joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fc40
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov esi, eax
test edi, edi
je 0x40fe0d
test esi, esi
je 0x40fe0d
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x40fe0d
mov ebx, dword [esp + 0x20]
mov eax, ebx
call fcn.0040fbb0
cmp dword [ebp], eax
jl 0x40fe0d
mov eax, 0x55555556
imul ebx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [ecx*4]
mov eax, 0x6bca1af3
imul edx
sar edx, 5
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
xor eax, eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], ecx
mov ebp, 0x13
mov dword [esp + 0x14], eax
test ebx, ebx
jl 0x40fd81
cmp eax, ebx
jne 0x40fcdd
mov edx, ebx
imul edx, edx, 0x4c
lea eax, [ecx*4]
sub eax, edx
cdq
and edx, 3
add eax, edx
mov ebp, eax
sar ebp, 2
test ebp, ebp
jle 0x40fd4b
mov eax, ebp
movzx ecx, byte [edi]
movzx edx, byte [edi + 1]
shl ecx, 8
or ecx, edx
movzx edx, byte [edi + 2]
shl ecx, 8
or ecx, edx
shl ecx, 8
mov edx, ecx
shr edx, 0x1a
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], dl
shl ecx, 6
mov edx, ecx
shr edx, 0x1a
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
shl ecx, 6
mov byte [esi + 1], dl
mov edx, ecx
shr edx, 0x1a
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
shr ecx, 0x14
and ecx, 0x3f
mov byte [esi + 2], dl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 3], cl
add edi, 3
add esi, 4
sub eax, 1
jne 0x40fce3
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
lea eax, [edx + ebp*4]
add eax, 2
mov byte [esi], 0xd
inc esi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
inc eax
mov byte [esi], 0xa
inc esi
cmp eax, ebx
mov dword [esp + 0x14], eax
jle 0x40fcc2
cmp dword [esp + 0x10], 0
je 0x40fd81
sub esi, 2
sub dword [esp + 0x10], 2
lea eax, [ecx + ecx*2]
mov ecx, dword [esp + 0x20]
sub ecx, eax
je 0x40fdf6
lea ebp, [ecx + 1]
test ebp, ebp
je 0x40fdf6
xor eax, eax
test ecx, ecx
jle 0x40fd9d
movzx eax, byte [edi]
inc edi
shl eax, 8
cmp ecx, 1
jle 0x40fdab
movzx edx, byte [edi]
or eax, edx
inc edi
shl eax, 8
cmp ecx, 2
jle 0x40fdb8
movzx ecx, byte [edi]
or eax, ecx
shl eax, 8
test ebp, ebp
jle 0x40fdd7
mov ecx, ebp
mov edx, eax
shr edx, 0x1a
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], dl
inc esi
shl eax, 6
sub ecx, 1
jne 0x40fdc1
add dword [esp + 0x10], ebp
mov edi, 4
sub edi, ebp
test edi, edi
jle 0x40fdf2
push edi
push 0x3d
push esi
call sub.MSVCR90.dll_memset
add esp, 0xc
add dword [esp + 0x10], edi
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov dword [eax], ecx
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x411ce0
Capabilities:
Connect socket

Disassembly:
sub esp, 0x2c
cmp byte [esi + 0x44], 0
je 0x411cef
mov al, 1
add esp, 0x2c
ret
mov eax, dword [esi + 0x40]
push ebx
mov bl, 1
cmp eax, 0xffffffff
jne 0x411d01
xor al, al
pop ebx
add esp, 0x2c
ret
push 0
push 0
push 0
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_WSAConnect]
test eax, eax
je 0x411d63
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x411d5e
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x411d61
push 0x2c
push eax
lea edx, [esp + 0xc]
push edx
call sub.MSVCR90.dll_memset
mov ecx, dword [esi + 0x40]
add esp, 0xc
lea eax, [esp + 4]
push eax
push 0
push ecx
call dword [sym.imp.WS2_32.dll_WSAEnumNetworkEvents]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x411d63
mov dword [esi + 0x48], eax
xor bl, bl
mov byte [esi + 0x44], bl
mov al, bl
pop ebx
add esp, 0x2c
ret

Function at 0x411d70
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0xc]
sub esp, 0x14
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push eax
push ecx
call ebx
test eax, eax
je 0x411d98
mov dword [esi + 0x48], 0x2749
xor al, al
pop ebx
add esp, 0x14
ret 8
mov edx, dword [esi + 8]
push 0
push edx
call ebx
cmp eax, 0x102
jne 0x411db7
mov dword [esi + 0x48], 0x2734
xor al, al
pop ebx
add esp, 0x14
ret 8
push ebp
lea ebp, [esi + 0x28]
push ebp
mov dword [edi], 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 8]
push eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi + 0x40]
push 0
push edi
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
je 0x411e05
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x411e4b
mov ecx, dword [esi + 0x4c]
mov edx, dword [esi + 8]
push ecx
push edx
call ebx
test eax, eax
jne 0x411e4e
mov edx, dword [esi + 0x40]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x24]
push eax
push 0
push edi
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x411e45
push ebp
mov bl, 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebp
mov al, bl
pop ebx
add esp, 0x14
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x48], eax
push ebp
xor bl, bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebp
mov al, bl
pop ebx
add esp, 0x14
ret 8
Function at 0x411e70
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0xc]
sub esp, 0x20
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebp
push eax
push ecx
call ebx
test eax, eax
je 0x411e9a
mov dword [esi + 0x48], 0x2749
xor al, al
pop ebp
pop ebx
add esp, 0x20
ret 4
mov edx, dword [esi + 4]
push 0
push edx
call ebx
cmp eax, 0x80
jne 0x411eba
mov dword [esi + 0x48], 0x2734
xor al, al
pop ebp
pop ebx
add esp, 0x20
ret 4
mov eax, dword [esp + 0x2c]
mov ecx, dword [edi]
mov dword [esp + 0x10], eax
xor eax, eax
lea ebp, [esi + 0x10]
push ebp
mov dword [esp + 0x10], ecx
mov dword [edi], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 4]
push eax
mov dword [esp + 0x28], eax
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
push 0
lea edx, [esp + 0x18]
push edx
mov edx, dword [esi + 0x40]
lea eax, [esp + 0x10]
push eax
push edi
push 1
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x411f33
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x411f79
mov eax, dword [esi + 0x4c]
mov ecx, dword [esp + 0x24]
push eax
push ecx
call ebx
test eax, eax
jne 0x411f7c
mov ecx, dword [esi + 0x40]
lea edx, [esp + 8]
push edx
push eax
mov dword [esp + 0x10], eax
push edi
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x411f73
push ebp
mov bl, 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
pop ebp
pop ebx
add esp, 0x20
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x48], eax
push ebp
xor bl, bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebp
mov al, bl
pop ebx
add esp, 0x20
ret 4

Function at 0x4176d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x494e24
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4bb028]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
lea ecx, [esi + 0x28]
call dword [0x497e20]
lea ecx, [esi + 0x2c]
mov dword [esp + 0x14], 0
call dword [0x497e20]
lea ecx, [esi + 0x30]
call dword [0x497e20]
mov byte [esp + 0x14], 2
mov dword [esi], 0xffffffff
call fcn.004180f0
call sub.BootTime.dll_Ordinal_1
push 0xffffffffffffffff
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
call sub.BootTime.dll_GetSetupTime
add esp, 4
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edx
call sub.BootTime.dll_Ordinal_2
mov ecx, dword [esi + 0x24]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x20]
add eax, dword [esi + 0x18]
mov dword [esi + 0x1c], edx
adc ecx, edx
add eax, dword [esi + 0x10]
adc ecx, dword [esi + 0x14]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x4180f0
Capabilities:
Check if file exists
Query environment variable
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x494d7d
mov eax, dword fs:[0]
push eax
sub esp, 0x304
mov eax, dword [0x4bb028]
xor eax, esp
mov dword [esp + 0x300], eax
mov eax, dword [0x4bb028]
xor eax, esp
push eax
lea eax, [esp + 0x308]
mov dword fs:[0], eax
lea eax, [esp + 4]
push eax
call fcn.00431770
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x106]
push edx
mov word [esp + 0x108], cx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x104
lea eax, [esp + 0x100]
push eax
push str._appdata_GlarySoftGlary_Utilities_5Startup_boottime.dat
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4181de
lea ecx, [esp + 0xfc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4181de
lea edx, [esp + 0xfc]
push edx
push 0xffffffffffffffff
push str.BootTime
push str.Main
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x4181de
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, eax
imul edx, edx, 0x3e8
sub ecx, edx
mov dword [esi], eax
je 0x4181c2
inc eax
mov dword [esi], eax
lea eax, [esp + 4]
push eax
mov dword [esp + 0x314], 0xffffffff
call fcn.00431850
mov eax, 1
jmp 0x4181f5
lea ecx, [esp + 4]
push ecx
mov dword [esp + 0x314], 0xffffffff
call fcn.00431850
xor eax, eax
mov ecx, dword [esp + 0x308]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x300]
xor ecx, esp
call fcn.0048a3f6
add esp, 0x310
ret

Function at 0x41d53e
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
xor eax, eax
pop edi
pop esi
ret

Function at 0x41d540
Capabilities:
Enumerate pe sections

Disassembly:
and al, 8
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x41d579
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x41d560
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x41d571
add edx, ecx
cmp dword [esp + 0xc], edx
invalid
Function at 0x41d8d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub dh, al
inc ebp
lcall 0xc635, 0x9b45c633
inc ebp
pushfd
xor al, 0xc6
inc ebp
popfd
and dh, al
inc ebp
sahf
sub eax, 0x119f45c6
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0041d50e
push eax
push esi
push dword [ebp + 8]
call fcn.0041d4c3
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
inc ebp
loope 0x41d9ac
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0041d50e
push eax
push esi
push dword [ebp + 8]
call fcn.0041d4c3
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0041d4fe
fld dword [ebx - 0x6277d5ab]
jl 0x41d983
invalid
invalid
Function at 0x4271d0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x495698
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4bb028]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
lea eax, [esp + 0x28]
push eax
call fcn.00404e10
mov ebx, dword [esp + 0x54]
lea esi, [ebx + 0x240]
push esi
mov dword [esp + 0x50], 0
call fcn.00408fc0
push esi
lea edi, [esp + 0x2c]
call fcn.00409790
mov ecx, dword [ebx + 0x20]
push ecx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call sub.mfc90u.dll_CWnd::FromHandle
mov eax, dword [eax + 0x20]
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov ebx, dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
cmp esi, eax
jbe 0x42725a
call ebx
mov eax, dword [esp + 0x38]
mov ebp, dword [esp + 0x28]
mov edi, edi
mov edi, eax
cmp dword [esp + 0x34], eax
jbe 0x42726a
call ebx
test ebp, ebp
je 0x427274
cmp ebp, dword [esp + 0x28]
je 0x427276
call ebx
cmp esi, edi
je 0x427351
test ebp, ebp
jne 0x42729f
call ebx
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x42728d
call ebx
mov eax, dword [esi]
add eax, 0xe0
cmp dword [eax + 0x18], 8
jb 0x4272a4
mov eax, dword [eax + 4]
jmp 0x4272a7
mov eax, dword [ebp]
jmp 0x427286
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42731f
test ebp, ebp
jne 0x42733a
call ebx
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x4272c5
call ebx
mov ecx, dword [esi]
cmp dword [ecx + 0x114], 0xffffffff
jne 0x42731f
test ebp, ebp
jne 0x427342
call ebx
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x4272df
call ebx
mov edx, dword [esi]
test byte [edx + 0x124], 4
je 0x42731f
test ebp, ebp
jne 0x427347
call ebx
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x4272f9
call ebx
mov ecx, dword [esi]
sub esp, 0x128
mov eax, esp
mov dword [esp + 0x13c], esp
push eax
call fcn.00402e80
mov ecx, dword [esp + 0x17c]
push 0
push ecx
call fcn.004273a0
test ebp, ebp
jne 0x42734c
call ebx
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x42732e
call ebx
mov eax, dword [esp + 0x38]
add esi, 4
jmp 0x427260
mov eax, dword [ebp]
jmp 0x4272be
mov eax, dword [ebp]
jmp 0x4272d8
mov eax, dword [ebp]
jmp 0x4272f2
mov eax, dword [ebp]
jmp 0x427327
mov edx, dword [esp + 0x54]
push edx
call fcn.00429710
mov eax, dword [esp + 0x34]
xor esi, esi
cmp eax, esi
je 0x42736e
push eax
call sub.mfc90u.dll_delete
add esp, 4
mov eax, dword [esp + 0x28]
push eax
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
call sub.mfc90u.dll_delete
add esp, 4
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 4
Function at 0x42a990
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x491ad7
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4bb028]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push esi
call fcn.00404e10
lea eax, [esi + 0x18]
push eax
mov dword [esp + 0x18], 0
call fcn.00404e10
lea ecx, [esi + 0x30]
push ecx
mov byte [esp + 0x18], 1
call fcn.00404e10
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x42b340
Capabilities:
Create thread

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov ebx, eax
xor ebp, ebp
push edi
mov esi, ecx
cmp ebx, ebp
je 0x42b426
lea edx, [eax + 2]
jmp 0x42b360
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x42b360
sub eax, edx
sar eax, 1
je 0x42b426
cmp dword [esi + 0x68], ebp
lea edi, [esi + 0x68]
je 0x42b38a
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
mov eax, dword [esp + 0x34]
lea ecx, [esi + 0x18]
push ecx
xor ecx, ecx
mov dword [esi + 0x48], ebp
mov dword [esi + 0x50], ebp
mov dword [esi + 0x54], ebp
mov dword [esi + 0x58], ebp
mov dword [esi + 0x60], eax
call fcn.0045b220
add esp, 4
push esi
mov ecx, str..png.jpg.gif.jpeg
call fcn.0045b220
add esp, 4
push ebx
lea ecx, [esi + 0x6c]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
push ebp
push ebp
push esi
push 0x42abc0
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
mov dword [edi], eax
push 0x4ff
push 0xffffffffffffffff
push ebp
push edi
push 1
call esi
test eax, eax
je 0x42b40b
push 1
push ebp
push ebp
push ebp
lea edx, [esp + 0x24]
push edx
call ebx
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x42b3e1
mov eax, dword [edi]
cmp eax, ebp
je 0x42b418
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], ebp
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
add esp, 0x20
ret 4
Function at 0x431930
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x491a69
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bb028]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, edx
mov eax, esi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x431960
sub eax, edx
sar eax, 1
mov edi, eax
je 0x4319c3
push esi
lea ecx, [esp + 0x18]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x3c], 0
call fcn.0040a120
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea esi, [esi + edi*2 + 2]
mov eax, esi
lea edx, [eax + 2]
jmp 0x4319b0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4319b0
sub eax, edx
sar eax, 1
mov edi, eax
jne 0x431973
mov ecx, dword [ebx + 0x10]
sub ecx, dword [ebx + 0xc]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
neg eax
sbb eax, eax
neg eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x431a40
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x268
mov eax, dword [0x4bb028]
xor eax, esp
mov dword [esp + 0x264], eax
mov eax, dword [esp + 0x26c]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x10]
mov dword [esp + 0x14], eax
cmp dword [esi + 0xc], edi
jbe 0x431a73
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov ebx, dword [esi + 0xc]
mov ebp, dword [esi]
cmp ebx, dword [esi + 0x10]
jbe 0x431a83
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov eax, dword [esi]
push edi
push ebp
push ebx
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.0040ab60
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x431b71
cmp dword [esp + 0x3c], 0
je 0x431abc
mov edi, 0x5000
jmp 0x431ac2
mov edi, dword [esp + 0x40]
shr edi, 1
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.mfc90u.dll_new__
add esp, 4
push ebp
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebp, dword [esp + 0x14]
push ebp
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
lea ecx, [edi - 2]
cmp eax, ecx
jne 0x431b4c
lea ebx, [ebx]
push ebx
call sub.mfc90u.dll_delete__
add esp, 4
cmp edi, 0x100000
jge 0x431b15
add edi, edi
jmp 0x431b1b
add edi, 0x100000
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.mfc90u.dll_new__
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x431b71
push ebp
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
lea ecx, [edi - 2]
cmp eax, ecx
je 0x431b00
mov ecx, esi
mov edx, ebx
call fcn.00431930
push ebx
test eax, eax
je 0x431b69
call sub.mfc90u.dll_delete__
add esp, 4
mov eax, 1
jmp 0x431b73
call sub.mfc90u.dll_delete__
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x274]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048a3f6
add esp, 0x268
ret
Function at 0x432380
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4bb028]
xor eax, esp
mov dword [esp + 0x208], eax
push ebp
mov ebp, dword [esp + 0x214]
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xa0]
mov ecx, edi
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::clear_void_]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x16]
push ecx
mov word [esp + 0x18], ax
call sub.MSVCR90.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 8
jb 0x4323d3
mov esi, dword [esi + 4]
jmp 0x4323d6
add esi, 4
push esi
push 0x104
lea edx, [esp + 0x14]
push edx
push 0x4987c8
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0xc]
push eax
mov ecx, edi
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
cmp dword [edi + 0x18], 8
jb 0x432406
mov eax, dword [edi + 4]
jmp 0x432409
lea eax, [edi + 4]
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0048a3f6
add esp, 0x20c
ret 4

Function at 0x432430
Capabilities:
Read .ini file

Disassembly:
cmp dword [eax + 0x18], 8
jb 0x43244a
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 8]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
ret 4
add eax, 4
push eax
mov eax, dword [esp + 8]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
ret 4
Function at 0x433890
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4338ca
lea ecx, [esp + 4]
push ecx
push 0x4a09ac
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x4338d0
mov edx, dword [esp]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x1c
ret
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push 0
push 0
push 0x10
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
push 0
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x43391c
mov ecx, dword [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x1c
ret
mov eax, 1
add esp, 0x1c
ret