joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ef70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45028b
mov eax, dword fs:[0]
push eax
mov eax, 0x2838
call fcn.00446fd0
mov eax, dword [0x469090]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, ecx
mov esi, edx
push ebx
mov dword [ebp - 0x2844], eax
mov dword [ebp - 0x283c], esi
mov dword [ebp - 0x2840], 6
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41f0ed
test al, 0x10
jne 0x41f0ed
xor ecx, ecx
lea edi, [ebp - 0x2838]
mov eax, ebx
mov word [ebp - 0x2814], cx
call fcn.00407eb0
mov edi, dword [ebp - 0x2838]
lea ecx, [edi + eax]
mov eax, ecx
sub eax, edi
mov dword [ebp - 0x2838], ecx
mov dword [ebp - 0x2834], edi
cmp eax, 0x1e
jl 0x41f04f
mov esi, edi
sub esi, 0x45c680
mov ecx, 0x45c680
jmp 0x41f020
cmp ecx, 0x45c69e
je 0x41f0c2
mov dl, byte [esi + ecx]
cmp dl, byte [ecx]
jne 0x41f036
inc ecx
jmp 0x41f020
inc dword [ebp - 0x2834]
dec eax
inc esi
cmp eax, 0x1e
jge 0x41f013
mov esi, dword [ebp - 0x283c]
mov ecx, dword [ebp - 0x2838]
mov dword [ebp - 0x2834], ecx
push edi
call fcn.00437245
mov ecx, dword [ebp - 0x2838]
add esp, 4
cmp dword [ebp - 0x2834], ecx
mov ecx, esi
jae 0x41f0d9
push str.JavaVer.class_found
push str.INFO
call fcn.0040c980
mov edx, dword [ebp - 0x2844]
push ebx
push edx
push str.__s_binjavaw.exe___classpath___s__ru.megamakc.core.JavaVer
lea eax, [ebp - 0x2814]
push 0x1400
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
lea ecx, [ebp - 0x2814]
push 0
push ecx
mov ebx, esi
mov ecx, 1
call fcn.00407b10
add esp, 8
mov dword [ebp - 0x2840], eax
jmp 0x41f198
mov eax, dword [ebp - 0x2834]
mov esi, dword [ebp - 0x283c]
mov dword [ebp - 0x2834], eax
jmp 0x41f055
push str.JavaVer.class_NOT_FOUND
push str.ERROR
call fcn.0040c980
jmp 0x41f198
xor edi, edi
xor edx, edx
mov eax, ebx
mov word [ebp - 0x2830], dx
mov dword [ebp - 0x281c], 7
mov dword [ebp - 0x2820], edi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x41f110
sub eax, edx
sar eax, 1
push eax
mov eax, ebx
lea esi, [ebp - 0x2830]
call fcn.00402510
push 0xa
mov eax, str._not_found
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.00402190
mov esi, 8
cmp dword [eax + 0x14], esi
jb 0x41f14a
mov eax, dword [eax]
mov ecx, dword [ebp - 0x283c]
push eax
push str.INFO
call fcn.0040c980
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x281c], esi
jb 0x41f179
mov eax, dword [ebp - 0x2830]
push eax
call fcn.00437245
add esp, 4
mov esi, dword [ebp - 0x283c]
xor ecx, ecx
mov dword [ebp - 0x281c], 7
mov dword [ebp - 0x2820], edi
mov word [ebp - 0x2830], cx
push str.Test_java_ver...
push str.INFO
mov ecx, esi
call fcn.0040c980
mov eax, dword [ebp - 0x2840]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0043722b
mov esp, ebp
pop ebp
ret
Function at 0x41f8e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44fa9b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x469090]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 8]
mov ebx, dword [eax + 0xc]
push 0x1c
mov dword [esp + 0x20], ecx
call fcn.004372a1
mov edi, eax
add esp, 4
mov dword [esp + 0x18], edi
mov dword [esp + 0x30], 0
test edi, edi
je 0x41f9c0
mov esi, dword [esi + 0x18]
call fcn.0040dc90
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
add eax, 0x264
lea edx, [esp + 0x14]
call fcn.0040d2b0
mov edx, dword [eax]
test edx, edx
jne 0x41f964
mov edx, esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [esp + 0x1c]
mov esi, dword [0x46dbc0]
push 0
push 0
push 0
push ecx
push ebx
add eax, 0xffffffd8
push eax
push 0x14
push 0x14
push 0x50000000
push edx
push str.Static
add esi, 8
push 0
mov dword [edi + 4], esi
mov dword [edi + 8], eax
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], 0x14
mov dword [edi + 0x14], 0x14
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 1
mov dword [edi], eax
mov esi, dword [esi]
push esi
push 0x30
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x424
mov dword [esp + 0x34], 0xffffffff
call fcn.004372a1
mov esi, eax
add esp, 4
test esi, esi
je 0x41fa1b
mov ecx, dword [esp + 0x10]
add ecx, 0x1c
cmp dword [ecx + 0x14], 8
jb 0x41f9ea
mov ecx, dword [ecx]
mov eax, dword [esp + 0x1c]
mov edx, dword [ebp + 0xc]
push ecx
add eax, 0xffffffd8
push eax
mov eax, dword [0x46dbc0]
mov edi, dword [eax + 4]
push 0x50
push 0x14
lea ecx, [eax + 8]
push ecx
mov ecx, dword [edx]
push ecx
mov ebx, 0x14
call fcn.0042d6c0
mov dword [esi], vtable.UrlLinkLabel.0
jmp 0x41fa1d
xor esi, esi
mov eax, dword [esp + 0x10]
add eax, 0x1c
cmp dword [eax + 0x14], 8
jb 0x41fa2c
mov eax, dword [eax]
push eax
push 0x100
add esi, 0x224
push esi
call fcn.0043782b
add esp, 0xc
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x421f90
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4501a8
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x469090]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov word [ebp - 0x2c], ax
push 0x1a
mov eax, str.using_GlobalMemoryStatusEx
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
call fcn.00402510
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
mov esi, 8
cmp dword [ebp - 0x18], esi
jae 0x421ff3
lea eax, [ebp - 0x2c]
mov ecx, dword [0x46dbc4]
push eax
push str.INFO
call fcn.0040c980
cmp dword [ebp - 0x18], esi
jb 0x422015
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.00437245
add esp, 4
lea edx, [ebp - 0x70]
push edx
mov dword [ebp - 0x70], 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalMemoryStatusEx]
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x60]
shrd ecx, eax, 0xa
mov dword [ebp - 0x78], ecx
shr eax, 0xa
mov ecx, eax
and eax, 0x7fffffff
mov dword [ebp - 0x74], eax
and ecx, 0x80000000
fild qword [ebp - 0x78]
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], 0
fild qword [ebp - 0x78]
fchs
faddp st(1)
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043722b
mov esp, ebp
pop ebp
ret

Function at 0x422620
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4520b8
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x469090]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00423a20
fstp qword [ebp - 0x80]
xor eax, eax
mov word [ebp - 0x2c], ax
push 0x1a
mov eax, str.setMaxMemoryPercentOfTotal
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
call fcn.00402510
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
mov esi, 8
cmp dword [ebp - 0x18], esi
jae 0x42268b
lea eax, [ebp - 0x2c]
mov ecx, dword [0x46dbc4]
push eax
push str.INFO
call fcn.0040c980
cmp dword [ebp - 0x18], esi
jb 0x4226ad
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.00437245
add esp, 4
fldz
fld qword [ebp - 0x80]
fcom st(1)
fnstsw ax
fld qword [0x4600d8]
test ah, 5
jp 0x4226ca
fstp st(1)
fstp st(0)
fstp qword [ebp - 0x80]
jmp 0x4226d7
fstp st(2)
fcomp st(1)
fnstsw ax
test ah, 0x41
je 0x4226c5
fstp st(0)
lea edx, [ebp - 0x70]
push edx
mov dword [ebp - 0x70], 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalMemoryStatusEx]
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x68]
shrd ecx, eax, 0xa
mov dword [ebp - 0x78], ecx
shr eax, 0xa
mov ecx, eax
and eax, 0x7fffffff
mov dword [ebp - 0x74], eax
and ecx, 0x80000000
fild qword [ebp - 0x78]
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], 0
fild qword [ebp - 0x78]
fchs
faddp st(1)
fmul qword [ebp - 0x80]
fdiv qword [0x4600d8]
call fcn.0044ef10
mov dword [edi + 0x1f4], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043722b
mov esp, ebp
pop ebp
ret
Function at 0x422750
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4520b8
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x469090]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00423a20
fstp qword [ebp - 0x80]
xor eax, eax
mov word [ebp - 0x2c], ax
push 0x1b
mov eax, str.setInitMemoryPercentOfTotal
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
call fcn.00402510
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
mov esi, 8
cmp dword [ebp - 0x18], esi
jae 0x4227bb
lea eax, [ebp - 0x2c]
mov ecx, dword [0x46dbc4]
push eax
push str.INFO
call fcn.0040c980
cmp dword [ebp - 0x18], esi
jb 0x4227dd
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.00437245
add esp, 4
fldz
fld qword [ebp - 0x80]
fcom st(1)
fnstsw ax
fld qword [0x4600d8]
test ah, 5
jp 0x4227fa
fstp st(1)
fstp st(0)
fstp qword [ebp - 0x80]
jmp 0x422807
fstp st(2)
fcomp st(1)
fnstsw ax
test ah, 0x41
je 0x4227f5
fstp st(0)
lea edx, [ebp - 0x70]
push edx
mov dword [ebp - 0x70], 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalMemoryStatusEx]
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x68]
shrd ecx, eax, 0xa
mov dword [ebp - 0x78], ecx
shr eax, 0xa
mov ecx, eax
and eax, 0x7fffffff
mov dword [ebp - 0x74], eax
and ecx, 0x80000000
fild qword [ebp - 0x78]
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], 0
fild qword [ebp - 0x78]
fchs
faddp st(1)
fmul qword [ebp - 0x80]
fdiv qword [0x4600d8]
call fcn.0044ef10
mov dword [edi + 0x200], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043722b
mov esp, ebp
pop ebp
ret
Function at 0x429d40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x450048
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x469090]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, ecx
mov esi, edx
push ebx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x34], esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x429e76
test al, 0x10
jne 0x429e76
push 0x2800
call fcn.0043723a
mov dword [ebp - 0x3c], eax
add esp, 4
lea edi, [ebp - 0x30]
mov eax, ebx
call fcn.00407eb0
mov edi, dword [ebp - 0x30]
add eax, edi
mov dword [ebp - 0x30], eax
sub eax, edi
mov dword [ebp - 0x38], edi
cmp eax, 0x1f
jl 0x429def
mov esi, edi
sub esi, str.ru_megamakc_core_JavaArch.class
mov ecx, str.ru_megamakc_core_JavaArch.class
lea esp, [esp]
cmp ecx, 0x45eb2b
je 0x429e56
mov dl, byte [esi + ecx]
cmp dl, byte [ecx]
jne 0x429de2
inc ecx
jmp 0x429dd0
inc dword [ebp - 0x38]
dec eax
inc esi
cmp eax, 0x1f
jge 0x429dc4
mov esi, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jae 0x429e5e
push edi
call fcn.00437245
add esp, 4
push str.JavaArch.class_found
push str.INFO
mov ecx, esi
call fcn.0040c980
mov eax, dword [ebp - 0x40]
mov edi, dword [ebp - 0x3c]
push ebx
push eax
push str.__s_binjavaw.exe___classpath___s__ru.megamakc.core.JavaArch
push 0x1400
push edi
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
push 0
push edi
mov ebx, esi
mov ecx, 1
call fcn.00407b10
mov ecx, edi
push ecx
mov esi, eax
call fcn.00437245
xor eax, eax
add esp, 0xc
cmp esi, 0x20
sete al
jmp 0x429ee8
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x34]
jmp 0x429df2
push str.JavaArch.class_NOT_FOUND
push str.ERROR
mov ecx, esi
call fcn.0040c980
test edi, edi
je 0x429ee6
push edi
jmp 0x429ede
xor edi, edi
xor edx, edx
mov eax, ebx
mov word [ebp - 0x2c], dx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], edi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x429e90
sub eax, edx
sar eax, 1
push eax
mov eax, ebx
lea esi, [ebp - 0x2c]
call fcn.00402510
push 0xa
mov eax, str._not_found
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.00402190
mov esi, 8
cmp dword [eax + 0x14], esi
jb 0x429ec7
mov eax, dword [eax]
mov ecx, dword [ebp - 0x34]
push eax
push str.INFO
call fcn.0040c980
cmp dword [ebp - 0x18], esi
jb 0x429ee6
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00437245
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043722b
mov esp, ebp
pop ebp
ret
Function at 0x42d260
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, eax
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
test esi, esi
je 0x42d323
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
test edi, edi
je 0x42d323
push esi
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x42d323
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
test eax, eax
je 0x42d31c
push esi
push edi
push eax
call fcn.0043c140
add esp, 0xc
lea eax, [ebp - 4]
push eax
xor edi, edi
push edi
push ebx
mov dword [ebp - 4], edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x42d315
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042d220
mov esi, dword [ebp + 8]
mov dword [esi], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
add esp, 4
push eax
mov eax, dword [edx + 8]
call eax
mov eax, dword [esi]
cmp eax, edi
je 0x42d315
mov ecx, dword [eax + 8]
mov dword [eax + 8], edi
cmp ecx, edi
jne 0x42d305
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi]
cmp ecx, edi
je 0x42d313
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [esi], edi
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42d550
Capabilities:
Create thread
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x469090]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
lea ecx, [ebp - 0x20c]
push ecx
push 0
push 0x4594ac
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
push ebx
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
push edi
push 0x4598e4
push esi
call fcn.0042ec40
add esp, 0x1c
lea ecx, [ebp - 0x210]
push ecx
push 0
push eax
push 0x42d480
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043722b
mov esp, ebp
pop ebp
ret

Function at 0x42d750
Capabilities:
Create process on windows

Disassembly:
push 1
push 0
push 0
add ecx, 0x224
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret
Function at 0x42e9c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42e9d0
push ebx
sub eax, edx
sar eax, 1
push esi
mov ebx, eax
push edi
lea edi, [ebx + 1]
push edi
call fcn.0043723a
push ebx
mov esi, eax
push 0
push esi
call fcn.0043c0c0
add esp, 0x10
test edi, edi
je 0x42ea2b
mov ecx, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
push 0
push edi
push esi
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
cmp eax, edi
jae 0x42ea21
mov byte [eax + esi], 0
jmp 0x42ea2b
cmp byte [edi + esi - 1], 0
je 0x42ea2b
mov byte [esi], 0
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42ea30
sub eax, edx
push 0
lea edx, [ebp - 4]
push edx
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push esi
push ecx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push esi
call fcn.00437245
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42eb90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, eax
mov ecx, dword [edi + 0x204]
xor ebx, ebx
cmp ecx, ebx
je 0x42ebb4
push str.httpget_start_asynch_loading
push str.INFO
call fcn.0040c980
mov ecx, dword [edi + 0x204]
cmp ecx, ebx
je 0x42ebcf
mov eax, dword [edi + 0x20c]
push eax
push str.INFO
call fcn.0040c980
push 0x20
call fcn.004372a1
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x42ec1d
push 0x200
mov dword [esi], edi
mov edi, dword [sym.imp.KERNEL32.DLL_LocalAlloc]
push 0x40
mov byte [esi + 8], bl
mov dword [esi + 4], ebx
call edi
push 0x200
push 0x40
mov dword [esi + 0x14], eax
call edi
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x18], eax
xor edx, edx
mov word [ecx], dx
mov eax, dword [esi + 0x18]
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 0x10], ebx
mov byte [esi + 0x1c], bl
jmp 0x42ec1f
xor esi, esi
lea edx, [ebp - 4]
push edx
push ebx
push esi
push 0x42eb30
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42f890
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ffb8
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x469090]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edi, edi
push edi
push 1
push 3
push edi
push 1
mov ebx, ecx
push SysReAllocString
push ebx
mov dword [ebp - 0x90], eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
mov dword [ebp - 0x94], esi
cmp esi, 0xffffffff
je 0x42f9e6
push 0x40000
call fcn.0043723a
add esp, 4
push edi
lea ecx, [ebp - 0x90]
push ecx
push 0x40000
mov ebx, eax
push ebx
push esi
mov dword [ebp - 0x8c], 0x67452301
mov dword [ebp - 0x88], 0xefcdab89
mov dword [ebp - 0x84], 0x98badcfe
mov dword [ebp - 0x80], 0x10325476
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x78], edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x42f9d2
jmp 0x42f950
mov eax, dword [ebp - 0x90]
test eax, eax
je 0x42f986
push eax
push ebx
lea eax, [ebp - 0x8c]
call fcn.004369a0
add esp, 8
push 0
lea edx, [ebp - 0x90]
push edx
push 0x40000
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x42f950
jmp 0x42f9d2
push 0x200
call fcn.0043723a
mov edi, eax
lea ecx, [ebp - 0x24]
add esp, 4
xor eax, eax
push ecx
lea esi, [ebp - 0x8c]
mov word [edi], ax
call fcn.00436ab0
add esp, 4
xor esi, esi
mov edi, edi
movzx edx, byte [ebp + esi - 0x24]
push edx
push edi
push str._s_02x
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
inc esi
add esp, 0x10
cmp esi, 0x10
jb 0x42f9b0
mov esi, dword [ebp - 0x94]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebx
call fcn.00437245
add esp, 4
mov eax, edi
jmp 0x42fa5b
xor eax, eax
mov word [ebp - 0x30], ax
push 0x10
mov eax, str.Cant_open_file
lea esi, [ebp - 0x30]
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], edi
call fcn.00402510
mov eax, ebx
mov dword [ebp - 4], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42fa11
sub eax, edx
sar eax, 1
push eax
mov eax, ebx
lea ecx, [ebp - 0x30]
call fcn.00402190
mov esi, 8
cmp dword [eax + 0x14], esi
jb 0x42fa37
mov eax, dword [eax]
mov ecx, dword [ebp - 0x90]
push eax
push str.ERROR
call fcn.0040c980
cmp dword [ebp - 0x1c], esi
jb 0x42fa59
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.00437245
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0043722b
mov esp, ebp
pop ebp
ret
Function at 0x42fcf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
jne 0x42fd08
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov esi, eax
test esi, esi
je 0x42fd3a
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x42fd36
cmp esi, eax
jae 0x42fd3a
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x42fd28
cmp esi, eax
jb 0x42fd40
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x43722b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x469090]
jne 0x437235
repz ret
jmp fcn.0043924f

Function at 0x43ff12
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x469090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0043a4c9
and dword [ebp - 0x14], 0
cmp dword [0x46d88c], 0
mov dword [ebp - 0x18], eax
jne 0x43ffc5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x44006d
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x456dfc
push ebx
call edi
test eax, eax
je 0x44006d
mov esi, dword [sym.imp.KERNEL32.DLL_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x46d88c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x46d890], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x46d894], eax
call edi
push eax
call esi
mov dword [0x46d89c], eax
test eax, eax
je 0x43ffc5
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46d898], eax
mov eax, dword [0x46d898]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.DLL_DecodePointer]
cmp eax, ecx
je 0x44001e
cmp dword [0x46d89c], ecx
je 0x44001e
push eax
call esi
push dword [0x46d89c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x44001e
test ebx, ebx
je 0x44001e
call edi
test eax, eax
je 0x440015
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x440015
test byte [ebp - 8], 1
jne 0x44001e
or dword [ebp + 0x10], 0x200000
jmp 0x440051
mov eax, dword [0x46d890]
cmp eax, dword [ebp - 0x18]
je 0x440051
push eax
call esi
test eax, eax
je 0x440051
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x440051
mov eax, dword [0x46d894]
cmp eax, dword [ebp - 0x18]
je 0x440051
push eax
call esi
test eax, eax
je 0x440051
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46d88c]
call esi
test eax, eax
je 0x44006d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x44006f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043722b
leave
ret