joyce8/EMBER2024-capa huggingface dataset:
Function at 0xdd75f3
Capabilities:
Encode data using base64
Encode data using xor
Encrypt data using speck

Disassembly:
mov dword [esp + ecx - 0xbf], 0xa732e53f
mov ecx, dword [esi + edx*2 - 0x5416000a]
sub byte [esp + edx - 0x2a0b0005], 0x30
lea esi, [esi + edx*2 - 0x54160006]
adc dl, dl
xor ecx, ebx
and edx, edx
shr dword [esp + edx*2 - 0x54160014], 0x2b
sbb ecx, 0xafbd51a5
sub edx, dword [esp + edx - 0x2a0b000a]
add dl, dl
not ecx
jle 0xcba0d0

Function at 0xdd78bf
Capabilities:
Encrypt data using speck

Disassembly:
movzx dx, byte [eax]
rol cx, 2
sbb edi, 1
mov dword [esp], 0x2e0fb206
xor cx, 0xab91
mov word [edi], dx
mov eax, dword [ebp]
or word [esp + 2], cx
movsx edx, word [esp + 4]
shl byte [esp + edx*4 - 0x115f1], cl
lea ebp, [ebp + edx*4 - 0x115f4]
xor eax, ebx
lea eax, [eax + edx*8 - 0x5b38c7ae]
shr dx, cl
call fcn.00deb99c
mov esp, ebp
mov eax, 0x2d914c07
pop esi
popfd
call fcn.00c9f04a
mov edx, 0x39237e19
dec eax
lea ebp, [edx + edx*2 - 0x7adf64cd]
dec esp
lea edi, [edx + 0x46083b91]
dec ecx
mov eax, dword [ebp + edx - 0x39237e19]
inc ebp
movzx eax, byte [edx + ebp - 0x308b157f]
inc ebp
xor al, bl
jmp 0x91fff5

Function at 0xdd7c97
Capabilities:
Encrypt data using speck

Disassembly:
call 0xd8d2cd
test ax, 0x3ca4

Function at 0xddad31
Capabilities:
Encrypt data using speck

Disassembly:
push 0xe12e7900
neg byte [esp + 1]
mov dword [esp + 4], ebx
lea esp, [esp + 4]

Function at 0xde2b8c
Capabilities:
Encrypt data using speck

Disassembly:
add ax, dx
and edx, eax
xor ecx, ebx
add ax, 0x7602
shl dl, 0xa3
inc ecx
inc edx
neg ecx
lea ecx, [ecx + edx*2 - 0x6182153]
xchg dh, dl
xchg dh, dl
ror ecx, 1
call fcn.00921755
inc cl
neg cl
add eax, dword [esp + eax + 4]
rol cl, 1
shl dword [esp + 4], 0xd3
bts eax, eax
xor bl, cl
xadd dword [esp + 4], eax
call fcn.00ca7ac3
movsx edx, ax
rol edx, 0xdb
lea ebp, [ebp + edx - 0x6fffffec]
jae 0xd6ba16
xchg bh, bh
sbb ebp, 0xfffffffc
movzx ecx, byte [esi - 5]
sub ax, ax
mov dword [esp], 0x615fd3f
sbb esi, 5
cbw
sub eax, 0xc7920095
sub eax, eax
xor cl, bl
cwde
rol cl, 1
jmp 0xdb4e5d

Function at 0xdea750
Capabilities:
Encrypt data using speck

Disassembly:
movzx ebx, byte [edx]
jmp 0xe01895
lea esp, [esp + 0x18]
jne 0xddad42
mov ecx, 0xa4af8b0f
pop ebx
mov edx, 0xfd018612
not edx
not eax
neg dl
dec edx
mov ecx, edx
mov dword [edx + edi - 0x2fe7912], eax
and cx, cx
movsx eax, cx
jmp ebp
xor ebx, eax
call fcn.00941be1
Function at 0xdf3511
Capabilities:
Encrypt data using speck

Disassembly:
xor ebp, 0x2c395e0a
dec esp
imul esi, dword [esp + edx - 0x4096fc81]
inc edx
lea ebp, [ebp + ecx*2 + 0x7aa56fdd]
dec edx
mov dword [esp + ecx*2 - 0xfe44], edx
dec edx
rol dword [esp + ecx - 0x7f1a], 0xb1
inc edx
sar byte [esp + ecx - 0x7f1a], 0xa3
dec esp
mov dword [esp + edx - 0x4096fc81], ebx
xor dword [esp + edx - 0x4096fc81], ebp
dec esi
mov ebx, dword [esp + ecx*4 - 0x1fc80]
dec eax
arpl bp, bp
jmp 0xc94c67
dec ebp
btc ecx, esp
inc cx
bt eax, 0x18
dec eax
add ebx, ebp
inc esp
xadd edx, eax
dec eax
mov dword [esp + edx - 0x4096fa2f], ebx
ret 8
neg dword [esp + edx - 0x4096fc7d]
inc eax
xor bh, 0x3a
not ebp
dec esi
lea esi, [ecx + ecx*2 - 0x7842cb65]
dec eax
bts edi, 7
inc ecx
shr dh, 0x42
lea ebp, [ebp + edi - 0x26786565]
inc esp
movsx eax, word [esp + edx - 0x4096fc7d]
jne 0xc76aed

Function at 0xdf5bb5
Capabilities:
Encrypt data using speck

Disassembly:
xor ebx, ecx
shl edx, 0x49
rol eax, 0x36
btc eax, eax
adc ebp, ecx
movsx ecx, dx
mov al, byte [edx + edi - 0x663edffc]
lea edi, [edx + edi - 0x663edffb]
sar ecx, 0x51
xor al, bl
btr dx, 0x17
adc edx, 0x8db44a1e
adc al, 0x33
not dl
btr dx, 0x37
ror al, 1
btc edx, 0xa
bt cx, 0xb8
not dx
neg al
xor ecx, ecx
push ecx
sal word [esp + ecx + 2], 0xe3
adc al, 0x8b
inc edx
jle 0xdf3545
xor word [esp + ecx], cx
xor bl, al
rol dword [esp + ecx], 0xdf
or ecx, ecx
lea eax, [esp + eax + 4]
shr word [esp + ecx*2], 0x21
sal dword [esp + ecx], 9
call fcn.00defa52
inc ecx
neg edx
or ax, cx
btr eax, 0x8b
rol ecx, 0x9a
xor ebx, edx
dec ecx
add ebp, edx
dec eax
sub ecx, 0x6480d2b2
movzx ecx, word [eax + esi - 0x23a37466]
mov dword [esp + eax*2 - 0x4746e8cc], eax
shr dword [esp + eax*2 - 0x4746e8cc], 0x46
lea esi, [esi + eax*2 - 0x4746e8ca]
call fcn.009790b0
mov ecx, 0x451ceda5
movzx edx, cx
mov ecx, dword [edi + edx*2 - 0x1db4a]
sal edx, 0xdf
lea eax, [edx + edx*8 - 0x48663eee]
xor ecx, ebx
ror ecx, 1
shl al, 0x24
jp 0xdaf1cd
mul edx
lea ecx, [eax + ecx - 0x48a385a5]
ror ecx, 1
inc ecx
not edx
rol ecx, 1
inc edx
jno 0x970efb

Function at 0xdf7dab
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
bswap edx
neg edx
sal dword [esp], cl
ror al, 0x63
xor ebx, edx
push eax
mov dword [esp + 8], ecx
and eax, eax
adc esi, edx
imul cx, ax
lea edx, [ecx + ecx*4 + 0x733e5112]
pop ecx
pop ecx
pop edx
jno fcn.00dd66d7
mov dword [esp], 0x7e97b82f
call fcn.00da3447
mov ecx, 0x310366af
mov edx, ecx
mov eax, edx
mov ecx, dword [edx + esi - 0x310366af]
and dx, ax
cwde
rol dx, 0xec
lea esi, [esi + edx*2 - 0x6207ecd0]
jnp 0xa04386
xor ecx, ebx
sal eax, 0x9f
xadd dl, dh
inc eax
inc ecx
shr eax, 0x6a
sal ax, 1
bswap ecx
push edx
rol ecx, 1
sub ecx, 0xaf28213a
sub edx, 0xf1232117
xor dword [esp + eax - 0x200000], edx
xor ebx, ecx
rol dx, 0xf
shl dl, 0xa5
sar dl, 0x87
adc ebp, ecx
and word [esp + edx*2 - 0x7fc149fd], 0x318c
Function at 0xdfa30e
Capabilities:
Encrypt data using speck

Disassembly:
bswap edx
xor ebx, eax
call fcn.00e1ce9c
adc eax, eax
bswap ecx
xor ecx, 0x3994661c
inc eax
or edx, eax
xadd al, ah
rol ecx, 1
mov dword [esp + edx - 0x400001fb], eax
xor ebx, ecx
btr edx, edx
shl edx, 0x15
adc ebp, ecx
movzx edx, byte [edx + esi - 0x3fdffffc]
call fcn.00c85916
jns 0xdfa3aa
pop eax
push edx
push edx
repne stosd dword es:[edi], eax
cmp dword [ebx - 0x75], esp
mov al, byte [esi - 0x61]
cmp dword [ebx - 0x75], esp
mov byte [0x6339f3aa], al
mov esp, esp
test byte [edi + 0x78], 0x3d
jl 0xdfa2ea
dec esi
mov dl, 0x1a
inc ecx
out 0x4d, eax
wait
xchg ebp, eax
dec ebx
mov ebx, 0xd1ee7f8b
jae 0xdfa367
out dx, al
sal dword [ebx - 4], 1
and esp, dword [eax + 0x25]
adc byte [ecx + 0x6b], dh
pop edi
loop 0xdfa3f2
fldcw word [ebp + 0x5d7e427d]
cmpsd dword [esi], dword es:[edi]
sbb al, 0x4d
jecxz 0xdfa305
or edx, edx
test dword [ebx], esp
lodsd eax, dword [esi]
dec esi
jg 0xdfa342
sbb al, 0x51
invalid
mov eax, dword [0x881624b2]
pop esp
dec ebp
loop 0xdfa427
sahf
ljmp 0xb61d
sub al, al
dec ebp
adc dword [edx + 0x4ba0c85], esi
mov dl, 0xf6
stosd dword es:[edi], eax
mov edi, 0xb204ba28
test byte [edi + 0x1d], 0xad
pop ebx
dec esp
dec esp
mov dl, 0xf6
inc edi
sbb eax, 0x4c4c5bad
push dword [esi + 0x4b]
insd dword es:[edi], dx
pop eax
xacquire xchg byte [ebp + edx*8 - 0x3f749cc2], cl
sub byte [ecx + 0x5a8b633e], dl
and al, 0xfd
arpl word ds:[ebx + 0x7f3960d8], cx
cmp eax, 0x9918d97c
push ds
inc ecx
cmp esp, dword [ebp - 0x43]
xchg ebp, eax
ljmp 0x1bb2
jl 0xdfa402
sbb byte [ecx + 0x653b411e], bl
mov ebp, 0x7a90ea95
in al, dx
sbb dh, byte [edx + 0xf1b9e1b]
mov dl, 0x40
invalid

Function at 0xdfd1a8
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp], 0xd5f63dce
call fcn.00a17e74
mov eax, 0xfdb0ad97
movzx edx, ax
mov ecx, dword [edi + edx*8 - 0x56cb8]
jmp 0xdc7f93

Function at 0xe01ba4
Capabilities:
Encrypt data using speck

Disassembly:
dec eax
btc edi, eax
inc eax
movsx esi, bh
inc ebp
movsx ecx, dh
inc ecx
dec eax
inc esp
movsx esp, al
inc ecx
movzx ebp, si
inc ecx
neg eax
sar ax, 0x6a
inc cx
neg esi
inc ecx
push ebx
shr di, 4
inc eax
shl ch, 0xc6
dec ebx
lea esi, [edi + esi*4 + 0x2a3deb1b]
inc esi
xor dword [esp + edi - 0x51bb4420], eax
dec ebp
or esi, esi
rol di, 0xb
dec eax
lea ecx, [ebp*8 + 0x117cb19]
inc ecx
pop ebx
dec ebp
arpl ax, ax
inc ecx
movzx edx, sp
inc ecx
xadd bh, ch
dec ecx
adc ebx, eax
dec eax
not edi
inc bp
btr edi, esp
sub esi, 0x242cad8c
inc di
mov ebp, dword [ebp + edi - 0x51bb4420]
inc cx
ror esi, 0xcf
inc esp
movzx eax, ax
inc esp
add bh, al
ja fcn.00c9d101
dec eax
mov dword [esp + esi*4 - 0x2b8cc], edx
inc ebp
mov eax, esi
dec esi
lea ebp, [esi + ebp - 0xae37]
dec eax
neg dword [esp + esi*4 - 0x2b8cc]
xor dword [esp + esi - 0xae31], 0xcb0b9f81
inc ebp
mov dword [ebp + esi - 0xae33], ecx
dec esp
mov dword [esp + esi*2 - 0x15c66], esi
dec esi
lea edx, [esi + edx - 0xae37]
mov edi, edx
inc ecx
mov eax, dword [edx + esi*2 - 0x15c66]
neg edi
inc ecx
xor eax, ebx
inc ecx
movsx ebp, al
inc ecx
neg al
ror eax, 2
inc eax
add word [esp + esi - 0xae31], 0x13ab
rol word [esp + esi*4 - 0x2b8ca], 0x4c
not eax
jp 0xa31ddd
jns 0xa1abfa
Function at 0xe08e6d
Capabilities:
Encrypt data using speck

Disassembly:
add ebp, ecx
lea esp, [esp + 0xc]
call fcn.00d4b508
mov eax, 0xd6ba052c
movsx edx, al
lea ecx, [edx + eax - 0x1cdeca77]
mov edx, dword [edi + edx*4 - 0xb0]
not cl
cwde
and cx, ax
mov ecx, dword fs:[edx + eax - 0x52c]
sbb eax, 0xf288fe86
sub eax, 0x3ba32a86
bswap eax
mov dword [eax + edi - 0x20dcd3d1], ecx
call fcn.00966d6f

Function at 0xe0b3b9
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
xor ecx, ebx
inc edx
xor ecx, 0x51391987
call fcn.0093f6d4
inc ecx
movzx edi, byte [edx - 1]
inc ecx
mov eax, 0x35368636
inc ecx
xor bh, bl
inc ecx
movsx ebp, al
call fcn.00cb162e
xor ebx, ecx
and ebx, 0xff
mov dword [esp], 0x373e4e81
mov ebx, dword [ebx*4 + 0xca6464]
shr ecx, 8
shl dword [esp], 0x66
js 0xdadf6f

Function at 0xe159d0
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
xor cl, bl
add byte [esp + 3], 0x1c
mov eax, dword [esp]
call fcn.00d90aa1
jg 0xc90963
or cl, cl
mov eax, dword [edi + ecx - 0x479a1319]
mov edx, dword [edi + ecx - 0x479a1315]
mov dword fs:[eax + ecx - 0x479a1319], edx
mov dword [esp + ecx - 0x479a1319], ecx
movzx ecx, byte [esi + ecx - 0x479a1319]
dec dword [esp]
jp 0xd6447f
mov eax, dword [edi]
mov edx, 0x4d199c30
add edx, edx
mov ecx, dword [edi + 4]
shl dx, 0x67
inc dl
mov dword ss:[eax], ecx
mov ecx, dword [ebp]
lea eax, [edx + edx - 0x6ce1da55]
cdq
rol dx, 0x41
xor ecx, ebx
neg eax
xor ecx, edx
xadd dx, ax
xadd al, ah
adc dx, dx
dec ecx
xor ecx, 0xb2051fa2
ror eax, 0xfb
mul eax
ror ecx, 3
sub edx, 0x87019590
sub edx, edx
dec ecx
rol dl, 0xe4
neg eax
xor ebx, ecx
add eax, eax
ror ax, 0x86
div ax
add esi, ecx
neg eax
movzx ecx, dl
add cl, byte [ebp + eax*2 - 0x6401fffa]
btc ax, 0x8b
call fcn.00d856e9

Function at 0xe16fe6
Capabilities:
Encrypt data using speck

Disassembly:
dec eax
shl eax, 0xbb
inc ecx
xor ecx, 0x80030c35
inc edx
sar dword [esp + eax + 0xb], 0xad
inc cx
div esp
inc ecx
dec ecx
dec edx
mov dword [esp + eax], 0xc1937809
push eax
call fcn.00ddc0fd

Function at 0xe1798c
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x10]
je 0xdaf20f
Function at 0xe1f9b8
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
not dword [esp + ecx*2 + 1]
mov eax, ecx
pop edx
pop ecx
pop ecx
pop edx
jbe fcn.00dd66d7
mov edi, 0x54172bba
inc eax
movsx ecx, bh
call fcn.00d8b24a
xadd dword [esp + eax + 0xb], eax
mov dword [esp + eax - 0x4001c], eax
inc dl
mov dword [esp + eax - 0x40020], eax
dec dword [esp + eax - 0x40020]
lea ecx, [eax - 0x327a9975]
xor bl, dl
xadd word [esp + eax*4 - 0x100072], cx
lea edx, [esp + edx + 0x10]
idiv al
sub ecx, 0xbbbf300a
setnp cl
mov al, byte [edx + eax*8 - 0x200008]
bt cx, 0x9d
sub ecx, ecx
mov word [ecx + edi - 4], ax
lea edi, [ecx + edi - 4]
jns 0xa287c6

Function at 0xe20cb1
Capabilities:
Encrypt data using speck

Disassembly:
mov eax, dword [ebp + edx - 0xe79edcd]
call fcn.00df577b

Function at 0xe212db
Capabilities:
Encrypt data using speck

Disassembly:
or eax, ecx
bts dx, 1
mov dword [esp], edx
and dl, byte [esp]
not eax
call fcn.00cb2da5
Function at 0xe212f1
Capabilities:
Encrypt data using speck

Disassembly:
sbb cl, 0x97
adc ebp, 3
bswap edx
xor eax, ebx
lea edx, [edx - 0x52f996d5]
sub cl, cl
dec eax
inc edx
add cl, 0
inc ecx
xor eax, 0xa934a9e
lea eax, [ecx + eax - 0x177fab77]
btr edx, 0x91
neg dx
rol eax, 2
ror dx, 0xad
xor cx, cx
xor ebx, eax
bts edx, 0x8b
neg edx
add esi, eax
mov eax, 0xac3a6db6
not eax
ror cl, 0x42
fadd qword [edi + edx*2 - 0x2c978ae2]
and edx, 0x4a8da020
jmp esi
dec eax
cdq
dec eax
imul edx, dword [esp + ecx - 0x49f1]
dec ecx
lea esi, [eax + esi + 0x6570f068]
inc ecx
seto ah
inc ecx
movsx edi, di
dec eax
bswap esi
inc esi
and byte [esp + eax + 0x534d7965], dh
dec eax
rol esi, 1
dec eax
neg esi
sar dl, 0x22
dec ecx
inc ecx
seta dl
dec edx
lea esi, [esi + eax + 0x5c8fc2da]
dec esp
lea esp, [edi - 0x1b7f44d5]
dec eax
rol esi, 7
dec eax
inc dword [esp + ecx - 0x49fb]
inc ecx
ror al, 0xc1
inc dx
rol dword [esp + eax + 0x534d79c5], cl
dec eax
bswap esi
dec esp
xor ebx, esi
inc esi
mov byte [esp + eax + 0x534d79ba], ah
dec ebx
mov dword [eax + ebp + 0x534d79aa], esi
dec esi
xadd dword [esp + eax + 0x534d79b1], edi
sete cl
dec edi
lea ebp, [ebp + eax + 0x534d79aa]
inc cx
shl edi, 0x2d
dec esp
lea esp, [edi + edx - 0x775ab8ec]
inc esp
xadd edi, ecx
inc ecx
pop ecx
pop ebp
pop esi
pop edi
js fcn.00c9d101
mov eax, 0x3e3e5d12
lea ecx, [eax + eax*4 + 0x279a8f8b]
sub ecx, 0xdb22b3a9
mov eax, dword [ebp + eax*2 - 0x7c7cba24]
mov edx, ecx
jge 0xcc741c
inc edx
movzx ebp, word [esp + eax + 0x534d7978]
inc ebx
movzx eax, byte [edx + eax + 0x534d795b]
inc ecx
xor al, bl
dec esp
mov dword [esp + ecx - 0x127a], eax
inc al
dec ecx
lea edx, [esi + ecx*4 - 0x59e4d357]
rol al, 1
dec eax
not edx
inc edx
xor dword [esp - 0x5b61270], 0x34bc3813
inc dx
sub dword [esp + eax + 0x534d797a], ecx
dec al
not al
inc esp
xor bl, al
dec eax
lea esi, [ebp + ebp*8 + 0x51dbf28]
dec eax
lea eax, [esp + eax + 0x20]
dec eax
rol ebp, 0x61
inc dx
not dword [esp + eax + 0x534d7974]
dec eax
rol ecx, cl
inc edx
mov byte [eax + eax + 0x534d7960], bh
inc ecx
dec esi
movzx eax, dl
dec ecx
mov esi, dword [edx + ecx - 0x4a15]
inc eax
shr ch, 0x64
cdq
dec ecx
idiv esp
dec ebp
lea edx, [edx + ecx - 0x4a15]
dec edx
mov dword [esp + eax + 0x534d7960], ebp
dec ecx
xor esi, ebx
jmp 0xe17e96

Function at 0xe2138c
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [edi + ecx*2 - 0x1fe]
mov dword [esp + ecx - 0xf7], 0x6a193c8d
mov cx, word [ecx + edi - 0xfb]
lea edi, [edi + edx - 0xf9]
push edx
mov word ss:[edx + eax - 0xff], cx
call fcn.00df8d88

Function at 0xe218d0
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp], 0xefa3ab98
ror dword [esp], 0xec
dec ebx
mov dword [esp + 4], 0xe1373886
lea esp, [esp + 8]
jne 0xd49ede
Function at 0x401120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401139
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40114d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x40116e
cmp esi, eax
jae 0x401147
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401160
cmp esi, eax
jae 0x401147
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x403940
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4215b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x28], edi
call fcn.00401e50
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.004019a0
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x4039d2
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x404e90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindResourceExA]
push ebp
mov eax, ecx
push esi
shr eax, 4
inc eax
movzx esi, ax
xor eax, eax
mov ax, word [0x42f69c]
push edi
mov edi, dword [esp + 0x14]
and ecx, 0xf
mov ebp, ecx
push eax
push esi
push 6
push edi
call ebx
test eax, eax
jne 0x404ee1
push 0x809
push esi
push 6
push edi
call ebx
test eax, eax
jne 0x404ee1
push 0x1009
push esi
push 6
push edi
call ebx
test eax, eax
je 0x404f48
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x404f48
mov edx, eax
xor eax, eax
mov si, word [edx]
add edx, 2
test si, si
je 0x404f07
cmp eax, ebp
je 0x404f15
movsx ecx, si
lea edx, [edx + ecx*2]
inc eax
cmp eax, 0x10
jl 0x404ef2
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
ret
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
mov ecx, ebx
mov ebp, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
push 0
push 0
mov ecx, ebp
and ecx, 3
push ebx
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x28]
push eax
movsx ecx, si
push ecx
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
ret
Function at 0x4053f0
Capabilities:
Get common file path

Disassembly:
mov eax, 0x7434
call fcn.00407700
mov eax, dword [0x42e660]
push ebx
push esi
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x743c], eax
call fcn.00403760
lea ecx, [esp + 0x14]
call fcn.00401a00
lea ecx, [esp + 0x10]
call fcn.00401a00
lea eax, [esp + 0x703c]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edi, [esp + 0x703c]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x405440
mov cx, word [0x422c3c]
mov word [edi], cx
lea edi, [esp + 0x703c]
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x405460
mov edx, dword [str.Localization.ini]
mov eax, dword [0x422c2c]
mov ecx, dword [0x422c30]
mov dword [edi], edx
mov edx, dword [0x422c34]
mov dword [edi + 4], eax
mov al, byte [0x422c38]
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov byte [edi + 0x10], al
lea eax, [esp + 0x703c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4054a0
sub eax, edx
push eax
lea ecx, [esp + 0x7040]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00401580
mov esi, dword [esp + 0x744c]
mov edi, dword [esp + 0x7448]
mov ebx, dword [esp + 0x7444]
push esi
push edi
push 0x8c
push ebx
call fcn.00404e90
add esp, 0xc
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x10], esp
push edx
call fcn.00401a20
lea ecx, [esp + 0x1c]
call fcn.00403ce0
push 0x422a7c
lea ecx, [esp + 0x1c]
call fcn.00404550
test eax, eax
jne 0x4055f6
xor eax, eax
mov ax, word [0x42f69c]
push eax
call fcn.00404880
push eax
call fcn.00404f50
add esp, 8
lea ecx, [esp + 0x10]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00401690
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CDKEY
call fcn.00401690
lea ecx, [esp + 0x24]
call fcn.00404260
lea ecx, [esp + 0xc]
call fcn.00401a00
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x10]
call fcn.00401fe0
lea ecx, [esp + 0xc]
call fcn.00405350
lea ecx, [esp + 0xc]
call fcn.00405300
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
call fcn.00401fe0
mov ecx, dword [esp + 0x10]
push 0x422a84
push ecx
call fcn.004084a2
add esp, 8
test eax, eax
jne 0x4055a8
push esi
push edi
push 0x8c
jmp 0x4055e4
mov edx, dword [esp + 0x10]
push 0x422c1c
push edx
call fcn.004084a2
add esp, 8
test eax, eax
jne 0x4055c7
push esi
push edi
push 0x8d
jmp 0x4055e4
mov eax, dword [esp + 0x10]
push 0x422c18
push eax
call fcn.004084a2
add esp, 8
test eax, eax
jne 0x4055ed
push esi
push edi
push 0x8e
push ebx
call fcn.00404e90
add esp, 0x10
lea ecx, [esp + 0xc]
call fcn.00401410
lea ecx, [esp + 0x10]
call fcn.00401410
lea ecx, [esp + 0x14]
call fcn.00401410
lea ecx, [esp + 0x18]
call fcn.00404480
mov ecx, dword [esp + 0x743c]
call fcn.0040776e
pop edi
pop esi
pop ebx
add esp, 0x7434
ret
Function at 0x4056f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
sub esp, 0x50c
push ebx
push eax
push ecx
lea edx, [esp + 0x14]
push str.SOFTWARE_s_s
push edx
xor bl, bl
call fcn.00408398
add esp, 0x10
lea eax, [esp + 4]
push eax
push 1
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405788
mov ecx, dword [esp + 4]
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x114]
push eax
push 0
push 0
push str.DisplayName
push ecx
mov dword [esp + 0x20], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40577d
mov edx, dword [esp + 0x51c]
lea eax, [esp + 0x110]
mov ecx, eax
mov bl, 1
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x405773
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
add esp, 0x50c
ret 0xc

Function at 0x4057a0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
sub esp, 0x108
push ebx
push eax
push ecx
lea edx, [esp + 0x10]
push str.SOFTWAREElectronic_Arts_s_sergc
push edx
xor bl, bl
call fcn.00408398
add esp, 0x10
push 0
lea eax, [esp + 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40582e
mov edx, dword [esp + 0x118]
mov eax, edx
push esi
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405800
sub eax, esi
push eax
push edx
mov edx, dword [esp + 0x10]
push 1
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop esi
jne 0x405823
mov bl, 1
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
add esp, 0x108
ret 0xc
Function at 0x405840
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x294
push esi
mov esi, dword [esp + 0x29c]
push edi
mov edi, dword [esp + 0x2a4]
push edi
push esi
lea eax, [esp + 0x20]
push str.SOFTWAREElectronic_Arts_s_sergc
push eax
call fcn.00408398
push edi
push esi
lea ecx, [esp + 0xb0]
push str.SOFTWAREElectronic_Arts_s_s
push ecx
call fcn.00408398
push esi
lea edx, [esp + 0x13c]
push str.SOFTWAREElectronic_Arts_s
push edx
call fcn.00408398
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0x2c
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
lea ecx, [esp + 0x24]
push ecx
push 0x80000002
call esi
test eax, eax
jne 0x405947
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea edx, [esp + 0x18]
push edx
push 0x80000002
call edi
test eax, eax
jne 0x405947
lea eax, [esp + 0x98]
push eax
push 0x80000002
call edi
test eax, eax
jne 0x405947
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 8]
push edx
push 0xf003f
push 0
lea eax, [esp + 0x124]
push eax
push 0x80000002
call esi
test eax, eax
jne 0x405947
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0xc]
push eax
push eax
push eax
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1ac]
push eax
push 0
push ecx
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x405947
lea edx, [esp + 0x118]
push edx
push 0x80000002
call edi
pop edi
pop esi
add esp, 0x294
ret 8