joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40dbf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 0x10]
lea ebx, [edi + 0x41c]
test ecx, ecx
je 0x40dc84
mov esi, dword [ecx]
push 0
push 1
push ebx
mov esi, dword [esi + 0x64]
push 0
push ecx
mov ecx, esi
call dword [0x55f634]
call esi
mov ecx, dword [edi + 0x10]
mov dword [edi], eax
mov eax, dword [edi + 0x470]
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 0x428]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x424]
mov dword [ebp - 0x10], eax
test ecx, ecx
je 0x40dc9f
mov eax, dword [ecx]
push dword [edi + 0x440]
push ecx
mov esi, dword [eax + 0x80]
mov ecx, esi
call dword [0x55f634]
call esi
mov ecx, dword [edi + 0x10]
mov dword [edi], eax
test ecx, ecx
je 0x40dc9f
mov esi, dword [ecx]
push 0
push 1
push ebx
mov esi, dword [esi + 0x64]
push 0
push ecx
mov ecx, esi
call dword [0x55f634]
call esi
mov ecx, dword [edi + 0x10]
mov dword [edi], eax
jmp 0x40dc9f
mov eax, dword [edi + 0x470]
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 0x428]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x424]
mov dword [ebp - 0x10], eax
cmp dword [edi], 0
jne 0x40dcac
mov eax, dword [edi + 0x440]
jmp 0x40dcaf
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x40dcd1
mov eax, dword [ecx]
push dword [edi + 0x440]
push ecx
mov esi, dword [eax + 0x80]
mov ecx, esi
call dword [0x55f634]
call esi
mov dword [edi], eax
mov esi, dword [ebp - 8]
imul esi, dword [ebp - 0x14]
mov eax, dword [edi + 0x42c]
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
push dword [ebp + 0xc]
shr esi, 3
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edx, eax
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x14], edx
test eax, eax
je 0x40dd2d
mov esi, dword [eax]
push 0
push 1
push ebx
mov esi, dword [esi + 0x64]
mov ecx, esi
push 0
push eax
call dword [0x55f634]
call esi
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 8]
mov dword [edi], eax
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
test ecx, ecx
je 0x40dd9a
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 0x18]
nop dword [eax]
test esi, esi
je 0x40dd8a
mov edi, dword [ebp - 8]
mov esi, eax
nop dword [eax]
mov cl, byte [esi]
movzx eax, cl
add ebx, eax
cmp edx, 0xffffffff
je 0x40dd75
push 0
lea eax, [ebp - 0x1c]
mov byte [ebp - 1], cl
push eax
push 1
lea eax, [ebp - 1]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x14]
mov byte [esi], 0
inc esi
sub edi, 1
jne 0x40dd50
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x18]
add eax, edi
sub ecx, 1
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
jne 0x40dd40
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x40ddbc
mov eax, dword [ecx]
push dword [edi + 0x440]
push ecx
mov esi, dword [eax + 0x80]
mov ecx, esi
call dword [0x55f634]
call esi
mov dword [edi], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x418], ebx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40e410
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54995d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 4], 0
push esi
call dword [sym.imp.USER32.dll_GetDC]
push esi
mov ebx, eax
mov dword [ebp - 0x48], 0x28
lea eax, [ebp - 0x48]
xorps xmm0, xmm0
push eax
push esi
push esi
push esi
push dword [ebp + 0x20]
movlpd qword [ebp - 0x44], xmm0
push ebx
movlpd qword [ebp - 0x3c], xmm0
movlpd qword [ebp - 0x34], xmm0
movlpd qword [ebp - 0x2c], xmm0
movlpd qword [ebp - 0x24], xmm0
call dword [sym.imp.GDI32.dll_GetDIBits]
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x40e4a0
mov eax, dword [ebp - 0x40]
cdq
mov ecx, eax
movzx eax, word [ebp - 0x3a]
xor ecx, edx
add eax, 7
sub ecx, edx
imul eax, ecx
imul eax, dword [ebp - 0x44]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp - 0x34], eax
push eax
call fcn.00511d0c
mov edi, eax
add esp, 4
test edi, edi
jne 0x40e4c8
push str.Unable_to_Allocate_Bitmap_Memory
push 0x4e20
push 8
call fcn.004204c0
add esp, 0xc
jmp 0x40e55f
push 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x38], esi
push eax
push edi
push dword [ebp - 0x40]
push 0
push dword [ebp + 0x20]
push ebx
call dword [sym.imp.GDI32.dll_GetDIBits]
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push 0x561bb0
cmovae eax, dword [ebp + 8]
push eax
call fcn.00504bca
mov esi, eax
add esp, 8
test esi, esi
jne 0x40e516
push str.Unable_to_Create_Bitmap_File
push 0x4e20
push 8
call fcn.004204c0
add esp, 0xc
jmp 0x40e55f
xor eax, eax
mov dword [ebp - 0x12], 0x36
mov dword [ebp - 0x16], eax
mov eax, dword [ebp - 0x34]
add eax, 0x36
mov dword [ebp - 0x1a], eax
mov eax, 0x4d42
push esi
push 1
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1c]
push 0xe
push eax
call fcn.00504f19
push esi
push 1
lea eax, [ebp - 0x48]
push 0x28
push eax
call fcn.00504f19
push esi
push 1
push dword [ebp - 0x34]
push edi
call fcn.00504f19
add esp, 0x30
test ebx, ebx
je 0x40e56c
push ebx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
test edi, edi
je 0x40e579
push edi
call fcn.004f1251
add esp, 4
test esi, esi
je 0x40e586
push esi
call fcn.00504888
add esp, 4
mov edx, dword [ebp + 0x1c]
pop edi
pop esi
pop ebx
cmp edx, 0x10
jb 0x40e5b9
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e5af
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e5c9
push edx
push ecx
call fcn.004c824c
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x1c
call fcn.004f1161
int3
Function at 0x4378b0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
jne 0x437958
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, dword [ebp + 0xc]
cmp eax, esi
je 0x437957
push ebx
push edi
push 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
cmp ebx, edi
je 0x437947
push 1
push ebx
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
jne 0x437910
push str.Fail_to_attach_thread.
push 0x7d0
push 5
call fcn.004204c0
add esp, 0xc
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call dword [sym.imp.USER32.dll_SetFocus]
push 0
push ebx
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
jne 0x437955
push str.Fail_to_detach_thread.
push 0x7d0
push 5
call fcn.004204c0
add esp, 0xc
mov al, 1
pop edi
pop ebx
pop esi
pop ebp
ret
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop ebx
pop esi
mov al, 1
pop ebp
ret

Function at 0x43f670
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x43f71c
cmp byte [ebx + 0x3d], 0
je 0x43f71c
mov eax, dword [ebx]
push esi
push 0xffffffffffffffff
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x55f634]
mov ecx, ebx
call esi
cmp eax, 0xffffffff
je 0x43f714
push edi
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
mov esi, dword [edi]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebx + 0x40]
push eax
mov esi, dword [esi + 0x20]
mov ecx, esi
call dword [0x55f634]
mov ecx, edi
call esi
pop edi
sub eax, 0
je 0x43f6e6
sub eax, 1
je 0x43f6ea
sub eax, 2
jne 0x43f714
mov byte [ebx + 0x3d], al
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [ebx + 0x3d], 0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x43f707
push dword [ebx + 0x4c]
push esi
push 1
push eax
call fcn.00504f19
add esp, 0x10
cmp esi, eax
jne 0x43f714
cmp byte [ebx + 0x3d], 0
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x441870
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
cmp ebx, 0xffffffff
jne 0x44188c
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x20]
push esi
mov ecx, dword [eax]
test ecx, ecx
je 0x4418be
mov edx, dword [edi + 0x30]
mov esi, dword [edx]
lea eax, [esi + ecx]
cmp ecx, eax
jae 0x4418be
lea ecx, [esi - 1]
mov dword [edx], ecx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x4c], 0
je 0x4419a0
mov esi, dword [edi + 0xc]
lea eax, [edi + 0x3c]
cmp dword [esi], eax
jne 0x4418e6
mov edx, dword [edi + 0x54]
mov ecx, dword [edi + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [edi + 0x1c]
mov dword [eax], ecx
mov eax, dword [edi + 0x2c]
mov dword [eax], edx
mov eax, dword [edi + 0x38]
mov dword [ebp - 8], eax
test eax, eax
jne 0x441912
push dword [edi + 0x4c]
movsx eax, bl
push eax
call fcn.005181ae
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop esi
pop edi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 4], bl
mov esi, dword [eax]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
mov esi, dword [esi + 0x1c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x40]
push eax
call dword [0x55f634]
mov ecx, dword [ebp - 8]
call esi
sub eax, 0
je 0x441973
sub eax, 1
je 0x441973
sub eax, 2
jne 0x4419a0
push dword [edi + 0x4c]
push dword [ebp - 4]
call fcn.00432f70
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop esi
pop edi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 0x30]
sub esi, eax
je 0x441990
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.00504f19
add esp, 0x10
cmp esi, eax
jne 0x4419a0
lea eax, [ebp - 4]
mov byte [edi + 0x3d], 1
cmp dword [ebp - 0x10], eax
jne 0x4418b3
pop esi
pop edi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x443670
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
je 0x443751
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
test esi, esi
jl 0x443740
jg 0x4436a8
test edx, edx
je 0x443740
call fcn.00406090
mov esi, eax
mov eax, edx
mov dword [ebp - 0xc], eax
test eax, eax
jl 0x4436f6
jg 0x4436be
test esi, esi
je 0x4436f6
cmp ebx, eax
jg 0x4436cd
jl 0x4436c8
cmp edi, esi
jae 0x4436cd
mov esi, edi
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 8]
push esi
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
push dword [eax]
call fcn.004e4e00
mov ecx, dword [ebp - 4]
add esp, 0xc
sub edi, esi
sbb ebx, dword [ebp - 0xc]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x443725
mov eax, dword [ebp - 8]
movzx ecx, byte [eax]
mov eax, dword [ebp - 4]
push ecx
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x55f634]
mov ecx, dword [ebp - 4]
call esi
cmp eax, 0xffffffff
je 0x44373a
mov ecx, dword [ebp - 4]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [ebp - 8], esi
test ebx, ebx
jg 0x4436a8
jl 0x44373a
test edi, edi
jne 0x4436a8
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
pop edi
sbb esi, ebx
mov eax, edx
mov edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x10], esi
mov eax, dword [eax]
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x443770
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x443772
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [ebp - 0xc], eax
test edi, edi
jl 0x4437eb
jg 0x443784
test esi, esi
je 0x4437eb
test eax, eax
jl 0x4437cf
jg 0x44378e
test ebx, ebx
je 0x4437cf
cmp edi, eax
jg 0x44379d
jl 0x443798
cmp esi, ebx
jae 0x44379d
mov ebx, esi
mov dword [ebp - 0xc], edi
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.004e4e00
mov ecx, dword [ebp - 4]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [ebp - 0xc]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x4437eb
jg 0x4437d2
test esi, esi
je 0x4437eb
jmp 0x4437d2
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x4437eb
push eax
push esi
push 1
push edx
call fcn.00504f19
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x44e920
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54ebbd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push esi
mov dword [ebp - 0x24], 0
mov esi, ecx
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x24], 0
cmp byte [esi + 0x1c], 0
mov dword [ebp - 4], 0
jne 0x44e990
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [esi + 0x10], 0
mov byte [esi], 0
jmp 0x44ea5a
push 0xff
lea eax, [ebp - 0x124]
push 0
push eax
call fcn.004e43a0
add esi, 4
add esp, 0xc
mov ecx, esi
cmp dword [esi + 0x14], 0x10
jb 0x44e9b3
mov ecx, dword [esi]
push edi
mov edi, dword [ebp + 0x10]
mov edx, edi
cmp dword [edi + 0x14], 0x10
jb 0x44e9c1
mov edx, dword [edi]
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], 0x10
jb 0x44e9cc
mov eax, dword [eax]
push ecx
push 0xff
lea ecx, [ebp - 0x124]
push ecx
lea ecx, [ebp - 0x24]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x44ea1e
cmp dword [esi + 0x14], 0x10
jb 0x44e9f1
mov esi, dword [esi]
cmp dword [ebp - 0x10], 0x10
lea eax, [ebp - 0x24]
cmovae eax, dword [ebp - 0x24]
cmp dword [edi + 0x14], 0x10
jb 0x44ea04
mov edi, dword [edi]
push esi
push 0xff
lea ecx, [ebp - 0x124]
push ecx
push eax
push edi
push 0x56211c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x124]
lea edx, [ecx + 1]
pop edi
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44ea42
sub ecx, edx
lea eax, [ebp - 0x124]
push ecx
push eax
mov ecx, esi
call fcn.00406430
mov edx, dword [ebp - 0x10]
cmp edx, 0x10
jb 0x44ea8a
mov ecx, dword [ebp - 0x24]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x44ea80
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44ea9d
push edx
push ecx
call fcn.004c824c
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
call fcn.004f1161
int3
Function at 0x44ed20
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x1c], 0
jne 0x44ed66
mov esi, dword [ebp + 8]
xor eax, eax
push eax
push 0x5618f0
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
call fcn.00406520
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0xc
push 0xff
lea eax, [ebp - 0x200]
push 0
push eax
call fcn.004e43a0
add edi, 4
add esp, 0xc
mov ecx, edi
cmp dword [edi + 0x14], 8
jb 0x44ed89
mov ecx, dword [edi]
mov esi, dword [ebp + 0x10]
mov edx, esi
cmp dword [esi + 0x14], 8
jb 0x44ed96
mov edx, dword [esi]
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], 8
jb 0x44eda1
mov eax, dword [eax]
push ecx
push 0xff
lea ecx, [ebp - 0x200]
push ecx
push 0x5618f0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jne 0x44eded
cmp dword [edi + 0x14], 8
jb 0x44edc7
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x44edcf
mov esi, dword [esi]
push edi
push 0xff
lea eax, [ebp - 0x200]
push eax
push 0x5618f0
push esi
push 0x563ae8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x200]
xor eax, eax
lea edx, [ecx + 2]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44ee12
sub ecx, edx
lea eax, [ebp - 0x200]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00406520
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x455640
Capabilities:
Check mutex on windows

Disassembly:
cmp dword [0x59a42c], 0xffffffff
jne 0x455666
push str._VisionPromptLock
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0xffffffffffffffff
push eax
mov dword [0x59a42c], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret

Function at 0x45cc60
Capabilities:
Check mutex on windows

Disassembly:
push str.VisionActivePopupLock
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x5a9da8], eax
test eax, eax
je 0x45cc91
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x45cc94
push dword [0x5a9da8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
ret
mov al, 1
ret
Function at 0x4722f0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x551858
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x41c
mov eax, ecx
mov dword [ebp - 0x14], eax
mov dword [eax], vtable.FileParser.0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x410], 0
mov dword [ebp - 4], 0
mov dword [eax + 0x420], 0
mov dword [eax + 0x424], 0xf
mov byte [eax + 0x410], 0
mov dword [eax + 0x428], 0
mov dword [eax + 0x438], 0
mov dword [eax + 0x43c], 0xf
mov byte [eax + 0x428], 0
mov dword [eax + 0x440], 0
mov dword [eax + 0x450], 0
mov dword [eax + 0x454], 0xf
mov byte [eax + 0x440], 0
mov dword [eax + 0x458], 0
mov dword [eax + 0x45c], 0
mov dword [eax + 0x460], 0
push 0x400
lea eax, [ebp - 0x428]
mov byte [ebp - 4], 4
push 0
push eax
call fcn.004e43a0
mov ax, word [0x565bd8]
add esp, 0xc
movups xmm0, xmmword [str._VisionFileParser]
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x428]
push 0
push eax
push 0x400
push dword [ebp + 8]
movups xmmword [ebp - 0x28], xmm0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea eax, [ebp - 0x428]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x472411
push esi
push edi
sub eax, edx
je 0x472457
lea edi, [ebp + eax - 0x429]
mov dl, byte [edi]
xor ecx, ecx
cmp dl, 0x5c
sete cl
mov dword [ebp - 0x10], ecx
xor ecx, ecx
mov esi, dword [ebp - 0x10]
cmp dl, 0x3a
sete cl
or esi, ecx
cmp dl, 0x2e
mov ecx, 1
cmove esi, ecx
test esi, esi
je 0x472451
mov byte [edi], 0x5f
dec edi
sub eax, 1
jne 0x472425
lea edx, [ebp - 0x28]
mov esi, edx
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x472460
lea edi, [ebp - 0x428]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x472470
mov ecx, edx
lea eax, [ebp - 0x428]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
mov ecx, edx
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, dword [ebp - 0x14]
push 0xffffffffffffffff
push eax
mov dword [esi + 0x470], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp + 8]
mov edx, ecx
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4724b1
sub edx, edi
push edx
push ecx
lea ecx, [esi + 0x428]
call fcn.00406430
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x474], 0xffffffff
mov dword [esi + 0x478], 0xffffffff
mov dword [esi], vtable.OrgFileParser.0
mov dword [esi + 0x47c], 0
mov dword [esi + 0x480], 0
mov dword [esi + 0x484], 0
mov dword [esi + 0x488], 0
mov dword [esi + 0x498], 0
mov dword [esi + 0x49c], 0xf
mov byte [esi + 0x488], 0
mov dword [esi + 0x4a4], 0
mov dword [esi + 0x4a0], 0
mov dword [esi + 0x4a8], 0
mov dword [esi + 0x4ac], 0
mov dword [esi + 0x4b0], 0
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x472e70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5518bd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
mov eax, ecx
xor ebx, ebx
push esi
mov dword [ebp - 0x14], eax
xor esi, esi
push edi
mov eax, dword [eax + 0x474]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
cmp eax, 0xffffffff
jne 0x473012
mov dword [ebp - 4], ebx
mov edi, 1
cmp edi, 0x20
jge 0x472f12
imul ebx, edi, 0x2800
push ebx
call fcn.004c8e2b
mov esi, eax
add esp, 4
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x473023
push ebx
push 0xff
push esi
call fcn.004e43a0
mov eax, dword [ebp - 0x14]
add esp, 0xc
add eax, 0x428
cmp dword [eax + 0x14], 0x10
jb 0x472ef4
mov eax, dword [eax]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
add eax, 2
cmp eax, ebx
jne 0x472f12
push 1
push esi
call fcn.004c824c
add esp, 8
inc edi
jmp 0x472eb4
mov ecx, esi
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0xf
mov byte [ebp - 0x3c], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x472f30
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x3c]
call fcn.00406430
mov byte [ebp - 4], 1
xor eax, eax
mov dword [ebp - 0x18], eax
cmp eax, ebx
jge 0x472fb2
cmp byte [eax + esi], 0
lea ecx, [eax + esi]
mov dword [ebp - 0x24], ecx
jne 0x472faf
mov edi, dword [ebp - 0x14]
lea ecx, [ebp - 0x3c]
push ecx
mov eax, dword [edi + 8]
cmp eax, dword [edi + 0xc]
je 0x472f78
mov ecx, eax
call fcn.00402c00
add dword [edi + 8], 0x18
jmp 0x472f81
push eax
lea ecx, [edi + 4]
call fcn.00427a90
mov edx, dword [ebp - 0x24]
inc edx
mov ecx, edx
lea edi, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x472f90
sub ecx, edi
push ecx
push edx
lea ecx, [ebp - 0x3c]
call fcn.00406430
mov eax, dword [ebp - 0x14]
inc dword [eax + 0x474]
mov eax, dword [ebp - 0x18]
inc eax
jmp 0x472f49
mov edx, dword [ebp - 0x28]
cmp edx, 0x10
jb 0x472ffa
mov ecx, dword [ebp - 0x3c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x472fd8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x473038
push edx
push ecx
call fcn.004c824c
add esp, 8
jmp 0x472ffa
test esi, esi
je 0x473009
push 1
push esi
call fcn.004c824c
add esp, 8
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x474]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x58a910
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0xffffffff
push eax
call fcn.004e4900
call fcn.004f1161
int3