joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f3a0
Capabilities:
Inspect load icon resource

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
call fcn.004491a6
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x31
push dword [ebx + 0x210]
call edi
push eax
call fcn.0044ef8c
lea esi, [ebx + 0xd0]
push esi
push 0x3c
push dword [eax + 4]
call dword [sym.imp.GDI32.dll_GetObjectA]
mov eax, dword [esi]
add eax, eax
mov dword [esi], eax
mov eax, dword [ebx + 0xd4]
add eax, eax
mov dword [ebx + 0xd4], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x62b5c0]
cmp eax, dword [ecx + 4]
jle 0x40f44b
push 0x62b5c0
call fcn.0057e2e6
add esp, 4
cmp dword [0x62b5c0], 0xffffffff
jne 0x40f44b
xorps xmm0, xmm0
movq qword [0x62b5c4], xmm0
push 0x5b6360
mov dword [0x62b5c8], 0
mov dword [0x62b5c4], 0x5b8f7c
call fcn.0057e010
push 0x62b5c0
call fcn.0057e2a7
add esp, 8
push esi
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
mov ecx, 0x62b5c4
call fcn.0044ece7
push 1
push dword [0x62b5c8]
push 0x30
push dword [ebx + 0x210]
call edi
push 1
push dword [0x62b5c8]
push 0x30
push dword [ebx + 0x290]
call edi
push 0x3e9
mov ecx, ebx
call fcn.00450378
push 1
push dword [0x62b5c8]
push 0x30
push dword [eax + 0x20]
call edi
mov ecx, 0x62b5c4
call fcn.0044eeb3
push 0
push 0
push 0x20
push 0x20
lea esi, [ebx + 0x10c]
push 0x20
mov ecx, esi
call fcn.0045ef78
push 0xffffff
push dword [ebx + 0x110]
call dword [sym.imp.COMCTL32.dll_ImageList_SetBkColor]
call fcn.0045ab94
call fcn.0045ab94
push 0x8d
mov eax, dword [eax + 0xc]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
push eax
push 0xffffffffffffffff
push dword [ebx + 0x110]
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
test esi, esi
jne 0x40f4fe
xor eax, eax
jmp 0x40f501
mov eax, dword [esi + 4]
push eax
push 1
push 0x1003
push dword [ebx + 0x210]
call edi
push eax
call fcn.0045f126
push 0x20
push 0
push 0x1036
push dword [ebx + 0x210]
call edi
push 0xffffffffffffffff
push 0x12c
push 0x800
push 0x5ed400
push 0
lea ecx, [ebx + 0x1f0]
call fcn.0045f37f
lea esi, [ebx + 0x114]
push esi
push dword [ebx + 0x290]
call dword [sym.imp.USER32.dll_GetClientRect]
add dword [ebx + 0x118], 0x28
lea edi, [ebx + 0x124]
add dword [ebx + 0x120], 0xfffffffb
xor eax, eax
add dword [esi], 0xa
mov ecx, 0x32
add dword [ebx + 0x11c], 0xfffffffb
rep stosd dword es:[edi], eax
mov ecx, ebx
call fcn.0040f5e0
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x414d50
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x474
mov eax, dword [0x617e6c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x400
lea eax, [ebp - 0x404]
mov dword [ebp - 0x470], 0x67452301
xorps xmm0, xmm0
mov dword [ebp - 0x46c], 0xefcdab89
push 0
push eax
mov esi, ecx
movq qword [ebp - 0x460], xmm0
mov dword [ebp - 0x468], 0x98badcfe
mov dword [ebp - 0x464], 0x10325476
call fcn.00581040
push 0x5eff90
lea eax, [ebp - 0x474]
push esi
push eax
call fcn.0058ca46
mov eax, dword [ebp - 0x474]
add esp, 0x18
pop esi
test eax, eax
je 0x414e55
push eax
push 0x400
lea eax, [ebp - 0x404]
push 1
push eax
call fcn.005929a6
add esp, 0x10
test eax, eax
je 0x414e23
nop dword [eax + eax]
push eax
lea eax, [ebp - 0x404]
push eax
lea ecx, [ebp - 0x470]
call fcn.00414e70
push dword [ebp - 0x474]
lea eax, [ebp - 0x404]
push 0x400
push 1
push eax
call fcn.005929a6
add esp, 0x10
test eax, eax
jne 0x414df0
lea ecx, [ebp - 0x470]
call fcn.00414f20
push dword [ebp - 0x474]
call fcn.0058cd93
add esp, 4
lea ecx, [ebp - 0x418]
call fcn.00414cb0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057dd8f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0057dd8f
mov esp, ebp
pop ebp
ret
Function at 0x417520
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a76fd
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x617e6c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0xc], 0
mov dword [ebp - 0x14], esi
mov dword [esi + 0x14], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 2
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [esi], vtable.CryptoPP::PK_DefaultEncryptionFilter.1.0
mov dword [esi + 4], vtable.CryptoPP::PK_DefaultEncryptionFilter.0
mov dword [esi + 0x20], eax
push 0x18
mov dword [esi + 0x24], vtable.CryptoPP::ByteQueue.1.0
mov dword [esi + 0x28], vtable.CryptoPP::ByteQueue.0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [esi + 0x30], 1
mov dword [esi + 0x34], 0x100
call fcn.00439ea8
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 5
test edi, edi
je 0x4175ed
mov ecx, dword [esi + 0x34]
mov dword [edi + 8], ecx
test ecx, ecx
jne 0x4175cf
xor eax, eax
jmp 0x4175d4
call fcn.004325f0
mov dword [edi + 0xc], eax
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi], 0
jmp 0x4175ef
xor edi, edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov byte [ebp - 4], 0xb
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x41761c
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [ebp + 0x10]
mov dword [esi + 0xc], ecx
jmp 0x417622
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x418980
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a6136
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x617e6c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esi + 0x30]
xor al, al
mov ecx, dword [esi + 0x2c]
mov edi, edx
rep stosb byte es:[edi], al
push edx
call fcn.0058dbee
add esp, 4
mov dword [ebp - 4], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4189cf
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x4189e0
push 0x44
push esi
call fcn.0057e048
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x432020
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
xor ebx, ebx
push edi
mov edi, esi
mov ebp, ecx
shr edi, 2
mov dword [esp + 0x14], edi
test edi, edi
je 0x4320c7
cmp edi, 8
jb 0x4320a0
lea eax, [edx - 4]
lea eax, [eax + edi*4]
lea ecx, [ebp - 4]
lea ecx, [ecx + edi*4]
cmp ebp, eax
ja 0x432059
cmp ecx, edx
jae 0x4320a0
mov ecx, edi
lea eax, [ebp + 0x10]
mov esi, edx
and ecx, 0xfffffff8
sub esi, ebp
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [edx + ebx*4]
add ebx, 8
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm1, xmmword [edi + eax - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp ebx, ecx
jb 0x432071
mov edi, dword [esp + 0x14]
cmp ebx, edi
jae 0x4320c7
lea ecx, [ebx*4]
mov esi, edx
sub edi, ebx
add ecx, ebp
sub esi, ebp
add ebx, edi
mov eax, dword [ecx + esi]
lea ecx, [ecx + 4]
xor dword [ecx - 4], eax
sub edi, 1
jne 0x4320b5
mov esi, dword [esp + 0x1c]
shl ebx, 2
sub esi, ebx
je 0x432144
add ebp, ebx
add edx, ebx
xor edi, edi
test esi, esi
je 0x432144
cmp esi, 0x20
jb 0x43212b
lea eax, [edx - 1]
lea ecx, [ebp - 1]
add eax, esi
add ecx, esi
cmp ebp, eax
ja 0x4320ef
cmp ecx, edx
jae 0x43212b
mov ecx, esi
mov ebx, edx
and ecx, 0xffffffe0
mov eax, ebp
sub ebx, ebp
nop word [eax + eax]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebx - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm1, xmmword [edx + edi + 0x10]
add edi, 0x20
movups xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp edi, ecx
jb 0x432100
cmp edi, esi
jae 0x432144
sub edx, ebp
lea ecx, [edi + ebp]
sub esi, edi
mov al, byte [ecx + edx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub esi, 1
jne 0x432136
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x432380
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ebp, ecx
mov ecx, esi
mov dword [esp + 0xc], edx
push edi
shr ecx, 2
xor ebx, ebx
xor edi, edi
test ecx, ecx
je 0x432449
cmp ecx, 8
jb 0x432420
mov ebx, ecx
lea eax, [edx + 0x10]
mov esi, ebp
and ebx, 0xfffffff8
sub esi, edx
xorps xmm3, xmm3
mov dword [esp + 0x14], esi
movaps xmm2, xmm3
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
nop word [eax + eax]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ebp + edi*4]
add edi, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [edx + eax - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, ebx
jb 0x4323d0
mov edx, dword [esp + 0x10]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd ebx, xmm2
cmp edi, ecx
jae 0x432449
mov esi, ebp
lea edx, [edx + edi*4]
sub esi, dword [esp + 0x10]
sub ecx, edi
add edi, ecx
mov eax, dword [edx + esi]
lea edx, [edx + 4]
xor eax, dword [edx - 4]
or ebx, eax
sub ecx, 1
jne 0x432431
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
shl edi, 2
sub esi, edi
jne 0x43245f
pop edi
xor eax, eax
test ebx, ebx
pop esi
pop ebp
sete al
pop ebx
add esp, 0xc
ret
add edx, edi
mov eax, ebx
mov dword [esp + 0x10], edx
add ebp, edi
shr eax, 0x10
mov edx, ebx
shr edx, 0x18
xor edi, edi
or dl, al
mov eax, ebx
shr eax, 8
or dl, al
or dl, bl
mov dword [esp + 0x14], edx
test esi, esi
je 0x432536
cmp esi, 0x20
jb 0x432517
mov eax, dword [esp + 0x10]
mov ecx, esi
mov edx, ebp
and ecx, 0xffffffe0
sub edx, eax
xorps xmm3, xmm3
mov dword [esp + 0x18], edx
movaps xmm2, xmm3
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebx - 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
por xmm3, xmm1
movups xmm1, xmmword [edi + ebp + 0x10]
add edi, 0x20
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, ecx
jb 0x4324b2
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd eax, xmm2
or dl, al
mov ebx, dword [esp + 0x10]
cmp edi, esi
jae 0x432536
sub ebp, ebx
lea ecx, [edi + ebx]
sub esi, edi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
or dl, al
sub esi, 1
jne 0x432526
pop edi
pop esi
test dl, dl
pop ebp
sete al
pop ebx
add esp, 0xc
ret
Function at 0x435c70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a7ff9
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x617e6c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
cmp dword [0x62a3c8], 0
jne 0x435cbd
call fcn.004263d0
mov dword [0x62a3c8], 0x41bb20
mov esi, dword [ebp + 8]
mov ecx, 2
mov dword [esi], vtable.CryptoPP::Integer.0
mov dword [esi + 8], 2
call fcn.0042b620
mov ecx, 8
call fcn.004325f0
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0
mov dword [eax + 4], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
push 1
push dword [ebp + 0x10]
mov dword [ebp - 4], 0
mov ecx, edi
push dword [ebp + 0xc]
mov edx, dword [edi]
push esi
mov dword [ebp - 0x10], 1
call dword [edx + 0x30]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x439810
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
movaps xmm0, xmmword [eax]
lea edx, [esi - 1]
pxor xmm0, xmmword [edi]
movaps xmmword [eax], xmm0
cmp edx, 1
jbe 0x43985d
add edx, 0xfffffffe
lea ecx, [edi + 0x10]
shr edx, 1
inc edx
nop dword [eax]
movaps xmm0, xmmword [eax]
lea ecx, [ecx + 0x20]
aesenc xmm0, xmmword [ecx - 0x20]
movaps xmmword [eax], xmm0
aesenc xmm0, xmmword [ecx - 0x10]
movaps xmmword [eax], xmm0
sub edx, 1
jne 0x439840
movaps xmm0, xmmword [eax]
add esi, esi
aesenc xmm0, xmmword [edi + esi*8 - 0x10]
movaps xmmword [eax], xmm0
aesenclast xmm0, xmmword [edi + esi*8]
pop edi
movaps xmmword [eax], xmm0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x439880
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0x18]
sub esp, 8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
movaps xmm1, xmmword [eax]
movaps xmm0, xmmword [ecx]
mov eax, dword [ebp + 0x14]
pxor xmm0, xmm1
movaps xmmword [ecx], xmm0
movaps xmm0, xmmword [edx]
push esi
mov esi, dword [ebp + 0x10]
pxor xmm0, xmm1
movaps xmmword [edx], xmm0
push edi
mov edi, dword [ebp + 0x1c]
movaps xmm0, xmmword [esi]
pxor xmm0, xmm1
movaps xmmword [esi], xmm0
movaps xmm0, xmmword [eax]
pxor xmm0, xmm1
movaps xmmword [eax], xmm0
cmp edi, 1
jbe 0x43991d
mov edi, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
add edi, 0x10
dec ecx
mov dword [esp + 0xc], ecx
mov ecx, dword [ebp + 8]
nop
sub dword [esp + 0xc], 1
lea edi, [edi + 0x10]
movaps xmm1, xmmword [edi - 0x10]
movaps xmm0, xmmword [ecx]
aesenc xmm0, xmm1
movaps xmmword [ecx], xmm0
movaps xmm0, xmmword [edx]
aesenc xmm0, xmm1
movaps xmmword [edx], xmm0
movaps xmm0, xmmword [esi]
aesenc xmm0, xmm1
movaps xmmword [esi], xmm0
movaps xmm0, xmmword [eax]
aesenc xmm0, xmm1
movaps xmmword [eax], xmm0
jne 0x4398e0
mov edi, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
add edi, edi
movaps xmm0, xmmword [ecx]
movaps xmm1, xmmword [eax + edi*8]
mov eax, dword [ebp + 0x14]
aesenclast xmm0, xmm1
movaps xmmword [ecx], xmm0
movaps xmm0, xmmword [edx]
aesenclast xmm0, xmm1
movaps xmmword [edx], xmm0
movaps xmm0, xmmword [esi]
aesenclast xmm0, xmm1
movaps xmmword [esi], xmm0
movaps xmm0, xmmword [eax]
aesenclast xmm0, xmm1
pop edi
movaps xmmword [eax], xmm0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43bfb9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
mov eax, ecx
push edi
mov edi, esi
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], esi
je 0x43c003
call fcn.0045ab94
push 0xf0
push dword [ebp + 0xc]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
test eax, eax
je 0x43c000
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov edi, eax
test edi, edi
je 0x43c051
push edi
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov esi, eax
mov eax, dword [ebp - 4]
xor ebx, ebx
inc ebx
test esi, esi
je 0x43c02f
mov ecx, dword [eax]
push dword [ebp + 0x10]
push esi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call fcn.0057e819
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
test edi, edi
je 0x43c02f
push edi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x43c04f
mov eax, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [eax + 0xa0]
mov ecx, esi
call fcn.0057e819
mov ecx, edi
call esi
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x447eda
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x5a9781
call fcn.0057e856
mov eax, ecx
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp + 0x10]
xor edi, edi
mov ecx, dword [ebp + 0x14]
push edi
mov dword [ebx], edi
mov dword [ecx], edi
cmp dword [eax + 0x58], edi
je 0x447f84
push dword [ebp + 8]
mov ecx, eax
call fcn.0044820f
mov esi, eax
test esi, esi
je 0x448017
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], edi
push eax
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
test eax, eax
jne 0x447f6d
push edx
call fcn.00439ee4
pop ecx
lea ecx, [ebp - 0x14]
mov dword [ebx], eax
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x447f6d
xor edi, edi
inc edi
jmp 0x447f77
push dword [ebx]
call fcn.00439edf
pop ecx
mov dword [ebx], edi
lea ecx, [ebp - 0x24]
call fcn.00447d9f
jmp 0x448015
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [esi + 0x84]
mov ecx, esi
push eax
call fcn.0057e819
mov ecx, dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov esi, dword [eax - 0xc]
mov dword [ebp - 0x18], esi
test esi, esi
je 0x44800d
mov ecx, dword [ebp + 0x14]
mov eax, esi
shr eax, 1
push eax
mov dword [ecx], eax
call fcn.00439ee4
mov dword [ebx], eax
pop ecx
test esi, esi
jle 0x448007
mov esi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040e730
push edi
lea ecx, [ebp - 0x10]
lea ebx, [eax - 1]
shl bl, 4
sub bl, 0x41
call fcn.0040e730
add al, bl
mov edx, edi
test edx, edx
jns 0x447ff8
add edx, 1
sar edx, 1
mov ecx, dword [esi]
add edi, 2
mov byte [edx + ecx], al
cmp edi, dword [ebp - 0x18]
jl 0x447fcf
mov eax, dword [ebp - 0x10]
xor edi, edi
inc edi
lea ecx, [eax - 0x10]
call fcn.0040c4e0
mov eax, edi
call fcn.0057e81f
ret 0x10

Function at 0x44801f
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x448072
push esi
push dword [ebp + 8]
call fcn.0044820f
mov edi, eax
test edi, edi
jne 0x448042
mov eax, dword [ebp + 0x10]
jmp 0x448084
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x44803d
mov eax, dword [ebp - 8]
jmp 0x448084
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x448a7a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.0045ab94
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov edi, eax
test edi, edi
je 0x448ab1
push edi
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.00448ad2
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4507bd
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5ab839
call fcn.0057e856
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x4507e3
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x450842
call fcn.0044e0ae
push eax
lea ecx, [ebp - 0x10]
call fcn.0040c460
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call fcn.0057e819
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.00594664
push eax
call fcn.0040b770
add esp, 0x14
test esi, esi
je 0x450835
push esi
call fcn.00593970
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040c4e0
mov eax, ebx
call fcn.0057e81f
ret 8

Function at 0x453482
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x4534c7
call fcn.0045ab94
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
test eax, eax
je 0x4534c7
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov esi, eax
test esi, esi
je 0x4534e3
push esi
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0045ad43
mov ebx, eax
test edi, edi
je 0x4534e1
test esi, esi
je 0x4534e1
push esi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x453ec8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x453f86
cmp dword [esi + 0x20], 0
je 0x453f86
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x453f86
cmp dword [ebp + 8], 0
je 0x453f86
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.0045ab94
push 0x5baf40
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x453f57
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov edi, eax
test edi, edi
je 0x453f86
push edi
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.004f7a2c
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x453f77
test edi, edi
je 0x453f77
push edi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
test ebx, ebx
je 0x453f82
mov ecx, esi
call fcn.00453c6b
mov eax, ebx
jmp 0x453f88
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x45b098
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.004503b1
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x45b0d4
call fcn.0045b2ba
mov dword [esi + 0xc], 1
jmp 0x45b0d9
call fcn.0045b2ba
cmp dword [esi], 0
je 0x45b122
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x45b0fc
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.004500c0
jmp 0x45b10d
push 0xff
mov ecx, esi
call fcn.0040c640
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, esi
call fcn.0044834b
jmp 0x45b146
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x45b146
push dword [esi]
push dword [ebp - 4]
call fcn.00462942
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x45b20f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0045b2ba
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x45b257
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.004500c0
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0044834b
jmp 0x45b262
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00462942
pop edi
pop esi
pop ebp
ret 0xc