joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401def
Capabilities:
Delete file
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push 0
push 0
call dword [sym.imp.MSVCR80.dll__tempnam]
mov esi, dword [sym.imp.MSVCR80.dll___iob_func]
mov ebp, eax
mov dword [esp + 0x1c], ebp
call esi
mov edi, dword [sym.imp.MSVCR80.dll_freopen]
add eax, 0x40
push eax
mov ebx, 0x4078c0
push ebx
push ebp
call edi
call esi
add eax, 0x20
push eax
push ebx
push ebp
call edi
add esp, 0x20
mov ebx, 0x40c920
call fcn.00401a09
mov edi, eax
test edi, edi
jne 0x401e50
push str.Cant_load_Python_for_pre_install_script
call fcn.00401613
or eax, 0xffffffff
jmp 0x401f45
push dword [esp + 0x20]
call fcn.00401d60
pop ecx
push edi
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
mov edi, dword [sym.imp.MSVCR80.dll_fflush]
add eax, 0x40
push eax
call edi
call esi
mov ebp, dword [sym.imp.MSVCR80.dll_fclose]
add eax, 0x40
push eax
call ebp
call esi
add eax, 0x20
push eax
call edi
call esi
add eax, 0x20
push eax
call ebp
add esp, 0x10
cmp dword [esp + 0x18], 0
je 0x401f37
push str.Running_the_pre_installation_script_failed_r_n
call sub.MSVCR80.dll_strlen
mov dword [esp], 0x407860
push dword [esp + 0x18]
mov edi, eax
call dword [sym.imp.MSVCR80.dll_fopen]
mov esi, dword [sym.imp.MSVCR80.dll_fseek]
push 2
mov ebx, eax
push 0
push ebx
call esi
push ebx
call dword [sym.imp.MSVCR80.dll_ftell]
push 0
push 0
push ebx
mov dword [esp + 0x34], eax
call esi
mov eax, dword [esp + 0x34]
lea eax, [eax + edi + 1]
push eax
call dword [sym.imp.MSVCR80.dll_malloc]
mov esi, eax
add esp, 0x28
test esi, esi
je 0x401f2c
push str.Running_the_pre_installation_script_failed_r_n
push esi
call sub.MSVCR80.dll_strcpy
push ebx
push dword [esp + 0x1c]
lea eax, [esi + edi]
push 1
push eax
call dword [sym.imp.MSVCR80.dll_fread]
add eax, esi
push ebx
mov byte [eax + edi], 0
call ebp
push esi
call fcn.00401613
push esi
call dword [sym.imp.MSVCR80.dll_free]
add esp, 0x24
jmp 0x401f37
push str.Out_of_memory_
call fcn.00401613
pop ecx
push dword [esp + 0x14]
call dword [sym.imp.MSVCR80.dll_remove]
mov eax, dword [esp + 0x1c]
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x402142
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40216f
xor eax, eax
jmp 0x4021bd
push ebx
lea eax, [ebp - 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
push esi
push esi
push 2
push esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], eax
call edi
cmp dword [ebp - 4], 0xffffffff
jne 0x4021a0
xor eax, eax
jmp 0x4021bc
push esi
push esi
push esi
push 4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push dword [ebp - 4]
mov esi, eax
call edi
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
mov eax, esi
pop ebx
pop edi
pop esi
leave
ret
Function at 0x40220d
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x40c17c]
xor eax, ebp
mov dword [ebp + 0x90], eax
mov eax, dword [ebp + 0x9c]
mov dword [ebp - 0x78], ecx
lea ecx, [edx + eax - 0x16]
sub eax, dword [ecx + 0x10]
push esi
sub eax, dword [ecx + 0xc]
push edi
mov edi, dword [ebp + 0xa0]
sub eax, 0x22
lea esi, [edx + eax]
xor edx, edx
mov dword [edi], edx
mov dword [ebx], edx
cmp dword [ecx], 0x6054b50
mov dword [ebp - 0x80], edi
jne 0x40234d
cmp dword [esi], 0x1234567b
je 0x402277
push edx
mov edi, str.Invalid_cfgdata_magic_number__see_bdist_wininst.py_
call fcn.00401f4e
pop ecx
jmp 0x40234f
cmp eax, edx
jl 0x40234d
mov ecx, dword [esi + 8]
cmp ecx, edx
je 0x402293
mov edx, esi
sub edx, dword [esi + 4]
sub edx, ecx
mov dword [0x40ca30], edx
sub eax, dword [esi + 4]
mov ecx, dword [ebp - 0x78]
sub eax, dword [esi + 8]
mov edi, esi
mov dword [ecx], eax
sub edi, dword [esi + 4]
push 0x104
call dword [sym.imp.MSVCR80.dll_malloc]
test eax, eax
pop ecx
mov dword [ebp - 0x7c], eax
je 0x40234d
lea eax, [ebp - 0x74]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x40233b
push dword [ebp - 0x7c]
lea eax, [ebp - 0x74]
push 0
push 0x407940
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x40233b
xor eax, eax
push eax
push eax
push eax
push dword [esi + 4]
push eax
push dword [ebp - 0x7c]
push 2
call fcn.004010ab
add esp, 0x1c
test eax, eax
mov dword [ebp - 0x78], eax
je 0x40234d
push dword [esi + 4]
push edi
push eax
call dword [sym.imp.MSVCR80.dll_strncpy]
push dword [ebp - 0x78]
call sub.MSVCR80.dll_strlen
lea edi, [edi + eax + 1]
push edi
call dword [sym.imp.MSVCR80.dll__strdup]
mov ecx, dword [ebp - 0x80]
add esp, 0x14
push dword [ebp - 0x78]
mov dword [ecx], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor eax, eax
inc eax
jmp 0x40234f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edi, str.Could_not_create_temporary_file
call fcn.00401f4e
pop ecx
xor eax, eax
mov ecx, dword [ebp + 0x90]
pop edi
xor ecx, ebp
pop esi
call fcn.004065b0
add ebp, 0x94
leave
ret
Function at 0x409908
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424070]
jne 0x409912
repz ret
jmp fcn.0041156c

Function at 0x40c850
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40c85f
pop dword [ebp - 0x18]
mov eax, 0x42fcdeae
add eax, 0xbd43e9b1
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x51e8ddf0
sub dword [ebp - 0x28], 0x39698a5
mov dword [ebp - 0x24], 0x55292682
add dword [ebp - 0x24], 0xdd0a25c3
mov dword [ebp - 0x20], 0xed1968bb
add dword [ebp - 0x20], 0x5f32db73
mov dword [ebp - 0x1c], 0xf1d7d60
add dword [ebp - 0x1c], 0xf0e282a0
lea eax, [ebp - 0x28]
push eax
mov eax, 0x9c18e2f8
add eax, 0x6428dd58
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x666e0e67
add dword [ebp - 0x28], 0xe045aef
mov dword [ebp - 0x24], 0xc476b9a7
sub dword [ebp - 0x24], 0x830a5832
mov dword [ebp - 0x20], 0xee8987ee
add dword [ebp - 0x20], 0x74e5e47e
mov dword [ebp - 0x1c], 0xbb422204
add dword [ebp - 0x1c], 0x44bdddfc
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3eb12
push 0
call eax
mov ecx, 0x9dc8ba05
sub ecx, 0x9dc8656f
mov edi, eax
mov ebx, 0x9739ae48
add ebx, 0x69097bb8
add ebx, dword [ebp - 0x18]
mov esi, 0x3c2ec4a
add esi, 0xe8c41159
xor dword [ebp - 8], 0x3b48eaea
mov edx, dword [ebx]
add dword [ebp - 4], ecx
xor edx, esi
add dword [ebp - 0x10], 0xb9810943
mov dword [edi], edx
xor dword [ebp - 4], 0x242a9436
add edi, 4
add ebx, 0x1b100683
sub ebx, 0x1b10067f
loop 0x40c97c
add eax, 0xae30e1ef
add eax, 0x51d0633c
mov ebx, eax
add eax, 0xfacfcb05
sub eax, 0xfacfcb00
mov ecx, 0x6042bd50
add ecx, 0x9ffd42b0
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x401996
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
test ebx, ebx
sete dl
cmp dword [ebp + 8], 0
sete al
mov ecx, 0
or dl, al
jne 0x401ada
lea ecx, [edi*4 + 0xb]
mov edx, 0x2aaaaaab
mov eax, ecx
imul edx
sar edx, 1
mov eax, ecx
sar eax, 0x1f
sub edx, eax
lea edx, [edx*4 + 1]
cmp edx, dword [ebp + 0x14]
jle 0x401a3d
mov dword [esp], 0x6f
call 0x40c300
sub esp, 4
mov ecx, 0
jmp 0x401ada
movzx eax, byte [ecx]
and eax, 3
shl eax, 4
movzx eax, byte [eax + section.g4bkkmzc]
mov byte [ebx + 1], al
mov byte [ebx + 2], 0x3d
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
movzx eax, byte [ecx + 1]
and eax, 0xf
movzx eax, byte [eax*4 + section.g4bkkmzc]
mov byte [ebx + 2], al
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
mov esi, 0
mov ecx, dword [ebp + 8]
cmp esi, edi
jge 0x401ad2
movzx eax, byte [ecx]
shr al, 2
movzx eax, al
movzx eax, byte [eax + section.g4bkkmzc]
mov byte [ebx], al
mov eax, edi
sub eax, esi
cmp eax, 1
je 0x4019fc
movzx edx, byte [ecx]
and edx, 3
shl edx, 4
movzx eax, byte [ecx + 1]
shr al, 4
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.g4bkkmzc]
mov byte [ebx + 1], al
mov eax, edi
sub eax, esi
cmp eax, 2
je 0x401a1f
movzx edx, byte [ecx + 1]
and edx, 0xf
shl edx, 2
movzx eax, byte [ecx + 2]
shr al, 6
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.g4bkkmzc]
mov byte [ebx + 2], al
movzx eax, byte [ecx + 2]
and eax, 0x3f
movzx eax, byte [eax + section.g4bkkmzc]
mov byte [ebx + 3], al
add esi, 3
add ecx, 3
add ebx, 4
cmp esi, edi
jl 0x401a4d
mov byte [ebx], 0
mov ecx, 1
mov eax, ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x79842045
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43104e
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, str.b6y
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x362229c9
nop
nop
nop
test eax, eax
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x47f430
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5c000]
push edi
or ebp, 0xffffffff
jmp 0x47f452
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x47f459
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47f448
mov eax, 1
add ebx, ebx
jne 0x47f46b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x47f47c
jne 0x47f49b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47f49b
dec eax
add ebx, ebx
jne 0x47f488
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x47f460
add ebx, ebx
jne 0x47f497
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x47f4ed
xor ecx, ecx
sub eax, 3
jb 0x47f4b3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x47f522
sar eax, 1
mov ebp, eax
jmp 0x47f4be
add ebx, ebx
jne 0x47f4be
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47f48c
inc ecx
add ebx, ebx
jne 0x47f4cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47f48c
add ebx, ebx
jne 0x47f4d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x47f4ce
jne 0x47f4ea
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x47f4ce
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x47f50c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x47f4fe
jmp 0x47f44e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x47f50c
add edi, ecx
jmp 0x47f44e
pop esi
mov edi, esi
mov ecx, 0x1779
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x47f52a
cmp byte [edi], 0x13
jne 0x47f52a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x47f52f
lea edi, [esi + 0x7c000]
mov eax, dword [edi]
or eax, eax
je 0x47f5a7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x805e8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x806bc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x47f55c
mov ecx, edi
jns 0x47f58b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x806c4]
or eax, eax
je 0x47f5a1
mov dword [ebx], eax
add ebx, 4
jmp 0x47f579
call dword [esi + 0x806c0]
mov ebp, dword [esi + 0x806c8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x47f5db
sub esp, 0xffffff80
jmp 0x4033df
Function at 0x404b20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b4438
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x4fa008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
push 0x4cb3e0
mov eax, dword [ebx]
call dword [eax + 4]
mov esi, dword [ebp + 8]
mov eax, esi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x404cb0
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
and esi, 0xf
jbe 0x404ba2
movzx ecx, word [edi]
lea edi, [edi + ecx*2]
add edi, 2
sub esi, 1
jne 0x404b94
movzx esi, word [edi]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x18]
call fcn.00403cc0
add esi, esi
lea eax, [edi + 2]
push esi
push eax
push dword [ebp - 0x18]
call fcn.0049a3f0
mov eax, dword [ebp - 0x18]
add esp, 0xc
xor ecx, ecx
push dword [ebp + 0xc]
mov word [esi + eax], cx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov dword [ebp - 0x28], vtable.UnicodeStringStorage.0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 1
push eax
push 1
mov ecx, eax
call fcn.00403cc0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x4cb34c
push ecx
call fcn.0049a3f0
add esp, 0xc
mov byte [ebp - 4], 2
mov esi, 0x4cb34c
mov eax, dword [ebp - 0x18]
test eax, eax
cmovne esi, eax
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404c53
sub eax, edx
lea ecx, [ebp - 0x24]
sar eax, 1
push ecx
inc eax
push eax
call fcn.00403cc0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
sub eax, ecx
and eax, 0xfffffffe
push eax
push esi
push ecx
call fcn.0049a3f0
mov eax, dword [ebx]
add esp, 0xc
mov ecx, ebx
push 0x4cb34c
call dword [eax + 4]
mov eax, dword [ebx]
mov ecx, ebx
push dword [ebp - 0x24]
call dword [eax + 4]
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x28], vtable.UnicodeStringStorage.0
call fcn.00403b90
lea ecx, [ebp - 0x18]
call fcn.00403b90
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4085f0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b46e0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4fa008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
mov ecx, dword [eax]
mov edi, ecx
mov ebx, dword [ebp + 0x10]
mov al, 1
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 0x14], al
mov edx, dword [edi + 4]
cmp byte [edx + 0xd], 0
jne 0x40866b
mov ecx, dword [ebx]
mov eax, dword [edx + 0x10]
mov edi, edx
cmp ecx, eax
jb 0x40865b
ja 0x408654
mov eax, dword [ebx + 4]
cmp eax, dword [edx + 0x14]
jb 0x40865b
mov edx, dword [edx + 8]
xor al, al
jmp 0x40865f
mov edx, dword [edx]
mov al, 1
cmp byte [edx + 0xd], 0
mov byte [ebp - 0x14], al
je 0x408641
mov ecx, dword [ebp - 0x1c]
mov esi, edi
test al, al
je 0x40870b
cmp edi, dword [ecx]
jne 0x4086ab
push dword [ebp + 0x14]
push ecx
push edi
push 1
mov ecx, dword [ebp - 0x18]
lea eax, [ebp + 0x10]
push eax
call fcn.004083c0
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp byte [edi + 0xd], 0
je 0x4086b6
mov esi, dword [edi + 8]
jmp 0x40870b
mov eax, dword [edi]
cmp byte [eax + 0xd], 0
je 0x4086ed
mov eax, dword [edi + 4]
cmp byte [eax + 0xd], 0
jne 0x4086e3
mov ecx, edi
nop dword [eax]
mov edx, eax
cmp ecx, dword [eax]
jne 0x4086e3
mov esi, eax
mov ecx, edx
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x4086d0
cmp byte [esi + 0xd], 0
jne 0x40870b
mov esi, eax
jmp 0x40870b
mov esi, eax
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x40870b
nop dword [eax + eax]
mov esi, eax
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x408700
mov ecx, dword [ebx]
cmp dword [esi + 0x10], ecx
jb 0x40875f
ja 0x40871c
mov eax, dword [esi + 0x14]
cmp eax, dword [ebx + 4]
jb 0x40875f
mov ebx, dword [ebp + 0x14]
lea ecx, [ebx + 0x30]
call fcn.004069b0
lea ecx, [ebx + 0x24]
call fcn.004069b0
lea ecx, [ebx + 0x18]
call fcn.004069b0
push 0x3c
push ebx
call fcn.004971f4
mov eax, dword [ebp + 8]
add esp, 8
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push dword [ebp + 0x14]
push ecx
push edi
push dword [ebp - 0x14]
jmp 0x408680
Function at 0x408cc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b47ef
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4fa008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [ebp - 4], 0
lea eax, [edi + 0x10]
mov dword [edi], vtable.ControlCommandLine.0
lea esi, [eax + 4]
mov dword [ebp - 0x14], eax
mov dword [eax], vtable.StringStorage.0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push esi
push 1
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00403cc0
mov ecx, dword [esi]
mov eax, dword [esi + 4]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x4cb34c
push ecx
call fcn.0049a3f0
add esp, 0xc
lea eax, [edi + 0x20]
mov dword [ebp - 0x14], eax
lea esi, [eax + 4]
mov dword [eax], vtable.StringStorage.0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push esi
push 1
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.00403cc0
mov ecx, dword [esi]
mov eax, dword [esi + 4]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x4cb34c
push ecx
call fcn.0049a3f0
add esp, 0xc
lea eax, [edi + 0x30]
mov dword [ebp - 0x14], eax
lea esi, [eax + 4]
mov dword [eax], vtable.StringStorage.0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push esi
push 1
mov ecx, esi
mov byte [ebp - 4], 5
call fcn.00403cc0
mov ecx, dword [esi]
mov eax, dword [esi + 4]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x4cb34c
push ecx
call fcn.0049a3f0
add esp, 0xc
lea eax, [edi + 0x40]
mov dword [ebp - 0x14], eax
mov dword [eax], vtable.StringStorage.0
lea esi, [eax + 4]
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push esi
push 1
mov ecx, esi
mov byte [ebp - 4], 7
call fcn.00403cc0
mov ecx, dword [esi]
mov eax, dword [esi + 4]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x4cb34c
push ecx
call fcn.0049a3f0
add esp, 0xc
lea eax, [edi + 0x50]
mov dword [ebp - 0x14], eax
lea esi, [eax + 4]
mov dword [eax], vtable.StringStorage.0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push esi
push 1
mov ecx, esi
mov byte [ebp - 4], 9
call fcn.00403cc0
mov ecx, dword [esi]
mov eax, dword [esi + 4]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x4cb34c
push ecx
call fcn.0049a3f0
add esp, 0xc
mov dword [edi + 0x60], vtable.Rect.0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
lea eax, [edi + 0x78]
mov byte [edi + 0x74], 0
mov dword [ebp - 0x14], eax
lea esi, [eax + 4]
mov dword [eax], vtable.StringStorage.0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push esi
push 1
mov ecx, esi
mov byte [ebp - 4], 0xc
call fcn.00403cc0
mov ecx, dword [esi]
mov eax, dword [esi + 4]
sub eax, ecx
and eax, 0xfffffffe
push eax
push 0x4cb34c
push ecx
call fcn.0049a3f0
add esp, 0xc
mov dword [edi + 0x88], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40c440
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b4f68
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4fa008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0x86
mov dword [esi + 0xc], vtable.Control.0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x20], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.SetPasswordsDialog.0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], vtable.CheckBox.0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], vtable.CheckBox.0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], vtable.CheckBox.0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], vtable.TextBox.0
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], vtable.TextBox.0
mov dword [esi + 0x64], 0
mov dword [esi + 0x60], vtable.CheckBox.0
mov dword [esi + 0x70], 0
mov dword [esi + 0x6c], vtable.CheckBox.0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x78], vtable.CheckBox.0
mov dword [esi + 0x88], 0
mov dword [esi + 0x84], vtable.TextBox.0
mov dword [esi + 0x94], 0
mov dword [esi + 0x90], vtable.TextBox.0
lea edi, [esi + 0x9c]
mov byte [ebp - 4], 0xa
mov ecx, edi
call fcn.0044cae0
lea ebx, [esi + 0xc0]
mov byte [ebp - 4], 0xb
mov ecx, ebx
call fcn.0044cae0
lea ecx, [esi + 0xe4]
mov byte [ebp - 4], 0xc
call fcn.0044cae0
mov cl, byte [ebp + 8]
mov al, cl
mov byte [esi + 0x109], cl
xor al, 1
mov byte [esi + 0x108], al
lea eax, [esi + 0x10c]
mov dword [ebp + 8], eax
lea esi, [eax + 4]
mov dword [eax], vtable.StringStorage.0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push esi
push 1
mov ecx, esi
mov byte [ebp - 4], 0xe
call fcn.00403cc0
mov ecx, dword [esi]
mov eax, dword [esi + 4]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x4cb34c
push ecx
call fcn.0049a3f0
add esp, 0xc
mov eax, dword [ebp - 0x10]
mov word [eax + 0x11c], 1
add eax, 0x120
mov dword [ebp + 8], eax
lea esi, [eax + 4]
mov dword [eax], vtable.StringStorage.0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push esi
push 1
mov ecx, esi
mov byte [ebp - 4], 0x10
call fcn.00403cc0
mov ecx, dword [esi]
mov eax, dword [esi + 4]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x4cb34c
push ecx
call fcn.0049a3f0
add esp, 0xc
mov byte [ebp - 4], 0x11
mov ecx, 0x9c57
mov esi, dword [edi]
call fcn.0044e2b0
push eax
mov ecx, edi
call dword [esi + 8]
mov esi, dword [edi]
mov ecx, 0x9c55
call fcn.0044e2b0
push eax
mov ecx, edi
call dword [esi + 0xc]
mov esi, dword [ebx]
mov ecx, 0x9c58
call fcn.0044e2b0
push eax
mov ecx, ebx
call dword [esi + 8]
mov esi, dword [ebx]
mov ecx, 0x9c55
call fcn.0044e2b0
push eax
mov ecx, ebx
call dword [esi + 0xc]
mov edi, dword [ebp - 0x10]
mov ecx, 0x9ca7
mov esi, dword [edi + 0xe4]
call fcn.0044e2b0
push eax
lea ecx, [edi + 0xe4]
call dword [esi + 8]
mov esi, dword [edi + 0xe4]
mov ecx, 0x9ca8
call fcn.0044e2b0
push eax
lea ecx, [edi + 0xe4]
call dword [esi + 0xc]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8