joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a81a0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4e2298
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 0x118]
test eax, eax
jne 0x4a8250
mov eax, dword [0x86dd50]
push esi
mov dword [esp + 8], eax
push 0x104
push 0x104
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call fcn.004d129b
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call fcn.004d12ea
push str.winhlp32.exe
lea ecx, [esp + 0xc]
call fcn.004d1247
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4a8237
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x4a8237
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [edi + 0x118], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.004d0e6b
pop esi
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4ab350
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4e2720
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, ecx
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4ab4f7
mov ecx, dword [0x86dd50]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], ecx
mov ecx, dword [eax - 8]
mov bl, 1
test ecx, ecx
mov byte [esp + 0x28], bl
jle 0x4ab44c
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push edi
push ecx
mov ecx, esi
call fcn.004aa070
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.004d0fa4
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.004d0e6b
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x86bf4c
call fcn.004d0ed9
lea edx, [esp + 0x14]
push 0x3d
push edx
lea eax, [esp + 0x24]
push edi
push eax
mov ecx, esi
call fcn.004aa430
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 3
call fcn.004d0fa4
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call fcn.004d0e6b
lea ecx, [esp + 0xc]
call fcn.004d137f
mov ecx, dword [esp + 0xc]
push 0x86c98c
push ecx
call fcn.004c0494
add esp, 8
test eax, eax
je 0x4ab474
mov edx, dword [edi]
mov ecx, dword [esp + 0x10]
mov eax, dword [edx - 8]
cmp ecx, eax
jl 0x4ab3ad
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.004d0e6b
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.004d0e6b
jmp 0x4ab4fb
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call fcn.004ab0f0
test eax, eax
push 0
je 0x4ab4df
lea ecx, [esp + 0x34]
push 0x64
push ecx
mov ecx, esi
call fcn.004a9790
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x4ab4c5
cmp eax, 0x64
jg 0x4ab4b3
mov edx, dword [esp + 0x38]
push eax
push 0x64
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x4ab450
push 0x64
push eax
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x4ab450
cmp eax, 0x64
jge 0x4ab44c
mov ecx, dword [esp + 0x34]
push 0x64
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x4ab450
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.004a9790
mov esi, eax
jmp 0x4ab450
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
cmp esi, eax
jl 0x4ab505
mov eax, esi
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 0x10
Function at 0x4b3060
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x4b3103
test eax, eax
jbe 0x4b3103
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x4b3103
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x4b30ae
xor esi, esi
jmp 0x4b30b4
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x4b30df
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.0044fec0
add esi, eax
push esi
mov ebx, esi
call fcn.0044fec0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x4b30c0
pop ebp
test edi, edi
pop edi
jne 0x4b3103
test ebx, ebx
je 0x4b3103
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.004c0e70
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x4b3245
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4b335d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4b335d
mov eax, dword [esi + 0x3c]
push eax
call fcn.004d2922
mov esi, eax
test esi, esi
je 0x4b335d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x4b335d
mov ecx, esi
call fcn.004b31b0
cmp edi, eax
jge 0x4b335d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x4b32e3
mov dword [esp + 0x34], 1
jmp 0x4b333e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x4b335d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.004b2770
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x4d32c5
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4d32fd
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004d1312
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004d12ea
jmp 0x4d3309
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4d49b8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4d49fa
call fcn.004daa72
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4d49fa
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4d49f1
xor eax, eax
jmp 0x4d4a02
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004d4a08
pop edi
pop esi
pop ebx
ret 4

Function at 0x4dafa2
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4dafd0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4dafee
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004daf08
jmp 0x4dafee
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4dafee
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004daf08
test edi, edi
mov eax, edi
jne 0x4dafd8
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x409ebd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x409ebd
lcall 0x5de5, 0x8b10c483
jmp fcn.0076d6b4
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x566008], 0x8088405
inc edx
mov dword [ebx + 0x566008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cc40
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cc71
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cc59
add dl, dl
jne 0x41cc7c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cccd
xor eax, eax
add dl, dl
jne 0x41cc89
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cd6a
add dl, dl
jne 0x41cc98
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cca3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41ccae
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41ccb9
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41ccc3
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cc68
mov eax, 1
add dl, dl
jne 0x41ccdb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cce6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ccd2
sub eax, ebx
mov ebx, 1
jne 0x41cd19
mov ecx, 1
add dl, dl
jne 0x41ccff
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cd0a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ccf6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cc68
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cd30
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cd3b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cd27
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cc68
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41cd8b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cc68
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41e214
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x54f6d3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e2c5
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e2ae
test esi, esi
jbe 0x41e2c5
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088dc
test eax, eax
jne 0x41e2a0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e2c5
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e27d
jmp 0x41e2c5
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e2c5
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54f6da
ret
Function at 0x41eb1c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x5500cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41eb57
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41eb70
lea eax, [ebp - 0x10]
mov edx, dword [0x568258]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41eb83
lea eax, [ebp - 0x10]
mov edx, dword [0x568258]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41eb8f
adc edx, 0
mov edx, dword [edx*4 + 0x5670e8]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x41ec9d
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41ec90
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dcc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41ec90
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41ec90
cmp dx, 0x150
ja 0x41ec90
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41ec90
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41ecb5
inc ebx
cmp ebx, 0x19
jne 0x41eb49
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5500d2
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x1001dc45
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1001dc54
pop dword [ebp - 0x44]
mov eax, 0xc1dcc033
add eax, 0x4e251c21
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x40629
push 0
mov eax, 0xb353b0cc
sub eax, 0xa3511fec
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x4f0d
xor edi, edi
add edi, eax
mov edx, 0x10042200
add edx, dword [ebp - 0x44]
mov esi, 0xd62b871a
xor dword [ebp - 0x18], edi
mov ebx, dword [edx]
sub dword [ebp - 0x2c], 0xd431fe50
xor ebx, esi
sub dword [ebp - 8], ecx
mov dword [edi], ebx
xor dword [ebp - 0x20], edi
add edi, 4
add edx, 0x256b0870
sub edx, 0x256b086c
loop 0x1001dca3
add eax, 0x12f07
xor ebx, ebx
add ebx, eax
add eax, 0x4119143f
add eax, 0xbee6ebc6
mov ecx, 0x10000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x40611c
pop dword [ebp - 0x10]
mov eax, 0x146e1f2e
add eax, 0xebd241ee
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xf86fef5e
sub dword [ebp - 0x20], 0xaa1daa13
mov dword [ebp - 0x1c], 0x303fe7c9
sub dword [ebp - 0x1c], 0xfe0c9b84
mov dword [ebp - 0x18], 0x38feb009
sub dword [ebp - 0x18], 0xecb26bdb
mov dword [ebp - 0x14], 0xd00e8f09
add dword [ebp - 0x14], 0x2ff170f7
lea eax, [ebp - 0x20]
push eax
mov eax, 0x8668ac14
sub eax, 0x86283bb4
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xafa17a27
sub dword [ebp - 0x20], 0x3b2f10d1
mov dword [ebp - 0x1c], 0x972c6084
sub dword [ebp - 0x1c], 0x55bfff0f
mov dword [ebp - 0x18], 0x4cc22545
sub dword [ebp - 0x18], 0xe952b8d9
mov dword [ebp - 0x14], 0x1974a58b
sub dword [ebp - 0x14], 0x1974a58b
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x33cab
push 0
call eax
mov ecx, 0x3cbc
mov ebx, eax
mov edx, 0x410000
add edx, dword [ebp - 0x10]
mov edi, 0xced30341
xor dword [ebp - 0xc], 0x3ba4dffd
mov esi, dword [edx]
sub dword [ebp - 8], 0x88d803ae
sub esi, edi
sub dword [ebp - 8], esi
mov dword [ebx], esi
mov dword [ebp - 8], 0x1f1ace02
add ebx, 4
add edx, 0x8e4c13de
sub edx, 0x8e4c13da
loop 0x406227
add eax, 0x6ae354d6
add eax, 0x951d90ed
mov ebx, eax
add eax, 0x1ba4f077
add eax, 0xe45b0f8e
mov ecx, 0xf715cf6d
sub ecx, 0xf6d5cf6d
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x40dd13
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
mov esi, 0x100
push esi
lea eax, [ebp - 0x100]
push 0
push eax
call fcn.00422bf0
add esp, 0xc
lea eax, [ebp - 0x100]
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
lea eax, [ebp - 0x100]
test eax, eax
je 0x40dda5
cmp byte [ebp - 0x100], 0
je 0x40dda5
lea eax, [ebp - 0x100]
push eax
call fcn.00420900
inc eax
push eax
call fcn.0042064c
pop ecx
mov esi, eax
pop ecx
call fcn.004169b6
cmp eax, 1
lea eax, [ebp - 0x100]
push eax
jne 0x40dd99
call fcn.00420900
inc eax
push eax
lea eax, [ebp - 0x100]
push esi
push eax
call fcn.0040dcc7
add esp, 0x10
jmp 0x40dda1
push esi
call fcn.00420980
pop ecx
pop ecx
mov eax, esi
jmp 0x40dda7
xor eax, eax
pop esi
leave
ret
Function at 0x418780
Capabilities:
Check if file exists

Disassembly:
sub esp, 0xc
mov eax, 0x52
mov byte [esp], al
push esi
mov byte [esp + 5], 0x4e
mov byte [esp + 6], 0x42
mov byte [esp + 7], 0x4f
mov byte [esp + 8], 0x44
mov esi, dword [esp + 0x14]
mov byte [esp + 9], al
mov ax, word [esp + 0x18]
push 0
add al, 0x30
push 0x80
mov byte [esp + 0x13], al
push 3
lea ecx, [esp + 0x10]
push 0
push 3
mov dword [esi], 0
mov byte [esp + 0x1e], 0x56
mov byte [esp + 0x20], 0
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x41881c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
jb 0x4187f8
cmp eax, 3
jbe 0x418811
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x418806
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ax, 0x80b
pop esi
add esp, 0xc
ret 8
mov ax, 0x80c
pop esi
add esp, 0xc
ret 8
mov ax, 0x800
pop esi
add esp, 0xc
ret 8

Function at 0x418830
Capabilities:
Enumerate pe sections
Read file on windows
Write file on windows

Disassembly:
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x14]
push edi
mov word [esi + 6], 0xffff
push esi
call fcn.00419950
lea eax, [esp + 0xc]
push 0
mov edi, dword [esp + 0x18]
push eax
xor eax, eax
mov ecx, dword [edi]
mov ax, word [esi + 2]
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov ebx, eax
test ebx, ebx
je 0x418882
lea eax, [esp + 0xc]
push 0
push eax
mov ecx, dword [edi]
xor eax, eax
mov ax, word [esi + 2]
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov ebx, eax
push esi
call fcn.00419900
test ebx, ebx
je 0x418894
cmp word [esi + 6], 0xffff
jne 0x41889a
mov word [esi + 6], 0x83b
mov ax, word [esi + 6]
pop edi
pop esi
pop ebx
add esp, 4
ret 8

Function at 0x418cd0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
push esi
mov bx, word [esp + 0x4c]
mov esi, dword [esp + 0x50]
mov word [esi], 0
cmp bx, 4
jbe 0x418cf3
xor al, al
pop esi
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.004189b0
lea eax, [esp + 0x38]
push 0x10
push eax
call fcn.00418a10
lea eax, [esp + 0x18]
push 0x10
push eax
add bl, 0x31
call fcn.00418ab0
lea eax, [esp + 0x18]
push eax
call fcn.004162e0
lea ecx, [esp + 0x28]
lea edx, [esp + 8]
movzx eax, ax
push ecx
push 0x10
lea ecx, [esp + 0x40]
push edx
mov byte [esp + eax + 0x24], bl
push 0x51a1ac
lea eax, [esp + 0x28]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
test eax, eax
je 0x418d9f
lea eax, [esp + 8]
push 0x2c
push eax
call fcn.00418cb0
test ax, ax
je 0x418d69
movzx eax, ax
mov byte [esp + eax + 8], 0
cmp byte [esp + 8], 0x30
jne 0x418d8b
mov al, byte [esp + 9]
and al, 0xdf
cmp al, 0x58
jne 0x418d8b
lea eax, [esp + 0xa]
push esi
push eax
call fcn.004163e0
test al, al
jne 0x418d9f
jmp 0x418d9a
lea eax, [esp + 8]
push esi
push eax
call fcn.00416340
test al, al
jne 0x418d9f
mov word [esi], 0
mov ax, word [esi]
test ax, ax
je 0x418db7
cmp ax, 0xffff
je 0x418db7
mov al, 1
pop esi
pop ebx
add esp, 0x40
ret 8
xor al, al
pop esi
pop ebx
add esp, 0x40
ret 8
Function at 0x418dd0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
push esi
mov bx, word [esp + 0x4c]
mov esi, dword [esp + 0x50]
mov word [esi], 0
cmp bx, 4
jbe 0x418df3
xor al, al
pop esi
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.004189b0
lea eax, [esp + 0x38]
push 0x10
push eax
call fcn.00418a10
lea eax, [esp + 0x18]
push 0x10
push eax
add bl, 0x31
call fcn.00418ab0
lea eax, [esp + 0x18]
push eax
call fcn.004162e0
lea ecx, [esp + 0x28]
lea edx, [esp + 8]
movzx eax, ax
push ecx
push 0x10
lea ecx, [esp + 0x40]
push edx
mov byte [esp + eax + 0x24], bl
push 0x51a1ac
lea eax, [esp + 0x28]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
test eax, eax
je 0x418e9a
lea eax, [esp + 8]
push 0x2c
push eax
call fcn.00418cb0
test ax, ax
je 0x418e9a
movzx eax, ax
mov cl, byte [esp + eax + 9]
and cl, 0xdf
cmp cl, 0x54
jne 0x418e9a
cmp byte [esp + eax + 0xa], 0x3a
jne 0x418e9a
lea eax, [esp + eax + 0xb]
push esi
push eax
call fcn.00416340
test al, al
je 0x418e95
mov ax, word [esi]
cmp ax, 1
jl 0x418e95
cmp ax, 6
jle 0x418e9a
mov word [esi], 0
cmp word [esi], 1
pop esi
sbb al, al
pop ebx
inc al
add esp, 0x40
ret 8

Function at 0x418eb0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x50
lea eax, [esp]
push esi
push 0x10
push eax
call fcn.004189b0
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.00418a10
lea eax, [esp + 0x14]
push 0x10
push eax
call fcn.00418b70
lea eax, [esp + 0x44]
push 0x10
push eax
call fcn.00418b30
lea eax, [esp + 4]
lea ecx, [esp + 0x34]
lea edx, [esp + 0x14]
push eax
lea eax, [esp + 0x28]
push 0x10
push ecx
push 0x51a1ac
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
mov esi, eax
test esi, esi
je 0x418f20
lea eax, [esp + 0x34]
lea ecx, [esp + 0x44]
push eax
push ecx
call fcn.00416160
mov ecx, dword [esp + 0x5c]
mov byte [ecx], al
cmp esi, 1
pop esi
sbb al, al
add esp, 0x50
inc al
ret 8

Function at 0x418f30
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x30
lea eax, [esp]
push 0x10
push eax
call fcn.004189b0
lea eax, [esp + 0x20]
push 0x10
push eax
call fcn.00418a10
lea eax, [esp + 0x10]
push 0x10
push eax
call fcn.00418af0
lea eax, [esp]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push eax
push 0
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntA]
mov ecx, dword [esp + 0x34]
cmp eax, 1
mov word [ecx], ax
sbb cl, cl
add esp, 0x30
inc cl
mov al, cl
ret 4