joyce8/EMBER2024-capa huggingface dataset:
Function at 0x113d20c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x113f118
sub eax, eax
test esi, esi
je 0x113d2e4
sub eax, 1
test ecx, ecx
je 0x113d2e2
test esi, 3
je 0x113d24a
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x113d22f
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x113d2c9
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x113d254
mov ecx, edx
test ecx, ecx
je 0x113d2e2
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x113d2cf
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x113d2ec
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0113d36f
jae 0x113d2fa
xor ecx, ecx
call fcn.0113d36f
jae 0x113d329
xor eax, eax
call fcn.0113d36f
jae 0x113d339
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0113d36f
adc al, al
jae 0x113d31b
jne 0x113d365
stosb byte es:[edi], al
jmp 0x113d2fd
call fcn.0113d37b
sub ecx, ebx
jne 0x113d342
call fcn.0113d379
jmp 0x113d361
lodsb al, byte [esi]
shr eax, 1
je 0x113d38b
adc ecx, ecx
jmp 0x113d35e
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.0113d379
cmp eax, 0x7d00
jae 0x113d35e
cmp ah, 5
jae 0x113d35f
cmp eax, 0x7f
ja 0x113d360
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x113d2fd
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x113dc7c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1140000]
jne 0x113dc86
repz ret
jmp fcn.0113df2d
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x401c66
pop dword [ebp - 0x4c]
mov eax, 0x95ea230
add eax, 0xf6e17a36
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x30240f50
add dword [ebp - 0x5c], 0x1e2e35fb
mov dword [ebp - 0x58], 0x609f7b4
add dword [ebp - 0x58], 0x2c295491
mov dword [ebp - 0x54], 0x52264ccb
sub dword [ebp - 0x54], 0x5da089d
mov dword [ebp - 0x50], 0xa10017d0
add dword [ebp - 0x50], 0x5effe830
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xfc196abb
sub eax, 0xfbd93a67
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x81871f31
sub dword [ebp - 0x5c], 0xd14b5db
mov dword [ebp - 0x58], 0x8dc947de
add dword [ebp - 0x58], 0xb3a31997
mov dword [ebp - 0x54], 0x293b4c74
sub dword [ebp - 0x54], 0xc5cbe008
mov dword [ebp - 0x50], 0x1532d2cc
sub dword [ebp - 0x50], 0x1532d2cc
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x24f287d9
sub eax, 0x24b257ad
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x37122
push 0
call eax
mov ecx, 0xb9c946e6
add ecx, 0x46370376
mov edx, eax
mov ebx, 0x6dd415fd
sub ebx, 0x6d93a5fd
add ebx, dword [ebp - 0x4c]
mov esi, 0xf73516d9
sub dword [ebp - 0x38], ebx
mov edi, dword [ebx]
mov dword [ebp - 0xc], 0x8b4534b0
add edi, esi
add dword [ebp - 0x2c], 0x739c7491
mov dword [edx], edi
xor dword [ebp - 0x18], esi
add edx, 0x6d11aec6
add edx, 0x92ee513e
add ebx, 0x1562a48e
add ebx, 0xea9d5b76
loop 0x401d82
add eax, 0x11c43
xor ebx, ebx
add ebx, eax
add eax, 0x8f756c1
sub eax, 0x8f756bc
mov ecx, 0x6e8437b4
add ecx, 0x91bbc84c
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x100bad5
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x100e2a0], 0
push esi
jne 0x100ba43
call fcn.0100b93a
test eax, eax
je 0x100ba86
mov eax, dword [0x100e2a0]
cmp eax, 1
jne 0x100ba64
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x100ba86
pop esi
ret
push eax
call dword [0x100e2a8]
test eax, eax
jne 0x100bace
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x100ba8a
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x100e2a0]
call dword [0x100e2a8]
mov edi, eax
test edi, edi
je 0x100baaf
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x100bacb
mov edi, esi
add esi, 0xff0
push edi
push dword [0x100e2a0]
call dword [0x100e2a4]
add edi, 0x10
cmp edi, esi
jb 0x100bab7
mov eax, edi
pop edi
pop esi
ret
jmp 0x100ba30
Function at 0x100bde8
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x100cdc8
call fcn.0100be64
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x100e610
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x100bba3
cmp eax, esi
jne 0x100bb96
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x100bba6
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100bb7d
xor esi, esi
inc esi
mov eax, dword [0x100e60c]
cmp eax, esi
jne 0x100bbb9
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x100bbe8
mov eax, dword [0x100e60c]
test eax, eax
jne 0x100bbe2
mov dword [0x100e60c], esi
push 0x1001344
push 0x1001338
call fcn.0100badf
pop ecx
pop ecx
test eax, eax
je 0x100bbe8
jmp 0x100bd0c
mov dword [0x100e2cc], esi
mov eax, dword [0x100e60c]
cmp eax, esi
jne 0x100bc0c
push 0x1001334
push 0x100132c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x100e60c], 2
cmp dword [ebp - 0x20], ebx
jne 0x100bc19
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x100e614], ebx
je 0x100bc3a
push 0x100e614
call fcn.0100c0b9
pop ecx
test eax, eax
je 0x100bc3a
push ebx
push 2
push ebx
call dword [0x100e614]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x100bd0c
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x100bca4
cmp cx, bx
je 0x100bc5f
cmp dword [ebp - 0x1c], ebx
jne 0x100bca4
movzx ecx, word [eax]
cmp cx, bx
je 0x100bc74
cmp cx, 0x20
ja 0x100bc74
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x100bc5f
test byte [ebp - 0x40], 1
je 0x100bc80
movzx ecx, word [ebp - 0x3c]
jmp 0x100bc83
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x100e2c8], eax
cmp dword [0x100e2bc], ebx
jne 0x100bce9
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x100bcb5
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x100bc49
cmp dword [0x100e2cc], ebx
jne 0x100bcf7
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x100e2c8]
jmp 0x100bd18
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0100bea9
ret
call fcn.0100c1fe
jmp 0x100bb40
Function at 0x100c532
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x100e160]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
xor eax, eax
xor ecx, ecx
mov dword [esi], eax
mov dword [esi + 4], eax
mov word [esi + 8], cx
cmp dword [0x100e600], eax
jne 0x100c5c7
push 0x110
push eax
lea eax, [ebp - 0x114]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [0x100e600], 1
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100c5c7
cmp dword [ebp - 0x114], 5
jb 0x100c5ab
cmp dword [ebp - 0x110], 1
jae 0x100c5b4
cmp dword [ebp - 0x114], 6
jb 0x100c5c7
cmp dword [ebp - 0x108], 2
jne 0x100c5c7
mov dword [0x100e17c], 0x7f
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0100be41
leave
ret

Function at 0x100cbdb
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
call fcn.0100c8ef
xor ebx, ebx
cmp dword [ebp + 8], ebx
jne 0x100cbfd
mov eax, 0x80070057
jmp 0x100ccdd
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 0x80070057
push dword [ebp + 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call edi
test eax, eax
jne 0x100ccd9
cmp dword [ebp - 8], 1
je 0x100cc41
cmp dword [ebp - 8], 2
je 0x100cc41
cmp dword [ebp - 8], 7
jne 0x100ccd9
shr dword [ebp - 4], 1
test byte [esi + 8], 0x20
je 0x100cc83
mov eax, dword [esi + 4]
cmp dword [ebp - 4], eax
jb 0x100cc55
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push dword [esi]
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
mov ecx, dword [esi + 4]
cmp ecx, ebx
jle 0x100cc7d
mov edx, dword [esi]
xor edi, edi
mov word [edx + ecx*2 - 2], di
cmp eax, ebx
jne 0x100ccd9
jmp 0x100ccc4
push dword [ebp - 4]
mov ecx, esi
call fcn.0100c694
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x100ccd9
mov ecx, dword [ebp - 4]
add ecx, ecx
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
mov ecx, esi
test eax, eax
je 0x100ccbc
lea eax, [ebp - 0x10]
push eax
call fcn.0100c6c0
jmp 0x100ccd9
push dword [ebp - 0x10]
call fcn.0100c99f
cmp dword [ebp - 8], 2
je 0x100cccf
mov dword [ebp - 0xc], ebx
jmp 0x100ccd9
mov ecx, esi
call fcn.0100cb1d
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0xa755f4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi]
mov ecx, dword [esi + 4]
test eax, eax
jle 0xa7564e
push edi
mov edi, dword [ebp + 0x10]
sub dword [ebp + 0xc], edi
mov dword [ebp + 8], eax
mov edi, edi
inc bl
lea edi, [edi + 1]
movzx ebx, bl
mov dl, byte [esi + ebx + 8]
add cl, dl
movzx ecx, cl
mov al, byte [esi + ecx + 8]
mov byte [esi + ebx + 8], al
add al, dl
movzx eax, al
mov byte [esi + ecx + 8], dl
movzx edx, byte [eax + esi + 8]
mov eax, dword [ebp + 0xc]
xor dl, byte [eax + edi - 1]
dec dword [ebp + 8]
mov byte [edi - 1], dl
jne 0xa75614
mov eax, dword [ebp + 0x14]
pop edi
mov dword [esi], ebx
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
ret
Function at 0x4082e8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x44d1fc], 0
mov ebp, esp
push edi
mov ecx, dword [ebp + 0xc]
push esi
push ebx
mov ebx, dword [ebp + 0x10]
jne 0x408329
xor edx, edx
mov eax, edx
mov esi, 8
mov edi, eax
and eax, 1
neg eax
shr edi, 1
and eax, 0xedb88320
xor eax, edi
dec esi
jne 0x408306
mov dword [edx*4 + 0x44d1f8], eax
inc edx
cmp edx, 0x100
jne 0x4082ff
mov eax, dword [ebp + 8]
not eax
jmp 0x408343
mov dl, byte [ecx]
dec ebx
inc ecx
xor edx, eax
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0x44d1f8]
test ebx, ebx
jne 0x408330
pop ebx
not eax
pop esi
pop edi
pop ebp
ret 0xc

Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ebx
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
call dword [sym.imp.MSVCR100.dll_getenv]
xor ebx, ebx
pop ecx
test eax, eax
je 0x40104d
mov edi, dword [sym.imp.MSVCR100.dll_printf]
push str.Windows_original_main_args:_n
call edi
mov eax, dword [sym.imp.MSVCR100.dll___argc]
xor esi, esi
pop ecx
cmp dword [eax], ebx
jle 0x40104d
mov eax, dword [sym.imp.MSVCR100.dll___argv]
mov eax, dword [eax]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call edi
mov eax, dword [sym.imp.MSVCR100.dll___argc]
add esp, 0xc
inc esi
cmp esi, dword [eax]
jl 0x40102e
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
mov edi, eax
lea eax, [edi*4 + 4]
push eax
call sub.jli.dll_JLI_MemAlloc
pop ecx
pop ecx
mov esi, eax
call sub.jli.dll_JLI_GetStdArgs
xor ecx, ecx
cmp edi, ebx
jle 0x401087
mov edx, dword [eax + ecx*8]
mov dword [esi + ecx*4], edx
inc ecx
cmp ecx, edi
jl 0x40107c
mov eax, dword [str.java]
mov dword [esi + ecx*4], ebx
cmp eax, ebx
jne 0x401095
mov eax, dword [esi]
mov ecx, dword [str.java]
cmp ecx, ebx
jne 0x4010a1
mov ecx, dword [esi]
push ebx
push ebx
push ebx
push 1
push eax
push ecx
push 0x40222c
push 0x40221c
push 0x403024
push 2
push 0x403010
push 5
push esi
push edi
call sub.jli.dll_JLI_Launch
add esp, 0x38
pop edi
pop esi
pop ebx
ret
Function at 0x51dea0
Capabilities:
Terminate process

Disassembly:
test byte [0x5cc2e8], 0x20
jne 0x51debe
vmovq xmm0, xmm0
vcvttpd2qq xmm0, xmm0
vmovd eax, xmm0
vpextrd edx, xmm0, 1
ret
mov ecx, esp
add esp, 0xfffffff8
and esp, 0xfffffff8
movsd qword [esp], xmm0
mov eax, dword [esp]
mov edx, dword [esp + 4]
mov esp, ecx
btr edx, 0x1f
sbb ecx, ecx
cmp edx, 0x41e00000
jae 0x51df1e
cvttsd2si eax, xmm0
cdq
ret
mov ecx, edx
bts edx, 0x14
shr ecx, 0x14
and edx, 0x1fffff
sub ecx, 0x433
jge 0x51df18
neg ecx
push ebx
xor ebx, ebx
shrd ebx, eax, cl
je 0x51df11
cvttss2si ebx, dword [0x532bec]
pop ebx
shrd eax, edx, cl
shr edx, cl
ret
shld edx, eax, cl
shl eax, cl
ret
cmp edx, 0x43e00000
jae 0x51df37
test ecx, ecx
je 0x51dee8
call 0x51dee8
neg eax
adc edx, 0
neg edx
ret
jecxz 0x51df3f
ja 0x51df3f
test eax, eax
je 0x51df47
cvttss2si ecx, dword [0x532be8]
mov edx, SysReAllocStringLen
xor eax, eax
ret

Function at 0x51e623
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x51e662
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x51e662
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x51e662
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x51e662
cmp dword [ecx + 0x74], 0xe
jbe 0x51e662
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x52adc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x52aded
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x52aded
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x118fdec
Capabilities:
Encode data using xor

Disassembly:
jmp 0x118fdf6
pushal
call 0x118fdfc
pop ebp
sub ebp, 0x10
sub ebp, 0xd8fdec
jmp 0x118fe12
mov eax, 0xd8fdec
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c5
mov edx, 0xe6424028
xor byte [eax], dl
inc eax
dec ecx
jne 0x118fe29
jmp 0x118fe3c
mov dword [0x14a1a3e5], eax
sub byte [eax], ch
sub byte [ecx + 0x2828d0e9], ch
sub byte [ebx], ch
in eax, 0x90
sub al, 0x28
sub byte [eax], ch
xchg edx, eax
add byte [eax], ch
sub byte [eax], ch
invalid
Function at 0x402b2a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x50a7dc
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x56d790]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.StubInit
call fcn.00401769
and dword [esp + 0x34], 0
or dword [esp + 0x34], 0xffffffff
call fcn.004019cf
mov ecx, dword [edi + 0xc]
mov eax, dword [ecx]
lea edx, [esp + 0xc]
push edx
call dword [eax + 0x80]
mov dword [esp + 0x30], 1
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x51cb50
call fcn.00401769
mov byte [esp + 0x34], 2
push ecx
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0040184e
mov byte [esp + 0x38], 3
mov byte [esp + 0x38], 1
lea esi, [esp + 0x18]
call fcn.00414ad0
mov byte [esp + 0x38], 4
add esp, 4
mov eax, esi
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0040184e
mov byte [esp + 0x34], 5
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x38], 4
call fcn.0046fa25
mov byte [esp + 0x30], 6
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x51cb5c
call fcn.00401769
mov byte [esp + 0x34], 7
lea ebx, [edi + 0x78]
mov byte [esp + 0x34], 6
call fcn.00401acd
test eax, eax
jne 0x402c24
mov ecx, edi
call fcn.004022a2
mov ecx, edi
call fcn.00402d48
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x51cc6c
call fcn.00401769
mov byte [esp + 0x34], 8
mov byte [esp + 0x34], 6
call fcn.00401acd
test eax, eax
je 0x402c71
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Dev_mode_started.
call fcn.00401769
mov byte [esp + 0x34], 9
push 2
mov byte [esp + 0x38], 6
call fcn.00412200
push ecx
lea eax, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0040184e
mov byte [esp + 0x34], 0xa
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x51d067
call fcn.00401769
mov byte [esp + 0x3c], 0xb
lea eax, [esp + 0x28]
push eax
push dword [edi + 4]
mov byte [esp + 0x44], 6
call fcn.0042acdb
test eax, eax
jne 0x402d16
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Engine_configuration_failed_
call fcn.00401769
mov byte [esp + 0x34], 0xc
push 1
mov byte [esp + 0x38], 6
call fcn.00412200
xor esi, esi
mov byte [esp + 0x30], 4
lea ecx, [esp + 0x1c]
call fcn.0046fa89
mov byte [esp + 0x30], 1
lea ecx, [esp + 0x10]
call fcn.00401898
or dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.00401898
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 4]
lea ecx, [esp + 0x14]
add eax, 4
push ecx
push eax
call fcn.00401ce5
mov byte [esp + 0x30], 0xd
lea ecx, [edi + 0x74]
push eax
call fcn.004043ce
mov byte [esp + 0x30], 6
lea ecx, [esp + 0x14]
call fcn.00401898
xor esi, esi
inc esi
jmp 0x402cd8
Function at 0x408b29
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x56d790]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
push dword [edi + 0x20]
mov dword [ebp - 0x204], edi
mov esi, edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x408b66
mov ecx, dword [edi + 0x198]
test ecx, ecx
je 0x408b66
push 0
call fcn.004c2386
mov eax, 0x1e8
test esi, esi
jne 0x408be0
lea esi, [ebp - 0x200]
mov dword [esi], eax
mov eax, dword [edi + 0x20]
or dword [esi + 0xc], 3
push ebx
mov dword [esi + 4], eax
mov dword [esi + 8], 0x63
call fcn.004c6f26
mov eax, dword [eax + 8]
push 0x66
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov ebx, dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
push esi
lea edi, [esi + 0x1a0]
push 0
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], 0x496
mov dword [edi], 0xa
call ebx
test eax, eax
je 0x408be8
push esi
push 4
mov dword [edi], 3
call ebx
test eax, eax
je 0x408be8
mov ecx, dword [ebp - 0x204]
push 0
call fcn.004c2386
xor eax, eax
inc eax
jmp 0x408bea
cmp dword [esi], eax
je 0x408b75
xor eax, eax
jmp 0x408beb
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004dd215
leave
ret
Function at 0x40d9f8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x14
mov eax, 0x50493c
call fcn.004e2589
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x10], edi
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0xc]
push dword [ebp + 0x10]
shr eax, 4
inc eax
movzx eax, ax
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
cmp eax, edi
jne 0x40da55
push ecx
lea eax, [ebp + 0x14]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.0040184e
mov byte [ebp - 4], 2
push dword [ebp + 0xc]
mov byte [ebp - 4], bl
call fcn.0040dbe5
pop ecx
pop ecx
mov dword [ebp - 0x10], ebx
jmp 0x40dbd1
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x40dabe
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
push str.CCoreResource::LoadStringEx
call fcn.00401769
mov byte [ebp - 4], 3
push 0x1c8
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str..CoreResource.cpp
call fcn.00401769
mov byte [ebp - 4], 4
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.LoadResource_failed_
call fcn.00401769
mov byte [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov byte [ebp - 4], bl
call fcn.0041129b
lea eax, [ebp + 0x14]
push eax
mov ecx, esi
call fcn.0040184e
jmp 0x40da4d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x40db0e
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
push str.CCoreResource::LoadStringEx
call fcn.00401769
mov byte [ebp - 4], 6
push 0x1d1
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str..CoreResource.cpp
call fcn.00401769
mov byte [ebp - 4], 7
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.LockResource_failed_
call fcn.00401769
mov byte [ebp - 4], 8
jmp 0x40daa2
mov eax, dword [ebp + 0xc]
and eax, 0xf
jle 0x40db20
dec eax
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x40db16
lea ecx, [ebp + 0xc]
call fcn.0040dd7a
mov byte [ebp - 4], 9
movzx eax, word [edi]
push eax
lea ecx, [ebp + 0xc]
call fcn.0040dfa7
test eax, eax
jne 0x40db9a
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.CCoreResource::LoadStringEx
call fcn.00401769
mov byte [ebp - 4], 0xa
push 0x1e2
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str..CoreResource.cpp
call fcn.00401769
mov byte [ebp - 4], 0xb
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.CStringW.GetBuffer_failed_
call fcn.00401769
mov byte [ebp - 4], 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov byte [ebp - 4], 9
call fcn.0041129b
lea eax, [ebp + 0x14]
push eax
mov ecx, esi
call fcn.0040184e
jmp 0x40dbc3
movzx ecx, word [edi]
add ecx, ecx
push ecx
lea ecx, [edi + 2]
push ecx
push eax
call fcn.004de9d0
movzx eax, word [edi]
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
call fcn.0040dd50
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0040de52
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], bl
lea ecx, [ebp + 0xc]
call fcn.0040dfdb
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.00401898
mov eax, esi
call fcn.004e2661
ret
Function at 0x40e055
Capabilities:
Identify system language via api

Disassembly:
push 8
mov eax, 0x50d0e3
call fcn.004e2589
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
xor esi, esi
inc esi
mov dword [ebp - 0x14], esi
call fcn.0041ce7d
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ecx, dword [ebp + 8]
movzx edi, ax
call fcn.00404312
movzx eax, di
push eax
push str.0x_04x
push dword [ebp + 8]
mov dword [ebp - 0x10], esi
call fcn.004042ff
add esp, 0xc
mov byte [ebp - 4], 0
call fcn.0040dffe
mov eax, dword [ebp + 8]
call fcn.004e2661
ret
Function at 0x41308c
Capabilities:
Read .ini file

Disassembly:
push 4
mov eax, 0x4fad32
call fcn.004e2589
mov esi, dword [ebp + 0xc]
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
mov dword [ebp - 4], 3
mov ecx, esi
call fcn.00404312
mov eax, dword [ebp + 8]
push dword [ebp + 0x18]
mov edi, dword [eax]
mov ecx, esi
mov dword [ebp - 0x10], 1
call fcn.00401673
push edi
push dword [ebp + 0x18]
push eax
push dword [ebp + 0x1c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00404286
mov byte [ebp - 4], 2
lea ecx, [ebp + 0x10]
call fcn.00401898
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x14]
call fcn.00401898
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x1c]
call fcn.00401898
mov eax, esi
call fcn.004e2661
ret 0x18