joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42378e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x220
mov eax, 0x5643f3
call fcn.0053cd89
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x224], esi
call fcn.00437969
push eax
mov ecx, edi
call fcn.00402738
lea eax, [ebp - 0x21c]
push eax
push 0x20019
push esi
push str.SOFTWAREEPSONEpsonScanManager
mov dword [ebp - 4], esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x224], 1
mov dword [ebp - 0x21c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x42383e
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x228]
push eax
push esi
push str.InstallFolder
push dword [ebp - 0x21c]
mov dword [ebp - 0x220], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x423832
lea eax, [ebp - 0x218]
push eax
mov ecx, edi
call fcn.0040234c
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.0053ce0c
ret

Function at 0x423846
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x220
mov eax, 0x5643f3
call fcn.0053cd89
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x224], esi
call fcn.00437969
push eax
mov ecx, edi
call fcn.00402738
lea eax, [ebp - 0x21c]
push eax
push 0x20019
push esi
push str.SOFTWAREEPSONEpsonScanManager
mov dword [ebp - 4], esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x224], 1
mov dword [ebp - 0x21c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x4238f6
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x228]
push eax
push esi
push str.InstallPath
push dword [ebp - 0x21c]
mov dword [ebp - 0x220], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4238ea
lea eax, [ebp - 0x218]
push eax
mov ecx, edi
call fcn.0040234c
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.0053ce0c
ret

Function at 0x423925
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x5c9030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x418]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWAREEPSONDocument_Capture
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x418], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4239a5
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x420]
push eax
push ebx
push str.InstallPath
push dword [ebp - 0x418]
mov dword [ebp - 0x41c], 0x410
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x423999
mov bl, 1
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0053780e
leave
ret
Function at 0x4241ba
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push esi
push edi
push 0x40
xor esi, esi
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.00538410
mov dword [ebp - 0x18], esi
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
lea edi, [ebp - 4]
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 8], esi
call fcn.00422f9d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x60]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x424229
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x14]
call esi
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00402760
pop edi
xor eax, eax
pop esi
leave
ret
Function at 0x424952
Capabilities:
Read .ini file

Disassembly:
push 8
mov eax, 0x565a0d
call fcn.0053cd20
call fcn.00437969
push eax
lea ecx, [ebp - 0x10]
call fcn.00402738
mov edi, dword [ebp + 8]
push edi
lea eax, [ebp - 0x10]
push 0x599d04
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.0040a7d8
mov ebx, dword [ebp - 0x10]
add esp, 0xc
cmp dword [ebx - 0xc], esi
je 0x4249fe
cmp edi, esi
jl 0x4249fe
lea eax, [edi - 0xa]
cmp eax, 9
ja 0x4249ad
lea edi, [ebp - 0x14]
call fcn.0041224b
push dword [eax]
push esi
push ebx
push str.WatchFolder
jmp 0x4249c9
lea eax, [edi - 0x3e8]
cmp eax, 0x63
ja 0x4249e4
lea edi, [ebp - 0x14]
call fcn.0041224b
push dword [eax]
push esi
push ebx
push str.WatchFolderV2
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov edi, eax
call fcn.00402760
cmp edi, 0xffffffff
jne 0x4249f2
mov edi, dword [ebp + 8]
push esi
push esi
push esi
push edi
call fcn.00424e40
add esp, 0x10
mov edi, eax
lea ecx, [ebx - 0x10]
call fcn.00402760
mov eax, edi
jmp 0x424a09
lea ecx, [ebx - 0x10]
call fcn.00402760
or eax, 0xffffffff
call fcn.0053cdf8
ret

Function at 0x424b70
Capabilities:
Read .ini file

Disassembly:
push 8
mov eax, 0x5659ea
call fcn.0053cd20
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.00437969
push eax
lea ecx, [ebp - 0x10]
call fcn.00402738
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push 0x599d04
push eax
mov byte [ebp - 4], 1
call fcn.0040a7d8
mov esi, dword [ebp - 0x10]
add esp, 0xc
cmp dword [esi - 0xc], ebx
je 0x424c0d
cmp dword [ebp + 8], ebx
jl 0x424c0d
mov eax, dword [ebp + 0xc]
cmp dword [eax - 0xc], ebx
je 0x424be4
lea edi, [ebp - 0x14]
call fcn.0041224b
push dword [eax]
push 0xffffffffffffffff
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov edi, eax
call fcn.00402760
cmp edi, 0xffffffff
jne 0x424bf6
push ebx
push dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
call fcn.00424e40
add esp, 0x10
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.00402760
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00402760
mov eax, edi
jmp 0x424c23
lea ecx, [esi - 0x10]
call fcn.00402760
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00402760
or eax, 0xffffffff
call fcn.0053cdf8
ret
Function at 0x425328
Capabilities:
Read .ini file

Disassembly:
push 0x2c
mov eax, 0x56426a
call fcn.0053cd20
mov edi, ecx
mov ebx, dword [ebp + 8]
and dword [ebp - 0x14], 0
lea ecx, [ebp - 0x38]
call fcn.00439a5b
xor esi, esi
inc esi
mov dword [ebp - 4], esi
call fcn.00437969
push eax
lea ecx, [ebp - 0x10]
call fcn.00402738
push str..plg
push edi
mov byte [ebp - 4], 2
call fcn.00429a95
mov edi, dword [edi]
push 0
push edi
lea ecx, [ebp - 0x38]
call fcn.00439b02
test eax, eax
je 0x425409
lea ecx, [ebp - 0x38]
call fcn.004396ad
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x38]
call fcn.00439d45
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.004024a4
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402760
lea ecx, [ebp - 0x38]
call fcn.00439a1d
mov edi, dword [ebp - 0x10]
test eax, eax
jne 0x4253e6
mov eax, dword [ebp - 0x38]
push 0x10
lea ecx, [ebp - 0x38]
call dword [eax + 0x38]
test eax, eax
jne 0x4253e6
push edi
push 0xffffffffffffffff
push str.ProjectID
push str.Launch
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [ebp + 0xc], eax
je 0x4253ee
cmp dword [ebp - 0x1c], 0
jne 0x42537d
jmp 0x42540c
lea ecx, [ebp - 0x38]
call fcn.004395c7
add edi, 0xfffffff0
push edi
call fcn.00402446
add eax, 0x10
pop ecx
mov dword [ebx], eax
mov ecx, edi
jmp 0x425424
mov edi, dword [ebp - 0x10]
lea ecx, [ebp - 0x38]
call fcn.004395c7
call fcn.00437969
push eax
mov ecx, ebx
call fcn.00402738
lea ecx, [edi - 0x10]
mov dword [ebp - 0x14], esi
call fcn.00402760
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0
call fcn.00439a8d
mov eax, ebx
call fcn.0053cdf8
ret
Function at 0x425502
Capabilities:
Read .ini file

Disassembly:
push 0x84
mov eax, 0x5687a6
call fcn.0053cd20
and dword [ebp - 0x20], 0
call fcn.00437969
push eax
lea ecx, [ebp - 0x14]
call fcn.00402738
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], ebx
call fcn.00439a5b
mov byte [ebp - 4], 2
call fcn.00437969
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402738
mov byte [ebp - 4], 3
push dword [ebp + 0x10]
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.Model
call fcn.00402372
lea edi, [ebp - 0x18]
call fcn.00436d6b
add esp, 4
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0x599080
call fcn.00402372
push dword [ebp + 0x10]
lea eax, [ebp - 0x90]
push eax
call fcn.0040ff02
lea eax, [ebp - 0x90]
mov byte [ebp - 4], 5
call fcn.0041008b
movzx eax, al
test eax, eax
je 0x4255c9
lea ecx, [ebp + 0x10]
call fcn.004123b4
mov byte [ebp - 4], 6
push dword [ebp - 0x18]
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x1c]
push str._s_sAppInfo1.plg
push eax
call fcn.0040a7d8
mov byte [ebp - 4], 5
mov ecx, dword [ebp + 0x10]
add esp, 0x10
jmp 0x425606
lea ecx, [ebp - 0x10]
call fcn.004123b4
push 0x598fdc
push eax
lea eax, [ebp + 0x10]
push eax
mov byte [ebp - 4], 7
call fcn.0040195d
add esp, 0xc
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 8
call fcn.004024a4
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00402760
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402760
mov edi, dword [ebp - 0x1c]
push 0
push edi
lea ecx, [ebp - 0x3c]
call fcn.00439b02
test eax, eax
je 0x4256df
lea ecx, [ebp - 0x3c]
call fcn.004396ad
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00439d45
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 9
call fcn.004024a4
mov byte [ebp - 4], 5
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00402760
lea ecx, [ebp - 0x3c]
call fcn.00439a1d
mov esi, dword [ebp - 0x14]
test eax, eax
jne 0x42568d
mov eax, dword [ebp - 0x3c]
push 0x10
lea ecx, [ebp - 0x3c]
call dword [eax + 0x38]
test eax, eax
jne 0x42568d
push esi
push 0xffffffffffffffff
push str.ProjectID
push str.Launch
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [ebp + 0xc], eax
je 0x425695
cmp dword [ebp - 0x10], 0
jne 0x425624
jmp 0x4256e2
lea ecx, [ebp - 0x3c]
call fcn.004395c7
add esi, 0xfffffff0
push esi
call fcn.00402446
pop ecx
mov ecx, dword [ebp + 8]
add eax, 0x10
mov dword [ecx], eax
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x20], ebx
call fcn.00410061
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402760
lea ecx, [edi - 0x10]
call fcn.00402760
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], bl
call fcn.00439a8d
mov ecx, esi
jmp 0x42571f
mov esi, dword [ebp - 0x14]
call fcn.00437969
mov ecx, dword [ebp + 8]
push eax
call fcn.00402738
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x20], ebx
call fcn.00410061
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402760
lea ecx, [edi - 0x10]
call fcn.00402760
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], bl
call fcn.00439a8d
lea ecx, [esi - 0x10]
call fcn.00402760
mov eax, dword [ebp + 8]
call fcn.0053cdf8
ret
Function at 0x426f93
Capabilities:
Create thread

Disassembly:
push 0x28
mov eax, 0x568d75
call fcn.0053cd20
mov eax, dword [ebp + 8]
or dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x28], eax
xor edi, edi
lea eax, [ebp - 0x18]
push eax
push edi
lea eax, [ebp - 0x2c]
push eax
push 0x426f51
push edi
push edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x2c], ebx
call fcn.0053c02f
mov esi, eax
lea eax, [ebp - 0x18]
push eax
push edi
push ebx
push 0x426f71
push edi
push edi
mov dword [ebp - 0x20], esi
call fcn.0053c02f
add esp, 0x30
push 0xffffffffffffffff
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], eax
push 1
lea eax, [ebp - 0x34]
push eax
push 2
mov dword [ebp - 0x34], esi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 0x14], edi
je 0x42704a
push 0x599080
lea ecx, [ebp + 8]
call fcn.00402372
lea esi, [ebp - 0x1c]
mov eax, ebx
mov dword [ebp - 4], edi
call fcn.0042c4e2
push 1
lea edx, [ebp + 8]
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00421713
pop ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00402760
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402760
push dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x24]
call esi
xor eax, eax
cmp dword [ebp - 0x14], edi
sete al
call fcn.0053cdf8
ret 4

Function at 0x4274f6
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push 0x10
pop eax
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
mov byte [ebp - 1], bl
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], eax
call fcn.00538410
add esp, 0xc
push 0xf0000020
push 1
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x427593
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x8003
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x427589
push ebx
push dword [ebp + 8]
call fcn.00537a20
pop ecx
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x427580
push ebx
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x427580
mov byte [ebp - 1], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, byte [ebp - 1]
pop ebx
leave
ret
Function at 0x427b29
Capabilities:
Read .ini file

Disassembly:
push 0xb0
mov eax, 0x568d3d
call fcn.0053cd89
mov eax, dword [ebp + 8]
mov dword [ebp - 0xb4], eax
call fcn.00437969
push eax
lea ecx, [ebp - 0xac]
call fcn.00402738
and dword [ebp - 4], 0
and dword [ebp - 0xa0], 0
lea eax, [ebp - 0x9c]
push eax
push ecx
mov esi, esp
mov eax, ebx
lea edi, [ebp - 0xb0]
mov dword [ebp - 0x9c], esp
call fcn.0042c4e2
mov ecx, edi
call fcn.00422a1e
pop ecx
pop ecx
mov dword [ebp - 0x98], 0xc9
push dword [ebp - 0x98]
lea eax, [ebp - 0xac]
push 0x599d04
push eax
call fcn.0040a7d8
add esp, 0xc
cmp dword [ebp - 0x98], 0xc9
jne 0x427bbf
mov dword [ebp - 0xa8], 0x2bd
jmp 0x427c01
lea esi, [ebp - 0xbc]
mov eax, ebx
call fcn.0042c4e2
mov byte [ebp - 4], 1
push dword [ebp - 0xb0]
mov eax, dword [eax]
push eax
push 1
push dword [ebp - 0x98]
call fcn.00424e40
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0xbc]
add esp, 0x10
add ecx, 0xfffffff0
mov dword [ebp - 0xa8], eax
call fcn.00402760
lea edi, [ebp - 0x9c]
call fcn.0041224b
mov edi, eax
lea esi, [ebp - 0xa4]
mov eax, ebx
mov byte [ebp - 4], 2
call fcn.0042c4e2
push eax
lea eax, [ebp - 0xb8]
push str.DCEX.
push eax
mov byte [ebp - 4], 3
call fcn.0040ee66
mov edi, dword [edi]
mov eax, dword [eax]
add esp, 0xc
push edi
push dword [ebp - 0xa8]
mov edi, dword [ebp - 0xac]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0xb8]
mov esi, eax
test esi, esi
setg byte [ebp - 0x91]
add ecx, 0xfffffff0
call fcn.00402760
mov ecx, dword [ebp - 0xa4]
add ecx, 0xfffffff0
call fcn.00402760
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x9c]
add ecx, 0xfffffff0
call fcn.00402760
cmp byte [ebp - 0x91], 0
je 0x427ca6
mov eax, dword [ebp - 0xa0]
inc dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x90], esi
inc dword [ebp - 0x98]
cmp dword [ebp - 0x98], 0xe6
jle 0x427b8d
lea esi, [ebp - 0xa4]
mov eax, ebx
call fcn.0042c4e2
mov esi, eax
lea eax, [ebp - 0x9c]
push ebx
push eax
mov byte [ebp - 4], 4
call fcn.00425b23
pop ecx
pop ecx
lea ecx, [ebp - 0x90]
push ecx
push dword [ebp - 0xa0]
mov ecx, dword [ebp - 0xb4]
mov byte [ebp - 4], 5
push dword [esi]
mov edx, dword [eax]
call fcn.00402ef8
mov ecx, dword [ebp - 0x9c]
add ecx, 0xfffffff0
call fcn.00402760
mov ecx, dword [ebp - 0xa4]
add ecx, 0xfffffff0
call fcn.00402760
lea ecx, [edi - 0x10]
call fcn.00402760
call fcn.0053ce0c
ret 4
Function at 0x427d2a
Capabilities:
Read .ini file

Disassembly:
push 0x1c
mov eax, 0x568498
call fcn.0053cd20
call fcn.00437969
push eax
lea ecx, [ebp - 0x14]
call fcn.00402738
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp + 8]
push ecx
mov esi, esp
lea edi, [ebp - 0x18]
mov dword [ebp - 0x28], esp
call fcn.0042c4e2
mov ecx, edi
call fcn.00422a1e
pop ecx
pop ecx
mov dword [ebp - 0x10], 0xc9
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push 0x599d04
push eax
call fcn.0040a7d8
add esp, 0xc
cmp dword [ebp - 0x10], 0xc9
jne 0x427d91
mov ebx, 0x2bd
jmp 0x427dc4
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x1c]
call fcn.0042c4e2
mov byte [ebp - 4], 1
push dword [ebp - 0x18]
mov eax, dword [eax]
push eax
push 1
push dword [ebp - 0x10]
call fcn.00424e40
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
add esp, 0x10
add ecx, 0xfffffff0
mov ebx, eax
call fcn.00402760
lea edi, [ebp - 0x28]
call fcn.0041224b
mov edi, eax
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.0042c4e2
push eax
lea eax, [ebp - 0x20]
push str.DCEX.
push eax
mov byte [ebp - 4], 3
call fcn.0040ee66
mov edi, dword [edi]
mov eax, dword [eax]
add esp, 0xc
push edi
mov edi, dword [ebp - 0x14]
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x20]
mov esi, eax
test esi, esi
setg bl
add ecx, 0xfffffff0
call fcn.00402760
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00402760
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.00402760
test bl, bl
je 0x427e41
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x54]
mov dword [eax + ecx*4 + 0x58], esi
inc dword [eax + 0x54]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xe6
jle 0x427d6d
lea ecx, [edi - 0x10]
call fcn.00402760
call fcn.0053cdf8
ret
Function at 0x428426
Capabilities:
Create thread

Disassembly:
push 0x1c
mov eax, 0x568c76
call fcn.0053cd20
mov ebx, ecx
lea eax, [ebp - 0x18]
push eax
push ecx
mov esi, esp
mov eax, ebx
lea edi, [ebp - 0x14]
mov dword [ebp - 0x20], esp
call fcn.0042c4e2
mov ecx, edi
call fcn.00422a1e
push dword [ebp - 0x14]
call fcn.004280b5
add esp, 0xc
push 0x1004
call fcn.004378c8
pop ecx
test eax, eax
je 0x428474
mov esi, eax
call fcn.0042782d
mov edi, eax
jmp 0x428476
xor edi, edi
lea esi, [ebp - 0x18]
mov eax, ebx
call fcn.0042c4e2
and dword [ebp - 4], 0
lea ecx, [edi + 4]
push eax
call fcn.004024a4
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402760
lea esi, [ebp - 0x18]
mov eax, ebx
call fcn.00412bdd
lea ecx, [edi + 8]
push eax
mov dword [ebp - 4], 1
call fcn.004024a4
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402760
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.00425b23
pop ecx
pop ecx
push eax
mov ecx, edi
mov dword [ebp - 4], 2
call fcn.004024a4
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00402760
and dword [edi + 0x54], 0
and dword [edi + 0x50], 0
push ecx
mov esi, esp
mov eax, ebx
mov dword [ebp - 0x18], esp
call fcn.0042c4e2
call fcn.00423320
pop ecx
test al, al
jne 0x42852b
push ecx
mov esi, esp
mov eax, ebx
mov dword [ebp - 0x18], esp
call fcn.0042c4e2
call fcn.00422f49
pop ecx
test al, al
jne 0x42852b
xor esi, esi
xor eax, eax
jmp 0x428530
xor eax, eax
inc eax
xor esi, esi
push edi
push ebx
mov byte [edi + 0x1000], al
call fcn.00427d2a
push dword [ebp - 0x14]
mov edx, edi
mov ecx, ebx
call fcn.00427e5f
add esp, 0xc
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push esi
push esi
push esi
push esi
mov dword [ebp - 0x28], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x24], eax
push 8
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0xff4]
push eax
call fcn.00537ab0
add esp, 0xc
test byte [ebx + 0x48], 0x10
jbe 0x4285bc
mov eax, dword [ebx + 0x30]
cmp eax, 0xca
jl 0x428597
mov dword [edi + 0xffc], 0x22
jmp 0x4285bc
cmp eax, 0xc8
jl 0x4285aa
mov dword [edi + 0xffc], 0x20
jmp 0x4285bc
xor ecx, ecx
cmp eax, 0x70
setge cl
lea ecx, [ecx + ecx + 0x1a]
mov dword [edi + 0xffc], ecx
lea eax, [ebp - 0x20]
push eax
push esi
push edi
push 0x427875
push esi
push esi
mov dword [ebp - 0x20], esi
call fcn.0053c02f
add esp, 0x18
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x733c
push esi
lea eax, [ebp - 0x28]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x4285f8
mov ebx, dword [ebx + 0x4c]
jmp 0x4285fb
mov ebx, dword [ebx + 0x50]
cmp ebx, esi
je 0x428606
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
call fcn.0053cdf8
ret
Function at 0x4294e6
Capabilities:
Read .ini file

Disassembly:
push 0
mov eax, 0x56361c
call fcn.0053cd20
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
push eax
call fcn.00402446
pop ecx
push dword [0x5d1ad4]
lea esi, [eax + 0x10]
push 1
push str.FirstRun
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea ecx, [esi - 0x10]
mov edi, eax
call fcn.00402760
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402760
mov eax, edi
call fcn.0053cdf8
ret

Function at 0x429537
Capabilities:
Read .ini file

Disassembly:
push 0
mov eax, 0x56361c
call fcn.0053cd20
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
push eax
call fcn.00402446
pop ecx
push dword [0x5d1ad8]
lea esi, [eax + 0x10]
push 1
push str.FirstRun
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea ecx, [esi - 0x10]
mov edi, eax
call fcn.00402760
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402760
mov eax, edi
call fcn.0053cdf8
ret