joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4334d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5d8c19
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x6d26f8]
xor eax, esp
mov dword [esp + 0x6c], eax
push ebx
push esi
push edi
mov eax, dword [0x6d26f8]
xor eax, esp
push eax
lea eax, [esp + 0x84]
mov dword fs:[0], eax
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x9c]
mov edx, dword [esp + 0x98]
xor ebx, ebx
mov dword [esp + 0x20], eax
xor esi, esi
xor eax, eax
xor edi, edi
mov dword [esp + 0x24], ebx
cmp ecx, ebx
ja 0x433535
cmp edx, 0x400
jb 0x433559
cmp esi, 5
jae 0x433559
mov eax, edx
shrd edx, ecx, 0xa
shr ecx, 0xa
and eax, 0x3ff
xor edi, edi
inc esi
cmp ecx, ebx
ja 0x433535
jb 0x433559
cmp edx, 0x400
jae 0x433535
mov dword [esp + 0x14], eax
mov eax, edi
and eax, 0x7fffffff
mov dword [esp + 0x18], eax
fild qword [esp + 0x14]
mov dword [esp + 0x14], ebx
and edi, 0x80000000
mov dword [esp + 0x18], edi
fild qword [esp + 0x14]
mov eax, ecx
mov dword [esp + 0x14], edx
fchs
and ecx, 0x7fffffff
faddp st(1)
mov dword [esp + 0x18], ecx
and eax, 0x80000000
fmul qword [0x6a3ec8]
fild qword [esp + 0x14]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ebx
fild qword [esp + 0x14]
fchs
faddp st(1)
faddp st(1)
fld qword [0x6a3e80]
fmul st(1), st(0)
fxch st(1)
fadd qword [0x6a3e78]
call fcn.00598df0
mov dword [esp + 0x14], eax
fidivr dword [esp + 0x14]
sub esp, 8
lea ecx, [esp + 0x4c]
fstp qword [esp]
push ecx
call fcn.004333f0
add esp, 0xc
mov dword [esp + 0x8c], 1
push 0x69a00c
push eax
lea edx, [esp + 0x30]
push edx
call fcn.0043f2b0
add esp, 0xc
mov byte [esp + 0x8c], 2
mov ecx, dword [esi*4 + 0x6d754c]
push ecx
push eax
lea edx, [esp + 0x68]
push edx
call fcn.0043f2b0
add esp, 0xc
mov byte [esp + 0x8c], 4
mov esi, 0x10
cmp dword [esp + 0x40], esi
jb 0x43363f
mov eax, dword [esp + 0x2c]
push eax
call fcn.0059392f
add esp, 4
mov edi, 0xf
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
mov byte [esp + 0x8c], 5
cmp dword [esp + 0x5c], esi
jb 0x43366b
mov ecx, dword [esp + 0x48]
push ecx
call fcn.0059392f
add esp, 4
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x5c], edi
mov dword [esp + 0x58], ebx
mov byte [esp + 0x48], bl
cmp dword [esp + 0x78], esi
jae 0x433685
lea ecx, [esp + 0x64]
lea edx, [esp + 0x14]
push edx
call fcn.0040b670
mov byte [esp + 0x8c], 6
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.00429380
add esp, 8
mov dword [esp + 0x24], 1
mov byte [esp + 0x8c], 5
lea ecx, [esp + 0x14]
call fcn.0040b720
mov byte [esp + 0x8c], bl
cmp dword [esp + 0x78], esi
jb 0x4336dc
mov edx, dword [esp + 0x64]
push edx
call fcn.0059392f
add esp, 4
mov dword [esp + 0x78], edi
mov dword [esp + 0x74], ebx
mov byte [esp + 0x64], bl
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x84]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c]
xor ecx, esp
call fcn.0059393a
add esp, 0x80
ret
Function at 0x433710
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x5d63a8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push edi
mov eax, dword [0x6d26f8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.Wow64DisableWow64FsRedirection
push str.kernel32.dll
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
test eax, eax
je 0x433770
lea ecx, [esp + 0x18]
push ecx
call eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], 0
lea edx, [esp + 0x14]
push edx
call fcn.00499170
mov byte [esp + 0x2c], 1
push eax
lea eax, [esp + 0x18]
push eax
mov ebx, 0x69a010
call fcn.004176f0
add esp, 0xc
mov byte [esp + 0x28], 2
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne bl
mov byte [esp + 0x28], 1
lea ecx, [esp + 0x10]
call fcn.0040b950
mov byte [esp + 0x28], 0
lea ecx, [esp + 0x14]
call fcn.0040b950
mov dword [esp + 0x28], 0xffffffff
cmp dword [esp + 0x1c], 0
je 0x4337f2
push str.Wow64RevertWow64FsRedirection
push str.kernel32.dll
call edi
push eax
call ebp
test eax, eax
je 0x4337f2
mov ecx, dword [esp + 0x18]
push ecx
call eax
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x433810
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x5cc6e9
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6d26f8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor ebp, ebp
mov dword [esp + 0x30], ebp
mov esi, ecx
mov dword [esp + 0x20], ebp
lea edi, [esi + 4]
xor eax, eax
mov dword [esp + 0x14], 2
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebp
mov dword [esp + 0x24], esi
mov word [edi], ax
mov dword [esp + 0x30], ebp
lea ecx, [esp + 0x18]
push ecx
push 1
push ebp
push str.SYSTEMCurrentControlSetControlSession_Manager
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x34], 1
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x433946
cmp dword [esi + 0x18], 8
jb 0x43389f
mov eax, dword [edi]
jmp 0x4338a1
mov eax, edi
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
push eax
lea eax, [esp + 0x24]
push eax
push ebp
push str.BootExecute
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
jne 0x43390a
mov ebx, dword [esp + 0x14]
mov ecx, dword [esi + 0x14]
inc ebx
cmp ebx, ecx
ja 0x4338da
or eax, 0xffffffff
call fcn.0040b3a0
jmp 0x4338e6
mov eax, ebx
push ebp
sub eax, ecx
mov ebx, esi
call fcn.00439b50
cmp dword [esi + 0x18], 8
jb 0x4338ee
mov edi, dword [edi]
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
push edi
lea eax, [esp + 0x24]
push eax
push ebp
push str.BootExecute
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x433934
mov eax, dword [esp + 0x1c]
cmp eax, 1
je 0x433921
cmp eax, 2
je 0x433921
cmp eax, 7
jne 0x433934
mov eax, dword [esp + 0x14]
cmp eax, ebp
jbe 0x433934
shr eax, 1
mov ecx, esi
call fcn.004377a0
jmp 0x43393b
mov eax, esi
call fcn.0040b510
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x433960
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x5d6353
mov eax, dword fs:[0]
push eax
sub esp, 0x47c
mov eax, dword [0x6d26f8]
xor eax, esp
mov dword [esp + 0x474], eax
push ebx
push esi
push edi
mov eax, dword [0x6d26f8]
xor eax, esp
push eax
lea eax, [esp + 0x48c]
mov dword fs:[0], eax
lea eax, [esp + 0x1c]
push eax
call fcn.00449770
mov dword [esp + 0x494], 0
nop
mov eax, dword [esp + 0x250]
mov byte [esp + 0x24c], 0
cmp eax, 0xffffffff
je 0x4339f4
cmp byte [esp + 0x1c], 0
jne 0x4339dd
lea ecx, [esp + 0x20]
push ecx
push eax
mov byte [esp + 0x24], 1
call sub.KERNEL32.dll_Process32FirstW
jmp 0x4339e8
lea edx, [esp + 0x20]
push edx
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x4339f4
mov byte [esp + 0x24c], 1
cmp byte [esp + 0x24c], 0
mov ecx, 0x8c
lea esi, [esp + 0x20]
lea edi, [esp + 0x254]
rep movsd dword es:[edi], dword [esi]
je 0x433af4
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x258]
call fcn.00426c10
mov byte [esp + 0x494], 1
mov eax, dword [eax]
push str.TrustedInstaller.exe
push eax
call fcn.00593c0f
add esp, 8
test eax, eax
sete bl
mov byte [esp + 0x494], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x433a6a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x4339b0
mov edx, dword [esp + 0x25c]
lea ecx, [esp + 0x14]
push ecx
push edx
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x433ac7
mov eax, dword [esp + 0x49c]
cmp eax, 0xffffffff
je 0x433aa7
cmp dword [esp + 0x14], eax
jne 0x4339b0
mov esi, dword [esp + 0x25c]
mov dword [esp + 0x494], 0xffffffff
lea eax, [esp + 0x1c]
push eax
call fcn.00449810
mov eax, esi
jmp 0x433b0c
cmp dword [0x6d138c], 3
jl 0x4339b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WD_ProcessIdToSessionId_error:__i
push str.Helper::getTIPidFromCurrentProcesses
push 3
call fcn.00552bc2
add esp, 0x10
jmp 0x4339b0
mov dword [esp + 0x494], 0xffffffff
lea ecx, [esp + 0x1c]
push ecx
call fcn.00449810
or eax, 0xffffffff
mov ecx, dword [esp + 0x48c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x474]
xor ecx, esp
call fcn.0059393a
add esp, 0x488
ret
Function at 0x433bb0
Capabilities:
Modify service

Disassembly:
push 0xffffffffffffffff
push 0x5c6e50
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x6d26f8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebx, 1
cmp dword [0x6d138c], ebx
jl 0x433bf6
push str.WD_service_stage1
push str.Helper::runManualService
push ebx
call fcn.00552bc2
add esp, 0xc
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x28], 0
test esi, esi
je 0x433d1a
cmp dword [0x6d138c], ebx
jl 0x433c36
push str.WD_service_stage2
push str.Helper::runManualService
push ebx
call fcn.00552bc2
add esp, 0xc
push 3
push str.TrustedInstaller
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
mov dword [esp + 0x1c], edi
mov byte [esp + 0x28], bl
test edi, edi
je 0x433ce1
cmp dword [0x6d138c], ebx
jl 0x433c71
push str.WD_service_stage3
push str.Helper::runManualService
push ebx
call fcn.00552bc2
add esp, 0xc
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 0xffffffff
call fcn.00433b40
add esp, 4
test al, al
je 0x433d03
cmp dword [esp + 0x14], 4
jne 0x433d03
cmp dword [0x6d138c], ebx
jl 0x433cac
push str.WD_service_stage4
push str.Helper::runManualService
push ebx
call fcn.00552bc2
add esp, 0xc
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 3
push 0xffffffffffffffff
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x433d03
cmp dword [0x6d138c], ebx
jl 0x433d03
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WD_ChangeServiceConfig__i
jmp 0x433cf5
cmp dword [0x6d138c], ebx
jl 0x433d03
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WD_OpenService__i
push str.Helper::runManualService
push ebx
call fcn.00552bc2
add esp, 0x10
call fcn.0042b840
mov byte [esp + 0x28], 0
test edi, edi
je 0x433d3c
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x433d3c
cmp dword [0x6d138c], ebx
jl 0x433d3c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WD_OpenSCManager__i
push str.Helper::runManualService
push ebx
call fcn.00552bc2
add esp, 0x10
mov dword [esp + 0x28], 0xffffffff
test esi, esi
je 0x433d4f
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x434b10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5c89d8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x6d26f8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0x38], 0
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0xc]
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x434b82
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x40]
call fcn.0040b950
mov eax, esi
mov edx, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x40]
call fcn.0040b950
xor eax, eax
xor edx, edx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret

Function at 0x434cd0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x5cf9b8
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push edi
mov eax, dword [0x6d26f8]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov ebx, 1
mov dword [esp + 0x6c], ebx
push 0x44
lea eax, [esp + 0x24]
push 0
push eax
call fcn.005985f0
xor eax, eax
add esp, 0xc
lea edx, [esp + 0xc]
xor ecx, ecx
push edx
mov dword [esp + 0x24], 0x44
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x50], ebx
mov word [esp + 0x54], cx
call fcn.0040b7e0
mov byte [esp + 0x6c], 2
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
push eax
push ecx
push str.__s___s
lea edi, [esp + 0x18]
call fcn.00421d60
mov eax, dword [esp + 0x18]
add esp, 0xc
cmp dword [eax - 4], ebx
jle 0x434d77
mov edx, dword [eax - 0xc]
push edx
mov eax, edi
push eax
call fcn.0040db00
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x434dda
mov byte [esp + 0x6c], bl
lea ecx, [esp + 0xc]
call fcn.0040b950
mov byte [esp + 0x6c], 0
lea ecx, [esp + 0x74]
call fcn.0040b950
mov dword [esp + 0x6c], 0xffffffff
lea ecx, [esp + 0x78]
call fcn.0040b950
xor eax, eax
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x64
ret
mov byte [esp + 0x6c], bl
lea ecx, [esp + 0xc]
call fcn.0040b950
mov byte [esp + 0x6c], 0
lea ecx, [esp + 0x74]
call fcn.0040b950
mov dword [esp + 0x6c], 0xffffffff
lea ecx, [esp + 0x78]
call fcn.0040b950
mov eax, ebx
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x64
ret
Function at 0x435350
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x5c89b0
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x6d26f8]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov dword [esp + 0x10], 1
cmp byte [0x6eaed0], 0
mov dword [esp + 4], 0
je 0x435396
cmp byte [esp + 0x24], 0
mov eax, 0x102
jne 0x43539b
mov eax, 2
mov edx, dword [esp + 0x18]
push 0
lea ecx, [esp + 8]
push ecx
push 0
push eax
push 0
push 0
push 0
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4353e5
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 4]
push 4
lea eax, [esp + 0x24]
push eax
push 4
push ecx
push 0
push edx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [esp + 0x10], 0
lea ecx, [esp + 0x18]
call fcn.0040b950
mov dword [esp + 0x10], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.0040b950
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret

Function at 0x4355c0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x5d2e78
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x6d26f8]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
lea eax, [esp + 4]
push eax
mov ecx, str.SoftwareVibraniumHomeGlobal
call fcn.0040b8a0
mov dword [esp + 0x10], 0
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx]
mov ecx, dword [eax - 0xc]
lea edx, [ecx + ecx]
push edx
push eax
mov eax, dword [esp + 0xc]
push 1
push str.Renewed
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [esp + 0x10], 0xffffffff
lea ecx, [esp + 4]
call fcn.0040b950
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret
Function at 0x435640
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x5d2e3d
mov eax, dword fs:[0]
push eax
sub esp, 0x814
mov eax, dword [0x6d26f8]
xor eax, esp
mov dword [esp + 0x810], eax
push ebx
mov eax, dword [0x6d26f8]
xor eax, esp
push eax
lea eax, [esp + 0x81c]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x824], ebx
push esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebx
call fcn.0040b7e0
mov dword [esp + 0x824], ebx
lea eax, [esp + 0xc]
push eax
mov ecx, str.SoftwareVibraniumHomeGlobal
mov dword [esp + 0x14], 1
call fcn.0040b8a0
mov dword [esp + 0x824], 1
push 0x7fe
lea edx, [esp + 0x1e]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x24], cx
call fcn.005985f0
mov edx, dword [esp + 0x18]
add esp, 0xc
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebx
push str.Renewed
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0x400
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x435731
mov eax, dword [esp + 8]
shr eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0x18], cx
lea eax, [esp + 0x18]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x435712
sub eax, edx
sar eax, 1
lea edx, [esp + 0x18]
mov ebx, eax
push edx
mov eax, esi
call fcn.0040f6d0
xor ebx, ebx
mov byte [esp + 0x824], bl
lea ecx, [esp + 0xc]
call fcn.0040b950
mov eax, esi
mov ecx, dword [esp + 0x81c]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x810]
xor ecx, esp
call fcn.0059393a
add esp, 0x820
ret
Function at 0x441b30
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x5cf71b
mov eax, dword fs:[0]
push eax
sub esp, 0x808
mov eax, dword [0x6d26f8]
xor eax, esp
mov dword [esp + 0x804], eax
push ebx
mov eax, dword [0x6d26f8]
xor eax, esp
push eax
lea eax, [esp + 0x810]
mov dword fs:[0], eax
push esi
mov dword [esp + 0xc], esi
call fcn.0040b7e0
mov dword [esp + 0x818], 0
push 0x400
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0xc]
push 0x5c
push ecx
call fcn.005963a5
add esp, 8
xor edx, edx
mov word [eax], dx
lea eax, [esp + 0xc]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x441bb0
sub eax, edx
sar eax, 1
lea ecx, [esp + 0xc]
mov ebx, eax
push ecx
mov eax, esi
call fcn.0040f6d0
push 9
push 0x69a86c
push esi
call fcn.00412100
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x441bee
mov byte [0x6ea5b0], 1
mov dword [esp + 0x818], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x810]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.0059393a
add esp, 0x814
ret

Function at 0x441c20
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x5d2ac2
mov eax, dword fs:[0]
push eax
sub esp, 0x80c
mov eax, dword [0x6d26f8]
xor eax, esp
mov dword [esp + 0x808], eax
mov eax, dword [0x6d26f8]
xor eax, esp
push eax
lea eax, [esp + 0x810]
mov dword fs:[0], eax
mov eax, dword [esp + 0x820]
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp + 0x818], 2
mov eax, dword [eax]
mov ecx, dword [esp + 0x828]
mov edx, dword [esp + 0x824]
push eax
push 0x400
lea eax, [esp + 0x14]
push eax
push ecx
push edx
push str.SETTINGS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
lea ecx, [esp + 0x10]
call fcn.0040b8a0
mov eax, 1
mov dword [esp + 4], eax
mov byte [esp + 0x818], al
lea ecx, [esp + 0x824]
call fcn.0040b950
mov byte [esp + 0x818], 0
lea ecx, [esp + 0x828]
call fcn.0040b950
mov eax, esi
mov ecx, dword [esp + 0x810]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.0059393a
add esp, 0x818
ret 0xc

Function at 0x441d00
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x5c87f8
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x6d26f8]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov dword [esp + 0x10], 0
mov eax, dword [0x6ebc08]
mov edx, dword [esp + 0x18]
push eax
push ecx
push edx
push str.SETTINGS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
mov dword [esp + 0x10], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.0040b950
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 4
Function at 0x442c30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d89d2
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x6d26f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
push 0x69a914
push 0x4e28
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x442e28
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
mov dword [ebp - 0x48], esi
mov byte [ebp - 4], 1
test eax, eax
je 0x442e19
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x442e19
push edi
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00495b40
add esp, 0xc
mov byte [ebp - 4], 2
lea eax, [ebp - 0x3c]
call fcn.004428e0
test al, al
jne 0x442e0d
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax + 4]
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.0043b930
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x60]
push ecx
call fcn.0041d3b0
mov byte [ebp - 4], 4
lea edx, [ebp - 0x34]
push edx
mov ecx, 0x69a920
call fcn.0040b670
mov bl, 5
mov byte [ebp - 4], bl
cmp dword [ebp - 0x18], 0x10
mov ecx, dword [ebp - 0x2c]
jae 0x442d19
lea ecx, [ebp - 0x2c]
lea eax, [ebp - 0x38]
push eax
call fcn.0040b670
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x38]
push edx
lea eax, [ebp - 0x60]
push eax
call fcn.00442ae0
add esp, 0xc
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x38]
call fcn.0040b720
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x34]
call fcn.0040b720
xor edi, edi
mov dword [ebp - 0x44], edi
mov ecx, dword [ebp - 0x50]
sub ecx, dword [ebp - 0x54]
sar ecx, 2
cmp edi, ecx
jae 0x442df1
lea esi, [ebp - 0x60]
call fcn.00467500
xor ecx, ecx
mov edx, 0x69a928
mov esi, eax
call fcn.004262c0
mov ebx, eax
test ebx, ebx
jle 0x442deb
lea eax, [ebx + 1]
lea edx, [ebp - 0x40]
push edx
lea esi, [ebp - 0x60]
mov dword [ebp - 0x34], eax
call fcn.00467500
push eax
mov eax, dword [ebp - 0x34]
mov edx, eax
call fcn.00445380
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 7
lea eax, [ebp - 0x38]
push eax
call fcn.00467500
mov ecx, ebx
mov edx, eax
call fcn.004453f0
mov byte [ebp - 4], 8
push 0x6eae80
mov ecx, eax
call fcn.004457e0
mov ebx, eax
mov eax, dword [ebp - 0x34]
call fcn.0040d9a0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x38]
call fcn.0040b720
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x40]
call fcn.0040b720
inc edi
jmp 0x442d53
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x60]
push ecx
call fcn.0041d420
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x30]
call fcn.0040ac60
mov esi, dword [ebp - 0x48]
mov byte [ebp - 4], 1
lea ebx, [ebp - 0x3c]
call fcn.004b7990
mov byte [ebp - 4], 0
test esi, esi
je 0x442e28
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0059393a
mov esp, ebp
pop ebp
ret