joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4015a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov esi, eax
lea eax, [esp + 0x18]
push eax
push 0x20119
xor edi, edi
push edi
push 0x464afc
push 0x80000002
mov ebx, ecx
mov dword [esp + 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401731
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esi + 0x10], eax
push ebx
mov dword [esi + 0x14], eax
lea edx, [esp + 0x1c]
push edx
mov dword [esi + 0x18], eax
push eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x28]
push 0x464b38
mov edi, 0x400
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401633
cmp dword [esp + 0x14], 1
jne 0x401718
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi], ebx
lea ebx, [eax + ebx]
je 0x401718
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push 0x464b4c
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x401678
cmp dword [esp + 0x14], 1
jne 0x401718
mov eax, dword [esp + 0x10]
mov dword [esi + 4], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x401718
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push 0x464b60
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x4016af
cmp dword [esp + 0x14], 1
jne 0x401718
mov eax, dword [esp + 0x10]
mov dword [esi + 8], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x401718
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push 0x464b80
push eax
mov dword [esp + 0x28], edi
call ebp
test eax, eax
jne 0x401718
cmp dword [esp + 0x14], 3
jne 0x401718
mov eax, dword [esp + 0x10]
sub edi, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
je 0x401718
lea eax, [esi + 0xc]
call fcn.00401480
test eax, eax
je 0x401718
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov ecx, 0x400
sub ecx, edi
push eax
mov dword [edx], ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x401c30
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x4727e4]
xor eax, esp
mov dword [esp + 0x5c], eax
xor eax, eax
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00404010
add esp, 4
test eax, eax
jne 0x401c8e
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.00435a11
add esp, 0x64
ret
lea esi, [esp + 8]
mov ecx, ebx
call fcn.00405390
mov ecx, dword [esp + 0x64]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.00435a11
add esp, 0x64
ret
Function at 0x4030a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x4727e4]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ebx
cmp eax, ebx
jne 0x4030d3
mov dword [esp + 0x10], 0xffffffff
jmp 0x4030d9
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push ebx
push ebx
push ebp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x4031c8
push 0
lea edx, [esp + 0x1c]
push edx
push 8
lea eax, [esp + 0x30]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40312b
push 0x464c78
push 0xfc
push 0x464c58
xor edx, edx
call fcn.004061d0
add esp, 0xc
jmp 0x4031fe
mov eax, 8
cmp dword [esp + 0x18], eax
je 0x403155
push 0x464c94
push 0xfe
lea edx, [eax - 7]
push 0x464c58
call fcn.00406300
add esp, 0xc
jmp 0x4031fe
cmp dword [esp + 0x40], ebx
je 0x40319b
mov ebx, eax
cmp dword [esp + 0x10], eax
jae 0x403181
push 0x464d48
push 0x321
mov edx, 5
push 0x464c58
call fcn.00406300
add esp, 0xc
jmp 0x4031fe
mov ecx, dword [esp + 0x24]
mov dx, word [esp + 0x28]
mov dword [esi], ecx
mov cx, word [esp + 0x2a]
mov word [esi + 4], dx
mov word [esi + 6], cx
jmp 0x4031f6
mov esi, dword [esp + 0x24]
cmp esi, dword [esp + 0x10]
jbe 0x4031b3
push 0x464d48
mov ebx, esi
push 0x32d
jmp 0x40316d
mov edx, dword [esp + 0x38]
xor ebx, ebx
push ebx
push ebx
push ebp
push edx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x4031e3
push 0x464c2c
push 0xf9
push 0x464c58
xor edx, edx
call fcn.004061d0
add esp, 0xc
jmp 0x4031fe
mov ecx, dword [esp + 0x20]
mov edx, edi
call fcn.00402720
test eax, eax
je 0x4031fe
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x403208
mov dword [eax], ebx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00435a11
add esp, 0x28
ret
Function at 0x403c80
Capabilities:
Get file size

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, eax
mov eax, dword [esi]
mov edi, dword [esi + 0x18]
lea ecx, [esp + 0x10]
push ecx
xor ebp, ebp
push eax
xor ebx, ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor edx, edx
test eax, eax
jne 0x403ccd
push 0x464ca4
push 0x11e
push 0x464c58
call fcn.004061d0
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ebx, dword [esp + 0x10]
mov ecx, dword [esi + 0xb4]
sub ebx, edi
mov edi, dword [esp + 0x14]
sbb edi, edx
sub ebx, 0x298
sbb edi, ebp
xor eax, eax
cmp edi, eax
jl 0x403d64
jg 0x403cf3
cmp ebx, ecx
jb 0x403d64
mov ebp, dword [esi]
push 0
push 0
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x403d29
push 0x464c2c
push 0xf9
push 0x464c58
xor edx, edx
call fcn.004061d0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x1c]
mov esi, 0x298
mov edx, ebp
call fcn.00402720
test eax, eax
je 0x403d1f
mov eax, dword [esp + 0x20]
test eax, eax
je 0x403d4a
mov dword [eax], ebx
mov dword [eax + 4], edi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x403d71
mov ecx, 1
mov word [eax], cx
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x403d71
xor edx, edx
mov word [eax], dx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x404630
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4727e4]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
push ebp
xor ebp, ebp
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ebp
cmp eax, ebp
je 0x404770
cmp dword [esp + 0x28], ebp
je 0x404770
push ebx
push 0x2800
call fcn.00438b6a
mov ebx, eax
add esp, 4
cmp ebx, ebp
jne 0x404693
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00435a11
add esp, 0x1c
ret
push esi
push edi
xor edi, edi
jmp 0x4046a0
push edi
push 0x464e64
mov ecx, 0x2800
call fcn.004025b0
add esp, 8
push ebp
push 0x80
push 3
push ebp
push 3
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x404746
xor eax, eax
push 0x2800
push ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call fcn.004354f0
add esp, 0xc
push ebp
lea eax, [esp + 0x18]
push eax
push 0x2800
push ebx
push 0xc
lea ecx, [esp + 0x30]
push ecx
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x404739
mov eax, dword [ebx + 0x18]
cmp eax, ebp
jbe 0x404739
mov edx, dword [esp + 0x18]
add eax, ebx
push eax
mov eax, dword [esp + 0x38]
push edx
push 0x464e78
call fcn.004043d0
add esp, 0xc
mov dword [esp + 0x10], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], ebp
jne 0x404750
inc edi
cmp edi, 0x10
jl 0x4046a0
push ebx
call fcn.00436fa7
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00435a11
add esp, 0x1c
ret
mov ecx, dword [esp + 0x1c]
pop ebp
xor ecx, esp
or eax, 0xffffffff
call fcn.00435a11
add esp, 0x1c
ret
Function at 0x404820
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
xor esi, esi
push edi
xor edi, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], esi
cmp dword [esp + 0x30], esi
je 0x40485a
cmp dword [esp + 0x34], esi
je 0x40485a
push 0x200
call fcn.00438b6a
mov ebx, eax
add esp, 4
cmp ebx, esi
jne 0x404865
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
lea eax, [esp + 0x14]
push eax
push 0x20119
push esi
push str._VC
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4049c4
mov edx, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x20]
push ecx
push ebx
push esi
push edx
mov dword [esp + 0x30], pe_nt_image_headers32
call ebp
test eax, eax
jne 0x40495a
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4048bd
mov eax, 0x80000002
lea ecx, [esp + 0x1c]
push ecx
push 0x20119
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404933
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x20]
lea eax, [ebx + 4]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push 0x464ef4
push edx
mov dword [esp + 0x38], 1
mov dword [esp + 0x28], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x404928
mov eax, ebx
mov dword [ebx], 0x5c2e5c5c
call fcn.00404790
cmp edx, edi
jb 0x404928
ja 0x404922
cmp eax, dword [esp + 0x24]
jbe 0x404928
mov dword [esp + 0x24], eax
mov edi, edx
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push ebx
inc esi
push esi
push edx
mov dword [esp + 0x30], pe_nt_image_headers32
call ebp
test eax, eax
je 0x4048b0
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
ja 0x404970
cmp dword [esp + 0x24], 0
jbe 0x4049c4
mov ecx, dword [esp + 0x24]
push edi
push ecx
push 0x464f00
mov ecx, 0x200
call fcn.004025b0
add esp, 0xc
test eax, eax
jne 0x4049a9
push ebx
mov dword [esp + 0x1c], 0xffffffff
call fcn.00436fa7
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
push ebx
push edx
push 0x464f0c
call fcn.004043d0
add esp, 0xc
mov dword [esp + 0x18], eax
push ebx
call fcn.00436fa7
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x407990
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4579f0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4727e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, dword [0x476264]
xor edi, edi
cmp ecx, edi
jne 0x4079db
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
jne 0x4079e8
mov dword [ebp - 0x14], edi
jmp 0x407a00
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x14], eax
cmp eax, edi
jne 0x407a96
mov ecx, dword [0x476264]
mov eax, dword [ecx]
cmp eax, edi
je 0x4079c7
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4079c7
mov ebx, 0x476264
mov dword [ebp - 4], edi
call fcn.00407ab0
mov esi, eax
mov dword [ebp - 0x14], esi
cmp esi, edi
jne 0x407a3e
push 0x46c57c
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], 1
call fcn.00435079
mov ecx, dword [0x476264]
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x407a58
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp eax, edi
jne 0x407a82
push 0x46c57c
lea edx, [ebp - 0x1c]
push edx
mov dword [ebp - 0x1c], 4
call fcn.00435079
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x407a79
call fcn.00407e10
mov eax, 0x407a7f
ret
mov eax, dword [0x476264]
mov eax, dword [eax]
test eax, eax
je 0x407a94
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407ab0
Capabilities:
Print debug messages

Disassembly:
sub esp, 8
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x5b0]
add eax, 8
mov dword [eax + 0x5b0], ecx
cmp ecx, eax
jne 0x407add
xor ecx, ecx
jmp 0x407ae9
mov edx, dword [ecx + 0x5a8]
mov dword [eax + 0x5b0], edx
push esi
mov esi, ecx
test ecx, ecx
je 0x407b9d
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenThread]
mov eax, dword [esi]
cmp dword [esp + 0x10], eax
jne 0x407b10
mov dword [esp + 0xc], esi
jmp 0x407b70
push eax
push 1
push 0x40
call edi
test eax, eax
jne 0x407b69
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x407b5c
mov eax, dword [esi + 0x5ac]
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5a8], ecx
mov edx, dword [esi + 0x5a8]
mov eax, dword [esi + 0x5ac]
mov dword [edx + 0x5ac], eax
call ebp
test eax, eax
je 0x407b70
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x407b70
push 0x4651c0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x407b70
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx]
mov esi, dword [eax + 0x5b8]
add eax, 8
cmp esi, eax
je 0x407b93
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5b0], ecx
test esi, esi
jne 0x407b02
mov eax, dword [esp + 0xc]
pop edi
pop ebp
test eax, eax
jne 0x407bb1
mov ecx, dword [ebx]
add ecx, 8
call fcn.00407d40
test eax, eax
je 0x407bb1
mov edx, dword [esp + 8]
mov dword [eax], edx
pop esi
add esp, 8
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..reloc
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x5f3f0f3f
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
mov ecx, 0x6b571069
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x44b490
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
and ecx, 1
je 0x44b4b1
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 8], eax
jmp 0x44b50c
push 5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x44b4d5
call fcn.004270f0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x44b4f4
call fcn.004270f0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x44b50c
call fcn.004270f0
call fcn.004342a0
cmp dword [eax + 0x3c], 0
je 0x44b526
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.0044b430
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0044b2e0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x7c], 0
je 0x44b556
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x7c]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x7c], 0
cmp dword [ebp - 4], 0
je 0x44b56b
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov dword [edx + 0x7c], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
or ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x408540
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x408577
mov dword [0x43f730], eax
push edx
push edx
push sym.get_globals_dtor_void_
push eax
call sym.___mingwthr_key_dtor
add esp, 0x10
test eax, eax
sete al
and eax, 0xff
mov dword [0x439040], eax
mov esp, ebp
pop ebp
ret
call fcn.00419800
jmp 0x408564

Function at 0x4085c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov eax, dword [0x439040]
mov ebp, esp
test eax, eax
push esi
push ebx
jne 0x4085e0
mov eax, 0x43f720
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov ebx, dword [0x43f730]
call fcn.00419800
sub esp, 0xc
mov esi, eax
push ebx
call sub.KERNEL32.dll_TlsGetValue
mov ebx, eax
push esi
call sub.KERNEL32.dll_SetLastError
mov eax, ebx
add esp, 0xc
jmp 0x4085d3

Function at 0x408610
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov edx, dword [0x439040]
mov ebp, esp
mov eax, 0x43f720
push esi
test edx, edx
push ebx
je 0x40864f
test edx, edx
js 0x4086a0
mov ebx, dword [0x43f730]
call fcn.00419800
sub esp, 0xc
mov esi, eax
push ebx
call sub.KERNEL32.dll_TlsGetValue
mov ebx, eax
push esi
call sub.KERNEL32.dll_SetLastError
add esp, 0xc
test ebx, ebx
je 0x408656
mov eax, ebx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
sub esp, 0xc
push 8
call sym._malloc
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x4086b9
mov esi, dword [0x43f730]
push eax
push eax
push ebx
push esi
call sub.KERNEL32.dll_TlsSetValue
pop edx
test eax, eax
pop ecx
je 0x408693
xor eax, eax
test eax, eax
jne 0x4086b9
mov dword [ebx], 0
mov dword [ebx + 4], 0
jmp 0x40864d
call fcn.00419800
jmp 0x408680
call sym.get_globals_init_once__
mov eax, dword [0x439040]
test eax, eax
jne 0x408628
mov eax, 0x43f720
jmp 0x40864f
call method.std.terminate__
mov esi, esi
Function at 0x415b50
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
push eax
mov ebx, dword [0x43f9d0]
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x415b90
mov dword [ebx + 0x28], eax
push eax
push eax
push sym._fc_key_dtor
mov eax, dword [ebx + 0x28]
push eax
call sym.___mingwthr_key_dtor
add esp, 0x10
test eax, eax
sete al
and eax, 0xff
mov dword [ebx + 0x2c], eax
mov ebx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call fcn.00419800
jmp 0x415b7b

Function at 0x415e90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov eax, dword [0x43f9d0]
mov edi, dword [ebp + 8]
test eax, eax
je 0x415fee
mov ecx, dword [eax + 0x2c]
test ecx, ecx
js 0x415fdf
mov edx, dword [eax + 0x2c]
test edx, edx
jne 0x415fba
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x415fb0
xor edx, edx
mov eax, 5
mov ecx, 5
cmp eax, 5
je 0x415f1e
mov ecx, 3
test eax, eax
jne 0x415f1e
test edx, edx
jne 0x415ef8
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
jmp 0x415ec5
lea ebx, [ebp - 0x14]
push eax
push eax
push ebx
push edi
mov eax, dword [edi + 4]
push eax
mov esi, dword [edi]
push esi
push 1
push 1
call edx
add esp, 0x20
cmp eax, 6
je 0x415f28
cmp eax, 8
je 0x415ef1
mov ecx, 3
lea esp, [ebp - 0xc]
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x14]
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [edi + 0xc], 0
mov dword [ebp - 0x14], eax
push ecx
push ecx
push ebx
push edi
call sym.__Unwind_RaiseException_Phase2
add esp, 0x10
mov ecx, eax
cmp eax, 7
jne 0x415f1e
mov eax, dword [0x43f9d0]
mov ebx, dword [ebp - 0x14]
test eax, eax
jne 0x415f64
call sym.___w32_sharedptr_initialize
mov eax, dword [0x43f9d0]
mov edx, dword [eax + 0x2c]
test edx, edx
js 0x415f9d
mov edi, dword [eax + 0x2c]
test edi, edi
je 0x415f8b
push esi
push esi
push ebx
mov ebx, dword [eax + 0x28]
push ebx
call sub.KERNEL32.dll_TlsSetValue
pop edx
test eax, eax
pop ecx
jne 0x415f8e
call fcn.00419800
jmp 0x415f8e
mov dword [eax + 0x24], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp dword [edx + 4]
call sym._fc_key_init_once
mov eax, dword [0x43f9d0]
jmp 0x415f6b
mov edx, dword [eax + 0x18]
xor eax, eax
jmp 0x415eda
mov ebx, dword [eax + 0x28]
call fcn.00419800
sub esp, 0xc
mov esi, eax
push ebx
call sub.KERNEL32.dll_TlsGetValue
mov ebx, eax
push esi
call sub.KERNEL32.dll_SetLastError
mov eax, ebx
add esp, 0xc
jmp 0x415ec2
call sym._fc_key_init_once
mov eax, dword [0x43f9d0]
jmp 0x415eb4
call sym.___w32_sharedptr_initialize
mov eax, dword [0x43f9d0]
jmp 0x415ea9