joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407aa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
mov eax, dword [esp + 0x68]
push ebx
push ebp
push esi
push edi
mov ebx, ecx
lea edi, [eax + 0x420]
mov ecx, edi
call dword [sym.imp.VzSatData.dll_public:_void___thiscall_CVzSatCtlPt::DeleteAll_void_]
mov ecx, dword [ebx + 0x20]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x1004
push ecx
call ebp
xor esi, esi
mov dword [esp + 0x20], eax
test eax, eax
jle 0x407bf7
push 0
lea edx, [esp + 0x14]
push esi
push edx
mov ecx, ebx
call sub.MFC42.DLL_CListCtrl::GetItemText
mov eax, dword [eax]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
cdq
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], edx
call fcn.0042fd2e
push 1
lea eax, [esp + 0x18]
push esi
push eax
mov ecx, ebx
call sub.MFC42.DLL_CListCtrl::GetItemText
mov eax, dword [eax]
push eax
call dword [sym.imp.MSVCRT.dll_atof]
fstp qword [esp + 0x28]
add esp, 4
lea ecx, [esp + 0x14]
call fcn.0042fd2e
push 2
lea ecx, [esp + 0x1c]
push esi
push ecx
mov ecx, ebx
call sub.MFC42.DLL_CListCtrl::GetItemText
mov eax, dword [eax]
push eax
call dword [sym.imp.MSVCRT.dll_atof]
fstp qword [esp + 0x30]
add esp, 4
lea ecx, [esp + 0x18]
call fcn.0042fd2e
push 3
lea edx, [esp + 0x20]
push esi
push edx
mov ecx, ebx
call sub.MFC42.DLL_CListCtrl::GetItemText
mov eax, dword [eax]
push eax
call dword [sym.imp.MSVCRT.dll_atof]
fstp qword [esp + 0x38]
add esp, 4
lea ecx, [esp + 0x1c]
call fcn.0042fd2e
mov eax, dword [ebx + 0x20]
push 0
push 0
push 0x1004
push eax
call ebp
test esi, esi
jl 0x407bca
cmp esi, eax
jge 0x407bca
mov edx, dword [ebx + 0x20]
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x4c]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0x50], esi
push ecx
push eax
push 0x1005
push edx
mov dword [esp + 0x5c], 2
call ebp
mov eax, dword [esp + 0x68]
jmp 0x407bcd
or eax, 0xffffffff
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x24]
push 1
lea edi, [ecx + 0x420]
push eax
mov ecx, edi
call dword [sym.imp.VzSatData.dll_public:_void___thiscall_CVzSatCtlPt::AddPoint_struct_CVzSatCtlPt::tagGCP___bool_]
mov eax, dword [esp + 0x20]
inc esi
cmp esi, eax
jl 0x407ade
mov ecx, edi
call dword [sym.imp.VzSatData.dll_public:_bool___thiscall_CVzSatCtlPt::Save_void_]
mov ebx, dword [esp + 0x78]
mov eax, dword [ebx + 0x414]
mov esi, dword [ebx + 0x410]
test eax, eax
jle 0x407c24
mov ebp, eax
mov ecx, dword [esi]
push edi
call dword [sym.imp.VzSatData.dll_public:_void___thiscall_CVzSatModel::InitializeParallax_class_CVzSatCtlPt__]
add esi, 4
dec ebp
jne 0x407c15
mov ecx, ebx
call dword [sym.imp.VzSatData.dll_public:_void___thiscall_CVzSatPro::UpdateGcpPtFlag_void_]
mov esi, dword [ebx + 0x408]
mov ebx, dword [ebx + 0x40c]
test ebx, ebx
jle 0x407c4c
mov edi, dword [sym.imp.VzSatData.dll_public:_bool___thiscall_CVzSatPhoto::Save_void_]
mov ecx, dword [esi]
call edi
add esi, 4
dec ebx
jne 0x407c42
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret 4
Function at 0x409640
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43dbdd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov ebp, ecx
push edi
mov dword [esp + 0x10], ebp
call fcn.0042fcc2
mov dword [ebp], 0x441c20
xor ebx, ebx
lea ecx, [ebp + 0x40]
mov dword [esp + 0x20], ebx
call dword [sym.imp.SpVZImage.dll_public:_void___thiscall_CSpVZImage::constructor_void_]
lea esi, [ebp + 0x56c]
mov dword [esp + 0x14], esi
push 0x428
mov byte [esp + 0x24], 2
mov dword [esi], 0x442508
mov dword [esi + 0x14], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x2c], 1
call sub.MFC42.DLL_operatornew
mov edi, eax
mov ecx, 0x10a
xor eax, eax
mov dword [esi + 0x1c], edi
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0x1c]
add esp, 4
add ecx, 0x28
add ecx, 2
mov byte [ecx - 2], al
mov byte [ecx - 1], al
mov byte [ecx], al
inc eax
add ecx, 4
cmp eax, 0x100
jl 0x4096c6
mov ecx, dword [esp + 0x18]
mov byte [esi + 0x18], 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0xc], ebx
pop edi
mov dword [ebp], 0x442448
mov dword [ebp + 0x5a4], 0x3f800000
mov dword [ebp + 0x5a8], ebx
mov dword [ebp + 0x5b0], ebx
mov dword [ebp + 0x5ac], ebx
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x41d880
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [esp + 8]
push 0
push eax
push 2
push ecx
push esi
mov dword [esp + 0x1c], 0
call edi
mov eax, dword [esp + 0x18]
lea edx, [esp + 8]
push 0
push edx
push 2
push eax
push esi
call edi
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 8]
push 0
push ecx
push 4
push edx
push esi
call edi
mov ecx, dword [esp + 0x20]
lea eax, [esp + 8]
push 0
push eax
push 4
push ecx
push esi
call edi
pop edi
pop esi
pop ecx
ret
Function at 0x422c90
Capabilities:
Get file version info

Disassembly:
sub esp, 0x314
mov al, byte [0x452670]
push ebx
push esi
push edi
mov byte [esp + 0x1c], al
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x1d]
rep stosd dword es:[edi], eax
mov edx, dword [esp + 0x324]
lea ecx, [esp + 0x1c]
stosw word es:[edi], ax
push 0x200
push ecx
push edx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x422dad
push esi
call sub.MFC42.DLL_operatornew
mov edx, dword [esp + 0x1c]
add esp, 4
mov ebx, eax
lea eax, [esp + 0x1c]
push ebx
push esi
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x422d10
test ebx, ebx
je 0x422dad
jmp 0x422da4
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push edx
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x422da0
mov eax, dword [esp + 0xc]
test eax, eax
jbe 0x422da0
mov eax, dword [esp + 0x328]
xor ecx, ecx
push eax
mov eax, dword [esp + 0x14]
xor edx, edx
mov cx, word [eax + 2]
mov dx, word [eax]
push ecx
push edx
lea eax, [esp + 0x228]
push str.StringFileInfo_04x_04x_s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
lea eax, [esp + 0x21c]
push ecx
push edx
push eax
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x422da0
mov edi, dword [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x4542a0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test ebx, ebx
je 0x422dad
push ebx
call sub.MFC42.DLL_operatordelete
add esp, 4
pop edi
pop esi
mov eax, 0x4542a0
pop ebx
add esp, 0x314
ret
Function at 0x424860
Capabilities:
Read file via mapping

Disassembly:
push 0xffffffffffffffff
push 0x43e7b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call dword [sym.imp.SpGUI.dll_protected:_void___thiscall_CGuiMDIFrameWnd::constructor_void_]
lea ecx, [esi + 0x1198]
mov dword [esp + 0x1c], 0
call dword [sym.imp.SpGUI.dll_public:_void___thiscall_CGuiStatusBar::constructor_void_]
lea ecx, [esi + 0x1228]
mov byte [esp + 0x1c], 1
call dword [sym.imp.SpGUI.dll_public:_void___thiscall_CGuiToolBar::constructor_void_]
lea edi, [esi + 0x1354]
mov byte [esp + 0x1c], 2
mov ecx, edi
call fcn.0042fcc2
mov dword [edi], 0x442b20
lea edi, [esi + 0x1394]
mov byte [esp + 0x1c], 3
mov ecx, edi
call fcn.0042fcc2
mov dword [edi], 0x441a04
lea edi, [esi + 0x13d8]
mov byte [esp + 0x1c], 4
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.0042fcc2
lea ebp, [edi + 0x40]
mov byte [esp + 0x1c], 5
mov ecx, ebp
call sub.MFC42.DLL_CString::CString
push str.__Supresoft_Inc___r_n
mov ecx, ebp
mov byte [esp + 0x20], 6
mov dword [edi], 0x443534
call fcn.0042fdd0
push str.VZSATWND
push 0
mov dword [edi + 0x44], 1
push 6
mov dword [esi + 0x1420], 0x443530
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
test eax, eax
mov dword [esi + 0x1424], eax
jne 0x42495e
push str.VZSATWND
push 0x100
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 0x1424], eax
mov eax, dword [esi + 0x1424]
push 0x100
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x1428], eax
mov dword [esi], 0x443420
mov dword [esi + 0x13d4], 0
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x428c20
Capabilities:
Delete directory
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x43eda8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 1
call sub.MFC42.DLL_CFileFind::CFileFind
mov esi, dword [esp + 0x40]
lea ecx, [esp + 4]
push esi
mov dword [esp + 0x3c], 0
call sub.MFC42.DLL_CString::CString_1
push str..
lea ecx, [esp + 8]
mov byte [esp + 0x3c], 1
call sub.MFC42.DLL_CString::operator
mov eax, dword [esp + 4]
push 0
push eax
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
je 0x428d51
push ebx
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov bl, 3
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CFileFind::FindNextFileA
lea ecx, [esp + 0x20]
mov ebp, eax
call sub.MFC42.DLL_CFileFind::IsDots
test eax, eax
jne 0x428d46
mov edx, dword [esp + 0x20]
push 0x10
lea ecx, [esp + 0x24]
call dword [edx + 0x40]
test eax, eax
je 0x428cee
lea eax, [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
call sub.MFC42.DLL_CFileFind::GetFilePath
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x44], 2
push ecx
call fcn.00428c20
add esp, 4
mov byte [esp + 0x44], 1
lea ecx, [esp + 0x14]
jmp 0x428d41
lea ecx, [esp + 0x4c]
call sub.MFC42.DLL_CString::CString
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x20]
push edx
mov byte [esp + 0x48], bl
call sub.MFC42.DLL_CFileFind::GetFileName
mov eax, dword [eax]
lea ecx, [esp + 0x4c]
push eax
push esi
push str._s_s
push ecx
mov byte [esp + 0x54], 4
call sub.MFC42.DLL_CString::Format
add esp, 0x10
lea ecx, [esp + 0x1c]
mov byte [esp + 0x44], bl
call fcn.0042fd2e
mov edx, dword [esp + 0x4c]
push edx
call edi
mov byte [esp + 0x44], 1
lea ecx, [esp + 0x4c]
call fcn.0042fd2e
test ebp, ebp
jne 0x428c96
pop edi
pop ebp
pop ebx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CFileFind::Close
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
pop esi
jne 0x428d6a
mov dword [esp + 8], eax
lea ecx, [esp]
mov byte [esp + 0x34], 0
call fcn.0042fd2e
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], 0xffffffff
call fcn.00430382
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x432cc0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [esi + 8]
push eax
push 1
push ecx
push edi
call sub.MSVCRT.dll_fread
mov ecx, dword [esi + 8]
add esp, 0x10
cmp eax, 1
mov eax, ecx
cdq
sete bl
idiv dword [esi + 0x18]
test bl, bl
mov byte [esp + 0x12], bl
mov dword [esi + 0x1c], eax
je 0x432e44
mov edx, dword [esi + 0x14]
push 0xffffffffffffffff
add edx, ecx
push eax
push 0x18
mov dword [esi + 0x14], edx
push ecx
lea edx, [esi + 0x30]
lea ebx, [esi + 0x20]
mov ecx, esp
push edx
mov dword [esp + 0x28], ebx
call fcn.00433180
push ecx
mov ecx, esp
push str.read
call fcn.00423070
push ebx
call fcn.00430b40
mov ecx, dword [esi + 0x18]
mov ebp, dword [esi + 0x1c]
add esp, 0x18
xor ebx, ebx
xor eax, eax
cmp ecx, 1
sete byte [esp + 0x13]
mov edx, ebp
dec ebp
test edx, edx
je 0x432de5
inc ebp
mov dl, byte [esp + 0x13]
test dl, dl
je 0x432d5f
xor edx, edx
cmp byte [edi], dl
jmp 0x432d64
xor edx, edx
cmp word [edi], dx
sete dl
test edx, edx
je 0x432d8e
test eax, eax
je 0x432d87
cmp edi, eax
je 0x432d87
imul ecx, ebx
mov edx, edi
sub edx, eax
push edx
push eax
sub eax, ecx
push eax
call sub.MSVCRT.dll_memmove
add esp, 0xc
mov ecx, dword [esi + 0x18]
inc ebx
lea eax, [ecx + edi]
add edi, ecx
dec ebp
jne 0x432d51
test eax, eax
je 0x432db0
cmp edi, eax
je 0x432db0
mov ecx, dword [esi + 0x18]
sub edi, eax
imul ecx, ebx
push edi
push eax
sub eax, ecx
push eax
call sub.MSVCRT.dll_memmove
add esp, 0xc
test ebx, ebx
je 0x432de5
push 0xffffffffffffffff
push ebx
push 1
push ecx
mov ecx, esp
push 0
call fcn.00423070
push ecx
mov ecx, esp
push str.nulls_removed
call fcn.00423070
mov edx, dword [esp + 0x28]
push edx
call fcn.00430b40
mov eax, dword [esi + 0x1c]
add esp, 0x18
sub eax, ebx
mov dword [esi + 0x1c], eax
cmp dword [esi + 0x18], 1
jle 0x432e36
mov eax, dword [esi + 4]
push eax
call fcn.004317d0
add esp, 4
test al, al
je 0x432e36
mov ecx, dword [esi + 0x1c]
mov edx, dword [esp + 0x1c]
push ecx
push edx
call fcn.004317e0
add esp, 8
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov ecx, esp
push 0
call fcn.00423070
push ecx
mov ecx, esp
push str.endian_swap
call fcn.00423070
mov eax, dword [esp + 0x28]
push eax
call fcn.00430b40
add esp, 0x18
mov al, byte [esp + 0x12]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov ecx, esi
call fcn.00432340
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x433c40
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
mov ebp, ecx
push esi
mov esi, dword [esp + 0x14]
push edi
mov eax, dword [ebp + 0x18]
mov edi, dword [esp + 0x14]
imul eax, dword [ebp + 0x1c]
test esi, esi
mov dword [ebp + 8], eax
jne 0x433c5e
mov esi, edi
mov ecx, dword [ebp + 4]
xor ebx, ebx
push ecx
call fcn.004317d0
add esp, 4
test al, al
je 0x433cd3
test edi, edi
jne 0x433c9d
mov edx, dword [ebp + 0x1c]
shl edx, 1
push edx
call sub.MFC42.DLL_operatornew
mov ecx, dword [ebp + 0x1c]
mov ebx, eax
shl ecx, 1
mov eax, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
add esp, 4
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
mov esi, ebx
mov ecx, dword [ebp + 0x1c]
push ecx
push edi
call fcn.004317e0
add esp, 8
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov ecx, esp
push 0
call fcn.00423070
push ecx
mov ecx, esp
push str.endian_swap
call fcn.00423070
lea edx, [ebp + 0x20]
push edx
call fcn.00430b40
add esp, 0x18
mov eax, dword [ebp]
mov ecx, dword [ebp + 8]
push eax
push 1
push ecx
push esi
call sub.MSVCRT.dll_fwrite
add esp, 0x10
cmp eax, 1
sete byte [esp + 0x18]
test ebx, ebx
je 0x433cfb
push ebx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov al, byte [esp + 0x18]
test al, al
je 0x433d46
mov eax, dword [ebp + 0x1c]
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
push 0xffffffffffffffff
push eax
push 0x18
add esi, edx
push ecx
lea edx, [ebp + 0x30]
mov ecx, esp
push edx
mov dword [ebp + 0x14], esi
call fcn.00433180
push ecx
mov ecx, esp
push str.write
call fcn.00423070
add ebp, 0x20
push ebp
call fcn.00430b40
mov al, byte [esp + 0x30]
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov ecx, ebp
call fcn.00432340
mov al, byte [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x43ad00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
xor eax, eax
mov al, byte [0x45588c]
and eax, 1
test eax, eax
jne 0x43ad3a
mov cl, byte [0x45588c]
or cl, 1
mov byte [0x45588c], cl
mov ecx, 0x455788
call fcn.0043c2c0
push 0x43ae24
call fcn.0043047a
add esp, 4
mov dword [ebp - 4], 0x45578c
mov byte [ebp - 0x10], 0
mov edx, dword [ebp + 8]
mov byte [edx + 0x1f], 0x7a
mov byte [ebp - 8], 0x7a
mov eax, dword [ebp + 8]
mov byte [eax + 0x1d], 0x6f
mov byte [ebp - 0xc], 0
jmp 0x43ad66
mov cl, byte [ebp - 0xc]
add cl, 1
mov byte [ebp - 0xc], cl
mov edx, dword [ebp - 0xc]
and edx, 0xff
cmp edx, 0x1e
jge 0x43ad8a
mov eax, dword [ebp - 0xc]
and eax, 0xff
mov ecx, dword [ebp + 8]
mov dl, byte [ebp - 0x10]
add dl, byte [ecx + eax]
mov byte [ebp - 0x10], dl
jmp 0x43ad5d
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 0x10]
mov byte [eax + 0x1e], cl
mov edx, dword [ebp + 8]
mov al, byte [edx + 0x1e]
mov byte [ebp - 0x14], al
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov al, byte [edx + 4]
mov byte [ecx + 0x1e], al
mov ecx, dword [ebp + 8]
mov dl, byte [ebp - 0x14]
mov byte [ecx + 4], dl
mov byte [ebp - 0xc], 0
jmp 0x43adbf
mov al, byte [ebp - 0xc]
add al, 1
mov byte [ebp - 0xc], al
mov ecx, dword [ebp - 0xc]
and ecx, 0xff
cmp ecx, 0x1f
jge 0x43ae02
mov edx, dword [ebp - 0xc]
and edx, 0xff
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax + edx]
mov edx, dword [ebp - 4]
xor eax, eax
mov al, byte [edx + ecx]
mov ecx, dword [ebp - 8]
and ecx, 0xff
xor eax, ecx
mov edx, dword [ebp - 0xc]
and edx, 0xff
mov ecx, dword [ebp + 8]
mov byte [ecx + edx], al
jmp 0x43adb7
mov edx, dword [ebp + 8]
mov al, byte [edx + 0x1f]
mov byte [ebp - 0x18], al
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov al, byte [edx + 8]
mov byte [ecx + 0x1f], al
mov ecx, dword [ebp + 8]
mov dl, byte [ebp - 0x18]
mov byte [ecx + 8], dl
mov esp, ebp
pop ebp
ret
Function at 0x1000c0a0
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
lea eax, [ebp - 0x34]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call 0x100b8d09
test eax, eax
js 0x1000c196
cmp word [ebp - 0x34], 6
je 0x1000c196
lea eax, [ebp - 4]
push eax
push 0x10004090
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1000c14d
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x100040ac
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000c144
cmp dword [ebp - 0xc], eax
je 0x1000c144
push 0x100040c0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1000c144
push 0x100040cc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1000c144
push dword [ebp + 8]
mov ecx, esi
call dword [0x100a8504]
call esi
pop esi
mov esp, ebp
pop ebp
ret 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 8]
cmp esi, 0x78
je 0x1000c165
cmp esi, 0xdc
jb 0x1000c196
cmp esi, 0x140
jae 0x1000c196
push 0x3594
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
je 0x1000c196
mov ecx, eax
mov edx, 0x20
and ecx, 0x1f
sub edx, ecx
push esi
mov dword [eax + edx - 4], edx
lea ecx, [eax + edx]
call 0x100b8d09
pop esi
mov esp, ebp
pop ebp
ret 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1ae9e68
Capabilities:
Encode data using xor

Disassembly:
and al, 8
je 0x1ae9e32
jp 0x1aeb5d7
test bp, 0x1b9a
cmp ah, 0x2e
pushfd
call fcn.01ae4476
lea ebx, [eax + 0x45f5b40a]
inc bx
mov ebx, eax
pushfd
stc
bt si, 6
cmp byte [edi], 0x23
call fcn.00f21a9d
push edx
dec al
bt bp, 0xa
clc
test si, 0x3d0f
stc
shr eax, 1
call fcn.01ae5520
dec dword [ecx + 0x58202444]
mov dword [esp + 0x20], eax
pop eax
pushal
mov dword [esp + 0x38], 0
push dword [esp]
lea eax, [ebp - 0x6bbe51d]
lea eax, sym.imp.KERNEL32.dll_LocalAlloc
push esp
call fcn.017f9fa7
nop
jo 0x1ae9e1b
sbb al, 0x1d
mov eax, 0xd92f4c36
jo 0x1ae9e9b
loope 0x1ae9ee4
inc esp
cmp al, 0xd5
mov bh, 0x52
aad 0xb7
push edx
and cl, byte [ebp + 0x3b]
cli
or dh, byte [ebp + 0x63]
jne 0x1ae9e67
xor eax, 0xd2d34bbb
xor eax, 0x45a303c3
sbb dword [edx + 0x730b912c], esp
rcr al, cl
pop ecx
pop es
setg byte [esi]
add ecx, dword [ecx + 0xbf2934]
pushfd
test eax, 0x95e0f0cf
lahf
das
shr esp, cl
dec edi
mov eax, dword [ebp - 0x4c6e72ef]
inc esi
cmp eax, dword [ecx + 0x55]
dec ecx
pop es
pop es
cmpsb byte [esi], byte es:[edi]
or dword [ebx + 0x5966627d], edx
arpl word [edx], sp
jl 0x1ae9f0f
and bh, byte [eax + ebp - 0x53]
lodsd eax, dword [esi]
push ebp
mov al, 0xdb
mov ebp, 0xa9cb16a1
mov byte [ebx - 5], ch
invalid
ja 0x1ae9f82
mov esp, 0xfdc1b310
cmp ecx, ecx
lcall 0xc4d, 0x5ed2b155
inc byte [ebp + 0x18]
add dword [ecx], ebx
movsb byte es:[edi], byte [esi]
cdq
aas
push eax
inc ebp
dec edi
dec eax
dec eax
inc esi
cmp byte [esi + 0x2e9832ec], cl
ror byte [esi], 0x80
inc esi
invalid
invalid
std
xchg dword [edi], esp
xchg edx, eax
popal
add dh, byte [ebx + eax*4 + 0x7d5077c2]
inc eax
test edi, edx
rol edx, 0x4f
cmp eax, 0x9c216829
mov edi, 0xd712990d
pop ss
xor dword [esi], 0x678aca35
sbb byte [edi + 0x7dfdac1f], 0x73
or ebp, esp
loope 0x1ae9f78
dec esi
dec edi
mov ebx, 0x57d40c24
push ecx
mov byte [ecx + edi*4], 0xe0
fisubr word [esi]
adc eax, 0xb7b69998
test byte [ecx], dh
inc ebp
pop ebp
xchg ebx, eax
loope 0x1ae9ffb
sahf
rol dword [ebx], cl
lea esi, [edx]
xor al, 0x46
xchg edi, eax
push ebx
in al, dx
xchg esp, eax
push ds
push esi
cmpsd dword [esi], dword es:[edi]
xchg esp, eax
add eax, 0xd161fe1b
invalid
adc byte [0x45709027], ah
fistp dword [eax + eax - 0x67137cef]
cmpsd dword [esi], dword es:[edi]
sub eax, 0xed0ff0fc
sub dword [0x8239502e], eax
hlt
cmc
test cl, dl
clc
clc
cmp ah, 0x2e
push 0x6675057d
pushal
pushal
push dword [esp + 4]
push dword [esp + 0x48]
ret 0x4c

Function at 0x1af61ac
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], al
mov dword [ebp], edx
push ebp
push dword [esp]
mov dword [ebp + 4], eax
mov byte [esp + 4], al
push dword [esp + 4]
mov byte [esp + 8], 0xbc
pushfd
lea esp, [esp + 0x38]
jmp 0x1af4c5b
pushal
jmp 0x1af4f10
rol dl, cl
rdtsc
cmp dl, dh
call fcn.01af40f6
call fcn.01af59b2
jnp 0x1af4d31
rdtsc
stc
pushal
pushfd
stc
sub ebp, 8
mov byte [esp], ch
push eax
jmp 0x1af4294
Function at 0x405e67
Capabilities:
Hide graphical window

Disassembly:
push 8
mov eax, 0x41600f
call fcn.00414bab
mov esi, ecx
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push 0
push dword [esi + 0x308]
call ebx
push 0
push dword [esi + 0x30c]
call ebx
call dword [sym.imp.GrooveUtil.DLL_public:_static_struct_HINSTANCE______stdcall_GCGrooveResourceModule::GetHandle_void_]
push eax
push 0x3ab3
lea edi, [ebp - 0x14]
call fcn.00407a99
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
push eax
add esi, 0x310
push dword [esi]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 1
push dword [esi]
call ebx
push 5
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi]
call dword [sym.imp.USER32.dll_SetFocus]
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], 0
je 0x405ee6
lea ecx, [ebp - 0x10]
call dword [sym.imp.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_]
call fcn.00414c4a
ret

Function at 0x405f59
Capabilities:
Hide graphical window

Disassembly:
push 0x13c
mov eax, 0x415f62
call fcn.00414c14
mov eax, dword [ebp + 8]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x28], eax
lea eax, [ebp - 0x124]
xor edi, edi
push eax
mov dword [ebx + 0x24], edi
mov dword [ebp - 0x148], 1
call fcn.00407a43
mov dword [ebp - 4], edi
push 0xa
lea eax, [ebp - 0x124]
push eax
push dword [ebx + 0x24]
call dword [sym.imp.GrooveUtil.DLL_public:_static_void___stdcall_raw_GCStr::LongToString_long_int__class_GCStackStrBase___long_int_]
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x148]
push eax
push dword [ebx + 0x24]
mov eax, dword [ebx + 0x28]
mov byte [ebp - 0x11c], 1
call fcn.00411c5b
lea esi, [ebp - 0x128]
call fcn.00407981
mov byte [ebp - 4], 1
lea esi, [ebx + 8]
push edi
xor eax, eax
mov edi, esi
call fcn.00411c5b
test eax, eax
jne 0x405ff6
push 0xe
call dword [sym.imp.kernel32.dll_SetLastError]
jmp 0x40601b
push ebx
push esi
call fcn.00411c5b
push 0
push 0x4076dc
push dword [ebp - 0x12c]
push 0x515
push dword [0x424edc]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov byte [ebp - 4], 0
lea esi, [ebp - 0x128]
call fcn.0040796b
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x124]
push eax
call fcn.00408436
call fcn.00414c5e
ret 8