joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439930
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x104
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0xe54]
test eax, eax
jne 0x439951
pop esi
xor eax, eax
pop ebx
add esp, 0x104
ret 8
mov ebx, dword [esp + 0x110]
push edi
push ebx
mov ecx, esi
call fcn.00439500
mov edi, dword [esp + 0x118]
push 0x6500fc
push edi
call fcn.005fad60
add esp, 8
test eax, eax
jne 0x4399bf
mov ecx, dword [0x6633d4]
call fcn.004216f0
test eax, eax
push edi
je 0x4399a3
push 0x64ee98
lea eax, [esp + 0x14]
push 0x64c6a0
push eax
call fcn.005faef4
add esp, 0x10
jmp 0x4399cd
mov ecx, esi
call fcn.00439700
push eax
lea ecx, [esp + 0x14]
push 0x64c6a0
push ecx
call fcn.005faef4
add esp, 0x10
jmp 0x4399cd
lea edx, [esp + 0xc]
push edi
push edx
call fcn.005faef4
add esp, 8
push 0x180
lea eax, [esp + 0x10]
push 0x8002
push eax
call fcn.005fbe12
add esp, 0xc
mov esi, eax
cmp esi, 0xffffffff
pop edi
jne 0x4399f9
pop esi
xor eax, eax
pop ebx
add esp, 0x104
ret 8
push 0
push 0
push esi
call fcn.005fc0f3
push 0xe48
push ebx
push esi
call fcn.005fbc1c
mov eax, dword [ebx + 0x10]
add esp, 0x18
cmp eax, 0x11
je 0x439a27
pop esi
xor eax, eax
pop ebx
add esp, 0x104
ret 8
push esi
call fcn.005fbb69
add esp, 4
mov eax, 1
pop esi
pop ebx
add esp, 0x104
ret 8

Function at 0x439b60
Capabilities:
Delete file

Disassembly:
sub esp, 0x104
push esi
mov esi, ecx
mov ecx, dword [0x6633d4]
call fcn.004216f0
test eax, eax
je 0x439b91
mov eax, dword [esp + 0x10c]
lea ecx, [esp + 4]
push eax
push 0x64ee98
push 0x64c6a0
push ecx
jmp 0x439bab
mov edx, dword [esp + 0x10c]
mov ecx, esi
push edx
call fcn.00439700
push eax
lea eax, [esp + 0xc]
push 0x64c6a0
push eax
call fcn.005faef4
add esp, 0x10
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, esi
call fcn.00439120
pop esi
add esp, 0x104
ret 4

Function at 0x439bd0
Capabilities:
Delete file

Disassembly:
sub esp, 0xf4c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov eax, dword [esi + 0xe58]
test eax, eax
jle 0x439c9f
push ebp
mov ebp, dword [esp + 0xf5c]
push edi
xor edi, edi
mov eax, dword [esi + 0xe54]
push ebp
lea ecx, [edi + eax + 0x10]
push ecx
mov ecx, esi
call fcn.004397e0
test eax, eax
je 0x439c8b
mov edx, dword [esi + 0xe54]
lea ecx, [esp + 0x114]
mov eax, dword [edi + edx]
push eax
push ecx
mov ecx, esi
call fcn.00439930
mov ecx, dword [0x6633d4]
call fcn.004216f0
mov edx, dword [esi + 0xe54]
test eax, eax
mov eax, dword [edi + edx]
push eax
je 0x439c45
push 0x64ee98
jmp 0x439c4d
mov ecx, esi
call fcn.00439700
push eax
lea ecx, [esp + 0x18]
push 0x64c6a0
push ecx
call fcn.005faef4
mov eax, dword [esp + 0x13c]
add esp, 0x10
test eax, eax
jne 0x439c8b
lea edx, [esp + 0x10]
push str.tempsave
push edx
call fcn.005fad60
add esp, 8
test eax, eax
je 0x439c8b
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esi + 0xe58]
inc ebx
add edi, 0x20
cmp ebx, eax
jl 0x439bf5
pop edi
pop ebp
mov ecx, esi
call fcn.00439120
pop esi
pop ebx
add esp, 0xf4c
ret 4
Function at 0x4465d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x90
push esi
mov esi, dword [esp + 0x98]
lea eax, [esp + 0xc]
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_OpenFile]
cmp eax, 0xffffffff
mov dword [esp + 4], eax
jne 0x446628
push 2
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x446637
push eax
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
pop esi
add esp, 0x90
ret
push eax
call fcn.00446700
mov esi, eax
add esp, 4
test esi, esi
jne 0x446641
xor eax, eax
pop esi
add esp, 0x90
ret
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x14]
test eax, eax
mov dword [esp + 8], edx
jne 0x446660
mov cx, word [esi + 0xe]
cmp cx, 8
ja 0x446660
mov eax, 1
shl eax, cl
mov ecx, dword [esi]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push ebp
push edi
lea edi, [ecx + eax*4]
push esi
add edi, edx
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push eax
call ebp
push 0
push edi
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GlobalReAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x4466a8
push esi
call ebx
push eax
call ebp
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor esi, esi
jmp 0x4466da
mov edx, dword [eax + 0x20]
mov esi, eax
test edx, edx
jne 0x4466c2
mov cx, word [eax + 0xe]
cmp cx, 8
ja 0x4466c2
mov edx, 1
shl edx, cl
mov ebx, dword [eax]
mov ecx, dword [esp + 0x14]
lea edx, [eax + edx*4]
mov eax, dword [esp + 0x10]
add edx, ebx
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll__hread]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll__lclose]
pop edi
pop ebp
mov eax, esi
pop ebx
pop esi
add esp, 0x90
ret
Function at 0x45ea50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xd0
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x3c], 2
je 0x45ea6d
pop edi
pop esi
xor al, al
pop ebx
add esp, 0xd0
ret
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x45eb0f
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x45eb0f
mov edx, dword [ecx + 0x3c]
test edx, edx
je 0x45eb0f
mov ecx, dword [eax]
push eax
xor bl, bl
call dword [ecx + 0x60]
test eax, eax
je 0x45eb53
push eax
mov ecx, esi
call fcn.0045f1c0
push 0x6c
lea edx, [esp + 0x10]
push 0
push edx
call fcn.005fc4e0
mov eax, dword [esi + 0x18]
add esp, 0xc
lea edx, [esp + 0xc]
mov dword [esp + 0xc], 0x6c
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x30]
test eax, eax
jne 0x45eafa
mov eax, dword [esp + 0x18]
mov ecx, dword [esi + 0x2c]
cmp eax, ecx
jne 0x45eaee
mov ecx, dword [esp + 0x14]
mov eax, dword [esi + 0x30]
cmp ecx, eax
jne 0x45eaee
cmp dword [esp + 0x60], 8
je 0x45eafa
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0xd0
ret
mov eax, dword [esi + 0x1c]
push eax
mov edx, dword [eax]
call dword [edx + 0x6c]
test eax, eax
je 0x45eb1b
push eax
mov ecx, esi
call fcn.0045f210
pop edi
pop esi
mov al, 3
pop ebx
add esp, 0xd0
ret
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0x78]
push edx
push 0x1000400
push 0
mov dword [esi + 0x4c], 1
mov dword [esp + 0x84], 0x64
mov dword [esp + 0xd4], 0
mov ecx, dword [eax]
push 0
push 0
push eax
mov bl, 2
call dword [ecx + 0x14]
mov edi, dword [esi + 0x14]
test edi, edi
je 0x45eb73
mov ecx, dword [edi]
mov eax, dword [esi + 0x10]
cmp ecx, eax
je 0x45eb6c
call fcn.0045fd50
cmp al, 3
je 0x45eb0f
mov edi, dword [edi + 8]
test edi, edi
jne 0x45eb5a
pop edi
mov al, bl
pop esi
pop ebx
add esp, 0xd0
ret
Function at 0x4612e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp edi, ebp
jne 0x46130f
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
sub edx, eax
inc edx
push edx
push eax
push edi
call fcn.00461510
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
cmp ebx, esi
jne 0x461332
mov eax, dword [esp + 0x24]
sub ebp, edi
inc ebp
push eax
push ebp
push ebx
push edi
call fcn.00461480
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov eax, dword [ecx + 8]
test eax, eax
mov dword [esp + 0x18], eax
je 0x46146a
mov eax, dword [ecx + 0x28]
cmp edi, eax
jge 0x46134c
mov edi, eax
jmp 0x461355
mov edx, dword [ecx + 0x30]
cmp edi, edx
jle 0x461355
mov edi, edx
cmp ebp, eax
jl 0x461360
mov eax, dword [ecx + 0x30]
cmp ebp, eax
jle 0x461362
mov ebp, eax
mov eax, dword [ecx + 0x2c]
cmp ebx, eax
jge 0x46136d
mov ebx, eax
jmp 0x461376
mov edx, dword [ecx + 0x34]
cmp ebx, edx
jle 0x461376
mov ebx, edx
cmp esi, eax
jl 0x461381
mov eax, dword [ecx + 0x34]
cmp esi, eax
jle 0x461383
mov esi, eax
cmp ebx, esi
jle 0x461393
mov eax, ebx
mov ebx, esi
mov esi, eax
mov eax, edi
mov edi, ebp
mov ebp, eax
mov eax, ebp
sub esi, ebx
sub eax, edi
cdq
xor eax, edx
sub eax, edx
inc eax
inc esi
cmp eax, 1
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], esi
jl 0x46146a
cmp esi, 1
jl 0x46146a
cmp dword [ecx + 0x24], 1
jne 0x4613d4
mov ecx, dword [ecx + 0x20]
mov edx, dword [esp + 0x18]
mov esi, ecx
imul esi, ebx
add esi, edx
mov ebx, ecx
add esi, edi
jmp 0x4613ec
mov esi, dword [ecx + 0x1c]
mov eax, dword [ecx + 0x20]
sub esi, ebx
mov ebx, dword [esp + 0x18]
dec esi
imul esi, eax
add esi, ebx
add esi, edi
neg eax
mov ebx, eax
fild dword [esp + 0x20]
mov dword [esp + 0x20], 0
fidiv dword [esp + 0x14]
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
fadd dword [0x61b588]
call fcn.005faa4c
test eax, eax
mov dword [esp + 0x1c], eax
jne 0x46141f
mov dword [esp + 0x1c], 1
cmp edi, ebp
jle 0x46142d
fld dword [esp + 0x18]
fchs
fstp dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
test ebp, ebp
jle 0x46146a
mov edi, dword [esp + 0x24]
and edi, 0xff
mov ecx, dword [esp + 0x1c]
fld dword [esp + 0x20]
push ecx
push edi
call fcn.005faa4c
add eax, esi
push eax
call fcn.005fc4e0
fld dword [esp + 0x2c]
fadd dword [esp + 0x24]
add esp, 0xc
add esi, ebx
dec ebp
fstp dword [esp + 0x20]
jne 0x46143f
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
Function at 0x465430
Capabilities:
Get file version info

Disassembly:
sub esp, 0x22c
mov ecx, dword [0x641f9c]
mov edx, dword [0x641fa0]
mov eax, dword [0x641f98]
push ebx
xor ebx, ebx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
lea ecx, [esp + 8]
mov dword [esp + 0x20], eax
mov eax, dword [0x641fa4]
push ebx
lea edx, [esp + 0x24]
push ecx
push edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x38], eax
call sub.DPLAYX.dll_Ordinal_1
test eax, eax
je 0x465481
xor eax, eax
pop ebx
add esp, 0x22c
ret
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x4654b0
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push str.0_nEG
push eax
call dword [ecx]
test eax, eax
je 0x4654a6
xor eax, eax
pop ebx
add esp, 0x22c
ret
mov eax, dword [esp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
push esi
push str.dplayx
mov byte [esp + 0x10], 0
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
je 0x465633
lea edx, [esp + 0x38]
push 0x100
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x38]
push eax
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
je 0x465633
push esi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
cmp ebp, ebx
mov dword [esp + 0x24], ebp
je 0x465633
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
cmp edi, ebx
je 0x46562b
mov edx, dword [esp + 0x20]
push edi
push esi
lea eax, [esp + 0x44]
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoA
lea ecx, [esp + 0x24]
lea edx, [esp + 0x18]
push ecx
push edx
push 0x6500fc
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x465620
mov eax, dword [esp + 0x18]
mov bx, word [eax + 0xc]
mov esi, dword [eax + 8]
mov bp, word [eax + 8]
mov edi, dword [eax + 0xc]
mov eax, ebx
mov edx, ebp
shr edi, 0x10
and eax, 0xffff
mov ecx, edi
shr esi, 0x10
push eax
and ecx, 0xffff
mov eax, esi
and edx, 0xffff
push ecx
and eax, 0xffff
push edx
push eax
lea ecx, [esp + 0x14c]
push str.DPlay_Version_found:__d._d._d._d._Version_Required:_4.7.0.177__DX7__or_5.0.2046.1__Win2k__or_4.6.3.516__DX6.1a__r_n
push ecx
call fcn.005faef4
add esp, 0x18
cmp si, 5
mov eax, 1
jbe 0x4655b1
mov byte [esp + 0x10], al
jne 0x4655c6
test bp, bp
ja 0x46561c
cmp di, 0x7fe
jae 0x46561c
mov byte [esp + 0x10], 0
jmp 0x465620
cmp si, 4
jne 0x465605
cmp bp, 7
jbe 0x4655d6
mov byte [esp + 0x10], al
jne 0x4655eb
test di, di
ja 0x46561c
cmp bx, 0xb1
ja 0x46561c
mov byte [esp + 0x10], 0
jmp 0x465620
cmp bp, 6
jne 0x465620
cmp di, 3
jne 0x4655e2
cmp bx, 0x204
jae 0x46561c
mov byte [esp + 0x10], 0
jmp 0x465620
cmp si, ax
jne 0x465620
cmp bp, 2
jne 0x465620
cmp di, 3
jne 0x465620
cmp bx, 0xc
jne 0x465620
mov byte [esp + 0x10], al
mov ebp, dword [esp + 0x28]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, dword [esp + 0x18]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0xc]
pop esi
pop ebp
and eax, 0xff
pop ebx
add esp, 0x22c
ret
Function at 0x47caf0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
xor edx, edx
push edi
cmp esi, edx
jge 0x47cb04
mov dword [esp + 0x14], edx
jmp 0x47cb10
mov eax, dword [ecx + 8]
dec eax
cmp esi, eax
jle 0x47cb14
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
cmp edi, edx
jge 0x47cb20
xor edi, edi
jmp 0x47cb2a
mov eax, dword [ecx + 0xc]
dec eax
cmp edi, eax
jle 0x47cb2a
mov edi, eax
mov ebx, dword [esp + 0x1c]
cmp ebx, edx
jge 0x47cb36
xor ebx, ebx
jmp 0x47cb40
mov eax, dword [ecx + 8]
dec eax
cmp ebx, eax
jle 0x47cb40
mov ebx, eax
mov ebp, dword [esp + 0x20]
cmp ebp, edx
jge 0x47cb4e
mov dword [esp + 0x20], edx
jmp 0x47cb5a
mov eax, dword [ecx + 0xc]
dec eax
cmp ebp, eax
jle 0x47cb5a
mov dword [esp + 0x20], eax
cmp edi, dword [esp + 0x20]
jg 0x47cbf0
lea edx, [esi*8]
sub edx, esi
shl edx, 2
mov dword [esp + 0x18], edx
mov eax, dword [ecx + 0x8e8c]
mov eax, dword [eax + edi*4]
add eax, edx
cmp esi, ebx
jg 0x47cbe7
lea edx, [edi + esi]
mov ebp, edi
imul dx, word [ecx + 0x8eb4]
mov word [eax], dx
sub ebp, esi
movzx dx, byte [eax + 6]
imul bp, word [ecx + 0x8eb2]
imul dx, word [ecx + 0x8eb6]
sub ebp, edx
xor edx, edx
mov dl, byte [eax + 4]
mov word [eax + 2], bp
lea ebp, [edx - 2]
cmp ebp, 0xe
ja case.0x47cbc5.3
xor edx, edx
mov dl, byte [ebp + 0x47cc00]
jmp dword [edx*4 + 0x47cbf8]
mov dx, word [ecx + 0x8eb6]
sub word [eax + 2], dx
add eax, 0x1c
inc esi
cmp esi, ebx
jle 0x47cb83
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
inc edi
cmp edi, eax
jle 0x47cb74
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x482fe0
Capabilities:
Access peb ldr_data
Get memory capacity

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x60945b
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x30]
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
push ecx
mov dword [esi + 0x9034], eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea eax, [esi + 0x908c]
mov ecx, 0x11
xor ebp, ebp
mov dword [eax - 0x44], ebp
mov dword [eax], ebp
mov dword [eax + 0x44], ebp
add eax, 4
dec ecx
jne 0x48301f
mov edx, dword [esp + 0x14]
mov ecx, 0x190
mov dword [esi + 0x9038], ebp
mov dword [esi + 0x9040], ecx
lea eax, [edx + 0xdbba0]
shr eax, 0x14
cmp eax, 0x22
jg 0x483062
mov dword [esi + 0x9040], ebp
mov dword [esi + 0x9038], 1
jmp 0x483082
cmp eax, 0x28
jle 0x48307c
xor ecx, ecx
cmp eax, 0x40
setg cl
dec ecx
and ecx, 0xfffffaec
add ecx, 0x9c4
mov dword [esi + 0x9040], ecx
mov eax, dword [esi + 0x9038]
mov dword [esi + 0x9044], ebp
cmp eax, ebp
je 0x4830fc
push ebx
mov dword [esi + 0x903c], ebp
mov edi, 0x39c
lea ebx, [esi + 0x9114]
push 0x1c
call fcn.005faa3d
add esp, 4
mov dword [esp + 0x40], eax
cmp eax, ebp
mov dword [esp + 0x38], ebp
je 0x4830cd
mov edx, dword [esi + 0x9034]
mov ecx, dword [edi + edx]
push ecx
mov ecx, eax
call fcn.0051f100
jmp 0x4830cf
xor eax, eax
mov dword [ebx], eax
add edi, 4
add ebx, 4
cmp edi, 0x3e0
mov dword [esp + 0x38], 0xffffffff
jl 0x4830a4
pop ebx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
mov edx, dword [esi + 0x9040]
shl edx, 3
push edx
call fcn.005faa3d
mov ecx, dword [esi + 0x9040]
mov edi, eax
shl ecx, 3
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 0x903c], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea edi, [esi + 0x9114]
mov ecx, 0x11
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x49aac0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x609aa8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x78]
xor ebx, ebx
mov esi, ecx
cmp edi, ebx
mov dword [esp + 0x18], esi
je 0x49ab34
fld dword [esp + 0x68]
fcomp dword [0x61b5a8]
fnstsw ax
test ah, 0x41
jne 0x49ab34
fld dword [esp + 0x6c]
fcomp dword [0x61b5a8]
fnstsw ax
test ah, 0x41
jne 0x49ab34
fld dword [esp + 0x6c]
call fcn.005faa4c
fld dword [esp + 0x68]
push eax
call fcn.005faa4c
push eax
mov ecx, edi
call fcn.0052c580
and eax, 0xff
mov dword [esp + 0x10], eax
jmp 0x49ab3c
mov dword [esp + 0x10], 0xffffffff
mov eax, dword [esi + 8]
mov dword [esp + 0x14], ebx
cmp eax, ebx
mov dword [esp + 0x78], 0xbf800000
jle 0x49acca
mov eax, dword [esi + 4]
mov esi, dword [eax + ebx*4]
mov ecx, dword [esi + 8]
movsx eax, word [ecx + 0x10]
cmp eax, dword [esp + 0x60]
je 0x49ab70
cmp eax, dword [esp + 0x64]
jne 0x49acbc
mov al, byte [esp + 0x70]
test al, al
je 0x49ab87
mov dl, byte [esp + 0x74]
mov al, byte [esi + 0x48]
cmp al, dl
jne 0x49acbc
fld dword [esp + 0x68]
fcomp dword [0x61b5a8]
fnstsw ax
test ah, 0x40
je 0x49abad
fld dword [esp + 0x6c]
fcomp dword [0x61b5a8]
fnstsw ax
test ah, 0x40
jne 0x49ace3
mov ebp, dword [esp + 0x10]
cmp ebp, 0xffffffff
jle 0x49abdc
fld dword [esi + 0x3c]
call fcn.005faa4c
fld dword [esi + 0x38]
push eax
call fcn.005faa4c
push eax
mov ecx, edi
call fcn.0052c580
and eax, 0xff
cmp eax, ebp
jne 0x49acbc
test edi, edi
je 0x49ac76
mov ecx, dword [edi + 0xc]
mov eax, dword [edi + 8]
push eax
mov edx, dword [ecx + 0x8c]
mov ecx, dword [edx + 0x74]
call fcn.004876d0
mov ebp, eax
test ebp, ebp
je 0x49ac76
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
call fcn.004a7200
mov eax, dword [esi + 8]
mov ecx, dword [edi + 8]
mov edx, dword [esi + 0x3c]
push 0
fld dword [eax + 0x34]
fadd dword [ecx + 0x34]
mov eax, dword [esi + 0x38]
push 0
push 0
push 0
push ecx
mov ecx, dword [edi + 0x3c]
mov dword [esp + 0x6c], 0
fstp dword [esp]
push edx
mov edx, dword [edi + 0x38]
push eax
push ecx
lea eax, [esp + 0x3c]
push edx
push eax
mov ecx, ebp
call fcn.00484260
and eax, 0xff
je 0x49ac65
cmp eax, 1
je 0x49ac65
lea ecx, [esp + 0x1c]
mov dword [esp + 0x58], 0xffffffff
call fcn.004a7270
jmp 0x49acbc
lea ecx, [esp + 0x1c]
mov dword [esp + 0x58], 0xffffffff
call fcn.004a7270
fld dword [esp + 0x68]
fsub dword [esi + 0x38]
fld dword [esp + 0x6c]
fsub dword [esi + 0x3c]
fld st(0)
fmul st(1)
fld st(2)
fmul st(3)
faddp st(1)
fstp st(2)
fstp st(0)
fld dword [esp + 0x78]
fcomp dword [0x61b5a8]
fnstsw ax
test ah, 0x40
jne 0x49acb0
fld dword [esp + 0x78]
fcomp st(1)
fnstsw ax
test ah, 0x41
jne 0x49acba
fstp dword [esp + 0x78]
mov dword [esp + 0x14], esi
jmp 0x49acbc
fstp st(0)
mov esi, dword [esp + 0x18]
inc ebx
cmp ebx, dword [esi + 8]
jl 0x49ab53
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x50]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x4c
ret 0x1c
mov eax, esi
jmp 0x49acce
Function at 0x49c090
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov al, byte [0x66d650]
push esi
mov esi, ecx
push edi
test al, al
mov edi, dword [esi + 0x1f8]
je 0x49c0bb
mov eax, dword [esi + 0x1c0]
test eax, eax
je 0x49c0bb
push str.RTO
push eax
call fcn.005fb6cc
add esp, 8
test edi, edi
je 0x49c11d
push ebx
mov eax, dword [edi + 0x18]
mov edx, dword [esi + 0x1c]
xor ecx, ecx
mov cl, ah
and eax, 0xff
mov eax, dword [edx + eax*4]
lea eax, [eax + ecx*4]
mov ecx, dword [eax]
xor ecx, 0x80
mov dword [eax], ecx
mov al, byte [0x66d650]
mov ebx, dword [edi + 0xc]
test al, al
je 0x49c107
mov eax, dword [esi + 0x1c0]
test eax, eax
je 0x49c107
mov ecx, dword [edi + 0x18]
push ecx
push str.___Del_id_d_n
push eax
call fcn.005fb6cc
add esp, 0xc
push edi
mov ecx, esi
call fcn.0049c5e0
mov ecx, dword [esi + 0x20]
mov edi, ebx
dec ecx
test ebx, ebx
mov dword [esi + 0x20], ecx
jne 0x49c0c0
pop ebx
mov dword [esi + 0x1f8], 0
mov al, byte [0x66d650]
test al, al
je 0x49c148
mov esi, dword [esi + 0x1c0]
test esi, esi
je 0x49c148
push 0x651d7c
push esi
call fcn.005fb6cc
add esp, 8
pop edi
pop esi
ret
Function at 0x4b3660
Capabilities:
Get graphical window text

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x4b371b
movsx ecx, word [esi + 0xfc]
mov edx, dword [esi + 0x100]
inc ecx
push edi
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edx, dword [esi + 0x100]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
movsx eax, word [esi + 0xfc]
not ecx
dec ecx
pop edi
mov dword [esi + 0x104], ecx
mov byte [eax + edx - 1], 0
movsx ecx, word [esi + 0xfc]
mov eax, dword [esi + 0x104]
dec ecx
cmp eax, ecx
jle 0x4b36df
mov edx, dword [esi + 0x100]
mov eax, dword [esi + 0xf8]
push edx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
mov eax, dword [esi + 0xf8]
lea ecx, [esp + 4]
lea edx, [esp + 8]
push ecx
push edx
push 0xb0
push eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
sub ecx, eax
mov dword [esi + 0x150], ecx
pop esi
add esp, 8
ret
Function at 0x4be420
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 4]
push 4
test eax, eax
je 0x4be44e
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor edx, edx
test eax, eax
sete dl
mov eax, edx
ret 0xc
mov eax, dword [esp + 0xc]
mov ecx, dword [ecx]
lea edx, [esp + 0x10]
push edx
push 4
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor edx, edx
test eax, eax
sete dl
mov eax, edx
ret 0xc

Function at 0x4be480
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4be4b1
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov ecx, dword [ecx + 4]
push eax
mov eax, dword [esp + 0xc]
push edx
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
ret 0x10
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push edx
mov edx, dword [esp + 0xc]
push eax
mov eax, dword [ecx]
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
ret 0x10

Function at 0x4be4e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push esi
test eax, eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0xff
lea esi, [ecx + 0x10]
je 0x4be517
mov ecx, dword [ecx + 4]
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0xc]
push esi
push edx
push 0
push eax
push ecx
jmp 0x4be52d
lea edx, [esp + 4]
lea eax, [esp + 8]
push edx
mov edx, dword [esp + 0x18]
push esi
push eax
mov eax, dword [ecx + 8]
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
not eax
and eax, esi
pop esi
add esp, 8
ret 8

Function at 0x4be550
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, 4
mov dword [esp], eax
mov dword [esp + 4], eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4be584
lea eax, [esp]
lea edx, [esp + 0x10]
push eax
lea eax, [esp + 8]
push edx
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [ecx + 4]
push 0
push edx
push eax
jmp 0x4be59e
mov ecx, dword [ecx + 8]
lea edx, [esp]
push edx
lea eax, [esp + 0x14]
lea edx, [esp + 8]
push eax
mov eax, dword [esp + 0x18]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4be5b2
mov eax, dword [esp + 0x10]
add esp, 8
ret 8
or eax, 0xffffffff
add esp, 8
ret 8