joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450e00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x450e38]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x450e19
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x450e28
or bl, 4
test esi, 0x20000000
je 0x450e33
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4574fc
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45750e
add esp, 0xfffffff0
call fcn.00403890
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041ef28
mov eax, dword [0x4921ac]
mov dword [eax + 4], ebx
mov dword [eax], 0x4578a0
mov eax, dword [0x4921bc]
mov dword [eax + 4], ebx
mov dword [eax], 0x4578ac
mov eax, ebx
call fcn.004578b8
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x415ca8]
call fcn.00403528
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x415ca8]
call fcn.00403528
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x415ca8]
call fcn.00403528
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x415ca8]
call fcn.00403528
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x415ca8]
call fcn.00403528
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x453cd0
push eax
push 0
push 0
mov eax, dword [0x49240c]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x420994]
call fcn.004221cc
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x420994]
call fcn.004221cc
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x420994]
call fcn.004221cc
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00457d08
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x457bd0
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x457bd0
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x457bd0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45764b
call fcn.004038e8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4579b4
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x457b5f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x457b40
mov dl, 1
mov eax, dword [0x41630c]
call fcn.00403528
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404368
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x457b2f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044584c
test al, al
je 0x457b22
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x457b70
lea eax, [ebp - 0x254]
call fcn.004096e4
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x457b22
xor eax, eax
push ebp
push 0x457b1b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x457ba8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x457b04
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004045d8
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x457b04
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004045d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457b22
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x457a25
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041aae0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457b66
lea eax, [ebp - 0x260]
call fcn.00404368
ret

Function at 0x4584a8
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x493be4]
cmp byte [eax + 0xa5], 0
jne 0x458519
cmp dword [0x493bfc], 0
jne 0x4584da
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x458464
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x493bfc], eax
cmp dword [0x493bf8], 0
jne 0x4584f5
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x493bf8], eax
cmp dword [0x493c00], 0
jne 0x458519
push esp
push 0
push 0
push 0x458408
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x493c00], eax
pop edx
ret
Function at 0x458bac
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x493be4]
cmp dword [eax + 0x30], 0
je 0x458c56
cmp dword [ebx + 0x94], 0
jne 0x458c50
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x458b3c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x458c50
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x458c16
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x458c50
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00418360
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x458c25
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4597b4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4597e9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404458
jmp 0x4597f6
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004043bc
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45a908
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45a949
mov eax, esi
call fcn.00440e78
test al, al
je 0x45a949
mov eax, dword [ebx + 0x84]
call fcn.00440b74
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45a949
push 0
mov eax, dword [ebx + 0x84]
call fcn.00440b74
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x463a3c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x463a44
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x463c36
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x463c4c
mov eax, esi
call fcn.004617cc
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.004043bc
lea ecx, [ebp - 0x10]
mov edx, 0x463c60
mov eax, esi
call fcn.004617cc
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.004043bc
lea ecx, [ebp - 0x14]
mov edx, 0x463c78
mov eax, esi
call fcn.004617cc
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004043bc
lea ecx, [ebp - 0x18]
mov edx, 0x463c94
mov eax, esi
call fcn.004617cc
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.004043bc
lea ecx, [ebp - 0x1c]
mov edx, 0x463cb0
mov eax, esi
call fcn.004617cc
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.004043bc
lea ecx, [ebp - 0x24]
mov edx, 0x463cc8
mov eax, esi
call fcn.004617cc
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408704
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00408af8
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x463ce0
mov eax, esi
call fcn.004617cc
mov eax, dword [ebp - 0x28]
call fcn.004608e4
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x463cf0
mov eax, esi
call fcn.004617cc
mov eax, dword [ebp - 0x2c]
call fcn.004608e4
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x463d08
mov eax, esi
call fcn.004617cc
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00408af8
inc eax
je 0x463bd9
lea ecx, [ebp - 0x34]
mov edx, 0x463d08
mov eax, esi
call fcn.004617cc
mov eax, dword [ebp - 0x34]
call fcn.00408abc
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a054
fstp qword [ebp - 0x3c]
wait
call fcn.0040a3c4
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x463bf4
lea ecx, [ebp - 0x40]
mov edx, 0x463d08
mov eax, esi
call fcn.004617cc
mov eax, dword [ebp - 0x40]
call fcn.004608e4
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x463d18
mov eax, esi
call fcn.004617cc
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.004043bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463c3d
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.0040438c
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.0040438c
ret
Function at 0x46fed4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x46ff2e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0046fec4
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.0045f454
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0045f054
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ff35
lea eax, [ebp - 4]
call fcn.00404368
ret

Function at 0x473b6c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x415258]
call fcn.00404d24
xor eax, eax
push ebp
push 0x473cb0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4915f8], 0
jne 0x473bbf
mov ecx, dword [0x492048]
mov dl, 1
mov eax, dword [0x4077b0]
call fcn.0040c21c
call fcn.00403cf8
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402f5c
mov eax, ebx
call fcn.00404bd0
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x473cc0
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405e78
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404be0
test eax, eax
jle 0x473c57
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x473c50
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.004045f0
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.004045d8
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408694
test eax, eax
jne 0x473c50
mov ebx, 0x15
jmp 0x473c5c
mov ebx, 0x10
jmp 0x473c5c
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4915f8]
call fcn.00473ac4
mov eax, dword [ebp - 8]
call fcn.00473ac4
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00405e90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473cb7
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.0040438c
lea eax, [ebp - 0x10]
mov edx, dword [0x415258]
call fcn.00404df4
ret
Function at 0x47ddc0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x47ddee
mov eax, ebx
call fcn.0047e874
cmp dword [ebx + 0x40], 0
je 0x47dde7
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x47de5f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x47de51
cmp dword [ebx + 8], 0
je 0x47de10
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x47de22
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x47de51
cmp dword [ebx + 8], 0
je 0x47de03
cmp eax, 3
je 0x47de35
dec eax
jne 0x47de03
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x47de03
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x47de03
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x47de7d
cmp dword [ebx + 0x14], 0xcc
je 0x47de7d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0047de88
pop ebx
ret
Function at 0x3ac3700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.03ac378f
jae 0x3ac370e
xor ecx, ecx
call fcn.03ac378f
jae 0x3ac373d
xor eax, eax
call fcn.03ac378f
jae 0x3ac374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.03ac378f
adc al, al
jae 0x3ac372f
jne 0x3ac3779
stosb byte es:[edi], al
jmp 0x3ac3711
call fcn.03ac379b
sub ecx, ebx
jne 0x3ac3756
call fcn.03ac3799
jmp 0x3ac3775
lodsb al, byte [esi]
shr eax, 1
je 0x3ac3783
adc ecx, ecx
jmp 0x3ac3772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.03ac3799
cmp eax, 0x7d00
jae 0x3ac3772
cmp ah, 5
jae 0x3ac3773
cmp eax, 0x7f
ja 0x3ac3774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x3ac3711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8

Function at 0x3ae3700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.03ae378f
jae 0x3ae370e
xor ecx, ecx
call fcn.03ae378f
jae 0x3ae373d
xor eax, eax
call fcn.03ae378f
jae 0x3ae374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.03ae378f
adc al, al
jae 0x3ae372f
jne 0x3ae3779
stosb byte es:[edi], al
jmp 0x3ae3711
call fcn.03ae379b
sub ecx, ebx
jne 0x3ae3756
call fcn.03ae3799
jmp 0x3ae3775
lodsb al, byte [esi]
shr eax, 1
je 0x3ae3783
adc ecx, ecx
jmp 0x3ae3772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.03ae3799
cmp eax, 0x7d00
jae 0x3ae3772
cmp ah, 5
jae 0x3ae3773
cmp eax, 0x7f
ja 0x3ae3774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x3ae3711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0xada058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xada1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xada07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xada06a
add dl, dl
jne 0xada089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xada0dc
xor eax, eax
add dl, dl
jne 0xada096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xada17d
add dl, dl
jne 0xada0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xada0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xada0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xada0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xada0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xada075
mov eax, 1
add dl, dl
jne 0xada0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xada0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xada0e1
sub eax, ebx
mov ebx, 1
jne 0xada128
mov ecx, 1
add dl, dl
jne 0xada10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xada119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xada105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xada075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xada13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xada14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xada136
cmp eax, 0x7d00
jae 0xada16d
cmp eax, 0x500
jb 0xada168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xada075
cmp eax, 0x7f
ja 0xada170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xada075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xada19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xada075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401000
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x508
lea eax, [ebp - 0x308]
push esi
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x108]
mov esi, 0x403018
push eax
push 0
lea eax, [ebp - 0x308]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x508]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll__splitpath
lea eax, [ebp - 0x208]
push esi
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call sub.MSVCRT.dll__makepath
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll__unlink
add esp, 0x2c
pop esi
leave
ret
Function at 0x403350
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403369
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4033a4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4033a0
lea ebx, [ebx]
cmp esi, eax
jae 0x4033a4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x403390
cmp esi, eax
jb 0x4033aa
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x404530
Capabilities:
Print debug messages

Disassembly:
push ebp
lea ebp, [esp - 0x804]
sub esp, 0x804
push 0xffffffffffffffff
push 0x437ee0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4509cc]
xor eax, ebp
mov dword [ebp + 0x800], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, 1
cmp dword [0x450b00], ebx
ja 0x404669
mov eax, dword [0x450b58]
mov edx, dword [eax + 0xc]
mov ecx, 0x450b58
mov dword [ebp - 4], 0
call edx
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp + 0x80c]
lea eax, [ebp + 0x810]
push eax
push ecx
push 0x400
lea edx, [ebp]
push 0x400
push edx
mov byte [ebp - 4], bl
call dword [sym.imp.MSVCR90.dll__vsnwprintf_s]
add esp, 0x14
test eax, eax
jle 0x404649
lea eax, [ebp]
push eax
push str.DENG
lea ecx, [ebp - 0x14]
push str.__s__s
push ecx
call fcn.00404330
add esp, 0x10
push ebx
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x14]
call fcn.00403e20
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
cmp ecx, ebx
jne 0x404612
test ecx, ecx
jge 0x404607
push 0x80070057
call fcn.00401000
movzx eax, word [eax]
cmp ax, 0xa
jne 0x404612
xor bl, bl
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404631
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x40463f
push 0xa
lea ecx, [ebp - 0x14]
call fcn.004042d0
mov esi, dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404669
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.0043707e
add ebp, 0x804
mov esp, ebp
pop ebp
ret
Function at 0x405a10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x438141
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4509cc]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor ebx, ebx
lea ecx, [esi + 0x10]
mov dword [esi + 0x70], ebx
call fcn.0040dc00
lea edi, [esi + 0xdc]
mov ecx, edi
mov dword [esp + 0x1c], ebx
call fcn.00428ec0
mov dword [edi], vtable.CPMonThread.0
mov dword [edi + 0x28], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [esi + 0x11c], ebx
mov dword [esi + 0x120], ebx
mov dword [esi + 0x124], ebx
lea ecx, [esi + 0x128]
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov byte [esp + 0x1c], 4
mov dword [ecx + 0x14], eax
call fcn.00401040
cmp eax, ebx
jge 0x405aa9
push eax
call fcn.00401000
push 4
mov byte [esp + 0x20], 5
lea edi, [esi + 0x140]
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
cmp eax, ebx
je 0x405ac6
mov dword [eax], edi
jmp 0x405ac8
xor eax, eax
mov dword [edi], eax
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
mov dword [esi + 0x114], ebx
mov dword [esi + 0x118], 0xffffffff
mov dword [esi + 0x6c], 1
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret