joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465ef0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x5d5206], 0
je 0x465f0a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x465f10
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x5d5206], 0
je 0x465f2b
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback

Function at 0x466d90
Capabilities:
Allocate thread local storage

Disassembly:
mov ebp, esp
mov eax, dword [sym.imp.kernel32.dll_TlsAlloc]
call eax
mov esp, ebp
mov ecx, eax
cmp ecx, 0x40
jb 0x466daa
mov ecx, 0x14
jmp 0x466db3
shl ecx, 2
add ecx, 0xe10
mov dword [0x5d5324], ecx
ret
Function at 0x49a2a0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5d5324]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49a48a
sub esp, 0x48
mov eax, dword [0x5ac35c]
mov ecx, dword [esp + 0x50]
movzx edx, word [ecx + 0xa]
movzx ebx, word [ecx + 0xc]
movzx ebp, word [ecx + 2]
movzx esi, word [ecx + 8]
mov edi, dword [esp + 0x4c]
mov dword [esp], edi
mov dword [esp + 4], ebp
mov dword [esp + 8], 1
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
call sym.time.Date
lea edi, [esp + 0x34]
lea esi, [esp + 0x20]
call fcn.004666de
lea edi, [esp]
lea esi, [esp + 0x34]
call fcn.004666de
call sym.time.Time.abs
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add eax, 0x15180
adc ecx, 0
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x93a80
call sym.runtime.uint64mod
mov eax, dword [esp + 0x50]
movzx ecx, word [eax + 4]
mov edx, dword [esp + 0x10]
mov ebx, eax
mov eax, 0xc22e4507
mov ebp, edx
imul edx
lea eax, [ebp + edx]
sar eax, 0x10
sar ebp, 0x1f
sub eax, ebp
sub ecx, eax
test ecx, ecx
jge 0x49a377
add ecx, 7
movzx edx, word [ebx + 6]
lea ebp, [edx - 1]
cmp ebp, 4
jge 0x49a391
lea ebx, [edx + edx*2]
lea edx, [edx + ebx*2]
lea ecx, [ecx + edx - 6]
mov edx, ecx
jmp 0x49a408
movzx eax, word [ebx + 2]
cmp eax, 2
jne 0x49a3de
mov edx, dword [esp + 0x4c]
test edx, 3
jne 0x49a3da
mov ebx, edx
sar edx, 0x1f
mov ebp, eax
mov eax, 0x51eb851f
mov esi, edx
imul ebx
mov edi, edx
sar edx, 5
sub edx, esi
imul edx, edx, 0x64
cmp ebx, edx
jne 0x49a3d3
sar edi, 7
sub edi, esi
imul edx, edi, 0x190
cmp ebx, edx
jne 0x49a3e0
mov ebx, 0x1d
jmp 0x49a3fe
mov ebp, eax
jmp 0x49a3e0
mov ebp, eax
cmp ebp, 0xd
jae 0x49a47d
lea eax, [ebp - 1]
lea edx, [0x5a37c0]
mov ebx, dword [edx + ebp*4]
cmp eax, 0xd
jae 0x49a473
sub ebx, dword [edx + ebp*4 - 4]
lea edx, [ecx + 0x1d]
cmp ebx, edx
jge 0x49a408
lea edx, [ecx + 0x16]
mov ecx, dword [esp + 0x38]
test ecx, 0x80000000
je 0x49a43a
mov ebx, dword [esp + 0x34]
shl ecx, 1
mov ebp, ebx
shl ebx, 1
shr ebp, 0x1f
or ebp, ecx
mov ecx, ebp
shl ebp, 1
shr ecx, 0x1f
shr ebx, 0x1f
or ebp, ebx
add ebp, 0xd7b17f80
adc ecx, 0xd
jmp 0x49a442
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
lea eax, [edx - 1]
mov edx, eax
sar edx, 0x1f
mov ebx, 0x15180
mov esi, edx
mul ebx
imul ebx, esi, 0x15180
add edx, ebx
add eax, ebp
adc edx, ecx
add eax, 0x886e0900
adc edx, 0xfffffff1
mov dword [esp + 0x58], edx
mov dword [esp + 0x54], eax
add esp, 0x48
ret
mov ecx, 0xd
call sym.runtime.panicIndex
mov eax, ebp
mov ecx, 0xd
call sym.runtime.panicIndex
nop
call sym.runtime.morestack_noctxt
jmp sym.time.pseudoUnix
Function at 0x4ad4c0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5d5324]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4ad561
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [esp + 0x18]
cmp dword [edx], ecx
jne 0x4ad557
movzx ecx, byte [eax + 4]
cmp byte [edx + 4], cl
jne 0x4ad557
movzx ecx, byte [eax + 5]
cmp byte [edx + 5], cl
jne 0x4ad557
movzx ecx, byte [eax + 6]
cmp byte [edx + 6], cl
jne 0x4ad557
movzx ecx, byte [eax + 7]
cmp byte [edx + 7], cl
jne 0x4ad557
movzx ecx, byte [eax + 8]
cmp byte [edx + 8], cl
jne 0x4ad557
movzx ecx, byte [eax + 9]
cmp byte [edx + 9], cl
jne 0x4ad557
movzx ecx, byte [eax + 0xa]
cmp byte [edx + 0xa], cl
jne 0x4ad557
movzx ecx, byte [eax + 0xb]
cmp byte [edx + 0xb], cl
jne 0x4ad557
movzx ecx, byte [eax + 0xc]
cmp byte [edx + 0xc], cl
jne 0x4ad557
add eax, 0x10
mov dword [esp], eax
lea eax, [edx + 0x10]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x4c
call sym.runtime.memequal
movzx eax, byte [esp + 0xc]
jmp 0x4ad559
xor eax, eax
mov byte [esp + 0x1c], al
add esp, 0x10
ret
call sym.runtime.morestack_noctxt
jmp sym.type:.eq.fmt.fmt
Function at 0x4b6880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x5d5324]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b6971
sub esp, 0x1c
mov ecx, dword [esp + 0x20]
test byte [ecx], al
mov edx, dword [esp + 0x24]
and edx, 0x7f
shl edx, 5
add ecx, edx
mov dword [esp + 0x18], ecx
xor eax, eax
jmp 0x4b68bc
mov ebx, dword [esp + 0xc]
inc ebx
mov ecx, dword [esp + 0x18]
mov eax, ebx
cmp eax, 4
jge 0x4b68f5
mov dword [esp + 0xc], eax
lea edx, [ecx + eax*8]
mov dword [esp], edx
call sym.sync_atomic.LoadUint64
mov eax, dword [esp + 0x24]
cmp dword [esp + 4], eax
sete cl
mov edx, dword [esp + 0x28]
cmp dword [esp + 8], edx
sete bl
and ebx, ecx
test bl, bl
je 0x4b68b1
mov byte [esp + 0x2c], 1
add esp, 0x1c
ret
xor eax, eax
mov edx, 0x84222325
jmp 0x4b68ff
inc eax
cmp eax, 4
jge 0x4b6914
mov dword [esp + 0x14], eax
lea ebx, [ecx + eax*8]
mov ebp, dword [ebx]
mov ebx, dword [ebx + 4]
xor esi, esi
jmp 0x4b696a
and edx, 3
lea eax, [ecx + edx*8]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call sym.sync_atomic.StoreUint64
mov byte [esp + 0x2c], 0
add esp, 0x1c
ret
mov edi, ebp
and edi, 0xff
xor edx, edi
shr ebp, 8
mov edi, ebx
shl edi, 0x18
mov dword [esp + 0x10], edi
mov eax, edx
mov edi, 0x1b3
mul edi
inc esi
mov edi, dword [esp + 0x10]
or ebp, edi
shr ebx, 8
mov edx, eax
mov eax, dword [esp + 0x14]
cmp esi, 8
jl 0x4b693b
jmp 0x4b68fe
call sym.runtime.morestack_noctxt
jmp sym.internal_bisect._dedup_.seenLossy
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x40c228
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
mov bl, 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.0040bf8d
loope 0x40c211
xchg edx, eax
inc esp
lea eax, [ebp - 0x58]
push eax
call fcn.0040bf9d
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.0040bf52
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x40c27b
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0040bf8d
mov eax, dword [0x8d68abe5]
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x40cc9f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax - 0x6b75b], al
inc dword [eax]
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
wait
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
invalid
invalid
push ebp

Function at 0x40cf58
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
test dword [ebx + 0x55fffffc], ebp
test dword [ebx + 0x55fffffc], ebp
invalid
invalid
xchg esp, eax
cld
invalid
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x50b7751e
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x69a6353e
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4059a6
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
test edi, edi
pop ecx
mov esi, eax
jbe 0x4059d1
mov eax, dword [esp + 0xc]
push ebx
mov ecx, esi
sub eax, esi
mov edx, edi
mov bl, byte [eax + ecx]
xor bl, 0x42
mov byte [ecx], bl
inc ecx
dec edx
jne 0x4059c4
pop ebx
push 0x408230
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push edi
push esi
call fcn.00404b97
push esi
mov edi, eax
call fcn.00405a0a
add esp, 0x18
mov eax, edi
pop edi
pop esi
ret 0x10

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x625b2f85
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, 0x902a282c
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401530
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55dafc
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5b2ee4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
push str.alpha_controlor
mov ecx, dword [ebp - 0x38]
add ecx, 0x2c
call dword [sym.imp.DuiLib32.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const]
mov dword [ebp - 0x10], eax
call fcn.004021c0
mov ecx, eax
call fcn.00438110
push eax
push 0x64
push 0x568160
push 0x568178
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::CProgressUI::SetValue_int_]
cmp dword [ebp - 0x10], 0
je 0x4015f6
mov dword [ebp - 0x1c], 0x401260
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x38]
push eax
lea ecx, [ebp - 0x34]
push ecx
call fcn.00402250
add esp, 0x10
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x40], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::CEventSource::operator_class_DuiLib::CDelegateBase_const__]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.0042d380
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x40f1f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
call fcn.004021c0
mov ecx, eax
call fcn.00402680
call fcn.004021c0
mov ecx, eax
call fcn.00438150
push eax
push 0
push str.auto
push 0x569fec
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x10], eax
call fcn.004021c0
mov ecx, eax
call fcn.00438150
push eax
push 0
push str.UserID
push 0x56a010
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 8], eax
call fcn.004021c0
mov ecx, eax
call fcn.00438150
push eax
push 0
push str.IsLoginSuccess
push str.UserLogin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jne 0x40f288
mov eax, dword [ebp - 8]
push eax
call fcn.004021c0
mov ecx, eax
call fcn.00437190
call fcn.0040f330
mov ecx, eax
call fcn.00424a40
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040e0b0
mov ecx, eax
call fcn.004342f0
mov edx, dword [ebp + 8]
push edx
call fcn.0040e140
mov ecx, eax
call fcn.0040fe70
mov eax, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x40f7e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
push 0x56a20c
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x40f80c
xor eax, eax
jmp 0x40f8d6
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edx, dword [ebp - 0x20]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0047f490
add esp, 0xc
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [ebp - 8]
push ecx
push 1
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.0040fa80
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40f8ac
xor eax, eax
jmp 0x40f8d6
mov ecx, dword [ebp - 0x10]
call fcn.0040fca0
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x40], eax
mov ecx, dword [ebp - 0x10]
call fcn.0040fcd0
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x44], eax
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov dword [edx + 4], eax
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x40f8e0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
push 0
push 0x80
push 3
push 0
push 3
push closesocket
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x40f915
xor eax, eax
jmp 0x40f9d4
push 0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0
push 0
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [ebp - 8]
push ecx
push 1
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.0040fa80
add esp, 8
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc], 0
jne 0x40f9aa
xor eax, eax
jmp 0x40f9d4
mov ecx, dword [ebp - 0xc]
call fcn.0040fca0
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x40], eax
mov ecx, dword [ebp - 0xc]
call fcn.0040fcd0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], ecx
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x415fa0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0x415ff0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 8]
mov dword [edx + 0x7c4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x7c4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x417c50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55eaba
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x5b2ee4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x880], 0
jne 0x417d14
push 0x300
call fcn.004617c5
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
je 0x417cb6
mov ecx, dword [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.00425ed0
mov dword [ebp - 0x20], eax
jmp 0x417cbd
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x880], ecx
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 0x880], 0
jne 0x417ce4
jmp 0x417d58
mov dword [ebp - 0x10], 0x188
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
push 0x90cf0000
push 0x56b428
push 0
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx + 0x880]
call dword [sym.imp.DuiLib32.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::Create_struct_HWND_____wchar_t_const___unsigned_long_int__unsigned_long_int__int__int__int__int__struct_HMENU____]
push 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x880]
mov ecx, dword [eax + 0x2f8]
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x880]
mov edx, dword [eax + 0x2f8]
mov eax, dword [ecx]
mov ecx, edx
mov edx, dword [eax + 0xcc]
call edx
push 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x880]
call dword [sym.imp.DuiLib32.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x41aec0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov byte [eax + 0x7a0], 1
mov dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
push 0x41b320
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x7c4], eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x7c4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x424ac0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x56be14
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0
jne 0x424ae6
xor eax, eax
jmp 0x424bac
push str.GetNativeSystemInfo
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
push str.IsWow64Process
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
push str.Wow64DisableWow64FsRedirection
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
push 0x56be74
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
push str.GetSystemWow64DirectoryW
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
jne 0x424b77
xor eax, eax
jmp 0x424bac
push 0x56becc
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], eax
push str.Wow64RevertWow64FsRedirection
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
mov eax, 1
mov esp, ebp
pop ebp
ret