joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x22c477a6
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x30ab1329
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x414d9f
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x41cbec], ebx
push esi
push edi
jne 0x414e1f
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x414e5a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x41cbec], eax
je 0x414e5a
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x41cbf0], eax
call esi
cmp dword [0x41ca2c], 2
mov dword [0x41cbf4], eax
jne 0x414e1f
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x41cbfc], eax
je 0x414e1f
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x41cbf8], eax
mov eax, dword [0x41cbf8]
test eax, eax
je 0x414e64
call eax
test eax, eax
je 0x414e4b
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x41cbfc]
test eax, eax
je 0x414e4b
test byte [ebp - 8], 1
jne 0x414e64
cmp dword [0x41ca38], 4
jb 0x414e5e
or byte [ebp + 0x12], 0x20
jmp 0x414e83
xor eax, eax
jmp 0x414e93
or byte [ebp + 0x12], 4
jmp 0x414e83
mov eax, dword [0x41cbf0]
test eax, eax
je 0x414e83
call eax
mov ebx, eax
test ebx, ebx
je 0x414e83
mov eax, dword [0x41cbf4]
test eax, eax
je 0x414e83
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x41cbec]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403740
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
sub esp, 0xc
mov edi, dword [esp + 0x20]
cmp edi, 0x100
mov ebp, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
mov dword [esp], 0
jge 0x40376d
mov ecx, dword [edi*4 + 0x40d9b8]
test ecx, ecx
jne 0x403787
push 1
call fcn.00403de0
pop ecx
mov dword [eax + 4], 9
or eax, 0xffffffff
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, dword [ecx]
mov dword [esp + 8], eax
movsx edx, byte [ecx + 4]
test edx, edx
je 0x4037e6
xor esi, esi
xor eax, eax
test ebx, ebx
jbe 0x4037b0
lea eax, [eax]
cmp byte [eax + ebp], 0xa
jne 0x4037a9
add esi, 1
add eax, 1
cmp eax, ebx
jb 0x4037a0
lea ecx, [esi + ebx]
push ecx
call fcn.00404dd0
pop ecx
xor ecx, ecx
test ebx, ebx
mov dword [esp], eax
mov edx, eax
jbe 0x4037e1
cmp byte [ecx + ebp], 0xa
jne 0x4037d1
mov byte [edx], 0xd
add edx, 1
movzx eax, byte [ecx + ebp]
add ecx, 1
mov byte [edx], al
add edx, 1
cmp ecx, ebx
jb 0x4037c5
add ebx, esi
mov ebp, dword [esp]
mov edx, dword [edi*4 + 0x40d9b8]
cmp byte [edx + 5], 0
je 0x403800
push 2
push 0
push edi
call fcn.004036d0
add esp, 0xc
push 0
lea ecx, [esp + 8]
push ecx
push ebx
push ebp
push dword [esp + 0x18]
call dword [0x40ae2c]
cmp dword [esp], 0
mov esi, eax
je 0x403824
push dword [esp]
call fcn.00404e00
pop ecx
test esi, esi
je 0x403834
mov eax, dword [esp + 4]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
call dword [0x40ae24]
push eax
call fcn.00403e90
xor eax, eax
pop ecx
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4038b0
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
sub esp, 4
cmp dword [esp + 0x18], 0x100
mov ebp, dword [esp + 0x1c]
jge 0x4038d4
mov eax, dword [esp + 0x18]
mov edx, dword [eax*4 + 0x40d9b8]
test edx, edx
jne 0x4038f0
push 1
call fcn.00403de0
pop ecx
mov dword [eax + 4], 9
or eax, 0xffffffff
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
ret
movsx ebx, byte [edx + 4]
push 0
lea ecx, [esp + 4]
push ecx
push dword [esp + 0x28]
push ebp
push dword [edx]
call dword [0x40ae34]
test eax, eax
je 0x403991
cmp dword [esp], 0
je 0x403986
test ebx, ebx
je 0x403986
mov esi, ebp
xor ebx, ebx
xor ecx, ecx
cmp dword [esp], 0
mov edi, esi
jbe 0x403957
movzx eax, byte [edi]
cmp al, 0xd
jne 0x403947
mov edx, dword [esp]
add edx, 0xffffffff
cmp ecx, edx
jae 0x403947
cmp byte [edi + 1], 0xa
jne 0x403947
add edi, 1
add ebx, 1
jmp 0x40394f
mov byte [esi], al
add edi, 1
add esi, 1
add ecx, 1
cmp ecx, dword [esp]
jb 0x403928
mov eax, dword [esp + 0x20]
cmp dword [esp], eax
jne 0x403983
cmp dword [esp], 1
jbe 0x403983
mov ecx, dword [esp]
cmp byte [ebp + ecx - 1], 0xd
jne 0x403983
push 1
push 0xffffffffffffffff
push dword [esp + 0x20]
call fcn.004036d0
add esp, 0xc
add ebx, 1
sub dword [esp], ebx
mov eax, dword [esp]
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
ret
call dword [0x40ae24]
push eax
call fcn.00403e90
xor eax, eax
pop ecx
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x403b00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push ebp
push dword [0x409700]
call dword [0x40ae4c]
test eax, eax
jne 0x403ce5
call dword [0x40ae24]
test eax, eax
jne 0x403ce0
push 0x1d0
call fcn.00404dd0
mov ebx, eax
test ebx, ebx
pop ecx
jne 0x403b40
xor eax, eax
pop ebp
pop ebx
ret
mov ebp, 0x40de48
push ebp
call dword [0x40ae18]
mov edx, dword [0x40c410]
mov dword [ebx], edx
mov dword [0x40c410], ebx
push ebp
call dword [0x40ae1c]
mov dword [ebx + 4], 0
mov dword [ebx + 8], 1
mov dword [ebx + 0xc], 0x409704
mov dword [ebx + 0x10], 0x409704
mov eax, dword [esp + 0xc]
mov dword [ebx + 0x14], eax
lea edx, [ebx + 0x188]
mov dword [ebx + 0x180], 0x409708
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x48], 1
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x50], 0
mov dword [ebx + 0x54], 1
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x5c], 0xffffffff
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 1
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 1
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x38], 0xffffffff
mov dword [ebx + 0x184], 0
push 0x40a238
push edx
call fcn.00404eb0
pop ecx
pop ecx
mov ecx, dword [0x40a268]
mov dword [ebx + 0x1b8], ecx
mov eax, dword [0x40a26c]
mov dword [ebx + 0x1bc], eax
mov edx, dword [0x40a270]
mov dword [ebx + 0x1c0], edx
mov ecx, dword [0x40a274]
mov dword [ebx + 0x1c4], ecx
mov eax, dword [0x40a278]
mov dword [ebx + 0x1c8], eax
xor edx, edx
mov ecx, dword [edx + 0x40a234]
mov dword [edx + ebx + 0x184], ecx
mov ecx, dword [edx + 0x40a238]
mov dword [edx + ebx + 0x188], ecx
mov ecx, dword [edx + 0x40a23c]
mov dword [edx + ebx + 0x18c], ecx
mov ecx, dword [edx + 0x40a240]
mov dword [edx + ebx + 0x190], ecx
add edx, 0x10
cmp edx, 0x40
jl 0x403c65
mov ecx, dword [0x40a274]
mov dword [ebx + 0x1c4], ecx
mov ecx, dword [0x40a278]
mov dword [ebx + 0x1c8], ecx
mov dword [ebx + 0x17c], 0x40a15c
mov dword [ebx + 0x1cc], 0
push ebx
push dword [0x409700]
call dword [0x40ae50]
pop ebp
pop ebx
ret
xor eax, eax
pop ebp
pop ebx
ret
mov eax, 1
pop ebp
pop ebx
ret
Function at 0x405ae0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push ebx
push esi
push edi
sub esp, 0x14c
or ecx, 0xffffffff
mov edx, dword [0x40de8c]
mov ebx, dword [0x40de88]
mov esi, dword [edx + ebx*4 - 4]
mov edi, esi
repne scasb al, byte es:[edi]
mov edi, 0xfffffffe
sub edi, ecx
add edi, esi
jmp 0x405b13
sub edi, 1
cmp edi, esi
jbe 0x405b2c
movsx edx, byte [edi - 1]
push edx
push 0x40a280
call fcn.00404f10
pop ecx
test eax, eax
pop ecx
je 0x405b10
lea ecx, [ebp - 0x150]
push ecx
push esi
call dword [0x40ae38]
cmp eax, 0xffffffff
mov dword [ebp - 0x154], eax
je 0x405be5
mov dword [ebp - 0x10], edi
sub dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x10]
lea ebx, [ebp - 0x124]
mov dword [ebp - 0x158], eax
mov eax, eax
xor eax, eax
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
mov edx, 0xfffffffe
sub edx, ecx
add edx, dword [ebp - 0x158]
add edx, 1
push edx
call fcn.00404dd0
mov edi, eax
pop ecx
push esi
push edi
call fcn.00404eb0
pop ecx
pop ecx
push ebx
mov ecx, edi
add ecx, dword [ebp - 0x10]
push ecx
call fcn.00404eb0
pop ecx
pop ecx
call fcn.00405a90
test eax, eax
je 0x405bd9
mov eax, dword [0x40de8c]
mov edx, dword [0x40de88]
lea ecx, [ebp - 0x150]
mov dword [eax + edx*4 - 4], edi
push ecx
push dword [ebp - 0x154]
call dword [0x40ae74]
test eax, eax
je 0x405bd9
mov edx, dword [0x40de88]
add dword [0x40de88], 1
test edx, edx
jne 0x405b60
push dword [ebp - 0x154]
call dword [0x40ae3c]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x405bf0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 8
mov dword [0x40d3b0], 1
push 4
mov dword [0x40de88], 0
call fcn.00404dd0
mov dword [0x40de8c], eax
test eax, eax
pop ecx
mov dword [0x40de74], 0
jne 0x405c35
call fcn.00405a70
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
call dword [0x40ae78]
mov dword [ebp - 0x14], eax
mov esi, eax
xor eax, eax
or ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
mov edx, 0xfffffffe
sub edx, ecx
add edx, 1
push edx
call fcn.00404dd0
mov ebx, eax
test ebx, ebx
pop ecx
mov dword [0x40d3a8], eax
jne 0x405c75
call fcn.00405a70
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
add esi, 1
movsx eax, byte [esi]
push eax
push str.__t_r_n_v
call fcn.00404f10
pop ecx
test eax, eax
pop ecx
jne 0x405c72
cmp byte [esi], 0
je 0x405e0c
call fcn.00405a90
test eax, eax
je 0x405e0c
cmp dword [0x40de88], 1
mov dword [ebp - 0x10], 0
jne 0x405cba
mov ecx, esi
sub ecx, dword [ebp - 0x14]
mov dword [0x40de74], ecx
mov edx, dword [0x40de8c]
mov eax, dword [0x40de88]
mov dword [edx + eax*4], ebx
add dword [0x40de88], 1
movzx ecx, byte [esi]
xor edi, edi
test cl, cl
je 0x405df8
lea eax, [eax]
test edi, edi
jne 0x405d36
movsx ecx, cl
push ecx
push str.__t_r_n_v
call fcn.00404f10
pop ecx
test eax, eax
pop ecx
je 0x405d21
add esi, 1
movzx ecx, byte [esi]
test cl, cl
je 0x405d16
movsx edx, cl
push edx
push str.__t_r_n_v
call fcn.00404f10
pop ecx
test eax, eax
pop ecx
jne 0x405cf8
mov byte [ebx], 0
add ebx, 1
jmp 0x405df8
movzx ecx, byte [esi]
cmp cl, 0x22
jne 0x405d60
add esi, 1
mov edi, 1
jmp 0x405ded
cmp cl, 0x22
jne 0x405d50
cmp byte [esi + 1], 0x22
jne 0x405d50
mov byte [ebx], 0x22
add ebx, 1
add esi, 2
jmp 0x405ded
cmp cl, 0x22
jne 0x405d60
add esi, 1
xor edi, edi
jmp 0x405ded
cmp cl, 0x5c
jne 0x405db4
cmp byte [esi + 1], 0x5c
jne 0x405db4
cmp byte [esi + 2], 0x5c
mov eax, 2
jne 0x405d7f
add eax, 1
cmp byte [esi + eax], 0x5c
je 0x405d76
cmp byte [esi + eax], 0x22
jne 0x405dad
and eax, 0xfffffffe
je 0x405ded
lea eax, [eax]
movzx ecx, byte [esi]
mov byte [ebx], cl
add ebx, 1
add esi, 2
sub eax, 2
jne 0x405d90
jmp 0x405ded
movzx edx, byte [esi]
mov byte [ebx], dl
add esi, 1
add ebx, 1
sub eax, 1
jae 0x405da2
jmp 0x405ded
cmp cl, 0x5c
jne 0x405dd0
cmp byte [esi + 1], 0x22
jne 0x405dd0
mov byte [ebx], 0x22
add ebx, 1
add esi, 2
jmp 0x405ded
test edi, edi
jne 0x405de5
cmp cl, 0x2a
je 0x405dde
cmp cl, 0x3f
jne 0x405de5
mov dword [ebp - 0x10], 1
mov byte [ebx], cl
add esi, 1
add ebx, 1
movzx ecx, byte [esi]
test cl, cl
jne 0x405ce0
cmp dword [ebp - 0x10], 0
je 0x405e03
call fcn.00405ae0
cmp byte [esi], 0
jne 0x405c92
mov byte [ebx], 0
cmp dword [0x40de88], 1
jne 0x405e22
mov eax, esi
sub eax, dword [ebp - 0x14]
mov dword [0x40de74], eax
mov ecx, dword [0x40de8c]
mov edx, dword [0x40de88]
mov dword [ecx + edx*4], 0
push 0x405a30
call fcn.004059b0
pop ecx
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4018d8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xc
mov eax, 0x42baa0
call fcn.00418317
mov ebx, ecx
mov dword [ebp - 0x18], ebx
movzx edi, word [ebp + 8]
call fcn.00405792
mov esi, dword [eax + 0xc]
test esi, esi
je 0x401a6e
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x401a6e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401a6e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp dword [esi + 0x10], 3
lea edi, [esi + 0x34]
je 0x401934
lea edi, [esi + 0x28]
mov eax, dword [esi + 0x20]
test eax, eax
jne 0x40193f
movzx eax, word [esi + 0xe]
mov ecx, eax
test ecx, ecx
mov dword [ebp + 8], eax
lea eax, [edi + ecx*4]
mov dword [ebp - 0x10], eax
jne 0x401950
xor edi, edi
push eax
push esi
mov ecx, ebx
call fcn.00401855
test eax, eax
mov dword [ebp - 0x14], eax
jne 0x401a69
cmp dword [ebp + 0xc], eax
je 0x401a69
test edi, edi
je 0x401a69
push 0x20
call fcn.00404a61
pop ecx
mov dword [ebp + 0xc], eax
and dword [ebp - 4], 0
test eax, eax
je 0x401991
mov ecx, eax
call fcn.0040127e
jmp 0x401993
xor eax, eax
push dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
push esi
mov ecx, eax
mov dword [ebx + 0x1c], eax
call fcn.00401855
test eax, eax
mov dword [ebp - 0x14], eax
jne 0x401a69
push dword [ebx + 4]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalLock]
call esi
mov edi, eax
mov eax, dword [ebx + 0x1c]
push dword [eax + 4]
call esi
push edi
mov ecx, ebx
mov esi, eax
call fcn.00401051
push esi
mov edx, eax
call fcn.00401051
xor ecx, ecx
cmp dword [ebp + 8], ecx
mov edi, eax
mov dword [ebp - 0x10], ecx
jle 0x401a56
sub eax, edx
lea esi, [edx + 1]
mov dword [ebp + 0xc], eax
movzx ebx, byte [esi + 1]
xor edx, edx
mov dh, byte [esi - 1]
mov dl, byte [esi]
shl edx, 8
or edx, ebx
cmp edx, dword [ebp + 0x10]
jne 0x401a0b
mov byte [esi + 1], 0
mov byte [esi], 0
mov byte [esi - 1], 0
mov edx, ecx
shl edx, 2
xor ebx, ebx
lea ecx, [edx + edi]
mov bh, byte [ecx]
lea edx, [edx + edi + 2]
mov bl, byte [eax + esi]
movzx eax, byte [edx]
shl ebx, 8
or ebx, eax
cmp ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
jne 0x401a3a
mov byte [edx], 0xff
mov byte [eax + esi], 0xff
mov byte [ecx], 0xff
jmp 0x401a44
mov byte [edx], 0
mov byte [eax + esi], 0
mov byte [ecx], 0
mov ecx, dword [ebp - 0x10]
inc ecx
add esi, 4
cmp ecx, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
jl 0x4019eb
mov ebx, dword [ebp - 0x18]
push dword [ebx + 4]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call esi
mov eax, dword [ebx + 0x1c]
push dword [eax + 4]
call esi
mov eax, dword [ebp - 0x14]
jmp 0x401a71
push 0xb
pop eax
call fcn.004183b6
ret 0xc
Function at 0x40369d
Capabilities:
Check for time delay via gettickcount
Check mutex on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov dword [esp + 8], eax
call esi
sub eax, dword [esp + 8]
mov ebx, 0x2710
cmp eax, ebx
jae 0x403702
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
push str.RS_UPNP_DISCOVER_COMPLETE
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov ebp, eax
test ebp, ebp
jne 0x4036fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x4036fd
push ebp
call edi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call esi
sub eax, dword [esp + 0x10]
cmp eax, ebx
jb 0x4036c3
jmp 0x403700
push ebp
call edi
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x403969
Capabilities:
Create process on windows

Disassembly:
push 0x64
mov eax, 0x42be08
call fcn.00418317
xor esi, esi
mov dword [ebp - 0x70], 0x3c
mov dword [ebp - 0x6c], 0x140
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], str.open
mov dword [ebp - 0x5c], 0x42f5e8
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], esi
call fcn.00405792
mov eax, dword [eax + 8]
mov edi, str.ServUAdmin.exe
mov ebx, 0x42f5c8
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0x42f5b8
mov dword [ebp - 0x10], esi
call fcn.004122d4
push esi
push ebx
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], esi
call fcn.00412360
test eax, eax
jne 0x4039ef
mov dword [ebp - 0x18], esi
xor ebx, ebx
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x60], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x403a0d
push 0xffffffffffffffff
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp + ebx*4 - 0x18]
inc ebx
cmp edi, esi
jne 0x4039f1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.004122f8
call fcn.004183b6
ret
Function at 0x404054
Capabilities:
Create process on windows

Disassembly:
push 0x130
mov eax, 0x42be3f
call fcn.00418317
mov esi, ecx
call fcn.00406905
push eax
lea ecx, [ebp - 0x14]
call fcn.00401473
push dword [esi + 0xb0]
lea eax, [ebp - 0x14]
push str._k___s_
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0040167d
mov edi, dword [ebp - 0x14]
add esp, 0xc
mov dword [ebp - 0x50], 0x3c
mov dword [ebp - 0x4c], 0x140
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], str.open
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
call fcn.00405792
mov eax, dword [eax + 8]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x40], 0x42f5c8
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x4040f0
push 0xffffffffffffffff
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x404188
cmp dword [ebp - 0x10], ebx
jne 0x404188
push 0x128
call fcn.00404a61
pop ecx
mov ecx, eax
mov dword [ebp - 0x54], ecx
cmp ecx, ebx
mov byte [ebp - 4], 1
je 0x40412d
push ebx
call fcn.00403390
jmp 0x40412f
xor eax, eax
push dword [esi + 0x20]
lea ecx, [ebp - 0x13c]
push 1
push 0x85
push 0x81
push eax
push dword [esi + 0x44]
mov byte [ebp - 4], bl
call fcn.004026d8
push 0x69
push 0x6a
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 2
call fcn.004028c0
lea ecx, [ebp - 0x13c]
call fcn.00410748
mov eax, dword [ebp - 0xb4]
lea ecx, [ebp - 0x13c]
mov dword [esi + 0xa4], eax
mov byte [ebp - 4], bl
call fcn.00402770
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [edi - 0x10]
call fcn.004010fc
call fcn.004183b6
ret

Function at 0x40af40
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x40af79
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004070bc
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00403adb
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]
Function at 0x40c5bd
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
push 0x42ef10
mov ecx, edi
call fcn.00401658
cmp dword [esi + 0x4c], 0
push dword [esp + 0xc]
jne 0x40c610
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x40c623
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, edi
call fcn.004070bc
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, edi
call fcn.00403adb
jmp 0x40c623
mov ecx, esi
call fcn.0040ccaf
test eax, eax
je 0x40c623
push edi
mov ecx, eax
call fcn.0040af40
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
pop edi
pop esi
ret 8

Function at 0x40cc0d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x40cc50
call fcn.00405792
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40cc50
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40cc6b
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0040c7c4
test ebx, ebx
mov esi, eax
je 0x40cc69
test edi, edi
je 0x40cc69
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x410748
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x42c690
call fcn.0041834a
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x18], eax
call fcn.00405792
mov edi, dword [eax + 0xc]
xor ebx, ebx
cmp dword [esi + 0x58], ebx
je 0x410793
call fcn.00405792
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x58]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x4107a4
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x4107b1
or eax, 0xffffffff
jmp 0x41090d
mov ecx, esi
call fcn.0041029a
mov dword [ebp - 0x14], eax
call fcn.00409e01
and dword [ebp - 0x28], ebx
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
je 0x41082f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x41082f
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x41082f
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x2c], 1
call fcn.00406cae
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x24], ebx
je 0x41082f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x120]
test eax, eax
je 0x41082f
mov ecx, ebx
call fcn.0040ce63
test eax, eax
je 0x41082f
push 0
mov ecx, ebx
call fcn.0040ce7e
mov dword [ebp - 0x28], 1
and dword [ebp - 4], 0
push esi
call fcn.0040b97d
push dword [ebp - 0x14]
call fcn.00409d59
push edi
push eax
push dword [ebp - 0x1c]
mov ecx, esi
call fcn.00410550
xor edi, edi
cmp eax, edi
je 0x41088c
test byte [esi + 0x3c], 0x10
je 0x410876
push 4
pop edi
mov ecx, esi
call fcn.0040cd4a
test ax, 0x100
je 0x41086c
push 5
pop edi
push edi
mov ecx, esi
call fcn.004098ef
xor edi, edi
cmp dword [esi + 0x20], edi
je 0x41088c
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.0040cee5
or dword [ebp - 4], 0xffffffff
jmp 0x4108b7
cmp dword [ebp - 0x28], edi
je 0x4108c5
push 1
mov ecx, ebx
call fcn.0040ce7e
cmp dword [ebp - 0x2c], edi
je 0x4108d5
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x4108ee
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x20]
jne 0x4108ee
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.004102d4
cmp dword [esi + 0x58], edi
je 0x41090a
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x44]
call fcn.004183b6
ret