joyce8/EMBER2024-capa huggingface dataset:
Function at 0x478cff
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x4a3610
call fcn.0047abdc
mov edi, 0x94
mov eax, edi
call fcn.004779b0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [0x49b16c]
mov ecx, dword [esi + 0x10]
mov dword [0x4e49a4], ecx
mov eax, dword [esi + 4]
mov dword [0x4e49b0], eax
mov edx, dword [esi + 8]
mov dword [0x4e49b4], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x4e49a8], esi
cmp ecx, 2
je 0x478d5f
or esi, 0x8000
mov dword [0x4e49a8], esi
shl eax, 8
add eax, edx
mov dword [0x4e49ac], eax
xor esi, esi
push esi
mov edi, dword [0x49b178]
call edi
cmp word [eax], 0x5a4d
jne 0x478d9a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x478d9a
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x478db2
cmp eax, 0x20b
je 0x478d9f
mov dword [ebp - 0x1c], esi
jmp 0x478dc6
cmp dword [ecx + 0x84], 0xe
jbe 0x478d9a
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x478dc0
cmp dword [ecx + 0x74], 0xe
jbe 0x478d9a
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0047c889
pop ecx
test eax, eax
jne 0x478dda
push 0x1c
call fcn.00478cdb
pop ecx
call fcn.0047aa88
test eax, eax
jne 0x478deb
push 0x10
call fcn.00478cdb
pop ecx
call fcn.00480795
mov dword [ebp - 4], esi
call fcn.0047fc68
test eax, eax
jge 0x478e04
push 0x1b
call fcn.00478cb6
pop ecx
call dword [0x49b170]
mov dword [0x4e5fc0], eax
call fcn.00480673
mov dword [0x4e4728], eax
call fcn.004805d1
test eax, eax
jge 0x478e2a
push 8
call fcn.00478cb6
pop ecx
call fcn.0048039e
test eax, eax
jge 0x478e3b
push 9
call fcn.00478cb6
pop ecx
push 1
call fcn.0047fec0
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x478e51
push eax
call fcn.00478cb6
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [0x49b174]
call fcn.00480341
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x478e72
movzx eax, word [ebp - 0x40]
jmp 0x478e75
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.0040f400
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x478e93
push edi
call fcn.0047ffed
call fcn.0048000f
jmp 0x478ec5
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0047ac17
ret
Function at 0x483fc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x483fee
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x483ff5
cmp ebx, dword [eax + 4]
jae 0x483ff5
xor eax, eax
jmp 0x4841e5
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x484006
xor eax, eax
inc eax
jmp 0x4841e4
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x48401c
cmp ecx, edx
jae 0x484161
cmp dword [eax + 4], 0
je 0x484025
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x48400d
cmp dword [ebp + 8], 0
je 0x484047
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x484161
cmp eax, esi
jae 0x484161
mov eax, dword [0x4e4b90]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x48406c
cmp dword [esi*4 + 0x4e4b98], edi
je 0x484165
inc esi
cmp esi, eax
jl 0x48405a
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x49b0c0]
test eax, eax
je 0x4841e1
cmp dword [ebp - 8], 0x1000000
jne 0x4841e1
test byte [ebp - 0xc], 0xcc
je 0x4840ea
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x4841e1
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4841e1
cmp word [eax + 0x18], 0x10b
jne 0x4841e1
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x4841e1
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x4840ea
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x4840ea
test byte [ecx + 0x27], 0x80
jne 0x484161
push 1
push 0x4e4bd8
call dword [0x49b0c4]
test eax, eax
jne 0x483ffe
mov ecx, dword [0x4e4b90]
test ecx, ecx
mov edx, ecx
jle 0x48411e
lea eax, [ecx*4 + 0x4e4b94]
cmp dword [eax], edi
je 0x48411e
dec edx
sub eax, 4
test edx, edx
jg 0x484112
test edx, edx
jne 0x48414f
push 0xf
pop ebx
cmp ecx, ebx
jg 0x48412b
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x484143
lea eax, [edx*4 + 0x4e4b98]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x484131
cmp ecx, 0x10
jge 0x48414f
inc ecx
mov dword [0x4e4b90], ecx
push 0
push 0x4e4bd8
call dword [0x49b0c4]
jmp 0x483ffe
xor eax, eax
jmp 0x4841e4
test esi, esi
jle 0x483ffe
mov ebx, dword [0x49b0c4]
push 1
push 0x4e4bd8
call ebx
test eax, eax
jne 0x483ffe
cmp dword [esi*4 + 0x4e4b98], edi
je 0x4841bb
mov eax, dword [0x4e4b90]
lea esi, [eax - 1]
test esi, esi
jl 0x4841a9
cmp dword [esi*4 + 0x4e4b98], edi
je 0x4841a5
dec esi
jns 0x484199
test esi, esi
jge 0x4841b9
cmp eax, 0x10
jge 0x4841b4
inc eax
mov dword [0x4e4b90], eax
lea esi, [eax - 1]
jmp 0x4841bb
je 0x4841d3
xor ecx, ecx
test esi, esi
jl 0x4841d3
lea eax, [ecx*4 + 0x4e4b98]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x4841c1
push 0
push 0x4e4bd8
call ebx
jmp 0x483ffe
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x488430
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
xor edx, edx
cmp ecx, edx
je 0x4884d1
push ebx
push ebp
push esi
mov esi, dword [ecx]
mov byte [esi + 0x16], dl
mov esi, dword [ecx]
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov byte [esi + 0x18], dl
mov esi, dword [ecx]
mov byte [esi + 0x19], dl
mov esi, dword [ecx + 4]
xor eax, eax
cmp esi, edx
push edi
jle 0x48847f
mov edi, dword [ecx]
movzx ebx, byte [edi + edx]
mov ebp, eax
shr ebp, 0x18
xor ebx, ebp
mov ebp, dword [ebx*4 + 0x4ad368]
shl eax, 8
xor eax, ebp
inc edx
cmp edx, esi
jl 0x488461
xor edx, edx
mov esi, dword [ecx + 0xc]
cmp esi, edx
jle 0x4884ac
mov edi, dword [ecx + 8]
lea esp, [esp]
movzx ebx, byte [edi + edx]
mov ebp, eax
shr ebp, 0x18
xor ebx, ebp
mov ebp, dword [ebx*4 + 0x4ad368]
shl eax, 8
xor eax, ebp
inc edx
cmp edx, esi
jl 0x488490
mov edx, dword [ecx]
mov byte [edx + 0x16], al
mov esi, dword [ecx]
mov edx, eax
shr edx, 8
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov edx, eax
shr edx, 0x10
pop edi
mov byte [esi + 0x18], dl
mov ecx, dword [ecx]
pop esi
shr eax, 0x18
pop ebp
mov byte [ecx + 0x19], al
pop ebx
ret
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130

Function at 0x40107a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareeGalaxTouch
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4010d3
push 4
lea edx, [ebp + 0xc]
push edx
push 4
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret 8
Function at 0xdb6430
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [esi + 0x19], 0
je 0xdb6445
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 0x24], eax
jne 0xdb6445
inc dword [esi + 0x28]
ret
cmp byte [esi + 0x19], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
mov byte [esi + 0x1a], 0
je 0xdb647a
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ecx]
call ebx
sub eax, dword [esi + 0x20]
cmp eax, dword [esi + 0x1c]
ja 0xdb6476
push 0xa
call edi
cmp byte [esi + 0x19], 0
jne 0xdb6460
jmp 0xdb647a
mov byte [esi + 0x1a], 1
lea edi, [esi + 0x2c]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esi + 0x19], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x24], eax
call ebx
push edi
mov dword [esi + 0x20], eax
mov dword [esi + 0x28], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebx
ret

Function at 0xdb7070
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
mov ebx, ecx
test edi, edi
je 0xdb70e4
mov eax, 0x90909090
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov word [esi + 0x1c], ax
mov eax, dword [ebp + 8]
push eax
push edi
push esi
call fcn.00dc36e0
mov eax, dword [ebp + 8]
add esp, 0xc
lea edx, [ebp - 4]
push edx
push 0x40
lea ecx, [edi + eax]
push 0x1e
mov byte [esi + 0xf], 0x68
mov dword [esi + 0x10], ecx
mov byte [esi + 0x14], 0xc3
mov dword [esi + 0x15], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push edi
call esi
sub ebx, edi
sub ebx, 5
mov byte [edi], 0xe9
mov dword [edi + 1], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xdb8370
Capabilities:
Accept command line arguments

Disassembly:
push esi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
jne 0xdb8384
mov eax, 1
pop esi
ret
push 0xdd46d4
push eax
call fcn.00dbd136
add esp, 8
test eax, eax
jne 0xdb839d
mov eax, 2
pop esi
ret
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov word [eax + 0x10], cx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
test eax, eax
jne 0xdb83bf
mov eax, 3
pop esi
ret
push 0xdd46e8
push eax
call fcn.00dbd0b0
add esp, 8
test eax, eax
jne 0xdb83d8
mov eax, 4
pop esi
ret
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov byte [eax + 8], cl
mov eax, esi
pop esi
ret
Function at 0xdb83f0
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xdcf9e8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0xdd7024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor edi, edi
mov dword [ebp - 0x14], edi
push 0xdbac60
call fcn.00dbe664
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], edi
mov byte [ebp - 4], 1
push 0xdd46f4
call fcn.00dba610
call fcn.00db97e0
push eax
push 0xdd46f8
call fcn.00dba610
add esp, 0xc
mov eax, dword [0xdda4c0]
cmp eax, edi
jne 0xdb848f
push edi
call fcn.00db9a00
add esp, 4
mov esi, eax
mov ecx, esi
call fcn.00dbb200
cmp eax, edi
je 0xdb8488
mov ecx, dword [eax + 8]
mov dword [0xdda4c4], ecx
mov eax, dword [eax + 0xc]
add eax, esi
mov dword [0xdda4c0], eax
jne 0xdb848f
mov eax, 0xdd496c
jmp 0xdb8492
add eax, 0x48
push eax
push 0xdd4700
call fcn.00dba610
push 0xdd84d0
push 0xdd4700
call fcn.00dba610
add esp, 0x10
call fcn.00db8bf0
mov dword [ebp - 0x18], eax
cmp eax, edi
jne 0xdb8565
push 0xdd4704
call fcn.00dba610
add esp, 4
call fcn.00db9800
call fcn.00db8760
test al, al
je 0xdb8565
push 0xdd4708
call fcn.00dba610
add esp, 4
call fcn.00db9710
mov esi, eax
mov dword [ebp - 0x18], esi
cmp esi, edi
je 0xdb8509
push esi
push 0xdd470c
call fcn.00dba610
push esi
push 1
jmp 0xdb855d
push 0xdd4718
call fcn.00dba610
add esp, 4
call fcn.00db9ad0
mov esi, eax
mov dword [ebp - 0x18], esi
cmp esi, edi
je 0xdb8534
push esi
push 0xdd471c
call fcn.00dba610
push esi
push 2
jmp 0xdb855d
push 0xdd4728
call fcn.00dba610
add esp, 4
call fcn.00db98c0
mov esi, eax
mov dword [ebp - 0x18], esi
cmp esi, edi
je 0xdb8579
push esi
push 0xdd46c8
call fcn.00dba610
push esi
push 3
call fcn.00dbb320
add esp, 0x10
call fcn.00db9890
lea esi, [ebp - 0x14]
call fcn.00dbac80
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xdd472c
call fcn.00dba610
push 0xdd4730
call fcn.00dba610
add esp, 8
call fcn.00db9890
lea esi, [ebp - 0x14]
call fcn.00dbac80
call fcn.00dba140
cmp eax, 1
jne 0xdb85b7
push edi
push edi
push edi
push 0xdb9f60
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], edi
call fcn.00db8300
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, edi
je 0xdb85d9
push eax
call fcn.00dbe664
add esp, 4
mov dword [ebp - 0x14], edi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xdb8760
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xdcf7c8
mov eax, dword fs:[0]
push eax
sub esp, 0x10c
mov eax, dword [0xdd7024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
xor edi, edi
cmp esi, edi
je 0xdb87e2
push 0xdd4aa4
push esi
call fcn.00dbd136
push 0xdd4ab8
push esi
call fcn.00dbd136
add esp, 0x10
cmp eax, edi
je 0xdb87e2
push 0xdd4acc
push eax
call fcn.00dbd136
add esp, 8
cmp eax, edi
je 0xdb87e2
push 0xa
add eax, 2
push edi
push eax
call fcn.00dbe45d
add esp, 0xc
cmp eax, edi
jne 0xdb890e
xor bl, bl
test byte [0xddaaf4], 1
mov dword [ebp - 0x118], edi
jne 0xdb8826
or dword [0xddaaf4], 1
mov dword [ebp - 4], edi
mov dword [0xddaae0], edi
mov dword [0xddaae4], edi
mov dword [0xddaae8], edi
mov byte [ebp - 4], bl
push 0xdd0110
call fcn.00dbcdf5
add esp, 4
mov dword [ebp - 4], 0xffffffff
call fcn.00dba960
test eax, eax
jne 0xdb8831
mov bl, 1
push 0x103
lea eax, [ebp - 0x113]
push edi
push eax
mov byte [ebp - 0x114], 0
call fcn.00dc1d20
push 0xdd4740
lea ecx, [ebp - 0x114]
push 0xdd4700
push ecx
call fcn.00dbd196
add esp, 0x18
test bl, bl
sete dl
movzx eax, dl
push eax
lea esi, [ebp - 0x114]
mov ecx, 0xddaae0
call fcn.00dbaca0
mov eax, 0xddaae0
call fcn.00dbad60
cmp bl, 1
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0xdb8901
lea edi, [ebp - 0x118]
mov esi, 0xddaae0
call fcn.00dba8b0
call ebx
sub eax, dword [ebp - 0x118]
cmp eax, 0x2710
jae 0xdb8901
push 0xdd4750
push 0x3ff
push 0xdd9ca8
call fcn.00dbd21a
push 0xdd479c
call fcn.00dba610
add esp, 0x10
push 0
push 0
push 0xdd9ca8
push 0xdb8740
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0xdb890e
push 0xbb8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call ebx
push eax
mov esi, 0xddaae0
call fcn.00dba7f0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00dbc69c
mov esp, ebp
pop ebp
ret
Function at 0xdb9b90
Capabilities:
Create process memory minidump

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4f4
mov eax, dword [0xdd7024]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x208
push eax
lea ecx, [ebp - 0x4de]
push ecx
mov word [ebp - 0x4e0], ax
call fcn.00dc1d20
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x2d2]
push eax
mov word [ebp - 0x2d4], dx
call fcn.00dc1d20
xor ecx, ecx
push 0xc6
push ecx
lea edx, [ebp - 0xca]
push edx
mov word [ebp - 0xcc], cx
call fcn.00dc1d20
push 0
call fcn.00dbd5dd
mov dword [ebp - 0x4e8], eax
lea eax, [ebp - 0x4e8]
push eax
mov dword [ebp - 0x4e4], edx
call fcn.00dbd5b6
add esp, 0x2c
push 0x104
lea ecx, [ebp - 0x2d4]
push ecx
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0xdb9c80
lea eax, [ebp - 0x2d4]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0xdb9c41
sub eax, edx
sar eax, 1
cmp word [ebp + eax*2 - 0x2d6], 0x5c
lea eax, [ebp + eax*2 - 0x2d6]
je 0xdb9c80
cmp word [eax], 0x2f
je 0xdb9c80
lea edx, [ebp - 0x2d4]
cmp eax, edx
je 0xdb9c80
xor ecx, ecx
mov word [eax], cx
sub eax, 2
cmp word [eax], 0x5c
jne 0xdb9c62
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
push edx
mov edx, dword [esi + 0xc]
push eax
mov eax, dword [esi + 0x10]
push ecx
mov ecx, dword [esi + 0x14]
push edx
inc eax
push eax
add ecx, 0x76c
push ecx
push 0xdd498c
lea edx, [ebp - 0xcc]
push 0x64
push edx
call fcn.00dbcb79
lea eax, [ebp - 0xcc]
push eax
lea ecx, [ebp - 0x2d4]
push ecx
push 0xdd49c8
lea edx, [ebp - 0x4e0]
push 0x104
push edx
call fcn.00dbcb79
add esp, 0x38
push 0
push 0
push 2
push 0
push 1
push 0x10000000
lea eax, [ebp - 0x4e0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0xdb9d40
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 0
lea ecx, [ebp - 0x4f4]
push ecx
push 2
push esi
mov dword [ebp - 0x4f4], eax
mov dword [ebp - 0x4ec], 1
mov dword [ebp - 0x4f0], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00dbc69c
mov esp, ebp
pop ebp
ret
Function at 0xdba140
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0xdd7024]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.00dc1d20
add esp, 0xc
push 0x104
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0xdba1fa
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0xdba1a0
sub eax, edx
sar eax, 1
cmp word [ebp + eax*2 - 0x20e], 0x5c
lea eax, [ebp + eax*2 - 0x20e]
je 0xdba1df
cmp word [eax], 0x2f
je 0xdba1df
lea ecx, [ebp - 0x20c]
cmp eax, ecx
je 0xdba1df
xor edx, edx
mov word [eax], dx
sub eax, 2
cmp word [eax], 0x5c
jne 0xdba1c1
lea eax, [ebp - 0x20c]
push 0xdd45ec
push eax
push 0xdd4ad0
mov edx, eax
call fcn.00dbaa40
add esp, 0xc
lea eax, [ebp - 0x20c]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0xdba203
mov ecx, dword [0xdd4a0c]
mov edx, dword [0xdd4a10]
mov dword [eax], ecx
mov ecx, dword [0xdd4a14]
mov dword [eax + 4], edx
mov edx, dword [0xdd4a18]
mov dword [eax + 8], ecx
mov ecx, dword [0xdd4a1c]
mov dword [eax + 0xc], edx
lea edx, [ebp - 0x20c]
push edx
push 0
push 0xdd45fc
push 0xdd4a20
mov dword [eax + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 4]
dec eax
neg eax
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.00dbc69c
mov esp, ebp
pop ebp
ret

Function at 0xdba270
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0xdd7024]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.00dc1d20
add esp, 0xc
push 0x104
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0xdba32a
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0xdba2d0
sub eax, edx
sar eax, 1
cmp word [ebp + eax*2 - 0x20e], 0x5c
lea eax, [ebp + eax*2 - 0x20e]
je 0xdba30f
cmp word [eax], 0x2f
je 0xdba30f
lea ecx, [ebp - 0x20c]
cmp eax, ecx
je 0xdba30f
xor edx, edx
mov word [eax], dx
sub eax, 2
cmp word [eax], 0x5c
jne 0xdba2f1
lea eax, [ebp - 0x20c]
push 0xdd45ec
push eax
push 0xdd4ad0
mov edx, eax
call fcn.00dbaa40
add esp, 0xc
lea eax, [ebp - 0x20c]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0xdba333
mov ecx, dword [0xdd4a0c]
mov edx, dword [0xdd4a10]
mov dword [eax], ecx
mov ecx, dword [0xdd4a14]
mov dword [eax + 4], edx
mov edx, dword [0xdd4a18]
mov dword [eax + 8], ecx
mov ecx, dword [0xdd4a1c]
mov dword [eax + 0xc], edx
lea edx, [ebp - 0x20c]
push edx
push 0
push 0xdd4a28
push 0xdd4a20
mov dword [eax + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 4]
dec eax
neg eax
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.00dbc69c
mov esp, ebp
pop ebp
ret