joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d340
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x6c]
mov edx, dword [ecx + 0xf54]
and edx, 0x40
test edx, edx
jne 0x44d36a
xor eax, eax
jmp 0x44d542
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3fc]
and ecx, 0x80
test ecx, ecx
jne 0x44d3da
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3fc]
or al, 0x80
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x3fc], eax
push str.BUG_B
push 0x45
push 0x44
push str.FLEXLM__c_c_sADDATE
lea edx, [ebp - 0x2cc]
push edx
call fcn.00404911
add esp, 0x14
lea eax, [ebp - 0x2cc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042148d
add esp, 8
test eax, eax
je 0x44d3da
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3fc]
or ah, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x3fc], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3fc]
and eax, 0x100
test eax, eax
je 0x44d447
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x14], 0
je 0x44d409
xor edx, edx
test edx, edx
je 0x44d409
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x2d0], ecx
jmp 0x44d413
mov dword [ebp - 0x2d0], 0xffffffa8
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x2d0]
mov dword [edx + 0x14], eax
push 0
push 0xff
push 0
push 0
push 0x138
push 0xffffffffffffffa8
mov ecx, dword [ebp + 8]
push ecx
call fcn.004105d0
add esp, 0x1c
mov eax, 0xffffffa8
jmp 0x44d542
mov byte [ebp - 0x204], 0x5c
mov byte [ebp - 0x203], 0
push 0
lea edx, [ebp - 0x204]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0044d546
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x44d47b
mov eax, dword [ebp - 4]
jmp 0x44d542
push 0x200
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0
lea edx, [ebp - 0x204]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0044d546
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x44d4b3
mov eax, dword [ebp - 4]
jmp 0x44d542
mov byte [ebp - 0x204], 0x2f
mov byte [ebp - 0x202], 0x61
mov byte [ebp - 0x201], 0x72
mov byte [ebp - 0x203], 0x76
mov byte [ebp - 0x200], 0
push 0
lea ecx, [ebp - 0x204]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0044d546
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x44d4f9
mov eax, dword [ebp - 4]
jmp 0x44d542
mov byte [ebp - 0x204], 0x2f
mov byte [ebp - 0x200], 0
mov byte [ebp - 0x202], 0x6d
mov byte [ebp - 0x203], 0x74
mov byte [ebp - 0x201], 0x70
push 0
lea eax, [ebp - 0x204]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0044d546
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x44d53f
mov eax, dword [ebp - 4]
jmp 0x44d542
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x44e3c0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
add eax, 0x5c
push eax
call fcn.004504c4
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx], 0x67452301
mov edx, dword [ebp + 8]
mov dword [edx + 4], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x98badcfe
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0x10325476
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0xc3d2e1f0
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], 0
pop ebp
ret

Function at 0x4504f0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
and eax, 0xff
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
and ecx, 0xffff
sar ecx, 8
and ecx, 0xff
and ecx, 0xff
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 0x80000000
jae 0x450545
mov edx, dword [ebp - 8]
shr edx, 0x10
and edx, 0xffff
and edx, 0xffff
mov dword [ebp - 0x14], edx
jmp 0x45056a
cmp dword [ebp - 0x10], 4
jae 0x450563
mov eax, dword [ebp - 8]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
and ah, 0x7f
mov dword [ebp - 0x14], eax
jmp 0x45056a
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x10], 5
jne 0x45057d
cmp dword [ebp - 4], 2
jne 0x45057d
mov dword [ebp - 0xc], 8
cmp dword [ebp - 0x10], 5
jne 0x450590
cmp dword [ebp - 4], 1
jne 0x450590
mov dword [ebp - 0xc], 7
cmp dword [ebp - 0x10], 5
jne 0x4505a3
cmp dword [ebp - 4], 0
jne 0x4505a3
mov dword [ebp - 0xc], 6
cmp dword [ebp - 0x10], 4
jne 0x4505b6
cmp dword [ebp - 4], 0
jne 0x4505b6
mov dword [ebp - 0xc], 4
cmp dword [ebp - 0x10], 3
jne 0x4505c9
cmp dword [ebp - 4], 0
jne 0x4505c9
mov dword [ebp - 0xc], 5
cmp dword [ebp - 0x10], 4
jne 0x4505dc
cmp dword [ebp - 4], 1
jne 0x4505dc
mov dword [ebp - 0xc], 3
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4505e3
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push edi
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x120], 0
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
push str.FLEXLM_TS_GATE
call fcn.00404a9d
add esp, 4
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x45067d
push str.bypass
mov eax, dword [ebp - 0x120]
push eax
call fcn.0040b840
add esp, 8
test eax, eax
jne 0x45067d
xor eax, eax
jmp 0x450858
cmp dword [0x49b8e4], 0
jne 0x45084c
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
push str.TerminalServerFlexlmMutex
push 0x494178
lea ecx, [ebp - 0x104]
push ecx
call fcn.00404911
add esp, 0x10
lea edx, [ebp - 0x104]
push edx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jne 0x4506d0
xor eax, eax
jmp 0x450858
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4506ec
push 0xffffffffffffffff
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x49b8e4], 0
jne 0x450832
call fcn.004504f0
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
mov dword [ebp - 0x124], ecx
mov edx, dword [ebp - 0x124]
sub edx, 4
mov dword [ebp - 0x124], edx
cmp dword [ebp - 0x124], 4
ja case.default.0x450732
mov eax, dword [ebp - 0x124]
jmp dword [eax*4 + 0x45085d]
push str.wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x49b8f4], eax
cmp dword [0x49b8f4], 0
je 0x4507eb
push str.WTSEnumerateSessionsA
mov ecx, dword [0x49b8f4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x49b8ec], eax
cmp dword [0x49b8ec], 0
je 0x4507eb
push str.WTSFreeMemory
mov edx, dword [0x49b8f4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x49b8f0], eax
cmp dword [0x49b8f0], 0
je 0x4507eb
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x114]
push ecx
push 1
push 0
push 0
call dword [0x49b8ec]
cmp dword [ebp - 0x114], 0
je 0x4507c5
mov edx, dword [ebp - 0x114]
cmp dword [edx + 8], 0
jne 0x4507d4
mov eax, dword [ebp - 0x114]
push eax
call dword [0x49b8f0]
jmp 0x4507eb
mov ecx, dword [ebp - 0x114]
push ecx
call dword [0x49b8f0]
mov dword [0x49b8e8], 1
mov edx, dword [0x49b8f4]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x49b8f4], 0
jmp case.default.0x450732
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
je case.default.0x450732
mov dword [0x49b8e8], 1
mov dword [0x49b8e4], 1
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [0x49b8e8], 0
setne al
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x450880
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x11c]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionNetworkCards
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4509e9
mov dword [ebp - 0x120], 0x104
mov dword [ebp - 0x10], 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x120]
push ecx
lea edx, [ebp - 0x118]
push edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x124], eax
mov ecx, dword [ebp - 0x124]
push ecx
mov edx, dword [ebp - 0x11c]
push edx
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x4509da
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x118]
push edx
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4509c1
mov dword [ebp - 0x120], 0
lea ecx, [ebp - 0x120]
push ecx
push 0
lea edx, [ebp - 8]
push edx
push 0
push 0x4941f4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x120]
add ecx, 1
push ecx
call fcn.00404963
add esp, 4
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x120]
push edx
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push str.ServiceName
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x14], 0
je 0x4509b5
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040c6a0
add esp, 8
mov edx, dword [ebp - 0x14]
push edx
call fcn.00404828
add esp, 4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x120], 0x104
jmp 0x4508cc
mov ecx, dword [ebp - 0x11c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4509f0
mov eax, 0xffffff01
jmp 0x4509f2
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x450d67
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push edi
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x108], 0
cmp dword [0x49b900], 0
jne 0x450e95
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
push str.IPHelperMutex
push 0x494230
lea eax, [ebp - 0x104]
push eax
call fcn.00404911
add esp, 0x10
lea ecx, [ebp - 0x104]
push ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x450df1
xor eax, eax
jmp 0x450e9b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x450e0d
push 0xffffffffffffffff
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x49b900], 0
jne 0x450e7b
push str.iphlpapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x49b904], eax
cmp dword [0x49b904], 0
jne 0x450e3b
mov dword [ebp - 0x108], 0xfffffffe
jmp 0x450e71
push str.GetNetworkParams
mov eax, dword [0x49b904]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x49b8f8], eax
cmp dword [0x49b8f8], 0
je 0x450e71
push str.GetAdaptersInfo
mov ecx, dword [0x49b904]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x49b8fc], eax
mov dword [0x49b900], 1
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x108]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x45178c
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4942b8]
mov dword [ebp - 8], eax
mov ecx, dword [0x4942bc]
mov dword [ebp - 4], ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x451856
push 0xf01ff
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x451801
push 0
push 0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x4517f4
mov eax, 1
jmp 0x451858
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
xor eax, eax
jmp 0x451858
push 0
push 0
push 0
push 0
push str.Extended_Base
push str.SYSTEM32driversDS1410D.SYS
push 1
push 2
push 1
push 0xf01ff
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x451856
push 0
push 0
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x451852
mov eax, 1
jmp 0x451858
xor eax, eax
jmp 0x451858
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x452739
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 4], 1
cmp dword [0x49b93c], 0
je 0x45275a
mov al, byte [ebp + 8]
push eax
push 2
call fcn.004527cd
add esp, 8
jmp 0x4527c9
cmp dword [0x49b938], 0
je 0x4527c7
cmp dword [0x49b928], 0
je 0x4527c2
mov byte [0x49d3fc], 1
mov cl, byte [ebp + 8]
mov byte [0x49d3fd], cl
push 0
push 0x49d408
push 2
push 0x49d3fc
mov edx, dword [0x49d414]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4527c2
push 0
push 0x49d408
push 1
push 0x49d3fc
mov eax, dword [0x49d414]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4527c2
mov cl, byte [0x49d3fc]
mov byte [ebp - 4], cl
mov al, byte [ebp - 4]
jmp 0x4527c9
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x45283e
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov al, byte [ebp + 8]
mov byte [ebp - 4], al
cmp dword [0x49b93c], 0
je 0x452861
mov cl, byte [ebp + 8]
push ecx
push 3
call fcn.004527cd
add esp, 8
jmp 0x4528d0
cmp dword [0x49b938], 0
je 0x4528ce
cmp dword [0x49b928], 0
je 0x4528c9
mov byte [0x49d3fc], 2
mov dl, byte [ebp + 8]
mov byte [0x49d3fd], dl
push 0
push 0x49d408
push 2
push 0x49d3fc
mov eax, dword [0x49d414]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4528c9
push 0
push 0x49d408
push 1
push 0x49d3fc
mov ecx, dword [0x49d414]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4528c9
mov dl, byte [0x49d3fc]
mov byte [ebp - 4], dl
mov al, byte [ebp - 4]
jmp 0x4528d0
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x4528d4
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 4], 0
cmp dword [0x49b93c], 0
je 0x4528f3
push 0
push 1
call fcn.004527cd
add esp, 8
jmp 0x45296b
cmp dword [0x49b938], 0
je 0x452969
cmp dword [0x49b928], 0
je 0x452964
mov byte [0x49d3fc], 0
mov al, byte [0x4942ac]
mov byte [0x49d3fd], al
push 0
push 0x49d408
push 2
push 0x49d3fc
mov ecx, dword [0x49d414]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x45295c
push 0
push 0x49d408
push 1
push 0x49d3fc
mov edx, dword [0x49d414]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45295c
mov al, byte [0x49d3fc]
mov byte [ebp - 4], al
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, byte [ebp - 4]
jmp 0x45296b
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x45296f
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 4], 0
cmp dword [0x49b93c], 0
je 0x45298e
push 0
push 4
call fcn.004527cd
add esp, 8
jmp 0x4529f4
cmp dword [0x49b938], 0
je 0x4529f2
cmp dword [0x49b928], 0
je 0x4529ed
mov byte [0x49d3fc], 3
push 0
push 0x49d408
push 2
push 0x49d3fc
mov eax, dword [0x49d414]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4529ed
push 0
push 0x49d408
push 1
push 0x49d3fc
mov ecx, dword [0x49d414]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4529ed
mov dl, byte [0x49d3fc]
mov byte [ebp - 4], dl
mov al, byte [ebp - 4]
jmp 0x4529f4
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x4529f8
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 4], 0
cmp dword [0x49b93c], 0
je 0x452a17
push 0
push 0x22
call fcn.004527cd
add esp, 8
jmp 0x452a7d
cmp dword [0x49b938], 0
je 0x452a7b
cmp dword [0x49b928], 0
je 0x452a76
mov byte [0x49d3fc], 0x22
push 0
push 0x49d408
push 2
push 0x49d3fc
mov eax, dword [0x49d414]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x452a76
push 0
push 0x49d408
push 1
push 0x49d3fc
mov ecx, dword [0x49d414]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x452a76
mov dl, byte [0x49d3fc]
mov byte [ebp - 4], dl
mov al, byte [ebp - 4]
jmp 0x452a7d
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x452a81
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 4], 0
cmp dword [0x49b93c], 0
je 0x452aa0
push 0
push 5
call fcn.004527cd
add esp, 8
jmp 0x452b06
cmp dword [0x49b938], 0
je 0x452b04
cmp dword [0x49b928], 0
je 0x452aff
mov byte [0x49d3fc], 5
push 0
push 0x49d408
push 2
push 0x49d3fc
mov eax, dword [0x49d414]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x452aff
push 0
push 0x49d408
push 1
push 0x49d3fc
mov ecx, dword [0x49d414]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x452aff
mov dl, byte [0x49d3fc]
mov byte [ebp - 4], dl
mov al, byte [ebp - 4]
jmp 0x452b06
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x452d95
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 4], 0
cmp dword [0x49b928], 0
je 0x452ded
mov byte [0x49d3fc], 6
mov al, byte [0x4942ac]
mov byte [0x49d3fd], al
push 0
push 0x49d408
push 2
push 0x49d3fc
mov ecx, dword [0x49d414]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0x49d408
push 1
push 0x49d3fc
mov edx, dword [0x49d414]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esp, ebp
pop ebp
ret
Function at 0x452df1
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 1
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x452e83
cmp dword [ebp - 0x10], 0
jne 0x452e83
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov edx, dword [ebp + 8]
and edx, 0xffff
imul eax, edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x452e83
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0xc]
push edx
call fcn.00452e9e
add esp, 8
push 0
push 1
call dword [sym.imp.KERNEL32.dll_SleepEx]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x24]
push edx
call fcn.00452efe
add esp, 8
test eax, eax
jne 0x452e54
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x452e9a
push 0
mov eax, dword [ebp + 8]
and eax, 0xffff
push eax
call dword [sym.imp.KERNEL32.dll_SleepEx]
mov esp, ebp
pop ebp
ret

Function at 0x453a70
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
push esi
mov esi, dword [esp + 0x50]
mov bx, word [esp + 0x4c]
cmp bx, 4
mov word [esi], 0
jbe 0x453a93
sub al, al
pop esi
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x38]
push 0x10
push eax
call fcn.004536d0
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.00453730
lea eax, [esp + 0x18]
push 0x10
push eax
call fcn.004537f0
lea eax, [esp + 0x18]
push eax
call fcn.004530d0
add bl, 0x31
and eax, 0xffff
mov byte [esp + eax + 0x18], bl
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0xc]
push 0x10
push eax
lea eax, [esp + 0x24]
push 0x453a60
push eax
lea eax, [esp + 0x3c]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
or eax, eax
je 0x453b44
lea eax, [esp + 8]
push 0x2c
push eax
call fcn.00453a40
or ax, ax
je 0x453b0c
and eax, 0xffff
mov byte [esp + eax + 8], 0
cmp byte [esp + 8], 0x30
jne 0x453b30
mov al, byte [esp + 9]
and al, 0xdf
cmp al, 0x58
jne 0x453b30
lea eax, [esp + 0xa]
push esi
push eax
call fcn.004531e0
or al, al
jne 0x453b44
jmp 0x453b3f
lea eax, [esp + 8]
push esi
push eax
call fcn.00453130
or al, al
jne 0x453b44
mov word [esi], 0
mov ax, word [esi]
or ax, ax
je 0x453b5c
cmp ax, 0xffff
je 0x453b5c
mov al, 1
pop esi
pop ebx
add esp, 0x40
ret 8
sub al, al
pop esi
pop ebx
add esp, 0x40
ret 8
Function at 0x453b80
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
push esi
mov esi, dword [esp + 0x50]
mov bx, word [esp + 0x4c]
cmp bx, 4
mov word [esi], 0
jbe 0x453ba3
sub al, al
pop esi
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x38]
push 0x10
push eax
call fcn.004536d0
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.00453730
lea eax, [esp + 0x18]
push 0x10
push eax
call fcn.004537f0
lea eax, [esp + 0x18]
push eax
call fcn.004530d0
add bl, 0x31
and eax, 0xffff
mov byte [esp + eax + 0x18], bl
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0xc]
push 0x10
push eax
lea eax, [esp + 0x24]
push 0x453b70
push eax
lea eax, [esp + 0x3c]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
or eax, eax
je 0x453c54
lea eax, [esp + 8]
push 0x2c
push eax
call fcn.00453a40
or ax, ax
je 0x453c54
and eax, 0xffff
mov cl, byte [esp + eax + 9]
and cl, 0xdf
cmp cl, 0x54
jne 0x453c54
cmp byte [esp + eax + 0xa], 0x3a
jne 0x453c54
push esi
lea eax, [esp + eax + 0xf]
push eax
call fcn.00453130
or al, al
jne 0x453c40
jmp 0x453c4f
mov ax, word [esi]
cmp ax, 1
jl 0x453c4f
cmp ax, 6
jle 0x453c54
mov word [esi], 0
cmp word [esi], 1
sbb al, al
inc al
pop esi
pop ebx
add esp, 0x40
ret 8

Function at 0x453c80
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x50
push esi
lea eax, [esp + 0x44]
push 0x10
push eax
call fcn.004536d0
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.00453730
lea eax, [esp + 0x34]
push 0x10
push eax
call fcn.004538e0
lea eax, [esp + 4]
push 0x10
push eax
call fcn.00453890
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x18]
push 0x10
push eax
lea eax, [esp + 0x40]
push 0x453c70
push eax
lea eax, [esp + 0x38]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
mov esi, eax
or esi, esi
je 0x453cef
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 8]
push eax
call fcn.00452f60
mov ecx, dword [esp + 0x5c]
mov byte [ecx], al
cmp esi, 1
sbb al, al
inc al
pop esi
add esp, 0x50
ret 8

Function at 0x453d00
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x30
lea eax, [esp + 0x20]
push 0x10
push eax
call fcn.004536d0
lea eax, [esp]
push 0x10
push eax
call fcn.00453730
lea eax, [esp + 0x10]
push 0x10
push eax
call fcn.00453840
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x14]
push 0
push eax
lea eax, [esp + 0xc]
push eax
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov ecx, dword [esp + 0x34]
cmp eax, 1
mov word [ecx], ax
sbb cl, cl
inc cl
mov al, cl
add esp, 0x30
ret 4
Function at 0x453d70
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x70
push esi
mov esi, dword [esp + 0x78]
push 0x10
mov word [esi], 0
lea eax, [esp + 8]
push 0
push eax
call fcn.004530f0
lea eax, [esp + 0x64]
push 0x10
push eax
call fcn.004536d0
lea eax, [esp + 0x44]
push 0x10
push eax
call fcn.00453730
lea eax, [esp + 0x54]
push 0x10
push eax
call fcn.00453790
lea eax, [esp + 0x34]
push 0x10
push eax
call fcn.00453940
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.004539f0
lea eax, [esp + 0x14]
push 0x10
push eax
call fcn.004539a0
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 8]
push 0x10
push eax
lea eax, [esp + 0x60]
push 0x453d60
push eax
lea eax, [esp + 0x58]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
or eax, eax
je 0x453e43
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 8]
push eax
call fcn.00452f60
or al, al
je 0x453e11
mov word [esi], 2
jmp 0x453e43
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 8]
push eax
call fcn.00452f60
or al, al
je 0x453e2b
mov word [esi], 3
jmp 0x453e43
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 8]
push eax
call fcn.00452f60
or al, al
je 0x453e43
mov word [esi], 1
cmp word [esi], 1
sbb al, al
inc al
pop esi
add esp, 0x70
ret 4