joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4013a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x415004]
xor eax, ebp
mov dword [ebp - 4], eax
push 1
call fcn.00401940
add esp, 4
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0x40d1f0
push 0x65
call fcn.004018d0
add esp, 0x10
test eax, eax
jne 0x4013dc
xor eax, eax
jmp 0x401515
lea edx, [ebp - 0xc]
push edx
push 0xf023f
push 0
push 0x40d1f4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40141a
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 3
push 0
push 0x40d208
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x401421
xor eax, eax
jmp 0x401515
lea eax, [ebp - 0xc]
push eax
push 0xf013f
push 0
push str.SOFTWARE
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40145f
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 3
push 0
push str._isfecwvistager
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x401466
xor eax, eax
jmp 0x401515
push 0
call section..text
add esp, 4
mov dword [ebp - 0x18], eax
push 1
call section..text
add esp, 4
mov dword [ebp - 0x1c], eax
push 0x40d25c
call fcn.00401750
add esp, 4
call fcn.00401970
test eax, eax
je 0x40149f
mov dword [ebp - 0x14], str.C:WindowsSysWOW64WindowsPowerShell_v1.0
jmp 0x4014a6
mov dword [ebp - 0x14], 0x40d2f0
mov ecx, dword [ebp - 0x18]
push ecx
push 0x40d280
mov edx, dword [ebp - 0x14]
push edx
push 0x40d2f4
call fcn.00401550
add esp, 0x10
test eax, eax
je 0x4014d1
push str._isfecwvinzuldgpd
call fcn.004019c0
add esp, 4
call fcn.00401970
test eax, eax
je 0x401513
push 0x40d33c
call fcn.00401750
add esp, 4
mov eax, dword [ebp - 0x1c]
push eax
push str.powershell
push 0x40d378
push 0x40d37c
call fcn.00401550
add esp, 0x10
test eax, eax
je 0x401513
push str._isfecwvinsuvifeg
call fcn.004019c0
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401a9f
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4039e7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call sub.msvcrt.dll_wcslen
pop ecx
add eax, eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
leave
ret

Function at 0x403b62
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
xor esi, esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
test ebp, ebp
je 0x403bbf
push ebx
push edi
push ebp
call sub.msvcrt.dll_wcslen
pop ecx
lea ebx, [eax + eax + 2]
push ebx
push 0x2000
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x403bbd
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push ebx
push ebp
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
mov esi, eax
neg esi
sbb esi, esi
neg esi
pop edi
pop ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, esi
pop esi
pop ebp
ret

Function at 0x403d84
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x403f10
Capabilities:
Get common file path

Disassembly:
cmp word [0x4165f8], 0
push esi
mov esi, 0x4165f8
jne 0x403f31
push 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
mov dword [0x416804], eax
push esi
push dword [esp + 0xc]
call sub.msvcrt.dll_wcscpy
mov eax, dword [0x416804]
pop ecx
pop ecx
pop esi
ret

Function at 0x403f44
Capabilities:
Get common file path

Disassembly:
cmp word [0x416808], 0
push esi
mov esi, 0x416808
jne 0x403f65
push 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
mov dword [0x416a14], eax
push esi
push dword [esp + 0xc]
call sub.msvcrt.dll_wcscpy
mov eax, dword [0x416a14]
pop ecx
pop ecx
pop esi
ret

Function at 0x403f78
Capabilities:
Get common file path

Disassembly:
cmp word [0x416a18], 0
push esi
mov esi, 0x416a18
jne 0x403fd6
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call fcn.00404b09
test eax, eax
pop ecx
je 0x403fc5
push edi
mov edi, 0x104
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
call fcn.00403a0b
push edi
push str.Sysnative
mov edi, esi
call fcn.0040467b
push esi
call sub.msvcrt.dll_wcslen
add esp, 0xc
pop edi
jmp 0x403fd1
push 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
mov dword [0x416c24], eax
push esi
push dword [esp + 0xc]
call sub.msvcrt.dll_wcscpy
mov eax, dword [0x416c24]
pop ecx
pop ecx
pop esi
ret

Function at 0x40446e
Capabilities:
Create process on windows

Disassembly:
push 5
mov eax, 0x41147c
push eax
push eax
push dword [esp + 0x14]
push str.open
push dword [esp + 0x18]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x20
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
ret
Function at 0x4053ae
Capabilities:
Enumerate files on windows

Disassembly:
push ecx
push esi
mov esi, eax
mov eax, dword [esi]
cmp eax, 0xffffffff
push edi
jne 0x4053e8
lea edi, [esi + 4]
mov ecx, edi
call fcn.00403e44
mov dword [esi + 0x404], eax
lea eax, [esi + 0x408]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov dword [esi], eax
mov dword [esp + 8], ecx
jmp 0x405403
lea ecx, [esi + 0x408]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
mov dword [esp + 8], eax
jne 0x40540a
call fcn.00405454
cmp dword [esp + 8], 0
je 0x40544c
push ebx
lea edi, [esi + 0x658]
lea ebx, [esi + 0x434]
push ebp
add esi, 0xa58
push esi
call sub.msvcrt.dll_wcslen
push ebx
mov ebp, eax
call sub.msvcrt.dll_wcslen
lea eax, [eax + ebp + 1]
cmp eax, 0x1ff
pop ecx
pop ecx
jae 0x405446
push ebx
push esi
mov eax, edi
call fcn.00403eec
pop ecx
pop ecx
jmp 0x40544a
and word [edi], 0
pop ebp
pop ebx
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret

Function at 0x405ce1
Capabilities:
Read .ini file

Disassembly:
and word [esi], 0
push 0x415f88
push dword [esp + 0xc]
push esi
push 0x41147c
push dword [esp + 0x14]
push 0x416198
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
mov eax, esi
ret

Function at 0x405d06
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.004108e0
and word [ebp - 0x2004], 0
push 0x2000
lea eax, [ebp - 0x2002]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x415f88
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push 0x41147c
push dword [ebp + 8]
push 0x416198
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
cmp word [ebp - 0x2004], 0
je 0x405d75
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + 0xc]
call sub.msvcrt.dll_wcscpy
pop ecx
xor eax, eax
pop ecx
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x405d79
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.004108e0
and word [ebp - 0x2004], 0
push esi
push edi
push 0x2000
lea eax, [ebp - 0x2002]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov edi, 0x415f88
push edi
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push 0x41147c
push dword [ebp + 8]
mov esi, 0x416198
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
cmp word [ebp - 0x2004], 0
je 0x405de0
cmp dword [ebp + 0x10], 0
jne 0x405de0
xor eax, eax
jmp 0x405dee
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringW]
pop edi
pop esi
leave
ret
Function at 0x406199
Capabilities:
Read .ini file

Disassembly:
push dword [esp + 4]
call fcn.00403d84
test eax, eax
pop ecx
je 0x406220
push esi
push edi
push dword [esp + 0xc]
mov edi, 0x415f88
push edi
call sub.msvcrt.dll_wcscpy
push str.general
mov esi, 0x416198
push esi
call sub.msvcrt.dll_wcscpy
add esp, 0x10
push edi
push 0
push 0x411a70
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
dec eax
neg eax
sbb eax, eax
inc eax
push 0x3f
push str.charset
mov esi, 0x416220
mov dword [0x41621c], eax
call fcn.00405ce1
push 0x3f
push str.TranslatorName
mov esi, 0x4162a0
call fcn.00405ce1
push 0xff
push str.TranslatorURL
mov esi, 0x416320
call fcn.00405ce1
add esp, 0x18
pop edi
pop esi
ret

Function at 0x407229
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, eax
mov edi, ecx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp - 0x10], eax
mov eax, edi
call fcn.004067c1
and dword [ebp - 4], 0
test eax, eax
mov dword [ebp - 8], eax
jle 0x4072b6
cmp dword [ebp + 8], 0
je 0x407274
mov eax, dword [ebp - 4]
push 0x64
cdq
pop ecx
idiv ecx
test edx, edx
jne 0x407274
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [ebp - 0x10]
cmp eax, 0x1f4
ja 0x4072b6
mov ebx, dword [esi + 0xc]
add ebx, dword [ebp - 4]
cmp ebx, dword [ebp - 8]
jl 0x407288
test byte [esi + 0x10], 0x20
je 0x4072b6
sub ebx, dword [ebp - 8]
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push edi
mov eax, ebx
call fcn.00406fa3
test eax, eax
je 0x4072ab
push dword [ebp + 8]
push dword [ebp - 0xc]
call fcn.0040719a
test eax, eax
jne 0x4072c0
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jl 0x407251
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret 4
mov eax, ebx
jmp 0x4072b9

Function at 0x4077f3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8004
call fcn.004108e0
push ebx
push esi
mov esi, 0x7fff
xor ebx, ebx
push esi
lea eax, [ebp - 0x8003]
push ebx
push eax
mov byte [ebp - 0x8004], bl
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push ebx
push esi
lea eax, [ebp - 0x8004]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x8004]
push eax
call sub.msvcrt.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x8004]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop esi
pop ebx
leave
ret
Function at 0x407862
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.004108e0
push ebx
push esi
mov esi, 0x1fff
xor ebx, ebx
push esi
lea eax, [ebp - 0x2003]
push ebx
push eax
mov byte [ebp - 0x2004], bl
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push ebx
push esi
lea eax, [ebp - 0x2004]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2004]
push eax
call sub.msvcrt.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop esi
pop ebx
leave
ret
Function at 0x408b40
Capabilities:
Get common file path
Get file system object information

Disassembly:
sub esp, 0x4cc
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push ebp
push esi
mov esi, eax
xor ebp, ebp
cmp dword [esi + 0x2e4], ebp
push edi
je 0x408c10
cmp dword [esi + 0x2ec], ebp
je 0x408bd1
push 0x2b0
lea eax, [esp + 0x230]
push ebp
push eax
mov dword [esp + 0x234], ebp
call sub.msvcrt.dll_memset
push 0x208
lea eax, [esp + 0x2e]
push ebp
push eax
mov word [esp + 0x34], bp
call sub.msvcrt.dll_memset
add esp, 0x18
push 0x104
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
push 0x4001
push 0x2b4
lea eax, [esp + 0x230]
push eax
push ebp
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [esi + 0x2d8], eax
push eax
jmp 0x408c01
call fcn.00404c72
push 0x60
pop ecx
shl eax, 4
xor edx, edx
div ecx
push 1
push 1
push 0x19
push eax
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
push 1
lea edi, [esi + 0x2d8]
push eax
mov dword [edi], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push dword [edi]
push 1
push 0x1003
push dword [esi + 0x2d0]
call ebx
cmp dword [esi + 0x2e8], ebp
je 0x408c56
call fcn.00404c72
push 0x60
pop ecx
shl eax, 5
xor edx, edx
div ecx
push 1
push 1
push 0x19
push eax
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
push 1
lea edi, [esi + 0x2dc]
push eax
mov dword [edi], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push dword [edi]
push ebp
push 0x1003
push dword [esi + 0x2d0]
call ebx
call fcn.00404c72
push 0x60
pop ecx
shl eax, 4
xor edx, edx
div ecx
push 1
push 1
push 0x19
mov edi, eax
push edi
push edi
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
push ebp
mov dword [esi + 0x2d4], eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push 0x1000
push edi
push edi
push ebp
push 0x85
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
push ebp
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push 0x1000
push edi
push edi
push ebp
push 0x86
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
push ebp
push dword [esi + 0x2d4]
mov dword [esp + 0x1c], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
mov edi, dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
push eax
push dword [esp + 0x14]
mov dword [esp + 0x20], eax
push dword [esi + 0x2d4]
call edi
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esi + 0x2d4]
call edi
push dword [esp + 0x10]
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
call edi
push dword [esp + 0x14]
call edi
mov eax, dword [esi + 0x2d4]
mov esi, dword [esi + 0x2d0]
push eax
push ebp
push 0x1208
push esi
call fcn.0040287b
pop ecx
push eax
call ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4cc
ret
Function at 0x4094dc
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push esi
mov esi, eax
movzx eax, word [esi + 0x2cc]
cmp word [esp + 0x10], ax
push edi
jb 0x40952f
movzx edi, word [esp + 0x14]
movzx eax, ax
add eax, dword [esi + 0x308]
cmp edi, eax
jge 0x40952f
push 0x10
xor ebx, ebx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x409512
inc ebx
movzx ecx, word [esi + 0x2cc]
push ebx
mov eax, edi
push 0
sub eax, ecx
call fcn.00406d12
call fcn.00409538
xor eax, eax
inc eax
jmp 0x409531
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret 4

Function at 0x40a46f
Capabilities:
Open clipboard

Disassembly:
push esi
push 1
push 2
push 2
mov esi, eax
mov eax, dword [esi + 0x69c]
push 0x41147c
push eax
call fcn.0040a427
test eax, eax
je 0x40a4b9
mov eax, dword [esi + 0x69c]
mov eax, dword [eax + 0x2f4]
push edi
call fcn.00404e99
push dword [esi + 0x208]
mov edi, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40a4b8
push edi
call fcn.00403b62
pop ecx
pop edi
pop esi
ret
Function at 0x40a7f9
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa40
push esi
push edi
mov edi, eax
xor esi, esi
cmp dword [edi + 0x27c], esi
jne 0x40a9bf
push ebx
mov ebx, 0x208
push ebx
lea eax, [ebp - 0x20a]
push esi
push eax
mov word [ebp - 0x20c], si
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x20c]
push eax
call fcn.00403db3
lea eax, [ebp - 0x20c]
push 0x2e
push eax
call sub.msvcrt.dll_wcsrchr
add esp, 0x18
cmp eax, esi
je 0x40a853
mov word [eax], si
lea eax, [ebp - 0x20c]
push str..cfg
push eax
call sub.msvcrt.dll_wcscat
mov esi, dword [edi + 0xecc]
pop ecx
pop ecx
push str._cfg
call fcn.004052ff
test eax, eax
jl 0x40a956
mov esi, 0x104
push esi
lea ecx, [ebp - 0x20c]
push ecx
lea ecx, [eax + 1]
mov eax, dword [edi + 0xecc]
call fcn.004052ef
push eax
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call sub.msvcrt.dll_wcschr
test eax, eax
pop ecx
pop ecx
jne 0x40a956
and word [ebp - 0x418], ax
push ebx
push eax
lea eax, [ebp - 0x416]
push eax
call sub.msvcrt.dll_memset
and word [ebp - 0x624], 0
push ebx
lea eax, [ebp - 0x622]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
lea eax, [ebp - 0x418]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
lea eax, [ebp - 0x418]
push eax
call sub.msvcrt.dll_wcslen
mov esi, eax
lea eax, [ebp - 0x20c]
push eax
call sub.msvcrt.dll_wcslen
lea eax, [esi + eax + 1]
cmp eax, 0x1ff
pop ecx
pop ecx
jae 0x40a939
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x624]
call fcn.00403eec
pop ecx
pop ecx
jmp 0x40a941
and word [ebp - 0x624], 0
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.msvcrt.dll_wcscpy
pop ecx
pop ecx
mov eax, dword [ebp + 8]
and word [ebp - 0xa38], 0
and word [ebp - 0x82e], 0
mov dword [ebp - 0xa3c], eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa38]
push eax
mov dword [ebp - 0xa40], 0x412a40
call sub.msvcrt.dll_wcscpy
pop ecx
pop ecx
lea eax, [ebp - 0xa40]
call fcn.0040d141
mov eax, dword [edi + 0x698]
lea esi, [ebp - 0xa40]
call fcn.00401ee0
mov eax, edi
call fcn.00401a40
mov edi, dword [edi + 0x69c]
mov ebx, esi
call fcn.0040682c
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x40bee6
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call fcn.00404cb9
add esi, 0x20
call fcn.0040c0a5
push dword [ebp + 0xc]
call fcn.004039b5
cmp eax, 0xffffffff
pop ecx
mov dword [ebp + 0xc], eax
je 0x40bf90
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
cmp esi, ebx
jbe 0x40bf87
lea eax, [esi + 1]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov edi, eax
push esi
push edi
push dword [ebp + 0xc]
call fcn.0040463d
add esp, 0xc
push edi
lea eax, [ebp - 0x18]
push eax
mov byte [edi + esi], bl
mov dword [ebp - 4], 1
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], 0x100
mov dword [ebp - 0x10], ebx
call fcn.00405034
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp - 0x18]
cmp eax, ebx
pop ecx
jne 0x40bf76
mov eax, 0x41147c
push eax
push dword [ebp + 8]
call fcn.0040bd2a
lea esi, [ebp - 0x18]
call fcn.00404e80
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40cdde
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20000
call fcn.004108e0
cmp dword [ebp + 8], 0
je 0x40ce43
test esi, esi
je 0x40ce31
push 0x22
push esi
call sub.msvcrt.dll_wcschr
test eax, eax
pop ecx
pop ecx
je 0x40ce31
and word [ebp - 0x20000], 0
push esi
push str.__s_
lea eax, [ebp - 0x20000]
push 0xfffe
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x10
push dword [ebp + 0x1c]
lea eax, [ebp - 0x20000]
push eax
jmp 0x40ce35
push dword [ebp + 0x1c]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringW]
leave
ret
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
leave
ret

Function at 0x40ce5b
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4004
call fcn.004108e0
push esi
push edi
xor eax, eax
cmp dword [ebp + 8], eax
push 0x4000
push eax
mov word [ebp - 0x4004], ax
lea eax, [ebp - 0x4002]
mov edi, ecx
push eax
je 0x40ceba
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x4004]
push eax
push dword [edi]
push dword [ebp + 0x14]
call fcn.004046c7
add esp, 0x18
push dword [ebp + 0x18]
lea eax, [ebp - 0x4004]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringW]
mov esi, eax
jmp 0x40cefb
call sub.msvcrt.dll_memset
add esp, 0xc
push dword [ebp + 0x18]
lea eax, [ebp - 0x4004]
push 0x2000
push eax
push 0x41147c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
push dword [ebp + 0x14]
xor ecx, ecx
cmp ecx, eax
sbb esi, esi
push edi
lea edi, [ebp - 0x4004]
neg esi
call fcn.00404750
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x40cf01
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push dword [ebp + 0x18]
je 0x40cf1f
push dword [esi]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0040cd91
add esp, 0x10
pop ebp
ret
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
mov dword [esi], eax
pop ebp
ret
Function at 0x40e64a
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x10], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, esi
mov dword [ebp - 4], eax
jbe 0x40e7dc
push ebx
mov eax, edi
call fcn.004056a6
push dword [ebp - 4]
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov ebx, eax
push ebx
push dword [ebp - 4]
push esi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x4118a8
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40e6cd
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x30]
mov dword [edi + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edi], ecx
mov ecx, dword [eax + 0x14]
mov dword [edi + 0xc], ecx
mov ecx, dword [eax + 0x10]
mov dword [edi + 8], ecx
mov ecx, dword [eax + 0x24]
mov dword [edi + 0x10], ecx
mov eax, dword [eax + 0x28]
mov dword [edi + 0x14], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40e71c
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
push str._4.4X_4.4X
lea eax, [ebp - 0x38]
push 0x14
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x14
push 0x41147c
lea eax, [ebp - 0x38]
push eax
push ebx
lea esi, [ebp - 0x238]
call fcn.0040e5bb
test eax, eax
jne 0x40e72c
lea eax, [ebp - 0x38]
push str.040904E4
push eax
call sub.msvcrt.dll_wcscpy
pop ecx
pop ecx
push 0x412e28
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0x18]
push ebx
call fcn.0040e5bb
push 0x412e40
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0x218]
push ebx
call fcn.0040e5bb
push 0x412e60
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0x418]
push ebx
call fcn.0040e5bb
push 0x412e78
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0x618]
push ebx
call fcn.0040e5bb
push 0x412e98
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0x818]
push ebx
call fcn.0040e5bb
push 0x412eb0
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0xa18]
push ebx
call fcn.0040e5bb
push 0x412ecc
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0xc18]
push ebx
call fcn.0040e5bb
push str.OriginalFileName
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0xe18]
push ebx
call fcn.0040e5bb
xor esi, esi
push ebx
inc esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ebx
mov eax, esi
pop esi
leave
ret 4