joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41223a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 0x108]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x412275
push esi
lea eax, [ebp - 0x108]
push str.C:Temp
push eax
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0
lea eax, [ebp - 0x108]
push 0x42e020
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
pop esi
je 0x41229e
lea eax, [ebp - 0x20c]
push eax
jmp 0x4122a3
push 0x43127c
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [ebp + 8]
leave
ret

Function at 0x412326
Capabilities:
Copy file

Disassembly:
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
neg eax
sbb eax, eax
neg eax
ret

Function at 0x412ec8
Capabilities:
Check if file exists
Delete file

Disassembly:
mov eax, 0x4235a4
call sub.MSVCRT.dll__EH_prolog
push ecx
lea eax, [ebp - 0x10]
push esi
mov esi, ecx
push eax
call fcn.00412e1c
push dword [ebp - 0x10]
and dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push dword [ebp - 0x10]
test eax, eax
jne 0x412f09
push 0x42e0f4
add esi, 8
push esi
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push 2
pop esi
jmp 0x412f30
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0x10]
test eax, eax
jne 0x412f1d
push 0x42e0dc
jmp 0x412ef8
add esi, 8
push 0x42e0c8
push esi
call sub.MFC42.DLL_CString::Format
add esp, 0xc
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x413a1e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov ecx, dword [esi + 0x10]
mov dword [ebp - 4], edi
cmp ecx, edi
je 0x413a39
call fcn.0040a161
jmp 0x413a3b
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push 0x20019
push edi
push eax
push dword [esi + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x413a57
xor eax, eax
jmp 0x413a87
mov ecx, dword [esi + 0x18]
cmp ecx, edi
je 0x413a65
call fcn.0040a161
jmp 0x413a67
xor eax, eax
push edi
push edi
push edi
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x413a7c
push 1
pop edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x413a8b
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, ecx
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x413aa4
call fcn.0040a161
jmp 0x413aa6
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push 0x20006
push 0
push eax
push dword [esi + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x413ae6
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x413acd
call fcn.0040a161
jmp 0x413acf
xor eax, eax
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
test eax, eax
je 0x413aea
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x413b0d
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x413afe
call fcn.0040a161
jmp 0x413b00
xor eax, eax
push eax
push dword [esi + 0xc]
call dword [sym.imp.SHLWAPI.dll_SHDeleteEmptyKeyA]
push 1
pop eax
pop esi
leave
ret

Function at 0x414da0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x24]
mov ecx, dword [esi + 0x64]
mov eax, dword [esi + 0x34]
mov edx, dword [esi + 0x6c]
sub eax, ecx
sub eax, edx
mov dword [ebp + 8], eax
jne 0x414dca
test ecx, ecx
jne 0x414dd4
test edx, edx
jne 0x414dd4
mov eax, edi
jmp 0x414e40
cmp eax, 0xffffffff
jne 0x414dd4
push 0xfffffffffffffffe
pop eax
jmp 0x414e40
mov edx, dword [esi + 0x24]
lea edx, [edi + edx - 0x106]
cmp ecx, edx
jb 0x414e40
mov eax, dword [esi + 0x30]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call sub.MSVCRT.dll_memcpy
mov ecx, dword [esi + 0x44]
mov eax, dword [esi + 0x3c]
sub dword [esi + 0x68], edi
sub dword [esi + 0x64], edi
add esp, 0xc
sub dword [esi + 0x54], edi
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx edx, word [eax]
mov ebx, edx
sub ebx, edi
cmp edx, edi
sbb edx, edx
not edx
and edx, ebx
dec ecx
mov word [eax], dx
jne 0x414e05
mov eax, dword [esi + 0x38]
mov edx, edi
lea eax, [eax + edi*2]
dec eax
dec eax
movzx ecx, word [eax]
mov ebx, ecx
sub ebx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, ebx
dec edx
mov word [eax], cx
jne 0x414e24
mov eax, dword [ebp + 8]
add eax, edi
mov ecx, dword [esi]
cmp dword [ecx + 4], 0
je 0x414e9b
push eax
mov eax, dword [esi + 0x6c]
add eax, dword [esi + 0x64]
add eax, dword [esi + 0x30]
push eax
push ecx
call fcn.00414ea0
add dword [esi + 0x6c], eax
mov ebx, dword [esi + 0x6c]
add esp, 0xc
cmp ebx, 3
jb 0x414e87
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x30]
lea edx, [eax + ecx]
mov ecx, dword [esi + 0x50]
movzx eax, byte [edx]
mov dword [esi + 0x40], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x4c]
mov dword [esi + 0x40], eax
cmp ebx, 0x106
jae 0x414e9b
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x414dac
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4197e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
test ebx, ebx
mov edi, ecx
jne 0x41980f
mov eax, dword [esp + 0x10]
push eax
push 2
push eax
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
mov ecx, edi
call sub.MFC42.DLL_CGdiObject::Attach
pop edi
pop esi
pop ebx
ret 8
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x41982f
pop edi
pop esi
pop ebx
ret 8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov ecx, edi
call fcn.00419710
pop edi
pop esi
pop ebx
ret 8
Function at 0x41cac0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x4314b0]
sub esp, 0x104
test eax, eax
jne 0x41cca1
mov eax, dword [0x4314b4]
test eax, eax
jne 0x41ccd8
mov eax, dword [0x42f8f0]
test eax, eax
je 0x41cafe
push 0x431498
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x42f8f0], 0
push 0x431498
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4314b0]
test eax, eax
jne 0x41cc96
mov al, byte [0x431f84]
test al, al
je 0x41cb39
push 0x431f84
lea eax, [esp + 4]
push str._sGLJPG.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x41cb4c
lea ecx, [esp]
push str.GLJPG.dll
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x4314b0], eax
jne 0x41cb7e
push 0x431498
mov dword [0x4314b4], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add esp, 0x104
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LoadJpgFileImageData
push eax
call esi
mov dword [0x4314b8], eax
mov eax, dword [0x4314b0]
push str.LoadJpgImageDataFromMem
push eax
call esi
mov ecx, dword [0x4314b0]
push str.LoadJpgFile
push ecx
mov dword [0x4314bc], eax
call esi
mov edx, dword [0x4314b0]
push str.LoadJpgFromMem
push edx
mov dword [0x4314c0], eax
call esi
mov dword [0x4314c4], eax
mov eax, dword [0x4314b0]
push str.WriteBitmapToJpeg
push eax
call esi
mov ecx, dword [0x4314b0]
push str.WriteDibToJpeg
push ecx
mov dword [0x4314c8], eax
call esi
mov edx, dword [0x4314b0]
push str.WriteDibToJpegMEM
push edx
mov dword [0x4314cc], eax
call esi
mov dword [0x4314d0], eax
mov eax, dword [0x4314b0]
push str.GetPointerFromHandleLock
push eax
call esi
mov ecx, dword [0x4314b0]
push str.UnLockDataHandle
push ecx
mov dword [0x4314d4], eax
call esi
mov edx, dword [0x4314b0]
push str.FreeDataHandle
push edx
mov dword [0x4314d8], eax
call esi
mov ecx, dword [0x4314b8]
mov dword [0x4314dc], eax
test ecx, ecx
pop esi
je 0x41ccad
mov ecx, dword [0x4314bc]
test ecx, ecx
je 0x41ccad
mov ecx, dword [0x4314c0]
test ecx, ecx
je 0x41ccad
mov ecx, dword [0x4314c4]
test ecx, ecx
je 0x41ccad
mov ecx, dword [0x4314c8]
test ecx, ecx
je 0x41ccad
mov ecx, dword [0x4314cc]
test ecx, ecx
je 0x41ccad
test eax, eax
je 0x41ccad
mov eax, dword [0x4314d0]
test eax, eax
je 0x41ccad
mov eax, dword [0x4314d4]
test eax, eax
je 0x41ccad
mov eax, dword [0x4314d8]
test eax, eax
je 0x41ccad
push 0x431498
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
add esp, 0x104
ret
mov eax, dword [0x4314b0]
mov dword [0x4314b4], 1
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x431498
mov dword [0x4314b0], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add esp, 0x104
ret
Function at 0x41cd30
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x43150c]
sub esp, 0x104
test eax, eax
jne 0x41ce84
mov eax, dword [0x431510]
test eax, eax
jne 0x41cebc
mov eax, dword [0x42f9d4]
test eax, eax
je 0x41cd6e
push 0x4314e0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x42f9d4], 0
push 0x4314e0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x43150c]
test eax, eax
jne 0x41ce79
mov al, byte [0x431f84]
test al, al
je 0x41cda9
push 0x431f84
lea eax, [esp + 4]
push str._sGLPNG.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x41cdbc
lea ecx, [esp]
push str.GLPNG.dll
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x43150c], eax
jne 0x41cdee
push 0x4314e0
mov dword [0x431510], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add esp, 0x104
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LoadPNGFile
push eax
call esi
mov dword [0x4314f8], eax
mov eax, dword [0x43150c]
push str.LoadPNGFromMem
push eax
call esi
mov ecx, dword [0x43150c]
push str.WriteBmpToPNGMem
push ecx
mov dword [0x4314fc], eax
call esi
mov edx, dword [0x43150c]
push str.WriteBmpToPNGFile
push edx
mov dword [0x431500], eax
call esi
mov dword [0x431504], eax
mov eax, dword [0x43150c]
push str.WriteImageDataToPNGMem
push eax
call esi
mov ecx, dword [0x4314f8]
mov dword [0x431508], eax
test ecx, ecx
pop esi
je 0x41ce90
mov ecx, dword [0x4314fc]
test ecx, ecx
je 0x41ce90
mov ecx, dword [0x431500]
test ecx, ecx
je 0x41ce90
mov ecx, dword [0x431504]
test ecx, ecx
je 0x41ce90
test eax, eax
je 0x41ce90
push 0x4314e0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
add esp, 0x104
ret
mov ecx, dword [0x43150c]
mov dword [0x431510], 1
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x4314e0
mov dword [0x43150c], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add esp, 0x104
ret
Function at 0x41d020
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x104]
test eax, eax
je 0x41d049
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [esi + 0x104], 0
lea ebp, [esi + 0x108]
xor eax, eax
mov ecx, ebp
lea edi, [esi + 0x110]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov ecx, 0x41
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x120]
test edi, edi
je 0x41d089
cmp byte [edi], 0
jne 0x41d0a5
mov ecx, esi
call fcn.0041d350
lea edx, [esp + 0x18]
push 0x103
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edi, [esp + 0x18]
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x41d0c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 4
push ebx
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esi + 0x104], eax
test eax, eax
jne 0x41d0e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 4
push eax
push ebx
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoA
mov edx, dword [esi + 0x104]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0x42d15c
push edx
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 8]
shr ecx, 0x10
mov word [ebp], cx
mov dx, word [eax + 8]
mov word [esi + 0x10a], dx
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
mov word [esi + 0x10c], cx
mov ax, word [eax + 0xc]
mov word [esi + 0x10e], ax
and eax, 0xffff
xor edx, edx
push eax
mov dx, cx
xor eax, eax
mov ax, word [esi + 0x10a]
xor ecx, ecx
mov cx, word [ebp]
push edx
push eax
push ecx
push str._d._d._d._d
lea eax, [esi + 0x110]
push 0x3f
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
push 0x103
push edi
push esi
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
add esp, 0x28
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 4

Function at 0x41d2a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x118]
lea ecx, [esp + 0x14]
push eax
push str.SoftwareGloballinkGame_s
push 0xff
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea edx, [esp + 8]
lea eax, [esp + 0x14]
mov dword [esp + 8], 0
push edx
push 1
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x41d33c
mov edx, dword [esp + 0x11c]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push edx
push eax
push esi
push str.path
push ecx
mov dword [esp + 0x24], 0x103
mov dword [esp + 0x28], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 8]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
test esi, esi
sete al
pop esi
add esp, 0x10c
ret 8
Function at 0x41d370
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x423878
push eax
mov eax, dword [esp + 0x1c]
mov dword fs:[0], esp
mov edx, dword [esp + 0x14]
sub esp, 0x40
lea ecx, [esp]
push ebp
push esi
push eax
mov eax, dword [esp + 0x5c]
push 0x40
push ecx
push 0x43127c
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 8]
test al, al
jne 0x41d3c8
mov eax, dword [esp + 0x60]
pop esi
pop ebp
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
add esp, 0x4c
ret
lea ecx, [esp + 0x64]
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 8]
xor ebp, ebp
push ecx
lea ecx, [esp + 0x68]
mov dword [esp + 0x54], ebp
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [esp + 0x64]
cmp dword [eax - 8], 2
jge 0x41d41f
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
lea ecx, [esp + 0x64]
mov esi, eax
mov dword [esp + 0x50], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
add esp, 0x4c
ret
push 0x2c
push eax
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
test eax, eax
jne 0x41d479
mov edx, dword [esp + 0x64]
push edx
call fcn.0041ca40
mov esi, eax
mov ecx, eax
and esi, 0xff
and eax, 0xff00
shl esi, 0x10
sar ecx, 0x10
add esi, ecx
add esp, 4
lea ecx, [esp + 0x64]
add esi, eax
mov dword [esp + 0x50], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
add esp, 0x4c
ret
mov esi, dword [esp + 0x64]
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_atoi]
push edi
push esi
call ebx
mov dword [esp + 0x68], eax
mov al, byte [esi]
add esp, 4
xor edi, edi
test al, al
je 0x41d4a3
cmp al, 0x2c
je 0x41d4a3
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x41d497
cmp byte [esi], 0x2c
jne 0x41d4d1
inc esi
push esi
call ebx
mov ebp, eax
mov al, byte [esi]
add esp, 4
test al, al
je 0x41d4c3
cmp al, 0x2c
je 0x41d4c3
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x41d4b7
cmp byte [esi], 0x2c
jne 0x41d4d1
inc esi
push esi
call ebx
add esp, 4
mov edi, eax
mov eax, dword [esp + 0x64]
lea ecx, [esp + 0x6c]
shl edi, 8
add edi, ebp
mov dword [esp + 0x58], 0xffffffff
shl edi, 8
add edi, eax
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x50]
mov eax, edi
pop edi
pop ebx
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x4c
ret
Function at 0x41d510
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x423898
push eax
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 0x40
lea ecx, [esp]
push eax
mov eax, dword [esp + 0x54]
push 0x40
push ecx
push 0x43127c
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp]
test al, al
je 0x41d5be
push ebx
push esi
push edi
lea ecx, [esp + 0x68]
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0xc]
mov dword [esp + 0x54], 0
push ecx
lea ecx, [esp + 0x6c]
call sub.MFC42.DLL_CString::operator_1
mov esi, dword [esp + 0x68]
mov edi, dword [sym.imp.MSVCRT.dll_atoi]
push esi
call edi
mov ebx, dword [esp + 0x68]
add esp, 4
mov dword [ebx], eax
mov al, byte [esi]
test al, al
je 0x41d59b
cmp al, 0x2c
je 0x41d59b
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x41d58f
cmp byte [esi], 0x2c
jne 0x41d5aa
inc esi
push esi
call edi
add esp, 4
mov dword [ebx + 4], eax
lea ecx, [esp + 0x68]
mov dword [esp + 0x54], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
add esp, 0x4c
ret
Function at 0x4018e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x579d9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 0x38]
call fcn.00401cf0
xor edi, edi
lea ecx, [esi + 0x3c]
mov dword [esp + 0x14], edi
call fcn.00401cf0
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 4], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], edi
mov dword [esi], 0x58d49c
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4019e0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x579dd8
push eax
mov dword fs:[0], esp
push ebx
push esi
push edi
mov esi, ecx
push 0x10
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0
call fcn.00402370
push eax
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
lea ecx, [esi + 8]
mov edi, dword [esp + 0x50]
add esp, 0xc
mov dword [ecx], edx
mov edx, dword [esp + 0x28]
push edi
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x30]
mov dword [ecx + 8], edx
mov edx, dword [esp + 0x38]
mov dword [esi + 0x2c], edx
mov dword [ecx + 0xc], eax
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ecx
lea ecx, [esi + 0x3c]
call fcn.004021a0
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
mov edx, dword [esi]
push eax
mov eax, dword [esp + 0x44]
push ecx
push edi
push eax
mov ecx, esi
call dword [edx + 0x10]
lea ecx, [esp + 0x1c]
mov bl, al
mov dword [esp + 0x14], 0xffffffff
call fcn.00401e10
mov ecx, dword [esp + 0xc]
pop edi
mov al, bl
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0x34

Function at 0x404080
Capabilities:
Print debug messages

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 0x400
lea eax, [esp + 0x40c]
lea edx, [esp]
push eax
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_vsprintf]
mov eax, dword [esp + 0x410]
add esp, 0xc
test eax, eax
jne 0x4040b9
lea eax, [esp]
push eax
call fcn.00404130
add esp, 4
lea ecx, [esp]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push ecx
call esi
push 0x5b9674
call esi
pop esi
add esp, 0x400
ret

Function at 0x4040e0
Capabilities:
Print debug messages

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 0x400
lea eax, [esp + 0x40c]
lea edx, [esp]
push eax
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_vsprintf]
mov eax, dword [esp + 0x410]
add esp, 0xc
test eax, eax
jne 0x404119
lea eax, [esp]
push eax
call fcn.00404130
add esp, 4
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x400
ret
Function at 0x406170
Capabilities:
Get disk information

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x10]
push ebx
push ebp
push esi
mov edx, ecx
push edi
mov edi, dword [esp + 0x1c]
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov ebp, 1
and ecx, 3
mov bl, 0x41
rep stosb byte es:[edi], al
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp + 0x14], eax
xor edi, edi
test dword [esp + 0x14], ebp
je 0x4061ec
movsx ecx, bl
xor eax, eax
push ecx
lea edx, [esp + 0x14]
mov word [esp + 0x14], ax
push 0x5b9e84
push edx
mov byte [esp + 0x1e], al
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x4061ec
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov byte [esi + ecx], bl
inc esi
cmp esi, eax
jge 0x4061f6
shl ebp, 1
inc bl
inc edi
cmp edi, 0x20
jb 0x4061a4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x406340
Capabilities:
Set file attributes

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
call dword [eax + 0x18]
mov edi, dword [esp + 0xc]
push 0xa0
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x406373
push edi
push str.Change_Attribute_Error___s_
push eax
call fcn.00404080
add esp, 0xc
xor al, al
pop edi
pop esi
ret 8
mov ecx, dword [esp + 0x10]
push 0
push 0x80
push ecx
push 0
push 0
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
pop edi
pop esi
setne al
ret 8

Function at 0x407480
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push esi
push edi
mov edi, ecx
mov esi, 1
push esi
call ebx
mov ecx, dword [edi + 0x620]
shr eax, 0xf
shl ecx, 8
and al, 1
add ecx, esi
inc esi
cmp esi, 0x100
mov byte [ecx + edi + 0x10], al
jl 0x407490
pop edi
pop esi
mov al, 1
pop ebx
ret