joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41eaf6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
and edx, 0xfffffffe
mov esi, edi
lea ebx, [edi - 4]
add ebx, edx
cmp esi, ebx
ja 0x41eb68
movzx edx, byte [esi + 1]
movzx eax, byte [esi + 3]
xor edx, 8
and eax, edx
add esi, 2
cmp eax, 0xf8
jb 0x41eb05
movzx ecx, byte [esi - 2]
movzx eax, byte [esi + 1]
and eax, 7
shl edx, 8
add ecx, edx
lea ecx, [eax + ecx*8]
movzx eax, byte [esi]
add esi, 2
shl ecx, 8
add ecx, eax
mov eax, esi
sub eax, edi
shr eax, 1
sub ecx, eax
mov eax, ecx
mov byte [esi - 2], cl
shr eax, 0xb
mov byte [esi - 4], al
mov eax, ecx
shr eax, 0x13
and al, 7
shr ecx, 8
or al, 0xf0
or cl, 0xf8
mov byte [esi - 3], al
mov byte [esi - 1], cl
jmp 0x41eb05
sub esi, edi
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x41ec19
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, ecx
xor ebx, ebx
mov dword [ebp - 4], eax
mov esi, dword [esi]
and esi, 7
cmp edx, 5
jae 0x41ec3b
xor eax, eax
jmp UuidCreateSequential
add edx, 0xfffffffc
add edx, eax
mov dword [ebp - 8], edx
push edi
lea edi, [ebx + eax]
cmp edi, edx
jae 0x41ec5b
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x41ec58
inc edi
cmp edi, edx
jb 0x41ec4b
mov eax, dword [ebp - 4]
mov ecx, edi
sub ecx, ebx
mov ebx, edi
sub ecx, eax
sub ebx, eax
cmp edi, edx
jae 0x41ed27
cmp ecx, 2
jbe 0x41ece6
xor esi, esi
movzx edx, byte [edi + 4]
lea eax, [edx + 1]
test al, 0xfe
jne 0x41ed16
movzx eax, byte [edi + 3]
add ebx, 5
shl edx, 8
or edx, eax
movzx eax, byte [edi + 2]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 1]
shl edx, 8
or edx, eax
sub edx, ebx
test esi, esi
je 0x41ecc6
and esi, 6
mov eax, edx
shl esi, 2
mov ecx, esi
shr eax, cl
inc eax
test al, 0xfe
jne 0x41ecc4
mov eax, pe_nt_image_headers32
shl eax, cl
dec eax
xor edx, eax
sub edx, ebx
xor esi, esi
mov eax, edx
mov byte [edi + 1], dl
shr eax, 8
mov byte [edi + 2], al
mov eax, edx
shr edx, 0x18
shr eax, 0x10
and dl, 1
neg dl
mov byte [edi + 3], al
mov byte [edi + 4], dl
jmp 0x41ed1c
shr esi, cl
test esi, esi
je 0x41ec74
cmp esi, 4
ja 0x41ed0b
cmp esi, 3
je 0x41ed0b
mov eax, esi
shr eax, 1
movzx eax, byte [eax + edi + 1]
inc eax
test al, 0xfe
jne 0x41ec74
mov eax, dword [ebp - 4]
or esi, 8
shr esi, 1
inc ebx
jmp 0x41ec44
or esi, 8
shr esi, 1
inc ebx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
jmp 0x41ec44
push 2
shr esi, cl
pop eax
cmp eax, ecx
mov eax, dword [ebp + 0xc]
pop edi
sbb ecx, ecx
not ecx
and ecx, esi
mov dword [eax], ecx
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x40dcb6
Capabilities:
Encode data using xor

Disassembly:
xchg edi, eax
dec ebp
fild word [eax + 0x2a]
pushfd
pop eax
rcl byte [edx - 0x4bbd3a31], cl
push 0x50

Function at 0x424b46
Capabilities:
Encode data using xor

Disassembly:
clc
cwde
add bl, byte [edi]
stosd dword es:[edi], eax
sbb eax, 0x20bb13cd
sub ecx, dword [edx + 0x1b]
xor byte [edi], ch
mov dword [0xb79629d9], eax
aad 3
add byte [edi + 0x48], ch
push esp
aas
aam 0xdd
dec eax
loop 0x424b0e
fisttp qword [eax - 0x1e]
loopne 0x424b12
jecxz 0x424b33
add eax, ecx
mov edi, 0x20ee9974
pop ebx
sar dword [edi + 0x20ee9974], 0x5b
cdq
out dx, al
and byte [ebx - 0x24], bl
dec eax
jg 0x424b55
fmul qword [eax + 0x7f]
sbb cl, byte [ebp + 0x57]
dec ebp
push edi
adc byte fs:[edx + 0x70], bl
sbb dword [edx - 0x1dec8ad5], edx
loop 0x424b2a
push eax
loop 0x424b2a
push eax
invalid
in al, dx
iretd

Function at 0x43c900
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0xff3eb4ce
std
test byte [eax], bh
adc dl, byte [ebp + ebx + 0x5c]
inc esp
adc eax, 0x2d87744f
or byte [eax], 0xdc
std
imul ebx, dword [edi - 0x553f1bd2], 0x54
cld
iretd
cmpsb byte [esi], byte es:[edi]
inc edi
fnstsw word [ebx - 0x515af76c]
mov esi, 0x2701f613
pop es
in eax, dx
adc eax, 0x25caa0ea
in eax, 0x71
mov ebx, 0xc1247a1d
salc
inc ebp
jge 0x43c8c8
add byte [edx - 0x2d3d73be], cl
push cs
mov dh, 0x68
invalid
Function at 0x451b86
Capabilities:
Encode data using xor

Disassembly:
inc ebx
or eax, 0xbf263ac1
enter 0xffffffffffffa7b1, 0xffffffffffffffe6
adc eax, 0xb3bdcf06
mov al, byte [0x87fe65a8]
lahf
call 0x98beb5ba
xchg ebx, eax
inc eax
js 0x451bc0
aad 0xd4
push ebx
leave
jae 0x451ad1
or ch, 0x5f
rcl byte [edi], cl
sahf
pop ebx
out dx, eax
push edi
mov dh, 0x61
mov ss, word [eax - 0x72]
jnp 0x451bd8
cmp byte [eax + ebx*2], dl
xor byte [eax], dl
das
mov al, 0x3d
mov word [esi - 0xf58cf82], es
leave
mov dl, 0xe0
and eax, 0xb0416438
jae 0x451b63
invalid
bound esi, qword [edx - 0x5f]
sbb al, 0x6f
mov bl, 0x57
mov byte [0x818af080], al
mov edi, 0x73672c03
pop ebx
mov al, byte [ecx + 0x672c03bf]
jae 0x451be0
in al, 0xbe
mov byte [0xe7c135fc], al
mov ecx, 0x79ed803f
mov esi, 0xc135fca2
out 0xb9, eax
aas
xor eax, 0x3fb9e7c1
sub ch, 0x79
xor eax, 0xeec18c53
je 0x451b7d
loope 0x451b30
arpl word [esi], di
aad 0xe2
mov dh, 0x3d
ja 0x451bd7
inc ecx
jns 0x451b89
mov edi, 0xb0b0b3b0
in al, 0x35
add byte [eax + 0x53474a8], ah
mov al, byte [0x53474a8]
pushal
int1
daa
xor esi, 0x6d
mov bl, byte [edx + 0x5374e18a]
mov ah, 0xb5
mov cl, 0x36
mov ch, 0xb1
jp 0x451b68
jp 0x451b68
xchg ecx, eax
stosd dword es:[edi], eax
xchg ecx, eax
out 0xe3, al
pushal
pop ebp
mov byte [0xcf9b91b0], al
push esp
add edi, dword [eax - 0x36]
and eax, 0x30f99a0f
mov ch, 0xb0
xchg ecx, eax
sbb dl, byte [esi + 0x44]
setp cl
xor byte [ebp + 0x561a91b0], dh
lcall 0x1a91, 0xb0b530f9
push esi
inc esp
je 0x451c06
shr byte gs:[esi], 1
clc
cmpsb byte [esi], byte es:[edi]
xlatb
hlt
in al, dx
arpl dx, sp
pop esp
mov eax, dword [0xf1e04de6]
test byte [ebp + 0x5174c95e], bh
push ss
and byte [esi - 0x1da01951], 0xb7
cmpsb byte [esi], byte es:[edi]
scasd eax, dword es:[edi]
out 0x5f, al
loop 0x451bc3
je 0x451bae
imul byte [0x85469330]
xor byte [eax + 0x55], dh
test al, 0xed
pop edi
fsub qword gs:[eax + 0x63bfb045]
mov eax, dword [0x7f51dfde]
ficomp dword [eax - 0x32]
cmc
and al, 0x92
xchg edi, eax
mov dword [0x39cf84e5], eax
xor ch, byte [edx]
in eax, 0xad
xor ebp, 0x542859a0
loopne 0x451bf5
sal dword [ebp - 0x24], 1
sbb dword [0xa44d7078], esp
inc esi
cld
invalid
Function at 0x4688b6
Capabilities:
Encode data using xor

Disassembly:
push ecx
aad 0xb2
adc eax, 0xd3b41393
push ebp
sal byte [esi], cl
xchg ecx, eax
push ss
nop
aaa
out dx, eax
pop eax
fistp qword [eax - 0x45e265e2]
fcomp qword [ebx - 0x25]
cmp al, 0x9b
sbb eax, 0x5fd93e9a
xlatb
mov cl, 0x16
xchg edx, eax
adc eax, 0xd057d1b4
or byte [esi - 0x25c364e6], bl
pop esi
fdiv dword [eax - 0x4ceb6ee9]
rcl byte [esi - 0x30], cl
push esi
sal byte [edi], 1
push esi
sal byte [edi], 1
scasd eax, dword es:[edi]
sub byte [edi - 0x22a522c8], bl
mov esi, 0xb1189e19
aam 0x55
sal byte [esi], cl
scasd eax, dword es:[edi]
sbb byte [ebp - 0x28a027c5], bl
mov cl, 0x16
xchg ecx, eax
adc eax, 0xd453d5b2
xor al, 0x92
adc eax, 0xc9d03691
jl 0x46887e
lea edi, [esi + ecx*4 + 0x48794f9f]
sbb dword [ecx], ecx
cmp byte [edx], cl
sbb ecx, dword [ebx + 0x7a]
dec ebx
lcall 0x7242, 0x9187b784
jl 0x468916
push cs
aas
nop dword [eax + 0x79]
dec eax
cwde
mov dword [edx + 0x74449a8b], edi
inc esi
push ss
pop es
pop es
adc dword [eax + 0x71], eax
inc eax
xchg ecx, eax
xor byte [eax + 0x7c7c9381], 0x48
jl 0x468960
sbb dword [edx], ecx
xor eax, 0x7c4cbd07
dec edx
lcall 0x7b48, 0x9f1cb784
dec edx
sbb al, byte [0x7d120237]
jge 0x46897d
pushfd
invalid
lcall 0x7445, 0x9584ba8b
inc ebp
pop ss
push es
pop es
adc dword [ecx + 0x70], eax
inc ecx
xchg ebx, eax
insb byte es:[edi], dx
mov ebp, 0x7e4f9f8e
dec edi
push ds
or byte [ecx], bh
or dword [eax], ebx
dec ecx
jnp 0x4689ca
wait
mov edi, dword [edx + 0x74449584]
je 0x4689cd
adc al, 6
aaa
push es
push ss
inc edi
jno 0x4689d2
xchg ebx, eax
xor byte [edx + 0x7c4c9d5c], 0x4d
pop ds
push cs
or dword ds:[eax], ebx
dec edx
jp 0x4689e5
nop
dec esp
mov ch, 0x85
xchg esp, eax
inc esi
jbe 0x4689ef
adc dword [edx], eax
xor eax, dword [ebx]
sub al, 0x4f
jle 0x4689ff
cdq
mov byte [ecx + 0x78499889], bh
dec ecx
sbb byte [ecx], cl
cmp byte [ecx], cl
sbb ecx, dword [edx + 0x7b]
dec edx
lcall 0x7647, 0x9685ba8b
inc ecx
adc byte [edx], al
xor eax, dword [ebx]
adc ch, byte [ebp + edi*2 + 0x4c]
popfd
lea edi, [edi + 0x794f9e8e]
mov edi, 0x794f9e8e
dec ecx
inc ebx
jb 0x468a2b
stc
cmp dword [ebx - 0x1a], ebx
je 0x4689fa
push esp
xlatb
mov ch, 0x34
salc
jb 0x4689dd
jl 0x468a0b
pop esp
mov esi, 0x44d8593c
not byte [esi - 0x2c]
mov dh, 0x35
xlatb
push ebx
bnd jo 0x468a10
push ecx
mov esp, 0x78da5f3f
cli

Function at 0x4826f6
Capabilities:
Encode data using xor

Disassembly:
dec esi
lahf
mov edx, 0x7eda96b8
sar byte [ecx], 0x85
mov esp, 0x995f2dbc
pop edi
cdq
movsb byte es:[edi], byte [esi]
pop esi
scasb al, byte es:[edi]
mov ebx, 0x44315bfe
call [ecx - 0x31]
mov dh, 0x4d
test dword [eax + 0x5f], ebp
std
clc
aam 0xc0
push ss
xor ebx, dword [edi + 0x1a32b5ed]
mov ebx, dword [edi]
add ch, bl
dec esp
cwde
loop 0x482703
add esp, edi
xor edi, 0xd22f7551
mov eax, 0x4c76e275
adc byte [ecx], al
pop eax
invalid
Function at 0x627cf1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6303c0
cmp edx, dword [eax]
je 0x627d13
add eax, 8
inc ecx
cmp eax, 0x630450
jl 0x627d04
push esi
Function at 0x4269c9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x426a08
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x426a08
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x426a08
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x426a08
cmp dword [ecx + 0x74], 0xe
jbe 0x426a08
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x438db0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x438ddd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x438ddd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x43b665
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x43b3c1
sub edi, 0x77c1f2ee
call fcn.0043b69e
and edi, edi
or edi, edi
xor dword [ecx], eax
mov edx, 0x76793b7c
sub edx, 0xd4a8b6f4
inc ecx
sub edx, edx
cmp ecx, ebx
jne fcn.0043b665
sub edi, edx
add edi, 0xa3ff5a39
ret
Function at 0x4119a4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x44], eax
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edx, dword [ebp - 8]
mov dword [edx + 0x48], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov dword [eax + 0x4c], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [edx + 0x50], eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp - 8]
add edx, 0x44
push edx
push 0x411a87
push 0x800
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x40], eax
push 0xf
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov esp, ebp
pop ebp
ret 4
Function at 0x412388
Capabilities:
Create directory
Enumerate files on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f46a4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x260
mov dword [ebp - 0x26c], ecx
lea ecx, [ebp - 0x14]
call fcn.004048c0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004048c0
mov byte [ebp - 4], 1
push 0x725
mov ecx, dword [ebp - 0x26c]
call fcn.004dc934
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
call fcn.004057c0
push 0x104
push 0
lea eax, [ebp - 0x268]
push eax
call fcn.004b9030
add esp, 0xc
mov ecx, dword [ebp - 0x26c]
add ecx, 0x5c
push ecx
lea edx, [ebp - 0x268]
push edx
call fcn.004b9290
add esp, 8
push 0x519394
lea eax, [ebp - 0x268]
push eax
call fcn.004b92a0
add esp, 8
lea ecx, [ebp - 0x268]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x4124b4
push 0
lea edx, [ebp - 0x268]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x412494
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xb7
je 0x412494
lea eax, [ebp - 0x268]
push eax
push 0x519398
lea ecx, [ebp - 0x10]
push ecx
call fcn.004d3292
add esp, 0xc
push 0
push 0x5193dc
lea ecx, [ebp - 0x10]
call fcn.004048e0
push eax
mov ecx, dword [ebp - 0x26c]
call fcn.004db06e
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004dd6c1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004dd6c1
jmp 0x4125dd
push 0x140
push 0
lea edx, [ebp - 0x158]
push edx
call fcn.004b9030
add esp, 0xc
lea eax, [ebp - 0x158]
push eax
push 0x5193e4
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0xffffffff
jne 0x41250b
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004dd6c1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004dd6c1
jmp 0x4125dd
cmp dword [ebp - 0x15c], 0xffffffff
je 0x412579
lea ecx, [ebp - 0x14]
call fcn.004dd64c
lea ecx, [ebp - 0x12c]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004dd84a
push 0x2e
lea ecx, [ebp - 0x14]
call fcn.004d2f2f
mov dword [ebp - 0x164], eax
push 0
mov edx, dword [ebp - 0x164]
push edx
lea ecx, [ebp - 0x14]
call fcn.004d2a02
lea ecx, [ebp - 0x14]
call fcn.004048e0
push eax
mov ecx, dword [ebp - 0x18]
call fcn.00405790
lea eax, [ebp - 0x158]
push eax
mov ecx, dword [ebp - 0x15c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x412577
jmp 0x412579
jmp 0x41250b
mov edx, dword [ebp - 0x15c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x104
push 0
mov eax, dword [ebp - 0x26c]
add eax, 0x46c
push eax
call fcn.004b9030
add esp, 0xc
mov ecx, dword [ebp - 0x26c]
add ecx, 0x46c
push ecx
push 0
mov ecx, dword [ebp - 0x18]
call fcn.00414970
push 0
mov ecx, dword [ebp - 0x18]
call fcn.00405760
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004dd6c1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004dd6c1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4127b2
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], 0
jmp 0x4127cd
mov eax, dword [ebp - 0x40]
add eax, 1
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 7
jge 0x41281f
push 0x3c
push 0
lea ecx, [ebp - 0x3c]
push ecx
call fcn.004b9030
add esp, 0xc
mov edx, dword [ebp - 0x40]
add edx, 1
push edx
push 0x5193fc
lea eax, [ebp - 0x3c]
push eax
call fcn.004b953d
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 0
lea edx, [ebp - 0x3c]
push edx
push 0x519404
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x44]
mov dword [edx + ecx*4 + 0x570], eax
jmp 0x4127c4
push 0x58
push 0
mov eax, dword [ebp - 0x44]
add eax, 0x58c
push eax
call fcn.004b9030
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 0x29
mov edx, dword [ebp - 0x44]
add edx, 0x58c
push edx
push 0
push 0x51940c
push 0x519418
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [ebp + 8]
push eax
push 0x15
mov ecx, dword [ebp - 0x44]
add ecx, 0x5b5
push ecx
push 0
push 0x519424
push 0x519428
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edx, dword [ebp + 8]
push edx
push 9
mov eax, dword [ebp - 0x44]
add eax, 0x5ca
push eax
push 0
push 0x519434
push 0x519440
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0x51944c
push 0x519458
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edx, dword [ebp - 0x44]
mov dword [edx + 0x5d8], eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0x519464
push 0x519470
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 0x44]
mov dword [ecx + 0x5dc], eax
mov edx, dword [ebp + 8]
push edx
push 0
push 0x51947c
push 0x51948c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 0x44]
mov byte [ecx + 0x5d3], al
mov edx, dword [ebp + 8]
push edx
push 0
push 0x519498
push 0x5194a4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 0x44]
mov dword [ecx + 0x5d4], eax
mov edx, dword [ebp + 8]
push edx
push 0
push 0x5194b0
push 0x5194b4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 0x44]
mov dword [ecx + 0x5e0], eax
mov esp, ebp
pop ebp
ret 4
Function at 0x41aaa4
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov dword [ebp - 0x210], ecx
push 0x208
push 0
lea eax, [ebp - 0x208]
push eax
call fcn.004b9030
add esp, 0xc
mov ecx, dword [ebp - 0x210]
add ecx, 0x2dd
push ecx
lea edx, [ebp - 0x208]
push edx
call fcn.004b9290
add esp, 8
push 0x51a244
lea eax, [ebp - 0x208]
push eax
call fcn.004b92a0
add esp, 8
mov ecx, dword [ebp - 0x210]
add ecx, 0xf34
push ecx
lea edx, [ebp - 0x208]
push edx
call fcn.004b92a0
add esp, 8
push 0x51a250
lea eax, [ebp - 0x208]
push eax
call fcn.004b92a0
add esp, 8
mov ecx, dword [ebp - 0x210]
add ecx, 0xd2c
push ecx
lea edx, [ebp - 0x208]
push edx
call fcn.004b9e90
add esp, 8
test eax, eax
jne 0x41ab50
mov eax, 1
jmp 0x41abb4
push 0
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp - 0x210]
add ecx, 0xd2c
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x41abaf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20c], eax
mov edx, 1
test edx, edx
je 0x41ab91
mov dword [ebp - 0x214], 0
jmp 0x41abab
mov eax, dword [ebp - 0x20c]
push eax
push str._CopyLoadConfigAsFileToDefaultDir_:_errorcode___d_n
call fcn.00411ec0
add esp, 8
mov dword [ebp - 0x214], eax
xor eax, eax
jmp 0x41abb4
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x41cd5d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0x8f5
push eax
push 0
push 0x51abf0
push 0x51abf8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx], al
mov edx, dword [ebp - 4]
add edx, 0x8f5
push edx
push 0
push 0x51ac04
push 0x51ac10
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx + 1], al
mov edx, dword [ebp - 4]
add edx, 0x8f5
push edx
push 0
push 0x51ac1c
push 0x51ac24
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx + 2], al
mov edx, dword [ebp - 4]
add edx, 0x8f5
push edx
push 0
push 0x51ac30
push 0x51ac38
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx + 3], al
mov esp, ebp
pop ebp
ret 4

Function at 0x41cdf0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0x8f5
push eax
push 0
push 0x51ac44
push 0x51ac50
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx], al
mov edx, dword [ebp - 4]
add edx, 0x8f5
push edx
push 1
push 0x51ac5c
push 0x51ac68
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx + 1], al
mov edx, dword [ebp - 4]
add edx, 0x8f5
push edx
push 0
push 0x51ac74
push 0x51ac80
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx + 2], al
mov edx, dword [ebp - 4]
add edx, 0x8f5
push edx
push 1
push 0x51ac8c
push 0x51ac98
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx + 3], al
mov edx, dword [ebp - 4]
add edx, 0x8f5
push edx
push 0
push 0x51aca4
push 0x51acb4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx + 4], al
mov edx, dword [ebp - 4]
add edx, 0x8f5
push edx
push 0
push 0x51acc0
push 0x51accc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx + 5], al
mov edx, dword [ebp - 4]
add edx, 0x8f5
push edx
push 0
push 0x51acd8
push 0x51ace8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx + 6], al
mov edx, dword [ebp - 4]
add edx, 0x8f5
push edx
push 0
push 0x51acf4
push 0x51ad00
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx + 7], al
mov edx, dword [ebp - 4]
add edx, 0x8f5
push edx
push 0
push 0x51ad0c
push 0x51ad18
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx + 8], al
mov edx, dword [ebp - 4]
add edx, 0x8f5
push edx
push 0x28
push 0x51ad24
push 0x51ad30
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx + 9], al
mov esp, ebp
pop ebp
ret 4
Function at 0x41d463
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
add eax, 0x8f5
push eax
push 4
push 0x51af48
push 0x51af58
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ebp - 0x38], 0
jmp 0x41d49e
mov edx, dword [ebp - 0x38]
add edx, 1
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], 8
jge 0x41d4f5
push 0x32
push 0
lea eax, [ebp - 0x34]
push eax
call fcn.004b9030
add esp, 0xc
mov ecx, dword [ebp - 0x38]
add ecx, 1
push ecx
push 0x51af64
lea edx, [ebp - 0x34]
push edx
call fcn.004b953d
add esp, 0xc
mov eax, dword [ebp - 0x3c]
add eax, 0x8f5
push eax
push 0x100
lea ecx, [ebp - 0x34]
push ecx
push 0x51af68
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp + 8]
mov dword [ecx + edx*4 + 4], eax
jmp 0x41d495
mov esp, ebp
pop ebp
ret 4

Function at 0x41d4fb
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
add eax, 0x8f5
push eax
push 4
push 0x51af74
push 0x51af84
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ebp - 0x38], 0
jmp 0x41d536
mov edx, dword [ebp - 0x38]
add edx, 1
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], 4
jge 0x41d58d
push 0x32
push 0
lea eax, [ebp - 0x34]
push eax
call fcn.004b9030
add esp, 0xc
mov ecx, dword [ebp - 0x38]
add ecx, 1
push ecx
push 0x51af90
lea edx, [ebp - 0x34]
push edx
call fcn.004b953d
add esp, 0xc
mov eax, dword [ebp - 0x3c]
add eax, 0x8f5
push eax
push 0xff
lea ecx, [ebp - 0x34]
push ecx
push 0x51af94
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp + 8]
mov dword [ecx + edx*4 + 4], eax
jmp 0x41d52d
mov edx, dword [ebp - 0x3c]
add edx, 0x8f5
push edx
push 4
push 0x51afa0
push 0x51afb0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], eax
mov dword [ebp - 0x38], 0
jmp 0x41d5c1
mov edx, dword [ebp - 0x38]
add edx, 1
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], 4
jge 0x41d618
push 0x32
push 0
lea eax, [ebp - 0x34]
push eax
call fcn.004b9030
add esp, 0xc
mov ecx, dword [ebp - 0x38]
add ecx, 1
push ecx
push 0x51afbc
lea edx, [ebp - 0x34]
push edx
call fcn.004b953d
add esp, 0xc
mov eax, dword [ebp - 0x3c]
add eax, 0x8f5
push eax
push 0xff
lea ecx, [ebp - 0x34]
push ecx
push 0x51afc0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp + 8]
mov dword [ecx + edx*4 + 0x18], eax
jmp 0x41d5b8
mov esp, ebp
pop ebp
ret 4