joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002ba17
Capabilities:
Get common file path

Disassembly:
cmp eax, 0x1006eee0
je 0x1002ba24
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp dword [ebx + 4], esi
je 0x1002ba64
lea edx, [ebp + 8]
call fcn.100578f1
push 0xffffffffffffffff
push 0
mov ecx, edi
call fcn.1002da0c
mov dword [esp + 0x448], 0xffffffff
mov eax, dword [0x1006ef84]
test eax, eax
je 0x1002ba57
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [esp + 0x10], 0
jmp 0x100569da
mov eax, dword [0x1006ef84]
test eax, eax
je 0x1002ba74
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
push 0x410
push eax
mov dword [esp + 0x18], eax
mov word [esp + 0x24], ax
lea eax, [esp + 0x26]
push eax
call 0x10078697
mov edx, dword [ebp + 8]
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
xor ebx, ebx
push edx
push ebx
mov dword [esp + 0x18], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x1002bacf
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
jne 0x1002bae1
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x1002bacf
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [esp + 0x448], 0xffffffff
xor al, al
jmp 0x10056a59
lea eax, [esp + 0x1c]
lea edx, [eax + 2]
jmp 0x1002baf0
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1002baf0
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x20]
push edx
mov esi, edi
call 0x1002de5c
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x1002bb1b
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [0x1006ef84]
cmp eax, ebx
mov dword [esp + 0x14], 0x1006ef84
je 0x1002bb33
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esp + 0x448], 3
lea edx, [ebp + 8]
call fcn.10057a03
push 0xffffffffffffffff
mov ecx, eax
push ebx
mov eax, edi
call fcn.1002db1f
mov byte [esp + 0x448], 1
mov eax, dword [0x1006ef84]
cmp eax, ebx
je 0x1002bb67
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x448], 0xffffffff
mov al, 1
mov ecx, dword [esp + 0x440]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x42c]
xor ecx, esp
call 0x10077b11
mov esp, ebp
pop ebp
ret
invalid
pop ecx
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x1002e0e1
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edx
mov esi, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], edi
call fcn.1003d83f
cmp dword [esi + 0x18], 8
mov dword [esp + 0xc], 0
add byte [edx + 5], dh
mov esi, dword [esi + 4]
jmp 0x1002e085
add esi, 4
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push 0
push esi
push ebx
call ebp
cmp eax, 5
jne 0x1002e0c1
test esi, esi
je 0x1002e166
mov edx, esi
mov edi, ebx
call 0x1005bb51
lea edx, [esp + 0xc]
push edx
push 0x20019
push 0
push esi
push ebx
call ebp
test eax, eax
jne 0x1002e166
mov esi, dword [esp + 0xc]
test esi, esi
je 0x1002e166
push 0x410
push eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x28]
and al, 0x28
push eax
mov dword [esp + 0x1c], 0x40f
call 0x1007acf9
mov eax, dword [esp + 0x28]
add esp, 0xc
cmp dword [eax + 0x18], 8
jb 0x1002e103
mov eax, dword [eax + 4]
jmp 0x1002e106
add eax, 4
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x1c]
push ecx
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne fcn.1002e14e
lea eax, [esp + 0x20]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1002e130
mov esi, dword [esp + 0x18]
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x24]
push edx
call fcn.1003049e
xor al, al

Function at 0x1002e4fc
Capabilities:
Delete registry value

Disassembly:
fiadd dword [edx]
add byte [ebp + 0x52142454], cl
push 0x2001f
push 0
push esi
push edi
invalid

Function at 0x100309e3
Capabilities:
Read file on windows

Disassembly:
jne 0x100309ef
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov eax, dword [esp + 0x18]
push ebx
lea ecx, [esp + 0x28]

Function at 0x100309f4
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10030a4a
xor edi, edi
lea esi, [esp + 0x14]
je 0x10030a2b
adc al, 0xe8
jo 0x10030a4f
add al, byte [eax]
mov edx, eax
lea eax, [esp + 0x70]
call 0x10035e28
mov byte [esp + 0x9c], 2
lea edx, [esp + 0x70]
push edx
call 0x1006048a
mov eax, dword [esp + 0x28]
push eax
lea ecx, [esp + 0x74]
push ecx
call 0x100602b9
mov byte [esp + 0x9c], 1
lea ecx, [esp + 0x70]
call 0x1003272a
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esp + 0x9c], bl
pushfd
and al, 0x9c
add byte [eax], al
add byte [ebp - 0x17ebdb8c], cl
sub dl, 1
invalid
add dword [eax], eax
mov dword [esp + 0x9c], 0xffffffff
lea ecx, [esp + 0x54]
call fcn.10032755
jmp 0x10030aa6
mov ecx, dword [esp + 0x94]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call 0x1007ca3e
add esp, 0x8c
ret 4
Function at 0x1003135a
Capabilities:
Create shortcut via ishelllink

Disassembly:
push 0xffffffffffffffff
push 0x10052a57
mov eax, dword fs:[0]
push eax
sub esp, 0x2ac
mov eax, dword [0x1006c020]
xor eax, esp
les ecx, [ecx + 0x2a82484]
add byte [eax], al
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1006c020]
xor eax, esp
push eax

Function at 0x1003136e
Capabilities:
Create shortcut via ishelllink

Disassembly:
lea eax, [esp + 0x2c0]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2d4]

Function at 0x10036361
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10053e5e
mov eax, dword fs:[0]
add byte [eax], al
push eax
sub esp, 0xcc
push esi
push edi
mov eax, dword [0x1006c020]
xor eax, esp
push eax
lea eax, [esp + 0xd8]
add byte [ebx], ah
add byte [eax], al
add byte [ebx - 0x7c74f7b3], cl
mov ah, 0
add byte [eax], al

Function at 0x10036371
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10053e5e
mov eax, dword fs:[0]
add byte [eax], al
push eax
sub esp, 0xcc
push esi
push edi
mov eax, dword [0x1006c020]
xor eax, esp
push eax
lea eax, [esp + 0xd8]
add byte [ebx], ah
add byte [eax], al
add byte [ebx - 0x7c74f7b3], cl
mov ah, 0
add byte [eax], al
Function at 0x10039bb1
Capabilities:
Log keystrokes via polling

Disassembly:
test byte [edx - 0x75000000], bl
jne 0x10039bd1
mov edi, esi
and edi, 1
push edi
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [ebp + 0xc]
mov edx, esi
and dl, 2
shr eax, 0xf
and al, 1
cmp dl, 2
mov byte [esp + 0xf], al
add dword [eax + 0x448802fa], eax
and al, 0xf
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], ecx
sete cl
mov dword [eax + 0x30], ebx
mov byte [ebx + 0x24], cl
cmp edi, 1
sete dl
mov ecx, esi
and cl, 4
cmp cl, 4
stc
add al, 0x88
push ebx
sete dl
mov ecx, esi
and cl, 8
cmp cl, 8
mov byte [ebx + 0x2b], dl
sete dl
mov ecx, esi
and cl, 0x10
cmp cl, 0x10
mov byte [ebx + 0x2c], dl
sete dl
mov ecx, esi
and cl, 0x20
cmp cl, 0x20
mov byte [ebx + 0x2d], dl
sete dl
mov ecx, esi
and cl, 0x80
cmp cl, 0x80
mov byte [ebx + 0x2e], dl
sete dl
mov edi, eax
mov esi, ebx
mov byte [ebx + 0x2f], dl
call 0x10074730
call 0x100746b5
test al, al
jne 0x10039c5a
mov esi, edi
call 0x1006cab0
cmp byte [ebx + 0x2b], 0
mov al, byte [esp + 0xf]
mov byte [ebx + 0x27], al
mov byte [ebx + 0x25], al
jne 0x10039c95
mov eax, dword [edi + 0x20]
mov ecx, dword [ebx + 0xc]
mov edx, dword [ecx + 0x18]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push eax
push 0x117
push edx
call esi
mov eax, dword [ebx + 0xc]
push eax
mov eax, dword [eax + 0x18]
push 0
push 0x2117
push eax
call esi
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
xor esi, esi
push 0x10
push eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10039cd9
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax]
mov esi, dword [eax + 4]
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
jmp 0x10039ce5
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov dword [edi + 0x6c], ecx
mov dword [edi + 0x70], esi
mov dword [edi + 0x74], edx
mov dword [edi + 0x78], eax
movzx ecx, byte [ebx + 0x2e]
push ecx
lea esi, [esp + 0x14]
and al, 0x14
Function at 0x1003ca67
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x10078b2c
test al, al
jne 0x1003ca77
push esi
push edi
call 0x10078e17
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
push 0x10
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x1003caaa
push 0x1006ee68
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.USER32.dll_CopyRect]
mov esi, dword [edi + 0x38]
mov ebx, dword [edi + 0x40]
add esi, dword [0x1006ee3c]
sub ebx, dword [esp + 0x28]
add esi, dword [esp + 0x20]
mov edx, dword [edi + 0x44]
sub ebx, dword [0x1006ee40]
cmp dword [edi + 0x34], 0
mov ebp, dword [edi + 0x3c]
mov dword [esp + 0x5c], edx
je 0x1003cadb
call 0x100758e9
sub ebx, eax
cmp dword [edi + 0x30], 0
mov eax, dword [edi + 0x24]
mov edx, dword [esp + 0x5c]
lea ecx, [eax + esi + 4]
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
mov byte [esp + 0x13], 0
and al, 0x13
invalid
je 0x1003cb24
mov ecx, dword [edi + 0x30]
mov eax, dword [ecx]
mov edx, dword [eax + 0xe0]
call edx
test eax, eax
jle 0x1003cb24
cmp dword [edi + 0x24], eax
jle 0x1003cb24
lea eax, [eax + esi + 4]
mov byte [esp + 0x13], 1
mov dword [esp + 0x38], eax
mov edx, dword [esp + 0x5c]
mov ecx, ebx
sub ecx, dword [edi + 0x28]
cmp byte [esp + 0x13], 0
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ebp
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], edx
mov dword [esp + 0x14], 0x100024
je 0x1003cb54
mov dword [esp + 0x14], 0x140024
mov ecx, dword [edi + 0x18]
mov eax, dword [0x1006ee50]
mov esi, dword [0x1006ee4c]
shr ecx, 5
not cl
test cl, 1
mov dword [esp + 0x18], eax
jne 0x1003cb82
mov edx, dword [0x1006ee64]
mov esi, dword [0x1006ee5c]
mov dword [esp + 0x18], edx
jmp 0x1003cb9c
mov ebx, edi
call 0x10078519
test al, al
je 0x1003cb9c
mov eax, dword [0x1006ee60]
mov esi, dword [0x1006ee58]
mov dword [esp + 0x18], eax
mov ebp, dword [0x1006ee44]
xor bl, bl
test byte [edi + 0x18], 1
je 0x1003cbb5
mov ecx, ebp
call 0x100795d1
mov ebp, eax
invalid
mov bl, 1
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x34]
push edx
lea eax, [edi + 0x4c]
push ebp
push eax
mov eax, esi
mov esi, dword [esp + 0x2c]
call 0x1007a0df
add esp, 0x10
test bl, bl
je 0x1003cbdf
push ebp
call dword [sym.imp.GDI32.dll_DeleteObject]
xor bl, bl
movzx ecx, byte [edi + 0x4b]
movzx edx, byte [edi + 0x4a]
movzx eax, byte [edi + 0x49]
push ecx
movzx ecx, byte [edi + 0x48]
push edx
push eax
push ecx
lea esi, [esp + 0x70]
call 0x100781ec
add esp, 0x10
mov dword [esp + 0x88], 0
test byte [edi + 0x18], 1
mov ebp, dword [0x1006ee48]
je 0x1003cc21
mov ecx, ebp
call 0x1007963d
mov ebp, eax
mov bl, 1
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x64]
or ecx, 2
cmp dword [esp + 0x78], 8
jae 0x1003cc37
lea eax, [esp + 0x64]
mov esi, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x44]
push edx
push ebp
push eax
mov eax, dword [esp + 0x28]
call 0x1007a15c
add esp, 0x10
test bl, bl
je 0x1003cc5a
push ebp
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, esi
mov edx, edi
call 0x10079153
invalid
Function at 0x10046600
Capabilities:
Check os version

Disassembly:
add byte [eax], al
adc al, 1
add byte [eax], al
call 0x10093213
add esp, 0x3c
lea edx, [esp + 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, ebx
je 0x1004662b
cmp dword [esp + 0x50], 6
jb 0x1004662b
mov byte [edi + 0x1032], 1
push 0xe
mov dword [esp + 0x2c], esi
push str._nNwmteRQ
lea esi, [esp + 0x18]
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], bx
call fcn.10048998
mov byte [esp + 0x16c], 6
mov eax, esi
push eax
mov esi, ebp
call fcn.1004849a
add byte [eax], al
mov byte [esp + 0x16c], 5
cmp dword [esp + 0x28], 8
jb 0x10046676
mov ecx, dword [esp + 0x14]
push ecx
call 0x10092603
add esp, 4
mov eax, 7
push 8
push 0x1005bc98
lea esi, [esp + 0x34]
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], bx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], ebx
mov word [esp + 0x38], bx
call fcn.100489f5
mov byte [esp + 0x16c], 7
mov edx, esi
push edx
mov esi, ebp
call 0x100484f7
mov byte [esp + 0x16c], 5
cmp dword [esp + 0x44], 8
jb 0x100466d3
mov eax, dword [esp + 0x30]
push eax
call 0x10092660
add esp, 4
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], bx
mov dword [esp + 0x16c], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x164]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x150]
xor ecx, esp
call 0x1009268b
add esp, 0x160
ret

Function at 0x10049e7e
Capabilities:
Encode data using base64

Disassembly:
push eax
call 0x10096a8c
add esp, 0xc
mov cl, byte [esp + 0x14]
mov al, cl
shr al, 2
mov byte [esp + 0x18], al
mov al, byte [esp + 0x15]
mov dl, al
and cl, 3
shl cl, 4
shr dl, 4
add cl, dl
and al, 0xf
mov byte [esp + 0x19], cl
mov cl, byte [esp + 0x16]
add al, al
mov dl, cl
add al, al
shr dl, 6
add al, dl
mov byte [esp + 0x1a], al
and cl, 0x3f
lea eax, [edi + 1]
xor ebp, ebp
cmp eax, ebx
mov byte [esp + 0x1b], cl
jle 0x10049f08
mov edi, edi
movzx ebx, byte [esp + ebp + 0x18]
cmp ebx, dword [0x1006d974]
jbe 0x10049ee3
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp dword [0x1006d978], 0x10
mov eax, dword [0x1006d964]
jae 0x10049ef6
mov eax, 0x1006d964
mov bl, byte [eax + ebx]
call 0x1005a50e
add ebp, 1
lea eax, [edi + 1]
cmp ebp, eax
xchg byte [ebx - 0x78], bl
inc dword [ebx]
jge 0x10049f20
mov bh, bh
add edi, dword [ebp + 0x13]
mov ebp, 3
sub ebp, edi
mov bl, 0x3d
call 0x1005a52b
sub ebp, 1
jne 0x10049f14
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x1004d52e
Capabilities:
Check os version

Disassembly:
push 0x50ffffff
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [0xbd831005]
js 0x1004d546
invalid
inc dword [edx]
jne 0x1004d55a
cmp dword [ebp - 0x94], 5
mov eax, 0x1004d515
jae 0x1004d55f
mov eax, 0x1004d4b0
push eax
push 0x1006c030
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
Function at 0x805cf4
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x805cfa
pop ebp
sub ebp, 6
sub ebp, 0x405cf4
jmp 0x805d58
jmp 0x805d61
mov eax, 0x405cf4
add eax, ebp
add eax, 0x93
mov ecx, 0x62b
mov edx, 0x82a1cd34
xor byte [eax], dl
inc eax
dec ecx
jne 0x805d78
jmp 0x805d8b
pop esi
je 0x805dea
xor al, 0x24
xor al, 0x34
pop esp
xor al, 0xf8
sbb byte [edi + eax], dh
hlt
mov cl, 0x3c
xor al, 0x34
xor al, 0xbf
mov eax, dword [0x34343438]
mov edi, 0x343424b9
xor al, 0xf5
fnsave dword [esi]
add eax, 0x30f6b736
jge 0x805e40
mov cl, 0xc0
retf
xor al, 7
std
mov ch, 0xc6
jno 0x805e78
sub eax, esi
mov ch, 0xc6
jno 0x805e7e
sub eax, esi
pop es
out 0xb7, al
fdiv qword [ecx]
jl 0x805e91
mov al, 0x7a
xor al, 0x34
xor al, 0x3b
mov esp, 0x3434347c
push edx
mov edi, 0xcfb40d28
fdivr qword [ebx]
mov al, 0x2e
xor al, 0x34
xor al, 0xb4
iretd
mov ch, 0xcf
retf
and dword [esp + esi], esi
xor al, 0x75
invalid
xor ch, bl
mov ebx, ecx
retf
Function at 0x404a30
Capabilities:
Extract resource via kernel32 functions
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a64f5
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x617e6c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
push 0
push 0x66
call fcn.0044cdbf
mov dword [ebp - 4], 0
mov dword [edi], vtable.CactivationDlg.0
call fcn.0044e0ae
mov ecx, eax
test ecx, ecx
jne 0x404a88
push 0x80004005
call fcn.0040c690
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0xd4], eax
mov dword [edi + 0xe4], 0
mov dword [edi + 0xe0], vtable.CFont.0
mov dword [edi + 0xec], 0
mov dword [edi + 0xe8], vtable.CFont.0
lea esi, [edi + 0xf0]
mov byte [ebp - 4], 3
mov ecx, esi
mov dword [ebp - 0x10], esi
call fcn.00451548
mov dword [esi], vtable.CComboBox.0
push 0x5ed400
lea ecx, [edi + 0x184]
mov byte [ebp - 4], 4
call fcn.0040c330
push 0x5ed400
lea ecx, [edi + 0x188]
mov byte [ebp - 4], 5
call fcn.0040c330
push fcn.0040c4c0
push fcn.0040c490
push 0x1e
push 4
lea eax, [edi + 0x190]
mov byte [ebp - 4], 6
push eax
call fcn.0057e062
push fcn.0040c4c0
push fcn.0040c490
push 0x1e
push 4
lea eax, [edi + 0x208]
mov byte [ebp - 4], 7
push eax
call fcn.0057e062
mov byte [ebp - 4], 8
mov dword [edi + 0x2c0], 0
call fcn.0044e0ae
mov ecx, eax
test ecx, ecx
jne 0x404b5f
push 0x80004005
call fcn.0040c690
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x2d4], eax
push 0x5ed400
lea ecx, [edi + 0x2d8]
mov byte [ebp - 4], 9
call fcn.0040c330
mov byte [ebp - 4], 0xa
lea ecx, [edi + 0x2e0]
mov byte [edi + 0x2dc], 0
call fcn.0045826f
mov byte [ebp - 4], 0xb
call fcn.0045ab94
call fcn.0045ab94
push 0x80
mov eax, dword [eax + 0xc]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [edi + 0xd0], eax
call fcn.0045ab94
push 0x5ec1f8
push 0x83
mov eax, dword [eax + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
call fcn.0045ab94
push esi
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ebx, eax
call fcn.0045ab94
push esi
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push 0x48
mov dword [ebp - 0x10], eax
call fcn.00439ea8
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 0xc
test esi, esi
je 0x404c32
push 0x48
push 0
push esi
call fcn.00581040
add esp, 0xc
mov ecx, esi
push dword [ebp - 0x10]
push ebx
call fcn.0040fef0
jmp 0x404c34
xor eax, eax
mov dword [edi + 0xdc], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x409d10
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a6ba0
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x617e6c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x10], edx
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov byte [edx + 0x51], 0
mov dword [edx + 0x58], 0x10
cmp byte [edx + 0x51], 0
jne 0x409d60
mov byte [edx + 0x51], 1
lea ecx, [edx + 0x10]
jmp 0x409d62
xor ecx, ecx
mov dword [edx + 0x5c], ecx
mov byte [edx + 0xa1], 0
mov dword [edx + 0xa8], 0x10
cmp byte [edx + 0xa1], 0
jne 0x409d8b
mov byte [edx + 0xa1], 1
lea ecx, [edx + 0x60]
jmp 0x409d8d
xor ecx, ecx
mov dword [edx + 0xac], ecx
mov eax, edx
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x40b740
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00448a15

Function at 0x40bf30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
jne 0x40bf45
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov esi, eax
test esi, esi
je 0x40bf86
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40bf82
nop word [eax + eax]
cmp esi, edx
jae 0x40bf86
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x40bf70
cmp esi, edx
jb 0x40bf8b
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x40eac0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a67c8
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x617e6c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.004491a6
push dword [edi + 0x160]
call dword [sym.imp.KERNEL32.DLL_SetThreadLocale]
movzx eax, word [edi + 0x160]
push eax
call dword [sym.imp.KERNEL32.DLL_SetThreadUILanguage]
call fcn.0044e0ae
mov ecx, eax
test ecx, ecx
jne 0x40eb20
push 0x80004005
call fcn.0040c690
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
push 0x86
mov dword [ebp - 4], 0
call fcn.0045005b
test eax, eax
je 0x40eb51
push 0x86
push eax
lea ecx, [ebp - 0x14]
call fcn.0040c010
mov esi, dword [ebp - 0x14]
push esi
push 2
mov ecx, edi
call fcn.00450378
mov ecx, eax
call fcn.00450d6a
push 0x88
call fcn.0045005b
test eax, eax
je 0x40eb81
push 0x88
push eax
lea ecx, [ebp - 0x14]
call fcn.0040c010
mov esi, dword [ebp - 0x14]
push esi
mov ecx, edi
call fcn.00450d6a
push 0x640000
push 0
push 0x401
push dword [edi + 0x100]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push edi
push 0x40ec30
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [edi + 0xd0], eax
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40ebda
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057dd8f
mov esp, ebp
pop ebp
ret