joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4017d0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4daf68
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x5246f0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x244], ecx
mov dword [ebp - 0x240], 0
lea ecx, [ebp - 0x30]
call fcn.00402af0
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x23c], ax
push 0x206
push 0
lea ecx, [ebp - 0x23a]
push ecx
call fcn.00463ac0
add esp, 0xc
mov dword [ebp - 0x10], 0x104
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x23c]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x401866
lea ecx, [ebp - 0x23c]
push ecx
lea ecx, [ebp - 0x30]
call fcn.00402be0
lea edx, [ebp - 0x30]
push edx
mov ecx, dword [ebp + 8]
call fcn.00402b20
mov eax, dword [ebp - 0x240]
or eax, 1
mov dword [ebp - 0x240], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00405540
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045f522
mov esp, ebp
pop ebp
ret 4

Function at 0x4062c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x5246f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x239], 0
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0xffffffff
jne 0x4062fa
xor al, al
jmp 0x40638f
mov dword [ebp - 0x238], 0x22c
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp - 0x240]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x40632d
mov edx, dword [ebp - 0x240]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x40638f
mov ecx, dword [ebp + 8]
call fcn.00404cf0
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.0046017c
add esp, 8
test eax, eax
jne 0x406371
cmp dword [ebp + 0xc], 0
je 0x406368
mov ecx, dword [ebp - 0x230]
push ecx
push 0
push 0x100411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov byte [ebp - 0x239], 1
jmp 0x406389
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp - 0x240]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40632d
mov al, byte [ebp - 0x239]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045f522
mov esp, ebp
pop ebp
ret
Function at 0x406450
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x5246f0]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x406470
xor al, al
jmp 0x40659b
mov byte [ebp - 1], 1
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x406598
mov dword [ebp - 0x240], 0
push 0x228
push 0
lea eax, [ebp - 0x23c]
push eax
call fcn.00463ac0
add esp, 0xc
mov dword [ebp - 0x240], 0x22c
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x4064d1
xor al, al
jmp 0x40659b
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x40657f
mov edx, dword [ebp - 0x238]
push edx
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
je 0x40657f
push 0
mov eax, dword [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne cl
mov byte [ebp - 1], cl
mov dword [ebp - 0x248], 0
push 0x64
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x406572
mov eax, dword [ebp - 0x248]
add eax, 1
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0xa
jg 0x406572
push 0
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne dl
mov byte [ebp - 1], dl
jmp 0x40652e
mov eax, dword [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4064d1
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0045f522
mov esp, ebp
pop ebp
ret
Function at 0x406890
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dc3e8
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
mov eax, dword [0x5246f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov byte [ebp - 0x59], 0
push 0x44
push 0
lea eax, [ebp - 0xa4]
push eax
call fcn.00463ac0
add esp, 0xc
mov dword [ebp - 0xa4], 0x44
mov dword [ebp - 0x78], 1
xor ecx, ecx
mov word [ebp - 0x74], cx
xor edx, edx
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00405d80
mov dword [ebp - 0xc8], eax
mov ecx, dword [ebp - 0xc8]
mov dword [ebp - 0xcc], ecx
mov byte [ebp - 4], 1
push 0x510368
mov edx, dword [ebp - 0xcc]
push edx
lea eax, [ebp - 0x48]
push eax
call fcn.00407420
add esp, 0xc
mov dword [ebp - 0xd0], eax
mov ecx, dword [ebp - 0xd0]
mov dword [ebp - 0xd4], ecx
mov byte [ebp - 4], 2
lea edx, [ebp + 0xc]
push edx
mov eax, dword [ebp - 0xd4]
push eax
lea ecx, [ebp - 0xc0]
push ecx
call fcn.00407460
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.00405540
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00405540
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 0xa4]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea ecx, [ebp - 0xc0]
call fcn.00404cf0
push eax
push 0x51036c
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne cl
mov byte [ebp - 0x59], cl
cmp dword [ebp - 0x58], 0
je 0x4069c9
mov edx, dword [ebp - 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x54], 0
je 0x4069d9
mov eax, dword [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov cl, byte [ebp - 0x59]
mov byte [ebp - 0xc1], cl
lea ecx, [ebp - 0xc0]
call fcn.00405540
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00405540
mov al, byte [ebp - 0xc1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045f522
mov esp, ebp
pop ebp
ret
Function at 0x4072f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5246f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x14], 0x30
mov byte [ebp - 0x13], 0x31
mov byte [ebp - 0x12], 0x32
mov byte [ebp - 0x11], 0x33
mov byte [ebp - 0x10], 0x34
mov byte [ebp - 0xf], 0x35
mov byte [ebp - 0xe], 0x36
mov byte [ebp - 0xd], 0x37
mov byte [ebp - 0xc], 0x38
mov byte [ebp - 0xb], 0x39
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x62
mov byte [ebp - 8], 0x63
mov byte [ebp - 7], 0x64
mov byte [ebp - 6], 0x65
mov byte [ebp - 5], 0x66
movzx eax, byte [ebp + 8]
movzx cx, byte [ebp + eax - 0x14]
mov word [ebp - 0x18], cx
mov ax, word [ebp - 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045f522
mov esp, ebp
pop ebp
ret

Function at 0x407e00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4db42b
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x5246f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x23c], 0
lea ecx, [ebp - 0x238]
call fcn.00402af0
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.00463ac0
add esp, 0xc
lea edx, [ebp - 0x21c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x407e8e
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x238]
call fcn.00402be0
lea ecx, [ebp - 0x238]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00402b20
mov edx, dword [ebp - 0x23c]
or edx, 1
mov dword [ebp - 0x23c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.00405540
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045f522
mov esp, ebp
pop ebp
ret

Function at 0x4080c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dc308
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x5246f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x238], 0
lea ecx, [ebp - 0x2c]
call fcn.00402af0
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x234], ax
push 0x206
push 0
lea ecx, [ebp - 0x232]
push ecx
call fcn.00463ac0
add esp, 0xc
push 0
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x234]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40814b
lea ecx, [ebp - 0x234]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00402be0
lea edx, [ebp - 0x2c]
push edx
mov ecx, dword [ebp + 8]
call fcn.00402b20
mov eax, dword [ebp - 0x238]
or eax, 1
mov dword [ebp - 0x238], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00405540
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045f522
mov esp, ebp
pop ebp
ret
Function at 0x4081a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
pop ebp
ret

Function at 0x4081c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4081ea
mov ecx, dword [ebp - 4]
and ecx, 0x10
jne 0x4081ea
mov dword [ebp - 8], 1
jmp 0x4081f1
mov dword [ebp - 8], 0
mov al, byte [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x408200
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dca81
mov eax, dword fs:[0]
push eax
sub esp, 0x2d0
mov eax, dword [0x5246f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
call fcn.00404cf0
push eax
call fcn.004081a0
add esp, 4
movzx eax, al
test eax, eax
jne 0x40824a
mov al, 1
jmp 0x40844f
mov dword [ebp - 0x284], 0
push 0x24c
push 0
lea ecx, [ebp - 0x280]
push ecx
call fcn.00463ac0
add esp, 0xc
push 0x50fdf0
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x2c]
push eax
call fcn.00403800
add esp, 0xc
mov dword [ebp - 0x2dc], eax
lea ecx, [ebp - 0x284]
push ecx
mov ecx, dword [ebp - 0x2dc]
call fcn.00404cf0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x2c]
call fcn.00405540
cmp dword [ebp - 0x30], 0xffffffff
jne 0x4082c5
mov ecx, dword [ebp + 8]
call fcn.00404cf0
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor al, al
jmp 0x40844f
lea edx, [ebp - 0x258]
push edx
lea ecx, [ebp - 0x2bc]
call fcn.00405d80
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2bc]
push eax
push 0x50fdf8
call fcn.00408cb0
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x408314
lea edx, [ebp - 0x2bc]
push edx
push 0x50fdfc
call fcn.00408cb0
add esp, 8
movzx eax, al
test eax, eax
je 0x40832b
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2bc]
call fcn.00405540
jmp 0x408402
push 0x50fe04
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x2a0]
push edx
call fcn.00403800
add esp, 0xc
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2bc]
push eax
lea ecx, [ebp - 0x2a0]
call fcn.00403bc0
mov ecx, dword [ebp - 0x284]
and ecx, 1
je 0x40837b
push 0x80
lea ecx, [ebp - 0x2a0]
call fcn.00404cf0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, dword [ebp - 0x284]
and edx, 0x10
je 0x408397
lea eax, [ebp - 0x2a0]
push eax
call fcn.00408200
add esp, 4
jmp 0x4083e1
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x2d8]
call fcn.00404c60
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2d8]
call fcn.00404cf0
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [ebp - 0x2d8]
push edx
lea eax, [ebp - 0x2a0]
push eax
call fcn.00408c70
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2d8]
call fcn.00405540
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2a0]
call fcn.00405540
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2bc]
call fcn.00405540
lea ecx, [ebp - 0x284]
push ecx
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4082c5
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 8]
call fcn.00404cf0
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp + 8]
call fcn.00404cf0
push eax
call fcn.004081a0
add esp, 4
movzx eax, al
neg eax
sbb eax, eax
add eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045f522
mov esp, ebp
pop ebp
ret
Function at 0x4087c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dc26b
mov eax, dword fs:[0]
push eax
sub esp, 0x474
mov eax, dword [0x5246f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x480], 0
xor eax, eax
mov word [ebp - 0x254], ax
push 0x206
push 0
lea ecx, [ebp - 0x252]
push ecx
call fcn.00463ac0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x48]
call fcn.00405d80
mov dword [ebp - 4], 0
push 1
push 0
lea ecx, [ebp - 0x270]
push ecx
lea ecx, [ebp - 0x48]
call fcn.00402cb0
mov byte [ebp - 4], 1
xor edx, edx
mov word [ebp - 0x47c], dx
push 0x206
push 0
lea eax, [ebp - 0x47a]
push eax
call fcn.00463ac0
add esp, 0xfffffff0
mov ecx, 7
lea esi, [ebp - 0x270]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
push 0x510100
lea ecx, [ebp - 0x47c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x24
lea edx, [ebp - 0x47c]
push edx
lea ecx, [ebp - 0x2c]
call fcn.00405d80
mov byte [ebp - 4], 2
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 8]
call fcn.00402b20
mov ecx, dword [ebp - 0x480]
or ecx, 1
mov dword [ebp - 0x480], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00405540
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x270]
call fcn.00405540
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00405540
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045f522
mov esp, ebp
pop ebp
ret
Function at 0x408c70
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
call fcn.00404cf0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x408ca1
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00408910
add esp, 8
movzx edx, al
test edx, edx
jne 0x408ca1
xor al, al
jmp 0x408ca3
mov al, 1
pop ebp
ret

Function at 0x409630
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov byte [ebp - 1], 0
push str.bblplayer_install_global_instance_event_name
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x409662
mov byte [ebp - 1], 1
jmp 0x409685
push str.1011
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x409685
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
test eax, eax
je 0x40969b
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x40969d
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x40b380
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dc858
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x5246f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x84], 0
lea eax, [ebp - 0x2c]
push eax
call fcn.00406ab0
add esp, 4
mov dword [ebp - 0x8c], eax
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x90], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x90]
push edx
lea eax, [ebp - 0x48]
push eax
call fcn.00407010
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
call fcn.00405540
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x64]
call fcn.00404c60
mov byte [ebp - 4], 3
xor edx, edx
jne 0x40b427
push 0
push 0x50f46c
lea ecx, [ebp - 0x48]
call fcn.00402c80
cmp eax, 0xffffffff
je 0x40b436
push 0x50f470
lea ecx, [ebp - 0x64]
call fcn.00403be0
jmp 0x40b44d
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x80]
call fcn.00405d80
lea ecx, [ebp - 0x80]
call fcn.00405540
lea eax, [ebp - 0x64]
push eax
mov ecx, dword [ebp + 8]
call fcn.00402b20
mov ecx, dword [ebp - 0x84]
or ecx, 1
mov dword [ebp - 0x84], ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x64]
call fcn.00405540
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00405540
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045f522
mov esp, ebp
pop ebp
ret 8
Function at 0x40b4b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dd368
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x5246f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x78], ecx
lea eax, [ebp - 0x68]
push eax
call fcn.00409bf0
mov ecx, eax
call fcn.00409f80
mov dword [ebp - 4], 0
call fcn.00411690
mov ecx, eax
call fcn.0040af70
test eax, eax
je 0x40b514
push str.Bbsource64.dll
lea ecx, [ebp - 0x68]
call fcn.00403be0
jmp 0x40b521
push str.Bbsource.dll
lea ecx, [ebp - 0x68]
call fcn.00403be0
lea ecx, [ebp - 0x68]
push ecx
push 0x50f4bc
lea edx, [ebp - 0x2c]
push edx
call fcn.00407360
add esp, 0xc
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x80], eax
mov byte [ebp - 4], 1
push 0x50f4b8
mov ecx, dword [ebp - 0x80]
push ecx
lea edx, [ebp - 0x48]
push edx
call fcn.00407420
add esp, 0xc
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x88]
push ecx
lea ecx, [ebp - 0x68]
call fcn.00402bb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.00405540
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00405540
push 0
push 0
lea ecx, [ebp - 0x68]
call fcn.00404cf0
push eax
push str.regsvr32.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x20
jge 0x40b5e8
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6c], esp
push 0x50f4f0
call fcn.00405d80
mov dword [ebp - 0x8c], eax
push 0x7d6
call fcn.00402430
mov ecx, eax
call fcn.004022f0
jmp 0x40b611
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x70], esp
push 0x50f4f4
call fcn.00405d80
mov dword [ebp - 0x90], eax
push 0x7d6
call fcn.00402430
mov ecx, eax
call fcn.004022f0
mov byte [ebp - 0x71], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.00405540
mov al, byte [ebp - 0x71]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045f522
mov esp, ebp
pop ebp
ret
Function at 0x40cbd0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push 0x40cc10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x40cc70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x40cca0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x5c], eax
mov esp, ebp
pop ebp
ret
Function at 0x40e7e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x5246f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x44], ecx
sub esp, 0x14
mov eax, esp
mov dword [ebp - 0x40], esp
lea ecx, [ebp + 0xc]
call fcn.0041afc0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x44]
call fcn.004172c0
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx + 0xe0]
mov eax, dword [edx + 4]
add eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx + 0xe0]
mov eax, dword [edx + 8]
add eax, 2
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0x148
mov dword [ebp - 0x24], 0x14
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx + 0x118]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x40e95d
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x44]
call fcn.00415360
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 0x50000080
push 0
mov eax, dword [ebp - 0x38]
push eax
push 0
mov ecx, dword [ebp - 0x3c]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x34]
push eax
push 0
push str.Edit
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ecx, dword [ebp - 0x44]
mov dword [ecx + 0x118], eax
mov edx, dword [ebp - 0x44]
cmp dword [edx + 0x118], 0
je 0x40e95b
push 0
call fcn.0041ea50
mov edx, str._font_yahei_12
call fcn.0041ea60
mov ecx, eax
call fcn.0040d0d0
push eax
push 0x30
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x118]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x444444
push 0
push 0x444
mov edx, dword [ebp - 0x44]
mov eax, dword [edx + 0x118]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx + 0x118]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
lea eax, [ebp - 0x20]
push eax
call fcn.00409bf0
mov ecx, eax
call fcn.00409f80
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
call fcn.00404cf0
push eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx + 0x118]
push edx
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [ebp - 0x20]
call fcn.00405540
push 0
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x118]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40e97f
push 1
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x118]
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045f522
mov esp, ebp
pop ebp
ret 0x18