joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411106
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x431034]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x230], 0
push esi
push edi
push 6
xor eax, eax
pop ecx
lea edi, [ebp - 0x22c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x210]
mov ecx, eax
mov esi, 0x104
sub edx, ecx
lea ecx, [esi + 0x7ffffefa]
test ecx, ecx
je 0x41115c
movzx ecx, word [edx + eax]
test cx, cx
je 0x41115c
mov word [eax], cx
add eax, 2
dec esi
jne 0x411140
pop edi
test esi, esi
pop esi
jne 0x411165
sub eax, 2
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
mov word [ebp + eax*2 - 0x20e], cx
lea eax, [ebp - 0x210]
mov dword [ebp - 0x228], eax
mov eax, 0x614
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x230]
push eax
mov dword [ebp - 0x22c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421ac2
leave
ret

Function at 0x4111bc
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x240
mov eax, 0x4250bb
call fcn.0042201e
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
lea edi, [ebp - 0x22c]
mov dword [ebp - 4], ebx
call fcn.00410e36
test eax, eax
jne 0x4112da
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x23c], ebx
mov byte [ebp - 4], 1
xor edi, edi
xor eax, eax
push 0x206
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
mov dword [ebp - 0x234], 0x104
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x24c]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc edi
cmp eax, ebx
jne 0x4112a7
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.00401d9d
lea ecx, [ebp - 0x220]
lea esi, [ebp - 0x244]
mov byte [ebp - 4], 2
call fcn.00411611
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
call fcn.004011ad
jmp 0x411216
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x230]
lea eax, [ebp - 0x24c]
push dword [ebp - 0x240]
push dword [ebp - 0x244]
push eax
call fcn.00411811
add esp, 0x14
lea esi, [ebp - 0x244]
call fcn.004115dd
cmp dword [ebp - 0x22c], ebx
je 0x4112ee
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004220a1
ret
Function at 0x4112f4
Capabilities:
Enumerate files on windows

Disassembly:
push 0x26c
mov eax, 0x425309
call fcn.0042201e
lea eax, [ebp - 0x26c]
push eax
call fcn.004147c1
pop ecx
and dword [ebp - 4], 0
push dword [eax]
lea eax, [ebp - 0x264]
push eax
call fcn.00417a93
pop ecx
pop ecx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x26c]
add eax, 0xfffffff0
call fcn.004011ad
lea eax, [ebp - 0x264]
push eax
call fcn.00410fc4
pop ecx
test eax, eax
je 0x4114c4
mov eax, dword [section..data]
mov esi, section..data
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x274], eax
lea eax, [ebp - 0x274]
push eax
mov byte [ebp - 4], 3
call fcn.00414917
pop ecx
test eax, eax
jne 0x411386
mov eax, dword [ebp - 0x274]
add eax, 0xfffffff0
jmp 0x4114bf
mov eax, dword [section..data]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x270], eax
mov byte [ebp - 4], 4
mov ebx, dword [ebp - 0x274]
push str..
push ebx
lea edi, [ebp - 0x270]
call fcn.0041476a
mov edi, dword [ebp - 0x270]
pop ecx
pop ecx
lea eax, [ebp - 0x260]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x26c], eax
cmp eax, 0xffffffff
je 0x4114b4
test byte [ebp - 0x260], 0x10
je 0x411480
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x268]
push eax
call fcn.00401d9d
lea eax, [ebp - 0x268]
push eax
mov byte [ebp - 4], 5
call fcn.00410fc4
pop ecx
test eax, eax
je 0x41146e
push dword [ebp - 0x264]
mov ecx, dword [ebp - 0x268]
call fcn.00419b0b
pop ecx
test eax, eax
jns 0x41146e
mov eax, dword [section..data]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x278], eax
mov byte [ebp - 4], 6
push dword [ebp - 0x268]
lea edi, [ebp - 0x278]
push ebx
call fcn.0041476a
mov edi, dword [ebp - 0x278]
pop ecx
pop ecx
test eax, eax
je 0x411460
mov edx, edi
call fcn.00411106
lea eax, [edi - 0x10]
call fcn.004011ad
mov edi, dword [ebp - 0x270]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x268]
add eax, 0xfffffff0
call fcn.004011ad
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4113d9
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x264]
push eax
call fcn.004111bc
pop ecx
lea eax, [edi - 0x10]
call fcn.004011ad
lea eax, [ebx - 0x10]
call fcn.004011ad
mov eax, dword [ebp - 0x264]
add eax, 0xfffffff0
call fcn.004011ad
call fcn.004220a1
ret
Function at 0x411811
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
jmp 0x4118ab
push esi
call fcn.00410fc4
pop ecx
test eax, eax
je 0x4118a2
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov ecx, dword [esi]
push eax
call fcn.00419b0b
pop ecx
test eax, eax
jns 0x4118a2
mov eax, dword [ebp + 0x18]
mov ebx, dword [esi]
mov esi, dword [eax + 8]
mov edi, eax
test esi, esi
je 0x411854
push ebx
push dword [eax]
call fcn.00410dd4
jmp 0x4118a2
cmp byte [0x4334d0], 0
jne 0x411884
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41187d
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4334d4], eax
mov byte [0x4334d0], 1
mov eax, dword [0x4334d4]
test eax, eax
je 0x411899
push 0
push dword [edi + 4]
push ebx
push dword [edi]
call eax
jmp 0x4118a2
push ebx
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, dword [ebp + 0xc]
add esi, 4
mov dword [ebp + 0xc], esi
cmp esi, dword [ebp + 0x10]
jne 0x41181f
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ecx
mov ecx, dword [ebp + 0x18]
pop esi
mov dword [eax + 4], ecx
pop ebx
pop ebp
ret
Function at 0x41219c
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
push edi
mov esi, eax
xor al, al
mov bl, 1
mov edi, 0xffff
jmp 0x41232c
cmp ecx, 0x7c
je 0x412337
cmp ecx, 0x29
jne 0x4121df
cmp dword [esi + 0x10], 0
jne 0x412337
mov eax, 0x10000000
test dword [esi + 0x44], eax
jne 0x4121e4
push 5
call dword [sym.imp.MSVCP100.dll_void___cdecl_std::tr1::_Xbad_enum_std::tr1::regex_constants::error_type_]
pop ecx
jmp 0x412321
mov eax, 0x10000000
cmp ecx, 0x2e
jne 0x412200
push 5
lea eax, [esi + 0x18]
push eax
call fcn.0041241e
mov eax, esi
call fcn.00412170
jmp 0x412321
cmp ecx, 0x5c
jne 0x41225f
mov eax, esi
call fcn.00412170
mov eax, dword [esi + 0x44]
and eax, 0x80
je 0x412234
cmp word [esi + 0x3e], 0x62
jne 0x412234
push 4
lea eax, [esi + 0x18]
push eax
call fcn.0041241e
mov eax, esi
call fcn.00412170
jmp 0x412328
test eax, eax
je 0x412253
cmp word [esi + 0x3e], 0x42
jne 0x412253
push 4
lea eax, [esi + 0x18]
push eax
call fcn.0041241e
mov eax, dword [esi + 0x1c]
xor dword [eax + 8], 1
jmp 0x412228
mov eax, esi
call fcn.004129e4
jmp 0x412321
cmp ecx, 0x5b
jne 0x41228a
mov eax, esi
call fcn.00412170
mov eax, esi
call fcn.0041299a
cmp dword [esi + 0x40], 0x5d
je 0x4121f4
push 4
call dword [sym.imp.MSVCP100.dll_void___cdecl_std::tr1::_Xbad_enum_std::tr1::regex_constants::error_type_]
pop ecx
jmp 0x4121f4
cmp ecx, 0x28
jne 0x4122b5
mov eax, esi
call fcn.00412170
call fcn.00412ac0
cmp dword [esi + 0x40], 0x29
mov bl, al
je 0x4122ac
push 5
call dword [sym.imp.MSVCP100.dll_void___cdecl_std::tr1::_Xbad_enum_std::tr1::regex_constants::error_type_]
pop ecx
mov eax, esi
call fcn.00412170
jmp 0x41231d
cmp ecx, 0x5e
jne 0x4122c1
push 2
jmp 0x41221f
cmp ecx, 0x24
jne 0x4122cd
push 3
jmp 0x41221f
cmp ecx, 0x2a
je 0x412314
cmp ecx, 0x2b
je 0x412314
cmp ecx, 0x3f
je 0x412314
cmp ecx, 0x7b
je 0x412314
cmp ecx, 0x7d
jne 0x4122f2
test dword [esi + 0x44], eax
jne 0x4122f2
push 6
jmp 0x4121d3
cmp ecx, 0x5d
jne 0x412303
test dword [esi + 0x44], eax
jne 0x412303
push 4
jmp 0x4121d3
mov ax, word [esi + 0x3e]
lea ecx, [esi + 0x18]
call fcn.00412c82
jmp 0x4121f4
push 0xa
call dword [sym.imp.MSVCP100.dll_void___cdecl_std::tr1::_Xbad_enum_std::tr1::regex_constants::error_type_]
pop ecx
test bl, bl
je 0x412328
mov eax, esi
call fcn.00412b90
mov al, 1
mov bl, al
mov ecx, dword [esi + 0x40]
cmp ecx, edi
jne 0x4121af
pop edi
pop esi
pop ebx
ret
Function at 0x414881
Capabilities:
Get common file path

Disassembly:
push 0xc
mov eax, 0x423e40
call fcn.00421fb4
lea eax, [ebp - 0x10]
push eax
xor ebx, ebx
push 0x1a
push ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [ebp - 0x18], eax
cmp eax, ebx
jl 0x4148f2
cmp dword [ebp - 0x10], ebx
je 0x414900
mov eax, dword [section..data]
mov ecx, section..data
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push 0x104
lea esi, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.00401d53
push eax
push dword [ebp - 0x10]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
or eax, 0xffffffff
call fcn.004088f7
mov eax, esi
call fcn.004088b6
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004011ad
cmp dword [ebp - 0x10], ebx
je 0x414900
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp - 0x18], ebx
jl 0x41490f
cmp dword [ebp - 0x10], ebx
je 0x41490f
xor eax, eax
inc eax
jmp 0x414911
xor eax, eax
call fcn.0042208d
ret

Function at 0x41496f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x431034]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov edi, 0x206
push edi
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4149f9
xor eax, eax
push edi
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [ebp - 0x414]
push eax
push ebx
call fcn.00401f3d
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00421ac2
leave
ret

Function at 0x414ae1
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
xor ebx, ebx
push esi
cmp dword [ebp + 0x14], ebx
je 0x414b36
push edi
lea esi, [ebp - 0x38]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
call fcn.00414ba4
push dword [ebp + 0xc]
xor eax, eax
lea edi, [ebp - 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
push ebx
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
lea eax, [ebp - 0x38]
call fcn.00414b76
mov eax, esi
pop edi
jmp 0x414b41
push dword [ebp + 0xc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, dword [ebp + 8]
mov dword [esi], eax
cmp dword [ebp + 0x10], ebx
je 0x414b54
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4155c7
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
and dword [ebp - 0xc], 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov byte [ebp - 0x20], 0
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebx + 0x3c]
push eax
mov dword [ebp - 8], eax
call edi
push dword [ebp - 8]
mov esi, dword [ebx + 0x18]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, dword [ebx + 0x34]
jge 0x41568e
lea eax, [ebp - 0xc]
push eax
push 4
push ebx
push 0x414d03
push 0
push 0
call dword [sym.imp.MSVCR100.dll__beginthreadex]
mov esi, dword [ebp - 0xc]
add esp, 0x18
mov dword [ebp - 0x10], eax
test eax, eax
je 0x41568e
mov al, byte [ebp + 8]
xor ecx, ecx
test al, al
sete cl
push 0
mov byte [ebp - 0x20], al
push ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
call edi
mov dword [ebp - 0x34], esi
lea esi, [ebp - 0x20]
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add ebx, 0x10
lea eax, [ebp - 0x34]
mov ecx, ebx
movsd dword es:[edi], dword [esi]
call fcn.00416742
push eax
push ebx
lea esi, [ebp - 0x18]
call fcn.004161ee
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
jmp 0x415690
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x417a93
Capabilities:
Get file version info

Disassembly:
push 0x2c
mov eax, 0x423c33
call fcn.00421fe8
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov eax, dword [section..data]
mov ecx, section..data
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 4], ebx
push eax
push dword [ebp + 0xc]
mov byte [ebp - 4], 1
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
cmp edi, ebx
jne 0x417aef
mov dword [ebp - 0x24], 1
push 0x42a878
lea eax, [ebp - 0x24]
push eax
call sub.MSVCR100.dll__CxxThrowException
push edi
call fcn.00421ab1
mov esi, eax
pop ecx
mov dword [ebp - 0x14], esi
cmp esi, ebx
jne 0x417b10
mov dword [ebp - 0x28], 1
push 0x42a878
lea eax, [ebp - 0x28]
jmp 0x417ae9
push esi
push edi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x417b31
mov dword [ebp - 0x2c], 1
push 0x42a878
lea eax, [ebp - 0x2c]
jmp 0x417ae9
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x4285ec
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
jne 0x417b5a
mov dword [ebp - 0x30], 1
push 0x42a878
lea eax, [ebp - 0x30]
jmp 0x417ae9
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
jne 0x417b75
mov dword [ebp - 0x34], 1
push 0x42a878
lea eax, [ebp - 0x34]
jmp 0x417ae9
mov edx, dword [eax + 8]
mov esi, dword [eax + 0xc]
mov ecx, edx
mov eax, esi
shr eax, 0x10
shr ecx, 0x10
movzx edi, dx
movzx edx, si
cmp eax, ebx
jne 0x417baf
cmp edx, ebx
jne 0x417baf
cmp ecx, ebx
jne 0x417b9b
cmp edi, ebx
je 0x417bc3
push edi
push ecx
push str._d._d
lea eax, [ebp - 0x18]
call fcn.004021ec
add esp, 0xc
jmp 0x417bc3
push edx
push eax
push edi
push ecx
push 0x4287fc
lea eax, [ebp - 0x18]
call fcn.004021ec
add esp, 0x14
push dword [ebp - 0x14]
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
mov esi, dword [ebp - 0x18]
pop ecx
lea eax, [esi - 0x10]
mov dword [ebp - 0x14], ebx
call fcn.004020aa
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
lea eax, [esi - 0x10]
call fcn.004011ad
mov eax, edi
jmp 0x417c20
call fcn.0042208d
ret
Function at 0x417ef5
Capabilities:
Get storage device properties

Disassembly:
push 0x420
mov eax, 0x422cc7
call fcn.0042201e
mov eax, dword [ebp + 8]
xor esi, esi
push 0x428824
mov dword [ebp - 4], esi
push eax
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x428], esi
call fcn.0041866a
push esi
push esi
push 3
push esi
push 3
push esi
mov dword [ebp - 4], esi
push 0x428828
mov dword [ebp - 0x428], 1
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x424], eax
cmp eax, 0xffffffff
je 0x417feb
mov edi, dword [sym.imp.MSVCR100.dll_memset]
push 0xc
lea eax, [ebp - 0x41c]
push esi
push eax
mov dword [ebp - 0x42c], esi
call edi
mov ebx, 0x400
push ebx
lea eax, [ebp - 0x410]
push esi
push eax
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x418], esi
call edi
add esp, 0x18
push esi
lea eax, [ebp - 0x42c]
push eax
push ebx
lea eax, [ebp - 0x410]
push eax
push 0xc
lea eax, [ebp - 0x41c]
push eax
push 0x2d1400
push dword [ebp - 0x424]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x417fdf
mov esi, dword [ebp - 0x400]
lea esi, [ebp + esi - 0x410]
movsx eax, byte [esi]
push eax
call dword [sym.imp.MSVCR100.dll_isalnum]
pop ecx
test eax, eax
je 0x417fdf
push esi
push dword [ebp - 0x420]
call fcn.004186fa
push dword [ebp - 0x424]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x420]
call fcn.004220a1
ret
Function at 0x418bbc
Capabilities:
Read .ini file

Disassembly:
push 0x5c
mov eax, 0x424fe9
call fcn.0042201e
and dword [ebp - 0x68], 0
and dword [ebp - 0x20], 0
mov ebx, ecx
xor eax, eax
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
mov eax, 0x400
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 1
call fcn.00405873
mov edi, 0x433444
push edi
mov dword [ebp - 0x58], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 0x54], 1
lea esi, [ebp - 0x50]
mov byte [ebp - 4], 2
call fcn.00418b3e
cmp dword [ebp - 0x1c], 8
mov eax, dword [eax]
mov ecx, dword [ebp - 0x30]
jae 0x418c23
lea ecx, [ebp - 0x30]
push eax
push dword [ebp - 0x20]
push ecx
push 0x427608
push str.CrashTime
push str.StartInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, eax
mov eax, dword [ebp - 0x50]
add eax, 0xfffffff0
call fcn.004011ad
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x30]
cmp esi, eax
jb 0x418c64
add eax, eax
call fcn.00405873
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x418bfb
mov eax, esi
call fcn.00405873
push edi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x4288c4
lea eax, [ebp - 0x4c]
call fcn.004052b3
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 3
call fcn.0041988b
pop ecx
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x4c]
mov byte [ebp - 4], 5
call fcn.00405898
xor esi, esi
mov dword [ebx], esi
mov dword [ebx + 4], esi
mov dword [ebx + 8], esi
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x60]
push 0x1c
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x68], 1
mov edi, eax
mov dword [ebp - 0x50], edi
cmp edi, esi
jbe 0x418d12
push edi
mov eax, ebx
call fcn.00418f86
mov eax, dword [ebx + 4]
mov edx, eax
sub edx, dword [ebx]
mov ecx, edi
sar edx, 3
sub ecx, edx
je 0x418d00
lea ecx, [ecx*8 - 5]
mov dword [eax], esi
mov dword [eax + 4], esi
shr ecx, 2
mov esi, eax
lea edi, [eax + 8]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x50]
mov eax, dword [ebx + 4]
mov ecx, eax
sub ecx, dword [ebx]
sar ecx, 3
sub edi, ecx
lea eax, [eax + edi*8]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x5c]
mov ebx, dword [ebx]
cmp dword [ebp - 0x60], eax
je 0x418d46
mov edi, dword [ebp - 0x60]
mov esi, ebx
cmp dword [edi + 0x14], 8
jb 0x418d2b
mov eax, dword [edi]
jmp 0x418d2d
mov eax, edi
push eax
call dword [sym.imp.MSVCR100.dll__wtoi]
cdq
mov dword [esi], eax
mov dword [esi + 4], edx
add edi, 0x1c
add esi, 8
pop ecx
cmp edi, dword [ebp - 0x5c]
jne 0x418d21
lea ebx, [ebp - 0x60]
call fcn.004059c0
push 1
xor edi, edi
lea esi, [ebp - 0x30]
call fcn.00405898
mov eax, dword [ebp - 0x64]
call fcn.004220a1
ret
Function at 0x418d63
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x425289
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x431034]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
push 0
call dword [sym.imp.MSVCR100.dll__time64]
pop ecx
mov edi, eax
mov eax, dword [section..data]
mov esi, section..data
mov ecx, esi
mov dword [esp + 0x28], edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x1c], eax
and dword [esp + 0x48], 0
push dword [esp + 0x28]
mov ebx, 0x428588
push edi
push ebx
lea eax, [esp + 0x28]
call fcn.004021ec
add esp, 0xc
lea ecx, [esp + 0x2c]
call fcn.00418bbc
mov byte [esp + 0x48], 1
push dword [esp + 0x28]
mov eax, dword [esp + 0x34]
push edi
push eax
push dword [esp + 0x38]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x30]
push eax
call fcn.0041907c
mov eax, dword [eax]
add esp, 0x14
push dword [esp + 0x18]
lea edi, [esp + 0x30]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00418f4a
mov eax, dword [section..data]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x48], 2
mov eax, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x20], eax
cmp edi, eax
je 0x418eaa
mov eax, dword [edi]
mov dword [esp + 0x24], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x28], eax
mov eax, dword [section..data]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x48], 3
push dword [esp + 0x28]
lea eax, [esp + 0x1c]
push dword [esp + 0x28]
push ebx
call fcn.004021ec
mov eax, dword [esp + 0x24]
add esp, 0xc
push dword [eax - 0xc]
push eax
lea eax, [esp + 0x1c]
call fcn.00408c54
push 0x4288c4
lea eax, [esp + 0x18]
push eax
call fcn.00408c05
mov byte [esp + 0x48], 2
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.004011ad
add edi, 8
cmp edi, dword [esp + 0x20]
jne 0x418e38
mov ebx, dword [esp + 0x1c]
push dword [ebx - 0xc]
lea eax, [esp + 0x18]
push ebx
call fcn.00408c54
mov edi, 0x433444
push edi
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esp + 0x28], 1
lea esi, [esp + 0x20]
mov byte [esp + 0x48], 4
call fcn.00418b3e
push dword [eax]
mov esi, dword [esp + 0x18]
push esi
push str.CrashTime
push str.StartInfo
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
call fcn.004011ad
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [esi - 0x10]
call fcn.004011ad
xor esi, esi
cmp dword [esp + 0x2c], esi
je 0x418f23
push dword [esp + 0x2c]
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
pop ecx
lea eax, [ebx - 0x10]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
call fcn.004011ad
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret