joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40877c
Capabilities:
Accept command line arguments
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0x4181dc
call dword [sym.imp.ole32.dll_CoGetObjectContext]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4194d8], eax
call ebx
mov eax, dword [0x4194d8]
mov edi, dword [ebp + 8]
push 0
add eax, 0x5037d9a4
push 1
mov dword [edi], eax
push 0
add edi, 4
call dword [sym.imp.USER32.dll_EnableScrollBar]
push 3
pop esi
mov ecx, esi
xor eax, eax
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + eax*4]
sub edx, dword [0x4194d8]
sub edx, 0x2baeb68e
mov dword [edi], edx
xor edx, edx
add edi, 4
cmp ecx, esi
setne dl
lea ecx, [edx + 2]
add eax, ecx
cmp eax, 0xcd
jb 0x4087c5
mov eax, dword [0x419394]
mov ecx, eax
shr ecx, 1
mov dword [ebp - 4], edi
lea eax, [ecx + eax*2]
xor edi, edi
mov dword [ebp + 8], esi
test eax, eax
je 0x408847
call ebx
mov eax, dword [0x419434]
mov eax, dword [eax + edi*4]
mov ecx, dword [0x4194d8]
lea eax, [eax + ecx + 0x58aa47d3]
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], eax
xor eax, eax
cmp dword [ebp + 8], esi
setne al
add eax, 2
add edi, eax
mov dword [ebp + 8], eax
mov eax, dword [0x419394]
mov ecx, eax
shr ecx, 1
lea eax, [ecx + eax*2]
cmp edi, eax
jb 0x408807
mov ecx, dword [ebp - 4]
mov edi, esi
xor eax, eax
mov edx, dword [0x4194dc]
mov edx, dword [edx + eax*4]
mov ebx, dword [0x4194d8]
lea edx, [edx + ebx + 0x7f3b5002]
mov dword [ecx], edx
xor edx, edx
add ecx, 4
cmp edi, esi
setne dl
lea edi, [edx + 2]
add eax, edi
cmp eax, 0xaa
jb 0x40884e
mov ebx, ecx
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [0x4193ac]
mov eax, dword [eax + edi*4]
sub eax, dword [0x4194d8]
add eax, 0x48eccccd
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor eax, eax
add ebx, 4
cmp dword [ebp + 8], esi
setne al
add eax, 2
add edi, eax
mov dword [ebp + 8], eax
cmp edi, 0xdc
jb 0x408883
mov dword [ebp + 8], esi
xor edi, edi
push 0x71
push 0
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov eax, dword [0x4194d8]
mov ecx, dword [0x4193bc]
xor eax, 0xad5869a9
add eax, dword [ecx + edi*4]
mov dword [ebx], eax
xor eax, eax
add ebx, 4
cmp dword [ebp + 8], esi
setne al
add eax, 2
add edi, eax
mov dword [ebp + 8], eax
cmp edi, 0xde
jb 0x4088be
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a4de
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0xc]
push eax
push 0x4181dc
call dword [sym.imp.ole32.dll_CoGetObjectContext]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4194d8], eax
call esi
mov eax, dword [0x4194d8]
mov ecx, dword [0x419400]
push 3
pop ebx
add eax, 0x9423e1d0
push 0xfffffffffffffff8
mov dword [ecx], eax
add dword [0x419400], 4
mov edi, dword [0x419400]
push 0xc0ff
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov eax, dword [0x4194c0]
mov edx, eax
shr edx, 1
lea eax, [edx + eax*2]
xor ecx, ecx
test eax, eax
je 0x40a599
mov edx, dword [0x4194d8]
mov eax, ecx
shl eax, 2
add eax, 0x410d3a
mov eax, dword [eax]
lea eax, [eax + edx + 0x54b13ad1]
mov dword [edi], eax
xor eax, eax
add edi, 4
cmp dword [ebp - 4], ebx
setne al
add eax, 2
add ecx, eax
mov dword [ebp - 4], eax
mov eax, dword [0x4194c0]
mov edx, eax
shr edx, 1
lea eax, [edx + eax*2]
cmp ecx, eax
jb 0x40a55b
and dword [ebp - 8], 0
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax + ecx*4]
sub eax, dword [0x4194d8]
push 0x5f
sub eax, 0x219ce531
mov dword [edi], eax
push 0
add edi, 4
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
xor eax, eax
cmp dword [ebp - 4], ebx
setne al
add eax, 2
add dword [ebp - 8], eax
cmp dword [ebp - 8], 0xa2
mov dword [ebp - 4], eax
jb 0x40a5a0
mov eax, dword [0x41912c]
mov dword [0x419130], eax
call esi
mov eax, 0xcb3be8d4
sub eax, dword [0x4194d8]
push 0
mov dword [edi], eax
mov eax, dword [0x4194d8]
push ebx
add eax, 0x592345b1
push 0
mov dword [edi + 4], eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
mov eax, dword [0x41909c]
Function at 0x40aa52
Capabilities:
Accept command line arguments
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 1
push 0xbe
push 0
call dword [sym.imp.USER32.dll_CheckDlgButton]
lea eax, [esp + 0x10]
push eax
push 0x4181dc
call dword [sym.imp.ole32.dll_CoGetObjectContext]
push 3
pop ebp
mov dword [0x4194d8], eax
mov edi, ebp
xor esi, esi
mov eax, dword [0x41945c]
mov ecx, dword [0x4194d8]
mov eax, dword [eax + esi*4]
lea eax, [eax + ecx + 0x1df92d24]
mov ecx, dword [0x41944c]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
add dword [0x41944c], 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
cmp edi, ebp
setne al
lea edi, [eax + 2]
add esi, edi
cmp esi, 0xcd
jb 0x40aa82
mov edi, dword [0x41944c]
mov ecx, ebp
xor eax, eax
mov edx, dword [0x4194d8]
mov esi, dword [0x4194ac]
xor edx, 0x2ba73a6d
add edx, dword [esi + eax*4]
mov dword [edi], edx
xor edx, edx
add edi, 4
cmp ecx, ebp
setne dl
lea ecx, [edx + 2]
add eax, ecx
cmp eax, 0xca
jb 0x40aad0
mov ebx, ebp
xor esi, esi
push 0
push ebp
push 0
call dword [sym.imp.USER32.dll_EnableScrollBar]
mov eax, dword [esp + 0x18]
mov eax, dword [eax + esi*4]
mov ecx, dword [0x4194d8]
lea eax, [eax + ecx + 0x2b29aa25]
mov dword [edi], eax
xor eax, eax
add edi, 4
cmp ebx, ebp
setne al
lea ebx, [eax + 2]
add esi, ebx
cmp esi, 0xbb
jb 0x40ab01
mov ebx, ebp
xor esi, esi
mov eax, dword [0x4193cc]
mov eax, dword [eax + esi*4]
mov ecx, dword [0x4194d8]
lea eax, [eax + ecx - 0x349ea8dc]
push 0xfffffffffffffff8
mov dword [edi], eax
push 0xcc6a
add edi, 4
call dword [sym.imp.USER32.dll_GetWindowLongA]
xor eax, eax
cmp ebx, ebp
setne al
lea ebx, [eax + 2]
add esi, ebx
cmp esi, 0xde
jb 0x40ab3d
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x40c89c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
lea eax, [ebp - 0x1c]
xor ebx, ebx
push eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0x4181dc
call dword [sym.imp.ole32.dll_CoGetObjectContext]
mov esi, dword [ebp + 8]
mov ecx, 0xc0e710bc
sub ecx, eax
mov dword [0x4194d8], eax
push ebx
mov dword [esi], ecx
call dword [sym.imp.ole32.dll_StgIsStorageFile]
mov eax, dword [0x4194d8]
add eax, 0x8f0c0442
mov dword [esi + 4], eax
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoWaitForMultipleHandles]
push 3
pop edi
lea eax, [esi + 8]
mov ecx, edi
xor esi, esi
mov edx, dword [0x419500]
mov edx, dword [edx + esi*4]
sub edx, dword [0x4194d8]
add edx, 0x223c6dc1
mov dword [eax], edx
xor edx, edx
add eax, 4
cmp ecx, edi
setne dl
lea ecx, [edx + 2]
add esi, ecx
cmp esi, 0xc5
jb 0x40c906
push ebx
mov esi, eax
mov dword [ebp + 8], edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor eax, eax
mov ecx, dword [0x419388]
mov ecx, dword [ecx + eax*4]
mov edx, dword [0x4194d8]
lea ecx, [ecx + edx + 0x10a7869d]
mov dword [esi], ecx
xor ecx, ecx
add esi, 4
cmp dword [ebp + 8], edi
setne cl
add ecx, 2
add eax, ecx
mov dword [ebp + 8], ecx
cmp eax, 0xb9
jb 0x40c942
mov ecx, edi
xor eax, eax
mov edx, dword [0x41950c]
mov edx, dword [edx + eax*4]
sub edx, dword [0x4194d8]
add edx, 0x72542f74
mov dword [esi], edx
xor edx, edx
add esi, 4
cmp ecx, edi
setne dl
lea ecx, [edx + 2]
add eax, ecx
cmp eax, 0xcf
jb 0x40c978
mov eax, dword [0x41904c]
mov dword [ebp + 8], edi
mov dword [0x419288], eax
mov dword [ebp - 4], ebx
mov eax, dword [0x4193e0]
mov ecx, dword [ebp - 4]
mov eax, dword [eax + ecx*4]
mov ecx, dword [0x4194d8]
lea eax, [eax + ecx - 0x6ce82274]
mov dword [esi], eax
add esi, 4
cmp dword [ebp - 8], ebx
je 0x40c9e0
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_DeleteObject]
xor eax, eax
cmp dword [ebp + 8], edi
setne al
add eax, 2
add dword [ebp - 4], eax
cmp dword [ebp - 4], 0xe6
mov dword [ebp + 8], eax
jb 0x40c9b5
mov eax, dword [0x4194d8]
add eax, 0x4729313d
mov dword [esi], eax
lea eax, [esi + 4]
mov esi, edi
xor ecx, ecx
mov ebx, dword [0x419404]
mov ebx, dword [ebx + ecx*4]
xor edx, edx
cmp dword [0x4194d8], 0x800401f0
setne dl
dec edx
and edx, 0x7a67527
add edx, 0x39ea
sub ebx, edx
xor edx, edx
mov dword [eax], ebx
add eax, 4
cmp esi, edi
setne dl
lea esi, [edx + 2]
add ecx, esi
cmp ecx, 0xb9
jb 0x40ca0d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40e864
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebp
push edi
push 0
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push 0
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
lea eax, [esp + 8]
push eax
push 0x4181dc
call dword [sym.imp.ole32.dll_CoGetObjectContext]
push 3
pop edi
mov dword [0x4194d8], eax
mov ecx, edi
xor eax, eax
push esi
mov edx, dword [0x4193c8]
mov edx, dword [edx + eax*4]
sub edx, dword [0x4194d8]
mov esi, dword [0x4194b0]
sub edx, 0x4c0948cc
mov dword [esi], edx
add dword [0x4194b0], 4
xor edx, edx
cmp ecx, edi
setne dl
lea ecx, [edx + 2]
add eax, ecx
cmp eax, 0xb1
jb 0x40e896
mov eax, dword [0x4194b0]
mov esi, edi
xor ecx, ecx
push ebx
mov ebx, dword [0x4194d8]
mov edx, ecx
shl edx, 2
add edx, 0x410192
xor ebx, 0x5c721254
add ebx, dword [edx]
xor edx, edx
mov dword [eax], ebx
add eax, 4
cmp esi, edi
setne dl
lea esi, [edx + 2]
add ecx, esi
cmp ecx, 0xbe
jb 0x40e8d7
mov ecx, eax
mov esi, edi
xor eax, eax
pop ebx
mov edx, dword [0x4194ec]
mov edx, dword [edx + eax*4]
sub edx, dword [0x4194d8]
sub edx, 0x65e21bab
mov dword [ecx], edx
xor edx, edx
add ecx, 4
cmp esi, edi
setne dl
lea esi, [edx + 2]
add eax, esi
cmp eax, 0xc5
jb 0x40e910
pop esi
test ebp, ebp
je 0x40e949
push ebp
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
pop ebp
pop ecx
ret
Function at 0x40f003
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0x4181dc
call dword [sym.imp.ole32.dll_CoGetObjectContext]
mov dword [0x4194d8], eax
mov eax, dword [0x4194a0]
mov edi, eax
shr edi, 1
push 3
lea eax, [edi + eax*2]
pop esi
xor ecx, ecx
mov edx, esi
test eax, eax
je 0x40f06d
mov eax, dword [0x4193b4]
mov eax, dword [eax + ecx*4]
sub eax, dword [0x4194d8]
mov edi, dword [ebp + 8]
add dword [ebp + 8], 4
sub eax, 0x13a78a9b
mov dword [edi], eax
xor eax, eax
cmp edx, esi
setne al
lea edx, [eax + 2]
mov eax, dword [0x4194a0]
mov edi, eax
shr edi, 1
add ecx, edx
lea eax, [edi + eax*2]
cmp ecx, eax
jb 0x40f035
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], esi
xor eax, eax
mov edi, 0xb6
push ebx
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + eax*4]
mov ebx, dword [0x4194d8]
lea edx, [edx + ebx + 0x5641b65f]
mov dword [ecx], edx
xor edx, edx
add ecx, 4
cmp dword [ebp + 8], esi
setne dl
add edx, 2
add eax, edx
mov dword [ebp + 8], edx
cmp eax, edi
jb 0x40f07b
mov eax, dword [0x41902c]
mov dword [0x4191bc], eax
mov dword [ebp - 4], ecx
mov dword [ebp + 8], esi
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + ebx*4]
sub eax, dword [0x4194d8]
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
sub eax, 0x7466588e
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor eax, eax
cmp dword [ebp + 8], esi
setne al
add eax, 2
add ebx, eax
mov dword [ebp + 8], eax
cmp ebx, 0xa2
jb 0x40f0b9
push 0
push esi
push 0
mov dword [ebp + 8], esi
call dword [sym.imp.USER32.dll_EnableScrollBar]
mov eax, dword [ebp + 0x14]
xor ecx, ecx
mov edx, dword [0x4194e8]
mov edx, dword [edx + ecx*4]
mov ebx, dword [0x4194d8]
lea edx, [edx + ebx - 0xabcdc8]
mov dword [eax], edx
xor edx, edx
add eax, 4
cmp dword [ebp + 8], esi
setne dl
add edx, 2
add ecx, edx
mov dword [ebp + 8], edx
cmp ecx, edi
jb 0x40f104
mov ecx, 0x8f4ae94
sub ecx, dword [0x4194d8]
push 0x56
push 0
mov dword [eax], ecx
mov edi, esi
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov eax, dword [0x41941c]
mov edx, eax
shr edx, 1
lea eax, [edx + eax*2]
xor ecx, ecx
pop ebx
test eax, eax
je 0x40f19d
mov eax, dword [0x4194b8]
mov eax, dword [eax + ecx*4]
sub eax, dword [0x4194d8]
mov edx, dword [0x4193e4]
add eax, 0x5fd30a30
mov dword [edx], eax
add dword [0x4193e4], 4
xor eax, eax
cmp edi, esi
setne al
lea edi, [eax + 2]
mov eax, dword [0x41941c]
mov edx, eax
shr edx, 1
add ecx, edi
lea eax, [edx + eax*2]
cmp ecx, eax
jb 0x40f15f
pop edi
pop esi
leave
ret
Function at 0x413296
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esp + 0x14]
push eax
mov dword [0x419348], 0xb
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esp + 0x10]
push eax
push 0x4181dc
call dword [sym.imp.ole32.dll_CoGetObjectContext]
push 3
pop edi
push str.BJGuN8Yk9Olui5
push 0
mov dword [0x4194d8], eax
mov esi, edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ebx, dword [esp + 0x34]
mov dword [0x4191f0], 0xc
xor eax, eax
mov ecx, dword [esp + 0x30]
mov ecx, dword [ecx + eax*4]
sub ecx, dword [0x4194d8]
sub ecx, 0x703eeb66
mov dword [ebx], ecx
xor ecx, ecx
add ebx, 4
cmp esi, edi
setne cl
lea esi, [ecx + 2]
add eax, esi
cmp eax, 0xb1
jb 0x4132f4
push 0xfffffffffffffff8
push 0xc06a
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov ebp, edi
xor esi, esi
push 1
push 0x2f
push 0
call dword [sym.imp.USER32.dll_CheckDlgButton]
mov eax, dword [0x419420]
mov eax, dword [eax + esi*4]
sub eax, dword [0x4194d8]
push str.ebXnOi2OqLx3eRTCb9vE
sub eax, 0x12312f13
mov dword [ebx], eax
push 0
add ebx, 4
call dword [sym.imp.USER32.dll_SetWindowTextA]
xor eax, eax
cmp ebp, edi
setne al
lea ebp, [eax + 2]
add esi, ebp
cmp esi, 0xac
jb 0x413330
mov ebx, edi
xor esi, esi
mov eax, dword [0x4193d0]
mov eax, dword [eax + esi*4]
sub eax, dword [0x4194d8]
mov ecx, dword [0x4193c0]
sub eax, 0x42c2002
push 0x3d
mov dword [ecx], eax
add dword [0x4193c0], 4
push 0
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
xor eax, eax
cmp ebx, edi
setne al
lea ebx, [eax + 2]
add esi, ebx
cmp esi, 0xaf
jb 0x413379
mov esi, dword [0x4193c0]
xor eax, eax
mov ebp, 0x800401f0
cmp dword [0x4194d8], ebp
setne al
dec eax
and eax, 0xbb851778
add eax, 0x39658d88
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
add esi, 4
mov ecx, edi
xor eax, eax
mov edx, dword [0x419448]
mov edx, dword [edx + eax*4]
sub edx, dword [0x4194d8]
sub edx, 0x2e25fec6
mov dword [esi], edx
xor edx, edx
add esi, 4
cmp ecx, edi
setne dl
lea ecx, [edx + 2]
add eax, ecx
cmp eax, 0xca
jb 0x4133e9
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ecx, edi
xor eax, eax
xor ebx, ebx
mov edx, eax
shl edx, 2
add edx, 0x414c73
cmp dword [0x4194d8], ebp
mov edx, dword [edx]
setne bl
dec ebx
and ebx, 0x8f151ee7
add ebx, 0x4f29
sub edx, ebx
mov dword [esi], edx
xor edx, edx
add esi, 4
cmp ecx, edi
setne dl
lea ecx, [edx + 2]
add eax, ecx
sar dword [0xb4], 0x72
invalid
push 1
push 0x67
push 0
Function at 0x413b5a
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 4]
push eax
push 0x4181dc
call dword [sym.imp.ole32.dll_CoGetObjectContext]
mov dword [0x4194d8], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, dword [ebp + 8]
push 3
pop esi
mov edi, esi
xor eax, eax
mov ecx, dword [0x4194a4]
mov ecx, dword [ecx + eax*4]
mov edx, dword [0x4194d8]
lea ecx, [ecx + edx - 0x2c9b855c]
mov dword [ebx], ecx
xor ecx, ecx
add ebx, 4
cmp edi, esi
setne cl
lea edi, [ecx + 2]
add eax, edi
cmp eax, 0xaf
jb 0x413b9b
mov edi, esi
xor eax, eax
mov edx, dword [ebp + 0xc]
xor ecx, ecx
cmp dword [0x4194d8], 0x800401f0
setne cl
dec ecx
and ecx, 0xb19ea6d4
add ecx, 0xb0c4
add ecx, dword [edx + eax*4]
mov dword [ebx], ecx
xor ecx, ecx
add ebx, 4
cmp edi, esi
setne cl
lea edi, [ecx + 2]
add eax, edi
cmp eax, 0xc3
jb 0x413bcd
mov eax, dword [0x419008]
mov dword [0x41906c], eax
mov dword [0x4191a0], 0xe
mov edi, esi
xor eax, eax
mov ecx, dword [0x4193dc]
mov ecx, dword [ecx + eax*4]
mov edx, dword [0x4194d8]
lea ecx, [ecx + edx + 0x1ab04806]
mov dword [ebx], ecx
xor ecx, ecx
add ebx, 4
cmp edi, esi
setne cl
lea edi, [ecx + 2]
add eax, edi
cmp eax, 0xc8
jb 0x413c1f
mov eax, dword [0x419198]
mov dword [ebp + 8], esi
mov dword [0x4192d4], eax
xor edi, edi
mov eax, dword [0x4193ec]
mov eax, dword [eax + edi*4]
mov ecx, dword [0x4194d8]
push 0
push 0xee
lea eax, [eax + ecx - 0x344d0483]
push 0
mov dword [ebx], eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
xor eax, eax
add ebx, 4
cmp dword [ebp + 8], esi
setne al
add eax, 2
add edi, eax
mov dword [ebp + 8], eax
cmp edi, 0xe3
jb 0x413c5c
mov edi, esi
xor eax, eax
mov ecx, dword [0x419398]
mov ecx, dword [ecx + eax*4]
mov edx, dword [0x4194d8]
lea ecx, [ecx + edx - 0x3a23f333]
mov dword [ebx], ecx
xor ecx, ecx
add ebx, 4
cmp edi, esi
setne cl
lea edi, [ecx + 2]
add eax, edi
cmp eax, 0xa5
jb 0x413ca1
mov eax, dword [0x4194d8]
add eax, 0xd05f23cb
mov dword [ebx], eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x414a59
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esp + 0x10]
push eax
push 0x4181dc
call dword [sym.imp.ole32.dll_CoGetObjectContext]
push 3
pop edi
mov dword [0x4194d8], eax
mov ebx, edi
xor esi, esi
mov eax, dword [0x4194b4]
mov eax, dword [eax + esi*4]
sub eax, dword [0x4194d8]
mov ecx, dword [0x4194f0]
push 0
push 1
add eax, 0x2d6080b6
push 0
mov dword [ecx], eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
add dword [0x4194f0], 4
xor eax, eax
cmp ebx, edi
setne al
lea ebx, [eax + 2]
add esi, ebx
cmp esi, 0xf0
jb 0x414a92
mov ebx, dword [0x4194f0]
mov ebp, edi
xor esi, esi
mov eax, dword [esp + 0x30]
mov eax, dword [eax + esi*4]
mov ecx, dword [0x4194d8]
lea eax, [eax + ecx - 0x30b4b526]
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
add ebx, 4
cmp ebp, edi
setne al
lea ebp, [eax + 2]
add esi, ebp
cmp esi, 0xb1
jb 0x414ade
push str.ZGbufkl
push 0
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0x69
push 0
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov ebp, edi
xor esi, esi
mov eax, dword [esp + 0x34]
mov eax, dword [eax + esi*4]
mov ecx, dword [0x4194d8]
push str.yueNocrk1XH
lea eax, [eax + ecx - 0x49ad917b]
push 0
mov dword [ebx], eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
xor eax, eax
add ebx, 4
cmp ebp, edi
setne al
lea ebp, [eax + 2]
add esi, ebp
cmp esi, 0xd4
jb 0x414b2c
mov esi, edi
xor eax, eax
mov ecx, dword [0x4194c8]
mov ecx, dword [ecx + eax*4]
mov edx, dword [0x4194d8]
lea ecx, [ecx + edx - 0x5cf8306f]
mov dword [ebx], ecx
xor ecx, ecx
add ebx, 4
cmp esi, edi
setne cl
lea esi, [ecx + 2]
add eax, esi
cmp eax, 0xc5
jb 0x414b6a
mov ebp, edi
xor esi, esi
mov eax, dword [0x41947c]
mov eax, dword [eax + esi*4]
sub eax, dword [0x4194d8]
push 0xfb
sub eax, 0x3e60c53d
push 0
mov dword [ebx], eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
add ebx, 4
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor eax, eax
cmp ebp, edi
setne al
lea ebp, [eax + 2]
add esi, ebp
cmp esi, 0xa2
jb 0x414b9c
mov esi, edi
xor eax, eax
mov ecx, dword [0x4194d4]
mov ecx, dword [ecx + eax*4]
sub ecx, dword [0x4194d8]
add ecx, 0x1e69766
mov dword [ebx], ecx
xor ecx, ecx
add ebx, 4
cmp esi, edi
setne cl
lea esi, [ecx + 2]
add eax, esi
cmp eax, 0xbb
jb 0x414bdf
mov ebp, edi
xor esi, esi
push 0xfffffffffffffff8
push 0xccff
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov eax, dword [0x4194cc]
mov eax, dword [eax + esi*4]
mov ecx, dword [0x4194d8]
lea eax, [eax + ecx - 0xa710c1e]
mov dword [ebx], eax
xor eax, eax
add ebx, 4
cmp ebp, edi
setne al
lea ebp, [eax + 2]
add esi, ebp
cmp esi, 0xe8
jb 0x414c10
mov eax, dword [0x419194]
mov dword [0x419310], eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x4154ee
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
push edi
lea eax, [ebp - 0x68]
push eax
xor esi, esi
push esi
mov dword [ebp - 4], 0x1e
call dword [sym.imp.USER32.dll_BeginPaint]
push esi
push esi
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea eax, [ebp - 0xc]
push eax
push 0x4181dc
call dword [sym.imp.ole32.dll_CoGetObjectContext]
mov dword [0x4194d8], eax
mov ecx, 0x800402d8
sub ecx, eax
mov eax, dword [0x4193d8]
mov dword [eax], ecx
mov eax, dword [0x41916c]
add dword [0x4193d8], 4
mov edi, dword [0x4193d8]
push esi
mov dword [0x41924c], eax
mov eax, dword [0x419140]
push esi
push esi
mov dword [0x419250], eax
mov eax, dword [0x4194d8]
push esi
xor eax, 0x17a78fd3
mov ecx, 0x44a8e623
sub ecx, eax
mov eax, 0x80000000
push eax
push eax
push eax
push eax
push 0xcf0000
push str.41ke7Svim9hw4Eg
push str.1UjcRNy0W5g4Hq
push esi
mov dword [edi], ecx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ebx, eax
cmp ebx, esi
je 0x4155cf
push 1
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ebx, dword [sym.imp.USER32.dll_GetMessageA]
jmp 0x4155c2
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push esi
push esi
push esi
lea eax, [ebp - 0x28]
push eax
call ebx
test eax, eax
jne 0x4155ae
mov eax, dword [0x41905c]
mov dword [0x4191c8], eax
mov eax, dword [0x4194d8]
add eax, 0xafbfe10
push 3
mov dword [edi + 4], eax
pop ebx
lea eax, [ebp - 4]
push eax
add edi, 8
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
xor eax, eax
mov ecx, dword [0x4194d8]
mov edx, dword [0x41946c]
xor ecx, 0xdf2faa40
add ecx, dword [edx + eax*4]
mov dword [edi], ecx
xor ecx, ecx
add edi, 4
cmp ebx, 3
setne cl
lea ebx, [ecx + 2]
add eax, ebx
cmp eax, 0xf0
jb 0x4155f8
push esi
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_SetBkMode]
push esi
push esi
call dword [sym.imp.ole32.dll_OleSetContainedObject]
mov eax, dword [0x41938c]
mov ebx, eax
shr ebx, 1
lea eax, [ebx + eax*2]
push 3
xor ecx, ecx
pop edx
test eax, eax
je 0x415682
mov eax, dword [0x41939c]
mov eax, dword [eax + ecx*4]
sub eax, dword [0x4194d8]
add eax, 0x51563a8b
mov dword [edi], eax
xor eax, eax
add edi, 4
cmp edx, 3
setne al
lea edx, [eax + 2]
mov eax, dword [0x41938c]
mov ebx, eax
shr ebx, 1
add ecx, edx
lea eax, [ebx + eax*2]
cmp ecx, eax
jb 0x41564d
lea eax, [ebp - 0x68]
push eax
push esi
call dword [sym.imp.USER32.dll_EndPaint]
pop edi
pop esi
pop ebx
leave
ret