joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454000
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x454033
push esi
call fcn.00457100
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x45402c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4540b9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4540a2
mov eax, dword [esi + 8]
test eax, eax
je 0x454057
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x45409e
cmp eax, 2
je 0x4540a2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x45404a
cmp eax, 3
je 0x45407d
cmp eax, 1
jne 0x45404a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x45404a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x45404a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004540e0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4540c8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004540e0
add esp, 4
pop esi
ret

Function at 0x45fc00
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x45fca3
test eax, eax
jbe 0x45fca3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x45fca3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x45fc4e
xor esi, esi
jmp 0x45fc54
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x45fc7f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00461bb0
add esi, eax
push esi
mov ebx, esi
call fcn.00461bb0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x45fc60
pop ebp
test edi, edi
pop edi
jne 0x45fca3
test ebx, ebx
je 0x45fca3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.0046f2e0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x45fde5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x45fefd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45fefd
mov eax, dword [esi + 0x3c]
push eax
call fcn.004800f9
mov esi, eax
test esi, esi
je 0x45fefd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x45fefd
mov ecx, esi
call fcn.0045fd50
cmp edi, eax
jge 0x45fefd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x45fe83
mov dword [esp + 0x34], 1
jmp 0x45fede
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x45fefd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0045f340
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x480a9c
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x480ad4
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0047eb29
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0047eb01
jmp 0x480ae0
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x48218d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4821cf
call fcn.00487e78
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4821cf
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4821c6
xor eax, eax
jmp 0x4821d7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004821dd
pop edi
pop esi
pop ebx
ret 4
Function at 0x4883a8
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4883d6
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4883f4
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0048830e
jmp 0x4883f4
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4883f4
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0048830e
test edi, edi
mov eax, edi
jne 0x4883de
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x404dd0
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, ecx
push edi
push str.Button_Shop
mov ecx, dword [esi + 0x43c]
mov eax, dword [ecx]
call dword [eax + 0x60]
mov edi, dword [esp + 0xc]
cmp edi, eax
jne 0x404e09
push 1
push 0
push 0
push str.http:__r2.qq.com_2006web_market_
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
ret 4
mov ecx, dword [esi + 0x43c]
push str.Button_Vip
mov edx, dword [ecx]
call dword [edx + 0x60]
cmp edi, eax
jne 0x404e3a
push 1
push 0
push 0
push str.http:__r2.qq.com_vip_
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
ret 4
mov ecx, dword [esi + 0x43c]
push str.Button_Seed
mov eax, dword [ecx]
call dword [eax + 0x60]
cmp edi, eax
jne 0x404e6b
push 1
push 0
push 0
push str.http:__r2.qq.com_seed5_
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
ret 4
mov ecx, dword [esi + 0x43c]
push str.Button_Mission
mov edx, dword [ecx]
call dword [edx + 0x60]
cmp edi, eax
jne 0x404e9c
push 1
push 0
push 0
push str.http:__r2.qq.com_a20070521rw_
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
ret 4
mov ecx, dword [esi + 0x43c]
push str.Button_Prize
mov eax, dword [ecx]
call dword [eax + 0x60]
cmp edi, eax
jne 0x404ecd
push 1
push 0
push 0
push str.http:__r2.qq.com_a20061106bc_
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
ret 4
mov ecx, dword [esi + 0x43c]
push str.Button_Bill
mov edx, dword [ecx]
call dword [edx + 0x60]
cmp edi, eax
jne 0x404ef9
push 1
push 0
push 0
push str.http:__r2.qq.com_web200612_pay_pay.shtml
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
ret 4
Function at 0x407ce0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x400
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x40c]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x410]
push eax
push ecx
push 0x3ff
push 0x400
push edx
call dword [0x423074]
add esp, 0x14
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
add esp, 0x400
ret
Function at 0x408080
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x400
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x40c]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x410]
push eax
push ecx
push 0x3ff
push 0x400
push edx
call dword [0x423074]
add esp, 0x14
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
add esp, 0x400
ret
Function at 0x408420
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x400
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x40c]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x410]
push eax
push ecx
push 0x3ff
push 0x400
push edx
call dword [0x423074]
add esp, 0x14
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
add esp, 0x400
ret

Function at 0x408480
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x400
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x40c]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x410]
push eax
push ecx
push 0x3ff
push 0x400
push edx
call dword [0x423074]
add esp, 0x14
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
add esp, 0x400
ret

Function at 0x4084e0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x400
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x40c]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x410]
push eax
push ecx
push 0x3ff
push 0x400
push edx
call dword [0x423074]
add esp, 0x14
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
add esp, 0x400
ret

Function at 0x408540
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x400
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x40c]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x410]
push eax
push ecx
push 0x3ff
push 0x400
push edx
call dword [0x423074]
add esp, 0x14
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
add esp, 0x400
ret
Function at 0x409120
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
mov ebx, dword [esp + 0x11c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
lea eax, [esp + 0x18]
push 0x104
push eax
push 0
push str.Path
push str.Redirect
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x14]
lea ecx, [esp + 0x14]
test edx, edx
je 0x40918d
mov al, byte [esp + 0x14]
test al, al
je 0x40918d
cmp al, 0x20
je 0x409185
cmp al, 9
jne 0x4091d0
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40917d
mov esi, dword [esp + 0x120]
test esi, esi
je 0x4091c3
mov edx, dword [esp + 0x124]
test edx, edx
jle 0x4091c3
test ebx, ebx
je 0x4091c3
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jae 0x4091c3
push ebx
push edx
push esi
call dword [0x423080]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
lea eax, [esp + 0x14]
push 0x3a
push eax
call fcn.00413383
add esp, 8
test eax, eax
jne 0x409293
cmp byte [esp + 0x14], 0x5c
je 0x409293
test ebx, ebx
je 0x4091c3
mov edi, dword [esp + 0x120]
test edi, edi
je 0x4091c3
mov ebp, dword [esp + 0x124]
test ebp, ebp
jle 0x4091c3
push 0x5c
push ebx
call fcn.0041341a
add esp, 8
test eax, eax
jne 0x409226
push 0x2f
push ebx
call fcn.0041341a
add esp, 8
test eax, eax
mov byte [edi], 0
je 0x40926a
sub eax, ebx
inc eax
mov esi, eax
test esi, esi
jle 0x40924b
cmp ebp, esi
jle 0x40924b
push esi
push ebx
push ebp
push edi
call dword [0x42307c]
add esp, 0x10
mov byte [esi + edi], 0
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push ebp
push edi
mov ecx, esi
call fcn.0040bfe0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
push ebp
push ebx
mov ecx, esi
call fcn.0040b760
test eax, eax
je 0x409283
push ebx
push ebp
push edi
call dword [0x423080]
add esp, 0xc
push 0x4237fc
push ebp
push edi
mov ecx, esi
call fcn.0040bfe0
jmp 0x40924f
mov edx, dword [esp + 0x124]
mov eax, dword [esp + 0x120]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
call fcn.00409120
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
Function at 0x409700
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x400
push ebx
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
mov edx, dword [esp + 0x41c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x410]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0x41c]
push 0x400
push ecx
mov ecx, dword [esp + 0x420]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0xc]
xor edi, edi
xor esi, esi
lea edx, [esp + 0xc]
test al, al
lea ecx, [esp + 0xc]
je 0x409786
cmp al, 0x20
je 0x409777
cmp al, 9
je 0x409777
test edi, edi
jne 0x40977e
mov edi, 1
mov edx, ecx
jmp 0x40977e
cmp edi, 1
jne 0x40977e
mov esi, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x409762
mov ebx, dword [esp + 0x420]
test edx, edx
mov byte [ebx], 0
je 0x4097f5
test esi, esi
jne 0x4097cf
test ebx, ebx
je 0x4097f5
mov esi, dword [esp + 0x424]
test esi, esi
jle 0x4097f5
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, esi
jae 0x4097f5
push edx
push esi
push ebx
call dword [0x423080]
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x400
ret 0x18
sub esi, edx
test ebx, ebx
je 0x4097f5
test esi, esi
jle 0x4097f5
mov eax, dword [esp + 0x424]
cmp eax, esi
jle 0x4097f5
push esi
push edx
push eax
push ebx
call dword [0x42307c]
add esp, 0x10
mov byte [esi + ebx], 0
pop edi
pop esi
pop ebx
add esp, 0x400
ret 0x18
Function at 0x409810
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
mov ebx, dword [esp + 0x11c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
lea eax, [esp + 0x18]
push 0x104
push eax
push 0
push str.Path
push str.Redirect
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x14]
lea ecx, [esp + 0x14]
test edx, edx
je 0x40987d
mov al, byte [esp + 0x14]
test al, al
je 0x40987d
cmp al, 0x20
je 0x409875
cmp al, 9
jne 0x4098c0
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40986d
mov esi, dword [esp + 0x120]
test esi, esi
je 0x4098b3
mov edx, dword [esp + 0x124]
test edx, edx
jle 0x4098b3
test ebx, ebx
je 0x4098b3
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jae 0x4098b3
push ebx
push edx
push esi
call dword [0x423080]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
lea eax, [esp + 0x14]
push 0x3a
push eax
call fcn.00413383
add esp, 8
test eax, eax
jne 0x409983
cmp byte [esp + 0x14], 0x5c
je 0x409983
test ebx, ebx
je 0x4098b3
mov edi, dword [esp + 0x120]
test edi, edi
je 0x4098b3
mov ebp, dword [esp + 0x124]
test ebp, ebp
jle 0x4098b3
push 0x5c
push ebx
call fcn.0041341a
add esp, 8
test eax, eax
jne 0x409916
push 0x2f
push ebx
call fcn.0041341a
add esp, 8
test eax, eax
mov byte [edi], 0
je 0x40995a
sub eax, ebx
inc eax
mov esi, eax
test esi, esi
jle 0x40993b
cmp ebp, esi
jle 0x40993b
push esi
push ebx
push ebp
push edi
call dword [0x42307c]
add esp, 0x10
mov byte [esi + edi], 0
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push ebp
push edi
mov ecx, esi
call fcn.0040c0b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
push ebp
push ebx
mov ecx, esi
call fcn.0040b9b0
test eax, eax
je 0x409973
push ebx
push ebp
push edi
call dword [0x423080]
add esp, 0xc
push 0x4237fc
push ebp
push edi
mov ecx, esi
call fcn.0040c0b0
jmp 0x40993f
mov edx, dword [esp + 0x124]
mov eax, dword [esp + 0x120]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
call fcn.00409810
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
Function at 0x409df0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
mov ebx, dword [esp + 0x11c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
lea eax, [esp + 0x18]
push 0x104
push eax
push 0
push str.Path
push str.Redirect
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x14]
lea ecx, [esp + 0x14]
test edx, edx
je 0x409e5d
mov al, byte [esp + 0x14]
test al, al
je 0x409e5d
cmp al, 0x20
je 0x409e55
cmp al, 9
jne 0x409ea0
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x409e4d
mov esi, dword [esp + 0x120]
test esi, esi
je 0x409e93
mov edx, dword [esp + 0x124]
test edx, edx
jle 0x409e93
test ebx, ebx
je 0x409e93
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jae 0x409e93
push ebx
push edx
push esi
call dword [0x423080]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
lea eax, [esp + 0x14]
push 0x3a
push eax
call fcn.00413383
add esp, 8
test eax, eax
jne 0x409f63
cmp byte [esp + 0x14], 0x5c
je 0x409f63
test ebx, ebx
je 0x409e93
mov edi, dword [esp + 0x120]
test edi, edi
je 0x409e93
mov ebp, dword [esp + 0x124]
test ebp, ebp
jle 0x409e93
push 0x5c
push ebx
call fcn.0041341a
add esp, 8
test eax, eax
jne 0x409ef6
push 0x2f
push ebx
call fcn.0041341a
add esp, 8
test eax, eax
mov byte [edi], 0
je 0x409f3a
sub eax, ebx
inc eax
mov esi, eax
test esi, esi
jle 0x409f1b
cmp ebp, esi
jle 0x409f1b
push esi
push ebx
push ebp
push edi
call dword [0x42307c]
add esp, 0x10
mov byte [esi + edi], 0
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push ebp
push edi
mov ecx, esi
call fcn.0040c180
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
push ebp
push ebx
mov ecx, esi
call fcn.0040bc00
test eax, eax
je 0x409f53
push ebx
push ebp
push edi
call dword [0x423080]
add esp, 0xc
push 0x4237fc
push ebp
push edi
mov ecx, esi
call fcn.0040c180
jmp 0x409f1f
mov edx, dword [esp + 0x124]
mov eax, dword [esp + 0x120]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
call fcn.00409df0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
Function at 0x40a3d0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x400
push ebx
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
mov edx, dword [esp + 0x41c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x410]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0x41c]
push 0x400
push ecx
mov ecx, dword [esp + 0x420]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0xc]
xor edi, edi
xor esi, esi
lea edx, [esp + 0xc]
test al, al
lea ecx, [esp + 0xc]
je 0x40a456
cmp al, 0x20
je 0x40a447
cmp al, 9
je 0x40a447
test edi, edi
jne 0x40a44e
mov edi, 1
mov edx, ecx
jmp 0x40a44e
cmp edi, 1
jne 0x40a44e
mov esi, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40a432
mov ebx, dword [esp + 0x420]
test edx, edx
mov byte [ebx], 0
je 0x40a4c5
test esi, esi
jne 0x40a49f
test ebx, ebx
je 0x40a4c5
mov esi, dword [esp + 0x424]
test esi, esi
jle 0x40a4c5
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, esi
jae 0x40a4c5
push edx
push esi
push ebx
call dword [0x423080]
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x400
ret 0x18
sub esi, edx
test ebx, ebx
je 0x40a4c5
test esi, esi
jle 0x40a4c5
mov eax, dword [esp + 0x424]
cmp eax, esi
jle 0x40a4c5
push esi
push edx
push eax
push ebx
call dword [0x42307c]
add esp, 0x10
mov byte [esi + ebx], 0
pop edi
pop esi
pop ebx
add esp, 0x400
ret 0x18
Function at 0x40a4e0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
mov ebx, dword [esp + 0x11c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
lea eax, [esp + 0x18]
push 0x104
push eax
push 0
push str.Path
push str.Redirect
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x14]
lea ecx, [esp + 0x14]
test edx, edx
je 0x40a54d
mov al, byte [esp + 0x14]
test al, al
je 0x40a54d
cmp al, 0x20
je 0x40a545
cmp al, 9
jne 0x40a590
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40a53d
mov esi, dword [esp + 0x120]
test esi, esi
je 0x40a583
mov edx, dword [esp + 0x124]
test edx, edx
jle 0x40a583
test ebx, ebx
je 0x40a583
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jae 0x40a583
push ebx
push edx
push esi
call dword [0x423080]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
lea eax, [esp + 0x14]
push 0x3a
push eax
call fcn.00413383
add esp, 8
test eax, eax
jne 0x40a653
cmp byte [esp + 0x14], 0x5c
je 0x40a653
test ebx, ebx
je 0x40a583
mov edi, dword [esp + 0x120]
test edi, edi
je 0x40a583
mov ebp, dword [esp + 0x124]
test ebp, ebp
jle 0x40a583
push 0x5c
push ebx
call fcn.0041341a
add esp, 8
test eax, eax
jne 0x40a5e6
push 0x2f
push ebx
call fcn.0041341a
add esp, 8
test eax, eax
mov byte [edi], 0
je 0x40a62a
sub eax, ebx
inc eax
mov esi, eax
test esi, esi
jle 0x40a60b
cmp ebp, esi
jle 0x40a60b
push esi
push ebx
push ebp
push edi
call dword [0x42307c]
add esp, 0x10
mov byte [esi + edi], 0
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push ebp
push edi
mov ecx, esi
call fcn.0040c250
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
push ebp
push ebx
mov ecx, esi
call fcn.0040bd10
test eax, eax
je 0x40a643
push ebx
push ebp
push edi
call dword [0x423080]
add esp, 0xc
push 0x4237fc
push ebp
push edi
mov ecx, esi
call fcn.0040c250
jmp 0x40a60f
mov edx, dword [esp + 0x124]
mov eax, dword [esp + 0x120]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
call fcn.0040a4e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
Function at 0x40aac0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x400
push ebx
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
mov edx, dword [esp + 0x41c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x410]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0x41c]
push 0x400
push ecx
mov ecx, dword [esp + 0x420]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0xc]
xor edi, edi
xor esi, esi
lea edx, [esp + 0xc]
test al, al
lea ecx, [esp + 0xc]
je 0x40ab46
cmp al, 0x20
je 0x40ab37
cmp al, 9
je 0x40ab37
test edi, edi
jne 0x40ab3e
mov edi, 1
mov edx, ecx
jmp 0x40ab3e
cmp edi, 1
jne 0x40ab3e
mov esi, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40ab22
mov ebx, dword [esp + 0x420]
test edx, edx
mov byte [ebx], 0
je 0x40abb5
test esi, esi
jne 0x40ab8f
test ebx, ebx
je 0x40abb5
mov esi, dword [esp + 0x424]
test esi, esi
jle 0x40abb5
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, esi
jae 0x40abb5
push edx
push esi
push ebx
call dword [0x423080]
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x400
ret 0x18
sub esi, edx
test ebx, ebx
je 0x40abb5
test esi, esi
jle 0x40abb5
mov eax, dword [esp + 0x424]
cmp eax, esi
jle 0x40abb5
push esi
push edx
push eax
push ebx
call dword [0x42307c]
add esp, 0x10
mov byte [esi + ebx], 0
pop edi
pop esi
pop ebx
add esp, 0x400
ret 0x18