joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420c70
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x14
push ebx
push esi
lea eax, [esp + 9]
push edi
mov esi, ecx
push eax
mov byte [esp + 0x11], 0
call fcn.00420390
mov ecx, esi
mov bl, al
call fcn.0041f180
mov ecx, dword [esp + 0x24]
mov edi, eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], 0
mov byte [ecx], 0
mov edx, dword [0x4971e8]
push edx
push 0
push str.ExtraReserveBlockNum
push str.Scan
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov byte [esp + 0xe], al
mov eax, dword [esp + 0x28]
test eax, eax
mov byte [esp + 0xf], 0xff
je 0x420cdb
lea eax, [esi + 0xac]
mov dword [esp + 0x28], eax
jmp 0x420ce3
lea ecx, [esp + 0xf]
mov dword [esp + 0x28], ecx
mov cl, byte [esi + 0x16d]
xor al, al
test cl, cl
mov byte [esp + 0x14], al
jbe 0x420dd7
xor dx, dx
push ebp
mov dl, bl
mov word [esp + 0x1c], dx
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
and ecx, 0xff
mov dx, word [esi + ecx*2 + 0x5fee]
add dx, word [esi + ecx*2 + 0x4174]
add edi, edx
mov word [esi + ecx*2 + 0x41f4], di
mov dx, word [esi + 0x16e]
mov ebx, edi
mov ebp, edx
and ebx, 0xffff
and ebp, 0xffff
add ebx, 8
cmp ebp, ebx
jle 0x420d97
mov ebx, dword [esp + 0x2c]
mov dl, byte [ebx]
cmp dl, 0xff
jne 0x420d73
movzx dx, byte [esp + 0x12]
movzx di, byte [esp + 0x11]
add edx, edi
mov byte [ebx], al
add word [esi + ecx*2 + 0x41f4], dx
mov edx, dword [esp + 0x28]
inc byte [edx]
jmp 0x420d9f
cmp dl, al
jne 0x420d8f
movzx bx, byte [esp + 0x11]
movzx dx, byte [esp + 0x12]
add edi, ebx
add edx, edi
mov word [esi + ecx*2 + 0x41f4], dx
mov edx, dword [esp + 0x28]
inc byte [edx]
jmp 0x420d9f
mov word [esi + ecx*2 + 0x41f4], dx
mov edi, dword [esp + 0x14]
xor edx, edx
mov dx, word [esi + ecx*2 + 0x41f4]
xor ecx, ecx
mov cx, word [esi + 0x16e]
sub ecx, edx
add edi, ecx
mov cl, byte [esi + 0x16d]
inc al
mov dword [esp + 0x14], edi
cmp al, cl
mov byte [esp + 0x18], al
jb 0x420d02
mov edi, dword [esp + 0x20]
pop ebp
xor eax, eax
and edi, 0xffff
mov al, byte [esi + 0x172]
imul eax, edi
imul eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8
Function at 0x421bb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45ab9f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
lea ecx, [esp + 4]
mov dword [esp + 0xc], 0
call sub.MFC42.DLL_CString::CString_1
mov al, byte [esi + 0x23]
mov ecx, esi
mov dword [esp + 0x18], 1
mov byte [esp + 8], al
call fcn.004126f0
test eax, eax
je 0x421bfb
mov byte [esp + 8], 0x10
test byte [esp + 0x28], 0x80
je 0x421c38
mov al, byte [esp + 0x24]
mov ecx, dword [esp + 8]
test al, al
jne 0x421c23
mov edx, dword [0x49770c]
and ecx, 0xff
push ecx
push edx
push str._sCTL_02XBIN_
jmp 0x421c4f
mov edx, dword [0x49770c]
and ecx, 0xff
push ecx
push edx
push str._sCTL_02XDGD_BIN_
jmp 0x421c4f
mov ecx, dword [esp + 8]
mov edx, dword [0x49770c]
and ecx, 0xff
push ecx
push edx
push str._sCTL_02XSCAN_BIN_
lea eax, [esp + 0x10]
push eax
call sub.MFC42.DLL_CString::Format
mov esi, dword [esp + 0x30]
add esp, 0x10
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.0045822c
mov dword [esp + 0xc], 1
lea ecx, [esp + 4]
mov byte [esp + 0x18], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 0xc

Function at 0x422140
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45ac30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
push edi
mov esi, ecx
call fcn.004126f0
mov edi, dword [esp + 0x30]
mov ebp, dword [esp + 0x28]
push edi
lea eax, [esp + 0x14]
push ebp
push eax
mov ecx, esi
call fcn.00421bb0
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
mov dword [esp + 0x24], 0
call fcn.0045822c
mov eax, dword [esp + 0x30]
push edi
push eax
lea ecx, [esp + 0x18]
push ebp
push ecx
mov ecx, esi
call fcn.00421ca0
lea edx, [esp + 0xc]
lea eax, [esp + 0x10]
push edx
lea ecx, [esp + 0x34]
push eax
push ecx
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_operator
mov ebp, dword [esp + 0x24]
push eax
mov ecx, ebp
mov byte [esp + 0x20], 2
call fcn.004581c0
lea ecx, [esp + 0x30]
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::CString
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push ebp
call fcn.0045822c
call fcn.00412b60
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x422241
mov eax, dword [esp + 0x34]
test eax, eax
je 0x422241
push eax
push edi
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
call fcn.0045822c
mov ax, word [esi + 0x20]
mov cl, byte [esi + 0x23]
push eax
push ecx
push ecx
mov byte [esp + 0x34], 3
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x49770c
call fcn.0045822c
lea ecx, [esi + 0x100]
mov byte [esp + 0x34], 1
call fcn.00428e40
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
pop edi
mov eax, ebp
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x14
ret 0x14
Function at 0x422280
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46ecc8
push 0x458742
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 0xffffffff
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, 0xffffffff
jne 0x4222e5
mov dword [ebp - 0x24], edi
jmp 0x4223b8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x34], eax
lea edi, [eax + 0x200]
mov dword [ebp - 0x2c], edi
push edi
call sub.MFC42.DLL_operatornew
add esp, 4
mov ebx, eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x1c], ebx
mov ecx, edi
xor eax, eax
mov edi, ebx
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
push 0
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x422339
mov dword [ebp - 0x24], eax
jmp 0x4223b8
mov esi, ebx
mov dword [ebp - 0x38], esi
mov edx, dword [ebp - 0x34]
add edx, 2
mov eax, 0xf0f0f0f1
mul edx
shr edx, 5
mov ecx, edx
shl ecx, 4
mov eax, dword [ebp + 0xc]
and eax, 0xff
shl eax, 9
cmp eax, ecx
jb 0x422364
mov eax, ecx
mov dword [ebp - 0x28], eax
mov ecx, eax
xor eax, eax
mov edi, dword [ebp + 0x10]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov edi, dword [sym.imp.MSVCRT.dll_sscanf]
cmp ebx, dword [ebp - 0x28]
jae 0x4223b5
mov eax, dword [ebp + 0x10]
lea ecx, [ebx + eax]
push ecx
push str._2hx
push esi
call edi
add esp, 0xc
inc ebx
mov dword [ebp - 0x30], ebx
add esi, 2
mov dword [ebp - 0x38], esi
test bl, 0xf
jne 0x422387
add esi, 2
mov dword [ebp - 0x38], esi
jmp 0x422387
mov esi, dword [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
call fcn.004223dd
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x422e40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x90
xor eax, eax
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0x14
mov edx, dword [esi + 0xa8]
lea ebx, [esi + 0x4280]
mov edi, ebx
rep stosd dword es:[edi], eax
mov edi, dword [esi + 8]
shl edx, 0xb
mov al, byte [edi + 0x1b0]
cmp al, 4
jne 0x422ebd
mov eax, 0x1e4
mov edi, ebx
mov ecx, dword [esi + 8]
mov ebx, dword [ecx + 0x1e0]
test ebx, ebx
jne 0x422e96
xor ebx, ebx
mov bx, word [eax + ecx]
mov ecx, edx
shr ecx, 0xa
imul ebx, ecx
jmp 0x422e9f
xor ebx, ebx
mov bx, word [eax + ecx]
shl ebx, 0xb
mov dword [edi], ebx
add eax, 2
add edi, 4
cmp eax, 0x20c
jl 0x422e79
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x90
ret
cmp al, 2
jne 0x422eea
mov edx, dword [edi + 0x1c0]
shl edx, 0xb
mov dword [ebx], edx
mov eax, dword [edi + 0x1bc]
shl eax, 0xb
mov dword [esi + 0x4284], eax
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x90
ret
mov ebx, 0x3c1
mov edi, 0x1e1
mov ecx, 0xf1
mov eax, 0x79
cmp edx, 0x800000
mov dword [esp + 0x4c], 0x1e78
mov dword [esp + 0x50], 0x1e01
mov dword [esp + 0x54], 0x1dce
mov dword [esp + 0x58], 0x1d7e
mov dword [esp + 0x5c], 0x1a18
mov dword [esp + 0x60], 0x170c
mov dword [esp + 0x64], 0x165d
mov dword [esp + 0x68], 0x1334
mov dword [esp + 0x6c], 0x12a2
mov dword [esp + 0x70], 0xf5c
mov dword [esp + 0x74], 0xf01
mov dword [esp + 0x78], 0xed8
mov dword [esp + 0x7c], 0xdac
mov dword [esp + 0x80], 0xb84
mov dword [esp + 0x84], 0x781
mov dword [esp + 0x88], 0x76c
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], edi
mov dword [esp + 0x94], ecx
mov dword [esp + 0x98], eax
mov dword [esp + 0x14], 0xf5c
mov dword [esp + 0x18], 0xf01
mov dword [esp + 0x1c], 0xed8
mov dword [esp + 0x20], 0xe74
mov dword [esp + 0x24], 0xdac
mov dword [esp + 0x28], 0xb84
mov dword [esp + 0x2c], 0x9c4
mov dword [esp + 0x30], 0x781
mov dword [esp + 0x34], 0x76c
mov dword [esp + 0x38], 0x5dc
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], eax
je 0x423027
cmp edx, 0x1000000
je 0x42301c
xor edi, edi
mov byte [esp + 0xf], 0x14
jmp 0x423030
lea edi, [esp + 0x4c]
mov byte [esp + 0xf], 0x14
jmp 0x423030
lea edi, [esp + 0x14]
mov byte [esp + 0xf], 0xe
xor bl, bl
mov byte [esp + 0x10], bl
test edi, edi
je 0x42305c
cmp bl, byte [esp + 0xf]
jae 0x4230c4
mov eax, dword [esp + 0x10]
and eax, 0xff
mov ecx, dword [edi + eax*4]
shl ecx, 0xb
mov dword [esi + eax*4 + 0x4280], ecx
jmp 0x4230b5
mov ecx, dword [esp + 0x10]
mov eax, dword [esi + 0xa8]
and ecx, 0xff
shr eax, cl
cmp eax, 0x10
jb 0x4230c4
lea edx, [eax + eax*2]
lea edx, [edx + edx*4]
shl edx, 7
cmp eax, 0x100
mov dword [esi + ecx*4 + 0x4280], edx
jb 0x4230ae
cmp eax, 0x800
ja 0x423099
add edx, 0x800
jmp 0x4230ae
cmp eax, 0x1000
ja 0x4230a8
add edx, 0x2000
jmp 0x4230ae
add edx, 0x4000
mov dword [esi + ecx*4 + 0x4280], edx
inc bl
cmp bl, 0x14
mov byte [esp + 0x10], bl
jb 0x423036
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x90
ret
Function at 0x423490
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 4]
push 2
push eax
push 1
push esi
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push 0
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
mov eax, esi
pop esi
pop ecx
ret 0xc

Function at 0x4244c0
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
mov esi, ecx
xor bl, bl
cmp byte [esi + 0x10e], 4
jne 0x4244d1
mov bl, 2
mov al, byte [esi + 0x98]
test al, al
je 0x4244de
or bl, 0x40
mov eax, dword [esi + 0x110]
test eax, eax
je 0x4244eb
or bl, 0x80
mov ecx, dword [esi + 8]
mov al, byte [ecx + 0x64]
cmp al, 1
je 0x424516
cmp al, 2
jne 0x424504
cmp byte [esi + 0x131], 1
je 0x424519
jmp 0x424516
cmp byte [esi + 0xe4], 1
je 0x424516
cmp byte [esi + 0x131], 1
je 0x424519
or bl, 0x10
mov al, byte [ecx + 0x78]
test al, al
je 0x424523
and bl, 0xef
mov al, byte [esi + 0xe4]
cmp al, 1
jne 0x424597
mov dl, byte [esi + 0x12f]
test dl, dl
je 0x424593
mov eax, dword [0x4971e8]
push eax
push 0
push str.StableOptimize
push str.FlashModuleMode
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x424556
or bl, 8
cmp byte [esi + 0x23], 0x10
jne 0x42455f
or bl, 8
mov eax, dword [esi + 0x4278]
test eax, eax
je 0x424588
mov dl, byte [eax + 0x2f]
xor ecx, ecx
mov ch, byte [eax + 0x30]
push 0
mov cl, byte [eax + 0x31]
push 0
push edx
push ecx
mov ecx, esi
call fcn.00412db0
cmp al, 0x10
jne 0x424588
or bl, 8
cmp byte [esi + 0x5fc4], 1
jne 0x4245ab
jmp 0x4245a8
cmp al, 1
je 0x4245a8
mov eax, dword [ecx + 0x68]
test eax, eax
jne 0x4245a8
mov al, byte [esi + 0x4699]
test al, al
jbe 0x4245ab
or bl, 8
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x6c]
test ecx, ecx
je 0x4245b8
or bl, 0x20
cmp byte [esi + 0x12a], 1
jne 0x4245c4
or bl, 4
mov ecx, esi
call fcn.0043d5b0
test eax, eax
je 0x4245d2
or bl, 2
mov al, bl
pop esi
pop ebx
ret
Function at 0x424bd0
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x45acd8
push eax
mov dword fs:[0], esp
push ebx
xor eax, eax
mov dword [esp + 0xc], 0
mov al, byte [ecx + 0x23]
add eax, 0xfffffff0
cmp eax, 0x88
ja case.0x424aa5.21
xor edx, edx
mov dl, byte [eax + 0x424b40]
jmp dword [edx*4 + 0x424b28]
mov bl, 0x20
jmp 0x424aec
mov bl, 0x24
jmp 0x424aec
mov bl, byte [esp + 0x14]
neg bl
sbb bl, bl
and bl, 8
add bl, 8
jmp 0x424aec
mov bl, byte [esp + 0x14]
neg bl
sbb bl, bl
and bl, 0x18
add bl, 8
jmp 0x424aec
mov al, byte [esp + 0x14]
test al, al
jne 0x424ae0
mov bl, 0x18
jmp 0x424aec
mov eax, dword [esp + 0x18]
push eax
call 0x424bd0
mov bl, al
lea ecx, [esp + 0x18]
mov dword [esp + 0xc], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 4]
mov al, bl
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 8
lea ecx, [esp + 0x14]
push 0x48d780
push ecx
mov dword [esp + 0x1c], 0xffffffff
call sub.MSVCRT.dll__CxxThrowException
aam 0x4a
inc edx
add byte [edx + ecx*2 + 0x4ab00042], ch
inc edx
add byte [edx + ecx*2 + 0x4ac40042], dh
inc edx
add byte [ecx], dl
dec ebx
inc edx
add byte [eax], al
add eax, 0x50500
add eax, 0x5050505
add eax, 0x5050505
add eax, 0x5050505
add eax, 0x5050505
add eax, 0x5050505
add eax, 0x5050505
add eax, 0x5050505
add eax, 0x5050505
add eax, 0x5050505
add eax, 0x5050505
add eax, 0x5050505
add eax, 0x5050505
add eax, 0x5050505
add eax, 0x5050505
add eax, 0x5050505
add eax, 0x5050505
add eax, 0x5050505
add eax, 0x5050505
add eax, 0x5050505
add eax, 0x5050505
add eax, 0x5050505
add eax, 0x5050505
add eax, 0x5050105
add eax, 0x5050505
add eax, 0x3050205
add eax, 0x5040505
add byte [eax - 0x6f6f6f70], dl
nop
nop
mov eax, dword [esp + 4]
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x424c0c
lea ecx, [esp + 8]
push 0x48d780
push ecx
mov dword [esp + 0x10], 0x40100
call sub.MSVCRT.dll__CxxThrowException
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add edi, 2
mov eax, 0xf0f0f0f1
mul edi
mov eax, edx
pop edi
shr eax, 5
shl eax, 4
add eax, 0x1ff
pop esi
shr eax, 9
ret 4
Function at 0x426e50
Capabilities:
Read .ini file

Disassembly:
xor eax, eax
push ebx
mov ax, word [ecx + 0x122]
mov ecx, dword [0x4971e8]
and eax, 0xfffffc00
push ecx
cmp eax, 0x800
push 0
setge bl
dec ebx
push str.ResSlcBlkNum
and ebx, 0xfffffff6
push str.STLC
add ebx, 0x28
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test al, al
jne 0x426e8d
mov al, bl
pop ebx
ret

Function at 0x426e90
Capabilities:
Read .ini file

Disassembly:
sub esp, 8
or eax, 0xffffffff
push ebp
mov ebp, ecx
push edi
mov edi, dword [esp + 0x14]
mov ecx, 8
rep stosd dword es:[edi], eax
mov al, byte [ebp + 0x592c]
and al, 1
cmp al, 1
jne 0x42702b
cmp byte [ebp + 0x12f], 3
jne 0x42702b
mov al, byte [ebp + 0x16d]
mov byte [esp + 8], 0
test al, al
jbe 0x42701e
push ebx
push esi
mov ecx, ebp
call fcn.00426e50
mov cl, byte [esp + 0x10]
mov dl, byte [ebp + 0xac]
movzx ax, al
cmp cl, dl
mov dword [esp + 0x14], eax
jne 0x426f04
movzx dx, byte [ebp + 0x16d]
lea eax, [eax + edx + 1]
mov dword [esp + 0x14], eax
mov di, word [ebp + 0x16e]
xor edx, edx
xor esi, esi
test di, di
jbe 0x426f4f
mov ecx, dword [esp + 0x10]
and ecx, 0xff
shl ecx, 8
mov eax, esi
and eax, 0xffff
mov ebx, eax
and eax, 7
shr ebx, 3
add ebx, ecx
mov bl, byte [ebx + ebp + 0x173]
test byte [eax + 0x46d6d4], bl
jne 0x426f49
inc edx
cmp dx, word [esp + 0x14]
ja 0x426f4f
inc esi
cmp si, di
jb 0x426f21
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
and edi, 0xff
mov word [ecx + edi*2], si
mov edx, dword [0x4971e8]
push edx
push 0
push str.SeparateSLC
push str.Debug
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebx, eax
mov eax, dword [0x4971e8]
push eax
push 1
push str.CheckSLCBoundary
push str.Debug
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test ebx, ebx
je 0x427004
test eax, eax
je 0x427004
mov al, byte [ebp + 0x12c]
test al, al
jne 0x427004
cmp si, word [ebp + 0x16e]
jae 0x427004
mov ebx, edi
shl ebx, 8
mov eax, esi
and eax, 0xffff
mov ecx, eax
and eax, 7
shr ecx, 3
add ecx, ebx
mov dl, byte [ecx + ebp + 0x173]
mov cl, byte [eax + 0x46d6d4]
test cl, dl
jne 0x426ffa
mov eax, dword [esp + 0x10]
push esi
push eax
mov ecx, ebp
call fcn.00427250
test eax, eax
jne 0x427004
mov edx, dword [esp + 0x1c]
lea ecx, [esi + 1]
mov word [edx + edi*2], cx
inc word [ebp + edi*2 + 0x5fee]
inc esi
cmp si, word [ebp + 0x16e]
jb 0x426fb4
mov al, byte [esp + 0x10]
mov cl, byte [ebp + 0x16d]
inc al
cmp al, cl
mov byte [esp + 0x10], al
jb 0x426ed7
pop esi
pop ebx
pop edi
mov eax, 1
pop ebp
add esp, 8
ret 4
pop edi
xor eax, eax
pop ebp
add esp, 8
ret 4
Function at 0x4275b0
Capabilities:
Read .ini file

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x12e], 0xa2
je 0x4275c2
xor eax, eax
pop esi
ret 8
mov eax, dword [0x4971e8]
push eax
push 0
push str.SeparateSLC
push str.STLC
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
jne 0x4275e2
pop esi
ret 8
mov al, byte [esi + 0x592c]
test al, 6
je 0x4275f2
xor eax, eax
pop esi
ret 8
and al, 1
cmp al, 1
je 0x4275fe
xor eax, eax
pop esi
ret 8
mov cx, word [esi + 0xec]
mov dl, byte [esi + 0xea]
mov al, byte [esi + 0xe4]
push 0x80
push ecx
push edx
push eax
mov ecx, esi
call fcn.0041f1d0
cmp byte [esi + 0x167], 1
je 0x42762f
xor eax, eax
pop esi
ret 8
mov ecx, esi
call fcn.00426e50
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
push ecx
push edx
mov ecx, esi
call fcn.00427a30
test eax, eax
jne 0x427650
pop esi
ret 8
mov dword [esi + 0x6024], 1
mov eax, 1
pop esi
ret 8
Function at 0x431ad0
Capabilities:
Read .ini file

Disassembly:
mov al, byte [ecx + 0x12f]
push ebx
cmp al, 1
mov bl, 2
je 0x431ae1
cmp al, bl
jne 0x431ae3
mov bl, 2
mov eax, dword [0x4971e8]
push eax
push 0
push str.StableOptimize
push str.SCAN
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x431b03
xor al, al
pop ebx
ret
mov al, bl
pop ebx
ret

Function at 0x431b40
Capabilities:
Read .ini file

Disassembly:
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x14
mov al, byte [esi + 0x4699]
lea ebp, [esi + 0x4280]
mov byte [esi + 0x5fcc], al
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
mov ecx, esi
call fcn.00422e40
mov ecx, dword [esi + 8]
mov al, byte [ecx + 0x1b0]
cmp al, 4
je 0x431bb0
cmp al, 2
je 0x431bb0
mov edx, dword [0x4971e8]
push edx
push 0
push str.IgnoreBinCap
push str.Debug
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x431bb0
mov al, byte [esi + 0x5981]
pop edi
mov byte [esi + 0x5fcc], al
pop esi
mov eax, 1
pop ebp
pop ecx
ret 4
xor al, al
push ebx
mov bl, 0x14
mov byte [esp + 0x10], al
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov edx, dword [esi + ecx*4 + 0x4280]
test edx, edx
je 0x431bda
inc al
cmp al, 0x14
mov byte [esp + 0x10], al
jb 0x431bb9
jmp 0x431bdc
mov bl, al
mov dl, byte [esi + 0x5981]
mov edi, dword [esp + 0x18]
push edx
push edi
mov ecx, esi
call fcn.00431ca0
push ebp
push eax
mov ecx, esi
call fcn.00431d90
cmp al, bl
mov byte [esp + 0x18], al
jne 0x431c08
mov al, byte [esi + 0x4699]
jmp 0x431c0a
mov al, 0x10
mov ecx, dword [esi + 8]
mov dl, byte [ecx + 0x1b0]
test dl, dl
jne 0x431c2e
mov ecx, dword [esi + 0x4278]
test ecx, ecx
je 0x431c2e
mov cl, byte [ecx + 0x2c]
test cl, cl
je 0x431c2e
cmp al, cl
ja 0x431c2e
mov al, cl
mov bl, byte [esi + 0x5981]
mov dword [esi + 0x7860], 0
cmp al, bl
mov byte [esp + 0x10], al
jae 0x431c7c
mov edx, dword [esp + 0x10]
mov ecx, esi
push edx
push edi
call fcn.00431ca0
push ebp
push eax
mov ecx, esi
call fcn.00431d90
cmp al, byte [esp + 0x18]
je 0x431c78
mov al, byte [esp + 0x10]
mov cl, byte [esi + 0x5981]
inc al
cmp al, cl
mov byte [esp + 0x10], al
jb 0x431c46
jmp 0x431c7c
mov bl, byte [esp + 0x10]
mov cl, byte [esi + 0x5fcc]
mov eax, 1
cmp bl, cl
mov dword [esi + 0x7860], eax
je 0x431c97
mov byte [esi + 0x5fcc], bl
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret 4
Function at 0x4369b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ax, word [esi + 0x124]
mov edx, dword [esi + 8]
mov cl, byte [esi + 0x121]
mov bp, word [esi + 0x122]
mov word [esp + 0x18], ax
mov ax, word [edx + 0x420]
cmp ax, 2
mov byte [esp + 0x13], cl
jae 0x4369eb
mov eax, 2
and ebp, 0xffff
and eax, 0xffff
imul eax, ebp
cdq
and edx, 0x7ff
add eax, edx
sar eax, 0xb
inc eax
and eax, 0xfffe
cmp eax, 8
jge 0x436a15
mov eax, 8
xor edx, edx
mov ebx, 4
mov dl, byte [esi + 0x151]
shl edx, 1
cmp edx, 4
jl 0x436a2b
mov ebx, edx
cmp edx, 4
mov edi, 4
jl 0x436a37
mov edi, edx
cmp edx, 4
mov esi, 4
jl 0x436a43
mov esi, edx
and eax, 0xffff
lea eax, [eax + ebx - 1]
cdq
idiv edi
movzx di, cl
mov ebx, eax
mov eax, ebp
imul ebx, esi
mov ecx, ebx
imul edi, ebx
cdq
and ecx, 0xffff
mov dword [esp + 0x24], edi
idiv ecx
mov dword [esp + 0x1c], ecx
mov esi, eax
mov eax, edi
and eax, 0xffff
or esi, 1
shl eax, 1
push eax
sub esi, 2
call sub.MFC42.DLL_operatornew
mov ecx, dword [esp + 0x30]
add esp, 4
mov dword [ecx], eax
Function at 0x43d220
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, ecx
xor ebp, ebp
xor eax, eax
mov word [esi], bp
mov ax, word [edi + 0x16e]
mov ecx, eax
mov eax, 0x200
cdq
shr ecx, 3
idiv ecx
xor edx, edx
mov dl, byte [edi + 0x16d]
mov ecx, eax
push ecx
lea eax, [edx + ecx - 1]
mov dword [esp + 0x18], esp
cdq
idiv ecx
mov ecx, esp
mov word [esi + 2], ax
lea eax, [edi + 0x46c0]
push eax
call fcn.0045822c
mov ebx, 1
mov ecx, edi
push ebx
call fcn.00424a70
xor cx, cx
mov word [esi + 6], bp
mov cl, al
mov word [esi + 4], cx
mov al, byte [edi + 0x12f]
cmp al, 3
jne 0x43d295
mov word [esi + 6], bx
mov word [esi + 8], bp
mov al, byte [edi + 0x168]
cmp al, bl
jne 0x43d2a7
mov word [esi + 8], bx
mov word [esi + 0xa], bp
mov word [esi + 0xc], bp
mov al, byte [edi + 0x167]
cmp al, bl
je 0x43d2f1
cmp al, 3
je 0x43d2f1
cmp al, 2
je 0x43d2c5
cmp al, 4
jne 0x43d2fd
mov al, byte [edi + 0x5934]
imul byte [edi + 0x152]
imul byte [edi + 0x121]
imul byte [edi + 0x2c]
and eax, 0xff
add eax, 3
cdq
and edx, 3
add eax, edx
sar eax, 2
mov word [esi + 0xc], ax
jmp 0x43d2fd
movzx dx, byte [edi + 0x16d]
mov word [esi + 0xc], dx
mov ecx, dword [esp + 0x18]
xor eax, eax
cmp ecx, ebp
je 0x43d3aa
mov ecx, edi
call fcn.0043d600
mov byte [esp + 0x14], al
xor eax, eax
mov ecx, dword [esp + 0x14]
mov ax, word [esi]
and ecx, 0xff
lea eax, [eax + ecx - 1]
cdq
idiv ecx
xor edx, edx
mov dx, word [esi + 2]
mov edi, eax
lea eax, [edx + ecx - 1]
cdq
idiv ecx
mov word [esi], di
mov ebx, eax
xor eax, eax
mov ax, word [esi + 4]
mov word [esi + 2], bx
lea eax, [eax + ecx - 1]
cdq
idiv ecx
xor edx, edx
mov dx, word [esi + 6]
mov ebp, eax
lea eax, [edx + ecx - 1]
cdq
idiv ecx
mov word [esi + 4], bp
mov dword [esp + 0x18], eax
mov word [esi + 6], ax
xor eax, eax
mov ax, word [esi + 8]
lea eax, [eax + ecx - 1]
cdq
idiv ecx
xor edx, edx
mov dx, word [esi + 0xa]
mov dword [esp + 0x14], eax
mov word [esi + 8], ax
lea eax, [edx + ecx - 1]
cdq
idiv ecx
mov edx, dword [esp + 0x18]
mov ecx, eax
mov eax, dword [esp + 0x14]
add eax, ebp
mov word [esi + 0xa], cx
add eax, edx
add eax, ebx
add eax, edi
add eax, ecx
add ax, word [esi + 0xc]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x441bf0
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 8]
mov esi, eax
call sub.MFC42.DLL_CString::CString
mov eax, esi
pop esi
ret 4