joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b25d
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 0x40
push 0
push esi
call fcn.0040bc80
and dword [esi + 0x44], 0
and dword [esi + 0x40], 0
add esp, 0xc
mov dword [esi + 0x48], 0x67452301
mov dword [esi + 0x4c], 0xefcdab89
mov dword [esi + 0x50], 0x98badcfe
mov dword [esi + 0x54], 0x10325476
mov eax, esi
pop esi
ret

Function at 0x40b3d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp dword [esp + 0xc], ecx
not eax
jbe 0x40b405
push esi
mov edx, dword [esp + 0xc]
mov esi, eax
and esi, 0xff
movzx edx, byte [ecx + edx]
xor edx, esi
shr eax, 8
mov edx, dword [edx*4 + 0x41f830]
xor eax, edx
inc ecx
cmp ecx, dword [esp + 0x10]
jb 0x40b3df
pop esi
not eax
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4010d0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x406678
push eax
mov al, byte [0x409cc1]
mov dword fs:[0], esp
sub esp, 0x20
push ebx
mov ebx, 1
push esi
push edi
test bl, al
jne 0x40111a
mov dl, al
push 0x4012b0
or dl, bl
mov dword [0x409cc4], 0x4072b4
mov byte [0x409cc1], dl
call fcn.00401450
add esp, 4
call fcn.00406030
push 0
mov ecx, eax
call fcn.004060c0
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.00401670
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], 0
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [str.Readme_]
lea ecx, [esp + 0x10]
push eax
mov byte [esp + 0x38], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 2
push ecx
mov ecx, esi
call fcn.00404fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], bl
call fcn.00401412
mov edx, dword [str.Readme]
lea ecx, [esp + 0x10]
push edx
call sub.MFC42.DLL_CString::CString
mov eax, dword [esi]
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x3c], 3
call dword [eax + 0xc]
lea ecx, [esp + 0x10]
mov edi, eax
mov byte [esp + 0x34], bl
call fcn.00401412
cmp edi, 0xfffffc18
je 0x40127d
cmp edi, 0xfffffc19
je 0x40127d
mov eax, dword [str.Readme_]
lea ecx, [esp + 0xc]
push eax
call sub.MFC42.DLL_CString::operator
push 0x409064
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [str.Path]
mov byte [esp + 0x34], 4
push ecx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
mov edx, dword [esi]
lea eax, [esp + 0x14]
push ebx
push eax
lea ecx, [esp + 0x18]
lea eax, [esp + 0x20]
push ecx
push eax
mov ecx, esi
mov byte [esp + 0x44], 5
call dword [edx + 0x18]
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 6
call fcn.00401406
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 5
call fcn.00401412
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 4
call fcn.00401412
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], bl
call fcn.00401412
push 0x40805c
lea ecx, [esp + 0x10]
call fcn.00401400
mov ecx, dword [str.Readme.txt]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401400
mov edx, dword [esp + 0xc]
push ebx
push 0
push 0
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 0
call fcn.00401412
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xffffffff
call fcn.00401760
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x401910
Capabilities:
Get geographical location

Disassembly:
sub esp, 0xcc
push ebx
push ebp
push esi
lea eax, [esp + 0x44]
push edi
xor ebp, ebp
push eax
mov dword [esp + 0x14], ebp
mov dword [esp + 0x4c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x58], 1
jne 0x4019d3
cmp dword [esp + 0x50], ebp
jne 0x4019d3
lea ecx, [esp + 0x14]
push 0x32
push ecx
push 0x1001
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov eax, dword [0x4097f8]
mov edi, dword [sym.imp.MSVCRT.dll__mbscmp]
push 0x409064
push eax
call edi
add esp, 8
test eax, eax
je 0x4019a9
mov ebx, 0x4097f8
mov esi, ebx
mov ebx, dword [ebx]
lea edx, [esp + 0x14]
push edx
push ebx
call edi
add esp, 8
test eax, eax
je 0x4019b0
mov eax, dword [esi + 8]
add esi, 8
push 0x409064
push eax
inc ebp
mov ebx, esi
call edi
add esp, 8
test eax, eax
jne 0x401980
push 0x409064
jmp 0x4019ec
mov esi, dword [esp + 0xe0]
lea eax, [ebp*8 + 0x4097fc]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret
lea ecx, [esp + 0x14]
push 0x32
push ecx
push 0x59
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea edx, [esp + 0x14]
push edx
mov esi, dword [esp + 0xe4]
mov ecx, esi
call sub.MFC42.DLL_CString::CString
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret

Function at 0x401a10
Capabilities:
Get geographical location

Disassembly:
sub esp, 0xcc
push ebx
push ebp
push esi
lea eax, [esp + 0x44]
push edi
xor ebp, ebp
push eax
mov dword [esp + 0x14], ebp
mov dword [esp + 0x4c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x58], 1
jne 0x401ad0
cmp dword [esp + 0x50], ebp
jne 0x401ad0
lea ecx, [esp + 0x14]
push 0x32
push ecx
push 7
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov eax, dword [0x409080]
mov edi, dword [sym.imp.MSVCRT.dll__mbscmp]
push 0x409064
push eax
call edi
add esp, 8
test eax, eax
je 0x401aa6
mov ebx, 0x409080
mov esi, ebx
mov ebx, dword [ebx]
lea edx, [esp + 0x14]
push edx
push ebx
call edi
add esp, 8
test eax, eax
je 0x401aad
mov eax, dword [esi + 8]
add esi, 8
push 0x409064
push eax
inc ebp
mov ebx, esi
call edi
add esp, 8
test eax, eax
jne 0x401a7d
push 0x409064
jmp 0x401ae9
mov esi, dword [esp + 0xe0]
lea eax, [ebp*8 + 0x409084]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret
lea ecx, [esp + 0x14]
push 0x32
push ecx
push 0x5a
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea edx, [esp + 0x14]
push edx
mov esi, dword [esp + 0xe4]
mov ecx, esi
call sub.MFC42.DLL_CString::CString
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret
Function at 0x403d98
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00403d98
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x9c], eax
mov ebx, dword [ebp - 0x9c]
call fcn.00478657
mov eax, 1
call fcn.00478891
call fcn.00476e7a
lea ebx, [ebp - 0xa8]
call fcn.004779f9
mov edx, dword [ebp - 0xa8]
call fcn.00478805
call fcn.004787ea
mov si, ax
jmp 0x403e4b
mov edx, dword [ebp - 0xa8]
call fcn.00478805
mov ecx, 1
movsx eax, si
call fcn.004700ad
mov eax, 1
call fcn.00470111
mov edx, 0x47f3bc
call fcn.0047881c
call fcn.00477d52
jne 0x403e48
jmp 0x403e51
dec si
cmp si, 1
jge 0x403e10
mov edx, dword [ebp - 0xa8]
call fcn.00478805
mov eax, 1
movsx ecx, si
add eax, ecx
mov ecx, eax
mov eax, 0x7fffffff
call fcn.004700ad
lea ebx, [ebp - 0xa0]
call fcn.004779f9
mov edx, dword [ebp - 0xa8]
call fcn.00478805
mov ecx, 1
movsx eax, si
call fcn.004700ad
mov edx, dword [ebp - 0xa0]
call fcn.00478805
call fcn.00477cbd
lea ebx, [ebp - 0x98]
call fcn.004779f9
call fcn.004786f6
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4041fc
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.004041fc
xor esi, esi
xor edi, edi
mov ecx, 0x209
push esi
dec ecx
jne 0x404218
push 0
push 0
push 0
push 0
mov edx, 0x47f1ec
call fcn.0047881c
lea ebx, [esp + 0xc]
call fcn.00477abb
mov edx, 0x47f1ec
call fcn.0047881c
lea ebx, [esp + 0xc]
call fcn.00477abb
push 1
mov edx, 0x47f1ec
call fcn.0047881c
lea ebx, [esp + 0x10]
call fcn.00477abb
call dword [sym.imp.WININET.DLL_InternetOpenA]
push eax
mov ebx, esp
mov eax, dword [ebx + 0xc]
call fcn.00474673
mov eax, dword [ebx + 8]
call fcn.00474673
mov eax, dword [ebx + 4]
call fcn.00474673
pop eax
add esp, 0xc
fldcw word [ebp - 0x10]
mov esi, eax
push 0
push 0
push 0x80000000
push 0
mov edx, 0x47f1ec
call fcn.0047881c
lea ebx, [esp + 0xc]
call fcn.00477abb
lea ebx, [ebp + 8]
call fcn.00478911
push ebx
mov eax, esi
push eax
call dword [sym.imp.WININET.DLL_InternetOpenUrlA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00474673
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov edi, eax
cmp edi, 0
je 0x4043a4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, 0x47f1ec
call fcn.0047881c
lea ebx, [ebp - 0x8a4]
mov ecx, 0x800
call fcn.00478606
lea ebx, [ebp - 0xa4]
push ebx
lea ebx, [ebp - 0x8a4]
mov ecx, 0x800
call fcn.004785df
call fcn.004787ea
push eax
lea ebx, [ebp - 0x8a4]
push ebx
mov eax, edi
push eax
call dword [sym.imp.WININET.DLL_InternetReadFile]
fldcw word [ebp - 0x10]
mov eax, 1
call fcn.00473a1b
cmp dword [ebp - 0xa4], 0
jne 0x404342
jmp 0x404382
mov edx, dword [ebp - 0x8a8]
call fcn.00478805
lea ebx, [ebp - 0x8a4]
mov ecx, 0x800
call fcn.004785df
mov ecx, 1
mov eax, dword [ebp - 0xa4]
call fcn.004700ad
call fcn.00477cbd
lea ebx, [ebp - 0x8a8]
call fcn.004779f9
jmp 0x4042e0
mov edx, dword [ebp - 0x8a8]
call fcn.00478805
lea ebx, [ebp - 0x98]
call fcn.004779f9
mov eax, edi
push eax
call dword [sym.imp.WININET.DLL_InternetCloseHandle]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.WININET.DLL_InternetCloseHandle]
fldcw word [ebp - 0x10]
call fcn.004786f6
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x404f44
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00404f44
xor esi, esi
xor edi, edi
mov ecx, 0x108
push esi
dec ecx
jne 0x404f60
fild dword [0x4875b4]
mov eax, dword [ebp + 8]
call fcn.004779cb
fcompp
fnstsw ax
sahf
jne 0x404f87
fild qword [0x487398]
call fcn.004779f2
mov dword [ebp + 8], eax
mov edx, dword [ebp + 0x14]
call fcn.00478805
lea ebx, [ebp - 0x49c]
mov ecx, 0x400
call fcn.004786a0
push 0
push 0
lea ebx, [ebp - 0x9c]
mov dword [ebx], esi
push ebx
push 0x20019
push 0
mov edx, dword [ebp + 0xc]
call fcn.00478805
mov edx, 0x47f3bc
call fcn.0047881c
call fcn.00476506
mov edx, 0x47f3bc
call fcn.0047881c
call fcn.00476574
lea ebx, [esp + 0xc]
call fcn.00477abb
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00474673
pop eax
add esp, 4
mov esi, dword [ebp - 0x9c]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x405079
mov edi, 1
mov eax, 0x400
mov dword [ebp - 0x4a4], eax
push 0
lea ebx, [ebp - 0x4a4]
push ebx
lea ebx, [ebp - 0x49c]
push ebx
lea ebx, [ebp - 0x4a0]
mov dword [ebx], edi
push ebx
push 0
mov edx, dword [ebp + 0x10]
call fcn.00478805
lea ebx, [esp + 0x10]
call fcn.00477abb
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00474673
pop eax
add esp, 4
mov edi, dword [ebp - 0x4a0]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
lea ebx, [ebp - 0x49c]
call fcn.00478657
lea ebx, [ebp - 0x98]
call fcn.004779f9
call fcn.004786f6
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x4050bd
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.004050bd
xor esi, esi
xor edi, edi
mov ecx, 0x208
push esi
dec ecx
jne 0x4050d9
mov edx, dword [ebp + 0x14]
call fcn.00478805
lea ebx, [ebp - 0x89c]
mov ecx, 0x400
call fcn.004786a0
mov edx, dword [ebp + 0x10]
call fcn.00478805
lea ebx, [ebp - 0x49c]
mov ecx, 0x400
call fcn.004786a0
fild dword [0x4875b4]
mov eax, dword [ebp + 8]
call fcn.004779cb
fcompp
fnstsw ax
sahf
jne 0x405130
fild qword [0x487398]
call fcn.004779f2
mov dword [ebp + 8], eax
push 0
push 0
push 0
push 0
lea ebx, [ebp - 0x9c]
mov dword [ebx], esi
push ebx
push 0
push 0x20006
push 0
mov edx, 0x47f3cc
call fcn.0047881c
lea ebx, [esp + 0x18]
call fcn.00477abb
push 0
mov edx, dword [ebp + 0xc]
call fcn.00478805
mov edx, 0x47f3bc
call fcn.0047881c
call fcn.00476506
mov edx, 0x47f3bc
call fcn.0047881c
call fcn.00476574
lea ebx, [esp + 0x1c]
call fcn.00477abb
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.00474673
mov eax, dword [ebx + 4]
call fcn.00474673
pop eax
add esp, 8
mov esi, dword [ebp - 0x9c]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x405224
lea ebx, [ebp - 0x89c]
call fcn.00478657
call fcn.004787ea
mov dword [ebp - 0x8a4], eax
mov edi, 1
push 0
push dword [ebp - 0x8a4]
lea ebx, [ebp - 0x89c]
push ebx
mov eax, edi
push eax
push 0
lea ebx, [ebp - 0x49c]
push ebx
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x405218
mov dword [ebp - 0x98], 1
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
call fcn.004786f6
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x40538b
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0040538b
xor esi, esi
xor edi, edi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea ebx, [ebp - 0xa8]
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_GetWindowThreadProcessId]
fldcw word [ebp - 0x10]
push dword [ebp - 0xa8]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
fldcw word [ebp - 0x10]
mov esi, eax
push 4
push 0x1000
push 0x1000
push 0
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
fldcw word [ebp - 0x10]
mov dword [ebp - 0xac], eax
lea ebx, [ebp - 0xa4]
push ebx
push 0x1000
mov ebx, dword [ebp + 0xc]
push ebx
push dword [ebp - 0xac]
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
fldcw word [ebp - 0x10]
mov ebx, dword [ebp + 0x14]
mov eax, ebx
test eax, eax
je 0x405469
push 4
push 0x1000
mov ebx, dword [ebp + 0x14]
push dword [ebx]
push 0
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
fldcw word [ebp - 0x10]
mov dword [ebp - 0xb0], eax
lea ebx, [ebp - 0xa4]
push ebx
mov ebx, dword [ebp + 0x14]
push dword [ebx]
mov ebx, dword [ebp + 0x10]
push ebx
push dword [ebp - 0xb0]
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
fldcw word [ebp - 0x10]
lea ebx, [ebp - 0xa4]
push ebx
push 0
push dword [ebp - 0xb0]
push dword [ebp - 0xac]
push 0
push 0
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_CreateRemoteThread]
fldcw word [ebp - 0x10]
mov edi, eax
fild qword [0x487314]
call fcn.004779f2
push eax
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
fldcw word [ebp - 0x10]
push 0x8000
push 0
push dword [ebp - 0xac]
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualFreeEx]
fldcw word [ebp - 0x10]
mov ebx, dword [ebp + 0x14]
mov eax, ebx
test eax, eax
je 0x4054e7
push 0x8000
push 0
push dword [ebp - 0xb0]
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualFreeEx]
fldcw word [ebp - 0x10]
mov eax, edi
push eax
call dword [sym.imp.KERNEL32_CloseHandle]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.KERNEL32_CloseHandle]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x406d7a
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push sym..exe_WRITESCREENFUNC
xor esi, esi
xor edi, edi
mov ecx, 0x12b
push esi
dec ecx
jne 0x406d96
push 0
push 0
push 1
push 0x1000008
push 0
lea ebx, [ebp - 0x530]
call fcn.0046e4aa
mov dword [ebp - 0x494], 0
mov dword [ebp - 0x490], 0
mov dword [ebp - 0x48c], 0
mov dword [ebp - 0x488], 0x10
mov eax, dword [ebp + 8]
test eax, eax
je 0x406fa6
lea ebx, [ebp - 0x530]
push ebx
push 0
mov ebx, dword [ebp + 0xc]
call fcn.00478657
mov edx, 0x47f3cc
call fcn.0047881c
call fcn.00477cbd
lea ebx, [esp]
push ebx
call fcn.004779f9
call fcn.00406b2a
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00474673
pop eax
add esp, 4
call fcn.00478833
push 0
mov ebx, esp
call fcn.004779f9
call fcn.004069fb
lea ebx, [ebp - 0x4b4]
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_GetWindowThreadProcessId]
fldcw word [ebp - 0x10]
push dword [ebp - 0x4b4]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x4b8], eax
push 0x40
push 0x1000
push 0x1c
push 0
push dword [ebp - 0x4b8]
call dword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
fldcw word [ebp - 0x10]
mov esi, eax
push 0x40
push 0x1000
mov eax, 1
mov ecx, 1
lea ebx, [ebp - 0x530]
xchg ecx, eax
call fcn.0047003f
add eax, ecx
push eax
push 0
push dword [ebp - 0x4b8]
call dword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
fldcw word [ebp - 0x10]
mov edi, eax
lea ebx, [ebp - 0x4bc]
push ebx
push 0x1c
lea ebx, [ebp - 0x4a0]
push ebx
mov eax, esi
push eax
push dword [ebp - 0x4b8]
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
fldcw word [ebp - 0x10]
lea ebx, [ebp - 0x4bc]
push ebx
mov eax, 1
mov ecx, 1
lea ebx, [ebp - 0x530]
xchg ecx, eax
call fcn.0047003f
add eax, ecx
push eax
xor eax, eax
sub eax, dword [ebp - 0x518]
add eax, dword [ebp - 0x530]
mov ebx, eax
push ebx
mov eax, edi
push eax
push dword [ebp - 0x4b8]
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x4a8], esi
mov dword [ebp - 0x4a4], edi
push 0
mov eax, 8
lea ebx, [esp]
push ebx
mov dword [ebx], eax
lea ebx, [ebp - 0x4a8]
push ebx
mov eax, 0x407254
push eax
push dword [ebp + 8]
call fcn.0040538b
add esp, 4
push 0x8000
push 0
mov eax, esi
push eax
push dword [ebp - 0x4b8]
call dword [sym.imp.KERNEL32.DLL_VirtualFreeEx]
fldcw word [ebp - 0x10]
push 0x8000
push 0
mov eax, edi
push eax
push dword [ebp - 0x4b8]
call dword [sym.imp.KERNEL32.DLL_VirtualFreeEx]
fldcw word [ebp - 0x10]
push dword [ebp - 0x4b8]
call dword [sym.imp.KERNEL32_CloseHandle]
fldcw word [ebp - 0x10]
lea ebx, [ebp - 0x530]
mov eax, 8
call fcn.0046e774
mov dword [ebp - 0x98], 1
call fcn.004786f6
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4078a6
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.004078a6
xor esi, esi
push esi
push esi
push esi
push esi
cmp dword [0x47c798], 0
jne 0x40790f
mov dword [0x47c798], 1
mov ebx, 0x47c78c
push ebx
push dword [0x47c79c]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeThread]
fldcw word [ebp - 0x10]
push dword [0x47c78c]
push dword [0x47c79c]
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
fldcw word [ebp - 0x10]
push dword [0x47c79c]
call dword [sym.imp.KERNEL32_CloseHandle]
fldcw word [ebp - 0x10]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407c8b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00407c8b
xor esi, esi
push esi
push esi
push esi
push esi
push esi
mov eax, 0x1d
mov edx, dword [0x47c7f8]
call fcn.00478805
mov dword [ebp - 0x30], eax
call fcn.004787ea
cmp eax, dword [ebp - 0x30]
jl 0x407d13
mov ebx, 0x1d
mov edx, 0x47f218
call fcn.0047881c
call fcn.0047395d
lea ebx, [ebp - 0x98]
call fcn.004779f9
mov edx, 0x47f454
call fcn.0047881c
mov eax, 0x12000
mov edx, 0x47f2c4
call fcn.0047881c
call fcn.0046e9da
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov edx, dword [0x47c7f8]
call fcn.00478805
push 0
mov ebx, esp
call fcn.004779f9
call fcn.0040a4db
call fcn.00478833
mov ebx, 0x38
mov edx, 0x47f218
call fcn.0047881c
call fcn.0047395d
call fcn.00477cbd
mov ecx, 1
mov eax, 0x38
call fcn.004700ad
lea ebx, [ebp - 0x98]
call fcn.004779f9
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40a148
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0040a148
xor esi, esi
push esi
push esi
push esi
push esi
push 0
call fcn.0040a099
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x40a388
push 0
push 0xffffffffffffffff
mov edx, 0x47f5cc
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.0040e6de
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x40a323
push 0
push 0xffffffffffffffff
mov edx, 0x47f5dc
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.0040e6de
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x40a306
push 0
push 0xffffffffffffffff
mov edx, 0x47f5ec
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.0040e6de
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x40a2e9
push 0
push 0xffffffffffffffff
mov edx, 0x47f5fc
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.0040e6de
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x40a2cc
push 0
push 0xffffffffffffffff
mov edx, 0x47f60c
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.0040e6de
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x40a2af
push 0
push 0xffffffffffffffff
mov edx, 0x47f61c
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.0040e6de
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x40a292
mov edx, 0x47f62c
call fcn.0047881c
mov eax, 0x12000
mov edx, 0x47f2c4
call fcn.0047881c
call fcn.0046e9da
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov edx, 0x47f61c
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.00409ba4
jmp 0x40a2c7
mov edx, 0x47f60c
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.00409ba4
jmp 0x40a2e4
mov edx, 0x47f5fc
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.00409ba4
jmp 0x40a301
mov edx, 0x47f5ec
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.00409ba4
jmp 0x40a31e
mov edx, 0x47f5dc
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.00409ba4
jmp 0x40a33b
mov edx, 0x47f5cc
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.00409ba4
nop
nop
nop
nop
nop
push 0
mov edx, 0x47f648
call fcn.0047881c
lea ebx, [esp]
call fcn.00477abb
push dword [0x47c734]
call sym..exe_SendPacket
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00474673
pop eax
add esp, 4
mov eax, 0x64
call fcn.00473a9b
push 1
call fcn.0040a099
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x40a340
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret