joyce8/EMBER2024-capa huggingface dataset:
Function at 0x21b4193
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x21b41b0
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x21b41a1
add dl, dl
jne 0x21b41bb
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x21b4207
xor eax, eax
add dl, dl
jne 0x21b41c8
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x21b42a4
add dl, dl
jne 0x21b41d7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x21b41e2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x21b41ed
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x21b41f8
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x21b4202
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x21b41a7
mov eax, 1
add dl, dl
jne 0x21b4215
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x21b4220
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x21b420c
sub eax, 2
jne 0x21b424f
mov ecx, 1
add dl, dl
jne 0x21b4235
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x21b4240
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x21b422c
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x21b41a7
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x21b4266
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x21b4271
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x21b425d
cmp eax, 0x7d00
jae 0x21b4294
cmp eax, 0x500
jb 0x21b428f
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x21b41a7
cmp eax, 0x7f
ja 0x21b4297
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x21b41a7
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x21b42c0
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x21b41a7
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8
Function at 0x4021d0
Capabilities:
Link many functions at runtime

Disassembly:
push ecx
push eax
mov dword [esi], vtable.DownWrapper.0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 4], eax
test eax, eax
jne 0x4021fc
push 0x46d608
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], str.can_not_load_xldl.dll
call fcn.0043e58f
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.XL_Init
push eax
call edi
mov edx, dword [esi + 4]
push str.XL_UnInit
push edx
mov dword [esi + 8], eax
call edi
mov dword [esi + 0xc], eax
mov eax, dword [esi + 4]
push str.XL_CreateTask
push eax
call edi
mov ecx, dword [esi + 4]
push str.XL_DeleteTask
push ecx
mov dword [esi + 0x10], eax
call edi
mov edx, dword [esi + 4]
push str.XL_StartTask
push edx
mov dword [esi + 0x14], eax
call edi
mov dword [esi + 0x18], eax
mov eax, dword [esi + 4]
push str.XL_StopTask
push eax
call edi
mov ecx, dword [esi + 4]
push str.XL_QueryTaskInfo
push ecx
mov dword [esi + 0x1c], eax
call edi
mov edx, dword [esi + 4]
push str.XL_QueryTaskInfoEx
push edx
mov dword [esi + 0x20], eax
call edi
mov dword [esi + 0x24], eax
mov eax, dword [esi + 4]
push str.XL_SetSpeedLimit
push eax
call edi
mov ecx, dword [esi + 4]
push str.XL_SetUploadSpeedLimit
push ecx
mov dword [esi + 0x28], eax
call edi
mov edx, dword [esi + 4]
push str.XL_DelTempFile
push edx
mov dword [esi + 0x2c], eax
call edi
mov dword [esi + 0x30], eax
mov eax, dword [esi + 4]
push str.XL_SetProxy
push eax
call edi
mov ecx, dword [esi + 4]
push str.XL_SetUserAgent
push ecx
mov dword [esi + 0x34], eax
call edi
mov edx, dword [esi + 4]
push str.XL_GetFileSizeWithUrl
push edx
mov dword [esi + 0x38], eax
call edi
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 4]
push str.XL_ParseThunderPrivateUrl
push eax
call edi
mov ecx, dword [esi + 4]
push str.XL_SetAdditionInfo
push ecx
mov dword [esi + 0x40], eax
call edi
mov dword [esi + 0x44], eax
mov edx, dword [esi + 4]
push str.XL_SetFileIdAndSize
push edx
call edi
mov dword [esi + 0x48], eax
mov eax, dword [esi + 4]
push str.XL_CreateBTTask
push eax
call edi
mov ecx, dword [esi + 4]
push str.XL_QueryBTFileInfo
push ecx
mov dword [esi + 0x4c], eax
call edi
mov edx, dword [esi + 4]
push str.XL_QueryBTTaskInfo
push edx
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
mov eax, dword [esi + 4]
push str.XL_ParseSeedFile
push eax
call edi
mov ecx, dword [esi + 4]
push str.XL_ReleaseSeedFileInfo
push ecx
mov dword [esi + 0x58], eax
call edi
mov edx, dword [esi + 4]
push str.XL_GetBtDataFileList
push edx
mov dword [esi + 0x5c], eax
call edi
mov dword [esi + 0x60], eax
mov eax, dword [esi + 4]
push str.XL_ReleaseBtDataFileList
push eax
call edi
mov dword [esi + 0x64], eax
mov eax, esi
pop edi
pop ecx
ret
Function at 0x402a60
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ecx
push esi
push 0
push 0x100
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x402a89
xor eax, eax
pop esi
pop ecx
ret 4
mov ecx, dword [esp + 0xc]
push ebx
push edi
push 0x462fd8
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
lea edx, [esp + 0x10]
push edx
push eax
push ebx
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov eax, 1
pop esi
pop ecx
ret 4
Function at 0x4041d0
Capabilities:
Get mac address on windows

Disassembly:
push ecx
push esi
push 0x288
mov dword [esp + 8], 0x288
call fcn.0041d34d
mov esi, eax
add esp, 4
test esi, esi
je 0x4042a4
push 0x288
push 0
push esi
call fcn.0043ebe0
add esp, 0xc
lea eax, [esp + 4]
push eax
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x40421f
push esi
call fcn.0041d37c
add esp, 4
pop esi
pop ecx
ret 4
lea ecx, [esp + 4]
push ecx
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x40429b
mov eax, esi
mov ecx, 6
cmp dword [eax + 0x1a0], ecx
jne 0x404245
cmp dword [eax + 0x190], ecx
je 0x404259
mov eax, dword [eax]
test eax, eax
jne 0x404235
push esi
call fcn.0041d37c
add esp, 4
pop esi
pop ecx
ret 4
movzx edx, byte [esi + 0x199]
movzx eax, byte [esi + 0x198]
movzx ecx, byte [esi + 0x197]
push edx
movzx edx, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push ecx
movzx ecx, byte [esi + 0x194]
push edx
mov edx, dword [esp + 0x1c]
push eax
push ecx
push str._02X__02X__02X__02X__02X__02X
push edx
call fcn.00402130
add esp, 0x20
push esi
call fcn.0041d37c
add esp, 4
pop esi
pop ecx
ret 4

Function at 0x4042b0
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ecx
push esi
push 0x170
mov dword [esp + 8], 0x170
call fcn.0041d34d
mov esi, eax
add esp, 4
test esi, esi
je 0x404374
push 0x170
push 0
push esi
call fcn.0043ebe0
add esp, 0xc
lea eax, [esp + 4]
push eax
push esi
push 0
push 0
push 0
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
cmp eax, 0x6f
jne 0x404305
push esi
call fcn.0041d37c
add esp, 4
pop esi
pop ecx
ret 4
lea ecx, [esp + 4]
push ecx
push esi
push 0
push 0
push 0
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
test eax, eax
jne 0x40436b
mov eax, esi
mov ecx, 6
cmp dword [eax + 0x34], ecx
je 0x40433b
mov eax, dword [eax + 8]
test eax, eax
jne 0x404321
push esi
call fcn.0041d37c
add esp, 4
pop esi
pop ecx
ret 4
movzx edx, byte [eax + 0x31]
movzx ecx, byte [eax + 0x30]
push edx
movzx edx, byte [eax + 0x2f]
push ecx
movzx ecx, byte [eax + 0x2e]
push edx
movzx edx, byte [eax + 0x2d]
movzx eax, byte [eax + 0x2c]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
push eax
push str._02X__02X__02X__02X__02X__02X
push ecx
call fcn.00402130
add esp, 0x20
push esi
call fcn.0041d37c
add esp, 4
pop esi
pop ecx
ret 4
Function at 0x4064d0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x459390
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4737e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0x40
mov byte [esi + 0xa9], bl
mov byte [esi + 0xa8], 1
mov byte [esi + 0x1ea], bl
mov dword [ebp - 4], ebx
call fcn.0041d387
add esp, 4
mov dword [esi + 0x94], eax
jmp 0x406574
mov eax, dword [esi + 0x94]
mov dword [esi + 0x90], eax
mov dword [esi + 0x1b0], ebx
mov dword [esi + 0x1b4], ebx
mov dword [esi + 0x98], 0x67452301
mov dword [esi + 0x9c], 0xefcdab89
mov dword [esi + 0xa0], 0x98badcfe
mov dword [esi + 0xa4], 0x10325476
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x407580
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x45afe7
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4737e0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [edi], 0x465280
mov dword [edi + 8], 0x465288
mov dword [edi + 0x5c], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 0xc]
push esi
mov dword [esp + 0x20], ebx
push edi
mov dword [esp + 0x18], 1
call fcn.00408760
mov dword [esp + 0x1c], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], vtable.std::basic_fstream_char__struct_std::char_traits_char__.0
call fcn.00408eb0
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x478168]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x408eb0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x45941b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4737e0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0045648c
push 4
mov dword [esp + 0x20], 0
call fcn.0041d34d
mov edi, eax
add esp, 4
test edi, edi
je 0x408f2e
call fcn.004562fd
mov dword [edi], eax
call fcn.0045612b
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0045644d
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x408f23
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00456475
jmp 0x408f30
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x40aec0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, word [esp + 4]
mov dword [esp + 4], edx
jmp fcn.00424573
Function at 0x40e750
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x45a6e0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
mov eax, dword [0x4737e0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x28]
mov ebx, ecx
push ebx
lea ecx, [esp + 0x2c]
call fcn.00401ac0
xor eax, eax
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x28]
cmp dword [ecx - 0xc], eax
jne 0x40e7a7
mov edx, dword [ebp]
mov ebx, edi
mov dword [edx + 0x1c], eax
call fcn.0040c170
jmp 0x40e8d0
lea esi, [esp + 0x28]
call fcn.00415690
mov ecx, esi
push ecx
lea edx, [edi + 0x18c]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.00402f90
add esp, 0xc
mov byte [esp + 0x20], 1
mov ecx, dword [ebp]
lea edx, [esp + 0x10]
add ecx, 0x18
push edx
call fcn.00401d60
mov eax, dword [esp + 0x10]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov esi, esp
push eax
call fcn.00401ff0
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.004154f0
add esp, 4
test eax, eax
je 0x40e836
mov eax, dword [ebp]
push 0
push 0
push eax
push 0x40edb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 0x168]
mov ecx, dword [edi + 0x20]
push 0
push 0x1f4
push eax
push ecx
jmp 0x40e8a5
mov ecx, dword [edi + 0x160]
mov edx, ebx
mov ebx, dword [esp + 0x28]
call fcn.00402b30
mov edx, dword [ebp]
mov dword [edx + 0x24], eax
mov ecx, dword [edi + 0x160]
mov ecx, dword [ecx + 4]
mov ecx, dword [ecx + 0x18]
test ecx, ecx
je 0x40e863
push eax
call ecx
add esp, 4
mov eax, dword [edi + 0x160]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x28]
test eax, eax
je 0x40e87a
push 0xffffffffffffffff
call eax
add esp, 4
mov eax, dword [edi + 0x160]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x2c]
test eax, eax
je 0x40e893
push 0xffffffffffffffff
push 0xffffffffffffffff
call eax
add esp, 8
mov eax, dword [edi + 0x164]
push 0
push 0x3e8
push eax
mov eax, dword [edi + 0x20]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov byte [esp + 0x20], 0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e8d0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e8f8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x40e980
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x45a69b
mov eax, dword fs:[0]
push eax
sub esp, 0x5a4
mov eax, dword [0x4737e0]
xor eax, esp
mov dword [esp + 0x5a0], eax
push ebx
push edi
mov eax, dword [0x4737e0]
xor eax, esp
push eax
lea eax, [esp + 0x5b0]
mov dword fs:[0], eax
mov edi, dword [esi + 0x190]
xor ebx, ebx
cmp dword [edi + 0x24], ebx
je 0x40eb8f
push 0x595
lea eax, [esp + 0x18]
push ebx
push eax
call fcn.0043ebe0
fldz
mov eax, dword [esi + 0x160]
fst dword [esp + 0x448]
fstp dword [esp + 0x4ad]
mov dword [esp + 0x20], 2
mov dword [esp + 0x24], ebx
mov byte [esp + 0x4ac], bl
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x24]
mov edi, dword [edi + 0x24]
add esp, 0xc
cmp eax, ebx
je 0x40eb8f
lea ecx, [esp + 0x14]
push ecx
push edi
call eax
add esp, 8
cmp eax, ebx
je 0x40eb8f
mov eax, dword [esp + 0x14]
cmp eax, 6
ja 0x40ea3a
call fcn.00402ae0
jmp 0x40ea3e
mov eax, dword [esp + 0xc]
cmp eax, 3
jne 0x40eb09
mov eax, dword [esp + 0x494]
cmp eax, ebx
jne 0x40ea57
mov eax, 0xa
mov ecx, dword [esp + 0x42c]
sub ecx, dword [esp + 0x434]
mov edi, dword [esp + 0x430]
sbb edi, dword [esp + 0x438]
cdq
push edx
push eax
push edi
push ecx
call fcn.00457d10
lea edx, [esp + 0x10]
push edx
mov ecx, eax
call fcn.0040ebc0
mov dword [esp + 0x5b8], ebx
fld dword [esp + 0x43c]
fmul qword [0x466e38]
mov eax, dword [esi + 0x190]
lea edx, [esp + 0x10]
push edx
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fstp dword [eax + 0x20]
mov ecx, dword [esi + 0x190]
mov dword [ecx + 0x1c], 3
mov ecx, dword [esi + 0x190]
add ecx, 0x14
call fcn.00401d60
mov ebx, esi
call fcn.0040c170
mov dword [esp + 0x5b8], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40eb8f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x40eb8f
cmp eax, 1
jne 0x40eb6a
mov ecx, dword [esi + 0x190]
mov ebx, esi
mov dword [ecx + 0x1c], eax
call fcn.0040c170
mov edx, dword [esi + 0x190]
push 0
push 0
push edx
push 0x40edb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x164]
mov ecx, dword [esi + 0x20]
push eax
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov edx, dword [esi + 0x168]
mov eax, dword [esi + 0x20]
push 0
push 0x1f4
push edx
push eax
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x40eb8f
cmp eax, ebx
jne 0x40eb8f
mov ecx, dword [esi + 0x190]
mov dword [ecx + 0x1c], ebx
mov ebx, esi
call fcn.0040c170
mov edx, dword [esi + 0x164]
mov eax, dword [esi + 0x20]
push edx
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [esp + 0x5b0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x5a0]
xor ecx, esp
call fcn.0043bfab
add esp, 0x5b0
ret
Function at 0x40ebc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4598d9
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4737e0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x28]
xor esi, esi
cmp ecx, 0x33db0
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], esi
jle 0x40ec01
xor edi, edi
xor ebx, ebx
jmp 0x40ec2c
mov eax, 0x91a2b3c5
imul ecx
add edx, ecx
sar edx, 0xb
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, esi
imul edx, edx, 0xe10
mov eax, ecx
sub eax, edx
cdq
mov ecx, 0x3c
idiv ecx
mov edi, eax
mov ebx, edx
call fcn.0041d42a
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40ec46
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp], eax
push ebx
push edi
push esi
push str._02d:_02d:_02d
mov dword [esp + 0x30], 0
push ebp
mov dword [esp + 0x28], 1
call fcn.00402130
add esp, 0x14
mov eax, ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x410410
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4595c8
mov eax, dword fs:[0]
push eax
push edi
mov eax, dword [0x4737e0]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov dword [esp + 0x10], 2
mov eax, dword [esi]
mov edi, dword [esp + 0x20]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
sub eax, 0x104
or eax, ecx
jge 0x410462
push 0x104
mov ecx, esi
call fcn.00401fa0
mov eax, dword [esi]
mov ecx, dword [esp + 0x18]
push edi
push 0x104
push eax
mov eax, dword [esp + 0x28]
push 0x462d74
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x41049b
push ecx
push eax
call fcn.0043dbf8
add esp, 8
test eax, eax
jl 0x410536
mov ecx, dword [esi]
cmp eax, dword [ecx - 8]
jg 0x410536
mov dword [ecx - 0xc], eax
mov edx, dword [esi]
xor ecx, ecx
mov word [edx + eax*2], cx
mov byte [esp + 0x10], 1
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4104d6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x10], 0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4104fb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x10], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410523
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0xc
ret 0xc
push 0x80070057
call fcn.00401090
int3
Function at 0x411dd0
Capabilities:
Get common file path

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0x1a
push 0
mov dword [esp + 0xc], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x411e65
mov eax, dword [esi]
mov edx, dword [eax - 8]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
sub edx, 0x104
or ecx, edx
jge 0x411e11
push 0x104
mov ecx, esi
call fcn.00401fa0
mov eax, dword [esi]
push edi
push eax
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov edi, eax
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x411e39
push ecx
push eax
call fcn.0043dbf8
add esp, 8
test eax, eax
jl 0x411e5b
mov ecx, dword [esi]
cmp eax, dword [ecx - 8]
jg 0x411e5b
mov dword [ecx - 0xc], eax
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, edi
pop edi
pop ecx
ret
push 0x80070057
call fcn.00401090
xor eax, eax
pop ecx
ret