joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417a96
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc1c
mov eax, dword [0x41a140]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov esi, edx
xor edx, edx
mov eax, ecx
push edi
mov edi, dword [ebp + 8]
inc ebx
mov dword [ebp - 0xc18], eax
mov dword [ebp - 0xc14], edi
mov dword [ebp - 0xc1c], edx
cmp byte [0x41a62d], dl
je 0x417b2c
lea ecx, [ebp - 0xc08]
mov dword [ebp - 0xc08], 0x400
push ecx
lea ecx, [ebp - 0xc04]
push ecx
lea ecx, [ebp - 0xc0c]
push ecx
push edx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x417b21
jle 0x417b0a
movzx eax, ax
or eax, 0x80070000
lea esp, [ebp - 0xc28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419610
leave
ret 4
lea edx, [ebp - 0xc04]
jmp 0x417c23
test esi, esi
je 0x417bcd
push edx
push edx
push edx
push edx
push 0xffffffffffffffff
push esi
push edx
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jne 0x417b53
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jmp 0x417b00
call fcn.00419a40
mov eax, esp
xor ecx, ecx
push ecx
push ecx
push edi
push eax
push 0xffffffffffffffff
push esi
push ecx
push ecx
mov dword [ebp - 0xc10], eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x417b49
mov eax, dword [ebp - 0xc10]
xor edx, edx
mov edi, dword [ebp - 0xc14]
lea ecx, [ebp - 0xc08]
mov esi, 0x400
push ecx
lea ecx, [ebp - 0x404]
mov dword [ebp - 0xc08], esi
push ecx
lea ecx, [ebp - 0xc0c]
push ecx
push edx
push eax
push dword [ebp - 0xc18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x417b00
mov ecx, dword [ebp - 0xc08]
test ecx, ecx
jne 0x417bd1
mov eax, 0x80004005
jmp 0x417b0a
mov eax, edx
jmp 0x417b83
lea eax, [ecx - 1]
cmp eax, esi
jae 0x417ca4
xor edx, edx
mov byte [ebp + eax - 0x404], dl
mov eax, dword [ebp - 0xc0c]
cmp eax, ebx
je 0x417bfc
cmp eax, 2
je 0x417bfc
lea edx, [ebp - 0x404]
jmp 0x417c2f
push esi
lea eax, [ebp - 0xc04]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x404]
push eax
push edx
push edx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x417b49
mov edx, dword [ebp - 0xc1c]
mov eax, dword [ebp - 0xc0c]
mov ecx, dword [ebp - 0xc08]
sub eax, 1
je 0x417c55
sub eax, 1
je 0x417c55
dec eax
sub eax, 1
jne 0x417c4b
cmp ecx, 4
jne 0x417c4b
cmp dword [edx], eax
setne bl
jmp 0x417c9b
mov eax, 0x80040153
jmp 0x417b0a
push 0xffffffffffffffff
mov edx, 0x402ae8
mov byte [edi], bl
lea ecx, [ebp - 0xc04]
call fcn.00416ce0
test eax, eax
je 0x417c99
push 0xffffffffffffffff
mov edx, 0x402aec
lea ecx, [ebp - 0xc04]
call fcn.00416ce0
test eax, eax
je 0x417c99
push 0xffffffffffffffff
mov edx, 0x402af4
lea ecx, [ebp - 0xc04]
call fcn.00416ce0
test eax, eax
jne 0x417c9b
xor bl, bl
mov byte [edi], bl
xor eax, eax
jmp 0x417b0a
call fcn.00419808
int3
Function at 0x417cb0
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x41a140]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x41a62d], 0
push ebx
push esi
push edi
mov esi, ecx
je 0x417cf3
push esi
push 0x104
push dword [ebp + 0xc]
push 0x402334
push 0x402a30
push 0x4029e0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x417e2a
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push esi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jne 0x417d25
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x417e33
movzx eax, ax
or eax, 0x80070000
jmp 0x417e33
call fcn.00419a40
mov ebx, esp
test ebx, ebx
je 0x417e2e
xor eax, eax
push eax
push eax
push edi
push ebx
or edi, 0xffffffff
push edi
push esi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x417d0a
xor eax, eax
push eax
push eax
push eax
push eax
push edi
push 0x4029e0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
je 0x417d0a
call fcn.00419a40
mov eax, esp
mov dword [ebp - 0xc], eax
test eax, eax
je 0x417e2e
xor ecx, ecx
push ecx
push ecx
push esi
push eax
push edi
push 0x4029e0
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x417d0a
xor eax, eax
push eax
push eax
push eax
push eax
push edi
push 0x402a30
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
je 0x417d0a
call fcn.00419a40
mov eax, esp
mov dword [ebp - 8], eax
test eax, eax
je 0x417e2e
xor ecx, ecx
push ecx
push ecx
push esi
push eax
push edi
push 0x402a30
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x417d0a
push 4
pop eax
call fcn.00419a00
mov esi, esp
test esi, esi
je 0x417e2e
mov eax, 0x108
mov byte [esi], 0
call fcn.00419a40
mov edi, esp
test edi, edi
je 0x417e2e
push ebx
mov ebx, 0x104
push ebx
push edi
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ebx
push dword [ebp + 0xc]
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x417d0a
xor eax, eax
jmp 0x417e33
mov eax, 0x8007000e
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419610
leave
ret 0x10
Function at 0x4180a0
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
cmp eax, 0xffffffff
jne 0x4180b7
mov eax, 0x8000ffff
jmp 0x41810f
push edi
xor edi, edi
mov dword [esi], eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
je 0x4180f8
test eax, eax
je 0x41810c
push edi
push eax
push edi
push 2
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 4], eax
test eax, eax
je 0x4180f8
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
test eax, eax
jne 0x41810c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x41810e
movzx eax, ax
or eax, 0x80070000
jmp 0x41810e
xor eax, eax
pop edi
pop esi
pop ebp
ret 8

Function at 0x418efb
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x41a140]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
lea eax, [ebp - 0x44]
mov esi, 0xc04
push eax
push 8
push 0x404
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x418f49
push 3
lea eax, [ebp - 0x44]
push 0x402dd8
push eax
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0xfffff800
add esi, eax
mov ecx, dword [ebp - 4]
mov ax, si
xor ecx, ebp
pop esi
call fcn.00419610
leave
ret

Function at 0x418f5f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x41a140]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp ax, word [0x41a660]
jne 0x418ffb
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 6
push eax
push 1
xor edi, edi
push edi
push 0x402df0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x418ffa
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push 0x402ea8
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x418ffa
push 3
push dword [edi*8 + 0x401648]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x418fec
inc edi
cmp edi, 0x1c
jb 0x418fca
jmp 0x418ffa
mov ax, word [edi*8 + 0x40164c]
mov word [0x41a660], ax
pop edi
mov ecx, dword [ebp - 4]
mov ax, word [0x41a660]
xor ecx, ebp
call fcn.00419610
leave
ret
Function at 0x100c2d0
Capabilities:
Get common file path
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1012288]
mov dword [ebp - 4], eax
mov eax, dword [0x1011030]
test byte [eax + 0x14f9], 1
push ebx
mov ebx, ecx
je 0x100c31a
add eax, 0x6aa
push eax
push 0x30c
add ebx, 0x54
push ebx
push 0x1002a0c
push 0x10029c8
push 0x1001f94
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x100c38d
and dword [ebp - 0x20c], 0
push esi
push edi
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x208]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x1001b64
lea eax, [ebp - 0x20c]
push eax
call esi
push 0x10022b8
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
push 0x30c
add ebx, 0x54
push ebx
push 0x1002a0c
push 0x10029c8
push 0x1002294
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
pop edi
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.0100ecf8
leave
ret

Function at 0x100c3c4
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 4]
mov esi, ecx
push eax
push dword [esi + 0x48]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 4], 0x103
je 0x100c415
push ebx
push edi
push dword [esi + 0x48]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
lea ebx, [esi + 0x44]
push dword [ebx]
call edi
push ebx
push esi
xor eax, eax
push eax
push eax
push eax
push 1
push eax
push eax
add esi, 0x54
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop edi
pop ebx
jmp 0x100c425
push 0
push 0x100c39d
push dword [esi + 0x50]
call dword [sym.imp.USER32.dll_EnumThreadWindows]
pop esi
leave
ret

Function at 0x100eecd
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1002b68
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100ef25
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x100215a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100ef18
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x100ef27
xor eax, eax
pop esi
leave
ret 4

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43200c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x40cc7c
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0040ccff
jae 0x40cc8a
xor ecx, ecx
call fcn.0040ccff
jae 0x40ccb9
xor eax, eax
call fcn.0040ccff
jae 0x40ccc9
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0040ccff
adc al, al
jae 0x40ccab
jne 0x40ccf5
stosb byte es:[edi], al
jmp 0x40cc8d
call fcn.0040cd0b
sub ecx, ebx
jne 0x40ccd2
call fcn.0040cd09
jmp 0x40ccf1
lodsb al, byte [esi]
shr eax, 1
je 0x40cd1b
adc ecx, ecx
jmp 0x40ccee
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.0040cd09
cmp eax, 0x7d00
jae 0x40ccee
cmp ah, 5
jae 0x40ccef
cmp eax, 0x7f
ja 0x40ccf0
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x40cc8d
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x4060b6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004021ba
and dword [ebp - 4], 0
cmp dword [0x40b654], 0
mov ebx, eax
jne 0x406167
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406218
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406218
push eax
call fcn.00402148
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40b654], eax
call esi
push eax
call fcn.00402148
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40b658], eax
call esi
push eax
call fcn.00402148
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40b65c], eax
call esi
push eax
call fcn.00402148
pop ecx
mov dword [0x40b664], eax
test eax, eax
je 0x406167
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402148
pop ecx
mov dword [0x40b660], eax
mov eax, dword [0x40b660]
cmp eax, ebx
je 0x4061bf
cmp dword [0x40b664], ebx
je 0x4061bf
push eax
call fcn.004021c3
push dword [0x40b664]
mov esi, eax
call fcn.004021c3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4061bf
test edi, edi
je 0x4061bf
call esi
test eax, eax
je 0x4061b6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4061b6
test byte [ebp - 0xc], 1
jne 0x4061bf
or dword [ebp + 0x10], 0x200000
jmp 0x4061f8
mov eax, dword [0x40b658]
cmp eax, ebx
je 0x4061f8
push eax
call fcn.004021c3
pop ecx
test eax, eax
je 0x4061f8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4061f8
mov eax, dword [0x40b65c]
cmp eax, ebx
je 0x4061f8
push eax
call fcn.004021c3
pop ecx
test eax, eax
je 0x4061f8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40b654]
call fcn.004021c3
pop ecx
test eax, eax
je 0x406218
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40621a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4012f0
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov ebx, dword [eax]
call sym.___p___argv
mov esi, dword [eax]
call sym.__get_initial_narrow_environment
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
mov eax, dword [edx + 0x3c]
cmp word [edx + eax + 0x5c], 2
sete dl
movzx edx, dl
add edx, 1
mov dword [esp], edx
call sym.__set_app_type
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call dbg.main
mov dword [esp], eax
call sym._exit

Function at 0x4013f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_strlen]
mov esi, eax
xor eax, eax
test esi, esi
je 0x40144b
cmp byte [ebx + esi - 1], 0xa
je 0x40141f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x404084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x401a50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call dbg.__wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x401c20
mov eax, dword fs:[0x18]
mov edi, dword [0x404084]
cmp dword [eax + 0x24], edi
je 0x401c12
test byte [0x402018], 8
jne 0x401bc0
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x402028], 8
jne 0x401b80
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x401b13
cmp esi, 3
ja 0x401b13
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x403114]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.2
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x401b24
mov esi, edx
mov dword [esp + 0xc], edi
mov dword [esp + 4], 1
shr esi, 0x10
test edx, 0x8080
mov dword [esp], ebx
cmove edx, esi
lea esi, [ecx + 2]
mov eax, edx
cmove ecx, esi
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x402028
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x401aae
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x401aae
mov dword [esp], 0x402018
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x401a9b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
mov ecx, eax
lea ebx, [esp + 0x28]
mul edx
mov dword [esp + 4], str._3u._03u:
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x401aa1
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0xffffffff
jmp 0x401b71
Function at 0x401f40
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4204ac
mov eax, dword fs:[0]
push eax
sub esp, 0x408
mov eax, dword [0x427040]
xor eax, esp
mov dword [esp + 0x404], eax
push ebx
push esi
push edi
mov eax, dword [0x427040]
xor eax, esp
push eax
lea eax, [esp + 0x418]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x10], 0x428ec8
mov dword [0x428ef4], ebx
mov dword [0x428ef8], ebx
mov dword [0x428efc], ebx
mov dword [esp + 0x420], ebx
mov dword [0x428f18], 7
mov dword [0x428f14], ebx
mov word [0x428f04], bx
mov byte [esp + 0x420], 1
xor eax, eax
push 0x422d4c
lea ecx, [ebx + 0x20]
mov edi, 0x428ece
mov dword [0x428f1c], ebx
mov dword [0x428ece], eax
mov dword [0x428ed2], eax
mov dword [0x428ed6], eax
mov dword [0x428eda], eax
mov dword [0x428ede], eax
mov dword [0x428ee2], eax
mov dword [0x428ee6], eax
mov dword [0x428eea], eax
call fcn.00401ee0
add esp, 4
call fcn.00403ef0
push 0x3fe
lea eax, [esp + 0x1a]
push ebx
push eax
mov byte [0x428ecd], bl
mov byte [0x428ecc], bl
mov word [esp + 0x20], bx
call fcn.00413e90
add esp, 0xc
push 0x200
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [esp + 0x14]
mov word [esp + 0x1a], bx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x402046
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x18]
push edx
mov esi, 0x428f00
call fcn.004053a0
mov dword [0x428ec8], ebx
mov eax, 0x428ec8
mov ecx, dword [esp + 0x418]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.0041288d
add esp, 0x414
ret
Function at 0x403e10
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x41f8c8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x427040]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x427040]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
xor esi, esi
push 0xffffffffffffffff
add eax, 0x38
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], esi
mov word [esp + 0x14], si
call fcn.00404d90
push 0x11
push str.WindowsGA_OF.dat
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], esi
call fcn.004052d0
mov eax, dword [esp + 0xc]
mov esi, 8
cmp dword [esp + 0x20], esi
jae 0x403e8c
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x403eae
cmp dword [esp + 0x20], esi
jb 0x403eaa
mov eax, dword [esp + 0xc]
push eax
call fcn.004127aa
add esp, 4
xor al, al
jmp 0x403ec3
cmp dword [esp + 0x20], esi
jb 0x403ec1
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004127aa
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0041288d
add esp, 0x2c
ret 4
Function at 0x404350
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x104
mov eax, dword [0x427040]
xor eax, esp
mov dword [esp + 0x100], eax
push esi
push 0xff
lea eax, [esp + 9]
push 0
push eax
mov esi, ecx
mov byte [esp + 0x10], 0
call fcn.00413e90
add esp, 0xc
push esi
push 0x100
lea ecx, [esp + 0xc]
push ecx
push 0x422d4b
push str.LANGUAGE
push str.Language
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 4]
push 0x5c
push edx
call fcn.00413270
mov esi, eax
add esp, 8
test esi, esi
je 0x4043f6
lea eax, [esp + 4]
push 0x2e
push eax
call fcn.00413270
add esp, 8
test eax, eax
je 0x4043f6
mov byte [eax], 0
lea eax, [esi + 1]
mov edx, edi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x4043d2
mov al, 1
pop esi
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0041288d
add esp, 0x104
ret
mov ecx, dword [esp + 0x104]
pop esi
xor ecx, esp
xor al, al
call fcn.0041288d
add esp, 0x104
ret

Function at 0x404410
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x44
mov eax, dword [0x427040]
xor eax, esp
mov dword [esp + 0x40], eax
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
xor eax, eax
push edi
mov esi, ecx
push esi
push 0x20
mov dword [esp + 0x35], eax
mov dword [esp + 0x39], eax
mov dword [esp + 0x3d], eax
mov dword [esp + 0x41], eax
mov dword [esp + 0x45], eax
mov dword [esp + 0x49], eax
mov dword [esp + 0x4d], eax
mov word [esp + 0x51], ax
mov byte [esp + 0x53], al
lea eax, [esp + 0x34]
push eax
push 0x422d4c
push str.AFFI
push str.Version
mov edi, edx
mov byte [esp + 0x44], 0
call ebp
push esi
push 0x20
xor eax, eax
lea ecx, [esp + 0x14]
push ecx
push 0x422fa8
push str.VERSION
push str.Version
mov byte [esp + 0x24], 0
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
mov dword [esp + 0x2d], eax
mov dword [esp + 0x31], eax
mov dword [esp + 0x35], eax
mov dword [esp + 0x39], eax
mov dword [esp + 0x3d], eax
mov word [esp + 0x41], ax
mov byte [esp + 0x43], al
call ebp
lea edx, [esp + 0xc]
push edx
call fcn.00412843
mov esi, eax
lea eax, [esp + 0x30]
push eax
call fcn.00412843
lea ecx, [esi - 1]
add esp, 8
cmp ecx, 0x41
ja case.0x4044dd.8
movzx ecx, byte [ecx + 0x404588]
jmp dword [ecx*4 + 0x404564]
push 0x422fb4
jmp 0x404543
push 0x422fb8
jmp 0x404543
push 0x422fbc
jmp 0x404543
push 0x422fc0
jmp 0x404543
push str.setup
jmp 0x404543
push str.tech
jmp 0x404543
push str.pro_cn
jmp 0x404543
sub eax, 1
je 0x40453e
sub eax, 1
je 0x404537
sub eax, 1
mov ecx, 0x80
je 0x404530
push str.demo
jmp 0x404548
push str.affiunl
jmp 0x404548
push str.affisrv
jmp 0x404543
push str.affipro
mov ecx, 0x80
call fcn.00401ee0
add esp, 4
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebp
xor ecx, esp
mov al, 1
call fcn.0041288d
add esp, 0x44
ret