joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c020
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
cmp byte [esi], 0
je 0x40c065
cmp byte [esi + 1], 0
je 0x40c06d
mov eax, dword [esi + 4]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp byte [esi], 0
push ebp
je 0x40c082
cmp byte [esi + 1], 0
je 0x40c074
mov eax, dword [esi + 4]
push 1
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
sub eax, dword [esi + 0xc]
mov ebp, eax
mov dword [esp + 4], ebp
jmp 0x40c08b
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x1c], ecx
jmp 0x40c03e
or eax, 0xffffffff
add esp, 0x18
ret
mov dword [esp + 4], 0
mov ebp, dword [esp + 4]
jmp 0x40c08b
mov edx, dword [esi + 0x1c]
mov dword [esp + 4], edx
mov ebp, edx
push edi
mov edi, 0xffff
mov dword [esp + 0xc], edi
cmp ebp, edi
jae 0x40c09f
mov dword [esp + 0xc], ebp
mov edi, ebp
push ebx
push 0x404
call fcn.00487b6e
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x40c0bd
pop ebx
pop edi
or eax, 0xffffffff
pop ebp
add esp, 0x18
ret
mov eax, 4
mov dword [esp + 0x18], 0xffffffff
cmp edi, eax
jbe 0x40c1d1
jmp 0x40c0e0
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0xc]
add eax, 0x400
mov dword [esp + 0x14], edi
cmp eax, edi
ja 0x40c0f1
mov dword [esp + 0x14], eax
mov eax, ebp
sub eax, dword [esp + 0x14]
sub ebp, eax
mov dword [esp + 0x20], eax
cmp ebp, 0x404
jbe 0x40c10a
mov ebp, 0x404
cmp byte [esi], 0
je 0x40c12f
cmp byte [esi + 1], 0
je 0x40c1d1
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push 0
push 0
add ecx, eax
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
jmp 0x40c132
mov dword [esi + 0x1c], eax
cmp byte [esi], 0
mov edi, ebp
je 0x40c15a
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x20]
push eax
push ebp
push ebx
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x40c154
mov byte [esi + 8], 1
mov eax, dword [esp + 0x1c]
jmp 0x40c180
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea edx, [eax + ebp]
cmp edx, ecx
jbe 0x40c16b
sub ecx, eax
mov edi, ecx
mov ecx, dword [esi + 0x14]
push edi
add ecx, eax
push ecx
push ebx
call fcn.00488930
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div ebp
cmp eax, 1
jne 0x40c1d1
lea eax, [ebp - 3]
test eax, eax
jl 0x40c1bc
dec eax
cmp byte [eax + ebx], 0x50
jne 0x40c1ac
cmp byte [eax + ebx + 1], 0x4b
jne 0x40c1ac
cmp byte [eax + ebx + 2], 5
jne 0x40c1ac
cmp byte [eax + ebx + 3], 6
je 0x40c1b2
test eax, eax
jge 0x40c190
jmp 0x40c1bc
mov edx, dword [esp + 0x20]
add eax, edx
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0
jne 0x40c1d1
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x14], eax
jb 0x40c0d4
push ebx
call fcn.00487a91
mov eax, dword [esp + 0x1c]
add esp, 4
pop ebx
pop edi
pop ebp
add esp, 0x18
ret
Function at 0x40cc30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x40cc4e
pop edi
pop ebp
mov eax, 0xffffff9a
pop ebx
add esp, 0xc
ret
cmp dword [edi + 0x18], ebx
je 0x40cc42
cmp dword [edi + 0x7c], ebx
je 0x40cc5d
call fcn.0040d020
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.0040c9a0
add esp, 0xc
test eax, eax
je 0x40cc84
pop edi
pop ebp
mov eax, 0xffffff99
pop ebx
add esp, 0xc
ret
push esi
push 0x84
call fcn.00487b6e
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x40ccc5
push 0x4000
call fcn.00487b6e
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add esp, 4
mov dword [esi], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
cmp eax, ebx
jne 0x40ccd2
push esi
call fcn.00487a91
add esp, 4
pop esi
pop edi
pop ebp
mov eax, 0xffffff98
pop ebx
add esp, 0xc
ret
mov dword [esi + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
cmp eax, ebx
jne 0x40cd1a
lea eax, [esi + 4]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.0040b8a0
test eax, eax
jne 0x40cd1a
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x5c], ecx
mov dl, byte [edi + 0x30]
and dl, 1
mov byte [esi + 0x6c], dl
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x40cd44
mov cl, byte [edi + 0x39]
mov byte [esi + 0x80], cl
jmp 0x40cd4d
mov dl, byte [edi + 0x3f]
mov byte [esi + 0x80], dl
movzx eax, byte [esi + 0x6c]
neg eax
sbb eax, eax
and eax, 0xc
lea edx, [esi + 0x70]
mov dword [esi + 0x7c], eax
mov dword [edx], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
cmp ebp, ebx
je 0x40cd87
mov cl, byte [ebp]
cmp cl, bl
je 0x40cd87
call fcn.0040b590
add ebp, 1
jne 0x40cd76
mov ecx, dword [edi + 0x78]
mov edx, dword [esp + 0x18]
lea eax, [ecx + edx + 0x1e]
mov dword [esi + 0x3c], eax
mov dword [esi + 8], ebx
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x40d110
Capabilities:
Get common file path

Disassembly:
cmp dword [esi], 0
push ebp
mov ebp, dword [esp + 0xc]
jne 0x40d1d3
cmp dword [esi + 4], 0xffffffff
jne 0x40d1d3
push edi
lea edi, [esi + 0x244]
push edi
push 0x103
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
mov eax, edi
lea edx, [eax + 2]
pop edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d141
sub eax, edx
sar eax, 1
movzx ecx, word [esi + eax*2 + 0x242]
cmp cx, 0x5c
je 0x40d17b
cmp cx, 0x2f
je 0x40d17b
mov ecx, 0x2f
xor edx, edx
mov word [esi + eax*2 + 0x244], cx
mov word [esi + eax*2 + 0x246], dx
cmp ebp, 1
jne 0x40d19a
push ebp
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp eax, 0xffffffff
jne 0x40d19a
mov eax, 0x2000000
pop ebp
ret 8
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push ebp
push ecx
push ebx
call fcn.0040bcf0
add esp, 0x10
test eax, eax
jne 0x40d1ba
mov eax, dword [esp + 0xc]
pop ebp
ret 8
call fcn.0040c1f0
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
add eax, 0x200
pop ebp
ret 8
mov eax, 0x1000000
pop ebp
ret 8
Function at 0x40d940
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x414
mov eax, dword [0x4cdbb4]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
mov ebx, dword [esp + 0x41c]
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
push edi
mov edi, dword [esp + 0x428]
test ebx, ebx
je 0x40d9df
push 0x104
push ebx
lea eax, [esp + 0x21c]
push 0x104
push eax
call fcn.0048810c
lea eax, [esp + 0x224]
add esp, 0x10
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d994
sub eax, edx
sar eax, 1
je 0x40d9c0
lea ecx, [esp + eax*2 + 0x212]
movzx eax, word [ecx]
cmp ax, 0x2f
je 0x40d9bb
cmp ax, 0x5c
jne 0x40d9c0
xor edx, edx
mov word [ecx], dx
lea eax, [esp + 0x214]
push eax
call ebp
cmp eax, 0xffffffff
jne 0x40d9df
push 0
lea ecx, [esp + 0x218]
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
movzx eax, word [edi]
test ax, ax
je 0x40dac9
mov ecx, edi
mov edx, edi
movzx eax, ax
cmp ax, 0x2f
je 0x40d9fe
cmp ax, 0x5c
jne 0x40da00
mov ecx, edx
movzx eax, word [edx + 2]
add edx, 2
test ax, ax
jne 0x40d9f2
cmp ecx, edi
je 0x40da44
sub ecx, edi
sar ecx, 1
push esi
add ecx, ecx
mov esi, ecx
push esi
lea edx, [esp + 0x21c]
push edi
push edx
call fcn.00488930
lea ecx, [esp + 0x224]
push ecx
xor eax, eax
push ebx
mov word [esp + esi + 0x22c], ax
call fcn.0040d940
add esp, 0x14
pop esi
xor edx, edx
mov word [esp + 0xc], dx
test ebx, ebx
je 0x40da67
push 0x104
push ebx
lea eax, [esp + 0x14]
push 0x104
push eax
call fcn.0048810c
add esp, 0x10
xor ecx, ecx
lea eax, [esp + 0xc]
mov word [esp + 0x212], cx
lea edx, [eax + 2]
jmp 0x40da80
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40da80
sub eax, edx
sar eax, 1
mov ecx, 0x104
sub ecx, eax
push ecx
push edi
push ecx
lea edx, [esp + eax*2 + 0x18]
push edx
call fcn.0048810c
add esp, 0x10
lea ecx, [esp + 0xc]
xor eax, eax
push ecx
mov word [esp + 0x216], ax
call ebp
cmp eax, 0xffffffff
jne 0x40dac9
push 0
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
mov ecx, dword [esp + 0x41c]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.004874cc
add esp, 0x414
ret
Function at 0x40e6d0
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
push ebp
push esi
push edi
mov dword [eax], vtable.CRC32.0
xor ebx, ebx
lea esi, [eax + 4]
nop
xor ecx, ecx
test bl, 1
je 0x40e6ec
mov ecx, 0x80
mov edx, ebx
shr edx, 1
test dl, 1
je 0x40e6f8
or ecx, 0x40
shr edx, 1
test dl, 1
je 0x40e702
or ecx, 0x20
shr edx, 1
test dl, 1
je 0x40e70c
or ecx, 0x10
shr edx, 1
test dl, 1
je 0x40e716
or ecx, 8
shr edx, 1
test dl, 1
je 0x40e720
or ecx, 4
shr edx, 1
test dl, 1
je 0x40e72a
or ecx, 2
test dl, 2
je 0x40e732
or ecx, 1
shl ecx, 0x18
mov edx, ecx
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
add edx, edx
and ecx, 0x4c11db7
xor ecx, edx
mov edx, ecx
and edx, 0x80000000
neg edx
sbb edx, edx
add ecx, ecx
and edx, 0x4c11db7
xor edx, ecx
mov ecx, edx
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
add edx, edx
and ecx, 0x4c11db7
xor ecx, edx
mov edx, ecx
and edx, 0x80000000
neg edx
sbb edx, edx
add ecx, ecx
and edx, 0x4c11db7
xor edx, ecx
mov ecx, edx
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
add edx, edx
and ecx, 0x4c11db7
xor ecx, edx
mov edx, ecx
and edx, 0x80000000
neg edx
sbb edx, edx
add ecx, ecx
and edx, 0x4c11db7
xor edx, ecx
mov ecx, edx
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
add edx, edx
and ecx, 0x4c11db7
xor ecx, edx
mov edx, ecx
and edx, 0x80000000
neg edx
sbb edx, edx
add ecx, ecx
and edx, 0x4c11db7
xor edx, ecx
xor edi, edi
mov dword [esi], edx
lea ecx, [edi + 0x1f]
lea esp, [esp]
test dl, 1
je 0x40e7fe
mov ebp, 1
shl ebp, cl
or edi, ebp
dec ecx
shr edx, 1
cmp ecx, 0xffffffff
jg 0x40e7f0
mov dword [esi], edi
inc ebx
add esi, 4
cmp ebx, 0xff
jle 0x40e6e0
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4139c0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4a6b78
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4cdbb4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [ecx]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jne 0x413a02
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
add eax, 0xfffffff0
push eax
call fcn.00403ce0
lea esi, [eax + 0x10]
mov dword [esp + 0x10], esi
push 0x4ac928
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x2c], 0
call fcn.00413780
mov eax, dword [eax]
add esp, 0x10
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x413a5c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413a80
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x4161b0
Capabilities:
Create thread

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push esi
push 0
push 0
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x24]
push 1
push 0
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
push 0
push 0
lea edx, [esp + 0xc]
push edx
push 0x415eb0
push 0
push 0
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
call esi
mov eax, dword [esp + 0x10]
push 0x2710
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov ecx, dword [esp + 0x10]
push ecx
call esi
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
pop esi
test ecx, ecx
jg 0x416233
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esp, 0x10
ret 8
Function at 0x417300
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
add eax, eax
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x10]
push esi
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 0
mov dword [edi], 0
mov eax, dword [ecx]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x417376
mov eax, dword [esp + 0x10]
cmp eax, 1
je 0x417345
cmp eax, 2
jne 0x417361
mov eax, dword [esp + 0x14]
test esi, esi
je 0x417370
test eax, eax
je 0x41736b
test al, 1
jne 0x417361
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x417370
pop edi
mov eax, 0xd
pop esi
ret 0xc
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
ret 0xc

Function at 0x417380
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov ecx, dword [esp + 0x114]
mov eax, dword [esp + 0x110]
imul ecx, ecx, 0x3e8
lea edx, [esp]
push edx
push 0
mov dword [esp + 0x14], eax
push 0
lea eax, [esp + 0x14]
push eax
push 1
mov dword [esp + 0x1c], 1
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], ecx
call dword [sym.imp.WS2_32.dll_select]
add esp, 0x10c
ret

Function at 0x4173d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x14c
mov eax, dword [0x4cdbb4]
xor eax, esp
mov dword [esp + 0x148], eax
mov eax, dword [esp + 0x154]
push esi
mov esi, dword [esp + 0x15c]
lea ecx, [esp + 4]
push ecx
push eax
mov eax, dword [esp + 0x15c]
push 0
push 0x144
lea edx, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.WS2_32.dll_recvfrom]
mov cl, byte [esp + 0x10]
mov eax, dword [esp + 0x28]
mov byte [esi], cl
mov ecx, dword [esp + 0x14c]
pop esi
xor ecx, esp
call fcn.004874cc
add esp, 0x14c
ret

Function at 0x4183d0
Capabilities:
Send data
Send data on socket

Disassembly:
xor eax, eax
mov word [0x4cf556], ax
mov eax, dword [0x4cb090]
mov word [0x4cf558], ax
inc eax
mov dword [0x4cb090], eax
mov eax, dword [0x4cb08c]
mov word [0x4cf55a], ax
inc eax
mov dword [0x4cb08c], eax
mov byte [0x4cf554], 8
mov byte [0x4cf555], 0
xor eax, eax
lea ebx, [ebx]
mov cl, al
add cl, 0x20
mov byte [eax + 0x4cf564], cl
inc eax
cmp eax, 0x20
jl 0x418410
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [0x4cf560], eax
xor eax, eax
mov ecx, 0x4cf554
lea edx, [eax + 0x18]
push esi
movzx esi, word [ecx]
add eax, esi
add ecx, 2
sub edx, 1
jne 0x418437
mov ecx, eax
sar ecx, 0x10
and eax, 0xffff
add ecx, eax
mov eax, dword [esp + 0xc]
push 0x10
push eax
mov edx, ecx
push 0
sar edx, 0x10
push 0x30
add edx, ecx
mov ecx, dword [esp + 0x18]
push 0x4cf554
not edx
push ecx
mov word [0x4cf556], dx
call dword [sym.imp.WS2_32.dll_sendto]
pop esi
ret
Function at 0x4196d0
Capabilities:
Create raw socket
Resolve dns

Disassembly:
sub esp, 0x28
mov eax, dword [0x4cdbb4]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
push edi
mov edi, dword [esp + 0x34]
push 1
push 3
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x419709
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x41971d
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004874cc
add esp, 0x28
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [esp + 0x10], edx
lea edx, [esp + 0xc]
push edx
mov eax, 2
xor ecx, ecx
push esi
mov word [esp + 0x14], ax
mov word [esp + 0x16], cx
call fcn.004183d0
mov eax, dword [esp + 0x40]
push eax
push esi
call fcn.00417380
add esp, 0x10
cmp eax, 0xffffffff
je 0x419702
test eax, eax
je 0x419702
push ebx
lea ecx, [esp + 0xf]
push ecx
lea edx, [esp + 0x24]
push edx
push esi
call fcn.004173d0
add esp, 0xc
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov edi, eax
push esi
sub edi, ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [esp + 0x30]
pop ebx
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.004874cc
add esp, 0x28
ret

Function at 0x41a720
Capabilities:
Create thread

Disassembly:
sub esp, 0x3bc
mov eax, dword [0x4cdbb4]
xor eax, esp
mov dword [esp + 0x3b8], eax
push esi
mov esi, dword [esp + 0x3d0]
push edi
push 0x3b4
lea eax, [esp + 0x10]
push 0
push eax
mov edi, ecx
call fcn.00487ce0
mov ecx, dword [edi + 4]
mov eax, dword [esp + 0x3d4]
mov edx, dword [esp + 0x3dc]
push eax
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x138]
push 0x100
push ecx
mov dword [esp + 0x20], 0x3b8
mov dword [esp + 0x28], 0x80
mov dword [esp + 0x2c], 0x10
mov dword [esp + 0x3c4], edx
call fcn.00487c38
mov edx, dword [esp + 0x3e4]
push edx
lea eax, [esp + 0x348]
push 0x40
push eax
call fcn.00487c38
add esp, 0x24
lea ecx, [esp + 8]
push ecx
push 1
mov dword [esp + 0x330], esi
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
push 0
push 0
push esi
push 0x418810
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x3c8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
pop edi
pop esi
test ecx, ecx
jg 0x41a805
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x3c4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41a828
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x3b8]
xor ecx, esp
call fcn.004874cc
add esp, 0x3bc
ret 0x10
Function at 0x41e040
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x134
mov eax, dword [0x4cdbb4]
xor eax, esp
mov dword [esp + 0x130], eax
movzx eax, word [esp + 0x138]
push ebp
push esi
mov esi, dword [0x4cf65c]
push edi
push pe_nt_image_headers32
push eax
mov edi, 1
push esi
mov ebp, ecx
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
test eax, eax
je 0x41e1cc
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x41e1cc
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov esi, eax
test esi, esi
je 0x41e1cc
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
jmp 0x41e0b4
mov edi, dword [esp + 0x10]
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x41e1c8
add esi, 2
mov edx, dword [esi + 2]
movzx edi, ax
movzx eax, word [esi]
add esi, 2
mov ecx, 0x403
add esi, 4
mov dword [esp + 0x14], edx
cmp cx, ax
jne 0x41e130
push 3
lea edx, [esp + 0x44]
push esi
lea ecx, [esp + 0x44]
mov dword [esp + 0x44], edx
call fcn.0041cfa0
mov eax, dword [esp + 0x3c]
mov edx, dword [ebp + 4]
push eax
push 0
movzx ecx, di
push 0x143
push ecx
push edx
call ebx
cmp eax, 0xffffffff
jne 0x41e119
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x40]
cmp eax, ecx
je 0x41e19a
push eax
call fcn.00487a91
add esp, 4
jmp 0x41e19a
mov edx, 0x1234
cmp dx, ax
jne 0x41e19a
push 3
lea eax, [esp + 0x44]
push esi
lea ecx, [esp + 0x44]
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x44], eax
call fcn.0041cfa0
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x40]
mov dword [esp + 0x20], eax
cmp eax, ecx
je 0x41e177
push eax
call fcn.00487a91
add esp, 4
mov ecx, dword [ebp + 4]
lea edx, [esp + 0x18]
push edx
push 0
movzx eax, di
push 0x40b
push eax
push ecx
call ebx
cmp eax, 0xffffffff
jne 0x41e19a
mov dword [esp + 0x10], 0
add esi, dword [esp + 0x14]
cmp dword [esp + 0x10], 0
jne 0x41e0b0
mov eax, dword [esp + 0x10]
pop ebx
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.004874cc
add esp, 0x134
ret 4
mov eax, edi
jmp 0x41e1ad
mov eax, edi
jmp 0x41e1ae

Function at 0x41ecd0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x4cdbb4]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x110
lea eax, [esp + 8]
push 0
push eax
call fcn.00487ce0
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
je 0x41ed3a
mov eax, dword [esp + 4]
cmp eax, 5
jae 0x41ed23
cmp eax, 4
jne 0x41ed3a
cmp dword [esp + 8], 0x5a
jb 0x41ed3a
xor eax, eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004874cc
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor ecx, esp
mov eax, 1
call fcn.004874cc
add esp, 0x118
ret
Function at 0x420590
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
mov ebx, ecx
mov eax, dword [ebx]
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [esp + 0x10]
lea edi, [eax + 1]
mov eax, dword [esi]
mov edx, dword [eax - 8]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
sub edx, edi
or ecx, edx
jge 0x4205c3
push edi
mov ecx, esi
call fcn.00403ee0
mov eax, dword [esi]
push edi
push eax
mov eax, dword [ebx]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4205ea
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x4205ee
push ecx
push eax
call fcn.004876e0
add esp, 8
test eax, eax
jl 0x420608
mov ecx, dword [esi]
cmp eax, dword [ecx - 8]
jg 0x420608
mov dword [ecx - 0xc], eax
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
push 0x80070057
call fcn.004033e0
int3