joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45253f
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.004a98b0
mov eax, dword [0x4dd52c]
and word [ebp - 0x1004], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
xor eax, eax
mov ecx, 0x3ff
lea edi, [ebp - 0x1002]
rep stosd dword es:[edi], eax
xor ebx, ebx
inc ebx
cmp dword [ebp + 0xc], 0x10011
stosw word es:[edi], ax
jne 0x45263a
test esi, esi
je 0x452698
cmp dword [esi + 0x1dfa8], ebx
jne 0x452698
mov eax, dword [esi + 0x1dfac]
test eax, eax
je 0x452698
cmp eax, ebx
jb 0x452698
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x409b84
xor eax, eax
lea edi, [ebp - 0x1004]
mov ecx, 0x400
rep stosd dword es:[edi], eax
movzx eax, word [ebp - 0x1006]
push 0x409b70
push eax
movzx eax, word [ebp - 0x1008]
push eax
movzx eax, word [ebp - 0x100a]
push eax
movzx eax, word [ebp - 0x100c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4065a0
lea eax, [ebp - 0x1004]
push 0x800
push eax
call fcn.00431bde
add esp, 0x2c
cmp word [esi + 0x1dfa0], bx
lea eax, [ebp - 0x1004]
push eax
jne 0x45267a
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x452698
cmp dword [ebp + 0xc], 0x10023
jne 0x452698
test esi, esi
je 0x452698
cmp dword [esi + 0x1dfa8], ebx
jne 0x452698
mov eax, dword [esi + 0x1dfac]
test eax, eax
je 0x452698
cmp eax, ebx
jb 0x452698
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x409b44
jmp 0x4525c7
lea edi, [esi + 0x1dfa4]
push 0x4060a8
push dword [edi]
call dword [sym.imp.msvcrt.dll_fwprintf]
push dword [edi]
call dword [sym.imp.msvcrt.dll_fflush]
add esp, 0x10
push 0xea
push esi
call fcn.004a53d4
cmp eax, ebx
je 0x4526b7
cmp dword [esi + 0x1dfb0], ebx
je 0x4526b7
cmp dword [esi + 0x1dfb4], ebx
jne 0x45272a
cmp byte [esi + 0x246e], 0
jne 0x45272a
cmp word [esi + 0x5de], 0
jne 0x4526de
cmp byte [esi + 0x1cdd], 0
jne 0x4526de
push dword [ebp + 0xc]
push esi
call fcn.0045210e
jmp 0x45271b
mov edi, dword [ebp + 0xc]
push edi
push esi
call fcn.0045210e
cmp word [esi + 0xd8e], bx
jne 0x452714
cmp byte [esi + 0x184c], 5
jne 0x45270b
cmp edi, 0x10023
je 0x45270b
push edi
push esi
call fcn.00451dde
jmp 0x45271b
push edi
push esi
call fcn.00451e71
jmp 0x45271b
push edi
push esi
call fcn.00451b80
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.004a9585
leave
ret 8
cmp word [esi + 0x5de], 0
jne 0x452745
cmp byte [esi + 0x1cdd], 0
jne 0x452745
cmp dword [esi + 0x1dfb0], ebx
jne 0x45271b
push dword [ebp + 0xc]
push esi
call fcn.0045210e
cmp word [esi + 0xd8e], bx
push dword [ebp + 0xc]
jne 0x452715
push esi
call fcn.00451a12
jmp 0x45271b
Function at 0x452767
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.004a98b0
mov eax, dword [0x4dd52c]
and word [ebp - 0x1004], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
xor eax, eax
mov ecx, 0x3ff
lea edi, [ebp - 0x1002]
rep stosd dword es:[edi], eax
xor ebx, ebx
inc ebx
cmp dword [ebp + 0xc], 0x10012
stosw word es:[edi], ax
jne 0x452862
test esi, esi
je 0x4528c0
cmp dword [esi + 0x1dfa8], ebx
jne 0x4528c0
mov eax, dword [esi + 0x1dfac]
test eax, eax
je 0x4528c0
cmp eax, ebx
jb 0x4528c0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x409bd4
xor eax, eax
lea edi, [ebp - 0x1004]
mov ecx, 0x400
rep stosd dword es:[edi], eax
movzx eax, word [ebp - 0x1006]
push 0x409b70
push eax
movzx eax, word [ebp - 0x1008]
push eax
movzx eax, word [ebp - 0x100a]
push eax
movzx eax, word [ebp - 0x100c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4065a0
lea eax, [ebp - 0x1004]
push 0x800
push eax
call fcn.00431bde
add esp, 0x2c
cmp word [esi + 0x1dfa0], bx
lea eax, [ebp - 0x1004]
push eax
jne 0x4528a2
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x4528c0
cmp dword [ebp + 0xc], 0x10024
jne 0x4528c0
test esi, esi
je 0x4528c0
cmp dword [esi + 0x1dfa8], ebx
jne 0x4528c0
mov eax, dword [esi + 0x1dfac]
test eax, eax
je 0x4528c0
cmp eax, ebx
jb 0x4528c0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x409ba8
jmp 0x4527ef
lea edi, [esi + 0x1dfa4]
push 0x4060a8
push dword [edi]
call dword [sym.imp.msvcrt.dll_fwprintf]
push dword [edi]
call dword [sym.imp.msvcrt.dll_fflush]
add esp, 0x10
push 0xea
push esi
call fcn.004a53d4
cmp eax, ebx
je 0x4528df
cmp dword [esi + 0x1dfb0], ebx
je 0x4528df
cmp dword [esi + 0x1dfb4], ebx
jne 0x45294e
cmp byte [esi + 0x246e], 0
jne 0x45294e
xor eax, eax
cmp word [esi + 0x5de], ax
jne 0x452915
cmp byte [esi + 0x1cdd], al
jne 0x452915
cmp dword [esi + 0x1dfb0], ebx
jne 0x452930
cmp dword [esi + 0x1dfb8], ebx
jne 0x452930
cmp dword [esi + 0x1dfbc], eax
jne 0x452930
jmp 0x452943
cmp word [esi + 0xd8e], bx
jne 0x45297d
cmp byte [esi + 0x184c], 5
jne 0x45293b
cmp dword [ebp + 0xc], 0x10024
je 0x45293b
push dword [ebp + 0xc]
push esi
call fcn.00451fd6
jmp 0x452986
cmp dword [esi + 0x1dfb0], eax
jne 0x452986
push dword [ebp + 0xc]
push esi
call fcn.00451ff7
jmp 0x452986
cmp word [esi + 0x5de], 0
jne 0x452969
cmp byte [esi + 0x1cdd], 0
jne 0x452969
cmp dword [esi + 0x1dfb0], ebx
jne 0x45298f
cmp word [esi + 0xd8e], bx
jne 0x45297d
push dword [ebp + 0xc]
push esi
call fcn.00451c27
jmp 0x452986
push dword [ebp + 0xc]
push esi
call fcn.00451d4c
push dword [ebp + 0xc]
push esi
call fcn.00452166
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.004a9585
leave
ret 8
Function at 0x45b13a
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
push edi
push dword [ebp + 0xc]
call esi
mov ebx, dword [ebp + 0x10]
push ebx
mov dword [ebp - 4], eax
call esi
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
xor edi, edi
cmp ecx, edi
mov dword [ebp + 0x10], eax
je 0x45b197
cmp dword [ebp - 4], edi
je 0x45b197
cmp eax, edi
je 0x45b197
cmp dword [ebp - 4], edi
jbe 0x45b192
mov esi, dword [ebp + 0xc]
sub esi, ecx
xor edx, edx
mov eax, edi
div dword [ebp + 0x10]
mov ax, word [ebx + edx*2]
xor ax, word [esi + ecx]
inc edi
mov word [ecx], ax
inc ecx
inc ecx
cmp edi, dword [ebp - 4]
jb 0x45b178
xor eax, eax
inc eax
jmp 0x45b199
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x45d0b4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4dd52c]
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], eax
xor eax, eax
xor ebx, ebx
mov word [ebp - 0x20c], bx
mov ecx, 0x81
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
lea eax, [edx + 0x19a24]
push eax
add edx, 0x19c2c
push edx
lea eax, [ebp - 0x20c]
push 0x40c25c
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x14
test esi, esi
je 0x45d12b
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45d12b
test al, 0x10
jne 0x45d12d
inc ebx
jmp 0x45d12d
xor ebx, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.004a9585
leave
ret 8

Function at 0x45d143
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x4dd52c]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
xor ebx, ebx
mov word [ebp - 0x20c], bx
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
push 0x40c318
push esi
stosw word es:[edi], ax
mov dword [ebp - 0x418], ebx
call fcn.0045d0b4
cmp eax, 1
jne 0x45d1d3
push 0x40c308
lea eax, [esi + 0x19a24]
push eax
lea eax, [esi + 0x19c2c]
push eax
lea eax, [ebp - 0x20c]
push 0x40c25c
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
push 0x104
lea eax, [ebp - 0x20c]
push eax
add esi, 0x1d8c4
push esi
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0x20
inc ebx
jmp 0x45d2c7
lea eax, [ebp - 0x418]
push eax
push 1
push ebx
push 0x40c2a8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45d2c7
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
push 0x40c294
push dword [ebp - 0x418]
mov dword [ebp - 0x41c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x45d272
xor eax, eax
mov word [ebp - 0x414], bx
mov ecx, 0x81
lea edi, [ebp - 0x412]
rep stosd dword es:[edi], eax
push ebx
stosw word es:[edi], ax
push 0x25
lea eax, [ebp - 0x414]
push eax
push ebx
call sub.SHELL32.dll_SHGetSpecialFolderPathW
cmp eax, 1
jne 0x45d272
push 0x40c278
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push 0x40c26c
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x10
lea eax, [ebp - 0x20c]
push 0x405a00
push eax
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x45d2bb
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.004902b2
cmp eax, 1
jne 0x45d2bb
push 0x104
lea eax, [ebp - 0x20c]
push eax
add esi, 0x1d8c4
push esi
call dword [sym.imp.msvcrt.dll_wcsncpy]
xor ebx, ebx
add esp, 0xc
inc ebx
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.004a9585
leave
ret 4
Function at 0x45d2dd
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4dd52c]
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x95
push eax
xor esi, esi
call fcn.004a53d4
cmp eax, 1
jne 0x45d37a
lea eax, [ebp - 0x210]
push eax
push 1
push esi
push 0x405e98
push 0x80000002
mov dword [ebp - 0x210], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45d37a
push edi
mov word [ebp - 0x20c], si
mov ecx, 0x81
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push esi
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
pop edi
jne 0x45d36e
inc esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
call fcn.004a9585
leave
ret 4

Function at 0x45d9aa
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x4dd52c]
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], eax
xor esi, esi
xor eax, eax
mov word [ebp - 0x61c], si
mov ecx, 0x103
lea edi, [ebp - 0x61a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x20c], si
mov ecx, 0x81
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
push 0x208
stosw word es:[edi], ax
lea eax, [ebp - 0x20c]
push eax
push 0xb4
push ebx
mov dword [ebp - 0x624], esi
mov dword [ebp - 0x620], esi
mov dword [ebp - 0x628], esi
call fcn.004a5ad4
test eax, eax
jne 0x45da40
mov edi, 0x40c400
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
push eax
lea eax, [ebp - 0x20c]
push edi
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0x10
add ebx, 0x1a468
push ebx
push 0x40c3c4
lea eax, [ebp - 0x20c]
push eax
push 0x40c3b0
lea eax, [ebp - 0x61c]
push 0x40c39c
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x18
lea eax, [ebp - 0x624]
push eax
mov edi, 0xf003f
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x620]
push eax
push esi
push edi
push esi
push esi
lea eax, [ebp - 0x61c]
push esi
push eax
jne 0x45dac2
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push dword [ebp - 0x624]
mov edi, eax
call ebx
mov dword [ebp - 0x624], esi
jmp 0x45dacf
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp edi, esi
jne 0x45db0d
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push esi
push 0x40c388
push dword [ebp - 0x620]
call edi
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push esi
push 0x40c36c
push dword [ebp - 0x620]
call edi
push dword [ebp - 0x620]
call ebx
mov ecx, dword [ebp - 4]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
call fcn.004a9585
leave
ret 0xc
Function at 0x45e0ff
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
jle 0x45e127
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
sub ecx, eax
sub esi, eax
mov dl, byte [ecx + eax]
xor dl, byte [eax]
mov byte [esi + eax], dl
inc eax
dec edi
jne 0x45e11a
pop esi
pop edi
pop ebp
ret 0x10

Function at 0x45e61c
Capabilities:
Check if file exists
Create directory
Delete file
Get common file path
Get file attributes
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4dd52c]
push esi
mov esi, dword [ebp + 8]
xor edx, edx
cmp dword [esi + 0x1e594], edx
mov dword [ebp - 4], eax
jne 0x45e796
push ebx
push edi
xor eax, eax
mov word [ebp - 0x20c], dx
mov ecx, 0x81
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
push 0x405c38
stosw word es:[edi], ax
mov ebx, 0x405a00
push ebx
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 0x214], edx
mov dword [ebp - 0x210], edx
mov dword [ebp - 0x218], edx
call fcn.004805f0
test eax, eax
jne 0x45e794
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x218]
push eax
xor edi, edi
push edi
push edi
push 0x40c4c0
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45e788
cmp dword [ebp - 0x218], edi
je 0x45e788
lea edi, [esi + 0x1e59c]
push ebx
push edi
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
jne 0x45e766
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
push 0x8023
push 0
call sub.SHELL32.dll_SHGetFolderPathW
mov ebx, dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp - 0x20c]
push 0x40c4a0
push eax
call ebx
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x45e733
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
push 0
push 0x40c498
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x40c494
push edi
call dword [sym.imp.msvcrt.dll_wcstok]
push 0x40c488
push edi
call ebx
add esp, 0x10
push 0x407194
push edi
call dword [sym.imp.msvcrt.dll__wfopen]
test eax, eax
pop ecx
pop ecx
mov dword [esi + 0x1e590], eax
je 0x45e788
mov dword [esi + 0x1e594], 1
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
pop esi
call fcn.004a9585
leave
ret 4
Function at 0x45e8b3
Capabilities:
Get common file path
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x4dd52c]
push ebx
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
xor ebx, ebx
mov edx, 0x81
mov word [ebp - 0x61c], bx
mov ecx, edx
lea edi, [ebp - 0x61a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x414], bx
mov ecx, edx
lea edi, [ebp - 0x412]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov esi, dword [ebp + 8]
mov word [ebp - 0x20c], bx
mov ecx, edx
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x824], bx
mov ecx, edx
lea edi, [ebp - 0x822]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x61c]
push eax
push ebx
push ebx
push 0x23
push ebx
call sub.SHELL32.dll_SHGetFolderPathW
push 0x208
lea eax, [ebp - 0x20c]
push eax
push 0x4d
push esi
call fcn.004a5ad4
add esi, 0x19a24
push esi
mov esi, dword [sym.imp.msvcrt.dll_swprintf]
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push 0x40c578
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push 0x40c550
push eax
call esi
add esp, 0x1c
lea eax, [ebp - 0x414]
push eax
push ebx
lea eax, [ebp - 0x824]
push eax
push 0x40c540
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.004a9585
leave
ret 4
Function at 0x45e9dc
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
test byte [ebx + 5], 1
jne 0x45eac5
mov eax, dword [ebx]
push esi
push edi
push dword [ebx + 0x20]
xor esi, esi
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov dword [ebp + 0xc], eax
add eax, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
cmp edi, esi
mov dword [ebp - 8], edi
je 0x45ea35
push dword [ebp + 0xc]
push dword [ebx + 0x20]
push edi
call dword [sym.imp.msvcrt.dll_wcsncpy]
mov eax, dword [ebp - 4]
add esp, 0xc
mov word [edi + eax*2], si
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push edi
push esi
push 0xfde9
call ebx
cmp eax, esi
mov dword [ebp - 4], eax
jle 0x45eab8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, esi
mov dword [ebp + 0xc], eax
je 0x45eab8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
push esi
mov edx, ecx
push esi
push edx
push dword [ebp + 0xc]
shr ecx, 2
push 0xffffffffffffffff
push dword [ebp - 8]
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
push esi
and ecx, 3
push 0xfde9
rep stosb byte es:[edi], al
call ebx
mov edi, dword [ebp + 8]
push esi
lea ecx, [ebp - 0xc]
push ecx
add edi, 0x1e7f4
dec eax
push eax
push dword [ebp + 0xc]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edi, dword [ebp - 8]
cmp edi, esi
je 0x45eac3
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x46080c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfb
push dword [ebp + 8]
call fcn.0045af60
pop ebp
jmp fcn.0045d6da
Function at 0x46779a
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.004a98b0
mov eax, dword [0x4dd52c]
and word [ebp - 0x1004], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
xor eax, eax
mov ecx, 0x3ff
lea edi, [ebp - 0x1002]
rep stosd dword es:[edi], eax
xor ebx, ebx
inc ebx
cmp word [esi + 0xd8e], bx
stosw word es:[edi], ax
push esi
jne 0x4678c9
call fcn.0045db24
cmp eax, ebx
jne 0x46793d
mov eax, dword [esi + 0x16290]
and dword [eax + 0x10], 0xffffffbf
lea edi, [esi + 0x5230]
push edi
call fcn.004b6d07
push edi
call fcn.004b6e18
push 0x40e270
push esi
call fcn.0043e17f
push esi
call fcn.0043db13
cmp dword [esi + 0x1dfa8], ebx
jne 0x46793d
mov eax, dword [esi + 0x1dfac]
test eax, eax
je 0x46793d
cmp eax, 2
jb 0x46793d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x40e1e8
xor eax, eax
lea edi, [ebp - 0x1004]
mov ecx, 0x400
rep stosd dword es:[edi], eax
movzx eax, word [ebp - 0x1006]
push 0x40dee0
push eax
movzx eax, word [ebp - 0x1008]
push eax
movzx eax, word [ebp - 0x100a]
push eax
movzx eax, word [ebp - 0x100c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4065a0
lea eax, [ebp - 0x1004]
push 0x800
push eax
call fcn.00431bde
add esp, 0x2c
cmp word [esi + 0x1dfa0], bx
lea eax, [ebp - 0x1004]
push eax
jne 0x46791f
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x46793d
call fcn.0045db24
cmp eax, ebx
jne 0x46793d
push esi
call fcn.00493ae6
xor edi, edi
push edi
push edi
push edi
push edi
push edi
lea eax, [esi + 0x166f0]
push eax
call fcn.004bb3b2
cmp dword [esi + 0x1dfa8], ebx
jne 0x46793d
mov eax, dword [esi + 0x1dfac]
cmp eax, edi
je 0x46793d
cmp eax, 2
jb 0x46793d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x40e160
jmp 0x467856
add esi, 0x1dfa4
push 0x4060a8
push dword [esi]
call dword [sym.imp.msvcrt.dll_fwprintf]
push dword [esi]
call dword [sym.imp.msvcrt.dll_fflush]
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.004a9585
leave
ret 8
Function at 0x467951
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x2034
call fcn.004a98b0
mov eax, dword [0x4dd52c]
and word [ebp - 0x1024], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
mov ebx, 0x3ff
xor eax, eax
cmp word [esi + 0xd8e], 1
mov ecx, ebx
lea edi, [ebp - 0x1022]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
jne 0x467ae9
push 7
pop ecx
push dword [ebp + 0xc]
xor eax, eax
mov byte [ebp - 0x24], 0
lea edi, [ebp - 0x23]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x40e364
stosb byte es:[edi], al
lea eax, [ebp - 0x24]
push 0x40e35c
push eax
call fcn.004ac2d4
lea eax, [ebp - 0x24]
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4679c7
sub eax, edi
movzx eax, ax
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x5230]
push eax
call fcn.004b6d3a
cmp dword [esi + 0x1dfa8], 1
jne 0x467b60
mov eax, dword [esi + 0x1dfac]
test eax, eax
je 0x467b60
cmp eax, 3
jb 0x467b60
push dword [ebp + 0xc]
and word [ebp - 0x2024], 0
push 0x40e2f0
xor eax, eax
mov ecx, ebx
lea edi, [ebp - 0x2022]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ebx, 0x800
lea eax, [ebp - 0x2024]
push ebx
push eax
call fcn.00431bde
add esp, 0x10
cmp dword [esi + 0x1dfa8], 1
jne 0x467b60
mov eax, dword [esi + 0x1dfac]
test eax, eax
je 0x467b60
cmp eax, 3
jb 0x467b60
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x2034]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
mov ecx, 0x400
lea edi, [ebp - 0x1024]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2024]
push eax
movzx eax, word [ebp - 0x2026]
push 0x40dee0
push eax
movzx eax, word [ebp - 0x2028]
push eax
movzx eax, word [ebp - 0x202a]
push eax
movzx eax, word [ebp - 0x202c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4065a0
lea eax, [ebp - 0x1024]
push ebx
push eax
call fcn.00431bde
add esp, 0x2c
cmp word [esi + 0x1dfa0], 1
lea eax, [ebp - 0x1024]
push eax
jne 0x467b42
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x467b60
push esi
call fcn.00493ae6
mov eax, dword [ebp + 0xc]
push 0x218c
mov dword [esi + 0x16940], eax
lea eax, [esi + 0x16720]
push eax
xor edi, edi
push edi
push edi
push edi
push edi
lea eax, [esi + 0x166f0]
push eax
call fcn.004bb18a
cmp dword [esi + 0x1dfa8], 1
jne 0x467b60
mov eax, dword [esi + 0x1dfac]
cmp eax, edi
je 0x467b60
cmp eax, 3
jb 0x467b60
push dword [ebp + 0xc]
mov word [ebp - 0x2024], di
push 0x40e280
jmp 0x467a18
add esi, 0x1dfa4
push 0x4060a8
push dword [esi]
call dword [sym.imp.msvcrt.dll_fwprintf]
push dword [esi]
call dword [sym.imp.msvcrt.dll_fflush]
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.004a9585
leave
ret 8