joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47be3b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4ac588]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebx, ebx
push str.kernel32.dll
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ebx
xor esi, esi
call edi
push str.GetUserDefaultUILanguage
push eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x47bedd
call eax
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ebx, 0x3ff
mov edi, 0xfc00
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ecx, cx
and eax, edi
or eax, ecx
push eax
mov dword [ebp - 0x1c], ecx
call esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
call esi
push str.GetSystemDefaultUILanguage
push dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ebx, cx
and eax, edi
or eax, ebx
push eax
call esi
push ebx
mov dword [ebp - 0x34], eax
call esi
mov dword [ebp - 0x30], eax
push 4
xor ebx, ebx
jmp 0x47bfdf
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x47bf8d
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push str.Control_PanelDesktopResourceLocale
push SysReAllocString
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47bfe0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x47bf82
cmp dword [ebp - 0x24], 1
jne 0x47bf82
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push 0x48f778
push eax
call fcn.0044ec50
add esp, 0xc
cmp eax, 1
jne 0x47bf82
mov eax, dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
push 2
mov dword [ebp - 0x38], eax
pop esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47bfe0
push str.ntdll.dll
call edi
cmp eax, ebx
je 0x47bfe0
lea ecx, [ebp - 0x18]
push ecx
push 0x47be25
push 1
push 0x10
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
cmp word [ebp - 0x18], bx
je 0x47bfe0
movzx eax, word [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
mov dword [ebp - 0x38], eax
push 2
pop esi
mov dword [ebp + esi*4 - 0x3c], 0x800
inc esi
xor edi, edi
cmp esi, ebx
jle 0x47c006
push dword [ebp + edi*4 - 0x3c]
push dword [ebp + 8]
call fcn.0047bda6
cmp eax, ebx
pop ecx
pop ecx
jne 0x47c008
inc edi
cmp edi, esi
jl 0x47bfef
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0044af18
leave
ret 4
Function at 0x47c017
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x4ac300
je 0x47c0d3
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47c0bb
mov esi, dword [ebx + 4]
jmp 0x47c0b5
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x47c0a5
cmp dword [ebp - 0xc], 4
jne 0x47c0a5
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x47c09d
or dword [eax + 0x9c], ecx
jmp 0x47c0a5
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x47c069
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x47c04c
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x47c48c
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x4860dc
call fcn.0044e560
sub esp, 0x11c
mov eax, dword [0x4ac588]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x124]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x47c585
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x47c559
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.00401ac0
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.0047c48c
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.004011f0
test bl, bl
jne 0x47c559
or dword [ebp - 4], 0xffffffff
jmp 0x47c4ca
cmp esi, 0x103
je 0x47c569
cmp esi, 0x3f2
jne 0x47c579
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.0044af18
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x47cc09
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x47cc3e
cmp edi, dword [esi + 0xc]
jge 0x47cc3e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47cc3e
cmp edi, dword [eax + 8]
jge 0x47cc3e
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x47cc40
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x47cd44
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x47cd78
jmp fcn.0045e4e2
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x47cde9
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x47cee2
cmp eax, dword [edi + 0xc]
jge 0x47cee2
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x47ce3a
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x47cecb
cmp dword [ebp + 0xc], ebx
je 0x47cecb
jmp 0x47ce64
push 0x10
call fcn.0047cad5
cmp eax, ebx
je 0x47ce50
mov ecx, eax
call fcn.0047cd3b
mov esi, eax
jmp 0x47ce52
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x47ce7b
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x47ce8b
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x47ce9d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0045e4e2
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.0044e500
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x47cedd
cmp ecx, dword [esi + 8]
jge 0x47cedd
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x47cee3
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x480bf4
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x486162
call fcn.0044e560
sub esp, 0x198
mov eax, dword [0x4ac588]
push ebx
push esi
push edi
push 0x47c99a
mov ecx, 0x4affd8
mov dword [ebp - 0x10], eax
call fcn.0047cc69
mov edi, eax
xor ebx, ebx
cmp dword [edi + 0xc], ebx
jne 0x480c56
mov esi, dword [ebp + 8]
cmp esi, ebx
jne 0x480c34
lea esi, [ebp - 0x1a0]
push esi
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, ebx
jne 0x480c88
cmp byte [esi], 1
jne 0x480c82
cmp byte [esi + 1], 1
jne 0x480c82
mov dword [edi + 0xc], 0x480bc1
call fcn.0047b691
mov esi, eax
cmp dword [esi + 0x30], ebx
jne 0x480c95
push 0x1c
call fcn.0046702b
pop ecx
mov ecx, eax
mov dword [ebp - 0x1a4], ecx
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x480c8c
push 0xa
call fcn.00461351
jmp 0x480c8e
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x480cf8
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x30], eax
cmp dword [esi + 0x34], ebx
jne 0x480cc7
push 0x1c
call fcn.0046702b
pop ecx
mov ecx, eax
mov dword [ebp - 0x1a4], ecx
cmp ecx, ebx
mov dword [ebp - 4], 1
je 0x480cbe
push 0xa
call fcn.00461351
jmp 0x480cc0
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x34], eax
cmp dword [esi + 0x38], ebx
jne 0x480cf5
push 0x1c
call fcn.0046702b
pop ecx
mov ecx, eax
mov dword [ebp - 0x1a4], ecx
cmp ecx, ebx
mov dword [ebp - 4], 2
je 0x480cf0
push 0xa
call fcn.00460aea
jmp 0x480cf2
xor eax, eax
mov dword [esi + 0x38], eax
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0044af18
leave
ret 4
Function at 0x59f840
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0059f9f0
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x59f93e
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x59f8e1
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x59f924
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x59f8f8
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x59f913
test al, 0x40
je 0x59f90a
mov ecx, dword [edi + 0x20]
jmp 0x59f911
test al, 0x80
je 0x59f924
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x59f924
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x59f8b0
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x40109b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x250
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x4011a1
call dword [sym.imp.USER32.dll_LoadCursorA]
push esi
push esi
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x220], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push edx
push edx
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x238]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_RegisterClassW]
push ecx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
mov dword [esp], 0
call ebx
lea ebx, [ebp - 0x210]
push edx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push ecx
push ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1a
mov dword [esp], 0
call dword [sym.imp.SHELL32.DLL_SHGetFolderPathW]
sub esp, 0x14
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 5]
push esi
lea esp, [ebp - 8]
jmp 0x401218
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp], 0
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0
call ebx
push edx
mov dword [ebp - 0x228], eax
call esi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x21c], 6
push ecx
push ecx
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x218], 0
jmp 0x4010b1
pop ebx
pop esi
pop ebp
ret

Function at 0x401375
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
mov dword [ebp - 0x88], 1
call fcn.0040109b
test eax, eax
jne 0x40140f
lea eax, [ebp - 0x8c]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, 0x4029da
sub eax, 0x401f78
mov dword [esp], 0x401f78
mov dword [esp + 4], eax
mov dword [ebp - 0x8c], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x40140f
lea ebx, [ebp - 0x88]
mov dword [esp], 0
call fcn.004018d7
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.00401764
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c000
mov dword [esp], 0x40300c
call fcn.004026dd
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x404fef
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40eb58]
jne 0x404ff9
repz ret
jmp fcn.00408865

Function at 0x407b54
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403f52
and dword [ebp - 4], 0
cmp dword [0xb18bb8], 0
mov ebx, eax
jne 0x407c05
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407cb6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407cb6
push eax
call fcn.00403ee0
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0xb18bb8], eax
call esi
push eax
call fcn.00403ee0
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0xb18bbc], eax
call esi
push eax
call fcn.00403ee0
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0xb18bc0], eax
call esi
push eax
call fcn.00403ee0
pop ecx
mov dword [0xb18bc8], eax
test eax, eax
je 0x407c05
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403ee0
pop ecx
mov dword [0xb18bc4], eax
mov eax, dword [0xb18bc4]
cmp eax, ebx
je 0x407c5d
cmp dword [0xb18bc8], ebx
je 0x407c5d
push eax
call fcn.00403f5b
push dword [0xb18bc8]
mov esi, eax
call fcn.00403f5b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407c5d
test edi, edi
je 0x407c5d
call esi
test eax, eax
je 0x407c54
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407c54
test byte [ebp - 0xc], 1
jne 0x407c5d
or dword [ebp + 0x10], 0x200000
jmp 0x407c96
mov eax, dword [0xb18bbc]
cmp eax, ebx
je 0x407c96
push eax
call fcn.00403f5b
pop ecx
test eax, eax
je 0x407c96
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407c96
mov eax, dword [0xb18bc0]
cmp eax, ebx
je 0x407c96
push eax
call fcn.00403f5b
pop ecx
test eax, eax
je 0x407c96
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0xb18bb8]
call fcn.00403f5b
pop ecx
test eax, eax
je 0x407cb6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407cb8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4020a0
Capabilities:
Create thread
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b12b
mov eax, dword fs:[0]
push eax
sub esp, 0x310
mov eax, dword [0x447150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x318]
mov edi, dword [ebp + 0xc]
call fcn.0041a890
cmp byte [edi], 0
mov dword [ebp - 4], 0
je 0x402255
lea eax, [esi + 0x6ad8]
mov ecx, edi
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402120
test dl, dl
je 0x40211c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402120
add eax, 2
add ecx, 2
test dl, dl
jne 0x402100
xor eax, eax
jmp 0x402125
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40215e
mov ecx, ebx
lea eax, [esi + 0x69d4]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402151
test dl, dl
je 0x40214d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402151
add eax, 2
add ecx, 2
test dl, dl
jne 0x402131
xor eax, eax
jmp 0x402156
sbb eax, eax
or eax, 1
test eax, eax
je 0x402255
push edi
push ebx
lea ecx, [ebp - 0x318]
call fcn.0041acc0
mov ecx, esi
call fcn.0041c240
push eax
lea ecx, [ebp - 0x318]
call fcn.0041a8a0
cmp eax, 2
jne 0x40222e
push 0
push 5
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0x43c5b8
lea eax, [ebp - 0x110]
push 0x100
push eax
call fcn.0042cd81
push 0x448238
lea eax, [ebp - 0x110]
push 0x100
push eax
call fcn.0042cd81
push 0x43c5b8
lea eax, [ebp - 0x110]
push 0x100
push eax
call fcn.0042cd81
push str.cvr.ini
lea eax, [ebp - 0x110]
push 0x100
push eax
call fcn.0042cd81
add esp, 0x30
lea eax, [ebp - 0x110]
push eax
push 0x43c576
push str.PATH
push str.OPEN_PATH
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [ebp - 0x31c]
push eax
push 0
push esi
push 0x401f60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor esi, esi
jmp 0x40225a
push edi
lea eax, [esi + 0x6ad8]
push 0x104
push eax
call fcn.0042cd27
push ebx
lea eax, [esi + 0x69d4]
push 0x104
push eax
call fcn.0042cd27
add esp, 0x18
mov esi, 1
lea ecx, [ebp - 0x318]
call fcn.00419f20
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004271bb
mov esp, ebp
pop ebp
ret 8
Function at 0x4024a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push str.dvr2.ini
push 0
push str.debug
push str.generic
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, ebx
mov dword [ebx + 0x42c], eax
call fcn.00402610
mov eax, dword [ebp + 8]
lea edi, [ebx + 0x20c]
test eax, eax
mov ecx, str.message
cmovne ecx, eax
push ecx
push 0x104
push edi
mov dword [ebp + 8], ecx
call fcn.0042cd81
push str..txt
push 0x104
push edi
call fcn.0042cd81
push dword [ebp + 8]
lea esi, [ebx + 0x310]
push 0x104
push esi
call fcn.0042cd81
push str..txt
push 0x104
push esi
call fcn.0042cd81
push 0
push edi
call fcn.0042d12d
add esp, 0x38
test eax, eax
jns 0x402575
mov ecx, ebx
call fcn.00402610
push str...us_
push 0x104
push edi
call fcn.0042cd81
push dword [ebp + 8]
push 0x104
push edi
call fcn.0042cd81
push str..txt
push 0x104
push edi
call fcn.0042cd81
push edi
push 0x104
push esi
call fcn.0042cd27
add esp, 0x30
push edi
push 0x200
lea esi, [ebx + 0xc]
push esi
push 0x43c576
push str.Signature
push str.Version
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
push str.DVR_TEXT
call fcn.0042f784
add esp, 8
test eax, eax
je 0x4025b0
mov byte [edi], 0
mov byte [ebx + 0x310], 0
mov ecx, ebx
call fcn.00402cc0
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4
Function at 0x402cc0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d8
mov eax, dword [0x447150]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x1d4]
mov dword [ebp - 0x1d4], 0x94
mov esi, str.Fonts
mov ebx, ecx
push eax
mov dword [ebp - 0x1d8], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x1c4], 2
je 0x402d51
lea eax, [ebx + 0x20c]
push eax
push 0x100
lea eax, [ebp - 0x104]
push eax
push 0x43c576
push dword [0x44704c]
push str.Fonts.win95
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x104], 0
mov eax, str.Fonts.win95
movups xmm0, xmmword [str.MS_Sans_Serif_8]
cmove eax, esi
mov dword [ebp - 0x1d8], eax
movups xmmword [ebp - 0x104], xmm0
jmp 0x402d6e
movq xmm0, qword [str.Tahoma_10]
mov ax, word [0x43c75c]
movq qword [ebp - 0x104], xmm0
mov word [ebp - 0xfc], ax
lea eax, [ebp - 0x104]
mov ecx, ebx
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.00402fc0
test eax, eax
je 0x402d9a
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov dword [ebx + 0x428], eax
lea eax, [ebx + 0x20c]
xor esi, esi
lea edi, [ebx + 0x414]
nop dword [eax + eax]
push eax
push 0x100
lea eax, [ebp - 0x104]
mov dword [edi], 0
push eax
push 0x43c576
push dword [esi + 0x44704c]
push dword [ebp - 0x1d8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x104], 0
je 0x402e0b
lea eax, [ebp - 0x104]
mov ecx, ebx
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.00402fc0
test eax, eax
je 0x402e0b
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov dword [edi], eax
add esi, 4
lea eax, [ebx + 0x20c]
add edi, 4
cmp esi, 0x14
jb 0x402db0
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004271bb
mov esp, ebp
pop ebp
ret
Function at 0x402e70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x447150]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x14]
mov eax, ecx
cmp byte [eax + 0x20c], 0
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x40c], ecx
mov ecx, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x410], ecx
lea ecx, [eax + 0x20c]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x408], eax
mov dword [ebp - 0x414], ecx
je 0x402fa9
test edi, edi
je 0x402fa9
cmp byte [edi], 0
je 0x402fa9
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x402fa9
push ebx
push ecx
push eax
push esi
test edx, edx
mov ebx, str.Global
push 0x43c576
cmovne ebx, edx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esi], 0
jne 0x402f4d
mov ecx, dword [ebp - 0x40c]
test ecx, ecx
je 0x402f30
mov edx, dword [ebp - 0x410]
test edx, edx
je 0x402f30
mov eax, dword [ebp - 0x408]
push 1
push dword [eax + 0x428]
push 0x30
push edx
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp - 0x408]
add eax, 0x310
push eax
push dword [ebp + 0xc]
push esi
push 0x43c576
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [ebp - 0x408]
cmp dword [eax + 0x42c], 0
je 0x402f94
cmp byte [esi], 0
jne 0x402f94
push edi
push ebx
push dword [ebp - 0x414]
lea eax, [ebp - 0x404]
push str.Text_string_is_not_exist._nprofile_:__s_nsection_:__s_nkey_:__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x404]
push 0x40
push str.Information
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004271bb
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004271bb
mov esp, ebp
pop ebp
ret 0x18