joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1200925c
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x1201c270
call fcn.1201a4d8
sub esp, 0x218
mov eax, dword [section..cdata]
push ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
mov ebx, ecx
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x214], esi
push 0x2001f
push eax
push dword [ebx]
lea ecx, [ebp - 0x214]
mov dword [ebp - 4], esi
call fcn.12011713
cmp eax, esi
jne 0x12009305
push edi
mov edi, dword [sym.imp.advapi32.dll_RegEnumKeyExW]
jmp 0x120092bc
lea eax, [ebp - 0x210]
push eax
call fcn.1200925c
cmp eax, esi
jne 0x12009304
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x100
call edi
test eax, eax
lea ecx, [ebp - 0x214]
je 0x120092ac
call fcn.12008556
push dword [ebp - 0x21c]
push dword [ebx]
call dword [sym.imp.advapi32.dll_RegDeleteKeyW]
pop edi
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.12008556
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.1201a428
leave
ret 4
Function at 0x1200b5c5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x1201c373
call fcn.1201a4d8
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x10], ebx
push 2
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x14], esi
jne 0x1200b622
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
test eax, eax
jg 0x1200b60d
call esi
mov esi, eax
jmp 0x1200b73b
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1200b73b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov edi, eax
cmp edi, ebx
je 0x1200b643
push edi
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
mov esi, eax
cmp esi, ebx
jne 0x1200b66b
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
test eax, eax
jg 0x1200b656
call esi
jmp 0x1200b730
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1200b732
push edi
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
cmp byte [ebx + esi], 0
mov edi, esi
je 0x1200b6da
lea edi, [ebx + 1]
cmp edi, 0x400
ja 0x1200b6a7
push edi
call fcn.12008405
test al, al
pop ecx
je 0x1200b6a7
mov eax, edi
add eax, 3
and eax, 0xfffffffc
call fcn.1201a440
mov dword [ebp + 8], esp
jmp 0x1200b6b3
push edi
lea ecx, [ebp - 0x10]
call fcn.12011713
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
test eax, eax
jne 0x1200b6c1
mov esi, 0x8007000e
jmp 0x1200b732
mov ecx, edi
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
mov byte [eax + ebx], 0
test edi, edi
jne 0x1200b6e2
xor eax, eax
jmp 0x1200b724
push edi
call dword [sym.imp.kernel32.dll_lstrlenA]
mov esi, eax
inc esi
lea ebx, [esi + esi]
cmp ebx, 0x400
ja 0x1200b713
push ebx
call fcn.12008405
test al, al
pop ecx
je 0x1200b713
mov eax, ebx
add eax, 3
and eax, 0xfffffffc
call fcn.1201a440
mov eax, esp
jmp 0x1200b71c
push ebx
lea ecx, [ebp - 0x10]
call fcn.12011713
push esi
push edi
push eax
call fcn.12011713
push dword [ebp + 0x14]
lea ecx, [ebp - 0x1c]
push eax
call fcn.12011713
mov esi, eax
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea ecx, [ebp - 0x10]
call fcn.12008e8b
mov eax, esi
lea esp, [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x12011713
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x12011722
pop dword [ebp - 0x10]
mov eax, 0x36308e61
add eax, 0xdbd088c1
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x3c37e
push 0
mov eax, 0xf560438
add eax, 0x2aa0c18
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x4175f358
add ecx, 0xbe8a5311
mov edi, eax
mov esi, 0xf2b8e854
sub esi, 0xe0b39854
add esi, dword [ebp - 0x10]
mov ebx, 0xc42182c8
xor dword [ebp - 8], edi
mov edx, dword [esi]
sub dword [ebp - 4], eax
add edx, ebx
add dword [ebp - 0xc], 0x2f6880a8
mov dword [edi], edx
add edi, 4
add esi, 0x90abea4b
add esi, 0x6f5415b9
loop 0x1201177b
add eax, 0x8d4e8e6c
sub eax, 0x8d4d81f5
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xf432b1ea
sub ecx, 0xe232b1ea
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x1201a428
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [section..cdata]
push edi
mov dword [ebp + 0x2a4], eax
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x80], 0xc0000409
lea eax, [ebp + 0x2ac]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
lea eax, [ebp + 0x2ac]
mov dword [ebp - 0x28], 0x10001
mov eax, dword [eax]
mov dword [ebp + 0x90], eax
lea eax, [ebp + 0x2ac]
mov dword [ebp + 0x9c], eax
push ss
pop dword [ebp + 0xa0]
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x2c], eax
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
push 0x502
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.1201a428
pop edi
add ebp, 0x2a8
leave
ret
cmp ecx, dword [section..cdata]
jne 0x1201a431
ret
jmp 0x1201a2f6

Function at 0x1201b100
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x12020684]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax + 0xc]
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x409908
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424070]
jne 0x409912
repz ret
jmp fcn.0041156c

Function at 0x41863d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x41864c
pop dword [ebp - 0x24]
mov eax, 0x1c202959
sub eax, 0x1bdea30d
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x1b5e5030
sub dword [ebp - 0x34], 0xcd0c0ae5
mov dword [ebp - 0x30], 0xf62bb496
sub dword [ebp - 0x30], 0xc3f86851
mov dword [ebp - 0x2c], 0x115fc621
add dword [ebp - 0x2c], 0x3aec7e0d
mov dword [ebp - 0x28], 0xd3f1082
add dword [ebp - 0x28], 0xf2c0ef7e
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x79836a45
add dword [ebp - 0x34], 0xfaeeff11
mov dword [ebp - 0x30], 0x47bd4308
sub dword [ebp - 0x30], 0x650e193
mov dword [ebp - 0x2c], 0xbc73014d
add dword [ebp - 0x2c], 0xa6fc6b1f
mov dword [ebp - 0x28], 0x7e5a098b
sub dword [ebp - 0x28], 0x7e5a098b
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x37736ff1
add eax, 0xc8ce505b
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3a8eb
push 0
call eax
mov ecx, 0x8e454162
add ecx, 0x71bb02b8
mov ebx, eax
mov edx, 0x432a00
add edx, dword [ebp - 0x24]
mov edi, 0x6b905f9
add edi, 0x69f084bd
xor dword [ebp - 0x20], 0x1b955cb6
mov esi, dword [edx]
add esi, edi
sub dword [ebp - 0x1c], 0xb9d280b3
mov dword [ebx], esi
add ebx, 0xef19f37a
sub ebx, 0xef19f376
add edx, 0xa7f5575f
sub edx, 0xa7f5575b
loop 0x418763
add eax, 0x1033b
mov ebx, eax
add eax, 0xafaa0710
sub eax, 0xafaa070b
mov ecx, 0x8b460e32
add ecx, 0x74f9f1ce
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x403203
pop dword [ebp - 4]
mov eax, 0x17b514da
add eax, 0xe88b1d29
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x16d4172e
sub dword [ebp - 0x14], 0xc881d1e3
mov dword [ebp - 0x10], 0x45df11bb
sub dword [ebp - 0x10], 0x13abc576
mov dword [ebp - 0xc], 0x8cad0cc6
sub dword [ebp - 0xc], 0x4060c898
mov dword [ebp - 8], 0x4de1635b
sub dword [ebp - 8], 0x4de1635b
lea eax, [ebp - 0x14]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0x9f276e0d
sub dword [ebp - 0x14], 0x2ab504b7
mov dword [ebp - 0x10], 0x80085da0
add dword [ebp - 0x10], 0xc16403d5
mov dword [ebp - 0xc], 0x699690f
sub dword [ebp - 0xc], 0xa329fca3
mov dword [ebp - 8], 0x70ef5370
add dword [ebp - 8], 0x8f10ac90
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, 0x71f458ad
add eax, 0x8e4c17fb
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x35585
push 0
call eax
mov ecx, 0x4301
xor ebx, ebx
add ebx, eax
mov esi, 0x410000
add esi, dword [ebp - 4]
mov edi, 0xe550dcbf
add edi, 0xebd50162
mov edx, dword [esi]
xor edx, edi
mov dword [ebx], edx
add ebx, 0x9b932451
sub ebx, 0x9b93244d
add esi, 0x690a4382
add esi, 0x96f5bc82
loop 0x403316
add eax, 0xeb96a03f
sub eax, 0xeb95a168
mov ebx, eax
add eax, 0x7cf446b6
sub eax, 0x7cf446b1
mov ecx, 0x3b952518
sub ecx, 0x3b552518
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x3a28536d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x3a28537c
pop dword [ebp - 0x10]
mov eax, 0x68d8dc7c
sub eax, 0x2eb08900
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xaacfca56
add dword [ebp - 0x20], 0xa3827af5
mov dword [ebp - 0x1c], 0xc2791fa2
add dword [ebp - 0x1c], 0x6fba2ca3
mov dword [ebp - 0x18], 0xfc584488
sub dword [ebp - 0x18], 0xb00c005a
mov dword [ebp - 0x14], 0xe31bde17
add dword [ebp - 0x14], 0x1ce421e9
lea eax, [ebp - 0x20]
push eax
mov eax, 0x91005d8
sub eax, 0xcee7f594
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x89fa76c
sub dword [ebp - 0x20], 0x942d3e16
mov dword [ebp - 0x1c], 0xf49e117b
add dword [ebp - 0x1c], 0x4cce4ffa
mov dword [ebp - 0x18], 0x33dd1e4e
add dword [ebp - 0x18], 0x2f924e1e
mov dword [ebp - 0x14], 0x42a919e1
sub dword [ebp - 0x14], 0x42a919e1
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3645d
push 0
call eax
mov ecx, 0x40cf
xor ebx, ebx
add ebx, eax
mov edx, 0x7c0f5b0b
add edx, 0xbe19d2f5
add edx, dword [ebp - 0x10]
mov edi, 0x85b24086
add edi, 0x4aa6b057
add dword [ebp - 4], 0xb4a57643
mov esi, dword [edx]
add dword [ebp - 8], 0x6e4234ab
xor esi, edi
sub dword [ebp - 8], 0x1ae48c24
mov dword [ebx], esi
add dword [ebp - 0xc], 0xad18c936
add ebx, 0x23bd088c
add ebx, 0xdc42f778
add edx, 0xde8cd43
add edx, 0xf21732c1
loop 0x3a285495
add eax, 0x9569fbc3
add eax, 0x6a96fa4c
mov ebx, eax
add eax, 0xe2614287
add eax, 0x1d9ebd7e
mov ecx, 0xb22a4ad
sub ecx, 0xd0faa4ad
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x3a287a35
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x42c
mov eax, 0x3a28b1b0
call fcn.3a28a102
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
call dword [0x3a28e770]
xor ebx, ebx
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], edi
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
cmp esi, ebx
mov byte [ebp - 4], 1
je 0x3a287af5
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x42c], eax
lea eax, [ebp - 0x42c]
push eax
call fcn.3a28536d
add esp, 0xc
test eax, eax
jl 0x3a287af5
mov edi, dword [ebp - 0x42c]
cmp edi, 0x400
jg 0x3a287ad7
push edi
call fcn.3a282e50
test al, al
pop ecx
je 0x3a287ad7
mov eax, edi
call fcn.3a28a1e1
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x3a287ae3
push edi
lea ecx, [ebp - 0x428]
call fcn.3a28536d
push dword [ebp - 0x424]
push edi
push esi
push eax
call fcn.3a28536d
cmp eax, ebx
jne 0x3a287b2c
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x3a287b0e
lea ecx, [ebp - 0x418]
call fcn.3a284831
lea ecx, [ebp - 0x428]
call fcn.3a282d72
mov eax, 0x8007000e
lea esp, [ebp - 0x448]
call fcn.3a28a15b
ret 0x10
push 2
push ebx
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x424], edi
jne 0x3a287b4e
call fcn.3a283f4e
mov esi, eax
jmp 0x3a287c4c
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x3a287b71
call fcn.3a283f4e
jmp 0x3a287c3e
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 0x41c], eax
je 0x3a287b67
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
mov dword [ebp - 0x420], esi
jae 0x3a287bca
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x3a287bb3
lea ecx, [ebp - 0x418]
call fcn.3a284831
mov esi, 0x8007000e
lea ecx, [ebp - 0x428]
call fcn.3a282d72
mov eax, esi
jmp 0x3a287b1e
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.3a28536d
mov dword [ebp - 4], 1
jmp 0x3a287bfc
cmp dword [ebp - 0x418], ebx
jne 0x3a287c0b
mov esi, 0x8007000e
jmp 0x3a287c40
push esi
push dword [ebp - 0x41c]
push esi
push dword [ebp - 0x418]
call fcn.3a28536d
mov eax, dword [ebp - 0x418]
add esp, 0x10
push dword [ebp + 0x14]
mov byte [eax + esi], bl
push dword [ebp - 0x418]
lea ecx, [ebp - 0x434]
call fcn.3a28536d
mov esi, eax
push dword [ebp - 0x424]
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x3a287bb8
lea ecx, [ebp - 0x418]
call fcn.3a284831
jmp 0x3a287bb8
Function at 0x414900
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ecx
dec dword [0x4aa8e8]
jne 0x41490e
call fcn.004147e0
mov ecx, dword [0x4ad214]
mov eax, dword [ecx]
add ecx, 4
mov dword [0x4ad214], ecx
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
and edx, 0xff3a58ad
shl edx, 7
xor eax, edx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov edx, eax
shr edx, 0x12
xor edx, eax
mov dword [esp], edx
fild dword [esp]
jns 0x414955
fadd qword [0x4a3f38]
fmul qword [0x4a3f78]
pop ecx
ret

Function at 0x4163f0
Capabilities:
Reference http user-agent string

Disassembly:
test esi, esi
je 0x416440
cmp byte [esi], 0
je 0x416440
push 0x49e0b4
mov eax, esi
call fcn.004752c0
add esp, 4
test eax, eax
je 0x416412
mov eax, 6
ret
push 0x49e0b8
mov eax, esi
call fcn.004752c0
add esp, 4
test eax, eax
je 0x41642b
mov eax, 3
ret
push str.HIDE
mov eax, esi
call fcn.004752c0
add esp, 4
neg eax
sbb eax, eax
inc eax
ret
mov eax, 1
ret
Function at 0x45c120
Capabilities:
Reference http user-agent string

Disassembly:
test esi, esi
je 0x45c374
cmp byte [esi], 0
je 0x45c374
push str.Text
push esi
call fcn.004883a1
add esp, 8
test eax, eax
jne 0x45c146
mov al, 1
ret
push str.Edit
push esi
call fcn.004883a1
add esp, 8
test eax, eax
jne 0x45c15b
mov al, 0xc
ret
push str.Button
push esi
call fcn.004883a1
add esp, 8
test eax, eax
jne 0x45c170
mov al, 4
ret
push str.Checkbox
push esi
call fcn.004883a1
add esp, 8
test eax, eax
jne 0x45c185
mov al, 5
ret
push str.Radio
push esi
call fcn.004883a1
add esp, 8
test eax, eax
jne 0x45c19a
mov al, 6
ret
push 0x4a2f18
push esi
call fcn.004883a1
add esp, 8
test eax, eax
je 0x45c371
push str.DropDownList
push esi
call fcn.004883a1
add esp, 8
test eax, eax
je 0x45c371
push str.ComboBox
push esi
call fcn.004883a1
add esp, 8
test eax, eax
jne 0x45c1db
mov al, 8
ret
push str.ListBox
push esi
call fcn.004883a1
add esp, 8
test eax, eax
jne 0x45c1f0
mov al, 9
ret
push str.ListView
push esi
call fcn.004883a1
add esp, 8
test eax, eax
jne 0x45c205
mov al, 0xa
ret
push str.TreeView
push esi
call fcn.004883a1
add esp, 8
test eax, eax
jne 0x45c21a
mov al, 0xb
ret
push str.UpDown
push esi
call fcn.004883a1
add esp, 8
test eax, eax
jne 0x45c22f
mov al, 0x10
ret
push str.Slider
push esi
call fcn.004883a1
add esp, 8
test eax, eax
jne 0x45c244
mov al, 0x11
ret
push str.Progress
push esi
call fcn.004883a1
add esp, 8
test eax, eax
jne 0x45c259
mov al, 0x12
ret
push 0x49ca0c
push esi
call fcn.004883a1
add esp, 8
test eax, eax
jne 0x45c26e
mov al, 0x13
ret
push str.Tab2
push esi
call fcn.004883a1
add esp, 8
test eax, eax
jne 0x45c283
mov al, 0x14
ret
push str.Tab3
push esi
call fcn.004883a1
add esp, 8
test eax, eax
jne 0x45c298
mov al, 0x15
ret
push str.GroupBox
push esi
call fcn.004883a1
add esp, 8
test eax, eax
jne 0x45c2ad
mov al, 3
ret
push 0x4a2f6c
push esi
call fcn.004883a1
add esp, 8
test eax, eax
je 0x45c36e
push str.Picture
push esi
call fcn.004883a1
add esp, 8
test eax, eax
je 0x45c36e
push str.DateTime
push esi
call fcn.004883a1
add esp, 8
test eax, eax
jne 0x45c2ee
mov al, 0xd
ret
push str.MonthCal
push esi
call fcn.004883a1
add esp, 8
test eax, eax
jne 0x45c303
mov al, 0xe
ret
push str.Hotkey
push esi
call fcn.004883a1
add esp, 8
test eax, eax
jne 0x45c318
mov al, 0xf
ret
push str.StatusBar
push esi
call fcn.004883a1
add esp, 8
test eax, eax
jne 0x45c32d
mov al, 0x19
ret
push str.ActiveX
push esi
call fcn.004883a1
add esp, 8
test eax, eax
jne 0x45c342
mov al, 0x16
ret
push str.Link
push esi
call fcn.004883a1
add esp, 8
test eax, eax
jne 0x45c357
mov al, 0x17
ret
push str.Custom
push esi
call fcn.004883a1
add esp, 8
neg eax
sbb al, al
and al, 0xe8
add al, 0x18
ret
mov al, 2
ret
mov al, 7
ret
xor al, al
ret
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x402ee4
pop dword [ebp - 8]
mov eax, 0x131fc7e5
add eax, 0xed2066ff
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x48f0491
add dword [ebp - 0x18], 0x49c340ba
mov dword [ebp - 0x14], 0xbddd8b2c
sub dword [ebp - 0x14], 0x8baa3ee7
mov dword [ebp - 0x10], 0x8e76b3c8
add dword [ebp - 0x10], 0xbdd59066
mov dword [ebp - 0xc], 0xc9ad22f3
add dword [ebp - 0xc], 0x3652dd0d
lea eax, [ebp - 0x18]
push eax
mov eax, 0x5ea6bd81
sub eax, 0x5e663c7d
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xc9e4f721
sub dword [ebp - 0x18], 0x55728dcb
mov dword [ebp - 0x14], 0x9ab29b57
add dword [ebp - 0x14], 0xa6b9c61e
mov dword [ebp - 0x10], 0x8d7b3eed
sub dword [ebp - 0x10], 0x2a0bd281
mov dword [ebp - 0xc], 0xe1f8873e
add dword [ebp - 0xc], 0x1e0778c2
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xe8b7309e
sub eax, 0xe876af9e
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3bceb
push 0
call eax
mov ecx, 0x5b16
mov ebx, eax
mov esi, 0x2e2ecfa6
add esi, 0xd218145a
add esi, dword [ebp - 8]
mov edi, 0x59aa35d1
add edi, 0xe2af4855
add dword [ebp - 4], 0xe28653e3
mov edx, dword [esi]
add dword [ebp - 4], 0xed1ad97b
sub edx, edi
xor dword [ebp - 4], 0xaacafaed
mov dword [ebx], edx
add ebx, 0x62295e1a
sub ebx, 0x62295e16
add esi, 4
loop 0x403000
add eax, 0xe0b10d88
add eax, 0x1f5051a3
mov ebx, eax
add eax, 0x4b0e02a
add eax, 0xfb4f1fdb
mov ecx, 0x96855cff
sub ecx, 0x96455cff
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x6f812dc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea esi, [ebp + 0xc]
sub esp, 0x10
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], 0x6f815184
call sym._fwrite
mov eax, dword [ebp + 8]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.msvcrt.dll_vfprintf]
call sym._abort
lea esi, [esi]