joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401269
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
and dword [ebp - 4], 0
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
push 0x200
push 0x40ee70
push 0xc7
push dword [0x40f070]
call esi
mov ebx, 0x40ee08
push 0x64
push ebx
push 0xc8
push dword [0x40f070]
call esi
mov eax, dword [ebp + 0xc]
push str.shell
push dword [eax]
call fcn.00404150
pop ecx
test eax, eax
pop ecx
jbe 0x4012d4
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], 3
mov eax, dword [eax]
mov dword [ebp + 0xc], 0x40c0a4
mov dword [0x40c0a4], eax
cmp dword [ebp + 8], 1
jle 0x401314
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
cmp byte [eax], 0x2d
jne 0x401314
cmp byte [eax + 1], 0x53
jne 0x401314
push edi
mov edi, 0x40c390
push 0x40c480
mov esi, 0x40c38c
push edi
push esi
call fcn.00404058
push 0x40c4a0
push edi
push esi
call fcn.00404058
add esp, 0x18
pop edi
jmp 0x401321
call fcn.0040108a
test eax, eax
jne 0x40140d
xor esi, esi
inc esi
cmp dword [ebp + 8], esi
jle 0x40134c
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
cmp byte [eax], 0x2d
jne 0x40134c
cmp byte [eax + 1], 0x68
jne 0x40134c
lea eax, [ebp + 0xc]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp + 8]
push eax
call fcn.00401413
pop ecx
pop ecx
push dword [ebp - 4]
call fcn.00401194
cmp eax, 7
pop ecx
jne 0x40140d
cmp dword [ebp + 8], esi
jle 0x401378
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
cmp byte [eax], 0x2d
jne 0x401378
cmp byte [eax + 1], 0x63
je 0x40140d
push str.rwxre.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x401390
push 0x10
push 0xcb
jmp 0x4013a9
push str.rwxre_main
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x4013b5
push 0x10
push 0xcc
call fcn.00401157
pop ecx
or eax, 0xffffffff
pop ecx
jmp 0x40140f
push 0x34
lea eax, [ebp - 0x38]
push 0
push eax
call fcn.00404000
mov eax, dword [ebp + 8]
and dword [ebp - 0x30], 0
add esp, 0xc
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], 0x24
push str.RacerMessageWindowccn_racerpc_ha
push str.TRAYICON_WINDOWCLASS
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], str.3.3.130.356
mov dword [ebp - 0x1c], 0x40ee70
mov dword [ebp - 0x14], str.chrome_titlebarno_closeno_dialogno
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 0x38]
push eax
call esi
pop ecx
jmp 0x40140f
xor eax, eax
pop esi
pop ebx
leave
ret

Function at 0x403705
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
lea eax, [ebp - 0x104]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, eax
test esi, esi
jle 0x40375d
mov eax, dword [0x40f084]
test eax, eax
je 0x403737
push eax
call fcn.00403e59
pop ecx
lea eax, [ebp + esi - 0x104]
push str.mozregistry.dat
push eax
call fcn.00403760
lea eax, [ebp - 0x104]
push eax
call fcn.004089d6
add esp, 0xc
mov dword [0x40f084], eax
pop esi
leave
ret
Function at 0x407349
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40eb48
cmp edx, dword [eax]
je 0x40736b
add eax, 8
inc ecx
cmp eax, 0x40ebd8
jl 0x40735c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40eb48]
jne 0x407499
mov eax, dword [0x40f0f8]
cmp eax, 1
je 0x407473
test eax, eax
jne 0x40739c
cmp dword [0x40c6e4], 1
je 0x407473
cmp edx, 0xfc
je 0x407499
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4073d3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00403760
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00403850
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x407416
lea eax, [ebp - 0x1a4]
push eax
call fcn.00403850
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40b430
push edi
call fcn.00408540
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00403760
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00403770
lea eax, [ebp - 0xa0]
push 0x40b410
push eax
call fcn.00403770
push dword [esi + 0x40eb4c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00403770
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004084b0
add esp, 0x2c
pop edi
jmp 0x407499
lea eax, [ebp + 8]
lea esi, [esi + 0x40eb4c]
push 0
push eax
push dword [esi]
call fcn.00403850
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x408030
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x400
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x40c]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x410]
push eax
push ecx
push 0x3ff
push 0x400
push edx
call dword [0x422064]
add esp, 0x14
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
add esp, 0x400
ret
Function at 0x4083d0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x400
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x40c]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x410]
push eax
push ecx
push 0x3ff
push 0x400
push edx
call dword [0x422064]
add esp, 0x14
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
add esp, 0x400
ret
Function at 0x408770
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x400
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x40c]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x410]
push eax
push ecx
push 0x3ff
push 0x400
push edx
call dword [0x422064]
add esp, 0x14
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
add esp, 0x400
ret

Function at 0x4087d0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x400
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x40c]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x410]
push eax
push ecx
push 0x3ff
push 0x400
push edx
call dword [0x422064]
add esp, 0x14
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
add esp, 0x400
ret
Function at 0x408b70
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x400
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x40c]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x410]
push eax
push ecx
push 0x3ff
push 0x400
push edx
call dword [0x422064]
add esp, 0x14
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
add esp, 0x400
ret
Function at 0x409de0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
mov ebx, dword [esp + 0x11c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
lea eax, [esp + 0x18]
push 0x104
push eax
push 0
push str.Path
push str.Redirect
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x14]
lea ecx, [esp + 0x14]
test edx, edx
je 0x409e4d
mov al, byte [esp + 0x14]
test al, al
je 0x409e4d
cmp al, 0x20
je 0x409e45
cmp al, 9
jne 0x409e90
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x409e3d
mov esi, dword [esp + 0x120]
test esi, esi
je 0x409e83
mov edx, dword [esp + 0x124]
test edx, edx
jle 0x409e83
test ebx, ebx
je 0x409e83
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jae 0x409e83
push ebx
push edx
push esi
call dword [0x422070]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
lea eax, [esp + 0x14]
push 0x3a
push eax
call fcn.004122f5
add esp, 8
test eax, eax
jne 0x409f53
cmp byte [esp + 0x14], 0x5c
je 0x409f53
test ebx, ebx
je 0x409e83
mov edi, dword [esp + 0x120]
test edi, edi
je 0x409e83
mov ebp, dword [esp + 0x124]
test ebp, ebp
jle 0x409e83
push 0x5c
push ebx
call fcn.0041238c
add esp, 8
test eax, eax
jne 0x409ee6
push 0x2f
push ebx
call fcn.0041238c
add esp, 8
test eax, eax
mov byte [edi], 0
je 0x409f2a
sub eax, ebx
inc eax
mov esi, eax
test esi, esi
jle 0x409f0b
cmp ebp, esi
jle 0x409f0b
push esi
push ebx
push ebp
push edi
call dword [0x42206c]
add esp, 0x10
mov byte [esi + edi], 0
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push ebp
push edi
mov ecx, esi
call fcn.0040c5e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
push ebp
push ebx
mov ecx, esi
call fcn.0040bd30
test eax, eax
je 0x409f43
push ebx
push ebp
push edi
call dword [0x422070]
add esp, 0xc
push 0x4223c4
push ebp
push edi
mov ecx, esi
call fcn.0040c5e0
jmp 0x409f0f
mov edx, dword [esp + 0x124]
mov eax, dword [esp + 0x120]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
call fcn.00409de0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
Function at 0x40a3c0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x400
push ebx
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
mov edx, dword [esp + 0x41c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x410]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0x41c]
push 0x400
push ecx
mov ecx, dword [esp + 0x420]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0xc]
xor edi, edi
xor esi, esi
lea edx, [esp + 0xc]
test al, al
lea ecx, [esp + 0xc]
je 0x40a446
cmp al, 0x20
je 0x40a437
cmp al, 9
je 0x40a437
test edi, edi
jne 0x40a43e
mov edi, 1
mov edx, ecx
jmp 0x40a43e
cmp edi, 1
jne 0x40a43e
mov esi, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40a422
mov ebx, dword [esp + 0x420]
test edx, edx
mov byte [ebx], 0
je 0x40a4b5
test esi, esi
jne 0x40a48f
test ebx, ebx
je 0x40a4b5
mov esi, dword [esp + 0x424]
test esi, esi
jle 0x40a4b5
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, esi
jae 0x40a4b5
push edx
push esi
push ebx
call dword [0x422070]
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x400
ret 0x18
sub esi, edx
test ebx, ebx
je 0x40a4b5
test esi, esi
jle 0x40a4b5
mov eax, dword [esp + 0x424]
cmp eax, esi
jle 0x40a4b5
push esi
push edx
push eax
push ebx
call dword [0x42206c]
add esp, 0x10
mov byte [esi + ebx], 0
pop edi
pop esi
pop ebx
add esp, 0x400
ret 0x18
Function at 0x40a4d0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
mov ebx, dword [esp + 0x11c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
lea eax, [esp + 0x18]
push 0x104
push eax
push 0
push str.Path
push str.Redirect
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x14]
lea ecx, [esp + 0x14]
test edx, edx
je 0x40a53d
mov al, byte [esp + 0x14]
test al, al
je 0x40a53d
cmp al, 0x20
je 0x40a535
cmp al, 9
jne 0x40a580
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40a52d
mov esi, dword [esp + 0x120]
test esi, esi
je 0x40a573
mov edx, dword [esp + 0x124]
test edx, edx
jle 0x40a573
test ebx, ebx
je 0x40a573
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jae 0x40a573
push ebx
push edx
push esi
call dword [0x422070]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
lea eax, [esp + 0x14]
push 0x3a
push eax
call fcn.004122f5
add esp, 8
test eax, eax
jne 0x40a643
cmp byte [esp + 0x14], 0x5c
je 0x40a643
test ebx, ebx
je 0x40a573
mov edi, dword [esp + 0x120]
test edi, edi
je 0x40a573
mov ebp, dword [esp + 0x124]
test ebp, ebp
jle 0x40a573
push 0x5c
push ebx
call fcn.0041238c
add esp, 8
test eax, eax
jne 0x40a5d6
push 0x2f
push ebx
call fcn.0041238c
add esp, 8
test eax, eax
mov byte [edi], 0
je 0x40a61a
sub eax, ebx
inc eax
mov esi, eax
test esi, esi
jle 0x40a5fb
cmp ebp, esi
jle 0x40a5fb
push esi
push ebx
push ebp
push edi
call dword [0x42206c]
add esp, 0x10
mov byte [esi + edi], 0
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push ebp
push edi
mov ecx, esi
call fcn.0040c6b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
push ebp
push ebx
mov ecx, esi
call fcn.0040bf80
test eax, eax
je 0x40a633
push ebx
push ebp
push edi
call dword [0x422070]
add esp, 0xc
push 0x4223c4
push ebp
push edi
mov ecx, esi
call fcn.0040c6b0
jmp 0x40a5ff
mov edx, dword [esp + 0x124]
mov eax, dword [esp + 0x120]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
call fcn.0040a4d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
Function at 0x40aab0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
mov ebx, dword [esp + 0x11c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
lea eax, [esp + 0x18]
push 0x104
push eax
push 0
push str.Path
push str.Redirect
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x14]
lea ecx, [esp + 0x14]
test edx, edx
je 0x40ab1d
mov al, byte [esp + 0x14]
test al, al
je 0x40ab1d
cmp al, 0x20
je 0x40ab15
cmp al, 9
jne 0x40ab60
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40ab0d
mov esi, dword [esp + 0x120]
test esi, esi
je 0x40ab53
mov edx, dword [esp + 0x124]
test edx, edx
jle 0x40ab53
test ebx, ebx
je 0x40ab53
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jae 0x40ab53
push ebx
push edx
push esi
call dword [0x422070]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
lea eax, [esp + 0x14]
push 0x3a
push eax
call fcn.004122f5
add esp, 8
test eax, eax
jne 0x40ac23
cmp byte [esp + 0x14], 0x5c
je 0x40ac23
test ebx, ebx
je 0x40ab53
mov edi, dword [esp + 0x120]
test edi, edi
je 0x40ab53
mov ebp, dword [esp + 0x124]
test ebp, ebp
jle 0x40ab53
push 0x5c
push ebx
call fcn.0041238c
add esp, 8
test eax, eax
jne 0x40abb6
push 0x2f
push ebx
call fcn.0041238c
add esp, 8
test eax, eax
mov byte [edi], 0
je 0x40abfa
sub eax, ebx
inc eax
mov esi, eax
test esi, esi
jle 0x40abdb
cmp ebp, esi
jle 0x40abdb
push esi
push ebx
push ebp
push edi
call dword [0x42206c]
add esp, 0x10
mov byte [esi + edi], 0
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push ebp
push edi
mov ecx, esi
call fcn.0040c780
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
push ebp
push ebx
mov ecx, esi
call fcn.0040c1d0
test eax, eax
je 0x40ac13
push ebx
push ebp
push edi
call dword [0x422070]
add esp, 0xc
push 0x4223c4
push ebp
push edi
mov ecx, esi
call fcn.0040c780
jmp 0x40abdf
mov edx, dword [esp + 0x124]
mov eax, dword [esp + 0x120]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
call fcn.0040aab0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
Function at 0x40b090
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x400
push ebx
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
mov edx, dword [esp + 0x41c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x410]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0x41c]
push 0x400
push ecx
mov ecx, dword [esp + 0x420]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0xc]
xor edi, edi
xor esi, esi
lea edx, [esp + 0xc]
test al, al
lea ecx, [esp + 0xc]
je 0x40b116
cmp al, 0x20
je 0x40b107
cmp al, 9
je 0x40b107
test edi, edi
jne 0x40b10e
mov edi, 1
mov edx, ecx
jmp 0x40b10e
cmp edi, 1
jne 0x40b10e
mov esi, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40b0f2
mov ebx, dword [esp + 0x420]
test edx, edx
mov byte [ebx], 0
je 0x40b185
test esi, esi
jne 0x40b15f
test ebx, ebx
je 0x40b185
mov esi, dword [esp + 0x424]
test esi, esi
jle 0x40b185
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, esi
jae 0x40b185
push edx
push esi
push ebx
call dword [0x422070]
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x400
ret 0x18
sub esi, edx
test ebx, ebx
je 0x40b185
test esi, esi
jle 0x40b185
mov eax, dword [esp + 0x424]
cmp eax, esi
jle 0x40b185
push esi
push edx
push eax
push ebx
call dword [0x42206c]
add esp, 0x10
mov byte [esi + ebx], 0
pop edi
pop esi
pop ebx
add esp, 0x400
ret 0x18
Function at 0x40b1a0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
mov ebx, dword [esp + 0x11c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
lea eax, [esp + 0x18]
push 0x104
push eax
push 0
push str.Path
push str.Redirect
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x14]
lea ecx, [esp + 0x14]
test edx, edx
je 0x40b20d
mov al, byte [esp + 0x14]
test al, al
je 0x40b20d
cmp al, 0x20
je 0x40b205
cmp al, 9
jne 0x40b250
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40b1fd
mov esi, dword [esp + 0x120]
test esi, esi
je 0x40b243
mov edx, dword [esp + 0x124]
test edx, edx
jle 0x40b243
test ebx, ebx
je 0x40b243
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jae 0x40b243
push ebx
push edx
push esi
call dword [0x422070]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
lea eax, [esp + 0x14]
push 0x3a
push eax
call fcn.004122f5
add esp, 8
test eax, eax
jne 0x40b313
cmp byte [esp + 0x14], 0x5c
je 0x40b313
test ebx, ebx
je 0x40b243
mov edi, dword [esp + 0x120]
test edi, edi
je 0x40b243
mov ebp, dword [esp + 0x124]
test ebp, ebp
jle 0x40b243
push 0x5c
push ebx
call fcn.0041238c
add esp, 8
test eax, eax
jne 0x40b2a6
push 0x2f
push ebx
call fcn.0041238c
add esp, 8
test eax, eax
mov byte [edi], 0
je 0x40b2ea
sub eax, ebx
inc eax
mov esi, eax
test esi, esi
jle 0x40b2cb
cmp ebp, esi
jle 0x40b2cb
push esi
push ebx
push ebp
push edi
call dword [0x42206c]
add esp, 0x10
mov byte [esi + edi], 0
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push ebp
push edi
mov ecx, esi
call fcn.0040c850
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
push ebp
push ebx
mov ecx, esi
call fcn.0040c2e0
test eax, eax
je 0x40b303
push ebx
push ebp
push edi
call dword [0x422070]
add esp, 0xc
push 0x4223c4
push ebp
push edi
mov ecx, esi
call fcn.0040c850
jmp 0x40b2cf
mov edx, dword [esp + 0x124]
mov eax, dword [esp + 0x120]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
call fcn.0040b1a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
Function at 0x40b780
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x400
push ebx
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
mov edx, dword [esp + 0x41c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x410]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0x41c]
push 0x400
push ecx
mov ecx, dword [esp + 0x420]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0xc]
xor edi, edi
xor esi, esi
lea edx, [esp + 0xc]
test al, al
lea ecx, [esp + 0xc]
je 0x40b806
cmp al, 0x20
je 0x40b7f7
cmp al, 9
je 0x40b7f7
test edi, edi
jne 0x40b7fe
mov edi, 1
mov edx, ecx
jmp 0x40b7fe
cmp edi, 1
jne 0x40b7fe
mov esi, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40b7e2
mov ebx, dword [esp + 0x420]
test edx, edx
mov byte [ebx], 0
je 0x40b875
test esi, esi
jne 0x40b84f
test ebx, ebx
je 0x40b875
mov esi, dword [esp + 0x424]
test esi, esi
jle 0x40b875
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, esi
jae 0x40b875
push edx
push esi
push ebx
call dword [0x422070]
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x400
ret 0x18
sub esi, edx
test ebx, ebx
je 0x40b875
test esi, esi
jle 0x40b875
mov eax, dword [esp + 0x424]
cmp eax, esi
jle 0x40b875
push esi
push edx
push eax
push ebx
call dword [0x42206c]
add esp, 0x10
mov byte [esi + ebx], 0
pop edi
pop esi
pop ebx
add esp, 0x400
ret 0x18
Function at 0x40b890
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
mov ebx, dword [esp + 0x11c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
lea eax, [esp + 0x18]
push 0x104
push eax
push 0
push str.Path
push str.Redirect
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x14]
lea ecx, [esp + 0x14]
test edx, edx
je 0x40b8fd
mov al, byte [esp + 0x14]
test al, al
je 0x40b8fd
cmp al, 0x20
je 0x40b8f5
cmp al, 9
jne 0x40b940
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40b8ed
mov esi, dword [esp + 0x120]
test esi, esi
je 0x40b933
mov edx, dword [esp + 0x124]
test edx, edx
jle 0x40b933
test ebx, ebx
je 0x40b933
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jae 0x40b933
push ebx
push edx
push esi
call dword [0x422070]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
lea eax, [esp + 0x14]
push 0x3a
push eax
call fcn.004122f5
add esp, 8
test eax, eax
jne 0x40ba03
cmp byte [esp + 0x14], 0x5c
je 0x40ba03
test ebx, ebx
je 0x40b933
mov edi, dword [esp + 0x120]
test edi, edi
je 0x40b933
mov ebp, dword [esp + 0x124]
test ebp, ebp
jle 0x40b933
push 0x5c
push ebx
call fcn.0041238c
add esp, 8
test eax, eax
jne 0x40b996
push 0x2f
push ebx
call fcn.0041238c
add esp, 8
test eax, eax
mov byte [edi], 0
je 0x40b9da
sub eax, ebx
inc eax
mov esi, eax
test esi, esi
jle 0x40b9bb
cmp ebp, esi
jle 0x40b9bb
push esi
push ebx
push ebp
push edi
call dword [0x42206c]
add esp, 0x10
mov byte [esi + edi], 0
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push ebp
push edi
mov ecx, esi
call fcn.0040c920
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
push ebp
push ebx
mov ecx, esi
call fcn.0040c530
test eax, eax
je 0x40b9f3
push ebx
push ebp
push edi
call dword [0x422070]
add esp, 0xc
push 0x4223c4
push ebp
push edi
mov ecx, esi
call fcn.0040c920
jmp 0x40b9bf
mov edx, dword [esp + 0x124]
mov eax, dword [esp + 0x120]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
call fcn.0040b890
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc

Function at 0x40cb00
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x400
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x40c]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x410]
push eax
push ecx
push 0x3ff
push 0x400
push edx
call dword [0x422064]
add esp, 0x14
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
add esp, 0x400
ret