joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408cba
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push edi
mov dword [ebp - 0xc], ecx
and dword [ebp - 4], 0
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x30]
rep stosd dword es:[edi], eax
push 0x52e984
push 0x52e9e4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x408cfb
lea eax, [ebp - 0x30]
push eax
call dword [ebp - 8]
jmp 0x408d05
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x30]
cmp eax, 9
je 0x408d17
movzx eax, word [ebp - 0x30]
cmp eax, 6
jne 0x408d1e
mov dword [ebp - 4], 1
movzx eax, word [ebp - 0x30]
push eax
push str._CLauncher::CheckAMD64_Architecture_ID:_d
call fcn.0046c4d6
pop ecx
pop ecx
push dword [ebp - 4]
push str._CLauncher::CheckAMD64_Amd64_:_d
call fcn.0046c4d6
pop ecx
pop ecx
mov eax, dword [ebp - 4]
pop edi
leave
ret

Function at 0x408d44
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], ecx
and dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0x114
push 0x110
push 0
lea eax, [ebp - 0x114]
push eax
call fcn.004b0090
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x408dad
cmp dword [ebp - 0x114], 5
jne 0x408dad
mov dword [ebp - 0x11c], 1
push dword [ebp - 0x11c]
push str._CLauncher::CheckWinXP_WinXP_:_d
call fcn.0046c4d6
pop ecx
pop ecx
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret

Function at 0x408e22
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x54], ecx
and dword [ebp - 0x50], 0
push 0x40
push 0
lea eax, [ebp - 0x44]
push eax
call fcn.004b0090
add esp, 0xc
mov dword [ebp - 0x44], 0x40
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x408ec2
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
push 0
push 0x100000
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
call fcn.004ad9b0
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push str._WOW64_Memory_size:__llu
call fcn.0046c4d6
add esp, 0xc
mov edx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
call fcn.004addb0
comisd xmm0, xmmword [0x52ef88]
jb 0x408eb1
mov dword [ebp - 0x50], 1
push dword [ebp - 0x50]
push str._WOW64_Check_4G_memory_result:__d
call fcn.0046c4d6
pop ecx
pop ecx
jmp 0x408ed5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._WOW64_Get_memory_status_fail:__d.
call fcn.0046c5d3
pop ecx
pop ecx
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret
Function at 0x409848
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa18
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xa10], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004b0090
add esp, 0xc
push 0x800
push 0
lea eax, [ebp - 0xa0c]
push eax
call fcn.004b0090
add esp, 0xc
push dword [ebp + 8]
push 0x400
lea eax, [ebp - 0xa0c]
push eax
push 0
push 0x52eef8
push 0x52ef00
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x104
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa0c]
push eax
mov ecx, dword [ebp - 0xa10]
call fcn.0040a3f7
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0xa10]
call fcn.00409aab
test eax, eax
jne 0x409956
and dword [ebp - 0xa18], 0
cmp dword [ebp + 0xc], 0
je 0x409954
cmp dword [ebp + 0x10], 0
jle 0x409954
lea eax, [ebp - 0x20c]
test eax, eax
je 0x409954
and dword [ebp - 0xa14], 0
lea eax, [ebp - 0x20c]
test eax, eax
je 0x40992c
lea eax, [ebp - 0x20c]
push eax
call fcn.004cc4f3
pop ecx
cmp eax, dword [ebp + 0x10]
jae 0x40992c
mov dword [ebp - 0xa14], 1
cmp dword [ebp - 0xa14], 0
je 0x409954
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004cc3b7
add esp, 0xc
mov dword [ebp - 0xa18], 1
jmp 0x409971
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0xa10]
call fcn.0040a233
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 0xc

Function at 0x40997f
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], ecx
and dword [ebp - 0x210], 0
cmp dword [ebp + 8], 0
je 0x409a4f
push dword [ebp + 8]
call fcn.004cc4f3
pop ecx
test eax, eax
jbe 0x409a4f
mov dword [ebp - 0x210], 1
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004b0090
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0x218]
call fcn.00409dd2
cmp dword [ebp + 0xc], 0
jne 0x409a13
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0x10
je 0x409a13
and dword [ebp - 0x210], 0
cmp dword [ebp - 0x210], 0
je 0x409a3c
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004cc50e
pop ecx
pop ecx
test eax, eax
jne 0x409a3c
mov dword [ebp - 0x214], 1
jmp 0x409a43
and dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x210]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 8
Function at 0x40a005
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x800
push 0
lea eax, [ebp - 0x804]
push eax
call fcn.004b0090
add esp, 0xc
and dword [ebp - 0x808], 0
lea eax, [ebp + 0x10]
mov dword [ebp - 0x808], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x810], eax
push dword [ebp - 0x808]
push 0
push dword [ebp - 0x810]
push 0x3ff
push 0x400
lea eax, [ebp - 0x804]
push eax
call fcn.00407770
push dword [eax + 4]
push dword [eax]
call fcn.004cc171
add esp, 0x20
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
jge 0x40a090
or dword [ebp - 0x814], 0xffffffff
jmp 0x40a09c
mov eax, dword [ebp - 0x80c]
mov dword [ebp - 0x814], eax
and dword [ebp - 0x808], 0
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret

Function at 0x40a0bc
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004b0090
add esp, 0xc
push dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x52ef08
push str.Redirect
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x218], 1
cmp dword [ebp - 0x210], 0
je 0x40a16d
mov eax, dword [ebp - 0x210]
movzx eax, word [eax]
test eax, eax
je 0x40a16d
mov eax, dword [ebp - 0x210]
movzx eax, word [eax]
cmp eax, 0x20
je 0x40a15d
mov eax, dword [ebp - 0x210]
movzx eax, word [eax]
cmp eax, 9
je 0x40a15d
and dword [ebp - 0x218], 0
jmp 0x40a16d
mov eax, dword [ebp - 0x210]
inc eax
inc eax
mov dword [ebp - 0x210], eax
jmp 0x40a12b
cmp dword [ebp - 0x218], 0
jne 0x40a1c3
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x214]
call fcn.00409aab
test eax, eax
je 0x40a1a9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0x214]
call fcn.004092d4
jmp 0x40a1c1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x214]
call fcn.0040a0bc
jmp 0x40a225
and dword [ebp - 0x220], 0
cmp dword [ebp + 0xc], 0
je 0x40a225
cmp dword [ebp + 0x10], 0
jle 0x40a225
cmp dword [ebp + 8], 0
je 0x40a225
and dword [ebp - 0x21c], 0
cmp dword [ebp + 8], 0
je 0x40a201
push dword [ebp + 8]
call fcn.004cc4f3
pop ecx
cmp eax, dword [ebp + 0x10]
jae 0x40a201
mov dword [ebp - 0x21c], 1
cmp dword [ebp - 0x21c], 0
je 0x40a225
push dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004cc3b7
add esp, 0xc
mov dword [ebp - 0x220], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 0xc
Function at 0x40a233
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc34
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0xc2c], ecx
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x800
push 0
lea eax, [ebp - 0xc28]
push eax
call fcn.004b0090
add esp, 0xc
push dword [ebp + 8]
push 0x400
lea eax, [ebp - 0xc28]
push eax
push 0x52ef28
push 0x52ef2c
push 0x52ef00
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xa
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc28]
push eax
mov ecx, dword [ebp - 0xc2c]
call fcn.0040a3f7
push 2
pop eax
imul eax, eax, 0
movzx eax, word [ebp + eax - 0x18]
cmp eax, 0x31
jne 0x40a2d5
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov ecx, dword [ebp - 0xc2c]
call fcn.004092d4
jmp 0x40a3e8
push 0x208
push 0
lea eax, [ebp - 0x428]
push eax
call fcn.004b0090
add esp, 0xc
push dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x428]
push eax
push 0
push 0x52ef58
push str.DefaultValue
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x208
push 0
lea eax, [ebp - 0x220]
push eax
call fcn.004b0090
add esp, 0xc
push 0x104
lea eax, [ebp - 0x220]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x428]
push eax
mov ecx, dword [ebp - 0xc2c]
call fcn.0040942d
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp - 0xc2c]
call fcn.00409aab
test eax, eax
je 0x40a376
push dword [ebp + 0x14]
push dword [ebp + 0x10]
lea eax, [ebp - 0x220]
push eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0xc2c]
call fcn.004092d4
jmp 0x40a3e8
and dword [ebp - 0xc34], 0
cmp dword [ebp + 0x10], 0
je 0x40a3e8
cmp dword [ebp + 0x14], 0
jle 0x40a3e8
lea eax, [ebp - 0x220]
test eax, eax
je 0x40a3e8
and dword [ebp - 0xc30], 0
lea eax, [ebp - 0x220]
test eax, eax
je 0x40a3c0
lea eax, [ebp - 0x220]
push eax
call fcn.004cc4f3
pop ecx
cmp eax, dword [ebp + 0x14]
jae 0x40a3c0
mov dword [ebp - 0xc30], 1
cmp dword [ebp - 0xc30], 0
je 0x40a3e8
lea eax, [ebp - 0x220]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004cc3b7
add esp, 0xc
mov dword [ebp - 0xc34], 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 0x10
Function at 0x40a8aa
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x517816
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x7c], ecx
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0x90]
call fcn.0040b1a2
and dword [ebp - 4], 0
and dword [ebp - 0x74], 0
and dword [ebp - 0x80], 0
cmp dword [ebp + 8], 0
je 0x40a91f
push 2
pop eax
imul eax, eax, 0
mov ecx, dword [ebp + 8]
movzx eax, word [ecx + eax]
test eax, eax
je 0x40a91f
lea eax, [ebp - 0x80]
push eax
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
je 0x40aa72
and dword [ebp - 0x78], 0
jmp 0x40a936
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x80]
jge 0x40aa65
lea ecx, [ebp - 0x8c]
call fcn.0040b1d0
mov byte [ebp - 4], 1
push 0x52ef90
lea ecx, [ebp - 0x40]
call fcn.00409053
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x74]
push dword [ecx + eax*4]
lea ecx, [ebp - 0x28]
call fcn.00409053
mov byte [ebp - 4], 3
push 1
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x8c]
push eax
call fcn.0044b402
add esp, 0x10
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28]
call fcn.0040a62b
mov byte [ebp - 4], 5
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
mov dword [ebp - 0x94], eax
mov byte [ebp - 4], 6
mov byte [ebp - 4], 7
mov byte [ebp - 4], 2
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x40]
call fcn.0040a62b
mov byte [ebp - 4], 9
mov byte [ebp - 4], 1
lea eax, [ebp - 0x40]
mov dword [ebp - 0x98], eax
mov byte [ebp - 4], 0xa
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x8c]
call fcn.0040ba45
movzx eax, al
test eax, eax
jne 0x40aa51
lea ecx, [ebp - 0x70]
call fcn.0040b3d6
mov byte [ebp - 4], 0xc
xor eax, eax
imul eax, eax, 0x18
add eax, dword [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x70]
call fcn.0040b598
lea ecx, [ebp - 0x8c]
call fcn.0040ba6c
cmp eax, 1
jbe 0x40aa39
xor eax, eax
inc eax
imul eax, eax, 0x18
add eax, dword [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x58]
call fcn.0040b598
lea eax, [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0x7c]
call fcn.0040b151
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x70]
call fcn.0040b4ed
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x8c]
call fcn.0040b902
jmp 0x40a92f
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [ebp - 0x74], 0
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ad99f
leave
ret 4
Function at 0x40ada2
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x517947
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x5770a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
call fcn.0040b1fe
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
add eax, 0x18
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x18
call fcn.0040b1fe
mov byte [ebp - 4], 1
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
add eax, 0x30
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret 4
Function at 0x40bf59
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x517cc3
mov eax, dword fs:[0]
push eax
mov eax, 0x20ac
call fcn.004ade10
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x204c], ecx
mov byte [ebp - 0x2041], 0
push 0x2000
push 0
lea eax, [ebp - 0x2010]
push eax
call fcn.004b0090
add esp, 0xc
push str.startDNFchina.exe
lea ecx, [ebp - 0x2028]
call fcn.00409053
and dword [ebp - 4], 0
push 0x5c
lea eax, [ebp - 0x2028]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x2040]
push eax
call fcn.00481988
add esp, 0x10
mov dword [ebp - 0x2054], eax
mov eax, dword [ebp - 0x2054]
mov dword [ebp - 0x2058], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x2058]
call fcn.0040a5f1
push eax
push 0x52f1f4
push 0x1000
lea eax, [ebp - 0x2010]
push eax
call fcn.004077b0
add esp, 0x10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2040]
call fcn.0040a62b
mov byte [ebp - 4], 3
mov byte [ebp - 4], 0
lea eax, [ebp - 0x2040]
mov dword [ebp - 0x2060], eax
mov byte [ebp - 4], 4
mov byte [ebp - 4], 5
mov byte [ebp - 4], 0
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x2028]
call fcn.0040a62b
mov dword [ebp - 4], 7
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x2028]
mov dword [ebp - 0x2064], eax
mov dword [ebp - 4], 8
mov dword [ebp - 4], 9
or dword [ebp - 4], 0xffffffff
push 0x44
push 0
lea eax, [ebp - 0x20b8]
push eax
call fcn.004b0090
add esp, 0xc
mov dword [ebp - 0x20b8], 0x44
xor eax, eax
lea edi, [ebp - 0x2074]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov ecx, dword [ebp + 8]
call fcn.0040a5f1
mov dword [ebp - 0x205c], eax
lea eax, [ebp - 0x2074]
push eax
lea eax, [ebp - 0x20b8]
push eax
push dword [ebp - 0x205c]
push 0
push 0x20
push 1
push 0
push 0
lea eax, [ebp - 0x2010]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40c0f1
mov byte [ebp - 0x2042], 1
jmp 0x40c0f8
mov byte [ebp - 0x2042], 0
mov al, byte [ebp - 0x2042]
mov byte [ebp - 0x2041], al
movzx eax, byte [ebp - 0x2041]
test eax, eax
je 0x40c11d
mov eax, dword [ebp - 0x206c]
mov dword [ebp - 0x2048], eax
jmp 0x40c124
and dword [ebp - 0x2048], 0
mov eax, dword [ebp - 0x204c]
mov ecx, dword [ebp - 0x2048]
mov dword [eax + 0x4b8], ecx
movzx eax, byte [ebp - 0x2041]
test eax, eax
je 0x40c14f
mov eax, dword [ebp - 0x2074]
mov dword [ebp - 0x2050], eax
jmp 0x40c156
and dword [ebp - 0x2050], 0
mov eax, dword [ebp - 0x204c]
mov ecx, dword [ebp - 0x2050]
mov dword [eax + 0x4bc], ecx
mov al, byte [ebp - 0x2041]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ad99f
leave
ret 4
Function at 0x40f360
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa18
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xa10], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004b0090
add esp, 0xc
push 0x800
push 0
lea eax, [ebp - 0xa0c]
push eax
call fcn.004b0090
add esp, 0xc
push dword [ebp + 8]
push 0x400
lea eax, [ebp - 0xa0c]
push eax
push 0
push 0x52eef8
push 0x52ef00
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x104
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa0c]
push eax
mov ecx, dword [ebp - 0xa10]
call fcn.004112b1
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0xa10]
call fcn.0040f83f
test eax, eax
jne 0x40f46e
and dword [ebp - 0xa18], 0
cmp dword [ebp + 0xc], 0
je 0x40f46c
cmp dword [ebp + 0x10], 0
jle 0x40f46c
lea eax, [ebp - 0x20c]
test eax, eax
je 0x40f46c
and dword [ebp - 0xa14], 0
lea eax, [ebp - 0x20c]
test eax, eax
je 0x40f444
lea eax, [ebp - 0x20c]
push eax
call fcn.004cc4f3
pop ecx
cmp eax, dword [ebp + 0x10]
jae 0x40f444
mov dword [ebp - 0xa14], 1
cmp dword [ebp - 0xa14], 0
je 0x40f46c
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004cc3b7
add esp, 0xc
mov dword [ebp - 0xa18], 1
jmp 0x40f489
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0xa10]
call fcn.004110ed
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 0xc

Function at 0x410ebf
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x800
push 0
lea eax, [ebp - 0x804]
push eax
call fcn.004b0090
add esp, 0xc
and dword [ebp - 0x808], 0
lea eax, [ebp + 0x10]
mov dword [ebp - 0x808], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x810], eax
push dword [ebp - 0x808]
push 0
push dword [ebp - 0x810]
push 0x3ff
push 0x400
lea eax, [ebp - 0x804]
push eax
call fcn.00407770
push dword [eax + 4]
push dword [eax]
call fcn.004cc171
add esp, 0x20
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
jge 0x410f4a
or dword [ebp - 0x814], 0xffffffff
jmp 0x410f56
mov eax, dword [ebp - 0x80c]
mov dword [ebp - 0x814], eax
and dword [ebp - 0x808], 0
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret
Function at 0x410f76
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004b0090
add esp, 0xc
push dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x52ef08
push str.Redirect
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x218], 1
cmp dword [ebp - 0x210], 0
je 0x411027
mov eax, dword [ebp - 0x210]
movzx eax, word [eax]
test eax, eax
je 0x411027
mov eax, dword [ebp - 0x210]
movzx eax, word [eax]
cmp eax, 0x20
je 0x411017
mov eax, dword [ebp - 0x210]
movzx eax, word [eax]
cmp eax, 9
je 0x411017
and dword [ebp - 0x218], 0
jmp 0x411027
mov eax, dword [ebp - 0x210]
inc eax
inc eax
mov dword [ebp - 0x210], eax
jmp 0x410fe5
cmp dword [ebp - 0x218], 0
jne 0x41107d
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x214]
call fcn.0040f83f
test eax, eax
je 0x411063
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0x214]
call fcn.0040ea7a
jmp 0x41107b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x214]
call fcn.00410f76
jmp 0x4110df
and dword [ebp - 0x220], 0
cmp dword [ebp + 0xc], 0
je 0x4110df
cmp dword [ebp + 0x10], 0
jle 0x4110df
cmp dword [ebp + 8], 0
je 0x4110df
and dword [ebp - 0x21c], 0
cmp dword [ebp + 8], 0
je 0x4110bb
push dword [ebp + 8]
call fcn.004cc4f3
pop ecx
cmp eax, dword [ebp + 0x10]
jae 0x4110bb
mov dword [ebp - 0x21c], 1
cmp dword [ebp - 0x21c], 0
je 0x4110df
push dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004cc3b7
add esp, 0xc
mov dword [ebp - 0x220], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 0xc
Function at 0x4110ed
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc34
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0xc2c], ecx
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x800
push 0
lea eax, [ebp - 0xc28]
push eax
call fcn.004b0090
add esp, 0xc
push dword [ebp + 8]
push 0x400
lea eax, [ebp - 0xc28]
push eax
push 0x52ef28
push 0x52ef2c
push 0x52ef00
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xa
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc28]
push eax
mov ecx, dword [ebp - 0xc2c]
call fcn.004112b1
push 2
pop eax
imul eax, eax, 0
movzx eax, word [ebp + eax - 0x18]
cmp eax, 0x31
jne 0x41118f
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov ecx, dword [ebp - 0xc2c]
call fcn.0040ea7a
jmp 0x4112a2
push 0x208
push 0
lea eax, [ebp - 0x428]
push eax
call fcn.004b0090
add esp, 0xc
push dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x428]
push eax
push 0
push 0x52ef58
push str.DefaultValue
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x208
push 0
lea eax, [ebp - 0x220]
push eax
call fcn.004b0090
add esp, 0xc
push 0x104
lea eax, [ebp - 0x220]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x428]
push eax
mov ecx, dword [ebp - 0xc2c]
call fcn.0040ebd3
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp - 0xc2c]
call fcn.0040f83f
test eax, eax
je 0x411230
push dword [ebp + 0x14]
push dword [ebp + 0x10]
lea eax, [ebp - 0x220]
push eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0xc2c]
call fcn.0040ea7a
jmp 0x4112a2
and dword [ebp - 0xc34], 0
cmp dword [ebp + 0x10], 0
je 0x4112a2
cmp dword [ebp + 0x14], 0
jle 0x4112a2
lea eax, [ebp - 0x220]
test eax, eax
je 0x4112a2
and dword [ebp - 0xc30], 0
lea eax, [ebp - 0x220]
test eax, eax
je 0x41127a
lea eax, [ebp - 0x220]
push eax
call fcn.004cc4f3
pop ecx
cmp eax, dword [ebp + 0x14]
jae 0x41127a
mov dword [ebp - 0xc30], 1
cmp dword [ebp - 0xc30], 0
je 0x4112a2
lea eax, [ebp - 0x220]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004cc3b7
add esp, 0xc
mov dword [ebp - 0xc34], 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 0x10