joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46db8c
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
clc
jmp 0x46dbb6
pushal
jae 0x46dbbb
push esp
mov bh, 0xe8
sbb byte [eax], al
add byte [eax], al
call fcn.0046dbd8
or byte [edi - 0x5baf8e30], 0x43
inc ebx
pushfd
mov al, 0x89
outsb dx, byte [esi]
invalid

Function at 0x46dbd8
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
pop ebx
jae 0x46dbf4
rcl byte [ebx + 0x15], 0x90
dec ecx
push eax
cwde
xlatb
inc edi
and bh, bh
dec edi
sbb dword [ebx], edi
inc eax
pop es
pop edx
jno 0x46dc16
cmp byte [ecx - 0x7e5a73cf], 0xc3
mov al, byte [0xebffffff]
and byte [esp + edx + 0xc], al
wait
jge 0x46dc58
add ebx, 0xffffffa0
jmp 0x46dc1c
mov ebp, 0x8155e160
adc ecx, dword [ecx]
push esp
pop ebp
xor eax, 0x3a59ecc8
push cs
pop ebx
test dword [edx - 0x75c1e0f4], eax
cdq
les ebp, [esi + 0x3b8364]
mov bl, byte ds:[ecx - 0x7c9b513c]
cmp eax, dword [eax]
cmp dword [ebx], 0
stc
jb 0x46dc48
or al, 0xea
inc eax
sbb eax, 0x8be8cadd
wait
scasd eax, dword es:[edi]
sbb dl, byte [edx - 0x58775c0d]
iretd
je 0x46de04
jmp 0x46dc61
movsb byte es:[edi], byte [esi]
cmpsd dword [esi], dword es:[edi]
add eax, 0x41cf1a85
outsd dx, dword [esi]
mov ecx, ebx
jmp 0x46dc76
add ebx, 4
jmp 0x46dc8b
mov eax, dword [ebx]
jmp 0x46dcba
add eax, ebx
clc
jmp 0x46dcd5
mov edx, dword [ebx + 4]
jmp 0x46dce5
sub dword [eax], 0xec8c09fb
jmp 0x46dd11
add eax, 4
jmp 0x46dd2f
sub edx, 1
clc
jmp 0x46dd5a
jne 0x46dcd8
jmp 0x46dd89
add ebx, 8
jmp 0x46dda2
sub dword [ecx], 1
stc
jmp 0x46ddcb
jne 0x46dc79
jmp 0x46ddff
call fcn.0046de47
jmp 0x46de2c
popal
clc
jae 0x46de42
test byte [ecx - 0x43], bh
cli
ror byte [esi - 0x63e18742], cl
add dword [ebx - 0x1c53b90a], esp
mov bh, 0xc7
jmp fcn.0044ebcc
Function at 0x403881
Capabilities:
Encode data using xor

Disassembly:
cmp dword [str.STARTDLG], 0
jne 0x40388f
call fcn.00403857
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x4038bc
test cl, 7
je 0x4038bc
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
dec esi
inc ecx
jmp 0x40389d
cmp esi, 8
jb 0x403940
mov edi, esi
shr edi, 3
xor eax, dword [ecx]
add ecx, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
sub esi, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
mov edx, eax
movzx eax, dl
mov eax, dword [eax*4 + 0x4141c0]
xor eax, dword [ecx - 4]
shr edx, 8
xor eax, edx
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4141c0]
dec edi
jne 0x4038c6
xor edx, edx
test esi, esi
jbe 0x403960
push ebx
movzx edi, byte [edx + ecx]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x4141c0]
inc edx
cmp edx, esi
jb 0x403947
pop ebx
pop edi
pop esi
ret 0xc
Function at 0x40a57b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push 0x20
push dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 8], ecx
call fcn.0040ae8f
xor eax, eax
push 4
xor ecx, ecx
mov dword [ebp + 8], eax
xor ebx, ebx
pop edx
cmp eax, 0xa
jg 0x40a689
cmp ebx, edx
jge 0x40a5d0
lea esi, [ebp + ebx*4 - 0x28]
mov dword [ebp - 4], esi
cmp ecx, edx
jge 0x40a5d2
mov edi, dword [ebp - 8]
lea esi, [ecx + eax*4]
lea edi, [edi + esi*4 + 0x14]
mov esi, dword [ebp - 4]
add dword [ebp - 4], edx
inc ebx
inc ecx
cmp ebx, edx
movsd dword es:[edi], dword [esi]
jl 0x40a5b5
cmp ecx, edx
jne 0x40a5da
inc eax
mov dword [ebp + 8], eax
xor ecx, ecx
cmp ebx, edx
jl 0x40a5a1
cmp eax, 0xa
jg 0x40a689
mov dword [ebp - 4], 0x418ca8
movzx esi, byte [ebp - 0x1b]
mov al, byte [ebp - 0x28]
xor al, byte [esi + 0x418dc8]
movzx esi, byte [ebp - 0x1a]
mov bl, byte [esi + 0x418dc8]
movzx esi, byte [ebp - 0x19]
xor byte [ebp - 0x27], bl
mov bl, byte [esi + 0x418dc8]
movzx esi, byte [ebp - 0x1c]
xor byte [ebp - 0x26], bl
mov bl, byte [esi + 0x418dc8]
mov esi, dword [ebp - 4]
xor al, byte [esi]
xor byte [ebp - 0x25], bl
inc dword [ebp - 4]
push 3
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x24]
pop edi
xor esi, esi
mov bl, byte [eax + esi - 4]
xor byte [eax + esi], bl
inc esi
cmp esi, edx
jl 0x40a635
add eax, edx
dec edi
jne 0x40a633
xor ebx, ebx
cmp dword [ebp + 8], 0xa
jg 0x40a689
cmp ebx, edx
jge 0x40a672
lea eax, [ebp + ebx*4 - 0x28]
cmp ecx, edx
jge 0x40a674
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 8]
lea esi, [ecx + esi*4]
lea edi, [edi + esi*4 + 0x14]
mov esi, eax
inc ebx
add eax, edx
inc ecx
cmp ebx, edx
movsd dword es:[edi], dword [esi]
jl 0x40a656
cmp ecx, edx
jne 0x40a67b
inc dword [ebp + 8]
xor ecx, ecx
cmp ebx, edx
jl 0x40a648
cmp dword [ebp + 8], 0xa
jle 0x40a5ee
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40a690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
add ecx, 0x24
push 4
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 9
pop edi
xor eax, eax
mov ecx, dword [ebp - 4]
lea esi, [ebp + eax - 0x1c]
add ecx, 2
mov dword [ebp - 8], edi
movzx edx, byte [ecx + 1]
movzx ebx, byte [ecx - 1]
mov dl, byte [eax + edx*4 + 0x415ca8]
xor dl, byte [eax + ebx*4 + 0x4164a8]
movzx ebx, byte [ecx - 2]
xor dl, byte [eax + ebx*4 + 0x4168a8]
movzx ebx, byte [ecx]
xor dl, byte [eax + ebx*4 + 0x4160a8]
add ecx, edi
mov byte [esi], dl
add esi, edi
dec dword [ebp - 8]
jne 0x40a6b8
inc eax
cmp eax, edi
jl 0x40a6ab
push 0x10
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call fcn.0040ae8f
add dword [ebp - 4], 0x10
dec dword [ebp - 0xc]
jne 0x40a6a9
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a7b1
Capabilities:
Encode data using xor

Disassembly:
push dword [ebx]
add al, 0x8d
test al, 0x6c
inc ecx
add byte [edi], cl
mov dh, 0x4d
stc
mov dword [esi + 8], eax
movzx eax, byte [ebp - 4]
mov eax, dword [eax*4 + 0x4178a8]
xor eax, dword [ecx*4 + 0x4174a8]
movzx ecx, byte [ebp - 0xa]
xor eax, dword [ecx*4 + 0x4170a8]
movzx ecx, byte [ebp - 0xd]
xor eax, dword [ecx*4 + 0x416ca8]
lea ebx, [edi + 0xa4]
mov dword [esi + 0xc], eax
mov dword [ebp + 8], 8
push ebx
push esi
lea eax, [ebp - 0x10]
push eax
call fcn.0040a549
movzx eax, byte [ebp - 0x10]
mov eax, dword [eax*4 + 0x4178a8]
movzx ecx, byte [ebp - 3]
xor eax, dword [ecx*4 + 0x4174a8]
movzx ecx, byte [ebp - 6]
xor eax, dword [ecx*4 + 0x4170a8]
movzx ecx, byte [ebp - 9]
xor eax, dword [ecx*4 + 0x416ca8]
movzx ecx, byte [ebp - 0xf]
mov dword [esi], eax
movzx eax, byte [ebp - 0xc]
mov eax, dword [eax*4 + 0x4178a8]
xor eax, dword [ecx*4 + 0x4174a8]
movzx ecx, byte [ebp - 2]
xor eax, dword [ecx*4 + 0x4170a8]
movzx ecx, byte [ebp - 5]
xor eax, dword [ecx*4 + 0x416ca8]
movzx ecx, byte [ebp - 0xb]
mov dword [esi + 4], eax
movzx eax, byte [ebp - 8]
mov eax, dword [eax*4 + 0x4178a8]
xor eax, dword [ecx*4 + 0x4174a8]
movzx ecx, byte [ebp - 0xe]
xor eax, dword [ecx*4 + 0x4170a8]
movzx ecx, byte [ebp - 1]
xor eax, dword [ecx*4 + 0x416ca8]
movzx ecx, byte [ebp - 7]
mov dword [esi + 8], eax
movzx eax, byte [ebp - 4]
mov eax, dword [eax*4 + 0x4178a8]
xor eax, dword [ecx*4 + 0x4174a8]
movzx ecx, byte [ebp - 0xa]
xor eax, dword [ecx*4 + 0x4170a8]
movzx ecx, byte [ebp - 0xd]
xor eax, dword [ecx*4 + 0x416ca8]
sub ebx, 0x10
dec dword [ebp + 8]
mov dword [esi + 0xc], eax
jne 0x40a7f8
lea eax, [edi + 0x24]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
call fcn.0040a549
movzx eax, byte [ebp - 0x10]
mov al, byte [eax + 0x418cc8]
mov byte [esi], al
movzx eax, byte [ebp - 3]
mov al, byte [eax + 0x418cc8]
mov byte [esi + 1], al
movzx eax, byte [ebp - 6]
mov al, byte [eax + 0x418cc8]
mov byte [esi + 2], al
movzx eax, byte [ebp - 9]
mov al, byte [eax + 0x418cc8]
mov byte [esi + 3], al
movzx eax, byte [ebp - 0xc]
mov al, byte [eax + 0x418cc8]
mov byte [esi + 4], al
movzx eax, byte [ebp - 0xf]
mov al, byte [eax + 0x418cc8]
mov byte [esi + 5], al
movzx eax, byte [ebp - 2]
mov al, byte [eax + 0x418cc8]
mov byte [esi + 6], al
movzx eax, byte [ebp - 5]
mov al, byte [eax + 0x418cc8]
mov byte [esi + 7], al
movzx eax, byte [ebp - 8]
mov al, byte [eax + 0x418cc8]
mov byte [esi + 8], al
movzx eax, byte [ebp - 0xb]
mov al, byte [eax + 0x418cc8]
mov byte [esi + 9], al
movzx eax, byte [ebp - 0xe]
mov al, byte [eax + 0x418cc8]
mov byte [esi + 0xa], al
movzx eax, byte [ebp - 1]
mov al, byte [eax + 0x418cc8]
mov byte [esi + 0xb], al
movzx eax, byte [ebp - 4]
mov al, byte [eax + 0x418cc8]
mov byte [esi + 0xc], al
movzx eax, byte [ebp - 7]
mov al, byte [eax + 0x418cc8]
mov byte [esi + 0xd], al
movzx eax, byte [ebp - 0xa]
mov al, byte [eax + 0x418cc8]
mov byte [esi + 0xe], al
movzx eax, byte [ebp - 0xd]
mov al, byte [eax + 0x418cc8]
add edi, 0x14
push edi
push esi
push esi
mov byte [esi + 0xf], al
call fcn.0040a549
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40e4ee
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x1d10be0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x788000]
push edi
jmp 0x1d10bfa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1d10c01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1d10bf0
mov eax, 1
add ebx, ebx
jne 0x1d10c13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1d10c24
jne 0x1d10c43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1d10c43
dec eax
add ebx, ebx
jne 0x1d10c30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1d10c08
add ebx, ebx
jne 0x1d10c3f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x1d10c95
xor ecx, ecx
sub eax, 3
jb 0x1d10c5b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1d10cca
sar eax, 1
mov ebp, eax
jmp 0x1d10c66
add ebx, ebx
jne 0x1d10c66
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1d10c34
inc ecx
add ebx, ebx
jne 0x1d10c74
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1d10c34
add ebx, ebx
jne 0x1d10c81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1d10c76
jne 0x1d10c92
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1d10c76
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1d10cb4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1d10ca6
jmp 0x1d10bf6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1d10cb4
add edi, ecx
jmp 0x1d10bf6
pop esi
mov edi, esi
mov ecx, 0x16ee1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1d10cd2
cmp byte [edi], 0x2e
jne 0x1d10cd2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1d10cd7
lea edi, [esi + 0x190c000]
mov eax, dword [edi]
or eax, eax
je 0x1d10d4f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19123f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1912564]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1d10d04
mov ecx, edi
jns 0x1d10d33
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x191256c]
or eax, eax
je 0x1d10d49
mov dword [ebx], eax
add ebx, 4
jmp 0x1d10d21
call dword [esi + 0x1912568]
mov ebp, dword [esi + 0x1912570]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x247]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1d10d83
sub esp, 0xffffff80
jmp 0x6e3399
Function at 0x4088d0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x400
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x40c]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x410]
push eax
push ecx
push 0x3ff
push 0x400
push edx
call dword [0x425074]
add esp, 0x14
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
add esp, 0x400
ret
Function at 0x408c70
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x400
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x40c]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x410]
push eax
push ecx
push 0x3ff
push 0x400
push edx
call dword [0x425074]
add esp, 0x14
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
add esp, 0x400
ret
Function at 0x409010
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x400
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x40c]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x410]
push eax
push ecx
push 0x3ff
push 0x400
push edx
call dword [0x425074]
add esp, 0x14
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
add esp, 0x400
ret

Function at 0x409070
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x400
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x40c]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x410]
push eax
push ecx
push 0x3ff
push 0x400
push edx
call dword [0x425074]
add esp, 0x14
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
add esp, 0x400
ret

Function at 0x4090d0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x400
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x40c]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x410]
push eax
push ecx
push 0x3ff
push 0x400
push edx
call dword [0x425074]
add esp, 0x14
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
add esp, 0x400
ret

Function at 0x409130
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x400
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x40c]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x410]
push eax
push ecx
push 0x3ff
push 0x400
push edx
call dword [0x425074]
add esp, 0x14
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
add esp, 0x400
ret
Function at 0x4094d0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x400
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x40c]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x410]
push eax
push ecx
push 0x3ff
push 0x400
push edx
call dword [0x425074]
add esp, 0x14
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
add esp, 0x400
ret
Function at 0x40a0b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
mov ebx, dword [esp + 0x11c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
lea eax, [esp + 0x18]
push 0x104
push eax
push 0
push str.Path
push str.Redirect
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x14]
lea ecx, [esp + 0x14]
test edx, edx
je 0x40a11d
mov al, byte [esp + 0x14]
test al, al
je 0x40a11d
cmp al, 0x20
je 0x40a115
cmp al, 9
jne 0x40a160
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40a10d
mov esi, dword [esp + 0x120]
test esi, esi
je 0x40a153
mov edx, dword [esp + 0x124]
test edx, edx
jle 0x40a153
test ebx, ebx
je 0x40a153
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jae 0x40a153
push ebx
push edx
push esi
call dword [0x425080]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
lea eax, [esp + 0x14]
push 0x3a
push eax
call fcn.004153e3
add esp, 8
test eax, eax
jne 0x40a223
cmp byte [esp + 0x14], 0x5c
je 0x40a223
test ebx, ebx
je 0x40a153
mov edi, dword [esp + 0x120]
test edi, edi
je 0x40a153
mov ebp, dword [esp + 0x124]
test ebp, ebp
jle 0x40a153
push 0x5c
push ebx
call fcn.0041547a
add esp, 8
test eax, eax
jne 0x40a1b6
push 0x2f
push ebx
call fcn.0041547a
add esp, 8
test eax, eax
mov byte [edi], 0
je 0x40a1fa
sub eax, ebx
inc eax
mov esi, eax
test esi, esi
jle 0x40a1db
cmp ebp, esi
jle 0x40a1db
push esi
push ebx
push ebp
push edi
call dword [0x42507c]
add esp, 0x10
mov byte [esi + edi], 0
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push ebp
push edi
mov ecx, esi
call fcn.0040d7a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
push ebp
push ebx
mov ecx, esi
call fcn.0040ccd0
test eax, eax
je 0x40a213
push ebx
push ebp
push edi
call dword [0x425080]
add esp, 0xc
push 0x425888
push ebp
push edi
mov ecx, esi
call fcn.0040d7a0
jmp 0x40a1df
mov edx, dword [esp + 0x124]
mov eax, dword [esp + 0x120]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
call fcn.0040a0b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
Function at 0x40a690
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x400
push ebx
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
mov edx, dword [esp + 0x41c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x410]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0x41c]
push 0x400
push ecx
mov ecx, dword [esp + 0x420]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0xc]
xor edi, edi
xor esi, esi
lea edx, [esp + 0xc]
test al, al
lea ecx, [esp + 0xc]
je 0x40a716
cmp al, 0x20
je 0x40a707
cmp al, 9
je 0x40a707
test edi, edi
jne 0x40a70e
mov edi, 1
mov edx, ecx
jmp 0x40a70e
cmp edi, 1
jne 0x40a70e
mov esi, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40a6f2
mov ebx, dword [esp + 0x420]
test edx, edx
mov byte [ebx], 0
je 0x40a785
test esi, esi
jne 0x40a75f
test ebx, ebx
je 0x40a785
mov esi, dword [esp + 0x424]
test esi, esi
jle 0x40a785
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, esi
jae 0x40a785
push edx
push esi
push ebx
call dword [0x425080]
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x400
ret 0x18
sub esi, edx
test ebx, ebx
je 0x40a785
test esi, esi
jle 0x40a785
mov eax, dword [esp + 0x424]
cmp eax, esi
jle 0x40a785
push esi
push edx
push eax
push ebx
call dword [0x42507c]
add esp, 0x10
mov byte [esi + ebx], 0
pop edi
pop esi
pop ebx
add esp, 0x400
ret 0x18
Function at 0x40a7a0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
mov ebx, dword [esp + 0x11c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
lea eax, [esp + 0x18]
push 0x104
push eax
push 0
push str.Path
push str.Redirect
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x14]
lea ecx, [esp + 0x14]
test edx, edx
je 0x40a80d
mov al, byte [esp + 0x14]
test al, al
je 0x40a80d
cmp al, 0x20
je 0x40a805
cmp al, 9
jne 0x40a850
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40a7fd
mov esi, dword [esp + 0x120]
test esi, esi
je 0x40a843
mov edx, dword [esp + 0x124]
test edx, edx
jle 0x40a843
test ebx, ebx
je 0x40a843
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jae 0x40a843
push ebx
push edx
push esi
call dword [0x425080]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
lea eax, [esp + 0x14]
push 0x3a
push eax
call fcn.004153e3
add esp, 8
test eax, eax
jne 0x40a913
cmp byte [esp + 0x14], 0x5c
je 0x40a913
test ebx, ebx
je 0x40a843
mov edi, dword [esp + 0x120]
test edi, edi
je 0x40a843
mov ebp, dword [esp + 0x124]
test ebp, ebp
jle 0x40a843
push 0x5c
push ebx
call fcn.0041547a
add esp, 8
test eax, eax
jne 0x40a8a6
push 0x2f
push ebx
call fcn.0041547a
add esp, 8
test eax, eax
mov byte [edi], 0
je 0x40a8ea
sub eax, ebx
inc eax
mov esi, eax
test esi, esi
jle 0x40a8cb
cmp ebp, esi
jle 0x40a8cb
push esi
push ebx
push ebp
push edi
call dword [0x42507c]
add esp, 0x10
mov byte [esi + edi], 0
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push ebp
push edi
mov ecx, esi
call fcn.0040d870
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
push ebp
push ebx
mov ecx, esi
call fcn.0040cf20
test eax, eax
je 0x40a903
push ebx
push ebp
push edi
call dword [0x425080]
add esp, 0xc
push 0x425888
push ebp
push edi
mov ecx, esi
call fcn.0040d870
jmp 0x40a8cf
mov edx, dword [esp + 0x124]
mov eax, dword [esp + 0x120]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
call fcn.0040a7a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc