joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450680
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x84
mov eax, dword [0x45f008]
xor eax, esp
mov dword [esp + 0x80], eax
push esi
push edi
mov edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
mov dword [esp + 8], 0x420041
xor edx, edx
mov dword [esp + 0xc], 0x440043
mov dword [esp + 0x10], 0x460045
mov dword [esp + 0x14], 0x480047
mov dword [esp + 0x18], 0x4a0049
mov dword [esp + 0x1c], 0x4c004b
mov dword [esp + 0x20], 0x4e004d
mov dword [esp + 0x24], 0x50004f
mov dword [esp + 0x28], 0x520051
mov dword [esp + 0x2c], 0x540053
mov dword [esp + 0x30], 0x560055
mov dword [esp + 0x34], 0x580057
mov dword [esp + 0x38], 0x5a0059
mov dword [esp + 0x3c], 0x620061
mov dword [esp + 0x40], 0x640063
mov dword [esp + 0x44], 0x660065
mov dword [esp + 0x48], 0x680067
mov dword [esp + 0x4c], 0x6a0069
mov dword [esp + 0x50], 0x6c006b
mov dword [esp + 0x54], 0x6e006d
mov dword [esp + 0x58], 0x70006f
mov dword [esp + 0x5c], 0x720071
mov dword [esp + 0x60], 0x740073
mov dword [esp + 0x64], 0x760075
mov dword [esp + 0x68], 0x780077
mov dword [esp + 0x6c], 0x7a0079
mov dword [esp + 0x70], 0x310030
mov dword [esp + 0x74], 0x330032
mov dword [esp + 0x78], 0x350034
mov dword [esp + 0x7c], 0x370036
mov dword [esp + 0x80], 0x390038
mov dword [esp + 0x84], 0x2f002b
test esi, esi
jle 0x4507e1
nop dword [eax]
movzx ecx, word [edi + edx*2]
xor eax, eax
cmp word [esp + eax*2 + 8], cx
je 0x4507dc
inc eax
cmp eax, 0x40
jb 0x4507b6
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.00421268
add esp, 0x84
ret
inc edx
cmp edx, esi
jl 0x4507b0
mov ecx, dword [esp + 0x88]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.00421268
add esp, 0x84
ret
Function at 0x10001060
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [ebp + 0x20], 0
xorps xmm0, xmm0
push ebx
push esi
push edi
movlpd qword [ebp - 8], xmm0
je 0x10001121
cmp dword [ebp + 0x18], 0
jl 0x100011ca
mov edi, dword [ebp + 0x14]
jg 0x10001092
test edi, edi
je 0x100011ca
mov dl, byte [ebp + 0x1c]
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
nop dword [eax + eax]
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov cl, byte [esi + eax]
mov al, cl
shr cl, 1
and al, 1
xor al, dl
mov byte [edi + esi*8], al
mov al, cl
and al, 1
shr cl, 1
xor al, dl
mov byte [edi + esi*8 + 1], al
mov al, cl
and al, 1
shr cl, 1
xor al, dl
mov byte [edi + esi*8 + 2], al
mov al, cl
and al, 1
shr cl, 1
xor al, dl
mov byte [edi + esi*8 + 3], al
mov al, cl
and al, 1
shr cl, 1
xor al, dl
mov byte [edi + esi*8 + 4], al
mov al, cl
and al, 1
shr cl, 1
xor al, dl
mov byte [edi + esi*8 + 5], al
mov al, cl
and al, 1
shr cl, 1
xor al, dl
xor cl, dl
mov byte [edi + esi*8 + 6], al
mov eax, edi
mov edi, dword [ebp + 0x14]
mov byte [eax + esi*8 + 7], cl
add esi, 1
adc ebx, 0
cmp ebx, dword [ebp + 0x18]
jl 0x100010a0
jg 0x100011ca
cmp esi, edi
jb 0x100010a0
jmp 0x100011ca
cmp dword [ebp + 0x18], 0
jl 0x100011ca
mov esi, dword [ebp + 0x14]
jg 0x10001138
test esi, esi
je 0x100011ca
mov bl, byte [ebp + 0x1c]
mov edi, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov cl, byte [edx + eax]
mov al, cl
shr al, 7
xor al, bl
mov byte [esi + edx*8], al
mov al, cl
shr al, 6
and al, 1
shl cl, 2
xor al, bl
mov byte [esi + edx*8 + 1], al
mov al, cl
shr al, 7
xor al, bl
mov byte [esi + edx*8 + 2], al
mov al, cl
shr al, 6
and al, 1
shl cl, 2
xor al, bl
mov byte [esi + edx*8 + 3], al
mov al, cl
shr al, 7
xor al, bl
mov byte [esi + edx*8 + 4], al
mov al, cl
shr al, 6
and al, 1
xor al, bl
mov byte [esi + edx*8 + 5], al
mov al, cl
shr al, 5
and al, 1
shr cl, 4
xor al, bl
and cl, 1
mov byte [esi + edx*8 + 6], al
xor cl, bl
mov eax, esi
mov esi, dword [ebp + 0x14]
mov byte [eax + edx*8 + 7], cl
add edx, 1
adc edi, 0
cmp edi, dword [ebp + 0x18]
jl 0x10001141
jg 0x100011ca
cmp edx, esi
jb 0x10001141
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0xffffffff
mov dword [eax + 0xc], 0x7fffffff
mov dword [eax + 0x10], 0xffffffff
mov dword [eax + 0x14], 0x7fffffff
mov esp, ebp
pop ebp
ret
Function at 0x1000bfb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
lea esi, [ecx - 1]
mov eax, esi
mov dword [ebp - 8], esi
sar eax, 1
push edi
mov edi, dword [ebp + 0xc]
mov edx, edi
mov dword [ebp + 0xc], edi
mov dword [ebp - 4], eax
cmp edi, eax
jge 0x1000c021
nop dword [eax + eax]
mov ecx, dword [ebp + 0x18]
lea esi, [edx + edx]
push dword [ebx + esi*8 + 0xc]
push dword [ebx + esi*8 + 8]
push dword [ebx + esi*8 + 0x14]
push dword [ebx + esi*8 + 0x10]
call fcn.1000d740
movzx edx, al
xor edx, 1
inc edx
add edx, esi
mov eax, dword [ebx + edx*8]
mov ecx, dword [ebx + edx*8 + 4]
mov dword [ebx + edi*8], eax
mov eax, dword [ebp - 4]
mov dword [ebx + edi*8 + 4], ecx
mov edi, edx
cmp edx, eax
jl 0x1000bfe0
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp - 8]
cmp edx, eax
jne 0x1000c03b
test cl, 1
jne 0x1000c03b
mov eax, dword [ebx + ecx*8 - 8]
mov ecx, dword [ebx + ecx*8 - 4]
mov dword [ebx + edi*8], eax
mov dword [ebx + edi*8 + 4], ecx
mov edi, esi
mov esi, dword [ebp + 0x18]
cmp dword [ebp + 0xc], edi
jge 0x1000c082
mov ecx, dword [ebp + 0x14]
lea eax, [edi - 1]
sar eax, 1
mov dword [ebp + 8], eax
lea eax, [ebx + eax*8]
mov dword [ebp + 0x10], eax
push dword [ecx + 4]
push dword [ecx]
mov ecx, esi
push dword [eax + 4]
push dword [eax]
call fcn.1000d740
test al, al
je 0x1000c082
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebx + edi*8], eax
mov eax, dword [ebp + 8]
mov dword [ebx + edi*8 + 4], ecx
mov edi, eax
cmp dword [ebp + 0xc], eax
jl 0x1000c043
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebx + edi*8], eax
mov dword [ebx + edi*8 + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c0a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
lea esi, [ecx - 1]
mov eax, esi
mov dword [ebp - 8], esi
sar eax, 1
push edi
mov edi, dword [ebp + 0xc]
mov edx, edi
mov dword [ebp + 0xc], edi
mov dword [ebp - 4], eax
cmp edi, eax
jge 0x1000c111
nop dword [eax + eax]
mov ecx, dword [ebp + 0x18]
lea esi, [edx + edx]
push dword [ebx + esi*8 + 0xc]
push dword [ebx + esi*8 + 8]
push dword [ebx + esi*8 + 0x14]
push dword [ebx + esi*8 + 0x10]
call fcn.1000d7b0
movzx edx, al
xor edx, 1
inc edx
add edx, esi
mov eax, dword [ebx + edx*8]
mov ecx, dword [ebx + edx*8 + 4]
mov dword [ebx + edi*8], eax
mov eax, dword [ebp - 4]
mov dword [ebx + edi*8 + 4], ecx
mov edi, edx
cmp edx, eax
jl 0x1000c0d0
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp - 8]
cmp edx, eax
jne 0x1000c12b
test cl, 1
jne 0x1000c12b
mov eax, dword [ebx + ecx*8 - 8]
mov ecx, dword [ebx + ecx*8 - 4]
mov dword [ebx + edi*8], eax
mov dword [ebx + edi*8 + 4], ecx
mov edi, esi
mov esi, dword [ebp + 0x18]
cmp dword [ebp + 0xc], edi
jge 0x1000c172
mov ecx, dword [ebp + 0x14]
lea eax, [edi - 1]
sar eax, 1
mov dword [ebp + 8], eax
lea eax, [ebx + eax*8]
mov dword [ebp + 0x10], eax
push dword [ecx + 4]
push dword [ecx]
mov ecx, esi
push dword [eax + 4]
push dword [eax]
call fcn.1000d7b0
test al, al
je 0x1000c172
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebx + edi*8], eax
mov eax, dword [ebp + 8]
mov dword [ebx + edi*8 + 4], ecx
mov edi, eax
cmp dword [ebp + 0xc], eax
jl 0x1000c133
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebx + edi*8], eax
mov dword [ebx + edi*8 + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002f3c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x18]
lea eax, [ecx - 1]
mov dword [ebp - 8], eax
sar eax, 1
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edi
mov dword [ebp + 0xc], edi
mov dword [ebp - 4], eax
cmp edi, eax
jge 0x1002f430
nop dword [eax]
mov ecx, dword [esi]
add ebx, ebx
mov eax, dword [edx + ebx*8 + 8]
push dword [ecx + eax*4]
mov eax, dword [edx + ebx*8 + 0x10]
push dword [ecx + eax*4]
call fcn.10035bb0
mov edx, dword [ebp + 8]
add esp, 8
movzx eax, al
xor eax, 1
inc eax
add ebx, eax
mov eax, dword [edx + ebx*8]
mov ecx, dword [edx + ebx*8 + 4]
mov dword [edx + edi*8], eax
mov eax, dword [ebp - 4]
mov dword [edx + edi*8 + 4], ecx
mov edi, ebx
cmp ebx, eax
jl 0x1002f3f0
mov ecx, dword [ebp + 0x10]
cmp ebx, eax
jne 0x1002f44b
test cl, 1
jne 0x1002f44b
mov eax, dword [edx + ecx*8 - 8]
mov ecx, dword [edx + ecx*8 - 4]
mov dword [edx + edi*8], eax
mov dword [edx + edi*8 + 4], ecx
mov edi, dword [ebp - 8]
cmp dword [ebp + 0xc], edi
jge 0x1002f48f
mov eax, dword [ebp + 0x14]
lea ebx, [edi - 1]
mov ecx, dword [esi]
sar ebx, 1
lea edx, [edx + ebx*8]
mov eax, dword [eax]
mov dword [ebp + 0x10], edx
push dword [ecx + eax*4]
mov eax, dword [edx]
push dword [ecx + eax*4]
call fcn.10035bb0
mov edx, dword [ebp + 8]
add esp, 8
test al, al
je 0x1002f48f
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [edx + edi*8], eax
mov dword [edx + edi*8 + 4], ecx
mov edi, ebx
cmp dword [ebp + 0xc], ebx
jl 0x1002f450
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [edx + edi*8], eax
mov dword [edx + edi*8 + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100302b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x18]
lea eax, [ecx - 1]
mov dword [ebp - 8], eax
sar eax, 1
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edi
mov dword [ebp + 0xc], edi
mov dword [ebp - 4], eax
cmp edi, eax
jge 0x10030320
nop dword [eax]
mov ecx, dword [esi]
add ebx, ebx
mov eax, dword [edx + ebx*8 + 8]
push dword [ecx + eax*4]
mov eax, dword [edx + ebx*8 + 0x10]
push dword [ecx + eax*4]
call fcn.10035c40
mov edx, dword [ebp + 8]
add esp, 8
movzx eax, al
xor eax, 1
inc eax
add ebx, eax
mov eax, dword [edx + ebx*8]
mov ecx, dword [edx + ebx*8 + 4]
mov dword [edx + edi*8], eax
mov eax, dword [ebp - 4]
mov dword [edx + edi*8 + 4], ecx
mov edi, ebx
cmp ebx, eax
jl 0x100302e0
mov ecx, dword [ebp + 0x10]
cmp ebx, eax
jne 0x1003033b
test cl, 1
jne 0x1003033b
mov eax, dword [edx + ecx*8 - 8]
mov ecx, dword [edx + ecx*8 - 4]
mov dword [edx + edi*8], eax
mov dword [edx + edi*8 + 4], ecx
mov edi, dword [ebp - 8]
cmp dword [ebp + 0xc], edi
jge 0x1003037f
mov eax, dword [ebp + 0x14]
lea ebx, [edi - 1]
mov ecx, dword [esi]
sar ebx, 1
lea edx, [edx + ebx*8]
mov eax, dword [eax]
mov dword [ebp + 0x10], edx
push dword [ecx + eax*4]
mov eax, dword [edx]
push dword [ecx + eax*4]
call fcn.10035c40
mov edx, dword [ebp + 8]
add esp, 8
test al, al
je 0x1003037f
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [edx + edi*8], eax
mov dword [edx + edi*8 + 4], ecx
mov edi, ebx
cmp dword [ebp + 0xc], ebx
jl 0x10030340
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [edx + edi*8], eax
mov dword [edx + edi*8 + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402ea9
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, esi
lea eax, [ebp - 4]
and esi, 0x300
push eax
mov eax, esi
and edi, 1
or al, 9
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004064d5
xor ebx, ebx
cmp eax, ebx
jne 0x402f8c
test byte [ebp + 0x10], 2
je 0x402f0a
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 8], ebx
push eax
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x402f71
lea eax, [ebp - 0x214]
push 0x105
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x402f46
test edi, edi
jne 0x402f71
push dword [ebp + 0x10]
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 4]
call fcn.00402ea9
test eax, eax
jne 0x402f4f
lea eax, [ebp - 0x214]
push 0x105
push eax
push edi
push dword [ebp - 4]
call ebx
test eax, eax
je 0x402f1f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.00406a35
test eax, eax
jne 0x402f81
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x402f8c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
jmp 0x402f8c
push 0
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4056ca
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ebp, 0xfffffed5
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.004047c6
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a

Function at 0x406158
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.004047e8
lodsb al, byte [esi]
push esi
stosb byte es:[edi], al
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x6f4]
push eax
call fcn.004047f8
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004047ad
add esp, 0xc
mov dword [ebp - 0x730], eax
invalid
movsd dword es:[edi], dword [esi]
add al, 0xf9
Function at 0xd68b7b
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xd68886
sub eax, 0xa3e10801
add eax, eax
mov ebx, 0xd6ce688
call fcn.00d68bc2
or ebx, eax
mov eax, 0xd70977ed
xor dword [esi], edx
or eax, ebx
sub eax, eax
add ebx, 0x6340ab04
add esi, 2
add eax, 0xf4d21496
dec eax
dec eax
cmp esi, ecx
jl fcn.00d68b7b
or ebx, eax
ret
Function at 0x402030
Capabilities:
Create thread

Disassembly:
mov eax, dword [esi + 0x184]
test eax, eax
je 0x40207d
push 0xffffffffffffffff
push eax
mov dword [esi + 0x188], 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x184]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi + 0xb4c]
push ecx
mov dword [esi + 0x184], 0
call fcn.005169a4
add esp, 4
mov dword [esi + 0xb4c], 0
movzx edx, word [esi + 0x10]
movzx eax, word [esi + 0x12]
imul eax, edx
push edi
lea edi, [eax + eax*2]
push edi
mov dword [esi + 0x188], 1
call fcn.00516910
push edi
push 0
push eax
mov dword [esi + 0xb4c], eax
call fcn.00518800
add esp, 0x10
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push esi
push 0
push 0x401840
mov dword [esi + 0x184], eax
call fcn.00516b86
add esp, 0xc
pop edi
ret
Function at 0x403a50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403a6b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403aa2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x403a9e
jmp 0x403a90
cmp esi, eax
jae 0x403aa2
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x403a90
cmp esi, eax
jb 0x403aa9
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403fe0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53df70
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x591a60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 2
call fcn.004199ce
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x404026
push 0x80004005
call fcn.00401570
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
fld dword [ebp + 0x14]
sub esp, 8
mov byte [ebp - 4], 3
fstp qword [esp]
lea ecx, [ebp - 0x10]
push 0x56a1b0
push ecx
call fcn.00401640
mov esi, dword [ebp - 0x10]
mov eax, dword [esi - 8]
mov edi, dword [ebp + 0x10]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
add esp, 0x10
or eax, ecx
jge 0x40407d
push 0x104
lea ecx, [ebp - 0x10]
call fcn.004014d0
mov esi, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edi
push 0x104
push esi
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.00516da6
add esp, 8
test eax, eax
js 0x404164
cmp eax, dword [esi - 8]
jg 0x404164
mov dword [esi - 0xc], eax
push esi
mov byte [eax + esi], 0
call fcn.00516ef5
fstp dword [ebp - 0x10]
lea eax, [esi - 0x10]
add esp, 4
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4040e4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404107
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40412a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404150
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
fld dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00401570
int3
Function at 0x4042a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push esi
push eax
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esi, eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4042d8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4042f7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404316
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x404450
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53dee9
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x591a60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 4
call fcn.004199ce
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4044a0
push 0x80004005
call fcn.00401570
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
mov edi, dword [ebp + 0x14]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x104
or eax, ecx
mov dword [ebp - 0x10], 1
jge 0x4044d8
push 0x104
mov ecx, esi
call fcn.004014d0
mov eax, dword [esi]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
push edi
push 0x104
push eax
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x40450e
push ecx
push eax
call fcn.00516da6
add esp, 8
test eax, eax
js 0x4045c1
mov ecx, dword [esi]
cmp eax, dword [ecx - 8]
jg 0x4045c1
mov dword [ecx - 0xc], eax
mov ecx, dword [esi]
mov byte [eax + ecx], 0
mov byte [ebp - 4], 3
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404545
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404568
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40458b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4045ae
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00401570
int3