joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1a5ac30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6c2000]
push edi
or ebp, 0xffffffff
jmp 0x1a5ac52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1a5ac59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1a5ac48
mov eax, 1
add ebx, ebx
jne 0x1a5ac6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1a5ac60
jne 0x1a5ac7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1a5ac60
xor ecx, ecx
sub eax, 3
jb 0x1a5ac90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1a5ad02
mov ebp, eax
add ebx, ebx
jne 0x1a5ac9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x1a5aca8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x1a5accc
inc ecx
add ebx, ebx
jne 0x1a5acb8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1a5acad
jne 0x1a5acc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1a5acad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1a5acec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1a5acdd
jmp 0x1a5ac4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1a5acec
add edi, ecx
jmp 0x1a5ac4e
pop esi
mov edi, esi
mov ecx, 0x2d47f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1a5ad0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1a5ad0f
lea edi, [esi + 0xb56000]
mov eax, dword [edi]
or eax, eax
je 0x1a5ad77
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xbd6500]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xbd662c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1a5ad35
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xbd6630]
or eax, eax
je 0x1a5ad71
mov dword [ebx], eax
add ebx, 4
jmp 0x1a5ad52
call dword [esi + 0xbd6640]
mov ebp, dword [esi + 0xbd6634]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1a5adab
sub esp, 0xffffff80
jmp 0x14e7e98
Function at 0x4385b0
Capabilities:
Hash data using murmur3

Disassembly:
mov bh, 0xa8
and dword [edi - 0x21d40e], eax
leave

Function at 0x438600
Capabilities:
Hash data using murmur3

Disassembly:
xor edi, dword [0x603d50]
not esi
sub edi, eax
sub edi, dword [0x6038d5]
dec eax
sub eax, 0x250cc79b
add dword [0x6031d7], eax
call fcn.004ee4d8
call fcn.00406d43
add eax, 0x250cc79b
inc eax
add edi, eax
not esi
ror edx, 9
xor dword [0x60359d], edi
xor ecx, edx
rol esi, 0x10

Function at 0x438640
Capabilities:
Hash data using murmur3

Disassembly:
xchg ecx, esi
inc edi
not edi
xor edx, 0xf16631dd
rol eax, 0x11
inc ecx
xor ebx, 0x53be387c
jl 0x43868b
mov esi, 0xd6f74053
ror esi, 0x16
xor ebx, dword [0x60393c]
add bh, dh
rol ecx, cl
into
adc dword [ebx], eax
add eax, 0x6038ed
sub esi, 0x9aafeacb
dec edi
call fcn.0054ed60
call fcn.004f0308
inc edi
add esi, 0x9aafeacb
rol esi, 0x11
not ebx
rol esi, 0x16
not esi
dec eax
xor ebx, 0x8dcbeb5f
not esi
and dword [0x60360e], eax
sub ebx, esi
call fcn.00480e74
xor ebx, edx
xchg edx, eax
call fcn.004eb392
sub eax, esp
call fcn.00488fe9
or edx, dword [0x603e74]
xor dword [0x60353f], ebx
call fcn.00425417
add ebx, dword [0x603998]
invalid
invalid
invalid
invalid
pushal

Function at 0x438650
Capabilities:
Hash data using murmur3

Disassembly:
jl 0x43868b
mov esi, 0xd6f74053
push ss

Function at 0x438660
Capabilities:
Hash data using murmur3

Disassembly:
add bh, dh
rol ecx, cl
into
adc dword [ebx], eax
add eax, 0x6038ed

Function at 0x438700
Capabilities:
Hash data using murmur3

Disassembly:
and dword [0x60354b], ecx
call fcn.00566930
add eax, esp
call fcn.00413657
xchg edx, eax
xor ebx, edx
call fcn.004bd21d
add ebx, esi
add dword [0x6035a6], ecx
not esi
push ebx
rol ebx, 0x1d
sub ecx, dword [0x60395c]
xchg eax, esi
rol edi, 0x16
add edi, dword [0x603b43]
call fcn.004790f9
or eax, dword [0x603bdb]
or dword [0x6031b8], ecx
inc edi
invalid
invalid
lea edi, [eax]
Function at 0x438850
Capabilities:
Hash data using murmur3

Disassembly:
sub dword [0x603659], 0x801f3a6f
add dword [0x6030f0], ecx
xor eax, 0x3881111c
inc ebx
ror esi, 0x1e
add edi, edx
call fcn.0040ab7c
inc esi
ror eax, 0x13
sub edx, 0x85f825cf
xor eax, dword [0x603c4a]
add edx, 0x85f825cf
rol eax, 0x13
dec esi
call fcn.004ad182
sub edi, edx
rol esi, 0x1e
dec ebx
xor eax, 0x3881111c
sub dword [0x60332d], edx
sub eax, 0x81006033
sub eax, 0x60316f
jns 0x438802
cld
inc edi
sub eax, 0x81006033
sub eax, 0x60316f
jns 0x438802
cld
inc edi
sub dword [0x6033d4], edx
add esi, 0x3d540468
add ebx, 0x1522e356
call fcn.00428e33
neg edi
xor ebx, 0x1c354f
inc esi
or dword [0x6032a7], 0x23764f8e
cmpsd dword [esi], dword es:[edi]
xor ah, byte [eax]
mov cs, word [edi + 0x76]
and esi, edi
sal dword [ebx], cl
fldenv [ecx]
or eax, 0x603197
pushal
add cl, al
ret 0x2b02
ret 0xd09
test al, 0x31
pushal
add cl, al
ror byte [ebx], 0x33
std
xor dword [0x60327c], ebx
sub dword [0x603340], ecx
inc eax
xor dword [0x60374d], 0x476d6d34
xor eax, 0x60374d
xor al, 0x6d
insd dword es:[edi], dx
inc edi
and dword [0x60329e], esi
or ebx, dword [0x603b5c]
sbb eax, 0x603b5c
sub esi, dword [0x603ecd]
sub dword [0x603355], ebx
dec eax
or dword [0x603803], eax
xor edi, ebp
ror eax, 0xb
or dword [0x603431], eax
add eax, edx
ror edx, 2
xor ebx, ecx
not ebx
dec esi
xor ebx, 0x1c354f
neg edi
call fcn.004a75c3
sub ebx, 0x1522e356
push esi
mov dword [0x603134], edi
call fcn.00543d2c
not edx
call fcn.0049edd6
add dword [0x603404], edi
xor ecx, esp
call fcn.0057e368
or eax, dword [0x603a27]
sub dword [0x60337a], ecx
neg esi
inc edi
sub ebx, 0x2fc219e3
xor ebx, 0xe841990
xor eax, 0xcd0627e3
call fcn.0048feaf
call fcn.0041fbb4
xor eax, 0xcd0627e3
xor ebx, 0xe841990
add ebx, 0x2fc219e3
dec edi
neg esi
call fcn.00407ac0
xor ecx, esp
not edx
call fcn.0043a199
or dword [0x603340], ebx
mov edx, 0xb09ef71b
inc edx
sub eax, 0xe344f8e3
call fcn.0053db0a
neg edx
call fcn.004f6c06
rol ebx, 7
dec esi
xor esi, esp
xor dword [0x603408], ecx
ror eax, 5
call fcn.004c18d8
rol eax, 5
add dword [0x60373b], eax
xor esi, esp
inc esi
ror ebx, 7
call fcn.0046ceed
cmp dword [ebp + 3], eax
add bh, dh
fiadd dword [ecx + 0x44f8e3c0]
jecxz 0x438a07
Function at 0x479170
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
cmp esi, 0x80
jge 0x47918d
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
add esp, 4
test eax, eax
je 0x47918d
xor al, al
pop esi
cmp esi, 0x2a
je 0x4791e7
cmp esi, 0x2f
je 0x4791e7
cmp esi, 0x2d
je 0x4791e7
cmp esi, 0x2b
je 0x4791e7
cmp esi, 0x28
je 0x4791e7
cmp esi, 0x29
je 0x4791e7
cmp esi, 0x3d
je 0x4791e7
cmp esi, 0x5e
je 0x4791e7
cmp esi, 0x5b
je 0x4791e7
cmp esi, 0x5d
je 0x4791e7
cmp esi, 0x3c
je 0x4791e7
cmp esi, 0x26
je 0x4791e7
cmp esi, 0x3e
je 0x4791e7
cmp esi, 0x2c
je 0x4791e7
cmp esi, 0x7c
je 0x4791e7
cmp esi, 0x7e
je 0x4791e7
cmp esi, 0x25
je 0x4791e7
cmp esi, 0x3a
jne 0x479189
mov al, 1
pop esi
ret

Function at 0x47d0b0
Capabilities:
Parse credit card information

Disassembly:
push ebx
mov bl, cl
movsx eax, bl
test bl, bl
js 0x47d0cc
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
add esp, 4
test eax, eax
je 0x47d0cc
xor al, al
pop ebx
ret
cmp bl, 0x2b
je 0x47d11c
cmp bl, 0x2d
je 0x47d11c
cmp bl, 0x2a
je 0x47d11c
cmp bl, 0x2f
je 0x47d11c
cmp bl, 0x26
je 0x47d11c
cmp bl, 0x5e
je 0x47d11c
cmp bl, 0x3d
je 0x47d11c
cmp bl, 0x3c
je 0x47d11c
cmp bl, 0x3e
je 0x47d11c
cmp bl, 0x28
je 0x47d11c
cmp bl, 0x29
je 0x47d11c
cmp bl, 0x5b
je 0x47d11c
cmp bl, 0x5d
je 0x47d11c
cmp bl, 0x2c
je 0x47d11c
cmp bl, 0x3f
je 0x47d11c
cmp bl, 0x3a
jne 0x47d0c8
mov al, 1
pop ebx
ret

Function at 0x48b680
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a3ba5
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5f300c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp + 8]
mov dword [ebx + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebp - 4], 0
mov al, byte [ebp + 0x10]
push fcn.00475190
push 0x48bcf0
mov byte [ebx + 0x14], al
mov eax, dword [ebp + 0x14]
push 4
mov dword [ebx + 0x18], eax
lea eax, [ebx + 0x1c]
push 0x410
push eax
mov dword [ebx], vtable.LexerBasic.0
call fcn.0059e7e7
lea edi, [ebx + 0x105c]
lea ecx, [edi + 4]
mov dword [ebp + 0x10], edi
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov byte [edi + 0x1c], 0
push 0
mov byte [ebp - 4], 3
push 0x5adadd
mov word [edi], 0x100
mov byte [edi + 2], 0
call fcn.0040af10
push 0
push 0x5adadd
lea ecx, [edi + 0x1c]
call fcn.0040af10
mov word [edi + 0x34], 0x100
push dword [ebp + 0x18]
lea ecx, [ebx + 0x1094]
mov byte [ebp - 4], 4
call fcn.0048b470
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x406b30
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x10d2c
call fcn.00419420
mov eax, dword [0x435df8]
xor eax, esp
mov dword [esp + 0x10d28], eax
mov eax, dword [esp + 0x10d40]
push ebx
push ebp
push esi
push edi
push 0x10d1a
mov dword [esp + 0x18], eax
call fcn.004198ac
mov ecx, eax
mov edi, ecx
lea edx, [esp + 0x20]
add esp, 4
xor ebp, ebp
xor ebx, ebx
sub edi, edx
mov eax, ebx
cdq
idiv dword [esp + 0x10d4c]
mov eax, dword [esp + 0x10d48]
lea esi, [esp + ebx + 0x1c]
mov byte [edi + esi], bl
inc ebx
cmp ebx, 0x10d1a
mov dl, byte [edx + eax]
mov byte [esi], dl
jl 0x406b72
lea eax, [esp + 0x1c]
sub eax, ecx
mov esi, ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0x10d1a
mov edi, 0x10d1a
jmp 0x406bb7
mov eax, dword [esp + 0x18]
movzx edx, byte [eax + esi]
mov bl, byte [esi]
add edx, ebp
movzx eax, bl
add eax, edx
cdq
mov ebp, edi
idiv ebp
inc esi
sub dword [esp + 0x10], 1
mov ebp, edx
mov al, byte [ecx + ebp]
mov byte [ecx + ebp], bl
mov byte [esi - 1], al
jne 0x406bb3
mov edx, dword [esp + 0x10d44]
xor esi, esi
test edx, edx
jle 0x406c51
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x10d40]
sub eax, ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
mov edi, edi
lea eax, [edi + 1]
cdq
mov edi, 0x10d1a
idiv edi
mov ebp, 0x10d1a
inc ebx
mov edi, edx
movzx eax, byte [edi + ecx]
add eax, esi
cdq
mov esi, 0x10d1a
idiv esi
mov esi, edx
mov dl, byte [edi + ecx]
mov al, byte [esi + ecx]
mov byte [esi + ecx], dl
mov byte [edi + ecx], al
movzx edx, byte [esi + ecx]
movzx eax, al
add eax, edx
cdq
idiv ebp
movzx eax, byte [edx + ecx]
mov edx, dword [esp + 0x14]
xor al, byte [edx + ebx - 1]
sub dword [esp + 0x10], 1
mov byte [ebx - 1], al
jne 0x406c00
mov ecx, dword [esp + 0x10d38]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00419411
add esp, 0x10d2c
ret

Function at 0x40d328
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x40d36f
call fcn.00414474
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40d36f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40d38b
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0040cea2
mov esi, eax
test edi, edi
je 0x40d389
test ebx, ebx
je 0x40d389
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x413aa6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x413aca
cmp dword [edi + 0x54], 0
jne 0x413aca
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00414474
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00413a67
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x419411
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x435df8]
jne 0x41941b
repz ret
jmp fcn.0042122c

Function at 0x4262db
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041d689
and dword [ebp - 4], 0
cmp dword [0x439b1c], 0
mov ebx, eax
jne 0x42638c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42643d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x430130
push edi
call esi
test eax, eax
je 0x42643d
push eax
call fcn.0041d617
mov dword [esp], 0x430120
push edi
mov dword [0x439b1c], eax
call esi
push eax
call fcn.0041d617
mov dword [esp], 0x43010c
push edi
mov dword [0x439b20], eax
call esi
push eax
call fcn.0041d617
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x439b24], eax
call esi
push eax
call fcn.0041d617
pop ecx
mov dword [0x439b2c], eax
test eax, eax
je 0x42638c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041d617
pop ecx
mov dword [0x439b28], eax
mov eax, dword [0x439b28]
cmp eax, ebx
je 0x4263e4
cmp dword [0x439b2c], ebx
je 0x4263e4
push eax
call fcn.0041d692
push dword [0x439b2c]
mov esi, eax
call fcn.0041d692
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4263e4
test edi, edi
je 0x4263e4
call esi
test eax, eax
je 0x4263db
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4263db
test byte [ebp - 0xc], 1
jne 0x4263e4
or dword [ebp + 0x10], 0x200000
jmp 0x42641d
mov eax, dword [0x439b20]
cmp eax, ebx
je 0x42641d
push eax
call fcn.0041d692
pop ecx
test eax, eax
je 0x42641d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42641d
mov eax, dword [0x439b24]
cmp eax, ebx
je 0x42641d
push eax
call fcn.0041d692
pop ecx
test eax, eax
je 0x42641d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x439b1c]
call fcn.0041d692
pop ecx
test eax, eax
je 0x42643d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42643f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000b70d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x1000b71b
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x10], 8
push esi
push edi
not eax
mov ecx, 0xff
jb 0x1000b7fc
mov edi, dword [ebp + 0x10]
push ebx
shr edi, 3
movzx ebx, byte [edx]
mov esi, eax
sub dword [ebp + 0x10], 8
and esi, ecx
xor esi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [esi*4 + 0x1000fc78]
xor eax, ebx
inc edx
mov esi, eax
movzx ebx, byte [edx]
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x1000fc78]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x1000fc78]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x1000fc78]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x1000fc78]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x1000fc78]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x1000fc78]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x1000fc78]
xor eax, esi
inc edx
dec edi
jne 0x1000b738
pop ebx
cmp dword [ebp + 0x10], 0
je 0x1000b81d
movzx edi, byte [edx]
mov esi, eax
and esi, ecx
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x1000fc78]
xor eax, esi
inc edx
dec dword [ebp + 0x10]
jne 0x1000b802
pop edi
pop esi
not eax
pop ebp
ret
Function at 0x4035c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4035d9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403614
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x403610
lea ebx, [ebx]
cmp esi, eax
jae 0x403614
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x403600
cmp esi, eax
jb 0x40361a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x405d10
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x7d8
mov eax, dword [0x5a2184]
xor eax, esp
mov dword [esp + 0x7d4], eax
mov eax, dword [esp + 0x7dc]
push edx
push 0x7cf
lea edx, [esp + 0xc]
push edx
push ecx
push eax
push str.General
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 4]
push eax
mov ecx, esi
call fcn.00403380
mov ecx, dword [esp + 0x7d4]
xor ecx, esp
mov eax, esi
call fcn.00522672
add esp, 0x7d8
ret
Function at 0x4062e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5569d0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5a2184]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, dword [esp + 0x20]
lea esi, [edi + 0xa4]
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], esi
mov byte [esp + 0x18], 1
mov eax, dword [esi + 0x30]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40633d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, esi
mov byte [esp + 0x18], 0
call fcn.0051bcd8
mov ecx, edi
mov dword [esp + 0x18], 0xffffffff
call fcn.0051b1a3
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x4122e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x40c
mov eax, dword [0x5a2184]
xor eax, esp
mov dword [esp + 0x408], eax
test edi, edi
mov dword [esp + 4], 0x400
jne 0x412317
xor al, al
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.00522672
add esp, 0x40c
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SYSTEMCURRENTCONTROLSETENUMFTDIBUSVID_0403PID_6001DHY0201A0000Device_Parameters
push reloc.WS2_32.dll_bind
call esi
test eax, eax
je 0x412356
lea ecx, [esp + 4]
push ecx
push 0x20019
push 0
push str.SYSTEMCURRENTCONTROLSETENUMFTDIBUSVID_0403PID_60010000Device_Parameters
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x412378
mov ecx, dword [esp + 4]
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
push 0
push 0
push str.PortName
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x412390
xor al, al
pop esi
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.00522672
add esp, 0x40c
ret
push edi
lea edx, [esp + 0x10]
push str.COM_d
push edx
mov dword [edi], 0
call fcn.00522dc5
mov ecx, dword [esp + 0x418]
add esp, 0xc
cmp dword [edi], 0
pop esi
setne al
xor ecx, esp
call fcn.00522672
add esp, 0x40c
ret
Function at 0x414030
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x556ce0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5a2184]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, ecx
push str.MS_Shell_Dlg
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0
call fcn.00403380
mov ecx, dword [esp + 0x38]
push eax
mov byte [esp + 0x30], 1
call fcn.00403130
mov byte [esp + 0x2c], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4140a3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebp, dword [esp + 0x34]
mov dword [edi], 0xa
cmp dword [ebp - 0xc], 0
mov byte [esp + 0x17], 0
jge 0x4140bd
or esi, 0xffffffff
jmp 0x4140da
push 0x571d1c
push ebp
call fcn.005227ab
add esp, 8
test eax, eax
jne 0x4140d4
or esi, 0xffffffff
jmp 0x4140da
sub eax, ebp
sar eax, 1
mov esi, eax
call fcn.00517e28
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4140f4
push 0x80004005
call fcn.00402db0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
cmp esi, 0xffffffff
mov bl, 2
mov byte [esp + 0x2c], bl
je 0x41419c
push esi
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x3c]
call fcn.00414830
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 3
call fcn.00403130
mov byte [esp + 0x2c], bl
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x414155
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esi, 1
push esi
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x3c]
call fcn.00414800
mov eax, dword [eax]
push eax
call fcn.0052a54b
mov esi, eax
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x414194
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x4141aa
mov dword [edi], esi
jmp 0x4141aa
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00403130
mov esi, dword [esp + 0x18]
push ecx
add esi, 0xfffffff0
mov dword [esp + 0x24], esp
mov edi, esp
push esi
call fcn.00403060
add eax, 0x10
add esp, 4
mov dword [edi], eax
call fcn.00413e00
test al, al
je 0x4141e1
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x18]
push edx
call fcn.00403130
mov bl, 1
jmp 0x4141e5
mov bl, byte [esp + 0x17]
mov byte [esp + 0x2c], 0
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x414203
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
lea eax, [ebp - 0x10]
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414227
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, bl
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8