joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43efc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446b73
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x459080]
xor eax, ebp
mov dword [ebp - 0x24], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00424751
add esp, 4
lea esi, [ebp - 0x10]
call fcn.00405700
mov dword [ebp - 4], 0
call fcn.00424763
push eax
call fcn.00424763
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.NS_08d_05d_05d
lea edi, [ebp - 0x10]
call fcn.00405ee0
add esp, 0x10
cmp dword [ebp + 0xc], 0
je 0x43f123
push 0
lea ecx, [ebp - 0x1c]
call fcn.004123f0
mov byte [ebp - 4], 1
push 0xf003f
push 0x44e01c
push SysReAllocString
lea ecx, [ebp - 0x1c]
call fcn.00412100
test eax, eax
jne 0x43f0d8
mov dword [ebp - 0x20], 0x1e
xor eax, eax
mov word [ebp - 0x8c], ax
push 0x62
push 0
lea ecx, [ebp - 0x8a]
push ecx
call fcn.004188a0
add esp, 0xc
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x8c]
push eax
push 0x44e040
lea ecx, [ebp - 0x1c]
call fcn.00411fa0
lea ecx, [ebp - 0x8c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x14
je 0x43f0c8
push 1
lea eax, [ebp - 0x10]
call fcn.00405980
push eax
push 0x44e048
lea ecx, [ebp - 0x1c]
call fcn.004121a0
jmp 0x43f0d6
lea edx, [ebp - 0x8c]
lea edi, [ebp - 0x10]
call fcn.00405880
jmp 0x43f10f
push 0
push 0
push 0x2001f
push 0
push 0
push str.SOFTWARENewsoft
push SysReAllocString
lea ecx, [ebp - 0x1c]
call fcn.004122c0
push 1
lea eax, [ebp - 0x10]
call fcn.00405980
push eax
push 0x44e074
lea ecx, [ebp - 0x1c]
call fcn.004121a0
lea ecx, [ebp - 0x1c]
call fcn.00412380
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.004123d0
lea eax, [ebp - 0x10]
call fcn.00405980
push eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x10]
call fcn.004057f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.0041799a
mov esp, ebp
pop ebp
ret

Function at 0x43f6c0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x102
jne 0x43f6ef
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret 8

Function at 0x43f700
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
call fcn.00424124
add esp, 0x18
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
je 0x43f73e
cmp dword [ebp - 4], 0
je 0x43f73e
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x43f741
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43f980
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x28]
call sym.Install_ring.exe_private:_struct_tagNsTimer____thiscall_CNsThread::AddTimer_struct_tagNsTimer__
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x43f9c5
jmp 0x43f9ea
push 0
push 0
mov eax, dword [ebp - 0x20]
push eax
push sym.Install_ring.exe_private:_static_unsigned_int___stdcall_CNsThread::TimerThread_void__
push 0
push 0
call fcn.00424124
add esp, 0x18
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov dword [ecx + 0x14], edx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x440110
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44634c
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x459080]
xor eax, ebp
mov dword [ebp - 0x24], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x98], ecx
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov eax, dword [ebp + 0xc]
call fcn.00405980
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
jne 0x440172
jmp 0x4402b8
push 0
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x6c]
call fcn.00405700
mov dword [ebp - 4], 0
push 0x5c
mov ecx, dword [ebp + 0xc]
call fcn.0040e070
add eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
push 0x2e
mov ecx, dword [ebp + 0xc]
call fcn.0040e000
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x1c], 0
jle 0x440206
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x1c]
jle 0x440206
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x70]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.0040e0c0
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0xa0]
lea edi, [ebp - 0x6c]
call fcn.00405810
mov byte [ebp - 4], 0
lea eax, [ebp - 0x70]
call fcn.004057f0
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00422764
add esp, 4
mov dword [ebp - 0x74], eax
mov edx, dword [ebp - 0x74]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x68], 0
push 0
lea eax, [ebp - 0x68]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40
push 0
lea edx, [ebp - 0x64]
push edx
call fcn.004188a0
add esp, 0xc
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x6c]
call fcn.00405980
push eax
lea ecx, [ebp - 0x64]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [ebp + 8]
push edx
push 1
push 0x40
lea eax, [ebp - 0x64]
push eax
call fcn.0042431b
add esp, 0x10
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 1
mov eax, dword [ebp - 0x14]
push eax
call fcn.0042431b
add esp, 0x10
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x78], ecx
mov edx, dword [ebp - 0x78]
push edx
call fcn.00424395
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x6c]
call fcn.004057f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.0041799a
mov esp, ebp
pop ebp
ret 8
Function at 0x4402e0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446c1f
mov eax, dword fs:[0]
push eax
sub esp, 0x290
mov eax, dword [0x459080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x298], ecx
push 0x44e8b0
mov eax, dword [ebp + 0xc]
push eax
call fcn.0042445e
add esp, 8
mov dword [ebp - 0x26c], eax
lea ecx, [ebp - 0x268]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00405740
mov dword [ebp - 4], 0
push 0x44e8b4
lea ecx, [ebp - 0x268]
call fcn.0040cb60
lea edx, [ebp - 0x264]
push edx
lea eax, [ebp - 0x268]
call fcn.00405980
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0xffffffff
jne 0x44039c
mov byte [ebp - 0x275], 0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x268]
call fcn.004057f0
mov al, byte [ebp - 0x275]
jmp 0x440454
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0x10
je 0x4403b3
jmp 0x4403b5
jmp 0x44040a
lea esi, [ebp - 0x274]
call fcn.00405700
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x44e8bc
lea edi, [ebp - 0x274]
call fcn.00405ee0
add esp, 0xc
lea eax, [ebp - 0x274]
push eax
mov ecx, dword [ebp - 0x26c]
push ecx
mov ecx, dword [ebp - 0x298]
call sym.Install_ring.exe_private:_void___thiscall_CNsSkin::WriteSkin_struct__iobuf___class_ATL::CStringT_wchar_t__class_ATL::StrTraitATL_wchar_t__class_ATL::ChTraitsCRT_wchar_t_____
mov byte [ebp - 4], 0
lea eax, [ebp - 0x274]
call fcn.004057f0
lea edx, [ebp - 0x264]
push edx
mov eax, dword [ebp - 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x44039c
mov ecx, dword [ebp - 0x26c]
push ecx
call fcn.004220aa
add esp, 4
mov byte [ebp - 0x276], 1
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x268]
call fcn.004057f0
mov al, byte [ebp - 0x276]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041799a
mov esp, ebp
pop ebp
ret 8
Function at 0x440560
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
cmp dword [eax + 8], 0
je 0x44057a
mov ecx, dword [ebp - 0x14]
call sym.Install_ring.exe_public:_void___thiscall_CNsSkin::FreeSkin_void_
cmp dword [ebp + 8], 0
je 0x44058c
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x14]
call sym.Install_ring.exe_public:_void___thiscall_CNsSkin::SetSkinName_wchar_t_const__
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov eax, dword [ebp - 0x14]
call fcn.00405980
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4405ba
xor al, al
jmp 0x440623
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0xc]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
push 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x440f90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x28], 0
jne 0x440fb7
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x28], eax
mov edx, dword [ebp + 0xc]
push edx
movzx eax, word [ebp + 8]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x440fde
mov eax, dword [ebp - 0x20]
jmp 0x4410ce
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x441000
mov eax, dword [ebp - 0x20]
jmp 0x4410ce
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x441025
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0x20]
jmp 0x4410ce
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x441052
jmp 0x4410c1
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004192b0
add esp, 0xc
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 1
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x4410b7
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.0040c570
add esp, 8
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0x20]
mov esp, ebp
pop ebp
ret 8
Function at 0x442440
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446ccc
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x459080]
xor eax, ebp
mov dword [ebp - 0x3c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x6c], ecx
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCW]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x20], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x1c], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x20]
push edx
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
push 0
mov ecx, dword [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x38]
call fcn.0040c870
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
push edx
mov ecx, 0x44e8f8
call fcn.00405740
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040cb60
lea ecx, [ebp - 0x4c]
push ecx
lea eax, [ebp - 0x28]
call fcn.00405980
push eax
mov ecx, dword [ebp - 0x6c]
call sym.Install_ring.exe_public:_int___thiscall_CNsImage::GetEncoderClsid_wchar_t_const___struct__GUID__
push 0
lea edx, [ebp - 0x4c]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x38]
call fcn.0040c660
cmp dword [ebp - 0x18], 0
je 0x442563
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp dword [ebp - 0x10], 0
je 0x442573
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp dword [ebp - 0x14], 0
je 0x442583
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov byte [ebp - 0x4d], 1
mov byte [ebp - 4], 0
lea eax, [ebp - 0x28]
call fcn.004057f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.0040c7f0
mov al, byte [ebp - 0x4d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x3c]
xor ecx, ebp
call fcn.0041799a
mov esp, ebp
pop ebp
ret 8
Function at 0x4435b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x14], 0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x10]
call sym.Install_ring.exe_public:_bool___thiscall_CNsImage::isStop_int_
movzx edx, al
test edx, edx
jne 0x4435d5
jmp 0x443640
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call sym.Install_ring.exe_public:_int___thiscall_CNsImage::GetMovieIndex_int_
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4435ec
jmp 0x443640
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.0040cf80
mov dword [eax + 0x3c], 0
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.0040cf80
mov dword [ebp - 8], eax
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push sym.Install_ring.exe_private:_static_unsigned_int___stdcall_CNsImage::MovieThread_void__
push 0
push 0
call fcn.00424124
add esp, 0x18
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x443640
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret 4

Function at 0x443670
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x459080]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x41c], ecx
xor eax, eax
mov word [ebp - 0x418], ax
push 0x206
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.004188a0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.004188a0
add esp, 0xc
push 0
push 0x14
lea ecx, [ebp - 0x210]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x44e96c
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x443762
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.msyh.ttf
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44372d
mov eax, 1
jmp 0x443764
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.msyh.ttc
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
jmp 0x443764
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041799a
mov esp, ebp
pop ebp
ret 4
Function at 0x444710
Capabilities:
Create process memory minidump

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4471b0
mov eax, dword fs:[0]
push eax
sub esp, 0x62c
mov eax, dword [0x459080]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movzx eax, byte [0x45cd8c]
test eax, eax
je 0x444750
or eax, 0xffffffff
jmp 0x44491e
mov byte [0x45cd8c], 1
push 0x44d38c
mov eax, dword [0x45c50c]
add eax, 8
call fcn.00405980
push eax
push str.http:__api.hofosoft.com_api.ashx
call sym.Install_ring.exe_void___cdecl_DoReport_wchar_t_const___wchar_t_const___wchar_t_const__
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x224], cx
push 0x206
push 0
lea edx, [ebp - 0x222]
push edx
call fcn.004188a0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x224]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea esi, [ebp - 0x14]
call fcn.00405700
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea ecx, [ebp - 0x224]
push ecx
push str._s__d.dmp
lea edi, [ebp - 0x14]
call fcn.00405ee0
add esp, 0xc
mov byte [ebp - 0x605], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x228], eax
mov edx, dword [ebp - 0x228]
push edx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x44489e
push 0
push 0
push 2
push 0
push 0
push 0x1f01ff
lea eax, [ebp - 0x14]
call fcn.00405980
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x60c], eax
cmp dword [ebp - 0x60c], 0xffffffff
je 0x444894
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x618], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x614], eax
mov dword [ebp - 0x610], 1
push 0
push 0
lea ecx, [ebp - 0x618]
push ecx
push 0
mov edx, dword [ebp - 0x60c]
push edx
mov eax, dword [ebp - 0x228]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
test eax, eax
je 0x444887
mov byte [ebp - 0x605], 1
mov edx, dword [ebp - 0x60c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x604]
push ecx
call fcn.00408d30
mov byte [ebp - 4], 1
mov dword [ebp - 0x234], 0xea9d
push 9
push 8
push 0xc8
push 0x12c
push 5
push 0
call fcn.00401000
mov esi, eax
add esi, 0x212
call fcn.00401000
mov edx, dword [eax + 4]
push edx
mov edi, esi
xor edx, edx
lea eax, [ebp - 0x604]
call fcn.00409690
mov dword [ebp - 0x61c], 1
mov byte [ebp - 4], 0
lea eax, [ebp - 0x604]
push eax
call fcn.00408eb0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x14]
call fcn.004057f0
mov eax, dword [ebp - 0x61c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0041799a
mov esp, ebp
pop ebp
ret 4
Function at 0x444ab0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
je 0x444ad1
cmp dword [ebp + 0xc], 0
je 0x444ad1
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x1e
jl 0x444ad6
jmp 0x444b74
push 0x294
call fcn.004180a6
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
push 0x294
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.004188a0
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
add eax, 0x190
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [ebp + 0x10], 0
je 0x444b48
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x64
jge 0x444b48
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
add eax, 0x1cc
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [ebp - 0xc]
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
push 0x4449b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x444b74
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x192e037c
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x11d72c49
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219