joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40d08b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40d09a
pop dword [ebp - 0x4c]
mov eax, 0x40d09a
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x35b72
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x67785e4c
add ecx, 0x9887db9f
mov edi, eax
mov ebx, 0x82db2ccc
add ebx, 0x7d660ef8
add ebx, dword [ebp - 0x4c]
mov edx, 0xc761cab2
sub edx, 0x28755c9a
xor dword [ebp - 0x10], 0x6ff46f36
mov esi, dword [ebx]
mov dword [ebp - 0x44], 0xa2ddfea8
sub esi, edx
mov dword [ebp - 0x48], 0x1b78c530
mov dword [edi], esi
add dword [ebp - 0x34], edx
add edi, 0xe918663f
sub edi, 0xe918663b
add ebx, 0x8a81dd73
sub ebx, 0x8a81dd6f
loop 0x40d0ef
add eax, 0xf0746054
add eax, 0xf8c7a2b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x692ddc12
add ecx, 0x971223ee
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x40d20d
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419c98]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040a501
mov dword [ebp - 0x14], eax
cmp dword [0x4353a4], esi
jne 0x40d300
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d28d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d3e0
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d3e0
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d3e0
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4353a4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4353a8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4353ac], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4353b4], eax
test eax, eax
je 0x40d2fd
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4353b0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d325
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d318
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d33a
push 4
pop eax
jmp 0x40d3e2
cmp dword [ebp - 0x14], esi
je 0x40d33a
push dword [0x4353a4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d31f
mov eax, dword [0x4353b0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d398
cmp dword [0x4353b4], edi
je 0x40d398
push eax
call ebx
push dword [0x4353b4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d398
test eax, eax
je 0x40d398
call ecx
test eax, eax
je 0x40d38d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d38d
test byte [ebp - 8], 1
jne 0x40d398
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d3c8
mov eax, dword [0x4353a8]
cmp eax, edi
je 0x40d3c5
push eax
call ebx
test eax, eax
je 0x40d3c5
call eax
mov esi, eax
test esi, esi
je 0x40d3c5
mov eax, dword [0x4353ac]
cmp eax, edi
je 0x40d3c5
push eax
call ebx
test eax, eax
je 0x40d3c5
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4353a4]
call ebx
test eax, eax
je 0x40d3e0
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d3e2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004045c8
mov esp, ebp
pop ebp
ret
Function at 0x8f1f10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x362000]
push edi
jmp 0x8f1f2a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x8f1f31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8f1f20
mov eax, 1
add ebx, ebx
jne 0x8f1f43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x8f1f54
jne 0x8f1f73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8f1f73
dec eax
add ebx, ebx
jne 0x8f1f60
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x8f1f38
add ebx, ebx
jne 0x8f1f6f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x8f1fc5
xor ecx, ecx
sub eax, 3
jb 0x8f1f8b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x8f1ffa
sar eax, 1
mov ebp, eax
jmp 0x8f1f96
add ebx, ebx
jne 0x8f1f96
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8f1f64
inc ecx
add ebx, ebx
jne 0x8f1fa4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8f1f64
add ebx, ebx
jne 0x8f1fb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x8f1fa6
jne 0x8f1fc2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x8f1fa6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x8f1fe4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x8f1fd6
jmp 0x8f1f26
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x8f1fe4
add edi, ecx
jmp 0x8f1f26
pop esi
mov edi, esi
mov ecx, 0x6ad1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x8f2002
cmp byte [edi], 0x28
jne 0x8f2002
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x8f2007
lea edi, [esi + 0x4ee000]
mov eax, dword [edi]
or eax, eax
je 0x8f207f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4f7b28]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4f7c74]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x8f2034
mov ecx, edi
jns 0x8f2063
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4f7c7c]
or eax, eax
je 0x8f2079
mov dword [ebx], eax
add ebx, 4
jmp 0x8f2051
call dword [esi + 0x4f7c78]
mov ebp, dword [esi + 0x4f7c80]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x8f20b3
sub esp, 0xffffff80
jmp 0x4ebae1
Function at 0x100142b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov edx, dword [esp + 4]
push edi
mov edi, dword [edx + 0x9c0]
cmp edi, 0x270
jb 0x10014365
push ebx
push ebp
xor edi, edi
mov ebp, closesocket
push esi
mov esi, edi
mov ecx, dword [edx + esi*4 + 4]
xor ecx, dword [edx + esi*4]
and ecx, ebp
xor ecx, dword [edx + esi*4]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x10038110]
xor ecx, dword [edx + esi*4 + 0x634]
mov dword [edx + esi*4], ecx
inc esi
cmp esi, 0xe3
jl 0x100142d3
mov ebx, 0x26f
jmp 0x1001432c
mov ecx, dword [edx + esi*4 + 4]
xor ecx, dword [edx + esi*4]
and ecx, ebp
xor ecx, dword [edx + esi*4]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x10038110]
xor ecx, dword [edx + esi*4 - 0x38c]
mov dword [edx + esi*4], ecx
inc esi
cmp esi, ebx
jl 0x10014307
mov ecx, dword [edx + 0x9bc]
xor ecx, dword [edx]
and ecx, ebp
xor ecx, dword [edx + 0x9bc]
mov eax, ecx
shr ecx, 1
and eax, 1
pop esi
pop ebp
pop ebx
mov eax, dword [eax*4 + 0x10038110]
xor eax, dword [edx + 0x630]
xor eax, ecx
mov dword [edx + 0x9bc], eax
mov dword [edx + 0x9c0], edi
mov ecx, dword [edx + edi*4]
lea eax, [edi + 1]
mov dword [edx + 0x9c0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop edi
ret

Function at 0x1001478e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1001479d
pop dword [ebp - 0x1c]
mov eax, 0x5eac0ed6
add eax, 0xb15538c7
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x614b9f4
add dword [ebp - 0x2c], 0x483d8b57
mov dword [ebp - 0x28], 0x894fb69
sub dword [ebp - 0x28], 0xd661af24
mov dword [ebp - 0x24], 0x7ccd7f63
add dword [ebp - 0x24], 0xcf7ec4cb
mov dword [ebp - 0x20], 0xfbd0ba12
sub dword [ebp - 0x20], 0xfbd0ba12
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xff37eca
add dword [ebp - 0x2c], 0x647eea8c
mov dword [ebp - 0x28], 0x629d7909
add dword [ebp - 0x28], 0xdecee86c
mov dword [ebp - 0x24], 0x6067b536
sub dword [ebp - 0x24], 0xfcf848ca
mov dword [ebp - 0x20], 0x9aac956a
sub dword [ebp - 0x20], 0x9aac956a
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3cfd7
push 0
call eax
mov ecx, 0x8d9e076d
sub ecx, 0x8d9db7c9
xor esi, esi
add esi, eax
mov edx, 0x10088400
add edx, dword [ebp - 0x1c]
mov edi, 0xe2a827d6
add edi, 0xaa46219e
add dword [ebp - 0x14], 0x1faa54ca
mov ebx, dword [edx]
mov dword [ebp - 0x14], 0x2a40a740
sub ebx, edi
xor dword [ebp - 0x10], ebx
mov dword [esi], ebx
add dword [ebp - 8], ecx
add esi, 0xde8c5c68
sub esi, 0xde8c5c64
add edx, 4
loop 0x100148b1
add eax, 0x13163
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x4c38af5c
add ecx, 0xc3c750a4
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x725f69d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea esi, [ebp + 0xc]
sub esp, 0x10
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], 0x725f9b44
call sym._fwrite
mov eax, dword [ebp + 8]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.msvcrt.dll_vfprintf]
call sym._abort
lea esi, [esi]
Function at 0x419282
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x419291
pop dword [ebp - 0x20]
mov eax, 0xceec25
sub eax, 0x8d5994
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x3e4d4
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x4a2e
mov edi, eax
mov ebx, 0xc0e1bcb8
sub ebx, 0xc09e68b8
add ebx, dword [ebp - 0x20]
mov esi, 0x332f6aa3
sub esi, 0x5f4fbabc
xor dword [ebp - 0x14], ebx
mov edx, dword [ebx]
add dword [ebp - 8], ebx
xor edx, esi
mov dword [edi], edx
mov dword [ebp - 4], 0xfb4a7f7c
add edi, 4
add ebx, 0xd85cba35
add ebx, 0x27a345cf
loop 0x4192e5
add eax, 0x11b8b
xor ebx, ebx
add ebx, eax
add eax, 0xd2650442
add eax, 0x2d9afbc3
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x404ae0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b8bf8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x554008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
push 0x525e48
mov eax, dword [ebx]
call dword [eax + 4]
mov esi, dword [ebp + 8]
mov eax, esi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x404c70
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
and esi, 0xf
jbe 0x404b62
movzx ecx, word [edi]
lea edi, [edi + ecx*2]
add edi, 2
sub esi, 1
jne 0x404b54
movzx esi, word [edi]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x18]
call fcn.00403af0
add esi, esi
lea eax, [edi + 2]
push esi
push eax
push dword [ebp - 0x18]
call fcn.0049e720
mov eax, dword [ebp - 0x18]
add esp, 0xc
xor ecx, ecx
push dword [ebp + 0xc]
mov word [esi + eax], cx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov dword [ebp - 0x28], vtable.UnicodeStringStorage.0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 1
push eax
push 1
mov ecx, eax
call fcn.00403af0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x525db4
push ecx
call fcn.0049e720
add esp, 0xc
mov byte [ebp - 4], 2
mov esi, 0x525db4
mov eax, dword [ebp - 0x18]
test eax, eax
cmovne esi, eax
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404c13
sub eax, edx
lea ecx, [ebp - 0x24]
sar eax, 1
push ecx
inc eax
push eax
call fcn.00403af0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
sub eax, ecx
and eax, 0xfffffffe
push eax
push esi
push ecx
call fcn.0049e720
mov eax, dword [ebx]
add esp, 0xc
mov ecx, ebx
push 0x525db4
call dword [eax + 4]
mov eax, dword [ebx]
mov ecx, ebx
push dword [ebp - 0x24]
call dword [eax + 4]
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x28], vtable.UnicodeStringStorage.0
call fcn.004039c0
lea ecx, [ebp - 0x18]
call fcn.004039c0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x408dd0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b8ee0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x554008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
mov ecx, dword [eax]
mov edi, ecx
mov ebx, dword [ebp + 0x10]
mov al, 1
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 0x14], al
mov edx, dword [edi + 4]
cmp byte [edx + 0xd], 0
jne 0x408e4b
mov ecx, dword [ebx]
mov eax, dword [edx + 0x10]
mov edi, edx
cmp ecx, eax
jb 0x408e3b
ja 0x408e34
mov eax, dword [ebx + 4]
cmp eax, dword [edx + 0x14]
jb 0x408e3b
mov edx, dword [edx + 8]
xor al, al
jmp 0x408e3f
mov edx, dword [edx]
mov al, 1
cmp byte [edx + 0xd], 0
mov byte [ebp - 0x14], al
je 0x408e21
mov ecx, dword [ebp - 0x1c]
mov esi, edi
test al, al
je 0x408eeb
cmp edi, dword [ecx]
jne 0x408e8b
push dword [ebp + 0x14]
push ecx
push edi
push 1
mov ecx, dword [ebp - 0x18]
lea eax, [ebp + 0x10]
push eax
call fcn.00408ba0
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp byte [edi + 0xd], 0
je 0x408e96
mov esi, dword [edi + 8]
jmp 0x408eeb
mov eax, dword [edi]
cmp byte [eax + 0xd], 0
je 0x408ecd
mov eax, dword [edi + 4]
cmp byte [eax + 0xd], 0
jne 0x408ec3
mov ecx, edi
nop dword [eax]
mov edx, eax
cmp ecx, dword [eax]
jne 0x408ec3
mov esi, eax
mov ecx, edx
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x408eb0
cmp byte [esi + 0xd], 0
jne 0x408eeb
mov esi, eax
jmp 0x408eeb
mov esi, eax
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x408eeb
nop dword [eax + eax]
mov esi, eax
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x408ee0
mov ecx, dword [ebx]
cmp dword [esi + 0x10], ecx
jb 0x408f3f
ja 0x408efc
mov eax, dword [esi + 0x14]
cmp eax, dword [ebx + 4]
jb 0x408f3f
mov ebx, dword [ebp + 0x14]
lea ecx, [ebx + 0x30]
call fcn.00407190
lea ecx, [ebx + 0x24]
call fcn.00407190
lea ecx, [ebx + 0x18]
call fcn.00407190
push 0x3c
push ebx
call fcn.0049b534
mov eax, dword [ebp + 8]
add esp, 8
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push dword [ebp + 0x14]
push ecx
push edi
push dword [ebp - 0x14]
jmp 0x408e60
Function at 0x4094a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b8fef
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x554008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [ebp - 4], 0
lea eax, [edi + 0x10]
mov dword [edi], vtable.ControlCommandLine.0
lea esi, [eax + 4]
mov dword [ebp - 0x14], eax
mov dword [eax], vtable.StringStorage.0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push esi
push 1
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00403af0
mov ecx, dword [esi]
mov eax, dword [esi + 4]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x525db4
push ecx
call fcn.0049e720
add esp, 0xc
lea eax, [edi + 0x20]
mov dword [ebp - 0x14], eax
lea esi, [eax + 4]
mov dword [eax], vtable.StringStorage.0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push esi
push 1
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.00403af0
mov ecx, dword [esi]
mov eax, dword [esi + 4]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x525db4
push ecx
call fcn.0049e720
add esp, 0xc
lea eax, [edi + 0x30]
mov dword [ebp - 0x14], eax
lea esi, [eax + 4]
mov dword [eax], vtable.StringStorage.0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push esi
push 1
mov ecx, esi
mov byte [ebp - 4], 5
call fcn.00403af0
mov ecx, dword [esi]
mov eax, dword [esi + 4]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x525db4
push ecx
call fcn.0049e720
add esp, 0xc
lea eax, [edi + 0x40]
mov dword [ebp - 0x14], eax
mov dword [eax], vtable.StringStorage.0
lea esi, [eax + 4]
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push esi
push 1
mov ecx, esi
mov byte [ebp - 4], 7
call fcn.00403af0
mov ecx, dword [esi]
mov eax, dword [esi + 4]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x525db4
push ecx
call fcn.0049e720
add esp, 0xc
lea eax, [edi + 0x50]
mov dword [ebp - 0x14], eax
lea esi, [eax + 4]
mov dword [eax], vtable.StringStorage.0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push esi
push 1
mov ecx, esi
mov byte [ebp - 4], 9
call fcn.00403af0
mov ecx, dword [esi]
mov eax, dword [esi + 4]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x525db4
push ecx
call fcn.0049e720
add esp, 0xc
mov dword [edi + 0x60], vtable.Rect.0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
lea eax, [edi + 0x78]
mov byte [edi + 0x74], 0
mov dword [ebp - 0x14], eax
lea esi, [eax + 4]
mov dword [eax], vtable.StringStorage.0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push esi
push 1
mov ecx, esi
mov byte [ebp - 4], 0xc
call fcn.00403af0
mov ecx, dword [esi]
mov eax, dword [esi + 4]
sub eax, ecx
and eax, 0xfffffffe
push eax
push 0x525db4
push ecx
call fcn.0049e720
add esp, 0xc
mov dword [edi + 0x88], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40cf40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b9778
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x554008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0x86
mov dword [esi + 0xc], vtable.Control.0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x20], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.SetPasswordsDialog.0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], vtable.CheckBox.0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], vtable.CheckBox.0
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], vtable.CheckBox.0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], vtable.TextBox.0
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], vtable.TextBox.0
mov dword [esi + 0x64], 0
mov dword [esi + 0x60], vtable.CheckBox.0
mov dword [esi + 0x70], 0
mov dword [esi + 0x6c], vtable.CheckBox.0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x78], vtable.CheckBox.0
mov dword [esi + 0x88], 0
mov dword [esi + 0x84], vtable.TextBox.0
mov dword [esi + 0x94], 0
mov dword [esi + 0x90], vtable.TextBox.0
lea edi, [esi + 0x9c]
mov byte [ebp - 4], 0xa
mov ecx, edi
call fcn.0044d9d0
lea ebx, [esi + 0xc0]
mov byte [ebp - 4], 0xb
mov ecx, ebx
call fcn.0044d9d0
lea ecx, [esi + 0xe4]
mov byte [ebp - 4], 0xc
call fcn.0044d9d0
mov cl, byte [ebp + 8]
mov al, cl
mov byte [esi + 0x109], cl
xor al, 1
mov byte [esi + 0x108], al
lea eax, [esi + 0x10c]
mov dword [ebp + 8], eax
lea esi, [eax + 4]
mov dword [eax], vtable.StringStorage.0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push esi
push 1
mov ecx, esi
mov byte [ebp - 4], 0xe
call fcn.00403af0
mov ecx, dword [esi]
mov eax, dword [esi + 4]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x525db4
push ecx
call fcn.0049e720
add esp, 0xc
mov eax, dword [ebp - 0x10]
mov word [eax + 0x11c], 1
add eax, 0x120
mov dword [ebp + 8], eax
lea esi, [eax + 4]
mov dword [eax], vtable.StringStorage.0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push esi
push 1
mov ecx, esi
mov byte [ebp - 4], 0x10
call fcn.00403af0
mov ecx, dword [esi]
mov eax, dword [esi + 4]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x525db4
push ecx
call fcn.0049e720
add esp, 0xc
mov byte [ebp - 4], 0x11
mov ecx, 0x9c57
mov esi, dword [edi]
call fcn.00404d10
push eax
mov ecx, edi
call dword [esi + 8]
mov esi, dword [edi]
mov ecx, 0x9c55
call fcn.00404d10
push eax
mov ecx, edi
call dword [esi + 0xc]
mov esi, dword [ebx]
mov ecx, 0x9c58
call fcn.00404d10
push eax
mov ecx, ebx
call dword [esi + 8]
mov esi, dword [ebx]
mov ecx, 0x9c55
call fcn.00404d10
push eax
mov ecx, ebx
call dword [esi + 0xc]
mov edi, dword [ebp - 0x10]
mov ecx, 0x9ca7
mov esi, dword [edi + 0xe4]
call fcn.00404d10
push eax
lea ecx, [edi + 0xe4]
call dword [esi + 8]
mov esi, dword [edi + 0xe4]
mov ecx, 0x9ca8
call fcn.00404d10
push eax
lea ecx, [edi + 0xe4]
call dword [esi + 0xc]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8