joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401580
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
push ebp
push esi
mov ebp, ecx
mov ecx, dword [esp + 0x218]
push edi
push ebp
push 0x104
push eax
push str.NoString
push ecx
push str.MainBitmap
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, str.NoString
lea eax, [esp + 0x10]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4015e0
test cl, cl
je 0x4015dc
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4015e0
add eax, 2
add esi, 2
test cl, cl
jne 0x4015b8
xor eax, eax
jmp 0x4015e5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40164c
mov edi, 0x4337b8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x110]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 4
mov edi, str.Cannot_find_the_MainBitmap_section_of_the_init_file
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x114]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x114]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x11c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.0041d462
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x208
ret 4

Function at 0x4016d0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x34
lea eax, [esp]
push ebx
push ebp
push esi
mov ebp, ecx
push edi
push ebp
push 0x32
push eax
push str.NoString
push str.Title
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, str.NoString
lea eax, [esp + 0x10]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x401727
test cl, cl
je 0x401723
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x401727
add eax, 2
add esi, 2
test cl, cl
jne 0x4016ff
xor eax, eax
jmp 0x40172c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x401764
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x214]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
push 0xb
mov ecx, ebp
call fcn.00402060
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x34
ret
Function at 0x401780
Capabilities:
Read .ini file
Terminate process

Disassembly:
sub esp, 0x128
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x18], ecx
push 0x50
mov dword [esp + 0x20], 0x42f154
mov dword [esp + 0x24], 0x42f150
mov dword [esp + 0x28], 0x42f14c
mov dword [esp + 0x2c], 0x42f148
mov dword [esp + 0x30], 0x42f144
mov dword [esp + 0x34], str.654321
call fcn.00412f5c
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 4
mov dword [esp + 0x14], eax
lea ebp, [esp + 0x1c]
lea edi, [eax + 8]
mov dword [esp + 0x10], 5
mov eax, dword [esp + 0x18]
mov edx, dword [ebp]
push eax
lea ecx, [esp + 0x38]
push 0x104
push ecx
push str.NoString
push edx
push str.HighlightArea
call ebx
mov esi, str.NoString
lea eax, [esp + 0x34]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40182d
test cl, cl
je 0x401829
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40182d
add eax, 2
add esi, 2
test cl, cl
jne 0x401809
xor eax, eax
jmp 0x401832
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4018a6
lea eax, [esp + 0x34]
push 0x42f12c
push eax
call fcn.00407fd0
add esp, 8
push eax
call fcn.00407fc0
add esp, 4
mov dword [edi - 8], eax
push 0x42f12c
push 0
call fcn.00407fd0
add esp, 8
push eax
call fcn.00407fc0
add esp, 4
mov dword [edi - 4], eax
push 0x42f12c
push 0
call fcn.00407fd0
add esp, 8
push eax
call fcn.00407fc0
add esp, 4
mov dword [edi], eax
push 0x42f12c
push 0
call fcn.00407fd0
add esp, 8
push eax
call fcn.00407fc0
add esp, 4
mov dword [edi + 4], eax
jmp 0x4018bc
push 0xffffffffffffffff
push 0
push 0xef18
call fcn.0041d483
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [esp + 0x10]
add ebp, 4
add edi, 0x10
dec eax
mov dword [esp + 0x10], eax
jne 0x4017e1
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x128
ret
Function at 0x4018e0
Capabilities:
Read .ini file
Terminate process

Disassembly:
sub esp, 0x128
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x18], ecx
push 0x28
mov dword [esp + 0x20], 0x42f154
mov dword [esp + 0x24], 0x42f150
mov dword [esp + 0x28], 0x42f14c
mov dword [esp + 0x2c], 0x42f148
mov dword [esp + 0x30], 0x42f144
mov dword [esp + 0x34], str.654321
call fcn.00412f5c
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 4
mov dword [esp + 0x14], eax
mov ebp, eax
lea edi, [esp + 0x1c]
mov dword [esp + 0x10], 5
mov eax, dword [esp + 0x18]
mov edx, dword [edi]
push eax
lea ecx, [esp + 0x38]
push 0x104
push ecx
push str.NoString
push edx
push 0x42f158
call ebx
mov esi, str.NoString
lea eax, [esp + 0x34]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40198b
test cl, cl
je 0x401987
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40198b
add eax, 2
add esi, 2
test cl, cl
jne 0x401967
xor eax, eax
jmp 0x401990
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4019cf
lea eax, [esp + 0x34]
push 0x42f12c
push eax
call fcn.00407fd0
add esp, 8
push eax
call fcn.00407fc0
add esp, 4
mov dword [ebp], eax
push 0x42f12c
push 0
call fcn.00407fd0
add esp, 8
push eax
call fcn.00407fc0
add esp, 4
mov dword [ebp + 4], eax
jmp 0x4019e5
push 0xffffffffffffffff
push 0
push 0xef19
call fcn.0041d483
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [esp + 0x10]
add edi, 4
add ebp, 8
dec eax
mov dword [esp + 0x10], eax
jne 0x401940
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x128
ret

Function at 0x401af0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x104
lea eax, [esp]
push ebx
push ebp
push esi
mov ebp, ecx
push edi
push ebp
push 0x104
push eax
push str.NoString
push str.HtmlFileName
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, str.NoString
lea eax, [esp + 0x10]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x401b4d
test cl, cl
je 0x401b49
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x401b4d
add eax, 2
add esi, 2
test cl, cl
jne 0x401b25
xor eax, eax
jmp 0x401b52
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x401b8d
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x34a]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
push 0xb
mov ecx, ebp
call fcn.00402060
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x104
ret
Function at 0x401bb0
Capabilities:
Read .ini file
Terminate process

Disassembly:
sub esp, 0x34
lea eax, [esp]
push ebx
push ebp
push esi
mov ebp, ecx
push edi
push ebp
push 0x32
push eax
push str.NoString
push str.FontType
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, str.NoString
lea eax, [esp + 0x10]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x401c07
test cl, cl
je 0x401c03
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x401c07
add eax, 2
add esi, 2
test cl, cl
jne 0x401bdf
xor eax, eax
jmp 0x401c0c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x401c39
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x44e]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x401c42
push 0xb
mov ecx, ebp
call fcn.00402060
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push ebp
push 0
push str.FontWeight
push str.General
call esi
mov edi, dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 1
mov dword [ebp + 0x484], eax
jl 0x401c6d
cmp eax, 9
jle 0x401c7f
push 0xffffffffffffffff
push 0
push 0xef1d
call fcn.0041d483
push 0
call edi
push ebp
push 0
push str.FontHeight
push str.General
call esi
mov dword [ebp + 0x480], eax
mov eax, dword [ebp + 0x484]
cmp eax, 1
jl 0x401ca6
cmp eax, 0x4000
jle 0x401cb8
push 0xffffffffffffffff
push 0
push 0xef1e
call fcn.0041d483
push 0
call edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x34
ret

Function at 0x401cd0
Capabilities:
Read .ini file

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push esi
push 0
push str.RectWidth
push str.MainTextRect
call edi
mov ecx, dword [esp + 0xc]
push esi
push 0
push str.RectHeight
push str.MainTextRect
mov dword [ecx], eax
call edi
mov edx, dword [esp + 0x10]
pop edi
pop esi
mov dword [edx], eax
mov eax, 1
ret 8
Function at 0x401ef0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x64
lea eax, [esp]
push ebx
push ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
mov ebp, ecx
push edi
push ebp
push 0x64
push eax
push str.NoString
push str.InitWave
push str.WaveFile
call ebx
mov esi, str.NoString
lea eax, [esp + 0x10]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401f45
test cl, cl
je 0x401f41
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401f45
add eax, 2
add esi, 2
test cl, cl
jne 0x401f21
xor eax, eax
jmp 0x401f4a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x401fa7
mov edi, 0x4337b8
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x78]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov dword [esp + 0x78], eax
mov edi, edx
mov edx, dword [esp + 0x78]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebp
lea eax, [esp + 0x14]
push 0x64
push eax
push str.NoString
push str.PassSnd
push str.PassOverSound
call ebx
mov esi, str.NoString
lea eax, [esp + 0x10]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x401ff1
test cl, cl
je 0x401fed
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x401ff1
add eax, 2
add esi, 2
test cl, cl
jne 0x401fc9
xor eax, eax
jmp 0x401ff6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402049
mov edi, 0x4337b8
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x7c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x64
ret 8
Function at 0x402060
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x42323b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x304
push esi
push edi
lea ecx, [esp + 8]
call fcn.00414046
mov eax, dword [esp + 0x31c]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x318], 0
call fcn.00414613
mov ecx, dword [esp + 8]
mov edx, dword [ecx - 8]
lea ecx, [esp + 8]
push edx
call fcn.004144cc
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4337b8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
call fcn.00408130
add esp, 8
mov byte [eax], 0
lea edx, [esp + 0xc]
lea eax, [esp + 0x10c]
push edx
lea ecx, [esp + 0x210]
push eax
push ecx
call fcn.004080c0
add esp, 0xc
lea edx, [esp + 0x20c]
push 0
push 0
push edx
call fcn.0041d462
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x403df0
Capabilities:
Identify system language via api
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x42346d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6ec
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x120]
mov dword [esp + 0x1c], 0x100
mov dword [esp + 0x18], 1
call fcn.004021f0
lea eax, [esp + 0x14]
xor ebx, ebx
push eax
push 1
push ebx
push str.SOFTWAREORACLE
push 0x80000002
mov dword [esp + 0x718], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403f47
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
push str.NLS_LANG
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403f47
lea edx, [esp + 0x20]
lea ecx, [esp + 0x10]
push edx
call fcn.004141ff
lea edi, [esi + 0xc8]
push eax
mov ecx, edi
mov byte [esp + 0x708], 1
call fcn.0041428a
lea ecx, [esp + 0x10]
mov byte [esp + 0x704], bl
call fcn.00414191
mov ecx, edi
call fcn.004145a3
lea eax, [esp + 0x10]
push edi
push eax
lea ecx, [esp + 0x128]
call fcn.00403990
lea edi, [esi + 0xc4]
push eax
mov ecx, edi
mov byte [esp + 0x708], 2
call fcn.0041428a
lea ecx, [esp + 0x10]
mov byte [esp + 0x704], bl
call fcn.00414191
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push edi
call fcn.00414056
lea ecx, [esp + 0x124]
call fcn.00403760
lea ecx, [esp + 0x10]
push eax
push ecx
lea ecx, [esp + 0x128]
mov word [esi + 0xd0], ax
call fcn.00403930
push eax
lea ecx, [esi + 0xcc]
mov byte [esp + 0x708], 3
call fcn.0041428a
mov byte [esp + 0x704], bl
lea ecx, [esp + 0x10]
jmp 0x40400e
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edi, eax
lea edx, [esp + 0x10]
push edi
push edx
lea ecx, [esp + 0x128]
call fcn.00403800
lea ebp, [esi + 0xc4]
push eax
mov ecx, ebp
mov byte [esp + 0x708], 4
call fcn.0041428a
lea ecx, [esp + 0x10]
mov byte [esp + 0x704], bl
call fcn.00414191
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ebp
call fcn.00414056
lea ecx, [esp + 0x124]
call fcn.00403760
mov word [esi + 0xd0], ax
lea eax, [esp + 0x10]
push edi
push eax
lea ecx, [esp + 0x128]
call fcn.00403930
push eax
lea ecx, [esi + 0xcc]
mov byte [esp + 0x708], 5
call fcn.0041428a
lea ecx, [esp + 0x10]
mov byte [esp + 0x704], bl
call fcn.00414191
lea ecx, [esp + 0x10]
push edi
push ecx
lea ecx, [esp + 0x128]
call fcn.00403850
push eax
lea ecx, [esi + 0xc8]
mov byte [esp + 0x708], 6
call fcn.0041428a
mov byte [esp + 0x704], bl
lea ecx, [esp + 0x10]
call fcn.00414191
lea ecx, [esp + 0x120]
mov dword [esp + 0x704], 0xffffffff
call fcn.004036d0
mov ecx, dword [esp + 0x6fc]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x6f8
ret
Function at 0x405d70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x423787
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0
call fcn.00414046
mov dword [esp + 0x20], 1
call fcn.00421581
mov edi, dword [esp + 0x2c]
mov eax, dword [eax + 4]
mov esi, dword [0x4337a0]
mov ecx, edi
mov ax, word [eax + 0xd0]
shr ecx, 4
inc ecx
push eax
and ecx, 0xffff
push ecx
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x405e74
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x405e7e
and edi, 0xf
mov esi, eax
jle 0x405e02
mov eax, edi
xor ecx, ecx
dec eax
mov cx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x405df6
xor ebx, ebx
push 0
mov bx, word [esi]
push 0
push 0
add esi, 2
push 0
push ebx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x405e7e
push edi
call fcn.00412f5c
add esp, 4
mov ebp, eax
push 0
push 0
push edi
push ebp
push ebx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
push ebp
lea ecx, [esp + 0x34]
call fcn.00411e6a
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 2
call fcn.0041428a
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 1
call fcn.00414191
push ebp
call fcn.00412f98
add esp, 4
jmp 0x405e7e
push edi
lea ecx, [esp + 0x14]
call fcn.00414613
mov esi, dword [esp + 0x28]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.00414056
mov dword [esp + 0x14], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 0
call fcn.00414191
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret 8
Function at 0x405ec0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4237d7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4f4
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x4259f0
lea ecx, [esp + 0x74]
mov dword [esp + 0x504], 0
call fcn.004014e0
lea ecx, [esp + 8]
mov byte [esp + 0x504], 1
call fcn.00414046
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x18]
mov byte [esp + 0x504], 2
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x74]
call fcn.00401520
lea ecx, [esp + 0x74]
call fcn.00401bb0
mov eax, dword [esp + 0x4f4]
test eax, eax
jg 0x405f51
mov dword [esp + 0x4f4], 0x16
mov eax, dword [esp + 0x4f8]
test eax, eax
jg 0x405f67
mov dword [esp + 0x4f8], 5
lea eax, [esp + 0x14]
push 7
push eax
mov ecx, esi
call fcn.00405d70
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x508], 3
call fcn.0041428a
lea ecx, [esp + 0x14]
mov byte [esp + 0x504], 2
call fcn.00414191
mov ecx, dword [esp + 8]
mov esi, str.no_fonttype
mov edx, dword [ecx - 8]
lea ecx, [esp + 8]
push edx
call fcn.004144cc
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x405fd2
test cl, cl
je 0x405fce
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x405fd2
add eax, 2
add esi, 2
test cl, cl
jne 0x405fae
xor eax, eax
jmp 0x405fd7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea edi, [esp + 0x4c2]
jne 0x405fe8
lea edx, [esp + 0x34]
jmp 0x406016
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40600d
mov ecx, dword [esp + 8]
mov edx, dword [ecx - 8]
lea ecx, [esp + 8]
push edx
call fcn.004144cc
lea edx, [esp + 0x34]
mov edi, eax
jmp 0x406016
lea edx, [esp + 0x34]
mov edi, str.Times_New_Romans
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x4f8]
and ecx, 3
lea eax, [eax + eax*4]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x4f4]
lea edx, [eax + eax*4]
shl edx, 2
mov dword [esp + 0x18], ecx
mov dword [esp + 0x28], edx
call dword [sym.imp.KERNEL32.dll_GetACP]
lea ecx, [esp + 0x54]
push 2
push ecx
push eax
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
mov dl, byte [esp + 0x54]
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x33], dl
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
lea ecx, [esp + 0x10]
call fcn.0041a82a
mov ecx, dword [esp + 0x50c]
lea eax, [esp + 0xc]
push eax
mov edx, dword [ecx]
call dword [edx + 0x30]
lea ecx, [esp + 8]
mov byte [esp + 0x504], 1
call fcn.00414191
lea ecx, [esp + 0x74]
mov byte [esp + 0x504], 0
call fcn.00401510
mov dword [esp + 0xc], vtable.CGdiObject.0
lea ecx, [esp + 0xc]
mov dword [esp + 0x504], 4
call fcn.0041a881
mov ecx, dword [esp + 0x4fc]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x500
ret 4
Function at 0x406510
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
lea ecx, [esp + 4]
push ecx
push 0
push 0x4338e0
push 0x406550
push 0
push 0
mov dword [0x4338e0], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
mov dword [0x4338d8], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, 1
ret 4
Function at 0x408810
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428760
push 0x40c218
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x435790], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x43578c], ecx
shl ecx, 8
add ecx, edx
mov dword [0x435788], ecx
shr eax, 0x10
mov dword [0x435784], eax
call fcn.0040cff0
test eax, eax
jne 0x40887a
push 0x1c
call fcn.004089f0
add esp, 4
call fcn.0040b320
test eax, eax
jne 0x40888d
push 0x10
call fcn.004089f0
add esp, 4
mov dword [ebp - 4], 0
call fcn.0040cde0
call fcn.0040a5e0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x436e94], eax
call fcn.0040cc80
mov dword [0x435774], eax
test eax, eax
je 0x4088c0
mov eax, dword [0x436e94]
test eax, eax
jne 0x4088ca
push 0xffffffffffffffff
call fcn.00409800
add esp, 4
call fcn.0040c9d0
call fcn.0040c8e0
call fcn.004097d0
mov esi, dword [0x436e94]
mov dword [ebp - 0x64], esi
cmp byte [esi], 0x22
jne 0x4089a9
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
cmp al, 0x22
je 0x408911
test al, al
je 0x408911
and eax, 0xff
push eax
call fcn.0040c880
add esp, 4
test eax, eax
je 0x4088eb
inc esi
mov dword [ebp - 0x64], esi
jmp 0x4088eb
cmp byte [esi], 0x22
jne 0x40891a
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
test al, al
je 0x40892a
cmp al, 0x20
ja 0x40892a
inc esi
mov dword [ebp - 0x64], esi
jmp 0x40891a
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x40894b
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x408950
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.00409800
jmp 0x40898e
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x40891a
inc esi
mov dword [ebp - 0x64], esi
jmp 0x4089a9

Function at 0x4089f0
Capabilities:
Terminate process

Disassembly:
cmp dword [0x43577c], 1
jne 0x4089fe
call fcn.0040d030
mov eax, dword [esp + 4]
push eax
call fcn.0040d070
add esp, 4
push 0xff
call dword [sym.imp.KERNEL32.dll_ExitProcess]