joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e160
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f58b
mov eax, dword fs:[0]
push eax
sub esp, 0x160
mov eax, dword [0x4745a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, ecx
cmp dword [esi + 0x6c], 0
mov dword [ebp - 0x11c], eax
je 0x40e29a
push 0x4649dc
lea ecx, [ebp - 0x16c]
call fcn.00402de0
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push edi
push 0x104
lea edx, [ebp - 0x118]
push edx
push 0x46c3e8
push str.DAMIP
lea ecx, [ebp - 0x16c]
push 0x4662d0
mov dword [ebp - 4], 0
mov dword [esi + 0x6c], ecx
call ebx
lea eax, [ebp - 0x118]
push eax
push str.damIP
mov ecx, esi
call fcn.00406dc0
push edi
push 0x104
lea ecx, [ebp - 0x118]
push ecx
push 0x46c3e8
push str.DAMIPv6
push 0x4662d0
call ebx
lea edx, [ebp - 0x118]
push edx
push str.damIPv6
mov ecx, esi
call fcn.00406dc0
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push edi
push 0xffffffffffffffff
push str.DAMPort
push 0x4662d0
call ebx
cmp eax, 0xffffffff
je 0x40e255
push eax
push str.damPort
mov ecx, esi
call fcn.00407040
push edi
push 0xffffffffffffffff
push str.Customize
push 0x4662d0
call ebx
cmp eax, 0xffffffff
je 0x40e276
push eax
push str.customize
mov ecx, esi
call fcn.00407040
mov ecx, dword [ebp - 0x11c]
lea eax, [ebp - 0x16c]
push eax
call fcn.00402720
lea ecx, [ebp - 0x16c]
mov dword [ebp - 4], 0xffffffff
call fcn.00402fa0
push 1
mov ecx, esi
call fcn.00407280
movzx eax, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439bf4
mov esp, ebp
pop ebp
ret 8
Function at 0x40e2d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f5cb
mov eax, dword fs:[0]
push eax
sub esp, 0x160
mov eax, dword [0x4745a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, ecx
cmp dword [edi + 0x6c], 0
mov dword [ebp - 0x11c], eax
je 0x40e4a4
push 0x464944
lea ecx, [ebp - 0x16c]
call fcn.00402de0
push esi
push 0x104
lea edx, [ebp - 0x118]
push edx
push 0x46c3e8
push str.CustomizeProxyIP
lea ecx, [ebp - 0x16c]
push 0x466358
mov dword [ebp - 4], 0
mov dword [edi + 0x6c], ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x118]
push eax
push str.customizeProxyIP
mov ecx, edi
call fcn.00406dc0
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push esi
push 0xffffffffffffffff
push str.CustomizeProxyPort
push 0x466358
call ebx
cmp eax, 0xffffffff
je 0x40e392
push eax
push str.customizeProxyPort
mov ecx, edi
call fcn.00407040
push esi
push 0x104
lea ecx, [ebp - 0x118]
push ecx
push 0x46c3e8
push str.CustomizeProxyIPBak
push 0x466358
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x118]
push edx
push str.customizeProxyIPBak
mov ecx, edi
call fcn.00406dc0
push esi
push 0xffffffffffffffff
push str.CustomizeProxyPortBak
push 0x466358
call ebx
cmp eax, 0xffffffff
je 0x40e3e8
push eax
push str.customizeProxyPortBak
mov ecx, edi
call fcn.00407040
push esi
push 0xffffffffffffffff
push str.MakeSetup
push 0x466358
call ebx
cmp eax, 0xffffffff
je 0x40e409
push eax
push str.makeSetup
mov ecx, edi
call fcn.00407040
push esi
push 0xffffffffffffffff
push str.MakeUpdate
push 0x466358
call ebx
cmp eax, 0xffffffff
je 0x40e42a
push eax
push str.makeUpdate
mov ecx, edi
call fcn.00407040
push esi
push 0xffffffffffffffff
push str.TRMUninstall
push 0x466358
call ebx
cmp eax, 0xffffffff
je 0x40e44b
push eax
push str.trmUninstall
mov ecx, edi
call fcn.00407040
push esi
push 0x104
lea eax, [ebp - 0x118]
push eax
push 0x46c3e8
push str.TRMUninstallPass
push 0x466358
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x118]
push ecx
push str.trmUninstallPass
mov ecx, edi
call fcn.00406dc0
mov ecx, dword [ebp - 0x11c]
lea edx, [ebp - 0x16c]
push edx
call fcn.00402720
lea ecx, [ebp - 0x16c]
mov dword [ebp - 4], 0xffffffff
call fcn.00402fa0
push 1
mov ecx, edi
call fcn.00407280
movzx eax, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439bf4
mov esp, ebp
pop ebp
ret 8
Function at 0x40ea40
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f6b6
mov eax, dword fs:[0]
push eax
sub esp, 0x2bc
mov eax, dword [0x4745a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, ecx
mov eax, dword [edi + 0x6c]
xor ebx, ebx
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x224], eax
cmp eax, ebx
je 0x40eb9c
push str.exceptDevs
lea ecx, [ebp - 0x278]
call fcn.00402de0
push esi
push 0xffffffffffffffff
push str.DevsCount
lea eax, [ebp - 0x278]
push str.ExceptDevs
mov dword [ebp - 4], ebx
mov dword [edi + 0x6c], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 0xffffffff
je 0x40eac2
mov ebx, eax
xor esi, esi
test ebx, ebx
je 0x40eb6e
lea esp, [esp]
push str.devItem
lea ecx, [ebp - 0x2c8]
call fcn.00402de0
push esi
push str.DevName.
lea edx, [ebp - 0x118]
lea ecx, [ebp - 0x2c8]
push 0x466404
push edx
mov byte [ebp - 4], 1
mov dword [edi + 0x6c], ecx
call fcn.0043ac3a
mov eax, dword [ebp - 0x228]
add esp, 0x10
push eax
push 0x104
lea ecx, [ebp - 0x220]
push ecx
push 0x46c3e8
lea edx, [ebp - 0x118]
push edx
push str.ExceptDevs
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x220]
push eax
push str.devName
mov ecx, edi
call fcn.00406e90
lea ecx, [ebp - 0x2c8]
push ecx
lea ecx, [ebp - 0x278]
call fcn.00402720
lea ecx, [ebp - 0x2c8]
mov byte [ebp - 4], 0
call fcn.00402fa0
inc esi
cmp esi, ebx
jb 0x40ead0
mov esi, dword [ebp - 0x224]
lea edx, [ebp - 0x278]
mov eax, edx
push eax
mov ecx, esi
mov dword [edi + 0x6c], edx
call fcn.00402720
lea ecx, [ebp - 0x278]
mov dword [edi + 0x6c], esi
mov dword [ebp - 4], 0xffffffff
call fcn.00402fa0
push 1
mov ecx, edi
call fcn.00407280
movzx eax, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439bf4
mov esp, ebp
pop ebp
ret 4
Function at 0x40ed50
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f72b
mov eax, dword fs:[0]
push eax
sub esp, 0x160
mov eax, dword [0x4745a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
push 0xffffffffffffffff
push str.FuncComponents
push str.Components
mov edi, ecx
mov dword [ebp - 0x11c], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp dword [edi + 0x6c], 0
mov esi, eax
je 0x40ee87
push str.smartCard
lea ecx, [ebp - 0x16c]
call fcn.00402de0
lea ecx, [ebp - 0x16c]
and esi, 0xa
push esi
mov dword [edi + 0x6c], ecx
push str.type
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.00407040
push str..MaxUserCtrl
push str.SmartCard
lea edx, [ebp - 0x118]
push 0x4660ac
push edx
call fcn.0043ac3a
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
add esp, 0x10
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x118]
push eax
push str.Common
call esi
cmp eax, 0xffffffff
je 0x40ee22
push eax
push str.MaxUserCtrl
mov ecx, edi
call fcn.00407040
push str..ProbationCtrl
push str.SmartCard
lea ecx, [ebp - 0x118]
push 0x4660ac
push ecx
call fcn.0043ac3a
add esp, 0x10
push ebx
push 0xffffffffffffffff
lea edx, [ebp - 0x118]
push edx
push str.Common
call esi
cmp eax, 0xffffffff
je 0x40ee63
push eax
push str.ProbationCtrl
mov ecx, edi
call fcn.00407040
mov ecx, dword [ebp - 0x11c]
lea eax, [ebp - 0x16c]
push eax
call fcn.00402720
lea ecx, [ebp - 0x16c]
mov dword [ebp - 4], 0xffffffff
call fcn.00402fa0
push 1
mov ecx, edi
call fcn.00407280
movzx eax, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439bf4
mov esp, ebp
pop ebp
ret 8
Function at 0x410880
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f8b8
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push ebx
push esi
push edi
mov eax, dword [0x4745a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x6c]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x41094e
push str.protoComponent
lea ecx, [ebp - 0x60]
call fcn.00402de0
mov edi, dword [ebp + 8]
push edi
push 0xffffffffffffffff
push str.ProtoComponents
lea eax, [ebp - 0x60]
push str.Components
mov dword [ebp - 4], 0
mov dword [esi + 0x6c], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebx, eax
test bl, 1
je 0x4108fb
lea ecx, [ebp - 0x60]
push ecx
push edi
mov ecx, esi
call fcn.0040c8b0
test bl, 2
je 0x41090c
lea edx, [ebp - 0x60]
push edx
push edi
mov ecx, esi
call fcn.0040cd10
test bl, 4
je 0x41091d
lea eax, [ebp - 0x60]
push eax
push edi
mov ecx, esi
call fcn.0040f100
test bl, 8
je 0x41092e
lea ecx, [ebp - 0x60]
push ecx
push edi
mov ecx, esi
call fcn.0040d900
mov edi, dword [ebp - 0x10]
lea edx, [ebp - 0x60]
push edx
mov ecx, edi
call fcn.00402720
lea ecx, [ebp - 0x60]
mov dword [esi + 0x6c], edi
mov dword [ebp - 4], 0xffffffff
call fcn.00402fa0
push 1
mov ecx, esi
call fcn.00407280
movzx eax, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x410970
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f8e8
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [0x4745a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x6c], 0
je 0x410a3f
mov edi, dword [ebp + 8]
push edi
push 0xffffffffffffffff
push str.FuncComponents
push str.Components
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebx, eax
mov eax, dword [esi + 0x6c]
push str.funcComponent
lea ecx, [ebp - 0x5c]
mov dword [ebp + 8], eax
call fcn.00402de0
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 0
mov dword [esi + 0x6c], ecx
test bl, 1
je 0x4109ec
mov edx, ecx
push edx
push edi
mov ecx, esi
call fcn.0040df90
test bl, 4
je 0x4109fd
lea eax, [ebp - 0x5c]
push eax
push edi
mov ecx, esi
call fcn.0040e160
test bl, 0x10
je 0x410a0e
lea ecx, [ebp - 0x5c]
push ecx
push edi
mov ecx, esi
call fcn.0040e2d0
test bl, 0xa
je 0x410a1f
lea edx, [ebp - 0x5c]
push edx
push edi
mov ecx, esi
call fcn.0040ed50
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x5c]
push eax
mov ecx, edi
call fcn.00402720
lea ecx, [ebp - 0x5c]
mov dword [esi + 0x6c], edi
mov dword [ebp - 4], 0xffffffff
call fcn.00402fa0
push 1
mov ecx, esi
call fcn.00407280
movzx eax, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41da30
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x460bb3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4745a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push 0xffffffffffffffff
push 0
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
push edi
mov byte [esi], 0
call fcn.00407b80
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov ecx, dword [edi + 0x20]
mov dword [esi + 0x20], ecx
mov edx, dword [edi + 0x24]
mov dword [esi + 0x24], edx
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
mov edx, dword [edi + 0x30]
mov dword [esi + 0x30], edx
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov ecx, dword [edi + 0x38]
mov dword [esi + 0x38], ecx
mov edx, dword [edi + 0x3c]
mov dword [esi + 0x3c], edx
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x44], ecx
mov edx, dword [edi + 0x48]
mov dword [esi + 0x48], edx
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
mov ecx, dword [edi + 0x50]
lea edx, [edi + 0x54]
mov dword [esi + 0x50], ecx
push edx
lea ecx, [esi + 0x54]
mov dword [ebp - 4], 0
call fcn.0041d2f0
mov eax, dword [edi + 0x60]
add edi, 0x64
push edi
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 1
mov dword [esi + 0x60], eax
call fcn.0041d2f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x422390
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x422ec0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
jle 0x422faf
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
push edi
movzx ecx, byte [edx]
dec ebx
inc edx
mov dword [ebp + 0x10], ebx
test ebx, ebx
jle 0x422f75
movzx esi, byte [edx]
dec ebx
inc edx
mov dword [ebp + 0x10], ebx
test ebx, ebx
jle 0x422f3f
movzx edi, byte [edx]
dec ebx
mov dword [ebp + 0x10], ebx
mov ebx, ecx
shr ebx, 2
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__cccbccc]
mov byte [eax], bl
and ecx, 3
add ecx, ecx
mov ebx, esi
shr ebx, 4
movzx ecx, byte [ebx + ecx*8 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__cccbccc]
mov byte [eax + 1], cl
mov ecx, edi
shr ecx, 6
and esi, 0xf
movzx ecx, byte [ecx + esi*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__cccbccc]
inc edx
mov byte [eax + 2], cl
and edi, 0x3f
movzx ecx, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__cccbccc]
mov byte [eax + 3], cl
jmp 0x422f97
mov edi, ecx
shr edi, 2
mov bl, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__cccbccc]
and ecx, 3
mov byte [eax], bl
mov edi, esi
add ecx, ecx
shr edi, 4
movzx ecx, byte [edi + ecx*8 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__cccbccc]
mov byte [eax + 1], cl
and esi, 0xf
movzx ecx, byte [esi*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__cccbccc]
mov byte [eax + 2], cl
mov byte [eax + 3], 0x3d
jmp 0x422f97
mov esi, ecx
shr esi, 2
mov bl, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__cccbccc]
and ecx, 3
mov byte [eax], bl
shl ecx, 4
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__cccbccc]
mov byte [eax + 1], cl
mov word [eax + 2], 0x3d3d
mov ebx, dword [ebp + 0x10]
add eax, 4
test ebx, ebx
jg 0x422ed7
pop edi
pop esi
mov byte [eax], 0
xor eax, eax
pop ebx
pop ebp
ret
mov edx, dword [ebp + 0xc]
mov byte [edx], 0
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4232f0
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
push ebx
push esi
mov esi, dword [ecx + 4]
mov ecx, eax
shr ecx, 4
xor ecx, esi
and ecx, 0xf0f0f0f
xor esi, ecx
shl ecx, 4
xor eax, ecx
mov ecx, eax
shr ecx, 0x10
xor ecx, esi
and ecx, 0xffff
xor esi, ecx
shl ecx, 0x10
xor eax, ecx
mov ecx, esi
shr ecx, 2
xor ecx, eax
and ecx, 0x33333333
xor eax, ecx
add ecx, ecx
add ecx, ecx
xor esi, ecx
mov ecx, esi
shr ecx, 8
xor ecx, eax
and ecx, 0xff00ff
xor eax, ecx
shl ecx, 8
xor ecx, esi
rol ecx, 1
mov esi, ecx
xor esi, eax
and esi, 0xaaaaaaaa
xor ecx, esi
xor esi, eax
push edi
rol esi, 1
mov dword [ebp - 4], 8
lea esp, [esp]
mov eax, ecx
ror eax, 4
xor eax, dword [edx]
add edx, 0x10
mov edi, eax
shr edi, 0x18
and edi, 0x3f
mov edi, dword [edi*4 + 0x466f10]
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
xor edi, dword [ebx*4 + 0x467110]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
xor edi, dword [ebx*4 + 0x467310]
and eax, 0x3f
xor edi, dword [eax*4 + 0x467510]
mov eax, dword [edx - 0xc]
xor esi, edi
xor eax, ecx
mov edi, eax
shr edi, 0x18
and edi, 0x3f
mov edi, dword [edi*4 + 0x467010]
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
xor edi, dword [ebx*4 + 0x467210]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
xor edi, dword [ebx*4 + 0x467410]
and eax, 0x3f
xor edi, dword [eax*4 + 0x467610]
xor esi, edi
mov eax, esi
ror eax, 4
xor eax, dword [edx - 8]
mov edi, eax
shr edi, 0x18
and edi, 0x3f
mov edi, dword [edi*4 + 0x466f10]
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
xor edi, dword [ebx*4 + 0x467110]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
xor edi, dword [ebx*4 + 0x467310]
and eax, 0x3f
xor edi, dword [eax*4 + 0x467510]
mov eax, dword [edx - 4]
xor ecx, edi
xor eax, esi
mov edi, eax
shr edi, 0x18
and edi, 0x3f
mov edi, dword [edi*4 + 0x467010]
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
xor edi, dword [ebx*4 + 0x467210]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
xor edi, dword [ebx*4 + 0x467410]
and eax, 0x3f
xor edi, dword [eax*4 + 0x467610]
xor ecx, edi
dec dword [ebp - 4]
jne 0x423370
ror ecx, 1
mov eax, ecx
xor eax, esi
and eax, 0xaaaaaaaa
xor ecx, eax
xor eax, esi
ror eax, 1
mov edx, eax
shr edx, 8
xor edx, ecx
and edx, 0xff00ff
xor ecx, edx
shl edx, 8
xor eax, edx
mov edx, eax
shr edx, 2
xor edx, ecx
and edx, 0x33333333
xor ecx, edx
add edx, edx
add edx, edx
xor eax, edx
mov edx, ecx
shr edx, 0x10
xor edx, eax
and edx, 0xffff
xor eax, edx
shl edx, 0x10
xor ecx, edx
mov edx, ecx
shr edx, 4
xor edx, eax
and edx, 0xf0f0f0f
mov esi, edx
shl esi, 4
xor esi, ecx
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx], esi
xor edx, eax
pop esi
mov dword [ecx + 4], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x423ef0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
jne 0x423f05
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [ebp + 0x14]
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x423efe
mov edx, dword [ebp + 0x10]
mov eax, 4
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x14]
push esi
lea ecx, [ebp - 8]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp + 0x14]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x423fc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x4745a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
jne 0x423ff7
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439bf4
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x10c]
push edx
push 1
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x423fe5
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 0x10c]
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x114]
push edx
push 0
push esi
push eax
mov dword [ebp - 0x114], 2
mov dword [ebp - 0x110], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x10c]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x423fe5
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424063
sub eax, edx
cmp dword [ebp + 0x18], eax
jb 0x423fe5
lea eax, [ebp - 0x108]
mov edx, edi
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x424081
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.00439bf4
mov esp, ebp
pop ebp
ret

Function at 0x424480
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0x104
jae 0x4244a3
mov eax, dword [ebp + 8]
push 0
push str.the_len_in_is_too_small
push eax
call fcn.00424e80
add esp, 0xc
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
push 0x105
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
dec eax
cmp eax, 0x103
ja 0x4244c7
mov byte [esi + 1], 0
mov eax, 1
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x427940
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x4745a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x88], eax
test esi, esi
je 0x4279e4
test edi, edi
je 0x4279e4
test ebx, ebx
je 0x4279e4
test eax, eax
je 0x4279e4
cmp dword [ebp + 0x18], 0x80
jbe 0x4279e4
push 0x80
lea eax, [ebp - 0x84]
push 0
push eax
call fcn.0043abc0
add esp, 0xc
push esi
push 0x80
lea ecx, [ebp - 0x84]
push ecx
push 0x46c3e8
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, eax
test esi, esi
je 0x4279d1
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x88]
push edx
lea eax, [ebp - 0x84]
push eax
push ecx
call fcn.0043af30
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439bf4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00439bf4
mov esp, ebp
pop ebp
ret

Function at 0x427a00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4745a8]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push esi
mov byte [ebp - 0x24], 0
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
call fcn.00430650
add esp, 4
test eax, eax
je 0x427ac8
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x2c]
push ecx
push esi
call fcn.00435610
add esp, 0xc
test eax, eax
je 0x427ac8
cmp dword [ebp - 0x2c], 0
jne 0x427ac8
cmp dword [ebp - 0x28], 0x220
jb 0x427ac8
push 0x46c43c
push esi
call fcn.0043b9ba
mov esi, eax
add esp, 8
test esi, esi
je 0x427ac8
push 0
push 0x200
push esi
call fcn.0043b882
push esi
push 0x20
lea edx, [ebp - 0x24]
push 1
push edx
call fcn.0043b5e2
push esi
call fcn.0043b307
add esp, 0x20
mov ecx, 8
lea esi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439bf4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00439bf4
mov esp, ebp
pop ebp
ret