joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4441f0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x444223
push esi
call fcn.00452520
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44421c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4442a9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x444292
mov eax, dword [esi + 8]
test eax, eax
je 0x444247
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44428e
cmp eax, 2
je 0x444292
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44423a
cmp eax, 3
je 0x44426d
cmp eax, 1
jne 0x44423a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44423a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44423a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004442d0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4442b8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004442d0
add esp, 4
pop esi
ret

Function at 0x444b40
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x444b61
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x444b61
mov eax, dword [eax + 0x44]
test eax, eax
je 0x444b61
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x444fb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x444fbb
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x4450be
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x48e0d8]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x48e0d8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x48e0d8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x48e0d8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x48e0d8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x48e0d8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x48e0d8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x48e0d8]
xor eax, edx
inc ecx
dec edi
jne 0x444fd6
pop edi
test esi, esi
je 0x4450e0
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x48e0d8]
xor eax, edx
inc ecx
dec esi
jne 0x4450c2
pop esi
pop ebx
not eax
ret
Function at 0x46470f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x464747
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004627c7
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0046279f
jmp 0x464753
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x465e01
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x465e43
call fcn.0046b877
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x465e43
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x465e3a
xor eax, eax
jmp 0x465e4b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00465e51
pop edi
pop esi
pop ebx
ret 4
Function at 0x47f5b8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4b1954]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00474629
mov dword [ebp - 0x14], eax
cmp dword [0x4c4cf4], esi
jne 0x47f6ab
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x47f638
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x47f78b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x47f78b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x47f78b
push eax
call ebx
push 0x49769c
push edi
mov dword [0x4c4cf4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x4976ac
push edi
mov dword [0x4c4cf8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4c4cfc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4c4d04], eax
test eax, eax
je 0x47f6a8
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4c4d00], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x47f6d0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x47f6c3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x47f6e5
push 4
pop eax
jmp 0x47f78d
cmp dword [ebp - 0x14], esi
je 0x47f6e5
push dword [0x4c4cf4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x47f6ca
mov eax, dword [0x4c4d00]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x47f743
cmp dword [0x4c4d04], edi
je 0x47f743
push eax
call ebx
push dword [0x4c4d04]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x47f743
test eax, eax
je 0x47f743
call ecx
test eax, eax
je 0x47f738
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x47f738
test byte [ebp - 8], 1
jne 0x47f743
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x47f773
mov eax, dword [0x4c4cf8]
cmp eax, edi
je 0x47f770
push eax
call ebx
test eax, eax
je 0x47f770
call eax
mov esi, eax
test esi, esi
je 0x47f770
mov eax, dword [0x4c4cfc]
cmp eax, edi
je 0x47f770
push eax
call ebx
test eax, eax
je 0x47f770
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4c4cf4]
call ebx
test eax, eax
je 0x47f78b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x47f78d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00477ba9
mov esp, ebp
pop ebp
ret
Function at 0x4024e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push edi
mov edi, dword [esp + 0x14]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebp, eax
test ebp, ebp
jne 0x40250a
pop edi
pop ebp
xor eax, eax
pop ebx
ret
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402504
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40254a
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x402546
cmp esi, ecx
jae 0x40254a
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x402534
cmp esi, ecx
jb 0x402551
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
pop ebx
ret

Function at 0x402660
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
xor dl, dl
push ebx
push ebp
mov ebp, ecx
push esi
push edi
test eax, eax
je 0x402754
test eax, 0xffff0000
jne 0x402754
movzx edi, ax
push edi
call fcn.004310c8
mov ebx, eax
test ebx, ebx
je 0x402752
mov eax, edi
shr eax, 4
push 6
inc eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [esp + 0x14], eax
test eax, eax
je 0x402752
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402752
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402752
push dword [esp + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x4026f4
cmp esi, ecx
jae 0x402752
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x4026e2
cmp esi, ecx
jae 0x402752
movzx eax, word [esi]
test ax, ax
je 0x402752
mov edx, dword [ebp]
mov edi, eax
mov ebx, eax
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x402726
push edi
mov ecx, ebp
call fcn.00402b70
mov edx, dword [ebp]
movzx ebx, word [esi]
movzx ecx, bx
lea eax, [esi + 2]
push ecx
push eax
push edi
push edx
call fcn.0044ef63
push eax
call fcn.00402cb0
mov eax, dword [ebp]
add esp, 0x14
cmp edi, dword [eax - 8]
jg 0x40275d
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebp]
mov word [eax + edi*2], cx
mov dl, 1
pop edi
pop esi
pop ebp
mov al, dl
pop ebx
ret 4
push 0x80070057
call fcn.00402d40
int3
Function at 0x4081f3
Capabilities:
Get number of processors

Disassembly:
and edi, 0x7e2b
call 0x4081b5
add byte [ebx], dh
inc edi
aas
cmp eax, dword ds:[eax + 0x4c]
xor eax, 0x4c48342
jmp 0x4081be
pop edi
push esi
push eax
add esp, 4
and esi, 0x11879
add esi, 0xdd9d
pop esi
mov ecx, dword [ebp - 0x23c]
mov dword [ebp - 0xe48], ecx
push edx
xor edx, 0x4ed6
call 0x4081f3
add byte [ebp + 0x48], cl
inc ecx
aas
inc esp
dec edx
dec edx
dec edx
dec esi
add esp, 4
add edx, 0x8c9a
pop edx
push edx
push edi
add esp, 4
or edx, 0xa8a3
or edx, 0xdcc0
pop edx
mov edx, dword [ebp - 0xe48]
mov dword [ebp - 0xe4c], edx
lea eax, [ebp - 0xc50]
push eax
call dword [ebp - 0xe4c]
test eax, eax
jne 0x40826d
push ecx
push edi
add esp, 4
sub ecx, 0x3f5
add ecx, 0x1312b
add ecx, 0x2852
and ecx, 0x142e2
pop ecx
push eax
sub eax, 0x16a90
add byte [eax + 0x50], bl
push edx
add esp, 4
sub eax, 0x4d0e
pop eax
mov dword [ebp - 0x418], 0
jmp 0x408958
Function at 0x408289
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x3d4]
add eax, 1
mov dword [ebp - 0x3d4], eax
mov ecx, dword [ebp - 0x3d0]
mov edx, dword [ebp - 0x3d4]
cmp edx, dword [ecx + 0x18]
jae 0x408186
mov eax, dword [ebp - 0x3d4]
mov ecx, dword [ebp - 0xe38]
mov edx, dword [ebp - 0x1b4]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x3d8], edx
mov eax, dword [ebp - 0x3d4]
mov ecx, dword [ebp - 0xe3c]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0xe40]
mov ecx, dword [ebp - 0x1b4]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0xe44], ecx
mov dword [ebp - 0xcc], 0
jmp 0x407fea
mov edx, dword [ebp - 0xcc]
add edx, 1
mov dword [ebp - 0xcc], edx
mov eax, dword [ebp - 0x3d8]
add eax, dword [ebp - 0xcc]
movsx ecx, byte [eax]
test ecx, ecx
je 0x40809c
mov edx, dword [ebp - 0xcc]
movsx eax, byte [ebp + edx - 0x4c0]
test eax, eax
je 0x40809c
push ebx
add ebx, 0x15e0d
jmp 0x408025
jmp 0x40802a
pop ebx
push ebx
push ecx
add esp, 4
sub ebx, 0xbf90
add ebx, 0xcedd
xor ebx, 0x8fb9
add ebx, 0x151c3
pop ebx
mov ecx, dword [ebp - 0x3d8]
add ecx, dword [ebp - 0xcc]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0xcc]
movsx ecx, byte [ebp + eax - 0x4c0]
cmp edx, ecx
je 0x40808e
mov edx, dword [ebp - 0x3d8]
add edx, dword [ebp - 0xcc]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0xcc]
movsx edx, byte [ebp + ecx - 0x4c0]
cmp eax, edx
jne 0x408095
jmp 0x407fdb
jmp 0x40809c
push esi
sub esi, 0xf3f3
and esi, 0xaa67
pop esi
push edi
push esi
add esp, 4
add edi, 0x182c4
jmp 0x4080bc
call 0x4080ca
add byte [ebx + 0x40], cl
inc esp
cmp dword [esi], esi
cmp eax, 0xc4833b4b
add al, 0x5f
mov eax, dword [ebp - 0x3d8]
add eax, dword [ebp - 0xcc]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0xcc]
movsx eax, byte [ebp + edx - 0x4c0]
cmp ecx, eax
jne 0x4080fb
mov dword [ebp - 0x6c0], 0
jmp 0x40816a
push esi
push ecx
add esp, 4
xor esi, 0x3597
add esi, 0xb3cd
pop esi
push ebx
push edx
add esp, 4
xor ebx, 0xc011
pop ebx
push edx
or edx, 0x184d0
or edx, 0xa0d8
or edx, 0x152f4
pop edx
mov ecx, dword [ebp - 0x3d8]
add ecx, dword [ebp - 0xcc]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0xcc]
movsx ecx, byte [ebp + eax - 0x4c0]
or ecx, 0x20
cmp edx, ecx
jge fcn.00408160
mov dword [ebp - 0x6c0], 0xffffffff
jmp 0x40816a
mov dword [ebp - 0x6c0], 1
cmp dword [ebp - 0x6c0], 0
jne 0x408181
mov edx, dword [ebp - 0xe44]
mov dword [ebp - 0x23c], edx
jmp 0x408192
jmp 0x407f6b
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x40826d
push edi
push ecx
jmp 0x408275
jmp 0x40827b
pop ecx
push ecx
call 0x408289
add byte [ecx], bh
xor bh, byte [ebx]
dec ecx
cmp esi, dword [edi]
add esp, 4
sub ecx, 0x6523
add ecx, 0x12943
and ecx, 0xc66e
pop ecx
mov ecx, dword fs:[0x18]
mov ecx, dword [0x18]
mov dword [ebp - 0xe50], ecx
mov edx, dword [ebp - 0xe50]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xe54], eax
invalid
invalid
lodsb al, byte [esi]
int1
invalid
Function at 0x4082a0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x3d4]
add eax, 1
mov dword [ebp - 0x3d4], eax
mov ecx, dword [ebp - 0x3d0]
mov edx, dword [ebp - 0x3d4]
cmp edx, dword [ecx + 0x18]
jae 0x408186
mov eax, dword [ebp - 0x3d4]
mov ecx, dword [ebp - 0xe38]
mov edx, dword [ebp - 0x1b4]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x3d8], edx
mov eax, dword [ebp - 0x3d4]
mov ecx, dword [ebp - 0xe3c]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0xe40]
mov ecx, dword [ebp - 0x1b4]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0xe44], ecx
mov dword [ebp - 0xcc], 0
jmp 0x407fea
mov edx, dword [ebp - 0xcc]
add edx, 1
mov dword [ebp - 0xcc], edx
mov eax, dword [ebp - 0x3d8]
add eax, dword [ebp - 0xcc]
movsx ecx, byte [eax]
test ecx, ecx
je 0x40809c
mov edx, dword [ebp - 0xcc]
movsx eax, byte [ebp + edx - 0x4c0]
test eax, eax
je 0x40809c
push ebx
add ebx, 0x15e0d
jmp 0x408025
jmp 0x40802a
pop ebx
push ebx
push ecx
add esp, 4
sub ebx, 0xbf90
add ebx, 0xcedd
xor ebx, 0x8fb9
add ebx, 0x151c3
pop ebx
mov ecx, dword [ebp - 0x3d8]
add ecx, dword [ebp - 0xcc]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0xcc]
movsx ecx, byte [ebp + eax - 0x4c0]
cmp edx, ecx
je 0x40808e
mov edx, dword [ebp - 0x3d8]
add edx, dword [ebp - 0xcc]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0xcc]
movsx edx, byte [ebp + ecx - 0x4c0]
cmp eax, edx
jne 0x408095
jmp 0x407fdb
jmp 0x40809c
push esi
sub esi, 0xf3f3
and esi, 0xaa67
pop esi
push edi
push esi
add esp, 4
add edi, 0x182c4
jmp 0x4080bc
call 0x4080ca
add byte [ebx + 0x40], cl
inc esp
cmp dword [esi], esi
cmp eax, 0xc4833b4b
add al, 0x5f
mov eax, dword [ebp - 0x3d8]
add eax, dword [ebp - 0xcc]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0xcc]
movsx eax, byte [ebp + edx - 0x4c0]
cmp ecx, eax
jne 0x4080fb
mov dword [ebp - 0x6c0], 0
jmp 0x40816a
push esi
push ecx
add esp, 4
xor esi, 0x3597
add esi, 0xb3cd
pop esi
push ebx
push edx
add esp, 4
xor ebx, 0xc011
pop ebx
push edx
or edx, 0x184d0
or edx, 0xa0d8
or edx, 0x152f4
pop edx
mov ecx, dword [ebp - 0x3d8]
add ecx, dword [ebp - 0xcc]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0xcc]
movsx ecx, byte [ebp + eax - 0x4c0]
or ecx, 0x20
cmp edx, ecx
jge fcn.00408160
mov dword [ebp - 0x6c0], 0xffffffff
jmp 0x40816a
mov dword [ebp - 0x6c0], 1
cmp dword [ebp - 0x6c0], 0
jne 0x408181
mov edx, dword [ebp - 0xe44]
mov dword [ebp - 0x23c], edx
jmp 0x408192
jmp 0x407f6b
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x40826d
push edi
push ecx
jmp 0x408275
jmp 0x40827b
pop ecx
push ecx
call 0x408289
add byte [ecx], bh
xor bh, byte [ebx]
dec ecx
cmp esi, dword [edi]
add esp, 4
sub ecx, 0x6523
add ecx, 0x12943
and ecx, 0xc66e
pop ecx
mov ecx, dword fs:[0x18]
mov ecx, dword [0x18]
mov dword [ebp - 0xe50], ecx
mov edx, dword [ebp - 0xe50]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xe54], eax
invalid
invalid
lodsb al, byte [esi]
int1
invalid
Function at 0x4264d0
Capabilities:
Read .ini file

Disassembly:
movzx ecx, byte [esp + 8]
push esi
mov eax, ecx
shl eax, 8
push edi
push dword [esp + 0x14]
or eax, ecx
shl eax, 8
or eax, ecx
push eax
push dword [esp + 0x14]
push str.Color
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [esp + 0xc]
or edi, 0xffffffff
movzx esi, al
add edx, 0xfffffff0
movzx ecx, ax
shl esi, 8
shr ecx, 8
or esi, ecx
shr eax, 0x10
movzx eax, al
shl esi, 8
or esi, eax
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42652e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x426547
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
pop edi
mov eax, esi
pop esi
ret 0xc

Function at 0x429cc0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x210
mov eax, dword [0x486540]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push esi
xor eax, eax
mov dword [esp + 0x10], 0
push edi
mov word [esp + 0x18], ax
mov esi, ecx
lea eax, [esp + 0x14]
mov dword [esp + 0xc], 0
push eax
push esi
mov ebx, edx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
xor ecx, ecx
mov dword [esp + 0x10], eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004308df
add esp, 4
mov edi, eax
push edi
push dword [esp + 0x14]
push 0
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x429dc3
mov esi, dword [sym.imp.VERSION.dll_VerQueryValueW]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
push 0x473a80
push edi
call esi
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
push 0x479350
push edi
call esi
mov eax, dword [esp + 0xc]
push 0x479384
mov ecx, dword [eax]
mov eax, ecx
shr eax, 0x10
push eax
movzx eax, cx
push eax
lea eax, [esp + 0x24]
push str.StringFileInfo_04X_04X_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x20]
push eax
push edi
call esi
push dword [esp + 0xc]
lea eax, [esp + 0x1c]
push 0x100
push eax
call fcn.0045210f
add esp, 0xc
test ebx, ebx
je 0x429dc3
push dword [esp + 0xc]
push 0x100
push ebx
call fcn.0045210f
add esp, 0xc
push edi
call fcn.004308da
add esp, 4
lea eax, [esp + 0x18]
mov ecx, 0x4733b8
pop edi
pop esi
pop ebx
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x429dfe
test dx, dx
je 0x429dfa
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x429dfe
add eax, 4
add ecx, 4
test dx, dx
jne 0x429dd8
xor eax, eax
jmp 0x429e03
sbb eax, eax
or eax, 1
test eax, eax
je 0x429e34
lea eax, [esp + 0xc]
push eax
call fcn.0045607f
fmul qword [0x47bae0]
add esp, 4
call fcn.0044bd70
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.0044b35e
add esp, 0x210
ret
mov ecx, dword [esp + 0x20c]
xor eax, eax
xor ecx, esp
call fcn.0044b35e
add esp, 0x210
ret
Function at 0x45a247
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4713d4
push 0x4713cc
push str.FlsAlloc
push 0x1e
call fcn.0045a0c8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x45a27b
push dword [ebp + 8]
mov ecx, esi
call dword [0x46a694]
call esi
jmp 0x45a281
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x45a2c5
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4713e4
push 0x4713dc
push str.FlsGetValue
push 0x20
call fcn.0045a0c8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x45a2fc
push dword [ebp + 8]
mov ecx, esi
call dword [0x46a694]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x459080
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x53000]
push edi
jmp 0x45909a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4590a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x459090
mov eax, 1
add ebx, ebx
jne 0x4590b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4590a8
jne 0x4590c4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4590a8
xor ecx, ecx
sub eax, 3
jb 0x4590d8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45914a
mov ebp, eax
add ebx, ebx
jne 0x4590e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4590f0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x459114
inc ecx
add ebx, ebx
jne 0x459100
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4590f5
jne 0x459111
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4590f5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x459134
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x459125
jmp 0x459096
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x459134
add edi, ecx
jmp 0x459096
pop esi
mov edi, esi
mov ecx, 0x278
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x459152
cmp byte [edi], 0
jne 0x459152
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x459157
lea edi, [esi + 0x57000]
mov eax, dword [edi]
or eax, eax
je 0x4591cf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5bf14]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5bfcc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x459184
mov ecx, edi
jns 0x4591b3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5bfd4]
or eax, eax
je 0x4591c9
mov dword [ebx], eax
add ebx, 4
jmp 0x4591a1
call dword [esi + 0x5bfd0]
mov ebp, dword [esi + 0x5bfd8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x459203
sub esp, 0xffffff80
jmp 0x403814