joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a2450
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x501358
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [esp + 0x40]
push ebx
push esi
lea ecx, [esp + 8]
push eax
push ecx
mov ecx, dword [esp + 0x4c]
call fcn.004a2760
mov esi, eax
lea edx, [esp + 0x48]
xor ebx, ebx
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x4c], 0x7aec0c
call fcn.004cde38
mov ecx, dword [0x757f9c]
mov al, byte [esi]
push ecx
push ebx
push esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x48], 1
mov byte [esp + 0x30], al
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call fcn.0049dcf0
mov esi, 0x757fd8
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0xc]
mov byte [esp + 0x3c], 3
cmp eax, ebx
je 0x4a24f7
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4a24ee
cmp al, 0xff
je 0x4a24ee
dec al
mov byte [ecx], al
jmp 0x4a24f7
push ecx
call fcn.004ef7bc
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
call fcn.004eb560
mov eax, dword [esp + 0x28]
mov dword [esp + 0x3c], 0xffffffff
cmp eax, ebx
mov dword [esp + 0x18], esi
je 0x4a253d
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4a2534
cmp al, 0xff
je 0x4a2534
dec al
mov byte [ecx], al
jmp 0x4a253d
push ecx
call fcn.004ef7bc
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.004cdebf
mov ecx, dword [esp + 0x34]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x4a3700
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x4a3766
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x4a3766
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x4a3747
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x4a3af0
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4a3b28
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x4aa4b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4aa4bb
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x4aa5be
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x759ab4]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x759ab4]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x759ab4]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x759ab4]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x759ab4]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x759ab4]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x759ab4]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x759ab4]
xor eax, edx
inc ecx
dec edi
jne 0x4aa4d6
pop edi
test esi, esi
je 0x4aa5e0
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x759ab4]
xor eax, edx
inc ecx
dec esi
jne 0x4aa5c2
pop esi
pop ebx
not eax
ret

Function at 0x4aad80
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
mov cl, byte [ebx]
mov eax, ebp
imul eax, dword [esp + 0x14]
test cl, cl
je 0x4aadc1
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0xc]
push 0
push ecx
push eax
mov eax, dword [ebx + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4aadb6
mov byte [ebx + 8], 1
mov eax, dword [esp + 0xc]
xor edx, edx
div ebp
pop ebp
pop ebx
ret
mov edx, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
push esi
push edi
lea esi, [edx + eax]
cmp esi, ecx
jbe 0x4aadd4
sub ecx, edx
mov eax, ecx
mov esi, dword [ebx + 0x10]
mov edi, dword [esp + 0x14]
mov ecx, eax
add esi, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x18]
pop edi
add ecx, eax
pop esi
div ebp
mov dword [ebx + 0x18], ecx
pop ebp
pop ebx
ret
Function at 0x4afd50
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x7dc440]
xor edx, edx
cmp eax, edx
jne 0x4afd76
xor eax, eax
mov byte [eax + 0x7dc340], al
inc eax
cmp eax, 0x100
jl 0x4afd5e
mov dword [0x7dc440], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x7dc340
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4afe07
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4afdda
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4afda8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4afe80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4afed3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4afeba
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b6880
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x501cee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004b71a0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x75a12c
call fcn.004ef793
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4b6913
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004ef793
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4b690c
push 0
mov ecx, eax
call fcn.004ad990
mov dword [esi + 0xc], eax
jmp 0x4b6915
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4b6915
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x4e5ba0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x503310
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.004dac7e
mov eax, dword [0x75e7e8]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.004dabb0
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.004e6670
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x4e5c47
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4e5c3e
cmp al, 0xff
je 0x4e5c3e
dec al
mov byte [ecx], al
jmp 0x4e5c47
push ecx
call fcn.004ef7bc
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x4e5c78
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4e5c6f
cmp al, 0xff
je 0x4e5c6f
dec al
mov byte [ecx], al
jmp 0x4e5c78
push ecx
call fcn.004ef7bc
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x100015a5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x100015b4
pop dword [ebp - 0x14]
mov eax, 0xc36fffb8
sub eax, 0xb36fea04
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x33e30fd1
sub dword [ebp - 0x24], 0xe590ca86
mov dword [ebp - 0x20], 0x9cbf1112
add dword [ebp - 0x20], 0x95743b33
mov dword [ebp - 0x1c], 0x1a68e295
sub dword [ebp - 0x1c], 0xce1c9e67
mov dword [ebp - 0x18], 0xef375138
sub dword [ebp - 0x18], 0xef375138
lea eax, [ebp - 0x24]
push eax
mov eax, 0xb98320d7
add eax, 0x567d0f2d
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xfa9dec7a
add dword [ebp - 0x24], 0x79d47cdc
mov dword [ebp - 0x20], 0xa7d4d4cb
sub dword [ebp - 0x20], 0x66687356
mov dword [ebp - 0x1c], 0x19a30174
sub dword [ebp - 0x1c], 0xb6339508
mov dword [ebp - 0x18], 0xe4019ddc
sub dword [ebp - 0x18], 0xe4019ddc
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xed55b7cd
sub eax, 0xdd5587c1
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x34077
push 0
call eax
mov ecx, 0x766c462f
sub ecx, 0x766c0801
mov ebx, eax
mov edx, 0x10006400
add edx, dword [ebp - 0x14]
mov edi, 0x6144cab7
xor dword [ebp - 0xc], 0x7576f9dd
mov esi, dword [edx]
sub dword [ebp - 8], ebx
xor esi, edi
add dword [ebp - 0xc], ecx
mov dword [ebx], esi
xor dword [ebp - 4], esi
add ebx, 0x84a47f10
add ebx, 0x7b5b80f4
add edx, 0x6e62e636
add edx, 0x919d19ce
loop 0x100016ca
add eax, 0xeb8b
mov ebx, eax
add eax, 0x11ebfb4d
sub eax, 0x11ebfb48
mov ecx, 0x175c4978
sub ecx, 0x75c4978
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x407701
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x407710
pop dword [ebp - 0x38]
mov eax, 0x2fe61f56
sub eax, 0x2fa5a846
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xc656ab01
add dword [ebp - 0x48], 0x87fb9a4a
mov dword [ebp - 0x44], 0x9666ce61
add dword [ebp - 0x44], 0x9bcc7de4
mov dword [ebp - 0x40], 0x819d739a
sub dword [ebp - 0x40], 0x35512f6c
mov dword [ebp - 0x3c], 0x85ce3237
add dword [ebp - 0x3c], 0x7a31cdc9
lea eax, [ebp - 0x48]
push eax
mov eax, 0x8c268c98
add eax, 0x7419f37c
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xd9c17b8e
sub dword [ebp - 0x48], 0x654f1238
mov dword [ebp - 0x44], 0x55b8ff98
sub dword [ebp - 0x44], 0x144c9e23
mov dword [ebp - 0x40], 0x75ae3884
add dword [ebp - 0x40], 0xedc133e8
mov dword [ebp - 0x3c], 0xb442c035
sub dword [ebp - 0x3c], 0xb442c035
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x4a4a0bf8
add eax, 0xb5f67418
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x38ad8
push 0
call eax
mov ecx, 0x4e11
mov esi, eax
mov edx, 0x9c30d56a
sub edx, 0x9befe96a
add edx, dword [ebp - 0x38]
mov edi, 0x9bacacc6
add dword [ebp - 0x14], 0xf11e5d5
mov ebx, dword [edx]
xor dword [ebp - 0x2c], eax
sub ebx, edi
sub dword [ebp - 0x2c], 0xf1e4a0fd
mov dword [esi], ebx
sub dword [ebp - 0xc], edx
add esi, 4
add edx, 0x4e73e6fc
sub edx, 0x4e73e6f8
loop 0x407826
add eax, 0xd41d0520
add eax, 0x2be425f7
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x7ccadd8d
add ecx, 0x83752273
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x1fbb6034
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1761285
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4019ac
Capabilities:
Access the windows event log
Clear file content
Clear windows event logs
Get common file path
Get keyboard layout

Disassembly:
sub esp, 0x400
push esi
push edi
xor esi, esi
xor edi, edi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
cmp edi, 0x58ced85
jg 0x4019d9
inc edi
cmp edi, 0x1f6502b1
jl 0x4019b8
cmp dword [0x280fac4], 0x400
jne 0x401a36
push str.sadahoziyofejonoh_niforapo_pihekezavokigubodatojup_rafepigojamulexiwodugaxexude_jam
push str.nelugidoneyari
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
call dword [sym.imp.USER32.dll_DdeKeepStringHandle]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
push 0x41eb10
push esi
call dword [sym.imp.ADVAPI32.dll_BackupEventLogW]
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogW]
push esi
push esi
call fcn.00401fbd
push esi
push esi
call fcn.00401fbd
push esi
call fcn.00402127
push esi
call fcn.00402136
add esp, 0x18
xor edi, edi
cmp edi, 0xd0fe
jge 0x401a47
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
cmp edi, 0xd2ce6e
jg 0x401a6e
inc edi
cmp edi, 0x26bcf
jl 0x401a38
mov eax, dword [0x421c14]
mov dword [0x280fac4], eax
call fcn.00401726
mov edi, 0x3078f
cmp dword [0x280fac4], 0x51f
jne 0x401a9a
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec edi
jne 0x401a82
pop edi
xor eax, eax
pop esi
add esp, 0x400
ret 0x10

Function at 0x404bbe
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x421930]
jne 0x404bc8
repz ret
jmp fcn.004061fc
Function at 0x401140
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444f4e
mov eax, dword fs:[0]
push eax
push ebx
mov eax, dword [0x456080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
lea eax, [ebx + 1]
mov dword [esi], vtable.CNsBase.0
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov word [esi + 0x30], 0x100
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], 4
mov byte [esi + 0x3c], bl
test byte [0x45938c], al
jne 0x4011ce
or dword [0x45938c], eax
mov ecx, 0x459390
mov dword [ebp - 4], ebx
call sym.Install_vip.exe_public:_void___thiscall_CNsFont::constructor_void_
push 0x4457c0
call fcn.004174f8
add esp, 4
mov dword [ebp - 4], 0xffffffff
push ebx
push ebx
push ebx
push ebx
push ebx
mov ecx, 0x459390
call sym.Install_vip.exe_public:_struct_HFONT______thiscall_CNsFont::GetFont_int__wchar_t_const___int__int__int_
mov dword [esi + 0x24], eax
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov byte [esi + 0x48], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402320
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
mov byte [ecx + 0x31], al
test al, al
je 0x40233d
mov eax, dword [ecx + 0x4c]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 4
mov ecx, dword [ecx + 0x4c]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 4

Function at 0x403140
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 0x66666667
imul dword [esi + 0x18]
push ebx
push edi
sar edx, 1
mov edi, edx
shr edi, 0x1f
add edi, edx
mov ebx, edi
mov dword [ebp - 4], 5
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x10]
push 0x40
sub eax, ebx
push eax
mov eax, dword [esi + 0xc]
push ecx
mov ecx, dword [esi + 0x4c]
push edx
push eax
push 0
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
add ebx, edi
dec dword [ebp - 4]
jne 0x403160
mov edx, dword [esi + 0x4c]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x4c]
push 0
push 0
push 0x200
push eax
mov byte [esi + 0xbf], 1
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403470
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, 0x66666667
imul dword [esi + 0x18]
sar edx, 2
push ebx
mov ebx, dword [esi + 0x10]
push edi
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov byte [esi + 0xc0], 1
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edi
mov dword [ebp - 8], 9
jmp 0x4034b3
mov eax, dword [ebp - 0xc]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0xc]
add ebx, eax
mov eax, dword [esi + 0x18]
sub eax, dword [ebp - 4]
push 0x40
push eax
mov eax, dword [esi + 0x4c]
push ecx
push ebx
push edx
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0xf
call dword [sym.imp.KERNEL32.dll_Sleep]
add dword [ebp - 4], edi
dec dword [ebp - 8]
jne 0x4034b0
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
cdq
push 0x40
sub eax, edx
mov edx, dword [esi + 0xc]
push 1
sar eax, 1
add eax, dword [esi + 0x10]
push ecx
push eax
mov eax, dword [esi + 0x4c]
push edx
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [esi]
mov eax, dword [edx + 0x20]
mov ecx, esi
call eax
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esi + 0x4c]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 0x4c]
push 0
push 0
push 0x200
push edx
mov byte [esi + 0xbf], 1
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403550
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0x4c]
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowLongW]
push 0xffffffffffffffec
push eax
call edi
mov ecx, dword [esi + 0x4c]
or eax, 0x80000
push eax
push 0xffffffffffffffec
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov edx, dword [esi + 0x4c]
push 2
push 0
push 0
push edx
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov eax, dword [esi + 0x4c]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, 1
mov ecx, dword [esi + 0x4c]
push 0xffffffffffffffec
push ecx
call edi
mov edx, dword [esi + 0x4c]
or eax, 0x80000
push eax
push 0xffffffffffffffec
push edx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov al, bl
mov cl, 0x13
imul cl
add al, 0x3c
movzx edx, al
mov eax, dword [esi + 0x4c]
push 2
push edx
push 0
push eax
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
push 0x1e
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0xa
jle 0x403593
pop edi
pop ebx
ret
Function at 0x403f10
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 0x66666667
imul dword [esi + 0x14]
push ebx
push edi
sar edx, 2
mov edi, edx
shr edi, 0x1f
add edi, edx
mov ebx, edi
mov dword [ebp - 4], 0xa
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x10]
push 0x40
push eax
mov eax, dword [esi + 0xc]
sub ecx, ebx
push ecx
mov ecx, dword [esi + 0x4c]
push edx
push eax
push 0
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [esi]
mov eax, dword [edx + 0x20]
mov ecx, esi
call eax
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
add ebx, edi
dec dword [ebp - 4]
jne 0x403f31
mov ecx, dword [esi + 0x4c]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 0x4c]
push 0
push 0
push 0x200
push edx
mov byte [esi + 0xbf], 1
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4041f0
Capabilities:
Hide graphical window

Disassembly:
mov ecx, dword [esi + 0x4c]
push 0
push ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 0x4c]
push 0
push 0
push 0x200
push edx
mov byte [esi + 0xbf], 1
call dword [sym.imp.USER32.dll_SendMessageW]
ret

Function at 0x404220
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0x4c]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x4c]
push 0
push 0
push 0x200
push ecx
mov byte [esi + 0xbf], 1
call dword [sym.imp.USER32.dll_SendMessageW]
ret

Function at 0x404b90
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x404bec
mov eax, dword [esi + 0x4c]
push 0
push 0
push 0x200
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 0x4c]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 0xf4]
mov eax, dword [esi + 0x4c]
push 0x472
push str.ck_W
push edx
push eax
call sym.Install_vip.exe_int___cdecl_ShowTray_struct_HWND_____struct_HICON_____wchar_t_const___unsigned_int_
mov ecx, dword [esi + 0x4c]
push 2
push 0x448d04
push 0x448d0c
push ecx
call sym.Install_vip.exe_int___cdecl_ShowBalloon_struct_HWND_____wchar_t_const___wchar_t_const___int_
add esp, 0x20
pop esi
pop ebp
ret 4

Function at 0x405720
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x405738
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40576a
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x405766
cmp esi, eax
jae 0x40576a
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x405758
cmp esi, eax
jb 0x405770
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret