joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c0100
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x506318
mov eax, dword fs:[0]
push eax
sub esp, 0x2fc
mov eax, dword [0x54f018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.00493c40
mov eax, dword [ebx + 0x14]
push eax
lea esi, [ebp - 0x2c]
call fcn.0047d700
mov edi, eax
xor esi, esi
mov dword [ebp - 4], esi
mov eax, dword [ebx + 0x14]
mov ecx, dword [eax + 0x408]
mov dword [ebp - 0x2cc], eax
add eax, 0x3f8
cmp dword [eax + 0x14], 0x10
jb 0x4c0164
mov eax, dword [eax]
push ecx
mov ecx, dword [edi + 0x10]
push eax
push ecx
push esi
mov ecx, edi
call fcn.00404050
test eax, eax
jne 0x4c0192
mov esi, dword [ebp - 0x2cc]
add esi, 4
mov ecx, 0xa6
lea edi, [ebp - 0x2c8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor esi, esi
jmp 0x4c01a6
mov edx, dword [ebp - 0x2cc]
push edx
lea edx, [ebp - 0x2c8]
mov ecx, edi
call fcn.0047fe10
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 0x10
jb 0x4c01c0
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.mfc100.dll_Ordinal_1296]
add esp, 4
mov eax, dword [ebx + 0x18]
xor ecx, ecx
cmp byte [ebp - 0x3b], 2
mov dword [ebx + 0x20], esi
setne cl
mov dword [ebx + 0x24], 0xf00000
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x2c], 0
dec ecx
and ecx, 0xfffe0020
add ecx, 0x20000
mov dword [ebx + 0x1c], ecx
mov edx, dword [eax + 0x700]
mov dword [ebx + 0x28], edx
mov dword [ebx + 0x2c], esi
mov dword [ebx + 0x30], esi
mov dword [ebx + 0x34], esi
mov dword [ebx + 0x38], 0xc1
mov dword [ebx + 0x3c], esi
mov dword [ebx + 0x40], esi
mov ecx, 1
mov dword [ebx + 0x44], ecx
mov dword [ebx + 0x6c], ecx
mov dword [ebx + 0x70], ecx
movzx edx, byte [eax + 0x704]
mov dword [ebx + 0x7c], ecx
mov dword [ebx + 0x74], edx
mov dword [ebx + 0x78], 0x200
mov dword [ebx + 0x80], 0x55aa
mov dword [ebx + 0x84], esi
mov dword [ebx + 0x88], esi
mov ecx, dword [eax + 0x6f4]
mov dword [ebx + 0x60], ecx
mov edx, dword [eax + 0x6f8]
mov dword [ebx + 0x64], edx
movzx ecx, byte [eax + 0x6fd]
mov dword [ebx + 0x68], ecx
movzx edx, byte [eax + 0x6ec]
mov byte [ebx + 0x59], dl
mov cl, byte [eax + 0x6f0]
mov byte [ebx + 0x5a], cl
movzx edx, byte [eax + 0x6fc]
mov byte [ebx + 0x5b], dl
mov eax, dword [eax + 0x6e8]
lea ecx, [ebp - 0x308]
push ecx
mov dword [ebx + 0x5c], eax
call fcn.00493c40
push eax
call fcn.004a4310
mov edx, dword [ebp - 0x2ec]
mov eax, dword [ebp - 0x2e8]
mov ecx, dword [ebp - 0x2e4]
mov dword [ebx + 0x8c], edx
mov edx, dword [ebp - 0x2e0]
mov dword [ebx + 0x90], eax
mov eax, dword [ebp - 0x2dc]
mov dword [ebx + 0x94], ecx
mov ecx, dword [ebp - 0x2d8]
mov dword [ebx + 0x98], edx
mov edx, dword [ebp - 0x2d4]
mov dword [ebx + 0x9c], eax
mov eax, dword [ebp - 0x2d0]
mov dword [ebx + 0xa0], ecx
mov dword [ebx + 0xa4], edx
mov dword [ebx + 0xa8], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e8d32
mov esp, ebp
pop ebp
ret
Function at 0x4c3c90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f9f70
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x54f018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [edi], vtable.CAdvanceDataManager.0
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [ebp - 4], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
push 0x24
mov dword [edi + 0x30], ebx
call dword [sym.imp.mfc100.dll_Ordinal_1294]
add esp, 4
cmp eax, ebx
je 0x4c3dcb
mov dword [edi + 0x2c], eax
mov dword [eax], eax
mov eax, dword [edi + 0x2c]
mov dword [eax + 4], eax
mov eax, dword [edi + 0x2c]
mov dword [eax + 8], eax
mov eax, dword [edi + 0x2c]
mov byte [eax + 0x20], 1
mov ecx, dword [edi + 0x2c]
mov byte [ecx + 0x21], 1
mov dword [edi + 0x450], ebx
mov dword [edi + 0x474], ebx
mov dword [edi + 0x478], ebx
mov dword [edi + 0x47c], ebx
lea esi, [edi + 0x490]
mov dword [edi + 0x484], ebx
mov dword [edi + 0x488], ebx
mov dword [edi + 0x48c], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [edi + 0x4a0], ebx
mov dword [edi + 0x4a4], ebx
mov dword [edi + 0x4a8], ebx
mov dword [edi + 0x8b0], ebx
mov dword [edi + 0x8b4], ebx
mov dword [edi + 0x8b8], ebx
push 0x400
lea edx, [edi + 0x4b0]
push ebx
push edx
mov byte [ebp - 4], 5
call sub.MSVCR100.dll_memset
add esp, 0xc
call fcn.004c8b80
mov dword [ebp - 0x10], 8
jmp 0x4c3da0
mov esi, dword [edi + 0x490]
add esi, ebx
call fcn.004c8c10
add ebx, 0x10
dec dword [ebp - 0x10]
jne 0x4c3da0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
push 0x535fb0
lea ecx, [ebp - 0x1c]
push ecx
mov dword [ebp - 0x1c], vtable.std::bad_alloc.0
call sub.MSVCR100.dll__CxxThrowException
int3
Function at 0x4cec90
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f9cd2
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x54f018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x84], ebx
push eax
lea esi, [ebp - 0x7c]
mov dword [ebp - 0x88], edi
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x74], 0x67452301
mov dword [ebp - 0x70], 0xefcdab89
mov dword [ebp - 0x6c], 0x98badcfe
mov dword [ebp - 0x68], 0x10325476
call fcn.004e7ef0
add esp, 4
mov ecx, esi
call fcn.004e8020
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 0x84], 1
xor esi, esi
jmp 0x4ced20
movzx eax, byte [ebp + esi - 0x24]
push eax
push str._02x
lea ecx, [ebp - 0x80]
push 3
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf_s]
lea eax, [ebp - 0x80]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4ced40
sub eax, edx
push eax
lea edx, [ebp - 0x80]
push edx
mov ecx, edi
call fcn.004015b0
inc esi
cmp esi, 0x10
jl 0x4ced20
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004e8d32
mov esp, ebp
pop ebp
ret
Function at 0x4e67d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
test edi, edi
je 0x4e68ec
test esi, 1
jne 0x4e68ec
and eax, 0xff
movzx ecx, word [eax*2 + 0x51d328]
mov eax, ecx
and eax, 1
add eax, eax
add eax, eax
mov edx, ecx
and edx, 2
or eax, edx
add eax, eax
add eax, eax
mov edx, ecx
and edx, 4
or eax, edx
add eax, eax
add eax, eax
mov edx, ecx
and edx, 8
or eax, edx
add eax, eax
add eax, eax
mov edx, ecx
and edx, 0x10
or eax, edx
add eax, eax
add eax, eax
mov edx, ecx
and edx, 0x20
or eax, edx
add eax, eax
add eax, eax
mov edx, ecx
and edx, 0x40
or eax, edx
add eax, eax
push ebx
add eax, eax
mov edx, ecx
and edx, 0x80
or eax, edx
mov edx, ecx
shr edx, 2
and edx, 0x1000
mov ebx, ecx
and ebx, 0x2000
or edx, ebx
shr edx, 2
mov ebx, ecx
and ebx, 0x1000
or edx, ebx
shr edx, 2
mov ebx, ecx
and ebx, 0x800
or edx, ebx
shr edx, 2
mov ebx, ecx
and ebx, 0x400
or edx, ebx
shr edx, 2
mov ebx, ecx
and ebx, 0x200
or edx, ebx
shr edx, 2
and ecx, 0x100
or edx, ecx
shr edx, 1
add eax, eax
or eax, edx
xor edx, edx
shr esi, 1
mov dword [ebp - 4], esi
je 0x4e68e1
mov ecx, eax
mov esi, eax
shr esi, 1
and ecx, 2
shl ecx, 0xe
or ecx, esi
mov esi, eax
and esi, 8
and eax, 4
mov ebx, ecx
shl esi, 0xc
shr ebx, 1
shl eax, 0xc
or esi, ebx
xor eax, esi
xor eax, ecx
xor word [edi + edx*2], ax
inc edx
cmp edx, dword [ebp - 4]
jb 0x4e68b1
pop ebx
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4e8d32
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x54f018]
jne 0x4e8d3c
repz ret
jmp fcn.004e9286

Function at 0x4e9830
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 4]
pop ebp
jmp fcn.004ee040

Function at 0x4e9840
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 4]
pop ebp
jmp fcn.004ee190
Function at 0x4ea190
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f3868
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x54f018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x1c]
mov ebx, dword [ebp + 8]
mov eax, ebx
cmp esi, 0x10
jae 0x4ea1c5
lea eax, [ebp + 8]
push 0
push 0x51d12c
push eax
call fcn.00401d40
mov ecx, dword [ebp + 0x18]
add esp, 0xc
test eax, eax
jne 0x4ea20c
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x4ea20c
cmp esi, 0x10
jb 0x4ea1f5
push ebx
call sub.mfc100.dll_Ordinal_1296
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, 2
jne 0x4ea221
mov eax, ebx
cmp esi, 0x10
jae 0x4ea21b
lea eax, [ebp + 8]
cmp byte [eax + 1], 0x3a
je 0x4ea1e7
xor edi, edi
test ecx, ecx
jne 0x4ea249
cmp esi, 0x10
jb 0x4ea235
push ebx
call sub.mfc100.dll_Ordinal_1296
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, ebx
cmp esi, 0x10
jae 0x4ea253
lea eax, [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4ea268
test al, 0x10
je 0x4ea268
mov edi, 1
cmp dword [ebp + 0x1c], 0x10
jb 0x4ea27a
mov eax, dword [ebp + 8]
push eax
call sub.mfc100.dll_Ordinal_1296
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ea4e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f3e08
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x54f018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x44], 0
je 0x4ea607
cmp byte [edi + 0x49], 0
je 0x4ea607
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
je 0x4ea5fb
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], 0
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x4ea556
lea eax, [ebp - 0x2c]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
lea ebx, [edi + 0x4c]
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
mov ecx, eax
cmp edx, 0x10
jae 0x4ea576
lea ecx, [ebp - 0x2c]
mov eax, ecx
add ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push ecx
mov ecx, dword [edi + 0x44]
push eax
push ebx
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x4ea59b
dec eax
je 0x4ea59f
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x4ea5f6
jmp 0x4ea602
mov byte [edi + 0x49], 0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp edx, 0x10
jae 0x4ea5af
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x4ea5d9
cmp edx, 0x10
jae 0x4ea5be
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x4ea5f3
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x4ea5ff
test esi, esi
jne 0x4ea56a
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.0040d150
jmp 0x4ea564
lea ecx, [ebp - 0x2c]
call fcn.00432240
xor al, al
jmp 0x4ea609
lea ecx, [ebp - 0x2c]
call fcn.00432240
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e8d32
mov esp, ebp
pop ebp
ret
Function at 0x4eab00
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f38a0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x54f018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x30], esp
xor ebx, ebx
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 8]
mov esi, 0xf
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ecx], bl
call fcn.00401460
lea ecx, [ebp - 0x2c]
push ecx
call fcn.004eaa50
add esp, 4
mov ecx, esp
mov dword [ebp - 0x30], esp
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x2c]
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], ebx
push edx
mov byte [ebp - 4], 1
mov byte [ecx], bl
call fcn.00401460
call fcn.004ea190
add esp, 0x1c
cmp eax, ebx
jne 0x4eabaa
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x30], esp
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x2c]
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], ebx
push eax
mov byte [ecx], bl
call fcn.00401460
call fcn.004eab00
add esp, 0x1c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x30], esp
push 0xffffffffffffffff
push ebx
lea edx, [ebp + 8]
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], ebx
push edx
mov byte [ecx], bl
call fcn.00401460
call fcn.004ea190
add esp, 0x1c
mov edi, 0x10
cmp eax, ebx
jne 0x4eac1d
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x1c], edi
jae 0x4eabe2
lea eax, [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4eac1d
cmp dword [ebp - 0x18], edi
jb 0x4eabff
mov eax, dword [ebp - 0x2c]
push eax
call sub.mfc100.dll_Ordinal_1296
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
cmp dword [ebp + 0x1c], edi
jb 0x4eac19
mov ecx, dword [ebp + 8]
push ecx
call sub.mfc100.dll_Ordinal_1296
add esp, 4
xor eax, eax
jmp 0x4eac4d
cmp dword [ebp - 0x18], edi
jb 0x4eac2e
mov edx, dword [ebp - 0x2c]
push edx
call sub.mfc100.dll_Ordinal_1296
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
cmp dword [ebp + 0x1c], edi
jb 0x4eac48
mov eax, dword [ebp + 8]
push eax
call sub.mfc100.dll_Ordinal_1296
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e8d32
mov esp, ebp
pop ebp
ret
Function at 0x4eae20
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
sub esp, 0x1c
mov dword [ebp - 4], esp
mov edi, esp
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 4], esp
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push esi
mov byte [ecx], 0
call fcn.00401460
push edi
call fcn.004eaa50
add esp, 0x20
call fcn.004eab00
add esp, 0x1c
test eax, eax
jne 0x4eae6f
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x10
cmp dword [esi + 0x14], ecx
jb 0x4eae7b
mov esi, dword [esi]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], ecx
jb 0x4eae85
mov eax, dword [eax]
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4ecc20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
shr edx, 2
xor eax, eax
xor ecx, ecx
test edx, edx
je 0x4ecc3e
push esi
mov esi, dword [ebp + 8]
xor eax, dword [esi + ecx*4]
inc ecx
cmp ecx, edx
jb 0x4ecc35
pop esi
pop ebp
ret
Function at 0x4ed410
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f3eab
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x54f018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x14], 0x10
mov eax, dword [ebp + 0x10]
mov ebx, dword [edi + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x238], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x23c], 0
mov eax, ebx
jb 0x4ed475
mov eax, dword [edi]
jmp 0x4ed477
mov eax, edi
push 0
push 0x51d12c
push eax
call fcn.00401d40
add esp, 0xc
test eax, eax
jne 0x4ed492
test ebx, ebx
setne al
test eax, eax
sete al
test al, al
je 0x4ed4c1
mov edx, dword [ebp - 0x230]
push 0xffffffffffffffff
push 0
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
push edx
mov ecx, esi
mov byte [esi], 0
call fcn.00401460
jmp 0x4ed59e
push 0x1ff
lea eax, [ebp - 0x20f]
push 0
push eax
mov byte [ebp - 0x210], 0
call sub.MSVCR100.dll_memset
mov eax, dword [ebp - 0x238]
add eax, 4
mov ebx, 0x10
add esp, 0xc
cmp dword [eax + 0x14], ebx
jb 0x4ed4f3
mov eax, dword [eax]
mov edx, dword [ebp - 0x230]
cmp dword [edx + 0x14], ebx
jb 0x4ed500
mov edx, dword [edx]
mov ecx, dword [ebp - 0x234]
cmp dword [ecx + 0x14], ebx
jb 0x4ed50d
mov ecx, dword [ecx]
cmp dword [edi + 0x14], ebx
jb 0x4ed514
mov edi, dword [edi]
push eax
push 0x200
lea eax, [ebp - 0x210]
push eax
push edx
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebx, 0xf
xor edi, edi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x21c], edi
mov byte [ebp - 0x22c], 0
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4ed550
sub eax, edx
push eax
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [ebp - 0x22c]
call fcn.004016d0
lea edx, [ebp - 0x22c]
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], edi
push edx
mov ecx, esi
mov dword [ebp - 4], edi
mov byte [esi], 0
call fcn.004013e0
cmp dword [ebp - 0x218], 0x10
jb 0x4ed59e
mov eax, dword [ebp - 0x22c]
push eax
call sub.mfc100.dll_Ordinal_1296
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e8d32
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4ee040
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f401b
mov eax, dword fs:[0]
push eax
mov eax, 0x7d28
call fcn.004ef140
mov eax, dword [0x54f018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push 0x7cff
mov esi, ecx
lea ecx, [ebp - 0x7d0f]
push ebx
push ecx
mov dword [ebp - 0x7d34], eax
mov byte [ebp - 0x7d10], bl
call sub.MSVCR100.dll_memset
lea eax, [esi + 4]
add esp, 0xc
cmp dword [eax + 0x14], 0x10
jb 0x4ee0a5
mov eax, dword [eax]
push eax
push 0x3200
lea edx, [ebp - 0x7d10]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
xor edi, edi
mov dword [ebp - 0x7d30], ebx
cmp eax, ebx
je 0x4ee170
cmp dword [ebp - 0x7d30], 0x1f4
jae 0x4ee170
lea esi, [ebp + edi - 0x7d10]
mov eax, esi
mov dword [ebp - 0x7d18], 0xf
mov dword [ebp - 0x7d1c], ebx
mov byte [ebp - 0x7d2c], bl
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4ee100
sub eax, edx
push eax
push esi
lea ecx, [ebp - 0x7d2c]
call fcn.004016d0
mov ecx, dword [ebp - 0x7d34]
lea eax, [ebp - 0x7d2c]
push eax
mov dword [ebp - 4], ebx
call fcn.00416690
cmp dword [ebp - 0x7d18], 0x10
mov dword [ebp - 4], 0xffffffff
jb 0x4ee14a
mov ecx, dword [ebp - 0x7d2c]
push ecx
call sub.mfc100.dll_Ordinal_1296
add esp, 4
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4ee150
inc dword [ebp - 0x7d30]
sub eax, edx
lea edi, [edi + eax + 1]
cmp byte [ebp + edi - 0x7d10], bl
jne 0x4ee0c8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e8d32
mov esp, ebp
pop ebp
ret 4
Function at 0x4ee4b0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [ecx + 4]
lea eax, [ebp - 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x4ee4d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4f0353
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [edx + 8]
mov eax, ecx
imul eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
lea esi, [ecx + eax]
mov ecx, dword [ebp + 8]
lea ecx, [ecx + eax*4]
mov dword [ebp + 8], ecx
mov ecx, dword [edx + 0x78]
lea ecx, [ecx + eax*4]
push edi
mov edi, dword [ecx]
mov ecx, dword [ecx + 4]
add ebx, edi
sub ecx, edi
cmp eax, esi
jge 0x4f03b0
mov edi, ebx
shl edi, 2
shl ecx, 2
sub esi, eax
mov eax, dword [ebp + 8]
mov dword [ebp + 0xc], esi
mov esi, dword [edx + 0x7c]
mov esi, dword [esi + edi]
mov ebx, dword [edx + 0xb4]
movsx esi, byte [esi + ebx]
xor dword [eax], esi
add eax, 4
add edi, ecx
dec dword [ebp + 0xc]
jne 0x4f0394
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4f08ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 8], 0
push edi
mov edi, dword [eax + 8]
lea edx, [eax + ecx*4 + 0x1a0]
imul edi, ecx
cmp dword [edx], 0
mov dword [ebp - 0x14], edx
jle 0x4f099b
imul ecx, ecx, 0x14
lea ecx, [ecx + eax + 0x4c0]
push ebx
mov dword [ebp - 0xc], ecx
push esi
mov edx, dword [ecx + 0xfa0]
mov ebx, dword [eax + 8]
mov ecx, dword [ecx]
imul ecx, ebx
mov dword [ebp - 0x10], edx
lea esi, [edx + edi]
cmp edx, ebx
jge 0x4f0960
mov edx, esi
sub edx, edi
mov dword [ebp - 4], edx
mov ebx, dword [eax + 0x100]
mov edx, dword [eax + 0xfc]
mov bl, byte [ebx + esi]
xor byte [edx + ecx], bl
inc esi
inc dword [ebp - 4]
mov edx, dword [ebp - 4]
inc ecx
cmp edx, dword [eax + 8]
jl 0x4f093e
mov edx, dword [ebp - 0x10]
sub esi, dword [eax + 8]
test edx, edx
jle 0x4f0983
mov dword [ebp - 4], edx
mov ebx, dword [eax + 0x100]
mov bl, byte [ebx + esi]
mov edx, dword [eax + 0xfc]
xor byte [edx + ecx], bl
inc esi
inc ecx
dec dword [ebp - 4]
jne 0x4f096a
inc dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 8]
add ecx, 4
mov dword [ebp - 0xc], ecx
cmp esi, dword [edx]
jl 0x4f091f
pop esi
pop ebx
pop edi
leave
ret