joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003ebf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x10003ece
pop dword [ebp - 0x24]
mov eax, 0x3625458b
sub eax, 0x262506bd
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xdb586a30
add dword [ebp - 0x34], 0x72f9db1b
mov dword [ebp - 0x30], 0x8753679c
add dword [ebp - 0x30], 0xaadfe4a9
mov dword [ebp - 0x2c], 0x692edbc6
add dword [ebp - 0x2c], 0xe31d6868
mov dword [ebp - 0x28], 0x34c8e5e9
sub dword [ebp - 0x28], 0x34c8e5e9
lea eax, [ebp - 0x34]
push eax
mov eax, 0x65f25a95
sub eax, 0x55f20a51
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x4453ec41
sub dword [ebp - 0x34], 0xcfe182eb
mov dword [ebp - 0x30], 0xbcf2142f
sub dword [ebp - 0x30], 0x7b85b2ba
mov dword [ebp - 0x2c], 0xa921706e
add dword [ebp - 0x2c], 0xba4dfbfe
mov dword [ebp - 0x28], 0x2dfe615e
sub dword [ebp - 0x28], 0x2dfe615e
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x2eca5c98
add eax, 0xe135f3a8
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3bfe6
push 0
call eax
mov ecx, 0xe17913c2
sub ecx, 0xe178b651
xor esi, esi
add esi, eax
mov edi, 0xc7d4da1e
add edi, 0x482bdbe2
add edi, dword [ebp - 0x24]
mov ebx, 0x837c07e
sub ebx, 0x467d9922
mov dword [ebp - 0xc], 0x744947a
mov edx, dword [edi]
add dword [ebp - 0x10], 0xf506becd
xor edx, ebx
mov dword [esi], edx
add esi, 4
add edi, 4
loop 0x10003ff2
add eax, 0xe09a9608
sub eax, 0xe0992d71
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x29c25383
sub ecx, 0x19c25383
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x42153d
Capabilities:
Encode data using xor

Disassembly:
xor byte [eax - 0x2e], bl
dec edx
fistp dword [0xa2dc2ec8]
ror byte [edx - 0x25], cl
sbb eax, 0xa2dc2ec8
cwde
mov esi, 0x349e505e
sub ah, 0xd0
outsd dx, dword [esi]
and dword [ebp - 0x56], ebp
jge 0x42153b
invalid

Function at 0x4658bd
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
adc dword [esi - 0x69], edx
mov bh, 0x6d
loop 0x4657e6
mov bl, 0x36
or dword [ecx + esi + 0x385909ee], edx
xchg ebp, eax
ret 0x6983
push ebp
aam 0x78
out 0xc5, al
cdq
dec edi
inc esi
xchg ecx, eax
test al, 0xe9
test eax, 0x6d608d24
adc byte [ebp + 0x18216f62], bh
or edx, dword [edi - 0x5ec459cd]
test dword [ebx], edi
call ebx
jb 0x465824
xor dword [ebp + 0x43], ebp
jmp 0x4657b1
xchg edx, eax
jp 0x465869
pop edi
shr ecx, 0x93
stosb byte es:[edi], al
push edi
or byte [ecx], dl
add ebp, 0x8c92e4c6
invalid
loop 0x465840
xchg ebx, eax
jl 0x46580b
dec edi
fsub st(4), st(0)
pushal
jae 0x465871
dec esi
mov dword [esi - 0x6d], edx
cmp ecx, 0x7a
shr byte [ebx + 0x35], 1
push ebx
inc ebp
inc ebx
xor eax, 0xb9ae69ab
mov ch, 0x7b
add edi, dword [ecx + 0x33]
dec ecx
not dword [ebp - 9]
in al, 0x8b
cli
jae 0x465859
and eax, 0xc28634a2
cmc
invalid
lds ecx, [ebp + 0x56]
mov esi, 0x8519c498
add dh, byte [eax]
leave
jge 0x4658df
popal
xchg esi, eax
jmp 0x465872
mov ah, 0xd7
movsb byte es:[edi], byte [esi]
xchg esp, eax
mov bl, 0xf1
and dword [0x8b7397d5], 0xa6f357f5
mov ecx, 0xc5d173e7
push 0x35
mov ecx, 0x230add75
inc ebp
xor eax, dword [ebx + 0x66]
sub al, 0xf5
jge 0x4658fb
cmc
xchg ch, dl
invalid
Function at 0x469f63
Capabilities:
Encode data using xor

Disassembly:
mov ss, word [0x837f7565]
pushfd
pushfd
invalid
xchg eax, edx
ret 0xb172
jb 0x469ee6
fsub qword [esi + edi + 0x3c]
test byte [ebp + 0x76e3e574], bh
xchg dword [edx + 0x68f83af5], edx
movsd dword es:[edi], dword [esi]
sub byte [esi - 0x7bf11af2], 0xa9
inc eax
aas
mov ecx, 0xa86c5d9d
push ecx
sbb cl, ah
cmp byte [eax + 7], bh
jnp 0x469f60
pop esp
lcall 0xf6c4, 0xc5dd7b4
not byte [eax]
and eax, dword [eax]
pop ecx
std
xlatb
pop ebp
or al, 0xc4
not byte [eax]
and eax, dword [eax]
pop ecx
std
mov edi, 0xad8dc73a
std
mov dword [0xb8aa66b5], eax
cmp eax, 0x95f72165
imul byte [esi - 7]
dec edi
add eax, 0xd0a330e2
arpl word [edi + 0x2e], dx
xchg edx, eax
inc edx
shr dl, 1
js 0x46a009
mov edi, 0xe530e77b
cdq
lodsd eax, dword [esi]
xchg ebp, eax
pop ebx
mov byte [edi - 0x280a6ff2], ah
adc esp, edi
xor eax, 0xba97481f
mov ch, ch
pop ds
test al, 0xa8
pop esp
jp 0x469f33
outsb dx, byte [esi]
jecxz 0x469f30
xchg ebp, eax
and bl, ch
ret 0x1abc
scasb al, byte es:[edi]
rol edi, cl
popal
shl byte [ebp + 0x4fd59eee], cl
insb byte es:[edi], dx
or dword [ecx + eax*8 + 0xa], ebp
xor cl, ah
xor al, 0x20
fnstcw word [ecx - 0x2c9eeac1]
cmp byte [eax], bl
fbstp tbyte [edx - 0x19ad1e37]
or dword [esi + 0x5f], ecx
sbb bh, bl
mov dl, 0xc9
loope 0x46a061
out 9, al
dec esi
pop edi
cmc
and dword [eax - 0x1f], edi
insb byte es:[edi], dx
mov dword [0xc39db635], eax
cmp eax, 0x795bc2f0
cmp eax, 0xa62bd89e
jle 0x469fef
xor eax, 0x3dc39db6
invalid
xor dword es:[eax - 0x226669], ebx
and eax, 0x9049b739
and dword [ebp - 0x61dd26ff], esi
jge 0x46a03e
push edx
mov esi, 0x2ef67c07
push ds
lcall 0xaf56, 0x3df22194
cmp ch, byte [ecx]
cmp eax, 0x1beb4c41
mov byte [edx + 0x3f], ah
push ss
retf 0x696a
imul edx, eax, 0x239e17c6
imul ebp, dword [eax - 0x1364d906], 0xfffffff6
mov bl, 0x8a
push ebx
and bl, byte [edx - 0x58]
sal cl, cl
wait
in al, dx
div byte [ebx + 0x5a22538a]
test al, 0xd2
int1
pushfd
jae 0x46a058
cmp dword [ecx + 0x294e5b55], eax
jo 0x46a019
adc byte [ecx - 0x7da33a61], ch
sbb edi, dword [ebp + 0x50b9a3d4]
lcall 0xfaae, 0x2f4cded3
dec esp
das
scasb al, byte es:[edi]
cli
ror dword [ebx - 0xd8df039], 0xfe
adc al, 0xe6
daa
pushal
xchg byte [eax - 0x42], bh
daa
je 0x46a087
lodsd eax, dword [esi]
stosb byte es:[edi], al
fidiv dword [eax + 0x3395e4e0]
push eax
cmp byte [esi + 0x3724c27f], bl
add eax, 0x2c96467f
adc dword [ecx + ecx], esp
pop ss
in al, dx
invalid

Function at 0x46d574
Capabilities:
Encode data using xor

Disassembly:
inc ebx
insd dword es:[edi], dx
pop edi
mov ah, 0xf6
sbb bl, bh
mov ebp, 0xdeafabe7
adc byte [ebp - 0x33a9ee20], bl
std
dec ecx
jne 0x46d5f6
push esi
push 0x57
div dword [edi + 0x4a]
pop es
out 0x34, eax
and byte [edx + 0x4536d57], bl
mov al, 0xbe
inc ebp
aas
bound edx, qword [esi]
add al, 0xb0
mov esi, 0x623f45f3
push ss
sbb dword [ebx - 0x5b2e87d0], ebx
mov al, byte [0xc9153164]
inc edx
nop
xor dword [ebp + 0x3d], 0x81c5aa52
cld
pop esi
pop ebp
js 0x46d598
out 0x2a, al
int3
ljmp 0x293d:0xc511e283
Function at 0x47c45d
Capabilities:
Encode data using xor

Disassembly:
mov ch, 0xf
dec ebx
inc ecx
scasb al, byte es:[edi]
stc
mov dword [bx], eax
mov dh, 0xb3
sub bl, byte [ebp + 0x7292f7ab]
dec esi
xor esp, ebp
dec ebx
imul esp, dword [ecx - 0x3c63f918], 0x866a0c01
call 0x20b5ff8
or al, 0x6a
xchg dl, ah
invalid
sub eax, 0x6bd77a5e
invalid
push 0xfffffffffffffff1
jbe 0x47c3d6
adc al, 0x72
dec ebp
invalid
pop esi
jnp 0x47c46b
push ds
cwde
into
cdq
mov al, byte fs:[0x69c3b9cf]
lahf
add ah, bl
push edx
jbe 0x47c439
invalid

Function at 0x47f89d
Capabilities:
Encode data using xor

Disassembly:
fisubr dword cs:[edi]
push esp
inc esi
insd dword es:[edi], dx
sahf
cmp al, 0
aaa
aad 0x1a
jne 0x47f8e4
pop ebx
push ebx
mov dl, 0xf
invalid
lodsd eax, dword [esi]
sar dword [ebx + ebx*4 - 0x4a], 0x3e
mov dl, 0x6f
xor ch, 0xf1
push esi
cwde
xchg ebp, eax
fbstp tbyte [ecx + edx*8 + 0x5057dbbd]
cmp eax, 0xa67ebb4c
jg 0x47f8e4
iretd

Function at 0x4aab0d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 2
jne 0x4aab3f
movzx ecx, word [ebp + 8]
sar ecx, 8
push ecx
mov ecx, dword [ebp - 4]
call fcn.004aaa0d
movzx edx, byte [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.004aaa0d
jmp 0x4aac0e
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 1
jne 0x4aab6a
movzx ecx, byte [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.004aaa0d
movzx edx, word [ebp + 8]
sar edx, 8
push edx
mov ecx, dword [ebp - 4]
or bh, byte [eax - 0x76]
push es
push cs
xchg ebx, eax
fimul dword [esi - 0x48]
push edi
cmpsd dword [esi], dword es:[edi]
and al, 0x3a
inc edx
loope 0x4aab98
stosd dword es:[edi], eax
dec dword [ebx]
or al, 0x3a
std
push 0xffffffffffffffab
pop eax
sub ebp, dword gs:[ecx - 0x7a7961b2]
stosb byte es:[edi], al
dec ecx
mov dh, byte [ecx]
fisubr dword [esi + 0x2a]
inc esi
sar byte [eax], cl
invalid
push eax
xor eax, ecx
mov byte [0x899e6407], al
mov bh, byte [ecx + 0x48165d6a]
jp 0x4aab6d
lds esp, [esi]
and al, 0xb
and al, 0xb
jae 0x4aaba7
rol eax, cl
dec edi
mov dh, bl
ljmp 0xa4d
dec byte [edi]
adc dh, ch
fsubrp st(3)
cmp ecx, eax
wait
ror byte [ebx + 0x7cfacb5a], 0xb7
jl 0x4aabd6

Function at 0x4aba9d
Capabilities:
Encode data using xor

Disassembly:
fst dword [ebx]
dec ebx
lodsb al, byte [esi]
sbb dword [esi + 0x3f5f06b], ebp
in eax, 0xd7
cmp dh, byte [eax + 0x6dc8682e]
mov bl, 0x7a
mov ebx, 0x2271e67a
bound ebp, qword [edx]
and ch, byte [eax + 0x25955a6b]
push ds
xor ch, cl
imul ebp, dword [esi + 0x5b], 0xffffffaa
xchg edx, eax
stosb byte es:[edi], al
sbb ch, 0x4e
push 0xffffffffffffffb2
or al, 9
xor eax, 0x3cbe13fa
sbb esp, dword [ebx + 0x3e577e7]
xchg esi, eax
ficomp word [esi + 0x13292ea5]
out 0xe6, al
add eax, 0x2b1acecf
stosb byte es:[edi], al
pop es
imul esp, dword [ebp + ebp*8 + 0x7bec3307], 0x18
or dh, bl
test eax, ebx
jle 0x4aba9f
mov cl, bh
in eax, 0xf3
test al, 0x6c
sbb edx, dword [edx]
sal al, cl
retf
Function at 0x4bae67
Capabilities:
Check os version
Query environment variable

Disassembly:
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4bae96
cmp dword [ebp - 0x88], 2
jne 0x4bae96
cmp dword [ebp - 0x94], 5
jb 0x4bae96
push 1
pop eax
jmp 0x4baf98
lea eax, [ebp - 0x122c]
push 0x1090
push eax
push str.__MSVCRT_HEAP_SELECT
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x4baf85
xor ebx, ebx
lea ecx, [ebp - 0x122c]
cmp byte [ebp - 0x122c], bl
je 0x4baed8
mov al, byte [ecx]
cmp al, 0x61
jl 0x4baed3
cmp al, 0x7a
jg 0x4baed3
sub al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], bl
jne 0x4baec5
lea eax, [ebp - 0x122c]
push 0x16
push eax
push str.__GLOBAL_HEAP_SELECTED
call fcn.004bce00
add esp, 0xc
test eax, eax
jne 0x4baefa
lea eax, [ebp - 0x122c]
jmp 0x4baf43
lea eax, [ebp - 0x19c]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [ebp - 0x19c], bl
lea ecx, [ebp - 0x19c]
je 0x4baf2e
mov al, byte [ecx]
cmp al, 0x61
jl 0x4baf29
cmp al, 0x7a
jg 0x4baf29
sub al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], bl
jne 0x4baf1b
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x122c]
push eax
call fcn.004bcd80
pop ecx
pop ecx
cmp eax, ebx
je 0x4baf85
push 0x2c
push eax
call fcn.004bccc0
pop ecx
cmp eax, ebx
pop ecx
je 0x4baf85
inc eax
mov ecx, eax
cmp byte [eax], bl
je 0x4baf6a
cmp byte [ecx], 0x3b
jne 0x4baf65
mov byte [ecx], bl
jmp 0x4baf66
inc ecx
cmp byte [ecx], bl
jne 0x4baf5c
push 0xa
push ebx
push eax
call fcn.004bca92
add esp, 0xc
cmp eax, 2
je 0x4baf98
cmp eax, 3
je 0x4baf98
cmp eax, 1
je 0x4baf98
lea eax, [ebp - 4]
push eax
call fcn.004bae26
cmp byte [ebp - 4], 6
pop ecx
sbb eax, eax
add eax, 3
pop ebx
leave
ret
Function at 0x4bb031
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c2390
cmp edx, dword [eax]
je 0x4bb053
add eax, 8
inc ecx
cmp eax, 0x4c2420
jl 0x4bb044
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c2390]
jne 0x4bb181
mov eax, dword [0x4c6d1c]
cmp eax, 1
je 0x4bb15b
test eax, eax
jne 0x4bb084
cmp dword [0x4c22bc], 1
je 0x4bb15b
cmp edx, 0xfc
je 0x4bb181
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb0bb
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bba10
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bbea0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb0fe
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bbea0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c072c
push edi
call fcn.004bdd70
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bba10
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bba20
lea eax, [ebp - 0xa0]
push 0x4c070c
push eax
call fcn.004bba20
push dword [esi + 0x4c2394]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bba20
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bdce4
add esp, 0x2c
pop edi
jmp 0x4bb181
lea eax, [ebp + 8]
lea esi, [esi + 0x4c2394]
push 0
push eax
push dword [esi]
call fcn.004bbea0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4036e1
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x403afd
push ecx
lfence
call fcn.00451b13
pop ecx
mov ecx, eax
test ecx, ecx
je 0x403710
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
lfence
mov dword [eax - 4], ecx
pop ebp
ret
jmp fcn.00461969
push ebp
mov ebp, esp
sub esp, 0xc
lea ecx, [ebp - 0xc]
call fcn.0040392b
push 0x4d4568
lea eax, [ebp - 0xc]
push eax
call fcn.0045438b
int3
Function at 0x4076a6
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.0040dd4f
test eax, eax
je 0x4076e7
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push 0
push 0xffffffffffffffff
push eax
push dword [ebp + 8]
call fcn.0040d431
add esp, 0x10
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push dword [ebp - 4]
mov esi, eax
call fcn.00451c94
pop ecx
mov eax, esi
pop esi
leave
ret
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
leave
ret

Function at 0x4079e6
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.0040dd4f
test eax, eax
je 0x407a24
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push 0
push 0xffffffffffffffff
push eax
push dword [ebp + 8]
call fcn.0040d431
add esp, 0x10
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 4]
mov esi, eax
call fcn.00451c94
pop ecx
mov eax, esi
pop esi
leave
ret
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
leave
ret

Function at 0x409680
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.0040dd4f
test eax, eax
je 0x4096fd
mov eax, dword [ebp + 0x10]
xor ecx, ecx
push ebx
push esi
push edi
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00451c8b
xor ebx, ebx
mov edi, eax
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push dword [ebp + 8]
call fcn.0040d431
add esp, 0x14
push dword [ebp + 0x10]
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push ebx
push ebx
push dword [ebp + 0x10]
mov esi, eax
push dword [ebp + 0xc]
push 0xffffffffffffffff
push edi
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
call fcn.00451c94
push dword [ebp - 4]
call fcn.00451c94
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
leave
ret

Function at 0x4097a4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.0040dd4f
test eax, eax
je 0x4097ea
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push 0
push 0xffffffffffffffff
push eax
push dword [ebp + 8]
call fcn.0040d431
add esp, 0x10
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.VERSION.dll_GetFileVersionInfoW
push dword [ebp - 4]
mov esi, eax
call fcn.00451c94
pop ecx
mov eax, esi
pop esi
leave
ret
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
leave
ret
Function at 0x409bf5
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.0040dd4f
test eax, eax
je 0x409c83
push esi
push 0xffffffffffffffff
lea eax, [ebp - 4]
xor esi, esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call fcn.0040d2ca
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
call fcn.0040d2ca
push esi
push 0xffffffffffffffff
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x14]
call fcn.0040d431
mov esi, dword [ebp - 0xc]
add esp, 0x28
push esi
push dword [ebp + 0x10]
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [ebp - 4], 0
mov dword [ebp - 0xc], eax
je 0x409c63
push dword [ebp - 4]
call fcn.00451c94
pop ecx
cmp dword [ebp - 8], 0
je 0x409c72
push dword [ebp - 8]
call fcn.00451c94
pop ecx
test esi, esi
je 0x409c7d
push esi
call fcn.00451c94
pop ecx
mov eax, dword [ebp - 0xc]
pop esi
leave
ret
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
leave
ret

Function at 0x409c97
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.0040dd4f
test eax, eax
je 0x409d94
push esi
push edi
or esi, 0xffffffff
lea eax, [ebp - 4]
push esi
xor edi, edi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], edi
call fcn.0040d2ca
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
call fcn.0040d2ca
push esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
call fcn.0040d2ca
push edi
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x1c]
call fcn.0040d431
mov eax, dword [ebp + 0x18]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00451c8b
mov edi, dword [ebp - 0x10]
add esp, 0x38
mov esi, eax
xor eax, eax
push edi
push dword [ebp + 0x18]
mov word [esi], ax
push esi
push dword [ebp + 0x10]
call fcn.00464400
pop ecx
test eax, eax
mov ecx, 0x4b845c
cmovne ecx, dword [ebp - 0xc]
push ecx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
push eax
push esi
call fcn.0040d4ea
push esi
call fcn.00451c94
add esp, 0x10
cmp dword [ebp - 4], 0
je 0x409d64
push dword [ebp - 4]
call fcn.00451c94
pop ecx
cmp dword [ebp - 8], 0
je 0x409d73
push dword [ebp - 8]
call fcn.00451c94
pop ecx
cmp dword [ebp - 0xc], 0
je 0x409d82
push dword [ebp - 0xc]
call fcn.00451c94
pop ecx
test edi, edi
je 0x409d8d
push edi
call fcn.00451c94
pop ecx
mov eax, dword [ebp - 0x10]
pop edi
pop esi
leave
ret
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
leave
ret
Function at 0x40a1b1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
call fcn.0040dd4f
test eax, eax
je 0x40a208
mov eax, dword [ebp + 8]
xor ecx, ecx
push esi
push edi
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00451c8b
pop ecx
mov esi, eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
push dword [ebp + 8]
mov edi, eax
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.0040d58a
add esp, 0x10
test esi, esi
je 0x40a202
push esi
call fcn.00451c94
pop ecx
mov eax, edi
pop edi
pop esi
pop ebp
ret
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
pop ebp
ret

Function at 0x40a575
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0040dd4f
test eax, eax
jne 0x40a5d2
mov edi, dword [ebp + 0x10]
push ebx
push edi
call fcn.00451c8b
pop ecx
push edi
mov esi, eax
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push edi
push esi
mov dword [ebp - 4], eax
call fcn.0040d240
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x40a5c1
push edi
push ebx
push dword [ebp + 0xc]
call fcn.004645d0
push ebx
call fcn.00451c94
add esp, 0x10
pop ebx
test esi, esi
je 0x40a5cd
push esi
call fcn.00451c94
pop ecx
mov eax, dword [ebp - 4]
jmp 0x40a61d
mov eax, dword [ebp + 0x10]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00451c8b
pop ecx
push dword [ebp + 0x10]
mov edi, eax
push edi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, eax
xor eax, eax
push eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xffffffffffffffff
push edi
push eax
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
call fcn.00451c94
pop ecx
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x40ae1d
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
call fcn.0040dd4f
test eax, eax
je 0x40ae8a
push esi
push edi
xor esi, esi
lea eax, [ebp - 4]
push esi
push 0xffffffffffffffff
push eax
push dword [ebp + 8]
mov dword [ebp - 4], esi
call fcn.0040d431
add esp, 0x10
mov dword [ebp - 8], esi
cmp dword [ebp + 0xc], esi
je 0x40ae61
push esi
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
call fcn.0040d431
mov esi, dword [ebp - 8]
add esp, 0x10
push dword [ebp + 0x10]
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push dword [ebp - 4]
mov edi, eax
call fcn.00451c94
pop ecx
test esi, esi
je 0x40ae84
push esi
call fcn.00451c94
pop ecx
mov eax, edi
pop edi
pop esi
leave
ret
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
leave
ret