joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4606f0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x46078f
cmp dword [ebx + 0x94], 0
jne 0x460789
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x460678
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x460789
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x46074f
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x460789
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414898
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x46075e
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4609a8
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x46dca0]
cmp dword [eax + 0x30], 0
je 0x460b05
test bl, bl
jne 0x460a56
cmp dword [esi + 0x9c], 0
jne 0x460a4b
mov eax, esi
call fcn.004632d0
push eax
push 0x4608d4
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x460a1c
mov eax, dword [0x46dca0]
call fcn.004639b0
test al, al
je 0x460a1c
mov eax, dword [0x46dcc4]
call fcn.004057d8
mov edi, eax
cmp edi, 0
jl 0x460a1c
push 0
mov eax, dword [0x46dcc4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x460a06
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x460a4b
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00414898
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x460a2b
inc dword [esi + 0x9c]
jmp 0x460b05
cmp dword [esi + 0x9c], 0
jle 0x460b05
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x460b05
cmp dword [esi + 0x44], 0
je 0x460ab1
mov eax, dword [0x46dca0]
call fcn.004639b0
test al, al
je 0x460ab1
mov eax, dword [0x46dcc4]
call fcn.004057d8
mov edi, eax
cmp edi, 0
jl 0x460ab1
push 5
mov eax, dword [0x46dcc4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x460a9b
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x460ae0
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00414898
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x460ac0
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x46dcc4
mov ecx, 1
mov edx, dword [0x4608b4]
call fcn.0040598c
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4615ec
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x461656
mov eax, ebx
call fcn.004639b0
test al, al
jne 0x461656
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004049ec
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x461643
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x461663
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404950
jmp 0x461663
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404950
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x462ad4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x462b42
mov eax, esi
call fcn.0044b708
test al, al
je 0x462b42
mov eax, dword [ebx + 0x84]
call fcn.0044b368
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x462b42
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x462b36
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044b368
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.004431d8
jmp 0x462b42
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00462910
pop esi
pop ebx
ret
Function at 0x401215
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
mov esi, dword [sym.imp.USER32.dll_LoadIconA]
push edi
push 0x7f00
xor edi, edi
push edi
mov dword [ebp - 0x24], str.construct
mov dword [ebp - 0x44], 0x401000
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x4c], 0x30
call esi
push 0x7f00
push edi
mov dword [ebp - 0x34], eax
call esi
push 0x7f00
push edi
mov dword [ebp - 0x20], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
call esi
push edi
mov dword [0x4030f0], eax
mov dword [ebp - 0x38], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
je 0x401327
push 1
push dword [0x4030f0]
call dword [sym.imp.USER32.dll_LoadBitmapA]
push edi
push edi
call esi
push eax
push edi
push edi
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.displayed
push str.construct
push edi
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 0
push eax
mov dword [0x4030f8], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x401327
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
push 0
push 0
push 0
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x40130a
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x585d4999
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0x3c79741a
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4037b0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00403540

Function at 0x405c10
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x80000000
jae 0x405d0c
mov dword [ebp - 8], 1
push 0x94
call fcn.0047c10e
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405d07
push 0x94
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.00477ee0
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ecx], 0x94
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 4
jne 0x405c9a
mov dword [ebp - 8], 5
jmp 0x405cfb
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 5
jne 0x405cb5
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
jne 0x405cb5
mov dword [ebp - 8], 6
jmp 0x405cfb
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 5
jne 0x405cd0
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 1
jne 0x405cd0
mov dword [ebp - 8], 7
jmp 0x405cfb
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 5
jne 0x405ceb
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 2
jne 0x405ceb
mov dword [ebp - 8], 8
jmp 0x405cfb
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 6
jb 0x405cfb
mov dword [ebp - 8], 9
mov edx, dword [ebp - 4]
push edx
call fcn.0047b4f8
add esp, 4
jmp 0x405db4
mov eax, dword [ebp - 0xc]
and eax, 0xffff
movzx ecx, ax
and ecx, 0xff
movzx edx, cl
cmp edx, 4
jge 0x405d31
mov dword [ebp - 8], 0
jmp 0x405db4
mov dword [ebp - 8], 2
push 0x94
call fcn.0047c10e
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405db4
push 0x94
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.00477ee0
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ecx], 0x94
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 4
jne 0x405d8f
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0xa
jne 0x405d8f
mov dword [ebp - 8], 3
jmp 0x405da8
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 4
jne 0x405da8
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0x5a
jne 0x405da8
mov dword [ebp - 8], 4
mov ecx, dword [ebp - 4]
push ecx
call fcn.0047b4f8
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4220d0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x68], 0
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x10], 0
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x10], 0
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx], 0x67452301
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax], 0xefcdab89
mov edx, 4
shl edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0x98badcfe
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0x10325476
mov esp, ebp
pop ebp
ret

Function at 0x422150
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x4c506c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x814], ecx
mov dword [ebp - 0x80c], 0
cmp dword [ebp + 0xc], 0
jne 0x4221c2
call fcn.00421970
cmp eax, 4
jg 0x42219e
push str.path_is_null.
push 4
push 0x4bbca0
push 0x65
push 0x4bbcb0
call fcn.00421d50
add esp, 0x14
push 0x4b9d22
mov ecx, dword [ebp + 8]
call fcn.004046a0
mov eax, dword [ebp - 0x80c]
or eax, 1
mov dword [ebp - 0x80c], eax
mov eax, dword [ebp + 8]
jmp 0x422332
mov ecx, dword [ebp - 0x814]
call fcn.004220d0
push 0
push 0
push 3
push 0
push 3
push closesocket
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x810], eax
cmp dword [ebp - 0x810], 0xffffffff
je 0x422296
push 0x400
push 0
lea edx, [ebp - 0x404]
push edx
call fcn.00477ee0
add esp, 0xc
push 0
lea eax, [ebp - 0x808]
push eax
push 0x400
lea ecx, [ebp - 0x404]
push ecx
mov edx, dword [ebp - 0x810]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42225e
mov eax, dword [ebp - 0x808]
push eax
lea ecx, [ebp - 0x404]
push ecx
mov ecx, dword [ebp - 0x814]
call fcn.00422350
cmp dword [ebp - 0x808], 0x400
jae 0x42225c
jmp 0x42225e
jmp 0x42220f
mov edx, dword [ebp - 0x810]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x814]
call fcn.004238f0
mov ecx, dword [ebp - 0x80c]
or ecx, 1
mov dword [ebp - 0x80c], ecx
mov eax, dword [ebp + 8]
jmp 0x422332
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x818], eax
push 0x400
push 0
lea edx, [ebp - 0x804]
push edx
call fcn.00477ee0
add esp, 0xc
push 0
push 0x400
lea eax, [ebp - 0x804]
push eax
push 0
mov ecx, dword [ebp - 0x818]
push ecx
push 0
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
call fcn.00421970
cmp eax, 3
jg 0x422313
lea edx, [ebp - 0x804]
push edx
mov eax, dword [ebp - 0x818]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.open_file___s__error._lasterror___d___s
push 3
push str.MD5::encodeFile
push 0x7e
push str.D:_tyb_updateUpdater_toolsmd5md5.cpp
call fcn.00421d50
add esp, 0x20
push 0x4b9d23
mov ecx, dword [ebp + 8]
call fcn.004046a0
mov edx, dword [ebp - 0x80c]
or edx, 1
mov dword [ebp - 0x80c], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00475c6f
mov esp, ebp
pop ebp
ret 8
Function at 0x424030
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4c506c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0x10], 0
jg 0x42405a
jl 0x424051
cmp dword [ebp + 0xc], 0
ja 0x42405a
xor eax, eax
xor edx, edx
jmp 0x424191
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x38], 0
je 0x42407c
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.0040c040
jmp 0x424191
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x10]
call fcn.0040da40
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x4240eb
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
call fcn.004050e0
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.0040dba0
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00404c20
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.0040db20
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x4c], 0
je 0x424182
mov ecx, dword [ebp - 0x10]
call fcn.00424d10
mov dword [ebp - 0x24], 0xfff
cmp dword [ebp - 8], 0xfff
jbe 0x42415b
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0048644a
add esp, 0x10
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x18]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
cmp dword [ebp - 0x18], 0xfff
je 0x424159
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x424191
jmp 0x424107
cmp dword [ebp - 8], 0
jbe 0x424182
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.0048644a
add esp, 0x10
mov ecx, dword [ebp - 8]
sub ecx, eax
mov dword [ebp - 8], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00475c6f
mov esp, ebp
pop ebp
ret 0xc
Function at 0x424620
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x4c506c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov dword [ebp - 0x38], ecx
call fcn.004050d0
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x4c]
push ecx
call fcn.0040de90
add esp, 8
movzx edx, al
test edx, edx
je 0x424665
lea eax, [ebp + 8]
push eax
call fcn.0040de40
add esp, 4
jmp 0x4247e2
mov ecx, dword [ebp - 0x38]
call fcn.0040db80
test eax, eax
je 0x4246a7
mov ecx, dword [ebp - 0x38]
call fcn.0040db80
mov esi, eax
mov ecx, dword [ebp - 0x38]
call fcn.0040dac0
cmp esi, eax
jae 0x4246a7
lea ecx, [ebp + 8]
push ecx
call fcn.0040ded0
add esp, 4
mov bl, al
mov ecx, dword [ebp - 0x38]
call fcn.0040d970
mov byte [eax], bl
mov eax, dword [ebp + 8]
jmp 0x4247e2
mov edx, dword [ebp - 0x38]
cmp dword [edx + 0x4c], 0
jne 0x4246ba
call fcn.004050d0
jmp 0x4247e2
mov ecx, dword [ebp - 0x38]
call fcn.00424d10
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x38], 0
jne 0x424709
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x4c]
push edx
lea eax, [ebp + 8]
push eax
call fcn.0040ded0
add esp, 4
movzx ecx, al
push ecx
call fcn.00423a30
add esp, 8
movzx edx, al
test edx, edx
je 0x4246f9
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
jmp 0x424701
call fcn.004050d0
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
jmp 0x4247e2
mov dword [ebp - 0x50], 0x20
lea ecx, [ebp + 8]
push ecx
call fcn.0040ded0
add esp, 4
mov byte [ebp - 0x2a], al
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x29]
push eax
lea ecx, [ebp - 0x2a]
push ecx
mov edx, dword [ebp - 0x38]
add edx, 0x40
push edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x38]
call fcn.00424bc0
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x424760
cmp dword [ebp - 0x3c], 1
je 0x424760
cmp dword [ebp - 0x3c], 3
je 0x4247ad
jmp 0x4247dd
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x40], ecx
je 0x424792
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x40]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.0047ed3f
add esp, 0x10
cmp dword [ebp - 0x40], eax
je 0x424792
call fcn.004050d0
jmp 0x4247e2
mov ecx, dword [ebp - 0x38]
mov byte [ecx + 0x3d], 1
lea edx, [ebp - 0x2a]
cmp dword [ebp - 0x34], edx
je 0x4247a6
mov eax, dword [ebp + 8]
jmp 0x4247e2
call fcn.004050d0
jmp 0x4247e2
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
movzx edx, byte [ebp - 0x2a]
push edx
call fcn.00423a30
add esp, 8
movzx eax, al
test eax, eax
je 0x4247d0
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x48], ecx
jmp 0x4247d8
call fcn.004050d0
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
jmp 0x4247e2
call fcn.004050d0
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00475c6f
mov esp, ebp
pop ebp
ret 4
Function at 0x424da0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x4c506c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x38], 0
je 0x424dc7
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x424dce
mov al, 1
jmp 0x424ea9
call fcn.004050d0
push eax
mov eax, dword [ebp - 0x30]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x30]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x40], eax
call fcn.004050d0
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x44]
push edx
call fcn.0040de90
add esp, 8
movzx eax, al
test eax, eax
je 0x424e0a
xor al, al
jmp 0x424ea9
mov dword [ebp - 0x48], 0x20
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x30]
mov ecx, dword [edx + 0x38]
call fcn.00425260
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x424e46
cmp dword [ebp - 0x34], 1
je 0x424e4d
cmp dword [ebp - 0x34], 3
je 0x424e9c
jmp 0x424ea7
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x3d], 0
mov ecx, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x38], ecx
je 0x424e7c
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.0047ed3f
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x424e7c
xor al, al
jmp 0x424ea9
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x424e90
mov dword [ebp - 0x3c], 1
jmp 0x424e97
mov dword [ebp - 0x3c], 0
mov al, byte [ebp - 0x3c]
jmp 0x424ea9
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x3d], 0
mov al, 1
jmp 0x424ea9
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00475c6f
mov esp, ebp
pop ebp
ret
Function at 0x426920
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a078b
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x4c506c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x130], 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x150]
push ecx
call fcn.00406450
add esp, 8
mov dword [ebp - 0x134], eax
mov edx, dword [ebp - 0x134]
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], 0
push str.launcher_config.ini
mov eax, dword [ebp - 0x138]
push eax
lea ecx, [ebp - 0x12c]
push ecx
call fcn.0040fc70
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x150]
call fcn.00404630
push 0x104
push 0
lea edx, [ebp - 0x114]
push edx
call fcn.00477ee0
add esp, 0xc
lea ecx, [ebp - 0x12c]
call fcn.00404610
push eax
push 0x103
lea eax, [ebp - 0x114]
push eax
push 0x4b9d3a
push 0x4bc240
push 0x4bc248
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x114]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004046a0
mov edx, dword [ebp - 0x130]
or edx, 1
mov dword [ebp - 0x130], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.00404630
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00475c6f
mov esp, ebp
pop ebp
ret

Function at 0x426a40
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a078b
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x4c506c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x130], 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x150]
push ecx
call fcn.00406450
add esp, 8
mov dword [ebp - 0x134], eax
mov edx, dword [ebp - 0x134]
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], 0
push str.launcher_config.ini
mov eax, dword [ebp - 0x138]
push eax
lea ecx, [ebp - 0x12c]
push ecx
call fcn.0040fc70
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x150]
call fcn.00404630
push 0x104
push 0
lea edx, [ebp - 0x114]
push edx
call fcn.00477ee0
add esp, 0xc
lea ecx, [ebp - 0x12c]
call fcn.00404610
push eax
push 0x103
lea eax, [ebp - 0x114]
push eax
push 0x4b9d3b
push str.updatecfg
push str.MainProgram
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x114]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004046a0
mov edx, dword [ebp - 0x130]
or edx, 1
mov dword [ebp - 0x130], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.00404630
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00475c6f
mov esp, ebp
pop ebp
ret