joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e1d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4657eb
mov eax, dword fs:[0]
push eax
sub esp, 0x160
mov eax, dword [0x47c5a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, ecx
cmp dword [edi + 0x6c], 0
mov dword [ebp - 0x11c], eax
je 0x40e32b
push 0x46ab30
lea ecx, [ebp - 0x16c]
call fcn.00402de0
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
push 0x104
lea edx, [ebp - 0x118]
push edx
push 0x472d80
push str.DAMIP
lea ecx, [ebp - 0x16c]
push 0x46c7d8
mov dword [ebp - 4], 0
mov dword [edi + 0x6c], ecx
call ebx
lea eax, [ebp - 0x118]
push eax
push str.damIP
mov ecx, edi
call fcn.00406dc0
push esi
push 0x104
lea ecx, [ebp - 0x118]
push ecx
push 0x472d80
push str.DAMIPv6
push 0x46c7d8
call ebx
lea edx, [ebp - 0x118]
push edx
push str.damIPv6
mov ecx, edi
call fcn.00406dc0
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push esi
push 0xffffffffffffffff
push str.DAMPort
push 0x46c7d8
call ebx
cmp eax, 0xffffffff
je 0x40e2c5
push eax
push str.damPort
mov ecx, edi
call fcn.00407040
push esi
push 0xffffffffffffffff
push str.Customize
push 0x46c7d8
call ebx
cmp eax, 0xffffffff
je 0x40e2e6
push eax
push str.customize
mov ecx, edi
call fcn.00407040
push esi
push 0
push str.DisabType
push 0x46c7d8
call ebx
cmp eax, 0xffffffff
je 0x40e307
push eax
push str.DisabType
mov ecx, edi
call fcn.00407040
mov ecx, dword [ebp - 0x11c]
lea eax, [ebp - 0x16c]
push eax
call fcn.00402720
lea ecx, [ebp - 0x16c]
mov dword [ebp - 4], 0xffffffff
call fcn.00402fa0
push 1
mov ecx, edi
call fcn.00407280
movzx eax, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043fe5a
mov esp, ebp
pop ebp
ret 8
Function at 0x40eb80
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465926
mov eax, dword fs:[0]
push eax
sub esp, 0x2bc
mov eax, dword [0x47c5a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, ecx
mov eax, dword [edi + 0x6c]
xor ebx, ebx
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x224], eax
cmp eax, ebx
je 0x40ecdc
push str.exceptDevs
lea ecx, [ebp - 0x278]
call fcn.00402de0
push esi
push 0xffffffffffffffff
push str.DevsCount
lea eax, [ebp - 0x278]
push str.ExceptDevs
mov dword [ebp - 4], ebx
mov dword [edi + 0x6c], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 0xffffffff
je 0x40ec02
mov ebx, eax
xor esi, esi
test ebx, ebx
je 0x40ecae
lea esp, [esp]
push str.devItem
lea ecx, [ebp - 0x2c8]
call fcn.00402de0
push esi
push str.DevName.
lea edx, [ebp - 0x118]
lea ecx, [ebp - 0x2c8]
push 0x46c90c
push edx
mov byte [ebp - 4], 1
mov dword [edi + 0x6c], ecx
call fcn.00440eaa
mov eax, dword [ebp - 0x228]
add esp, 0x10
push eax
push 0x104
lea ecx, [ebp - 0x220]
push ecx
push 0x472d80
lea edx, [ebp - 0x118]
push edx
push str.ExceptDevs
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x220]
push eax
push str.devName
mov ecx, edi
call fcn.00406e90
lea ecx, [ebp - 0x2c8]
push ecx
lea ecx, [ebp - 0x278]
call fcn.00402720
lea ecx, [ebp - 0x2c8]
mov byte [ebp - 4], 0
call fcn.00402fa0
inc esi
cmp esi, ebx
jb 0x40ec10
mov esi, dword [ebp - 0x224]
lea edx, [ebp - 0x278]
mov eax, edx
push eax
mov ecx, esi
mov dword [edi + 0x6c], edx
call fcn.00402720
lea ecx, [ebp - 0x278]
mov dword [edi + 0x6c], esi
mov dword [ebp - 4], 0xffffffff
call fcn.00402fa0
push 1
mov ecx, edi
call fcn.00407280
movzx eax, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043fe5a
mov esp, ebp
pop ebp
ret 4
Function at 0x40ee90
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46599b
mov eax, dword fs:[0]
push eax
sub esp, 0x160
mov eax, dword [0x47c5a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
push 0xffffffffffffffff
push str.FuncComponents
push str.Components
mov edi, ecx
mov dword [ebp - 0x11c], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp dword [edi + 0x6c], 0
mov esi, eax
je 0x40efc7
push str.smartCard
lea ecx, [ebp - 0x16c]
call fcn.00402de0
lea ecx, [ebp - 0x16c]
and esi, 0xa
push esi
mov dword [edi + 0x6c], ecx
push str.type
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.00407040
push str..MaxUserCtrl
push str.SmartCard
lea edx, [ebp - 0x118]
push 0x46c5b4
push edx
call fcn.00440eaa
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
add esp, 0x10
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x118]
push eax
push str.Common
call esi
cmp eax, 0xffffffff
je 0x40ef62
push eax
push str.MaxUserCtrl
mov ecx, edi
call fcn.00407040
push str..ProbationCtrl
push str.SmartCard
lea ecx, [ebp - 0x118]
push 0x46c5b4
push ecx
call fcn.00440eaa
add esp, 0x10
push ebx
push 0xffffffffffffffff
lea edx, [ebp - 0x118]
push edx
push str.Common
call esi
cmp eax, 0xffffffff
je 0x40efa3
push eax
push str.ProbationCtrl
mov ecx, edi
call fcn.00407040
mov ecx, dword [ebp - 0x11c]
lea eax, [ebp - 0x16c]
push eax
call fcn.00402720
lea ecx, [ebp - 0x16c]
mov dword [ebp - 4], 0xffffffff
call fcn.00402fa0
push 1
mov ecx, edi
call fcn.00407280
movzx eax, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043fe5a
mov esp, ebp
pop ebp
ret 8
Function at 0x410e30
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465af8
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push ebx
push esi
push edi
mov eax, dword [0x47c5a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x6c]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x410efe
push str.protoComponent
lea ecx, [ebp - 0x60]
call fcn.00402de0
mov edi, dword [ebp + 8]
push edi
push 0xffffffffffffffff
push str.ProtoComponents
lea eax, [ebp - 0x60]
push str.Components
mov dword [ebp - 4], 0
mov dword [esi + 0x6c], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebx, eax
test bl, 1
je 0x410eab
lea ecx, [ebp - 0x60]
push ecx
push edi
mov ecx, esi
call fcn.0040c920
test bl, 2
je 0x410ebc
lea edx, [ebp - 0x60]
push edx
push edi
mov ecx, esi
call fcn.0040cd80
test bl, 4
je 0x410ecd
lea eax, [ebp - 0x60]
push eax
push edi
mov ecx, esi
call fcn.0040f140
test bl, 8
je 0x410ede
lea ecx, [ebp - 0x60]
push ecx
push edi
mov ecx, esi
call fcn.0040d970
mov edi, dword [ebp - 0x10]
lea edx, [ebp - 0x60]
push edx
mov ecx, edi
call fcn.00402720
lea ecx, [ebp - 0x60]
mov dword [esi + 0x6c], edi
mov dword [ebp - 4], 0xffffffff
call fcn.00402fa0
push 1
mov ecx, esi
call fcn.00407280
movzx eax, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x410f20
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465b28
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [0x47c5a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x6c], 0
je 0x410fef
mov edi, dword [ebp + 8]
push edi
push 0xffffffffffffffff
push str.FuncComponents
push str.Components
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebx, eax
mov eax, dword [esi + 0x6c]
push str.funcComponent
lea ecx, [ebp - 0x5c]
mov dword [ebp + 8], eax
call fcn.00402de0
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 0
mov dword [esi + 0x6c], ecx
test bl, 1
je 0x410f9c
mov edx, ecx
push edx
push edi
mov ecx, esi
call fcn.0040e000
test bl, 4
je 0x410fad
lea eax, [ebp - 0x5c]
push eax
push edi
mov ecx, esi
call fcn.0040e1d0
test bl, 0x10
je 0x410fbe
lea ecx, [ebp - 0x5c]
push ecx
push edi
mov ecx, esi
call fcn.0040e360
test bl, 0xa
je 0x410fcf
lea edx, [ebp - 0x5c]
push edx
push edi
mov ecx, esi
call fcn.0040ee90
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x5c]
push eax
mov ecx, edi
call fcn.00402720
lea ecx, [ebp - 0x5c]
mov dword [esi + 0x6c], edi
mov dword [ebp - 4], 0xffffffff
call fcn.00402fa0
push 1
mov ecx, esi
call fcn.00407280
movzx eax, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x421150
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4674d3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x47c5a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push 0xffffffffffffffff
push 0
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
push edi
mov byte [esi], 0
call fcn.00407c80
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov ecx, dword [edi + 0x20]
mov dword [esi + 0x20], ecx
mov edx, dword [edi + 0x24]
mov dword [esi + 0x24], edx
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
mov edx, dword [edi + 0x30]
mov dword [esi + 0x30], edx
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov ecx, dword [edi + 0x38]
mov dword [esi + 0x38], ecx
mov edx, dword [edi + 0x3c]
mov dword [esi + 0x3c], edx
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x44], ecx
mov edx, dword [edi + 0x48]
mov dword [esi + 0x48], edx
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
mov ecx, dword [edi + 0x50]
lea edx, [edi + 0x54]
mov dword [esi + 0x50], ecx
push edx
lea ecx, [esi + 0x54]
mov dword [ebp - 4], 0
call fcn.004205f0
mov eax, dword [edi + 0x60]
lea ecx, [edi + 0x64]
push ecx
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 1
mov dword [esi + 0x60], eax
call fcn.004205f0
mov edx, dword [edi + 0x70]
mov dword [esi + 0x70], edx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x425d80
Capabilities:
Create process on windows

Disassembly:
push esi
push str.StopLvdunService
call fcn.00425870
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
add esp, 4
push 0
push 0
push str._F__IM__LdMainControl.exe_
push str.taskkill
push str.open
push 0
call esi
push 0
push 0
push str._F__IM__ldbusiness_32.exe_
push str.taskkill
push str.open
push 0
call esi
push 0
push 0
push str._F__IM__ldbusiness_64.exe_
push str.taskkill
push str.open
push 0
call esi
push 0
push 0
push str._F__IM__LdContentAware.exe_
push str.taskkill
push str.open
push 0
call esi
push 0
push 0
push str._F__IM__LdFileGate.exe_
push str.taskkill
push str.open
push 0
call esi
push 0
push 0
push str._F__IM__LdMsgInject.exe_
push str.taskkill
push str.open
push 0
call esi
push 0
push 0
push str._F__IM__LdMsgInject64.exe_
push str.taskkill
push str.open
push 0
call esi
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
ret
Function at 0x427b60
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x428690
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
jle 0x42877f
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
push edi
movzx ecx, byte [edx]
dec ebx
inc edx
mov dword [ebp + 0x10], ebx
test ebx, ebx
jle 0x428745
movzx esi, byte [edx]
dec ebx
inc edx
mov dword [ebp + 0x10], ebx
test ebx, ebx
jle 0x42870f
movzx edi, byte [edx]
dec ebx
mov dword [ebp + 0x10], ebx
mov ebx, ecx
shr ebx, 2
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__cccbccc]
mov byte [eax], bl
and ecx, 3
add ecx, ecx
mov ebx, esi
shr ebx, 4
movzx ecx, byte [ebx + ecx*8 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__cccbccc]
mov byte [eax + 1], cl
mov ecx, edi
shr ecx, 6
and esi, 0xf
movzx ecx, byte [ecx + esi*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__cccbccc]
inc edx
mov byte [eax + 2], cl
and edi, 0x3f
movzx ecx, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__cccbccc]
mov byte [eax + 3], cl
jmp 0x428767
mov edi, ecx
shr edi, 2
mov bl, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__cccbccc]
and ecx, 3
mov byte [eax], bl
mov edi, esi
add ecx, ecx
shr edi, 4
movzx ecx, byte [edi + ecx*8 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__cccbccc]
mov byte [eax + 1], cl
and esi, 0xf
movzx ecx, byte [esi*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__cccbccc]
mov byte [eax + 2], cl
mov byte [eax + 3], 0x3d
jmp 0x428767
mov esi, ecx
shr esi, 2
mov bl, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__cccbccc]
and ecx, 3
mov byte [eax], bl
shl ecx, 4
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__cccbccc]
mov byte [eax + 1], cl
mov word [eax + 2], 0x3d3d
mov ebx, dword [ebp + 0x10]
add eax, 4
test ebx, ebx
jg 0x4286a7
pop edi
pop esi
mov byte [eax], 0
xor eax, eax
pop ebx
pop ebp
ret
mov edx, dword [ebp + 0xc]
mov byte [edx], 0
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x428ac0
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
push ebx
push esi
mov esi, dword [ecx + 4]
mov ecx, eax
shr ecx, 4
xor ecx, esi
and ecx, 0xf0f0f0f
xor esi, ecx
shl ecx, 4
xor eax, ecx
mov ecx, eax
shr ecx, 0x10
xor ecx, esi
and ecx, 0xffff
xor esi, ecx
shl ecx, 0x10
xor eax, ecx
mov ecx, esi
shr ecx, 2
xor ecx, eax
and ecx, 0x33333333
xor eax, ecx
add ecx, ecx
add ecx, ecx
xor esi, ecx
mov ecx, esi
shr ecx, 8
xor ecx, eax
and ecx, 0xff00ff
xor eax, ecx
shl ecx, 8
xor ecx, esi
rol ecx, 1
mov esi, ecx
xor esi, eax
and esi, 0xaaaaaaaa
xor ecx, esi
xor esi, eax
push edi
rol esi, 1
mov dword [ebp - 4], 8
lea esp, [esp]
mov eax, ecx
ror eax, 4
xor eax, dword [edx]
add edx, 0x10
mov edi, eax
shr edi, 0x18
and edi, 0x3f
mov edi, dword [edi*4 + 0x46d7c0]
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
xor edi, dword [ebx*4 + 0x46d9c0]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
xor edi, dword [ebx*4 + 0x46dbc0]
and eax, 0x3f
xor edi, dword [eax*4 + 0x46ddc0]
mov eax, dword [edx - 0xc]
xor esi, edi
xor eax, ecx
mov edi, eax
shr edi, 0x18
and edi, 0x3f
mov edi, dword [edi*4 + 0x46d8c0]
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
xor edi, dword [ebx*4 + 0x46dac0]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
xor edi, dword [ebx*4 + 0x46dcc0]
and eax, 0x3f
xor edi, dword [eax*4 + 0x46dec0]
xor esi, edi
mov eax, esi
ror eax, 4
xor eax, dword [edx - 8]
mov edi, eax
shr edi, 0x18
and edi, 0x3f
mov edi, dword [edi*4 + 0x46d7c0]
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
xor edi, dword [ebx*4 + 0x46d9c0]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
xor edi, dword [ebx*4 + 0x46dbc0]
and eax, 0x3f
xor edi, dword [eax*4 + 0x46ddc0]
mov eax, dword [edx - 4]
xor ecx, edi
xor eax, esi
mov edi, eax
shr edi, 0x18
and edi, 0x3f
mov edi, dword [edi*4 + 0x46d8c0]
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
xor edi, dword [ebx*4 + 0x46dac0]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
xor edi, dword [ebx*4 + 0x46dcc0]
and eax, 0x3f
xor edi, dword [eax*4 + 0x46dec0]
xor ecx, edi
dec dword [ebp - 4]
jne 0x428b40
ror ecx, 1
mov eax, ecx
xor eax, esi
and eax, 0xaaaaaaaa
xor ecx, eax
xor eax, esi
ror eax, 1
mov edx, eax
shr edx, 8
xor edx, ecx
and edx, 0xff00ff
xor ecx, edx
shl edx, 8
xor eax, edx
mov edx, eax
shr edx, 2
xor edx, ecx
and edx, 0x33333333
xor ecx, edx
add edx, edx
add edx, edx
xor eax, edx
mov edx, ecx
shr edx, 0x10
xor edx, eax
and edx, 0xffff
xor eax, edx
shl edx, 0x10
xor ecx, edx
mov edx, ecx
shr edx, 4
xor edx, eax
and edx, 0xf0f0f0f
mov esi, edx
shl esi, 4
xor esi, ecx
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx], esi
xor edx, eax
pop esi
mov dword [ecx + 4], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4296c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
jne 0x4296d5
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [ebp + 0x14]
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4296ce
mov edx, dword [ebp + 0x10]
mov eax, 4
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x14]
push esi
lea ecx, [ebp - 8]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp + 0x14]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x429730
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ecx
push edx
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x429786
mov eax, dword [ebp - 4]
test eax, eax
je 0x429786
mov edx, dword [ebp + 0x10]
push esi
push 4
lea ecx, [ebp + 0x14]
push ecx
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x429790
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x47c5a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
jne 0x4297c7
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043fe5a
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x10c]
push edx
push 1
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4297b5
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 0x10c]
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x114]
push edx
push 0
push esi
push eax
mov dword [ebp - 0x114], 2
mov dword [ebp - 0x110], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x10c]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4297b5
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x429833
sub eax, edx
cmp dword [ebp + 0x18], eax
jb 0x4297b5
lea eax, [ebp - 0x108]
mov edx, edi
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x429851
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0043fe5a
mov esp, ebp
pop ebp
ret
Function at 0x429c50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0x104
jae 0x429c73
mov eax, dword [ebp + 8]
push 0
push str.the_len_in_is_too_small
push eax
call fcn.0042a650
add esp, 0xc
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
push 0x105
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
dec eax
cmp eax, 0x103
ja 0x429c97
mov byte [esi + 1], 0
mov eax, 1
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x42d110
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x47c5a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x88], eax
test esi, esi
je 0x42d1b4
test edi, edi
je 0x42d1b4
test ebx, ebx
je 0x42d1b4
test eax, eax
je 0x42d1b4
cmp dword [ebp + 0x18], 0x80
jbe 0x42d1b4
push 0x80
lea eax, [ebp - 0x84]
push 0
push eax
call fcn.00440e30
add esp, 0xc
push esi
push 0x80
lea ecx, [ebp - 0x84]
push ecx
push 0x472d80
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, eax
test esi, esi
je 0x42d1a1
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x88]
push edx
lea eax, [ebp - 0x84]
push eax
push ecx
call fcn.004411a0
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043fe5a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0043fe5a
mov esp, ebp
pop ebp
ret

Function at 0x42d1d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x47c5a8]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push esi
mov byte [ebp - 0x24], 0
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
call fcn.004365a0
add esp, 4
test eax, eax
je 0x42d298
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x2c]
push ecx
push esi
call fcn.0043b870
add esp, 0xc
test eax, eax
je 0x42d298
cmp dword [ebp - 0x2c], 0
jne 0x42d298
cmp dword [ebp - 0x28], 0x220
jb 0x42d298
push 0x472dd4
push esi
call fcn.00441c2a
mov esi, eax
add esp, 8
test esi, esi
je 0x42d298
push 0
push 0x200
push esi
call fcn.00441af2
push esi
push 0x20
lea edx, [ebp - 0x24]
push 1
push edx
call fcn.00441852
push esi
call fcn.00441577
add esp, 0x20
mov ecx, 8
lea esi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043fe5a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0043fe5a
mov esp, ebp
pop ebp
ret