joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423a00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x423a0e
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not eax
cmp esi, 8
jb 0x423acd
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6c53b8]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6c53b8]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6c53b8]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6c53b8]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6c53b8]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6c53b8]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6c53b8]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6c53b8]
sub edi, 1
jne 0x423a26
pop edi
test esi, esi
je 0x423aeb
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6c53b8]
sub esi, 1
jne 0x423ad1
not eax
pop esi
pop ebp
ret
Function at 0x424380
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
xor edi, edi
mov eax, dword [esi + 0x6af90]
mov dword [esi + 0x6af80], 2
test eax, eax
je 0x42459d
cmp eax, 3
jb 0x4243f6
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
xor ecx, eax
and ecx, 0x7fff
and edx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
test ebx, ebx
je 0x424434
mov eax, dword [esi + 0x6af84]
sub eax, ebx
cmp eax, 0x7efa
ja 0x424434
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x42441d
mov dword [esi + 0x6afa0], eax
push ebx
push esi
call fcn.00425020
mov ecx, dword [esi + 0x6af90]
mov edi, eax
add esp, 8
cmp edi, ecx
cmova edi, ecx
mov ecx, dword [esi + 0x6af84]
cmp edi, 3
jb 0x42451a
sub ecx, dword [esi + 0x6af88]
lea eax, [edi - 3]
push eax
push ecx
push esi
call fcn.00423e20
mov ecx, dword [esi + 0x6af90]
add esp, 0xc
sub ecx, edi
mov dword [ebp + 8], eax
mov dword [esi + 0x6af90], ecx
cmp edi, dword [esi + 0x6af98]
ja 0x4244d9
cmp ecx, 3
jb 0x4244d9
dec edi
nop word [eax + eax]
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
and edx, 0x7fff
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
sub edi, 1
jne 0x424480
jmp 0x424537
add dword [esi + 0x6af84], edi
xor edi, edi
mov eax, dword [esi + 0x6af84]
push str.Call_UPDATE_HASH___MIN_MATCH_3_more_times
push 1
push esi
movzx ecx, byte [eax + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [eax + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
mov dword [esi + 0x6af7c], eax
call fcn.004227c0
add esp, 0xc
jmp 0x42453d
movzx eax, byte [ecx + esi + 0x1af70]
push eax
push 0
push esi
call fcn.00423e20
add esp, 0xc
mov dword [ebp + 8], eax
dec dword [esi + 0x6af90]
inc dword [esi + 0x6af84]
cmp dword [ebp + 8], 0
je 0x42457a
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x424557
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x424559
xor edx, edx
mov eax, dword [esi + 0x6af84]
push 0
sub eax, ecx
push eax
push edx
push esi
call fcn.004247e0
mov eax, dword [esi + 0x6af84]
add esp, 0x10
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x42458f
push esi
call fcn.00424680
add esp, 4
mov eax, dword [esi + 0x6af90]
test eax, eax
jne 0x4243a5
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x4245b1
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x4245b3
xor edx, edx
mov eax, dword [esi + 0x6af84]
push 1
sub eax, ecx
push eax
push edx
push esi
call fcn.004247e0
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x425ff0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x84]
test ecx, ecx
je 0x426052
mov edx, dword [edi + 0x8c]
mov ebx, dword [edi + 0x88]
cmp edx, ebx
jae 0x426099
mov esi, dword [ebp + 8]
lea eax, [edx + ecx]
sub ebx, edx
cmp ebx, dword [ebp + 0xc]
cmova ebx, dword [ebp + 0xc]
push ebx
push eax
push esi
call fcn.0062f5b0
add dword [edi + 0x8c], ebx
add dword [edi + 0x74], ebx
push ebx
push esi
push dword [edi + 0x78]
call fcn.00423a00
add esp, 0x18
mov dword [edi + 0x78], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 0x7c]
test eax, eax
je 0x426092
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 4]
push 0
push ecx
push dword [ebp + 0xc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x426099
mov esi, dword [ebp - 4]
add dword [edi + 0x74], esi
push esi
push ebx
push dword [edi + 0x78]
call fcn.00423a00
add esp, 0xc
mov dword [edi + 0x78], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [edi + 0x14], 0x1000000
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x426600
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movsx eax, byte [ebp + 0xc]
mov ecx, dword [edx]
xor eax, ecx
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x6c53b8]
movzx eax, cl
add eax, dword [edx + 4]
imul eax, eax, 0x8088405
mov dword [edx], ecx
mov ecx, dword [edx + 8]
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6c53b8]
mov dword [edx + 8], ecx
pop ebp
ret
Function at 0x426650
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
je 0x4266d2
mov ecx, dword [esi + 0x3c]
mov eax, ecx
test ecx, ecx
je 0x426684
cmp dword [esi + 0x40], ebx
jae 0x426684
push ecx
call fcn.0043f8b7
add esp, 4
mov dword [esi + 0x3c], 0
jmp 0x426688
test eax, eax
jne 0x42669a
lea eax, [ebx + ebx]
push eax
call fcn.00436654
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
push ebx
push edi
push eax
call fcn.0062f5b0
add esp, 0xc
xor edi, edi
test ebx, ebx
je 0x4266cf
lea ecx, [esi + 0x30]
nop
mov eax, dword [esi + 0x3c]
movzx eax, byte [eax + edi]
push eax
push ecx
call fcn.00426740
mov ecx, dword [esi + 0x3c]
add esp, 8
mov byte [edi + ecx], al
inc edi
lea ecx, [esi + 0x30]
cmp edi, ebx
jb 0x4266b0
mov edi, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x42670d
mov edx, dword [esi + 0x24]
lea eax, [edx + ebx]
cmp eax, dword [esi + 0x28]
jb 0x4266f4
pop edi
mov dword [esi + 0x14], 0x30000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
push ebx
add ecx, edx
push edi
push ecx
call fcn.0062f5b0
add esp, 0xc
mov eax, ebx
add dword [esi + 0x24], ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x42672d
push 0
lea ecx, [ebp + 8]
push ecx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
Function at 0x426810
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69939d
mov eax, dword fs:[0]
push eax
sub esp, 0x16c
mov eax, dword [0x75f140]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
push 0x40
lea eax, [ebp - 0x50]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.006300b0
add esp, 0xc
lea eax, [ebp - 0x50]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x124
lea eax, [ebp - 0x174]
mov dword [ebp - 0x178], 0x128
push 0
push eax
call fcn.006300b0
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x4268d4
lea eax, [ebp - 0x178]
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4268d4
lea eax, [ebp - 0x154]
push eax
push dword [ebp + 8]
call fcn.0065a911
add esp, 8
test eax, eax
je 0x426916
lea eax, [ebp - 0x178]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4268a6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
mov eax, dword [ebp + 8]
or ecx, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4268f8
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00609c1d
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x170]
push esi
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
jmp 0x4268d6

Function at 0x426930
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push 0
push 0x102b
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
jne 0x42694b
xor al, al
pop ebp
ret
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov al, 1
pop ebp
ret
Function at 0x426c60
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x75f140]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push 0x104
mov dword [ebp - 0x110], eax
xor bl, bl
lea eax, [ebp - 0x108]
mov byte [ebp - 0x109], bl
push 0
push eax
call fcn.006300b0
mov eax, dword [ebp + 0xc]
lea esi, [ebp - 0x108]
mov edx, eax
add esp, 0xc
sub esi, edx
nop dword [eax]
mov cl, byte [edx]
lea edx, [edx + 1]
mov byte [esi + edx - 1], cl
test cl, cl
jne 0x426cb0
push edi
push dword [ebp - 0x110]
mov edi, dword [eax - 0xc]
push 0
push 0x1fffff
inc edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x426d4d
push 4
push 0x1000
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
test ebx, ebx
je 0x426d47
push 0
push edi
lea eax, [ebp - 0x108]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x426d47
push 0x6c5988
push str.Kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0
push ebx
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x426d47
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov bl, 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x426d57
mov bl, byte [ebp - 0x109]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x426d5e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
or ecx, 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
pop edi
test ecx, ecx
jg 0x426d7a
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00609c1d
mov esp, ebp
pop ebp
ret
Function at 0x429390
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x10]
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.ole32.dll_CoTreatAsClass]
mov edi, eax
test edi, edi
je 0x42941c
cmp dword [ebp + 8], esi
je 0x42941c
push esi
lea eax, [ebp - 8]
push eax
push 2
push esi
push 0x6cc1d4
push bind
call fcn.0045722e
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ole32.dll_StringFromCLSID]
test eax, eax
js 0x4293e5
push dword [ebp - 4]
call fcn.00457c64
mov esi, eax
push dword [ebp + 8]
call fcn.0066be50
pop ecx
push eax
push dword [ebp + 8]
push 1
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
push esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ole32.dll_CoTreatAsClass]
push dword [ebp - 8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret 0xc

Function at 0x429a32
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x429a8b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x429a8b
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 0x10]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x429a7c
cmp esi, ecx
jae 0x429a8b
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x429a6a
cmp esi, ecx
jae 0x429a8b
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
jmp 0x429a8d
xor eax, eax
pop esi
pop ebp
ret

Function at 0x42de34
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x42de73
call fcn.00436ce4
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x42de73
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x42de7b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.0042aaa2
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x42efaf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x42f03b
cmp dword [esi + 0x20], 0
je 0x42f03b
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42f03b
cmp dword [ebp + 8], 0
je 0x42f03b
xor edi, edi
mov ebx, edi
call fcn.00436ce4
push 0x6cd018
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 8], eax
test eax, eax
je 0x42f01f
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x42f03b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.00466d0d
mov edi, eax
add esp, 0xc
test edi, edi
je 0x42f037
mov ecx, esi
call fcn.0042ecc1
mov eax, edi
jmp 0x42f03d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x434781
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x69a231
call fcn.0060ae76
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x4347a7
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x434801
lea ecx, [ebp - 0x10]
call fcn.00401f50
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x6bfdfc]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0066bd65
push eax
call fcn.0040d920
add esp, 0x14
test esi, esi
je 0x4347f4
push esi
call fcn.0066be50
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00428a03
mov eax, ebx
call fcn.0060ae44
ret 8

Function at 0x435247
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x84], 0
mov esi, dword [ebx + 0x8c]
mov edi, dword [ebx + 0x88]
je 0x43528f
call fcn.00436ce4
push 5
push dword [ebx + 0x84]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x43528f
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x43529c
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
xor eax, eax
inc eax
test esi, esi
je 0x4352d8
mov edx, 0xffff
lea ecx, [esi + 0xc]
cmp word [esi + 2], dx
jne 0x4352bb
movzx edi, word [esi + 0x12]
movzx edx, word [esi + 0x14]
jmp 0x4352c4
movzx edx, word [ecx]
mov ecx, esi
movzx edi, word [esi + 0xa]
test dword [ecx], 0x1801
jne 0x4352d6
test di, di
jne 0x4352d6
test dx, dx
je 0x4352d8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4352dd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [esi + 0x84], edi
test edi, 0xffff0000
jne 0x435308
cmp dword [esi + 0x80], 0
jne 0x435308
movzx eax, di
mov dword [esi + 0x80], eax
call fcn.00436ce4
push 5
push edi
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x435338
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x435338
push ebx
push dword [ebp + 0xc]
mov ecx, esi
push eax
call fcn.0043559f
jmp 0x43533a
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x435341
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
call fcn.00436ce4
push 5
push dword [ebp + 8]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x435381
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x435381
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.00435389
jmp 0x435383
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x4356a2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x69a2c7
call fcn.0060aedf
mov edi, ecx
mov dword [ebp - 0x24], edi
mov ebx, dword [edi + 0x8c]
mov esi, dword [edi + 0x88]
mov dword [ebp - 0x18], ebx
call fcn.00436ce4
cmp dword [edi + 0x84], 0
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
je 0x435701
call fcn.00436ce4
push 5
push dword [edi + 0x84]
mov ebx, dword [eax + 0xc]
push ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x435715
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, dword [ebp - 0x18]
mov esi, eax
test esi, esi
je 0x435711
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 0x18], eax
test ebx, ebx
jne 0x43571d
or eax, 0xffffffff
jmp 0x43586f
mov ecx, edi
call fcn.00435d2f
mov ebx, eax
mov dword [ebp - 0x2c], ebx
call fcn.0042c8f7
xor esi, esi
and dword [ebp - 0x1c], esi
and dword [ebp - 0x28], esi
mov dword [ebp - 0x14], esi
test ebx, ebx
je 0x4357a9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp ebx, eax
je 0x4357a9
push ebx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4357a9
push esi
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x14], 1
call fcn.0042c4f0
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x4357a6
mov ecx, dword [esi]
mov esi, dword [ecx + 0x150]
mov ecx, esi
call dword [0x6bfdfc]
mov ecx, dword [ebp - 0x1c]
call esi
test eax, eax
je 0x4357a6
mov esi, dword [ebp - 0x1c]
mov ecx, esi
call fcn.00434976
test eax, eax
je 0x4357a6
push 0
mov ecx, esi
call fcn.004340c0
mov dword [ebp - 0x28], 1
mov esi, dword [ebp - 0x14]
and dword [ebp - 4], 0
push edi
call fcn.0042c565
push ebx
call fcn.0042dec8
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.00435645
test eax, eax
jne 0x4357f2
cmp dword [edi + 0x9c], eax
jne 0x4357f2
call fcn.00436ce4
push ebx
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
call fcn.0042dec8
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.00435645
and dword [edi + 0x9c], 0
jmp 0x43581d
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x28], 0
je 0x435831
mov ecx, dword [ebp - 0x1c]
push 1
call fcn.004340c0
test esi, esi
je 0x43583e
push 1
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
test ebx, ebx
je 0x435854
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [edi + 0x20]
jne 0x435854
push ebx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [edi]
mov esi, dword [eax + 0x60]
mov ecx, esi
call dword [0x6bfdfc]
mov ecx, edi
call esi
mov ecx, edi
call fcn.00435ce3
mov eax, dword [edi + 0x68]
call fcn.0060ae44
ret
Function at 0x44605f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x69baa0
call fcn.0060ae76
mov eax, ecx
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp + 0x10]
xor edi, edi
mov esi, dword [ebp + 0x14]
push edi
mov dword [ebx], edi
mov dword [esi], edi
cmp dword [eax + 0x58], edi
je 0x446107
push dword [ebp + 8]
call fcn.0044637c
mov dword [ebp - 0x10], eax
test eax, eax
je 0x44618e
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
push ecx
push edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push ecx
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
mov dword [esi], ecx
test eax, eax
jne 0x4460f0
push ecx
call fcn.00436654
pop ecx
lea ecx, [ebp - 0x14]
mov dword [ebx], eax
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4460f0
xor edi, edi
inc edi
jmp 0x4460fa
push dword [ebx]
call fcn.0043f8b7
pop ecx
mov dword [ebx], edi
lea ecx, [ebp - 0x24]
call fcn.00445e84
jmp 0x44618c
mov eax, dword [eax]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [eax + 0x84]
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call dword [0x6bfdfc]
mov ecx, dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x446184
mov esi, dword [ebp + 0x14]
shr ecx, 1
push ecx
mov dword [esi], ecx
call fcn.00436654
mov dword [ebx], eax
pop ecx
cmp dword [esi], edi
jbe 0x44617e
lea esi, [edi + edi]
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x10]
call fcn.00445e61
push esi
lea ecx, [ebp - 0x10]
lea ebx, [eax - 1]
shl bl, 4
sub bl, 0x41
call fcn.00445e61
mov ecx, dword [ebp + 0x10]
add al, bl
mov ecx, dword [ecx]
mov byte [edi + ecx], al
inc edi
mov eax, dword [ebp + 0x14]
cmp edi, dword [eax]
jb 0x44614b
mov eax, dword [ebp - 0x10]
xor edi, edi
inc edi
lea ecx, [eax - 0x10]
call fcn.00428a03
mov eax, edi
call fcn.0060ae44
ret 0x10

Function at 0x446196
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x4461e9
push esi
push dword [ebp + 8]
call fcn.0044637c
mov edi, eax
test edi, edi
je 0x4461e4
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4461e4
mov eax, dword [ebp - 8]
jmp 0x4461fb
mov eax, dword [ebp + 0x10]
jmp 0x4461fb
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop esi
leave
ret 0xc