joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4050e2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x405105
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x4051a4
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], edi
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x405170
jg 0x40512b
test esi, esi
je 0x405170
test ecx, ecx
jl 0x4051a9
jg 0x405135
test eax, eax
je 0x4051a9
cmp edi, ecx
jg 0x405147
jl 0x40513f
cmp esi, eax
jae 0x405147
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push eax
call fcn.004045f3
mov ecx, dword [ebp + 0x10]
add esp, 0xc
add dword [ebp + 8], ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
push ecx
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
mov eax, dword [ebp + 8]
test edi, edi
jl 0x405198
jg 0x40517d
test esi, esi
je 0x405198
cmp dword [ebx + 0x4c], 0
je 0x405198
push dword [ebx + 0x4c]
push esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
mov eax, dword [ebp + 8]
jmp 0x40517d
Function at 0x405566
Capabilities:
Delete file
Get common file path

Disassembly:
push 0x1cc
mov eax, 0x432c7e
call fcn.0041d630
mov dword [ebp - 0x148], ecx
push 0x4344ec
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBeginUltra]
lea ecx, [ebp - 0x144]
call fcn.00403aa1
and dword [ebp - 4], 0
lea ecx, [ebp - 0x12c]
call fcn.00403aa1
push 0xf
pop ecx
mov esi, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
mov byte [ebp - 4], 1
lea edi, [ebp - 0x1d8]
rep movsd dword es:[edi], dword [esi]
push 0
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.00405bf4
mov esi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
push eax
call esi
mov ebx, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
call ebx
mov edi, eax
and edi, 0x80000007
jns 0x4055de
dec edi
or edi, 0xfffffff8
inc edi
push 0
add edi, 0xa
call fcn.00405bf4
add eax, edi
push eax
call esi
add esp, 0x10
test edi, edi
jle 0x40562c
push 0
call fcn.00405bf4
mov esi, eax
call ebx
add eax, esi
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
pop ecx
pop ecx
call ebx
push 0x3f
pop ecx
xor edx, edx
div ecx
lea ecx, [ebp - 0x144]
movzx eax, byte [ebp + edx - 0x1d8]
push eax
call fcn.00404a97
sub edi, 1
jne 0x4055f4
mov esi, 0x104
lea eax, [ebp - 0x114]
push esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x405771
cmp eax, esi
ja 0x405771
lea eax, [ebp - 0x114]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
pop ecx
cmp byte [ebp + eax - 0x115], 0x5c
jne 0x405696
lea eax, [ebp - 0x114]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
dec eax
pop ecx
cmp eax, esi
jae 0x40578f
mov byte [ebp + eax - 0x114], 0
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x198]
call fcn.00405429
push 0x434538
push eax
lea eax, [ebp - 0x180]
mov byte [ebp - 4], 2
push eax
call fcn.004051cb
lea ecx, [ebp - 0x144]
mov byte [ebp - 4], 3
push ecx
push eax
lea eax, [ebp - 0x168]
push eax
call fcn.004051ae
add esp, 0x18
lea ecx, [ebp - 0x12c]
push eax
call fcn.004054d2
lea ecx, [ebp - 0x168]
call fcn.00403d61
lea ecx, [ebp - 0x180]
call fcn.00403d61
lea ecx, [ebp - 0x198]
mov byte [ebp - 4], 1
call fcn.00403d61
lea ecx, [ebp - 0x12c]
call fcn.00404582
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
sub esp, 0x14
mov ecx, esp
mov dword [ebp - 0x14c], esp
push str.Feng2022
call fcn.00405429
sub esp, 0x18
mov byte [ebp - 4], 4
lea eax, [ebp - 0x12c]
mov ecx, esp
push eax
call fcn.00403a5f
mov ecx, dword [ebp - 0x148]
mov byte [ebp - 4], 1
call fcn.0040469c
lea ecx, [ebp - 0x12c]
mov bl, al
call fcn.00403d61
lea ecx, [ebp - 0x144]
call fcn.00403d61
mov al, bl
jmp 0x405789
lea ecx, [ebp - 0x12c]
call fcn.00403d61
lea ecx, [ebp - 0x144]
call fcn.00403d61
xor al, al
call fcn.0041d5df
ret
call fcn.0041d81a
int3
Function at 0x405fb0
Capabilities:
Start service

Disassembly:
push esi
mov esi, ecx
call fcn.00405e7c
cmp eax, 3
jne 0x405fc1
xor al, al
pop esi
ret
cmp eax, 4
je 0x405ff1
cmp eax, 2
je 0x405ff1
push ebx
xor ebx, ebx
push ebx
push ebx
push dword [esi + 0x34]
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov ecx, esi
call fcn.00405e7c
cmp eax, 4
je 0x405fea
cmp eax, 2
jne 0x405fec
mov bl, 1
mov al, bl
pop ebx
pop esi
ret
mov al, 1
pop esi
ret

Function at 0x406355
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
mov edx, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
add ecx, 0xc
mov eax, ecx
cmp edx, dword [ecx + 0x18]
je 0x406379
mov ecx, dword [ecx + 4]
cmp ecx, eax
jne 0x406369
xor al, al
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov al, 1
pop ebp
ret
Function at 0x406382
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x98
push esi
push edi
push str.duanlian2
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBeginUltra]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x50]
push dword [ebp - 4]
mov byte [ebp - 8], 0
push dword [ebp - 8]
push dword [ebp - 0x10]
call fcn.004060ac
mov ecx, eax
call fcn.00406267
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x406541
mov byte [ebp - 8], 0
lea ecx, [ebp - 0x70]
push dword [ebp - 8]
mov byte [ebp - 4], 0
push dword [ebp - 4]
push dword [ebp - 0x10]
call fcn.0040610b
mov ecx, eax
call fcn.00406267
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
push edi
call esi
mov byte [ebp - 8], 0
lea ecx, [ebp - 0x90]
push dword [ebp - 8]
mov byte [ebp - 4], 0
push dword [ebp - 4]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call fcn.0040616a
mov ecx, eax
call fcn.00406267
push eax
push edi
call esi
mov byte [ebp - 8], 0
lea ecx, [ebp - 0x30]
push dword [ebp - 8]
mov byte [ebp - 4], 0
push dword [ebp - 4]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x10]
call fcn.004061c9
mov ecx, eax
call fcn.004062f9
push eax
push edi
call esi
push dword [ebx + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 8]
push eax
call fcn.00406355
pop ecx
pop ecx
test al, al
je 0x406541
mov esi, dword [ebp - 8]
push 0x40
push 0x1000
push dword [esi + 0x20]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
je 0x406541
push dword [esi + 0x20]
push 0
push edi
call sub.VCRUNTIME140.dll_memset
push dword [esi + 0x20]
push dword [ebx + 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x18
cmp byte [ebx + 0xc], 0
je 0x4064be
push 0x1000
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push esi
call fcn.004061fe
pop ecx
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
test eax, eax
je 0x406533
push 0x1000
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x44
push 0x43be68
push dword [ebp - 4]
call sub.VCRUNTIME140.dll_memcpy
push edi
push dword [esi + 0x20]
mov esi, dword [ebp - 4]
push dword [ebx + 8]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x10]
call esi
add esp, 0x30
mov byte [ebp - 9], al
push 0x8000
push 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFree]
call esi
push 0x8000
push 0
push edi
call esi
mov al, byte [ebp - 9]
jmp 0x406543
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4083d9
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x43bfc0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.00416e82
mov dword [0x43bf08], eax
mov dword [0x43bf0c], edx
call fcn.004095a2
test al, al
je 0x408606
push 1
push 0x4c3d14bc
push dword [0x43c2dc]
call fcn.0040826b
add esp, 0xc
xor edi, edi
cmp eax, 0x28
je 0x40848a
push 1
push 0x4c3d14c0
push dword [0x43c2dc]
call fcn.0040826b
add esp, 0xc
cmp eax, 4
je 0x40848a
sub esp, 0x18
mov byte [ebp - 0x10], 0
mov esi, esp
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x30]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.00407e36
mov ecx, eax
call fcn.004062f9
push eax
mov ecx, esi
call fcn.00408342
call fcn.0040a16b
add esp, 0x18
call fcn.00416d20
push edi
push 0x1f4
call fcn.0041655c
pop ecx
pop ecx
mov esi, edi
call fcn.00416d20
push 0x499
call fcn.00417174
pop ecx
cmp edx, edi
ja 0x408511
jb 0x4084b4
cmp eax, 1
jae 0x408511
cmp byte [0x43c318], 1
jne 0x408511
mov eax, dword [0x43bf0c]
add eax, 0x14d
push eax
mov eax, dword [0x43bf08]
add eax, 0x293
push eax
call fcn.00416ddc
call fcn.00416d7c
mov eax, dword [0x43bf0c]
add eax, 0x183
push eax
mov eax, dword [0x43bf08]
add eax, 0x2cd
push eax
call fcn.00416ddc
call fcn.00416d7c
push edi
push 0x1f4
call fcn.0041655c
add esp, 0x18
inc esi
cmp esi, 3
jl 0x408499
call fcn.00416d20
push edi
mov esi, 0x1f4
push esi
call fcn.0041655c
call fcn.00408619
push edi
push esi
call fcn.0041655c
call fcn.00416d20
push 0x46
push 0x20
call fcn.00416a6c
mov esi, dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0xc]
add esp, 0x18
push eax
call esi
test eax, eax
jne 0x408555
lea eax, [ebp - 0xc]
push eax
call esi
mov eax, dword [ebp - 8]
add eax, 0xffffffbf
push eax
push dword [ebp - 0xc]
call fcn.00416ddc
pop ecx
pop ecx
call fcn.00416d20
call fcn.00416d7c
lea eax, [ebp - 0xc]
push eax
call esi
test eax, eax
jne 0x408580
lea eax, [ebp - 0xc]
push eax
call esi
mov eax, dword [ebp - 8]
add eax, 0x41
push eax
push dword [ebp - 0xc]
call fcn.00416ddc
pop ecx
pop ecx
lea eax, [ebp - 0xc]
push eax
call esi
test eax, eax
jne 0x4085a1
lea eax, [ebp - 0xc]
push eax
call esi
mov eax, dword [ebp - 0xc]
push dword [ebp - 8]
add eax, 0xffffffce
push eax
call fcn.00416ddc
call fcn.00416d20
call fcn.00416d7c
push edi
push 0xbb8
call fcn.0041655c
push 0x46
push 0x1b
call fcn.00416a6c
push edi
push 0x320
call fcn.0041655c
push 0x499
call fcn.00417174
add esp, 0x24
test edx, edx
jne 0x4085ee
test eax, eax
je 0x408606
push 0
push 0x1f4
call fcn.0041655c
push 0x46
push 0x1b
call fcn.00416a6c
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041d5bd
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x40b683
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
lea edx, [ecx - 1]
mov ebx, edx
mov dword [ebp - 4], edi
sar ebx, 1
mov eax, edi
mov dword [ebp + 0xc], edx
cmp edi, ebx
jge 0x40b6e4
mov ecx, dword [ebp + 8]
lea edx, [eax + eax]
lea eax, [edx + 2]
imul eax, eax, 0x14
add ecx, eax
lea eax, [ecx - 0x14]
push eax
push ecx
lea ecx, [ebp + 0x18]
call fcn.0040c862
movzx eax, al
xor eax, 1
imul edi, edi, 0x14
inc eax
add eax, edx
mov edx, dword [ebp + 8]
imul esi, eax, 0x14
push 5
add edi, edx
pop ecx
add esi, edx
rep movsd dword es:[edi], dword [esi]
mov edi, eax
cmp eax, ebx
jl 0x40b6a3
mov ecx, dword [ebp + 0x10]
jmp 0x40b6e7
mov edx, dword [ebp + 8]
cmp eax, ebx
jne 0x40b705
test cl, 1
jne 0x40b705
imul esi, ecx, 0x14
imul edi, edi, 0x14
push 5
pop ecx
add esi, 0xffffffec
add esi, edx
add edi, edx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 0xc]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 4]
push edi
push edx
call fcn.0040b79d
add esp, 0x14
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40cca6
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov esi, dword [ebp + 0xc]
cmp dword [ebp + 0x10], edx
jbe 0x40ccc9
movzx eax, byte [esi + edx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [ebp + 0x10]
jb 0x40ccb7
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x415720
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x43c2f4]
push esi
mov esi, dword [ebp + 8]
movzx ecx, si
push edi
test eax, eax
jne 0x415777
cmp si, 0x25
je 0x415756
cmp si, 0x26
je 0x415756
cmp si, 0x27
je 0x415756
cmp si, 0x28
je 0x415756
cmp si, 0x22
je 0x415756
push 2
jmp 0x415758
push 3
pop eax
push 0
push eax
push 0
movzx edi, si
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push esi
call dword [sym.imp.USER32.dll_keybd_event]
mov eax, dword [0x43c2f4]
jmp 0x415779
mov edi, ecx
cmp eax, 1
jne 0x41578a
push edi
call fcn.00416305
mov eax, dword [0x43c2f4]
pop ecx
cmp eax, 2
jne 0x415796
push edi
call fcn.00416a9f
pop ecx
pop edi
pop esi
pop ebp
ret

Function at 0x415e01
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x43c2f4]
push esi
mov esi, dword [ebp + 8]
movzx ecx, si
push edi
test eax, eax
jne 0x415e58
cmp si, 0x25
je 0x415e37
cmp si, 0x26
je 0x415e37
cmp si, 0x27
je 0x415e37
cmp si, 0x28
je 0x415e37
cmp si, 0x22
je 0x415e37
push 2
jmp 0x415e39
push 3
pop eax
push 0
push eax
push 0
movzx edi, si
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push esi
call dword [sym.imp.USER32.dll_keybd_event]
mov eax, dword [0x43c2f4]
jmp 0x415e5a
mov edi, ecx
cmp eax, 1
jne 0x415e6b
push edi
call fcn.00416305
mov eax, dword [0x43c2f4]
pop ecx
cmp eax, 2
jne 0x415e77
push edi
call fcn.00416a9f
pop ecx
push 0
push 0xf
call fcn.0041655c
pop ecx
pop ecx
pop edi
pop esi
pop ebp
ret
Function at 0x415ea6
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x43bfc0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x415f29
movd xmm0, dword [ebp + 8]
lea eax, [ebp - 0xc]
cvtdq2pd xmm0, xmm0
push ebx
push edi
push eax
divsd xmm0, qword [0x434708]
movsd qword [ebp - 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
call fcn.0041ddd0
lea eax, [ebp - 0xc]
movsd qword [ebp - 0x14], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
sub ecx, edi
sbb edx, ebx
call fcn.0041ddd0
divsd xmm0, qword [ebp - 0x14]
movsd xmm1, qword [ebp - 0x1c]
comisd xmm1, xmm0
ja 0x415efe
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d5bd
leave
ret

Function at 0x415f35
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x43c2f4]
push esi
mov esi, dword [ebp + 8]
movzx ecx, si
push edi
test eax, eax
jne 0x415f88
cmp si, 0x25
je 0x415f67
cmp si, 0x26
je 0x415f67
cmp si, 0x27
je 0x415f67
cmp si, 0x28
je 0x415f67
cmp si, 0x22
jne 0x415f6a
xor eax, eax
inc eax
push 0
push eax
push 0
movzx edi, si
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push esi
call dword [sym.imp.USER32.dll_keybd_event]
mov eax, dword [0x43c2f4]
jmp 0x415f8a
mov edi, ecx
cmp eax, 1
jne 0x415f9b
push edi
call fcn.00416319
mov eax, dword [0x43c2f4]
pop ecx
cmp eax, 2
jne 0x415fa7
push edi
call fcn.00416aaf
pop ecx
pop edi
pop esi
pop ebp
ret
Function at 0x41636a
Capabilities:
Link many functions at runtime
Terminate process

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x48
push esi
push edi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
push dword [ebp - 4]
mov byte [ebp - 8], 0
push dword [ebp - 8]
push dword [ebp - 8]
call fcn.004148e5
mov ecx, eax
call fcn.00406267
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [ebp - 8], 0
lea ecx, [ebp - 0x20]
push dword [ebp - 8]
mov byte [ebp - 4], 0
mov edi, eax
push dword [ebp - 4]
push dword [ebp - 8]
test edi, edi
jne 0x416406
call fcn.00406569
mov ecx, eax
call fcn.004062f9
mov byte [ebp - 8], 0
lea ecx, [ebp - 0x40]
push dword [ebp - 8]
mov byte [ebp - 4], 0
mov esi, eax
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00414acb
mov ecx, eax
call fcn.00406267
push edi
push 0x10
push esi
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxExW]
push edi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call fcn.00414bbe
mov ecx, eax
call fcn.004062f9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
push edi
call esi
mov byte [ebp - 8], 0
lea ecx, [ebp - 0x20]
push dword [ebp - 8]
mov byte [ebp - 4], 0
push dword [ebp - 4]
mov dword [0x43c3e4], eax
push dword [ebp - 8]
call fcn.00414c28
mov ecx, eax
call fcn.004062f9
push eax
push edi
call esi
mov byte [ebp - 8], 0
lea ecx, [ebp - 0x20]
push dword [ebp - 8]
mov byte [ebp - 4], 0
push dword [ebp - 4]
mov dword [0x43c3f4], eax
push dword [ebp - 8]
call fcn.00414c92
mov ecx, eax
call fcn.004062f9
push eax
push edi
call esi
mov byte [ebp - 8], 0
lea ecx, [ebp - 0x20]
push dword [ebp - 8]
mov byte [ebp - 4], 0
push dword [ebp - 4]
mov dword [0x43c3ec], eax
push dword [ebp - 8]
call fcn.00414cfc
mov ecx, eax
call fcn.004062f9
push eax
push edi
call esi
mov byte [ebp - 8], 0
lea ecx, [ebp - 0x20]
push dword [ebp - 8]
mov byte [ebp - 4], 0
push dword [ebp - 4]
mov dword [0x43c3f0], eax
push dword [ebp - 8]
call fcn.00414d66
mov ecx, eax
call fcn.004062f9
push eax
push edi
call esi
mov byte [ebp - 8], 0
lea ecx, [ebp - 0x20]
push dword [ebp - 8]
mov byte [ebp - 4], 0
push dword [ebp - 4]
mov dword [0x43c3f8], eax
push dword [ebp - 8]
call fcn.00414dd0
mov ecx, eax
call fcn.004062f9
push eax
push edi
call esi
mov byte [ebp - 8], 0
lea ecx, [ebp - 0x20]
push dword [ebp - 8]
mov byte [ebp - 4], 0
push dword [ebp - 4]
mov dword [0x43c3fc], eax
push dword [ebp - 8]
call fcn.004147dc
mov ecx, eax
call fcn.004062f9
push eax
push edi
call esi
mov byte [ebp - 8], 0
lea ecx, [ebp - 0x20]
push dword [ebp - 8]
mov byte [ebp - 4], 0
push dword [ebp - 4]
mov dword [0x43c400], eax
push dword [ebp - 8]
call fcn.00414846
mov ecx, eax
call fcn.004062f9
push eax
push edi
call esi
push 1
push edi
mov dword [0x43c408], eax
call fcn.00406382
mov eax, dword [0x43c3e4]
pop ecx
pop ecx
push 1
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4166fe
Capabilities:
Read .ini file

Disassembly:
push 0x10
push 0x258
mov eax, 0x433ae2
call fcn.0041db68
mov esi, dword [ebx + 8]
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x22c], esi
and dword [ebp - 4], 0
push 0x4346f0
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBeginUltra]
mov edi, 0x1f4
lea eax, [ebp - 0x210]
push edi
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__getcwd]
pop ecx
pop ecx
test eax, eax
je 0x416847
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x228]
call fcn.00405429
mov byte [ebp - 0x230], 0
lea ecx, [ebp - 0x250]
push dword [ebp - 0x230]
mov byte [ebp - 0x22c], 0
push dword [ebp - 0x22c]
mov byte [ebp - 4], 1
push dword [ebp - 0x234]
call fcn.004149d8
mov ecx, eax
call fcn.004062f9
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x268]
push eax
call fcn.00414e3a
add esp, 0xc
lea ecx, [ebp - 0x228]
push eax
call fcn.004054d2
lea ecx, [ebp - 0x268]
call fcn.00403d61
push edi
lea eax, [ebp - 0x210]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x228]
call fcn.00404582
lea ecx, [ebx + 0xc]
mov esi, eax
call fcn.00404582
mov byte [ebp - 0x22c], 0
lea ecx, [ebp - 0x250]
push dword [ebp - 0x22c]
mov byte [ebp - 0x230], 0
mov edi, eax
push dword [ebp - 0x230]
push dword [ebp - 0x234]
call fcn.00414b2a
mov ecx, eax
call fcn.004062f9
push esi
push 0x1f4
lea ecx, [ebp - 0x210]
push ecx
push 0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 0
call fcn.00403d61
mov esi, dword [ebp - 0x234]
lea eax, [ebp - 0x210]
mov ecx, esi
push eax
call fcn.00405429
lea ecx, [ebx + 0xc]
call fcn.00403d61
mov eax, esi
mov ecx, dword [ebp - 0x14]
call fcn.0041db46
ret
Function at 0x416936
Capabilities:
Read .ini file

Disassembly:
push 0x10
push 0x158
mov eax, 0x433b27
call fcn.0041db68
xor eax, eax
push 0x4346f0
mov dword [ebp - 0x13c], eax
mov dword [ebp - 4], eax
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBeginUltra]
lea eax, [ebp - 0x120]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__getcwd]
pop ecx
pop ecx
test eax, eax
je 0x416a55
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x138]
call fcn.00405429
xor ecx, ecx
mov byte [ebp - 4], 1
mov byte [ebp - 0x13c], cl
push dword [ebp - 0x13c]
mov byte [ebp - 0x140], cl
lea ecx, [ebp - 0x150]
push dword [ebp - 0x140]
push dword [ebp - 0x140]
call fcn.004149d8
mov ecx, eax
call fcn.004062f9
push eax
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x168]
push eax
call fcn.00414e3a
add esp, 0xc
lea ecx, [ebp - 0x138]
push eax
call fcn.004054d2
lea ecx, [ebp - 0x168]
call fcn.00403d61
lea ecx, [ebp - 0x138]
call fcn.00404582
lea ecx, [ebx + 8]
mov edi, eax
call fcn.00404582
mov esi, eax
lea ecx, [ebp - 0x150]
xor eax, eax
mov byte [ebp - 0x140], al
push dword [ebp - 0x140]
mov byte [ebp - 0x13c], al
push dword [ebp - 0x13c]
push dword [ebp - 0x140]
call fcn.00414b2a
mov ecx, eax
call fcn.004062f9
push edi
xor ecx, ecx
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [ebp - 0x138]
mov dword [ebp - 0x13c], eax
call fcn.00403d61
lea ecx, [ebx + 8]
call fcn.00403d61
mov eax, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x14]
call fcn.0041db46
ret
Function at 0x41e512
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41e551
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41e551
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41e551
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41e551
cmp dword [ecx + 0x74], 0xe
jbe 0x41e551
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret