joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453024
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
push ebx
mov ebx, 0x80
push edi
xor al, al
lea edi, [ebp - 0x80]
mov ecx, ebx
rep stosb byte es:[edi], al
cmp dword [ebp + 0xc], ebx
jbe 0x453075
lea eax, [ebp - 0x14c]
push eax
call fcn.004534f3
push dword [ebp + 0xc]
lea eax, [ebp - 0x14c]
push dword [ebp + 8]
push eax
call fcn.00453516
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.00453563
add esp, 0x18
jmp 0x453082
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x80]
rep movsb byte es:[edi], byte [esi]
pop esi
xor eax, eax
xor byte [ebp + eax - 0x80], 0x36
inc eax
cmp eax, ebx
jb 0x453084
lea eax, [ebp - 0x14c]
push eax
call fcn.004534f3
push ebx
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.00453516
push dword [ebp + 0x14]
lea eax, [ebp - 0x14c]
push dword [ebp + 0x10]
push eax
call fcn.00453516
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.00453563
add esp, 0x24
xor eax, eax
xor byte [ebp + eax - 0x80], 0x6a
inc eax
cmp eax, ebx
jb 0x4530d5
lea eax, [ebp - 0x14c]
push eax
call fcn.004534f3
push ebx
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.00453516
push 0x40
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.00453516
push dword [ebp + 0x18]
lea eax, [ebp - 0x14c]
push eax
call fcn.00453563
add esp, 0x24
xor al, al
mov ecx, ebx
push 0x40
lea edi, [ebp - 0x80]
rep stosb byte es:[edi], al
pop ecx
lea edi, [ebp - 0x18c]
rep stosb byte es:[edi], al
lea edi, [ebp - 0x14c]
mov ecx, 0xcc
rep stosb byte es:[edi], al
pop edi
pop ebx
leave
ret
Function at 0x453148
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [ebp + 0x20], 0
push ebx
push edi
push 0x40
mov dword [ebp - 4], 1
pop ebx
je 0x45320d
push esi
mov eax, dword [ebp + 0x18]
mov esi, dword [ebp + 0x14]
mov ecx, eax
lea edi, [ebp - 0x108]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 4]
bswap ecx
mov dword [ebp + eax - 0x108], ecx
lea ecx, [ebp - 0x44]
push ecx
add eax, 4
push eax
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00453024
mov eax, dword [ebp + 8]
add esp, 0x14
lea esi, [ebp - 0x44]
lea edi, [ebp - 0x84]
mov ecx, ebx
rep movsb byte es:[edi], byte [esi]
cmp eax, 1
jle 0x4531e2
lea esi, [eax - 1]
lea eax, [ebp - 0x44]
push eax
push ebx
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00453024
add esp, 0x14
xor eax, eax
mov cl, byte [ebp + eax - 0x44]
xor byte [ebp + eax - 0x84], cl
inc eax
cmp eax, ebx
jl 0x4531cf
dec esi
jne 0x4531b9
mov eax, dword [ebp + 0x20]
cmp dword [ebp + 0x20], ebx
jb 0x4531ec
mov eax, ebx
mov edi, dword [ebp + 0x1c]
add dword [ebp + 0x1c], eax
sub dword [ebp + 0x20], eax
inc dword [ebp - 4]
cmp dword [ebp + 0x20], 0
lea esi, [ebp - 0x84]
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
jne 0x453168
pop esi
xor al, al
lea edi, [ebp - 0x108]
mov ecx, 0x84
rep stosb byte es:[edi], al
mov ecx, ebx
lea edi, [ebp - 0x84]
rep stosb byte es:[edi], al
mov ecx, ebx
lea edi, [ebp - 0x44]
rep stosb byte es:[edi], al
pop edi
pop ebx
leave
ret
Function at 0x454b76
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x20
pop ecx
mov ebx, edi
rep movsb byte es:[edi], byte [esi]
push 7
xor esi, esi
pop edi
inc esi
mov ecx, dword [ebx + 0x1c]
call fcn.00454b34
xor eax, esi
xor ecx, ecx
xor eax, dword [ebx + ecx*4]
inc ecx
mov dword [ebx + ecx*4 + 0x1c], eax
cmp ecx, 4
jl 0x454b9e
dec edi
je 0x454bd0
mov ecx, dword [ebx + 0x2c]
ror ecx, 0x18
call fcn.00454b34
push 4
pop ecx
xor eax, dword [ebx + ecx*4]
inc ecx
mov dword [ebx + ecx*4 + 0x1c], eax
cmp ecx, 8
jl 0x454bbc
add ebx, 0x20
add esi, esi
jmp 0x454b92
mov ecx, dword [ebp + 0xc]
and dword [ebp - 4], 0
lea eax, [ecx + 0xf0]
mov dword [ebp + 0xc], ecx
sub dword [ebp + 0xc], eax
mov ebx, eax
mov dword [ebp - 8], 0x38
sub ebx, ecx
lea esi, [eax + 0xe0]
mov edx, esi
mov dword [ebp - 0xc], 4
mov edi, dword [ebp + 0xc]
mov edi, dword [edi + edx]
mov dword [ebx + ecx], edi
mov edi, dword [ecx]
mov dword [edx], edi
add ecx, 4
add edx, 4
dec dword [ebp - 0xc]
jne 0x454bfd
add dword [ebp - 4], 4
sub dword [ebp - 8], 4
mov edx, dword [ebp - 4]
sub esi, 0x10
cmp edx, dword [ebp - 8]
jle 0x454bf4
add eax, 0x10
mov dword [ebp + 0xc], 0x34
mov edx, dword [eax]
push 0x20
xor esi, esi
pop ebx
movzx ecx, dl
movzx ecx, byte [ecx + 0x19f0]
mov edi, dword [ecx*4 + 0x1af0]
mov cl, bl
ror edi, cl
shr edx, 8
xor esi, edi
sub ebx, 8
jne 0x454c39
mov dword [eax], esi
add eax, 4
dec dword [ebp + 0xc]
jne 0x454c32
pop edi
pop esi
pop ebx
leave
ret
Function at 0x454ed3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
xor dl, dl
mov cl, 1
movzx eax, dl
mov byte [ebp + eax - 0x104], cl
movzx eax, cl
mov byte [ebp + eax - 0x204], dl
add eax, eax
test cl, cl
jns 0x454eff
xor eax, 0x11b
xor cl, al
inc dl
jne 0x454ee0
push ebx
push esi
mov byte [ebp - 0x204], dl
mov byte [ebp - 5], dl
push edi
movzx esi, dl
movzx eax, byte [ebp + esi - 0x204]
lea ecx, [ebp - 5]
sub ecx, eax
mov cl, byte [ecx]
mov al, cl
shr al, 1
xor al, cl
shr al, 1
mov bl, cl
add bl, bl
xor bl, cl
xor al, cl
add bl, bl
shr al, 1
xor bl, cl
xor al, cl
add bl, bl
shr al, 4
xor bl, cl
add bl, bl
xor al, bl
xor al, cl
xor al, 0x63
mov byte [esi + 0x19f0], al
movzx eax, al
mov byte [eax + 0x1ef0], dl
inc dl
jne 0x454f11
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
mov cl, byte [eax + 0x19f0]
mov bl, byte [eax + 0x1ef0]
movzx edx, cl
test cl, cl
mov cl, dl
jns 0x454f80
add cl, cl
xor cl, 0x1b
jmp 0x454f82
add cl, cl
mov edi, eax
movzx ecx, cl
mov eax, ecx
xor eax, edx
shl eax, 8
or eax, edx
shl eax, 8
or eax, edx
shl eax, 8
or eax, ecx
mov dword [edi*4 + 0x15f0], eax
test bl, bl
jne 0x454fa9
xor ecx, ecx
jmp 0x455010
movzx eax, bl
movzx esi, byte [ebp + eax - 0x204]
lea eax, [esi + 0x68]
cdq
mov ecx, 0xff
idiv ecx
lea eax, [esi + 0xee]
mov ebx, 0xff
movzx ecx, byte [ebp + edx - 0x104]
cdq
idiv ebx
shl ecx, 8
movzx eax, byte [ebp + edx - 0x104]
xor ecx, eax
lea eax, [esi + 0xc7]
cdq
idiv ebx
shl ecx, 8
movzx eax, byte [ebp + edx - 0x104]
xor ecx, eax
lea eax, [esi + 0xdf]
cdq
mov esi, ebx
idiv esi
shl ecx, 8
movzx eax, byte [ebp + edx - 0x104]
xor ecx, eax
inc byte [ebp - 1]
mov dword [edi*4 + 0x1af0], ecx
jne 0x454f60
pop edi
pop esi
pop ebx
leave
ret
Function at 0x455025
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x48
push esi
mov esi, ecx
mov ecx, dword [ebx + 0xc]
push edi
mov edi, eax
mov eax, dword [ebx + 0x10]
shrd ecx, eax, 9
mov dword [ebp - 0x30], ecx
xor ecx, ecx
shr eax, 9
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
cmp dword [ebx + 8], ecx
je 0x455160
jmp 0x45506c
mov eax, dword [ebp - 0x2c]
cmp dword [0x160], 0x1c0
jne 0x45507d
pushfd
popfd
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0x30], 1
adc eax, 0
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx + 0x18]
add eax, 0x1e0
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
call dword [0x160]
add esp, 0xc
cmp dword [0x160], 0x1c0
jne 0x4550af
pushfd
popfd
mov dword [ebp - 4], 0x20
mov eax, dword [esi]
xor eax, dword [ebp - 0x20]
mov ecx, dword [esi + 4]
xor ecx, dword [ebp - 0x1c]
push dword [ebx + 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [esi + 8]
xor eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [esi + 0xc]
xor ecx, dword [ebp - 0x14]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x40]
push eax
push eax
mov dword [ebp - 0x34], ecx
call dword [ebx + 0x14]
mov eax, dword [ebp - 0x40]
xor eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x3c]
xor ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
mov dword [edi], eax
mov eax, dword [ebp - 0x38]
xor eax, dword [ebp - 0x18]
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 0x34]
xor ecx, edx
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [edi + 0xc], ecx
mov ecx, edx
shld edx, eax, 1
add eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
shr ecx, 0x1f
imul ecx, ecx, 0x87
shr eax, 0x1f
or dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0x1c]
shld edx, eax, 1
add eax, eax
mov dword [ebp - 0x20], eax
xor dword [ebp - 0x20], ecx
add esp, 0xc
add esi, 0x10
add edi, 0x10
dec dword [ebp - 4]
mov dword [ebp - 0x1c], edx
jne 0x4550b6
sub dword [ebx + 8], 0x200
jne 0x455069
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x457174
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
push ebx
mov ebx, 0x80
push edi
xor al, al
lea edi, [ebp - 0x80]
mov ecx, ebx
rep stosb byte es:[edi], al
cmp dword [ebp + 0xc], ebx
jbe 0x4571c5
lea eax, [ebp - 0x14c]
push eax
call fcn.00457643
push dword [ebp + 0xc]
lea eax, [ebp - 0x14c]
push dword [ebp + 8]
push eax
call fcn.00457666
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.004576b3
add esp, 0x18
jmp 0x4571d2
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x80]
rep movsb byte es:[edi], byte [esi]
pop esi
xor eax, eax
xor byte [ebp + eax - 0x80], 0x36
inc eax
cmp eax, ebx
jb 0x4571d4
lea eax, [ebp - 0x14c]
push eax
call fcn.00457643
push ebx
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.00457666
push dword [ebp + 0x14]
lea eax, [ebp - 0x14c]
push dword [ebp + 0x10]
push eax
call fcn.00457666
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.004576b3
add esp, 0x24
xor eax, eax
xor byte [ebp + eax - 0x80], 0x6a
inc eax
cmp eax, ebx
jb 0x457225
lea eax, [ebp - 0x14c]
push eax
call fcn.00457643
push ebx
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.00457666
push 0x40
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.00457666
push dword [ebp + 0x18]
lea eax, [ebp - 0x14c]
push eax
call fcn.004576b3
add esp, 0x24
xor al, al
mov ecx, ebx
push 0x40
lea edi, [ebp - 0x80]
rep stosb byte es:[edi], al
pop ecx
lea edi, [ebp - 0x18c]
rep stosb byte es:[edi], al
lea edi, [ebp - 0x14c]
mov ecx, 0xcc
rep stosb byte es:[edi], al
pop edi
pop ebx
leave
ret
Function at 0x457298
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [ebp + 0x20], 0
push ebx
push edi
push 0x40
mov dword [ebp - 4], 1
pop ebx
je 0x45735d
push esi
mov eax, dword [ebp + 0x18]
mov esi, dword [ebp + 0x14]
mov ecx, eax
lea edi, [ebp - 0x108]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 4]
bswap ecx
mov dword [ebp + eax - 0x108], ecx
lea ecx, [ebp - 0x44]
push ecx
add eax, 4
push eax
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00457174
mov eax, dword [ebp + 8]
add esp, 0x14
lea esi, [ebp - 0x44]
lea edi, [ebp - 0x84]
mov ecx, ebx
rep movsb byte es:[edi], byte [esi]
cmp eax, 1
jle 0x457332
lea esi, [eax - 1]
lea eax, [ebp - 0x44]
push eax
push ebx
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00457174
add esp, 0x14
xor eax, eax
mov cl, byte [ebp + eax - 0x44]
xor byte [ebp + eax - 0x84], cl
inc eax
cmp eax, ebx
jl 0x45731f
dec esi
jne 0x457309
mov eax, dword [ebp + 0x20]
cmp dword [ebp + 0x20], ebx
jb 0x45733c
mov eax, ebx
mov edi, dword [ebp + 0x1c]
add dword [ebp + 0x1c], eax
sub dword [ebp + 0x20], eax
inc dword [ebp - 4]
cmp dword [ebp + 0x20], 0
lea esi, [ebp - 0x84]
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
jne 0x4572b8
pop esi
xor al, al
lea edi, [ebp - 0x108]
mov ecx, 0x84
rep stosb byte es:[edi], al
mov ecx, ebx
lea edi, [ebp - 0x84]
rep stosb byte es:[edi], al
mov ecx, ebx
lea edi, [ebp - 0x44]
rep stosb byte es:[edi], al
pop edi
pop ebx
leave
ret
Function at 0x458000
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x40
lea eax, [esp + 0x44]
lea ecx, [esp]
push ebx
mov ebx, dword [0x45d008]
push ebp
push esi
mov esi, dword [esp + 0x50]
push edi
push 0
push eax
push 0x40
push ecx
push esi
call ebx
test eax, eax
je 0x458175
cmp dword [esp + 0x54], 0x40
jne 0x458175
cmp word [esp + 0x10], 0x5a4d
jne 0x458175
mov edx, dword [esp + 0x4c]
mov ebp, dword [0x45d004]
push 0
push 0
push edx
push esi
call ebp
cmp eax, 0xffffffff
je 0x458175
lea eax, [esp + 0x54]
push 0
push eax
push 0xf8
push 0x45e960
push esi
call ebx
test eax, eax
je 0x458175
cmp dword [esp + 0x54], 0xf8
jne 0x458175
cmp dword [0x45e960], 0x4550
jne 0x458175
mov eax, dword [0x45e976]
test ah, 0x20
jne 0x458175
mov edx, dword [0x45ea80]
xor eax, eax
mov ax, word [0x45e966]
add eax, edx
lea eax, [eax + eax*4]
shl eax, 3
push eax
push 0x40
call dword [fcn.0045d000]
test eax, eax
mov dword [0x45ea58], eax
je 0x458175
push 1
push 0
push 0
push esi
call ebp
mov dword [0x45ea6c], eax
xor eax, eax
mov ax, word [0x45e966]
mov edx, dword [0x45ea58]
lea ecx, [esp + 0x54]
push 0
lea edi, [eax + eax*4]
push ecx
shl edi, 3
push edi
push edx
push esi
call ebx
test eax, eax
je 0x458175
cmp dword [esp + 0x54], edi
jne 0x458175
push 1
push 0
push 0
push esi
call ebp
mov ecx, dword [0x45ea80]
lea ecx, [ecx + ecx*4]
lea edx, [eax + ecx*8]
mov eax, dword [0x45e9b4]
cmp edx, eax
ja 0x458175
mov edi, dword [0x45ea58]
mov ecx, dword [0x45e988]
mov eax, dword [edi + 0x10]
mov edx, dword [edi + 0xc]
add eax, edx
cmp ecx, eax
jae 0x458175
xor eax, eax
push 2
mov ax, word [0x45e966]
push 0
push 0
push esi
lea ecx, [eax + eax*4]
mov ebx, dword [edi + ecx*8 - 0x18]
lea edi, [edi + ecx*8]
call ebp
mov edx, dword [edi - 0x14]
add edx, ebx
cmp eax, edx
jne 0x458175
cmp dword [edi - 0x20], ebx
ja 0x458175
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x40
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x40
ret
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219

Function at 0x4282a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x4282ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4282c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4282b0
mov eax, 1
add ebx, ebx
jne 0x4282d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4282c8
jne 0x4282e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282c8
xor ecx, ecx
sub eax, 3
jb 0x4282f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42836a
mov ebp, eax
add ebx, ebx
jne 0x428303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x428334
inc ecx
add ebx, ebx
jne 0x428320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x428315
jne 0x428331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428315
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x428354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x428345
jmp 0x4282b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x428354
add edi, ecx
jmp 0x4282b6
pop esi
mov edi, esi
mov ecx, 0x115
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x428372
cmp byte [edi], 3
jne 0x428372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x428377
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4283e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x280c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4283a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x280cc]
or eax, eax
je 0x4283e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4283c1
call dword [esi + 0x280c8]
mov ebp, dword [esi + 0x280d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42841a
sub esp, 0xffffff80
jmp 0x409ac0
Function at 0x402080
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x4020a9
pop edi
pop ebx
pop ebp
ret
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4020bf
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4020b6
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x4020f2
nop
cmp esi, ecx
jae 0x4020b6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x4020e0
cmp esi, ecx
jae 0x4020b6
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402150
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 4], ecx
call fcn.00419a94
mov ebx, eax
test ebx, ebx
jne 0x402170
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, edi
shr eax, 4
push esi
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x402257
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402257
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402257
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x4021d8
cmp esi, ecx
jae 0x402257
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x4021c2
cmp esi, ecx
jae 0x402257
cmp word [esi], 0
je 0x402257
movzx eax, word [esi]
lea ecx, [esi + 2]
push 0
push 0
push 0
push 0
push eax
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
js 0x402262
mov ebx, dword [ebp - 4]
mov edx, 1
mov ecx, dword [ebx]
sub edx, dword [ecx - 4]
mov ecx, dword [ecx - 8]
sub ecx, edi
or edx, ecx
jge 0x402220
push edi
mov ecx, ebx
call fcn.00402650
movzx eax, word [esi]
push 0
push 0
push edi
push dword [ebx]
push eax
lea eax, [esi + 2]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x402262
mov dword [eax - 0xc], edi
mov eax, dword [ebx]
pop esi
mov byte [edi + eax], 0
mov eax, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004026f0
int3

Function at 0x404810
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004142ca
Function at 0x4074a2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov eax, ecx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], edi
je 0x4074e7
call fcn.0042548c
push 0xf0
push dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4074e4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40752e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, dword [ebp - 4]
push ebx
xor ebx, ebx
inc ebx
test edi, edi
je 0x40750a
mov ecx, dword [eax]
push dword [ebp + 0x10]
push edi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call dword [0x57d9d0]
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x40752b
mov edx, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [edx + 0xa0]
mov ecx, esi
call dword [0x57d9d0]
mov ecx, edi
call esi
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 0xc
Function at 0x413992
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x56ed4b
call fcn.0054da08
mov eax, ecx
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp + 0x10]
xor edi, edi
mov esi, dword [ebp + 0x14]
push edi
mov dword [ebx], edi
mov dword [esi], edi
cmp dword [eax + 0x58], edi
je 0x413a3a
push dword [ebp + 8]
call fcn.00413cbb
mov dword [ebp - 0x10], eax
test eax, eax
je 0x413acd
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
push ecx
push edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push ecx
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
mov dword [esi], ecx
test eax, eax
jne 0x413a23
push ecx
call fcn.0042b52f
pop ecx
lea ecx, [ebp - 0x14]
mov dword [ebx], eax
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x413a23
xor edi, edi
inc edi
jmp 0x413a2d
push dword [ebx]
call fcn.0042b538
pop ecx
mov dword [ebx], edi
lea ecx, [ebp - 0x24]
call fcn.00413859
jmp 0x413acb
mov eax, dword [eax]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [eax + 0x84]
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call dword [0x57d9d0]
mov ecx, dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x413ac3
mov esi, dword [ebp + 0x14]
shr ecx, 1
push ecx
mov dword [esi], ecx
call fcn.0042b52f
mov dword [ebx], eax
pop ecx
cmp dword [esi], edi
jbe 0x413abd
mov esi, dword [ebp + 0x10]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x18], ecx
push ecx
lea ecx, [ebp - 0x10]
call fcn.00413836
lea ecx, [edi + edi]
push ecx
lea ecx, [ebp - 0x10]
lea ebx, [eax - 1]
shl bl, 4
sub bl, 0x41
call fcn.00413836
mov ecx, dword [esi]
add al, bl
mov byte [edi + ecx], al
inc edi
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x18]
add ecx, 2
mov dword [ebp - 0x18], ecx
cmp edi, dword [eax]
jb 0x413a87
mov eax, dword [ebp - 0x10]
xor edi, edi
inc edi
lea ecx, [eax - 0x10]
call fcn.004029f0
mov eax, edi
call fcn.0054d9d6
ret 0x10

Function at 0x413ad5
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x413b28
push esi
push dword [ebp + 8]
call fcn.00413cbb
mov edi, eax
test edi, edi
je 0x413b23
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x413b23
mov eax, dword [ebp - 8]
jmp 0x413b3a
mov eax, dword [ebp + 0x10]
jmp 0x413b3a
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop esi
leave
ret 0xc