joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405060
Capabilities:
Create thread

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x426e20
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebp
push esi
mov esi, ecx
mov ecx, dword [esi + 0x3a8]
xor eax, eax
cmp ecx, 0xffffffff
push edi
jne 0x4051e8
mov ebp, dword [esp + 0x3c]
mov dword [esi + 0x3a4], eax
lea eax, [esp + 0x10]
push 0x42a624
push eax
mov dword [esi + 0x3a8], ebp
call fcn.00410470
mov ecx, dword [esi + 8]
add esp, 8
push 0x6c
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
cmp dword [esp + 0x28], 0x10
mov eax, dword [esp + 0x14]
jae 0x4050cd
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [esp + 0x28], 0x10
jb 0x4050f2
mov edx, dword [esp + 0x14]
push edx
call fcn.0041e69d
add esp, 4
mov eax, dword [esi + 8]
push 0
push 0
push 0x402
push 0x6a
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
cmp ebp, 0x70
jne 0x4051c7
mov ecx, dword [0x43627c]
push ecx
mov ecx, 0x436260
call fcn.00415110
test eax, eax
jne 0x4051c7
mov ecx, 0x436260
call fcn.004153a0
test eax, eax
jne 0x405144
push ebp
mov ecx, esi
call fcn.00404420
jmp 0x4051e3
lea edx, [esp + 0x10]
push str.msg_searchingphone
push edx
call fcn.00410470
sub esp, 0x14
mov ecx, esp
mov dword [esp + 0x58], esp
push 0x42a6d0
push eax
push ecx
mov dword [esp + 0x5c], 0
call fcn.00401510
add esp, 0xc
mov edx, dword [esi + 0x10]
lea ecx, [esi + 0x10]
mov byte [esp + 0x50], 0
call dword [edx + 4]
push eax
call fcn.00409250
add esp, 0x20
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], 0xffffffff
call fcn.00409d00
mov eax, dword [esi + 0x3ac]
push eax
mov ecx, esi
call fcn.00404f40
test eax, eax
je 0x4051e3
mov ecx, dword [esi + 0x3ac]
mov edx, dword [esi + 8]
push 0
push 0x3e8
push ecx
push edx
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x4051e3
lea eax, [esp + 0xc]
push eax
push 0
push ebp
push 0x404e80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x436260], eax
mov eax, 1
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x2c
ret 4
Function at 0x4057c0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x426db8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
lea ebp, [ebx + ebx + 2]
cmp ebp, eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x14], ebx
jge 0x4058a8
lea esp, [esp]
mov esi, dword [esp + 0x28]
mov eax, ebp
imul eax, eax, 0x1c
mov ecx, dword [eax + esi - 4]
mov edi, dword [eax + esi - 8]
add eax, esi
cmp ecx, 0x10
mov dword [esp + 0x10], edi
jb 0x405825
mov ecx, dword [eax - 0x18]
mov dword [esp + 0x2c], ecx
jmp 0x40582c
lea edx, [eax - 0x18]
mov dword [esp + 0x2c], edx
mov edx, dword [eax + 0x14]
mov ecx, edx
cmp ecx, edx
jae 0x405835
test edx, edx
je 0x40586c
cmp edx, edi
mov ecx, edx
jb 0x405841
mov ecx, edi
cmp dword [eax + 0x18], 0x10
jb 0x40584c
mov eax, dword [eax + 4]
jmp 0x40584f
add eax, 4
mov edi, dword [esp + 0x2c]
mov esi, eax
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x405860
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
mov esi, dword [esp + 0x28]
jne 0x405879
mov edi, dword [esp + 0x10]
cmp edx, edi
jb 0x40587b
xor eax, eax
cmp edx, edi
setne al
test eax, eax
jge 0x40587c
dec ebp
mov eax, ebp
imul eax, eax, 0x1c
mov ecx, ebx
imul ecx, ecx, 0x1c
push 0xffffffffffffffff
add eax, esi
push 0
add ecx, esi
push eax
call fcn.00401310
mov eax, dword [esp + 0x30]
mov ebx, ebp
lea ebp, [ebp + ebp + 2]
cmp ebp, eax
jl 0x405800
jmp 0x4058ac
mov esi, dword [esp + 0x28]
cmp ebp, eax
jne 0x4058cf
imul eax, eax, 0x1c
mov ecx, ebx
imul ecx, ecx, 0x1c
push 0xffffffffffffffff
lea eax, [eax + esi - 0x1c]
push 0
add ecx, esi
push eax
call fcn.00401310
mov eax, dword [esp + 0x30]
lea ebx, [eax - 1]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x4c], esp
push 0xffffffffffffffff
push 0
lea edx, [esp + 0x58]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push edx
mov byte [ecx + 4], 0
call fcn.00401310
mov eax, dword [esp + 0x30]
push eax
push ebx
push esi
call fcn.00404820
mov eax, dword [esp + 0x74]
add esp, 0x28
cmp eax, 0x10
jb 0x40591d
mov ecx, dword [esp + 0x38]
push ecx
call fcn.0041e69d
add esp, 4
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret
Function at 0x4073f0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x426fb8
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x24]
sub ebp, esi
mov eax, ebp
and eax, 0x8000000f
push edi
jns 0x407424
dec eax
or eax, 0xfffffff0
inc eax
je 0x407437
mov eax, ebp
cdq
and edx, 0xf
add eax, edx
sar eax, 4
inc eax
shl eax, 4
mov ebp, eax
lea ecx, [esp + 0x2c]
push ecx
push 0x40
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.0041eff7
cdq
mov ecx, 5
idiv ecx
mov ebx, edx
add ebx, 4
shl ebx, 4
call fcn.0041eff7
cdq
mov ecx, 5
idiv ecx
lea ecx, [esp + 0x10]
add edx, 4
shl edx, 4
add edx, ebx
add edx, ebp
push edx
call fcn.0041b3f0
xor edi, edi
cmp ebx, edi
mov dword [esp + 0x20], edi
jle 0x40749b
mov esi, dword [esp + 0x10]
call fcn.0041eff7
mov byte [esi + edi], al
inc edi
cmp edi, ebx
jl 0x407486
mov esi, dword [esp + 0x28]
mov edx, dword [esp + 0x10]
mov ecx, ebp
mov eax, ecx
shr ecx, 2
lea edi, [edx + ebx]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x14]
lea esi, [ebx + ebp]
cmp esi, eax
jge 0x4074d5
lea ecx, [ecx]
mov edi, dword [esp + 0x10]
call fcn.0041eff7
mov byte [edi + esi], al
mov eax, dword [esp + 0x14]
inc esi
cmp esi, eax
jl 0x4074c0
mov ecx, dword [esp + 0x10]
push eax
push ecx
mov ecx, 0x436260
call fcn.00415130
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0x28]
mov ecx, ebp
mov eax, ecx
shr ecx, 2
lea esi, [edx + ebx]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.0041b440
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8

Function at 0x4075b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 8
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, ecx
call edi
mov ebp, eax
mov ecx, dword [esi + 8]
push 0
push 1
lea edx, [esp + 0x14]
mov byte [esp + 0x14], 0xaa
mov eax, dword [ecx]
push edx
call dword [eax + 0xc]
test eax, eax
je 0x4075f8
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
push 0
push 1
lea edx, [esp + 0x1b]
push edx
call dword [eax + 0x10]
test eax, eax
je 0x4075f8
cmp byte [esp + 0x13], 0x55
je 0x40760f
call edi
mov ecx, dword [esp + 0x18]
sub eax, ebp
cmp eax, ecx
jb 0x4075c2
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 8
ret 4
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 8
ret 4
Function at 0x409480
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
mov eax, ecx
and al, 1
neg al
mov edx, ecx
sbb eax, eax
shr edx, 1
and eax, 0xedb88320
xor eax, edx
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor edx, eax
mov dword [ecx*4 + 0x435dc0], edx
inc ecx
cmp ecx, 0x100
jl 0x409482
ret

Function at 0x409530
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x435dc4]
test eax, eax
jne 0x40953e
call fcn.00409480
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
test esi, esi
not eax
jbe 0x40956f
mov ecx, dword [esp + 0xc]
push edi
xor edx, edx
mov dl, byte [ecx]
xor edx, eax
and edx, 0xff
mov edi, dword [edx*4 + 0x435dc0]
shr eax, 8
xor eax, edi
inc ecx
dec esi
jne 0x409552
pop edi
not eax
pop esi
ret
Function at 0x40dde0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4276c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x30]
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [esp + 0xc], ebx
je 0x40de23
mov eax, 1
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x64
ret 4
cmp dword [esi + 0x2c], ebx
jne 0x40de6e
mov eax, dword [esp + 0x74]
push ebx
push eax
call dword [sym.imp.thunk.dll_int___cdecl_LoadSRVLibrary_char_const___unsigned_long_int_]
add esp, 8
cmp eax, ebx
mov dword [esi + 0x2c], eax
jne 0x40de65
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x90], esp
push str.err_srvloadfailed
push ecx
call fcn.00410470
add esp, 8
push 0x435cf4
call fcn.004091d0
add esp, 0x20
cmp dword [esi + 0x2c], ebx
je 0x40df78
mov edi, dword [sym.imp.USER32.dll_RegisterWindowMessageA]
push str.WM_PST_DISPLAY_STATUS
call edi
push str.WM_PST_DISPLAY_PROGRESS
mov dword [esi + 0x48], eax
call edi
push str.WM_PST_DISPLAY_ERROR
mov dword [esi + 0x4c], eax
call edi
push ebx
push 1
mov dword [esi + 0x50], eax
call dword [sym.imp.thunk.dll_int___cdecl_SRVInitialize_unsigned_long_int__unsigned_long_int_]
add esp, 8
cmp eax, ebx
jne 0x40deaf
mov dword [esp + 0xc], 1
jmp 0x40df78
push 1
push eax
lea edx, [esp + 0x50]
push edx
call fcn.0040d290
mov edi, eax
lea eax, [esp + 0x38]
push str.msg_initusb
push eax
mov dword [esp + 0x80], ebx
call fcn.00410470
push 0x42a6d0
push eax
lea ecx, [esp + 0x2c]
push ecx
mov byte [esp + 0x8c], 1
call fcn.00401510
add esp, 4
mov edx, esp
mov dword [esp + 0x90], esp
push edi
push eax
push edx
mov byte [esp + 0x94], 2
call fcn.00401ed0
add esp, 0xc
push 0x435cf4
call fcn.00409250
mov eax, dword [esp + 0x48]
mov edi, 0x10
add esp, 0x20
cmp eax, edi
jb 0x40df32
mov eax, dword [esp + 0x14]
push eax
call fcn.0041e69d
add esp, 4
cmp dword [esp + 0x44], edi
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
jb 0x40df55
mov ecx, dword [esp + 0x30]
push ecx
call fcn.0041e69d
add esp, 4
cmp dword [esp + 0x60], edi
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
jb 0x40df78
mov edx, dword [esp + 0x4c]
push edx
call fcn.0041e69d
add esp, 4
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x64]
pop edi
mov dword [esi + 0x30], eax
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x64
ret 4
Function at 0x40dfa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x427838
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebp
mov ebp, dword [esp + 0x30]
push esi
push edi
lea eax, [esp + 0xc]
push str.msg_testinterface
xor edi, edi
push eax
mov esi, ecx
mov dword [ebp], edi
call fcn.00410470
sub esp, 0x14
mov ecx, esp
mov dword [esp + 0x54], esp
push 0x42a6d0
push eax
push ecx
mov dword [esp + 0x58], edi
call fcn.00401510
add esp, 0xc
push 0x435cf4
call fcn.00409250
mov eax, dword [esp + 0x44]
add esp, 0x20
cmp eax, 0x10
mov dword [esp + 0x30], 0xffffffff
jb 0x40e01c
mov edx, dword [esp + 0x10]
push edx
call fcn.0041e69d
add esp, 4
xor ecx, ecx
mov cx, word [esi + 0x3c]
lea eax, [esi + 0x44]
push eax
push str.Motorola_Test_Command
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
push ecx
call dword [sym.imp.thunk.dll_int___cdecl_SRVGetInterfaceHandle_unsigned_short_int__char_const___unsigned_long_int__]
add esp, 0xc
test eax, eax
je 0x40e0c5
sub esp, 0x1c
cmp eax, 0x47
mov dword [esp + 0x54], esp
jne 0x40e094
mov edx, esp
push str.err_interfacenotfound
push edx
call fcn.00410470
add esp, 8
push 0x435cf4
call fcn.004091d0
add esp, 0x20
mov dword [ebp], 1
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
add esp, 0x28
ret 4
mov ecx, esp
push 5
push eax
push ecx
call fcn.0040d290
add esp, 0xc
push 0x435cf4
call fcn.004091d0
add esp, 0x20
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
add esp, 0x28
ret 4
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
mov dword [esi + 0x28], eax
call dword [sym.imp.thunk.dll_int___cdecl_SRVTestCmdInit_struct_HINSTANCE____]
sub esp, 0x18
mov edx, esp
mov dword [esp + 0x54], esp
mov esi, eax
push 6
push esi
push edx
call fcn.0040d290
add esp, 0xc
push 0x435cf4
call fcn.004091d0
mov ecx, dword [esp + 0x48]
add esp, 0x20
xor eax, eax
pop edi
test esi, esi
pop esi
sete al
mov dword fs:[0], ecx
pop ebp
add esp, 0x28
ret 4

Function at 0x40eca0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x427749
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi], 0x42ae88
mov eax, dword [edi + 0x30]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x1c], 3
je 0x40ecdb
mov dword [edi + 0x30], ebx
cmp dword [edi + 0x2c], ebx
je 0x40ece6
call dword [sym.imp.thunk.dll_int___cdecl_UnloadSRVLibrary_void_]
lea ecx, [edi + 0x60]
call fcn.0040e570
mov eax, dword [edi + 0x58]
mov ecx, dword [eax]
lea esi, [edi + 0x54]
push eax
push ecx
lea eax, [esp + 0x18]
push eax
mov ecx, esi
mov byte [esp + 0x28], 1
call fcn.0040e120
mov eax, dword [esi + 4]
push eax
call fcn.0041e69d
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov ecx, dword [edi + 0x34]
push ecx
mov byte [esp + 0x24], bl
call dword [sym.imp.thunk.dll_void___cdecl_DLFree_void__]
add esp, 8
mov ecx, edi
mov dword [esp + 0x1c], 0xffffffff
call fcn.00413290
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4104a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x427938
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
xor eax, eax
mov dword [esp], eax
mov dword [esp + 0xc], eax
cmp dword [esp + 0x30], 0x10
mov eax, dword [esp + 0x1c]
jae 0x4104ce
lea eax, [esp + 0x1c]
push esi
mov esi, dword [esp + 0x18]
push eax
push esi
mov ecx, 0x4361e8
call fcn.0040ff40
cmp dword [esp + 0x34], 0x10
jb 0x4104f3
mov eax, dword [esp + 0x20]
push eax
call fcn.0041e69d
add esp, 4
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x412220
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x427c78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
xor ebx, ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
lea edi, [esi + 0x18]
push edi
mov dword [esp + 0x38], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esp + 0x40]
imul eax, eax, 0x1c
push 0xffffffffffffffff
lea ecx, [eax + esi + 0x30]
push ebx
push ecx
lea ecx, [esp + 0x1c]
call fcn.00401310
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [esp + 0x3c]
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x18]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push edx
mov ecx, esi
mov byte [esi + 4], bl
call fcn.00401310
cmp dword [esp + 0x28], 0x10
jb 0x4122b4
mov eax, dword [esp + 0x14]
push eax
call fcn.0041e69d
add esp, 4
mov ecx, dword [esp + 0x2c]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 8

Function at 0x4122d0
Capabilities:
Get process heap force flags

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x427c98
push eax
mov dword fs:[0], esp
push esi
push edi
mov esi, ecx
lea edi, [esi + 0x18]
push edi
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esp + 0x18]
imul ecx, ecx, 0x1c
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x24]
push eax
lea ecx, [ecx + esi + 0x30]
call fcn.00401310
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esp + 0x34], 0x10
jb 0x41232f
mov edx, dword [esp + 0x20]
push edx
call fcn.0041e69d
add esp, 4
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 0x20
Function at 0x412350
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x427cd0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push esi
xor ebx, ebx
push edi
mov dword [esp + 0xc], ebx
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x5c], 1
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.00401310
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x24]
inc eax
cmp eax, ecx
mov byte [esp + 0x50], 2
ja 0x4123ba
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x18]
call fcn.00401060
jmp 0x4123c8
sub eax, ecx
push 0x20
push eax
lea ecx, [esp + 0x18]
call fcn.0040cbd0
push 0x42a6f8
lea ecx, [esp + 0x80]
push ecx
lea edx, [esp + 0x34]
push edx
call fcn.00401510
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x5c], 3
call fcn.00401220
mov eax, dword [esp + 0x44]
mov edi, 0x10
cmp eax, edi
mov byte [esp + 0x50], 2
jb 0x412413
mov eax, dword [esp + 0x30]
push eax
call fcn.0041e69d
add esp, 4
mov esi, dword [esp + 0x58]
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x18]
push ecx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov ecx, esi
mov byte [esi + 4], bl
call fcn.00401310
cmp dword [esp + 0x28], edi
jb 0x412446
mov edx, dword [esp + 0x14]
push edx
call fcn.0041e69d
add esp, 4
cmp dword [esp + 0x74], edi
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
jb 0x412469
mov eax, dword [esp + 0x60]
push eax
call fcn.0041e69d
add esp, 4
cmp dword [esp + 0x94], edi
jb 0x412482
mov ecx, dword [esp + 0x80]
push ecx
call fcn.0041e69d
add esp, 4
mov ecx, dword [esp + 0x48]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x48
ret
Function at 0x4126a0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x427d67
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x45c
push ebx
push ebp
push esi
mov si, word [esp + 0x478]
push edi
xor ebx, ebx
mov edi, ecx
push ebx
mov ebp, 0xf
push 0x42a46c
lea ecx, [esp + 0x1c]
mov word [edi + 0x12c], si
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.00401b80
push ebx
push 0x42a46c
lea ecx, [esp + 0x38]
mov dword [esp + 0x47c], ebx
mov dword [esp + 0x50], ebp
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
call fcn.00401b80
cmp si, bx
mov byte [esp + 0x474], 1
je 0x41285f
movzx eax, si
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 4
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push str._04X
mov byte [ecx + 4], bl
call fcn.00401b80
lea ecx, [esp + 0x6c]
push ecx
call fcn.0041b820
add esp, 0x24
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x480], 2
call fcn.00401310
mov eax, dword [esp + 0x64]
mov esi, 0x10
cmp eax, esi
mov byte [esp + 0x474], 1
jb 0x41278b
mov edx, dword [esp + 0x50]
push edx
call fcn.0041e69d
add esp, 4
lea eax, [esp + 0x4c]
push eax
mov ecx, 0x436438
call fcn.0041a420
push str.langpack.ini
push eax
lea ecx, [esp + 0x70]
push ecx
mov byte [esp + 0x480], 3
call fcn.00401510
add esp, 0xc
cmp dword [esp + 0x64], esi
mov byte [esp + 0x474], 5
jb 0x4127d0
mov edx, dword [esp + 0x50]
push edx
call fcn.0041e69d
add esp, 4
cmp dword [esp + 0x80], esi
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x64], ebp
mov dword [esp + 0x60], ebx
mov byte [esp + 0x50], bl
jae 0x4127ed
lea ecx, [esp + 0x6c]
cmp dword [esp + 0x2c], esi
mov eax, dword [esp + 0x18]
jae 0x4127fb
lea eax, [esp + 0x18]
push ecx
push 0x3e8
lea ecx, [esp + 0x8c]
push ecx
push 0x42a46c
push eax
push str.LANGPACK
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x84]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x412824
sub eax, edx
push eax
lea edx, [esp + 0x88]
push edx
lea ecx, [esp + 0x38]
call fcn.00401b80
cmp dword [esp + 0x80], esi
mov byte [esp + 0x474], 1
jb 0x412864
mov eax, dword [esp + 0x6c]
push eax
call fcn.0041e69d
add esp, 4
jmp 0x412864
mov esi, 0x10
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x38]
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00401310
push 7
mov ecx, edi
call fcn.004122d0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x54]
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00401310
push 8
mov ecx, edi
call fcn.004122d0
cmp dword [esp + 0x48], esi
jb 0x4128c7
mov ecx, dword [esp + 0x34]
push ecx
call fcn.0041e69d
add esp, 4
cmp dword [esp + 0x2c], esi
mov dword [esp + 0x48], ebp
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
jb 0x4128e6
mov edx, dword [esp + 0x18]
push edx
call fcn.0041e69d
add esp, 4
mov ecx, dword [esp + 0x46c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x468
ret 4
Function at 0x412dd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x427e18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
cmp dword [ebp + 0x14], 0xffffffff
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], 1
jne 0x412e07
mov eax, dword [esi + 4]
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [esi]
xor edi, edi
push edi
push 2
push eax
push ecx
mov ecx, esi
call dword [edx + 0x10]
test eax, eax
jne 0x412e38
mov eax, 2
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov dword [esp + 0x1c], eax
mov word [esp + 0x20], di
lea esp, [esp]
mov edx, dword [esi]
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x2c]
push ecx
mov ecx, esi
mov dword [esp + 0x28], 8
call dword [edx + 0x14]
test eax, eax
je 0x412efc
cmp word [esp + 0x20], 0
jne 0x412eaa
call ebx
mov edx, dword [esp + 0x1c]
mov ecx, dword [ebp + 0x14]
sub eax, edx
cmp eax, ecx
jbe 0x412e97
mov dword [esp + 0x10], 4
or edi, 0xffffffff
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xc]
test edi, edi
je 0x412e50
test edi, edi
jle 0x412f41
mov eax, dword [esi + 8]
push eax
lea ecx, [esp + 0x14]
call fcn.0041b3f0
movzx cx, byte [esp + 0x21]
mov ch, byte [esp + 0x20]
mov ebx, dword [ebp + 0x10]
xor edi, edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x1c], ecx
mov edi, edi
movzx edx, di
mov ax, word [esp + edx*2 + 0x22]
movzx cx, ah
mov ch, al
push ebx
lea edx, [esp + 0x14]
push ecx
push edx
mov ecx, esi
call fcn.00412d40
test eax, eax
je 0x412f15
inc edi
cmp di, word [esp + 0x1c]
jne 0x412ed0
xor esi, esi
jmp 0x412f1a
mov eax, 3
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, 6
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], 0xffffffff
call fcn.0041b440
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10