joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4eda78
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4edb82
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x50226c]
cmp byte [eax], 0
jne 0x4edb03
cmp dword [ebp - 4], 1
jne 0x4edade
lea eax, [ebp - 8]
mov edx, esi
call fcn.00404624
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov edx, edi
call fcn.00404624
mov edx, dword [ebp - 0xc]
mov eax, ebx
pop ecx
call fcn.0043b754
jmp 0x4edb5f
lea eax, [ebp - 0x10]
mov edx, esi
call fcn.00404624
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
mov edx, edi
call fcn.00404624
mov edx, dword [ebp - 0x14]
mov eax, ebx
pop ecx
call fcn.0043b780
jmp 0x4edb5f
mov eax, esi
call fcn.00404cfc
inc eax
add eax, eax
push eax
mov eax, esi
call fcn.00404cec
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, edi
call fcn.00404cec
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x4edb5f
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x18], 0xf
lea eax, [ebp - 0x1c]
push eax
push 0
lea edx, [ebp - 0x20]
mov eax, dword [0x5024c8]
call fcn.00406684
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x43b150]
call fcn.0040d9dc
call fcn.00403cec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4edb89
lea eax, [ebp - 0x20]
call fcn.00404370
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404394
ret
Function at 0x4f5da8
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4f5db1
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
lea eax, [ebp - 8]
call fcn.004050a4
xor eax, eax
push ebp
push 0x4f5f87
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 6
mov eax, dword [ebx + 0x424]
mov byte [eax + 0x14c], 1
mov edx, dword [ebx + 0x4f8]
mov dword [eax + 0x150], edx
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004f5380
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00404e14
jne 0x4f5e1d
mov esi, 2
jmp 0x4f5f5f
mov eax, dword [ebp - 0xc]
call fcn.00476fd4
test al, al
je 0x4f5e42
mov eax, 0x4f5f9c
call fcn.004a9610
cmp eax, 2
jne 0x4f5e42
mov esi, 2
jmp 0x4f5f5f
mov eax, dword [ebx + 0x424]
mov eax, dword [eax + 0x150]
mov dword [ebx + 0x4f8], eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00477188
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00476f18
mov eax, dword [ebp - 0x10]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00477188
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00476f18
mov edx, dword [ebp - 0x18]
pop eax
call fcn.00404e14
jne 0x4f5ee8
cmp dword [0x51d65c], 1
jg 0x4f5eb1
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0xc]
call fcn.00404624
mov eax, dword [ebp - 0x20]
call fcn.004aa5f4
test al, al
jne 0x4f5ee8
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404cec
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00404cec
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x4f5edf
mov eax, 0x4f5fc0
call fcn.004a959c
jmp 0x4f5f5f
mov byte [0x51d62d], 0
jmp 0x4f5f5f
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0xc]
call fcn.00404624
mov eax, dword [ebp - 0x24]
call fcn.004aa5f4
test al, al
je 0x4f5f55
cmp byte [ebx + 0x4ec], 0
je 0x4f5f42
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
call fcn.00404624
mov eax, dword [ebp - 0x28]
call fcn.004a9c78
cmp al, 3
jne 0x4f5f42
mov eax, dword [ebx + 0x428]
call fcn.00499b58
xor edx, edx
mov eax, ebx
call fcn.004f2a1c
xor edx, edx
mov eax, dword [ebx + 0x428]
call fcn.00499b60
push 1
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004f5bc8
jmp 0x4f5f5f
mov eax, 0x4f5fd0
call fcn.004a959c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f5f8e
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00404394
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00404ac0
ret
Function at 0x4f67cc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
push edx
push eax
mov eax, dword [0x502100]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x4f67fa
cmp eax, 0x14
jae 0x4f67fc
jmp 0x4f6872
jl 0x4f6872
xor eax, eax
push ebp
push 0x4f685e
push dword fs:[eax]
mov dword fs:[eax], esp
sub esi, 7
je 0x4f681a
dec esi
je 0x4f6829
dec esi
je 0x4f6838
dec esi
je 0x4f6847
jmp 0x4f6854
mov edx, dword [ebx + 0x398]
mov eax, ebx
call fcn.004f2bac
jmp 0x4f6854
mov edx, dword [ebx + 0x394]
mov eax, ebx
call fcn.004f2bac
jmp 0x4f6854
mov edx, dword [ebx + 0x388]
mov eax, ebx
call fcn.004f3b90
jmp 0x4f6854
mov edx, dword [ebx + 0x384]
mov eax, ebx
call fcn.004f3b90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f6868
call sub.kernel32.dll_GetTickCount_1
mov dword [0x502100], eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4f8ca0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x20c], ecx
mov dword [ebp - 4], edx
mov esi, eax
lea eax, [ebp - 4]
call fcn.004050a4
xor eax, eax
push ebp
push 0x4f8de5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x4f8df4
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
jbe 0x4f8d4d
push 0xff
lea eax, [ebp - 0x204]
push eax
push ebx
call sub.user32.dll_GetClassNameW
test eax, eax
jle 0x4f8d3f
mov eax, 0x4f8e04
lea edx, [ebp - 0x204]
mov dword [ebp - 0x208], edx
mov edx, dword [ebp - 0x208]
call fcn.00404e14
jne 0x4f8d3f
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.00476bc8
mov edx, dword [ebp - 0x20c]
mov eax, ebx
call fcn.004a91c8
test al, al
jne 0x4f8dad
push 2
push ebx
call sub.user32.dll_GetWindow
mov ebx, eax
test ebx, ebx
ja 0x4f8cec
push 1
push 0x4f8e18
push 0x4f8e20
push dword [ebp - 4]
push 0x4f8e20
lea eax, [ebp - 0x210]
mov edx, 3
call fcn.00404dcc
mov eax, dword [ebp - 0x210]
call fcn.00404cec
push eax
mov edx, dword [0x502680]
mov edx, dword [edx]
lea eax, [ebp - 0x214]
mov ecx, 0x4f8e28
call fcn.00404d68
mov eax, dword [ebp - 0x214]
call fcn.00404cec
push eax
push 0x4f8e18
push 0
call sub.shell32.dll_ShellExecuteW
mov eax, esi
call fcn.00456dc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f8dec
lea eax, [ebp - 0x214]
mov edx, 2
call fcn.00404ac0
lea eax, [ebp - 0x20c]
call fcn.00404370
lea eax, [ebp - 4]
call fcn.00404aa8
ret
Function at 0x4f8e98
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f8f9b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x428]
mov eax, dword [eax + 0x1b4]
call fcn.0042b208
test eax, eax
je 0x4f8f78
call fcn.004ab914
test al, al
je 0x4f8f78
lea eax, [ebp - 0xc]
call fcn.004a9080
push dword [ebp - 0xc]
push 0x4f8fac
lea ecx, [ebp - 0x10]
lea edx, [ebp - 8]
mov eax, dword [0x51d654]
call fcn.004abb14
push dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404dcc
cmp dword [ebp - 8], 0
jne 0x4f8f31
push 0
mov eax, dword [ebp - 4]
call fcn.00404cec
push eax
mov eax, dword [0x51d654]
call fcn.00404cec
push eax
call sub.kernel32.dll_CopyFileW
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x4f8f60
xor edx, edx
mov eax, ebx
call fcn.004f2a1c
push 0
push 5
push 0
push 0
mov eax, dword [ebx + 0x428]
mov eax, dword [eax + 0x1b4]
call fcn.0042ab64
mov ecx, 0x5c
mov edx, dword [ebp - 4]
call fcn.004aa9d8
test al, al
je 0x4f8f6e
mov eax, dword [ebp - 4]
call fcn.004aba74
jmp 0x4f8f78
mov eax, 0x4f8fbc
call fcn.004a959c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f8fa2
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404ac0
lea eax, [ebp - 4]
call fcn.00404aa8
ret
Function at 0x102da738
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
cwde
mov eax, dword [esp + 0x44]
jmp 0x10496483
jne 0x10356493
btc di, 9
cmc
shl di, 5
stc
cmp byte [edi - 1], 0
jmp 0x102e5fc4
push dword [esp]
lea esp, [esp + 0x4c]
ja 0x102e0afa
pushfd
pushfd
lea esp, [esp + 8]
jb 0x102e5e5b
jmp 0x1048d3ae

Function at 0x102daf95
Capabilities:
Encode data using xor

Disassembly:
xchg dword [ebp - 0x28], edx
pushal
pushfd
push 0xcd7fe1b0
lea esp, [esp + 0x2c]
jae 0x1048aeaa
push 0x4bda0967
pop eax
push 0xae802ae5
xchg dword [ebp - 0x14], edx
movzx ax, al
mov dword [ebp - 0x20], edx
not dh
movsx ax, bl
mov edx, dword [esp + 4]
mov ax, word [esp + 4]
not ax
movzx ax, cl
lea eax, [ebx + 0x50d0]
jmp 0x1048ce6e
pushfd
lea esp, [esp + 0xc]
call fcn.1048f8ed
pushal
bt edx, 0xe
pushfd
clc
cmp ecx, 7
pushfd
sbb ecx, ecx
clc
bt di, 6
clc
cmc
lea ecx, [ecx + ecx*2 + 0xb]
mov dword [esp], edi
call fcn.1048b1ba
inc edi
pop es
sbb eax, 0x732a319c
scasb al, byte es:[edi]
xchg ecx, eax
lodsd eax, dword [esi]
sub ebp, 0x1139bd79
xor eax, 0x45392d11
cmc
movsd dword es:[edi], dword [esi]
invalid

Function at 0x102e454b
Capabilities:
Encode data using xor

Disassembly:
add byte [eax + 0x28], ah
sar cl, 0xf2
scasb al, byte es:[edi]
call fcn.102da93d
stc
jno 0x102e453e
scasb al, byte es:[edi]
mov edx, 0xad31734c
xchg ebp, eax
mov ecx, 0xc5d1a1a5
jno 0x102e44e6
mov eax, dword [0x8571c5d1]
leave
test ebp, eax
and ebp, 0xce88a999
add al, 0x3e
cmp byte [edx], al
and al, 0x36
xor byte [esi], cl
xchg edi, eax
xchg ebx, eax
in eax, dx
and al, 0xb9
fbstp tbyte [esp + edi*2 - 0xe]
je 0x102e455c
mov eax, 0xae419d9a
sahf
iretd

Function at 0x10492725
Capabilities:
Encode data using xor

Disassembly:
and al, 0x16
cmpsb byte [esi], byte es:[edi]
sbb al, 0x2a
dec edx
xlatb
mov byte [0xaa68b08a], al
xchg ebx, eax
sbb byte [esi], ch
mov word [edi - 0x35], gs
dec ebp
push eax
ljmp 0x4fc
sar dword [edx], 0xc3
jg 0x1049277a
mov ecx, 0x5e8b7532
xor dh, byte [ebp - 0x75]
pop esi
in al, 0xa0
jbe 0x104926cd
xchg edx, eax
enter 0x1d15, 0xffffffffffffffb0
jb 0x10492716
call fcn.10496463
fcomp dword [esi + 0x71]
and al, bl
sub esi, dword [ebx + 0x32]
sbb dh, byte [edx + 0x6a3d2549]
mov ah, 0x7a
sal byte [ecx - 0x2b], 1
imul edx, ecx, 0xd5d0155
jns 0x1049270f
push 0x2c6ae8f2
inc esi
mov dl, 0xf9
lds ebx, [eax]
aad 0x51
hlt
jl 0x10492746
dec eax
int1
ret
Function at 0x4028b0
Capabilities:
Connect socket
Get socket status
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x128
push ebx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push edi
cmp dword [esi + 0xc], ebp
je 0x4028c8
call fcn.00402fd0
mov edi, dword [esp + 0x13c]
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x402a03
push edi
mov word [esp + 0x28], 2
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x140]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov ebx, 1
push ebp
push ebx
push 2
mov word [esp + 0x32], ax
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, ebp
mov dword [esi + 8], eax
ja 0x402931
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x128
ret 0xc
mov edi, dword [sym.imp.WS2_32.dll_ioctlsocket]
lea ecx, [esp + 0x10]
push ecx
push 0x8004667e
push eax
mov dword [esp + 0x1c], ebx
call edi
cmp eax, 0xffffffff
je 0x4029ed
mov ecx, dword [esi + 8]
lea eax, [esp + 0x24]
push 0x10
push eax
push ecx
mov dword [esp + 0x20], 0xffffffff
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4029d3
mov edx, dword [esp + 0x144]
mov eax, dword [esi + 8]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], edx
push ecx
lea edx, [esp + 0x38]
push ebp
push edx
push ebp
push eax
mov dword [esp + 0x34], ebp
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x4029cf
mov edx, dword [esi + 8]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0x1007
push 0xffff
push edx
mov dword [esp + 0x2c], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp dword [esp + 0x14], ebp
sete bl
jmp 0x4029d5
xor bl, bl
jmp 0x4029d5
mov bl, 1
mov ecx, dword [esi + 8]
lea eax, [esp + 0x10]
push eax
push 0x8004667e
push ecx
mov dword [esp + 0x1c], ebp
call edi
test bl, bl
jne 0x402a12
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [esi + 8]
mov dword [esi + 4], eax
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 8], ebp
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x128
ret 0xc
mov eax, 1
pop edi
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], eax
pop esi
pop ebp
mov al, al
pop ebx
add esp, 0x128
ret 0xc

Function at 0x402f00
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push esi
push edi
mov esi, ecx
xor edi, edi
push eax
push 0x202
mov dword [esi], 0x404644
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], 0xffffffff
mov dword [esi + 0x28], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x20], edi
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x402f57
mov dword [esi + 4], edi
mov dword [esi + 0x24], 1
mov eax, esi
pop edi
pop esi
add esp, 0x190
ret
mov dword [esi + 0x24], edi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov eax, esi
pop edi
pop esi
add esp, 0x190
ret
Function at 0x403050
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ecx
push ebx
push ebp
mov ebp, ecx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
je 0x40312c
mov ecx, dword [ebp + 8]
cmp ecx, ebx
je 0x40312c
mov eax, dword [esp + 0x18]
push esi
push edi
lea edx, [esp + 0x10]
lea eax, [eax + eax*4]
push 4
push edx
push 0x1006
lea eax, [eax + eax*4]
push 0xffff
push ecx
lea eax, [eax + eax*4]
shl eax, 3
mov dword [esp + 0x24], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp dword [esp + 0x24], ebx
je 0x4030ce
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [ebp + 8]
push ebx
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4030c4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp + 4], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ecx, dword [ebp + 8]
push 0
push edi
push eax
push ecx
mov dword [esp + 0x30], ebx
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
je 0x4030c4
cmp esi, 0xffffffff
je 0x4030bb
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
add eax, esi
cmp eax, ecx
mov dword [esp + 0x20], eax
jge 0x4030c4
mov edx, dword [esp + 0x18]
mov ecx, dword [ebp + 8]
add ebx, esi
sub edi, esi
push 0
push edi
lea eax, [ebx + edx]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
jne 0x4030ee
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
or eax, 0xffffffff
mov dword [ebp + 4], eax
pop ebp
pop ebx
pop ecx
ret 0x10

Function at 0x403140
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x40317c
mov eax, dword [esi + 8]
test eax, eax
je 0x40317c
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push edi
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
cmp edi, 0xffffffff
jne 0x403175
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov eax, edi
pop edi
pop esi
ret 0xc
or eax, 0xffffffff
mov dword [esi + 4], eax
pop esi
ret 0xc

Function at 0x4031e0
Capabilities:
Get file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x403a18
push eax
mov dword fs:[0], esp
push esi
lea esi, [ecx + 4]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov dword [esp + 0x10], 0
call sub.MFC42.DLL_CString::operator
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
or ecx, 0xffffffff
cmp eax, ecx
jne 0x40323e
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0x14]
call fcn.004033e0
xor eax, eax
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4
test al, 0x10
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0x14]
je 0x403263
call fcn.004033e0
xor eax, eax
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4
call fcn.004033e0
mov ecx, dword [esp + 4]
mov eax, 1
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4
Function at 0x403280
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x403a38
push eax
mov dword fs:[0], esp
push esi
mov ecx, dword [ecx + 4]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push edx
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.004033e0
lea ecx, [esp + 0x18]
mov dword [esp + 0xc], 0xffffffff
call fcn.004033e0
mov ecx, dword [esp + 4]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 0xc

Function at 0x476fbc
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x476fcf
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x476fcb
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x476ffc
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x47703b
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x477031
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x47703d
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x477021
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x49afbc
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x49afcf
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x49afcb
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x49affc
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x49b03b
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x49b031
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x49b03d
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x49b021
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4062d0
Capabilities:
Check for software breakpoints

Disassembly:
xor eax, eax
mov byte [0x5e9895], 0
mov al, byte [0x5e9896]
mov ax, word [eax*4 + 0x5e9898]
cmp ax, 0x64
jae 0x4062a3
cmp ax, 0x5a
jbe 0x4061fd
call dword [0x485210]
and eax, 0x800003ff
jns 0x4061ea
dec eax
or eax, 0xfffffc00
inc eax
cmp eax, 0xcc
jge 0x4062a3
mov byte [0x5e9895], 1
ret
cmp ax, 0x50
jbe 0x40622a
call dword [0x485210]
and eax, 0x800003ff
jns 0x406217
dec eax
or eax, 0xfffffc00
inc eax
cmp eax, 0x199
jge 0x4062a3
mov byte [0x5e9895], 1
ret
cmp ax, 0x46
jbe 0x406253
call dword [0x485210]
and eax, 0x800003ff
jns 0x406244
dec eax
or eax, 0xfffffc00
inc eax
cmp eax, 0x266
jge 0x4062a3
mov byte [0x5e9895], 1
ret
cmp ax, 0x3c
jbe 0x40627c
call dword [0x485210]
and eax, 0x800003ff
jns 0x40626d
dec eax
or eax, 0xfffffc00
inc eax
cmp eax, 0x333
jge 0x4062a3
mov byte [0x5e9895], 1
ret
test ax, ax
jbe 0x4062a3
call dword [0x485210]
and eax, 0x800003ff
jns 0x406295
dec eax
or eax, 0xfffffc00
inc eax
cmp eax, 0x39a
jge 0x4062a3
mov byte [0x5e9895], 1
ret
push ebx
push ebp
push esi
push edi
mov ecx, 0x5e9898
mov esi, 0x65343c
mov edi, dword [0x652130]
mov ebx, dword [esi]
mov eax, dword [edi + 0x34]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 2
sub eax, ebx
test eax, eax
mov dword [ecx], eax
jg 0x406302
mov dword [ecx], 0x64
jmp 0x406311
cdq
idiv dword [edi + 0x34]
mov edx, 0x32
sub edx, eax
shl edx, 1
mov dword [ecx], edx
cmp dword [ecx], 0
jge 0x40631c
mov dword [ecx], 0
add esi, 0x7d0
add ecx, 4
cmp esi, 0x65537c
jl 0x4062de
mov edi, dword [0x5e9898]
mov ebp, dword [0x485210]
mov ebx, 1
mov byte [0x5e9896], 0
mov esi, 0x5e989c
mov eax, dword [esi]
cmp edi, eax
jl 0x406371
jne 0x406369
call ebp
and eax, 0x800003ff
jns 0x406362
dec eax
or eax, 0xfffffc00
inc eax
cmp eax, 0x200
jg 0x406371
mov edi, dword [esi]
mov byte [0x5e9896], bl
add esi, 4
inc ebx
cmp esi, 0x5e98a8
jl 0x40634a
mov eax, dword [0x652130]
pop edi
pop esi
pop ebp
mov ecx, dword [eax + 0x3c]
pop ebx
cmp ecx, 3
jge 0x406395
mov byte [0x5e9896], 0
jmp 0x4061b0
Function at 0x407790
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x2c
push esi
push edi
call fcn.00401950
push 0
push 0x3ff00000
push 0
push 0
mov edi, eax
mov eax, dword [0x6349a8]
push 0x3e8
push 0
push 0xd
push eax
push 0x145
push 0xffffff47
push edi
mov dword [esp + 0x34], edi
call fcn.00401b10
add esp, 0x2c
mov esi, 0x14
push 0
push 0x1e
push edi
call fcn.004026c0
add esp, 0xc
call fcn.004454f0
dec esi
jne 0x4077d2
mov ecx, dword [0x66c0a8]
mov edx, dword [0x66c0d0]
push ebx
push ebp
push 0
push 0x407970
push ecx
push 0x85
push edx
call dword [0x48531c]
mov ecx, dword [0x66c0a8]
mov ebx, eax
lea eax, [esp + 0x2c]
push eax
push ecx
call dword [0x485314]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], edx
mov edx, dword [0x66c0a8]
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], eax
push ecx
push edx
call dword [0x485324]
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [0x485320]
mov ecx, dword [esp + 0x28]
mov edi, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov esi, 1
sub ecx, edi
push esi
sub edx, eax
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x1c]
add eax, 0xec
push edx
add ecx, 0x17c
push eax
push ecx
push ebx
call dword [0x485328]
push 0x3e8
push ebx
call dword [0x485330]
push eax
call dword [0x485334]
push 5
push ebx
call dword [0x485344]
call fcn.004454f0
push esi
call fcn.004234d0
add esp, 4
test eax, eax
jne 0x4078ba
call fcn.00423520
test eax, eax
je 0x4078c0
mov dword [0x5e9cc0], esi
cmp dword [0x66c0e0], esi
je 0x4078da
mov eax, dword [0x5e9cc0]
test eax, eax
jne 0x4078da
mov eax, dword [0x5e98b0]
test eax, eax
je 0x40789f
mov ebp, dword [esp + 0x40]
push 0x14
push ebp
push 0x3e8
push ebx
call dword [0x485340]
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x40791b
mov edi, str._IGS_
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebx
call dword [0x485348]
pop ebp
mov esi, 0x14
pop ebx
mov eax, dword [esp + 8]
push 0
push 0x1e
push eax
call fcn.004026c0
add esp, 0xc
call fcn.004454f0
dec esi
jne 0x407929
mov ecx, dword [esp + 8]
push ecx
call fcn.00401a90
mov ecx, dword [0x5e9cc0]
add esp, 4
xor eax, eax
test ecx, ecx
pop edi
pop esi
setne al
add esp, 0x2c
ret