joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1b5a90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x48]
movzx eax, word [eax]
mov dword [esp], 0x1065d53
mov word [esp + 4], 0
mov ecx, 0x13da8e83
mov edx, 0x7e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x13da8e83]
mov edi, esi
not edi
or edi, edx
lea esi, [esi + edi*2]
add esi, ecx
mov edi, esi
and edi, 0x7a
xor esi, 0x7a
lea ebx, [esi + edi*2]
inc bl
mov byte [esp + ecx - 0x13da8e83], bl
inc ecx
dec edx
cmp ecx, 0x13da8e89
jne 0x1b5ac0
xor ecx, ecx
cmp dword [esp], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x18eef4]
Function at 0x401910
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [esp + 0x34]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
add ebx, 0x40
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
mov dword [esp + 0x1c], eax
call sym._fwrite
mov eax, dword [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]
lea edi, [edi]

Function at 0x401970
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x5c
mov dword [esp + 0x4c], ebx
mov ebx, eax
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 0x50], esi
mov esi, edx
mov dword [esp + 0x54], edi
mov edi, ecx
mov dword [esp + 0x58], ebp
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x401a66
mov eax, dword [esp + 0x38]
cmp eax, 4
jne 0x4019e0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
add esp, 0x5c
ret
cmp eax, 0x40
je 0x4019b5
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov eax, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
cmp eax, 0x40
setne byte [esp + 0x1e]
cmp eax, 4
setne byte [esp + 0x1f]
call sym._memcpy
cmp byte [esp + 0x1f], 0
je 0x4019c5
cmp byte [esp + 0x1e], 0
je 0x4019c5
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
jmp 0x4019c5
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call sym.___report_error
nop

Function at 0x401d00
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x406048
call sym._EnterCriticalSection_4
mov ebx, dword [0x406060]
sub esp, 4
test ebx, ebx
je 0x401d4b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401d44
test esi, esi
je 0x401d44
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401d20
mov dword [esp], 0x406048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x402040
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call sym.___main
call sym._GetCommandLineA_0
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sym._GetStartupInfoA_4
sub esp, 4
test ebx, ebx
jne 0x402076
jmp 0x4020b5
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x402073
cmp al, 0x20
je 0x402073
cmp al, 0x22
jne 0x402099
jmp 0x402104
cmp al, 0x20
lea esi, [esi]
je 0x4020a0
test al, al
je 0x4020b5
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
jne 0x402087
movzx eax, byte [ebx]
cmp al, 0x20
jne 0x40211a
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x4020a7
cmp al, 0x20
je 0x4020a7
test byte [ebp - 0x30], 1
mov esi, 0xa
je 0x4020c4
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._WinMain_16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
cmp al, 0x22
je 0x40210e
add ebx, 1
movzx eax, byte [ebx]
test al, al
jne 0x402100
cmp al, 0x22
sete al
movzx eax, al
add ebx, eax
jmp 0x4020a0
cmp al, 9
je 0x4020a7
jmp 0x4020b5
Function at 0x41f240
Capabilities:
Resolve function by parsing pe exports

Disassembly:
loop 0x41f1f8
sub al, 0x8b
clc
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.0041d072
std
sbb dword [edi - 0x10], edx
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x41f25f
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x41f25f
call fcn.0041d072
in eax, dx
or dword [ebx + 0x5d], esi
mov ebx, dword [edx + 0x24]
add ebx, edi
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.0041d072
pop edx
push esp
insd dword es:[edi], dx
das
push dword [ebp + 8]
push dword [ebp + 4]
push dword [ebp]
call fcn.0041d872
add byte [eax], al
add al, ch
adc byte [edi - 0x3b7cffee], 4
mov dword [edi], vtable.google::protobuf::MessageLite.0
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x427390
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5bff69
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x6216ec]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esi], vtable.ipc::proto::CandidateList.0
mov dword [esi + 4], eax
lea ecx, [esi + 0x1c]
mov dword [esi + 0x10], ecx
mov ecx, 4
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
lea edx, [esi + 0x3c]
mov dword [esi + 0x2c], edx
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], ecx
mov byte [esp + 0x10], 3
mov ecx, 1
mov dword [esi + 0x74], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], ecx
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x5c], 0xa
mov dword [esi + 0x78], eax
mov eax, dword [esp + 0x1c]
push eax
mov ecx, esi
call fcn.00428a30
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 8
Function at 0x403300
Capabilities:
Enumerate gui resources
Get disk information

Disassembly:
mov eax, dword [0x2b9b67c]
mov ecx, dword [0x2b98588]
sub esp, 0x424
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x4033f7
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeA]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
cmp dword [0x2b9b67c], 0x959
jne 0x4033dd
call edi
push 0
lea eax, [esp + 0x34]
push eax
push 0
call ebx
push 0
push 0
call esi
push 0
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0x402cb8
push 0x402d60
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
xor eax, eax
lea ecx, [esp + 0x1c]
push ecx
push eax
push eax
push eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov edx, dword [esp + 0x14]
push edx
call fcn.00403140
add dword [esp + 0x14], 8
sub dword [esp + 0x18], 1
jne 0x403340
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x424
ret
Function at 0x408e80
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x444c30]
jne 0x408e8a
repz ret
jmp fcn.0040b99c

Function at 0x40b167
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405317
and dword [ebp - 4], 0
cmp dword [0x445fc4], 0
mov ebx, eax
jne 0x40b218
push 0x402ac4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b2c9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402ab8
push edi
call esi
test eax, eax
je 0x40b2c9
push eax
call fcn.004052a5
mov dword [esp], 0x402aa8
push edi
mov dword [0x445fc4], eax
call esi
push eax
call fcn.004052a5
mov dword [esp], 0x402a94
push edi
mov dword [0x445fc8], eax
call esi
push eax
call fcn.004052a5
mov dword [esp], 0x402a78
push edi
mov dword [0x445fcc], eax
call esi
push eax
call fcn.004052a5
pop ecx
mov dword [0x445fd4], eax
test eax, eax
je 0x40b218
push 0x402a60
push edi
call esi
push eax
call fcn.004052a5
pop ecx
mov dword [0x445fd0], eax
mov eax, dword [0x445fd0]
cmp eax, ebx
je 0x40b270
cmp dword [0x445fd4], ebx
je 0x40b270
push eax
call fcn.00405320
push dword [0x445fd4]
mov esi, eax
call fcn.00405320
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b270
test edi, edi
je 0x40b270
call esi
test eax, eax
je 0x40b267
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b267
test byte [ebp - 0xc], 1
jne 0x40b270
or dword [ebp + 0x10], 0x200000
jmp 0x40b2a9
mov eax, dword [0x445fc8]
cmp eax, ebx
je 0x40b2a9
push eax
call fcn.00405320
pop ecx
test eax, eax
je 0x40b2a9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b2a9
mov eax, dword [0x445fcc]
cmp eax, ebx
je 0x40b2a9
push eax
call fcn.00405320
pop ecx
test eax, eax
je 0x40b2a9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x445fc4]
call fcn.00405320
pop ecx
test eax, eax
je 0x40b2c9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b2cb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411fe4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x44], eax
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edx, dword [ebp - 8]
mov dword [edx + 0x48], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov dword [eax + 0x4c], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [edx + 0x50], eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp - 8]
add edx, 0x44
push edx
push 0x4120c7
push 0x800
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x40], eax
push 0xf
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov esp, ebp
pop ebp
ret 4
Function at 0x4129ca
Capabilities:
Create directory
Enumerate files on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f9e04
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x260
mov dword [ebp - 0x26c], ecx
lea ecx, [ebp - 0x14]
call fcn.00404900
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00404900
mov byte [ebp - 4], 1
push 0x725
mov ecx, dword [ebp - 0x26c]
call fcn.004e2094
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
call fcn.00405a70
push 0x104
push 0
lea eax, [ebp - 0x268]
push eax
call fcn.004be790
add esp, 0xc
mov ecx, dword [ebp - 0x26c]
add ecx, 0x5c
push ecx
lea edx, [ebp - 0x268]
push edx
call fcn.004be9f0
add esp, 8
push 0x51f688
lea eax, [ebp - 0x268]
push eax
call fcn.004bea00
add esp, 8
lea ecx, [ebp - 0x268]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x412af6
push 0
lea edx, [ebp - 0x268]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x412ad6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xb7
je 0x412ad6
lea eax, [ebp - 0x268]
push eax
push 0x51f68c
lea ecx, [ebp - 0x10]
push ecx
call fcn.004d89f2
add esp, 0xc
push 0
push 0x51f6d0
lea ecx, [ebp - 0x10]
call fcn.00404920
push eax
mov ecx, dword [ebp - 0x26c]
call fcn.004e07ce
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004e2e21
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004e2e21
jmp 0x412c1f
push 0x140
push 0
lea edx, [ebp - 0x158]
push edx
call fcn.004be790
add esp, 0xc
lea eax, [ebp - 0x158]
push eax
push 0x51f6d8
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0xffffffff
jne 0x412b4d
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004e2e21
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004e2e21
jmp 0x412c1f
cmp dword [ebp - 0x15c], 0xffffffff
je 0x412bbb
lea ecx, [ebp - 0x14]
call fcn.004e2dac
lea ecx, [ebp - 0x12c]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004e2faa
push 0x2e
lea ecx, [ebp - 0x14]
call fcn.004d868f
mov dword [ebp - 0x164], eax
push 0
mov edx, dword [ebp - 0x164]
push edx
lea ecx, [ebp - 0x14]
call fcn.004d8162
lea ecx, [ebp - 0x14]
call fcn.00404920
push eax
mov ecx, dword [ebp - 0x18]
call fcn.00405a40
lea eax, [ebp - 0x158]
push eax
mov ecx, dword [ebp - 0x15c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x412bb9
jmp 0x412bbb
jmp 0x412b4d
mov edx, dword [ebp - 0x15c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x104
push 0
mov eax, dword [ebp - 0x26c]
add eax, 0x46c
push eax
call fcn.004be790
add esp, 0xc
mov ecx, dword [ebp - 0x26c]
add ecx, 0x46c
push ecx
push 0
mov ecx, dword [ebp - 0x18]
call fcn.00414fb0
push 0
mov ecx, dword [ebp - 0x18]
call fcn.00405a10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004e2e21
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004e2e21
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x412df4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], 0
jmp 0x412e0f
mov eax, dword [ebp - 0x40]
add eax, 1
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 7
jge 0x412e61
push 0x3c
push 0
lea ecx, [ebp - 0x3c]
push ecx
call fcn.004be790
add esp, 0xc
mov edx, dword [ebp - 0x40]
add edx, 1
push edx
push 0x51f6f0
lea eax, [ebp - 0x3c]
push eax
call fcn.004bec9d
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 0
lea edx, [ebp - 0x3c]
push edx
push 0x51f6f8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x44]
mov dword [edx + ecx*4 + 0x570], eax
jmp 0x412e06
push 0x58
push 0
mov eax, dword [ebp - 0x44]
add eax, 0x58c
push eax
call fcn.004be790
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 0x29
mov edx, dword [ebp - 0x44]
add edx, 0x58c
push edx
push 0
push 0x51f700
push 0x51f70c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [ebp + 8]
push eax
push 0x15
mov ecx, dword [ebp - 0x44]
add ecx, 0x5b5
push ecx
push 0
push 0x51f718
push 0x51f71c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edx, dword [ebp + 8]
push edx
push 9
mov eax, dword [ebp - 0x44]
add eax, 0x5ca
push eax
push 0
push 0x51f728
push 0x51f734
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0x51f740
push 0x51f74c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edx, dword [ebp - 0x44]
mov dword [edx + 0x5d8], eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0x51f758
push 0x51f764
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 0x44]
mov dword [ecx + 0x5dc], eax
mov edx, dword [ebp + 8]
push edx
push 0
push 0x51f770
push 0x51f780
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 0x44]
mov byte [ecx + 0x5d3], al
mov edx, dword [ebp + 8]
push edx
push 0
push 0x51f78c
push 0x51f798
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 0x44]
mov dword [ecx + 0x5d4], eax
mov edx, dword [ebp + 8]
push edx
push 0
push 0x51f7a4
push 0x51f7a8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 0x44]
mov dword [ecx + 0x5e0], eax
mov esp, ebp
pop ebp
ret 4
Function at 0x41b414
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov dword [ebp - 0x210], ecx
push 0x208
push 0
lea eax, [ebp - 0x208]
push eax
call fcn.004be790
add esp, 0xc
mov ecx, dword [ebp - 0x210]
add ecx, 0x5b0
push ecx
lea edx, [ebp - 0x208]
push edx
call fcn.004be9f0
add esp, 8
push 0x520558
lea eax, [ebp - 0x208]
push eax
call fcn.004bea00
add esp, 8
mov ecx, dword [ebp - 0x210]
add ecx, 0x1208
push ecx
lea edx, [ebp - 0x208]
push edx
call fcn.004bea00
add esp, 8
push 0x520564
lea eax, [ebp - 0x208]
push eax
call fcn.004bea00
add esp, 8
mov ecx, dword [ebp - 0x210]
add ecx, 0x1000
push ecx
lea edx, [ebp - 0x208]
push edx
call fcn.004bf5f0
add esp, 8
test eax, eax
jne 0x41b4c0
mov eax, 1
jmp 0x41b524
push 0
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp - 0x210]
add ecx, 0x1000
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x41b51f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20c], eax
mov edx, 1
test edx, edx
je 0x41b501
mov dword [ebp - 0x214], 0
jmp 0x41b51b
mov eax, dword [ebp - 0x20c]
push eax
push str._CopyLoadConfigAsFileToDefaultDir_:_errorcode___d_n
call fcn.00412500
add esp, 8
mov dword [ebp - 0x214], eax
xor eax, eax
jmp 0x41b524
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x41d7c2
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0xbc8
push eax
push 0
push 0x520f88
push 0x520f90
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx], al
mov edx, dword [ebp - 4]
add edx, 0xbc8
push edx
push 0
push 0x520f9c
push 0x520fa8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx + 1], al
mov edx, dword [ebp - 4]
add edx, 0xbc8
push edx
push 0
push 0x520fb4
push 0x520fbc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx + 2], al
mov edx, dword [ebp - 4]
add edx, 0xbc8
push edx
push 0
push 0x520fc8
push 0x520fd0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx + 3], al
mov esp, ebp
pop ebp
ret 4

Function at 0x41d855
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0xbc8
push eax
push 0
push 0x520fdc
push 0x520fe8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx], al
mov edx, dword [ebp - 4]
add edx, 0xbc8
push edx
push 1
push 0x520ff4
push 0x521000
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx + 1], al
mov edx, dword [ebp - 4]
add edx, 0xbc8
push edx
push 0
push 0x52100c
push 0x521018
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx + 2], al
mov edx, dword [ebp - 4]
add edx, 0xbc8
push edx
push 1
push 0x521024
push 0x521030
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx + 3], al
mov edx, dword [ebp - 4]
add edx, 0xbc8
push edx
push 0
push 0x52103c
push 0x52104c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx + 4], al
mov edx, dword [ebp - 4]
add edx, 0xbc8
push edx
push 0
push 0x521058
push 0x521064
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx + 5], al
mov edx, dword [ebp - 4]
add edx, 0xbc8
push edx
push 0
push 0x521070
push 0x521080
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx + 6], al
mov edx, dword [ebp - 4]
add edx, 0xbc8
push edx
push 0
push 0x52108c
push 0x521098
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx + 7], al
mov edx, dword [ebp - 4]
add edx, 0xbc8
push edx
push 0
push 0x5210a4
push 0x5210b0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx + 8], al
mov edx, dword [ebp - 4]
add edx, 0xbc8
push edx
push 0x28
push 0x5210bc
push 0x5210c8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx + 9], al
mov esp, ebp
pop ebp
ret 4
Function at 0x41df2a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
add eax, 0xbc8
push eax
push 4
push 0x521310
push 0x521320
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ebp - 0x38], 0
jmp 0x41df65
mov edx, dword [ebp - 0x38]
add edx, 1
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], 8
jge 0x41dfbc
push 0x32
push 0
lea eax, [ebp - 0x34]
push eax
call fcn.004be790
add esp, 0xc
mov ecx, dword [ebp - 0x38]
add ecx, 1
push ecx
push 0x52132c
lea edx, [ebp - 0x34]
push edx
call fcn.004bec9d
add esp, 0xc
mov eax, dword [ebp - 0x3c]
add eax, 0xbc8
push eax
push 0x100
lea ecx, [ebp - 0x34]
push ecx
push 0x521330
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp + 8]
mov dword [ecx + edx*4 + 4], eax
jmp 0x41df5c
mov esp, ebp
pop ebp
ret 4

Function at 0x41dfc2
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
add eax, 0xbc8
push eax
push 4
push 0x52133c
push 0x52134c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ebp - 0x38], 0
jmp 0x41dffd
mov edx, dword [ebp - 0x38]
add edx, 1
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], 4
jge 0x41e054
push 0x32
push 0
lea eax, [ebp - 0x34]
push eax
call fcn.004be790
add esp, 0xc
mov ecx, dword [ebp - 0x38]
add ecx, 1
push ecx
push 0x521358
lea edx, [ebp - 0x34]
push edx
call fcn.004bec9d
add esp, 0xc
mov eax, dword [ebp - 0x3c]
add eax, 0xbc8
push eax
push 0xff
lea ecx, [ebp - 0x34]
push ecx
push 0x52135c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp + 8]
mov dword [ecx + edx*4 + 4], eax
jmp 0x41dff4
mov edx, dword [ebp - 0x3c]
add edx, 0xbc8
push edx
push 4
push 0x521368
push 0x521378
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], eax
mov dword [ebp - 0x38], 0
jmp 0x41e088
mov edx, dword [ebp - 0x38]
add edx, 1
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], 4
jge 0x41e0df
push 0x32
push 0
lea eax, [ebp - 0x34]
push eax
call fcn.004be790
add esp, 0xc
mov ecx, dword [ebp - 0x38]
add ecx, 1
push ecx
push 0x521384
lea edx, [ebp - 0x34]
push edx
call fcn.004bec9d
add esp, 0xc
mov eax, dword [ebp - 0x3c]
add eax, 0xbc8
push eax
push 0xff
lea ecx, [ebp - 0x34]
push ecx
push 0x521388
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp + 8]
mov dword [ecx + edx*4 + 0x18], eax
jmp 0x41e07f
mov esp, ebp
pop ebp
ret 4