joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405c73
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov ecx, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
push ebx
push esi
push edi
push 1
pop eax
cmp ecx, eax
jl 0x405d86
cmp ecx, 7
jg 0x405d86
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
jl 0x405d86
mov esi, ecx
shl esi, 3
mov ecx, dword [esi + 0x4174d0]
cmp ecx, ebx
jne 0x405cc1
cmp dword [ebp + 0xc], ebx
je 0x405d86
cmp ecx, ebx
je 0x405cca
cmp dword [ebp + 0xc], ebx
jne 0x405d86
push 0x105
lea eax, [ebp - 0x118]
push ebx
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
cmp dword [esi + 0x4174d0], ebx
push str..lck
je 0x405cfa
call sub.MSVCR80.dll__getpid
push eax
push dword [esi + 0x4174d0]
jmp 0x405d03
call sub.MSVCR80.dll__getpid
push eax
push dword [ebp + 0xc]
push str._s_d_s
lea eax, [ebp - 0x118]
push 0x104
push eax
call dword [sym.imp.MSVCR80.dll__snprintf]
add esp, 0x18
lea eax, [ebp - 0x10]
push eax
call fcn.00405a00
test eax, eax
pop ecx
jne 0x405d43
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x10]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
cmp edi, ebx
jne 0x405d48
push 3
pop eax
jmp 0x405d86
push dword [ebp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x405d7a
cmp eax, 0x80
je 0x405d74
cmp eax, 0x102
jne 0x405d83
push edi
mov dword [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405d83
or dword [ebp - 4], 0xffffffff
jmp 0x405d83
mov dword [ebp - 4], ebx
mov dword [esi + 0x4174d4], edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4062ea
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
mov esi, 0x100
push esi
lea eax, [ebp - 0x100]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x100]
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [ebp - 0x100]
test eax, eax
je 0x406380
cmp byte [ebp - 0x100], 0
je 0x406380
lea eax, [ebp - 0x100]
push eax
call sub.MSVCR80.dll_strlen
inc eax
push eax
call fcn.00404b75
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x406380
call fcn.004085cd
cmp eax, 1
lea eax, [ebp - 0x100]
push eax
jne 0x406374
call sub.MSVCR80.dll_strlen
inc eax
push eax
lea eax, [ebp - 0x100]
push esi
push eax
call fcn.00406299
add esp, 0x10
jmp 0x40637c
push esi
call sub.MSVCR80.dll_strcpy
pop ecx
pop ecx
mov eax, esi
jmp 0x406382
xor eax, eax
pop esi
leave
ret
Function at 0x406385
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x51c
push esi
xor esi, esi
cmp dword [ebp + 8], esi
lea eax, [ebp - 0x51c]
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x104
je 0x4064c2
push 0x106
lea eax, [ebp - 0x11c]
push esi
push eax
call sub.MSVCR80.dll_memset
push 5
lea eax, [ebp - 0x14]
push esi
push eax
call sub.MSVCR80.dll_memset
mov edi, 0x400
lea eax, [ebp - 0x51c]
push edi
push esi
push eax
call sub.MSVCR80.dll_memset
lea eax, [ebp - 0xc]
push 0x18
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.00408837
add esp, 0x30
cmp eax, esi
je 0x406418
lea eax, [ebp - 0xc]
push 0x19
push eax
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 0xc], 0x104
call fcn.00408837
add esp, 0xc
cmp eax, esi
jne 0x40645c
lea eax, [ebp - 0x11c]
push 3
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.MSVCR80.dll_strncpy]
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x40645c
push esi
push esi
push esi
lea eax, [ebp - 4]
push esi
push eax
push esi
lea eax, [ebp - 0x14]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x40645c
mov eax, dword [ebp - 4]
cmp eax, esi
jne 0x4064b9
lea eax, [ebp - 0x51c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea eax, [ebp - 0x51c]
push eax
call sub.MSVCR80.dll_strlen
test eax, eax
pop ecx
je 0x4064c2
mov edi, dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x4064b6
push esi
push esi
push esi
lea eax, [ebp - 4]
push esi
push eax
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x4064a6
mov eax, dword [ebp - 4]
cmp eax, esi
jne 0x4064b9
push edi
call sub.MSVCR80.dll_strlen
lea eax, [edi + eax + 1]
pop ecx
mov dword [ebp - 8], eax
mov edi, eax
push edi
jmp 0x406471
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
xor eax, eax
jmp 0x4064c5
push 0xfffffffffffffffe
pop eax
pop edi
pop esi
leave
ret

Function at 0x406523
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, 0xc6ef3720
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
mov dword [ebp + 8], 0x20
mov edi, dword [eax]
mov dword [ebp - 0xc], edi
mov edi, dword [eax + 4]
mov dword [ebp - 8], edi
mov edi, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], edi
mov dword [ebp + 0x10], eax
mov eax, edx
mov edi, edx
shr eax, 5
add eax, dword [ebp + 0x10]
shl edi, 4
add edi, dword [ebp - 4]
xor eax, edi
lea edi, [esi + edx]
xor eax, edi
sub ecx, eax
mov eax, ecx
mov edi, ecx
shr eax, 5
add eax, dword [ebp - 8]
shl edi, 4
add edi, dword [ebp - 0xc]
xor eax, edi
lea edi, [esi + ecx]
xor eax, edi
add esi, 0x61c88647
sub edx, eax
dec dword [ebp + 8]
jne 0x406559
mov eax, dword [ebp + 0xc]
pop edi
pop esi
mov dword [eax], edx
mov dword [eax + 4], ecx
leave
ret
Function at 0x407380
Capabilities:
Get session user name

Disassembly:
mov eax, dword [esp + 8]
push esi
dec eax
push edi
mov edi, dword [esp + 0xc]
mov esi, str.NONAME
push eax
push esi
push edi
call dword [sym.imp.MSVCR80.dll_strncpy]
mov eax, dword [esp + 0x1c]
add esp, 0xc
and byte [edi + eax - 1], 0
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x4073c3
push esi
push edi
call sub.MSVCR80.dll_strcpy
pop ecx
pop ecx
push 0xfffffffffffffffe
pop eax
jmp 0x4073c5
xor eax, eax
pop edi
pop esi
ret

Function at 0x407aec
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x408660
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x408683
push edi
call sub.MSVCR80.dll_strlen
mov esi, 0x104
pop ecx
cmp eax, esi
jb 0x40868d
mov eax, 0xc8003004
jmp 0x4087c2
push esi
lea eax, [ebp - 0x108]
push 0
push eax
call sub.MSVCR80.dll_memset
push esi
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.MSVCR80.dll_memset
push edi
call sub.MSVCR80.dll_strlen
mov ecx, 0x103
add esp, 0x1c
cmp eax, ecx
jae 0x4086c6
push edi
call sub.MSVCR80.dll_strlen
pop ecx
jmp 0x4086c8
mov eax, ecx
push eax
lea eax, [ebp - 0x20c]
push edi
push eax
call dword [sym.imp.MSVCR80.dll_strncpy]
mov ebx, dword [sym.imp.MSVCR80.dll_strtok]
and byte [ebp - 0x109], 0
mov esi, 0x417598
lea eax, [ebp - 0x20c]
push esi
push eax
call ebx
mov edi, eax
add esp, 0x14
test edi, edi
je 0x4087c0
push edi
call sub.MSVCR80.dll_strlen
push eax
lea eax, [ebp - 0x108]
push edi
mov edi, dword [sym.imp.MSVCR80.dll_strncat]
push eax
call edi
push 1
lea eax, [ebp - 0x108]
push esi
push eax
call edi
push esi
push 0
call ebx
add esp, 0x24
mov dword [ebp + 8], eax
test eax, eax
je 0x4087c0
push dword [ebp + 8]
call sub.MSVCR80.dll_strlen
push eax
lea eax, [ebp - 0x108]
push dword [ebp + 8]
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x408790
lea eax, [ebp - 0x108]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4087c7
cmp dword [ebp + 0xc], 0x23
jne 0x408790
lea eax, [ebp - 0x108]
push eax
call fcn.004087ce
pop ecx
push 1
lea eax, [ebp - 0x108]
push esi
push eax
call edi
push esi
push 0
call ebx
add esp, 0x14
cmp dword [ebp - 4], 0xffffffff
mov dword [ebp + 8], eax
je 0x4087b6
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
jne 0x408736
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, 0xc8003005
jmp 0x4087c2
Function at 0x409230
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebp, ebp
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov ebx, 4
sub esi, ecx
lea eax, [edi + ecx]
lea edx, [esp + ebp + 0x10]
add edi, ebx
mov cl, byte [esi + eax]
mov byte [edx], cl
mov byte [eax], cl
add edx, 4
inc eax
dec ebx
jne 0x409253
inc ebp
cmp ebp, 4
jl 0x40923b
cmp edi, 0xb0
jge 0x40930a
mov ebp, 0x432604
xor eax, eax
lea ecx, [esp + 0x10]
inc eax
mov edx, eax
and edx, 0x80000003
jns 0x40928e
dec edx
or edx, 0xfffffffc
inc edx
xor ebx, ebx
add ecx, 4
mov bl, byte [esp + edx*4 + 0x13]
mov dl, byte [ebx + 0x432404]
mov bl, byte [ecx - 4]
xor bl, dl
cmp eax, 4
mov byte [ecx - 4], bl
jl 0x40927e
mov al, byte [ebp]
mov cl, byte [esp + 0x10]
xor cl, al
add ebp, 4
mov byte [esp + 0x10], cl
mov esi, 1
lea eax, [esp + esi + 0x10]
mov ecx, 4
mov dl, byte [eax - 1]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
add eax, 4
dec ecx
jne 0x4092c8
inc esi
cmp esi, 4
jl 0x4092bf
xor esi, esi
lea eax, [esp + esi + 0x10]
mov ecx, 4
mov ebx, dword [esp + 0x24]
mov dl, byte [eax]
add eax, 4
mov byte [edi + ebx], dl
inc edi
dec ecx
jne 0x4092e8
inc esi
cmp esi, 4
jl 0x4092df
cmp edi, 0xb0
jl 0x409278
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8

Function at 0x409320
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
push ebp
push esi
call fcn.004093a0
lea edi, [ebp + 0x10]
mov ebx, 9
xor eax, eax
xor ecx, ecx
mov cl, byte [eax + esi]
inc eax
cmp eax, 0x10
mov dl, byte [ecx + 0x432404]
mov byte [eax + esi - 1], dl
jl 0x40933d
push 0
push esi
call fcn.004093d0
push esi
call fcn.00409420
push edi
push esi
call fcn.004093a0
add edi, 0x10
dec ebx
jne 0x40933b
xor eax, eax
xor ecx, ecx
mov cl, byte [eax + esi]
inc eax
cmp eax, 0x10
mov dl, byte [ecx + 0x432404]
mov byte [eax + esi - 1], dl
jl 0x40936f
push 0
push esi
call fcn.004093d0
add ebp, 0xa0
push ebp
push esi
call fcn.004093a0
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x4093a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push ebx
push esi
sub ecx, eax
mov esi, 0x10
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec esi
jne 0x4093b1
pop esi
pop ebx
ret 8

Function at 0x409ad0
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x10
lea ecx, [esp]
push esi
push eax
push ecx
call fcn.00409b50
push 0
push 0x80
push 3
push 0
push 3
lea edx, [esp + 0x18]
push 0xc0000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov esi, dword [esp + 0x18]
mov dword [esi], eax
jne 0x409b3f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x409b26
cmp eax, 3
ja 0x409b26
mov ax, 0x20c
pop esi
add esp, 0x10
ret 8
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x409b34
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ax, 0x20b
pop esi
add esp, 0x10
ret 8
mov ax, 0x200
pop esi
add esp, 0x10
ret 8
Function at 0x409b90
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x10
mov al, 0x5c
push esi
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 7], al
push 0
mov al, 0x6e
push 0x80
push 3
mov byte [esp + 0x15], al
mov byte [esp + 0x17], al
push 0
push 3
lea eax, [esp + 0x18]
push 0xc0000000
push eax
mov byte [esp + 0x22], 0x2e
mov byte [esp + 0x24], 0x53
mov byte [esp + 0x26], 0x74
mov byte [esp + 0x28], 0x6c
mov byte [esp + 0x29], 0x55
mov byte [esp + 0x2a], 0x73
mov byte [esp + 0x2b], 0x62
mov byte [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov esi, dword [esp + 0x18]
mov dword [esi], eax
jne 0x409c30
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x409c17
cmp eax, 3
ja 0x409c17
mov ax, 0x20c
pop esi
add esp, 0x10
ret 8
mov esi, dword [esi]
cmp esi, 0xffffffff
je 0x409c25
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ax, 0x20b
pop esi
add esp, 0x10
ret 8
mov ax, 0x200
pop esi
add esp, 0x10
ret 8

Function at 0x409da0
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push edi
mov edi, dword [esi + 0xc]
mov edx, 0xc6ef3720
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x10], edi
mov edi, dword [esi + 8]
mov dword [esp + 0x24], edi
mov edi, dword [esi + 4]
mov esi, dword [esi]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov edi, 0x20
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x10]
mov esi, ecx
shl esi, 4
add esi, ebx
mov ebx, ecx
shr ebx, 5
add ebx, ebp
mov ebp, dword [esp + 0x18]
xor esi, ebx
lea ebx, [edx + ecx]
xor esi, ebx
mov ebx, dword [esp + 0x14]
sub eax, esi
mov esi, eax
shl esi, 4
add esi, ebx
mov ebx, eax
shr ebx, 5
add ebx, ebp
xor esi, ebx
lea ebx, [edx + eax]
xor esi, ebx
add edx, 0x61c88647
sub ecx, esi
dec edi
jne 0x409dd9
mov edx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [edx], ecx
mov dword [edx + 4], eax
pop ebx
add esp, 0xc
ret 8

Function at 0x409f20
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push edi
mov edi, dword [esi + 4]
xor edx, edx
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esp + 0x10], edi
mov edi, dword [esi]
mov dword [esp + 0x24], edi
mov edi, dword [esi + 0xc]
mov esi, dword [esi + 8]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov edi, 0x20
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x10]
mov esi, ecx
sub edx, 0x61c88647
shl esi, 4
add esi, ebx
mov ebx, ecx
shr ebx, 5
add ebx, ebp
mov ebp, dword [esp + 0x18]
xor esi, ebx
lea ebx, [edx + ecx]
xor esi, ebx
mov ebx, dword [esp + 0x14]
add eax, esi
mov esi, eax
shl esi, 4
add esi, ebx
mov ebx, eax
shr ebx, 5
add ebx, ebp
xor esi, ebx
lea ebx, [edx + eax]
xor esi, ebx
add ecx, esi
dec edi
jne 0x409f56
mov edx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [edx], eax
mov dword [edx + 4], ecx
pop ebx
add esp, 0xc
ret 8
Function at 0x40ab55
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
mov bx, word [esp + 0x48]
push esi
mov esi, dword [esp + 0x50]
cmp bx, 4
mov word [esi], 0
jbe 0x40ab78
pop esi
xor al, al
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.0040ae63
lea ecx, [esp + 0x38]
push 0x10
push ecx
call fcn.0040aebd
lea edx, [esp + 0x18]
push 0x10
push edx
call fcn.0040af15
lea eax, [esp + 0x18]
add bl, 0x31
push eax
call fcn.0040ac55
and eax, 0xffff
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0xc]
mov byte [esp + eax + 0x1c], bl
push 0x10
push edx
lea eax, [esp + 0x24]
push 0x40ab54
lea ecx, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x40ac28
lea edx, [esp + 8]
push 0x2c
push edx
call fcn.0040af55
test ax, ax
je 0x40abf2
and eax, 0xffff
mov byte [esp + eax + 8], 0
cmp byte [esp + 8], 0x30
jne 0x40ac14
mov al, byte [esp + 9]
and al, 0xdf
cmp al, 0x58
jne 0x40ac14
lea ecx, [esp + 0xa]
push esi
push ecx
call fcn.0040ad15
test al, al
jne 0x40ac28
jmp 0x40ac23
lea edx, [esp + 8]
push esi
push edx
call fcn.0040ac75
test al, al
jne 0x40ac28
mov word [esi], 0
mov ax, word [esi]
test ax, ax
je 0x40ac43
cmp ax, 0xffff
je 0x40ac43
pop esi
mov eax, 1
pop ebx
add esp, 0x40
ret 8
pop esi
xor eax, eax
pop ebx
add esp, 0x40
ret 8

Function at 0x40af89
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
mov bx, word [esp + 0x48]
push esi
mov esi, dword [esp + 0x50]
cmp bx, 4
mov word [esi], 0
jbe 0x40afac
pop esi
xor al, al
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.0040ae63
lea ecx, [esp + 0x38]
push 0x10
push ecx
call fcn.0040aebd
lea edx, [esp + 0x18]
push 0x10
push edx
call fcn.0040af15
lea eax, [esp + 0x18]
add bl, 0x31
push eax
call fcn.0040ac55
and eax, 0xffff
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0xc]
mov byte [esp + eax + 0x1c], bl
push 0x10
push edx
lea eax, [esp + 0x24]
push 0x40af88
lea ecx, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x40b057
lea edx, [esp + 8]
push 0x2c
push edx
call fcn.0040af55
test ax, ax
je 0x40b057
and eax, 0xffff
mov cl, byte [esp + eax + 9]
and cl, 0xdf
cmp cl, 0x54
jne 0x40b057
cmp byte [esp + eax + 0xa], 0x3a
jne 0x40b057
lea edx, [esp + eax + 0xb]
push esi
push edx
call fcn.0040ac75
test al, al
je 0x40b052
mov ax, word [esi]
cmp ax, 1
jl 0x40b052
cmp ax, 7
jle 0x40b057
mov word [esi], 0
xor eax, eax
cmp word [esi], ax
pop esi
pop ebx
setne al
add esp, 0x40
ret 8
Function at 0x40b06d
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x50
lea eax, [esp]
push esi
push 0x10
push eax
call fcn.0040ae63
lea ecx, [esp + 0x24]
push 0x10
push ecx
call fcn.0040aebd
lea edx, [esp + 0x14]
push 0x10
push edx
call fcn.0040b1a3
lea eax, [esp + 0x44]
push 0x10
push eax
call fcn.0040b155
lea ecx, [esp + 4]
lea edx, [esp + 0x34]
push ecx
push 0x10
push edx
lea eax, [esp + 0x20]
push 0x40b06c
lea ecx, [esp + 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, eax
test esi, esi
je 0x40b0dd
lea edx, [esp + 0x34]
lea eax, [esp + 0x44]
push edx
push eax
call fcn.0040b0ed
mov ecx, dword [esp + 0x5c]
mov byte [ecx], al
xor eax, eax
test esi, esi
setne al
pop esi
add esp, 0x50
ret 8

Function at 0x40b1f3
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x30
lea eax, [esp]
push 0x10
push eax
call fcn.0040ae63
lea ecx, [esp + 0x20]
push 0x10
push ecx
call fcn.0040aebd
lea edx, [esp + 0x10]
push 0x10
push edx
call fcn.0040b25a
lea eax, [esp]
lea ecx, [esp + 0x10]
push eax
push 0
lea edx, [esp + 0x28]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
xor edx, edx
mov ecx, dword [esp + 0x34]
test eax, eax
setne dl
mov word [ecx], ax
mov al, dl
add esp, 0x30
ret 4

Function at 0x40b29d
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x70
lea eax, [esp]
push esi
mov esi, dword [esp + 0x78]
push 0x10
push 0
push eax
mov word [esi], 0
call fcn.0040a871
lea ecx, [esp + 0x14]
push 0x10
push ecx
call fcn.0040ae63
lea edx, [esp + 0x34]
push 0x10
push edx
call fcn.0040aebd
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.0040b3a8
lea ecx, [esp + 0x44]
push 0x10
push ecx
call fcn.0040b400
lea edx, [esp + 0x54]
push 0x10
push edx
call fcn.0040b49c
lea eax, [esp + 0x64]
push 0x10
push eax
call fcn.0040b454
lea ecx, [esp + 0x14]
lea edx, [esp + 4]
push ecx
push 0x10
push edx
lea eax, [esp + 0x30]
push 0x40b29c
lea ecx, [esp + 0x44]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x40b38b
lea edx, [esp + 0x44]
lea eax, [esp + 4]
push edx
push eax
call fcn.0040b0ed
test al, al
je 0x40b34c
xor eax, eax
mov word [esi], 2
cmp word [esi], ax
pop esi
setne al
add esp, 0x70
ret 4
lea ecx, [esp + 0x54]
lea edx, [esp + 4]
push ecx
push edx
call fcn.0040b0ed
test al, al
je 0x40b373
xor eax, eax
mov word [esi], 3
cmp word [esi], ax
pop esi
setne al
add esp, 0x70
ret 4
lea eax, [esp + 0x64]
lea ecx, [esp + 4]
push eax
push ecx
call fcn.0040b0ed
test al, al
je 0x40b38b
mov word [esi], 1
xor eax, eax
cmp word [esi], ax
pop esi
setne al
add esp, 0x70
ret 4
Function at 0x40c93c
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc0
push ebx
mov ebx, dword [esp + 0xc8]
test bl, 0x80
je 0x40caae
push esi
mov esi, dword [esp + 0xd0]
mov eax, esi
mov ecx, esi
and eax, 0xff00
xor edx, edx
shl ecx, 0x10
or eax, ecx
mov ecx, esi
and ecx, 0xff0000
push edi
shr esi, 0x10
or ecx, esi
mov esi, ebx
and esi, 0xf
shl eax, 8
shr ecx, 8
cmp esi, 3
ja case.default.0x40c98d
jmp dword [esi*4 + 0x40cbb0]
mov edi, 0x20
mov esi, eax
shr esi, 0xd
and esi, 1
mov ebx, esi
xor esi, ecx
shl ebx, 0x1f
shr edx, 1
shl esi, 0x1f
shr eax, 1
or edx, ebx
or esi, eax
shr ecx, 1
dec edi
mov eax, esi
jne 0x40c999
jmp case.default.0x40c98d
mov esi, 0x20
mov edi, eax
mov ebx, ecx
and edi, 0xffff0000
shl edi, 0xf
shr edx, 1
or edx, edi
mov edi, eax
and edi, 0xfffff000
shl ebx, 0xc
xor edi, ebx
mov ebx, eax
shl edi, 8
and ebx, 0xfff00000
xor edi, ebx
shl edi, 0xb
shr eax, 1
or eax, edi
shr ecx, 1
dec esi
jne 0x40c9c4
jmp case.default.0x40c98d
push ebp
mov edi, 0x20
mov esi, ecx
mov ebp, eax
and esi, 1
and ebp, 0xfff80000
mov ebx, esi
shl ebx, 0x13
xor ebx, ebp
shl ebx, 0xc
shr edx, 1
or edx, ebx
mov ebx, eax
and bl, 0
shl esi, 8
xor ebx, esi
mov esi, eax
shl ebx, 0xf
and esi, 0xff800000
xor ebx, esi
shl ebx, 8
shr eax, 1
or eax, ebx
shr ecx, 1
dec edi
jne 0x40ca06
pop ebp
jmp case.default.0x40c98d
mov esi, 0x20
mov edi, eax
mov ebx, ecx
and edi, 0xfffff800
shl ebx, 0xb
xor edi, ebx
mov ebx, eax
shl edi, 5
and ebx, 0xffff0000
xor edi, ebx
mov ebx, ecx
shl edi, 0xf
shr edx, 1
or edx, edi
mov edi, eax
and edi, 0xffffff80
shl ebx, 7
xor edi, ebx
mov ebx, eax
shl edi, 0x12
and ebx, 0xfe000000
xor edi, ebx
shl edi, 6
shr eax, 1
or eax, edi
shr ecx, 1
dec esi
jne 0x40ca4c
xor eax, eax
pop edi
mov al, dh
pop esi
mov ah, dl
and edx, 0xffff0000
or eax, edx
pop ebx
add esp, 0xc0
ret 8
lea edx, [esp + 4]
lea eax, [esp + 0x14]
push edx
push eax
mov byte [esp + 0xc], 0x29
mov byte [esp + 0xd], 0x56
mov byte [esp + 0xe], 0xb2
mov byte [esp + 0xf], 0x39
mov byte [esp + 0x10], 0xa0
mov byte [esp + 0x11], 0xce
mov byte [esp + 0x12], 0xeb
mov byte [esp + 0x13], 0x87
mov byte [esp + 0x14], 0x52
mov byte [esp + 0x15], 0xb4
mov byte [esp + 0x16], 0x76
mov byte [esp + 0x17], 0xfb
mov byte [esp + 0x18], 0xc
mov byte [esp + 0x19], 0x94
mov byte [esp + 0x1a], 0x37
mov byte [esp + 0x1b], 0x71
call fcn.00409230
and ebx, 0xff
mov eax, dword [esp + 0xcc]
mov byte [esp + 4], al
mov ecx, eax
mov edx, eax
shr eax, 0x18
mov byte [esp + 7], al
mov al, bl
mov ah, al
mov ebx, eax
shl ebx, 0x10
shr ecx, 8
shr edx, 0x10
mov bx, ax
mov byte [esp + 5], cl
mov byte [esp + 6], dl
mov dword [esp + 8], ebx
lea ecx, [esp + 4]
lea edx, [esp + 0x14]
mov dword [esp + 0xc], ebx
push ecx
push edx
mov dword [esp + 0x18], ebx
call fcn.00409320
lea eax, [esp + 4]
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.00409230
pop ebx
mov eax, dword [esp + 3]
mov edx, dword [esp + 2]
mov ecx, dword [esp + 1]
and eax, 0xff
shl eax, 8
and edx, 0xff
and ecx, 0xff
or eax, edx
mov edx, dword [esp]
shl eax, 8
or eax, ecx
and edx, 0xff
shl eax, 8
or eax, edx
add esp, 0xc0
ret 8
Function at 0x40e8c0
Capabilities:
Identify system language via api

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
push edi
push esi
sub esp, 8
mov edi, edx
mov esi, eax
cmp esi, 2
jne 0x40e8de
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x40e8ef
test esi, esi
jne 0x40e8ea
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
jmp 0x40e8ef
mov eax, 0x409
push edi
movzx ecx, ax
push ecx
call fcn.0040e920
add esp, 8
test eax, eax
je 0x40e906
add esp, 8
pop esi
pop edi
ret
cmp esi, 1
je 0x40e900
mov eax, 1
mov edx, edi
call 0x40e8c8
add esp, 8
pop esi
pop edi
ret

Function at 0x40e8c8
Capabilities:
Identify system language via api

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
push edi
push esi
sub esp, 8
mov edi, edx
mov esi, eax
cmp esi, 2
jne 0x40e8de
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x40e8ef
test esi, esi
jne 0x40e8ea
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
jmp 0x40e8ef
mov eax, 0x409
push edi
movzx ecx, ax
push ecx
call fcn.0040e920
add esp, 8
test eax, eax
je 0x40e906
add esp, 8
pop esi
pop edi
ret
cmp esi, 1
je 0x40e900
mov eax, 1
mov edx, edi
call 0x40e8c8
add esp, 8
pop esi
pop edi
ret