joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468e74
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46901f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x469000
mov dl, 1
mov eax, dword [0x419158]
call fcn.00403fe8
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404e6c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x468fef
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0045a040
test al, al
je 0x468fe2
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x469030
lea eax, [ebp - 0x254]
call fcn.0040a438
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x468fe2
xor eax, eax
push ebp
push 0x468fdb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x469068
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x468fc4
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004050dc
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x468fc4
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004050dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468fe2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x468ee5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.0041d948
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469026
lea eax, [ebp - 0x260]
call fcn.00404e6c
ret

Function at 0x469998
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4a9588]
cmp byte [eax + 0xad], 0
jne 0x469a09
cmp dword [0x4a95a0], 0
jne 0x4699ca
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x469954
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4a95a0], eax
cmp dword [0x4a959c], 0
jne 0x4699e5
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4a959c], eax
cmp dword [0x4a95a4], 0
jne 0x469a09
push esp
push 0
push 0
push 0x4698f8
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x4a95a4], eax
pop edx
ret
Function at 0x469bdc
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x469bf3
add esp, 0xfffffff0
call fcn.00404364
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00423dc0
mov eax, dword [0x4a53fc]
cmp word [eax + 2], 0
jne 0x469c1b
mov eax, dword [0x4a53fc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0046b6a4
mov eax, dword [0x4a54d4]
cmp word [eax + 2], 0
jne 0x469c35
mov eax, dword [0x4a54d4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0046b8b0
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x418aec]
call fcn.00403fe8
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x418aec]
call fcn.00403fe8
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x418aec]
call fcn.00403fe8
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x428354]
call fcn.0042e450
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x469dec
mov eax, dword [0x4a52f4]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042e824
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x46bf80
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4a52f4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040dd00
test eax, eax
je 0x469d3c
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409ddc
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040dd34
test eax, eax
je 0x469d50
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004050dc
mov byte [ebx + 0xd4], 0
push ebx
push 0x46b1ec
call fcn.00424f3c
mov dword [ebx + 0xc8], eax
mov eax, dword [0x4a51ac]
cmp byte [eax], 0
jne 0x469da1
mov eax, ebx
call fcn.00469f30
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.0046c15c
mov eax, ebx
call fcn.0046ccbc
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x469de1
call fcn.004043bc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46a1b0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4a9588]
cmp dword [eax + 0x30], 0
je 0x46a25a
cmp dword [ebx + 0x94], 0
jne 0x46a254
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x46a140
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x46a254
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x46a21a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x46a254
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041b388
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x46a229
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x46af74
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x46afa9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404f5c
jmp 0x46afb6
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404ec0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x46c340
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x46c3ae
mov eax, esi
call fcn.00454c74
test al, al
je 0x46c3ae
mov eax, dword [ebx + 0x84]
call fcn.004548d4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46c3ae
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x46c3a2
push 0
mov eax, dword [ebx + 0x84]
call fcn.004548d4
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0044ccc0
jmp 0x46c3ae
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0046c17c
pop esi
pop ebx
ret
Function at 0x4925d8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
mov eax, esp
mov edx, 0x49265c
call fcn.00409e48
movzx eax, byte [ebx + 0xc]
sub al, 1
jb 0x4925fc
je 0x492617
jmp 0x492630
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push 0x1001
push 0x800
call sub.kernel32.dll_GetLocaleInfoA_1
jmp 0x492630
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push 0x1001
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
mov edx, esi
mov eax, esp
call fcn.00409fc8
cmp word [ebx + 0x12], 0
je 0x49264a
mov ecx, esi
mov edx, ebx
mov eax, dword [ebx + 0x14]
call dword [ebx + 0x10]
add esp, 0x100
pop esi
pop ebx
ret
Function at 0x49a388
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
dec ecx
test ecx, ecx
jl 0x49a3b9
inc ecx
xor esi, esi
mov ebx, eax
and bl, 0xff
mov edi, edx
add edi, esi
xor bl, byte [edi]
movzx ebx, bl
mov ebx, dword [ebx*4 + 0x4a4d84]
shr eax, 8
xor ebx, eax
mov eax, ebx
inc esi
dec ecx
jne 0x49a399
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0xfa7c50
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ecx, dword [eax + 0x3c]
add ecx, eax
push esi
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
xor edx, edx
add eax, ecx
push edi
or ebx, ebx
je 0xfa7c8c
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0xfa7c84
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0xfa7c8e
inc edx
add eax, 0x28
cmp edx, ebx
jb 0xfa7c74
sub eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0xfa7d60
Capabilities:
Parse pe header

Disassembly:
push ebp
push esp
pop ebp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0xfa7d74
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
sub eax, eax
cmp dword [ecx], 0x4550
jne 0xfa7d8f
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
Function at 0x401b40
Capabilities:
Inspect load icon resource

Disassembly:
push esi
mov esi, ecx
call sub.MFC42.DLL_AfxGetModuleState
push 0xd0
push 0xe
push 0xd0
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0
mov ecx, esi
mov dword [esi + 0x50], eax
mov dword [esi + 0x40], 0
call fcn.00401a30
mov eax, dword [esp + 8]
test eax, eax
jne 0x401b7f
pop esi
ret 4
mov ecx, dword [esi + 0x28]
push 0
push eax
mov eax, dword [esi + 0x20]
or ecx, 0x10
push 0x2275
push eax
mov dword [esi + 0x28], ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x78]
test eax, eax
je 0x401bb4
test byte [esi + 0x28], 8
jne 0x401bb4
push 0
mov ecx, esi
call sub.MFC42.DLL_CWnd::RunModalLoop
mov eax, dword [esi + 0x40]
pop esi
ret 4

Function at 0x403b30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebx, ecx
call fcn.00404ee0
push eax
call fcn.00404750
add esp, 4
mov ebp, eax
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [esp + 0x14]
mov edi, dword [eax + 8]
and esi, 0xffff
push ebp
push esi
push 4
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x403b89
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call dword [sym.imp.USER32.dll_LoadMenuIndirectA]
push eax
mov ecx, ebx
call sub.MFC42.DLL_CMenu::Attach
test eax, eax
jne 0x403ba1
push esi
push 4
push esi
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call dword [sym.imp.USER32.dll_LoadMenuA]
push eax
mov ecx, ebx
call sub.MFC42.DLL_CMenu::Attach
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x403ce0
Capabilities:
Check os version

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
lea ebp, [esi + 0xa8]
push str.Unknown
mov ecx, ebp
mov dword [esi + 8], edi
call fcn.0041d8a2
lea ebx, [esi + 0xc]
mov dword [esi + 4], edi
mov ecx, 0x27
xor eax, eax
mov edi, ebx
push ebx
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebx], 0x9c
call edi
test eax, eax
mov dword [esp + 0x10], eax
jne 0x403d2f
push ebx
mov dword [ebx], 0x94
call edi
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
and eax, 0xffff
sub ecx, 0
mov dword [esi + 4], eax
je 0x403ed6
dec ecx
je 0x403e55
dec ecx
je 0x403d61
push str.Undetermined
mov ecx, ebp
call fcn.0041d8a2
jmp 0x403ee9
mov eax, dword [esi + 0x10]
add eax, 0xfffffffd
cmp eax, 3
ja case.default.0x403d70
jmp dword [eax*4 + 0x403f28]
push str.WinNT_3.51
mov ecx, ebp
call fcn.0041d8a2
mov dword [esi + 8], 1
jmp 0x403ee9
push str.WinNT4
mov ecx, ebp
call fcn.0041d8a2
mov dword [esi + 8], 2
jmp 0x403ee9
mov eax, dword [esi + 0x14]
test eax, eax
je 0x403e07
jbe case.default.0x403d70
cmp eax, 2
ja case.default.0x403d70
push str.WinXP
mov ecx, ebp
call fcn.0041d8a2
mov eax, dword [esp + 0x10]
mov dword [esi + 8], 4
test eax, eax
je 0x403ee9
test byte [esi + 0xa5], 2
je 0x403df6
push str._Home_Edition
mov ecx, ebp
call sub.MFC42.DLL_CString::operator
jmp 0x403ee9
push str._Professional
mov ecx, ebp
call sub.MFC42.DLL_CString::operator
jmp 0x403ee9
push str.Win2000
mov ecx, ebp
call fcn.0041d8a2
mov dword [esi + 8], 3
jmp 0x403ee9
mov eax, dword [esi + 0x14]
dec eax
je 0x403e3d
push str.Windows__Vista
mov ecx, ebp
call fcn.0041d8a2
mov dword [esi + 8], 0xa
jmp 0x403ee9
push str.Windows_7
mov ecx, ebp
call fcn.0041d8a2
mov dword [esi + 8], 0xb
jmp 0x403ee9
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x403ec1
cmp ecx, 0xa
je 0x403e89
cmp ecx, 0x5a
je 0x403e74
push str.Undetermined
mov ecx, ebp
call fcn.0041d8a2
jmp 0x403ee9
push str.WinME
mov ecx, ebp
call fcn.0041d8a2
mov dword [esi + 8], 8
jmp 0x403ee9
cmp eax, 0x7ce
jne 0x403ea5
push str.Win98
mov ecx, ebp
call fcn.0041d8a2
mov dword [esi + 8], 6
jmp 0x403ee9
cmp eax, 0x8ae
jb 0x403ee9
push str.Win98SE
mov ecx, ebp
call fcn.0041d8a2
mov dword [esi + 8], 7
jmp 0x403ee9
push str.Win95
mov ecx, ebp
call fcn.0041d8a2
mov dword [esi + 8], 5
jmp 0x403ee9
push str.Win31
mov ecx, ebp
call fcn.0041d8a2
mov dword [esi + 8], 9
mov al, byte [esi + 0x20]
lea edi, [esi + 0x20]
test al, al
je 0x403f07
push 0x428118
mov ecx, ebp
call sub.MFC42.DLL_CString::operator
push edi
mov ecx, ebp
call sub.MFC42.DLL_CString::operator
mov ecx, esi
call fcn.00403f40
mov ecx, esi
mov dword [esi + 0xac], eax
call fcn.00403f40
mov dword [esi + 0xb0], eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x404380
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41e5d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x421c4c
mov dword [esp + 0x18], 0
call fcn.004044d0
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x34]
mov edx, dword [esi + 0x30]
mov edi, dword [esi + 0x2c]
push eax
push ecx
push edx
push edi
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push eax
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CGdiObject::Attach
test eax, eax
jne 0x404409
mov dword [esp + 8], 0x421a1c
lea ecx, [esp + 8]
mov dword [esp + 0x18], 1
call sub.MFC42.DLL_CGdiObject::DeleteObject
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x3c]
push ecx
push eax
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.GDI32.dll_OffsetRgn]
test eax, eax
jne 0x40444c
mov dword [esp + 8], 0x421a1c
lea ecx, [esp + 8]
mov dword [esp + 0x18], 2
call sub.MFC42.DLL_CGdiObject::DeleteObject
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov edx, dword [esp + 0xc]
lea eax, [esp + 8]
neg eax
sbb eax, eax
and eax, edx
test esi, esi
jne 0x404462
xor ecx, ecx
jmp 0x404465
mov ecx, dword [esi + 4]
push 3
push eax
push ecx
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.GDI32.dll_CombineRgn]
test eax, eax
mov dword [esp + 8], 0x421a1c
jne 0x4044a3
lea ecx, [esp + 8]
mov dword [esp + 0x18], 3
call sub.MFC42.DLL_CGdiObject::DeleteObject
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea ecx, [esp + 8]
mov dword [esp + 0x18], 4
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x10]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x404510
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [ecx + 0x14]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
cmp esi, edx
jne 0x404528
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
mov eax, dword [ecx + 0x10]
mov edi, eax
imul eax, edx
imul edi, esi
mov esi, dword [esp + 0x18]
lea ebx, [edi + esi]
cmp ebx, eax
jl 0x404547
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
mov eax, dword [ecx + 0x24]
mov edx, esi
lea edi, [eax + ebx*4]
mov eax, dword [esp + 0x1c]
cmp esi, eax
jge 0x404587
mov ebp, dword [ecx + 0x28]
cmp ebp, dword [edi]
jne 0x40453e
inc edx
add edi, 4
cmp edx, eax
jl 0x40455a
cmp esi, eax
jge 0x404587
sub eax, esi
lea edx, [ebx*4]
mov esi, eax
mov eax, dword [ecx + 0x24]
add eax, edx
add edx, 4
mov ebx, dword [eax]
xor ebx, 1
dec esi
mov dword [eax], ebx
jne 0x404575
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0xc
Function at 0x404cf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e650
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
call sub.MFC42.DLL_AfxGetModuleState
mov edi, dword [eax + 8]
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
test edi, edi
je 0x404df8
mov ecx, dword [ebp + 0xc]
mov eax, ecx
and ecx, 0xf
shr eax, 4
inc eax
mov edi, ecx
mov ecx, dword [ebp + 8]
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x404df8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x404df8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x404df8
test edi, edi
jle 0x404d81
xor edx, edx
dec edi
mov dx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x404d75
xor edi, edi
mov di, word [esi]
add esi, 2
test edi, edi
jle 0x404df8
lea eax, [edi + edi + 2]
mov dword [ebp - 4], 0
push eax
call sub.MFC42.DLL_operatornew
add esp, 4
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
push edi
push esi
push ebx
call dword [sym.imp.MSVCRT.dll_wcsncpy]
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov word [ebx + edi*2], 0
push ebx
call sub.MFC42.DLL_CString::operator_2
test ebx, ebx
je 0x404dd2
push ebx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x404f00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x41e6fa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
lea ecx, [esi + 0x20]
mov dword [esp + 8], esi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x24]
mov dword [esp + 0x14], edi
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x28]
mov byte [esp + 0x14], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x2c]
mov byte [esp + 0x14], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x34]
mov byte [esp + 0x14], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x38]
mov byte [esp + 0x14], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x3c]
mov byte [esp + 0x14], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x40]
mov byte [esp + 0x14], 7
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x44]
mov byte [esp + 0x14], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x48]
mov byte [esp + 0x14], 9
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x4c]
mov byte [esp + 0x14], 0xa
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x50]
mov byte [esp + 0x14], 0xb
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x54]
mov byte [esp + 0x14], 0xc
call sub.MFC42.DLL_CString::CString
mov ecx, esi
mov byte [esp + 0x14], 0xd
mov dword [esi], 0x421c60
call fcn.00405140
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x407f30
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x41ea28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
lea ecx, [esp + 4]
xor esi, esi
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 8]
mov dword [esp + 0x1c], esi
push eax
push str.SoftwareAnalog_DevicesSMax4PNPSettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x407fca
mov ecx, dword [esp + 0x24]
lea edx, [esp + 4]
push ecx
push str.Jack_d
push edx
mov dword [esp + 0x18], 4
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x34]
add esp, 0xc
lea eax, [esp + 0xc]
lea edx, [esp + 0x10]
push eax
push ecx
push edx
push esi
push esi
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::GetBuffer
push eax
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x407fbf
mov esi, 1
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 4]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0041d8b4
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 8

Function at 0x408ca0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x41eb58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
lea ecx, [esp]
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 4]
mov dword [esp + 0x10], 0
push eax
push str.SoftwareAnalog_DevicesSMax4PNPSettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x408d26
mov ecx, dword [esp + 0x18]
lea edx, [esp]
push ecx
push str.Jack_d
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea eax, [esp + 0x1c]
lea ecx, [esp]
push 4
push eax
push 4
push 0
push 0
call sub.MFC42.DLL_CString::GetBuffer
mov ecx, dword [esp + 0x14]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp]
mov dword [esp + 0x10], 0xffffffff
call fcn.0041d8b4
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 8