joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446060
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x50d080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
test esi, esi
je 0x446092
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x446092
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x44617c
push edi
mov edi, ebx
mov ecx, ebx
mov edx, eax
cmp dx, 0x2f
je 0x4460b1
cmp dx, 0x5c
jne 0x4460b3
mov edi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x4460a5
cmp edi, ebx
je 0x4460fe
sub edi, ebx
lea eax, [ebp - 0x414]
and edi, 0xfffffffe
push edi
push ebx
push eax
call fcn.0047e6d0
add esp, 0xc
cmp edi, 0x208
jae 0x44618c
xor eax, eax
lea edx, [ebp - 0x414]
mov ecx, esi
mov word [ebp + edi - 0x414], ax
call fcn.00446060
xor eax, eax
mov word [ebp - 0x20c], ax
test esi, esi
je 0x446123
lea ecx, [ebp - 0x20c]
sub ecx, esi
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x446113
mov esi, ebx
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x446125
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x446140
mov ecx, ebx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop edi
cmp eax, 0xffffffff
jne 0x44617c
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0047cdd2
mov esp, ebp
pop ebp
ret
call fcn.0047d80e
int3
Function at 0x456d10
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [edx + 0x14]
push ebx
movzx ebx, word [edx + 6]
add eax, 0x18
push esi
add eax, edx
xor esi, esi
push edi
mov edi, ecx
test ebx, ebx
je 0x456d48
nop dword [eax + eax]
mov edx, dword [eax + 0xc]
cmp edi, edx
jb 0x456d40
mov ecx, dword [eax + 8]
add ecx, edx
cmp edi, ecx
jb 0x456d4f
inc esi
add eax, 0x28
cmp esi, ebx
jb 0x456d30
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
mov eax, dword [eax + 0x14]
sub eax, edx
add eax, edi
add eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x456d60
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push dword [ebp + 8]
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 4], edi
cmp edi, 0xffffffff
je 0x456e4b
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 8], eax
test eax, eax
je 0x456e44
push esi
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x456e3a
mov eax, 0x5a4d
cmp ax, word [esi]
jne 0x456e33
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi], 0x4550
jne 0x456e30
push dword [ebp + 0xc]
mov edx, edi
mov ecx, esi
call fcn.004571e0
add esp, 4
test al, al
je 0x456df3
mov bl, 1
jmp 0x456e30
mov ecx, dword [edi + 0x88]
test ecx, ecx
je 0x456e30
push esi
mov edx, edi
call fcn.00456d10
mov edx, dword [ebp + 0xc]
mov ecx, edi
add edx, 0x18
push edx
push 0x69
push 0x4fed64
push 0
push eax
push eax
mov edx, esi
call fcn.00456e60
add esp, 0x1c
movzx ebx, bl
test al, al
mov ecx, 1
cmovne ebx, ecx
mov edi, dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4571e0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, word [edx + 0x14]
push ebx
movzx ebx, word [edx + 6]
push esi
lea esi, [edx + 0x18]
mov dword [ebp - 0xc], ecx
add esi, eax
xor cl, cl
push edi
xor eax, eax
mov byte [ebp - 1], cl
xor edi, edi
test ebx, ebx
je 0x45723e
nop word [eax + eax]
push esi
push str..rsrc
call fcn.004af7b3
add esp, 8
test eax, eax
je 0x457233
inc edi
add esi, 0x28
cmp edi, ebx
jb 0x457210
mov cl, byte [ebp - 1]
xor esi, esi
xor eax, eax
jmp 0x457240
mov eax, dword [esi + 0x14]
mov esi, dword [esi + 8]
mov cl, byte [ebp - 1]
jmp 0x457240
xor esi, esi
mov ebx, dword [ebp - 0xc]
add ebx, eax
je 0x45733f
lea eax, [esi - 2]
push 2
add eax, ebx
push eax
push 0x4fed74
call fcn.004afe80
add esp, 0xc
test eax, eax
jne 0x457335
cmp dword [esi + ebx - 6], 1
jne 0x457335
mov eax, dword [esi + ebx - 0xe]
lea edi, [esi - 0xa]
mov ecx, dword [edi + ebx]
sub edi, 8
mov esi, dword [ebp + 8]
mov dword [ebp - 8], eax
mov edx, dword [edi + ebx]
sub edi, ecx
test byte [esi + 0x24], 1
mov dword [ebp - 0xc], edx
je 0x4572c3
add esi, 0x18
push esi
push ecx
mov ecx, esi
call fcn.00417600
mov ecx, dword [esi]
mov eax, dword [esi + 4]
cmp ecx, eax
je 0x4572bd
sub eax, ecx
push eax
lea eax, [edi + ebx]
push eax
push ecx
call fcn.0047e6d0
add esp, 0xc
mov byte [ebp - 1], 1
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 8]
sub edi, eax
test byte [esi + 0x24], 4
je 0x4572fd
add esi, 0xc
push esi
push eax
mov ecx, esi
call fcn.00417600
mov ecx, dword [esi]
mov eax, dword [esi + 4]
cmp ecx, eax
je 0x4572fa
sub eax, ecx
push eax
lea eax, [edi + ebx]
push eax
push ecx
call fcn.0047e6d0
mov esi, dword [ebp + 8]
mov al, 1
add esp, 0xc
mov byte [ebp - 1], al
jmp 0x457300
mov esi, dword [ebp + 8]
mov al, byte [ebp - 1]
test byte [esi + 0x24], 2
je 0x457341
push esi
push dword [ebp - 0xc]
mov ecx, esi
call fcn.00417600
mov ecx, dword [esi]
mov eax, dword [esi + 4]
cmp ecx, eax
je 0x457335
sub edi, dword [ebp - 0xc]
sub eax, ecx
push eax
add edi, ebx
push edi
push ecx
call fcn.0047e6d0
add esp, 0xc
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, cl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45da8f
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Get file attributes

Disassembly:
push 0x18
mov eax, 0x4de984
call fcn.0047ce1a
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov esi, dword [ebp + 8]
push 0x1c
push esi
mov dword [ebp - 4], ebx
call fcn.004164a0
mov edi, str.SpreadsheetToolsempty.xls
mov dword [ebp - 4], ebx
push edi
mov dword [ebp - 0x14], 3
call fcn.00489f6d
add esp, 0xc
mov ecx, esi
push eax
push edi
call fcn.00409280
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x45dad9
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x45db9b
call fcn.00460c0f
mov edi, eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
push str.RT_ZIPPED_DATA
push 0x7f
push edi
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x45db58
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x45db58
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x45db58
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x45db58
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 0x24]
push eax
push edi
mov ecx, eax
call fcn.00417600
push edi
push ebx
push dword [ebp - 0x24]
call fcn.0047e6d0
add esp, 0xc
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x20]
je 0x45db93
lea ecx, [ebp - 0xd]
call fcn.00428de0
cmp dword [esi + 0x14], 8
mov eax, esi
mov byte [ebp - 4], 2
jb 0x45db76
mov eax, dword [esi]
push 0
push eax
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0xd]
sub eax, dword [ebp - 0x24]
push eax
push dword [ebp - 0x24]
call fcn.004291f0
lea ecx, [ebp - 0xd]
call fcn.00428df0
lea ecx, [ebp - 0x24]
call fcn.00407c60
mov eax, esi
call fcn.0047cde3
ret
Function at 0x45df3d
Capabilities:
Delete registry key

Disassembly:
push 0xa8
mov eax, 0x4dea42
call fcn.0047ce4e
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x90]
xor ebx, ebx
inc ebx
call fcn.0042a360
and dword [ebp - 4], 0
lea ecx, [ebp - 0x90]
call fcn.0042ad90
test eax, eax
je 0x45e0a5
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x48]
mov byte [ebp - 4], bl
push eax
lea ecx, [ebp - 0x28]
call fcn.004102d0
mov esi, str.ExcelResiliencyDisabledItems
push esi
call fcn.00489f6d
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00409280
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ebx
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xb4]
push closesocket
push eax
call fcn.0040ea80
mov eax, dword [ebp - 0xb4]
xor esi, esi
test eax, eax
cmovne esi, ebx
mov byte [ebp - 4], 2
je 0x45dfe1
push eax
call dword [ebp - 0xa8]
mov byte [ebp - 4], bl
test esi, esi
jne 0x45e049
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x28]
call fcn.004102d0
push str.ExcelResiliencyStartupItems
call fcn.00489f6d
pop ecx
push eax
push str.ExcelResiliencyStartupItems
lea ecx, [ebp - 0x28]
call fcn.00409280
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ebx
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xb4]
push closesocket
push eax
call fcn.0040ea80
mov eax, dword [ebp - 0xb4]
test eax, eax
cmovne esi, ebx
mov byte [ebp - 4], 3
je 0x45e042
push eax
call dword [ebp - 0xa8]
mov byte [ebp - 4], bl
test esi, esi
je 0x45e09d
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x28]
call fcn.004102d0
mov esi, str.ExcelResiliency
push esi
call fcn.00489f6d
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00409280
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push closesocket
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
je 0x45e09d
mov esi, str.Data_can_not_be_removed_from_Registry.
push esi
call fcn.00489f6d
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00410170
xor ebx, ebx
lea ecx, [ebp - 0x28]
call fcn.00410420
lea ecx, [ebp - 0x90]
call fcn.0042a890
mov eax, ebx
call fcn.0047cdf8
ret
Function at 0x45e179
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x74
mov eax, 0x4deaaf
call fcn.0047ce4e
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x6c], eax
call fcn.00460c0f
push 0x4e4624
mov esi, eax
push 0x7d
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x45e2b7
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x68], eax
test eax, eax
je 0x45e2b7
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x45e2b7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x45e2b7
lea ecx, [ebp - 0x80]
call fcn.0042f5f0
mov esi, dword [ebp - 0x68]
mov dword [ebp - 4], ebx
test esi, esi
je 0x45e2af
lea eax, [ebp - 0x80]
push eax
push esi
mov ecx, eax
call fcn.00417600
push esi
push edi
push dword [ebp - 0x80]
call fcn.0047e6d0
add esp, 0xc
lea ecx, [ebp - 0x4c]
call fcn.00433510
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x4c]
call fcn.00433870
test eax, eax
je 0x45e2a7
mov esi, dword [ebp - 0x6c]
lea ecx, [ebp - 0x80]
push esi
call fcn.0042ffa0
push esi
lea ecx, [ebp - 0x30]
call fcn.00401910
mov byte [ebp - 4], 2
cmp byte [esi + 4], bl
jne 0x45e29d
push ebx
lea ecx, [ebp - 0x30]
call fcn.00403640
test al, al
jne 0x45e29d
cmp dword [ebp - 0x18], ebx
je 0x45e29f
push dword [ebp - 0x70]
lea eax, [ebp - 0x64]
push eax
call fcn.00460a99
pop ecx
pop ecx
mov ecx, eax
cmp dword [ecx + 0x14], 8
jb 0x45e279
mov ecx, dword [ecx]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0x1010
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call fcn.00460a43
add esp, 0xc
lea ecx, [ebp - 0x64]
call fcn.00410420
jmp 0x45e29f
mov bl, 1
lea ecx, [ebp - 0x30]
call fcn.00401970
lea ecx, [ebp - 0x4c]
call fcn.004335a0
lea ecx, [ebp - 0x80]
call fcn.0042f610
mov al, bl
call fcn.0047cdf8
ret
Function at 0x45e9c8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x468
mov eax, 0x4dec75
call fcn.0047ce4e
mov esi, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x474], esi
xor eax, eax
mov dword [ebp - 0x45c], ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x45c], 1
call fcn.00460c0f
push 0x4e4624
mov ebx, eax
push 0x7d
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x460], eax
test eax, eax
je 0x45eb04
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x45eb04
push dword [ebp - 0x460]
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x45eb04
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x45eb04
lea ecx, [ebp - 0x470]
call fcn.0042f5f0
mov dword [ebp - 4], 1
test edi, edi
je 0x45eaf9
lea eax, [ebp - 0x470]
push eax
push edi
mov ecx, eax
call fcn.00417600
push edi
push ebx
push dword [ebp - 0x470]
call fcn.0047e6d0
add esp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.00433510
lea eax, [ebp - 0x470]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x2c]
call fcn.00433870
test eax, eax
je 0x45eaf1
lea ecx, [ebp - 0x458]
call fcn.0042bf40
lea eax, [ebp - 0x458]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x470]
call fcn.0042ffa0
lea eax, [ebp - 0x450]
mov ecx, esi
push eax
call fcn.004102d0
lea ecx, [ebp - 0x458]
call fcn.0042c730
lea ecx, [ebp - 0x2c]
call fcn.004335a0
lea ecx, [ebp - 0x470]
call fcn.0042f610
mov eax, esi
call fcn.0047cdf8
ret

Function at 0x45f065
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 0x10]
push ebx
push esi
push dword [ebp + 0xc]
xor bl, bl
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x45f0cd
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x45f0cc
test edi, edi
je 0x45f0cc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp + 0x10], eax
test eax, eax
je 0x45f0cc
mov esi, dword [ebp + 0x14]
mov ecx, esi
push esi
push edi
call fcn.00417600
push edi
push dword [ebp + 0x10]
push dword [esi]
call fcn.0047e6d0
add esp, 0xc
inc bl
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret

Function at 0x45f16e
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x45f17f
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x45f19c
cmp dword [esi + 0x14], 8
jb 0x45f193
mov esi, dword [esi]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop esi
pop ebp
ret
Function at 0x460567
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x2d4
mov eax, 0x4df02a
call fcn.0047ce4e
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
je 0x460617
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x460590
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x460617
push esi
lea ecx, [ebp - 0x2dc]
call fcn.00429a90
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x2dc]
call fcn.00429c30
mov byte [ebp - 4], 1
jmp 0x4605fe
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
lea eax, [ebp - 0x2e0]
push eax
call fcn.0044ebc0
lea ecx, [ebp - 0x2e0]
call fcn.0044f6a0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x2dc]
call fcn.00429c30
push eax
lea ecx, [ebp - 0x28]
call fcn.0040e350
lea ecx, [ebp - 0x40]
call fcn.00410420
cmp dword [ebp - 0x18], 0
jne 0x4605c1
lea ecx, [ebp - 0x28]
call fcn.00410420
lea ecx, [ebp - 0x2dc]
call fcn.00429b30
call fcn.0047cdf8
ret

Function at 0x460a7c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x460a8a
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
pop ebp
ret

Function at 0x4c6329
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c5f10

Function at 0x4c6334
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c609a

Function at 0x4cba0a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004cb3c2

Function at 0x4cbda4
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004cbc78
Function at 0x10001520
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x10034680], 0
je 0x10001539
mov eax, dword [0x10034680]
jmp 0x100016d6
mov dword [0x10034680], 0x10034658
push 0x28
push 0
push 0x10034658
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x10034658], eax
push str.imagehlp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x1003465c], eax
cmp dword [0x1003465c], 0
jne 0x1000157f
xor eax, eax
jmp 0x100016d6
push str.ImagehlpApiVersionEx
mov eax, dword [0x1003465c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10034660], eax
push str.SymInitialize
mov ecx, dword [0x1003465c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10034664], eax
push str.SymSetOptions
mov edx, dword [0x1003465c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10034668], eax
push str.SymGetOptions
mov eax, dword [0x1003465c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1003466c], eax
push str.SymLoadModule
mov ecx, dword [0x1003465c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10034670], eax
push str.SymGetModuleInfo
mov edx, dword [0x1003465c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10034674], eax
push str.SymGetSymFromName
mov eax, dword [0x1003465c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10034678], eax
push str.BindImage
mov ecx, dword [0x1003465c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1003467c], eax
push 8
push 0
lea edx, [ebp - 8]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov word [ebp - 8], 9
cmp dword [0x10034660], 0
je 0x1000165d
lea eax, [ebp - 8]
push eax
call dword [0x10034660]
cmp dword [0x10034660], 0
je 0x1000166f
movzx ecx, word [ebp - 8]
cmp ecx, 9
jge 0x1000168a
mov edx, dword [0x1003465c]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x1003465c], 0
xor eax, eax
jmp 0x100016d6
cmp dword [0x10034664], 0
je 0x100016a3
push 0
push 0
mov eax, dword [0x10034658]
push eax
call dword [0x10034664]
cmp dword [0x1003466c], 0
je 0x100016d1
cmp dword [0x10034668], 0
je 0x100016d1
call dword [0x1003466c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
and ecx, 7
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [0x10034668]
mov eax, dword [0x10034680]
mov esp, ebp
pop ebp
ret
Function at 0x10005f70
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x44
mov eax, dword [0x1003400c]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
mov ebx, dword [esp + 0x4c]
xorps xmm1, xmm1
push esi
mov esi, ecx
lea ecx, [esp + 0x10]
push edi
mov edi, edx
call fcn.10005e10
cmp dword [eax + 0x14], 0x10
jb 0x10005f9d
mov eax, dword [eax]
push ebx
push 0x20
lea ecx, [esp + 0x34]
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [esp + 0x28]
cmp ecx, 0x10
jb 0x10005fe6
mov edx, dword [esp + 0x14]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10005fdc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10005fdc
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10027da6
add esp, 8
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
mov ecx, dword [esp + 0x50]
add esp, 4
fstp dword [esp + 0x10]
movss xmm0, dword [esp + 0x10]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10027a7e
add esp, 0x44
ret

Function at 0x100060a0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x48
mov eax, dword [0x1003400c]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push esi
mov esi, dword [esp + 0x58]
mov ebx, edx
mov edx, dword [esp + 0x54]
push edi
mov edi, ecx
lea ecx, [esp + 0x14]
call fcn.1000b590
cmp dword [esp + 0x28], 0x10
lea ecx, [esp + 0x2c]
push esi
push 0x20
push ecx
lea eax, [esp + 0x20]
cmovae eax, dword [esp + 0x20]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [esp + 0x28]
cmp ecx, 0x10
jb 0x1000611d
mov edx, dword [esp + 0x14]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10006113
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10006113
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10027da6
add esp, 8
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ecx, dword [esp + 0x50]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10027a7e
add esp, 0x48
ret
Function at 0x1000d700
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
mov eax, dword [0x1003400c]
xor eax, esp
mov dword [esp + 0x54], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edi
mov dword [0x1003469c], 0
xorps xmm0, xmm0
lea edx, [esp + 0x20]
mov ecx, esi
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x30], xmm0
movq qword [esp + 0x40], xmm0
call fcn.100026e0
mov eax, dword [esp + 0x26]
cmp eax, 0xffffffff
je 0x1000d764
test eax, 0x68000
jne 0x1000d764
mov eax, dword [esp + 0x22]
test eax, eax
je 0x1000d7f0
cmp eax, 5
je 0x1000d7b4
xorps xmm0, xmm0
lea edx, [esp + 0x20]
mov ecx, esi
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x30], xmm0
movq qword [esp + 0x40], xmm0
call fcn.100026e0
mov eax, dword [esp + 0x26]
cmp eax, 0xffffffff
je 0x1000d798
test eax, 0x68000
jne 0x1000d798
mov ecx, dword [esp + 0x22]
jmp 0x1000d79b
or ecx, 0xffffffff
mov eax, dword [0x1003469c]
add eax, ecx
add esi, eax
mov dword [0x1003469c], eax
cmp eax, 5
jl 0x1000d725
jmp 0x1000d7c1
mov eax, dword [0x1003469c]
add eax, 4
mov dword [0x1003469c], eax
push eax
call fcn.10028010
add esp, 4
mov dword [0x100346a4], eax
mov dword [0x100346a0], edi
push 0x40
push 0x3000
push dword [0x1003469c]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1000d805
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.10027a7e
mov esp, ebp
pop ebp
ret 8
push dword [0x1003469c]
push edi
push dword [0x100346a4]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push dword [0x1003469c]
push dword [0x100346a4]
push esi
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [0x1003469c]
mov eax, edi
sub eax, esi
mov byte [esp + 0x20], 0xe9
sub eax, 5
add esp, 0xc
mov dword [esp + 0x15], eax
mov eax, dword [esp + 0x14]
mov dword [ecx + esi], eax
mov al, byte [esp + 0x18]
mov byte [ecx + esi + 4], al
lea eax, [esp + 0x1c]
push eax
push 0x40
push dword [0x1003469c]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [0x1003469c], 5
mov cl, 5
jle 0x1000d891
mov eax, 5
nop dword [eax + eax]
inc cl
mov byte [eax + edi], 0x90
movzx eax, cl
cmp eax, dword [0x1003469c]
jl 0x1000d880
mov eax, dword [ebp + 0xc]
sub eax, edi
sub eax, 5
mov dword [esp + 0x15], eax
mov eax, dword [esp + 0x14]
mov dword [edi], eax
mov al, byte [esp + 0x18]
mov byte [edi + 4], al
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x20]
push dword [0x1003469c]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [esp + 0x5c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.10027a7e
mov esp, ebp
pop ebp
ret 8