joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1d0e2f1
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1d06410]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
push edi
test eax, eax
jne 0x1d0e314
push ebx
call dword [0x1d1f01c]
mov esi, dword [eax + 0x3c]
add esi, eax
mov dword [ebp - 0xc], 0x646f632e
mov dword [ebp - 8], 0x65
movzx edi, word [esi + 0x14]
push dword [esi + 0x88]
add edi, 0x18
push esi
add edi, esi
call fcn.01d07824
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x1d0e3bd
movzx edx, word [esi + 6]
xor ecx, ecx
test edx, edx
jle 0x1d0e36a
lea eax, [ebp - 0xc]
mov eax, dword [eax]
cmp eax, dword [edi]
jne 0x1d0e362
lea eax, [ebp - 0xc]
mov eax, dword [eax + 4]
cmp eax, dword [edi + 4]
je 0x1d0e36a
add edi, 0x28
inc ecx
cmp ecx, edx
jl 0x1d0e34e
cmp ecx, edx
je 0x1d0e3bd
mov ecx, dword [esi + 0x34]
add ecx, dword [edi + 0xc]
mov edi, 0x1d07e30
xor edx, edx
mov eax, dword [ecx + edx*4]
cmp eax, dword [edi + edx*4]
jne 0x1d0e3bd
inc edx
cmp edx, 4
jne 0x1d0e37b
xor edx, edx
mov eax, dword [ecx + edx*4 + 0x140]
cmp eax, dword [edi + edx*4]
jne 0x1d0e3bd
inc edx
cmp edx, 4
jne 0x1d0e38b
cmp dword [ecx + 0x124], 0
je 0x1d0e3ad
push 0x1d0e67c
jmp 0x1d0e3b2
push 0x1d0e661
push esi
push ebx
push ecx
call fcn.01d0e3ce
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01d0fd46
mov esp, ebp
pop ebp
ret
Function at 0x1d4f5b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ecx, esi
push edi
call fcn.01d631c0
mov ebx, dword [esp + 0x30]
mov ecx, esi
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], eax
call fcn.01d62a40
add eax, ebx
push eax
call dword [0x100df290]
test eax, eax
jne 0x1d4f695
mov ecx, esi
call fcn.01d62a40
mov ecx, dword [esp + 0x2c]
mov esi, dword [eax + ebx + 8]
mov edi, dword [eax + ebx + 0xc]
call fcn.01d62a40
mov ecx, dword [esp + 0x2c]
add eax, ebx
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov dword [esp + 0x14], ebx
call fcn.01d62a40
mov ebx, dword [esp + 0x2c]
sub esp, 0x10
mov edx, esp
mov ecx, dword [eax + esi + 0x10]
mov eax, dword [eax + esi + 0x14]
mov dword [edx + 8], ecx
mov ecx, ebx
mov dword [edx], ebx
mov dword [edx + 0xc], eax
call fcn.01d62a40
mov ebx, dword [esp + 0x20]
lea ecx, [ebx + eax]
call fcn.01d4cdc0
mov ecx, dword [esp + 0x2c]
sub esp, 0x10
mov eax, esp
mov dword [eax + 8], esi
mov esi, ecx
mov dword [eax], ecx
mov dword [eax + 0xc], edi
call fcn.01d62a40
lea ecx, [ebx + eax]
call fcn.01d4cdc0
mov ebx, dword [esp + 0x14]
sub esp, 0x10
mov eax, esp
mov ecx, esi
mov dword [eax], esi
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
call fcn.01d62a40
add eax, dword [esp + 0x20]
mov ecx, eax
call fcn.01d4cdc0
push dword [esp + 0x34]
mov ecx, esi
push dword [esp + 0x34]
call fcn.01d62870
mov ecx, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
jmp fcn.01d63d10

Function at 0x1d4f6b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ecx, esi
push edi
call fcn.01d631c0
mov ebx, dword [esp + 0x30]
mov ecx, esi
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], eax
call fcn.01d62a40
add eax, ebx
push eax
call dword [0x100df290]
test eax, eax
jne 0x1d4f795
mov ecx, esi
call fcn.01d62a40
mov ecx, dword [esp + 0x2c]
mov esi, dword [eax + ebx + 8]
mov edi, dword [eax + ebx + 0xc]
call fcn.01d62a40
mov ecx, dword [esp + 0x2c]
add eax, ebx
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov dword [esp + 0x14], ebx
call fcn.01d62a40
mov ebx, dword [esp + 0x2c]
sub esp, 0x10
mov edx, esp
mov ecx, dword [eax + esi + 0x10]
mov eax, dword [eax + esi + 0x14]
mov dword [edx + 8], ecx
mov ecx, ebx
mov dword [edx], ebx
mov dword [edx + 0xc], eax
call fcn.01d62a40
mov ebx, dword [esp + 0x20]
lea ecx, [ebx + eax]
call fcn.01d4ce60
mov ecx, dword [esp + 0x2c]
sub esp, 0x10
mov eax, esp
mov dword [eax + 8], esi
mov esi, ecx
mov dword [eax], ecx
mov dword [eax + 0xc], edi
call fcn.01d62a40
lea ecx, [ebx + eax]
call fcn.01d4ce60
mov ebx, dword [esp + 0x14]
sub esp, 0x10
mov eax, esp
mov ecx, esi
mov dword [eax], esi
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
call fcn.01d62a40
add eax, dword [esp + 0x20]
mov ecx, eax
call fcn.01d4ce60
push dword [esp + 0x34]
mov ecx, esi
push dword [esp + 0x34]
call fcn.01d62870
mov ecx, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
jmp fcn.01d63d10
Function at 0x1d4f7b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
mov ecx, ebx
push edi
call fcn.01d631c0
mov ecx, ebx
call fcn.01d62a40
mov edi, eax
add edi, dword [esp + 0x20]
push edi
call dword [0x100df290]
test eax, eax
jne 0x1d4f83f
mov ecx, ebx
call fcn.01d631c0
cmp dword [edi + 0x28], 0xffffffff
jne 0x1d4f7eb
cmp dword [edi + 0x2c], 0xffffffff
je 0x1d4f829
push esi
mov esi, dword [edi + 0x28]
lea ecx, [esp + 0xc]
mov edi, dword [edi + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x18], 0xffffffff
call fcn.01d4f560
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
call fcn.01d4f560
pop esi
push dword [esp + 0x24]
mov ecx, ebx
push dword [esp + 0x24]
call fcn.01d62870
mov ecx, ebx
call fcn.01d63d10
pop edi
mov ecx, ebx
pop ebx
add esp, 0x10
jmp fcn.01d63d10

Function at 0x1d4f850
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
mov ecx, esi
push edi
call fcn.01d631c0
mov ecx, esi
call fcn.01d62a40
mov edi, eax
add edi, dword [esp + 0x20]
push edi
call dword [0x100df290]
test eax, eax
jne 0x1d4f8d2
mov ecx, esi
call fcn.01d631c0
cmp dword [edi + 0x28], 0xffffffff
jne 0x1d4f88b
cmp dword [edi + 0x2c], 0xffffffff
je 0x1d4f8bc
push dword [edi + 0x2c]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
push dword [edi + 0x28]
mov dword [esp + 0x18], 0xffffffff
push esi
mov dword [esp + 0x20], 0xffffffff
call fcn.01d4baf0
lea ecx, [esp + 8]
call fcn.01d4a1f0
push dword [esp + 0x24]
mov ecx, esi
push dword [esp + 0x24]
call fcn.01d62870
mov ecx, esi
call fcn.01d63d10
pop edi
mov ecx, esi
pop esi
add esp, 0x10
jmp fcn.01d63d10

Function at 0x1d4f8e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov ecx, edi
call fcn.01d631c0
mov ecx, edi
call fcn.01d62a40
mov esi, eax
add esi, dword [esp + 0x10]
lea ecx, [esi + 4]
push ecx
call dword [0x100df290]
test eax, eax
jne 0x1d4f97d
mov ecx, dword [esi + 0x38]
mov eax, dword [esi + 0x3c]
cmp ecx, 0xffffffff
jne 0x1d4f917
cmp eax, ecx
je 0x1d4f920
push eax
push ecx
mov ecx, edi
call fcn.01d62870
mov ecx, dword [esi + 0x28]
mov eax, dword [esi + 0x2c]
cmp ecx, 0xffffffff
jne 0x1d4f92f
cmp eax, ecx
je 0x1d4f938
push eax
push ecx
mov ecx, edi
call fcn.01d62870
cmp dword [esi + 0x18], 0xffffffff
jne 0x1d4f944
cmp dword [esi + 0x1c], 0xffffffff
je 0x1d4f953
push dword [esi + 0x1c]
push dword [esi + 0x18]
push edi
call fcn.01d4f5b0
add esp, 0xc
cmp dword [esi + 0x20], 0xffffffff
jne 0x1d4f95f
cmp dword [esi + 0x24], 0xffffffff
je 0x1d4f96e
push dword [esi + 0x24]
push dword [esi + 0x20]
push edi
call fcn.01d4f6b0
add esp, 0xc
push dword [esp + 0x14]
mov ecx, edi
push dword [esp + 0x14]
call fcn.01d62870
mov ecx, edi
pop edi
pop esi
jmp fcn.01d63d10
Function at 0x1d4f990
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
mov ecx, esi
push edi
call fcn.01d631c0
mov ecx, esi
call fcn.01d62a40
mov edi, eax
add edi, dword [esp + 0x10]
lea ecx, [edi + 4]
push ecx
call dword [0x100df290]
test eax, eax
jne 0x1d4f9f4
mov ecx, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
cmp ecx, 0xffffffff
jne 0x1d4f9c7
cmp eax, ecx
je 0x1d4f9d0
push eax
push ecx
mov ecx, esi
call fcn.01d62870
mov edx, dword [edi + 0x10]
mov eax, edx
mov ecx, dword [edi + 0x14]
or eax, ecx
je 0x1d4f9e5
push ecx
push edx
mov ecx, esi
call fcn.01d62870
push dword [esp + 0x14]
mov ecx, esi
push dword [esp + 0x14]
call fcn.01d62870
pop edi
mov ecx, esi
pop esi
jmp fcn.01d63d10
Function at 0x1df6660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
xor ebp, ebp
push edi
test ebx, ebx
je 0x1df66c6
mov eax, dword [ebx + 0x3c]
xor esi, esi
add eax, ebx
mov dword [esp + 0x14], eax
mov edi, dword [eax + 0x78]
add edi, ebx
cmp dword [edi + 0x18], esi
jbe 0x1df66c6
mov edx, dword [esp + 0x18]
mov eax, dword [edi + 0x20]
lea eax, [eax + esi*4]
mov ecx, dword [eax + ebx]
add ecx, ebx
test ecx, 0xffff0000
je 0x1df66b5
test edx, 0xffff0000
je 0x1df66b5
push edx
push ecx
call dword [0x100df134]
mov edx, dword [esp + 0x18]
neg eax
sbb eax, eax
inc eax
jmp 0x1df66bc
xor eax, eax
cmp ecx, edx
sete al
test eax, eax
jne 0x1df66cd
inc esi
cmp esi, dword [edi + 0x18]
jb 0x1df6687
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
mov eax, dword [edi + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + ebx]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov ebp, dword [eax + ebx]
add ebp, ebx
cmp ebp, edi
jb 0x1df66c6
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x7c]
add eax, edi
cmp ebp, eax
ja 0x1df66c6
xor ecx, ecx
mov eax, ebp
cmp byte [ebp], cl
je 0x1df6709
lea esp, [esp]
lea eax, [eax + 1]
inc ecx
cmp byte [eax], 0
jne 0x1df6700
lea esi, [ecx + 1]
xor edi, edi
test esi, esi
je 0x1df671d
push esi
call fcn.01df0a70
add esp, 4
mov edi, eax
push esi
push ebp
push edi
call fcn.01d68250
add esp, 0xc
mov esi, edi
cmp byte [edi], 0
je 0x1df673b
nop
cmp byte [esi], 0x2e
je 0x1df674d
inc esi
cmp byte [esi], 0
jne 0x1df6730
push edi
xor esi, esi
call fcn.01df0a60
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
mov byte [esi], 0
call dword [0x100df1e0]
mov ecx, eax
lea eax, [esi + 1]
push eax
push ecx
call fcn.01df6660
add esp, 8
mov esi, eax
push edi
call fcn.01df0a60
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10004cd0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
test esi, esi
not eax
je 0x10004d02
lea esp, [esp]
test cl, 3
je 0x10004d02
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x11ada460]
add ecx, 1
sub esi, 1
jne 0x10004ce0
cmp esi, 0x20
push ebx
push edi
jb 0x10004eec
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x11ada860]
xor edx, dword [ebx*4 + 0x11adac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x11ada460]
add ecx, 4
xor edx, dword [eax*4 + 0x11adb060]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x11ada860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x11adac60]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x11ada460]
add ecx, 4
xor eax, dword [edx*4 + 0x11adb060]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x11ada860]
xor edx, dword [ebx*4 + 0x11adac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x11ada460]
xor edx, dword [eax*4 + 0x11adb060]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x11ada860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x11adac60]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x11ada460]
xor eax, dword [edx*4 + 0x11adb060]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x11ada860]
xor edx, dword [ebx*4 + 0x11adac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x11ada460]
xor edx, dword [eax*4 + 0x11adb060]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x11ada860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x11adac60]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x11ada460]
and edx, 0xff
xor eax, dword [edx*4 + 0x11adb060]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x11ada860]
xor edx, dword [ebx*4 + 0x11adac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x11ada460]
add ecx, 4
xor edx, dword [eax*4 + 0x11adb060]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x11ada860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x11adac60]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x11ada460]
and edx, 0xff
xor eax, dword [edx*4 + 0x11adb060]
sub edi, 1
jne 0x10004d12
cmp esi, 4
jb 0x10004f39
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x11ada860]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x11adac60]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x11ada460]
and eax, 0xff
xor edi, dword [eax*4 + 0x11adb060]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x10004ef6
test esi, esi
pop edi
pop ebx
je 0x10004f5d
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x11ada460]
add ecx, 1
sub esi, 1
jne 0x10004f40
not eax
pop esi
ret
Function at 0x401d80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
lea edi, [ebp - 0x404]
mov ebx, edx
mov ecx, 0x100
mov esi, 0x5ac8c0
rep movsd dword es:[edi], dword [esi]
test ebx, ebx
jg 0x401db1
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
xor edx, edx
test ebx, ebx
je 0x401dd8
mov esi, dword [ebp - 4]
nop dword [eax]
movzx ecx, byte [edx + esi]
inc edx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ebp + ecx*4 - 0x404]
cmp edx, ebx
jne 0x401dc0
pop edi
pop esi
not eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401df0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 0xc], edi
lea ebx, [edi + 4]
mov dword [ebp - 0x10], ebx
test esi, esi
jle 0x401ef4
test edi, edi
je 0x401ef4
movzx edx, word [ebx + 2]
mov eax, edx
mov dword [ebp - 8], eax
movzx eax, word [ebx]
mov ecx, eax
mov dword [ebp - 4], ecx
lea ecx, [edx + eax]
lea eax, [esi - 8]
cmp ecx, eax
ja 0x401ef4
lea edx, [esi - 4]
mov ecx, ebx
call fcn.00401d80
cmp eax, dword [edi]
jne 0x401ef4
lea eax, [edi + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
movzx ebx, ax
lea eax, [edi + 8]
add eax, ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
movzx edi, ax
sub esi, edi
sub esi, ebx
lea eax, [esi - 8]
mov esi, dword [ebp + 0xc]
push eax
mov dword [esi], eax
call fcn.0040383f
mov ecx, dword [ebp + 8]
mov edx, eax
mov esi, dword [esi]
add esp, 4
mov dword [ebp - 4], eax
mov dword [ecx], eax
lea ecx, [edi + ebx]
mov eax, dword [ebp - 0xc]
add eax, 8
add ecx, eax
test esi, esi
je 0x401ea3
mov edi, esi
mov al, byte [ecx]
lea edx, [edx + 1]
mov byte [edx - 1], al
lea ecx, [ecx + 1]
sub edi, 1
jne 0x401e93
mov eax, dword [ebp - 0x10]
movzx ecx, word [eax + 2]
movzx edi, word [eax]
mov dword [ebp - 0x10], ecx
xor ecx, ecx
test esi, esi
jle 0x401ecc
mov eax, ecx
mov ebx, dword [ebp - 0x14]
cdq
idiv edi
mov al, byte [edx + ebx]
mov ebx, dword [ebp - 4]
xor byte [ecx + ebx], al
inc ecx
cmp ecx, esi
jl 0x401eb6
xor ecx, ecx
test esi, esi
jle 0x401eeb
mov edi, dword [ebp - 0x10]
mov eax, ecx
mov ebx, dword [ebp - 0x18]
cdq
idiv edi
mov al, byte [edx + ebx]
mov ebx, dword [ebp - 4]
xor byte [ecx + ebx], al
inc ecx
cmp ecx, esi
jl 0x401ed5
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401f50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x567fe0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5cafd4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 8
push eax
mov dword [ebp - 0x18], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
call fcn.004031ac
push 0x208
call fcn.0040383f
add esp, 4
mov dword [ebp - 0x20], 0
mov edi, eax
mov ecx, edi
call fcn.00402f20
test eax, eax
je 0x402009
lea edx, [ebp - 0x20]
mov ecx, edi
call fcn.004029c0
test eax, eax
jg 0x401fe1
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x402009
push eax
jmp 0x402001
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x24]
mov edx, eax
push ecx
mov ecx, esi
call fcn.00401df0
add esp, 8
test al, al
jne 0x402041
test esi, esi
je 0x402009
push esi
call fcn.0040383a
add esp, 4
mov ecx, ebx
call fcn.0040e911
call fcn.0040fcfa
test eax, eax
jne 0x40207f
push 0xffffffffffffffff
push eax
push 0x64
call fcn.0040fea1
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054b32b
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x40204e
push esi
call fcn.0040383a
add esp, 4
push edi
call fcn.0040383a
mov esi, dword [ebp - 0x24]
lea eax, [ebp - 0x14]
add esp, 4
mov dword [ebp - 0x14], 0
push eax
push 0x40
push dword [ebp - 0x28]
push esi
call dword [0x5d3ffc]
test eax, eax
je 0x402000
call esi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
call fcn.00410526
add esp, 4
mov ecx, ebx
push 0
call fcn.0040f3b3
push str.Local_AppWizard_Generated_Applications
mov ecx, ebx
call fcn.0040f9d4
push 0x360
call fcn.00403802
mov edi, eax
add esp, 4
test edi, edi
je 0x402023
push 0x360
push 0
push edi
call fcn.0054d6b0
add esp, 0xc
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.00414c08
lea ecx, [edi + 0x120]
mov dword [edi], vtable.CMainFrame.0
call fcn.004188b0
lea ecx, [edi + 0x210]
call fcn.0041a4b4
lea esi, [edi + 0x2e0]
mov ecx, esi
mov dword [ebp - 0x24], esi
call fcn.0040396f
push 0
mov dword [esi], vtable.CChildView.0
mov ecx, edi
mov dword [ebp - 4], 0xffffffff
push 0
mov dword [ebx + 0x20], edi
mov eax, dword [edi]
push 0xcf8000
push 0x80
call dword [eax + 0x168]
push 5
mov ecx, edi
call fcn.0040dc65
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
jmp 0x402025

Function at 0x4022c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00411af7
Function at 0x4029c0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x5cafd4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, edx
mov dword [ebp - 0x10], eax
push ebx
test ecx, ecx
je 0x402ab6
test eax, eax
je 0x402ab6
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402ab6
push edi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x402a34
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054b32b
mov esp, ebp
pop ebp
ret
push esi
push edi
call fcn.0040383f
push edi
push 0
push eax
mov dword [ebp - 0xc], eax
call fcn.0054d6b0
add esp, 0x10
xor esi, esi
test edi, edi
je 0x402a7a
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
mov eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0xc]
add eax, esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402a9c
add esi, dword [ebp - 8]
cmp esi, edi
jb 0x402a50
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
push ebx
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054b32b
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054b32b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop ebx
call fcn.0054b32b
mov esp, ebp
pop ebp
ret
Function at 0x402f20
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file attributes

Disassembly:
sub esp, 0x670
mov eax, dword [0x5cafd4]
xor eax, esp
mov dword [esp + 0x66c], eax
push ebx
push ebp
push esi
push edi
push 0x208
mov edi, ecx
mov dword [esp + 0x58], 0x3a0044
push 0
push edi
mov dword [esp + 0x64], 0x5c
call fcn.0054d6b0
add esp, 0xc
push 0x104
push edi
push 0
call dword [0x5d4000]
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub eax, 1
js 0x402f93
movzx ecx, word [edi + eax*2]
cmp ecx, 0x5c
je 0x402f84
cmp ecx, 0x2f
jne 0x402f85
inc esi
sub eax, 1
jns 0x402f76
cmp esi, 1
jg 0x403191
xor eax, eax
mov word [edi + 6], ax
mov ax, word [edi]
push 0x20a
mov word [esp + 0x58], ax
lea eax, [esp + 0x474]
push 0
push eax
call fcn.0054d6b0
push 0x20a
lea eax, [esp + 0x274]
push 0
push eax
call fcn.0054d6b0
add esp, 0x18
mov dword [esp + 0x10], 0
lea eax, [esp + 0x264]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
push 0x105
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x20]
push eax
push 0x105
lea eax, [esp + 0x488]
push eax
lea eax, [esp + 0x70]
push eax
call dword [0x5d3ff8]
neg eax
push 0x40
sbb eax, eax
and eax, dword [esp + 0x14]
cbw
movzx eax, al
imul esi, eax, 0xf425c842
call fcn.0040383f
push 0xa
mov ebx, eax
push 0x20
push ebx
push esi
call fcn.00551fbb
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x30]
add esp, 0x14
mov dword [esp + 0x1c], 0x61004b
mov dword [esp + 0x20], 0x700073
mov dword [esp + 0x24], 0x720065
mov dword [esp + 0x28], 0x6b0073
push eax
lea eax, [esp + 0x60]
mov dword [esp + 0x30], 0x5c0079
push eax
mov dword [esp + 0x38], 0x730055
mov dword [esp + 0x3c], 0x200062
mov dword [esp + 0x40], 0x720044
mov dword [esp + 0x44], 0x760069
mov dword [esp + 0x48], 0x200f0065
mov dword [esp + 0x4c], 0x33005c
mov dword [esp + 0x50], 0x30002e
mov dword [esp + 0x54], 0x5c
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x5c]
push eax
push edi
call esi
push ebx
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4030e2
test al, 0x10
je 0x403181
xor eax, eax
mov dword [esp + 0x1c], 0x790053
mov word [esp + 0x50], ax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x60]
mov dword [esp + 0x24], 0x740073
push eax
mov dword [esp + 0x2c], 0x6d0065
mov dword [esp + 0x30], 0x560020
mov dword [esp + 0x34], 0x6c006f
mov dword [esp + 0x38], 0x6d0075
mov dword [esp + 0x3c], 0x200065
mov dword [esp + 0x40], 0x6e0049
mov dword [esp + 0x44], 0x6f0066
mov dword [esp + 0x48], 0x6d0072
mov dword [esp + 0x4c], 0x740061
mov dword [esp + 0x50], 0x6f0069
mov dword [esp + 0x54], 0x5c006e
call ebp
lea eax, [esp + 0x54]
push eax
push edi
call ebp
lea eax, [esp + 0x5c]
push eax
push edi
call esi
push ebx
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x403191
test al, 0x10
jne 0x403191
push ebx
call fcn.0040383a
add esp, 4
mov eax, 1
jmp 0x403193
xor eax, eax
mov ecx, dword [esp + 0x67c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0054b32b
add esp, 0x670
ret