joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ba35
Capabilities:
Get common file path

Disassembly:
mov eax, 0x421ca3
call main
sub esp, 0x110
and dword [ebp - 0x18], 0
push ebx
push str.OutputName
push ecx
lea eax, [ecx + 4]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.0040ac2e
lea eax, [ebp - 0x10]
push eax
call fcn.00409725
add esp, 0xc
push 1
lea ecx, [ebp - 0x10]
pop ebx
push 0x42c150
push str..exe
mov dword [ebp - 4], ebx
call sub.MFC42.DLL_CString::Replace
lea eax, [ebp - 0x11c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x11c]
lea ecx, [ebp - 0x14]
push eax
call sub.MFC42.DLL_CString::CString_1
push str.GLSetup2.exe__Uninstall:
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00417c12
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x14]
push eax
call sub.MFC42.DLL_CString::operator_1
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call fcn.00417b2e
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov dword fs:[0], ecx
pop ebx
leave
ret 4

Function at 0x411a2c
Capabilities:
Set registry value

Disassembly:
mov eax, 0x422ab8
call main
sub esp, 0x108
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], 1
cmp dword [eax - 8], 0xfe
jle 0x411a5c
xor esi, esi
jmp 0x411acf
push eax
lea eax, [ebp - 0x114]
push eax
call sub.MSVCRT.dll_strcpy
mov eax, dword [esi + 0xc]
pop ecx
pop ecx
lea ecx, [ebp - 0x10]
push ecx
push 0x20006
push ebx
push eax
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x411a58
lea eax, [ebp - 0x114]
push edi
mov edi, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
lea eax, [ebp - 0x114]
push eax
push 1
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop edi
je 0x411ab5
mov dword [ebp - 0x14], ebx
cmp dword [esi + 8], ebx
jne 0x411ac3
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x14]
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x411bfa
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 0x108]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x411c35
push esi
lea eax, [ebp - 0x108]
push str.C:Temp
push eax
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0
lea eax, [ebp - 0x108]
push 0x42cff8
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
pop esi
je 0x411c5e
lea eax, [ebp - 0x20c]
push eax
jmp 0x411c63
push 0x42f9e0
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [ebp + 8]
leave
ret

Function at 0x411ce6
Capabilities:
Copy file

Disassembly:
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
neg eax
sbb eax, eax
neg eax
ret

Function at 0x412888
Capabilities:
Check if file exists
Delete file

Disassembly:
mov eax, 0x422c9c
call main
push ecx
lea eax, [ebp - 0x10]
push esi
mov esi, ecx
push eax
call fcn.004127dc
push dword [ebp - 0x10]
and dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push dword [ebp - 0x10]
test eax, eax
jne 0x4128c9
push 0x42d0cc
add esi, 8
push esi
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push 2
pop esi
jmp 0x4128f0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0x10]
test eax, eax
jne 0x4128dd
push 0x42d0b4
jmp 0x4128b8
add esi, 8
push 0x42d0a0
push esi
call sub.MFC42.DLL_CString::Format
add esp, 0xc
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4133e2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov ecx, dword [esi + 0x10]
mov dword [ebp - 4], edi
cmp ecx, edi
je 0x4133fd
call fcn.00409865
jmp 0x4133ff
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push 0x20019
push edi
push eax
push dword [esi + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x41341b
xor eax, eax
jmp 0x41344b
mov ecx, dword [esi + 0x18]
cmp ecx, edi
je 0x413429
call fcn.00409865
jmp 0x41342b
xor eax, eax
push edi
push edi
push edi
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x413440
push 1
pop edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x41344f
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, ecx
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x413468
call fcn.00409865
jmp 0x41346a
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push 0x20006
push 0
push eax
push dword [esi + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4134aa
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x413491
call fcn.00409865
jmp 0x413493
xor eax, eax
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
test eax, eax
je 0x4134ae
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4134d1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x4134c2
call fcn.00409865
jmp 0x4134c4
xor eax, eax
push eax
push dword [esi + 0xc]
call dword [sym.imp.SHLWAPI.dll_SHDeleteEmptyKeyA]
push 1
pop eax
pop esi
leave
ret

Function at 0x414764
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x24]
mov ecx, dword [esi + 0x64]
mov eax, dword [esi + 0x34]
mov edx, dword [esi + 0x6c]
sub eax, ecx
sub eax, edx
mov dword [ebp + 8], eax
jne 0x41478e
test ecx, ecx
jne 0x414798
test edx, edx
jne 0x414798
mov eax, edi
jmp 0x414804
cmp eax, 0xffffffff
jne 0x414798
push 0xfffffffffffffffe
pop eax
jmp 0x414804
mov edx, dword [esi + 0x24]
lea edx, [edi + edx - 0x106]
cmp ecx, edx
jb 0x414804
mov eax, dword [esi + 0x30]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call sub.MSVCRT.dll_memcpy
mov ecx, dword [esi + 0x44]
mov eax, dword [esi + 0x3c]
sub dword [esi + 0x68], edi
sub dword [esi + 0x64], edi
add esp, 0xc
sub dword [esi + 0x54], edi
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx edx, word [eax]
mov ebx, edx
sub ebx, edi
cmp edx, edi
sbb edx, edx
not edx
and edx, ebx
dec ecx
mov word [eax], dx
jne 0x4147c9
mov eax, dword [esi + 0x38]
mov edx, edi
lea eax, [eax + edi*2]
dec eax
dec eax
movzx ecx, word [eax]
mov ebx, ecx
sub ebx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, ebx
dec edx
mov word [eax], cx
jne 0x4147e8
mov eax, dword [ebp + 8]
add eax, edi
mov ecx, dword [esi]
cmp dword [ecx + 4], 0
je 0x41485f
push eax
mov eax, dword [esi + 0x6c]
add eax, dword [esi + 0x64]
add eax, dword [esi + 0x30]
push eax
push ecx
call fcn.00414864
add dword [esi + 0x6c], eax
mov ebx, dword [esi + 0x6c]
add esp, 0xc
cmp ebx, 3
jb 0x41484b
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x30]
lea edx, [eax + ecx]
mov ecx, dword [esi + 0x50]
movzx eax, byte [edx]
mov dword [esi + 0x40], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x4c]
mov dword [esi + 0x40], eax
cmp ebx, 0x106
jae 0x41485f
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x414770
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x419040
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
test ebx, ebx
mov edi, ecx
jne 0x41906f
mov eax, dword [esp + 0x10]
push eax
push 2
push eax
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
mov ecx, edi
call sub.MFC42.DLL_CGdiObject::Attach
pop edi
pop esi
pop ebx
ret 8
call sub.MFC42.DLL_AfxGetModuleState
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x41908f
pop edi
pop esi
pop ebx
ret 8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov ecx, edi
call fcn.00418f70
pop edi
pop esi
pop ebx
ret 8
Function at 0x41c300
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x42fc20]
sub esp, 0x104
test eax, eax
jne 0x41c4e1
mov eax, dword [0x42fc24]
test eax, eax
jne 0x41c518
mov eax, dword [0x42e8c0]
test eax, eax
je 0x41c33e
push 0x42fc08
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x42e8c0], 0
push 0x42fc08
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x42fc20]
test eax, eax
jne 0x41c4d6
mov al, byte [0x4306f4]
test al, al
je 0x41c379
push 0x4306f4
lea eax, [esp + 4]
push str._sGLJPG.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x41c38c
lea ecx, [esp]
push str.GLJPG.dll
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x42fc20], eax
jne 0x41c3be
push 0x42fc08
mov dword [0x42fc24], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add esp, 0x104
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LoadJpgFileImageData
push eax
call esi
mov dword [0x42fc28], eax
mov eax, dword [0x42fc20]
push str.LoadJpgImageDataFromMem
push eax
call esi
mov ecx, dword [0x42fc20]
push str.LoadJpgFile
push ecx
mov dword [0x42fc2c], eax
call esi
mov edx, dword [0x42fc20]
push str.LoadJpgFromMem
push edx
mov dword [0x42fc30], eax
call esi
mov dword [0x42fc34], eax
mov eax, dword [0x42fc20]
push str.WriteBitmapToJpeg
push eax
call esi
mov ecx, dword [0x42fc20]
push str.WriteDibToJpeg
push ecx
mov dword [0x42fc38], eax
call esi
mov edx, dword [0x42fc20]
push str.WriteDibToJpegMEM
push edx
mov dword [0x42fc3c], eax
call esi
mov dword [0x42fc40], eax
mov eax, dword [0x42fc20]
push str.GetPointerFromHandleLock
push eax
call esi
mov ecx, dword [0x42fc20]
push str.UnLockDataHandle
push ecx
mov dword [0x42fc44], eax
call esi
mov edx, dword [0x42fc20]
push str.FreeDataHandle
push edx
mov dword [0x42fc48], eax
call esi
mov ecx, dword [0x42fc28]
mov dword [0x42fc4c], eax
test ecx, ecx
pop esi
je 0x41c4ed
mov ecx, dword [0x42fc2c]
test ecx, ecx
je 0x41c4ed
mov ecx, dword [0x42fc30]
test ecx, ecx
je 0x41c4ed
mov ecx, dword [0x42fc34]
test ecx, ecx
je 0x41c4ed
mov ecx, dword [0x42fc38]
test ecx, ecx
je 0x41c4ed
mov ecx, dword [0x42fc3c]
test ecx, ecx
je 0x41c4ed
test eax, eax
je 0x41c4ed
mov eax, dword [0x42fc40]
test eax, eax
je 0x41c4ed
mov eax, dword [0x42fc44]
test eax, eax
je 0x41c4ed
mov eax, dword [0x42fc48]
test eax, eax
je 0x41c4ed
push 0x42fc08
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
add esp, 0x104
ret
mov eax, dword [0x42fc20]
mov dword [0x42fc24], 1
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x42fc08
mov dword [0x42fc20], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add esp, 0x104
ret
Function at 0x41c570
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x42fc7c]
sub esp, 0x104
test eax, eax
jne 0x41c6c4
mov eax, dword [0x42fc80]
test eax, eax
jne 0x41c6fc
mov eax, dword [0x42e9a4]
test eax, eax
je 0x41c5ae
push 0x42fc50
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x42e9a4], 0
push 0x42fc50
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x42fc7c]
test eax, eax
jne 0x41c6b9
mov al, byte [0x4306f4]
test al, al
je 0x41c5e9
push 0x4306f4
lea eax, [esp + 4]
push str._sGLPNG.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x41c5fc
lea ecx, [esp]
push str.GLPNG.dll
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x42fc7c], eax
jne 0x41c62e
push 0x42fc50
mov dword [0x42fc80], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add esp, 0x104
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LoadPNGFile
push eax
call esi
mov dword [0x42fc68], eax
mov eax, dword [0x42fc7c]
push str.LoadPNGFromMem
push eax
call esi
mov ecx, dword [0x42fc7c]
push str.WriteBmpToPNGMem
push ecx
mov dword [0x42fc6c], eax
call esi
mov edx, dword [0x42fc7c]
push str.WriteBmpToPNGFile
push edx
mov dword [0x42fc70], eax
call esi
mov dword [0x42fc74], eax
mov eax, dword [0x42fc7c]
push str.WriteImageDataToPNGMem
push eax
call esi
mov ecx, dword [0x42fc68]
mov dword [0x42fc78], eax
test ecx, ecx
pop esi
je 0x41c6d0
mov ecx, dword [0x42fc6c]
test ecx, ecx
je 0x41c6d0
mov ecx, dword [0x42fc70]
test ecx, ecx
je 0x41c6d0
mov ecx, dword [0x42fc74]
test ecx, ecx
je 0x41c6d0
test eax, eax
je 0x41c6d0
push 0x42fc50
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
add esp, 0x104
ret
mov ecx, dword [0x42fc7c]
mov dword [0x42fc80], 1
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x42fc50
mov dword [0x42fc7c], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add esp, 0x104
ret
Function at 0x41c860
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x104]
test eax, eax
je 0x41c889
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [esi + 0x104], 0
lea ebp, [esi + 0x108]
xor eax, eax
mov ecx, ebp
lea edi, [esi + 0x110]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov ecx, 0x41
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x120]
test edi, edi
je 0x41c8c9
cmp byte [edi], 0
jne 0x41c8e5
mov ecx, esi
call fcn.0041cb90
lea edx, [esp + 0x18]
push 0x103
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edi, [esp + 0x18]
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x41c900
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 4
push ebx
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esi + 0x104], eax
test eax, eax
jne 0x41c920
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 4
push eax
push ebx
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoA
mov edx, dword [esi + 0x104]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0x42c144
push edx
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 8]
shr ecx, 0x10
mov word [ebp], cx
mov dx, word [eax + 8]
mov word [esi + 0x10a], dx
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
mov word [esi + 0x10c], cx
mov ax, word [eax + 0xc]
mov word [esi + 0x10e], ax
and eax, 0xffff
xor edx, edx
push eax
mov dx, cx
xor eax, eax
mov ax, word [esi + 0x10a]
xor ecx, ecx
mov cx, word [ebp]
push edx
push eax
push ecx
push str._d._d._d._d
lea eax, [esi + 0x110]
push 0x3f
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
push 0x103
push edi
push esi
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
add esp, 0x28
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 4

Function at 0x41cae0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x118]
lea ecx, [esp + 0x14]
push eax
push str.SoftwareGloballinkGame_s
push 0xff
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea edx, [esp + 8]
lea eax, [esp + 0x14]
mov dword [esp + 8], 0
push edx
push 1
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x41cb7c
mov edx, dword [esp + 0x11c]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push edx
push eax
push esi
push str.path
push ecx
mov dword [esp + 0x24], 0x103
mov dword [esp + 0x28], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 8]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
test esi, esi
sete al
pop esi
add esp, 0x10c
ret 8
Function at 0x41cbb0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x422f68
push eax
mov eax, dword [esp + 0x1c]
mov dword fs:[0], esp
mov edx, dword [esp + 0x14]
sub esp, 0x40
lea ecx, [esp]
push ebp
push esi
push eax
mov eax, dword [esp + 0x5c]
push 0x40
push ecx
push 0x42f9e0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 8]
test al, al
jne 0x41cc08
mov eax, dword [esp + 0x60]
pop esi
pop ebp
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
add esp, 0x4c
ret
lea ecx, [esp + 0x64]
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 8]
xor ebp, ebp
push ecx
lea ecx, [esp + 0x68]
mov dword [esp + 0x54], ebp
call sub.MFC42.DLL_CString::operator
mov eax, dword [esp + 0x64]
cmp dword [eax - 8], 2
jge 0x41cc5f
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
lea ecx, [esp + 0x64]
mov esi, eax
mov dword [esp + 0x50], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
add esp, 0x4c
ret
push 0x2c
push eax
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
test eax, eax
jne 0x41ccb9
mov edx, dword [esp + 0x64]
push edx
call fcn.0041bea0
mov esi, eax
mov ecx, eax
and esi, 0xff
and eax, 0xff00
shl esi, 0x10
sar ecx, 0x10
add esi, ecx
add esp, 4
lea ecx, [esp + 0x64]
add esi, eax
mov dword [esp + 0x50], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
add esp, 0x4c
ret
mov esi, dword [esp + 0x64]
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_atoi]
push edi
push esi
call ebx
mov dword [esp + 0x68], eax
mov al, byte [esi]
add esp, 4
xor edi, edi
test al, al
je 0x41cce3
cmp al, 0x2c
je 0x41cce3
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x41ccd7
cmp byte [esi], 0x2c
jne 0x41cd11
inc esi
push esi
call ebx
mov ebp, eax
mov al, byte [esi]
add esp, 4
test al, al
je 0x41cd03
cmp al, 0x2c
je 0x41cd03
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x41ccf7
cmp byte [esi], 0x2c
jne 0x41cd11
inc esi
push esi
call ebx
add esp, 4
mov edi, eax
mov eax, dword [esp + 0x64]
lea ecx, [esp + 0x6c]
shl edi, 8
add edi, ebp
mov dword [esp + 0x58], 0xffffffff
shl edi, 8
add edi, eax
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x50]
mov eax, edi
pop edi
pop ebx
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x4c
ret
Function at 0x41cd50
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x422f88
push eax
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 0x40
lea ecx, [esp]
push eax
mov eax, dword [esp + 0x54]
push 0x40
push ecx
push 0x42f9e0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp]
test al, al
je 0x41cdfe
push ebx
push esi
push edi
lea ecx, [esp + 0x68]
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0xc]
mov dword [esp + 0x54], 0
push ecx
lea ecx, [esp + 0x6c]
call sub.MFC42.DLL_CString::operator
mov esi, dword [esp + 0x68]
mov edi, dword [sym.imp.MSVCRT.dll_atoi]
push esi
call edi
mov ebx, dword [esp + 0x68]
add esp, 4
mov dword [ebx], eax
mov al, byte [esi]
test al, al
je 0x41cddb
cmp al, 0x2c
je 0x41cddb
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x41cdcf
cmp byte [esi], 0x2c
jne 0x41cdea
inc esi
push esi
call edi
add esp, 4
mov dword [ebx + 4], eax
lea ecx, [esp + 0x68]
mov dword [esp + 0x54], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
add esp, 0x4c
ret
Function at 0x4030cc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x482020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403164
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403144
xor eax, eax
push ebp
push 0x40313d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403180
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403144
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x482020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x482020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403e30
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x48504c], 0
je 0x403e91
cmp word [0x485220], 0xd7b2
jne 0x403e59
cmp dword [0x485228], 0
jbe 0x403e59
mov eax, 0x48521c
call dword [0x485238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x48206c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403eb8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x482030], 0
jne 0x403ead
push 0
push 0x482064
push 0x48206c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x403fe4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.0040279c
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x48504d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x403fac
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc