joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10042ba0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10091398
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x100af4a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x18]
cmp eax, 0xffffffff
je 0x10042d78
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [edi + 0xc]
push eax
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.100034d6
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
call fcn.100039a9
add esp, 0x10
or esi, 0xffffffff
test eax, eax
je 0x10042d57
call fcn.10003d87
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x10042c27
push 0x80004005
call fcn.1000118b
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
call fcn.10003d87
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x10042c54
push 0x80004005
call fcn.1000118b
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 2
push eax
call fcn.1000169a
add esp, 4
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.100010c8
mov edx, dword [ebp - 0x1c]
mov ecx, esi
add edx, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10042c9e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
call fcn.10002775
add esp, 8
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 4
call fcn.100010c8
mov edx, dword [ebp - 0x1c]
mov ecx, esi
add edx, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10042cda
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100034d6
add esp, 0xc
push 0
push dword [eax]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edx, dword [ebp - 0x1c]
mov ecx, esi
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10042d17
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
mov ecx, esi
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10042d37
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x18]
mov ecx, esi
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10042d57
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x10042d78
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [edi + 0x18], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10042e10
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100913d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100af4a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push esi
call fcn.10001aaf
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10042eb6
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10042eb6
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0xb7
je 0x10042eb6
lea eax, [ebp - 0x10]
push eax
call fcn.10001334
mov eax, dword [ebp - 0x10]
add esp, 4
cmp dword [eax - 0xc], 0
jne 0x10042e89
xor esi, esi
jmp 0x10042ebb
push dword [ebp - 0x10]
call fcn.10003a58
add esp, 4
test eax, eax
jne 0x10042e9c
xor esi, esi
jmp 0x10042ebb
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10042eb6
call edi
cmp eax, 0xb7
je 0x10042eb6
xor esi, esi
jmp 0x10042ebb
mov esi, 1
mov edi, dword [ebp - 0x10]
or ecx, 0xffffffff
add edi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10042edf
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10043b80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x100af4a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100b2a54]
mov dword [ebp - 0x210], 0
push esi
mov esi, dword [ebp + 8]
test al, 1
jne 0x10043bdb
or eax, 1
mov dword [0x100b2a54], eax
call fcn.10003d87
mov ecx, eax
test ecx, ecx
je 0x10043c76
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
push 0x10094710
mov dword [0x100b2a50], eax
call fcn.10057a63
add esp, 4
mov ecx, dword [0x100b2a50]
cmp dword [ecx - 0xc], 0
je 0x10043bed
add ecx, 0xfffffff0
push ecx
jmp 0x10043c58
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x10043c4f
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10043c10
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
mov ecx, 0x100b2a50
call fcn.10003daa
push 0x100b2a50
call fcn.10004115
add esp, 4
mov ecx, 0x100b2a50
push 8
push str.drivers_
call fcn.100035ee
mov eax, dword [0x100b2a50]
add eax, 0xfffffff0
push eax
call fcn.100024e1
mov ecx, dword [ebp - 4]
add esp, 4
add eax, 0x10
xor ecx, ebp
mov dword [esi], eax
mov eax, esi
pop esi
call fcn.100567ed
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.1000118b
int3
Function at 0x100486d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10091888
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x100af4a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi + 4], vtable.ICompressSetInStream.0
mov dword [esi + 8], vtable.ISequentialInStream.0
mov dword [esi + 0xc], vtable.ICompressSetOutStream.0
mov dword [esi + 0x10], vtable.ISequentialOutStream.0
mov dword [esi + 0x14], vtable.IOutStreamFlush.0
mov dword [esi + 0x18], vtable.ICryptoSetPassword.0
mov dword [esi + 0x1c], vtable.ICompressSetCoderProperties.0
mov dword [esi + 0x20], vtable.ICompressWriteCoderProperties.0
mov dword [esi + 0x24], vtable.ICryptoResetInitVector.0
mov dword [esi + 0x28], vtable.ICompressSetDecoderProperties2.0
mov dword [esi + 0x2c], 0
mov dword [esi], vtable.CFilterCoder.0
mov dword [esi + 4], vtable.CFilterCoder.1.0
mov dword [esi + 8], vtable.CFilterCoder.2.0
mov dword [esi + 0xc], vtable.CFilterCoder.3.0
mov dword [esi + 0x10], vtable.CFilterCoder.4.0
mov dword [esi + 0x14], vtable.CFilterCoder.5.0
mov dword [esi + 0x18], vtable.CFilterCoder.6.0
mov dword [esi + 0x1c], vtable.CFilterCoder.7.0
mov dword [esi + 0x20], vtable.CFilterCoder.8.0
mov dword [esi + 0x24], vtable.CFilterCoder.9.0
mov dword [esi + 0x28], vtable.CFilterCoder.10.0
mov dword [esi + 0x34], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
push 0x20000
mov byte [ebp - 4], 7
call fcn.10002969
add esp, 4
mov dword [esi + 0x30], eax
test eax, eax
jne 0x10048800
push 0x100a7b70
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 1
push eax
call fcn.10057a86
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10048910
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009190d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100af4a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CFilterCoder.0
mov dword [esi + 4], vtable.CFilterCoder.1.0
mov dword [esi + 8], vtable.CFilterCoder.2.0
mov dword [esi + 0xc], vtable.CFilterCoder.3.0
mov dword [esi + 0x10], vtable.CFilterCoder.4.0
mov dword [esi + 0x14], vtable.CFilterCoder.5.0
mov dword [esi + 0x18], vtable.CFilterCoder.6.0
mov dword [esi + 0x1c], vtable.CFilterCoder.7.0
mov dword [esi + 0x20], vtable.CFilterCoder.8.0
mov dword [esi + 0x24], vtable.CFilterCoder.9.0
mov dword [esi + 0x28], vtable.CFilterCoder.10.0
push dword [esi + 0x30]
mov dword [ebp - 4], 6
call fcn.10003d4b
mov ecx, dword [esi + 0x74]
add esp, 4
test ecx, ecx
je 0x100489a4
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x70]
mov byte [ebp - 4], 5
test ecx, ecx
je 0x100489b5
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x6c]
mov byte [ebp - 4], 4
test ecx, ecx
je 0x100489c6
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x68]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x100489d7
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x64]
mov byte [ebp - 4], 2
test ecx, ecx
je 0x100489e8
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x60]
mov byte [ebp - 4], 1
test ecx, ecx
je 0x100489f9
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x38]
mov byte [ebp - 4], 0
test ecx, ecx
je 0x10048a0a
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x34]
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x10048a1e
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10049af0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10091988
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100af4a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 4
mov dword [ebp - 4], 0
mov dword [edi], vtable.CRecordVector_void__.0
call fcn.100011c7
mov esi, dword [ebp + 8]
mov ecx, edi
push esi
call fcn.10003f2b
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov al, byte [esi + 0x1c]
mov byte [edi + 0x1c], al
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x401250
Capabilities:
Check internet connectivity via wininet

Disassembly:
sub esp, 0x10
push ebx
push 0
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 7
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
jne 0x40127d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x1c]
mov dword [ecx], eax
xor bl, bl
jmp 0x4012d8
push esi
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push 8
lea edx, [esp + 0x14]
push edx
xor eax, eax
push 0x32
mov dword [esp + 0x1c], eax
push eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 1
call esi
push 4
lea eax, [esp + 0x10]
push eax
push 2
push 0
mov dword [esp + 0x1c], 0xbb8
call esi
mov ecx, dword [esp + 0x1c]
push 0
push 1
push ecx
call dword [sym.imp.WININET.dll_InternetCheckConnectionW]
test eax, eax
setne bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x20]
mov dword [edx], eax
pop esi
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4012f8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, bl
pop ebx
add esp, 0x10
ret 8
Function at 0x401ad0
Capabilities:
Hash data with crc32

Disassembly:
push esi
mov esi, ecx
call fcn.00401930
push 0x400
call fcn.0040a94b
add esp, 4
mov dword [esi + 4], eax
xor ecx, ecx
lea ebx, [ebx]
mov eax, ecx
shr eax, 1
test cl, 1
je 0x401afe
xor eax, 0xedb88320
test al, 1
je 0x401b0b
shr eax, 1
xor eax, 0xedb88320
jmp 0x401b0d
shr eax, 1
test al, 1
je 0x401b1a
shr eax, 1
xor eax, 0xedb88320
jmp 0x401b1c
shr eax, 1
test al, 1
je 0x401b29
shr eax, 1
xor eax, 0xedb88320
jmp 0x401b2b
shr eax, 1
test al, 1
je 0x401b38
shr eax, 1
xor eax, 0xedb88320
jmp 0x401b3a
shr eax, 1
test al, 1
je 0x401b47
shr eax, 1
xor eax, 0xedb88320
jmp 0x401b49
shr eax, 1
test al, 1
je 0x401b56
shr eax, 1
xor eax, 0xedb88320
jmp 0x401b58
shr eax, 1
test al, 1
je 0x401b65
shr eax, 1
xor eax, 0xedb88320
jmp 0x401b67
shr eax, 1
mov edx, dword [esi + 4]
mov dword [edx + ecx*4], eax
inc ecx
cmp ecx, 0x100
jl 0x401af0
pop esi
ret

Function at 0x401da0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x620
mov eax, dword [0x44e848]
xor eax, esp
mov dword [esp + 0x61c], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x638]
xor eax, eax
mov esi, ecx
push 0x206
push eax
lea ecx, [esp + 0x1e]
push ecx
mov dword [esp + 0x1c], esi
mov word [esp + 0x20], ax
call fcn.00427580
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x43a]
push eax
mov word [esp + 0x43c], dx
call fcn.00427580
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x23e]
push edx
mov word [esp + 0x240], cx
call fcn.00427580
add esp, 0x24
call fcn.00412396
mov ebp, dword [esp + 0x634]
mov ebx, dword [eax + 4]
push 0x104
cmp ebp, 0x82
jne 0x401e43
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.004134a3
jmp 0x401e50
lea ecx, [esp + 0x18]
push ecx
push ebp
mov ecx, esi
call fcn.00412d57
lea esi, [ebx + 0x2ae]
push esi
push 0x104
lea edx, [esp + 0x42c]
push edx
lea eax, [esp + 0x20]
push eax
push edi
push 0x43d9c8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
push 0x104
lea ecx, [esp + 0x224]
push ecx
lea edx, [esp + 0x430]
push edx
push edi
add ebx, 0xa6
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp ebp, 0x82
jne 0x401eb4
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x21c]
push eax
call fcn.00412e42
jmp 0x401ec6
lea ecx, [esp + 0x21c]
push ecx
mov ecx, dword [esp + 0x14]
push ebp
call fcn.00412d81
mov ecx, dword [esp + 0x62c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00427533
add esp, 0x620
ret 8
Function at 0x4021b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x620
mov eax, dword [0x44e848]
xor eax, esp
mov dword [esp + 0x61c], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x638]
xor eax, eax
mov esi, ecx
push 0x206
push eax
lea ecx, [esp + 0x1e]
push ecx
mov dword [esp + 0x1c], esi
mov word [esp + 0x20], ax
call fcn.00427580
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x232]
push eax
mov word [esp + 0x234], dx
call fcn.00427580
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x446]
push edx
mov word [esp + 0x448], cx
call fcn.00427580
add esp, 0x24
call fcn.00412396
mov ebp, dword [esp + 0x634]
mov ebx, dword [eax + 4]
push 0x104
cmp ebp, 0x83
jne 0x402253
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.004134a3
jmp 0x402260
lea ecx, [esp + 0x18]
push ecx
push ebp
mov ecx, esi
call fcn.00412d57
lea esi, [ebx + 0x2ae]
push esi
push 0x104
lea edx, [esp + 0x42c]
push edx
lea eax, [esp + 0x20]
push eax
push edi
push 0x43d9c8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
push 0x104
lea ecx, [esp + 0x224]
push ecx
lea edx, [esp + 0x430]
push edx
push edi
add ebx, 0xa6
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp ebp, 0x83
jne 0x4022c4
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x21c]
push eax
call fcn.00412e42
jmp 0x4022d6
lea ecx, [esp + 0x21c]
push ecx
mov ecx, dword [esp + 0x14]
push ebp
call fcn.00412d81
mov ecx, dword [esp + 0x62c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00427533
add esp, 0x620
ret 8

Function at 0x402500
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x620
mov eax, dword [0x44e848]
xor eax, esp
mov dword [esp + 0x61c], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x638]
xor eax, eax
mov esi, ecx
push 0x206
push eax
lea ecx, [esp + 0x1e]
push ecx
mov dword [esp + 0x1c], esi
mov word [esp + 0x20], ax
call fcn.00427580
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x232]
push eax
mov word [esp + 0x234], dx
call fcn.00427580
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x446]
push edx
mov word [esp + 0x448], cx
call fcn.00427580
add esp, 0x24
call fcn.00412396
mov ebp, dword [esp + 0x634]
mov ebx, dword [eax + 4]
push 0x104
cmp ebp, 0x85
jne 0x4025a3
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.004134a3
jmp 0x4025b0
lea ecx, [esp + 0x18]
push ecx
push ebp
mov ecx, esi
call fcn.00412d57
lea esi, [ebx + 0x2ae]
push esi
push 0x104
lea edx, [esp + 0x42c]
push edx
lea eax, [esp + 0x20]
push eax
push edi
push 0x43d9c8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
push 0x104
lea ecx, [esp + 0x224]
push ecx
lea edx, [esp + 0x430]
push edx
push edi
add ebx, 0xa6
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp ebp, 0x85
jne 0x402614
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x21c]
push eax
call fcn.00412e42
jmp 0x402626
lea ecx, [esp + 0x21c]
push ecx
mov ecx, dword [esp + 0x14]
push ebp
call fcn.00412d81
mov ecx, dword [esp + 0x62c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00427533
add esp, 0x620
ret 8
Function at 0x402860
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x620
mov eax, dword [0x44e848]
xor eax, esp
mov dword [esp + 0x61c], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x638]
xor eax, eax
mov esi, ecx
push 0x206
push eax
lea ecx, [esp + 0x1e]
push ecx
mov dword [esp + 0x1c], esi
mov word [esp + 0x20], ax
call fcn.00427580
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x232]
push eax
mov word [esp + 0x234], dx
call fcn.00427580
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x446]
push edx
mov word [esp + 0x448], cx
call fcn.00427580
add esp, 0x24
call fcn.00412396
mov ebp, dword [esp + 0x634]
mov ebx, dword [eax + 4]
push 0x104
cmp ebp, 0x84
jne 0x402903
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.004134a3
jmp 0x402910
lea ecx, [esp + 0x18]
push ecx
push ebp
mov ecx, esi
call fcn.00412d57
lea esi, [ebx + 0x2ae]
push esi
push 0x104
lea edx, [esp + 0x42c]
push edx
lea eax, [esp + 0x20]
push eax
push edi
push 0x43d9c8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
push 0x104
lea ecx, [esp + 0x224]
push ecx
lea edx, [esp + 0x430]
push edx
push edi
add ebx, 0xa6
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp ebp, 0x84
jne 0x402974
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x21c]
push eax
call fcn.00412e42
jmp 0x402986
lea ecx, [esp + 0x21c]
push ecx
mov ecx, dword [esp + 0x14]
push ebp
call fcn.00412d81
mov ecx, dword [esp + 0x62c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00427533
add esp, 0x620
ret 8

Function at 0x402b70
Capabilities:
Read .ini file

Disassembly:
sub esp, 0xc38
mov eax, dword [0x44e848]
xor eax, esp
mov dword [esp + 0xc34], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0xc50]
xor eax, eax
mov esi, ecx
push 0x40e
push eax
lea ecx, [esp + 0x1e]
push ecx
mov dword [esp + 0x1c], esi
mov word [esp + 0x20], ax
call fcn.00427580
xor edx, edx
push 0x40e
push edx
lea eax, [esp + 0x43a]
push eax
mov word [esp + 0x43c], dx
call fcn.00427580
xor ecx, ecx
push 0x40e
push ecx
lea edx, [esp + 0x856]
push edx
mov word [esp + 0x858], cx
call fcn.00427580
add esp, 0x24
call fcn.00412396
mov ebp, dword [esp + 0xc4c]
mov ebx, dword [eax + 4]
cmp ebp, 0x8b
jne 0x402c13
push 0x104
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.004134a3
jmp 0x402c25
push 0x208
lea ecx, [esp + 0x18]
push ecx
push ebp
mov ecx, esi
call fcn.00412d57
lea esi, [ebx + 0x2ae]
push esi
push 0x104
lea edx, [esp + 0x83c]
push edx
lea eax, [esp + 0x20]
push eax
push edi
push 0x43d9c8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
push 0x208
lea ecx, [esp + 0x42c]
push ecx
lea edx, [esp + 0x840]
push edx
push edi
add ebx, 0xa6
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp ebp, 0x8b
jne 0x402c89
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x424]
push eax
call fcn.00412e42
jmp 0x402c9b
lea ecx, [esp + 0x424]
push ecx
mov ecx, dword [esp + 0x14]
push ebp
call fcn.00412d81
mov ecx, dword [esp + 0xc44]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00427533
add esp, 0xc38
ret 8
Function at 0x402dd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402de9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402e24
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x402e20
lea ebx, [ebx]
cmp esi, eax
jae 0x402e24
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402e10
cmp esi, eax
jb 0x402e2a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x403000
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x620
mov eax, dword [0x44e848]
xor eax, esp
mov dword [esp + 0x61c], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x638]
xor eax, eax
mov esi, ecx
push 0x206
push eax
lea ecx, [esp + 0x1e]
push ecx
mov dword [esp + 0x1c], esi
mov word [esp + 0x20], ax
call fcn.00427580
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x232]
push eax
mov word [esp + 0x234], dx
call fcn.00427580
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x446]
push edx
mov word [esp + 0x448], cx
call fcn.00427580
add esp, 0x24
call fcn.00412396
mov ebp, dword [esp + 0x634]
mov ebx, dword [eax + 4]
push 0x104
cmp ebp, 0x81
jne 0x4030a3
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.004134a3
jmp 0x4030b0
lea ecx, [esp + 0x18]
push ecx
push ebp
mov ecx, esi
call fcn.00412d57
lea esi, [ebx + 0x2ae]
push esi
push 0x104
lea edx, [esp + 0x42c]
push edx
lea eax, [esp + 0x20]
push eax
push edi
push 0x43d9c8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
push 0x104
lea ecx, [esp + 0x224]
push ecx
lea edx, [esp + 0x430]
push edx
push edi
add ebx, 0xa6
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp ebp, 0x81
jne 0x403114
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x21c]
push eax
call fcn.00412e42
jmp 0x403126
lea ecx, [esp + 0x21c]
push ecx
mov ecx, dword [esp + 0x14]
push ebp
call fcn.00412d81
mov ecx, dword [esp + 0x62c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00427533
add esp, 0x620
ret 8