joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4110af
Capabilities:
Shutdown system

Disassembly:
mov eax, 0x4288e8
call fcn.0041b8d0
sub esp, 0xb8
push ebx
push esi
lea eax, [ebp - 0xc4]
push eax
mov dword [ebp - 0xc4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor ebx, ebx
test eax, eax
push 2
pop esi
je 0x411137
cmp dword [ebp - 0xb4], esi
jne 0x411137
lea eax, [ebp - 0x20]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x411137
lea eax, [ebp - 0x28]
push eax
push 0x402004
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [ebp - 0x28]
push ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x24]
push ebx
push ebx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push ebx
push esi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov esi, eax
cmp esi, ebx
jne 0x4111ba
push ebx
lea ecx, [ebp - 0x1c]
call fcn.004133d0
mov dword [ebp - 4], ebx
push ebx
lea ecx, [ebp - 0x30]
call fcn.004133d0
mov byte [ebp - 4], 1
push 0x42e128
lea eax, [ebp - 0x1c]
push 0x1073
push eax
call fcn.00413429
lea eax, [ebp - 0x30]
push 0x1074
push eax
call fcn.00413429
mov ecx, dword [ebp - 0x2c]
add esp, 0x14
cmp ecx, ebx
mov eax, 0x401650
jne 0x411190
mov ecx, eax
cmp dword [ebp - 0x18], ebx
je 0x411198
mov eax, dword [ebp - 0x18]
push 0x30
push ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x30]
call fcn.0041341e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0041341e
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x411816
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ebx
jne 0x41182f
xor esi, esi
jmp 0x411863
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and eax, 0xfffffffc
call fcn.0041c620
mov esi, esp
cmp esi, ebx
je 0x41182b
and byte [esi], 0
push ebx
push ebx
push edi
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
cmp esi, ebx
mov dword [ebp + 8], esi
jne 0x41187f
call fcn.0040a6f3
mov esi, eax
jmp 0x4118fa
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
cmp edi, ebx
je 0x4118a0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
cmp esi, ebx
jne 0x4118a7
call fcn.0040a6f3
jmp 0x4118ef
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp byte [ebx + esi], 0
mov eax, esi
je 0x4118e3
lea edi, [ebx + 1]
mov eax, edi
add eax, 3
and eax, 0xfffffffc
call fcn.0041c620
mov ecx, edi
mov edx, ecx
shr ecx, 2
mov eax, esp
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
and byte [eax + ebx], 0
push dword [ebp + 0x14]
lea ecx, [ebp - 8]
push eax
call fcn.00411906
push dword [ebp + 8]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x412317
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebx, ecx
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x412322
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x4124b1
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x4289de
call fcn.0041b8d0
sub esp, 0x110
push ebx
push esi
xor esi, esi
mov ebx, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
push 0x2001f
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
push dword [ebx]
call fcn.00404be8
cmp eax, esi
jne 0x412533
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x4124fc
lea eax, [ebp - 0x11c]
push eax
call fcn.004124b1
cmp eax, esi
jne 0x412532
lea eax, [ebp - 0x1c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x11c]
push eax
push esi
push dword [ebp - 0x10]
mov dword [ebp - 0x14], pe_nt_image_headers32
call edi
test eax, eax
lea ecx, [ebp - 0x10]
je 0x4124ec
call fcn.00404bd1
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
mov esi, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00404bd1
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x4129f1
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ebx
jne 0x412a0b
xor esi, esi
jmp 0x412a3e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and eax, 0xfffffffc
call fcn.0041c620
mov esi, esp
cmp esi, ebx
je 0x412a07
push ebx
push ebx
push edi
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
mov byte [esi], bl
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push 1
push 3
push ebx
push ebx
push SysReAllocStringLen
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x412a60
call fcn.0040a6f3
jmp 0x412ab8
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea eax, [esi + 1]
add eax, 3
and eax, 0xfffffffc
call fcn.0041c620
mov edi, esp
push ebx
lea eax, [ebp - 4]
push eax
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x412a99
call fcn.0040a6f3
mov esi, eax
cmp esi, ebx
jl 0x412aad
push dword [ebp + 0xc]
mov eax, dword [ebp - 4]
push edi
lea ecx, [ebp - 0xc]
mov byte [eax + edi], bl
call fcn.00411906
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x412b7f
Capabilities:
Delete file
Get common file path
Get startup folder

Disassembly:
mov eax, 0x428a1f
call fcn.0041b8d0
sub esp, 0x128
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [ebp - 0x10]
push eax
push 7
push 0
call esi
test eax, eax
jge 0x412bb2
lea eax, [ebp - 0x10]
push eax
push 0x18
push 0
call esi
test eax, eax
jl 0x412c26
and byte [ebp - 0x134], 0
push edi
push 0x41
pop ecx
xor eax, eax
lea edi, [ebp - 0x133]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x134]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
pop edi
je 0x412c26
lea eax, [ebp - 0x134]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00405ea1
and dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
call fcn.00413951
push 0x4021d0
lea ecx, [ebp - 0x2c]
call fcn.00405e10
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x412c11
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x2c]
call fcn.00405948
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x412c33
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x428a7f
call fcn.0041b8d0
sub esp, 0x2ac
push esi
push edi
push 0x104e
lea ecx, [ebp - 0x1c]
call fcn.004133d0
and dword [ebp - 4], 0
mov eax, dword [eax + 4]
test eax, eax
mov esi, 0x401650
jne 0x412c64
mov eax, esi
push eax
lea ecx, [ebp - 0x70]
call fcn.00405ea1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.0041341e
push 0x104f
lea ecx, [ebp - 0x1c]
call fcn.004133d0
mov byte [ebp - 4], 3
mov eax, dword [eax + 4]
test eax, eax
jne 0x412c93
mov eax, esi
push eax
lea ecx, [ebp - 0x54]
call fcn.00405ea1
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1c]
call fcn.0041341e
and byte [ebp - 0x1b0], 0
push 0x41
pop ecx
xor eax, eax
lea edi, [ebp - 0x1af]
rep stosd dword es:[edi], eax
push 0x3017
lea ecx, [ebp - 0x1c]
call fcn.004133d0
mov byte [ebp - 4], 6
mov eax, dword [eax + 4]
test eax, eax
jne 0x412cd6
mov eax, esi
push eax
lea ecx, [ebp - 0x38]
call fcn.00405ea1
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1c]
call fcn.0041341e
push 0x103e
lea ecx, [ebp - 0x1c]
call fcn.004133d0
mov byte [ebp - 4], 9
mov eax, dword [eax + 4]
test eax, eax
jne 0x412d05
mov eax, esi
push eax
lea ecx, [ebp - 0xa8]
call fcn.00405ea1
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1c]
call fcn.0041341e
push 0x104d
lea ecx, [ebp - 0x1c]
call fcn.004133d0
mov byte [ebp - 4], 0xc
mov eax, dword [eax + 4]
test eax, eax
jne 0x412d37
mov eax, esi
push eax
lea ecx, [ebp - 0x8c]
call fcn.00405ea1
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x1c]
call fcn.0041341e
push 0x105
lea eax, [ebp - 0x1b0]
push eax
push dword [0x4301b8]
call fcn.004134a1
mov eax, dword [ebp - 0xa4]
push 0x10
pop esi
cmp dword [ebp - 0x90], esi
jae 0x412d7d
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x1b0]
push eax
call fcn.00413a76
cmp dword [ebp - 0x58], esi
mov edx, dword [ebp - 0x6c]
jae 0x412d95
lea edx, [ebp - 0x6c]
cmp dword [ebp - 0x74], esi
mov ecx, dword [ebp - 0x88]
jae 0x412da6
lea ecx, [ebp - 0x88]
cmp dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x34]
jae 0x412db1
lea eax, [ebp - 0x34]
lea edi, [ebp - 0x1b0]
push edi
push 0x104
lea edi, [ebp - 0x2b8]
push edi
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp dword [ebp - 0x3c], esi
mov eax, dword [ebp - 0x50]
jae 0x412dd8
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x2b8]
push eax
call fcn.0041bc58
xor esi, esi
pop ecx
inc esi
test eax, eax
pop ecx
je 0x412dfb
call fcn.0041352b
test eax, eax
je 0x412dfb
mov edi, esi
jmp 0x412dfd
xor edi, edi
mov byte [ebp - 4], 0xb
push esi
lea ecx, [ebp - 0x8c]
call fcn.00405948
mov byte [ebp - 4], 8
push esi
lea ecx, [ebp - 0xa8]
call fcn.00405948
mov byte [ebp - 4], 5
push esi
lea ecx, [ebp - 0x38]
call fcn.00405948
mov byte [ebp - 4], 2
push esi
lea ecx, [ebp - 0x54]
call fcn.00405948
or dword [ebp - 4], 0xffffffff
push esi
lea ecx, [ebp - 0x70]
call fcn.00405948
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x41357c
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
xor eax, eax
cmp esi, ebx
je 0x4136b3
push edi
mov edi, esi
stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
push esi
lea eax, [edi - 1]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp eax, ebx
je 0x4136b0
cmp eax, edi
ja 0x4136b0
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x4135da
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, ecx
jmp 0x4136b2
lea eax, [ebp + 8]
push eax
push 0x20019
push ebx
push 0x4022d8
push reloc.OLEAUT32.dll_SysReAllocString
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41367e
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 0x4022c4
push dword [ebp + 8]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], 4
call edi
test eax, eax
jne 0x413632
cmp dword [ebp - 4], ebx
sete al
mov esi, eax
cmp esi, ebx
jne 0x413669
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x40c]
push eax
push ebx
push ebx
push 0x4022b8
push dword [ebp + 8]
mov dword [ebp - 0xc], 0x400
call edi
test eax, eax
jne 0x413669
lea eax, [ebp - 0x40c]
push eax
call fcn.0041c3b9
mov esi, eax
neg esi
sbb esi, esi
pop ecx
neg esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x41367e
mov edi, dword [ebp + 0xc]
jmp 0x4135c9
mov edi, dword [ebp + 0xc]
push 0x5c
push edi
call fcn.0041d100
cmp eax, ebx
pop ecx
pop ecx
je 0x413696
cmp byte [eax + 1], bl
jne 0x413696
mov byte [eax], bl
push 0x5c
push edi
call fcn.0041d100
cmp eax, ebx
pop ecx
pop ecx
je 0x4135c9
mov byte [eax + 1], bl
jmp 0x4135c9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x414082
Capabilities:
Extract resource via kernel32 functions

Disassembly:
cmp dword [ecx], 0
je 0x41408c
jmp fcn.00413da6
jmp fcn.00413f25
Function at 0x414122
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push 0x4023bc
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4141db
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
mov edi, 0x4023ac
push edi
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4141d9
cmp dword [ebp - 8], ebx
je 0x4141d9
push dword [ebp - 8]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x4141d9
lea ecx, [ebp - 8]
push ecx
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push edi
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4141d0
cmp dword [ebp - 0xc], 7
jne 0x4141d0
mov esi, dword [ebp - 0x10]
jmp 0x4141c3
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x4141c9
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esi + eax + 1]
cmp byte [esi], bl
jne 0x4141aa
jmp 0x4141d0
mov dword [ebp - 0x14], 1
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
cmp dword [ebp - 4], ebx
pop ebx
je 0x4141ea
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
leave
ret 4

Function at 0x414298
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
call fcn.004141f1
test eax, eax
je 0x4142de
mov eax, dword [ebp + 8]
xor ecx, ecx
sub eax, ecx
push esi
push edi
je 0x4142bc
dec eax
jne 0x4142c9
mov esi, 0x402458
jmp 0x4142c1
mov esi, 0x402448
lea edi, [ebp - 0x64]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push ecx
push ecx
lea eax, [ebp - 0x64]
push eax
push 0x402440
push ecx
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
leave
ret 4
Function at 0x4149c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xbc
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x44], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x414ad8
cmp dword [ebp - 0x34], 2
je 0x414a54
lea eax, [ebp + 0x74]
push eax
push 0x20019
push 0
push 0x402690
push SysReAllocStringLen
mov dword [ebp + 0x70], 0x20
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x414ad8
lea eax, [ebp + 0x70]
push eax
lea eax, [ebp + 0x50]
push eax
push 0
push 0
push 0x401650
push dword [ebp + 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x414ad8
push dword [ebp + 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10
lea eax, [ebp + 0x50]
push 0
push eax
call fcn.0041d0e9
add esp, 0xc
jmp 0x414b0e
mov eax, dword [ebp - 0x40]
fild dword [ebp - 0x40]
test eax, eax
jge 0x414a64
fadd qword [0x402688]
fcomp qword [0x402680]
fnstsw ax
test ah, 1
jne 0x414a94
push 0x40266c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x414ad8
push 0x402650
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x414ad8
call eax
jmp 0x414b0e
lea eax, [ebp + 0x74]
push eax

Function at 0x41546e
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x18], 0x10
push edi
lea edi, [esi + 4]
jb 0x415489
mov eax, dword [edi]
jmp 0x41548b
mov eax, edi
push eax
push 0x400
lea eax, [ebp - 0x40c]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp dword [esi + 0x18], 0x10
jb 0x4154ab
mov edi, dword [edi]
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x18], 0x10
jb 0x4154b9
mov eax, dword [eax + 4]
jmp 0x4154bc
add eax, 4
push edi
push 0xa
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
leave
ret 8

Function at 0x415cb5
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x428c50
call fcn.0041b8d0
sub esp, 0x108
and dword [ebp - 0x10], 0
and byte [ebp - 0x114], 0
push edi
mov edx, ecx
push 0x40
xor eax, eax
cmp dword [edx + 0x28], 0x10
pop ecx
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop edi
jb 0x415cef
mov edx, dword [edx + 0x14]
jmp 0x415cf2
add edx, 0x14
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x18], 0x10
jb 0x415d00
mov eax, dword [eax + 4]
jmp 0x415d03
add eax, 4
push edx
push 0x104
lea ecx, [ebp - 0x114]
push ecx
push 0x401650
push 0x402768
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x114]
push eax
call fcn.00405ea1
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], 1
mov dword fs:[0], ecx
leave
ret 8
Function at 0x415fcd
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x428ca4
call fcn.0041b8d0
sub esp, 0x938
push ebx
push esi
push edi
push dword [ebp + 8]
mov ebx, 0x400
push ebx
lea eax, [ebp - 0x944]
push eax
xor edi, edi
push edi
push edi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push dword [ebp + 8]
lea eax, [ebp - 0x544]
push ebx
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
cmp eax, 0x3fe
jb 0x41601f
xor eax, eax
jmp 0x416153
cmp eax, edi
jne 0x41602b
xor eax, eax
inc eax
jmp 0x416153
xor ebx, ebx
xor eax, eax
inc ebx
mov cl, byte [ebp + edi - 0x544]
test cl, cl
je 0x416049
mov byte [ebp + eax - 0x144], cl
inc edi
inc eax
jmp 0x4160cd
cmp byte [ebp + edi - 0x543], 0
je 0x4160db
and byte [ebp + eax - 0x144], 0
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x44]
call fcn.00405ea1
and dword [ebp - 4], 0
push eax
lea eax, [esi + 0x10]
push eax
mov ecx, esi
call fcn.0041546e
mov dword [ebp + 8], eax
or dword [ebp - 4], 0xffffffff
push ebx
lea ecx, [ebp - 0x44]
call fcn.00405948
cmp dword [ebp + 8], 0
je 0x4160c3
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x28]
call fcn.00405ea1
mov dword [ebp - 4], ebx
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + 4]
lea edx, [ebp - 0x28]
push edx
push eax
call fcn.00415d4d
or dword [ebp - 4], 0xffffffff
push ebx
lea ecx, [ebp - 0x28]
call fcn.00405948
and byte [ebp - 0x144], 0
xor eax, eax
inc edi
cmp edi, 0x400
jb 0x416030
jmp 0x416151
mov cl, byte [ebp + edi - 0x544]
mov byte [ebp + eax - 0x144], cl
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x44]
call fcn.00405ea1
mov dword [ebp - 4], 2
push eax
lea eax, [esi + 0x10]
push eax
mov ecx, esi
call fcn.0041546e
mov esi, eax
or dword [ebp - 4], 0xffffffff
push ebx
lea ecx, [ebp - 0x44]
call fcn.00405948
test esi, esi
je 0x416151
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x28]
call fcn.00405ea1
mov dword [ebp - 4], 3
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + 4]
lea edx, [ebp - 0x28]
push edx
push eax
call fcn.00415d4d
or dword [ebp - 4], 0xffffffff
push ebx
lea ecx, [ebp - 0x28]
call fcn.00405948
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x4169b2
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
push 0x10
pop ebx
cmp dword [ecx + 0x18], ebx
jb 0x4169cb
mov esi, dword [ecx + 4]
jmp 0x4169ce
lea esi, [ecx + 4]
lea edi, [ecx + 0x38]
cmp dword [edi + 0x18], ebx
jb 0x4169db
mov edx, dword [edi + 4]
jmp 0x4169de
lea edx, [edi + 4]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], ebx
jb 0x4169eb
mov eax, dword [eax + 4]
jmp 0x4169ee
add eax, 4
cmp dword [ecx + 0x34], ebx
jb 0x4169f8
mov ecx, dword [ecx + 0x20]
jmp 0x4169fb
add ecx, 0x20
push esi
mov esi, pe_nt_image_headers32
push esi
lea ebx, [ebp - 0x100]
push ebx
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebx, eax
cmp ebx, esi
jb 0x416a29
mov ecx, dword [ebp + 0xc]
push 0x401650
call fcn.00405e80
xor eax, eax
jmp 0x416a58
lea eax, [ebp - 0x100]
push eax
mov ecx, edi
call fcn.004138c1
test eax, eax
je 0x416a48
test ebx, ebx
je 0x416a48
lea eax, [ebp - 0x100]
push eax
jmp 0x416a4d
push 0x401650
mov ecx, dword [ebp + 0xc]
call fcn.00405e80
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x416a5f
Capabilities:
Get common file path

Disassembly:
mov eax, 0x428d94
call fcn.0041b8d0
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x18], 0x10
push esi
push edi
lea esi, [ebx + 4]
jb 0x416a7f
mov eax, dword [esi]
jmp 0x416a81
mov eax, esi
xor edi, edi
push edi
push eax
call fcn.0041c2eb
test eax, eax
pop ecx
pop ecx
jne 0x416aaa
cmp dword [ebx + 0x18], 0x10
jb 0x416a98
mov esi, dword [esi]
mov ecx, dword [ebp + 0xc]
mov al, byte [esi]
inc esi
mov byte [ecx], al
inc ecx
test al, al
jne 0x416a9b
jmp 0x416bf8
push fcn.0041d604
push ecx
mov eax, esp
mov dword [ebp + 8], esp
push eax
mov ecx, ebx
call fcn.00416691
push ecx
mov eax, esp
mov dword [ebp + 8], esp
push eax
mov ecx, ebx
call fcn.004166a8
push ecx
mov eax, esp
mov dword [ebp + 8], esp
push eax
mov ecx, ebx
call fcn.00416691
lea eax, [ebp + 8]
push eax
call fcn.00416802
push edi
push str._winsys_
mov ecx, ebx
call fcn.004167b8
or esi, 0xffffffff
cmp eax, esi
jne 0x416b1a
push edi
push str._windows_
mov ecx, ebx
call fcn.004167b8
cmp eax, esi
jne 0x416b2a
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
push 0x104
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x416b38
push 0x104
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp eax, edi
je 0x416b07
push esi
push 0x402ae4
mov ecx, ebx
call fcn.004167dd
mov edi, dword [ebp + 0xc]
mov dword [ebp + 8], eax
xor eax, eax
mov ecx, esi
repne scasb al, byte es:[edi]
mov eax, dword [ebp + 0xc]
not ecx
dec ecx
mov esi, 0x401654
lea eax, [ecx + eax - 1]
push esi
push eax
call fcn.0041bbc4
test eax, eax
pop ecx
pop ecx
je 0x416b7e
mov edi, dword [ebp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
movsw word es:[edi], word [esi]
mov edi, dword [ebp + 0xc]
mov edx, dword [ebx + 0x14]
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov eax, 0x104
dec ecx
sub eax, edx
sub eax, ecx
je 0x416b07
inc dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
mov ecx, ebx
call fcn.00405ec4
and dword [ebp - 4], 0
cmp dword [eax + 0x18], 0x10
jb 0x416bbf
mov eax, dword [eax + 4]
jmp 0x416bc2
add eax, 4
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
or ecx, 0xffffffff
mov esi, edi
mov edi, dword [ebp + 0xc]
repne scasb al, byte es:[edi]
mov ecx, edx
shr ecx, 2
dec edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x28]
call fcn.00405948
xor eax, eax
inc eax
jmp 0x416b09