joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9434b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3bd000]
push edi
or ebp, 0xffffffff
jmp 0x9434d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x9434d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9434c8
mov eax, 1
add ebx, ebx
jne 0x9434eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x9434fc
jne 0x94351b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x94351b
dec eax
add ebx, ebx
jne 0x943508
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x9434e0
add ebx, ebx
jne 0x943517
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x94356d
xor ecx, ecx
sub eax, 3
jb 0x943533
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x9435a2
sar eax, 1
mov ebp, eax
jmp 0x94353e
add ebx, ebx
jne 0x94353e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x94350c
inc ecx
add ebx, ebx
jne 0x94354c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x94350c
add ebx, ebx
jne 0x943559
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x94354e
jne 0x94356a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x94354e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x94358c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x94357e
jmp 0x9434ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x94358c
add edi, ecx
jmp 0x9434ce
pop esi
mov edi, esi
mov ecx, 0x35a2e3
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x9435c7
cmp byte [edi], 0x5c
jne 0x9435ac
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x9435aa
lea edi, [esi + 0x53f000]
mov eax, dword [edi]
or eax, eax
je 0x94360f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x54401c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x544134]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x9435cd
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x544138]
or eax, eax
je 0x943609
mov dword [ebx], eax
add ebx, 4
jmp 0x9435ea
call dword [esi + 0x544148]
mov ebp, dword [esi + 0x54413c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x943643
sub esp, 0xffffff80
jmp 0x7abbc4
Function at 0x5fc1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.005fc140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.005fc140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.005fc140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.005fc140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x5fcbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5fcc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x60e87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5fcc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x5fcc52
xor eax, eax
pop esi
leave
ret 4

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x758848fb
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x372e6625
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x62cd2dc3
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x563c656f
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Get routing table

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor esi, esi
inc esi
push esi
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push ebx
mov dword [ebp - 4], ebx
call sub.iphlpapi.dll_GetIpForwardTable
cmp dword [ebp - 4], ebx
je 0x4010d4
push dword [ebp - 4]
call fcn.00467413
mov edi, eax
cmp edi, ebx
pop ecx
je 0x4010d4
push dword [ebp - 4]
push ebx
push edi
call fcn.004665b0
add esp, 0xc
push esi
lea eax, [ebp - 4]
push eax
push edi
call sub.iphlpapi.dll_GetIpForwardTable
test eax, eax
je 0x401079
cmp dword [0x4c0558], 2
jne 0x401071
push str.GetIpForwardTable_fail_n
call fcn.00475895
add eax, 0x40
push eax
call fcn.0046a56f
pop ecx
pop ecx
push edi
call fcn.0046662f
jmp 0x4010f1
cmp dword [edi], ebx
mov dword [ebp - 8], ebx
jbe 0x4010bd
lea esi, [edi + 4]
cmp dword [0x4c0558], 2
jne 0x4010a7
push dword [esi + 4]
push dword [esi]
push str.MIB_IPFORWARDROW__lu__lu_n
call fcn.00475895
add eax, 0x40
push eax
call fcn.0046a56f
add esp, 0x10
cmp dword [esi], ebx
jne 0x4010b0
cmp dword [esi + 4], ebx
je 0x4010c8
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
add esi, 0x38
cmp eax, dword [edi]
jb 0x401083
push edi
call fcn.0046662f
pop ecx
xor eax, eax
jmp 0x4010f4
push edi
call fcn.0046662f
xor eax, eax
pop ecx
inc eax
jmp 0x4010f4
cmp dword [0x4c0558], 2
jne 0x4010f2
push str.size__0__malloc_fail_n
call fcn.00475895
add eax, 0x40
push eax
call fcn.0046a56f
pop ecx
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4010f9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x4bc660]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
push 0x7fe
lea eax, [ebp - 0x802]
push edi
push eax
mov word [ebp - 0x804], di
call fcn.004665b0
push 0xffffffffffffffff
push str.SOFTWARETencent_bugReport_
mov esi, 0x400
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.004674d6
push 0x4c0580
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.0046852e
add esp, 0x28
lea eax, [ebp - 0x810]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x804]
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4011d8
push 4
pop esi
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x80c]
push eax
push edi
push str.lcdbg
push dword [ebp - 0x810]
mov dword [ebp - 0x808], edi
mov dword [ebp - 0x814], esi
mov dword [ebp - 0x80c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x810]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x80c], esi
je 0x4011d0
mov dword [ebp - 0x808], edi
mov eax, dword [ebp - 0x808]
jmp 0x4011da
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00464a9b
leave
ret
Function at 0x4017e1
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x4bc660]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp byte [0x4c05c8], bl
push esi
jne 0x4018c5
cmp eax, ebx
mov byte [0x4c05c8], 1
je 0x4018c5
cmp word [eax], bx
je 0x4018c5
push 0xffffffffffffffff
push eax
push 0x21
mov esi, 0x4c0580
push esi
call fcn.004674d6
push 0x63
lea eax, [ebp - 0x67]
push ebx
push eax
mov byte [ebp - 0x68], bl
call fcn.004665b0
add esp, 0x1c
push ebx
push ebx
push 0x63
lea eax, [ebp - 0x68]
push eax
push 0xffffffffffffffff
push esi
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0xffffffffffffffff
lea eax, [ebp - 0x68]
push eax
push 0x21
push 0x4c055c
call fcn.00467f04
add esp, 0x10
cmp byte [0x4c055c], bl
je 0x4018c5
movzx eax, word [ebp + 0xc]
movzx ecx, word [ebp + 0x10]
imul eax, eax, 0x64
add eax, ecx
imul eax, eax, 0x2710
add eax, dword [ebp + 0x14]
mov dword [ebp - 0x6c], ebx
mov dword [0x4c05c4], eax
lea eax, [ebp - 0x6c]
push eax
push 4
push ebx
push 0x4011e8
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
cmp esi, ebx
je 0x4018c5
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4018c8
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00464a9b
leave
ret

Function at 0x401b4f
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x4bc660]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push esi
push esi
push 3
push esi
push 3
push esi
push str..PhysicalDrive0
mov dword [ebp - 0x414], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401c29
push edi
push 0xc
lea eax, [ebp - 0x410]
push esi
push eax
call fcn.004665b0
mov edi, 0x400
push edi
lea eax, [ebp - 0x404]
push esi
push eax
mov dword [ebp - 0x410], esi
mov dword [ebp - 0x40c], esi
mov dword [ebp - 0x418], esi
call fcn.004665b0
add esp, 0x18
push esi
lea eax, [ebp - 0x418]
push eax
push edi
lea eax, [ebp - 0x404]
push eax
push 0xc
lea eax, [ebp - 0x410]
push eax
push 0x2d1400
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
pop edi
je 0x401c22
mov esi, dword [ebp - 0x3f4]
lea esi, [ebp + esi - 0x404]
movsx eax, byte [esi]
push eax
call fcn.00468fbb
test eax, eax
pop ecx
je 0x401c22
mov ecx, dword [ebp - 0x414]
push esi
call fcn.0040209f
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x401c2b
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00464a9b
leave
ret 4
Function at 0x402821
Capabilities:
Hash data with md5

Disassembly:
push 0x5c
push 0
push esi
call fcn.004665b0
and dword [esi + 0x10], 0
and dword [esi + 0x14], 0
and dword [esi + 0x58], 0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
ret
Function at 0x40362d
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
push esi
xor esi, esi
and dword [ebp - 4], esi
push edi
lea eax, [ebp - 8]
push eax
push esi
push 0
push 0
push 2
call sub.iphlpapi.dll_GetAdaptersAddresses
mov edi, eax
cmp edi, 0x6f
jne 0x403678
test esi, esi
je 0x403660
push esi
call fcn.0046662a
pop ecx
push dword [ebp - 8]
call fcn.0046696d
mov esi, eax
test esi, esi
pop ecx
je 0x4036b0
inc dword [ebp - 4]
cmp dword [ebp - 4], 5
jl 0x40363e
test edi, edi
jne 0x4036a5
test esi, esi
je 0x4036b0
push dword [ebp + 8]
mov ecx, esi
call fcn.004036b8
mov edi, eax
test edi, edi
je 0x40369a
push dword [ebp + 8]
call fcn.00403fd6
mov edi, eax
push esi
call fcn.0046662a
pop ecx
mov eax, edi
jmp 0x4036b2
test esi, esi
je 0x4036b0
push esi
call fcn.0046662a
pop ecx
xor eax, eax
pop edi
pop esi
leave
ret 4

Function at 0x4064e5
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4bc660]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x406550
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x406547
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
xor ecx, ebp
pop ebx
call fcn.00464a9b
leave
ret
Function at 0x40bc9c
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [sym.imp.WS2_32.dll_ntohl]
push edi
mov edi, eax
push dword [edi]
call esi
push dword [edi + 4]
mov ebx, eax
call esi
and dword [ebp - 4], 0
mov edi, eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
sub eax, ecx
mov dword [ebp - 8], eax
jmp 0x40bcce
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
lea eax, [eax + ecx*4]
push dword [ebp + eax - 0x18]
call esi
mov ecx, dword [ebp - 4]
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
mov dword [ebp + ecx*4 - 0x18], eax
jl 0x40bccb
push 0x10
xor eax, eax
pop ecx
mov edx, edi
shr edx, 5
add edx, dword [ebp - 0x14]
mov esi, edi
shl esi, 4
add esi, dword [ebp - 0x18]
sub eax, 0x61c88647
xor edx, esi
lea esi, [eax + edi]
xor edx, esi
add ebx, edx
mov edx, ebx
shr edx, 5
add edx, dword [ebp - 0xc]
mov esi, ebx
shl esi, 4
add esi, dword [ebp - 0x10]
xor edx, esi
lea esi, [eax + ebx]
xor edx, esi
add edi, edx
dec ecx
jne 0x40bcef
mov esi, dword [sym.imp.WS2_32.dll_htonl]
push ebx
call esi
mov ebx, dword [ebp + 0xc]
push edi
mov dword [ebx], eax
call esi
pop edi
pop esi
mov dword [ebx + 4], eax
pop ebx
leave
ret

Function at 0x40bd42
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [sym.imp.WS2_32.dll_ntohl]
push edi
mov edi, eax
push dword [edi]
call esi
push dword [edi + 4]
mov ebx, eax
call esi
and dword [ebp - 4], 0
mov edi, eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
sub eax, ecx
mov dword [ebp - 8], eax
jmp 0x40bd74
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
lea eax, [eax + ecx*4]
push dword [ebp + eax - 0x18]
call esi
mov ecx, dword [ebp - 4]
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
mov dword [ebp + ecx*4 - 0x18], eax
jl 0x40bd71
push 0x10
mov eax, 0xe3779b90
pop ecx
mov edx, ebx
shr edx, 5
add edx, dword [ebp - 0xc]
mov esi, ebx
shl esi, 4
add esi, dword [ebp - 0x10]
xor edx, esi
lea esi, [eax + ebx]
xor edx, esi
sub edi, edx
mov edx, edi
shr edx, 5
add edx, dword [ebp - 0x14]
mov esi, edi
shl esi, 4
add esi, dword [ebp - 0x18]
xor edx, esi
lea esi, [eax + edi]
xor edx, esi
sub ebx, edx
add eax, 0x61c88647
dec ecx
jne 0x40bd98
mov esi, dword [sym.imp.WS2_32.dll_htonl]
push ebx
call esi
mov ebx, dword [ebp + 0xc]
push edi
mov dword [ebx], eax
call esi
pop edi
pop esi
mov dword [ebx + 4], eax
pop ebx
leave
ret
Function at 0x40d1c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x40cc
call fcn.004671d0
mov eax, dword [0x4bc660]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x2004], 0
push ebx
mov ebx, dword [ebp + 0x20]
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x1c]
push 0x1ffe
lea eax, [ebp - 0x2002]
push 0
push eax
call fcn.004665b0
push ebx
lea eax, [ebp - 0x2004]
push edi
push eax
call fcn.004671af
and word [ebp - 0x40cc], 0
push 0x20c6
lea eax, [ebp - 0x40ca]
push 0
push eax
call fcn.004665b0
lea eax, [ebp - 0x2004]
push eax
push esi
lea eax, [ebp - 0x40cc]
push 0x4a0044
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x34
lea eax, [ebp - 0x40cc]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00464a9b
leave
ret

Function at 0x40d260
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2068
call fcn.004671d0
mov eax, dword [0x4bc660]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x20]
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x1c]
push 0xfff
lea eax, [ebp - 0x1003]
push 0
push eax
mov byte [ebp - 0x1004], 0
call fcn.004665b0
push ebx
lea eax, [ebp - 0x1004]
push edi
push eax
call fcn.00467277
push 0x1063
lea eax, [ebp - 0x2067]
push 0
push eax
mov byte [ebp - 0x2068], 0
call fcn.004665b0
lea eax, [ebp - 0x1004]
push eax
push esi
lea eax, [ebp - 0x2068]
push str.__s_:___s_
push eax
call fcn.00466a76
add esp, 0x34
lea eax, [ebp - 0x2068]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00464a9b
leave
ret

Function at 0x40d650
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
sub esp, 0x224
lea ebp, [esp - 4]
mov eax, dword [0x4bc660]
xor eax, ebp
mov dword [ebp + 0x224], eax
push 4
mov eax, 0x49387b
call fcn.00464aaa
mov edi, dword [ebp + 0x230]
xor ebx, ebx
push ebx
lea ecx, [ebp]
mov dword [ebp - 0x10], ebx
mov dword [ebp + 0x18], 7
call fcn.004024d0
push 1
push 0x1a
lea eax, [ebp + 0x1c]
push eax
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x40d6cb
lea eax, [ebp + 0x1c]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, esi
ja 0x40d6bd
cmp eax, ebx
jne 0x40d6cb
push 0x4a8d80
mov ecx, edi
call fcn.004041de
jmp 0x40d70f
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp]
call fcn.0040219c
mov eax, dword [ebp + 0x14]
dec eax
push eax
lea ecx, [ebp]
call fcn.0041bae9
cmp word [eax], 0x5c
je 0x40d6f7
push 0x49fa70
lea ecx, [ebp]
call fcn.0040afcc
push 0x4a00a8
lea ecx, [ebp]
call fcn.0040afcc
lea eax, [ebp]
push eax
mov ecx, edi
call fcn.00401fda
push ebx
push 1
lea ecx, [ebp]
call fcn.004021e1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.00464a9b
add ebp, 0x228
leave
ret
Function at 0x40d73f
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push 0x3c
mov eax, 0x4938ab
call fcn.00464b13
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x48]
push eax
call fcn.0040d650
mov dword [esp], 0x4a0104
push eax
lea eax, [ebp - 0x2c]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.0040afe9
add esp, 0xc
push edi
push 1
lea ecx, [ebp - 0x48]
call fcn.004021e1
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x40d787
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40d7cf
test al, 0x10
jne 0x40d7cf
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x40d7a3
lea eax, [ebp - 0x28]
push eax
push edi
push 0x4a00f0
push 0x4a00dc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
push edi
neg eax
push 1
lea ecx, [ebp - 0x2c]
mov dword [esi], eax
call fcn.004021e1
xor eax, eax
inc eax
jmp 0x40d7dc
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.004021e1
xor eax, eax
call fcn.00464b96
ret

Function at 0x40d7e2
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push ebp
sub esp, 0x224
lea ebp, [esp - 4]
mov eax, dword [0x4bc660]
xor eax, ebp
mov dword [ebp + 0x224], eax
push 0x1c
mov eax, 0x4938e0
call fcn.00464aaa
mov edi, dword [ebp + 0x230]
lea eax, [ebp - 0x28]
push eax
call fcn.0040d650
mov dword [esp], 0x4a0104
push eax
lea eax, [ebp]
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.0040afe9
add esp, 0xc
push esi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004021e1
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x40d849
lea eax, [ebp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40d8b8
test al, 0x10
jne 0x40d8b8
push 0x204
lea eax, [ebp + 0x20]
push esi
push eax
mov dword [ebp + 0x1c], 0x30
call fcn.004665b0
mov eax, dword [ebp + 4]
add esp, 0xc
cmp dword [ebp + 0x18], 8
jae 0x40d87e
lea eax, [ebp + 4]
push eax
push 0x104
lea eax, [ebp + 0x1c]
push eax
push 0x4a0124
push 0x4a011c
push 0x4a00dc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp + 0x1c]
push eax
mov ecx, edi
call fcn.0040219c
push esi
push 1
lea ecx, [ebp]
call fcn.004021e1
xor eax, eax
inc eax
jmp 0x40d8c5
push esi
push 1
lea ecx, [ebp]
call fcn.004021e1
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.00464a9b
add ebp, 0x228
leave
ret