joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401320
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [ebp + 8]
mov ecx, dword [0x3289cac]
push ebx
push esi
mov esi, dword [eax]
push edi
mov edi, dword [eax + 4]
mov dword [ebp - 8], esi
cmp ecx, 0x44a
jne 0x40135a
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [0x3289cac]
mov dword [ebp - 0x10], 0xc6ef3720
cmp ecx, 0x114e
jne 0x401379
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
mov ecx, dword [0x3289cac]
mov edx, dword [0x413070]
mov eax, dword [0x413074]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
cmp ecx, 0xb54
jne 0x4013c0
lea ecx, [ebp - 0x74]
push ecx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindActCtxSectionStringW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [0x3289cac]
mov edx, dword [0x413078]
mov eax, dword [0x41307c]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0x20
jmp 0x4013e3
mov esi, dword [ebp - 8]
mov ebx, esi
shl ebx, 4
cmp ecx, 0x4c3
jne 0x4013fe
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [0x3289cac]
add ebx, dword [ebp - 0x18]
cmp ecx, 0xfa9
jne 0x401413
mov dword [0x326f2d4], 0xedeb2e40
mov edx, dword [ebp - 0x10]
add edx, esi
shr esi, 5
add esi, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
mov dword [0x326f2d0], 0x9150ce2e
cmp ecx, 0x912
jne 0x401445
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [0x432ddc], 0
xor esi, dword [ebp - 0x20]
mov dword [ebp - 0xc], 0
xor esi, ebx
sub edi, esi
and eax, 0x4dd0071b
sub dword [ebp - 0xc], 0x2273eb88
mov ebx, 0x3a7cd587
add dword [ebp - 0xc], 0x2273eb8c
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ebx, edi
shl ebx, cl
mov ecx, dword [0x3289cac]
mov esi, edi
shr esi, 5
add ebx, dword [ebp - 0x28]
add esi, dword [ebp - 0x24]
add eax, edi
xor ebx, eax
cmp ecx, 0xb3f
jne 0x4014aa
xor eax, eax
lea ecx, [ebp - 0x34]
push ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
call dword [sym.imp.KERNEL32.dll_QueryDepthSList]
mov ecx, dword [0x3289cac]
xor esi, ebx
sub dword [ebp - 8], esi
mov dword [0x432dd8], 0
cmp ecx, 0x1d5
jne 0x4014cd
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
mov ecx, dword [0x3289cac]
lea eax, [ebp - 0x10]
call fcn.00401310
sub dword [ebp - 0x14], 1
jne 0x4013e0
mov edx, dword [ebp - 8]
mov esi, dword [ebp + 8]
mov dword [esi], edx
cmp ecx, 0xa6d
jne 0x401514
push 0x30
lea eax, [ebp - 0x64]
push 0
push eax
mov dword [ebp - 0x68], 0
call fcn.00405d90
add esp, 0xc
push 0
lea ecx, [ebp - 0x68]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigA]
mov dword [esi + 4], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4015b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40e428
push eax
mov dword fs:[0], esp
sub esp, 0x424
push ebx
push esi
push edi
push 0x326f2d8
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x280a7
jne 0x401609
push 0x410c3c
push str.bu.txt
call fcn.00402884
push 0x410c03
push 0x424338
call fcn.004024a3
add esp, 0x10
call fcn.00402b2e
push 0x424338
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x35d85
jne 0x40168d
cmp dword [0x3289cac], 0x1286
jne 0x401640
push 0
call sub.KERNEL32.dll_GetSystemPowerStatus
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetACP]
cmp dword [0x3289cac], 0xa95
jne 0x40165a
push 0
call dword [sym.imp.KERNEL32.dll_HeapUnlock]
call dword [sym.imp.KERNEL32.dll_GetVersion]
lea esi, [ebp - 0x30]
call fcn.004018a0
push 0
push 0x27d0c10a
mov dword [ebp - 4], 0
call fcn.00402642
push 0
call fcn.00402ac0
add esp, 0xc
mov eax, esi
mov dword [ebp - 4], 0xffffffff
call fcn.004018d0
mov eax, dword [0x416d38]
mov dword [0x3289cac], eax
call fcn.004015a0
push 0x410c4c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
mov dword [0x326e424], eax
xor esi, esi
lea ebx, [ebx]
call edi
push 0
push 0
push 0
push 0
push 0
push 0
call ebx
cmp esi, 0xd03868
jle 0x4016ea
cmp dword [ebp - 0x14], 0x4fc7c54
je 0x4016ea
cmp dword [ebp - 0x10], 0x1b5adea6
jne 0x4016fc
inc esi
mov eax, esi
cdq
cmp edx, 0xd
jl 0x4016c0
jg 0x4016fc
cmp eax, 0x4fe89cbd
jb 0x4016c0
mov edx, dword [0x3289cac]
mov ecx, dword [0x413068]
push edx
push 0
mov dword [0x3289cb0], ecx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [0x3289cac]
mov dword [0x326e420], eax
xor eax, eax
test ecx, ecx
jbe 0x401738
call fcn.00401580
mov ecx, dword [0x3289cac]
inc eax
cmp eax, ecx
jb 0x401728
lea eax, [ebp - 0x10]
push eax
push 0x40
push ecx
mov ecx, dword [0x326e420]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.00401520
mov esi, dword [sym.imp.KERNEL32.dll_HeapLock]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, 0xea7bb
cmp dword [0x3289cac], 0x3b3
jne 0x401776
push 0
call esi
push 0
call edi
sub ebx, 1
jne 0x401762
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ebx, dword [sym.imp.KERNEL32.dll_CommConfigDialogA]
xor esi, esi
lea esp, [esp]
cmp dword [0x3289cac], 0xde6
jne 0x4017b1
push 0
push 0
lea edx, [ebp - 0x430]
push edx
call edi
push 0
push 0
push 0
call ebx
cmp esi, 0x156cae
jne 0x4017c3
mov eax, dword [0x326e420]
mov dword [0x326f2cc], eax
inc esi
cmp esi, 0x24c129
jl 0x401790
call dword [0x326e420]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40330d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x412458]
jne 0x403317
repz ret
jmp fcn.00407e1c
Function at 0x40bee0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404aa5
and dword [ebp - 4], 0
cmp dword [0x424250], 0
mov ebx, eax
jne 0x40bf91
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40c042
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40c042
push eax
call fcn.00404a33
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x424250], eax
call esi
push eax
call fcn.00404a33
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x424254], eax
call esi
push eax
call fcn.00404a33
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x424258], eax
call esi
push eax
call fcn.00404a33
pop ecx
mov dword [0x424260], eax
test eax, eax
je 0x40bf91
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404a33
pop ecx
mov dword [0x42425c], eax
mov eax, dword [0x42425c]
cmp eax, ebx
je 0x40bfe9
cmp dword [0x424260], ebx
je 0x40bfe9
push eax
call fcn.00404aae
push dword [0x424260]
mov esi, eax
call fcn.00404aae
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40bfe9
test edi, edi
je 0x40bfe9
call esi
test eax, eax
je 0x40bfe0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40bfe0
test byte [ebp - 0xc], 1
jne 0x40bfe9
or dword [ebp + 0x10], 0x200000
jmp 0x40c022
mov eax, dword [0x424254]
cmp eax, ebx
je 0x40c022
push eax
call fcn.00404aae
pop ecx
test eax, eax
je 0x40c022
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40c022
mov eax, dword [0x424258]
cmp eax, ebx
je 0x40c022
push eax
call fcn.00404aae
pop ecx
test eax, eax
je 0x40c022
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x424250]
call fcn.00404aae
pop ecx
test eax, eax
je 0x40c042
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40c044
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10028219
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x1004c040]
test eax, eax
je 0x10028258
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10028258
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10028258
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10028258
cmp dword [ecx + 0x74], 0xe
jbe 0x10028258
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10047880
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100478ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100478ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40a2d0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x485230]
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x62c], ecx
mov eax, dword [ebp - 0x62c]
cmp dword [eax + 0xb8], 0xffffffff
je 0x40a2fe
xor al, al
jmp 0x40a449
mov cx, word [0x46bdbc]
mov word [ebp - 0x210], cx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.ServiceCore.dll_public:_static_bool___cdecl_CWHService::GetWorkDirectory_wchar_t__const__unsigned_short_int_]
add esp, 8
mov ax, word [0x46bdc0]
mov word [ebp - 0x418], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x416]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x210]
push ecx
push str._sDownLoad
push 0x104
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0
jbe 0x40a3ad
mov ecx, dword [ebp - 0x420]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2]
cmp eax, 0x2f
je 0x40a3ad
mov ecx, dword [ebp - 0x420]
sub ecx, 1
mov dword [ebp - 0x420], ecx
jmp 0x40a381
mov dx, word [0x46bddc]
mov word [ebp - 0x628], dx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x626]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 0x420]
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 0x41c], edx
mov eax, dword [ebp - 0x41c]
push eax
lea ecx, [ebp - 0x418]
push ecx
push str._s_s.WHD
push 0x104
lea edx, [ebp - 0x628]
push edx
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x14
push 0
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push 0x1001
lea ecx, [ebp - 0x628]
push ecx
mov ecx, dword [ebp - 0x62c]
add ecx, 0xb4
mov edx, dword [ebp - 0x62c]
mov eax, dword [edx + 0xb4]
call dword [eax + 0x28]
test eax, eax
jne 0x40a447
xor al, al
jmp 0x40a449
mov al, 1
mov ecx, dword [ebp - 4]
call fcn.00462b3d
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x43c030
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x5c], 0
je 0x43c08b
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0x70], 0
je 0x43c08b
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x70]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43c08b
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x64]
mov dword [ebp - 4], edx
lea eax, [ebp - 8]
push eax
push 0x43bff0
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 8], 0
je 0x43c08b
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x43c0a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x20], 0
je 0x43c0bc
push 0x64
mov ecx, dword [ebp - 0x10]
call fcn.0040c2f0
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x5c], 0
je 0x43c1cb
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x70], 0
je 0x43c122
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x70]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43c122
push 0
push 0
push 0x64
push 2
mov ecx, dword [ebp - 0x10]
call fcn.0043c630
push 0x3e8
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x102
jne 0x43c120
push 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x43c14c
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x102
jne 0x43c14c
push 0
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x60], 0
je 0x43c17a
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x5c], 0
je 0x43c190
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x70], 0
push 0x10
push 0
mov edx, dword [ebp - 0x10]
add edx, 0x5c
push edx
call sub.MSVCR71.dll_memset
add esp, 0xc
movzx eax, byte [ebp + 8]
cmp eax, 1
jne 0x43c1cb
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x6c]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0xc]
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x4408c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x948
mov eax, dword [0x485230]
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x944], ecx
mov ax, word [0x47541c]
mov word [ebp - 0x418], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x416]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.ServiceCore.dll_public:_static_bool___cdecl_CWHService::GetWorkDirectory_wchar_t__const__unsigned_short_int_]
add esp, 8
mov dx, word [0x475420]
mov word [ebp - 0x210], dx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x418]
push eax
push 0x475424
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x10
mov dx, word [0x47545c]
mov word [ebp - 0x818], dx
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x816]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x210]
push eax
push 0x200
lea ecx, [ebp - 0x818]
push ecx
push 0x475460
push 0x475464
push str.Assistant
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movzx edx, word [ebp - 0x818]
test edx, edx
je 0x440afe
mov dword [ebp - 0x81c], 1
mov dword [ebp - 0x820], 0x2f
push 0xffff0002
push 0
push 0
push 0x10
push 0x10
push 0xb
push 0xb
lea eax, [ebp - 0x818]
push eax
mov ecx, dword [ebp - 0x820]
push ecx
mov ecx, dword [ebp - 0x944]
call sub.MFC71U.DLL_CTabCtrl::InsertItem
mov edx, dword [ebp - 0x944]
mov dword [edx + 0x64], eax
mov ax, word [0x475494]
mov word [ebp - 0x840], ax
xor ecx, ecx
mov dword [ebp - 0x83e], ecx
mov dword [ebp - 0x83a], ecx
mov dword [ebp - 0x836], ecx
mov dword [ebp - 0x832], ecx
mov dword [ebp - 0x82e], ecx
mov dword [ebp - 0x82a], ecx
mov dword [ebp - 0x826], ecx
mov word [ebp - 0x822], cx
mov edx, dword [ebp - 0x81c]
push edx
push 0x475498
push 0x10
lea eax, [ebp - 0x840]
push eax
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x10
mov cx, word [0x4754b4]
mov word [ebp - 0x940], cx
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x93e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [ebp - 0x210]
push edx
push 0x80
lea eax, [ebp - 0x940]
push eax
push 0x4754b8
push str.AssistantName
lea ecx, [ebp - 0x840]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movzx edx, word [ebp - 0x940]
test edx, edx
jne 0x440a9c
jmp 0x440ae9
mov eax, dword [ebp - 0x81c]
mov dword [ebp - 0x948], eax
mov ecx, dword [ebp - 0x944]
mov edx, dword [ecx + 0x64]
push edx
mov eax, dword [ebp - 0x948]
push eax
push 0xa
lea ecx, [ebp - 0x940]
push ecx
mov ecx, dword [ebp - 0x944]
call fcn.00442d10
mov edx, dword [ebp - 0x81c]
add edx, 1
mov dword [ebp - 0x81c], edx
mov eax, 1
test eax, eax
jne 0x4409e8
mov ecx, dword [ebp - 0x944]
mov edx, dword [ecx + 0x64]
push edx
mov ecx, dword [ebp - 0x944]
call fcn.00441360
mov ecx, dword [ebp - 4]
call fcn.00462b3d
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x456880
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x485230]
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x90], ecx
mov ax, word [0x477f60]
mov word [ebp - 0x88], ax
mov ecx, 0x1f
xor eax, eax
lea edi, [ebp - 0x86]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x10
push 0
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR71.dll_memset
add esp, 0xc
mov edx, dword [ebp + 0x14]
push edx
push 0x40
lea eax, [ebp - 0x88]
push eax
push 0x477f64
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movzx eax, word [ebp - 0x88]
test eax, eax
je 0x456960
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x8c], ecx
lea edx, [ebp - 0x8c]
push edx
mov ecx, dword [ebp - 0x90]
call fcn.004567d0
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
lea edx, [ebp - 0x8c]
push edx
mov ecx, dword [ebp - 0x90]
call fcn.004567d0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
lea edx, [ebp - 0x8c]
push edx
mov ecx, dword [ebp - 0x90]
call fcn.004567d0
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
lea edx, [ebp - 0x8c]
push edx
mov ecx, dword [ebp - 0x90]
call fcn.004567d0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], eax
mov al, 1
jmp 0x456962
xor al, al
mov ecx, dword [ebp - 4]
call fcn.00462b3d
pop edi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x456980
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x485230]
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x90], ecx
mov ax, word [0x477f68]
mov word [ebp - 0x88], ax
mov ecx, 0x1f
xor eax, eax
lea edi, [ebp - 0x86]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 8
push 0
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR71.dll_memset
add esp, 0xc
mov edx, dword [ebp + 0x14]
push edx
push 0x40
lea eax, [ebp - 0x88]
push eax
push 0x477f6c
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movzx eax, word [ebp - 0x88]
test eax, eax
je 0x456a30
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x8c], ecx
lea edx, [ebp - 0x8c]
push edx
mov ecx, dword [ebp - 0x90]
call fcn.004567d0
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
lea edx, [ebp - 0x8c]
push edx
mov ecx, dword [ebp - 0x90]
call fcn.004567d0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov al, 1
jmp 0x456a32
xor al, al
mov ecx, dword [ebp - 4]
call fcn.00462b3d
pop edi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x456a50
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x485230]
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x90], ecx
mov ax, word [0x477f70]
mov word [ebp - 0x88], ax
mov ecx, 0x1f
xor eax, eax
lea edi, [ebp - 0x86]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 4
push 0
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR71.dll_memset
add esp, 0xc
mov edx, dword [ebp + 0x14]
push edx
push 0x40
lea eax, [ebp - 0x88]
push eax
push 0x477f74
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movzx eax, word [ebp - 0x88]
test eax, eax
je 0x456b20
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x8c], ecx
lea edx, [ebp - 0x8c]
push edx
mov ecx, dword [ebp - 0x90]
call fcn.004567d0
movzx esi, al
lea eax, [ebp - 0x8c]
push eax
mov ecx, dword [ebp - 0x90]
call fcn.004567d0
movzx ecx, al
shl ecx, 8
or esi, ecx
lea edx, [ebp - 0x8c]
push edx
mov ecx, dword [ebp - 0x90]
call fcn.004567d0
movzx eax, al
shl eax, 0x10
or esi, eax
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov al, 1
jmp 0x456b22
xor al, al
mov ecx, dword [ebp - 4]
call fcn.00462b3d
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4628e4
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x479208
call fcn.00462ecc
xor edi, edi
mov dword [ebp - 0x20], edi
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call ebx
cmp word [eax], 0x5a4d
jne 0x462924
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x462924
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x46293c
cmp eax, 0x20b
je 0x462929
mov dword [ebp - 0x1c], edi
jmp 0x462950
cmp dword [ecx + 0x84], 0xe
jbe 0x462924
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x46294a
cmp dword [ecx + 0x74], 0xe
jbe 0x462924
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x4873a4], 0xffffffff
or dword [0x4873a8], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x48732c]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x487328]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4873a0], eax
call fcn.00462f24
call fcn.00462fc4
cmp dword [0x485260], edi
jne 0x4629b0
push fcn.00462fc4
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.00462fb2
push 0x485094
push 0x485090
call sub.MSVCR71.dll__initterm
push 0x462f68
call fcn.00462b84
mov eax, dword [0x487324]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x487320]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___wgetmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, edi
jge 0x462a04
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x48508c
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
jne 0x462a2e
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x462ae8
mov dword [ebp - 0x24], esi
mov ax, word [esi]
cmp ax, 0x20
ja 0x462a9d
cmp ax, di
je 0x462a44
cmp dword [ebp - 0x20], edi
jne 0x462a9d
mov ax, word [esi]
cmp ax, di
je 0x462a59
cmp ax, 0x20
ja 0x462a59
inc esi
inc esi
mov dword [ebp - 0x24], esi
jmp 0x462a44
mov dword [ebp - 0x58], edi
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x58], 1
je 0x462a75
movzx eax, word [ebp - 0x54]
jmp 0x462a78
push 0xa
pop eax
push eax
push esi
push edi
push edi
call ebx
push eax
call fcn.0046321a
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], edi
jne 0x462a95
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x462ae2
cmp ax, 0x22
jne 0x462aae
xor eax, eax
cmp dword [ebp - 0x20], edi
sete al
mov dword [ebp - 0x20], eax
inc esi
inc esi
jmp 0x462a2e
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00462f07
ret