joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c9190
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
test dl, dl
je 0x4c91a2
add esp, 0xfffffff0
call fcn.00403240
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004b780c
mov eax, dword [ebp - 4]
mov dword [eax + 0x538], 0xffffffff
mov eax, 4
call fcn.00402b78
imul eax, eax, 0x1f4
add eax, 0x3e8
mov edx, dword [ebp - 4]
mov dword [edx + 0x3f0], eax
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x3f4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x23a], 0x32
mov eax, 0xbb8
call fcn.00402b78
push eax
call fcn.00407b30
pop edx
sub eax, edx
mov edx, dword [ebp - 4]
mov dword [edx + 0x3f8], eax
mov eax, 0xbb8
call fcn.00402b78
push eax
call fcn.00407b30
pop edx
sub eax, edx
mov edx, dword [ebp - 4]
mov dword [edx + 0x3fc], eax
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x400], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x540], 0
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x544], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x548], edx
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x4c9276
call fcn.00403298
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
pop ecx
pop ecx
pop ebp
ret

Function at 0x4caf08
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cb0f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x60c]
jmp loc.0050a470

Function at 0x4cb11c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cb34f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x60c]
jmp fcn.0050a4fe

Function at 0x4cb7f8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cbc37
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x608]
jmp fcn.0050a58c
Function at 0x512250
Capabilities:
Read .ini file

Disassembly:
test byte [eax + 0x123], 4
je fcn.004b865c
cmp byte [eax + 0x34], 0x2d
jb fcn.004b865c
push ecx
lea eax, [ebp - 0x20]
add edx, 0x10f
call fcn.00403e70
mov eax, dword [0x4ea490]
mov eax, dword [eax]
mov edx, dword [ebp - 0x20]
call fcn.004ae640
cmp eax, 0
je 0x51232d
cmp byte [eax + 0x128], 0
je 0x51229d
dec byte [eax + 0x128]
cmp word [eax + 0x11e], 0xfff2
jae 0x5122b0
add word [eax + 0x11e], 8
push eax
mov edx, dword [ebp - 4]
add edx, 0x15
lea eax, [ebp - 0x20]
call fcn.00403e70
push 0x51ebb8
push dword [ebp - 0x20]
push 0x51ebd8
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403f8c
pop eax
push eax
mov edx, dword [ebp - 0x20]
xor ecx, ecx
call fcn.004bb124
pop eax
call fcn.004bf0c4
mov edx, 0x51eb68
mov eax, dword [ebp - 4]
xor ecx, ecx
mov byte [eax + 0x11e], 4
call fcn.004bb124
mov eax, dword [ebp - 4]
and byte [eax + 0x123], 0xfb
xor ecx, ecx
mov dword [eax + 0x10f], ecx
mov dword [eax + 0x113], ecx
mov eax, dword [ebp - 4]
call fcn.004bf0c4
pop ecx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
jmp fcn.004b865c
push 0x51ecd8
push 7
xor eax, eax
mov dword [0x51b811], eax
mov dword [0x51b814], eax
push 0x51b811
push 0x4e46dc
push dword [ebp - 0x20]
push 0x51ed18
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
xor edx, edx
mov eax, 0x51b811
call fcn.00453b20
add eax, 8
lea edx, [ebp - 0x1c]
call fcn.004091c0
push 0x51ecd8
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 0x51ed18
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringA]
jmp 0x5122eb
Function at 0x1003205
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
je 0x10031de
xor eax, eax
jmp 0x1003233
cmp dword [ebp - 4], 1
jbe 0x10031da
push ebx
push edi
mov edi, 0x10074a0
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp - 4]
call fcn.01003307
pop ecx
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x1003225
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
je 0x1003229
push ebx
call fcn.01003324
xor eax, eax
jmp 0x1003231
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
xor eax, eax
inc eax
pop edi
pop ebx
pop esi
leave
ret 0x10
Function at 0x401000
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x409004]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.00403760
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x412]
push eax
mov word [ebp - 0x414], dx
call fcn.00403760
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x61a]
push edx
mov word [ebp - 0x61c], cx
call fcn.00403760
add esp, 0x24
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x20c]
push 0x5c
push ecx
call fcn.004013fe
add esp, 8
test eax, eax
je 0x401095
add eax, 2
jmp 0x40109b
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x414]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4010a3
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea edx, [ebp - 0x620]
push edx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
mov dword [ebp - 0x624], 0x208
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x401117
lea eax, [ebp - 0x624]
push eax
mov eax, dword [ebp - 0x620]
lea ecx, [ebp - 0x61c]
push ecx
push 0
push 0
lea edx, [ebp - 0x414]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x620]
push ecx
call edi
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x61c]
push eax
call fcn.00401373
add esp, 8
test eax, eax
jne 0x401146
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004011da
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x620]
push ecx
push 0x20006
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call esi
mov esi, eax
test esi, esi
jne 0x4011ad
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401170
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
push edx
mov edx, dword [ebp - 0x620]
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
lea ecx, [ebp - 0x414]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [ebp - 0x620]
push eax
call edi
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
sete al
pop edi
xor ecx, ebp
pop esi
call fcn.004011da
mov esp, ebp
pop ebp
ret

Function at 0x4011da
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x409004]
jne 0x4011e4
repz ret
jmp fcn.004015cc
Function at 0x404dfc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x409004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004020ef
and dword [ebp - 0x14], 0
cmp dword [0x40a898], 0
mov dword [ebp - 0x18], eax
jne 0x404eaf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404f57
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404f57
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40a898], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40a89c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40a8a0], eax
call edi
push eax
call esi
mov dword [0x40a8a8], eax
test eax, eax
je 0x404eaf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40a8a4], eax
mov eax, dword [0x40a8a4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404f08
cmp dword [0x40a8a8], ecx
je 0x404f08
push eax
call esi
push dword [0x40a8a8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404f08
test ebx, ebx
je 0x404f08
call edi
test eax, eax
je 0x404eff
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x404eff
test byte [ebp - 8], 1
jne 0x404f08
or dword [ebp + 0x10], 0x200000
jmp 0x404f3b
mov eax, dword [0x40a89c]
cmp eax, dword [ebp - 0x18]
je 0x404f3b
push eax
call esi
test eax, eax
je 0x404f3b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x404f3b
mov eax, dword [0x40a8a0]
cmp eax, dword [ebp - 0x18]
je 0x404f3b
push eax
call esi
test eax, eax
je 0x404f3b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40a898]
call esi
test eax, eax
je 0x404f57
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404f59
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004011da
leave
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x46bb6a7d
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..text_1
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x59160a42
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401056
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov ecx, 0x51eea8
jmp 0x401040
push 0xffffffffffffffff
push 0x4f0b6f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
xor ecx, ecx
or eax, 0xffffffff
mov dword [esp + 4], esi
mov dword [esi], ecx
mov dword [esi + 4], eax
mov dword [esp + 0x10], ecx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], ecx
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], ecx
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], ecx
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], ecx
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], ecx
mov dword [esi + 0x7c], eax
mov dword [esi + 0x80], ecx
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], ecx
mov dword [esi + 0x8c], eax
mov dword [esi + 0x90], ecx
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], ecx
mov dword [esi + 0x9c], eax
mov dword [esi + 0xa0], ecx
mov dword [esi + 0xa4], eax
mov dword [esi + 0xa8], ecx
mov dword [esi + 0xac], eax
mov dword [esi + 0xb0], ecx
mov dword [esi + 0xb4], eax
mov ecx, esi
mov byte [esp + 0x10], 0x16
call fcn.00401360
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x402f70
Capabilities:
Check os version

Disassembly:
sub esp, 0x19c
xor eax, eax
mov cl, byte [eax + str.Unknown]
mov byte [esp + eax + 0x9c], cl
inc eax
test cl, cl
jne 0x402f78
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
xor eax, eax
mov ecx, 0x27
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x9c
call esi
test eax, eax
jne 0x402fc9
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x94
call esi
test eax, eax
je 0x4030ea
mov eax, dword [esp + 0x18]
sub eax, 0
je 0x4030aa
dec eax
je 0x403044
dec eax
jne 0x4030c2
mov edx, dword [esp + 0xc]
cmp edx, 4
ja 0x403002
xor eax, eax
nop
lea esp, [esp]
mov cl, byte [eax + str.Windows_NT]
mov byte [esp + eax + 0xa4], cl
inc eax
test cl, cl
jne 0x402ff0
cmp edx, 5
jb 0x4030c2
cmp dword [esp + 0x10], 1
jb 0x40302b
xor eax, eax
mov cl, byte [eax + str.Windows_XP]
mov byte [esp + eax + 0xa4], cl
inc eax
test cl, cl
jne 0x403014
jmp 0x4030c2
xor eax, eax
lea ecx, [ecx]
mov cl, byte [eax + str.Windows_2000]
mov byte [esp + eax + 0xa4], cl
inc eax
test cl, cl
jne 0x403030
jmp 0x4030c2
mov eax, dword [esp + 0xc]
cmp eax, 4
mov ecx, dword [esp + 0x10]
jb 0x403077
cmp ecx, 0x5a
jb 0x40306c
xor eax, eax
mov cl, byte [eax + str.Windows_ME]
mov byte [esp + eax + 0xa4], cl
inc eax
test cl, cl
jne 0x403058
jmp 0x4030c2
cmp eax, 4
ja 0x403094
jne 0x403077
test ecx, ecx
ja 0x403094
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + str.Windows_95]
mov byte [esp + eax + 0xa4], cl
inc eax
test cl, cl
jne 0x403080
jmp 0x4030c2
xor eax, eax
mov cl, byte [eax + str.Windows_98]
mov byte [esp + eax + 0xa4], cl
inc eax
test cl, cl
jne 0x403096
jmp 0x4030c2
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + str.Microsoft_Win32s]
mov byte [esp + eax + 0xa4], cl
inc eax
test cl, cl
jne 0x4030b0
mov edx, dword [esp + 0x1a8]
test edx, edx
je 0x4030ea
lea ecx, [esp + 0xa4]
lea eax, [esp + 0xa4]
sub edx, ecx
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4030e0
pop edi
pop esi
add esp, 0x19c
ret 4
Function at 0x403a20
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
sub esp, 0x454
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea edx, [esp + 0x54]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x403a30
lea ecx, [esp + 0x54]
call fcn.00403b30
mov dword [0x51f1b0], eax
mov eax, dword [0x51eee0]
test eax, eax
jne 0x403a56
mov eax, 0x51ef98
push esi
push edi
push str.GAME.DIC
push eax
mov ecx, 0x51efa0
call fcn.00403740
push str..437
push 0
call fcn.00432f44
add esp, 8
mov dword [0x51f440], 0xfffffffe
mov dword [0x51f438], 4
call sub.COMCTL32.dll_InitCommonControls
mov edi, dword [esp + 0x460]
mov edx, 1
mov ecx, edi
call fcn.004075b0
mov esi, eax
cmp esi, 1
jne 0x403ac4
mov dword [0x51f440], 0
call sub.COMCTL32.dll_InitCommonControls
mov edx, esi
mov ecx, edi
call fcn.004075b0
mov esi, eax
test esi, esi
jne 0x403b15
mov eax, dword [0x51f1b0]
test eax, eax
jne 0x403b15
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0xc]
push ecx
push esi
push esi
push 0x20
push esi
push esi
push esi
push esi
lea edx, [esp + 0x80]
push edx
mov dword [esp + 0x30], 0x44
mov dword [esp + 0x5c], 1
mov word [esp + 0x60], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
mov eax, esi
pop esi
add esp, 0x454
ret 0x10
Function at 0x405f40
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x404
push ebx
push ebp
push esi
push edi
push 0x51efac
mov edi, ecx
push str.Hardware_Error
mov ecx, 0x51efa0
mov dword [esp + 0x18], edx
call fcn.00403930
test eax, eax
je 0x405f81
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + str.Hardware_Error]
mov byte [eax + 0x51efac], cl
inc eax
test cl, cl
jne 0x405f70
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x51efac
push 0x49a
push edi
call esi
mov ebp, dword [sym.imp.USER32.dll_SetWindowTextA]
push eax
call ebp
push 0
push 0x4a0
push edi
call esi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
push 0
push 0x4b8
push edi
call esi
push eax
call ebx
push 0
push 0x3f4
push edi
call esi
push eax
call ebx
push 0
push 0x3f5
push edi
call esi
push eax
call ebx
push 0
push 0x4a4
push edi
call esi
push eax
call ebx
push 0
push 0x4b2
push edi
call esi
push eax
call ebx
push 0
push 0x4b5
push edi
call esi
push eax
call ebx
push 0
push 0x4b3
push edi
call esi
push eax
call ebx
push 0
push 0x4a3
push edi
call esi
push eax
call ebx
push 0
push 0x4b9
push edi
call esi
push eax
call ebx
push 0
push 0x4b4
push edi
call esi
push eax
call ebx
push 0
push 0x4b1
push edi
call esi
push eax
call ebx
push 0
push 0x3fe
push edi
call esi
push eax
call ebx
mov eax, dword [esp + 0x418]
mov ecx, dword [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x1c]
push str._s___s
push edx
call fcn.004326d1
add esp, 0x10
lea eax, [esp + 0x14]
push eax
push 0x4ab
push edi
call esi
push eax
call ebp
push 1
push 0x4ab
push edi
call esi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 1
push 0x4ab
push edi
call esi
push eax
call ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x404
ret 4
Function at 0x409a60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test edx, edx
mov eax, ecx
jne 0x409a6b
xor eax, eax
ret 4
push ebx
push esi
mov esi, dword [esp + 0xc]
cmp esi, 8
not eax
jb 0x409b6a
push edi
mov edi, esi
shr edi, 3
mov ecx, eax
xor ebx, ebx
mov bl, byte [edx]
and ecx, 0xff
xor ecx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [ecx*4 + 0x4f23a0]
sub esi, 8
xor eax, ebx
inc edx
mov ecx, eax
xor ebx, ebx
mov bl, byte [edx]
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [edx + 1]
mov ecx, dword [ecx*4 + 0x4f23a0]
shr eax, 8
xor ecx, eax
inc edx
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [edx + 1]
mov eax, dword [eax*4 + 0x4f23a0]
shr ecx, 8
xor eax, ecx
inc edx
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [edx + 1]
mov ecx, dword [ecx*4 + 0x4f23a0]
shr eax, 8
xor ecx, eax
inc edx
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [edx + 1]
mov eax, dword [eax*4 + 0x4f23a0]
shr ecx, 8
xor eax, ecx
inc edx
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [edx + 1]
mov ecx, dword [ecx*4 + 0x4f23a0]
shr eax, 8
xor ecx, eax
inc edx
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [edx + 1]
mov eax, dword [eax*4 + 0x4f23a0]
shr ecx, 8
xor eax, ecx
inc edx
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x4f23a0]
xor eax, ecx
inc edx
dec edi
jne 0x409a82
pop edi
test esi, esi
je 0x409b8c
mov ecx, eax
xor ebx, ebx
mov bl, byte [edx]
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x4f23a0]
xor eax, ecx
inc edx
dec esi
jne 0x409b6e
pop esi
pop ebx
not eax
ret 4
Function at 0x40dea0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, dword [esp + 0x18]
push edi
mov ecx, dword [esi + 0x18]
mov eax, ecx
cdq
and edx, 0xfff
add eax, edx
mov edi, eax
lea eax, [ecx + ebx - 1]
cdq
and edx, 0xfff
add eax, edx
sar edi, 0xc
sar eax, 0xc
cmp edi, eax
jne 0x40df19
cmp edi, dword [esi + 0x10]
jge 0x40df19
mov eax, dword [esi + 0xc]
and ecx, 0x80000fff
mov edi, dword [eax + edi*4]
jns 0x40deed
dec ecx
or ecx, 0xfffff000
inc ecx
xor eax, eax
test ebx, ebx
jle 0x40dfd5
mov ebp, dword [esp + 0x18]
add edi, ecx
mov cl, byte [eax + ebp]
mov dl, byte [esi + 0x18]
xor cl, dl
mov byte [edi + eax], cl
mov ecx, dword [esi + 0x18]
inc ecx
inc eax
cmp eax, ebx
mov dword [esi + 0x18], ecx
jl 0x40defd
jmp 0x40dfd5
xor ebp, ebp
test ebx, ebx
jle 0x40dfd5
mov ecx, dword [esi + 0x18]
mov eax, ecx
cdq
and edx, 0xfff
add eax, edx
mov edi, eax
sar edi, 0xc
and ecx, 0x80000fff
jns 0x40df46
dec ecx
or ecx, 0xfffff000
inc ecx
mov eax, dword [esi + 0x10]
mov dword [esp + 0x10], ecx
cmp edi, eax
jl 0x40dfac
lea edx, [eax*4 + 4]
push edx
call fcn.00432f36
mov ecx, dword [esi + 0x10]
mov ebx, eax
add esp, 4
xor eax, eax
test ecx, ecx
jle 0x40df7f
mov ecx, dword [esi + 0xc]
inc eax
mov edx, dword [ecx + eax*4 - 4]
mov dword [ebx + eax*4 - 4], edx
mov ecx, dword [esi + 0x10]
cmp eax, ecx
jl 0x40df6c
mov eax, dword [esi + 0xc]
push eax
call fcn.00432366
push 0x1000
mov dword [esi + 0xc], ebx
call fcn.00432f36
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
mov ebx, dword [esp + 0x24]
add esp, 8
mov dword [edx + ecx*4], eax
mov eax, dword [esi + 0x10]
inc eax
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x18]
mov edx, dword [esi + 0xc]
mov cl, byte [eax + ebp]
mov al, byte [esi + 0x18]
xor cl, al
mov eax, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
mov byte [edx + eax], cl
mov edx, dword [esi + 0x18]
inc edx
inc ebp
cmp ebp, ebx
mov dword [esi + 0x18], edx
jl 0x40df23
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
cmp ecx, eax
jge 0x40dfe2
mov dword [esi + 0x14], eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8

Function at 0x40ea10
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx + 0x14]
test eax, eax
jne 0x40ea32
mov eax, dword [ecx + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push ecx
push 1
push edx
call fcn.00432576
add esp, 0x10
ret 8
mov ecx, dword [ecx + 4]
cmp eax, 5
je 0x40ea4b
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
call fcn.00407b60
ret 8
jmp fcn.0040dff0