joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6234ab50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x62467064
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6246705c]
sub esp, 4
test ebx, ebx
je 0x6234aba5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6234ab9e
test esi, esi
je 0x6234ab9e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6234ab80
mov dword [esp], 0x62467064
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6234aee0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x62340000], 0x5a4d
jne 0x6234af05
mov ecx, dword [0x6234003c]
cmp dword [ecx + 0x62340000], 0x4550
lea edx, [ecx + 0x62340000]
je 0x6234af10
ret
cmp word [ecx + 0x62340018], 0x10b
jne 0x6234af05
push esi
movzx eax, word [ecx + 0x62340014]
push ebx
movzx esi, word [ecx + 0x62340006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x62340000
test si, si
je 0x6234af58
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x6234af4e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x6234af5a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x6234af40
xor eax, eax
pop ebx
pop esi
ret

Function at 0x62350290
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
mov dword [0x624670c0], 0xffffffff
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xffff
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
sub esp, 0x10
mov dword [0x624670c4], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x62350300
mov dword [esp + 4], 0x623501a0
mov dword [esp], eax
mov dword [0x624670bc], eax
call fcn.62359b50
test eax, eax
jne 0x62416d79
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x623502ea
Function at 0x6235c3c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x62420df5
push ebx
sub esp, 0x9c
mov eax, dword [str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_https:__gcc.gnu.org_bugs__:_n]
mov dword [ebp - 0x81], eax
mov eax, dword [0x62420e59]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.6234b1c0
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 8], edx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x8c], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.62415980
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x6241e248], 0
jne 0x6235c4e6
mov byte [0x6241e248], 1
call fcn.624137f0
test eax, eax
je 0x6235c4b4
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.6234a340
mov dword [esp], 2
mov esi, dword [fcn.623592d0]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x6235c4a4
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x624215f9
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x62416164
jmp 0x6241615c
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x6235c46a
mov dword [esp], 2
call dword [0x6241d0a0]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x62416157
mov dword [esp], 2
call dword [0x6241d0a0]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x624215a8
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
call sub.msvcrt.dll_abort
mov dword [esp], edi
call fcn.62359a38
call fcn.62413b20
call fcn.624136e0
call fcn.62413820
jmp 0x62416157
Function at 0x2098fa
Capabilities:
Terminate process

Disassembly:
push ebp
mov ah, byte [ebp - 0x70]
nop
push 0x20c3d0
push 0x209b6c
mov eax, dword fs:[0]
push eax
mov dword fs:[0x90], esp
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x70], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
push 2
pop edi
push edi
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
adc dword [eax + 0x20e690], 0xffffffff
or dword [0x20e684], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x20e674]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x20e670]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x20e67c], eax
call fcn.00209b59
cmp dword [0x20e570], ebx
jne 0x20997f
push 0x209b56
call dword [sym.imp.MSVCRT.dll___setusermatherr_1]
pop ecx
call fcn.00209b3e
push 0x20e014
push 0x20e010
call sub.MSVCRT.dll__initterm
mov eax, dword [0x20e66c]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
push dword [0x20e668]
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.MSVCRT.dll___wgetmainargs]
push 0x20e00c
push section..data
call sub.MSVCRT.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.MSVCRT.dll__wcmdln]
mov esi, dword [eax]
cmp esi, ebx
jne 0x2099e7
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
mov dword [ebp - 0x74], esi
cmp word [esi], 0x22
jne 0x209a35
add esi, edi
mov dword [ebp - 0x74], esi
mov ax, word [esi]
cmp ax, bx
je 0x209a03
cmp ax, 0x22
jne 0x2099f0
cmp word [esi], 0x22
jne 0x209a0e
add esi, edi
mov dword [ebp - 0x74], esi
mov ax, word [esi]
cmp ax, bx
je 0x209a1c
cmp ax, 0x9020
jbe 0x209a09
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x30], 1
je 0x209a42
movzx eax, word [ebp - 0x2c]
jmp 0x209a45
cmp word [esi], 0xff90
jbe 0x209a0e
add esi, edi
mov dword [ebp - 0x74], esi
jmp 0x209a35
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x78], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x4010bc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x3c], 0x3e0000
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], 0
call dword [sym.imp.USER32.dll_InSendMessage]
mov dword [ebp - 0x30], eax
jmp loc.00593d1d

Function at 0x401316
Capabilities:
Packed with generic packer
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x10], 0
mov byte [ebp - 0xc], 0
mov eax, dword [ebp + 0x14]
mov cl, byte [eax]
mov byte [ebp - 4], cl
mov dword [ebp - 0x18], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x1c], eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x4013b4
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e6
jne 0x4013b4
mov ecx, dword [ebp - 4]
and ecx, 0xff
add ecx, 0x2f
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov edx, dword [ebp + 0x10]
mov byte [eax + edx], cl
push 0
push 0
jmp loc.00593e3f
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push 0
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x4013dc
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0xb53
cmp dword [ebp - 0x14], 0
jbe fcn.004014a1
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x14]
jae 0x401492
push 0
push 0
push 0
jmp loc.00593d4f
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
jmp loc.0058b9f3

Function at 0x402870
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
jmp loc.00591873
Function at 0x402970
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x302c
call fcn.00407350
push edi
mov byte [ebp - 0x3008], 0
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x3007]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x2008], 0
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x2007]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x1000], 0
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0xfff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x1004], eax
cmp dword [ebp + 8], 0
jl 0x4029de
cmp dword [ebp + 8], 3
jl 0x4029e6
or eax, 0xffffffff
jmp 0x402cfb
cmp dword [ebp + 8], 2
jmp 0x5947f6
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x403287
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [edx + 0xe], 5
jne 0x40329e
mov bx, word [ebp - 0xa4]
or bh, 2
and bh, 0xfe
mov bl, 0x3f
jmp 0x4032a2
mov bx, 0x133f
mov word [ebp - 0xa2], bx
fldcw word [ebp - 0xa2]
mov ebx, 0x577acd
fxam
mov dword [ebp - 0x94], edx
wait
fnstsw word [ebp - 0xa0]
mov byte [ebp - 0x90], 0
fxch st(1)
mov cl, byte [ebp - 0x9f]
fxam
wait
fnstsw word [ebp - 0xa0]
fxch st(1)
mov ch, byte [ebp - 0x9f]
shl ch, 1
sar ch, 1
rol ch, 1
mov al, ch
and al, 0xf
xlatb
mov ah, al
shl cl, 1
sar cl, 1
rol cl, 1
mov al, cl
and al, 0xf
xlatb
shl ah, 1
shl ah, 1
or al, ah
movsx eax, al
and ecx, 0x404
mov ebx, edx
jmp 0x58ebcf

Function at 0x403580
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
jmp loc.0058fa57

Function at 0x403d10
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [0x57891c], 1
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
jmp loc.0058bbdb

Function at 0x4040e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x578984], 1
jne fcn.004040fe
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
jmp loc.0058b776

Function at 0x4050e2
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov eax, dword [esp + 0x10]
push eax
push 0xfffffffffffffffe
push 0x4050c0
push dword fs:[0]
mov dword fs:[0], esp
mov eax, dword [esp + 0x20]
mov ebx, dword [eax + 8]
mov esi, dword [eax + 0xc]
cmp esi, 0xffffffff
je 0x40513c
cmp esi, dword [esp + 0x24]
je 0x40513c
lea esi, [esi + esi*2]
mov ecx, dword [ebx + esi*4]
mov dword [esp + 8], ecx
mov dword [eax + 0xc], ecx
cmp dword [ebx + esi*4 + 4], 0
jne 0x40513a
jmp loc.0058f67d
jmp 0x4050ff
pop dword fs:[0]
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x405270
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x578908], 1
je 0x40528e
cmp dword [0x578908], 0
jne 0x4052b7
jmp loc.0058f84e
push 0xfc
call fcn.004052c0
add esp, 4
cmp dword [0x578a98], 0
je 0x4052aa
call dword [0x578a98]
push 0xff
call fcn.004052c0
add esp, 4
pop ebp
ret
Function at 0x405820
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
jmp loc.0058ffe3

Function at 0x405c70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
jmp loc.00593f33

Function at 0x406580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
mov dword [ebp - 0x4c], 0
jmp 0x40659b
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x10], 0x10
jge 0x4065af
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x54], eax
jmp fcn.004065b6
jmp loc.0059362b

Function at 0x4069c0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 1
jmp loc.0059239f

Function at 0x408960
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
wait
fnstcw word [ebp - 0x10]
mov ax, word [ebp - 0x10]
push eax
call fcn.004089d0
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
and ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0xc]
not edx
mov eax, dword [ebp - 8]
and eax, edx
or ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
push ecx
jmp loc.0058e467

Function at 0x4089b0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
and eax, 0xfff7ffff
push eax
mov ecx, dword [ebp + 8]
push ecx
jmp loc.00591595

Function at 0x408ea0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
cdq
and edx, 0x1f
add eax, edx
sar eax, 5
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
and eax, 0x8000001f
jns 0x408ec4
dec eax
or eax, 0xffffffe0
inc eax
mov ecx, 0x1f
sub ecx, eax
mov dword [ebp - 4], ecx
or edx, 0xffffffff
mov ecx, dword [ebp - 4]
shl edx, cl
not edx
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax*4]
and edx, dword [ebp - 8]
test edx, edx
je 0x408eef
xor eax, eax
jmp 0x408f20
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x408f03
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 3
jge 0x408f1b
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
cmp dword [eax + edx*4], 0
je 0x408f19
xor eax, eax
jmp 0x408f20
jmp 0x408efa
jmp 0x58b6f2
mov esp, ebp
pop ebp
ret
Function at 0x4094c0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0x578260
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
jmp loc.0058ba74

Function at 0x409500
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0xc]
push edx
jmp loc.0058d82c

Function at 0x409870
Capabilities:
Packed with generic packer

Disassembly:
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 4]
test edx, edx
je 0x4098c3
xor eax, eax
mov al, byte [esp + 8]
push edi
mov edi, ecx
cmp edx, 4
jb 0x4098b7
neg ecx
and ecx, 3
je 0x409899
sub edx, ecx
mov byte [edi], al
inc edi
dec ecx
jne 0x409893
jmp 0x58b4fd
mov byte [edi], al
inc edi
dec edx
jne 0x4098b7
mov eax, dword [esp + 8]
pop edi
ret
mov eax, dword [esp + 4]
ret

Function at 0x40a420
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x579ec8], 0
jne fcn.0040a440
push 0xfffffffffffffffd
call fcn.00409cb0
add esp, 4
jmp loc.00590b58

Function at 0x40a850
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
sub ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
shr edx, 0xf
mov dword [ebp - 4], edx
mov eax, 0x80000000
mov ecx, dword [ebp - 4]
shr eax, cl
jmp loc.0058ec10

Function at 0x40bd10
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp eax, dword [0x578390]
ja 0x40bd39
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040ae80
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40bd39
mov eax, dword [ebp - 4]
jmp fcn.0040bd65
cmp dword [ebp + 8], 0
jne 0x40bd46
mov dword [ebp + 8], 1
mov edx, dword [ebp + 8]
add edx, 0xf
and edx, 0xfffffff0
mov dword [ebp + 8], edx
mov eax, dword [ebp + 8]
push eax
push 0
mov ecx, dword [0x579da8]
push ecx
jmp loc.0059292c

Function at 0x40c540
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0x7ff00000
jne 0x40c559
cmp dword [ebp + 8], 0
jne 0x40c559
mov eax, 1
jmp 0x40c5ba
jmp loc.0058b462
pop ebp
ret

Function at 0x40d6c0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
add eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jb 0x40d6e6
jmp loc.0058b585
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x40d7b0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
jmp loc.0058e388
Function at 0x58bd4b
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
mov edi, edi
push ecx
mov eax, dword [0x419140]
push ebx
push edi
push 0
mov ecx, eax
test eax, eax
add esp, 0x10
leave
popal
popfd
fld xword [esp]
fxch st(1)
jmp fcn.00408499
Function at 0x401c00
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56cd98
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x5cce74]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 8
push eax
mov dword [ebp - 0x14], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, edi
call fcn.00404bd7
push 0
call fcn.004060ec
test eax, eax
jne 0x401c68
push 0xffffffffffffffff
push eax
push 0x67
call fcn.00406db6
jmp 0x401d5f
push 0
call fcn.00407446
push 0xc
call fcn.00403d5b
add esp, 8
mov dword [ebp - 0xf4], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x401ca3
xorps xmm0, xmm0
mov ecx, eax
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.0040827f
mov esi, eax
jmp 0x401ca5
xor esi, esi
push 0x57eb3c
mov dword [ebp - 4], 0xffffffff
call fcn.00410c94
push 0x5ae1c0
mov ecx, edi
call fcn.0041445a
push 0xd8
lea eax, [ebp - 0xf0]
push 0
push eax
call fcn.0054ece0
add esp, 0xc
lea ecx, [ebp - 0xf0]
push 0
push 0x66
call fcn.0041b8e2
mov dword [ebp - 4], 1
mov dword [ebp - 0xf0], 0x5ae434
call fcn.0041c1c7
call fcn.0041c1c7
push 0x80
mov eax, dword [eax + 0xc]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0xf0]
mov dword [ebp - 4], 2
mov ecx, eax
mov dword [edi + 0x20], eax
call fcn.00414c2a
test esi, esi
je 0x401d38
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
call fcn.00415c17
lea ecx, [ebp - 0x30]
call fcn.00419b87
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], vtable.CBrush.0
call fcn.00402800
lea ecx, [ebp - 0xf0]
call fcn.004146d8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054c956
mov esp, ebp
pop ebp
ret

Function at 0x401f30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x401f59
pop edi
pop ebx
pop ebp
ret
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401f6f
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401f66
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x401fa2
nop
cmp esi, ecx
jae 0x401f66
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x401f90
cmp esi, ecx
jae 0x401f66
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402000
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 4], ecx
call fcn.004183bf
mov ebx, eax
test ebx, ebx
jne 0x402020
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, edi
shr eax, 4
push esi
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x402107
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402107
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402107
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x402088
cmp esi, ecx
jae 0x402107
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x402072
cmp esi, ecx
jae 0x402107
movzx eax, word [esi]
test ax, ax
je 0x402107
push 0
push 0
push 0
push 0
push eax
lea ecx, [esi + 2]
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
js 0x402112
mov ebx, dword [ebp - 4]
mov edx, 1
mov eax, dword [ebx]
mov ecx, dword [eax - 8]
sub edx, dword [eax - 4]
sub ecx, edi
or edx, ecx
jge 0x4020d1
push edi
mov ecx, ebx
call fcn.00402520
mov eax, dword [ebx]
push 0
push 0
push edi
push eax
movzx eax, word [esi]
push eax
lea eax, [esi + 2]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x402112
mov dword [eax - 0xc], edi
mov eax, dword [ebx]
pop esi
mov byte [edi + eax], 0
mov eax, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00402600
int3