joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4051d2
Capabilities:
Gather cuteftp information

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 0xc]
call fcn.00401e6a
mov dword [ebp - 4], eax
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp - 4]
call fcn.00401db1
push eax
push reloc.shlwapi.dll_PathIsUNCServerShareW
push eax
push dword [ebp + 8]
call fcn.0040509b
call fcn.00401871
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp - 4]
call fcn.00401db1
push eax
push reloc.shlwapi.dll_PathIsUNCServerShareW
push eax
push dword [ebp + 8]
call fcn.0040509b
call fcn.00401871
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp - 4]
call fcn.00401db1
push eax
push reloc.shlwapi.dll_PathIsUNCServerShareW
push eax
push dword [ebp + 8]
call fcn.0040509b
call fcn.00401871
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp - 4]
call fcn.00401db1
push eax
push reloc.shlwapi.dll_PathIsUNCServerShareW
push eax
push dword [ebp + 8]
call fcn.0040509b
call fcn.00401871
push dword [ebp - 4]
call fcn.00401871
leave
ret 8

Function at 0x405885
Capabilities:
Gather filezilla information

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
push reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_ChrCmpIA
push reloc.shlwapi.dll_PathCanonicalizeA
push reloc.shlwapi.dll_SHRegGetBoolUSValueA
push reloc.shlwapi.dll_SHRegDeleteUSValueW
push reloc.shlwapi.dll_PathIsRelativeA
push reloc.shlwapi.dll_SHRegGetBoolUSValueA
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405725
push reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_ChrCmpIA
push reloc.shlwapi.dll_SHRegGetBoolUSValueA
push reloc.shlwapi.dll_ChrCmpIA
push reloc.shlwapi.dll_ChrCmpIA
push reloc.shlwapi.dll_ChrCmpIA
push reloc.shlwapi.dll_ChrCmpIA
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405725
push reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_SHRegSetUSValueW
push reloc.shlwapi.dll_SHRegSetUSValueW
push reloc.shlwapi.dll_SHRegSetUSValueW
push reloc.shlwapi.dll_SHRegSetUSValueW
push reloc.shlwapi.dll_SHRegSetUSValueW
push reloc.shlwapi.dll_SHRegSetUSValueW
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405725
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [reloc.gdi32.dll_SwapBuffers]
call fcn.0041104e
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00411054
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
push reloc.gdi32.dll_SetMetaFileBitsEx
push dword [ebp + 0xc]
call fcn.00401db1
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401e05
mov dword [ebp - 0x810], eax
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00405885
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
inc dword [ebp - 8]
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 4]
call fcn.00411048
leave
ret 8
Function at 0x4060d3
Capabilities:
Gather direct-ftp information

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [reloc.gdi32.dll_SwapBuffers]
call fcn.0041104e
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00411054
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
push reloc.gdi32.dll_SetMetaFileBitsEx
push dword [ebp + 0xc]
call fcn.00401db1
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401db1
mov dword [ebp - 0x810], eax
call fcn.00401871
push 0
push reloc.shlwapi.dll_SHRegGetBoolUSValueA
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [reloc.gdi32.dll_SwapBuffers]
call fcn.00401d2a
mov dword [ebp - 0x81c], eax
push 0
push reloc.shlwapi.dll_PathIsRelativeA
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [reloc.gdi32.dll_SwapBuffers]
call fcn.00401d2a
mov dword [ebp - 0x814], eax
push 0
push reloc.shlwapi.dll_SHRegGetBoolUSValueA
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [reloc.gdi32.dll_SwapBuffers]
call fcn.00401d2a
mov dword [ebp - 0x820], eax
push 0
push reloc.shlwapi.dll_SHRegDeleteUSValueW
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [reloc.gdi32.dll_SwapBuffers]
call fcn.00401d2a
mov dword [ebp - 0x818], eax
push 0
push reloc.shlwapi.dll_PathIsRelativeA
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [reloc.gdi32.dll_SwapBuffers]
call fcn.00401d2a
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x81c], 0
je reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 0x814], 0
je reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 0x818], 0
je reloc.gdi32.dll_SetWorldTransform
push reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.004060d3
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
inc dword [ebp - 8]
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 4]
call fcn.00411048
leave
ret 8
Function at 0x407296
Capabilities:
Gather fling-ftp information

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0041104e
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00411054
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
push reloc.gdi32.dll_SetMetaFileBitsEx
push dword [ebp + 0x10]
call fcn.00401db1
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401db1
mov dword [ebp - 0x810], eax
call fcn.00401871
push 0
push reloc.shlwapi.dll_PathRemoveExtensionA
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x81c], eax
push 0
push reloc.shlwapi.dll_PathBuildRootA
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x820], eax
push 0
push reloc.shlwapi.dll_PathRemoveExtensionA
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x814], eax
push 0
push reloc.shlwapi.dll_PathRemoveExtensionA
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x818], eax
push 0
push reloc.shlwapi.dll_PathRemoveExtensionA
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x81c], 0
jne reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 0x820], 0
je reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 0x814], 0
je reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 0x818], 0
je reloc.gdi32.dll_SetWorldTransform
push reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407296
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
inc dword [ebp - 8]
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 4]
call fcn.00411048
leave
ret 0xc
Function at 0x407685
Capabilities:
Gather direct-ftp information

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 0xc]
call fcn.00401e6a
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
je reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.00401e05
mov dword [ebp - 4], eax
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp - 4]
call fcn.00401db1
push eax
push reloc.gdi32.dll_SetWorldTransform
push eax
push dword [ebp + 8]
call fcn.00403f0f
call fcn.00401871
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp - 4]
call fcn.00401db1
push eax
push reloc.gdi32.dll_SetWorldTransform
push eax
push dword [ebp + 8]
call fcn.00403f0f
call fcn.00401871
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp - 4]
call fcn.00401db1
push eax
push reloc.gdi32.dll_SetWorldTransform
push eax
push dword [ebp + 8]
call fcn.00403f0f
call fcn.00401871
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp - 4]
call fcn.00401db1
push eax
push reloc.gdi32.dll_SetWorldTransform
push eax
push dword [ebp + 8]
call fcn.00403f0f
call fcn.00401871
push dword [ebp - 4]
call fcn.00401871
leave
ret 0xc
Function at 0x4077b7
Capabilities:
Gather leapftp information

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0041104e
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00411054
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
push reloc.gdi32.dll_SetMetaFileBitsEx
push dword [ebp + 0x10]
call fcn.00401db1
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401db1
mov dword [ebp - 0x810], eax
call fcn.00401871
push 0
push reloc.shlwapi.dll_StrNCatA
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x814], eax
push 0
push reloc.shlwapi.dll_StrDupA
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x818], eax
cmp dword [ebp - 0x814], 0
je reloc.gdi32.dll_SetWorldTransform
push reloc.gdi32.dll_SetWorldTransform
push reloc.gdi32.dll_GdiComment
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.004041f4
push reloc.gdi32.dll_SetWorldTransform
push reloc.gdi32.dll_GdiComment
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.004041f4
cmp dword [ebp - 0x818], 0
je reloc.gdi32.dll_SetWorldTransform
push reloc.gdi32.dll_SetWorldTransform
push reloc.gdi32.dll_GdiComment
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.004041f4
push reloc.gdi32.dll_SetWorldTransform
push reloc.gdi32.dll_GdiComment
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.004041f4
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004077b7
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
inc dword [ebp - 8]
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 4]
call fcn.00411048
leave
ret 0xc
Function at 0x40d3f3
Capabilities:
Gather robo-ftp information

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
lea eax, [ebp - 4]
push eax
push reloc.shlwapi.dll_PathRemoveExtensionA
push reloc.shlwapi.dll_ChrCmpIA
push dword [ebp + 0xc]
call fcn.00401d2a
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push eax
cmp dword [ebp - 4], 4
jne reloc.gdi32.dll_SetWorldTransform
push dword [eax]
pop dword [ebp - 8]
cmp dword [ebp - 8], 0x1f4
jbe reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 8], 0x1f4
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 8]
push reloc.shlwapi.dll_PathRemoveExtensionA
lea eax, [ebp - 0x1c]
push eax
call fcn.00411036
add esp, 0xc
push 0
lea eax, [ebp - 0x1c]
push eax
push reloc.shlwapi.dll_ChrCmpIA
push dword [ebp + 0xc]
call fcn.00401d2a
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push eax
push reloc.gdi32.dll_SetWorldTransform
push eax
push dword [ebp + 8]
call fcn.00403f0f
call fcn.00401871
dec dword [ebp - 8]
cmp dword [ebp - 8], 0
jne reloc.gdi32.dll_SetWorldTransform
call fcn.00401871
leave
ret 8
Function at 0x40e35f
Capabilities:
Gather winzip information

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041104e
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
push 0
push reloc.shlwapi.dll_ChrCmpIA
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401d2a
mov dword [ebp - 8], eax
push 0
push reloc.shlwapi.dll_SHRegDeleteUSValueW
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401d2a
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
push eax
push reloc.shlwapi.dll_PathFindNextComponentA
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401d2a
mov dword [ebp - 0x10], eax
push 0
push reloc.shlwapi.dll_SHRegGetBoolUSValueA
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401d2a
mov dword [ebp - 0x14], eax
push 0
push reloc.shlwapi.dll_PathRemoveExtensionA
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401d2a
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x10], 0
je reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 0x1c], 0
je reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
call fcn.00402ad7
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
shr dword [ebp - 0x1c], 1
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
call fcn.0040427f
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 8], 0
je reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 0xc], 0
je reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 0x10], 0
je reloc.gdi32.dll_SetWorldTransform
push reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 0x10]
call fcn.00401522
push dword [ebp - 8]
push dword [ebp + 0x10]
call fcn.00401584
push dword [ebp - 0xc]
push dword [ebp + 0x10]
call fcn.00401584
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
call fcn.00401558
push dword [ebp - 0x14]
push dword [ebp + 0x10]
call fcn.00401584
push dword [ebp - 0x18]
push dword [ebp + 0x10]
call fcn.00401584
push dword [ebp - 8]
call fcn.00401871
push dword [ebp - 0xc]
call fcn.00401871
push dword [ebp - 0x10]
call fcn.00401871
push dword [ebp - 0x14]
call fcn.00401871
push dword [ebp - 0x18]
call fcn.00401871
push dword [ebp - 4]
call fcn.00411048
leave
ret 0xc
Function at 0x7f3b50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x396000]
push edi
jmp 0x7f3b6a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x7f3b71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7f3b60
mov eax, 1
add ebx, ebx
jne 0x7f3b83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x7f3b94
jne 0x7f3bb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7f3bb3
dec eax
add ebx, ebx
jne 0x7f3ba0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x7f3b78
add ebx, ebx
jne 0x7f3baf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x7f3c05
xor ecx, ecx
sub eax, 3
jb 0x7f3bcb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x7f3c3a
sar eax, 1
mov ebp, eax
jmp 0x7f3bd6
add ebx, ebx
jne 0x7f3bd6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7f3ba4
inc ecx
add ebx, ebx
jne 0x7f3be4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7f3ba4
add ebx, ebx
jne 0x7f3bf1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x7f3be6
jne 0x7f3c02
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x7f3be6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x7f3c24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x7f3c16
jmp 0x7f3b66
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x7f3c24
add edi, ecx
jmp 0x7f3b66
pop esi
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x7f3c42
cmp byte [edi], 0x11
jne 0x7f3c42
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x7f3c47
lea edi, [esi + 0x3ec000]
mov eax, dword [edi]
or eax, eax
je 0x7f3cbf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x701b8c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x701d08]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x7f3c74
mov ecx, edi
jns 0x7f3ca3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x701d0c]
or eax, eax
je 0x7f3cb9
mov dword [ebx], eax
add ebx, 4
jmp 0x7f3c91
call dword [esi + 0x701d1c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x7f3cf0
cmp al, 0xef
ja 0x7f3ce3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x7f3cc5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x7f3cd2
mov ebp, dword [esi + 0x701d10]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x7f3d24
sub esp, 0xffffff80
jmp 0x420577
Function at 0x4035e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
movzx ebp, word [esp + 0xc]
push esi
push edi
push 0x448c98
mov edi, eax
push ebp
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x403633
push 2
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4036df
push 0x2000
push ebx
push ebx
push ebx
push ebp
push edi
call dword [sym.imp.USER32.dll_LoadImageW]
mov dword [esi + 4], eax
xor eax, eax
call fcn.00402fa0
xor al, al
pop edi
pop esi
pop ebp
pop ebx
ret
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40364d
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebx
push edi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push ebx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
push ebp
push eax
call fcn.0042eff0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [esp + 0x14]
push eax
push 1
xor ebx, ebx
push edi
mov dword [esp + 0x20], ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x4036d8
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x4036d8
push eax
push esi
call fcn.00402b80
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
sub esp, 0x10
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
xor edi, edi
mov dword [eax + 8], edi
push esi
mov dword [eax + 0xc], ebx
call fcn.004034e0
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret

Function at 0x405870
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x443db8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x4531c4]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor edi, edi
xor eax, eax
push 0xffffffffffffffff
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x3c]
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
call fcn.00401a20
mov eax, ebx
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4058c6
sub eax, edx
sar eax, 1
push eax
mov eax, ebx
lea ecx, [esp + 0x10]
call fcn.00405aa0
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0xffffffffffffffff
mov word [esi + 4], cx
push edi
mov ecx, esi
call fcn.00401a20
cmp dword [esp + 0x24], 8
jb 0x40590f
mov edx, dword [esp + 0x10]
push edx
call fcn.0042a3f0
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret
Function at 0x406070
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x20
push esi
mov esi, ecx
cmp dword [esi + 0xac], 0
jne 0x406088
xor al, al
pop esi
add esp, 0x20
ret 4
push 0
lea eax, [esp + 0x18]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov edx, dword [esi + 0xac]
lea ecx, [esp + 4]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 8]
sub eax, dword [esp + 0x10]
push 0x41
add eax, dword [esp + 0x24]
push 0
cdq
sub eax, edx
sar eax, 1
push 0
push eax
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0x1c]
add eax, dword [esp + 0x2c]
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, dword [esi + 0xac]
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [esp + 0x28]
mov edx, dword [esi + 0xac]
push ecx
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0xac]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov al, 1
pop esi
add esp, 0x20
ret 4

Function at 0x406110
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx]
mov edx, dword [eax + 0x8c]
push 0
call edx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x406150
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
push edi
call edx
push eax
call dword [sym.imp.USER32.dll_IsIconic]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x406180
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
push 9
mov ecx, esi
call edx
push eax
call edi
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
push 5
mov ecx, esi
call edx
push eax
call edi
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
push 0x43
push 0
push 0
push 0
push 0
push 0
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
ret