joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7288370e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebx, dword [esi + edi*4]
add ebx, ebp
mov ebp, 0xffffffff
xor edx, edx
nop
nop
nop
nop
mov ecx, edx
cmp byte [ebx + ebp + 1], 0
lea ebp, [ebp + 1]
add dword [ebp - 0xe8afeae], ecx
add dword [ebp - 0xe8afeae], ecx
test ebp, ebp
je 0x72883745
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
imul ebp, eax
movzx edx, byte [ebx]
add ebp, edx
inc ebx
dec ecx
jne 0x72883725
cmp ebp, dword [esp]
jne 0x7288374c
jmp 0x72883761
xor ebp, ebp
cmp ebp, dword [esp]
je 0x72883761
inc edi
cmp edi, dword [esp + 0xc]
mov ebp, dword [esp + 4]
jne 0x728836f5
mov dword [esp + 0x14], 0
jmp 0x7288377a
mov eax, dword [esp + 8]
movzx eax, word [eax + edi*2]
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
mov ebp, dword [esp + 4]
add eax, ebp
mov dword [esp + 0x14], eax
push dword [0x7288a1c8]
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edx, dword [0x7288a1c8]
mov dword [esp + 0xc], eax
mov ecx, eax
call fcn.72883585
mov ecx, dword [0x7288a1b0]
mov eax, dword [0x7288a1dc]
mov edx, dword [0x7288a1f4]
mov dword [esp], edx
mov edx, dword [ebp + 0x3c]
add edx, ebp
mov ecx, dword [edx + ecx*8 + 0x78]
mov edx, dword [ebp + ecx + 0x20]
add edx, ebp
mov esi, dword [ebp + ecx + 0x1c]
mov dword [esp + 8], esi
mov ecx, dword [ebp + ecx + 0x24]
mov dword [esp + 0x10], ecx
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [edx + ebx*4]
add edi, ebp
mov esi, 0xffffffff
xor ecx, ecx
nop
nop
nop
nop
mov ebp, ecx
cmp byte [edi + esi + 1], 0
lea esi, [esi + 1]
lea ecx, [ecx + 1]
jne 0x728837e5
test esi, esi
je 0x72883825
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
imul esi, eax
movzx ecx, byte [edi]
add esi, ecx
inc edi
dec ebp
jne 0x72883805
cmp esi, dword [esp]
jne 0x7288382c
jmp 0x72883833
xor esi, esi
cmp esi, dword [esp]
je 0x72883833
inc ebx
mov ebp, dword [esp + 4]
jmp 0x728837d5
mov ebp, dword [esp + 4]
mov ecx, dword [esp + 8]
add ecx, ebp
mov eax, dword [esp + 0x10]
add eax, ebp
movzx eax, word [eax + ebx*2]
mov ecx, dword [ecx + eax*4]
add ecx, ebp
push 0x104
mov edi, dword [esp + 0x10]
push edi
push 0
call ecx
mov ecx, 0xffffffff
mov eax, dword [0x7288a1d0]
nop
cmp word [edi + ecx*2 + 2], 0
lea ecx, [ecx + 1]
jne 0x72883865
mov edx, dword [0x7288a1f0]
cmp word [edi + ecx*2 - 2], dx
jne 0x72883885
mov edx, ecx
jmp 0x7288389d
mov word [edi + ecx*2], 0
mov esi, dword [0x7288a1f0]
lea edx, [ecx - 1]
cmp word [edi + ecx*2 - 4], si
mov ecx, edx
jne 0x72883885
movzx ecx, byte [eax]
test cl, cl
je 0x728838c6
lea edx, [edi + edx*2]
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movsx ecx, cl
mov word [edx + esi*2], cx
movzx ecx, byte [eax + esi + 1]
inc esi
test cl, cl
jne 0x728838b5
mov ecx, dword [0x7288a1b0]
mov eax, dword [0x7288a1dc]
mov edx, dword [0x7288a1c4]
mov dword [esp], edx
mov edx, dword [ebp + 0x3c]
add edx, ebp
mov ecx, dword [edx + ecx*8 + 0x78]
mov edx, dword [ebp + ecx + 0x20]
add edx, ebp
mov esi, dword [ebp + ecx + 0x1c]
mov dword [esp + 8], esi
mov ecx, dword [ebp + ecx + 0x24]
mov dword [esp + 0x10], ecx
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x72883c28
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0xc], esi
mov esi, dword [edi + edx + 0x1c]
add esi, edi
mov dword [esp + 0x1c], esi
mov edx, dword [edi + edx + 0x24]
add edx, edi
mov dword [esp + 0x2c], edx
xor esi, esi
nop
nop
nop
mov edx, dword [esp + 0xc]
mov ebx, dword [edx + esi*4]
add ebx, edi
mov edx, 0xffffffff
xor edi, edi
mov ebp, edi
cmp byte [ebx + edx + 1], 0
lea edx, [edx + 1]
lea edi, [edi + 1]
jne 0x72883c55
test edx, edx
je 0x72883c95
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
imul edx, eax
movzx edi, byte [ebx]
add edx, edi
inc ebx
dec ebp
jne 0x72883c75
cmp edx, ecx
jne 0x72883c9b
jmp 0x72883cb5
xor edx, edx
cmp edx, ecx
je 0x72883cb5
inc esi
cmp esi, dword [esp]
mov edi, dword [esp + 4]
jne 0x72883c45
push 1
call dword [esp + 0x18]
mov dword [esp + 0x1c], 0
jmp 0x72883ccc
mov eax, dword [esp + 0x2c]
movzx eax, word [eax + esi*2]
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + eax*4]
add eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 8]
movsx ecx, byte [eax]
add eax, ecx
mov dword [esp + 8], eax
mov eax, dword [0x7288a1b0]
mov dword [esp], eax
mov eax, dword [0x7288a1dc]
mov esi, dword [0x7288a1dc]
mov edx, dword [esp + 0x18]
add edx, ecx
mov ecx, dword [esp + 0x10]
lea edi, [ecx + edx + 1]
mov ebx, 0xffffffff
nop
nop
nop
nop
nop
nop
cmp byte [edi + ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x72883d05
xor ecx, ecx
test ebx, ebx
je 0x72883d33
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
imul ecx, esi
movzx edx, byte [edi + ebp]
add ecx, edx
inc ebp
cmp ebx, ebp
jne 0x72883d25
mov edi, dword [esp + 4]
mov edx, dword [edi + 0x3c]
add edx, edi
mov esi, dword [esp]
mov edx, dword [edx + esi*8 + 0x78]
mov esi, dword [edi + edx + 0x18]
mov dword [esp], esi
test esi, esi
je 0x72883dd5
mov esi, dword [edi + edx + 0x20]
add esi, edi
mov dword [esp + 0xc], esi
mov esi, dword [edi + edx + 0x1c]
add esi, edi
mov dword [esp + 0x10], esi
mov edx, dword [edi + edx + 0x24]
add edx, edi
mov dword [esp + 0x18], edx
xor esi, esi
nop
nop
nop
mov edx, dword [esp + 0xc]
mov ebx, dword [edx + esi*4]
add ebx, edi
mov edx, 0xffffffff
xor edi, edi
mov ebp, edi
cmp byte [ebx + edx + 1], 0
lea edx, [edx + 1]
lea edi, [edi + 1]
jne 0x72883d85
test edx, edx
je 0x72883dc5
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
imul edx, eax
movzx edi, byte [ebx]
add edx, edi
inc ebx
dec ebp
jne 0x72883da5
cmp edx, ecx
jne 0x72883dcb
jmp 0x72883de5
xor edx, edx
cmp edx, ecx
je 0x72883de5
inc esi
cmp esi, dword [esp]
mov edi, dword [esp + 4]
jne 0x72883d75
push 1
call dword [esp + 0x18]
mov dword [esp + 4], 0
jmp 0x72883dfc
mov eax, dword [esp + 0x18]
movzx eax, word [eax + esi*2]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 4]
add edx, dword [ecx + eax*4]
mov dword [esp + 4], edx
mov ecx, dword [esp + 8]
movsx eax, byte [ecx]
lea esi, [ecx + eax]
lea eax, [ecx + eax + 1]
push eax
Function at 0x7288408f
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea esi, [edi + 4]
mov eax, dword [esi]
cmp eax, 2
je 0x72884112
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
mov eax, dword [0x7288a3c4]
mov ecx, dword [esi]
cmp ecx, 2
je 0x72884111
pause
dec eax
test eax, eax
jg 0x728840b9
call ebx
sub eax, dword [ebp - 4]
cmp eax, 0x64
jb 0x728840ae
xor ecx, ecx
inc ecx
xor eax, eax
lock cmpxchg dword [esi], ecx
cmp eax, 2
je 0x72884111
cmp dword [edi + 0xc], 0
jne 0x72884106
test eax, eax
jne 0x728840fa
lea esi, [ebp - 0xc]
mov byte [ebp - 0xc], 1
call fcn.728821a0
mov dword [edi + 0xc], eax
jmp 0x72884106
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
cmp dword [edi + 0xc], 0
je 0x728840fa
push 0xffffffffffffffff
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop ebx
pop esi
leave
ret

Function at 0x72884225
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [0x7288a034]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [eax + 0x18]
mov dword [ebp - 4], eax
mov ecx, dword [edx + 0x10]
test ecx, ecx
je 0x7288425e
lea edi, [ecx - 1]
lea ebx, [edx + 0x10]
mov eax, ecx
lock cmpxchg dword [ebx], edi
cmp eax, ecx
jne 0x72884240
mov esi, dword [edx + 0xc]
sub esi, ecx
jmp 0x72884269
mov eax, dword [ebp - 4]
or esi, 0xffffffff
call fcn.728846e8
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x72884319
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x7288a034]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x72884337
mov ecx, dword [eax + 0x14]
cmp dword [ecx + 4], 1
je 0x72884337
jmp fcn.728846e8
ret

Function at 0x7288433d
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
push dword [0x7288a034]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
je 0x72884385
mov eax, dword [edi + 0x14]
cmp dword [eax + 4], 1
je 0x72884385
mov eax, dword [edi + 0x18]
mov ecx, dword [ebp + 8]
push esi
lea edx, [ebp + 0xc]
lea esi, [eax + 0x14]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
call fcn.7288411a
mov eax, edi
call fcn.728846e8
pop esi
pop edi
pop ebp
jmp sym.VCOMP100.DLL__vcomp_barrier
pop edi
pop ebp
ret

Function at 0x7288438d
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebx
push esi
push edi
push dword [0x7288a034]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp dword [esi + 0xc], 0
mov ebx, dword [esi + 0x18]
jne 0x728843bd
lea edi, [ebx + 0x14]
call fcn.7288408f
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0xc]
mov dword [esi + 0xc], ecx
mov dword [esi + 8], eax
add dword [esi + 0xc], 4
mov eax, dword [esi + 0xc]
mov edi, dword [eax - 4]
dec dword [esi + 8]
jne 0x728843d0
and dword [esi + 0xc], 0
cmp dword [esi + 0xc], 0
jne 0x728843dd
mov eax, esi
call fcn.728846e8
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x728846e8
Capabilities:
Get thread local storage value

Disassembly:
mov ecx, dword [eax + 0x18]
mov byte [eax + 0x1c], 0
lea eax, [ecx + 4]
or edx, 0xffffffff
lock xadd dword [eax], edx
mov eax, dword [ecx]
jne 0x72884726
call dword [eax + 0xc]
push dword [0x7288a034]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax + 0x14]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 8]
mov dword [eax + 0x18], edx
add eax, 0x1c
cmp ecx, eax
je 0x72884725
mov eax, dword [ecx]
push 1
call dword [eax]
ret
jmp dword [eax + 8]

Function at 0x7288472e
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push ebx
push esi
push dword [0x7288a034]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jne 0x728847b5
push 0x24
call fcn.72881c36
mov esi, eax
pop ecx
cmp esi, ebx
je 0x728847a6
push 0x2c
call fcn.72881c36
pop ecx
cmp eax, ebx
je 0x72884788
lea ecx, [eax + 0x1c]
mov byte [eax], bl
xor edx, edx
mov dword [eax + 8], ebx
inc edx
mov dword [eax + 4], edx
mov dword [eax + 0x18], ecx
mov dword [ecx], 0x72881408
mov dword [ecx + 4], edx
mov dword [ecx + 8], ebx
mov dword [ecx], 0x72881418
mov dword [eax + 0x28], ebx
jmp 0x7288478a
xor eax, eax
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], eax
mov byte [esi + 0x1c], bl
mov dword [esi + 0x20], ebx
mov eax, dword [eax + 0x18]
mov dword [esi + 0x18], eax
jmp 0x728847a8
xor esi, esi
push esi
push dword [0x7288a034]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
pop esi
pop ebx
ret

Function at 0x728857f4
Capabilities:
Allocate thread local storage
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 0xc]
cmp ebx, 1
jne 0x7288582d
push esi
push edi
call fcn.72887df0
mov eax, 0x72881104
mov esi, 0x72881108
mov edi, eax
cmp eax, esi
jae 0x7288582b
mov eax, dword [edi]
test eax, eax
je 0x72885824
call eax
add edi, 4
cmp edi, esi
jb 0x7288581c
pop edi
pop esi
and dword [0x7288a3a8], 0
cmp ebx, 1
jne 0x72885866
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x7288a034], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x7288585a
mov dword [0x7288a010], eax
call fcn.7288592a
call fcn.728859b1
jmp 0x72885880
test ebx, ebx
jne 0x72885871
call fcn.7288588d
jmp 0x72885880
cmp ebx, 2
je 0x72885880
cmp ebx, 3
jne 0x72885880
call fcn.728858e0
xor eax, eax
inc eax
pop ebx
leave
ret 0xc
Function at 0x4011a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44bb49
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x45e080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [esi], vtable.CNsBase.0
mov eax, dword [section..data]
mov edx, dword [eax + 0xc]
mov ecx, section..data
call edx
add eax, 0x10
mov dword [esi + 0x4c], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebx + 1]
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov word [esi + 0x30], pe_nt_image_headers32
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], 4
mov byte [esi + 0x3c], bl
test byte [0x4613bc], al
jne 0x401246
or dword [0x4613bc], eax
mov ecx, 0x4613c0
mov byte [ebp - 4], al
call sym.Install_vip.exe_public:_void___thiscall_CNsFont::constructor_void_
push 0x44c4d0
call fcn.004196ac
add esp, 4
mov byte [ebp - 4], bl
push ebx
push ebx
push ebx
push ebx
push ebx
mov ecx, 0x4613c0
call sym.Install_vip.exe_public:_struct_HFONT______thiscall_CNsFont::GetFont_int__wchar_t_const___int__int__int_
mov dword [esi + 0x24], eax
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov byte [esi + 0x48], bl
mov dword [esi + 0x50], esi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x402580
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
mov byte [ecx + 0x31], al
test al, al
je 0x40259d
mov eax, dword [ecx + 0x54]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 4
mov ecx, dword [ecx + 0x54]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 4

Function at 0x403cc0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 0x66666667
imul dword [esi + 0x18]
push ebx
push edi
sar edx, 1
mov edi, edx
shr edi, 0x1f
add edi, edx
mov ebx, edi
mov dword [ebp - 4], 5
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x10]
push 0x40
sub eax, ebx
push eax
mov eax, dword [esi + 0xc]
push ecx
mov ecx, dword [esi + 0x54]
push edx
push eax
push 0
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
add ebx, edi
dec dword [ebp - 4]
jne 0x403ce0
mov edx, dword [esi + 0x54]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x54]
push 0
push 0
push 0x200
push eax
mov byte [esi + 0xc7], 1
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403ff0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, 0x66666667
imul dword [esi + 0x18]
sar edx, 2
push ebx
mov ebx, dword [esi + 0x10]
push edi
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov byte [esi + 0xc8], 1
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edi
mov dword [ebp - 8], 9
jmp 0x404033
mov eax, dword [ebp - 0xc]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0xc]
add ebx, eax
mov eax, dword [esi + 0x18]
sub eax, dword [ebp - 4]
push 0x40
push eax
mov eax, dword [esi + 0x54]
push ecx
push ebx
push edx
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0xf
call dword [sym.imp.KERNEL32.dll_Sleep]
add dword [ebp - 4], edi
dec dword [ebp - 8]
jne 0x404030
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
cdq
push 0x40
sub eax, edx
mov edx, dword [esi + 0xc]
push 1
sar eax, 1
add eax, dword [esi + 0x10]
push ecx
push eax
mov eax, dword [esi + 0x54]
push edx
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [esi]
mov eax, dword [edx + 0x20]
mov ecx, esi
call eax
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esi + 0x54]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 0x54]
push 0
push 0
push 0x200
push edx
mov byte [esi + 0xc7], 1
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4040d0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0x54]
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowLongW]
push 0xffffffffffffffec
push eax
call edi
mov ecx, dword [esi + 0x54]
or eax, 0x80000
push eax
push 0xffffffffffffffec
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov edx, dword [esi + 0x54]
push 2
push 0
push 0
push edx
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov eax, dword [esi + 0x54]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, 1
mov ecx, dword [esi + 0x54]
push 0xffffffffffffffec
push ecx
call edi
mov edx, dword [esi + 0x54]
or eax, 0x80000
push eax
push 0xffffffffffffffec
push edx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov al, bl
mov cl, 0x13
imul cl
add al, 0x3c
movzx edx, al
mov eax, dword [esi + 0x54]
push 2
push edx
push 0
push eax
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
push 0x1e
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0xa
jle 0x404113
pop edi
pop ebx
ret
Function at 0x404a90
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 0x66666667
imul dword [esi + 0x14]
push ebx
push edi
sar edx, 2
mov edi, edx
shr edi, 0x1f
add edi, edx
mov ebx, edi
mov dword [ebp - 4], 0xa
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x10]
push 0x40
push eax
mov eax, dword [esi + 0xc]
sub ecx, ebx
push ecx
mov ecx, dword [esi + 0x54]
push edx
push eax
push 0
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [esi]
mov eax, dword [edx + 0x20]
mov ecx, esi
call eax
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
add ebx, edi
dec dword [ebp - 4]
jne 0x404ab1
mov ecx, dword [esi + 0x54]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 0x54]
push 0
push 0
push 0x200
push edx
mov byte [esi + 0xc7], 1
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404d70
Capabilities:
Hide graphical window

Disassembly:
mov ecx, dword [esi + 0x54]
push 0
push ecx
mov dword [esi + 0x68], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 0x54]
push 0
push 0
push 0x200
push edx
mov byte [esi + 0xc7], 1
call dword [sym.imp.USER32.dll_SendMessageW]
ret

Function at 0x404da0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0x54]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x54]
push 0
push 0
push 0x200
push ecx
mov byte [esi + 0xc7], 1
call dword [sym.imp.USER32.dll_SendMessageW]
ret

Function at 0x4057a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4057fc
mov eax, dword [esi + 0x54]
push 0
push 0
push 0x200
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 0x54]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 0x10c]
mov eax, dword [esi + 0x54]
push 0x472
push str.ck_W
push edx
push eax
call sym.Install_vip.exe_int___cdecl_ShowTray_struct_HWND_____struct_HICON_____wchar_t_const___unsigned_int_
mov ecx, dword [esi + 0x54]
push 2
push 0x44fd9c
push 0x44fda4
push ecx
call sym.Install_vip.exe_int___cdecl_ShowBalloon_struct_HWND_____wchar_t_const___wchar_t_const___int_
add esp, 0x20
pop esi
pop ebp
ret 4

Function at 0x406370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x406388
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4063ba
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x4063b6
cmp esi, eax
jae 0x4063ba
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4063a8
cmp esi, eax
jb 0x4063c0
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x408e40
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x44c228
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push ebx
push esi
push edi
mov eax, dword [0x45e080]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0xc]
cmp eax, 0x10
je 0x409000
cmp eax, 0x113
je 0x408fe3
cmp eax, 0x7e9
je 0x408eb5
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push ecx
push edx
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, esi
call fcn.00402c30
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp byte [esi + 0x1994], 0
je 0x408fb3
mov ecx, dword [ebp + 0x10]
fild dword [ebp + 0x10]
test ecx, ecx
jns 0x408ed2
fadd dword [0x453118]
fdiv qword [0x4530f0]
mov edx, dword [ebp + 0x14]
mov dword [esi + 0x1998], edx
mov ecx, section..data
fstp dword [esi + 0x24c]
mov eax, dword [section..data]
mov edx, dword [eax + 0xc]
call edx
add eax, 0x10
mov dword [esp + 0x40], eax
mov dword [esp + 0x80], 0
fld dword [esi + 0x24c]
mov eax, dword [esi + 0x1998]
sub esp, 8
fstp qword [esp]
mov ebx, 1
test eax, eax
jne 0x408f2a
push str._.0f__
jmp 0x408f3a
cmp eax, ebx
jne 0x408f35
push str._.1f__
jmp 0x408f3a
push str._.2f__
lea edi, [esp + 0x4c]
call fcn.00405ff0
mov eax, dword [esi + 0x118]
mov edi, dword [esp + 0x4c]
mov byte [eax + 0x31], bl
mov eax, dword [esi + 0x118]
add esp, 0xc
mov edx, edi
call fcn.00402370
fld dword [esi + 0x24c]
fcomp qword [0x4530f0]
fnstsw ax
test ah, 1
jne 0x408f83
mov ecx, dword [esi + 0x54]
push 0
push 0
push 0x10
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [edi - 0x10]
mov dword [esp + 0x80], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409075
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x409075
mov eax, 0x51eb851f
mul dword [ebp + 0x10]
shr edx, 5
mov dword [esi + 0x250], edx
mov dword [esi + 0x1998], 0
cmp edx, 0x64
jne 0x409075
mov byte [esi + 0x244], 1
jmp 0x409075
mov eax, dword [esi + 0x19a0]
inc eax
cdq
idiv dword [esi + 0x199c]
mov dword [esi + 0x19a0], edx
mov edx, dword [esi]
mov eax, dword [edx + 0x20]
call eax
jmp 0x409075
mov ecx, dword [esi + 0x54]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 0x54]
push 0
push 0
push 0x200
mov ebx, 1
push edx
mov byte [esi + 0xc7], bl
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esi + 0x258]
call sym.Install_vip.exe_public:_void___thiscall_CNsInstaller::AutoRun_void_
lea ecx, [esi + 0x258]
call sym.Install_vip.exe_public:_void___thiscall_CNsInstaller::WaitUpdate_void_
mov byte [esi + 0x234], bl
test byte [0x461000], bl
jne 0x40906b
or dword [0x461000], ebx
mov ecx, 0x461008
call sym.Install_vip.exe_public:_void___thiscall_CNsApp::constructor_void_
push 0x44c4c0
call fcn.004196ac
add esp, 4
mov ecx, 0x461008
call sym.Install_vip.exe_public:_void___thiscall_CNsApp::ExitApp_void_
xor eax, eax
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10