joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472fd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b38f0
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.004ad23e
mov edi, dword [eax + 0xc]
xor ebp, ebp
cmp edi, ebp
jne 0x473003
xor al, al
jmp 0x47312f
mov ebx, dword [esp + 0x28]
push 0xf1
and ebx, 0xffff
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebp
jne 0x473025
xor al, al
jmp 0x47312f
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebp
jne 0x473038
xor al, al
jmp 0x47312f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebp
jne 0x47304c
xor al, al
jmp 0x47312f
xor eax, eax
xor ecx, ecx
mov ax, word [edi + 2]
push ebp
mov dword [esi + 0x14], eax
xor eax, eax
mov ax, word [edi + 4]
mov edx, dword [esi + 0x14]
mov dword [esi + 0x18], eax
mov cx, word [edi + 6]
push ecx
push 5
push eax
push edx
lea ecx, [esi + 0x1c]
call fcn.004a1685
test eax, eax
jne 0x473080
xor al, al
jmp 0x47312f
mov eax, dword [esi + 0x34]
push eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetBkColor]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 0x4c6b84
mov dword [esp + 0x20], ebp
call fcn.004ad23e
mov eax, dword [eax + 0xc]
push ebx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
lea ecx, [esp + 0x14]
call fcn.004aa148
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x10]
push 0xc0c0c0
neg eax
sbb eax, eax
and eax, edx
push eax
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
lea ecx, [esp + 0x10]
call fcn.004aa19f
xor ecx, ecx
lea ebx, [edi + 8]
cmp word [edi + 6], cx
jbe 0x473114
mov ax, word [ebx]
test ax, ax
je 0x473106
mov edx, ecx
inc ecx
mov dword [esp + 0x28], ecx
push eax
push edx
mov ecx, esi
call fcn.00473150
mov ecx, dword [esp + 0x28]
xor edx, edx
inc ebp
mov dx, word [edi + 6]
add ebx, 2
cmp ebp, edx
jl 0x4730ea
mov dword [esp + 0x10], method.CGdiObject.virtual_0
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 1
call fcn.004aa19f
mov al, 1
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4

Function at 0x473690
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x50
push esi
mov esi, dword [esp + 0x58]
push edi
push eax
mov ecx, esi
call fcn.004ab7f8
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x4736d6
lea ecx, [esp + 8]
push 0x50
push ecx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 8]
push edx
call fcn.00491c88
mov ecx, dword [esp + 0x68]
add esp, 4
pop edi
mov dword [ecx], eax
pop esi
add esp, 0x50
ret 0xc
mov edx, dword [esp + 0x64]
lea ecx, [esp + 8]
mov eax, dword [edx]
push eax
push 0x4e3dd4
push ecx
call fcn.00493341
add esp, 0xc
lea edx, [esp + 8]
push edx
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
add esp, 0x50
ret 0xc
Function at 0x4756a0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x475743
test eax, eax
jbe 0x475743
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x475743
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x4756ee
xor esi, esi
jmp 0x4756f4
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x47571f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00479320
add esi, eax
push esi
mov ebx, esi
call fcn.00479320
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x475700
pop ebp
test edi, edi
pop edi
jne 0x475743
test ebx, ebx
je 0x475743
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.004927b0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x475885
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x47599d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x47599d
mov eax, dword [esi + 0x3c]
push eax
call fcn.004a4d6b
mov esi, eax
test esi, esi
je 0x47599d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x47599d
mov ecx, esi
call fcn.004757f0
cmp edi, eax
jge 0x47599d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x475923
mov dword [esp + 0x34], 1
jmp 0x47597e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x47599d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00473ff0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x47e750
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
mov esi, dword [esp + 0x18]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_GetWindowDC]
push eax
mov dword [esi + 4], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 1
push eax
mov dword [esi + 8], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x47e79a
push eax
mov eax, dword [esi + 8]
mov dword [esi + 0x18], 0
push eax
jmp 0x47e7c9
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
sub ecx, eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esp + 8]
mov dword [esi + 0x18], 1
sub edx, ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esi + 8]
push eax
mov dword [esi + 0x10], eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
cmp eax, 1
jne 0x47e80b
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esp + 0x18]
sub eax, edx
mov edx, dword [esp + 0x14]
sub ecx, edx
mov edx, dword [esi + 8]
push eax
push ecx
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 8]
pop esi
add esp, 0x10
ret 4
Function at 0x48b760
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c7638
push 0x4939c4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
rdtsc
mov esi, eax
mov edi, edx
call ebx
rdtsc
pop ebx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xffffffff
xor esi, esi
mov edi, dword [ebp - 0x20]
push 1
push esi
push esi
mov eax, dword [ebp - 0x28]
push eax
call fcn.00491db0
sub eax, esi
sbb edx, edi
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sbb edx, esi
mov ecx, dword [ebp - 0x24]
add eax, ecx
adc edx, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48b910
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x9c
push eax
call esi
test eax, eax
jne 0x48b951
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x94
push ecx
call esi
test eax, eax
je 0x48b9be
cmp dword [esp + 0x1c], 2
jne 0x48b9be
cmp dword [esp + 0x10], 5
jne 0x48b9be
cmp dword [esp + 0x14], 1
jne 0x48b9be
push str.kernel32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x48b9a8
push str.IsWow64Process
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x48b999
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
jmp 0x48b9a1
mov dword [esp + 8], 0
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 8]
test eax, eax
je 0x48b9be
pop edi
mov eax, 1
pop esi
add esp, 0xa0
ret
pop edi
xor eax, eax
pop esi
add esp, 0xa0
ret
Function at 0x48c550
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x2820
call fcn.00492690
mov eax, dword [esp + 0x2824]
push ebx
push esi
push edi
push eax
lea ecx, [esp + 0x20]
push str..PhysicalDrive_d
push ecx
call fcn.00493341
add esp, 0xc
lea edx, [esp + 0x1c]
push 0
push 0
push 3
push 0
push 3
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x48c6fd
xor eax, eax
mov ecx, 0x9c4
mov dword [esp + 0x10], eax
lea edi, [esp + 0x11c]
mov dword [esp + 0x14], eax
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push eax
push ecx
lea edx, [esp + 0x124]
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
push 0x2710
push edx
lea eax, [esp + 0x20]
push 0xc
push eax
push 0x2d1400
push esi
mov dword [esp + 0x2c], 0
call ebx
test eax, eax
je 0x48c6fd
mov ecx, dword [esp + 0x283c]
mov edx, dword [esp + 0x128]
push ecx
push 0
lea eax, [esp + 0x124]
push edx
push eax
call fcn.0048c710
mov ecx, dword [esp + 0x2848]
mov edx, dword [esp + 0x13c]
push ecx
push 0
lea eax, [esp + 0x134]
push edx
push eax
call fcn.0048c710
mov ecx, dword [esp + 0x2860]
mov edx, dword [esp + 0x150]
push ecx
push 0
lea eax, [esp + 0x144]
push edx
push eax
call fcn.0048c710
mov ecx, dword [esp + 0x2864]
mov edx, dword [esp + 0x164]
push ecx
push 1
lea eax, [esp + 0x154]
push edx
push eax
call fcn.0048c710
mov ecx, dword [esp + 0x2884]
add esp, 0x40
xor eax, eax
lea edi, [esp + 0x11c]
mov dword [ecx], 1
mov ecx, 0x9c4
lea edx, [esp + 0xc]
push eax
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x124]
push 0x2710
push eax
push 0
push 0
push 0x700a0
push esi
call ebx
test eax, eax
je 0x48c6fd
mov edi, dword [esp + 0x124]
mov edx, dword [esp + 0x2848]
mov eax, dword [esp + 0x284c]
xor ecx, ecx
cmp edi, 0xc
push esi
setne cl
inc ecx
mov dword [edx], ecx
mov ecx, dword [esp + 0x138]
mov edx, dword [esp + 0x13c]
mov dword [eax], ecx
mov dword [eax + 4], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x2820
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x2820
ret

Function at 0x4a570e
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4a5746
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004a37b3
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004a378b
jmp 0x4a5752
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x4a6f0c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4a6f4e
call fcn.004ad23e
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4a6f4e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4a6f45
xor eax, eax
jmp 0x4a6f56
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004a6f5c
pop edi
pop esi
pop ebx
ret 4

Function at 0x4ad76e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4ad79c
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4ad7ba
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004ad6d4
jmp 0x4ad7ba
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4ad7ba
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004ad6d4
test edi, edi
mov eax, edi
jne 0x4ad7a4
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4026c8
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4026d6
call dword [0x454024]
or eax, eax
je 0x4026d7
ret
mov al, 1
jmp fcn.00402754

Function at 0x4026e0
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4026ee
call dword [0x454028]
or eax, eax
jne 0x4026ef
ret
mov al, 2
jmp fcn.00402754

Function at 0x4026f8
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x402730
test edx, edx
je 0x40271a
push eax
mov eax, ecx
call dword [0x45402c]
pop ecx
or eax, eax
je 0x402729
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.00402754
mov dword [eax], edx
mov eax, ecx
call dword [0x454028]
or eax, eax
jne 0x402713
ret
mov al, 1
jmp fcn.00402754
test edx, edx
je 0x402744
push eax
mov eax, edx
call dword [0x454024]
pop ecx
or eax, eax
je 0x402729
mov dword [ecx], eax
ret

Function at 0x402754
Capabilities:
Terminate process

Disassembly:
and eax, 0x7f
mov ecx, dword [0x455004]
test ecx, ecx
je 0x402764
pop edx
call ecx
dec eax
mov al, byte [eax + 0x40277d]
jns 0x402778
call fcn.00406180
mov eax, dword [eax + 4]
jmp fcn.00403944

Function at 0x402798
Capabilities:
Terminate process

Disassembly:
push eax
push edx
push ecx
call fcn.00406180
cmp dword [eax + 4], 0
pop ecx
pop edx
pop eax
jne 0x4027ad
ret
xor eax, eax
jmp fcn.00402754

Function at 0x402acc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402b64
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402b44
xor eax, eax
push ebp
push 0x402b3d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402b80
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402b44
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x402de4
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x402dfe
mov ecx, eax
mov ecx, dword [ecx]
cmp ecx, edx
je 0x402dfe
mov ecx, dword [ecx - 0x24]
test ecx, ecx
jne 0x402dea
mov al, 0xa
jmp fcn.00402754
ret

Function at 0x402e30
Capabilities:
Terminate process

Disassembly:
cmp dword [0x45501c], 0
je 0x40283b
call dword [0x45501c]
mov eax, 0xd2
jmp fcn.00403944
push eax
push ecx
mov eax, dword [eax]
call fcn.00402e00
pop ecx
pop eax
je 0x402e3f
jmp ebx
pop ecx
jmp 0x40282c

Function at 0x402e48
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
mov eax, dword [eax]
call fcn.00402e00
mov eax, ebx
pop ebx
jne 0x402e5d
pop ecx
jmp 0x40282c
ret
Function at 0x4036b4
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
mov esi, 0x4554a4
lea edi, [ebp - 0x3c]
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop dword [0x4554c4]
pop dword [0x4554c0]
mov dword [0x4554b8], ebp
mov dword [0x4554bc], ebx
mov dword [0x4554ac], eax
mov dword [0x4554b4], edx
lea ecx, [ebp - 0x3c]
mov dword [0x4554a4], ecx
xor ecx, ecx
cmp dword [ebp + 0xc], 0
jne 0x4036fd
mov ecx, dword [eax]
mov dword [0x4554b0], ecx
call fcn.004035ac
mov eax, dword [ebp + 0xc]
inc eax
mov byte [0x4554c8], al
dec eax
pop ecx
mov edx, dword [ecx]
mov dword [0x4554cc], edx
je 0x403720
call dword [ecx + eax*4]
mov edx, dword [esp + 4]
test edx, edx
je 0x40372d
mov eax, dword [ebp + 0xc]
call edx
cmp dword [0x455020], 0
jne 0x403743
mov byte [0x455028], 1
fnstcw word [section.DATA]
mov eax, dword [ebp + 0xc]
dec eax
jne fcn.00403818
call fcn.00403654
ret 4

Function at 0x403818
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x4554a4
mov esi, 0x455038
mov edi, 0x45503c
cmp byte [ebx + 0x24], 0
jne 0x403847
cmp dword [edi], 0
je 0x403847
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x403836
cmp dword [0x455040], 0
je 0x403897
call fcn.00403794
cmp byte [0x455048], 0
je 0x403874
mov edx, 0x454030
mov eax, 0x45521c
call fcn.00405998
call fcn.0040591b
jmp 0x403890
cmp byte [0x454010], 0
jne 0x403890
push 0
push 0x454050
push 0x454030
push 0
call sub.user32.dll_MessageBoxA
xor eax, eax
mov dword [0x455040], eax
cmp byte [ebx + 0x24], 2
jne 0x4038a7
cmp dword [esi], 0
jne 0x4038a7
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.004035f4
cmp byte [ebx + 0x24], 1
jbe 0x4038b7
cmp dword [esi], 0
je 0x4038d4
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x4038d4
call fcn.00405380
mov eax, dword [ebx + 0x10]
mov edx, dword [eax + 0x10]
cmp edx, dword [eax + 4]
je 0x4038d4
push edx
call sub.kernel32.dll_FreeLibrary
call fcn.004035cc
cmp byte [ebx + 0x24], 1
jne 0x4038e2
call dword [ebx + 0x28]
cmp byte [ebx + 0x24], 0
je 0x4038ed
call fcn.004037e4
cmp dword [ebx], 0
jne 0x4038fa
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x403897

Function at 0x403938
Capabilities:
Terminate process

Disassembly:
mov dword [0x455038], eax
jmp fcn.00403818

Function at 0x403fbc
Capabilities:
Terminate process

Disassembly:
test edx, edx
je fcn.00403f80
mov ecx, dword [edx - 4]
shr ecx, 1
je fcn.00403f80
push ecx
push edx
push eax
call sub.oleaut32.dll_SysReAllocStringLen
test eax, eax
je 0x403f68
ret

Function at 0x404064
Capabilities:
Terminate process

Disassembly:
mov al, 1
jmp fcn.00402754
test ecx, ecx
je fcn.00403f80
push eax
push ecx
push edx
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x403f68
pop edx
push dword [edx]
mov dword [edx], eax
call sub.oleaut32.dll_SysFreeString
ret

Function at 0x404138
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x40414c
push eax
push 0
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x403f68
ret
Function at 0x404194
Capabilities:
Terminate process

Disassembly:
mov edx, dword [eax]
test edx, edx
je 0x4041b2
push eax
mov ecx, dword [edx - 4]
shr ecx, 1
push ecx
push edx
call sub.oleaut32.dll_SysAllocStringLen
pop edx
test eax, eax
je 0x403f68
mov dword [edx], eax
ret

Function at 0x4041e0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x40421f
cmp al, 0xb
je 0x40421f
cmp al, 0xc
je 0x404229
cmp al, 0xd
je 0x40423c
cmp al, 0xe
je 0x40425a
cmp al, 0xf
je 0x40421f
cmp al, 0x11
je 0x40421f
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.00402754
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x40421f
jmp 0x40426e
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x404229
jmp 0x40426e
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call 0x4041e0
dec edi
jg 0x40423f
pop ebp
jmp 0x40426e
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.004041b4
dec edi
jg 0x40425d
pop ebp
pop edi
pop esi
pop ebx
ret
mov ecx, 1
jmp 0x4041e0

Function at 0x404274
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x40421f
cmp al, 0xb
je 0x40421f
cmp al, 0xc
je 0x404229
cmp al, 0xd
je 0x40423c
cmp al, 0xe
je 0x40425a
cmp al, 0xf
je 0x40421f
cmp al, 0x11
je 0x40421f
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.00402754
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x40421f
jmp 0x40426e
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x404229
jmp 0x40426e
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call 0x4041e0
dec edi
jg 0x40423f
pop ebp
jmp 0x40426e
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.004041b4
dec edi
jg 0x40425d
pop ebp
pop edi
pop esi
pop ebx
ret
mov ecx, 1
jmp 0x4041e0
Function at 0x4042ac
Capabilities:
Terminate process

Disassembly:
cmp ecx, 0
je 0x404392
push eax
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x4042fc
cmp al, 0xb
je 0x404316
cmp al, 0xc
je 0x40432d
cmp al, 0xd
je 0x40433c
cmp al, 0xe
je 0x40435a
cmp al, 0xf
je 0x404370
cmp al, 0x11
je 0x40437f
pop edi
pop esi
pop ebx
pop eax
mov al, 2
jmp fcn.00402754
cmp ecx, 1
mov eax, ebx
jg 0x40430d
call fcn.00403950
jmp 0x40438e
mov edx, ecx
call fcn.00403974
jmp 0x40438e
cmp ecx, 1
mov eax, ebx
jg 0x404324
call fcn.00403f80
jmp 0x40438e
mov edx, ecx
call fcn.00403f98
jmp 0x40438e
mov eax, ebx
add ebx, 0x10
call fcn.00404c14
dec edi
jg 0x40432d
jmp 0x40438e
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.004042ac
dec edi
jg 0x40433f
pop ebp
jmp 0x40438e
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404280
dec edi
jg 0x40435d
pop ebp
jmp 0x40438e
mov eax, ebx
add ebx, 4
call fcn.00405448
dec edi
jg 0x404370
jmp 0x40438e
mov eax, ebx
mov edx, esi
add ebx, 4
call fcn.00404e08
dec edi
jg 0x40437f
pop edi
pop esi
pop ebx
pop eax
ret

Function at 0x404394
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.004042ac

Function at 0x4043cc
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x404409
cmp al, 0xb
je 0x404418
cmp al, 0xc
je 0x404427
cmp al, 0xd
je 0x404436
cmp al, 0xe
je 0x404454
cmp al, 0xf
je 0x40446a
cmp al, 0x11
je 0x404479
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.00402754
mov eax, dword [ebx]
add ebx, 4
call fcn.00403d84
dec edi
jg 0x404409
jmp 0x404486
mov eax, ebx
add ebx, 4
call fcn.00404194
dec edi
jg 0x404418
jmp 0x404486
mov eax, ebx
add ebx, 0x10
call fcn.00404c1c
dec edi
jg 0x404427
jmp 0x404486
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call 0x4043cc
dec edi
jg 0x404439
pop ebp
jmp 0x404486
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.004043a0
dec edi
jg 0x404457
pop ebp
jmp 0x404486
mov eax, dword [ebx]
add ebx, 4
call fcn.0040547c
dec edi
jg 0x40446a
jmp 0x404486
mov eax, dword [ebx]
add ebx, 4
call fcn.00404e6c
dec edi
jg 0x404479
pop edi
pop esi
pop ebx
ret
mov ecx, 1
jmp 0x4043cc