joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479c20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a90cd
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x55d008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 0xc]
mov edi, edx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
cmp dword [edx + 0x14], 0x10
jb 0x479c5b
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x479c79
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x479c67
push esi
push edx
lea eax, [ebp - 0x18]
push eax
call fcn.0047a650
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x479c96
mov dword [ebx], eax
mov byte [ebx + 4], 0
jmp 0x479df8
cmp dword [0x7386d4], 0x4444444
jne 0x479cad
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x20], 0x7386d0
mov dword [ebp - 4], 0
push 0x3c
mov dword [ebp - 0x1c], 0
call fcn.004a6595
mov edi, eax
add esp, 4
mov dword [ebp - 0x1c], edi
push dword [ebp - 0x10]
lea eax, [edi + 8]
mov ecx, eax
mov dword [ebp - 0x24], eax
call fcn.0046af00
mov edx, dword [ebp - 0x10]
lea ecx, [edi + 8]
mov byte [ebp - 4], 1
mov eax, dword [edx + 0x18]
mov dword [ecx + 0x18], eax
lea eax, [edx + 0x1c]
add ecx, 0x1c
push eax
call fcn.0046af00
mov dword [ebp - 4], 2
mov ecx, dword [0x7386d4]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x553580]
mov eax, dword [0x7386e8]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x553580]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
movss xmm1, dword [0x7386cc]
comiss xmm2, xmm1
jbe 0x479da5
divss xmm0, xmm1
call fcn.0042fec0
call fcn.004a71e0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [0x7386e8]
cmp eax, ecx
jae 0x479d87
cmp eax, 0x200
jae 0x479d85
shl eax, 3
cmp eax, ecx
jae 0x479d87
mov eax, ecx
push eax
call fcn.0047a3e0
push esi
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0047a650
mov ecx, dword [0x7386d4]
mov edx, dword [eax]
jmp 0x479da8
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
inc ecx
mov dword [0x7386d4], ecx
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [0x7386d8]
mov dword [ebp - 0x10], eax
mov eax, dword [0x7386e4]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [0x7386d0]
jne 0x479ddc
mov dword [ecx + eax*8], edi
jmp 0x479dee
cmp esi, edx
jne 0x479de5
mov dword [ecx + eax*8], edi
jmp 0x479df2
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x479df2
mov dword [ecx + eax*8 + 4], edi
mov dword [ebx], edi
mov byte [ebx + 4], 1
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x49ab40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x55d008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push 0x543b00
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], ecx
push eax
mov dword [ebp - 8], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov ebx, dword [ebp - 8]
add esp, 0xc
test ebx, ebx
jne 0x49ab8c
lea eax, [ebx - 3]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a5d94
mov esp, ebp
pop ebp
ret 4
push esi
push 2
push 0
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
je 0x49aba6
mov esi, 0xfffffffd
jmp 0x49ac1d
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
add esp, 4
test esi, esi
js 0x49ab9f
jne 0x49abbc
xor esi, esi
jmp 0x49ac1d
push edi
lea eax, [esi + 1]
push 0x4b0610
push eax
call fcn.004a65f1
mov edi, eax
add esp, 8
test edi, edi
jne 0x49abd9
lea esi, [eax - 2]
jmp 0x49ac1c
push 0
push 0
push ebx
mov byte [edi + esi], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push ebx
push esi
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x1c
cmp eax, esi
je 0x49ac07
push edi
call fcn.004a6590
mov esi, 0xfffffffd
jmp 0x49ac19
mov ecx, dword [ebp - 0xc]
push eax
push edi
call fcn.0049d910
push edi
mov esi, eax
call fcn.004a6590
add esp, 4
pop edi
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, esi
xor ecx, ebp
pop esi
pop ebx
call fcn.004a5d94
mov esp, ebp
pop ebp
ret 4
Function at 0x49c880
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov eax, 0x1fffffff
mov esi, 1
push edi
mov edi, ecx
bsr ecx, eax
mov eax, esi
mov dword [ebp - 0x10], edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x49c8b1
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov ebx, dword [edi + 4]
or eax, 1
mov dword [ebp - 8], ebx
bsr ecx, eax
push ebx
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [edi + 0xc]
lea eax, [esi + esi]
push eax
call fcn.0049a830
lea eax, [esi - 1]
mov dword [edi + 0x1c], esi
mov dword [edi + 0x18], eax
mov ecx, dword [edi + 4]
mov ecx, dword [ecx]
cmp ecx, ebx
je 0x49c9b7
mov eax, ecx
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
movzx edx, byte [eax + 0xa]
imul esi, esi, 0x1000193
xor esi, edx
movzx edx, byte [eax + 0xb]
imul esi, esi, 0x1000193
xor esi, edx
imul edx, esi, 0x1000193
mov esi, dword [edi + 0x18]
and esi, edx
mov edx, dword [edi + 0xc]
mov edi, dword [edx + esi*8]
lea ebx, [edx + esi*8]
mov dword [ebp - 4], ebx
cmp edi, dword [ebp - 8]
jne 0x49c943
mov dword [ebx], eax
mov dword [ebx + 4], eax
jmp 0x49c9a9
mov edx, dword [ebx + 4]
mov esi, dword [eax + 8]
cmp esi, dword [edx + 8]
jne 0x49c97a
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
cmp edx, eax
je 0x49c975
mov edi, dword [eax + 4]
mov ebx, dword [ebp - 0xc]
mov dword [edi], ecx
mov esi, dword [ecx + 4]
mov dword [esi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [ebx + 4], esi
mov ebx, dword [ebp - 4]
mov dword [ecx + 4], edi
mov dword [eax + 4], edx
mov dword [ebx + 4], eax
jmp 0x49c9a9
cmp edi, edx
je 0x49c98c
nop
mov edx, dword [edx + 4]
cmp esi, dword [edx + 8]
je 0x49c9c0
cmp edi, edx
jne 0x49c980
mov ebx, dword [eax + 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov esi, dword [edx + 4]
mov dword [esi], eax
mov dword [edx + 4], edi
mov edx, dword [ebp - 4]
mov dword [ecx + 4], ebx
mov dword [eax + 4], esi
mov dword [edx], eax
mov eax, ecx
mov edi, dword [ebp - 0x10]
cmp ecx, dword [ebp - 8]
jne 0x49c8f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [eax + 4]
mov ebx, dword [edx]
mov dword [edi], ecx
mov esi, dword [ecx + 4]
mov dword [esi], ebx
mov edx, dword [ebx + 4]
mov dword [edx], eax
mov dword [ebx + 4], esi
mov dword [ecx + 4], edi
mov dword [eax + 4], edx
jmp 0x49c9a9

Function at 0x4a69e9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4a6a28
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4a6a28
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4a6a28
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4a6a28
cmp dword [ecx + 0x74], 0xe
jbe 0x4a6a28
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x724d38
Capabilities:
Encode data using xor

Disassembly:
pop eax
sbb ch, byte [eax - 0x2b9c93e6]
cmp edi, ecx
stosb byte es:[edi], al
insb byte es:[edi], dx
mov cl, 0xf4
cmp byte [edi + ecx*4 + 0x37], ah
scasb al, byte es:[edi]
add al, 0x4a
push es
mov edx, 0x7b307c58
jl 0x724d7a
jnp 0x724d42
shr byte [esi - 0x29f81722], 0x24
movsd dword es:[edi], dword [esi]
jl 0x724dbb
setae byte [edi - 0x1c]
pop es
imul esp, dword [0x628ee27], 0xfffffff9
or al, 0xde
shr eax, cl
mov dl, 0xf6
inc ebx
sub esi, dword [ebx + 0x57]
shr dword fs:[ebp - 0x32], 0xf1
adc edi, eax
stosd dword es:[edi], eax
lea ecx, [ebx + esi*4 - 0x19a06ad8]
dec eax
je 0x724d31
hlt
in eax, 0xa8
bound ebp, qword [eax - 0x574b47f9]
or byte [ebx - 0x78], dl
inc esp
invalid
Function at 0x402e7a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2c
mov eax, dword [0x432180]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
mov esi, dword [0x48927c]
xor ebx, ebx
push edi
mov dword [esp + 0x14], edx
mov eax, dword [esi + 0x3c]
mov ebp, dword [eax + esi + 0x78]
add ebp, esi
mov edi, dword [ebp + 0x20]
mov eax, dword [ebp + 0x18]
add edi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x402ee1
mov eax, dword [edi]
lea ecx, [esp + 0x1c]
add eax, esi
push eax
call fcn.004035de
lea ecx, [esp + 0x1c]
call fcn.00402a0f
cmp eax, dword [esp + 0x14]
je 0x402ef9
lea ecx, [esp + 0x1c]
add edi, 4
call fcn.00404017
inc ebx
cmp ebx, dword [esp + 0x18]
jb 0x402eb1
xor edi, edi
mov ecx, dword [esp + 0x34]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00409367
add esp, 0x2c
ret
mov eax, dword [ebp + 0x24]
lea eax, [eax + ebx*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebp + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x1c]
call fcn.00404017
jmp 0x402ee3

Function at 0x402f7c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push esi
push edi
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x48927c], eax
push 0x27
mov esi, 0x486e60
mov edx, 0x547
push 0x432c30
mov ecx, esi
call fcn.00402805
pop ecx
pop ecx
mov edx, 0x8aafdc01
call fcn.00402e7a
lea ecx, [esp + 0xc]
push ecx
push 0x40
push 0x4e4
push esi
call eax
test eax, eax
je 0x403007
lea ecx, [esp + 0x10]
call fcn.004049da
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x10], ecx
mov byte [esp + 0x14], 1
test ecx, ecx
je 0x403011
cmp byte [ecx + 0x6c], 0
jne 0x403011
mov eax, dword [ecx]
push 1
call dword [eax + 8]
lea ecx, [esp + 0x10]
call fcn.0040315a
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 4
pop ecx
call fcn.0040277a
int3
Function at 0x41a9f5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041a866

Function at 0x41adef
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0040a430
mov eax, dword [0x432180]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00418914
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41ae31
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41af8d
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00424d30
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x488f40]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0041bde6
mov ecx, dword [esi*4 + 0x488f40]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x41af86
cmp eax, dword [edi + ecx + 0x24]
jne 0x41af86
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41af86
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041bde6
add esp, 0x14
test edx, edx
jl 0x41af86
jg 0x41aefc
test eax, eax
jb 0x41af86
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x41af86
jl 0x41af16
cmp dword [ebp - 0x1008], eax
ja 0x41af86
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x41af34
test ebx, ebx
je 0x41af6d
cmp ecx, edi
jae 0x41af6d
mov al, byte [ecx]
cmp al, 0xd
jne 0x41af4e
lea eax, [edi - 1]
cmp ecx, eax
jae 0x41af5a
cmp byte [ecx + 1], 0xa
jne 0x41af5a
inc ecx
jmp 0x41af5a
movzx eax, al
movsx eax, byte [eax + 0x432460]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x41af34
cmp edx, ebx
jne 0x41af34
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x41af8b
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00409367
leave
ret
Function at 0x41b284
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x488f40]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41b2c4
cmp byte [ebx], 0xa
jne 0x41b2c4
or byte [eax + edi + 0x28], 4
jmp 0x41b2c9
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x41b3c7
mov al, byte [edx]
cmp al, 0x1a
je 0x41b3a9
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x41b2f8
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x41b31d
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x41b327
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x41b2da
jmp 0x41b3c7
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41b3a4
cmp dword [ebp - 0xc], 0
je 0x41b3a4
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x488f40]
test byte [eax + edi + 0x28], 0x48
je 0x41b37e
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x41b369
mov byte [esi], dl
jmp 0x41b37a
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x488f40]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x41b3c7
cmp byte [ebp - 1], 0xa
jne 0x41b38d
cmp esi, ebx
jne 0x41b38d
mov byte [esi], 0xa
jmp 0x41b3c6
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041be04
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x41b3c7
mov byte [esi], 0xd
jmp 0x41b3c6
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x488f40]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41b3c3
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41b3c7
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41b3d0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x488f40]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41b413
cmp word [esi], dx
jne 0x41b413
or byte [edi + eax + 0x28], 4
jmp 0x41b418
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x41b56b
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x41b54b
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x41b45a
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41b490
cmp eax, edx
jae 0x41b49c
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x41b432
jmp 0x41b56b
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41b547
cmp dword [ebp - 0x14], 0
je 0x41b547
mov eax, dword [ebx*4 + 0x488f40]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x41b51f
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x41b4e8
mov word [esi], cx
jmp 0x41b51b
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x488f40]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x488f40]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x488f40]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x41b56b
pop ebx
cmp word [ebp - 4], bx
jne 0x41b530
cmp esi, dword [ebp + 0xc]
jne 0x41b530
mov word [esi], bx
jmp 0x41b568
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041be04
add esp, 0x10
cmp word [ebp - 4], bx
je 0x41b56b
push 0xd
jmp 0x41b564
mov ecx, dword [ebx*4 + 0x488f40]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41b562
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41b56b
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x401e60
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, 0x200
mov edi, ecx
push esi
call fcn.00421c0d
mov ebx, dword [ebp + 8]
add esp, 4
mov dword [edi], eax
push ebx
push esi
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
add eax, 2
cmp eax, esi
jb 0x401ebd
mov edi, edi
push dword [edi]
add esi, esi
call fcn.00421c08
push esi
mov dword [edi], 0
call fcn.00421c0d
add esp, 8
mov dword [edi], eax
push ebx
push esi
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
add eax, 2
cmp esi, eax
jbe 0x401e90
mov eax, dword [edi]
mov dword [edi + 4], eax
add eax, esi
mov dword [edi + 8], eax
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x401f60
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, 0x200
mov edi, ecx
push esi
call fcn.00421c0d
mov ebx, dword [ebp + 8]
add esp, 4
mov dword [edi], eax
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
add eax, 2
cmp eax, esi
jb 0x401fba
jmp 0x401f90
push dword [edi]
add esi, esi
call fcn.00421c08
push esi
mov dword [edi], 0
call fcn.00421c0d
add esp, 8
mov dword [edi], eax
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
add eax, 2
cmp esi, eax
jbe 0x401f90
mov eax, dword [edi]
mov dword [edi + 4], eax
add eax, esi
mov dword [edi + 8], eax
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x402250
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, ecx
cmp dword [esi + 0x14], 0x10
mov edi, dword [ebp + 8]
jb 0x402268
mov eax, dword [esi]
jmp 0x40226a
mov eax, esi
push eax
push dword [esi + 0x1c]
push dword [esi + 0x18]
push dword [ebp + 0x10]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test edi, edi
je 0x402287
test ebx, ebx
je 0x402287
inc eax
jmp 0x40228a
add eax, 2
mov edi, dword [esi + 0x1c]
cmp eax, edi
jb 0x4022ac
push dword [esi + 0x18]
add edi, edi
mov dword [esi + 0x1c], edi
call fcn.00421c08
push edi
call fcn.00421c0d
add esp, 8
mov dword [esi + 0x18], eax
jmp 0x40225b
mov edx, dword [esi + 0x18]
cmp byte [edx], 0
jne 0x4022c7
xor ecx, ecx
push ecx
mov ecx, dword [ebp + 0x14]
push edx
call fcn.00402bf0
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
mov ecx, edx
lea esi, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4022d0
sub ecx, esi
push ecx
mov ecx, dword [ebp + 0x14]
push edx
call fcn.00402bf0
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x404510
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x5d4050]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x114
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x110], 2
jne 0x40454f
call fcn.004043c0
test al, al
je 0x404561
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownW]
mov edi, eax
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x110], 2
jne 0x404586
call fcn.00404460
mov ecx, dword [ebp - 4]
xor eax, eax
test edi, edi
pop edi
setne al
xor ecx, ebp
call fcn.00549fe1
mov esp, ebp
pop ebp
ret

Function at 0x4045e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x5d4050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
lea ecx, [ebp - 0xc]
mov eax, edx
push ecx
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 0x10], eax
push ecx
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40469a
mov eax, dword [ebp - 8]
cmp eax, 1
je 0x40462a
cmp eax, 2
je 0x40462a
cmp eax, 7
jne 0x40469a
mov eax, dword [ebp - 0xc]
inc eax
push esi
push eax
call fcn.00421c0d
mov esi, eax
add esp, 4
test esi, esi
jne 0x404651
pop esi
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00549fe1
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov byte [eax + esi], 0
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete bl
test bl, bl
je 0x40467e
push esi
mov ecx, edi
call fcn.00402560
push esi
call fcn.00421c08
add esp, 4
mov al, bl
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00549fe1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop ebx
call fcn.00549fe1
mov esp, ebp
pop ebp
ret

Function at 0x4046b0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x5d4050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov eax, dword [ebp + 8]
mov esi, ecx
push 0
push 0
push 0
lea edi, [esi + 8]
mov dword [esi + 4], 0
push edi
lea ecx, [ebp - 8]
mov dword [edi], 0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
mov dword [esi], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
inc dword [edi]
test eax, eax
je 0x404714
push dword [esi + 4]
mov dword [edi], 0
call fcn.00421c08
mov dword [esi + 4], 0
jmp 0x40471e
push dword [edi]
call fcn.00421c0d
mov dword [esi + 4], eax
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, esi
xor ecx, ebp
pop edi
pop esi
call fcn.00549fe1
mov esp, ebp
pop ebp
ret 4