0x4045fd
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40458a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4046dd
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4046dd
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4046dd
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x411e08], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x411e0c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x411e10], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x411e18], eax
test eax, eax
je 0x4045fa
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x411e14], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x404622
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x404615
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x404637
push 4
pop eax
jmp 0x4046df
cmp dword [ebp - 0x14], esi
je 0x404637
push dword [0x411e08]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40461c
mov eax, dword [0x411e14]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x404695
cmp dword [0x411e18], edi
je 0x404695
push eax
call ebx
push dword [0x411e18]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x404695
test eax, eax
je 0x404695
call ecx
test eax, eax
je 0x40468a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40468a
test byte [ebp - 8], 1
jne 0x404695
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4046c5
mov eax, dword [0x411e0c]
cmp eax, edi
je 0x4046c2
push eax
call ebx
test eax, eax
je 0x4046c2
call eax
mov esi, eax
test esi, esi
je 0x4046c2
mov eax, dword [0x411e10]
cmp eax, edi
je 0x4046c2
push eax
call ebx
test eax, eax
je 0x4046c2
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x411e08]
call ebx
test eax, eax
je 0x4046dd
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4046df
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401210
mov esp, ebp
pop ebp
ret