joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6536ff
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x653735
bswap edx
lea ebx, [edx*4]
sub esp, 0x1f
jl 0x65371f
sub esp, 0
jmp 0x653765
not bl
lea esp, [esp + 8]
inc esi
lea eax, [edx*4]
not ax
jmp 0x653701

Function at 0x65371a
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.006536ff
sub esp, 0
jmp 0x65377b
lea esp, [esp + 3]

Function at 0x653b61
Capabilities:
Execute anti-debugging instructions

Disassembly:
add eax, 0x22f2ebdd
jmp 0x653dd6
add eax, 0x476b7a33
jmp 0x653e41
jmp 0x653b6e
cmc
jl 0x653b4b
bsr eax, ebp
call fcn.00653bb1
ret
bsr eax, ebp
mov ah, 0x81
xchg dword [esp + 0xb], eax
mov ah, 0x85
jmp 0x653c04
lea esp, [esp + 1]
jmp 0x653c25
sub cl, dl
xchg edx, eax
rdtsc
mov dl, byte [esp]
not dh
jmp 0x653c36
dec esi
bswap eax
mov ah, cl
cmp ax, sp
jnp 0x653cb3
rdtsc
mov dl, 0x72
jmp 0x653c68
mov dx, 0x1468
bswap eax
setb ah
jmp 0x653c94
rdtsc
mov dl, 0x72
mov dx, 0x1468
bswap eax
setb ah
jmp 0x653ce8
jmp 0x653c87
dec bl
call fcn.00653c96
lea esp, [esp + 0x10]
not bl
mov ah, byte [esp]
sub esp, 0xa
jmp 0x653db5
lea eax, [esp - 0xa4]
rcr dh, 4
jmp 0x653d7a
pushfd
add dl, 0xbb
mov word [esp], bp
lea eax, [ecx + ebx]
mov eax, 0x389fd15f
jmp 0x653d98
lea edx, [edx*4]
lea esp, [esp + 2]
jmp 0x653f87
mov word [esp], bp
lea eax, [ecx + ebx]
mov eax, 0x389fd15f
jmp 0x653d98
jb 0x653d3a
pushfd
add dl, 0xbb
jmp 0x653d64
pushal
mov al, dl
xchg esi, edi
mov dword [esp + 0x1c], ebx
bswap edx
jmp 0x653eed
rol bl, 0
mov dl, byte [esp]
mov eax, dword [esp]
jmp 0x653d82
jb 0x653f76
xchg dx, ax
sbb ah, 0xe9
jmp 0x653d54
sub esp, 3
jmp 0x652024
mov dx, word [esp]
neg edx
jno 0x653dff
bt dx, di
btr dx, di
jmp 0x653ea0
push ecx
shl eax, 2
call fcn.00653dc3
jl 0x653dce
sub esp, 3
jmp 0x652024
jmp 0x653e98
pushal
not edx
mov edx, 0xdae01548
mov edx, dword [esp + 0xc]
jmp 0x6520a5
mov edx, 0x70127acd
jmp 0x653dec
mov dx, bp
mov esp, edi
call fcn.00653e5f
call fcn.00653e79
loop 0x653e92
not byte [ecx - 0x62e3fda0]
or eax, 0x6cb2a754
jg 0x653e85
int1
invalid
mov dh, 0x62
mov dx, 0x8e62
jmp 0x653e21
xchg dword [esp], edx
mov ah, 2
rcl ax, cl
mov eax, edi
mov ah, 0xd1
jmp 0x653ec1
jmp 0x653e63
dec eax
pop ecx
mov eax, 0x66edf29b
bt edx, edi
bt dx, di
btr dx, di
mov eax, dword [eax - 0x228dab74]
jmp 0x653e04
mov al, dh
xchg dword [esp], edx
lea eax, [eax*4]
mov al, 0xca
jmp 0x653ed5
mov ax, 0xeb5b
lea edx, [edx + 0x19]
mov eax, dword [esp]
mov ax, 0x3e4c
cmc
lea eax, [ebx + ebp]
jmp 0x653eab
setg ah
neg ax
mov edx, esi
push dword [esp]
ret 4
mov dl, byte [esp]
popal
add dh, ah
jns 0x653e1a
mov edx, 0x70127acd
push ecx
jmp 0x653ded
xchg dx, ax
sbb ah, 0xe9
lea edx, [edx*4]
lea esp, [esp + 2]
lea esp, [esp + 8]
neg bl
jmp 0x653d2a

Function at 0x678018
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x678054
lea esp, [esp + 0x20]
xor edi, dword [ebx*4 + 0x64a41c]
sub esp, 0xd
lea ebx, [edi*4]
lea esp, [esp + 1]
jmp 0x67803e
Function at 0x6781ba
Capabilities:
Encrypt data using aes

Disassembly:
push esi
jmp 0x67818e
lea esp, [esp + 4]
xor edi, dword [ebx*4 + 0x64a81c]
sub ebx, edi
movzx ebx, byte [esi + 6]
jmp 0x678165
pushal
stc
push di
lea esp, [esp + 2]
mov dword [esp + 4], ebx
jmp 0x6781a0
popal
lea esi, [esi*4]
lea esi, [esi + 0x649c1c]
mov ebx, dword [esi]
pop esi
jmp 0x6781d2
jmp 0x67817b
push si
add esp, 1
lea esp, [esp + 1]
and ebx, ecx
call fcn.006781bc

Function at 0x678291
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov dword [esi + 4], edi
mov edi, 0x5b795a08
jmp 0x67827b

Function at 0x67835c
Capabilities:
Encrypt data using aes

Disassembly:
push word [esp + 3]
lea esp, [esp + 2]
jmp 0x677fb5
push ebx
mov ebx, edi
lea ebx, [ebx*4]
jmp 0x6782cc
lea ebx, [ebx + 0x64a01c]
mov edi, dword [ebx]
pop ebx
and ebx, ecx
call fcn.0067807d
lea esp, [esp + 1]
add esp, 0
lea esp, [esp + 1]
jmp 0x678338
mov edi, dword [edi*4 + 0x64a01c]
call fcn.00678316
mov byte [esp + 2], ah
call 0x67835c
lodsb al, byte [esi]
and eax, 0xaa2fdcb5
aam 0x56
les esp, [ebx - 0x14b8c3a2]
jmp 0x678344
and ebx, ecx
lea esp, [esp + 8]
xor edi, dword [ebx*4 + 0x64a41c]
jmp 0x67838c
or bx, 0xf453
mov bl, cl
mov bx, 0x67cd
shl ebx, 0xb
movzx ebx, byte [esi + 0xd]
jmp 0x67974b
pushal
mov ax, 0xf604
xchg cl, al
xchg ebp, ebx
mov dword [esp], edx
call fcn.006783d4
and ebx, ecx
jmp 0x678480
xor edi, dword [ebx*4 + 0x64a41c]
sub esp, 2
sub esp, 3
lea esp, [esp + 1]
jmp 0x6784c1
mov dword [esi + 8], edi
mov ebx, dword [ebx*4 + 0x649c1c]
mov edi, 0x499048ae
bswap edi
pushfd
jmp 0x67844d
dec dword [ebp - 4]
call fcn.0067854f
insb byte es:[edi], dx
jmp 0xc7529d32
and edx, ecx
lea esp, [esp + 4]
xor edi, dword [edx*4 + 0x64ac1c]
jmp 0x6784ab
lea esp, [esp + 0x2c]
xor edi, dword [edx*4 + 0x64ac1c]
mov edx, dword [esi + 0xc]
jmp 0x678497
mov edx, dword [edi]
pop edi
and edx, ecx
sub esp, 0x11
lea esp, [esp + 1]
jmp 0x6785e4
push edi
mov edi, edx
lea edi, [edi*4]
lea edi, [edi + 0x649c1c]
jmp 0x67868e
pushal
pop word [esp + 0x1a]
lea esp, [esp + 2]
and edx, ecx
jmp 0x679382

Function at 0x6783d4
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
stc
lea esp, [esp + 4]
popal
sub esp, 1
lea esp, [esp + 1]
jmp 0x678406
jmp 0x6783be
and ebx, ecx
pushal
jmp 0x67842a
mov edi, dword [edi*4 + 0x64a01c]
jmp 0x6783d6
shr edi, 0x18
mov edi, dword [edi*4 + 0x649c1c]
and edi, ecx
jmp 0x6783ec
mov ebx, dword [ebx*4 + 0x649c1c]
jmp 0x678474
lea esp, [esp + 0x24]
xor edi, dword [ebx*4 + 0x64a81c]
movzx ebx, byte [esi + 0xe]
jmp 0x678414
and edx, ecx
cmc
mov edx, dword [edx*4 + 0x649c1c]
jmp 0x67845e

Function at 0x6785ba
Capabilities:
Encrypt data using aes

Disassembly:
sbb byte [eax + ebx*8 + 0x4e], 0x29
fdiv dword [esi + 0x56d7a4b5]
pop word [esp + 2]
lea esp, [esp + 2]
lea esp, [esp + 4]
jmp 0x6785cd
je 0x63fed4
jne 0x67865a
stosd dword es:[edi], eax
cmp ebx, dword [esi - 0x53]
mov esp, 0x1b38d94e
jb 0x678572
and al, 0x2c
push edi
call fcn.0065765c
pop es
jmp 0x63fed4
Function at 0x80d981
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg esi, eax
rol bp, 0xd
push word [esp + 0x15]
lea eax, [ecx + 0x82]
jmp 0x80da06
cmp edx, 0x5440f495
bswap ebx
add ah, 0x6f
rdtsc
lea edi, [ebp*4]
cpuid
jmp 0x80d941
btc edx, edi
mov ch, byte [esp + 0x17]
jmp 0x80d957
rdtsc
bswap edi
mov dword [esp + 0x2a], ebx
mov edx, esi
rdtsc
bswap ecx
jmp 0x80d9de
mov cx, 0x8197
mov dh, 0x64
xchg dword [esp + 0x33], esi
cpuid
call fcn.0080d9c8
pop ebp
lodsb al, byte [esi]
mov edi, 0x64883186
and al, 5
mov byte [esp + 5], ah
setle al
shl ah, 2
mov dword [esp + 0x15], esp
mov edi, 0x305671ae
rcl eax, 0xf
jmp 0x80d98a
push word [esp + 0x1d]
bsr cx, di
mov bp, word [esp + 0x24]
mov bl, 0xc8
lea ecx, [edx + edi]
not ax
jmp 0x80d99a
xchg bl, ch
sub esp, 0x1f
xchg byte [esp + 7], ch
bsf edi, esp
dec esi
pop bp
jmp 0x80d9b0

Function at 0x80dbf3
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
bswap edi
neg dx
cpuid
lea esi, [esi + 0x22d7626c]
jmp 0x80dc0b
jmp 0x80dbdd
add esp, 0xa
neg ecx
bsf ebp, edx
lea esp, [esp + 1]
neg ebp
jmp 0x80dc1e
pop cx
add esp, 0xe
xchg word [esp + 7], cx
rdtsc
pop cx
bsr edx, ecx
jmp 0x80dbf5
lea ecx, [edx*4]
mov ecx, dword [esp]
cmc
setg dh
mov byte [esp], dh
jmp 0x80dcc7
mov ebp, 0xa46584
mov eax, 0xc90e4601
lea esp, [esp]
mov ch, dh
jmp 0x80dca9
mov eax, esi
mov dl, dh
xchg si, cx
setg bh
xchg byte [esp], bl
lea ebx, [ebx - 0x69a8]
jmp 0x80dc5f
std
setne bh
mov dl, 0x91
cmp ch, al
mov bh, ah
lea esp, [esp]
jmp 0x80dc75
dec dx
xchg byte [esp], dl
add esp, 0
rdtsc
mov edi, dword [esp]
xchg si, bx
dec ecx
lea ebp, [esi*4]
mov dl, bh
jmp 0x80dc9a
Function at 0x80e640
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
cpuid
stc
mov cl, 0x9d
sub esp, 0x17
inc dx
jmp 0x80e654
xchg byte [esp + 2], dl
sub esp, 0x1e
lea esp, [esp + 0x23]
lea ecx, [esi*4]
jmp 0x80e629
mov dword [esp + 0xc], edi
push word [esp + 9]
setl bh
push word [esp + 0x10]
jmp 0x80e6b4
mov ecx, 0xdf47be42
pop dword [esp + 0xb]
mov cx, 0x66b4
bsf ebp, ebp
jmp 0x80e816
xchg bp, bx
lea ebx, [ecx + ebp]
xchg dword [esp + 2], edi
pushfd
setne dl
cld
jmp 0x80e684
pop dword [esp + 0x13]
bsr dx, si
mov al, byte [esp + 0xd]
lea edi, [ebp*4]
mov word [esp + 0xb], sp
rdtsc
jmp 0x80e69a
btc dx, sp
add esp, 3
mov edx, ebp
mov bp, word [esp + 0xe]
cmc
call fcn.0080e7e2
std
pop eax
clc
xchg dx, cx
cpuid
pushal
jmp 0x80e726
rdtsc
mov ch, 0x1b
mov esi, dword [esp + 4]
lea esi, [ebx + ebp]
rdtsc
xchg word [esp + 1], ax
jmp 0x80e6d0
lea ebp, [ebp*4]
pushal
lea esp, [esp + 0x59]
mov dh, dl
xchg ch, dh
jmp 0x80e7a5
shl dx, 1
mov ch, 0xb9
push word [esp + 4]
mov bx, word [esp + 2]
cpuid
lea eax, [eax + 0x1c40fb2e]
jmp 0x80e70e
pop word [esp + 0x12]
mov ch, bh
lea esp, [esp + 0x14]
rdtsc
neg dx
jmp 0x80e77b
neg eax
not cx
mov si, di
pop bx
std
sub esp, 0x17
jmp 0x80e73f
pop ax
mov di, word [esp]
mov cx, 0x39d9
lea ebp, [ecx + esi]
mov byte [esp], bh
jmp 0x80e7bb
xchg word [esp + 3], cx
mov word [esp + 1], cx
pop dword [esp]
mov ecx, 0x502dfbf1
lea eax, [ecx - 0xf47c]
xchg byte [esp], cl
jmp 0x80e765
bsr cx, bx
lea ecx, [ebx - 0x9c]
neg ah
xchg cl, ch
sub esp, 9
bsf edx, esi
jmp 0x80e755
std
push edi
lea ebp, [0xa1ed2d71]
push word [esp + 5]
mov ecx, edx
bt bx, bx
jmp 0x80e7eb
mov word [esp + 4], ax
dec bl
mov ah, 0x44
pop dx
mov di, 0x69c5
xchg word [esp + 3], dx
jmp 0x80e8c0
pop bp
xchg word [esp + 1], si
cld
bswap ebx
xchg cl, dl
mov ecx, 0x513c7a12
jmp 0x80e6fa
xchg cx, di
and ah, bh
lea esi, [ebp*4]
sub esp, 0x19
jmp 0x80e857
lea ecx, [edx + 0xa1]
lea edx, [eax + esi]
std
mov ebp, 0x13c504cf
mov ch, 0x3d
rdtsc
jmp 0x80e82c
lea esp, [esp + 0x4b]
xchg esi, ebx
cpuid
mov al, 0x48
popal
call 0x80e868
jmp 0x248577d2
mov dx, cx
cpuid
push dword [esp + 0xf]
neg di
pop bp
mov cx, 0x5a19
jmp 0x80e842
sub esp, 0xa
mov ebx, dword [esp + 4]
pushal
xchg cx, bx
mov ebp, 0xf515de4
lea edx, [eax + edx]
jmp 0x80e87e

Function at 0x80e7e2
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 1]
jmp 0x80e6e4

Function at 0x80e913
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
mov byte [esp], dh
mov dword [esp + 0x14], edx
jmp 0x80e96c
mov dword [esp + 0x10], ebx
push esi
pop word [esp]
lea esp, [esp]
lea esp, [esp + 2]
mov dword [esp + 0xc], esp
jmp 0x80e956

Function at 0x80e929
Capabilities:
Parse pe header

Disassembly:
push word [esp + 0xe]
mov dword [esp + 0x14], ecx
call fcn.0080e913
in al, 0x60
not byte [ecx - 0x62e518a0]
or eax, 0x6c22a754
jg 0x80e98c
int1
invalid
je 0x80e9b2
adc dword [eax + 0x60082464], ecx
add bl, ch
and eax, 0x8bec7efc
xchg ch, cl
into
push ebx
ret
Function at 0x9551b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00955140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00955140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00955140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00955140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x955bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x955c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x96787c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x955c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x955c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x1142058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.011421a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x114207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x114206a
add dl, dl
jne 0x1142089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x11420dc
xor eax, eax
add dl, dl
jne 0x1142096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x114217d
add dl, dl
jne 0x11420a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11420b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11420bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11420c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x11420d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1142075
mov eax, 1
add dl, dl
jne 0x11420ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11420f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11420e1
sub eax, ebx
mov ebx, 1
jne 0x1142128
mov ecx, 1
add dl, dl
jne 0x114210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1142119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1142105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1142075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x114213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x114214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1142136
cmp eax, 0x7d00
jae 0x114216d
cmp eax, 0x500
jb 0x1142168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1142075
cmp eax, 0x7f
ja 0x1142170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1142075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x114219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1142075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x417b20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc000]
push edi
or ebp, 0xffffffff
jmp 0x417b42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x417b49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x417b38
mov eax, 1
add ebx, ebx
jne 0x417b5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x417b50
jne 0x417b6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417b50
xor ecx, ecx
sub eax, 3
jb 0x417b80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x417bf2
mov ebp, eax
add ebx, ebx
jne 0x417b8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x417b98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x417bbc
inc ecx
add ebx, ebx
jne 0x417ba8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x417b9d
jne 0x417bb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417b9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x417bdc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x417bcd
jmp 0x417b3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x417bdc
add edi, ecx
jmp 0x417b3e
pop esi
mov edi, esi
mov ecx, 0xe7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x417bfa
cmp byte [edi], 0xe
jne 0x417bfa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x417bff
lea edi, [esi + 0x15000]
mov eax, dword [edi]
or eax, eax
je 0x417c77
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x177c4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x17844]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x417c2c
mov ecx, edi
jns 0x417c5b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1784c]
or eax, eax
je 0x417c71
mov dword [ebx], eax
add ebx, 4
jmp 0x417c49
call dword [esi + 0x17848]
mov ebp, dword [esi + 0x17850]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x417cab
sub esp, 0xffffff80
jmp 0x408a43
Function at 0x401210
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402060
push 0x401350
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x403164], 0xffffffff
or dword [0x403168], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x403160]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x40315c]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x40316c], eax
call fcn.00401341
cmp dword [0x40314c], 0
jne 0x401293
push 0x40133e
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.0040132c
push 0x40300c
push 0x403008
call sub.MSVCRT.dll__initterm
mov eax, dword [0x403158]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x403154]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x403004
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call fcn.004011c0
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x401b50
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x45768e
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x473204]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
call fcn.0041ab87
push 0x4017a0
push 0x401790
push 4
push 8
lea ebx, [esi + 0x54]
xor edi, edi
push ebx
mov dword [esp + 0x30], edi
mov dword [esi], vtable.CComboBoxOwner.0
call fcn.0043e8b7
fldz
fst dword [esi + 0x74]
mov byte [esp + 0x1c], 1
fstp dword [esi + 0x78]
mov dword [esi + 0x7c], edi
call fcn.004184b1
mov eax, dword [eax + 0xc]
mov edi, dword [sym.imp.USER32.dll_LoadBitmapA]
push 0xce
push eax
call edi
push eax
mov ecx, ebx
call fcn.00418ea5
call fcn.004184b1
mov eax, dword [eax + 0xc]
push 0xcf
push eax
call edi
push eax
lea ecx, [esi + 0x5c]
call fcn.00418ea5
call fcn.004184b1
mov eax, dword [eax + 0xc]
push pe_nt_image_headers32
push eax
call edi
push eax
lea ecx, [esi + 0x64]
call fcn.00418ea5
call fcn.004184b1
mov eax, dword [eax + 0xc]
push 0xb4
push eax
call edi
push eax
lea ecx, [esi + 0x6c]
call fcn.00418ea5
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x402530
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402549
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402584
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x402580
lea ebx, [ebx]
cmp esi, eax
jae 0x402584
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402570
cmp esi, eax
jb 0x40258a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x4025d0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x473204]
xor eax, esp
mov dword [esp + 0x104], eax
push 0x104
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x40260d
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0043e7e7
add esp, 0x108
ret
lea eax, [esp]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x402611
mov ecx, dword [str.d3d9.dll]
mov edx, dword [0x45c2f0]
mov dword [eax], ecx
mov cx, word [0x45c2f4]
mov dword [eax + 4], edx
lea edx, [esp]
push 0
push edx
mov word [eax + 8], cx
call fcn.0043eaf5
mov ecx, dword [esp + 0x10c]
add esp, 8
neg eax
sbb eax, eax
xor ecx, esp
inc eax
call fcn.0043e7e7
add esp, 0x108
ret
Function at 0x402e90
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x84
mov eax, dword [0x473204]
xor eax, esp
mov dword [esp + 0x80], eax
push str..CONFIG.ini
push 0x104
lea eax, [esp + 8]
push eax
push 0x45bd84
push str.LANGUAGE
push str.LOGIN
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je case.0x402ee1.2
lea ecx, [esp]
push ecx
call fcn.0043ea61
add esp, 4
cmp eax, 0x10
ja case.0x402ee1.2
jmp dword [eax*4 + 0x402f78]
mov edx, 0x412
jmp 0x402f53
mov eax, 0x404
mov word [0x475f40], ax
jmp case.0x402ee1.2
mov ecx, 0x409
mov word [0x475f40], cx
jmp case.0x402ee1.2
mov edx, 0x407
jmp 0x402f53
mov eax, 0x40c
mov word [0x475f40], ax
jmp case.0x402ee1.2
mov ecx, 0x41f
mov word [0x475f40], cx
jmp case.0x402ee1.2
mov edx, 0x416
jmp 0x402f53
mov eax, 0xc0a
mov word [0x475f40], ax
jmp case.0x402ee1.2
mov ecx, 0x415
mov word [0x475f40], cx
jmp case.0x402ee1.2
mov edx, 0x410
mov word [0x475f40], dx
mov ecx, dword [esp + 0x80]
mov ax, word [0x475f40]
xor ecx, esp
call fcn.0043e7e7
add esp, 0x84
ret

Function at 0x403460
Capabilities:
Get disk size

Disassembly:
sub esp, 0x10
push 0
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov edx, dword [esp + 4]
cmp edx, dword [esp + 0x18]
ja 0x403494
jb 0x40348c
mov eax, dword [esp]
cmp eax, dword [esp + 0x14]
ja 0x403494
xor al, al
add esp, 0x10
ret 8
mov al, 1
add esp, 0x10
ret 8