joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416d10
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4bdbb0]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push edi
mov edi, dword [esp + 0x218]
lea eax, [esp + 0x80]
push eax
push 0x101
xor ebx, ebx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x416d50
push str.Failed_to_load_winsock_stack_n
jmp 0x416e1f
mov eax, dword [esp + 0x80]
cmp al, 1
jne 0x416e1a
shr eax, 8
cmp al, 1
jne 0x416e1a
push esi
lea ecx, [esp + 0x64]
mov dword [esp + 0xc], str.time.windows.com
call fcn.004290b0
lea ecx, [esp + 0x34]
call fcn.00428980
lea ecx, [esp + 0x3c]
call fcn.00428980
lea ecx, [esp + 0x44]
call fcn.00428980
lea ecx, [esp + 0x4c]
call fcn.00428980
xor esi, esi
mov edx, dword [esp + esi*4 + 0xc]
push 0x7b
lea ecx, [esp + 0x30]
push ecx
push edx
lea ecx, [esp + 0x70]
call fcn.004290e0
test eax, eax
jne 0x416dcc
inc esi
cmp esi, 1
jb 0x416da2
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
pop esi
jmp 0x416e29
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x48]
call fcn.00428f00
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x6c]
call fcn.00428d50
push 0xffffffffffffffff
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
call fcn.00410aa0
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov ebx, 1
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
pop esi
jmp 0x416e29
push str.Winsock_stack_does_not_support_version_which_this_program_requires_n
call fcn.00466dec
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x210]
pop edi
pop ebx
xor ecx, esp
call fcn.004644d0
add esp, 0x20c
ret 4
Function at 0x416f50
Capabilities:
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6c
mov eax, dword [0x4bdbb0]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
push str.Begin_CDocumentMgr::monitorHook_pid__d_
mov dword [esp + 0x14], esi
call fcn.0042a410
mov eax, dword [esi + 0x11e8]
add esp, 8
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x417095
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push 0
push 0x401
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x417095
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x41704a
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
sbb ecx, dword [esp + 0x1c]
push 0
push 0x989680
push ecx
push eax
call fcn.004660b0
test edx, edx
ja 0x41700a
cmp eax, 0xa
jbe 0x41704a
xor edx, edx
push 0x3e
push edx
lea eax, [esp + 0x3a]
push eax
mov word [esp + 0x3c], dx
call fcn.00463850
push edi
lea ecx, [esp + 0x40]
push str.ODMHOOK__u
push ecx
call fcn.00466e9b
add esp, 0x18
lea edx, [esp + 0x30]
push edx
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
test eax, eax
je 0x417070
push eax
call ebx
push esi
call ebx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x11e8]
push 0x1f4
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x416fa1
jmp 0x417095
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x34]
push edx
push str.OpenEvent_Mutex__NULL__::TerminateProcess___s__error__d_
call fcn.0042a410
add esp, 0xc
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call ebx
push str.End_CDocumentMgr::monitorHook
call fcn.0042a410
mov ecx, dword [esp + 0x78]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.004644d0
mov esp, ebp
pop ebp
ret 4

Function at 0x417410
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push edi
push 8
mov esi, ecx
call fcn.00440cff
add esp, 4
push 0
push 0
mov edi, eax
mov eax, dword [esp + 0x14]
push 1
push 0
mov dword [edi], esi
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 4
push edi
push 0x4173d0
push 0
push 0
mov dword [esi + 0x11e8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
mov dword [esi + 0x11e4], eax
pop esi
mov dword [esp + 4], eax
jmp dword [sym.imp.KERNEL32.dll_ResumeThread]
Function at 0x417550
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x487f6b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4bdbb0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esi], vtable.CDocumentMgr.0
xor ebx, ebx
mov dword [esp + 0x1c], ebx
call fcn.00416120
cmp dword [esi + 0xdd4], ebx
je 0x4175ad
lea edi, [esi + 0xdd8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x4175ad
push edi
call fcn.0042a1f0
add esp, 4
cmp dword [esi + 0x414], ebx
je 0x4175c1
mov eax, dword [0x4c293c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi + 0x11d8]
cmp eax, ebx
je 0x4175d2
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x11e0]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x4175eb
push eax
call edi
mov dword [esi + 0x11e0], ebx
mov eax, dword [esi + 0x11d8]
cmp eax, ebx
je 0x4175fe
push eax
call edi
mov dword [esi + 0x11d8], ebx
mov eax, dword [esi + 0x11dc]
cmp eax, ebx
je 0x417611
push eax
call edi
mov dword [esi + 0x11dc], ebx
mov ecx, esi
call fcn.00416930
mov esi, dword [esi + 4]
sub esi, 0x10
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41763f
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x4190b0
Capabilities:
Create process on windows
Print debug messages

Disassembly:
mov ecx, dword [0x4c2418]
test ecx, ecx
jne 0x4190bd
xor eax, eax
ret
jmp fcn.00418b30
Function at 0x41ad90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4880eb
mov eax, dword fs:[0]
push eax
sub esp, 0x440
mov eax, dword [0x4bdbb0]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
push esi
push edi
mov eax, dword [0x4bdbb0]
xor eax, esp
push eax
lea eax, [esp + 0x450]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 0x200
xor edi, edi
lea ecx, [esp + 0x3a]
xor eax, eax
push edi
push ecx
mov word [esp + 0x40], ax
call fcn.00463850
push 0x200
lea eax, [esp + 0x24e]
xor edx, edx
push edi
push eax
mov word [esp + 0x254], dx
call fcn.00463850
push 0x100
lea ecx, [esp + 0x258]
push ecx
push 0x100
lea edx, [esp + 0x58]
push edx
push edi
push edi
push edi
push edi
push esi
call fcn.00465992
add esp, 0x3c
lea eax, [esp + 0x23c]
push eax
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.AcroRd32.exe
lea edx, [esp + 0x38]
push edx
call ebx
test eax, eax
jne 0x41ae94
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 4
lea eax, [esp + 0x14]
push eax
push 4
push str.bProtectedMode
push str.SoftwareAdobeAcrobat_Reader10.0Privileged
push SysReAllocString
mov dword [esp + 0x28], edi
call esi
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push str.bProtectedMode
push str.SoftwareAdobeAcrobat_Reader11.0Privileged
push SysReAllocString
call esi
mov dword [esp + 0x1c], str.acrord32.exe
mov dword [esp + 0x20], str.acrobat.exe
mov dword [esp + 0x24], str.ACDSeePro1.exe
mov dword [esp + 0x28], str.ACDSeePro2.exe
mov dword [esp + 0x2c], str.ACDSeePro3.exe
mov dword [esp + 0x30], str.Photoshop.exe
mov esi, dword [esp + edi*4 + 0x1c]
lea edx, [esp + 0x34]
push edx
push esi
call ebx
test eax, eax
jne 0x41af15
lea ecx, [esp + 0x14]
call fcn.00426480
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
mov dword [esp + 0x460], 0
call fcn.00411f40
lea ecx, [esp + 0x18]
call fcn.004264f0
or ecx, 0xffffffff
mov dword [esp + 0x458], ecx
cmp eax, ecx
lea ecx, [esp + 0x14]
jne 0x41af46
call fcn.004264a0
inc edi
cmp edi, 6
jb 0x41aec4
mov eax, 1
mov ecx, dword [esp + 0x450]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x438]
xor ecx, esp
call fcn.004644d0
mov esp, ebp
pop ebp
ret 4
call fcn.004264a0
xor eax, eax
jmp 0x41af20
Function at 0x41b540
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x488190
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4bdbb0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
push eax
mov dword [esp + 0x1c], 0
call fcn.00411090
add eax, 0x10
add esp, 4
mov dword [esp + 0xc], eax
push 1
push 0x4a2058
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], 1
call fcn.004117d0
lea ecx, [edi + 0x574]
test ecx, ecx
jne 0x41b5a7
xor eax, eax
jmp 0x41b5bf
mov eax, ecx
lea esi, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x41b5b0
sub eax, esi
sar eax, 1
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.004117d0
lea edx, [edi + 0x676]
test edx, edx
jne 0x41b5d8
xor eax, eax
jmp 0x41b5ef
mov eax, edx
lea esi, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41b5e0
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x14]
call fcn.004117d0
mov esi, dword [esp + 0xc]
push 0
push esi
add edi, 8
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
lea eax, [esi - 0x10]
mov byte [esp + 0x18], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b62e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov dword [esp + 0x18], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b656
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x41b670
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4881bb
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x4bdbb0]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
push edi
mov eax, dword [0x4bdbb0]
xor eax, esp
push eax
lea eax, [esp + 0x21c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x22c]
lea eax, [esp + 0xc]
push eax
push 1
xor edi, edi
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41b781
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
push edi
push edi
push str.CDGRegedit
push eax
mov dword [esp + 0x2c], 0xff
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x41b772
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x14]
call fcn.00411f40
push str.CDGRegedit.exe
lea ecx, [esp + 0x14]
mov dword [esp + 0x228], edi
call fcn.00419550
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
push eax
mov dword [esp + 0x10], edi
call fcn.00411090
add eax, 0x10
mov dword [esi], eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
add esp, 4
mov dword [esp + 0x224], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b78d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41b78d
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], edi
push 0x4aa4cb
mov ecx, esi
call fcn.00411ca0
mov eax, esi
mov ecx, dword [esp + 0x21c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004644d0
add esp, 0x21c
ret 4
Function at 0x421ea0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [esp + 4]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
push eax
mov dword [esi], vtable.CEt99Ex.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0xc], eax
cmp eax, ebx
je 0x421f4f
cmp eax, 0xffffffff
je 0x421f4f
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.et_FindToken
push eax
call edi
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
push str.et_OpenToken
push eax
call edi
mov ecx, dword [esi + 0xc]
push str.et_CloseToken
push ecx
mov dword [esi + 0x18], eax
call edi
mov edx, dword [esi + 0xc]
push str.et_Verify
push edx
mov dword [esi + 0x1c], eax
call edi
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0xc]
push str.et_Read
push eax
call edi
mov dword [esi + 0x24], eax
pop edi
cmp dword [esi + 0x14], ebx
je 0x421f4f
cmp dword [esi + 0x18], ebx
je 0x421f4f
cmp dword [esi + 0x1c], ebx
je 0x421f4f
cmp dword [esi + 0x20], ebx
je 0x421f4f
cmp eax, ebx
mov eax, esi
je 0x421f51
mov dword [esi + 0x10], 1
pop esi
pop ebx
ret 4
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x422290
Capabilities:
Query or enumerate registry key

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push edi
lea eax, [esp + 4]
push eax
push 0x20019
xor edi, edi
push edi
push ecx
push edx
mov dword [esp + 0x18], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0x4222be
xor eax, eax
pop edi
pop ecx
ret 0x10
mov eax, dword [esp + 0x18]
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
shr eax, 0xa
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0x200
mov edi, edi
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x2c]
push eax
push ebx
push edi
push ecx
call ebp
mov esi, eax
inc edi
cmp esi, 0x103
je 0x422319
cmp edi, dword [esp + 0x18]
ja 0x422319
add ebx, 0x400
mov dword [esp + 0x1c], 0x200
test esi, esi
je 0x4222e0
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x42233a
cmp esi, 0x103
je 0x42233a
pop esi
pop ebp
pop ebx
xor eax, eax
pop edi
pop ecx
ret 0x10
pop esi
pop ebp
pop ebx
mov eax, 1
pop edi
pop ecx
ret 0x10
Function at 0x424880
Capabilities:
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x380
mov eax, dword [0x4bdbb0]
xor eax, esp
mov dword [esp + 0x37c], eax
push esi
mov esi, dword [esp + 0x388]
push 0x3c
lea eax, [esp + 0x28]
push 0
push eax
mov dword [esp + 0x2c], 0
call fcn.00463850
xor ecx, ecx
push 0x1fe
push ecx
lea edx, [esp + 0x196]
push edx
mov word [esp + 0x198], cx
call fcn.00463850
push 0
push 0
push 0x100
lea eax, [esp + 0x1a4]
push eax
push 0
push 0
push 0
push 0
push esi
call fcn.00465992
lea ecx, [esp + 0x1bc]
push str.ugs_router
push ecx
call fcn.0046740a
add esp, 0x44
test eax, eax
jne 0x42491f
xor eax, eax
pop esi
mov ecx, dword [esp + 0x37c]
xor ecx, esp
call fcn.004644d0
add esp, 0x380
ret
lea edx, [esp + 0x180]
push str.proe
push edx
call fcn.0046740a
add esp, 8
test eax, eax
je 0x424907
lea eax, [esp + 0x180]
push str.VSLauncher
push eax
call fcn.0046740a
add esp, 8
test eax, eax
je 0x424907
lea ecx, [esp + 0x180]
push str.AcLauncher
push ecx
call fcn.0046740a
add esp, 8
test eax, eax
je 0x424907
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x424907
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea edx, [esp + 0xc]
push edx
push 0x40
lea eax, [esp + 0x150]
push eax
push esi
call edi
test eax, eax
je 0x424a1d
mov ecx, 0x5a4d
cmp cx, word [esp + 0x144]
jne 0x424a1d
push 0
lea edx, [esp + 0xc]
push edx
push 0x40
lea eax, [esp + 0x30]
push eax
push esi
call edi
test eax, eax
je 0x424a1d
mov ecx, dword [esp + 0x180]
push 0
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x424a1d
push 0
lea edx, [esp + 0xc]
push edx
push 4
lea eax, [esp + 0x18]
push eax
push esi
call edi
test eax, eax
je 0x424a1d
cmp dword [esp + 0xc], 0x4550
jne 0x424a1d
push 0
lea ecx, [esp + 0xc]
push ecx
push 0x14
lea edx, [esp + 0x1c]
push edx
push esi
call edi
test eax, eax
jne 0x424a3d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x37c]
xor ecx, esp
call fcn.004644d0
add esp, 0x380
ret
push 0
lea eax, [esp + 0xc]
push eax
push 0xe0
lea ecx, [esp + 0x70]
push ecx
push esi
call edi
push esi
test eax, eax
je 0x424a1e
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x384]
xor eax, eax
cmp word [esp + 0xa8], 2
pop edi
sete al
pop esi
xor ecx, esp
call fcn.004644d0
add esp, 0x380
ret
Function at 0x424ff0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x404
mov eax, dword [0x4bdbb0]
xor eax, esp
mov dword [esp + 0x400], eax
push ebx
push ebp
mov ebp, dword [esp + 0x410]
push esi
push edi
mov edi, dword [esp + 0x41c]
xor eax, eax
push 0x3fe
mov esi, ecx
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.00463850
mov edx, dword [esi + 0x7c]
add esp, 0xc
push edx
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x10]
lea edx, [eax + 2]
jmp 0x425050
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x425050
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0xe], 0x5c
je 0x425079
push 0x4a2058
lea ecx, [esp + 0x14]
push ecx
call ebx
push str.PCID.DAT
lea edx, [esp + 0x14]
push edx
call ebx
mov ecx, dword [esi + 0x80]
lea eax, [esp + 0x10]
push eax
push 0
push str.Auto
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea edx, [esp + 0x10]
push edx
push 0x200
push edi
push 0
mov dword [ebp], eax
mov eax, dword [esi + 0x80]
push str.Pcid
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
test eax, eax
setg cl
pop edi
pop esi
pop ebp
pop ebx
mov eax, ecx
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.004644d0
add esp, 0x404
ret 8
Function at 0x426320
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x4879c8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4bdbb0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00449852
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x42635f
push 0x80004005
call fcn.004108b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0xc], edi
mov ecx, dword [esp + 0x20]
push ecx
push 0
push 0xf001f
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [esi + 4], eax
test eax, eax
jne 0x4263e7
lea edx, [esp + 0xc]
push str.CProcessMap::GetMapPoint_m_hMapFile_is_null
push edx
call fcn.004135e0
mov esi, dword [esp + 0x14]
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [esi - 0x10]
mov dword [esp + 0x18], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4263d1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 8
push 0
push 0
push 0
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
test eax, eax
jne 0x426437
lea ecx, [esp + 0xc]
push str.CProcessMap::GetMapPoint_m_lpMapAddress_is_null
push ecx
call fcn.004135e0
mov esi, dword [esp + 0x14]
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [esi - 0x10]
mov dword [esp + 0x18], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x4263c5
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
lea eax, [edi - 0x10]
mov dword [esp + 0x18], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x426461
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 8
Function at 0x427230
Capabilities:
Get common file path

Disassembly:
mov eax, 0x2a44
call fcn.00465640
mov eax, dword [0x4bdbb0]
xor eax, esp
mov dword [esp + 0x2a40], eax
push ebx
push esi
xor ebx, ebx
push 0x27ff
lea eax, [esp + 0x24d]
push ebx
push eax
mov byte [esp + 0x254], bl
call fcn.00463850
mov edx, dword [esp + 0x2a5c]
lea ecx, [esp + 0x2a60]
push ecx
push edx
lea eax, [esp + 0x25c]
push 0x2800
push eax
call fcn.00467a5a
push 0x1ff
lea ecx, [esp + 0x69]
push ebx
push ecx
mov byte [esp + 0x70], bl
call fcn.00463850
add esp, 0x28
push 0x200
lea edx, [esp + 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x48dc84
lea eax, [esp + 0x4c]
push eax
call esi
push str.ODMGuard.LOG
lea ecx, [esp + 0x4c]
push ecx
call esi
lea edx, [esp + 0x48]
push 0x48e77c
push edx
call fcn.00466b84
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x427375
xor eax, eax
mov dword [esp + 9], eax
mov dword [esp + 0xd], eax
mov dword [esp + 0x11], eax
mov dword [esp + 0x15], eax
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov word [esp + 0x25], ax
mov byte [esp + 0x27], al
mov dword [esp + 0x29], eax
mov dword [esp + 0x2d], eax
mov dword [esp + 0x31], eax
mov dword [esp + 0x35], eax
mov dword [esp + 0x39], eax
mov dword [esp + 0x3d], eax
mov dword [esp + 0x41], eax
mov word [esp + 0x45], ax
mov byte [esp + 0x47], al
lea eax, [esp + 0x248]
push eax
lea ecx, [esp + 0x2c]
push ecx
mov byte [esp + 0x10], bl
mov byte [esp + 0x30], bl
call fcn.0046798b
add esp, 4
push eax
lea edx, [esp + 0x10]
push edx
call fcn.004678cc
add esp, 4
push eax
push str._s__s____s_n
push esi
call fcn.00467704
push esi
call fcn.00466805
add esp, 0x18
mov ecx, dword [esp + 0x2a48]
pop esi
pop ebx
xor ecx, esp
call fcn.004644d0
add esp, 0x2a44
ret