joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e3d78
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test dh, 0xcc
call fcn.004e3334
push eax
lea esp, [esp + 0x28]
jne 0x4dd6cd
movsx eax, bl
pushal
cwde
mov eax, dword [edx + 8]
mov byte [esp], 0x4c
push 0x3042952f
push 0x59720f48
mov word [esp + 4], 0x59a0
lea esp, [esp + 0x28]
jmp fcn.004e06ac

Function at 0x4e436c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
mov dword [esp + 0x20], 0x4dd463
pushal
pushfd
call fcn.004e7780

Function at 0x4e4381
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub cl, byte [eax - 0x51]
dec ebx
invalid
clc
add ecx, 0xffffffff
call fcn.004df67a
jle 0x4dd6ac
outsd dx, dword gs:[esi]
sub byte [esi - 0x4b], bl
mov esi, 0x2ac74c30
jl 0x4dd71c
dec ebx
mov cs, word [ecx + 0x7154feab]
rcr byte [eax - 0x25ed0c07], cl
imul edx, dword [edi - 0x37], 0x24b0f652
retf
dec ebp
pop esi
dec esp
dec dword [ebp + 0xefadf42]
int 0x94
lds esi, [eax + 0x28]
pop esi
push ebp
jle 0x4dd750
in al, dx
push ds
sbb esp, 0x230e83a0
popfd
mov byte [ebx + 0x3a], al
cmp cl, byte [edx - 0x63]
adc al, 0x66
out dx, eax
scasd eax, dword es:[edi]
inc ebp
mov ah, 0x94
mov cl, 0x24
retf
invalid
call fcn.004e1d03
cmp bh, cl
lea esi, [eax + 0x28]
pop esi
hlt
pushfd
lea esp, [esp + 0xc]
call fcn.004e294e
jbe 0x4dd777
pushfd
mov byte [esp], bh
push dword [esp]
lea esp, [esp + 8]
jne 0x4dd6cd
movzx ax, cl
mov eax, dword [edx + 8]
push edx
pushal
pushal
push 0x93f20234
lea esp, [esp + 0x48]
jmp fcn.004e06ac
lea esp, [esp + 0x4c]
jne 0x4e06a8
or cl, al
rcl cl, 3
clc
mov ecx, dword [ebx]
test dh, 0x53
stc
or ecx, ecx
push ebp
lea esp, [esp + 4]
je 0x4e06a8
movzx si, cl
push ebp
pushfd
lea edx, [ebx + 4]
lea esp, [esp + 8]
movsx esi, dl
xchg di, si
movzx esi, word [edx + 0x1a]
movzx di, al
mov di, 0xca30
push edi
movzx di, cl
lea esi, [esi + edx + 0x1c]
lea edi, [esi + 0x729469d7]
jmp 0x4e5577
pushfd
bswap edi
mov edi, dword [ebp + 8]
jmp 0x4dfe25

Function at 0x4e491d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
pushfd
lea esp, [esp + 0xc]
jne 0x4dd6cd
push 0x121399f8
movzx ax, dl
lea eax, [ecx*8 - 0x1a62947a]
mov eax, dword [edx + 8]
pushfd
lea esp, [esp + 8]
jmp fcn.004e06ac
Function at 0x4e5641
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
not di
jmp 0x4e3438
cmp al, 0xc5
xor eax, eax
invalid
lea esi, [esi + edx + 0x1c]
call fcn.004e1db8
mov dl, 0xd3
mov bl, 0xcd
sub byte [esi + 0x67], bl
cmp byte [ebx - 0x12], 0xb9
pop esp
daa
adc dh, bh
and dword [ebx + 0x17], esp
popal
fsubr qword [ebx - 0x54]
sbb al, 0xe8
scasb al, byte es:[edi]
out 0x8d, al
bound ebp, qword [ecx + ebx*8 - 0xa]
in al, dx
push es
sub al, 0xb4
xor ecx, ebp
and al, 0xea
push ebp
jle 0x4e347c
sbb dword [ecx + 0x3c1d3c21], edi
and al, 1
mov eax, dword [0x3d97688c]
cmpsb byte [esi], byte es:[edi]
call dword [0x61847582]
jne 0x4e3402
popal
imul esp, ecx, 0x8205f060
sub ecx, dword [edi + 0x42]
stosd dword es:[edi], eax
pop ss
aaa
xchg edx, eax
fucompi st(2)
dec edi
cmpsb byte [esi], byte es:[edi]
dec ecx
into
nop
stc
add byte [ebx - 0x26265ecc], bl
adc al, 0x7a
bound ebp, qword [esi + edx*8 + 0x5a]
iretd
or eax, eax
pushfd
lea esp, [esp + 8]
jne 0x4e06a8
or cx, 0xe685
and cx, bp
not cl
shl ch, cl
mov ecx, dword [ebx]
bt cx, 0xc
or ecx, ecx
pushfd
pushfd
push 0x7a86612e
pushfd
lea esp, [esp + 0x10]
je 0x4e06a8
movsx di, cl
movzx si, dl
movsx edx, al
pushfd
lea edx, [ebx + 4]
bswap edi
movzx esi, word [edx + 0x1a]
jmp 0x4ddd20

Function at 0x4e7240
Capabilities:
Encode data using xor

Disassembly:
push ebx
lea esp, [esp + 8]
je 0x4e00aa
stc
push 0x50abe467
jmp 0x4e009e
clc
bt bp, bp
cmc
mov byte [ecx], al
call fcn.004e74c1
push 0x94f77d7e
cmp ah, 0x2e
lea esp, [esp + 8]
pushfd
call fcn.004e4cd5
je 0x4e00c5
lcall 0x764c, 0xa1085e28
mov ch, byte [0x40ee733f]
jle 0x4e008a
imul esp, dword [ebp + 0x215c8ad6], 8
mov bl, byte [ecx + 8]
and dword [eax], ecx
add edx, dword [eax + 0xe]
sbb esi, ebp
xor al, byte [ecx + 0x12]
loope 0x4e00c7
cmpsd dword [esi], dword es:[edi]
int 0x9e
lcall 0xb6c6, 0xb057f6c
sbb al, 0x82
lss ebp, [0x1f1f61f4]
jno 0x4e011d
mov word [ecx], cs
push edi
pushal
pop ecx
test dword [esi - 0x43c2b63f], ebp
xchg edx, eax
cmpsb byte [esi], byte es:[edi]
mov eax, 0x3ab18c95
mov bh, 0xdc
imul ebp, dword [ecx + 0x3b5c91c], 0x7ddbf33e
popfd
into
pop esi
lcall 0x4ba6, 0xd8b8f04f
outsb dx, byte [esi]
movsb byte es:[edi], byte [esi]
adc ah, byte [ebx - 0x39]
js 0x4e0148
sal dl, 0x30
mov ah, 0xff
mov esp, 0x1a287478
push es
retf
invalid
mov byte [0xbd920a3d], al
push esp
imul byte [edi]
das
imul edx, edx, 0xbd6f135
and edi, dword [eax - 0x2718f0f8]
dec edx
jle 0x4e0141
add al, 0x67
rcr dword [eax + edi*8], 0xd
xchg edi, eax
or bl, byte [edi + ebp*4 - 0x7b]
rcr byte [ecx + 0x4eb1a2bc], 0xa7
push ebx
invalid
jmp 0x4dedff
Function at 0x408d00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
jmp 0x408d1a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x408d21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x408d10
mov eax, 1
add ebx, ebx
jne 0x408d33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x408d28
jne 0x408d44
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x408d28
xor ecx, ecx
sub eax, 3
jb 0x408d58
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408dca
mov ebp, eax
add ebx, ebx
jne 0x408d63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x408d70
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x408d94
inc ecx
add ebx, ebx
jne 0x408d80
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x408d75
jne 0x408d91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x408d75
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x408db4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x408da5
jmp 0x408d16
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x408db4
add edi, ecx
jmp 0x408d16
pop esi
mov edi, esi
mov ecx, 0x29
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x408dd2
cmp byte [edi], 1
jne 0x408dd2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x408dd7
lea edi, [esi + 0x6000]
mov eax, dword [edi]
or eax, eax
je 0x408e46
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9110]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x914c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x408e04
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9154]
or eax, eax
je 0x408e40
mov dword [ebx], eax
add ebx, 4
jmp 0x408e21
call dword [esi + 0x9150]
mov ebp, dword [esi + 0x9158]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1e7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x408e7a
sub esp, 0xffffff80
jmp 0x402550
Function at 0x40bd10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57fb67
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5edfd4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
cmp dword [ebp + 8], 0
mov dword [ebp - 0x10], 0
je 0x40bd65
mov dword [ebx], 0x590a68
mov dword [ebx + 0x68], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
push 0
lea esi, [ebx + 4]
mov ecx, ebx
push 0
push esi
mov dword [ebp + 8], esi
call fcn.00402360
mov eax, dword [ebx]
push 8
mov dword [ebp - 4], 1
mov dword [ebp - 0x18], esi
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ecx + ebx - 4], eax
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004127a7
mov edi, eax
add esp, 4
test edi, edi
je 0x40bdc2
push 1
mov byte [ebp - 4], 2
call fcn.00557a1f
add esp, 4
mov dword [edi + 4], eax
jmp 0x40bdc4
xor edi, edi
mov ecx, dword [ebp + 8]
lea ebx, [esi + 4]
mov dword [esi + 0xc], ebx
lea eax, [esi + 8]
mov dword [esi + 0x34], edi
lea edi, [esi + 0x14]
mov dword [esi + 0x1c], edi
add esi, 0x18
mov dword [ecx + 0x20], esi
lea edx, [ecx + 0x24]
mov dword [ecx + 0x2c], edx
add ecx, 0x28
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x30], ecx
mov dword [eax], 0
mov eax, ebx
mov eax, dword [eax + 0x20]
mov dword [eax], 0
mov eax, ebx
mov eax, dword [eax + 0x30]
mov dword [eax], 0
mov eax, ebx
mov eax, dword [eax + 0xc]
mov dword [eax], 0
mov eax, ebx
mov eax, dword [eax + 0x1c]
mov dword [eax], 0
mov eax, ebx
mov eax, dword [eax + 0x2c]
mov dword [eax], 0
mov eax, ebx
mov ebx, dword [ebp - 0x10]
mov dword [eax + 0xc], ebx
mov ebx, eax
mov dword [eax], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [eax + 0x48], 0
mov byte [eax + 0x3d], 0
lea eax, [ebx + 8]
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x20], esi
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x30], ecx
mov dword [eax], 0
mov eax, dword [ebx + 0x20]
mov dword [eax], 0
mov eax, dword [ebx + 0x30]
mov dword [eax], 0
mov eax, dword [ebx + 0xc]
mov dword [eax], 0
mov eax, dword [ebx + 0x1c]
mov dword [eax], 0
mov eax, dword [ebx + 0x2c]
mov dword [eax], 0
mov dword [ebx + 0x4c], 0
mov eax, dword [0x5f322c]
mov dword [ebx + 0x40], eax
mov eax, dword [0x5f3230]
mov dword [ebx + 0x44], eax
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40c280
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5edfd4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x40c321
cmp byte [esi + 0x3d], 0
je 0x40c321
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40c2d7
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x40c2e9
sub eax, 1
je 0x40c2ed
sub eax, 2
je 0x40c321
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00556658
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40c30a
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00560617
add esp, 0x10
cmp edi, eax
jne 0x40c2d7
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00556658
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00556658
mov esp, ebp
pop ebp
ret
Function at 0x40cc00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x5edfd4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x40cc30
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00556658
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40cc6c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x40cc6c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00556658
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x40cd51
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x40cc94
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x40ccc7
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0055fcc2
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00556658
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x40cd51
cmp eax, 1
jle 0x40cd24
cmp eax, 3
jne 0x40cd51
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.0040bb90
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00556658
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40cd41
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00560617
add esp, 0x10
cmp edi, eax
jne 0x40cd51
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x40cc57
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00556658
mov esp, ebp
pop ebp
ret 4
Function at 0x40d3b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x40d3d4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040b980
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x40d3f5
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x40d3f7
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x40d47f
jg 0x40d40a
test esi, esi
je 0x40d47f
test ecx, ecx
jl 0x40d44c
jg 0x40d414
test eax, eax
je 0x40d44c
cmp ebx, ecx
jg 0x40d426
jl 0x40d41e
cmp esi, eax
jae 0x40d426
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.00558d80
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x40d452
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x40d47f
jg 0x40d45c
test esi, esi
je 0x40d47f
cmp dword [edi + 0x4c], 0
je 0x40d47f
mov ecx, edi
call fcn.0040c490
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call fcn.0055ffaa
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40d4a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x40d4c4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040ba50
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x40d4e5
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x40d4e7
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x40d564
jg 0x40d4fa
test esi, esi
je 0x40d564
test ecx, ecx
jl 0x40d53e
jg 0x40d504
test eax, eax
je 0x40d53e
cmp edi, ecx
jg 0x40d516
jl 0x40d50e
cmp esi, eax
jae 0x40d516
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.00558d80
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x40d541
mov edx, dword [ebp + 8]
test edi, edi
jl 0x40d564
jg 0x40d54b
test esi, esi
je 0x40d564
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x40d564
push eax
push esi
push 1
push edx
call fcn.00560617
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40e5a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0041466b

Function at 0x40fd30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40fd89
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40fd89
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40fd7a
cmp esi, edx
jae 0x40fd89
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x40fd68
cmp esi, edx
jae 0x40fd89
cmp word [esi], 0
je 0x40fd89
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4146d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.00419c2d
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x414707
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.00414726
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x41754b
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x41759e
push esi
push dword [ebp + 8]
call fcn.00417734
mov edi, eax
test edi, edi
je 0x417599
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x417599
mov eax, dword [ebp - 8]
jmp 0x4175b0
mov eax, dword [ebp + 0x10]
jmp 0x4175b0
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc

Function at 0x419000
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
mov eax, ecx
push edi
mov edi, esi
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], esi
je 0x41904a
call fcn.00419c2d
push 0xf0
push dword [ebp + 0xc]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x419047
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41909a
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov eax, dword [ebp - 4]
xor ebx, ebx
inc ebx
test esi, esi
je 0x419077
mov ecx, dword [eax]
push dword [ebp + 0x10]
push esi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call dword [0x58ea90]
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
test edi, edi
je 0x419077
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x419098
mov eax, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [eax + 0xa0]
mov ecx, esi
call dword [0x58ea90]
mov ecx, edi
call esi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x41bf3f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [edi + 4]
call fcn.004238d9
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
mov esi, eax
mov ecx, edi
and esi, 3
call fcn.0041c1fc
cmp esi, 3
je 0x41bf7d
mov dword [edi + 0xc], 1
cmp dword [edi], 0
je 0x41bfc6
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x41bfa0
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.00419857
jmp 0x41bfb1
push 0xff
mov ecx, esi
call fcn.004130af
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00417870
jmp 0x41bfea
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x41bfea
push dword [esi]
push dword [ebp - 4]
call fcn.00429abd
pop edi
pop esi
leave
ret 0xc
Function at 0x41c153
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0041c1fc
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x41c19b
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00419857
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00417870
jmp 0x41c1a6
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00429abd
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x41e81d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x41e862
call fcn.00419c2d
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41e862
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x41e87e
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0041c47c
mov ebx, eax
test edi, edi
je 0x41e87c
test esi, esi
je 0x41e87c
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41f27d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x41f33b
cmp dword [esi + 0x20], 0
je 0x41f33b
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41f33b
cmp dword [ebp + 8], 0
je 0x41f33b
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.00419c2d
push 0x594758
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x41f30c
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41f33b
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.0043b995
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x41f32c
test edi, edi
je 0x41f32c
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x41f337
mov ecx, esi
call fcn.0041f01f
mov eax, ebx
jmp 0x41f33d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4