joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d140
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e43d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x43f04c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
push 4
lea ecx, [ebp - 0x14]
call fcn.00402f60
mov eax, dword [ebp + 8]
push eax
call fcn.00408910
add esp, 4
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.0040d470
add esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0x40d4e0
mov edx, dword [ebp - 0x18]
add edx, 4
push edx
push 0
lea ecx, [ebp - 0x14]
call fcn.00401750
push eax
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 0
call fcn.004135a5
add esp, 0x18
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx], 0
je 0x40d1d5
lea ecx, [ebp - 0x14]
call fcn.0040d310
jmp 0x40d1e6
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], 0
push 6
call fcn.0040da20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040d340
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040eb0d
mov esp, ebp
pop ebp
ret 4

Function at 0x41f80a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041f680

Function at 0x42610a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00425d87

Function at 0x10010dc
Capabilities:
Get hostname
Initialize winsock library
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
push esi
push edi
push 0x1002040
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
jne 0x100110e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2713
call fcn.01001439
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov esi, 0x10010ac
jmp 0x1001121
cmp al, 0x73
jne 0x1001142
xor ebx, ebx
inc ebx
push esi
push edi
push dword [ebp + 8]
call fcn.01001475
cmp eax, 0xffffffff
jne 0x100111a
mov eax, dword [0x1002004]
cmp dword [edi + eax*4], 0
je 0x1001154
push 0x2714
jmp 0x1001147
push 0x2710
push 2
call fcn.010013ca
pop ecx
pop ecx
push 1
jmp 0x10011d0
push 0x400
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jge 0x100117d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2712
call fcn.01001439
jmp 0x1001150
test ebx, ebx
je 0x1001199
lea eax, [ebp - 0x400]
push 0x2e
push eax
call dword [sym.imp.msvcrt.dll_strchr]
test eax, eax
pop ecx
pop ecx
je 0x1001199
and byte [eax], 0
lea eax, [ebp - 0x400]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10011a2
sub eax, edx
push eax
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.USER32.dll_CharToOemBuffA]
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.msvcrt.dll_puts]
pop ecx
push 0
call dword [sym.imp.msvcrt.dll_exit]
int3
Function at 0x40102b
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
push esp
pop ebp
and esp, 0xfffffff8
sub esp, 0x1c
mov al, byte [ecx]
and dword [esp + 0x18], 0
push ebx
push esi
mov byte [edx], al
lea eax, [edx + 1]
push edi
sub edi, edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], edx
mov esi, dword [esp + 0x14]
xor ebx, ebx
lea eax, [ecx + 1]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
call fcn.004011dd
test eax, eax
je 0x40118f
lea ecx, [esp + 0x18]
call fcn.004011dd
lea ecx, [esp + 0x18]
test eax, eax
je 0x4010fe
jmp loc.0047a000
call fcn.004011bc
or edi, edi
jne 0x401133
cmp eax, 2
jne 0x40112e
lea ecx, [esp + 0x18]
call fcn.004011bc
mov edx, dword [esp + 0x1c]
mov edi, eax
test edi, edi
je 0x40118a
push edx
pop ecx
sub ecx, esi
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
dec edi
jne 0x401123
jmp 0x401186
sub eax, 3
jmp 0x401136
sub eax, 2
mov ecx, dword [esp + 0x18]
mov esi, eax
movzx eax, byte [ecx]
shl esi, 8
add esi, eax
inc ecx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
call fcn.004011bc
mov ecx, eax
cmp esi, 0x7d00
jb 0x40115d
inc ecx
cmp esi, 0x500
jb 0x401166
inc ecx
cmp esi, 0x80
jae 0x401171
add ecx, 2
mov edx, dword [esp + 0x1c]
test ecx, ecx
je 0x40118a
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x40117d
mov dword [esp + 0x1c], edx
sub edi, edi
inc edi
jmp 0x4011a7
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
mov dword [esp + 0x18], ecx
xor edi, edi
mov dword [esp + 0x1c], edx
or ebx, ebx
je 0x40105e
sub edx, dword [esp + 0x14]
pop edi
pop esi
push edx
pop eax
pop ebx
push ebp
pop esp
pop ebp
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x402c00
pop dword [ebp - 0x40]
mov eax, 0x3c0334c7
sub eax, 0x3bc308c7
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x5c60b2c
sub dword [ebp - 0x50], 0xb773c5e1
mov dword [ebp - 0x4c], 0x60192488
add dword [ebp - 0x4c], 0xd21a27bd
mov dword [ebp - 0x48], 0xe9cd16ca
add dword [ebp - 0x48], 0x627f2d64
mov dword [ebp - 0x44], 0x413fe994
sub dword [ebp - 0x44], 0x413fe994
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x4431ae47
sub dword [ebp - 0x50], 0xcfbf44f1
mov dword [ebp - 0x4c], 0x5db70b71
sub dword [ebp - 0x4c], 0x1c4aa9fc
mov dword [ebp - 0x48], 0x7fbcb901
add dword [ebp - 0x48], 0xe3b2b36b
mov dword [ebp - 0x44], 0x76f0a996
sub dword [ebp - 0x44], 0x76f0a996
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xe73041fd
sub eax, 0xe6efd155
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x38a22
push 0
call eax
mov ecx, 0xf3fa2ba7
add ecx, 0xc062420
xor esi, esi
add esi, eax
mov edx, 0xe12470b7
sub edx, 0xe0e370b7
add edx, dword [ebp - 0x40]
mov edi, 0x3d0f5b02
sub edi, 0x8b33b5a6
sub dword [ebp - 0x3c], 0x8d293a51
mov ebx, dword [edx]
sub dword [ebp - 0x1c], edi
sub ebx, edi
xor dword [ebp - 0x3c], eax
mov dword [esi], ebx
sub dword [ebp - 0x34], ecx
add esi, 0x1f4aca6a
add esi, 0xe0b5359a
add edx, 0x793c11de
sub edx, 0x793c11da
loop 0x402d1f
add eax, 0xa290f0c7
sub eax, 0xa28fbed8
xor ebx, ebx
add ebx, eax
add eax, 0x20b599d6
sub eax, 0x20b599d1
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x4019d0
Capabilities:
Encode data using xor

Disassembly:
or eax, 0xffffffff
xor ecx, ecx
test edx, edx
jle 0x4019ff
push ebx
push edi
jmp 0x4019e0
movzx edi, byte [ecx + esi]
mov ebx, eax
and ebx, 0xff
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x5920a8]
inc ecx
cmp ecx, edx
jl 0x4019e0
pop edi
pop ebx
not eax
ret
Function at 0x405580
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x538704
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [0x58a110]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, 0xf
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x30], bl
mov byte [ebp - 4], 1
push ebx
push 0x566db9
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 0x4c], bl
call fcn.00408000
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xb0], esi
mov dword [ebp - 0xb4], ebx
mov byte [ebp - 0xc4], bl
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x98], ebx
mov byte [ebp - 0xa8], bl
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x30]
mov ecx, 0x10
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x1c], ecx
jae 0x40561d
lea eax, [ebp - 0x30]
mov byte [eax], bl
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x1c], ecx
jae 0x40562a
lea eax, [ebp + 8]
mov ebx, dword [ebp + 0x18]
lea ecx, [ebp - 0x30]
push ecx
push eax
lea edi, [ebp - 0xc8]
call fcn.004051d0
xor ebx, ebx
add esp, 8
cmp al, bl
je 0x40570b
cmp dword [ebp - 0x20], ebx
jbe 0x40570d
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xcc], esp
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x30]
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], ebx
push edx
mov byte [ecx], bl
call fcn.00407270
lea esi, [ebp - 0x84]
call fcn.004027b0
add esp, 0x1c
mov edi, eax
lea ebx, [ebp - 0x68]
mov byte [ebp - 4], 6
call fcn.00402670
mov esi, eax
push 0
mov ebx, 7
push edi
or eax, 0xffffffff
mov byte [ebp - 4], bl
call fcn.00407560
mov esi, 8
cmp dword [eax + 0x14], esi
jb 0x4056b0
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [ebp - 4], 6
cmp dword [ebp - 0x54], esi
jb 0x4056cc
mov eax, dword [ebp - 0x68]
push eax
call fcn.0040dabc
add esp, 4
xor edi, edi
xor ecx, ecx
mov byte [ebp - 4], 4
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], edi
mov word [ebp - 0x68], cx
cmp dword [ebp - 0x70], esi
jb 0x4056f2
mov edx, dword [ebp - 0x84]
push edx
call fcn.0040dabc
add esp, 4
xor eax, eax
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x74], edi
mov word [ebp - 0x84], ax
xor ebx, ebx
lea esi, [eax + 0xf]
jmp 0x4055e2
jmp 0x40570d
mov edi, 0x10
mov byte [ebp - 4], 1
cmp dword [ebp - 0x38], edi
jb 0x405727
mov ecx, dword [ebp - 0x4c]
push ecx
call fcn.0040dabc
add esp, 4
mov byte [ebp - 4], bl
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 0x4c], bl
cmp dword [ebp - 0x1c], edi
jb 0x405744
mov edx, dword [ebp - 0x30]
push edx
call fcn.0040dabc
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x30], bl
cmp dword [ebp + 0x1c], edi
jb 0x405765
mov eax, dword [ebp + 8]
push eax
call fcn.0040dabc
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0050e12a
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4064a0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5387e7
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x58a110]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebx], 0x567618
mov dword [ebx + 0x68], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], eax
mov ecx, dword [ebx]
mov edx, dword [ecx + 4]
mov dword [ebx + edx], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx]
mov esi, dword [eax + 4]
add esi, ebx
mov dword [ebp - 0x10], 1
call fcn.00402580
push 0x20
lea edi, [ebx + 0x10]
push esi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], 0
call fcn.00408740
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], al
jne 0x406540
mov eax, dword [esi + 0xc]
or eax, 4
or eax, 4
and eax, 0x17
mov dword [esi + 0xc], eax
test dword [esi + 0x10], eax
je 0x406540
push 0
mov ecx, esi
call fcn.00402470
mov dword [ebp - 4], 2
mov ecx, dword [ebx]
mov edx, dword [ecx + 4]
push edi
mov dword [ebx + edx], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
call fcn.00408100
lea ecx, [edi + 0x18]
mov dword [edi + 0x20], ecx
lea eax, [edi + 8]
mov dword [edi + 0x10], eax
lea edx, [edi + 0x1c]
mov dword [edi + 0x24], edx
mov dword [edi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [edi + 0x50], 0
mov byte [edi + 0x49], 0
lea ecx, [edi + 0x28]
mov dword [edi + 0x30], ecx
xor ecx, ecx
lea eax, [edi + 0xc]
mov dword [edi + 0x14], eax
lea edx, [edi + 0x2c]
mov dword [edi + 0x34], edx
mov dword [eax], ecx
mov eax, dword [edi + 0x24]
mov dword [eax], ecx
mov edx, dword [edi + 0x34]
mov dword [edx], ecx
mov eax, dword [edi + 0x10]
mov dword [eax], ecx
mov edx, dword [edi + 0x20]
mov dword [edx], ecx
mov eax, dword [edi + 0x30]
mov edx, dword [0x5925a0]
mov dword [eax], ecx
mov dword [edi + 0x54], ecx
mov dword [edi + 0x4c], edx
mov dword [edi + 0x44], ecx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4066a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x538228
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x58a110]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov edi, ecx
cmp ebx, 0xffffffff
jne 0x4066dc
xor eax, eax
jmp 0x40686c
mov eax, dword [edi + 0x24]
mov ecx, dword [eax]
test ecx, ecx
je 0x406705
mov eax, dword [edi + 0x34]
mov edx, dword [eax]
add edx, ecx
cmp ecx, edx
jae 0x406705
dec dword [eax]
mov edi, dword [edi + 0x24]
mov eax, dword [edi]
lea ecx, [eax + 1]
mov dword [edi], ecx
mov byte [eax], bl
mov eax, ebx
jmp 0x40686c
cmp dword [edi + 0x54], 0
je 0x406869
mov ecx, dword [edi + 0x10]
lea edx, [edi + 0x48]
cmp dword [ecx], edx
jne 0x40672d
mov edx, dword [edi + 0x3c]
mov eax, dword [edi + 0x40]
mov dword [ecx], edx
mov ecx, dword [edi + 0x20]
mov dword [ecx], eax
mov edx, dword [edi + 0x30]
sub eax, eax
mov dword [edx], eax
cmp dword [edi + 0x44], 0
jne 0x406753
mov edi, dword [edi + 0x54]
movsx eax, bl
push edi
push eax
call fcn.0050f60e
add esp, 8
cmp eax, 0xffffffff
je 0x406869
mov eax, ebx
jmp 0x40686c
lea esi, [ebp - 0x2c]
mov byte [ebp - 0x2d], bl
call fcn.00407020
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
jmp 0x406770
mov edx, eax
cmp ebx, 0x10
jae 0x40677c
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x34]
push ebx
push edx
push eax
lea edx, [ebp - 0x38]
push edx
lea eax, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x2d]
push edx
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x14]
call eax
test eax, eax
js 0x40685a
cmp eax, 1
jg 0x406810
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x4067bc
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x34]
sub esi, ecx
je 0x4067e5
cmp ebx, 0x10
jae 0x4067cb
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.0050fa41
add esp, 0x10
cmp esi, eax
jne 0x40685a
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x2d]
mov byte [edi + 0x49], 1
cmp dword [ebp - 0x38], edx
jne 0x406846
test esi, esi
jne 0x406770
cmp dword [ebp - 0x1c], 0x20
jae 0x40685a
push esi
lea ebx, [esi + 8]
lea esi, [ebp - 0x2c]
call fcn.004071a0
jmp 0x406765
cmp eax, 3
jne 0x40685a
mov edi, dword [edi + 0x54]
movsx eax, byte [ebp - 0x2d]
push edi
push eax
call fcn.0050f60e
add esp, 8
cmp eax, 0xffffffff
je 0x406830
mov esi, dword [ebp + 8]
jmp 0x406833
or esi, 0xffffffff
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00401d70
mov eax, esi
jmp 0x40686c
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00401d70
mov eax, dword [ebp + 8]
jmp 0x40686c
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00401d70
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050e12a
mov esp, ebp
pop ebp
ret 4
Function at 0x407bd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x538408
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x58a110]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebx + 0x44], 0
je 0x407d76
cmp byte [ebx + 0x49], 0
je 0x407d76
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, ebx
call edx
cmp eax, 0xffffffff
je 0x407d63
lea esi, [ebp - 0x2c]
call fcn.00407020
mov dword [ebp - 4], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x407c43
lea edx, [ebp - 0x2c]
mov eax, edx
mov ecx, dword [ebx + 0x44]
mov esi, dword [ecx]
lea edi, [ebp - 0x30]
push edi
mov edi, dword [ebp - 0x1c]
add edi, edx
push edi
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x407c83
dec eax
je 0x407c87
sub eax, 2
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
je 0x407d71
call fcn.00401d70
xor al, al
jmp 0x407d78
mov byte [ebx + 0x49], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x407c97
lea edx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, edx
je 0x407cc4
cmp edi, 0x10
jae 0x407ca6
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x54]
push ecx
push esi
push 1
push eax
call fcn.0050fa41
add esp, 0x10
cmp esi, eax
jne 0x407d54
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [ebx + 0x49], 0
je 0x407d67
test esi, esi
jne 0x407c37
mov ecx, dword [ebp - 0x1c]
or edx, 0xffffffff
sub edx, ecx
cmp edx, 8
jbe 0x407d93
lea esi, [ecx + 8]
cmp esi, 0xfffffffe
ja 0x407d93
cmp edi, esi
jae 0x407d3d
push ecx
push esi
lea ecx, [ebp - 0x2c]
call fcn.004085c0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
test esi, esi
je 0x407c37
mov ecx, eax
cmp edi, 0x10
jae 0x407d19
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
xor eax, eax
mov dword [ecx + edx], eax
mov dword [ecx + edx + 4], eax
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
jae 0x407d34
lea eax, [ebp - 0x2c]
mov byte [eax + esi], 0
jmp 0x407c31
test esi, esi
jne 0x407d0f
mov dword [ebp - 0x1c], esi
cmp edi, 0x10
jae 0x407d4c
lea eax, [ebp - 0x2c]
mov byte [eax], 0
jmp 0x407c31
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00401d70
xor al, al
jmp 0x407d78
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00401d70
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050e12a
mov esp, ebp
pop ebp
ret
push str.string_too_long
call fcn.0052bda4
int3
Function at 0x408100
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5381fb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x58a110]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0052be5f
push 4
mov dword [ebp - 4], 0
call fcn.0040da8d
mov edi, eax
add esp, 4
test edi, edi
je 0x40817c
call fcn.0052b8d7
mov dword [edi], eax
call fcn.0052b696
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0052b5cb
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x408172
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0052b5f3
jmp 0x40817e
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4094e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4094fb
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x409532
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x40952e
jmp 0x409520
cmp esi, eax
jae 0x409532
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x409520
cmp esi, eax
jb 0x409539
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40a0e0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x18]
sub eax, dword [ebp + 0x10]
xor edx, edx
div dword [edi + 0x8c]
mov ecx, eax
mov dword [ebp - 8], eax
test edx, edx
je 0x40a101
inc ecx
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0x1c]
sub eax, dword [ebp + 0x14]
xor edx, edx
div dword [edi + 0x90]
push ebx
push esi
mov dword [ebp - 4], eax
test edx, edx
je 0x40a11b
inc dword [ebp - 4]
xor ebx, ebx
test ecx, ecx
jle 0x40a16b
xor esi, esi
cmp dword [ebp - 4], esi
jle 0x40a166
jmp 0x40a130
mov edx, dword [ebp + 0xc]
mov eax, dword [edi + 0x90]
mov ecx, dword [edi + 0x8c]
push 0xcc0020
push 0
push 0
push edx
push eax
imul eax, esi
push ecx
imul ecx, ebx
push eax
mov eax, dword [ebp + 8]
push ecx
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
inc esi
cmp esi, dword [ebp - 4]
jl 0x40a130
mov ecx, dword [ebp - 8]
inc ebx
cmp ebx, ecx
jl 0x40a121
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18