joyce8/EMBER2024-capa huggingface dataset:
Function at 0xbd22c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x77d000]
push edi
jmp 0xbd22da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xbd22e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xbd22d0
mov eax, 1
add ebx, ebx
jne 0xbd22f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xbd2304
jne 0xbd2323
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xbd2323
dec eax
add ebx, ebx
jne 0xbd2310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xbd22e8
add ebx, ebx
jne 0xbd231f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xbd2375
xor ecx, ecx
sub eax, 3
jb 0xbd233b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xbd23aa
sar eax, 1
mov ebp, eax
jmp 0xbd2346
add ebx, ebx
jne 0xbd2346
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xbd2314
inc ecx
add ebx, ebx
jne 0xbd2354
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xbd2314
add ebx, ebx
jne 0xbd2361
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xbd2356
jne 0xbd2372
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xbd2356
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xbd2394
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xbd2386
jmp 0xbd22d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xbd2394
add edi, ecx
jmp 0xbd22d6
pop esi
mov edi, esi
mov ecx, 0x3ed9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xbd23b2
cmp byte [edi], 0x11
jne 0xbd23b2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xbd23b7
lea edi, [esi + 0x7cb000]
mov eax, dword [edi]
or eax, eax
je 0xbd242f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xece708]
add ebx, esi
push eax
add edi, 8
call dword [esi + str.W_vqsU]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xbd23e4
mov ecx, edi
jns 0xbd2413
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xece888]
or eax, eax
je 0xbd2429
mov dword [ebx], eax
add ebx, 4
jmp 0xbd2401
call dword [esi + 0xece898]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0xbd2460
cmp al, 0xef
ja 0xbd2453
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0xbd2435
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0xbd2442
mov ebp, dword [esi + 0xece88c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xbd2494
sub esp, 0xffffff80
jmp 0x425f74
Function at 0xd83058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xd831a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd8307e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd8306a
add dl, dl
jne 0xd83089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd830dc
xor eax, eax
add dl, dl
jne 0xd83096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd8317d
add dl, dl
jne 0xd830a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd830b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd830bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd830c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd830d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd83075
mov eax, 1
add dl, dl
jne 0xd830ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd830f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd830e1
sub eax, ebx
mov ebx, 1
jne 0xd83128
mov ecx, 1
add dl, dl
jne 0xd8310e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd83119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd83105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd83075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd8313f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd8314a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd83136
cmp eax, 0x7d00
jae 0xd8316d
cmp eax, 0x500
jb 0xd83168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd83075
cmp eax, 0x7f
ja 0xd83170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd83075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd8319e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd83075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x40d440
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x40d46e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x40d48c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0040d3a6
jmp 0x40d48c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x40d48c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0040d3a6
test edi, edi
mov eax, edi
jne 0x40d476
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x107fe80c
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x107fe812
pop ebp
sub ebp, 6
sub ebp, 0x7fe80c
jmp 0x107fe870
mov al, byte [esp + 0x28]
cmp al, 1
je 0x107fe887
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x107fe890
mov eax, 0x7fe80c
add eax, ebp
add eax, 0xaa
mov ecx, 0x576
jbe 0x107fe8a5
add byte [eax], al
mov edx, 0xe20d9dde
or eax, 0x401030e2
xor byte [eax], dl
inc eax
dec ecx
jne 0x107fe8a7
jmp 0x107fe8ba
push ebp
adc edx, dword [ebp + 0x57]
loop 0x107fe89e
invalid
Function at 0x40126a
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4898bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.00402ff0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40132e
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.00402e50
push eax
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
call dword [eax + 0x14]
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
push ecx
push str.AdMsgHandler::Event____d.1:show_2:hide..ok
lea edx, [ebp - 0x14]
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
push eax
push 0x49d108
lea ecx, [ebp - 0x18]
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.00402e50
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x401cf7
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48998e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 4], 0
push str.AdMsgHandler::Hide____start
push 0x49d598
lea eax, [ebp - 0x10]
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.00402e50
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0x18]
add ecx, 0x10
call fcn.0040210f
mov ecx, dword [ebp - 0x18]
add ecx, 0xd4
call fcn.0040210f
mov ecx, dword [ebp - 0x18]
add ecx, 0x198
call fcn.0040210f
push 0
mov ecx, dword [ebp - 0x18]
add ecx, 0x25c
call fcn.00402c64
push 0
mov ecx, dword [ebp - 0x18]
add ecx, 0x25c
call fcn.00402ca1
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 4], 1
push str.AdMsgHandler::Hide____end
push 0x49d5cc
lea ecx, [ebp - 0x14]
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.00402e50
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x401df0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4899b3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 4], 0
push str.AdMsgHandler::Reset____start
push 0x49d604
lea eax, [ebp - 0x10]
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.00402e50
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx + 0x338], 0
jne 0x401e64
xor eax, eax
jmp 0x401f1a
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 4], 1
push str.AdMsgHandler::Reset____step_1
push 0x49d63c
lea edx, [ebp - 0x14]
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.00402e50
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
call fcn.004020a6
push 1
mov ecx, dword [ebp - 0x1c]
add ecx, 0x25c
call fcn.00402ca1
push 0
mov ecx, dword [ebp - 0x1c]
add ecx, 0x25c
call fcn.00402c34
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 4], 2
push str.AdMsgHandler::Reset____end
push 0x49d670
lea eax, [ebp - 0x18]
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.00402e50
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x401f2a
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4899d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 2
jne 0x401f99
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xb4], 0
jne 0x401f7d
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
jmp 0x402096
push str.hide
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::operator_2
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0xb4], 0
jmp 0x401fe8
cmp dword [ebp + 8], 1
jne 0x401fdb
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 0xb4], 1
jne 0x401fbf
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
jmp 0x402096
push str.show
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::operator_2
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0xb4], 1
jmp 0x401fe8
push str.other
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::operator_2
mov ecx, dword [ebp - 0x1c]
add ecx, 0xbc
push ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0xc0]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, 0x4a6a30
call fcn.0040126a
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0xbc]
push ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0xc0]
push eax
push str.AD_NODE_SIMPLE::Event..._d__s__s
lea ecx, [ebp - 0x10]
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0x14
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x10]
push edx
push 0x49d6c4
lea eax, [ebp - 0x18]
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.00402e50
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4023e9
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x489a73
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x41c
push edi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x428]
add ecx, 0xac
call fcn.00402e90
test eax, eax
jne 0x40245d
mov eax, dword [ebp - 0x428]
cmp dword [eax + 0xa8], 0
jle 0x40245d
mov dword [ebp - 0x41c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x41c]
jmp 0x402630
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x428]
add ecx, 0xac
call sub.MFC42.DLL_CString::operator_1
mov edx, dword [ebp - 0x428]
mov dword [edx + 0xa8], 0
mov byte [ebp - 0x20c], 0
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x20b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x410], 0
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x40f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x210], 0
jmp 0x4024cf
mov eax, dword [ebp - 0x210]
add eax, 1
mov dword [ebp - 0x210], eax
push 0x200
push 0
lea ecx, [ebp - 0x20c]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x200
push 0
lea edx, [ebp - 0x410]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x49d708
push 0x1ff
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
push str.setpath_filename_:_s
push 0x1ff
lea ecx, [ebp - 0x410]
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea ecx, [ebp - 0x418]
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 1
lea edx, [ebp - 0x410]
push edx
push 0x49d72c
lea eax, [ebp - 0x418]
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [ebp - 0x418]
call fcn.00402e50
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x418]
call sub.MFC42.DLL_CString::CString
push 0x49d744
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
je 0x4025da
mov edx, dword [ebp - 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x428]
mov ecx, dword [eax + 0xa8]
add ecx, 1
mov edx, dword [ebp - 0x428]
mov dword [edx + 0xa8], ecx
jmp 0x4025dc
jmp 0x4025e1
jmp 0x4024c0
mov eax, dword [ebp - 0x428]
cmp dword [eax + 0xa8], 0
jne 0x402611
mov dword [ebp - 0x420], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x420]
jmp 0x402630
mov dword [ebp - 0x424], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x424]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x402ff0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0
jne 0x403086
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 4], 0
jne 0x403017
mov ecx, dword [ebp - 0x10]
call fcn.004030d0
mov edx, dword [ebp - 0x10]
cmp dword [edx + 4], 0
je 0x403086
mov dword [ebp - 4], 0
push 0x49d7cc
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40307b
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0x1f001
mov edx, dword [ebp - 8]
push edx
call dword [ebp - 4]
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40306e
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 8], ecx
jmp 0x403079
push str.ERROR:_Cannt_create_Advertisement_Manager_Object._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x403086
push str.ERROR:_Cannt_find_CreateObject___in_Advertisement_Manager_DLL._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 8]
mov esp, ebp
pop ebp
ret

Function at 0x4030d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push edi
mov dword [ebp - 0x110], ecx
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x108], eax
push 0x104
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea edx, [ebp - 0x104]
push edx
call fcn.004031a0
add esp, 8
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x40314a
mov eax, dword [ebp - 0x10c]
mov byte [eax + 1], 0
push str...LogicAvMgrGm.dll
lea ecx, [ebp - 0x104]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 0x110]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x110]
cmp dword [edx + 4], 0
jne 0x403198
push str.ERROR:_Load_advertisement_manager_for_game_DLL_fail._Path:
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4032dc
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push edi
mov dword [ebp - 0x314], ecx
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 1
push 0x1a
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov byte [ebp - 0x20c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x20b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x49d830
lea ecx, [ebp - 0x104]
push ecx
push 0x49d860
push 0x103
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x49d868
push 0x49d870
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 1
jle 0x403482
mov byte [ebp - 0x310], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x30f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push str.TencentQQGamedoubleddzRpgFireworkuse.mif
lea ecx, [ebp - 0x104]
push ecx
push 0x49d8a8
push 0x103
lea edx, [ebp - 0x310]
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
push 0x3f4ccccd
push 0
push 0
push 0x28
push 0
push 0
lea eax, [ebp - 0x310]
push eax
push 0xa0
mov ecx, dword [ebp - 0x314]
call fcn.00403eb6
push str.TencentQQGamedoubleddzRpgFirework_reply.mif
lea ecx, [ebp - 0x104]
push ecx
push 0x49d8e0
push 0x103
lea edx, [ebp - 0x310]
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
push 0x3f800000
push 0
push 0
push 0x18
push 0
push 0
lea eax, [ebp - 0x310]
push eax
push 0xa1
mov ecx, dword [ebp - 0x314]
call fcn.00403eb6
push str.TencentQQGamedoubleddzRpgFireworklottery.mif
lea ecx, [ebp - 0x104]
push ecx
push 0x49d91c
push 0x103
lea edx, [ebp - 0x310]
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
push 0x3f800000
push 0
push 0
push 0x28
push 0
push 0
lea eax, [ebp - 0x310]
push eax
push 0x9f
mov ecx, dword [ebp - 0x314]
call fcn.00403eb6
jmp 0x4034ee
push 0x3f4ccccd
push 0
push 0
push 0x28
push 0
push 0
push str.data_fireworkuse.mif
push 0xa0
mov ecx, dword [ebp - 0x314]
call fcn.00403eb6
push 0x3f800000
push 0
push 0
push 0x18
push 0
push 0
push str.data_firework_reply.mif
push 0xa1
mov ecx, dword [ebp - 0x314]
call fcn.00403eb6
push 0x3f800000
push 0
push 0
push 0x28
push 0
push 0
push 0x49d954
push 0x9f
mov ecx, dword [ebp - 0x314]
call fcn.00403eb6
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40b3d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push edi
mov byte [ebp - 0x400], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x3ff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x404], 0
lea eax, [ebp + 0x10]
mov dword [ebp - 0x404], eax
mov ecx, dword [ebp - 0x404]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x3ff
push 0x400
lea eax, [ebp - 0x400]
push eax
call dword [0x49d97c]
add esp, 0x14
mov dword [ebp - 0x404], 0
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x40e280
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push edi
mov dword [ebp - 0x218], ecx
mov byte [ebp - 0xc], 0
xor eax, eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
mov byte [ebp - 3], al
push 0xa
lea ecx, [ebp - 0xc]
push ecx
push 0x49db80
push str.NotUseDefaultDllPath
push 0x49db3c
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x218]
call fcn.0040e3c0
movsx eax, byte [ebp - 0xc]
cmp eax, 0x31
jne 0x40e2ec
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x218]
call fcn.0040eaa0
jmp 0x40e3b2
mov byte [ebp - 0x214], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x213]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edx, dword [ebp + 8]
push edx
push 0x104
lea eax, [ebp - 0x214]
push eax
push 0
push str.DllPath
push str.DefaultValue
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov byte [ebp - 0x110], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x214]
push eax
mov ecx, dword [ebp - 0x218]
call fcn.0040e8f0
lea ecx, [ebp - 0x110]
push ecx
mov ecx, dword [ebp - 0x218]
call fcn.0040e5e0
test eax, eax
je 0x40e398
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x218]
call fcn.0040eaa0
jmp 0x40e3b2
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp - 0x218]
call fcn.0040e510
pop edi
mov esp, ebp
pop ebp
ret 0x10