joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4861f7
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x80c], ecx
cmp dword [ebp + 8], 0
jne 0x48621c
cmp dword [ebp + 0xc], 0
je 0x486281
push 0x800
push 0
lea eax, [ebp - 0x804]
push eax
call fcn.004b0090
add esp, 0xc
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x400
lea eax, [ebp - 0x804]
push eax
mov ecx, dword [ebp - 0x80c]
call fcn.0048628f
mov dword [ebp - 0x808], eax
cmp dword [ebp + 8], 0
je 0x48626a
push dword [ebp - 0x808]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp + 0xc], 0
je 0x486281
push dword [ebp - 0x808]
mov ecx, dword [ebp - 0x80c]
call fcn.0048601c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 0x14

Function at 0x4866aa
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x40], ecx
and dword [ebp - 0x3c], 0
mov esi, str.TENINSTIP
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x30]
rep stosd dword es:[edi], eax
and dword [ebp - 0x38], 0
and dword [ebp - 0x34], 0
push dword [ebp + 8]
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push str.Global_s__X__d
push 0x1f
lea eax, [ebp - 0x30]
push eax
call fcn.00486c20
add esp, 0x18
lea eax, [ebp - 0x30]
push eax
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x486747
push 0
push 0
push 0
push 4
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x486747
push dword [ebp + 0x10]
push dword [ebp - 0x34]
push dword [ebp + 0xc]
call fcn.004af590
add esp, 0xc
mov dword [ebp - 0x3c], 1
cmp dword [ebp - 0x34], 0
je 0x486756
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 0x38], 0
je 0x486765
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x3c]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 0xc
Function at 0x48bf15
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x218], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004b0090
add esp, 0xc
mov ecx, dword [ebp + 8]
call fcn.0040a5f1
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.004cc3b7
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call fcn.004cc4f3
pop ecx
lea eax, [eax + eax + 2]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0x208
jae 0x48bf87
jmp 0x48bf8c
call fcn.004adf6c
xor eax, eax
mov ecx, dword [ebp - 0x210]
mov word [ebp + ecx - 0x20c], ax
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x238]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x234], 3
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x230], eax
mov eax, 0x614
mov word [ebp - 0x228], ax
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
jne 0x48bfea
mov dword [ebp - 0x214], 1
jmp 0x48bff1
and dword [ebp - 0x214], 0
mov al, byte [ebp - 0x214]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 4

Function at 0x48d1fd
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa18
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xa10], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004b0090
add esp, 0xc
push 0x800
push 0
lea eax, [ebp - 0xa0c]
push eax
call fcn.004b0090
add esp, 0xc
push dword [ebp + 8]
push 0x400
lea eax, [ebp - 0xa0c]
push eax
push 0
push 0x52eef8
push 0x52ef00
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x104
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa0c]
push eax
mov ecx, dword [ebp - 0xa10]
call fcn.0048d917
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0xa10]
call fcn.0048d334
test eax, eax
jne 0x48d30b
and dword [ebp - 0xa18], 0
cmp dword [ebp + 0xc], 0
je 0x48d309
cmp dword [ebp + 0x10], 0
jle 0x48d309
lea eax, [ebp - 0x20c]
test eax, eax
je 0x48d309
and dword [ebp - 0xa14], 0
lea eax, [ebp - 0x20c]
test eax, eax
je 0x48d2e1
lea eax, [ebp - 0x20c]
push eax
call fcn.004cc4f3
pop ecx
cmp eax, dword [ebp + 0x10]
jae 0x48d2e1
mov dword [ebp - 0xa14], 1
cmp dword [ebp - 0xa14], 0
je 0x48d309
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004cc3b7
add esp, 0xc
mov dword [ebp - 0xa18], 1
jmp 0x48d326
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0xa10]
call fcn.0048d753
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 0xc
Function at 0x48d525
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x800
push 0
lea eax, [ebp - 0x804]
push eax
call fcn.004b0090
add esp, 0xc
and dword [ebp - 0x808], 0
lea eax, [ebp + 0x10]
mov dword [ebp - 0x808], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x810], eax
push dword [ebp - 0x808]
push 0
push dword [ebp - 0x810]
push 0x3ff
push 0x400
lea eax, [ebp - 0x804]
push eax
call fcn.00407770
push dword [eax + 4]
push dword [eax]
call fcn.004cc171
add esp, 0x20
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
jge 0x48d5b0
or dword [ebp - 0x814], 0xffffffff
jmp 0x48d5bc
mov eax, dword [ebp - 0x80c]
mov dword [ebp - 0x814], eax
and dword [ebp - 0x808], 0
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret

Function at 0x48d5dc
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004b0090
add esp, 0xc
push dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x52ef08
push str.Redirect
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x218], 1
cmp dword [ebp - 0x210], 0
je 0x48d68d
mov eax, dword [ebp - 0x210]
movzx eax, word [eax]
test eax, eax
je 0x48d68d
mov eax, dword [ebp - 0x210]
movzx eax, word [eax]
cmp eax, 0x20
je 0x48d67d
mov eax, dword [ebp - 0x210]
movzx eax, word [eax]
cmp eax, 9
je 0x48d67d
and dword [ebp - 0x218], 0
jmp 0x48d68d
mov eax, dword [ebp - 0x210]
inc eax
inc eax
mov dword [ebp - 0x210], eax
jmp 0x48d64b
cmp dword [ebp - 0x218], 0
jne 0x48d6e3
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x214]
call fcn.0048d334
test eax, eax
je 0x48d6c9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0x214]
call fcn.0048cceb
jmp 0x48d6e1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x214]
call fcn.0048d5dc
jmp 0x48d745
and dword [ebp - 0x220], 0
cmp dword [ebp + 0xc], 0
je 0x48d745
cmp dword [ebp + 0x10], 0
jle 0x48d745
cmp dword [ebp + 8], 0
je 0x48d745
and dword [ebp - 0x21c], 0
cmp dword [ebp + 8], 0
je 0x48d721
push dword [ebp + 8]
call fcn.004cc4f3
pop ecx
cmp eax, dword [ebp + 0x10]
jae 0x48d721
mov dword [ebp - 0x21c], 1
cmp dword [ebp - 0x21c], 0
je 0x48d745
push dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004cc3b7
add esp, 0xc
mov dword [ebp - 0x220], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 0xc
Function at 0x48d753
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc34
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0xc2c], ecx
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x800
push 0
lea eax, [ebp - 0xc28]
push eax
call fcn.004b0090
add esp, 0xc
push dword [ebp + 8]
push 0x400
lea eax, [ebp - 0xc28]
push eax
push 0x52ef28
push 0x52ef2c
push 0x52ef00
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xa
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc28]
push eax
mov ecx, dword [ebp - 0xc2c]
call fcn.0048d917
push 2
pop eax
imul eax, eax, 0
movzx eax, word [ebp + eax - 0x18]
cmp eax, 0x31
jne 0x48d7f5
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov ecx, dword [ebp - 0xc2c]
call fcn.0048cceb
jmp 0x48d908
push 0x208
push 0
lea eax, [ebp - 0x428]
push eax
call fcn.004b0090
add esp, 0xc
push dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x428]
push eax
push 0
push 0x52ef58
push str.DefaultValue
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x208
push 0
lea eax, [ebp - 0x220]
push eax
call fcn.004b0090
add esp, 0xc
push 0x104
lea eax, [ebp - 0x220]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x428]
push eax
mov ecx, dword [ebp - 0xc2c]
call fcn.0048ce44
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp - 0xc2c]
call fcn.0048d334
test eax, eax
je 0x48d896
push dword [ebp + 0x14]
push dword [ebp + 0x10]
lea eax, [ebp - 0x220]
push eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0xc2c]
call fcn.0048cceb
jmp 0x48d908
and dword [ebp - 0xc34], 0
cmp dword [ebp + 0x10], 0
je 0x48d908
cmp dword [ebp + 0x14], 0
jle 0x48d908
lea eax, [ebp - 0x220]
test eax, eax
je 0x48d908
and dword [ebp - 0xc30], 0
lea eax, [ebp - 0x220]
test eax, eax
je 0x48d8e0
lea eax, [ebp - 0x220]
push eax
call fcn.004cc4f3
pop ecx
cmp eax, dword [ebp + 0x14]
jae 0x48d8e0
mov dword [ebp - 0xc30], 1
cmp dword [ebp - 0xc30], 0
je 0x48d908
lea eax, [ebp - 0x220]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004cc3b7
add esp, 0xc
mov dword [ebp - 0xc34], 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 0x10
Function at 0x48e766
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x220], ecx
and dword [ebp - 0x214], 0
and dword [ebp - 0x20c], 0
and dword [ebp - 0x210], 0
and dword [ebp - 0x208], 0
push 0x200
push 0
lea eax, [ebp - 0x204]
push eax
call fcn.004b0090
add esp, 0xc
cmp dword [ebp + 8], 0
je 0x48e7d0
push dword [ebp + 8]
push 0x100
lea eax, [ebp - 0x204]
push eax
call fcn.004cc3b7
add esp, 0xc
jmp 0x48e7ef
push dword [ebp - 0x220]
push 0x541cb4
push 0x100
lea eax, [ebp - 0x204]
push eax
call fcn.004077b0
add esp, 0x10
push 0
push 0
push 0
push 0
push accept
push accept
push accept
push accept
push 0
lea eax, [ebp - 0x204]
push eax
push 0x541cd8
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x48e8de
mov byte [ebp - 0x215], 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x48e918
push 0xfffffffffffffffc
push dword [ebp - 0x21c]
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, dword [ebp - 0x220]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 0x220]
cmp dword [eax + 0xc], 0
jne 0x48e875
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x48e8c0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp - 0x220]
push 0xffffffffffffffeb
push dword [ebp - 0x21c]
call dword [sym.imp.USER32.dll_SetWindowLongW]
test eax, eax
jne 0x48e89f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x48e8c0
push 0
push dword [ebp - 0x21c]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp - 0x21c]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov byte [ebp - 0x215], 1
movzx eax, byte [ebp - 0x215]
test eax, eax
jne 0x48e8de
push dword [ebp - 0x21c]
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 4
Function at 0x48e95c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.0040b598
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x48e988
mov dword [ebp - 8], 1
jmp 0x48e98c
and dword [ebp - 8], 0
movzx eax, byte [ebp - 8]
test eax, eax
je 0x48e99b
xor al, al
jmp 0x48ea64
mov ecx, dword [ebp - 4]
call fcn.0040a5f1
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x18], 0
jne 0x48e9d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._CrashReportLoader__Load_library_failed_lu
call fcn.0048f8e0
pop ecx
pop ecx
xor al, al
jmp 0x48ea64
push str.InitCrashReportHelper
mov eax, dword [ebp - 4]
push dword [eax + 0x18]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x1c], eax
push str.UninitCrashReportHelper
mov eax, dword [ebp - 4]
push dword [eax + 0x18]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x20], eax
push str.SetCrashReportHelperOffline
mov eax, dword [ebp - 4]
push dword [eax + 0x18]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x24], eax
push str.SetCrashReportHelperCallback
mov eax, dword [ebp - 4]
push dword [eax + 0x18]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x28], eax
push str.AddCrashReportHelperFile
mov eax, dword [ebp - 4]
push dword [eax + 0x18]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2c], eax
push str.UpdateCrashReportHelperUserId
mov eax, dword [ebp - 4]
push dword [eax + 0x18]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x30], eax
mov al, 1
leave
ret 4
Function at 0x48f699
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52a7a8
mov eax, dword fs:[0]
push eax
sub esp, 0x150
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x15c], ecx
mov dword [ebp - 0x148], 0x34
and dword [ebp - 0x118], 0
mov byte [ebp - 0x111], 0
mov ecx, dword [ebp + 8]
call fcn.0040a5f1
mov dword [ebp - 0x13c], eax
push 0
push dword [ebp - 0x13c]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
je 0x48f8c1
lea eax, [ebp - 0x11d]
push eax
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x158]
call fcn.00490331
and dword [ebp - 4], 0
lea eax, [ebp - 0x158]
mov dword [ebp - 0x140], eax
push dword [ebp - 0x140]
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x158]
call fcn.0048fd8a
xor eax, eax
shl eax, 0
add eax, dword [ebp - 0x158]
mov dword [ebp - 0x134], eax
mov ecx, dword [ebp + 8]
call fcn.0040a5f1
mov dword [ebp - 0x144], eax
push dword [ebp - 0x134]
push dword [ebp - 0x11c]
push 0
push dword [ebp - 0x144]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x48f8b2
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x118]
push eax
push 0x541ef0
push dword [ebp - 0x134]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x48f8b2
mov eax, dword [ebp - 0x118]
mov eax, dword [eax + 8]
shr eax, 0x10
and eax, 0xffff
mov word [ebp - 0x130], ax
mov eax, dword [ebp - 0x118]
mov eax, dword [eax + 8]
and eax, 0xffff
mov word [ebp - 0x12c], ax
mov eax, dword [ebp - 0x118]
mov eax, dword [eax + 0xc]
shr eax, 0x10
and eax, 0xffff
mov word [ebp - 0x128], ax
mov eax, dword [ebp - 0x118]
mov eax, dword [eax + 0xc]
and eax, 0xffff
mov word [ebp - 0x124], ax
cmp dword [ebp + 0xc], 0
je 0x48f8ab
movzx eax, word [ebp - 0x124]
push eax
movzx eax, word [ebp - 0x128]
push eax
movzx eax, word [ebp - 0x12c]
push eax
movzx eax, word [ebp - 0x130]
push eax
push 0x541ef4
push 0xffffffffffffffff
push 0x80
lea eax, [ebp - 0x110]
push eax
call fcn.0040a851
add esp, 0x20
push 2
pop eax
imul eax, eax, 0x7f
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0x100
jae 0x48f86e
jmp 0x48f873
call fcn.004adf6c
xor eax, eax
mov ecx, dword [ebp - 0x138]
mov word [ebp + ecx - 0x110], ax
lea eax, [ebp - 0x110]
push eax
call fcn.004cc4f3
pop ecx
mov dword [ebp - 0x14c], eax
push dword [ebp - 0x14c]
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0040a770
mov byte [ebp - 0x111], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x158]
call fcn.004436bd
mov al, byte [ebp - 0x111]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ad99f
leave
ret 8
Function at 0x48f8e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
and dword [ebp - 0x618], 0
lea eax, [ebp + 0xc]
mov dword [ebp - 0x618], eax
push 0x200
push 0
lea eax, [ebp - 0x204]
push eax
call fcn.004b0090
add esp, 0xc
push 0x400
push 0
lea eax, [ebp - 0x604]
push eax
call fcn.004b0090
add esp, 0xc
xor eax, eax
lea edi, [ebp - 0x614]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x614]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
movzx eax, word [ebp - 0x606]
push eax
movzx eax, word [ebp - 0x608]
push eax
movzx eax, word [ebp - 0x60a]
push eax
movzx eax, word [ebp - 0x60c]
push eax
movzx eax, word [ebp - 0x60e]
push eax
movzx eax, word [ebp - 0x612]
push eax
push str.__d__d__d:_d:_d:_d__T_lu___s_n
push 0xffffffffffffffff
push 0x200
lea eax, [ebp - 0x204]
push eax
call fcn.0044d37c
add esp, 0x30
push dword [ebp - 0x618]
push 0
lea eax, [ebp - 0x204]
push eax
push 0xffffffffffffffff
push 0x400
lea eax, [ebp - 0x604]
push eax
call fcn.00407770
push dword [eax + 4]
push dword [eax]
call fcn.004cc14a
add esp, 0x20
mov dword [ebp - 0x61c], eax
cmp dword [ebp - 0x61c], 0
jge 0x48f9e5
or dword [ebp - 0x620], 0xffffffff
jmp 0x48f9f1
mov eax, dword [ebp - 0x61c]
mov dword [ebp - 0x620], eax
and dword [ebp - 0x618], 0
lea eax, [ebp - 0x604]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret

Function at 0x492a80
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa18
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xa10], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004b0090
add esp, 0xc
push 0x800
push 0
lea eax, [ebp - 0xa0c]
push eax
call fcn.004b0090
add esp, 0xc
push dword [ebp + 8]
push 0x400
lea eax, [ebp - 0xa0c]
push eax
push 0
push 0x52eef8
push 0x52ef00
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x104
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa0c]
push eax
mov ecx, dword [ebp - 0xa10]
call fcn.0049311a
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0xa10]
call fcn.00492bb7
test eax, eax
jne 0x492b8e
and dword [ebp - 0xa18], 0
cmp dword [ebp + 0xc], 0
je 0x492b8c
cmp dword [ebp + 0x10], 0
jle 0x492b8c
lea eax, [ebp - 0x20c]
test eax, eax
je 0x492b8c
and dword [ebp - 0xa14], 0
lea eax, [ebp - 0x20c]
test eax, eax
je 0x492b64
lea eax, [ebp - 0x20c]
push eax
call fcn.004cc4f3
pop ecx
cmp eax, dword [ebp + 0x10]
jae 0x492b64
mov dword [ebp - 0xa14], 1
cmp dword [ebp - 0xa14], 0
je 0x492b8c
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004cc3b7
add esp, 0xc
mov dword [ebp - 0xa18], 1
jmp 0x492ba9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0xa10]
call fcn.00492f56
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 0xc
Function at 0x492d28
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x800
push 0
lea eax, [ebp - 0x804]
push eax
call fcn.004b0090
add esp, 0xc
and dword [ebp - 0x808], 0
lea eax, [ebp + 0x10]
mov dword [ebp - 0x808], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x810], eax
push dword [ebp - 0x808]
push 0
push dword [ebp - 0x810]
push 0x3ff
push 0x400
lea eax, [ebp - 0x804]
push eax
call fcn.00407770
push dword [eax + 4]
push dword [eax]
call fcn.004cc171
add esp, 0x20
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
jge 0x492db3
or dword [ebp - 0x814], 0xffffffff
jmp 0x492dbf
mov eax, dword [ebp - 0x80c]
mov dword [ebp - 0x814], eax
and dword [ebp - 0x808], 0
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret

Function at 0x492ddf
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004b0090
add esp, 0xc
push dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x52ef08
push str.Redirect
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x218], 1
cmp dword [ebp - 0x210], 0
je 0x492e90
mov eax, dword [ebp - 0x210]
movzx eax, word [eax]
test eax, eax
je 0x492e90
mov eax, dword [ebp - 0x210]
movzx eax, word [eax]
cmp eax, 0x20
je 0x492e80
mov eax, dword [ebp - 0x210]
movzx eax, word [eax]
cmp eax, 9
je 0x492e80
and dword [ebp - 0x218], 0
jmp 0x492e90
mov eax, dword [ebp - 0x210]
inc eax
inc eax
mov dword [ebp - 0x210], eax
jmp 0x492e4e
cmp dword [ebp - 0x218], 0
jne 0x492ee6
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x214]
call fcn.00492bb7
test eax, eax
je 0x492ecc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0x214]
call fcn.00492579
jmp 0x492ee4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x214]
call fcn.00492ddf
jmp 0x492f48
and dword [ebp - 0x220], 0
cmp dword [ebp + 0xc], 0
je 0x492f48
cmp dword [ebp + 0x10], 0
jle 0x492f48
cmp dword [ebp + 8], 0
je 0x492f48
and dword [ebp - 0x21c], 0
cmp dword [ebp + 8], 0
je 0x492f24
push dword [ebp + 8]
call fcn.004cc4f3
pop ecx
cmp eax, dword [ebp + 0x10]
jae 0x492f24
mov dword [ebp - 0x21c], 1
cmp dword [ebp - 0x21c], 0
je 0x492f48
push dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004cc3b7
add esp, 0xc
mov dword [ebp - 0x220], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 0xc