joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ad10
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x60aca0]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0x18]
mov ecx, 0x6ef2f0
mov dword [ebp - 0x2c], eax
movzx eax, ax
push eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x18], 0
call fcn.00424ca0
mov dword [ebp - 0x28], eax
test eax, eax
je 0x43ad5b
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
jmp 0x43ad5d
xor eax, eax
mov dword [ebp - 0x1c], 0x46000000
test eax, eax
jne 0x43ad7c
test byte [ebx + 0x1e], 0x10
mov ecx, 0x86c40000
mov edx, 0x86cc0000
cmovne ecx, edx
mov dword [ebp - 0x1c], ecx
cmp byte [ebp + 0x1c], 0
je 0x43ae4b
test byte [ebx + 0x1e], 8
je 0x43ada2
mov ecx, dword [ebx + 0x24]
cmp ecx, 2
je 0x43ad99
cmp ecx, 3
jne 0x43ada2
mov eax, esi
mov esi, edi
mov edi, eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebx + 0x24]
cmp ecx, 2
je 0x43adaf
cmp ecx, 3
jne 0x43adc8
test eax, eax
jne 0x43adc8
push 0
push dword [ebx]
mov eax, esi
mov esi, edi
mov edi, eax
call dword [sym.imp.USER32.dll_ShowWindow]
or eax, 0xffffffff
jmp 0x43ade3
push 0
push dword [ebx]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp - 0x18], 0
jne 0x43addd
or eax, 0xffffffff
jmp 0x43ade3
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 8]
push dword [ebp - 0x1c]
mov dword [ebx + 0x24], eax
push 0xfffffffffffffff0
push dword [ebx]
call dword [sym.imp.USER32.dll_SetWindowLongA]
push dword [ebp - 0x18]
push dword [ebx]
call dword [sym.imp.USER32.dll_SetParent]
push 0
push edi
push esi
mov ecx, ebx
call fcn.004391e0
cmp dword [ebx + 0x24], 0xffffffff
movzx esi, word [ebx + 0x14]
movzx edi, word [ebx + 0x16]
mov dword [ebp + 0x14], esi
mov dword [ebp - 0x24], esi
mov dword [ebp + 0x18], edi
mov dword [ebp - 0x20], edi
jne 0x43ae37
movzx eax, word [ebx + 0xa]
mov ecx, 0x6ef2f0
push eax
call fcn.0042c6f0
mov eax, dword [eax + 0x5c]
jmp 0x43ae39
xor eax, eax
push 0
push eax
push dword [ebx]
mov ecx, 0x6ef2f0
call fcn.0042b540
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x43ae94
push edi
push esi
push eax
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_SetRect]
push dword [ebx]
mov ecx, 0x6ef2f0
call fcn.00427a30
push eax
push 0x80
push 0
push dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
mov ecx, 0x6ef2f0
push eax
call fcn.00424c20
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
movzx eax, word [ebx + 0x1e]
mov edi, dword [ebp + 0x10]
and eax, 0x20
mov esi, dword [ebp + 0xc]
or eax, 2
add eax, eax
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push edi
push esi
push 0
push dword [ebx]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
mov word [ebx + 0x14], ax
xor ecx, ebp
mov eax, dword [ebp + 0x18]
mov word [ebx + 0x12], di
pop edi
mov word [ebx + 0x10], si
mov word [ebx + 0x16], ax
mov eax, dword [ebp - 0x2c]
pop esi
mov word [ebx + 0xc], ax
pop ebx
call fcn.004dcc5c
mov esp, ebp
pop ebp
ret 0x18
Function at 0x43c610
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0xac]
mov byte [esi + 0xb0], 0
test ecx, ecx
je 0x43c633
call fcn.0043c610
mov dword [esi + 0xac], 0
push 0
push dword [esi + 0xb8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x43c68d
push edi
nop dword [eax]
mov eax, dword [esi + 0xc0]
mov edi, dword [eax + ecx*4 - 4]
test edi, edi
je 0x43c673
mov ecx, edi
call fcn.00436930
push 0xac
push edi
call fcn.004dcf9b
add esp, 8
mov ecx, dword [esi + 0xbc]
lea eax, [ecx - 1]
test ecx, ecx
jle 0x43c68c
mov ecx, eax
mov dword [esi + 0xbc], eax
test ecx, ecx
jg 0x43c650
pop edi
cmp dword [0x6f0808], esi
jne 0x43c69f
mov dword [0x6f0808], 0
push 1
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
xor eax, eax
pop esi
ret

Function at 0x43fda0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x60aca0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x108]
push edi
push ebx
push 0x58512c
push 0x104
push eax
mov dword [ebp - 0x24c], ecx
mov dword [ebp - 0x254], ebx
call fcn.004061a0
add esp, 0x10
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
mov dword [ebp - 0x250], edi
cmp edi, 0xffffffff
je 0x43ff3b
push esi
nop dword [eax]
nop dword [eax + eax]
test byte [ebp - 0x248], 0x10
je 0x43ff24
mov ecx, 0x581764
lea eax, [ebp - 0x21c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x43fe48
test dl, dl
je 0x43fe44
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x43fe48
add eax, 2
add ecx, 2
test dl, dl
jne 0x43fe28
xor eax, eax
jmp 0x43fe4d
sbb eax, eax
or eax, 1
test eax, eax
je 0x43ff24
mov eax, 0x585134
lea ecx, [ebp - 0x21c]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x43fe80
test dl, dl
je 0x43fe7c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x43fe80
add ecx, 2
add eax, 2
test dl, dl
jne 0x43fe60
xor eax, eax
jmp 0x43fe85
sbb eax, eax
or eax, 1
test eax, eax
je 0x43ff24
lea eax, [ebp - 0x21c]
push eax
push ebx
push str._s_s
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.004061a0
mov eax, dword [ebp - 0x24c]
xor esi, esi
lea ebx, [eax + 0xb44]
add esp, 0x14
cmp dword [ebx], esi
jle 0x43fef5
xor edi, edi
mov eax, dword [eax + 0xb48]
lea ecx, [ebp - 0x108]
add eax, edi
push ecx
push eax
call fcn.004e2ae3
add esp, 8
test eax, eax
je 0x43feef
mov eax, dword [ebp - 0x24c]
inc esi
add edi, 0x104
cmp esi, dword [ebx]
jl 0x43fec2
mov edi, dword [ebp - 0x250]
mov eax, dword [ebx]
cmp esi, eax
jne 0x43ff0c
push 1
push eax
lea eax, [ebp - 0x108]
mov ecx, ebx
push eax
call fcn.0042a050
mov ecx, dword [ebp - 0x24c]
lea eax, [ebp - 0x108]
push eax
call fcn.0043fda0
mov ebx, dword [ebp - 0x254]
lea eax, [ebp - 0x248]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x43fe10
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004dcc5c
mov esp, ebp
pop ebp
ret 4
Function at 0x43ff60
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x60aca0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push ebx
push 0x585138
push 0x104
push eax
mov dword [ebp - 0x460], ecx
mov dword [ebp - 0x468], ebx
call fcn.00440790
add esp, 0x10
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov dword [ebp - 0x464], edi
cmp edi, 0xffffffff
je 0x440109
push esi
nop dword [eax]
nop dword [eax + eax]
test byte [ebp - 0x45c], 0x10
je 0x4400f2
mov ecx, 0x585148
lea eax, [ebp - 0x430]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44000e
test dx, dx
je 0x44000a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44000e
add eax, 4
add ecx, 4
test dx, dx
jne 0x43ffe8
xor eax, eax
jmp 0x440013
sbb eax, eax
or eax, 1
test eax, eax
je 0x4400f2
mov eax, 0x58514c
lea ecx, [ebp - 0x430]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x44004c
test dx, dx
je 0x440048
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x44004c
add ecx, 4
add eax, 4
test dx, dx
jne 0x440026
xor eax, eax
jmp 0x440051
sbb eax, eax
or eax, 1
test eax, eax
je 0x4400f2
lea eax, [ebp - 0x430]
push eax
push ebx
push 0x585154
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00440790
mov eax, dword [ebp - 0x460]
xor esi, esi
lea ebx, [eax + 0x1670]
add esp, 0x14
cmp dword [ebx], esi
jle 0x4400c3
xor edi, edi
nop
mov eax, dword [eax + 0x1674]
lea ecx, [ebp - 0x20c]
add eax, edi
push ecx
push eax
call fcn.004f070d
add esp, 8
test eax, eax
je 0x4400bd
mov eax, dword [ebp - 0x460]
inc esi
add edi, 0x208
cmp esi, dword [ebx]
jl 0x440090
mov edi, dword [ebp - 0x464]
mov eax, dword [ebx]
cmp esi, eax
jne 0x4400da
push 1
push eax
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.00440130
mov ecx, dword [ebp - 0x460]
lea eax, [ebp - 0x20c]
push eax
call fcn.0043ff60
mov ebx, dword [ebp - 0x468]
lea eax, [ebp - 0x45c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x43ffd0
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004dcc5c
mov esp, ebp
pop ebp
ret 4
Function at 0x4402e0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc84
mov eax, dword [0x60aca0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov dword [ebp - 0xc78], edi
cmp byte [edi], 0
jne 0x440315
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dcc5c
mov esp, ebp
pop ebp
ret 4
cmp byte [edi + 0x104], 0
jne 0x440331
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dcc5c
mov esp, ebp
pop ebp
ret 4
cmp byte [ebp + 8], 0
push ebx
push esi
lea ebx, [edi + 0xb44]
je 0x44034f
mov dword [ebx], 0
mov dword [edi + 0xb30], 0
mov esi, dword [ebx]
mov ecx, ebx
push 1
push esi
push edi
mov dword [ebp - 0xc80], esi
call fcn.0042a050
push edi
mov ecx, edi
call fcn.0043fda0
cmp esi, dword [ebx]
jge 0x440516
imul ebx, esi, 0x104
mov dword [ebp - 0xc74], ebx
nop
push 0xffffffffffffffff
lea eax, [edi + 0x104]
push eax
lea eax, [ebp - 0xb30]
push 0xa28
push eax
call fcn.004e72b5
add esp, 0x10
lea esi, [ebp - 0xb30]
cmp byte [ebp - 0xb30], 0
je 0x4404f1
movsx eax, byte [edi + 0xb2c]
push eax
push esi
call fcn.004de6e0
mov ebx, eax
add esp, 8
mov dword [ebp - 0xc84], ebx
test ebx, ebx
je 0x4403d0
mov byte [ebx], 0
mov eax, dword [edi + 0xb48]
push esi
mov esi, dword [ebp - 0xc74]
add eax, esi
push eax
push str._s_s
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.004061a0
add esp, 0x14
lea eax, [ebp - 0xc70]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0xc7c], eax
cmp eax, 0xffffffff
je 0x4404d3
lea ebx, [edi + 0xb30]
lea eax, [ebp - 0xc44]
push eax
mov eax, dword [edi + 0xb48]
add eax, esi
push eax
push str._s_s
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.004061a0
xor esi, esi
add esp, 0x14
cmp dword [ebx], esi
jle 0x440486
xor edi, edi
mov eax, dword [ebp - 0xc78]
lea ecx, [ebp - 0x108]
push ecx
mov eax, dword [eax + 0xb34]
add eax, edi
push eax
call fcn.004e2ae3
add esp, 8
test eax, eax
je 0x440480
inc esi
add edi, 0x104
cmp esi, dword [ebx]
jl 0x440453
mov edi, dword [ebp - 0xc78]
mov eax, dword [ebx]
cmp esi, eax
jne 0x4404a6
test byte [ebp - 0xc70], 0x10
jne 0x4404a6
push 1
push eax
lea eax, [ebp - 0x108]
mov ecx, ebx
push eax
call fcn.0042a050
lea eax, [ebp - 0xc70]
push eax
push dword [ebp - 0xc7c]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov esi, dword [ebp - 0xc74]
test eax, eax
jne 0x440422
mov eax, dword [ebp - 0xc7c]
mov ebx, dword [ebp - 0xc84]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
je 0x4404eb
cmp byte [ebx + 1], 0
lea esi, [ebx + 1]
jne 0x4403b0
mov ebx, dword [ebp - 0xc74]
mov eax, dword [ebp - 0xc80]
add ebx, 0x104
inc eax
mov dword [ebp - 0xc74], ebx
mov dword [ebp - 0xc80], eax
cmp eax, dword [edi + 0xb44]
jl 0x440380
mov ecx, dword [ebp - 4]
mov eax, dword [edi + 0xb30]
xor ecx, ebp
pop esi
pop ebx
pop edi
call fcn.004dcc5c
mov esp, ebp
pop ebp
ret 4
Function at 0x440530
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x18c0
call fcn.004dd690
mov eax, dword [0x60aca0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov dword [ebp - 0x18b4], edi
cmp word [edi], 0
jne 0x44056a
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dcc5c
mov esp, ebp
pop ebp
ret 4
cmp word [edi + 0x208], 0
jne 0x440587
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dcc5c
mov esp, ebp
pop ebp
ret 4
cmp byte [ebp + 8], 0
push ebx
push esi
lea ebx, [edi + 0x1670]
je 0x4405a5
mov dword [ebx], 0
mov dword [edi + 0x165c], 0
mov esi, dword [ebx]
mov ecx, ebx
push 1
push esi
push edi
mov dword [ebp - 0x18bc], esi
call fcn.00440130
push edi
mov ecx, edi
call fcn.0043ff60
cmp esi, dword [ebx]
jge 0x440775
imul ebx, esi, 0x208
mov dword [ebp - 0x18b0], ebx
push 0xffffffffffffffff
lea eax, [edi + 0x208]
push eax
lea eax, [ebp - 0x165c]
push 0xa28
push eax
call fcn.004f0686
add esp, 0x10
lea esi, [ebp - 0x165c]
cmp word [ebp - 0x165c], 0
je 0x440750
movzx eax, word [edi + 0x1658]
push eax
push esi
call fcn.004df09a
mov ebx, eax
add esp, 8
mov dword [ebp - 0x18c0], ebx
test ebx, ebx
je 0x440627
xor eax, eax
mov word [ebx], ax
mov eax, dword [edi + 0x1674]
push esi
mov esi, dword [ebp - 0x18b0]
add eax, esi
push eax
push 0x585154
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00440790
add esp, 0x14
lea eax, [ebp - 0x18ac]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x18b8], eax
cmp eax, 0xffffffff
je 0x440731
lea ebx, [edi + 0x165c]
nop dword [eax]
lea eax, [ebp - 0x1880]
push eax
mov eax, dword [edi + 0x1674]
add eax, esi
push eax
push 0x585154
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00440790
xor esi, esi
add esp, 0x14
cmp dword [ebx], esi
jle 0x4406e4
xor edi, edi
mov eax, dword [ebp - 0x18b4]
lea ecx, [ebp - 0x20c]
push ecx
mov eax, dword [eax + 0x1660]
add eax, edi
push eax
call fcn.004f070d
add esp, 8
test eax, eax
je 0x4406de
inc esi
add edi, 0x208
cmp esi, dword [ebx]
jl 0x4406b1
mov edi, dword [ebp - 0x18b4]
mov eax, dword [ebx]
cmp esi, eax
jne 0x440704
test byte [ebp - 0x18ac], 0x10
jne 0x440704
push 1
push eax
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.00440130
lea eax, [ebp - 0x18ac]
push eax
push dword [ebp - 0x18b8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, dword [ebp - 0x18b0]
test eax, eax
jne 0x440680
mov eax, dword [ebp - 0x18b8]
mov ebx, dword [ebp - 0x18c0]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
je 0x44074a
cmp word [ebx + 2], 0
lea esi, [ebx + 2]
jne 0x440605
mov ebx, dword [ebp - 0x18b0]
mov eax, dword [ebp - 0x18bc]
add ebx, 0x208
inc eax
mov dword [ebp - 0x18b0], ebx
mov dword [ebp - 0x18bc], eax
cmp eax, dword [edi + 0x1670]
jl 0x4405d4
mov ecx, dword [ebp - 4]
mov eax, dword [edi + 0x165c]
xor ecx, ebp
pop esi
pop ebx
pop edi
call fcn.004dcc5c
mov esp, ebp
pop ebp
ret 4
Function at 0x440930
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x60aca0]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ebp + 8]
push esi
push edi
push 0xe
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x440b02
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x440b02
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, eax
mov dword [ebp - 0xa0], edx
test edx, edx
je 0x440b02
movaps xmm0, xmmword [0x585180]
lea ecx, [edx + 6]
mov dword [ebp - 0x98], ecx
xor edi, edi
mov ecx, dword [ebp + 0xc]
movups xmmword [ebp - 0x14], xmm0
push ebx
nop
test ecx, ecx
js 0x4409dd
movzx esi, word [edx + 4]
xor eax, eax
test esi, esi
je 0x4409d5
mov ebx, dword [ebp + ecx*4 - 0x14]
add edx, 0xc
movzx ecx, word [edx]
cmp ecx, ebx
jne 0x4409c4
mov dword [ebp + edi*4 - 0x94], eax
inc edi
inc eax
add edx, 0xe
cmp eax, esi
jl 0x4409b5
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xa0]
dec ecx
mov dword [ebp + 0xc], ecx
test edi, edi
je 0x4409a0
test edi, edi
jle 0x440a93
mov esi, dword [ebp + 0x10]
xor ecx, ecx
mov ebx, dword [ebp - 0x98]
mov dword [ebp - 0x9c], 0
nop word [eax + eax]
movzx eax, byte [ebx]
sub eax, esi
cdq
xor eax, edx
sub eax, edx
mov dword [ebp + ecx*4 - 0x54], eax
je 0x440a1c
test esi, esi
je 0x440a1c
inc ecx
add ebx, 0xe
cmp ecx, edi
jl 0x440a00
cmp ecx, edi
jne 0x440a76
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x98], eax
nop word [eax + eax]
mov edx, dword [ebp + eax - 0x54]
lea eax, [ebx*4]
cmp dword [ebp + eax - 0x54], edx
mov esi, dword [ebp - 0x9c]
mov dword [ebp - 0x9c], esi
mov esi, dword [ebp - 0x98]
cmovl esi, eax
mov eax, ebx
cmovge eax, dword [ebp - 0x9c]
inc ebx
mov dword [ebp - 0x9c], eax
mov eax, esi
mov dword [ebp - 0x98], esi
cmp ebx, edi
jl 0x440a30
mov ecx, dword [ebp - 0x9c]
mov eax, dword [ebp + ecx*4 - 0x94]
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [ebp - 0xa0]
movzx eax, word [eax + ecx*2 + 0x12]
jmp 0x440aa3
mov eax, dword [ebp + 0x10]
push 0
push eax
push eax
push 1
push edx
call dword [sym.imp.USER32.dll_LookupIconIdFromDirectoryEx]
push 3
movzx eax, ax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
pop ebx
test esi, esi
je 0x440b02
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x440b02
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x440b02
push 0
push 0
push 0
push 0x30000
push 1
push edi
push eax
call dword [sym.imp.USER32.dll_CreateIconFromResourceEx]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dcc5c
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004dcc5c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4415a0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push 0
push 0
push 3
push 0
push 3
push closesocket
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4415ce
mov eax, 3
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push esi
push 2
call fcn.004e217e
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4415ff
push edi
lea esi, [eax + 3]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 4]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4416e5
cmp esi, dword [ebp - 4]
jne 0x4416e5
push ebx
mov byte [esi + ebx], 0
call fcn.0042d4e0
push str._License_
push ebx
call fcn.004de470
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x441647
mov esi, 4
jmp 0x4416ea
cmp byte [esi + 9], 0x3d
jne 0x44163d
push 0x104
push str.DeskSoft_License
push str._Product_
push ebx
mov byte [esi + 9], 0
call fcn.0042e080
add esp, 0x10
test al, al
je 0x44163d
push 0x104
push 0x6f17d0
push str._Version_
push ebx
call fcn.0042e080
add esp, 0x10
test al, al
je 0x44163d
push 0x104
push 0x6f18d8
push str._ExpDate_
push ebx
call fcn.0042e080
add esp, 0x10
test al, al
je 0x44163d
lea eax, [esi + 0xa]
push eax
push ebx
call fcn.0042e940
neg eax
push str.DesktopPlant
sbb esi, esi
push str.DeskSoft_License
and esi, 2
call fcn.004de470
add esp, 0x10
test eax, eax
je 0x4416ea
push str.DesktopPlant
push 0x104
push str.DeskSoft_License
call fcn.004e2189
add esp, 0xc
jmp 0x4416ea
mov esi, 3
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.004e21e3
add esp, 4
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4422d0
Capabilities:
Create thread

Disassembly:
push 0
push 0x118
push 0x6f1bf8
push 0xffffffffffffffff
push str._DFC_UpdateCheck
call fcn.00418fe0
mov eax, dword [0x6f1d0c]
add esp, 0x14
test eax, eax
jne 0x4422fd
mov byte [0x6f1d09], 1
jmp 0x442302
cmp eax, 7
jg 0x44230c
mov dword [0x6f1d0c], 7
cmp byte [0x6f1d09], 0
je 0x442350
push 0
call fcn.004e7196
add esp, 4
sub eax, dword [0x6f1d00]
mov ecx, eax
sbb edx, dword [0x6f1d04]
call fcn.004dd980
movd xmm1, dword [0x6f1d0c]
cvtdq2pd xmm1, xmm1
mulsd xmm1, qword [0x5f7660]
comisd xmm0, xmm1
ja fcn.00442210
ret

Function at 0x442700
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0x120
push 0x6f1d10
push 0xffffffffffffffff
push str._DFC_Archive
call fcn.00418fe0
add esp, 0x14
cmp dword [0x6f1e24], 1
jge 0x442732
mov dword [0x6f1e24], 0xe
cmp dword [0x6f1e28], 1
jge 0x442745
mov dword [0x6f1e28], 0x1e
cmp byte [0x6f1e20], 0
je 0x4427d4
push 0
call fcn.004e7196
add esp, 4
sub eax, dword [0x6f1e18]
mov ecx, eax
sbb edx, dword [0x6f1e1c]
call fcn.004dd980
movd xmm2, dword [0x6f1e24]
cvtdq2pd xmm2, xmm2
mulsd xmm2, qword [0x5f7588]
mulsd xmm2, qword [0x5817b8]
mulsd xmm2, qword [0x5817b8]
comisd xmm0, xmm2
jbe 0x4427d4
cmp byte [0x6f1e31], 0
jne 0x4427d4
lea eax, [ebp - 4]
mov byte [0x6f1e31], 1
push eax
push 0
push 0
push fcn.004427e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x4427cd
mov byte [0x6f1e31], al
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x443870
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
xor eax, eax
xor esi, esi
push edi
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], eax
je 0x4439e5
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4439e5
mov ecx, dword [edi]
test ecx, ecx
je 0x4439e5
add ecx, 2
mov eax, 0x55555556
imul ecx
mov eax, 0x6bca1af3
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
shl ecx, 2
imul ecx
add ecx, 2
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
push ebx
lea eax, [ecx + eax*2]
push eax
call fcn.004e21fe
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4439da
mov edi, dword [edi]
test edi, edi
jle 0x4439d3
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
not dword [ebp - 0xc]
mov dword [ebp - 0x14], 0xfffffffe
sub dword [ebp - 0x14], ecx
lea edx, [ecx + 2]
mov dword [ebp - 8], 2
mov eax, dword [ebp - 0xc]
xor cl, cl
mov ch, byte [edx - 2]
add eax, edx
cmp eax, edi
mov byte [ebp + 0xb], 0
mov eax, dword [ebp - 8]
jge 0x443926
mov cl, byte [edx - 1]
mov byte [ebp + 0xb], cl
xor cl, cl
cmp eax, edi
jge 0x443926
mov cl, byte [edx]
mov ah, byte [ebp + 0xb]
mov al, cl
and ah, 0xf
shr al, 6
shl ah, 2
and cl, 0x3f
or ah, al
mov byte [ebp - 2], cl
mov byte [ebp - 1], ah
movzx eax, ch
and ch, 3
shr eax, 2
shl ch, 4
movzx ecx, ch
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx + esi], al
movzx eax, byte [ebp + 0xb]
shr eax, 4
or ecx, eax
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx + esi + 1], al
mov eax, dword [ebp - 0xc]
add eax, edx
cmp eax, edi
jge 0x44397f
movzx eax, byte [ebp - 1]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x443981
mov al, 0x3d
mov byte [esi + ebx + 2], al
cmp dword [ebp - 8], edi
jge 0x443996
movzx eax, byte [ebp - 2]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x443998
mov al, 0x3d
mov ecx, dword [ebp - 0x10]
inc ecx
mov byte [ebx + esi + 3], al
mov dword [ebp - 0x10], ecx
cmp ecx, 0x13
jne 0x4439b7
mov word [ebx + esi + 4], 0xa0d
add esi, 2
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
add edx, 3
add dword [ebp - 8], 3
add esi, 4
mov edi, dword [eax]
mov eax, dword [ebp - 0x14]
add eax, edx
cmp eax, edi
jl 0x443903
mov edi, dword [ebp + 0xc]
mov byte [ebx + esi], 0
mov eax, ebx
mov dword [edi], esi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret