joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f5c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46e9cb
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x495580]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
lea ecx, [edi + 8]
mov dword [edi], eax
mov dword [ecx + 4], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 8], 0
mov dword [ecx], vtable.OCArray_class_CVKAndModToChar_.0
mov dword [ebp - 4], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x1c], vtable.OCArray_class_CVKAndModToChar_.0
mov byte [ebp - 4], 1
mov eax, dword [edi]
push ecx
mov dword [edi + 4], 0
push dword [eax + 8]
call fcn.004219a0
mov eax, dword [edi]
push ecx
lea ecx, [edi + 0x1c]
push dword [eax + 8]
call fcn.004219a0
mov word [edi + 0x30], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x41fbd0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46ea53
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x495580]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
lea ecx, [esi + 4]
mov dword [esi], vtable.CVKToCharTable.0
call fcn.0043a4be
mov dword [esi + 0x18], vtable.CMap_unsigned_int__unsigned_int__class_CMappingVKToChars___class_CMappingVKToChars__.0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0x11
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0xa
push 0xffffffffffffffff
push 1
lea ecx, [esi + 4]
mov byte [ebp - 4], 2
call fcn.0043a61f
cmp dword [esi + 0xc], 0
jle 0x41fc6f
mov eax, dword [esi + 8]
mov byte [eax], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00436600
int3

Function at 0x4252f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46ee33
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x495580]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
lea ecx, [esi + 4]
mov dword [esi], vtable.CLigatures.0
call fcn.0043a4be
mov dword [esi + 0x18], vtable.CMap_struct_SLigatureKey__struct_SLigatureKey_const___class_CLigatureSequence__class_CLigatureSequence_const__.0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0x11
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0xa
push 0xffffffffffffffff
push 1
lea ecx, [esi + 4]
mov byte [ebp - 4], 2
call fcn.0043a61f
cmp dword [esi + 0xc], 0
jle 0x42538f
mov eax, dword [esi + 8]
mov byte [eax], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00436600
int3
Function at 0x4285d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46f0be
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x495580]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
lea ecx, [esi + 4]
mov dword [esi], vtable.CStickerMap.0
call fcn.0043a4be
mov dword [esi + 0x1c], vtable.CMap_struct_SStickerMapModPosKey__struct_SStickerMapModPosKey_const___class_CStickerMapModPosDesc__class_CStickerMapModPosDesc_const__.0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0x11
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0xa
mov dword [esi + 0x40], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x3c], vtable.OCArray_struct_SStickerMapModPosKey_.0
push 0xffffffffffffffff
push 1
lea ecx, [esi + 4]
mov byte [ebp - 4], 3
call fcn.0043a61f
cmp dword [esi + 0xc], 0
jle 0x4287ca
mov eax, dword [esi + 8]
lea ecx, [esi + 0x1c]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xffffff
mov word [ebp - 0x18], 0
mov byte [eax], 0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xe]
mov byte [esi + 0x18], 0
push eax
mov word [ebp - 0xe], 0
call fcn.0042baa0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0
push eax
lea eax, [ebp - 0xe]
mov dword [ebp - 0x1c], 0xffffff
push eax
lea ecx, [esi + 0x1c]
mov word [ebp - 0x18], 0
mov word [ebp - 0xe], 0x100
call fcn.0042baa0
push ecx
push 0x10
lea ecx, [esi + 0x3c]
mov word [esi + 0x38], 0x101
call fcn.0042c100
xor ecx, ecx
mov eax, dword [esi + 0x40]
mov word [eax + ecx], 0
mov eax, dword [esi + 0x40]
mov word [ecx + eax + 2], 0
mov eax, dword [esi + 0x40]
mov word [ecx + eax + 4], 0
mov eax, dword [esi + 0x40]
mov word [ecx + eax + 6], 0
add ecx, 8
cmp ecx, 0x20
jl 0x4286f1
movsd xmm0, qword [0x48a0a0]
mov eax, 0x7f
mov word [esi + 0xa0], ax
mov eax, esi
mov dword [esi + 0x50], 2
mov dword [esi + 0x54], 2
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 1
mov dword [esi + 0x60], 1
mov dword [esi + 0x64], 1
mov dword [esi + 0x68], 0xffffff
mov dword [esi + 0x6c], 0
mov byte [esi + 0x70], 1
mov dword [esi + 0x74], 0xe6e6e6
mov byte [esi + 0x78], 1
mov dword [esi + 0x7c], 0x646464
mov byte [esi + 0x80], 1
mov dword [esi + 0x84], 0xffdcdc
mov byte [esi + 0x88], 0
mov dword [esi + 0x8c], 0xff0000
mov dword [esi + 0x90], 0
movsd qword [esi + 0x98], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00436600
int3
Function at 0x431280
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46f66d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x495580]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ebx, eax
call fcn.00439fe5
mov ecx, dword [eax + 4]
call fcn.0043bce4
mov dword [ebp - 4], 0
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
nop dword [eax]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
call esi
test eax, eax
jne 0x431300
call edi
sub eax, ebx
cmp eax, 0x190
jae 0x43132c
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
call esi
test eax, eax
je 0x4312e2
nop
call fcn.00439fe5
mov ecx, dword [eax + 4]
mov eax, dword [ecx]
call dword [eax + 0x5c]
call edi
sub eax, ebx
cmp eax, 0x190
jae 0x43132c
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
call esi
test eax, eax
jne 0x431300
jmp 0x4312d0
lea ecx, [ebp - 0xd]
call fcn.00431690
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431910
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46f746
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x495580]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
lea ecx, [edi + 4]
mov dword [ecx + 4], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 8], 0
mov dword [ecx], vtable.OCArray_class_CVkFParam_.0
mov dword [ebp - 4], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x18], vtable.OCArray_bool_.0
mov dword [edi + 0x30], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x2c], vtable.OCArray_class_CVkFParam_.0
push ecx
mov byte [ebp - 4], 2
push 8
mov byte [edi], 0xff
call fcn.00432ca0
mov edx, dword [edi + 0x1c]
test edx, edx
jne 0x4319ec
mov esi, dword [edi + 0x28]
mov eax, 8
cmp esi, eax
cmovl esi, eax
push esi
call fcn.00437bff
push esi
push 0
push eax
mov dword [edi + 0x1c], eax
call fcn.0044cff0
add esp, 0x10
jmp 0x431aad
mov ecx, dword [edi + 0x24]
cmp ecx, 8
jl 0x431a1b
mov ecx, dword [edi + 0x20]
cmp ecx, 8
jge 0x431ab0
mov eax, 8
sub eax, ecx
push eax
lea eax, [ecx + edx]
push 0
push eax
call fcn.0044cff0
add esp, 0xc
jmp 0x431ab0
mov eax, dword [edi + 0x28]
test eax, eax
jne 0x431a44
mov eax, dword [edi + 0x20]
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp eax, 4
jge 0x431a3a
mov eax, 4
jmp 0x431a44
mov edx, 0x400
cmp eax, edx
cmovg eax, edx
add eax, ecx
mov esi, 8
cmp eax, esi
cmovg esi, eax
push esi
call fcn.00437bff
mov ecx, dword [edi + 0x1c]
mov ebx, eax
mov eax, dword [edi + 0x20]
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
test eax, eax
je 0x431ae9
test ebx, ebx
jne 0x431ad6
call fcn.004542cd
mov dword [eax], 0x16
call fcn.004541cf
mov ecx, 0x16
push ecx
call fcn.00403a40
mov eax, dword [edi + 0x20]
mov ecx, 8
sub ecx, eax
add eax, ebx
push ecx
push 0
push eax
call fcn.0044cff0
push dword [edi + 0x1c]
call fcn.00437038
add esp, 0x14
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x24], esi
push ecx
push 8
lea ecx, [edi + 0x2c]
mov dword [edi + 0x20], 8
call fcn.00432ca0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ecx, ecx
je 0x431aed
cmp esi, eax
jb 0x431aed
push eax
push ecx
push ebx
call fcn.0044ca70
add esp, 0xc
xor ecx, ecx
jmp 0x431a84
push esi
push 0
push ebx
call fcn.0044cff0
add esp, 0xc
cmp dword [ebp - 0x10], 0
je 0x431a6f
cmp esi, dword [ebp - 0x14]
jae 0x431a7f
call fcn.004542cd
mov dword [eax], 0x22
call fcn.004541cf
mov ecx, 0x22
jmp 0x431a84
Function at 0x4341b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
mov esi, 1
mov dword [ebp - 0xc], ebx
mov eax, esi
shl eax, cl
push edi
cmp edx, eax
ja 0x4342e1
mov edi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, esi
mov dword [ebp - 8], edi
bsr ecx, eax
push edi
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [ebx + 0xc]
lea eax, [esi + esi]
push eax
call fcn.00433e90
lea eax, [esi - 1]
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x18], eax
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp ecx, edi
je 0x4342bc
mov eax, ecx
movzx edx, byte [eax + 8]
mov esi, dword [ebx + 0x18]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edx, edx, 0x1000193
and esi, edx
mov edx, dword [ebx + 0xc]
lea ebx, [edx + esi*8]
mov esi, dword [ebx]
mov dword [ebp - 4], ebx
cmp esi, edi
jne 0x43423f
mov dword [ebx], eax
mov dword [ebx + 4], eax
jmp 0x4342af
mov edx, dword [ebx + 4]
mov bl, byte [eax + 8]
cmp bl, byte [edx + 8]
mov ebx, dword [ebp - 4]
jne 0x43427c
mov edx, dword [edx]
mov dword [ebp + 8], edx
cmp edx, eax
je 0x434277
mov edi, dword [eax + 4]
mov ebx, dword [ebp + 8]
mov dword [edi], ecx
mov esi, dword [ecx + 4]
mov dword [esi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [ebx + 4], esi
mov ebx, dword [ebp - 4]
mov dword [ecx + 4], edi
mov edi, dword [ebp - 8]
mov dword [eax + 4], edx
mov dword [ebx + 4], eax
jmp 0x4342af
cmp esi, edx
je 0x43428f
mov bl, byte [eax + 8]
mov edx, dword [edx + 4]
cmp bl, byte [edx + 8]
je 0x4342c5
cmp esi, edx
jne 0x434283
mov ebx, dword [eax + 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov esi, dword [edx + 4]
mov dword [esi], eax
mov dword [edx + 4], edi
mov edx, dword [ebp - 4]
mov dword [ecx + 4], ebx
mov dword [eax + 4], esi
mov dword [edx], eax
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov eax, ecx
cmp ecx, edi
jne 0x434212
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [eax + 4]
mov ebx, dword [edx]
mov dword [edi], ecx
mov esi, dword [ecx + 4]
mov dword [esi], ebx
mov edx, dword [ebx + 4]
mov dword [edx], eax
mov dword [ebx + 4], esi
mov dword [ecx + 4], edi
mov dword [eax + 4], edx
jmp 0x4342ac
push str.invalid_hash_bucket_count
call fcn.0044c076
int3
Function at 0x43860a
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
lea eax, [ebp - 4]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x438634
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x43863a
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop esi
leave
ret
lea ecx, [esi + 0xc]
call fcn.00404290
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.0043a480
int3

Function at 0x438915
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push esi
mov esi, ecx
jne 0x438926
xor eax, eax
jmp 0x438942
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x438947
mov eax, dword [ebp - 4]
pop esi
leave
ret 8
lea ecx, [esi + 0xc]
call fcn.00404290
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.0043a480
int3

Function at 0x4389b9
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
push 0
push dword [ebp + 0xc]
mov eax, dword [edi]
push dword [ebp + 8]
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x471538]
mov ecx, edi
call esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x4389ec
pop edi
pop esi
pop ebp
ret 8
lea ecx, [edi + 0xc]
call fcn.00404290
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.0043a480
int3

Function at 0x438ac5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
test esi, esi
je 0x438af0
push 0
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x438af6
cmp dword [ebp - 4], esi
jne 0x438b0d
pop edi
pop esi
leave
ret 8
lea ecx, [edi + 0xc]
call fcn.00404290
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.0043a480
lea ecx, [edi + 0xc]
call fcn.00404290
push eax
push 0xffffffffffffffff
push 0xd
call fcn.0043a0d6
int3
Function at 0x4425d5
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov edx, ecx
xor eax, eax
mov ecx, dword [ebp + 8]
inc eax
push edi
xor edi, edi
mov dword [ebp - 8], edx
inc edi
mov dword [ebp - 4], eax
lea ebx, [ecx + 0xc]
cmp dword [ecx + 8], edi
jle 0x442651
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x442616
mov eax, dword [edx + 0x10]
cmp dword [eax + edi*8 + 4], esi
je 0x442616
mov eax, dword [ebx]
cmp dword [eax + edi*4], 0
je 0x442644
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x442647
mov eax, dword [ebx]
mov eax, dword [eax + edi*4]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x44263e
mov eax, dword [eax]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x471538]
mov ecx, dword [ebp - 0xc]
call esi
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebx]
and dword [eax + edi*4], 0
mov eax, dword [ebp - 4]
inc edi
cmp edi, dword [ecx + 8]
jl 0x4425fa
test eax, eax
je 0x442698
lea esi, [edx + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 8]
mov edi, dword [ebp + 8]
add ecx, 0x14
push edi
call fcn.004428c9
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [edi]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x471538]
mov ecx, edi
call esi
mov eax, dword [ebp - 8]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x44291b
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0x10
mov eax, 0x47014a
call fcn.0044b5a6
mov ebx, ecx
mov dword [ebp - 0x18], ebx
lea eax, [ebx + 0x1c]
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [ebp + 8]
test edi, edi
jle 0x442a12
cmp edi, dword [ebx + 0xc]
jge 0x442a12
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x442972
cmp edi, dword [esi + 8]
jl 0x442a00
cmp dword [ebp + 0xc], 0
je 0x442a00
xor edi, edi
jmp 0x4429a4
xor edi, edi
push 0x10
mov dword [ebp - 4], edi
call fcn.00442409
mov esi, eax
test esi, esi
je 0x44298c
mov dword [esi], vtable.CThreadData.0
jmp 0x44298e
mov esi, edi
or dword [ebp - 4], 0xffffffff
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
mov dword [esi + eax], ecx
mov dword [ebx + 0x14], esi
push 4
push dword [ebx + 0xc]
call fcn.00412e60
cmp dword [esi + 0xc], 0
pop ecx
pop ecx
jne 0x4429c0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x4429cc
push 2
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov edx, eax
test edx, edx
je 0x442a39
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], edx
mov eax, dword [ebx + 0xc]
sub eax, ecx
shl eax, 2
push eax
lea eax, [edx + ecx*4]
push edi
push eax
call fcn.0044cff0
mov eax, dword [ebx + 0xc]
add esp, 0xc
mov dword [esi + 8], eax
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edi, dword [ebp + 8]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x442a12
cmp edi, dword [esi + 8]
jge 0x442a12
mov eax, dword [ebp + 0xc]
mov dword [ecx + edi*4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0044b50b
ret 8
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0043661a
int3
Function at 0x443117
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x470199
call fcn.0044b53d
mov eax, ecx
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp + 0x10]
xor edi, edi
mov esi, dword [ebp + 0x14]
push edi
mov dword [ebx], edi
mov dword [esi], edi
cmp dword [eax + 0x58], edi
je 0x4431bf
push dword [ebp + 8]
call fcn.00443436
mov dword [ebp - 0x10], eax
test eax, eax
je 0x443245
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
push ecx
push edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push ecx
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x14]
mov dword [esi], ecx
test eax, eax
jne 0x4431a8
push ecx
call fcn.00437bff
pop ecx
lea ecx, [ebp - 0x14]
mov dword [ebx], eax
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4431a8
xor edi, edi
inc edi
jmp 0x4431b2
push dword [ebx]
call fcn.00437038
pop ecx
mov dword [ebx], edi
lea ecx, [ebp - 0x24]
call fcn.0044303c
jmp 0x443243
mov eax, dword [eax]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [eax + 0x84]
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call dword [0x471538]
mov ecx, dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x44323b
mov esi, dword [ebp + 0x14]
shr ecx, 1
push ecx
mov dword [esi], ecx
call fcn.00437bff
mov dword [ebx], eax
pop ecx
cmp dword [esi], edi
jbe 0x443235
lea esi, [edi + edi]
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040ec60
push esi
lea ecx, [ebp - 0x10]
mov bl, al
call fcn.0040ec60
mov ecx, dword [ebp + 0x10]
shl bl, 4
sub bl, 0x51
add al, bl
mov ecx, dword [ecx]
mov byte [edi + ecx], al
inc edi
mov eax, dword [ebp + 0x14]
cmp edi, dword [eax]
jb 0x443203
mov eax, dword [ebp - 0x10]
xor edi, edi
inc edi
lea ecx, [eax - 0x10]
call fcn.00404460
mov eax, edi
call fcn.0044b50b
ret 0x10

Function at 0x44324d
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x4432a0
push esi
push dword [ebp + 8]
call fcn.00443436
mov edi, eax
test edi, edi
je 0x44329b
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x44329b
mov eax, dword [ebp - 8]
jmp 0x4432b2
mov eax, dword [ebp + 0x10]
jmp 0x4432b2
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc
Function at 0x4432b8
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4701c6
mov eax, dword fs:[0]
push eax
mov eax, 0x201c
call fcn.0044b750
mov eax, dword [0x495580]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x201c], edi
mov dword [ebp - 0x2024], eax
cmp dword [ecx + 0x58], ebx
je 0x4433e9
push ebx
push edx
call fcn.00443436
mov ebx, eax
test ebx, ebx
jne 0x443320
push esi
jmp 0x443411
lea ecx, [ebp - 0x2014]
call fcn.00404480
xor ecx, ecx
lea eax, [ebp - 0x2018]
push eax
push ecx
lea eax, [ebp - 0x2020]
mov dword [ebp - 4], ecx
push eax
push ecx
push dword [ebp - 0x2024]
mov dword [ebp - 0x2020], ecx
push ebx
mov dword [ebp - 0x2018], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x201c], eax
test eax, eax
jne 0x4433a8
mov eax, dword [ebp - 0x2018]
lea ecx, [ebp - 0x2014]
shr eax, 1
push eax
call fcn.00404200
lea ecx, [ebp - 0x2018]
push ecx
push eax
lea eax, [ebp - 0x2020]
push eax
push 0
push dword [ebp - 0x2024]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x2014]
mov dword [ebp - 0x201c], eax
call fcn.004069f0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x201c], 0
jne 0x4433d6
mov esi, dword [ebp - 0x2014]
add esi, 0xfffffff0
push esi
call fcn.00403700
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.00404460
jmp 0x443418
push esi
mov ecx, edi
call fcn.004038c0
mov ecx, dword [ebp - 0x2014]
lea ecx, [ecx - 0x10]
jmp 0x4433cf
test esi, esi
jne 0x4433f2
mov esi, 0x4792ac
push dword [ecx + 0x6c]
lea ecx, [ebp - 0x2010]
push 0x1000
push ecx
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x2010]
push eax
mov ecx, edi
call fcn.004038c0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044ae3d
leave
ret 0x10
Function at 0x4435a7
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x58], esi
je 0x4435f4
push esi
push dword [ebp + 8]
call fcn.00443436
mov edi, eax
test edi, edi
je 0x44367c
push dword [ebp + 0x14]
push ebx
push 3
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
jmp 0x44367c
mov eax, dword [ebp + 0x14]
push 2
pop ecx
lea eax, [eax*2 + 1]
mul ecx
setb cl
movsx ecx, cl
neg ecx
or ecx, eax
push ecx
call fcn.00437bff
mov edx, dword [ebp + 0x14]
pop ecx
mov ecx, eax
mov dword [ebp - 8], ecx
test edx, edx
je 0x44364e
mov dword [ebp - 4], 0x41
mov al, byte [ebx + esi]
and al, 0xf
movzx eax, al
add ax, word [ebp - 4]
mov word [ecx + esi*4], ax
mov al, byte [ebx + esi]
shr al, 4
movzx eax, al
add ax, word [ebp - 4]
mov word [ecx + esi*4 + 2], ax
inc esi
cmp esi, edx
jb 0x443627
xor eax, eax
mov word [ecx + esi*4], ax
mov eax, dword [edi]
push ecx
push dword [ebp + 0xc]
mov esi, dword [eax + 0x88]
mov ecx, esi
push dword [ebp + 8]
call dword [0x471538]
mov ecx, edi
call esi
push dword [ebp - 8]
mov esi, eax
call fcn.00437038
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10