joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005f1a0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006b89d
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x1008a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x84]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push eax
mov byte [ebp - 0x84], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x67452301
mov dword [ebp - 0x34], 0xefcdab89
mov dword [ebp - 0x30], 0x98badcfe
mov dword [ebp - 0x2c], 0x10325476
call fcn.1005f040
cmp byte [ebp - 0x84], 0
jne 0x1005f2f1
xor edx, edx
lea ecx, [ebp - 0x3f]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x18], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x17], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x16], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x15], al
add edx, 4
cmp edx, 8
jb 0x1005f235
mov edx, dword [ebp - 0x40]
mov ecx, 0x78
shr edx, 3
mov eax, 0x38
and edx, 0x3f
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovae eax, ecx
lea ecx, [ebp - 0x84]
push eax
push 0x1008a6f8
call fcn.1005f040
push 8
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x84]
call fcn.1005f040
xor edx, edx
lea ecx, [ebp - 0x37]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x28], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x27], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x26], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x25], al
add edx, 4
cmp edx, 0x10
jb 0x1005f2a4
push 0x40
lea eax, [ebp - 0x83]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
mov byte [ebp - 0x84], 1
add esp, 0xc
movq qword [ebp - 0x40], xmm0
push esi
lea ecx, [ebp - 0x84]
call fcn.1005f0f0
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x1005f333
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1005f329
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1005f329
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1005fd30
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005f409
mov esp, ebp
pop ebp
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x10007c1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x10007c2e
pop dword [ebp - 8]
mov eax, 0x1288cbf1
sub eax, 0x2884fc3
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x7d0d64b7
add dword [ebp - 0x18], 0xd144e094
mov dword [ebp - 0x14], 0xe01058ef
sub dword [ebp - 0x14], 0xaddd0caa
mov dword [ebp - 0x10], 0x4ca2e7ff
sub dword [ebp - 0x10], 0x56a3d1
mov dword [ebp - 0xc], 0x8869cbfc
sub dword [ebp - 0xc], 0x8869cbfc
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x938ebd81
add dword [ebp - 0x18], 0xe0e3abd5
mov dword [ebp - 0x14], 0x67ddd895
sub dword [ebp - 0x14], 0x26717720
mov dword [ebp - 0x10], 0x75cd6298
add dword [ebp - 0x10], 0xeda209d4
mov dword [ebp - 0xc], 0xf7bd8888
sub dword [ebp - 0xc], 0xf7bd8888
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x383b30fa
sub eax, 0x283ab0aa
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x358ae
push 0
call eax
mov ecx, 0x6cb641bc
add ecx, 0x934a01c4
xor esi, esi
add esi, eax
mov edi, 0xb7634fc2
sub edi, 0xa76255c2
add edi, dword [ebp - 8]
mov edx, 0x19c91832
xor dword [ebp - 4], 0x2fb081db
mov ebx, dword [edi]
xor dword [ebp - 4], 0x18c4f3f2
xor ebx, edx
mov dword [esi], ebx
add esi, 4
add edi, 0x5ff29229
add edi, 0xa00d6ddb
loop 0x10007d47
add eax, 0x9bb81e72
add eax, 0x6448e261
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x16bcf685
sub ecx, 0x6bcf685
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1001899b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x100189aa
pop dword [ebp - 0x2c]
mov eax, 0x58cd5cf0
sub eax, 0x48cbd346
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x42b78
push 0
mov eax, 0xcb26aee2
add eax, 0x44dcb1fa
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x1f8fb83f
sub ecx, 0x1f8f670e
mov edx, eax
mov ebx, 0xc4d99a4a
sub ebx, 0xb4d5dc4a
add ebx, dword [ebp - 0x2c]
mov esi, 0x4e370f1e
add esi, 0xff1a3f0f
add dword [ebp - 0x24], edx
mov edi, dword [ebx]
sub dword [ebp - 0x18], ecx
xor edi, esi
sub dword [ebp - 4], ebx
mov dword [edx], edi
add dword [ebp - 0x1c], edx
add edx, 0x94427e1f
add edx, 0x6bbd81e5
add ebx, 0xa3545ecc
sub ebx, 0xa3545ec8
loop 0x10018a09
add eax, 0x859a945d
sub eax, 0x85995cc6
mov ebx, eax
add eax, 0x9fbb877c
add eax, 0x60447889
mov ecx, 0x20f93b69
sub ecx, 0x10f93b69
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.1001899b
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1001899b
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret
Function at 0x100022e0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x30
cmp byte [0x100aa284], 0
je 0x1000236e
mov ecx, 0x100a8efc
call fcn.10008160
movd xmm0, eax
movq xmm1, qword [0x1000a058]
por xmm0, xmm1
subsd xmm0, xmm1
movapd xmmword [esp + 0x10], xmm0
mov ecx, 0x100a8efc
call fcn.10008160
movd xmm0, eax
movq xmm1, qword [0x1000a058]
por xmm0, xmm1
subsd xmm0, xmm1
mulsd xmm0, qword [0x1000a060]
addsd xmm0, qword [esp + 0x10]
movsd xmm1, qword [ebp + 0x10]
movsd xmm2, qword [ebp + 8]
subsd xmm1, xmm2
mulsd xmm1, qword [0x1000a068]
mulsd xmm1, xmm0
addsd xmm1, xmm2
movsd qword [esp + 8], xmm1
fld qword [esp + 8]
mov esp, ebp
pop ebp
ret
mov byte [0x100aa284], 1
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [0x100aa280], 0xffffffff
mov dword [0x100a8f00], eax
mov ecx, 0xfffffd92
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
add eax, 0x26f
mov dword [ecx*4 + 0x100a98bc], eax
test ecx, ecx
je 0x100023cd
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
add eax, 0x270
mov dword [ecx*4 + 0x100a98c0], eax
add ecx, 2
jmp 0x1000238e
mov dword [0x100a8efc], 0x270
jmp 0x100022f2
Function at 0x4044d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4044e5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x404526
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x404522
nop word [eax + eax]
cmp esi, edx
jae 0x404526
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x404510
cmp esi, edx
jb 0x40452b
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x4063a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0041750e
Function at 0x4068e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55cd11
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x5b7e5c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], 0
call fcn.004088f9
mov ecx, eax
test ecx, ecx
jne 0x406931
push 0x80004005
call fcn.00402590
mov eax, dword [ecx]
call dword [eax + 0xc]
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4069b3
mov eax, dword [ebp - 0x10]
inc eax
push eax
call fcn.0040710a
add esp, 4
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4069aa
test esi, esi
jne 0x406993
xor ecx, ecx
jmp 0x4069a1
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406998
sub ecx, edx
push ecx
push esi
mov ecx, edi
call fcn.004042c0
push esi
call fcn.00407105
add esp, 4
mov esi, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4069d2
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406de0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55cdb0
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5b7e5c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jne 0x406e34
push 0
push 0
push str.Informe_o_arquivo.
call fcn.0040acd9
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push eax
lea eax, [ebp + 8]
push eax
call fcn.00405c30
push dword [eax]
mov dword [ebp - 4], 0
call fcn.00405bf0
mov edx, dword [ebp + 8]
add esp, 0xc
test eax, eax
mov dword [ebp - 4], 0xffffffff
sete bl
or edi, 0xffffffff
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x406e78
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x406ea0
push 0
push 0
push str.Diret
call fcn.0040acd9
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push dword [esi]
lea eax, [ebp + 8]
push eax
call fcn.00405c90
add esp, 8
mov eax, dword [eax]
mov ebx, dword [eax - 0xc]
mov eax, dword [ebp + 8]
lea edx, [eax - 0x10]
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x406ecb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, ebx
je 0x406e10
push dword [esi]
call fcn.00405cf0
add esp, 4
test eax, eax
jne 0x406f03
push eax
push eax
push str.Informe_a_extens
call fcn.0040acd9
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp byte [ebp + 0xc], 0
je 0x406f37
test eax, eax
jne 0x406f91
push eax
push eax
push str.Arquivo_n
call fcn.0040acd9
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test eax, eax
je 0x406f91
lea ecx, [ebp + 0xc]
call fcn.00401c70
push dword [esi]
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 1
push str.Arquivo__s_j
push eax
call fcn.00403090
add esp, 0xc
push 0
push 4
push dword [ebp + 0xc]
call fcn.0040acd9
lea ecx, [ebp + 0xc]
cmp eax, 7
jne 0x406f8c
call fcn.00401fc0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.00401fc0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40d847
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x40d88c
call fcn.00426bed
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40d88c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x40d8a8
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00426d9c
mov ebx, eax
test edi, edi
je 0x40d8a6
test esi, esi
je 0x40d8a6
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40e2b2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x40e370
cmp dword [esi + 0x20], 0
je 0x40e370
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40e370
cmp dword [ebp + 8], 0
je 0x40e370
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.00426bed
push str.AFX_DIALOG_LAYOUT
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x40e341
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40e370
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.0042b318
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x40e361
test edi, edi
je 0x40e361
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x40e36c
mov ecx, esi
call fcn.0040e055
mov eax, ebx
jmp 0x40e372
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x412903
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x55ef08
call fcn.0053f932
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x412929
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x412988
call fcn.004088f9
push eax
lea ecx, [ebp - 0x10]
call fcn.00407695
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call fcn.0053f8f5
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.00548547
push eax
call fcn.00402430
add esp, 0x14
test esi, esi
je 0x41297b
push esi
call fcn.00548570
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004075b1
mov eax, ebx
call fcn.0053f8fb
ret 8
Function at 0x417573
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.00426bed
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4175aa
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.004175cb
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41a129
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x55d716
call fcn.0053f932
mov eax, ecx
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp + 0x10]
xor edi, edi
mov ecx, dword [ebp + 0x14]
push edi
mov dword [ebx], edi
mov dword [ecx], edi
cmp dword [eax + 0x58], edi
je 0x41a1d3
push dword [ebp + 8]
mov ecx, eax
call fcn.0041a45e
mov esi, eax
test esi, esi
je 0x41a266
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], edi
push eax
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
test eax, eax
jne 0x41a1bc
push edx
call fcn.0040710a
pop ecx
lea ecx, [ebp - 0x14]
mov dword [ebx], eax
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41a1bc
xor edi, edi
inc edi
jmp 0x41a1c6
push dword [ebx]
call fcn.00407105
pop ecx
mov dword [ebx], edi
lea ecx, [ebp - 0x24]
call fcn.00419fee
jmp 0x41a264
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [esi + 0x84]
mov ecx, esi
push eax
call fcn.0053f8f5
mov ecx, dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov esi, dword [eax - 0xc]
mov dword [ebp - 0x18], esi
test esi, esi
je 0x41a25c
mov ecx, dword [ebp + 0x14]
mov eax, esi
shr eax, 1
push eax
mov dword [ecx], eax
call fcn.0040710a
mov dword [ebx], eax
pop ecx
test esi, esi
jle 0x41a256
mov esi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
lea ecx, [ebp - 0x10]
call fcn.00440be9
push edi
lea ecx, [ebp - 0x10]
lea ebx, [eax - 1]
shl bl, 4
sub bl, 0x41
call fcn.00440be9
add al, bl
mov edx, edi
test edx, edx
jns 0x41a247
add edx, 1
sar edx, 1
mov ecx, dword [esi]
add edi, 2
mov byte [edx + ecx], al
cmp edi, dword [ebp - 0x18]
jl 0x41a21e
mov eax, dword [ebp - 0x10]
xor edi, edi
inc edi
lea ecx, [eax - 0x10]
call fcn.004075b1
mov eax, edi
call fcn.0053f8fb
ret 0x10
Function at 0x41a26e
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x41a2c1
push esi
push dword [ebp + 8]
call fcn.0041a45e
mov edi, eax
test edi, edi
jne 0x41a291
mov eax, dword [ebp + 0x10]
jmp 0x41a2d3
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x41a28c
mov eax, dword [ebp - 8]
jmp 0x41a2d3
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x42dc2a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
je 0x42dc44
mov edi, dword [esi + 0xc]
jmp 0x42dc84
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x42dc5d
call fcn.0041665a
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x42dc72
call fcn.0041665a
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x42dc84
call fcn.0041665a
call fcn.00426bed
cmp dword [eax + 0x3c], 0
je 0x42dc99
push edi
mov ecx, ebx
call fcn.0042d2be
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.0042de76
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x42dcc2
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x42dcce
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8