joyce8/EMBER2024-capa huggingface dataset:
Function at 0x515728
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x540439
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.005181b0
lea edi, [esi + 0x108]
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], edi
lea ecx, [edi + 0xc]
mov dword [edi], 0x9408c8
call fcn.0052f250
lea ecx, [edi + 0x14]
mov byte [esp + 0x18], 1
call fcn.0052f250
lea ecx, [edi + 0x1c]
mov byte [esp + 0x18], 2
call fcn.00517dd0
lea ecx, [edi + 0x30]
mov byte [esp + 0x18], 3
call fcn.00517dd0
lea ecx, [edi + 0x50]
mov byte [esp + 0x18], 4
call fcn.0052f250
lea ecx, [edi + 0x58]
mov byte [esp + 0x18], 5
call fcn.0052f250
lea ecx, [edi + 0x60]
mov byte [esp + 0x18], 6
call fcn.00517dd0
lea ecx, [edi + 0x74]
mov byte [esp + 0x18], 7
call fcn.00517dd0
mov dword [edi], 0x9408c0
lea ecx, [esi + 0x264]
mov byte [esp + 0x18], 8
call fcn.005181b0
lea ecx, [esi + 0x360]
mov byte [esp + 0x18], 9
call fcn.005181b0
lea ecx, [esi + 0x45c]
mov byte [esp + 0x18], 0xa
call fcn.005181b0
lea ecx, [esi + 0x558]
mov byte [esp + 0x18], 0xb
call fcn.005181b0
lea ecx, [esi + 0x654]
mov byte [esp + 0x18], 0xc
call fcn.005181b0
mov ecx, esi
mov byte [esp + 0x18], 0xd
mov dword [esi], method.CWnd.virtual_0
call fcn.00515a50
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x515910
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54054b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], method.CWnd.virtual_0
lea ecx, [esi + 0x654]
mov dword [esp + 0x18], 5
call fcn.00518380
lea ecx, [esi + 0x558]
mov byte [esp + 0x18], 4
call fcn.00518380
lea ecx, [esi + 0x45c]
mov byte [esp + 0x18], 3
call fcn.00518380
lea ecx, [esi + 0x360]
mov byte [esp + 0x18], 2
call fcn.00518380
lea ecx, [esi + 0x264]
mov byte [esp + 0x18], 1
call fcn.00518380
lea edi, [esi + 0x108]
mov dword [esp + 0xc], edi
lea ecx, [edi + 0x74]
mov byte [esp + 0x18], 0xc
mov dword [ecx], 0x9408d0
call fcn.00517fd0
lea ecx, [edi + 0x60]
mov byte [esp + 0x18], 0xb
mov dword [ecx], 0x9408d0
call fcn.00517fd0
lea ecx, [edi + 0x58]
mov byte [esp + 0x18], 0xa
call fcn.0052f279
lea ecx, [edi + 0x50]
mov byte [esp + 0x18], 9
call fcn.0052f279
lea ecx, [edi + 0x30]
mov byte [esp + 0x18], 8
mov dword [ecx], 0x9408d0
call fcn.00517fd0
lea ecx, [edi + 0x1c]
mov byte [esp + 0x18], 7
mov dword [ecx], 0x9408d0
call fcn.00517fd0
lea ecx, [edi + 0x14]
mov byte [esp + 0x18], 6
call fcn.0052f279
lea ecx, [edi + 0xc]
mov byte [esp + 0x18], 0
call fcn.0052f279
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.00518380
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x51a6f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x51a756
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x51a756
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x51a737
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x51aae0
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x51ab18
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x51b9c0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x51ba09
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x51be80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x540a80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0051ba30
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.0051bab0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.0051bab0
lea ecx, [esi + 0xc]
call fcn.0053083a
lea ecx, [esi + 0x10]
call fcn.0053083a
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0051d040
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0051d040
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0051d040
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.005308af
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.005308af
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x532c56
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x532c8e
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00530d0a
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00530ce2
jmp 0x532c9a
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x534348
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x53438a
call fcn.0053a28c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x53438a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x534381
xor eax, eax
jmp 0x534392
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00534398
pop edi
pop esi
pop ebx
ret 4

Function at 0x53a7bc
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x53a7ea
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x53a808
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0053a722
jmp 0x53a808
mov eax, dword [esi + 0x14]
test eax, eax
je 0x53a808
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0053a722
test edi, edi
mov eax, edi
jne 0x53a7f2
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x402510
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
test edi, edi
je 0x4026ad
mov esi, dword [ebp + 8]
test esi, esi
je 0x4026ad
mov dword [esi + 0xf0], 0xa
mov ecx, dword [edi]
mov eax, ecx
rol ecx, 8
and ecx, 0xff00ff
ror eax, 8
and eax, 0xff00ff00
or eax, ecx
mov dword [esi], eax
lea eax, [esi + 4]
mov edx, dword [edi + 4]
mov ecx, edx
ror ecx, 8
and ecx, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or ecx, edx
mov dword [eax], ecx
mov edx, dword [edi + 8]
mov ecx, edx
ror ecx, 8
and ecx, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or ecx, edx
mov dword [esi + 8], ecx
mov ecx, dword [edi + 0xc]
mov edi, 0x6017f4
push ebx
mov ebx, ecx
rol ecx, 8
and ecx, 0xff00ff
ror ebx, 8
and ebx, 0xff00ff00
or ebx, ecx
mov ecx, ebx
mov dword [esi + 0xc], ebx
shr ecx, 0x10
and ecx, 0xff
mov edx, dword [ecx*4 + 0x602d20]
mov ecx, ebx
shr ecx, 8
xor edx, 0x1000000
and ecx, 0xff
and edx, 0xff000000
mov ecx, dword [ecx*4 + 0x602920]
and ecx, 0xff0000
xor edx, ecx
mov ecx, ebx
shr ecx, 0x18
movzx ecx, byte [ecx*4 + 0x603120]
xor edx, ecx
movzx ecx, bl
mov ecx, dword [ecx*4 + 0x603520]
and ecx, 0xff00
xor edx, ecx
mov ecx, dword [eax]
xor edx, dword [esi]
xor ecx, edx
mov dword [esi + 0x10], edx
mov edx, dword [esi + 8]
xor edx, ecx
mov dword [esi + 0x14], ecx
mov ecx, ebx
mov dword [esi + 0x18], edx
xor ecx, edx
mov dword [esi + 0x1c], ecx
pop ebx
mov edi, edi
mov edx, dword [eax + 0x18]
lea eax, [eax + 0x10]
mov ecx, edx
shr ecx, 8
and ecx, 0xff
mov esi, dword [ecx*4 + 0x602920]
mov ecx, edx
shr ecx, 0x10
and esi, 0xff0000
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x602d20]
and ecx, 0xff000000
xor esi, ecx
mov ecx, edx
shr ecx, 0x18
movzx ecx, byte [ecx*4 + 0x603120]
xor esi, ecx
movzx ecx, dl
mov ecx, dword [ecx*4 + 0x603520]
and ecx, 0xff00
xor esi, ecx
xor esi, dword [eax - 4]
xor esi, dword [edi]
add edi, 4
mov dword [eax + 0xc], esi
mov ecx, dword [eax]
xor ecx, esi
mov dword [eax + 0x10], ecx
mov edx, dword [eax + 4]
xor edx, ecx
mov dword [eax + 0x14], edx
mov ecx, dword [eax + 8]
xor ecx, edx
mov dword [eax + 0x18], ecx
cmp edi, 0x601818
jne 0x402620
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
Function at 0x4026c0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.00402510
add esp, 4
test eax, eax
js 0x4028ac
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0xf0]
xor ebx, ebx
shl edi, 2
test edi, edi
jle 0x402734
lea esi, [eax + 8]
add eax, 8
lea esi, [esi + edi*4]
mov edx, dword [eax - 8]
lea eax, [eax + 0x10]
mov ecx, dword [esi - 8]
lea esi, [esi - 0x10]
mov dword [eax - 0x18], ecx
add ebx, 4
mov ecx, dword [esi + 0xc]
sub edi, 4
mov dword [esi + 8], edx
mov edx, dword [eax - 0x14]
mov dword [eax - 0x14], ecx
mov ecx, dword [esi + 0x10]
mov dword [esi + 0xc], edx
mov edx, dword [eax - 0x10]
mov dword [eax - 0x10], ecx
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x10], edx
mov edx, dword [eax - 0xc]
mov dword [eax - 0xc], ecx
mov dword [esi + 0x14], edx
cmp ebx, edi
jl 0x4026f4
mov ebx, dword [ebp + 8]
mov edi, 1
cmp dword [ebx + 0xf0], edi
jle 0x4028a7
lea esi, [ebx + 2]
jmp 0x402750
mov edx, dword [esi + 0xe]
lea esi, [esi + 0x10]
mov eax, edx
inc edi
shr eax, 0x18
movzx ecx, byte [eax*4 + 0x603120]
movzx eax, byte [esi - 1]
mov ecx, dword [ecx*4 + 0x602520]
movzx eax, byte [eax*4 + 0x603120]
xor ecx, dword [eax*4 + 0x601d20]
movzx eax, dl
mov edx, dword [esi + 2]
movzx eax, byte [eax*4 + 0x603120]
xor ecx, dword [eax*4 + 0x601920]
movzx eax, byte [esi]
movzx eax, byte [eax*4 + 0x603120]
xor ecx, dword [eax*4 + 0x602120]
mov eax, edx
shr eax, 0x18
mov dword [esi - 2], ecx
movzx ecx, byte [eax*4 + 0x603120]
movzx eax, byte [esi + 3]
mov ecx, dword [ecx*4 + 0x602520]
movzx eax, byte [eax*4 + 0x603120]
xor ecx, dword [eax*4 + 0x601d20]
movzx eax, byte [esi + 4]
movzx eax, byte [eax*4 + 0x603120]
xor ecx, dword [eax*4 + 0x602120]
movzx eax, dl
mov edx, dword [esi + 6]
movzx eax, byte [eax*4 + 0x603120]
xor ecx, dword [eax*4 + 0x601920]
mov eax, edx
shr eax, 0x18
mov dword [esi + 2], ecx
movzx ecx, byte [eax*4 + 0x603120]
movzx eax, byte [esi + 7]
mov ecx, dword [ecx*4 + 0x602520]
movzx eax, byte [eax*4 + 0x603120]
xor ecx, dword [eax*4 + 0x601d20]
movzx eax, byte [esi + 8]
movzx eax, byte [eax*4 + 0x603120]
xor ecx, dword [eax*4 + 0x602120]
movzx eax, dl
mov edx, dword [esi + 0xa]
movzx eax, byte [eax*4 + 0x603120]
xor ecx, dword [eax*4 + 0x601920]
mov eax, edx
shr eax, 0x18
mov dword [esi + 6], ecx
movzx ecx, byte [eax*4 + 0x603120]
movzx eax, byte [esi + 0xb]
mov ecx, dword [ecx*4 + 0x602520]
movzx eax, byte [eax*4 + 0x603120]
xor ecx, dword [eax*4 + 0x601d20]
movzx eax, byte [esi + 0xc]
movzx eax, byte [eax*4 + 0x603120]
xor ecx, dword [eax*4 + 0x602120]
movzx eax, dl
movzx eax, byte [eax*4 + 0x603120]
xor ecx, dword [eax*4 + 0x601920]
mov dword [esi + 0xa], ecx
cmp edi, dword [ebx + 0xf0]
jl 0x402750
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x403970
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b35ca
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x630490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.00599058
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x403a16
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], str.bad_locale_name
push eax
lea ecx, [ebp - 0x24]
call fcn.005775f6
push 0x62afb4
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.std::runtime_error.0
push eax
call fcn.0057ca35
push edi
push esi
call fcn.005992ee
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00577543
mov esp, ebp
pop ebp
ret 4

Function at 0x403fb0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b3658
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x630490]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
push dword [ebp + 0x10]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.004047b0
push dword [ebp + 0xc]
lea eax, [esp + 0x28]
push dword [ebp + 8]
push eax
call fcn.00403ee0
add esp, 0x24
mov dword [esp + 0x30], 0
cmp dword [eax + 0x14], 0x10
jb 0x404021
mov eax, dword [eax]
mov dword [esp + 8], eax
mov ecx, esi
lea eax, [esp + 8]
push eax
call fcn.005775f6
cmp dword [esp + 0x20], 0x10
mov dword [esi], vtable.std::runtime_error.0
jb 0x40404a
push dword [esp + 0xc]
call fcn.0044f658
add esp, 4
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, esi
mov dword [esi], vtable.std::_System_error.0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406000
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b3838
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x630490]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x630490]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea edx, [edi + 0x10]
lea ecx, [esp + 0x18]
call fcn.00425090
mov dword [esp + 0x40], 0
mov eax, dword [esp + 0x28]
add eax, 0xa
mov dword [edi], eax
add eax, 4
push eax
call fcn.0044f65d
mov esi, eax
mov dword [esp + 0x14], 0xe
mov eax, dword [edi]
sub esp, 0x14
mov ecx, esp
mov dword [esi], eax
movzx eax, byte [edi + 4]
mov byte [esi + 4], al
movzx eax, byte [edi + 5]
mov byte [esi + 5], al
mov eax, dword [edi + 8]
mov dword [esi + 6], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xa], eax
lea eax, [esp + 0x30]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004047b0
lea eax, [esp + 0x28]
mov ecx, esi
push eax
call fcn.00405f60
mov ecx, dword [edi]
add esp, 0x1c
add ecx, 4
mov dword [ebx], esi
cmp dword [esp + 0x2c], 0x10
mov dword [ebx + 4], ecx
jb 0x4060da
push dword [esp + 0x18]
call fcn.0044f658
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00577543
mov esp, ebp
pop ebp
ret 4

Function at 0x4071b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b3a08
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x630490]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.00599a21
mov esi, dword [ebp + 8]
lea ecx, [edi + 0x28]
mov dword [ebp - 4], 0
mov dword [edi], vtable.std::_LaunchPad_class_std::_Bind_1__void__void____cdecl__const__struct_AgentPack::CreateAgentAppLinkPack___struct_AgentPack::CreateAgentAppLinkPack__.0
push 0xffffffffffffffff
mov eax, dword [esi]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 4]
mov dword [edi + 0x14], eax
movzx eax, byte [esi + 8]
mov byte [edi + 0x18], al
movzx eax, byte [esi + 9]
mov byte [edi + 0x19], al
mov eax, dword [esi + 0xc]
mov dword [edi + 0x1c], eax
movzx eax, byte [esi + 0x10]
mov byte [edi + 0x20], al
mov eax, dword [esi + 0x14]
mov dword [edi + 0x24], eax
lea eax, [esi + 0x18]
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004047b0
mov ax, word [esi + 0x30]
mov word [edi + 0x40], ax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40bba0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b41bb
mov eax, dword fs:[0]
push eax
sub esp, 0x1a8
mov eax, dword [0x630490]
xor eax, esp
mov dword [esp + 0x1a0], eax
push ebx
push esi
push edi
mov eax, dword [0x630490]
xor eax, esp
push eax
lea eax, [esp + 0x1b8]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.004656d1
push 0
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call fcn.00469fef
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
je 0x40bca3
call fcn.0046664e
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x40bc22
push 0x80004005
call fcn.0040cef0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x18], esi
push 0x65
mov dword [esp + 0x1c4], 0
call fcn.004698f9
test eax, eax
je 0x40bc56
push 0x65
push eax
lea ecx, [esp + 0x20]
call fcn.0040c880
mov esi, dword [esp + 0x18]
cmp dword [esi - 0xc], 0
je 0x40bc7e
push 0
push 0
push 0x800
push dword [edi + 4]
mov edi, dword [sym.imp.USER32.dll_AppendMenuW]
call edi
mov eax, dword [esp + 0x14]
push esi
push 0x10
push 0
push dword [eax + 4]
call edi
add esi, 0xfffffff0
mov dword [esp + 0x1c0], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40bca3
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx + 0xbc]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0x80
push dword [ebx + 0x20]
call esi
push dword [ebx + 0xbc]
push 0
push 0x80
push dword [ebx + 0x20]
call esi
lea eax, [esp + 0x1c]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, ebx
call fcn.0040ba60
mov eax, 1
mov ecx, dword [esp + 0x1b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1a0]
xor ecx, esp
call fcn.00577543
mov esp, ebp
pop ebp
ret

Function at 0x40c510
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx eax, ax
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00464fe0

Function at 0x40c750
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40c765
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40c7a4
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40c7a0
lea ebx, [ebx]
cmp esi, edx
jae 0x40c7a4
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x40c790
cmp esi, edx
jb 0x40c7a9
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x40f5f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b467b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x630490]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea edx, [edi + 0x30]
mov byte [edi + 0x1c], 0
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
mov dword [ebp - 4], 0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp + 8], 0x2c
mov eax, dword [esi]
mov dword [edi], eax
movzx eax, byte [esi + 4]
mov byte [edi + 4], al
movzx eax, byte [esi + 5]
mov byte [edi + 5], al
movzx eax, word [esi + 6]
mov word [edi + 6], ax
movzx eax, word [esi + 8]
mov word [edi + 8], ax
movzx eax, word [esi + 0xa]
mov word [edi + 0xa], ax
movzx eax, word [esi + 0xc]
mov word [edi + 0xc], ax
movzx eax, word [esi + 0xe]
mov word [edi + 0xe], ax
movzx eax, word [esi + 0x10]
mov word [edi + 0x10], ax
movzx eax, word [esi + 0x12]
mov word [edi + 0x12], ax
movzx eax, word [esi + 0x14]
mov word [edi + 0x14], ax
movzx eax, word [esi + 0x16]
mov word [edi + 0x16], ax
movzx eax, word [esi + 0x18]
mov word [edi + 0x18], ax
movzx eax, word [esi + 0x1a]
mov word [edi + 0x1a], ax
movzx eax, byte [esi + 0x1c]
mov byte [edi + 0x1c], al
mov eax, dword [esi + 0x1d]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x21]
mov dword [edi + 0x24], eax
movzx eax, byte [esi + 0x25]
mov byte [edi + 0x28], al
movzx eax, byte [esi + 0x26]
mov byte [edi + 0x29], al
movzx eax, byte [esi + 0x27]
mov byte [edi + 0x2a], al
mov eax, dword [esi + 0x28]
push eax
mov dword [edi + 0x2c], eax
lea eax, [ebp + 8]
push edx
push eax
call fcn.004082b0
mov ecx, dword [ebp + 8]
add esp, 0xc
mov eax, dword [ecx + esi]
mov dword [edi + 0x48], eax
movzx eax, word [ecx + esi + 4]
mov word [edi + 0x4c], ax
movzx eax, byte [ecx + esi + 6]
mov byte [edi + 0x4e], al
mov eax, dword [ecx + esi + 7]
mov dword [edi + 0x50], eax
mov eax, dword [ecx + esi + 0xb]
mov dword [edi + 0x54], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4