joyce8/EMBER2024-capa huggingface dataset:
Function at 0x912d39
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg edx, edi
jmp 0x912d7a
xchg dword [esp + 0xa], eax
pop ebx
adc eax, ecx
mov ah, byte [esp + 1]
lea esp, [esp + 3]
jmp 0x912da6
bsr ax, ax
not edi
bt esi, edi
push si
mov cx, word [esp + 0x12]
mov esi, dword [esp + 0xb]
jmp 0x912d64
bsr bp, ax
xchg dword [esp + 7], ebx
pop dword [esp + 2]
dec ebx
pop dword [esp]
jmp 0x912dde
cmp ebx, 0x9b31b2e5
neg ch
lea esi, reloc.WINMM.dll_midiStreamOut
neg si
mov bx, word [esp + 0xb]
jmp 0x912d90
cpuid
setb al
mov word [esp + 1], ax
lea esp, [esp + 2]
xchg ebx, esi
mov dh, 0xac
jmp 0x912e1f
mov dh, 0x35
not edi
mov edx, 0xbeb4b133
pop bx
lea ebp, [ecx + esi]
dec dx
jmp 0x912e5b
xchg word [esp], si
cmp edx, esi
bswap ebp
rcr bp, 0
bts eax, edi
mov bh, ch
jmp 0x912df9
mov edi, 0xdf6b2927
mov al, 0xe2
mov esi, 0xa4210d6b
cld
mov ah, dl
setae bl
jmp 0x912e8f
btc bp, di
lea edi, [edi*4]
lea ebx, reloc.WINMM.dll_midiStreamOut
cmc
btr dx, si
lea edx, reloc.WINMM.dll_midiStreamOut
jmp 0x912e32
xchg dx, di
setnp ah
rcl eax, 0xf
cld
jmp 0x912f33
stc
rdtsc
bsr edx, edx
setg bl
xchg dx, ax
clc
jmp 0x912e79
mov al, 0xd5
mov bl, cl
bt di, dx
lea ebx, [edi + 0xde]
jmp 0x912f0e
neg edx
mov eax, dword [esp]
mov dx, di
mov edi, esp
mov dx, 0xe510
rdtsc
jmp 0x912ee6
mov eax, 0xd7e66255
mov edx, 0x314f1e4d
bswap ebp
cmp edx, 0x4c81473e
mov ecx, esi
dec dh
jmp 0x912fb8
lea esi, [eax*4]
mov dh, byte [esp]
btr si, bp
btr ebp, esi
mov ebx, esp
mov eax, dword [esp]
jmp 0x912efc
mov cx, word [esp + 9]
pop word [esp + 0xc]
jmp 0x912fa1
mov bx, word [esp + 8]
pop dword [esp]
mov cl, ch
pop dword [esp + 5]
jmp 0x912f4b
pop edx
mov ecx, dword [esp + 0x10]
xchg dword [esp + 0xf], edi
xchg esi, edi
push dword [esp + 4]
xchg edi, ecx
jmp 0x912f61
sub ax, bx
lea edi, reloc.WINMM.dll_midiStreamOut
sub esp, 0x11
mov bp, bx
jmp 0x912fe4
lea eax, [esi*4]
mov dh, byte [esp + 3]
pop dword [esp + 3]
jmp 0x912f8b
mov ch, 0xa5
xchg ebp, esi
sub esp, 0x1b
mov eax, dword [esp + 0x11]
xchg dword [esp + 0xa], esi
mov word [esp + 0x10], dx
jmp 0x912f78
mov bl, bh
xchg dh, cl
mov dl, 0x3e
call fcn.00912fce
add esp, 5
bswap edx
setae dl
lea edi, [ecx + ecx]
inc dl
jmp 0x913007
mov esi, dword [esp + 2]
cld
neg ebp
pop word [esp]
push ax
xchg cx, dx
jmp 0x9130ec
rdtsc
mov bp, ax
mov cx, 0x67bd
mov byte [esp + 1], cl
add esp, 3
lea esp, [esp]
mov ebx, eax
xchg byte [esp], ch
mov dh, al
jmp 0x913057

Function at 0x91309a
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap eax
pop bx
bsf di, bx
xchg word [esp + 0x20], ax
cmc
jmp 0x9130c0
bsr eax, ecx
mov dx, word [esp]
pushfd
neg bx
mov di, 0x6968
pushal
jmp 0x91306c
pop word [esp]
xchg dh, bh
xchg bp, si
rdtsc
bsr edx, edx
jmp 0x913082
mov edi, dword [esp + 0x17]
Function at 0x913199
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0xc
bswap ebx
mov edx, dword [esp + 0xe]
mov bl, byte [esp + 6]
jmp 0x9131e1
lea ecx, [esp + ecx]
mov bp, word [esp + 0x16]
push word [esp]
push word [esp + 5]
jmp 0x9131f2
mov ah, 0x4a
pushfd
bswap eax
mov edi, dword [esp + 0x10]
xchg al, bh
shl dx, 0xf
jmp 0x9131c5
lea edx, [esi*4]
popal
lea ebp, reloc.WINMM.dll_midiStreamOut
mov bh, 0x90
mov cx, word [esp]
lea ebx, [ebp*4]
jmp 0x913236
mov di, 0x795e
btc ax, ax
xchg bp, ax
lea ebx, reloc.WINMM.dll_midiStreamOut
mov ch, al
stc
jmp 0x91321b

Function at 0x913536
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
add bx, 0x3a25
xchg dword [esp + 4], ebx
jmp 0x913579
mov si, 0x96
mov word [esp], dx
push dword [esp]
cpuid
lea edi, [ebx + ebx]
jmp 0x9135cb
lea ecx, reloc.WINMM.dll_midiStreamOut
xchg dword [esp], ecx
mov di, 0x3c4f
xchg dword [esp + 1], edx
dec di
mov dword [esp + 2], ebx
jmp 0x913563
mov cl, 1
bswap ecx
mov dl, 0x87
mov ch, 0x84
lea ecx, reloc.WINMM.dll_midiStreamOut
jmp 0x9135f6
mov dx, 0xc658
sub esp, 0xe
bts edx, ebp
mov bp, word [esp + 0x17]
sub esp, 5
push esi
jmp 0x9135b5
mov byte [esp + 6], al
std
mov edi, esi
cpuid
xchg byte [esp + 9], bh
pop bp
jmp 0x91363b
mov eax, dword [esp + 1]
mov ebp, 0xd4f0ce71
setns ch
pop bp
bsr di, dx
jmp 0x9135e0
sbb edx, eax
mov si, 0xe08c
mov dx, word [esp + 4]
setg bh
pop ecx
jmp 0x9136d3
mov edi, dword [esp]
dec dl
cpuid
lea eax, [ecx*4]
mov eax, 0x9a30c8e5
pop word [esp + 0x1a]
jmp 0x913625
pop word [esp + 0x26]
sub esp, 5
xchg word [esp + 8], bx
mov dl, 0xad
pop bp
rdtsc
jmp 0x91367a
ror si, 7
xchg dword [esp + 0xa], ebp
pop dx
mov ecx, 0x9b50a792
sub esp, 0x16
bswap edi
jmp 0x9136a4
Function at 0x916970
Capabilities:
Execute anti-debugging instructions

Disassembly:
btr si, dx
xchg dl, dh
xchg dh, bl
push ebp
mov eax, dword [esp + 2]
setb cl
jmp 0x916925
lea esp, [esp]
pushal
lea esp, [esp + 2]
lea esp, [esp + 0x20]
pushal
lea esi, reloc.WINMM.dll_midiStreamOut
jmp 0x9168fa
mov ecx, dword [esp]
inc ebp
adc bp, si
xchg word [esp + 1], dx
cmc
pop ecx
jmp 0x916939
mov cl, byte [esp]
lea edx, [eax - 0xbb]
mov dh, 0xab
sub esp, 6
jmp 0x91698b
call 0x916970
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x69685320
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
and byte [esi + 0x32], dh
xor al, 0x2e
xor byte [esi], ch
xor byte [eax], al
pushfd
push cx
jmp 0x916910
dec ebx
lea esp, [esp + 3]
sub esp, 0x15
lea esp, [esp + 0x10]
pop edi
rdtsc
jmp 0x916a31
mov eax, dword [esp + 3]
bswap edx
mov cl, ch
and edi, eax
pop word [esp + 1]
xchg edi, ebx
jmp 0x916975
pop cx
sub esp, 0x1c
setp cl
mov word [esp + 0xa], cx
jmp 0x9169de
lea ecx, [esi*4]
not ax
rdtsc
mov esi, esp
bsf edi, esi
xchg word [esp], bx
jmp 0x9169b1
push word [esp + 0x16]
mov word [esp + 0xe], si
cld
mov dh, 0xf1
neg ax
mov ecx, dword [esp + 1]
jmp 0x916a19
rol bx, cl
lea ebp, [ebp*4]
not al
mov byte [esp], bh
mov bh, byte [esp]
xchg bx, ax
jmp 0x9169c7
mov dword [esp + 0x14], ecx
mov byte [esp + 0xf], dh
stc
pushfd
pushfd
not cl
jmp 0x916a64
rdtsc
setae dh
std
mov byte [esp], ah
std
bsf eax, edx
jmp 0x916a02
pop si
mov dword [esp + 3], edi
not si
rcr ch, cl
mov dl, byte [esp + 0x25]
add esp, 0x25
jmp 0x916a87
cld
cld
std
push di
bts ax, sp
not bh
jmp 0x916a40
xchg cl, ch
push ebx
setne bh
mov cl, 0xb7
pushfd
xor esi, esp
jmp 0x916a99
mov al, 0x51
stc
btr ebx, ebp
bsr si, di
lea edi, [eax - 0x48]
setp bh
jmp 0x916a71
lea esp, [esp + 1]
mov dl, bh
pushfd
push dword [esp + 9]
cld
xchg dword [esp + 8], ecx
jmp 0x916b17
inc ecx
pop cx
mov al, byte [esp + 2]
ror ebp, 5
call fcn.00916ae9
rcl bp, 2
pop cx
bswap ecx
bsf cx, di
mov bx, word [esp]
adc ah, al
jmp 0x916b85
rdtsc
rol cx, cl
bsr bp, bp
lea edx, [ebp*4]
inc cl
mov edi, eax
call fcn.00916b60
pop ebx
pop ebp
bsr ebx, edx
mov byte [esp + 1], dh
lea esi, [esi + ebp]
cld
jmp 0x916bfa
push dword [esp + 0xb]
pushfd
shl bl, 2
call fcn.00916c94
xchg edi, eax
adc al, byte [eax + 0x1bfb12e7]
xchg edi, eax
pop es
bound edx, qword [ecx + 0x54258a7d]
invalid
bswap ebp
push dword [esp + 0xb]
mov dl, byte [esp + 0xc]
add esp, 7
mov byte [esp + 9], bh
bts ecx, ecx
jmp 0x916bdb
Function at 0x916cda
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0x11]
bt cx, cx
xchg bp, si
add esp, 0x12
std
mov ah, dl
jmp 0x916af4
mov word [esp + 0xb], bx
xchg byte [esp + 8], al
jmp 0x916ac9
cpuid
lea edx, [esi*4]
mov dword [esp], ebx
pop word [esp]
bts cx, cx
cpuid
jmp 0x916cca
pop cx
lea ebx, reloc.WINMM.dll_midiStreamOut
rol cl, cl
dec edi
call fcn.00916bce
mov dword [esp + 3], eax
mov bl, byte [esp + 3]
mov dx, word [esp + 8]
bt bp, dx
setns dh
jmp 0x916d1b
mov edx, 0xf11c7e54
mov eax, 0x1ad1f24
pop eax
mov dl, 0x21
xchg si, ax
jmp 0x916d2e
push di
setg dl
xchg dx, ax
lea eax, [edi*4]
xchg bl, dl
std
jmp 0x916d05
not di
lea edi, [ebx*4]
mov dx, ax
pop word [esp + 2]
not cx
jmp 0x916d8e
mov word [esp], cx
pop ebx
setl bh
bswap ecx
xchg byte [esp], al
jmp 0x916dba
mov ch, 0x3f
rdtsc
xchg ah, cl
xchg bh, cl
rdtsc
btr ax, si
jmp 0x916d53
mov dword [esp + 1], esi
btc di, bx
xchg bh, bl
pop dword [esp]
mov dl, byte [esp + 3]
lea esp, [esp]
jmp 0x916d69
std
mov esi, 0xd63dd786
xchg byte [esp], ah
pushal
xchg edx, edi
xchg byte [esp + 0x16], ah
call fcn.00916dea
inc eax
lea edi, reloc.WINMM.dll_midiStreamOut
lea ebp, [edx*4]
mov cl, byte [esp]
mov edi, dword [esp]
add esp, 0
mov eax, ecx
jmp 0x916da4

Function at 0x916ed9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bl, ch
add dx, bp
lea esi, [ebx + ebx]
mov ebx, ebp
xchg ecx, eax
rdtsc
jmp 0x916eff
lea ecx, [esp + 0xd4]
inc cl
rdtsc
bswap eax
add esp, 3
mov byte [esp], al
jmp 0x916ea8
pop word [esp]
jmp 0x916ebe
xchg ebp, edx
mov ecx, 0xbab90f65
call fcn.00916edf
mov dword [esp + 3], edx
pop ecx
std
mov ch, byte [esp + 5]
neg ch
lea edx, [esp + esi]
jmp 0x916f73
mov ah, 0x71
xchg byte [esp + 4], ch
mov cl, byte [esp + 1]
bsf edi, ebp
pop eax
jmp 0x916fc4
not ebp
inc edi
not ch
mov bh, cl
cpuid
bswap edi
jmp 0x916f46
mov al, ah
inc dh
mov ah, byte [esp + 2]
xchg dx, ax
mov byte [esp + 7], ch
add esp, 0
jmp 0x916f5c
bswap eax
bswap eax
mov ax, word [esp + 0x10]
dec al
call int.00916fd6
rol dword [eax + reloc.WINMM.dll_midiStreamOut], 0xff
je 0x916fc4
push dword [esp + 2]
xchg word [esp], dx
add ah, byte [esi - 0x79]
adc al, 0x24
rdtsc
mov ah, byte [esp + 4]
push dword [esp + 0xc]
cmc
jmp 0x916f87
mov ah, byte [esp + 4]
xchg dword [esp], ebx
std
mov ah, 0x82
push word [esp + 7]
push ecx
jmp 0x916f9d

Function at 0x917082
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [esp + 3]
cpuid
mov eax, esp
mov ebp, 0x7626b082
jmp 0x917058
rdtsc
xchg cl, dh
xchg al, dl
push dword [esp]
mov bx, bp
mov bx, sp
jmp 0x917031
push word [esp + 8]
xchg word [esp + 2], cx
sub esp, 0x1f
not ax
rdtsc
push dx
jmp 0x917094
std
or ebx, 0x5d573977
mov word [esp], ax
lea ecx, [ecx + edi]
neg edi
jmp 0x917047
sub esp, 0x1e
lea esp, [esp + 0x4a]
bswap edi
mov ebp, dword [esp]
mov cl, byte [esp]
bswap ecx
jmp 0x91711d
add esp, 1
xchg edi, esi
lea esp, [esp + 1]
lea edx, [edx*4]
btc si, si
mov dx, 0x9b62
jmp 0x9170c3
xchg si, bp
not edi
pushfd
add esp, 1
cld
neg ecx
jmp 0x9170e5
Function at 0x917206
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [ebp*4]
xchg byte [esp + 0xe], cl
jmp 0x917233
bsr di, bp
mov dx, word [esp + 0xb]
xchg dword [esp + 8], edi
shl bh, 0
mov dword [esp], eax
sub esp, 0x11
jmp 0x9172ce
xchg dword [esp + 3], ebx
pop dword [esp]
rdtsc
mov bx, cx
lea ebp, reloc.WINMM.dll_midiStreamOut
neg ch
jmp 0x9172b2
cmp ebp, edi
mov bh, 0x2b
rdtsc
mov eax, dword [esp + 9]
pop dword [esp + 3]
cmc
jmp 0x917270
push word [esp + 1]
sub esp, 7
xchg dword [esp + 3], edx
mov ax, di
jmp 0x9172f6
shl ebp, cl
push dword [esp + 3]
and al, 0x31
lea esi, reloc.WINMM.dll_midiStreamOut
lea esp, [esp + 2]
pop dword [esp]
jmp 0x91729c
pop eax
bt edi, ecx
seto dl
add esp, 0xf
xchg dword [esp + 8], ebx
mov cl, bh
jmp 0x91728b
mov bx, word [esp + 9]
rcl si, 9
mov dword [esp + 1], ecx
jmp 0x917322
sbb dh, 0x38
neg dx
rcl ch, cl
xor ax, 0x79fc
xchg cx, di
xchg word [esp + 2], cx
jmp 0x9172e0
lea esi, [esi + 0xb9]
mov di, word [esp + 3]
cld
bsf esi, eax
jmp 0x917377
mov byte [esp + 4], dh
pop si
lea ebp, [esi*4]
jmp 0x91730c
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x63c7304d
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x977236b
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x41b570
Capabilities:
Allocate thread local storage
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x3c], 0x38
mov dword [ebp - 0x40], 0x4a
mov dword [ebp - 0x44], 0x2c
mov dword [ebp - 0x1c], 0x13
mov dword [ebp - 0x20], 0x54
mov dword [ebp - 0x48], 0x25
mov dword [ebp - 0x28], 0x10
mov dword [ebp - 0x4c], 0x50
mov dword [ebp - 0x50], 0x26
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x54], 0x4f
mov dword [ebp - 0x18], 0x31
mov dword [ebp - 0x2c], 0x5d
mov dword [ebp - 0x58], 0x27
mov dword [ebp - 4], 0x26
mov dword [ebp - 0x14], 0x27
mov dword [ebp - 0x5c], 0x5f
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x60], 0x5b
mov dword [ebp - 0x34], 0x1f
mov dword [ebp - 0xc], 0x22
mov dword [ebp - 0x10], 0x30
mov dword [ebp - 8], 0x1c
mov dword [ebp - 0x38], 0x39
mov dword [ebp - 0x64], 0x2e
mov eax, dword [ebp - 8]
add eax, 0x59
mov dword [ebp - 8], eax
cmp dword [ebp - 0x18], 0xd
jge 0x41b679
cmp dword [ebp - 0xc], 0x4a
jge 0x41b673
call dword [sym.imp.USER32.dll_GetSysColor]
cmp dword [ebp - 0xc], 5
je 0x41b673
cmp dword [ebp - 4], 0xa
jge 0x41b673
cmp dword [ebp - 0x24], 0x22
jle 0x41b673
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp dword [ebp - 0xc], 0x34
jne 0x41b673
cmp dword [ebp - 0x28], 0x1e
jge 0x41b66d
mov ecx, dword [ebp - 8]
or ecx, 0x53
mov dword [ebp - 8], ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
cmp dword [ebp - 0x10], 0x42
jge 0x41b688
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x10]
or eax, 0x40
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 4], 0x25
jne 0x41b6e5
cmp dword [ebp - 4], 0x12
jne 0x41b6e5
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
cmp dword [ebp - 0x2c], 3
jle 0x41b6df
cmp dword [ebp - 0x30], 0x30
jne 0x41b6df
cmp dword [ebp - 0x18], 0x2e
je 0x41b6df
cmp dword [ebp - 0xc], 0x2a
jle 0x41b6df
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x34], 0x2b
je 0x41b6d9
mov edx, dword [ebp - 0x20]
xor edx, 0x49
mov dword [ebp - 0x20], edx
call dword [sym.imp.USER32.dll_SetWindowPos]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp - 0x14], 0x28
jl 0x41b688
cmp dword [ebp - 0x38], 0x3e
jle 0x41b706
cmp dword [ebp - 0x18], 7
jge 0x41b700
mov eax, dword [ebp - 4]
and eax, 0x11
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov esp, ebp
pop ebp
ret
Function at 0x41c0d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x44], 5
mov dword [ebp - 0x48], 0x3e
mov dword [ebp - 0x20], 0x2d
mov dword [ebp - 0xc], 0x3e
mov dword [ebp - 4], 0x26
mov dword [ebp - 0x4c], 0x10
mov dword [ebp - 0x10], 0x49
mov dword [ebp - 0x14], 0x10
mov dword [ebp - 0x30], 0x5f
mov dword [ebp - 0x38], 0x45
mov dword [ebp - 8], 0x1e
mov dword [ebp - 0x50], 0xc
mov dword [ebp - 0x34], 0x50
mov dword [ebp - 0x54], 0x56
mov dword [ebp - 0x58], 0x16
mov dword [ebp - 0x24], 0x43
mov dword [ebp - 0x5c], 0x5a
mov dword [ebp - 0x3c], 0x14
mov dword [ebp - 0x18], 0x3d
mov dword [ebp - 0x60], 0x62
mov dword [ebp - 0x28], 0x51
mov dword [ebp - 0x40], 0x52
mov dword [ebp - 0x64], 3
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x68], 0x12
call fcn.004231b0
cmp dword [ebp - 0x10], 0x4a
jge 0x41c1cb
cmp dword [ebp - 0xc], 0x3a
jne 0x41c19f
mov eax, dword [ebp - 0xc]
or eax, 0x4e
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x14], 0x44
je 0x41c1c9
cmp dword [ebp + 0x10], 0x35
jne 0x41c1c9
cmp dword [ebp - 0x20], 0x5f
jle 0x41c1c9
cmp dword [ebp - 0x14], 0x42
jne 0x41c1c9
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
jmp 0x41c18a
cmp dword [ebp - 8], 0x1f
jge 0x41c212
cmp dword [ebp + 0x10], 0xe
jle 0x41c1fe
cmp dword [ebp - 0x30], 0x2d
jle 0x41c1fe
cmp dword [ebp + 8], 0x1c
je 0x41c1fe
cmp dword [ebp - 0x34], 0x64
jle 0x41c1fe
cmp dword [ebp - 0x38], 0x52
jne 0x41c1fe
cmp dword [ebp - 0x20], 0xf
jle 0x41c1fe
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
xor edx, 0x14
mov dword [ebp - 4], edx
jmp 0x41c1cb
cmp dword [ebp - 0x18], 0x3e
jge 0x41c241
cmp dword [ebp - 0x14], 7
jle 0x41c227
mov eax, dword [ebp - 0x28]
xor eax, 0x26
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 8], 0x4d
jge 0x41c23f
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x41c212
mov dword [ebp - 0x1c], 0
jmp 0x41c253
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x3c]
sub ecx, 0x13
cmp dword [ebp - 0x1c], ecx
jge 0x41c27b
cmp dword [ebp - 0x40], 0x41
jge 0x41c279
cmp dword [ebp + 8], 0x2f
jle 0x41c279
cmp dword [ebp - 0x20], 0x1e
je 0x41c279
mov edx, dword [ebp - 0x2c]
add edx, 0x42
mov dword [ebp - 0x2c], edx
jmp 0x41c24a
mov esp, ebp
pop ebp
ret
Function at 0x41c3c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0xc], 0x44
mov dword [ebp - 0x44], 0x17
mov dword [ebp - 0x30], 0x36
mov dword [ebp - 0x28], 0x34
mov dword [ebp - 0x48], 0x4a
mov dword [ebp - 0x4c], 0x45
mov dword [ebp - 0x20], 0x5a
mov dword [ebp - 0x3c], 0x4e
mov dword [ebp - 0x50], 8
mov dword [ebp - 0x54], 0x40
mov dword [ebp - 0x58], 0x37
mov dword [ebp - 0x5c], 0x1f
mov dword [ebp - 0x1c], 0x1a
mov dword [ebp - 0x24], 0x58
mov dword [ebp - 0x60], 0x28
mov dword [ebp - 0x2c], 0x30
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x64], 0x23
mov dword [ebp - 0x38], 0x14
mov dword [ebp - 0x18], 0x27
mov dword [ebp - 0x68], 0x15
mov dword [ebp - 0x34], 0x14
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x40], 0x4d
mov dword [ebp - 0x10], 0
jmp 0x41c480
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x2c]
sub ecx, 0x2f
cmp dword [ebp - 0x10], ecx
jge 0x41c4ae
cmp dword [ebp - 0xc], 0x2e
jne 0x41c4ac
cmp dword [ebp - 4], 0x32
jle 0x41c4ac
cmp dword [ebp - 4], 0x4f
je 0x41c4a6
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x41c477
mov dword [ebp - 0x14], 0
jmp 0x41c4c0
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x30]
sub ecx, 0x35
cmp dword [ebp - 0x14], ecx
jge 0x41c4d6
mov edx, dword [ebp - 8]
add edx, 0x5a
mov dword [ebp - 8], edx
jmp 0x41c4b7
cmp dword [ebp - 0x1c], 0x1b
jge 0x41c547
cmp dword [ebp - 0x34], 0x57
je 0x41c51b
cmp dword [ebp - 0x38], 0x62
jle 0x41c51b
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
cmp dword [ebp - 0x18], 0x19
jne 0x41c51b
cmp dword [ebp - 0x20], 0x4c
jge 0x41c515
cmp dword [ebp - 0x3c], 0x50
jne 0x41c515
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
call dword [sym.imp.USER32.dll_GetCursorPos]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 8], 0x1f
jne 0x41c545
cmp dword [ebp - 8], 0x14
jge 0x41c545
call dword [sym.imp.USER32.dll_FrameRect]
mov edx, dword [ebp - 0x24]
sub edx, 0x5b
mov dword [ebp - 0x24], edx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
jmp 0x41c4d6
cmp dword [ebp - 0xc], 0x45
jge 0x41c576
mov eax, dword [ebp - 0x28]
xor eax, 0x55
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0x40], 0x35
jne 0x41c574
call dword [sym.imp.SHELL32.dll_DragAcceptFiles]
mov edx, dword [ebp - 0x20]
or edx, 0x35
mov dword [ebp - 0x20], edx
jmp 0x41c547
mov esp, ebp
pop ebp
ret
Function at 0x41c770
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 0x24], 0x13
mov dword [ebp - 0x28], 0x24
mov dword [ebp - 0x2c], 0x56
mov dword [ebp - 0x30], 5
mov dword [ebp - 0x34], 0x40
mov dword [ebp - 0x38], 0x35
mov dword [ebp - 0x3c], 0x15
mov dword [ebp - 0x18], 8
mov dword [ebp - 0x40], 0xb
mov dword [ebp - 0x44], 0x15
mov dword [ebp - 0x14], 0x41
mov dword [ebp - 0x48], 0x25
mov dword [ebp - 0x4c], 0x1b
mov dword [ebp - 0x50], 0x10
mov dword [ebp - 0x1c], 0x32
mov dword [ebp - 0x54], 0x4f
mov dword [ebp - 0x58], 0x34
mov dword [ebp - 4], 0x3d
mov dword [ebp - 8], 0xe
mov dword [ebp - 0x20], 0x38
mov dword [ebp - 0x5c], 0x57
mov dword [ebp - 0x10], 0x37
mov dword [ebp - 0x60], 0xf
cmp dword [ebp - 8], 0xf
jge 0x41c83a
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
or edx, 0x41
mov dword [ebp - 4], edx
jmp 0x41c817
mov dword [ebp - 0xc], 0
jmp 0x41c84c
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x40
cmp dword [ebp - 0xc], ecx
jge 0x41c87a
cmp dword [ebp - 0x18], 0x49
jge 0x41c878
cmp dword [ebp - 0x1c], 0x30
jne 0x41c878
cmp dword [ebp - 0x20], 0x56
jge 0x41c878
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp - 4]
or edx, 3
mov dword [ebp - 4], edx
jmp 0x41c843
mov eax, dword [ebp - 0x10]
sub eax, 0x24
push eax
call fcn.0041c3c0
add esp, 4
mov esp, ebp
pop ebp
ret