joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403740
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46f008
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x48b914]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push edi
mov eax, dword [0x48b914]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
mov dword [esp + 0x38], ebx
cmp eax, ebx
jne 0x4037bc
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x18]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push eax
mov ecx, esi
mov byte [esi + 4], bl
call fcn.00402730
cmp dword [esp + 0x28], 0x10
jb 0x40381d
mov ecx, dword [esp + 0x14]
push ecx
jmp 0x403815
push eax
call fcn.004036d0
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x4037ed
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4037d0
sub eax, edx
push eax
push edi
lea ecx, [esp + 0x18]
call fcn.00402b00
push edi
call fcn.00455213
add esp, 4
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x18]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push edx
mov ecx, esi
mov byte [esi + 4], bl
call fcn.00402730
cmp dword [esp + 0x28], 0x10
jb 0x40381d
mov eax, dword [esp + 0x14]
push eax
call fcn.00436c58
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00454d22
add esp, 0x30
ret

Function at 0x4038b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x48b914]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
lea eax, [esp + 4]
push esi
mov esi, ecx
test eax, eax
je 0x4038ff
push 0x104
mov ecx, eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
dec eax
cmp eax, 0x102
ja 0x4038ff
lea edx, [esp + 8]
push 0x5c
push edx
call fcn.00456f10
add esp, 8
test eax, eax
je 0x4038ff
mov byte [eax + 1], 0
push str.config.ini
lea eax, [esp + 0xc]
push 0x104
push eax
call fcn.004558ea
push 0x30
push 0
push esi
call fcn.004592c0
add esp, 0x18
lea ebx, [esp + 8]
call fcn.0040f620
test eax, eax
je 0x4039e3
push edi
mov ecx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ecx
push 0x14
push esi
push 0x47b77f
push 0x47b780
push str.config
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea edx, [esp + 0xc]
push edx
push 0
push 0x47b78c
push str.config
call edi
mov dword [esi + 0x14], eax
lea eax, [esp + 0xc]
push eax
push 0
push str.lock
push str.config
call edi
lea ecx, [esp + 0xc]
push ecx
push 0
push str.unsafe
push str.config
mov dword [esi + 0x18], eax
call edi
lea edx, [esp + 0xc]
push edx
push 0
push str.chkmode
push str.config
mov dword [esi + 0x1c], eax
call edi
mov dword [esi + 0x20], eax
lea eax, [esp + 0xc]
push eax
push 0xc
add esi, 0x24
push esi
push 0x47b77f
push str.ipver
push str.config
call ebx
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00454d22
add esp, 0x108
ret
mov ecx, dword [esp + 0x10c]
pop esi
pop ebx
xor ecx, esp
xor al, al
call fcn.00454d22
add esp, 0x108
ret
Function at 0x403ab0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x134
mov eax, dword [0x48b914]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push ebp
push esi
push edi
push 0x128
xor esi, esi
lea eax, [esp + 0x14]
push esi
push eax
call fcn.004592c0
add esp, 0xc
push esi
push 2
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x403b63
lea ecx, [esp + 0x10]
push ecx
push ebx
call sub.KERNEL32.dll_Process32First
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x403b60
lea esp, [esp]
lea edx, [esp + 0x34]
push str.python27.exe
push edx
call fcn.0045503b
add esp, 8
test eax, eax
je 0x403b37
lea eax, [esp + 0x10]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x403b10
jmp 0x403b60
mov ecx, dword [esp + 0x18]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x403b60
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, eax
neg esi
sbb esi, esi
push edi
neg esi
call ebp
push ebx
call ebp
mov ecx, dword [esp + 0x13c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00454d22
add esp, 0x134
ret

Function at 0x403b80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403b99
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403bd4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x403bd0
lea ebx, [ebx]
cmp esi, eax
jae 0x403bd4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x403bc0
cmp esi, eax
jb 0x403bda
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x403de0
Capabilities:
Move file

Disassembly:
sub esp, 0x42c
mov eax, dword [0x48b914]
xor eax, esp
mov dword [esp + 0x428], eax
push ebx
push edi
xor ebx, ebx
push 0x103
lea eax, [esp + 0x119]
push ebx
push eax
mov byte [esp + 0x120], bl
call fcn.004592c0
add esp, 0xc
push 0x103
lea ecx, [esp + 0x221]
push ebx
push ecx
mov byte [esp + 0x228], bl
call fcn.004592c0
add esp, 0xc
push 0x103
lea edx, [esp + 0x329]
push ebx
push edx
mov byte [esp + 0x330], bl
call fcn.004592c0
add esp, 0xc
push 0x103
lea eax, [esp + 0x11]
push ebx
push eax
mov byte [esp + 0x18], bl
call fcn.004592c0
lea ecx, [esp + 0x120]
add esp, 0xc
test ecx, ecx
je 0x403ea1
push 0x104
mov edx, ecx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
dec eax
cmp eax, 0x102
ja 0x403ea1
lea eax, [esp + 0x114]
push 0x5c
push eax
call fcn.00456f10
add esp, 8
cmp eax, ebx
je 0x403ea1
mov byte [eax + 1], bl
lea ecx, [esp + 0x114]
push ecx
push str._sphotoused_
lea edx, [esp + 0x224]
push 0x104
push edx
call fcn.004551d4
mov eax, dword [esi + 4]
push eax
lea ecx, [esp + 0x230]
push ecx
push str._s_s.jpg
lea edx, [esp + 0x28]
push 0x104
push edx
call fcn.004551d4
add esp, 0x24
lea ebx, [esp + 0xc]
call fcn.0040f620
test eax, eax
jne 0x403f41
mov eax, dword [esi + 8]
push eax
lea ecx, [esp + 0x118]
push ecx
push str._sphoto_s_
lea edx, [esp + 0x228]
push 0x104
push edx
call fcn.004551d4
add esp, 0x14
lea eax, [esp + 0x324]
push eax
lea edi, [esp + 0x220]
call fcn.00403f90
test al, al
je 0x403f41
push 0
mov ecx, ebx
push ecx
lea edx, [esp + 0x32c]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea ebx, [esp + 0xc]
call fcn.0040f620
test eax, eax
jne 0x403f67
xor al, al
pop edi
pop ebx
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.00454d22
add esp, 0x42c
ret
mov eax, dword [esi]
mov edx, dword [eax]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call edx
mov ecx, dword [esp + 0x430]
pop edi
pop ebx
xor ecx, esp
call fcn.00454d22
add esp, 0x42c
ret

Function at 0x403f90
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x254
mov eax, dword [0x48b914]
xor eax, esp
mov dword [esp + 0x250], eax
push ebx
push ebp
mov ebp, dword [esp + 0x260]
push esi
xor ebx, ebx
push 0x13c
lea eax, [esp + 0x18]
push ebx
push eax
mov dword [esp + 0x1c], ebx
call fcn.004592c0
push edi
push str._s.jpg
lea edx, [esp + 0x164]
call fcn.00404290
add esp, 0x14
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x154]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x403ff7
xor al, al
jmp 0x404034
test byte [esp + 0x10], 0x10
je 0x404010
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x403ff7
jmp 0x40402b
lea ecx, [esp + 0x3c]
push ecx
push edi
push 0x47b70c
push 0x104
push ebp
mov bl, 1
call fcn.004551d4
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, bl
mov ecx, dword [esp + 0x25c]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00454d22
add esp, 0x254
ret 4
Function at 0x404cb0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax - 0xd4]
sub esp, 8
push ebx
push esi
push ecx
lea ecx, [esp + 0xc]
call fcn.00437d8b
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, 0x8000
test dx, ax
je 0x404d7a
mov esi, dword [esp + 0x18]
cmp dword [esi + 4], 0x100
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
jne 0x404d7a
push 0x4f
call ebx
test ax, ax
jge 0x404d1c
cmp dword [esp + 0xc], 0
je 0x404d12
mov eax, dword [esp + 8]
push eax
push 0
call fcn.00437473
pop esi
xor eax, eax
pop ebx
add esp, 8
ret 0x10
cmp dword [esi + 4], 0x100
jne 0x404d7a
push 0x50
call ebx
test ax, ax
jge 0x404d4b
cmp dword [esp + 0xc], 0
je 0x404d41
mov ecx, dword [esp + 8]
push ecx
push 0
call fcn.00437473
pop esi
xor eax, eax
pop ebx
add esp, 8
ret 0x10
cmp dword [esi + 4], 0x100
jne 0x404d7a
push 0x4e
call ebx
test ax, ax
jge 0x404d7a
cmp dword [esp + 0xc], 0
je 0x404d70
mov edx, dword [esp + 8]
push edx
push 0
call fcn.00437473
pop esi
xor eax, eax
pop ebx
add esp, 8
ret 0x10
cmp dword [esp + 0xc], 0
je 0x404d8d
mov eax, dword [esp + 8]
push eax
push 0
call fcn.00437473
pop esi
mov eax, 1
pop ebx
add esp, 8
ret 0x10

Function at 0x405450
Capabilities:
Create thread

Disassembly:
test eax, eax
je 0x405457
mov eax, dword [eax + 0x20]
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowExA]
push edi
push 0
push 0
push 0
push eax
call esi
push 0
push 0
push 0
push eax
call esi
mov edi, eax
test edi, edi
je 0x4054e7
push 0x408
call fcn.00436c29
mov esi, eax
add esp, 4
test esi, esi
je 0x40549c
push 0x408
push 0
push esi
call fcn.004592c0
add esp, 0xc
jmp 0x40549e
xor esi, esi
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push ecx
push 0x400
push esi
mov dword [esi + 0x400], edi
mov dword [esi + 0x404], eax
call fcn.00456953
push 0
push 0
push esi
push 0x405500
push 0
push 0
call fcn.0045553a
add esp, 0x24
test eax, eax
jne 0x4054ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call fcn.00436c58
add esp, 4
pop edi
xor al, al
pop esi
ret 8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, 1
pop esi
ret 8
Function at 0x405980
Capabilities:
Get file size
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x46f43b
mov eax, dword fs:[0]
push eax
mov eax, 0x100c
call fcn.00459b80
mov eax, dword [0x48b914]
xor eax, esp
mov dword [esp + 0x1008], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48b914]
xor eax, esp
push eax
lea eax, [esp + 0x1020]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, edx
call fcn.00436c6e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4059dd
push 0x80004005
call fcn.00401010
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
push 0x1000
lea ecx, [esp + 0x20]
push 0
push ecx
mov dword [esp + 0x1034], 0
call fcn.004592c0
add esp, 0xc
test esi, esi
jne 0x405a14
xor eax, eax
jmp 0x405a29
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405a20
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x1c]
call fcn.004029a0
mov ecx, dword [esp + 0x14]
mov edi, dword [ecx - 0xc]
mov eax, dword [ecx - 8]
mov edx, 1
sub edx, dword [ecx - 4]
lea esi, [edi + 1]
sub eax, esi
or eax, edx
jge 0x405a5d
push esi
lea ecx, [esp + 0x18]
call fcn.00402a40
mov ecx, dword [esp + 0x14]
mov byte [edi + ecx], 0x5c
test esi, esi
jl 0x405b9c
cmp esi, dword [ecx - 8]
jg 0x405b9c
mov dword [ecx - 0xc], esi
mov byte [esi + ecx], 0
test ebx, ebx
jne 0x405a81
xor eax, eax
jmp 0x405a8f
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405a86
sub eax, edx
push eax
push ebx
lea ecx, [esp + 0x1c]
call fcn.00409530
mov ebp, dword [esp + 0x14]
push 0
push 0x80
push 3
push 0
push 3
push 0x40000000
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x405b0a
mov dword [esp + 0x1028], eax
lea eax, [ebp - 0x10]
lea edx, [eax + 0xc]
or ecx, esi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x405ae0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x1020]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1008]
xor ecx, esp
call fcn.00454d22
add esp, 0x1018
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0
push 0x40
mov edi, eax
push esi
sub edi, 0x40
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test edi, edi
jbe 0x405b64
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
nop
push 0
cmp edi, 0x1000
jbe 0x405b56
lea ecx, [esp + 0x1c]
push ecx
push 0x1000
lea edx, [esp + 0x28]
push edx
push esi
call ebx
sub edi, 0x1000
jne 0x405b30
jmp 0x405b64
lea eax, [esp + 0x1c]
push eax
push edi
lea ecx, [esp + 0x28]
push ecx
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x10]
mov dword [esp + 0x1028], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x405b92
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x405ae2
push 0x80070057
call fcn.00401010
int3
Function at 0x406300
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
sub esp, 0x14
push ebx
push esi
push edi
test eax, eax
je 0x406316
mov eax, dword [eax + 0x20]
mov esi, dword [sym.imp.USER32.dll_FindWindowExA]
push 0
push 0
push 0
push eax
call esi
push 0
push 0
push 0
push eax
call esi
mov edi, eax
mov dword [esp + 0xc], edi
test edi, edi
je 0x406457
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClientRect]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
sub ebx, dword [esp + 0x10]
sub esi, dword [esp + 0x14]
mov ecx, dword [ebp + 8]
push 2
sub ebx, 0x64
sub esi, 0x64
call fcn.00406860
mov ecx, dword [ebp + 8]
push 1
add esi, eax
call fcn.00406860
mov ecx, dword [ebp + 0x10]
add ebx, eax
mov eax, dword [ebp + 0x18]
add ecx, eax
cmp ecx, esi
mov dword [ebp + 0x10], ecx
jle 0x4063b5
mov edi, ecx
sub edi, esi
mov esi, dword [ebp + 8]
push 2
mov ecx, esi
call fcn.00406480
push 2
mov ecx, esi
call fcn.00406860
mov edi, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [ebp + 0x18]
cdq
sub eax, edx
neg ecx
sar eax, 1
sub ecx, eax
add dword [ebp + 0x10], ecx
jmp 0x4063c1
cdq
sub eax, edx
sar eax, 1
neg eax
add ecx, eax
mov dword [ebp + 0x10], ecx
mov esi, dword [ebp + 0xc]
cmp esi, ebx
jle 0x4063ea
mov edi, esi
sub edi, ebx
mov ebx, dword [ebp + 8]
push 1
mov ecx, ebx
call fcn.00406480
push 1
mov ecx, ebx
call fcn.00406860
mov edi, dword [esp + 0xc]
sub esi, eax
mov dword [ebp + 0xc], esi
push 0x18
call fcn.00436c29
mov esi, eax
add esp, 4
xor eax, eax
test esi, esi
je 0x40646e
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x18]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
push 0
mov dword [esi + 0x10], eax
push 0
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x10]
push esi
push 0x406230
mov dword [esi + 8], edx
mov edx, dword [ebp + 0x14]
push 0
push 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], ecx
mov dword [esi + 0x10], edx
mov dword [esi], edi
mov dword [esi + 4], 0
call fcn.0045553a
add esp, 0x18
test eax, eax
jne 0x406462
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call fcn.00436c58
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x406b80
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], edi
xor esi, esi
mov ebp, 0x1000
mov eax, 0x7a
nop
test eax, eax
je 0x406bf1
cmp eax, 0x7a
jne 0x406c6f
push esi
call fcn.00436c58
push ebp
call fcn.00436c63
mov esi, eax
add esp, 8
mov dword [esi], ebp
mov dword [esp + 0x10], ebp
test edi, edi
jne 0x406be0
lea eax, [esp + 0x10]
push eax
push esi
push edi
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
mov edi, eax
xor eax, eax
test edi, edi
setne al
jmp 0x406be9
lea ecx, [esp + 0x10]
push ecx
push esi
push edi
call ebx
test eax, eax
je 0x406c60
xor eax, eax
jmp 0x406ba0
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x406c0a
mov eax, dword [esi + 4]
push ecx
push eax
call fcn.00455422
add esp, 8
test eax, eax
je 0x406c48
mov al, byte [esp + 0x1c]
test al, 1
je 0x406c21
test dword [esi + 0xc], 0x100000
je 0x406c21
mov edx, dword [esi + 4]
push edx
jmp 0x406c42
test al, 2
je 0x406c31
test byte [esi + 0xc], 1
je 0x406c31
mov eax, dword [esi + 4]
push eax
jmp 0x406c42
test al, 4
je 0x406c48
test dword [esi + 0xc], 0x200000
je 0x406c48
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
lea edx, [esp + 0x10]
push edx
push esi
push edi
mov dword [esp + 0x1c], ebp
call ebx
test eax, eax
je 0x406c60
xor eax, eax
jmp 0x406ba0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [esp + 0x10]
jmp 0x406ba0
cmp eax, 0x103
jne 0x406c7e
mov dword [esp + 0x14], 1
push esi
call fcn.00436c58
add esp, 4
test edi, edi
je 0x406c92
push edi
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x409260
Capabilities:
Write file on windows

Disassembly:
push ecx
test edi, edi
je 0x4092af
test eax, eax
je 0x4092af
push esi
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4092aa
mov ecx, dword [esp + 0xc]
push 0
lea eax, [esp + 8]
push eax
push ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop esi
pop ecx
ret
xor al, al
pop esi
pop ecx
ret
xor al, al
pop ecx
ret
Function at 0x40a530
Capabilities:
Check for time delay via gettickcount
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46f348
mov eax, dword fs:[0]
push eax
sub esp, 0x2a8
mov eax, dword [0x48b914]
xor eax, esp
mov dword [esp + 0x2a0], eax
push ebx
push esi
push edi
mov eax, dword [0x48b914]
xor eax, esp
push eax
lea eax, [esp + 0x2b8]
mov dword fs:[0], eax
push 0x4036c0
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea esi, [esp + 0x24]
call fcn.00412650
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov eax, esi
call fcn.00412a10
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 8
mov dword [esp + 0x20], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, edi
call fcn.00446f3c
push 8
call fcn.00436c29
xor esi, esi
add esp, 4
cmp eax, esi
je 0x40a5d1
mov dword [eax], vtable.CImpIDispatch.0
mov dword [eax + 4], esi
jmp 0x40a5d3
xor eax, eax
push 4
mov dword [edi + 0xdc], eax
call fcn.00447fb7
cmp eax, esi
je 0x40a5ec
mov dword [eax], vtable.CCustomOccManager.0
jmp 0x40a5ee
xor eax, eax
push eax
call fcn.00449dca
add esp, 4
push str.Local_AppWizard_Generated_Applications
mov ecx, edi
call fcn.00447e1d
push esi
lea ecx, [edi + 0xa4]
push ecx
lea edx, [edi + 0xb4]
push edx
call sub.gdiplus.dll_GdiplusStartup
test eax, eax
jne 0x40a722
lea eax, [esp + 0x14]
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], eax
push str.GlobalDAX1_FBFLOW_STR
push esi
push esi
mov dword [esp + 0x2cc], esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
call ebx
cmp eax, 0xb7
jne 0x40a66a
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x40a722
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40a722
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push esi
push esi
push 0x412600
push esi
push esi
call fcn.0045553a
add esp, 0x18
mov dword [0x48fa88], eax
cmp eax, esi
jne 0x40a68d
call ebx
lea ecx, [esp + 0x8c]
push ecx
call fcn.0040ae60
lea edx, [esp + 0x8c]
mov ebx, 1
mov byte [esp + 0x2c0], bl
mov ecx, edx
mov dword [edi + 0x20], edx
call fcn.0044b122
mov eax, dword [0x48fa88]
mov dword [0x48fa84], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, esi
je 0x40a6e3
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x48fa88]
push eax
call ebx
mov dword [0x48fa88], esi
mov edi, dword [edi + 0xdc]
cmp edi, esi
je 0x40a6fc
push edi
mov dword [edi], vtable.CImpIDispatch.0
call fcn.00436c58
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [esp + 0x8c]
push ecx
mov byte [esp + 0x2c4], 0
call fcn.0040a750
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x40a722
push eax
call ebx
xor eax, eax
mov ecx, dword [esp + 0x2b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2a0]
xor ecx, esp
call fcn.00454d22
mov esp, ebp
pop ebp
ret
Function at 0x40a8b0
Capabilities:
Read file via mapping

Disassembly:
cmp dword [esi + 4], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x40a8e1
mov eax, dword [esi]
test eax, eax
je 0x40a8d0
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x40a8e1
push eax
call ebx
mov dword [esi + 4], 0
push str.daxShareData
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 4], eax
test eax, eax
je 0x40a91f
push 0
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi], eax
test eax, eax
jne 0x40a923
mov eax, dword [esi + 4]
push eax
call ebx
mov dword [esi + 4], 0
xor eax, eax
pop ebx
ret
mov eax, 1
pop ebx
ret

Function at 0x40aa60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, word [esp + 4]
mov dword [esp + 4], edx
jmp fcn.0044b35a

Function at 0x40ac00
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x46f889
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x48b914]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
call fcn.00436c6e
xor ecx, ecx
xor ebx, ebx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x40ac43
push 0x80004005
call fcn.00401010
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
mov dword [esp + 0x18], ebx
lea edi, [esi + 4]
call fcn.00436c6e
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x40ac72
push 0x80004005
call fcn.00401010
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x30], ebx
mov ecx, esi
mov byte [esp + 0x18], 3
call fcn.004021f0
mov ecx, edi
call fcn.004021f0
mov ecx, esi
call fcn.00410b30
mov dword [esi + 0x28], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4