joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404b10
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ecx
push ebx
push 0
push 0x100
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x404b37
xor eax, eax
pop ebx
pop ecx
ret
push ebp
push esi
push edi
call fcn.00420e2b
mov esi, dword [eax + 0xc]
push str.unists
push 0x88
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
lea ecx, [esp + 0x14]
push ecx
push eax
push ebp
push ebx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x405550
Capabilities:
Create shortcut via ishelllink

Disassembly:
push 0xffffffffffffffff
push 0x4495e0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x460590]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
push ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0x10]
push eax
push 0x450f4c
push 1
push ebx
push 0x450f5c
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jge 0x4055c0
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x1c
ret 4
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push esi
push eax
call edx
push esi
lea ecx, [esp + 0x10]
call fcn.00402520
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0xc]
push 0x5c
push eax
call fcn.00432a50
add esp, 8
or esi, 0xffffffff
cmp eax, ebx
jne 0x4055f5
mov eax, esi
jmp 0x4055fb
sub eax, dword [esp + 0xc]
sar eax, 1
push eax
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x14]
call fcn.00405880
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 1
call fcn.00401f40
mov byte [esp + 0x24], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov ecx, esi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40563c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x24]
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push 0x451c5c
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0x14]
push edx
push 0x450f8c
push eax
mov eax, dword [ecx]
call eax
cmp eax, ebx
jge 0x4056b4
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [esp + 0x24], esi
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x40569e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x1c
ret 4
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x2c]
mov ecx, dword [eax]
push 1
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
cmp eax, ebx
jl 0x405677
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [esp + 0x24], esi
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x40570a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x1c
ret 4
Function at 0x406340
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4489cb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x460590]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
mov dword [esi], vtable.CHttpClient.0
xor ebx, ebx
mov eax, vtable.CBuffer_unsigned_char_.0
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esp + 0x18], ebx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x4c], 0xf
mov dword [esi + 0x48], ebx
mov byte [esi + 0x38], bl
push 0x14
mov byte [esp + 0x1c], 2
call fcn.004136c8
add esp, 4
mov dword [esp + 0xc], eax
mov byte [esp + 0x18], 3
cmp eax, ebx
je 0x4063cd
push ebx
push ebx
push ebx
push ebx
push 1
push 0x452f18
mov ecx, eax
call fcn.0041cc4b
jmp 0x4063cf
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x4071e0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x449558
mov eax, dword fs:[0]
push eax
push ebp
push esi
push edi
mov eax, dword [0x460590]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x20]
mov edi, ecx
mov dword [esp + 0x20], 0
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jne 0x40723c
push 0x451c5c
mov ecx, ebp
call fcn.00402520
mov eax, ebp
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0xc
ret 0xc
call fcn.00413d88
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x407256
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], 0
mov eax, dword [esi - 8]
mov edi, dword [edi]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x407296
push 0x104
lea ecx, [esp + 0x24]
call fcn.00402140
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push edi
push 0x104
push esi
push ecx
push edx
push str.cqss
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.004328f3
add esp, 8
test eax, eax
jl 0x40730d
cmp eax, dword [esi - 8]
jg 0x40730d
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
add esi, 0xfffffff0
push esi
call fcn.00402190
add eax, 0x10
mov dword [ebp], eax
add esp, 4
mov dword [esp + 0x18], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x407225
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
jmp 0x407225
push 0x80070057
call fcn.00401000
int3
Function at 0x407320
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x448c39
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x460590]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x14], 0
mov dword [esp + 8], 0
call fcn.00413d88
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x407370
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
mov dword [esp + 0x14], 0
mov ecx, 1
mov dword [esp + 8], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x104
or eax, ecx
jge 0x4073aa
push 0x104
mov ecx, esi
call fcn.00402140
mov ecx, dword [esp + 0x24]
mov eax, dword [esi]
mov edx, dword [esp + 0x20]
push ecx
push 0x104
push eax
push 0x451c5c
push edx
push str.main
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x4073e3
push ecx
push eax
call fcn.004328f3
add esp, 8
test eax, eax
jl 0x407408
mov ecx, dword [esi]
cmp eax, dword [ecx - 8]
jg 0x407408
mov dword [ecx - 0xc], eax
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
push 0x80070057
call fcn.00401000
int3

Function at 0x408160
Capabilities:
Get mac address on windows

Disassembly:
push ecx
push esi
push 0x288
mov dword [esp + 8], 0x288
call fcn.004136c8
mov esi, eax
add esp, 4
test esi, esi
je 0x408234
push 0x288
push 0
push esi
call fcn.00434530
add esp, 0xc
lea eax, [esp + 4]
push eax
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x4081af
push esi
call fcn.00413702
add esp, 4
pop esi
pop ecx
ret 4
lea ecx, [esp + 4]
push ecx
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x40822b
mov eax, esi
mov ecx, 6
cmp dword [eax + 0x1a0], ecx
jne 0x4081d5
cmp dword [eax + 0x190], ecx
je 0x4081e9
mov eax, dword [eax]
test eax, eax
jne 0x4081c5
push esi
call fcn.00413702
add esp, 4
pop esi
pop ecx
ret 4
movzx edx, byte [esi + 0x199]
movzx eax, byte [esi + 0x198]
movzx ecx, byte [esi + 0x197]
push edx
movzx edx, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push ecx
movzx ecx, byte [esi + 0x194]
push edx
mov edx, dword [esp + 0x1c]
push eax
push ecx
push 0x452960
push edx
call fcn.004022d0
add esp, 0x20
push esi
call fcn.00413702
add esp, 4
pop esi
pop ecx
ret 4
Function at 0x408240
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ecx
push esi
push 0x170
mov dword [esp + 8], 0x170
call fcn.004136c8
mov esi, eax
add esp, 4
test esi, esi
je 0x408304
push 0x170
push 0
push esi
call fcn.00434530
add esp, 0xc
lea eax, [esp + 4]
push eax
push esi
push 0
push 0
push 0
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
cmp eax, 0x6f
jne 0x408295
push esi
call fcn.00413702
add esp, 4
pop esi
pop ecx
ret 4
lea ecx, [esp + 4]
push ecx
push esi
push 0
push 0
push 0
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
test eax, eax
jne 0x4082fb
mov eax, esi
mov ecx, 6
cmp dword [eax + 0x34], ecx
je 0x4082cb
mov eax, dword [eax + 8]
test eax, eax
jne 0x4082b1
push esi
call fcn.00413702
add esp, 4
pop esi
pop ecx
ret 4
movzx edx, byte [eax + 0x31]
movzx ecx, byte [eax + 0x30]
push edx
movzx edx, byte [eax + 0x2f]
push ecx
movzx ecx, byte [eax + 0x2e]
push edx
movzx edx, byte [eax + 0x2d]
movzx eax, byte [eax + 0x2c]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
push eax
push 0x452960
push ecx
call fcn.004022d0
add esp, 0x20
push esi
call fcn.00413702
add esp, 4
pop esi
pop ecx
ret 4
Function at 0x40aa30
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x449b48
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push edi
mov eax, dword [0x460590]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
lea edi, [esi + 0x5c]
push edi
push 0x6d
call fcn.00411440
lea eax, [esi + 0x60]
push eax
push 0x68
call fcn.00411440
lea ecx, [esi + 0x64]
push ecx
push 0x70
call fcn.00411440
lea edx, [esi + 0x68]
push edx
push 0x7c
call fcn.00411440
lea eax, [esi + 0x6c]
push eax
push 0x7a
call fcn.00411440
lea ecx, [esi + 0x70]
push ecx
push 0x7b
call fcn.00411440
lea edx, [esi + 0x74]
push edx
push 0x79
call fcn.00411440
mov ebx, dword [edi]
mov ecx, dword [ebx + 4]
add esp, 0x38
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x14], 0
call sub.gdiplus.dll_GdipGetImageWidth
test eax, eax
je 0x40aac2
mov dword [ebx + 8], eax
mov edx, dword [esp + 0xc]
mov edi, dword [edi]
lea eax, [esp + 0xc]
mov dword [esi + 0x54], edx
mov ecx, dword [edi + 4]
push eax
push ecx
mov dword [esp + 0x14], 0
call sub.gdiplus.dll_GdipGetImageHeight
test eax, eax
je 0x40aae8
mov dword [edi + 8], eax
mov edx, dword [esp + 0xc]
mov dword [esi + 0x58], edx
mov eax, dword [esi + 0x190]
cmp dword [eax - 0xc], 0
lea edi, [esi + 0x190]
jne 0x40ab06
or eax, 0xffffffff
jmp 0x40ab19
push eax
push 0xffffffffffffffff
push str.Install
push str.cqss
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x451c5c
mov dword [esi + 0x17c], eax
push str.DName
lea eax, [esp + 0x14]
push eax
mov ecx, edi
call fcn.004071e0
lea ecx, [esi + 0x178]
push eax
mov dword [esp + 0x1c], 0
call fcn.00401f40
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ab71
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x10
ret
Function at 0x40bb70
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 0x120]
test eax, eax
je 0x40bbe2
mov eax, dword [eax + 0x20]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x40bbc0
mov eax, dword [esi + 0x120]
test eax, eax
je 0x40bb98
mov eax, dword [eax + 0x20]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [esi + 0x120]
test esi, esi
jne 0x40bbb4
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop esi
ret
mov esi, dword [esi + 0x20]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop esi
ret
mov esi, dword [esi + 0x120]
test esi, esi
jne 0x40bbd4
push esi
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
mov esi, dword [esi + 0x20]
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov ecx, esi
test eax, eax
jne 0x40bc05
push 5
call fcn.0041b76c
mov ecx, dword [esi + 0x20]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop esi
ret
push 0
call fcn.0041b76c
pop esi
ret

Function at 0x40bc90
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x234
mov eax, dword [0x460590]
xor eax, esp
mov dword [esp + 0x230], eax
push esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 4], esi
test esi, esi
jne 0x40bcda
push eax
push eax
push 0x452e98
call fcn.0041414b
pop esi
mov ecx, dword [esp + 0x230]
xor ecx, esp
call fcn.004323db
add esp, 0x234
ret
push ebp
lea eax, [esp + 0xc]
push eax
push esi
mov dword [esp + 0x14], 0x22c
call sub.KERNEL32.dll_Process32FirstW
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40bd43
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [esp + 0x1c]
push ecx
push 1
push 0x1fffff
call edi
mov esi, eax
test esi, esi
je 0x40bd2a
push 0xffffffffffffffff
push 0xffffffffffffffff
push esi
call ebx
push esi
call sub.PSAPI.DLL_EmptyWorkingSet
push esi
call ebp
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40bd06
mov esi, dword [esp + 0x10]
pop edi
pop ebx
push esi
call ebp
mov ecx, dword [esp + 0x238]
pop ebp
pop esi
xor ecx, esp
call fcn.004323db
add esp, 0x234
ret
Function at 0x40c110
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp]
push ecx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40c171
lea edx, [esp + 8]
push edx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x40c167
mov ecx, dword [esp]
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
push ecx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov edx, dword [esp]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x14
ret
Function at 0x40d110
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4490e8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x460590]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
lea ebx, [edi + 0x178]
push ebx
lea eax, [edi + 0x180]
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.0040d910
add esp, 0xc
mov dword [esp + 0x1c], 0
cmp dword [edi + 0x17c], 0
jne 0x40d1ac
mov eax, dword [esp + 0xc]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x14], esp
mov esi, esp
push eax
call fcn.00402190
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.00411260
add esp, 4
test eax, eax
je 0x40d1ac
mov edx, dword [ebx]
cmp dword [edx - 0xc], 0
je 0x40d1ac
push 0
push 0
push edi
push 0x40d1f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d1d4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x40fae0
Capabilities:
Create thread

Disassembly:
cmp dword [esi + 0x29c], 0
jne 0x40fb3c
mov ecx, dword [esi + 0x20]
push ebx
push edi
push 0
lea eax, [esi + 0x27c]
push eax
push ecx
mov dword [esi + 0x29c], 1
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push esi
push 0x40fbd0
push 0
push 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
push 0
push 0
push esi
push 0x40fc70
push 0
push 0
call edi
push eax
call ebx
pop edi
pop ebx
ret

Function at 0x40fd50
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryW]
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push ebx
push ebx
mov dword [esp + 0x18], ebx
call edi
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004136f7
add esp, 4
lea edx, [esp + 0xc]
push edx
mov esi, eax
push esi
push ebx
call edi
mov edi, eax
test edi, edi
je 0x40fdda
mov ebx, dword [sym.imp.WININET.dll_FindNextUrlCacheEntryW]
lea ecx, [ecx]
test dword [esi + 0xc], 0x100000
jne 0x40fda3
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
lea ecx, [esp + 0xc]
push ecx
push 0
push edi
mov dword [esp + 0x18], 0
call ebx
push esi
call fcn.00413702
mov edx, dword [esp + 0x10]
push edx
call fcn.004136f7
add esp, 8
mov esi, eax
lea eax, [esp + 0xc]
push eax
push esi
push edi
call ebx
test eax, eax
jne 0x40fd90
lea ebx, [eax + 1]
test esi, esi
je 0x40fde7
push esi
call fcn.00413702
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x411260
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x448b48
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x460590]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x18]
cmp dword [eax - 4], 1
jle 0x4112a4
mov eax, dword [eax - 0xc]
push eax
lea ecx, [esp + 0x1c]
call fcn.00402210
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
mov eax, dword [esp + 0x18]
setne cl
mov esi, ecx
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.004328f3
add esp, 8
test eax, eax
jl 0x41131b
mov ecx, dword [esp + 0x18]
cmp eax, dword [ecx - 8]
jg 0x41131b
mov dword [ecx - 0xc], eax
mov ecx, dword [esp + 0x18]
xor edx, edx
mov word [ecx + eax*2], dx
mov dword [esp + 0x10], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x411308
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret
push 0x80070057
call fcn.00401000
int3

Function at 0x411440
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
call fcn.00420e2b
mov esi, dword [eax + 0xc]
movzx eax, word [esp + 0x14]
push 0x453978
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x41146d
pop edi
pop esi
pop ebp
pop ecx
ret
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x41148c
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
push esi
push eax
call fcn.00439d80
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 0
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ebx, dword [esp + 0x10]
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov esi, eax
test esi, esi
je 0x4114e3
lea eax, [esi + 4]
push eax
push ebx
mov dword [esi], vtable.Gdiplus::Image.0
mov dword [eax], 0
call sub.gdiplus.dll_GdipLoadImageFromStream
mov dword [esi + 8], eax
jmp 0x4114e5
xor esi, esi
push edi
mov dword [ebp], esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
pop ebx
xor eax, eax
cmp dword [ebp], eax
pop edi
pop esi
setne al
pop ebp
pop ecx
ret
Function at 0x411880
Capabilities:
Create shortcut via ishelllink

Disassembly:
push 0xffffffffffffffff
push 0x4490e8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x460590]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
push 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 8]
push eax
push 0x450f4c
push 1
push 0
push 0x450f5c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x4118f2
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x18
ret
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x24]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x50]
call eax
call fcn.00413d88
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41191d
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0xc], eax
lea esi, [esp + 0xc]
mov dword [esp + 0x1c], 0
call fcn.00410e20
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx - 0xc]
push 0
dec eax
push eax
mov ecx, esi
call fcn.00411c80
mov eax, dword [esp + 8]
mov esi, dword [esp + 0xc]
mov edx, dword [eax]
push esi
push eax
mov eax, dword [edx + 0x24]
call eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push 0x450f8c
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jge 0x4119b7
call dword [sym.imp.ole32.dll_CoUninitialize]
lea eax, [esi - 0x10]
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4119a4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x18
ret
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x28]
mov ecx, dword [eax]
push 1
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
test eax, eax
jl 0x41197a
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
lea eax, [esi - 0x10]
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411a10
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x18
ret