joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4058b0
Capabilities:
Create thread

Disassembly:
push esi
push str.LogonUserExExW
push 1
push str.Advapi32.dll
call fcn.00401080
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 8
push eax
call esi
push str.WTSGetActiveConsoleSessionId
push 1
push str.Kernel32.dll
mov dword [0x44caf4], eax
call fcn.00401080
add esp, 8
push eax
call esi
push str.WTSQueryUserToken
push 1
push str.Wtsapi32.dll
mov dword [0x44caec], eax
call fcn.00401080
add esp, 8
push eax
call esi
push 0xffffffffffffffff
mov dword [0x44caf0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0x405020
mov dword [0x42cad8], eax
call fcn.0040ed7c
add esp, 0xc
push 0xffffffffffffffff
push dword [0x42cad8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
ret

Function at 0x405970
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x42c0e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x44cb04], 0
jne 0x405a03
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.PSINFSVC
push 0
mov dword [0x44cb00], eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
push dword [0x44cb00]
mov esi, eax
lea eax, [ebp - 0x204]
push str.PSINFSVC
push str._s_error:__d
push eax
call fcn.00401960
lea eax, [ebp - 0x204]
add esp, 0x10
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x208], eax
test esi, esi
je 0x405a02
push 0
lea eax, [ebp - 0x20c]
push eax
push 0
push 2
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406096
mov esp, ebp
pop ebp
ret

Function at 0x405a20
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp + 0x10], 0
mov esi, eax
je 0x405a50
push str.PsInfo_Service
push str.Debugging__s._n
call fcn.00401140
add esp, 8
push 1
push 0x405d20
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push esi
push dword [ebp - 4]
call fcn.004058b0
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x405a70
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x42c0e0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x405acb
push 0x100
push 0x44d540
call fcn.00405d60
push eax
push str.PsInfo_Service
push str.Unable_to_install__s____s_n
call fcn.00401140
add esp, 0x14
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406096
mov esp, ebp
pop ebp
ret
push esi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x405b80
push ebx
push 0
push 0
push 0x423dd8
push 0
push 0
lea eax, [ebp - 0x404]
push eax
push 1
push 3
push 0x10
push 0xf01ff
push str.PsInfo_Service
push str.PSINFSVC
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebx, eax
test ebx, ebx
je 0x405b4c
push str.PsInfo_Service
push str._s_installed._n
call fcn.00401140
add esp, 8
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406096
mov esp, ebp
pop ebp
ret
push 0x100
push 0x44d540
call fcn.00405d60
push eax
push str.CreateService_failed____s_n
call fcn.00401140
add esp, 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406096
mov esp, ebp
pop ebp
ret
push 0x100
push 0x44d540
call fcn.00405d60
push eax
push str.OpenSCManager_failed____s_n
call fcn.00401140
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop esi
call fcn.00406096
mov esp, ebp
pop ebp
ret
Function at 0x405bb0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x405cfc
push esi
push 0xf01ff
push str.PSINFSVC
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x405cd0
push edi
push 0x44d760
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x405c85
push str.PsInfo_Service
push str.Stopping__s.
call fcn.00401140
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
push 0x3e8
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push 0x44d760
push esi
call ebx
test eax, eax
je 0x405c5f
mov eax, dword [0x44d764]
cmp eax, 3
jne 0x405c64
push 0x4234ac
call fcn.00401140
add esp, 4
push 0x3e8
call edi
push 0x44d760
push esi
call ebx
test eax, eax
jne 0x405c35
mov eax, dword [0x44d764]
push str.PsInfo_Service
cmp eax, 1
jne 0x405c75
push str._n_s_stopped._n
jmp 0x405c7a
push str._n_s_failed_to_stop._n
call fcn.00401140
mov ebx, dword [ebp - 4]
add esp, 8
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x405c9c
mov edi, str._s_removed._n
mov eax, str.PsInfo_Service
jmp 0x405cb3
push 0x100
push 0x44d540
mov edi, str.DeleteService_failed____s_n
call fcn.00405d60
add esp, 8
push eax
push edi
call fcn.00401140
add esp, 8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
pop edi
push ebx
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x100
push 0x44d540
call fcn.00405d60
push eax
push str.OpenService_failed____s_n
call fcn.00401140
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 0x10
push ebx
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x100
push 0x44d540
call fcn.00405d60
push eax
push str.OpenSCManager_failed____s_n
call fcn.00401140
add esp, 0x10
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406a7a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x406ab9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x406ab9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x406ab9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x406ab9
cmp dword [ecx + 0x74], 0xe
jbe 0x406ab9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x410fca
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42626c
push 0x426264
push str.FlsAlloc
push 0x1f
call fcn.00410e49
mov esi, eax
add esp, 0x10
test esi, esi
je 0x410ffe
push dword [ebp + 8]
mov ecx, esi
call dword [0x41d2c0]
call esi
jmp 0x411004
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x411048
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42627c
push 0x426274
push str.FlsGetValue
push 0x21
call fcn.00410e49
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41107f
push dword [ebp + 8]
mov ecx, esi
call dword [0x41d2c0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x411087
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x426284
push 0x42627c
push str.FlsSetValue
push 0x22
call fcn.00410e49
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4110c1
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x41d2c0]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x414ef8
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x414f95
push ebx
push esi
call fcn.00414ec1
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041295f
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x414f42
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x414f94
push edi
push eax
call fcn.00410b45
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x414f62
call fcn.00410b0b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x414f93
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041295f
add esp, 0x20
test eax, eax
jne 0x414f81
push edi
call fcn.00410b0b
jmp 0x414f89
push ebx
call fcn.00410b0b
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x41ba30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41ba5d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41ba5d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401310
Capabilities:
Stop service

Disassembly:
sub esp, 0x1c
push edi
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x40132d
xor al, al
pop edi
add esp, 0x1c
ret
push esi
push 0x20
push 0x43ba7c
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
call edi
test esi, esi
jne 0x401353
pop esi
xor al, al
pop edi
add esp, 0x1c
ret
push ebx
lea eax, [esp + 0xc]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp eax, 1
push esi
sete bl
call edi
mov al, bl
pop ebx
pop esi
pop edi
add esp, 0x1c
ret

Function at 0x4013d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x84
mov eax, dword [0x444d08]
xor eax, esp
mov dword [esp + 0x80], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xff
push 0x43ba7c
cmp eax, 5
jb 0x401405
push 0x43ba30
lea eax, [esp + 8]
push eax
jmp 0x40140f
push str.._s
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x40144e
xor al, al
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.0041a25b
add esp, 0x84
ret
mov ecx, dword [esp + 0x80]
mov dword [0x449108], eax
xor ecx, esp
mov al, 1
call fcn.0041a25b
add esp, 0x84
ret

Function at 0x401550
Capabilities:
Get common file path
Set file attributes

Disassembly:
sub esp, 0x210
mov eax, dword [0x444d08]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
lea eax, [esp + 8]
push eax
push 0x208
mov dword [0x449108], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x43ba5c
push 0x43ba74
lea ecx, [esp + 0x10]
push ecx
call esi
mov edx, 0x103
sub edx, eax
push edx
lea eax, [esp + 0x14]
push eax
call esi
lea ecx, [esp + eax*2 + 0x14]
push ecx
call fcn.0041aa5a
lea edx, [esp + 0x14]
push edx
call fcn.004014d0
add esp, 0x14
pop esi
test al, al
jne 0x40160b
push 0x80
push 0x44a110
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [esp]
push eax
call fcn.004014d0
add esp, 4
test al, al
jne 0x40160b
call fcn.00401380
lea ecx, [esp]
push ecx
call fcn.004014d0
add esp, 4
test al, al
jne 0x40160b
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.0041a25b
add esp, 0x210
ret
mov ecx, dword [esp + 0x20c]
xor ecx, esp
mov al, 1
call fcn.0041a25b
add esp, 0x210
ret
Function at 0x401630
Capabilities:
Extract resource via kernel32 functions
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x435a2b
mov eax, dword fs:[0]
push eax
sub esp, 0x94
push ebx
push ebp
push esi
push edi
mov eax, dword [0x444d08]
xor eax, esp
push eax
lea eax, [esp + 0xa8]
mov dword fs:[0], eax
push str.IsWow64Process
push str.kernel32
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x401698
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
jne 0x401698
xor bl, bl
jmp 0x4016a0
cmp dword [esp + 0x14], 1
sete bl
mov eax, 0x44a110
lea edx, [eax + 2]
jmp 0x4016b0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4016b0
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 1]
push ecx
call fcn.0040d2d8
add esp, 4
push 0x44a110
push 0x104
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40185f
test bl, bl
je 0x40171c
push 0x43ba9c
push 0x104
push 0x44a110
call fcn.0041aa99
add esp, 0xc
push 0x44a110
call fcn.0041ab46
add esp, 4
call fcn.004012c0
push str.Driver
push 0x6a
jmp 0x40174c
push 0x43ba5c
push 0x104
push 0x44a110
call fcn.0041aa99
add esp, 0xc
push 0x44a110
call fcn.0041ab46
add esp, 4
call fcn.004012c0
push str.Driver
push 0x65
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov eax, 0x44a110
lea edx, [eax + 2]
jmp 0x401780
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401780
sub eax, edx
sar eax, 1
lea esi, [eax + eax + 1]
push esi
call fcn.0040d2d8
add esp, 4
push esi
push 0x44a110
mov edi, eax
push esi
lea edx, [esp + 0x24]
push edi
push edx
call fcn.0041aa3a
add esp, 0x14
push edi
lea eax, [esp + 0x20]
push eax
call fcn.00401b00
push ebp
lea ecx, [esp + 0x20]
push ecx
mov ecx, ebx
mov dword [esp + 0xb8], 0
call fcn.004019f0
lea esi, [esp + 0x20]
call fcn.00402b10
test eax, eax
jne 0x401810
mov edx, dword [esp + 0x1c]
mov ecx, dword [edx + 4]
mov eax, dword [esp + ecx + 0x24]
lea ecx, [esp + ecx + 0x1c]
or eax, 2
cmp dword [ecx + 0x28], 0
jne 0x4017fe
or eax, 4
and eax, 0x17
mov dword [ecx + 8], eax
test dword [ecx + 0xc], eax
je 0x401810
push 0
call fcn.00404aa0
lea ecx, [esp + 0x70]
mov dword [esp + 0xb0], 0xffffffff
call fcn.00401c20
lea eax, [esp + 0x70]
push eax
mov dword [esp + 0x74], vtable.std::ios_base.0
call fcn.004325f8
add esp, 4
call fcn.00401550
test al, al
jne 0x401849
test edi, edi
je 0x40186c
push edi
jmp 0x401864
call fcn.00401020
test edi, edi
je 0x40185b
push edi
call fcn.0040d2cd
add esp, 4
mov al, 1
jmp 0x40186e
test esi, esi
je 0x40186c
push esi
call fcn.0040d2cd
add esp, 4
xor al, al
mov ecx, dword [esp + 0xa8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x4018b0
Capabilities:
Create service

Disassembly:
push esi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x4018de
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_error_code:__d_n
call fcn.0041aba2
add esp, 8
xor al, al
pop esi
ret
push edi
push 0
push 0
push 0
push 0
push 0
push 0x44a110
push 1
push 3
push 1
push 0xf01ff
push 0x43ba7c
push 0x43ba7c
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
call esi
test edi, edi
jne 0x40191e
pop edi
xor al, al
pop esi
ret
push edi
call esi
pop edi
mov al, 1
pop esi
ret

Function at 0x401b00
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x435572
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x444d08]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [edi], 0x43bb2c
mov dword [edi + 0x54], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 4]
push esi
mov dword [esp + 0x24], ebx
push edi
mov dword [esp + 0x1c], 1
call fcn.004029d0
mov dword [esp + 0x20], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
call fcn.004031d0
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x44a7b8]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, dword [esp + 0x2c]
push eax
mov ecx, esi
mov byte [esp + 0x24], 2
call fcn.00402a70
test eax, eax
jne 0x401c03
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
mov eax, dword [ecx + edi + 8]
add ecx, edi
or eax, 2
cmp dword [ecx + 0x28], ebx
jne 0x401bf2
or eax, 4
and eax, 0x17
mov dword [ecx + 8], eax
test dword [ecx + 0xc], eax
je 0x401c03
push ebx
call fcn.00404aa0
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8
Function at 0x4031d0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x434ecb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x444d08]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00432839
push 4
mov dword [esp + 0x20], 0
call fcn.0040d29e
mov edi, eax
add esp, 4
test edi, edi
je 0x40324e
call fcn.00432c9e
mov dword [edi], eax
call fcn.00432acc
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.004328db
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x403243
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00432903
jmp 0x403250
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x406060
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [0x44a324]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push esi
push eax
push 0x1869f
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
mov eax, dword [esp + 8]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
cmp esi, 0x1869f
jne 0x4060cc
test edx, edx
jg 0x4060a6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4060c6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
pop esi
ret
test edx, edx
jg 0x4060da
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4060fa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
pop esi
ret
Function at 0x406100
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x435285
mov eax, dword fs:[0]
push eax
sub esp, 0x810
mov eax, dword [0x444d08]
xor eax, esp
mov dword [esp + 0x80c], eax
push ebx
push esi
mov eax, dword [0x444d08]
xor eax, esp
push eax
lea eax, [esp + 0x81c]
mov dword fs:[0], eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0
mov dword [esp + 0x824], 3
call fcn.0040d2e3
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40616a
push 0x80004005
call fcn.00405150
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0xc], eax
mov byte [esp + 0x824], 4
call fcn.0040d2e3
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40619c
push 0x80004005
call fcn.00405150
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
push 0x800
lea ecx, [esp + 0x1c]
push 0
push ecx
mov dword [esp + 0x1c], 1
call fcn.0041cf50
mov edx, dword [0x44a324]
mov ecx, dword [esp + 0x83c]
add esp, 0xc
push edx
mov edx, dword [esp + 0x830]
push 0x400
lea eax, [esp + 0x20]
push eax
push str.NoItem
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
push 0x43c6b0
push ecx
call fcn.00408060
mov esi, dword [esp + 0x18]
add esp, 0xc
mov ecx, str.NoItem
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40623a
test dx, dx
je 0x406236
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40623a
add eax, 4
add ecx, 4
test dx, dx
jne 0x406214
xor eax, eax
jmp 0x40623f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
mov ecx, edi
test al, al
je 0x406254
lea edx, [esp + 0x834]
push edx
jmp 0x406259
lea eax, [esp + 0xc]
push eax
call fcn.00404d80
mov eax, edi
call fcn.00407b40
mov ebx, eax
call fcn.00407b90
lea eax, [esi - 0x10]
mov byte [esp + 0x824], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406290
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x824], 2
mov eax, dword [esp + 0x82c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4062bb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x824], 1
mov eax, dword [esp + 0x830]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4062e6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x824], 0
mov eax, dword [esp + 0x834]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406311
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x81c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x80c]
xor ecx, esp
call fcn.0041a25b
add esp, 0x81c
ret