joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443290
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov ebx, dword [esi]
test byte [ebx + 8], 8
je 0x4432b5
cmp dword [ebx + 4], 0xfffffffe
jne 0x4432b5
or eax, 0xffffffff
jmp 0x4433ed
test byte [ebx + 8], 8
je 0x443322
cmp dword [ebx + 4], 0xffffffff
jne 0x443322
mov dword [esi + 8], 8
mov edx, dword [ebx + 0xc]
push edx
call fcn.00443180
pop ecx
mov edi, eax
test edi, edi
je 0x44330a
add esi, 0x10
xor eax, eax
push esi
push edi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov dword [ebx + 4], 0xfffffffe
xor eax, eax
jmp 0x4433ed
call fcn.00443e04
test eax, eax
jne 0x44331a
xor eax, eax
jmp 0x4433ed
or eax, 0xffffffff
jmp 0x4433ed
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
je 0x44332f
cmp eax, 0xfffffffe
jne 0x443356
mov dword [ebx + 4], 0xffffffff
lea edx, [ebp - 0x148]
push edx
mov ecx, dword [ebx + 0xc]
push ecx
call sub.KERNEL32.DLL_FindFirstFileA
mov edi, eax
mov dword [ebx + 4], edi
cmp edi, 0xffffffff
setne al
and eax, 1
jmp 0x443366
lea edx, [ebp - 0x148]
push edx
mov ecx, dword [ebx + 4]
push ecx
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x44337c
call fcn.00443e04
test eax, eax
jne 0x443377
xor eax, eax
jmp 0x4433ed
or eax, 0xffffffff
jmp 0x4433ed
mov eax, dword [ebp - 0x148]
test al, 0x16
je 0x443390
mov edx, dword [ebx + 8]
and edx, eax
test dl, 0x16
je 0x443322
mov ecx, dword [ebp - 0x148]
mov dword [esi + 8], ecx
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x134]
push edx
call sub.KERNEL32.DLL_FileTimeToLocalFileTime
lea ecx, [esi + 0xc]
push ecx
lea eax, [esi + 0xe]
push eax
lea edx, [ebp - 8]
push edx
call sub.KERNEL32.DLL_FileTimeToDosDateTime
mov ecx, dword [ebp - 0x128]
xor eax, eax
mov dword [esi + 4], ecx
add esi, 0x10
push esi
lea edi, [ebp - 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4439fc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x104
call fcn.0044065c
pop ecx
mov ebx, eax
test eax, eax
jne 0x443a20
xor eax, eax
jmp 0x443ac9
lea edx, [ebp - 4]
push edx
push ebx
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call sub.KERNEL32.DLL_GetFullPathNameA
mov esi, eax
test esi, esi
je 0x443a41
cmp esi, 0x104
jb 0x443a4c
push ebx
call fcn.0044066c
pop ecx
xor eax, eax
jmp 0x443ac9
cmp byte [ebx + 1], 0x3a
jne 0x443a7c
mov dl, byte [ebx]
lea ecx, [ebp - 8]
mov byte [ebp - 8], dl
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], 0x5c
mov byte [ebp - 5], 0
push ecx
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
jae 0x443a7c
push ebx
call fcn.0044066c
pop ecx
xor eax, eax
jmp 0x443ac9
inc esi
test edi, edi
je 0x443abf
cmp esi, dword [ebp + 0x10]
jbe 0x443a91
push ebx
call fcn.0044066c
pop ecx
xor eax, eax
jmp 0x443ac9
push edi
mov esi, edi
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push ebx
call fcn.0044066c
pop ecx
mov eax, edi
jmp 0x443ac9
push esi
push ebx
call fcn.0044067c
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4440e8
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateDirectoryA
dec eax
je 0x444116
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
jne 0x44410f
push 5
call fcn.00443dc0
pop ecx
pop ebp
ret
call fcn.00443e24
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x447150
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.004414ec
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.004415f8
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea ecx, [ebp - 0x200]
push ecx
call fcn.004415f8
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x463689
lea ecx, [ebp - 0x200]
push ecx
call fcn.004414ec
add esp, 8
push 0xa
lea eax, [ebp - 0x200]
push eax
call fcn.004415f8
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.0044834c
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x447261
push esi
call fcn.004415f8
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.004415f8
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.0044065c
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x447238
xor eax, eax
jmp 0x4472e8
push esi
call fcn.004415f8
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.004415f8
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.00441448
add esp, 0xc
jmp 0x4472a1
mov edi, dword [ebx + 0x24]
push edi
call fcn.004415f8
pop ecx
push eax
push esi
call fcn.004415f8
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.004415f8
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.0044067c
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x4472a1
xor eax, eax
jmp 0x4472e8
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.004414ec
add esp, 8
push 0x46368b
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.004414ec
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x24]
push edx
call fcn.004414ec
add esp, 8
push 0x46368d
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.004414ec
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44acfc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x44ad5e
call fcn.0044acac
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004415f8
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004415f8
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x44adbc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x463db8], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x44ae96
cmp dword [0x463db4], 0
jne 0x44ae96
cmp dword [0x463fa8], 0
je 0x44ae50
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.0044abac
add esp, 8
mov ebx, eax
test eax, eax
jne 0x44ae36
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.0044abac
add esp, 8
mov ebx, eax
test eax, eax
jne 0x44ae36
lea ebx, [ebp - 0x84]
jmp 0x44ae37
inc ebx
call fcn.0044ad78
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x44aed1
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x463dbc
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004415f8
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x463dbf
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x44aed1
cmp dword [0x463db4], 0
je 0x44aeb0
cmp dword [0x463db4], 0xffffffff
je 0x44aed1
push esi
call dword [0x463db4]
pop ecx
mov eax, dword [0x463db8]
test eax, eax
je 0x44aed1
cmp dword [0x463db8], 0xffffffff
je 0x44aed1
cmp byte [eax], 0
je 0x44aed1
push esi
push eax
call fcn.0044acfc
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44b714
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x187cbb8], 0
jne 0x44b795
cmp dword [0x187cbd8], 0
jne 0x44b744
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x187cbd8], eax
test eax, eax
jne 0x44b744
push str.GetEnvironmentStrings_failed
call fcn.0044aee8
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x187cbd8]
jmp 0x44b758
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004415f8
pop ecx
mov edi, eax
test eax, eax
jne 0x44b750
lea edi, [ebp + 1]
push edi
call fcn.0044065c
pop ecx
mov ebx, eax
mov dword [0x187cbbc], ebx
test ebx, ebx
jne 0x44b782
xor eax, eax
jmp 0x44b858
push edi
mov edx, dword [0x187cbd8]
push edx
push ebx
call fcn.004413d8
add esp, 0xc
jmp 0x44b7b5
xor esi, esi
mov ebx, dword [0x187cbb8]
jmp 0x44b7af
push eax
call fcn.004415f8
pop ecx
test eax, eax
jne 0x44b7ab
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x44b79f
lea ebx, [esi + 4]
push 4
mov dword [0x187cbc0], ebx
inc ebx
push ebx
call fcn.0044045c
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x44b7d8
xor eax, eax
jmp 0x44b858
cmp dword [0x187cbb8], 0
jne 0x44b809
xor esi, esi
mov ebx, dword [0x187cbbc]
mov eax, dword [esp]
mov ebp, eax
jmp 0x44b7fa
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004415f8
pop ecx
mov edi, eax
test eax, eax
jne 0x44b7f0
jmp 0x44b83a
xor esi, esi
mov ebx, dword [0x187cbb8]
mov eax, dword [esp]
mov edi, eax
jmp 0x44b834
push eax
call fcn.004415f8
pop ecx
test eax, eax
je 0x44b829
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x44b82d
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x44b818
mov eax, dword [0x187cbb8]
test eax, eax
je 0x44b84a
push eax
call fcn.0044066c
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x187cbb8], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x53d3c3
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x53d3d4
lcall 0x5de5, 0x8b10c483
jmp loc.0142d4ac

Function at 0x53d3d4
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x53d3d4
lcall 0x5de5, 0x8b10c483
jmp loc.0142d4ac
Function at 0x407229
Capabilities:
Check mutex on windows

Disassembly:
push 4
mov eax, 0x568ea1
call fcn.0051066c
push str.xundupdf_screencapture
lea ecx, [ebp - 0x10]
call fcn.0040941c
and dword [ebp - 4], 0
mov eax, dword [0x5dd108]
cmp dword [eax - 0xc], 0
jle 0x40725d
push dword [eax - 0xc]
lea ecx, [ebp - 0x10]
push eax
call fcn.0040826d
push dword [ebp - 0x10]
xor esi, esi
inc esi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x40727d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40727f
xor esi, esi
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00409cc2
mov eax, esi
call fcn.00510635
ret
Function at 0x408f9e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x408ff9
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x408fea
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x408fe6
cmp esi, ecx
jae 0x408fea
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x408fd4
cmp esi, ecx
jb 0x408fee
xor eax, eax
jmp 0x408ff8
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40ae6c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x40ae7e
push 0xd
pop eax
jmp 0x40aeaf
mov ecx, edx
push ebx
push edi
xor ebx, ebx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40ae87
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push ebx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop ebx
pop esi
pop ebp
ret 0xc

Function at 0x40af47
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, ecx
test edx, edx
jne 0x40af5a
push 0xd
pop eax
jmp 0x40af9e
push esi
xor eax, eax
push edi
mov dword [ebp + 0xc], eax
mov esi, eax
mov edi, edx
mov ecx, edi
lea eax, [ecx + 2]
mov dword [ebp - 4], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp + 0xc]
jne 0x40af6d
sub ecx, dword [ebp - 4]
sar ecx, 1
inc ecx
lea edi, [edi + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x40af65
push esi
push edx
push 7
xor eax, eax
push eax
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40c1bd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x56919d
call fcn.0051070e
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
push 0x60
push ebx
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x40c23a
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x40c23a
call fcn.0040a70e
mov esi, eax
jmp 0x40c311
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x40c25d
call fcn.0040a70e
jmp 0x40c304
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x40c253
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x420], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x40c28d
mov esi, 0x8007000e
jmp 0x40c306
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.0040a6e0
jmp 0x40c2b3
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
je 0x40c286
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x41c]
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x40c253
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.0040c081
mov esi, eax
test edi, edi
je 0x40c311
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x40c32a
lea ecx, [ebp - 0x418]
call fcn.0040a681
mov eax, esi
call fcn.0051065b
ret 0x10
Function at 0x40c698
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov ebx, ecx
call fcn.0040c62e
mov ecx, dword [ebp + 0xc]
xor edi, edi
test ecx, ecx
je 0x40c776
mov edx, ecx
push esi
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x40c6b8
sub edx, esi
sar edx, 1
je 0x40c775
push 0x83e
push ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x40c736
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x40c736
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [ebx + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push eax
push esi
call fcn.00513380
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor edi, edi
cmp dword [ebx + 0xc], 0
je 0x40c775
lea eax, [ebp + 8]
mov dword [ebp + 8], edi
push eax
push 1
push dword [ebx + 0xc]
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x40c775
cmp dword [ebp + 8], eax
je 0x40c775
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
test eax, eax
je 0x40c770
push ecx
push dword [ebp + 8]
mov ecx, eax
call fcn.0040cbbd
jmp 0x40c772
mov eax, edi
mov dword [ebx + 0x14], eax
pop esi
mov ecx, dword [ebx + 0x14]
test ecx, ecx
je 0x40c79a
call fcn.0040cb96
mov ecx, dword [ebx + 0x14]
mov dword [ebx + 4], eax
call fcn.0040cb6f
mov dword [ebx + 8], eax
xor eax, eax
cmp dword [ebx + 4], edi
setg al
jmp 0x40c79c
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40d334
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], edx
push eax
push 0x80
push 2
push eax
push eax
push 0xc0000000
push ecx
mov esi, 0xfa000
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40d366
xor eax, eax
jmp 0x40d3b3
mov eax, dword [ebp - 4]
push edi
mov edi, dword [ebp + 8]
push 0
cmp edi, 0xfa000
lea ecx, [ebp - 8]
push ecx
cmovb esi, edi
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40d3a9
cmp esi, edi
je 0x40d39d
mov eax, dword [ebp - 4]
sub edi, 0xfa000
add eax, esi
mov dword [ebp - 4], eax
jmp 0x40d36d
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x40d3b2
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40dd6c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [ebp + 0xc], ebx
jne 0x40dd81
push 0x83e
jmp 0x40dd84
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x5cbbf0]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x40de72
push esi
push dword [0x5cbbf0]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x40de72
push esi
push dword [0x5cbbf0]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push eax
push esi
call fcn.00513380
add esp, 0xc
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov esi, dword [ebp - 4]
test esi, esi
je 0x40de72
lea eax, [ebp + 0xc]
xor edi, edi
push eax
push 1
push esi
mov dword [ebp + 0xc], edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x40de31
cmp dword [ebp + 0xc], ebx
je 0x40de31
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
test eax, eax
je 0x40de31
push ecx
push dword [ebp + 0xc]
mov ecx, eax
call fcn.0040e4ae
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test ebx, ebx
je 0x40de72
mov dword [ebp + 8], edi
mov eax, dword [ebx + 8]
mov dword [ebx + 8], edi
test eax, eax
jne 0x40de65
push edi
lea eax, [ebp + 8]
push eax
push dword [ebx + 4]
call dword [sym.imp.gdiplus.dll_GdipCreateHBITMAPFromBitmap]
test eax, eax
je 0x40de65
mov dword [ebx + 8], eax
mov eax, dword [ebx]
mov ecx, ebx
push 1
call dword [eax]
mov eax, dword [ebp + 8]
jmp 0x40de74
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40e612
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5b3074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
push 0
push 0x100
push 0
lea ebx, [esi + 4]
mov ecx, ebx
call fcn.0040e9fb
lea edi, [esi + 0x28]
push 1
mov ecx, edi
call fcn.0041c508
push dword [ebx]
call fcn.0041b9ce
push 0xd
push str.IDB_PNG2
push ecx
mov ecx, edi
call fcn.0041ba21
cmp dword [0x5cbe0c], 0
mov eax, dword [0x5dd104]
je 0x40e6aa
cmp dword [eax - 0xc], 0
jne 0x40e692
mov ecx, dword [esi + 0xdc]
xor eax, eax
test ecx, ecx
mov edx, 0x5b7000
setne al
add eax, 0xc
push eax
mov eax, 0x5ba5a0
test ecx, ecx
cmovne eax, edx
jmp 0x40e6ec
mov ecx, dword [0x5cbbf4]
test ecx, ecx
push 0xb
pop eax
push 2
pop edx
cmovne eax, edx
mov edx, 0x5b42a0
jmp 0x40e6e3
cmp dword [eax - 0xc], 0
jne 0x40e6cd
mov ecx, dword [esi + 0xdc]
xor eax, eax
test ecx, ecx
mov edx, 0x5c0480
setne al
add eax, 0xc
push eax
mov eax, 0x5c3a20
jmp 0x40e68b
mov ecx, dword [0x5cbbf4]
test ecx, ecx
push 0xb
pop eax
push 2
pop edx
cmovne eax, edx
mov edx, 0x5bd720
push eax
mov eax, 0x5b3a60
cmove eax, edx
push eax
mov ecx, edi
call fcn.0041b798
push 0x1b
pop ecx
push 6
push ecx
xor edx, edx
mov dword [esi + 0xc4], eax
push eax
push edx
push edx
push edx
push dword [ebx]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.0041c065
push 1
mov ecx, edi
call fcn.0041c4fb
push 0
push dword [ebx]
call dword [sym.imp.USER32.dll_ShowWindow]
and dword [esi + 0xd8], 0
xor eax, eax
mov ecx, dword [ebp - 4]
inc eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0050f7b9
mov esp, ebp
pop ebp
ret 4
Function at 0x40f995
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5b3074]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x228], eax
je 0x40fb53
xor ecx, ecx
mov dword [ebx + 0x228], eax
inc ecx
xor edi, edi
cmp eax, ecx
je 0x40fa98
cmp eax, 3
je 0x40fa98
cmp eax, 2
jne 0x40fb48
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push dword [ebx + 0x22c]
call esi
push 5
push dword [ebx + 0x230]
call esi
push edi
lea ecx, [ebx + 0x3c]
call fcn.0041c4fb
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
mov edi, 0xc8
push 4
push edi
push 0x3c
push 7
push 0x1e
push 0
push dword [ebx + 0x230]
call esi
push 4
push edi
push 0x2b
push 7
push 0x64
xor edi, edi
push edi
push dword [ebx + 0x22c]
call esi
movaps xmm0, xmmword [0x5936e0]
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebx + 0x174]
movups xmmword [ebp - 0x18], xmm0
call fcn.0041c065
movaps xmm0, xmmword [0x593640]
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebx + 0xd8]
movups xmmword [ebp - 0x28], xmm0
call fcn.0041c065
push 0x22
push 0xb2
push 5
push 0x96
lea eax, [ebx + 0x214]
push eax
call dword [sym.imp.USER32.dll_SetRect]
push 6
push 0x27
push 0x144
push edi
push edi
push edi
push dword [ebx + 4]
call esi
jmp 0x40fb45
push ecx
lea ecx, [ebx + 0x3c]
call fcn.0041c4fb
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebx + 0x22c]
call esi
push 0
push dword [ebx + 0x230]
call esi
movaps xmm0, xmmword [0x5936d0]
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebx + 0x174]
movups xmmword [ebp - 0x28], xmm0
call fcn.0041c065
movaps xmm0, xmmword [0x593630]
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebx + 0xd8]
movups xmmword [ebp - 0x18], xmm0
call fcn.0041c065
push 0x22
push 0x76
push 5
push 0x5a
lea eax, [ebx + 0x214]
push eax
call dword [sym.imp.USER32.dll_SetRect]
xor eax, eax
cmp dword [ebp + 8], 1
push ecx
setne al
lea ecx, [ebx + 0x3c]
add eax, 0x500
push eax
call fcn.0041c2cb
push 0xa
pop eax
xor ecx, ecx
push 6
inc ecx
cmp dword [ebp + 8], ecx
push 0x27
push 0x108
cmove eax, ecx
xor edi, edi
push edi
push edi
push edi
push dword [ebx + 4]
mov dword [ebx + 0x224], eax
call dword [sym.imp.USER32.dll_SetWindowPos]
xor ecx, ecx
inc ecx
push ecx
push edi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0050f7b9
mov esp, ebp
pop ebp
ret 4