joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a9712
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [eax + 0x1b6141]
mov byte [esp], dh
lea eax, [eax - 0x6248e88]

Function at 0x100a9726
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, 0x1002a9d6
mov byte [esp + 4], 0x68
pushfd
mov ecx, dword [ecx + 0x13863f]
lea esp, [esp + 0x34]
jno 0x1012f2e4
lea ecx, [ecx + 0x13285821]
pushal
mov byte [esp], 0x43
call fcn.100b32ec
xchg ecx, eax
int3
pushfd
lea esp, [esp + 0x10]
jmp loc.1000ec6f
call fcn.101d5e63
fisttp dword [eax - 0x3c]
jbe 0x1012f366
cld
add bl, byte [ecx - 0x7ecd3a9e]
jb 0x1012f2cf
and al, 0x8f
jp 0x1012f2d9
mov eax, dword cs:[0xd53db5e]
dec esi
push ss
pushfd
jp 0x1012f34c
and dl, byte [ebx + 0x6d]
dec edx
rcr dl, 0x5e
lahf
sbb byte [ecx], cl
popal
ret
jp 0x1012f3c3
xor eax, 0x2dc22abe
adc dword [esi - 0x33235894], ebp
or al, 0xa4
dec ebx
pop ebp
cmovo esi, edi
and byte [ecx + 0x2ba35500], ch
fnstenv [ebx + eax*8]
sub ebx, ecx
xor al, 0xc3
or al, 0xe4
ror byte [ebx], 0xef
in al, 0x26
in eax, dx
xchg esi, eax
pushfd
pop esi
jns 0x1012f3f6
push ebx
jg 0x1012f3ed
invalid
movsb byte es:[edi], byte [esi]
xchg edx, eax
mov ch, 0x58
scasb al, byte es:[edi]
mov edi, dword fs:[esi + eax - 0x10c02b05]
ror byte [ebx], 0xa3
inc edi
rol byte [eax], 0xa8
mov dh, byte [ebx - 0x80]
ficomp dword [edi - 0x50]
mov eax, dword [0x885991dd]
cdq
inc esp
pop esi
sub byte [ecx], dh
mov dl, 0xc3
xchg dword [esi - 0x5eb3188e], edx
popfd
aas
mov byte [eax], 0xb7
mov al, byte [eax]
add dword [ebx + 0x6856c249], ebp
sub dword [esp + ebp*2 - 0x4fe72793], ebx
xchg ebp, eax
push ebp
jb 0x1012f41e
out 0x4c, eax
mov eax, dword [0xc63f9d]
mov bh, 0x8a
add byte [ecx], al
stosd dword es:[edi], eax
dec ecx
ret 0x6856
mov edi, 0xb8a7e754
sub byte [ebp - 0x219a696a], 0xe3
sub ah, 2
imul ebp, esi, 0xffffff85
arpl word [esp + ecx*2], dx
adc dh, ah
and al, 4
xor ah, cl
and ebp, dword [esp + ebp*2 - 0x20]
nop
ror edx, 1
add eax, 0x8269e2c5
mov esi, 0xb65de51c
add eax, 0x398e48e1
jmp 0x1012f454
hlt
and byte [ecx - 0x7b], cl
fcom dword [ecx]
and byte [edx], bh
push ebp
invalid

Function at 0x10110403
Capabilities:
Encode data using xor

Disassembly:
lea ecx, [ecx + 0x7ceceaa6]
call fcn.10255398
cmp dword [edi - 0x7b], edi
invalid
mov ecx, dword [ecx + 0x9ff8e]
lea esp, [esp + 0x50]
jbe 0x101627c5
lea ecx, [ecx + 0x7ceceaa6]
pushal
push dword [esp]
pushfd
call fcn.100283cb
cld
aas
mov al, 2
push es
popfd
retf
jmp 0x100fda02

Function at 0x10122150
Capabilities:
Packed with generic packer

Disassembly:
xchg dword [esp + 0x28], esi
mov byte [esp + 0xc], 0x8e
call fcn.10131c48
xor eax, 0xe9ba626a
sub al, 0x6a
pop ss
add byte [eax + 0x202444c7], bl
das
and ebx, dword [eax]
and byte [eax - 0x169fdbd4], cl
and eax, 0x8800023f
add al, 0x24
push 0x6eb1b4eb
pushfd
nop
pushal
jmp 0x100f8e91

Function at 0x10123396
Capabilities:
Encode data using xor

Disassembly:
call fcn.10149e0f
das
sbb bl, byte [esi]
pushfd
invalid
Function at 0x101274d4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x10057904
push dword [esp]
pushfd
pushal
mov ecx, dword [ecx + 0xa85d7]
pushfd
push dword [esp + 4]
mov byte [esp + 4], 0x4b
lea ecx, [ecx - 0x17395c40]
call fcn.1012f603
xor dword [ebx + 0x5d], edx
call 0xd6641e12
xor eax, 0x27db6394
mov esp, 0x3aaa5332
ror byte [esp + esi*4 + 0x19], 0xec
inc esi
mov ch, byte [ebp - 0x7ba70fc6]
salc
aaa
or edi, dword [edx + 0x5579a7ff]
sbb byte [ebx + 0x3e5ce001], al
pop edi
inc ecx
mov ah, 0x13
cmp al, 0x72
or dword [ecx + 0x6e], ebp
sahf
sub esp, ebx
and al, 3
mov edi, 0xdb83c540
push 0xffffffffffffffae
push es
dec ebp
popfd
push edi
pushfd
movsd dword es:[edi], dword [esi]
dec ecx
push eax
scasd eax, dword es:[edi]
pushal
mov esi, dword [esi + eax*4 - 0x13]
cwde
fiadd dword [edx + 0x51]
adc al, 0xc3
aam 0x1e
test eax, 0x46ee29bd
mov ebp, ss
sti
dec ebx
lodsb al, byte [esi]
mov dl, 0x4d
mov esi, 0x98f80088
mov esp, dword [edx - 0x2f]
invalid

Function at 0x1013f7e5
Capabilities:
Packed with generic packer

Disassembly:
pushal
pushfd
call fcn.1010c1a9
mov dword [esp], 0x20b21e4d
jmp 0x101cab82
lea esp, [esp + 0x24]
jae 0x100ac33d
xchg dword [esp], edx
pushal
pushal
pushfd
push dword [esp + 0x44]
ret 0x48
call fcn.1011bbc8
Function at 0x10191397
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 4]
mov dword [esp + 0x38], ebp
lea esp, [esp + 0x34]
jne 0x1015df20
push 0xce6ed3fc
lea ebp, [eax*2 + 0x2498ffd4]
pop ebp
mov ebp, 0x10035f9c
pushfd
mov ebp, dword [ebp + 0x12d079]
mov byte [esp], 0xee
jmp 0x10146af8
call fcn.1015c666
inc edi
jb 0x10146b76
hlt
push 0x13
ja 0x10146b8a
jno 0x10146bc0
pop edi
cld
push es
sti
enter 0x5483, 0x54
mov al, 0x8c
push edx
jo 0x10146bc4
mov al, byte [0xaad31a32]
jecxz 0x10146ba2
xor bl, byte [edx]
shr dword [edx - 0x19ced1d], cl
arpl si, di
in al, 0x5d
jle 0x10146be3
mov ss, word [edx - 0x30b24c82]
xor dword [eax - 0x33312192], ecx
pop es
and byte [ebx + 2], dh
popfd
stc
fadd qword [ecx]
je 0x10146c08
or edx, 0x4c978bc
lodsb al, byte [esi]
cmpsb byte [esi], byte es:[edi]
insd dword es:[edi], dx
cmpsb byte [esi], byte es:[edi]
sal dword [bx + di], 1
or eax, 0xfbad2f5e
inc edi
retf 0x456d
insd dword es:[edi], dx
inc ebp
push edi
inc edx
xchg esi, eax
lcall 0xefc8, 0x591b67b
mov ebx, dword [eax]
fdiv qword [ebp + esi + 0x3f]
in eax, 0xb0
sbb eax, ebp
out 0x9b, al
hlt
stosb byte es:[edi], al
and dh, al
cli
cmpsb byte [esi], byte es:[edi]
in eax, dx
or dword [0x4bbe1cb7], esi
aam 0x25
and dword [esi], ebx
les edi, [esi - 0x69a082d5]
invalid
mov dh, 0x6f
sahf
lcall 0x9ffd, 0x1ad58bdb
jmp 0x10146c2d
adc eax, 0x158f84f3
packuswb mm6, qword [eax + esi]
lodsd eax, dword [esi]
lahf
and eax, 0xf307f7f6
rcl dword [ebx]
mov byte [0x1c8486f], al
jne 0x10146cb8
std
aas
sbb dh, al
cmp dl, byte [edx - 0x3cfd5f43]
test byte [ebp + 0x7b], dh
aad 0x28
xchg ebp, eax
outsd dx, dword [esi]
mov edx, 0xee01ea80
sbb eax, 0x1c3bf06a
sbb eax, 0xe9c8745b
in eax, dx
jmp 0x8be06ff5
push esi
fnsave dword [ebx]
aad 0x65
jne 0x10146d29
mov al, byte [0xb75e2e87]
mov dword [eax - 0x4f], 0xc3e68cb5
sbb edi, edi
cmp byte cs:[edi - 9], bh
dec edx
lahf
scasb al, byte es:[edi]
or byte [ecx + 0x15], 0xbc
hlt
xor edx, ecx
sal edx, 1
dec ebx
sub byte [edx + 0x4e], 0x2b
outsb dx, byte [esi]
cmc
adc ah, byte [ebx + 0x28]
cmpsd dword [esi], dword es:[edi]
jle 0x10146d29
sub byte [ecx - 0x365eee42], dl
invalid
call fcn.10209fef
call fcn.1012e64d
mov ebp, dword [esp + 0x34]
jmp 0x10209c77
lea ebp, [ebp + 1]
jmp 0x100ff4d5

Function at 0x101c66fe
Capabilities:
Encode data using xor

Disassembly:
push ebx
jmp 0x101e4b2e
mov edi, dword [edi + 0xaf576]
jmp 0x1026e429
xor esp, esi
dec edi
push ecx
mov dh, 0x7e
rol bh, 1
and byte [ecx + 0x3a], ch
invalid
pushal
lea edi, [edi - 0x174a91bd]
call fcn.1016730d
and dl, dl
and eax, 0xa45d3cb3
cmp al, 0x5d
movsb byte es:[edi], byte [esi]
xor al, 0xce
inc ecx
mov esi, 0xf77af006
mov al, byte [0x873fcc5d]
jne 0x1026e439
pop ds
mov al, byte [0xee2a3eba]
inc esi
lcall 0x7fe4, 0xaea40cc6
add dh, dh
jecxz 0x1026e3e8
ret
Function at 0x101d34c6
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x3c], edx
lea edx, [ebp*4 + 0xf361655]
mov edx, 0x10016830
mov byte [esp + 4], al
pushfd
adc byte [eax - 0x63fbdbbc], cl
push esi
mov edx, dword [edx + 0x8cd4c]
mov word [esp + 8], bp
mov byte [esp], 0xa9
push dword [esp]
lea edx, [edx + 0x5d10818]
mov byte [esp + 8], ah
and al, 0x8d
xchg edx, eax
sbb byte [eax], cl
rol dword [0x8246488], 1
call fcn.1021e903
add al, 0
push ss
cmp byte [eax - 0x40], 0x3c
xor byte [eax - 0x2c], 0x2e
mov esi, 0x6006fd44
outsb dx, byte [esi]
or byte [edx - 0x7dd72082], cl
jle 0x101d34d5
push es
scasb al, byte es:[edi]
movsd dword es:[edi], dword [esi]
arpl word [eax - 0x77], ax
dec edi
out 0xc5, eax
sub ebx, dword [eax - 0x5eed0384]
scasd eax, dword es:[edi]
and ebx, dword [ebp - 0x61e1dd77]
dec edx
and byte [eax - 0x629c8fa9], cl
aas
xor dh, dh
pop esi
inc eax
mov ch, 0x30
fisub dword [0x658f033]
add eax, 0xe4deeb13
and esp, dword [edx]
jnp 0x101d34fb
inc edi
or dl, byte [ebp - 0x43b65180]
jg 0x101d34ed
lea esp, [ebx - 0x30]
xor al, 0xa9
ljmp 0x6029

Function at 0x10203bf6
Capabilities:
Encode data using xor

Disassembly:
lea ebx, [ebx - 0x345bc56f]
pushfd
mov byte [esp + 8], dl
call fcn.10144406
mov ebx, dword [ebx + 0xc79fc]
push dword [esp]
mov byte [esp + 0xc], ah
jmp 0x101f1fad

Function at 0x1023378c
Capabilities:
Packed with generic packer

Disassembly:
mov dh, 2
clc
invalid
call fcn.1013f769
push 0xffffffffffffffea
popal
cmp al, 0xc3
mov dword [0xd154a4d2], eax
sub al, 0x86
jo 0x10207ddf
and byte [eax - 0x65e1149c], bl
call 0x65933b24
div dword [ebp - 0x6f8101d2]
inc eax
jnp 0x10207dd1
sbb al, 0x42
jp 0x10207e84
or eax, dword [ecx - 0x61539186]
xchg ecx, eax
lcall 0x3fd4, 0x2923467
retf 0x746e
pop es
les ebp, [ecx + 0x28]
call [ebx]
wait
pop eax
jg 0x10207e7d
push cs
into
cmp al, 0x60
push eax
mov eax, dword [0xe9d83d5f]
arpl word [ebx - 0x60], sp
invalid
xchg dword [esp + 8], esi
pushal
movzx esi, dl
mov esi, 0x1006f370
jmp 0x10207df5

Function at 0x1023da0d
Capabilities:
Encode data using xor

Disassembly:
mov byte [esp], 0xd4
call fcn.1010963e
fldcw word gs:[ebx]
invalid

Function at 0x10251905
Capabilities:
Encode data using xor

Disassembly:
call fcn.1015d518
aam 0x2b
fnstsw word [ecx - 0x77]
aaa
mov al, 0xda
push ebx
sbb ah, cl
add dword [ebp + 0x63efac2f], 0xec61eb16
test al, 0x58
mov ebp, 0x9cbb746a
clc
invalid

Function at 0x102590f8
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp], dh
mov byte [esp], bl
mov dword [esp + 4], eax
bswap ax
bswap ax
lahf
mov eax, dword [esp + 8]
lea esp, [esp + 4]
jno 0x1018e8df
pushal
mov byte [esp + 4], 0x68
pushal
lea eax, [eax + 1]
jmp 0x101d9c62
lea eax, [eax + 1]
mov word [esp], cx
push 0xe153f53
mov dword [esp + 0xc], eax
movzx ax, cl
lahf
movzx ax, bl
pushfd
mov eax, 0x1005cc7f
call fcn.10146e46
push 0x451a4291
jmp 0x1013f7be
mov byte [esp], 0x7d
call fcn.1010f32e
pushfd
mov byte [esp], dh
nop
jmp 0x10128844
Function at 0x401000
Capabilities:
Print debug messages

Disassembly:
mov ecx, dword [esp + 4]
lea eax, [esp + 8]
push esi
push eax
push ecx
push 0x432260
call fcn.0040c970
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0xc
push str.MY_AX:
call esi
push 0x432260
call esi
pop esi
ret

Function at 0x403370
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x108
push esi
mov esi, ecx
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esi + 0x258]
lea edx, [esp + 8]
push ecx
push edx
push 0
push str.InstanceIndex
push eax
mov dword [esp + 0x1c], 4
mov dword [esp + 0x20], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4033d6
mov eax, dword [esi + 0x25c]
test eax, eax
jne 0x4033c9
push 2
call fcn.00403e90
add esp, 4
cmp eax, 0xffffffff
je 0x4033e0
mov eax, 1
pop esi
add esp, 0x108
ret
mov dword [esi + 0x25c], 0
xor eax, eax
pop esi
add esp, 0x108
ret

Function at 0x4034b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x42c
push ebx
push esi
push edi
mov edi, ecx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x38]
push eax
mov eax, dword [edi + 0x258]
lea edx, [esp + 0x28]
push ecx
push edx
push 0
mov esi, 1
push str.InstanceIndex
push eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x38], 0x100
mov dword [esp + 0x3c], 4
mov dword [esp + 0x34], 0x100
call ebx
test eax, eax
je 0x403511
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x42c
ret
mov al, byte [esp + 0x38]
cmp al, 1
jl 0x403565
push esi
lea ecx, [esp + 0x2c]
push str.ii_04d
push ecx
call fcn.0040cf76
add esp, 0xc
lea edx, [esp + 0x20]
lea eax, [esp + 0x138]
lea ecx, [esp + 0x18]
push edx
push eax
mov eax, dword [edi + 0x258]
push ecx
lea edx, [esp + 0x34]
push 0
push edx
push eax
call ebx
test eax, eax
mov al, byte [esp + 0x38]
jne 0x40355d
movsx ecx, al
cmp esi, ecx
jl 0x403565
movsx edx, al
inc esi
cmp esi, edx
jle 0x403519
lea eax, [esp + 0x14a]
lea ecx, [esp + 0x238]
push eax
push ecx
call fcn.0040cf76
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x238]
push edx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x338]
push ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push str.SnapShotState
push ecx
mov dword [esp + 0x2c], 4
mov dword [esp + 0x28], 0x100
call ebx
mov al, byte [esp + 0x338]
cmp al, 2
je 0x4035f2
cmp al, 3
je 0x4035f2
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x42c
ret
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x42c
ret
Function at 0x4038f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x108
mov ecx, dword [ecx + 0x258]
lea eax, [esp + 4]
push eax
lea edx, [esp + 0xc]
lea eax, [esp + 4]
push edx
push eax
push 0
push str.DisplaySelection
push ecx
mov dword [esp + 0x18], 4
mov dword [esp + 0x1c], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
movsx eax, byte [esp + 8]
je 0x403937
mov eax, 3
add esp, 0x108
ret

Function at 0x403aa0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x108
mov ecx, dword [ecx + 0x258]
lea eax, [esp + 4]
push eax
lea edx, [esp + 0xc]
lea eax, [esp + 4]
push edx
push eax
push 0
push str.DisplaySelection
push ecx
mov dword [esp + 0x18], 4
mov dword [esp + 0x1c], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
neg eax
add esp, 0x108
ret
Function at 0x403e60
Capabilities:
Enumerate devices by category

Disassembly:
sub esp, 0x28c
lea eax, [esp + 8]
push edi
push eax
xor edi, edi
push 0x426f40
push 1
push edi
push 0x426f60
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, edi
je 0x403ccf
xor eax, eax
pop edi
add esp, 0x28c
ret
mov eax, dword [esp + 0xc]
lea edx, [esp + 8]
push edi
push edx
mov ecx, dword [eax]
push 0x426f50
push eax
call dword [ecx + 0xc]
cmp eax, edi
je 0x403cf2
xor eax, eax
pop edi
add esp, 0x28c
ret
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x403d00
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 8]
push ebx
push ebp
mov dword [esp + 0x14], edi
mov edx, dword [eax]
push esi
push eax
call dword [edx + 0x14]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x20]
push edx
lea edx, [esp + 0x14]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
mov esi, eax
cmp esi, edi
jne 0x403e10
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push 0x429a00
mov ecx, dword [eax]
push edi
push edi
push eax
call dword [ecx + 0x24]
test eax, eax
jl 0x403df0
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x24]
push edi
mov word [esp + 0x28], 8
mov ecx, dword [eax]
push edx
push str.FriendlyName
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x403df0
lea eax, [esp + 0x19c]
push eax
call fcn.00404230
mov ecx, dword [esp + 0x30]
add esp, 4
lea edx, [esp + 0xac]
push ecx
push edx
call ebx
push edi
push edi
lea eax, [esp + 0x3c]
push 0x50
push eax
lea ecx, [esp + 0xbc]
push 0xffffffffffffffff
push ecx
push edi
push edi
call ebp
lea edx, [esp + 0x34]
push 0x18
lea eax, [esp + 0x1a0]
push edx
push eax
call fcn.0040cfd0
add esp, 0xc
test eax, eax
jne 0x403dea
mov eax, dword [esp + 0x10]
push 0x4323f4
push 0x426f30
push edi
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x20]
mov esi, eax
cmp esi, edi
je 0x403e10
jmp 0x403df0
mov dword [0x4323f4], edi
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x14]
mov edx, dword [eax]
push ecx
push 1
push eax
call dword [edx + 0xc]
mov esi, eax
cmp esi, edi
je 0x403d3d
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x403e1e
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], edi
cmp eax, edi
je 0x403e30
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], edi
cmp eax, edi
je 0x403e42
mov edx, dword [eax]
push eax
call dword [edx + 8]
xor eax, eax
cmp esi, edi
pop esi
pop ebp
pop ebx
pop edi
sete al
add esp, 0x28c
ret
jmp 0x403c90
Function at 0x410bf5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4315e0
cmp edx, dword [eax]
je 0x410c17
add eax, 8
inc ecx
cmp eax, 0x431670
jl 0x410c08
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4315e0]
jne 0x410d45
mov eax, dword [0x4344a8]
cmp eax, 1
je 0x410d1f
test eax, eax
jne 0x410c48
cmp dword [0x4310e4], 1
je 0x410d1f
cmp edx, 0xfc
je 0x410d45
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x410c7f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00410de0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00410ed0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x410cc2
lea eax, [ebp - 0x1a4]
push eax
call fcn.00410ed0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x429804
push edi
call fcn.0040d010
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00410de0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00410df0
lea eax, [ebp - 0xa0]
push 0x4297e4
push eax
call fcn.00410df0
push dword [esi + 0x4315e4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00410df0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0041345e
add esp, 0x2c
pop edi
jmp 0x410d45
lea eax, [ebp + 8]
lea esi, [esi + 0x4315e4]
push 0
push eax
push dword [esi]
call fcn.00410ed0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x418790
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.0040ddc0
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x41885b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x41885b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x41880e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x418819
or bh, 8
and edi, 0x8000000
je 0x418834
mov eax, dword [0x435bfc]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x41885b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418c30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x418c5b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x418c7f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x418c9a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x41a6a1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x41a6c3
cmp dword [edi + 0x3c], 0
jne 0x41a6c3
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.00421dab
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.0041a6f0
pop edi
pop esi
pop ebx
ret 8

Function at 0x41d258
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x41d29a
call fcn.00421dab
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x41d29a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x41d291
xor eax, eax
jmp 0x41d2a2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0041d2a8
pop edi
pop esi
pop ebx
ret 4

Function at 0x42249f
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4224cd
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4224eb
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00422405
jmp 0x4224eb
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4224eb
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00422405
test edi, edi
mov eax, edi
jne 0x4224d5
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8