joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b29cc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x178]
test eax, eax
je 0x5b2a78
cmp dword [ebx + 0x98], 0
jne 0x5b2a72
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5b2904
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x94]
cmp dword [eax + 8], 0
je 0x5b2a72
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
mov eax, esi
mov edx, 0xffffffec
push edx
push eax
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5b2a38
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x94]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5b2a72
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x94]
call fcn.004aba00
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5b2a47
inc dword [ebx + 0x98]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5b2c98
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x68b39c]
cmp dword [eax + 0x178], 0
je 0x5b2dfd
test bl, bl
jne 0x5b2d4b
cmp dword [esi + 0xa0], 0
jne 0x5b2d40
mov eax, esi
call fcn.005b5b88
push eax
push 0x5b2ba4
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x48], 0
je 0x5b2d11
mov eax, dword [0x68b39c]
cmp byte [eax + 0xd7], 0
je 0x5b2d11
mov eax, dword [esi + 0xdc]
call fcn.0040b150
mov edi, eax
cmp edi, 0
jl 0x5b2d11
push 0
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5b2cfa
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5b2d40
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.004aba00
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5b2d20
inc dword [esi + 0xa0]
jmp 0x5b2dfd
cmp dword [esi + 0xa0], 0
jle 0x5b2dfd
dec dword [esi + 0xa0]
cmp dword [esi + 0xa0], 0
jne 0x5b2dfd
cmp dword [esi + 0x48], 0
je 0x5b2da8
mov eax, dword [0x68b39c]
cmp byte [eax + 0xd7], 0
je 0x5b2da8
mov eax, dword [esi + 0xdc]
call fcn.0040b150
mov edi, eax
cmp edi, 0
jl 0x5b2da8
push 5
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5b2d91
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5b2dd7
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.004aba00
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5b2db7
mov eax, dword [esi + 0x9c]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xdc]
mov ecx, 1
mov edx, dword [0x5a46ec]
call fcn.0040b364
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x5c94e4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
test ebx, ebx
je 0x5c9509
mov ecx, 0x2d1c
mov edx, 0x5c958c
mov eax, 0x5c95e8
call fcn.00408ff0
test esi, esi
je 0x5c951b
mov dword [0x68b400], 0x13
xor eax, eax
jmp 0x5c9575
test edi, edi
jne 0x5c9533
mov ecx, 0x2d21
mov edx, 0x5c958c
mov eax, 0x5c95e8
call fcn.00408ff0
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x5c9553
sub eax, 4
je 0x5c9553
mov ecx, 0x2d22
mov edx, 0x5c958c
mov eax, 0x5c95e8
call fcn.00408ff0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
push ebx
call sub.kernel32.dll_CreateThread_1
cmp dword [ebp + 8], 0
je 0x5c9575
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dword [edx], ecx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc

Function at 0x5d3690
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
push esi
push edi
mov byte [ebx + 0x10], 1
mov eax, dword [ebp + 8]
mov esi, edx
push eax
mov edi, ecx
mov edx, dword [ebp + 0xc]
push edx
push edi
push esi
push esi
push str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
push ebx
call fcn.005cd958
add esp, 0x1c
test edi, edi
jne 0x5d36d4
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
push esi
push str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
push ebx
call fcn.005cd958
add esp, 0x14
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x64f714
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], edx
mov ebx, eax
mov eax, str.etilqs_
call fcn.00643db4
mov dword [esp + 4], eax
mov esi, dword [ebx + 8]
lea ebp, [esi + 2]
mov eax, ebp
cdq
push edx
push eax
call fcn.0064b800
mov ebx, eax
test ebx, ebx
jne 0x64f74e
mov eax, 0xc0a
jmp 0x64fa21
mov edx, dword [esp + 4]
add edx, 0xf
mov ecx, esi
sub ecx, edx
mov dword [esp + 8], ecx
call fcn.0064f6e4
test eax, eax
je 0x64f7f6
mov eax, dword [0x670944]
call fcn.00643db4
test eax, eax
jle 0x64f7e2
mov edx, dword [0x670944]
mov dl, byte [edx + eax - 1]
cmp dl, 0x2f
je 0x64f793
mov ecx, dword [0x670944]
cmp dl, 0x5c
je 0x64f793
inc eax
cmp eax, dword [esp + 8]
jle 0x64f7cc
mov eax, 0xb
call fcn.00630970
call fcn.006309ac
mov eax, ebx
call fcn.0064b4dc
push 0
push 0x12ba
mov ecx, str.winGetTempname1
xor edx, edx
mov eax, 1
call fcn.0064dd7c
jmp 0x64fa21
mov edx, dword [0x670944]
push edx
push 0x67f88e
push ebx
push esi
call fcn.00643ba4
add esp, 0x10
mov eax, 0xb
call fcn.00630970
call fcn.006309ac
jmp 0x64f945
mov eax, esi
add eax, eax
xor edx, edx
push edx
push eax
call fcn.0064b800
mov edi, eax
test edi, edi
jne 0x64f81a
mov eax, ebx
call fcn.0064b4dc
mov eax, 0xc0a
jmp 0x64fa21
push edi
push esi
call dword [0x67eee4]
test eax, eax
jne 0x64f857
mov eax, edi
call fcn.0064b4dc
mov eax, ebx
call fcn.0064b4dc
push 0
push 0x131f
call dword [0x67ee9c]
mov edx, eax
mov ecx, str.winGetTempname2
mov eax, 0x190a
call fcn.0064dd7c
jmp 0x64fa21
mov eax, edi
call fcn.0064d97c
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x64f892
mov edx, dword [esp + 0xc]
push edx
push 0x67f88e
push ebx
push esi
call fcn.00643ba4
add esp, 0x10
mov eax, dword [esp + 0xc]
call fcn.0064b4dc
mov eax, edi
call fcn.0064b4dc
jmp 0x64f945
mov eax, edi
call fcn.0064b4dc
mov eax, ebx
call fcn.0064b4dc
mov eax, 0xc0a
jmp 0x64fa21
mov eax, dword [esp + 8]
mov edx, ebx
inc eax
call fcn.0064f698
test eax, eax
jne 0x64f979
mov eax, ebx
call fcn.0064b4dc
push 0
push 0x1351
mov ecx, str.winGetTempname4
xor edx, edx
mov eax, 1
call fcn.0064dd7c
jmp 0x64fa21
mov eax, ebx
call fcn.00643db4
mov edx, dword [esp + 4]
add edx, eax
add edx, 0x11
cmp ebp, edx
jge 0x64f9ae
mov eax, ebx
call fcn.0064b4dc
push 0
push 0x1363
mov ecx, str.winGetTempname5
xor edx, edx
mov eax, 1
call fcn.0064dd7c
jmp 0x64fa21
push str.etilqs_
lea edx, [eax + ebx]
push edx
add ebp, 0xfffffff0
sub ebp, eax
push ebp
call fcn.00643ba4
add esp, 0xc
mov eax, ebx
call fcn.00643db4
mov edi, eax
mov eax, 0xf
mov edx, edi
add edx, ebx
call fcn.006482c0
call dword [0x67ee30]
mov esi, eax
xor ebp, ebp
lea ecx, [ebx + edi]
mov eax, esi
xor edx, edx
and al, 0xff
add byte [ecx], al
xor eax, eax
mov al, byte [ecx]
push ecx
shr esi, 8
mov ecx, 0x3e
div ecx
pop ecx
mov al, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [ecx], al
inc ebp
inc ecx
inc edi
cmp ebp, 0xf
jb 0x64f9e9
mov byte [ebx + edi], 0
xor eax, eax
mov byte [ebx + edi + 1], 0
mov edx, dword [esp]
mov dword [edx], ebx
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x655234
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
lea eax, [ebp - 0xf8]
call fcn.00655398
lea ecx, [ebp - 0xf8]
mov edx, edi
mov eax, esi
call fcn.006553a8
lea edx, [ebp - 0xf8]
lea eax, [ebp - 0x1a4]
mov ecx, 0xac
call fcn.005c83bc
lea ecx, [ebp - 0x1a4]
mov edx, dword [ebp + 0x14]
mov eax, ebx
call fcn.00655418
mov eax, dword [ebp + 8]
xor edx, edx
dec eax
shr eax, 5
inc eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0xc]
jae 0x65538c
lea eax, [ebp - 0x4c]
mov ecx, 0x20
xor edx, edx
call fcn.005c83cc
lea edx, [ebp - 0x1a4]
lea eax, [ebp - 0x250]
mov ecx, 0xac
call fcn.005c83bc
mov eax, dword [ebp - 4]
mov ebx, 4
inc eax
mov edx, eax
mov ecx, eax
shr edx, 0x18
shr ecx, 0x10
mov byte [ebp - 0x2c], dl
shr eax, 8
mov byte [ebp - 0x2b], cl
mov byte [ebp - 0x2a], al
xor edx, edx
mov al, byte [ebp - 4]
inc eax
mov byte [ebp - 0x29], al
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
jae 0x655352
lea ecx, [ebp - 0x250]
lea eax, [ebp - 0x2c]
mov edx, ebx
call fcn.00655418
lea ecx, [ebp - 0x250]
lea eax, [ebp - 0x2c]
mov edx, 0x20
call fcn.006554ac
xor ebx, ebx
lea edx, [ebp - 0x4c]
lea eax, [ebp - 0x2c]
mov cl, byte [eax]
xor byte [edx], cl
inc ebx
inc edx
inc eax
cmp ebx, 0x20
jb 0x655325
lea edx, [ebp - 0xf8]
lea eax, [ebp - 0x250]
mov ecx, 0xac
call fcn.005c83bc
inc dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 0x10]
jb 0x6552fa
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
shl ebx, 5
mov eax, dword [ebp + 0xc]
lea edx, [eax + ebx]
lea eax, [ebp - 0x4c]
jmp 0x655372
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc ebx
inc dword [ebp - 8]
inc edx
cmp dword [ebp - 8], 0x20
jae 0x65537d
cmp ebx, dword [ebp + 8]
jb 0x655368
inc dword [ebp - 4]
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jb 0x6552a2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x655418
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
push ecx
mov dword [esp], eax
mov eax, dword [ebx + 0xa8]
mov esi, edx
cmp eax, 0xffffffff
je 0x655496
cmp eax, 0x40
jbe 0x655447
lea edx, [ebx + 0x40]
mov eax, ebx
call fcn.006566a4
mov dword [ebx + 0xa8], 0x20
mov ecx, pe_nt_image_headers32
mov eax, dword [ebx + 0xa8]
sub ecx, dword [ebx + 0xa8]
add eax, ebx
xor edx, edx
call fcn.005c83cc
xor edx, edx
mov eax, ebx
xor dword [eax], 0x36363636
inc edx
add eax, 4
cmp edx, 0x10
jb 0x655465
lea edi, [ebx + 0x40]
mov eax, edi
call fcn.00656688
mov ecx, edi
mov edx, pe_nt_image_headers32
mov eax, ebx
call fcn.00656498
mov dword [ebx + 0xa8], 0xffffffff
test esi, esi
je 0x6554a7
lea ecx, [ebx + 0x40]
mov edx, esi
mov eax, dword [esp]
call fcn.00656498
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x6554ac
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffdc
mov ebx, ecx
mov esi, edx
mov dword [esp], eax
cmp dword [ebx + 0xa8], 0xffffffff
je 0x6554cd
mov ecx, ebx
xor edx, edx
xor eax, eax
call fcn.00655418
lea edx, [ebx + 0x40]
lea eax, [esp + 4]
call fcn.006566a4
xor eax, eax
mov edx, ebx
xor dword [edx], 0x6a6a6a6a
inc eax
add edx, 4
cmp eax, 0x10
jb 0x6554dd
lea edi, [ebx + 0x40]
mov eax, edi
call fcn.00656688
mov ecx, edi
mov edx, pe_nt_image_headers32
mov eax, ebx
call fcn.00656498
mov ecx, edi
lea eax, [esp + 4]
mov edx, 0x20
call fcn.00656498
mov edx, edi
lea eax, [esp + 4]
call fcn.006566a4
xor eax, eax
mov edx, dword [esp]
mov ecx, edx
lea edx, [esp + 4]
cmp esi, eax
jbe 0x655539
mov bl, byte [edx]
mov byte [ecx], bl
inc eax
inc ecx
inc edx
cmp esi, eax
ja 0x65552e
add esp, 0x24
pop edi
pop esi
pop ebx
ret
Function at 0x656688
Capabilities:
Hash data using sha256

Disassembly:
xor edx, edx
mov dword [eax + 4], edx
mov dword [eax], edx
mov edx, 0x684c30
add eax, 8
mov ecx, 0x20
call fcn.005c83bc
ret

Function at 0x656860
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x65686f
test al, 0x10
je 0x656872
xor eax, eax
ret
mov al, 1
ret

Function at 0x65e85c
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, eax
push 0
push 0x80
push 3
push 0
push 3
push 0x100
mov eax, ebx
call fcn.00409eb8
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x65e8fb
xor eax, eax
push ebp
push 0x65e8f4
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp + 0xc]
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
call fcn.00426e24
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
call sub.kernel32.dll_SystemTimeToFileTime
test eax, eax
jne 0x65e8c1
call fcn.00408958
jmp 0x65e8fb
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetFileTime
test eax, eax
jne 0x65e8dd
call fcn.00408958
jmp 0x65e8fb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65e8fb
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4019c3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov dword [0x4040d0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x4019d6
push esp
mov dword [ebp - 0x24], 0x4016fe
mov eax, dword [0x4040d0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.solienty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040d0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.absent
push str.solienty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040d8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401a75
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401a56
pop ebp
ret 0x10
Function at 0x4015b0
Capabilities:
Enumerate process modules
Enumerate processes
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x414014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x238], ecx
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push 0x128
mov ebx, eax
lea eax, [ebp - 0x230]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
push str.HH.exe
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x230], 0x128
push 0x104
push eax
mov dword [ebp - 0x22c], 1
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0x18
lea eax, [ebp - 0x230]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x401708
lea eax, [ebp - 0x230]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x401708
nop word [eax + eax]
push 0x100
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [ebp - 0x228]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4016f2
lea eax, [ebp - 0x23c]
push eax
push 4
lea eax, [ebp - 0x234]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x4016b3
push 0x100
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x234]
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.ThreadPathName:
call esi
lea eax, [ebp - 0x108]
push eax
call esi
push 0x40eca8
call esi
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x238]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x4016f2
inc edi
lea eax, [ebp - 0x230]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x401650
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040bb2c
mov esp, ebp
pop ebp
ret
Function at 0x401b70
Capabilities:
Print debug messages
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x824
mov eax, dword [0x414014]
xor eax, esp
mov dword [esp + 0x820], eax
push ebx
push esi
mov esi, dword [0x415714]
lea ecx, [esp + 8]
push edi
push 0x40e9a7
call dword [sym.imp.mfc140.dll_Ordinal_310]
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add esp, 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], edx
xorps xmm0, xmm0
mov dword [esp + 0x24], 0
lea ecx, [esp + 0x1c]
movsd qword [esp + 0x1c], xmm0
push eax
call fcn.0040a240
push 0x800
lea eax, [esp + 0x2c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x28]
push 0
push 0x800
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401d31
sub esp, 8
lea eax, [esp + 0x18]
lea ecx, [esp + 0x24]
push eax
call fcn.0040a060
push ebx
push dword [eax]
lea eax, [esp + 0x14]
push str.__s_RecvData_HDZB__4d_Bytes_:
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
add esp, 0x10
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, dword [0x414700]
mov eax, 0x800
cmp ebx, eax
cmovg ebx, eax
xor ecx, ecx
cmp edi, eax
cmovg edi, ecx
lea esi, [edi + ebx]
cmp esi, eax
jl 0x401c9c
sub eax, edi
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [edi + 0x414710]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [esi - 0x800]
push eax
lea eax, [esp + 0x82c]
sub eax, edi
push eax
push 0x414710
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 0xfffff800
jmp 0x401cb1
push ebx
lea eax, [esp + 0x2c]
push eax
lea eax, [edi + 0x414710]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [0x414700], esi
cmp esi, 0x800
jae 0x401d52
mov ecx, 0x414710
mov byte [esi + 0x414710], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401cd2
sub ecx, edx
cmp ecx, esi
cmovb esi, ecx
mov ecx, dword [0x414704]
mov eax, esi
mov dword [0x414700], esi
sub eax, ecx
push eax
push esi
push ecx
lea eax, [esp + 0x18]
push str.RecvData:_d_d_d_r_n
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
add esp, 0x14
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x820]
xor ecx, esp
call fcn.0040bb2c
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov ecx, dword [esp + 0x82c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040bb2c
mov esp, ebp
pop ebp
ret
call fcn.0040bc60
int3
Function at 0x402450
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
push edi
lea eax, [ebp - 0x68]
mov esi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [ebp - 0x54]
push esi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x44]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
jne 0x4024b7
push str.GetCpuUsageRatio_GetProcessTimes_failed_n
call fcn.00409f60
add esp, 4
xorps xmm0, xmm0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x24]
mov eax, edi
add esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
adc ecx, dword [ebp - 0x28]
cdq
push edx
push eax
push ecx
push esi
call fcn.0040cbc0
mov ecx, dword [0x4146e8]
mov edi, eax
or ecx, dword [0x4146ec]
mov ebx, edx
mov esi, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], eax
je 0x4025bd
mov ecx, dword [0x4146e0]
mov eax, ecx
mov edx, dword [0x4146e4]
or eax, edx
je 0x4025ba
push dword [ebp - 0xc]
mov eax, edi
sub eax, dword [0x4146e8]
mov dword [ebp - 0x1c], eax
sbb ebx, dword [0x4146ec]
mov dword [ebp - 0x18], ebx
mov ebx, esi
mov esi, dword [ebp - 4]
sub ebx, ecx
sbb esi, edx
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
or eax, esi
jne 0x402550
push str.GetCpuUsageRatio_time_delta_is_0__error_n
call fcn.00409f60
add esp, 4
xorps xmm0, xmm0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
push 0
push 0x64
push dword [ebp - 0x18]
mov dword [0x4146ec], eax
mov eax, dword [ebp - 0x14]
push dword [ebp - 0x1c]
mov dword [0x4146e0], eax
mov eax, dword [ebp - 4]
mov dword [0x4146e8], edi
mov dword [0x4146e4], eax
call fcn.0040cb50
push 0
push 2
push dword [ebp - 8]
mov edi, eax
mov esi, edx
push ebx
call fcn.0040caa0
push dword [ebp - 8]
add edi, eax
push ebx
adc esi, edx
push esi
push edi
call fcn.0040caa0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
cvtps2pd xmm0, xmm0
divsd xmm0, qword [0x410968]
cvtpd2ps xmm0, xmm0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov dword [0x4146e8], edi
xorps xmm0, xmm0
pop edi
mov dword [0x4146e0], esi
pop esi
mov dword [0x4146ec], ebx
mov dword [0x4146e4], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4025e0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x40f094
push 0x8c
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
jne 0x402634
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 4]
push eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40262b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret