joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48e10c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048ddcc

Function at 0x4a5de0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebx - 4]
jle 0x4a5e4a
mov ecx, dword [ebp + 8]
sub ecx, ebx
push esi
mov dword [ebp + 8], ecx
push edi
nop word [eax + eax]
mov esi, dword [ecx + ebx]
lea ebx, [ebx + 4]
mov ecx, eax
mov edi, esi
and edi, 0xffff00ff
and ecx, 0xffff00ff
add edi, ecx
mov edx, esi
movzx ecx, ax
and edx, 0xff00
add edx, ecx
and eax, 0xff00ffff
mov ecx, dword [ebp + 8]
xor edi, edx
and esi, 0xff00ff00
and edi, 0xff00ff
add eax, esi
xor eax, edi
sub dword [ebp + 0x10], 1
mov dword [ebx - 4], eax
jne 0x4a5e00
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4a5e50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jle 0x4a5ec3
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
sub ecx, eax
sub dword [ebp + 0x14], eax
push ebx
push esi
mov dword [ebp + 0xc], ecx
push edi
nop word [eax + eax]
mov ebx, dword [ecx + eax]
lea eax, [eax + 4]
mov esi, dword [eax - 4]
mov ecx, ebx
and ecx, 0xffff00ff
mov edi, esi
and edi, 0xffff00ff
mov edx, esi
add edi, ecx
and edx, 0xff00
movzx ecx, bx
and esi, 0xff00ff00
add edx, ecx
and ebx, 0xff00ffff
mov ecx, dword [ebp + 0x14]
xor edi, edx
and edi, 0xff00ff
add ebx, esi
xor edi, ebx
sub dword [ebp + 0x10], 1
mov dword [ecx + eax - 4], edi
mov ecx, dword [ebp + 0xc]
jne 0x4a5e70
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4a66c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 8]
push edi
mov dword [ebp + 8], 0
lea eax, [ebx + eax*4]
mov edi, eax
sub edi, ebx
add edi, 3
shr edi, 2
cmp ebx, eax
cmova edi, ecx
test edi, edi
je 0x4a6734
push esi
mov esi, dword [ebp + 0x10]
nop
mov edx, dword [ebx]
lea esi, [esi + 2]
mov ecx, edx
lea ebx, [ebx + 4]
shr ecx, 0x10
mov eax, edx
shr eax, 0xd
xor cl, al
mov eax, edx
and cl, 7
shr eax, 0x10
xor cl, al
mov eax, edx
mov byte [esi - 2], cl
mov ecx, edx
shr ecx, 5
shr eax, 3
xor cl, al
shr edx, 5
mov eax, dword [ebp + 8]
and cl, 0x1f
xor cl, dl
inc eax
mov byte [esi - 1], cl
mov dword [ebp + 8], eax
cmp eax, edi
jb 0x4a66f0
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4a6740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp + 8], 0
lea eax, [edi + eax*4]
mov ebx, eax
sub ebx, edi
add ebx, 3
shr ebx, 2
cmp edi, eax
cmova ebx, ecx
test ebx, ebx
je 0x4a67ab
push esi
mov esi, dword [ebp + 0x10]
nop
mov edx, dword [edi]
lea esi, [esi + 2]
mov ecx, edx
lea edi, [edi + 4]
shr ecx, 0x10
mov eax, edx
shr eax, 0xc
xor cl, al
mov eax, edx
shr eax, 0x10
and cl, 0xf
xor cl, al
mov eax, edx
shr eax, 0x1c
xor al, dl
mov byte [esi - 2], cl
and al, 0xf
xor al, dl
mov byte [esi - 1], al
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
cmp eax, ebx
jb 0x4a6770
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403936
Capabilities:
Set file attributes

Disassembly:
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret

Function at 0x403aaf
Capabilities:
Create directory

Disassembly:
mov eax, 0x424ebc
call fcn.00424100
sub esp, 0x38
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x403ad2
mov al, 1
jmp 0x403b17
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x403ae3
xor al, al
jmp 0x403b17
lea ecx, [ebp - 0x44]
call fcn.00403ef9
lea ecx, [ebp - 0x1c]
call fcn.00402543
push esi
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], ebx
call fcn.00403f2b
test al, al
je 0x403b0c
mov ebx, dword [ebp - 0x24]
shr ebx, 4
and bl, 1
push dword [ebp - 0x1c]
call fcn.00402084
pop ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x403f1c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x403f2a
or eax, eax
ret
Function at 0x4043cc
Capabilities:
Get disk information

Disassembly:
mov eax, 0x424f44
call fcn.00424100
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
call fcn.00401e65
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov ebx, eax
test ebx, ebx
je 0x40448c
lea eax, [ebx + ebx]
push eax
call fcn.0040205d
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
and dword [ebp - 4], 0
push esi
push ebx
call edi
mov edi, eax
test edi, edi
mov dword [ebp - 0x10], edi
je 0x404485
cmp edi, ebx
ja 0x404485
lea ecx, [ebp - 0x2c]
call fcn.00402543
xor eax, eax
xor ebx, ebx
cmp edi, eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], eax
jbe 0x40446d
push 2
pop edi
cmp word [esi + edi - 2], 0
jne 0x404462
add eax, esi
lea ecx, [ebp - 0x2c]
push eax
call fcn.00402638
mov ecx, dword [ebp - 0x18]
lea eax, [ebx + 1]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x1c], edi
call fcn.00401a40
mov eax, edi
inc ebx
inc edi
inc edi
cmp ebx, dword [ebp - 0x10]
jb 0x404438
mov edi, dword [ebp - 0x10]
push dword [ebp - 0x2c]
call fcn.00402084
push esi
call fcn.00402084
cmp dword [ebp - 0x14], edi
pop ecx
pop ecx
sete al
jmp 0x40448e
push esi
call fcn.00402084
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4044f6
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40451c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40451c
xor al, al
jmp 0x40453c
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.00424400
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x40c51f
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4256f6
call fcn.00424100
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], al
mov byte [esi + 0x21], al
call fcn.00402543
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.0040c56e
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40c5cb
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x425741
call fcn.00424100
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 3
call fcn.0040e8a0
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.0040c616
push dword [esi + 0x24]
call fcn.00402084
and byte [ebp - 4], 0
pop ecx
lea ecx, [esi + 0xc]
call fcn.00401a87
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0040cab7
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40fbbe
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2b4
lea eax, [esp]
neg cl
sbb ecx, ecx
and cl, 1
add ecx, 0x100
or cx, 0x4010
push ecx
push 0x2b4
push eax
push 0x90
push 0x4276f4
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
add esp, 0x2b4
ret

Function at 0x410bf0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov eax, 0x425e84
call fcn.00424100
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi], 0x427ec4
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 2
mov byte [esi + 0x45], bl
call fcn.00402543
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 3
call fcn.00402543
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 4
mov byte [esi + 0x60], bl
call fcn.00402543
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 5
call fcn.00402543
lea eax, [esi + 0x80]
mov byte [esi + 0x7c], 1
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
lea ecx, [esi + 0x8c]
mov byte [ebp - 4], 7
call fcn.00402543
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x427e90
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x410bfc
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov eax, 0x425e84
call fcn.00424100
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi], 0x427ec4
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 2
mov byte [esi + 0x45], bl
call fcn.00402543
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 3
call fcn.00402543
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 4
mov byte [esi + 0x60], bl
call fcn.00402543
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 5
call fcn.00402543
lea eax, [esi + 0x80]
mov byte [esi + 0x7c], 1
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
lea ecx, [esi + 0x8c]
mov byte [ebp - 4], 7
call fcn.00402543
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x427e90
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4110b7
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x425f7a
call fcn.00424100
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi], 0x427ec4
lea ecx, [esi + 0xc]
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
call fcn.00402543
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.00402543
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.00402543
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi], 0x427f24
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x411119
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x425fad
call fcn.00424100
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 3
call fcn.00401a87
push dword [esi + 0x24]
call fcn.00402084
push dword [esi + 0x18]
call fcn.00402084
push dword [esi + 0xc]
call fcn.00402084
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov dword [esi], 0x427ef4
mov dword fs:[0], ecx
pop esi
leave
ret
Function at 0x41251d
Capabilities:
Get file system object information

Disassembly:
mov eax, 0x426240
call fcn.00424100
sub esp, 0x340
push ebx
mov dword [ebp - 0x1c], ecx
push esi
push edi
lea ecx, [ebp - 0x34]
call fcn.00402543
mov esi, dword [ebp + 0x10]
and dword [ebp - 4], 0
cmp byte [esi], 0
je 0x41258a
push dword [esi + 0xc]
lea ecx, [ebp - 0x40]
push dword [esi + 8]
call fcn.004123fc
push eax
mov edx, 0xdb0
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.0041249c
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.0040269c
push dword [ebp - 0x4c]
call fcn.00402084
push dword [ebp - 0x40]
and byte [ebp - 4], 0
call fcn.00402084
pop ecx
pop ecx
lea edi, [esi + 0x18]
mov ecx, edi
call fcn.00402967
lea ebx, [eax + 1]
lea eax, [ebp - 0x28]
push ebx
push eax
mov ecx, edi
call fcn.00402e8e
mov eax, dword [edi]
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
lea eax, [eax + ebx*2]
push eax
call fcn.00402587
mov ebx, dword [ebp - 0x1c]
lea eax, [ebp - 0x28]
push eax
mov ecx, ebx
mov byte [ebp - 4], 4
call fcn.004124e2
lea eax, [ebp - 0x58]
mov ecx, ebx
push eax
call fcn.004124e2
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x18]
push eax
call fcn.004025ca
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 5
call fcn.0040274f
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x18]
push eax
call fcn.004027c2
lea ecx, [ebp - 0x18]
call fcn.0040274f
lea eax, [ebp - 0x34]
lea ecx, [ebp - 0x18]
push eax
call fcn.004027c2
lea ecx, [ebp - 0x18]
call fcn.0040274f
cmp byte [esi + 1], 0
je 0x412695
lea eax, [ebp - 0x48]
add esi, 0x10
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test eax, eax
jne 0x41263f
lea eax, [ebp + 0x10]
push 0x428e00
push eax
mov dword [ebp + 0x10], 0x3ff0c2
call sub.MSVCRT.dll__CxxThrowException
mov edx, 0x3f4
lea ecx, [ebp - 0x40]
call fcn.004052d5
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 6
call fcn.004027c2
push dword [ebp - 0x40]
mov byte [ebp - 4], 5
call fcn.00402084
lea ecx, [ebp - 0x18]
mov dword [esp], 0x428034
call fcn.00402776
push 1
push 1
lea edx, [ebp - 0x98]
lea ecx, [ebp - 0x48]
call fcn.00405295
lea eax, [ebp - 0x98]
lea ecx, [ebp - 0x18]
push eax
call fcn.00402776
push dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [ebx + 4]
call esi
push dword [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edi, dword [edi]
push 0x110
lea eax, [ebp - 0x34c]
push 0x2b4
push eax
push 0x80
push edi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x4126ec
push dword [ebp + 0xc]
push dword [ebx + 4]
call esi
push 0
push dword [ebp - 0x34c]
push 0x170
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0x18]
call fcn.00402084
push dword [ebp - 0x58]
call fcn.00402084
push dword [ebp - 0x28]
call fcn.00402084
push dword [ebp - 0x34]
call fcn.00402084
mov ecx, dword [ebp - 0xc]
add esp, 0x10
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x412857
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
mov eax, 0x426278
call fcn.00424100
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
or eax, 0xffffffff
mov dword [ebp - 0x10], esi
mov dword [esi + 8], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x38]
mov byte [esi], bl
mov byte [esi + 1], bl
mov byte [esi + 2], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x34], eax
call fcn.00402543
lea ecx, [esi + 0x44]
mov dword [ebp - 4], ebx
call fcn.00402543
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 1
call fcn.00402543
mov byte [esi + 0x5c], bl
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
lea ecx, [esi + 0x6c]
mov byte [ebp - 4], 3
call fcn.004128ed
lea ecx, [esi + 0x9c]
call fcn.00423040
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4141cf
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x4264f0
call fcn.00424100
sub esp, 0x44
push ebx
push esi
push edi
mov esi, ecx
push 0
call fcn.00412e88
push 1
mov ecx, esi
call fcn.004137df
mov edx, 0x198
lea ecx, [ebp - 0x20]
call fcn.0040f7d9
mov eax, dword [eax]
lea edi, [esi + 4]
push eax
push 2
push dword [edi]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push dword [ebp - 0x20]
call fcn.00402084
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
pop ecx
push 2
push dword [edi]
call ebx
push 1
push 1
push 0xf4
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x1bc
push dword [edi]
call ebx
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x1be
push dword [edi]
call ebx
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [ebp - 0x50]
call fcn.0041435e
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], ebx
call fcn.0041435e
lea eax, [esi + 0x1e4]
mov dword [ebp - 4], 1
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x1ac], ebx
lea ebx, [esi + 0x1b4]
push ebx
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 2
setne byte [ebp - 0xd]
call fcn.0041438f
add ebx, 0x18
lea ecx, [ebp - 0x38]
push ebx
call fcn.0041438f
push dword [ebp - 0x14]
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ebx, ebx
cmp dword [ebp - 0x40], ebx
je 0x4142e2
cmp dword [ebp - 0x4c], ebx
mov byte [esi + 0x203], 1
jne 0x4142d8
push 0x427e10
lea ecx, [ebp - 0x50]
call fcn.00402638
push 0x10
push dword [ebp - 0x50]
push dword [ebp - 0x44]
jmp 0x41430d
cmp byte [ebp - 0xd], 0
jne 0x414323
cmp dword [ebp - 0x28], ebx
mov byte [esi + 0x203], 1
je 0x41433c
cmp dword [ebp - 0x34], ebx
jne 0x414306
push 0x427e10
lea ecx, [ebp - 0x38]
call fcn.00402638
push ebx
push dword [ebp - 0x38]
push dword [ebp - 0x2c]
mov eax, esi
neg eax
sbb eax, eax
and eax, edi
push dword [eax]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp byte [ebp - 0xd], 0
je 0x41433c
cmp byte [esi + 0x136], 0
jne 0x41433c
mov ecx, esi
mov byte [esi + 0x135], 1
call fcn.0041472c
jmp 0x414345
push ebx
push dword [edi]
call dword [sym.imp.USER32.dll_EndDialog]
lea ecx, [ebp - 0x50]
call fcn.00412d41
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x414d51
Capabilities:
Get file system object information

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push edx
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
ret 0xc
Function at 0x401420
Capabilities:
Read .ini file
Reference google public dns server

Disassembly:
push 0xffffffffffffffff
push 0x427678
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [0x434794]
push esi
push edi
mov dword [esp + 0x10], eax
push str.C:WINDOWSxkkconfig.ini
push 0x104
push 0x104
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], 0
call fcn.0041edbf
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push eax
push str.8.8.8.8
push str.IPAddr
push str.config
call esi
mov ecx, dword [esp + 0x10]
mov edx, dword [0x439ae0]
push ecx
lea ecx, [edx + 0x5c]
call fcn.0041ef91
mov eax, dword [0x434794]
mov dword [esp + 0xc], eax
push str.C:WINDOWSxkkconfig.ini
push 0x104
push 0x104
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 1
call fcn.0041edbf
push eax
push str.User
push str.User
push str.config
call esi
mov ecx, dword [esp + 0xc]
push ecx
mov ecx, dword [0x439ae0]
push 0x3e9
call fcn.0041eefb
mov edx, dword [0x434794]
mov dword [esp + 8], edx
push str.C:WINDOWSxkkconfig.ini
push 0x104
push 0x104
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 2
call fcn.0041edbf
push eax
push 0x439ae8
push 0x4340e4
push str.config
call esi
mov eax, dword [esp + 8]
mov ecx, dword [0x439ae0]
push eax
push 0x3ea
call fcn.0041eefb
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push str.C:WINDOWSxkkconfig.ini
push 0
push str.Save
push str.config
call esi
mov ecx, dword [0x439ae0]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
mov edx, dword [ecx + 0x12c]
push 0xf1
push edx
call edi
push str.C:WINDOWSxkkconfig.ini
push 0
push str.Redialing
push str.config
call esi
push 0
push eax
mov eax, dword [0x439ae0]
push 0xf1
mov ecx, dword [eax + 0xf0]
push ecx
call edi
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 1
call fcn.0041eadd
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 0
call fcn.0041eadd
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0041eadd
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x403540
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4279f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push ebp
push esi
push edi
lea ecx, [esp + 0x44]
call fcn.00419fe1
lea ecx, [esp + 0x1c]
mov dword [esp + 0x60], 0
call fcn.00419fe1
push 0
push 0
push 0
push 0
push 1
push 0
lea ecx, [esp + 0x48]
mov byte [esp + 0x78], 1
call fcn.00422dda
push 0
push 0
push 1
push 1
push str.http:__www.416207.com_mf_ip.txt
lea ecx, [esp + 0x44]
mov byte [esp + 0x74], 2
call fcn.00422ed5
mov esi, eax
mov eax, dword [0x434794]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov eax, dword [esi]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
mov byte [esp + 0x64], 4
call dword [eax + 0x58]
test eax, eax
je 0x4035fa
push 0x4344d0
lea ecx, [esp + 0x10]
call fcn.0041ed6b
lea edx, [esp + 0x10]
lea ecx, [esp + 0xc]
push edx
call fcn.0041eda7
mov eax, dword [esi]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call dword [eax + 0x58]
test eax, eax
jne 0x4035ce
lea ecx, [esp + 0x30]
call fcn.00422e7f
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x4344cc
call fcn.0041eb4b
lea edx, [esp + 0x48]
lea eax, [esp + 0x10]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
mov byte [esp + 0x70], 5
call fcn.0041e852
mov byte [esp + 0x6c], 4
call fcn.00402590
mov ebp, eax
add esp, 0xc
xor esi, esi
test ebp, ebp
jle 0x4036c8
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x4344c8
call fcn.0041eb4b
lea ecx, [esp + 0x20]
mov byte [esp + 0x64], 6
push ecx
push esi
lea ecx, [esp + 0x50]
call fcn.00403730
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0041e852
mov byte [esp + 0x6c], 4
call fcn.00402590
add esp, 0xc
test eax, eax
jle 0x4036c3
mov edx, dword [esp + 0x20]
mov eax, dword [edx]
push eax
mov eax, dword [0x439ae0]
push 0
push 0x143
mov ecx, dword [eax + 0x78]
push ecx
call edi
mov edx, dword [esp + 0x20]
mov ecx, dword [0x4398d8]
lea eax, [edx + 4]
push eax
push ecx
mov ecx, 0x4398d0
call fcn.0041a1bd
inc esi
cmp esi, ebp
jl 0x40364e
lea ecx, [esp + 0xc]
mov byte [esp + 0x60], 3
call fcn.0041eadd
lea ecx, [esp + 0x10]
mov byte [esp + 0x60], 2
call fcn.0041eadd
lea ecx, [esp + 0x30]
mov byte [esp + 0x60], 1
call fcn.00422d95
lea ecx, [esp + 0x1c]
mov byte [esp + 0x60], 0
call fcn.0041a014
lea ecx, [esp + 0x44]
mov dword [esp + 0x60], 0xffffffff
call fcn.0041a014
mov ecx, dword [esp + 0x58]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x58
ret
Function at 0x4191c0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.0040bb40
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x41928b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x41928b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x41923e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x419249
or bh, 8
and edi, 0x8000000
je 0x419264
mov eax, dword [0x43d2fc]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x41928b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret