joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40dfb0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46173b
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x4775a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, ecx
cmp dword [esi + 0x6c], 0
mov dword [ebp - 0x224], eax
je 0x40e14c
push 0x466a80
lea ecx, [ebp - 0x274]
call fcn.00402de0
push edi
push 0x104
lea edx, [ebp - 0x220]
push edx
push 0x46e670
push str.EadIpv6Addr
lea ecx, [ebp - 0x274]
push 0x468374
mov dword [ebp - 4], 0
mov dword [esi + 0x6c], ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x220]
push eax
push str.eadIpv6Addr
mov ecx, esi
call fcn.00406dc0
push str..MaxUserCtrl
push 0x468374
lea ecx, [ebp - 0x118]
push 0x46817c
push ecx
call fcn.0043ce2a
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
add esp, 0x10
push edi
push 0xffffffffffffffff
lea edx, [ebp - 0x118]
push edx
push str.Common
call ebx
cmp eax, 0xffffffff
je 0x40e092
push eax
push str.MaxUserCtrl
mov ecx, esi
call fcn.00407040
push str..ProbationCtrl
push 0x468374
lea eax, [ebp - 0x118]
push 0x46817c
push eax
call fcn.0043ce2a
add esp, 0x10
push edi
push 0xffffffffffffffff
lea ecx, [ebp - 0x118]
push ecx
push str.Common
call ebx
cmp eax, 0xffffffff
je 0x40e0d3
push eax
push str.ProbationCtrl
mov ecx, esi
call fcn.00407040
push str..TimeStamp
push 0x468374
lea edx, [ebp - 0x118]
push 0x46817c
push edx
call fcn.0043ce2a
add esp, 0x10
push edi
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0x46e670
lea ecx, [ebp - 0x118]
push ecx
push str.Common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x220]
push edx
push str.TimeStamp
mov ecx, esi
call fcn.00406dc0
mov ecx, dword [ebp - 0x224]
lea eax, [ebp - 0x274]
push eax
call fcn.00402720
lea ecx, [ebp - 0x274]
mov dword [ebp - 4], 0xffffffff
call fcn.00402fa0
push 1
mov ecx, esi
call fcn.00407280
movzx eax, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043bde4
mov esp, ebp
pop ebp
ret 8
Function at 0x40e180
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46177b
mov eax, dword fs:[0]
push eax
sub esp, 0x160
mov eax, dword [0x4775a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, ecx
cmp dword [esi + 0x6c], 0
mov dword [ebp - 0x11c], eax
je 0x40e2ba
push 0x466a0c
lea ecx, [ebp - 0x16c]
call fcn.00402de0
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push edi
push 0x104
lea edx, [ebp - 0x118]
push edx
push 0x46e670
push str.DAMIP
lea ecx, [ebp - 0x16c]
push 0x4683a0
mov dword [ebp - 4], 0
mov dword [esi + 0x6c], ecx
call ebx
lea eax, [ebp - 0x118]
push eax
push str.damIP
mov ecx, esi
call fcn.00406dc0
push edi
push 0x104
lea ecx, [ebp - 0x118]
push ecx
push 0x46e670
push str.DAMIPv6
push 0x4683a0
call ebx
lea edx, [ebp - 0x118]
push edx
push str.damIPv6
mov ecx, esi
call fcn.00406dc0
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push edi
push 0xffffffffffffffff
push str.DAMPort
push 0x4683a0
call ebx
cmp eax, 0xffffffff
je 0x40e275
push eax
push str.damPort
mov ecx, esi
call fcn.00407040
push edi
push 0xffffffffffffffff
push str.Customize
push 0x4683a0
call ebx
cmp eax, 0xffffffff
je 0x40e296
push eax
push str.customize
mov ecx, esi
call fcn.00407040
mov ecx, dword [ebp - 0x11c]
lea eax, [ebp - 0x16c]
push eax
call fcn.00402720
lea ecx, [ebp - 0x16c]
mov dword [ebp - 4], 0xffffffff
call fcn.00402fa0
push 1
mov ecx, esi
call fcn.00407280
movzx eax, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043bde4
mov esp, ebp
pop ebp
ret 8
Function at 0x40eb10
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4618b6
mov eax, dword fs:[0]
push eax
sub esp, 0x2bc
mov eax, dword [0x4775a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, ecx
mov eax, dword [edi + 0x6c]
xor ebx, ebx
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x224], eax
cmp eax, ebx
je 0x40ec6c
push str.exceptDevs
lea ecx, [ebp - 0x278]
call fcn.00402de0
push esi
push 0xffffffffffffffff
push str.DevsCount
lea eax, [ebp - 0x278]
push str.ExceptDevs
mov dword [ebp - 4], ebx
mov dword [edi + 0x6c], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 0xffffffff
je 0x40eb92
mov ebx, eax
xor esi, esi
test ebx, ebx
je 0x40ec3e
lea esp, [esp]
push str.devItem
lea ecx, [ebp - 0x2c8]
call fcn.00402de0
push esi
push str.DevName.
lea edx, [ebp - 0x118]
lea ecx, [ebp - 0x2c8]
push 0x4684d4
push edx
mov byte [ebp - 4], 1
mov dword [edi + 0x6c], ecx
call fcn.0043ce2a
mov eax, dword [ebp - 0x228]
add esp, 0x10
push eax
push 0x104
lea ecx, [ebp - 0x220]
push ecx
push 0x46e670
lea edx, [ebp - 0x118]
push edx
push str.ExceptDevs
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x220]
push eax
push str.devName
mov ecx, edi
call fcn.00406e90
lea ecx, [ebp - 0x2c8]
push ecx
lea ecx, [ebp - 0x278]
call fcn.00402720
lea ecx, [ebp - 0x2c8]
mov byte [ebp - 4], 0
call fcn.00402fa0
inc esi
cmp esi, ebx
jb 0x40eba0
mov esi, dword [ebp - 0x224]
lea edx, [ebp - 0x278]
mov eax, edx
push eax
mov ecx, esi
mov dword [edi + 0x6c], edx
call fcn.00402720
lea ecx, [ebp - 0x278]
mov dword [edi + 0x6c], esi
mov dword [ebp - 4], 0xffffffff
call fcn.00402fa0
push 1
mov ecx, edi
call fcn.00407280
movzx eax, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043bde4
mov esp, ebp
pop ebp
ret 4
Function at 0x40ee20
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46192b
mov eax, dword fs:[0]
push eax
sub esp, 0x160
mov eax, dword [0x4775a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
push 0xffffffffffffffff
push str.FuncComponents
push str.Components
mov edi, ecx
mov dword [ebp - 0x11c], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp dword [edi + 0x6c], 0
mov esi, eax
je 0x40ef57
push str.smartCard
lea ecx, [ebp - 0x16c]
call fcn.00402de0
lea ecx, [ebp - 0x16c]
and esi, 0xa
push esi
mov dword [edi + 0x6c], ecx
push str.type
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.00407040
push str..MaxUserCtrl
push str.SmartCard
lea edx, [ebp - 0x118]
push 0x46817c
push edx
call fcn.0043ce2a
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
add esp, 0x10
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x118]
push eax
push str.Common
call esi
cmp eax, 0xffffffff
je 0x40eef2
push eax
push str.MaxUserCtrl
mov ecx, edi
call fcn.00407040
push str..ProbationCtrl
push str.SmartCard
lea ecx, [ebp - 0x118]
push 0x46817c
push ecx
call fcn.0043ce2a
add esp, 0x10
push ebx
push 0xffffffffffffffff
lea edx, [ebp - 0x118]
push edx
push str.Common
call esi
cmp eax, 0xffffffff
je 0x40ef33
push eax
push str.ProbationCtrl
mov ecx, edi
call fcn.00407040
mov ecx, dword [ebp - 0x11c]
lea eax, [ebp - 0x16c]
push eax
call fcn.00402720
lea ecx, [ebp - 0x16c]
mov dword [ebp - 4], 0xffffffff
call fcn.00402fa0
push 1
mov ecx, edi
call fcn.00407280
movzx eax, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043bde4
mov esp, ebp
pop ebp
ret 8
Function at 0x410a20
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x461a88
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push ebx
push esi
push edi
mov eax, dword [0x4775a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x6c]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x410aee
push str.protoComponent
lea ecx, [ebp - 0x60]
call fcn.00402de0
mov edi, dword [ebp + 8]
push edi
push 0xffffffffffffffff
push str.ProtoComponents
lea eax, [ebp - 0x60]
push str.Components
mov dword [ebp - 4], 0
mov dword [esi + 0x6c], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebx, eax
test bl, 1
je 0x410a9b
lea ecx, [ebp - 0x60]
push ecx
push edi
mov ecx, esi
call fcn.0040c8d0
test bl, 2
je 0x410aac
lea edx, [ebp - 0x60]
push edx
push edi
mov ecx, esi
call fcn.0040cd30
test bl, 4
je 0x410abd
lea eax, [ebp - 0x60]
push eax
push edi
mov ecx, esi
call fcn.0040f0d0
test bl, 8
je 0x410ace
lea ecx, [ebp - 0x60]
push ecx
push edi
mov ecx, esi
call fcn.0040d920
mov edi, dword [ebp - 0x10]
lea edx, [ebp - 0x60]
push edx
mov ecx, edi
call fcn.00402720
lea ecx, [ebp - 0x60]
mov dword [esi + 0x6c], edi
mov dword [ebp - 4], 0xffffffff
call fcn.00402fa0
push 1
mov ecx, esi
call fcn.00407280
movzx eax, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x410b10
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x461ab8
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [0x4775a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x6c], 0
je 0x410bdf
mov edi, dword [ebp + 8]
push edi
push 0xffffffffffffffff
push str.FuncComponents
push str.Components
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebx, eax
mov eax, dword [esi + 0x6c]
push str.funcComponent
lea ecx, [ebp - 0x5c]
mov dword [ebp + 8], eax
call fcn.00402de0
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 0
mov dword [esi + 0x6c], ecx
test bl, 1
je 0x410b8c
mov edx, ecx
push edx
push edi
mov ecx, esi
call fcn.0040dfb0
test bl, 4
je 0x410b9d
lea eax, [ebp - 0x5c]
push eax
push edi
mov ecx, esi
call fcn.0040e180
test bl, 0x10
je 0x410bae
lea ecx, [ebp - 0x5c]
push ecx
push edi
mov ecx, esi
call fcn.0040e2f0
test bl, 0xa
je 0x410bbf
lea edx, [ebp - 0x5c]
push edx
push edi
mov ecx, esi
call fcn.0040ee20
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x5c]
push eax
mov ecx, edi
call fcn.00402720
lea ecx, [ebp - 0x5c]
mov dword [esi + 0x6c], edi
mov dword [ebp - 4], 0xffffffff
call fcn.00402fa0
push 1
mov ecx, esi
call fcn.00407280
movzx eax, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41ec10
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x463053
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4775a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push 0xffffffffffffffff
push 0
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
push edi
mov byte [esi], 0
call fcn.00407b80
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov ecx, dword [edi + 0x20]
mov dword [esi + 0x20], ecx
mov edx, dword [edi + 0x24]
mov dword [esi + 0x24], edx
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
mov edx, dword [edi + 0x30]
mov dword [esi + 0x30], edx
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov ecx, dword [edi + 0x38]
mov dword [esi + 0x38], ecx
mov edx, dword [edi + 0x3c]
mov dword [esi + 0x3c], edx
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x44], ecx
mov edx, dword [edi + 0x48]
mov dword [esi + 0x48], edx
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
mov ecx, dword [edi + 0x50]
lea edx, [edi + 0x54]
mov dword [esi + 0x50], ecx
push edx
lea ecx, [esi + 0x54]
mov dword [ebp - 4], 0
call fcn.0041e3b0
mov eax, dword [edi + 0x60]
add edi, 0x64
push edi
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 1
mov dword [esi + 0x60], eax
call fcn.0041e3b0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x423ef0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x424a20
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
jle 0x424b0f
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
push edi
movzx ecx, byte [edx]
dec ebx
inc edx
mov dword [ebp + 0x10], ebx
test ebx, ebx
jle 0x424ad5
movzx esi, byte [edx]
dec ebx
inc edx
mov dword [ebp + 0x10], ebx
test ebx, ebx
jle 0x424a9f
movzx edi, byte [edx]
dec ebx
mov dword [ebp + 0x10], ebx
mov ebx, ecx
shr ebx, 2
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__cccbccc]
mov byte [eax], bl
and ecx, 3
add ecx, ecx
mov ebx, esi
shr ebx, 4
movzx ecx, byte [ebx + ecx*8 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__cccbccc]
mov byte [eax + 1], cl
mov ecx, edi
shr ecx, 6
and esi, 0xf
movzx ecx, byte [ecx + esi*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__cccbccc]
inc edx
mov byte [eax + 2], cl
and edi, 0x3f
movzx ecx, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__cccbccc]
mov byte [eax + 3], cl
jmp 0x424af7
mov edi, ecx
shr edi, 2
mov bl, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__cccbccc]
and ecx, 3
mov byte [eax], bl
mov edi, esi
add ecx, ecx
shr edi, 4
movzx ecx, byte [edi + ecx*8 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__cccbccc]
mov byte [eax + 1], cl
and esi, 0xf
movzx ecx, byte [esi*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__cccbccc]
mov byte [eax + 2], cl
mov byte [eax + 3], 0x3d
jmp 0x424af7
mov esi, ecx
shr esi, 2
mov bl, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__cccbccc]
and ecx, 3
mov byte [eax], bl
shl ecx, 4
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__cccbccc]
mov byte [eax + 1], cl
mov word [eax + 2], 0x3d3d
mov ebx, dword [ebp + 0x10]
add eax, 4
test ebx, ebx
jg 0x424a37
pop edi
pop esi
mov byte [eax], 0
xor eax, eax
pop ebx
pop ebp
ret
mov edx, dword [ebp + 0xc]
mov byte [edx], 0
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x424e50
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
push ebx
push esi
mov esi, dword [ecx + 4]
mov ecx, eax
shr ecx, 4
xor ecx, esi
and ecx, 0xf0f0f0f
xor esi, ecx
shl ecx, 4
xor eax, ecx
mov ecx, eax
shr ecx, 0x10
xor ecx, esi
and ecx, 0xffff
xor esi, ecx
shl ecx, 0x10
xor eax, ecx
mov ecx, esi
shr ecx, 2
xor ecx, eax
and ecx, 0x33333333
xor eax, ecx
add ecx, ecx
add ecx, ecx
xor esi, ecx
mov ecx, esi
shr ecx, 8
xor ecx, eax
and ecx, 0xff00ff
xor eax, ecx
shl ecx, 8
xor ecx, esi
rol ecx, 1
mov esi, ecx
xor esi, eax
and esi, 0xaaaaaaaa
xor ecx, esi
xor esi, eax
push edi
rol esi, 1
mov dword [ebp - 4], 8
lea esp, [esp]
mov eax, ecx
ror eax, 4
xor eax, dword [edx]
add edx, 0x10
mov edi, eax
shr edi, 0x18
and edi, 0x3f
mov edi, dword [edi*4 + 0x4690b0]
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
xor edi, dword [ebx*4 + 0x4692b0]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
xor edi, dword [ebx*4 + 0x4694b0]
and eax, 0x3f
xor edi, dword [eax*4 + 0x4696b0]
mov eax, dword [edx - 0xc]
xor esi, edi
xor eax, ecx
mov edi, eax
shr edi, 0x18
and edi, 0x3f
mov edi, dword [edi*4 + 0x4691b0]
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
xor edi, dword [ebx*4 + 0x4693b0]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
xor edi, dword [ebx*4 + 0x4695b0]
and eax, 0x3f
xor edi, dword [eax*4 + 0x4697b0]
xor esi, edi
mov eax, esi
ror eax, 4
xor eax, dword [edx - 8]
mov edi, eax
shr edi, 0x18
and edi, 0x3f
mov edi, dword [edi*4 + 0x4690b0]
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
xor edi, dword [ebx*4 + 0x4692b0]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
xor edi, dword [ebx*4 + 0x4694b0]
and eax, 0x3f
xor edi, dword [eax*4 + 0x4696b0]
mov eax, dword [edx - 4]
xor ecx, edi
xor eax, esi
mov edi, eax
shr edi, 0x18
and edi, 0x3f
mov edi, dword [edi*4 + 0x4691b0]
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
xor edi, dword [ebx*4 + 0x4693b0]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
xor edi, dword [ebx*4 + 0x4695b0]
and eax, 0x3f
xor edi, dword [eax*4 + 0x4697b0]
xor ecx, edi
dec dword [ebp - 4]
jne 0x424ed0
ror ecx, 1
mov eax, ecx
xor eax, esi
and eax, 0xaaaaaaaa
xor ecx, eax
xor eax, esi
ror eax, 1
mov edx, eax
shr edx, 8
xor edx, ecx
and edx, 0xff00ff
xor ecx, edx
shl edx, 8
xor eax, edx
mov edx, eax
shr edx, 2
xor edx, ecx
and edx, 0x33333333
xor ecx, edx
add edx, edx
add edx, edx
xor eax, edx
mov edx, ecx
shr edx, 0x10
xor edx, eax
and edx, 0xffff
xor eax, edx
shl edx, 0x10
xor ecx, edx
mov edx, ecx
shr edx, 4
xor edx, eax
and edx, 0xf0f0f0f
mov esi, edx
shl esi, 4
xor esi, ecx
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx], esi
xor edx, eax
pop esi
mov dword [ecx + 4], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425a50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
jne 0x425a65
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [ebp + 0x14]
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x425a5e
mov edx, dword [ebp + 0x10]
mov eax, 4
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x14]
push esi
lea ecx, [ebp - 8]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp + 0x14]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x425b20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x4775a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
jne 0x425b57
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043bde4
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x10c]
push edx
push 1
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x425b45
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 0x10c]
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x114]
push edx
push 0
push esi
push eax
mov dword [ebp - 0x114], 2
mov dword [ebp - 0x110], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x10c]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x425b45
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x425bc3
sub eax, edx
cmp dword [ebp + 0x18], eax
jb 0x425b45
lea eax, [ebp - 0x108]
mov edx, edi
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x425be1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0043bde4
mov esp, ebp
pop ebp
ret

Function at 0x425fe0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0x104
jae 0x426003
mov eax, dword [ebp + 8]
push 0
push str.the_len_in_is_too_small
push eax
call fcn.004269e0
add esp, 0xc
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
push 0x105
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
dec eax
cmp eax, 0x103
ja 0x426027
mov byte [esi + 1], 0
mov eax, 1
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4294a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x4775a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x88], eax
test esi, esi
je 0x429544
test edi, edi
je 0x429544
test ebx, ebx
je 0x429544
test eax, eax
je 0x429544
cmp dword [ebp + 0x18], 0x80
jbe 0x429544
push 0x80
lea eax, [ebp - 0x84]
push 0
push eax
call fcn.0043cdb0
add esp, 0xc
push esi
push 0x80
lea ecx, [ebp - 0x84]
push ecx
push 0x46e670
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, eax
test esi, esi
je 0x429531
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x88]
push edx
lea eax, [ebp - 0x84]
push eax
push ecx
call fcn.0043d120
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043bde4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0043bde4
mov esp, ebp
pop ebp
ret

Function at 0x429560
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4775a8]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push esi
mov byte [ebp - 0x24], 0
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
call fcn.00432840
add esp, 4
test eax, eax
je 0x429628
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x2c]
push ecx
push esi
call fcn.00437800
add esp, 0xc
test eax, eax
je 0x429628
cmp dword [ebp - 0x2c], 0
jne 0x429628
cmp dword [ebp - 0x28], 0x220
jb 0x429628
push 0x46e6c4
push esi
call fcn.0043dbaa
mov esi, eax
add esp, 8
test esi, esi
je 0x429628
push 0
push 0x200
push esi
call fcn.0043da72
push esi
push 0x20
lea edx, [ebp - 0x24]
push 1
push edx
call fcn.0043d7d2
push esi
call fcn.0043d4f7
add esp, 0x20
mov ecx, 8
lea esi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043bde4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0043bde4
mov esp, ebp
pop ebp
ret