joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ed10
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
sub esp, 0x420
push ebx
push ebp
push esi
mov ebp, ecx
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ebx, [ebp + 0x18]
mov ecx, 0xc2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
push 0x5965b8
push str._sconfig_server.ini
lea eax, [esp + 0x30]
push 0xff
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
lea ecx, [esp + 0x38]
push 0x581660
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 0x18
test edi, edi
mov dword [esp + 0x14], edi
je 0x42edd2
mov esi, 1
push edi
push esi
lea edx, [esp + 0x130]
push 0x308
push edx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, esi
je 0x42ed9c
push edi
mov dword [ebp + 0x1c], 0
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
jmp 0x42edd7
mov edx, 0x308
lea ecx, [esp + 0x128]
call fcn.004339d0
mov ecx, 0xc2
lea esi, [esp + 0x128]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x14]
mov esi, 1
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
jmp 0x42edd7
mov esi, 1
mov eax, dword [ebp + 0xb4]
mov dword [ebp + 0x220], eax
mov eax, dword [ebp + 0x1c]
cmp eax, 0x190
je 0x42ee4b
cmp eax, 0x191
je 0x42ee44
mov ecx, 0xc2
xor eax, eax
mov edi, ebx
push 0x7f
rep stosd dword es:[edi], eax
lea ecx, [ebp + 0x34]
push 0x5a22e4
push ecx
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
mov byte [ebp + 0xb3], 0
mov dword [ebp + 0x204], esi
mov dword [ebp + 0x20c], esi
push ebp
mov dword [ebp + 0x208], esi
mov dword [ebp + 0x214], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x420
ret
cmp eax, 0x190
jne 0x42ee64
push ebp
mov dword [ebp + 0x1c], 0x191
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x420
ret
cmp eax, 0x191
jne 0x42ef07
lea edx, [esp + 0x18]
push 0x1e240
push edx
call fcn.00409920
add esp, 8
mov ecx, 4
lea edi, [esp + 0x18]
lea esi, [ebp + 0x224]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x42eeb8
lea edx, [ebp + 0x24]
xor ecx, ecx
push ebp
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x420
ret
mov eax, dword [ebp + 0x20]
lea ecx, [esp + 0x18]
push eax
push ecx
xor ebx, ebx
call fcn.00409920
lea edx, [ebp + 0x24]
add esp, 8
mov ecx, 4
lea edi, [esp + 0x18]
mov esi, edx
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x42ef03
mov cl, byte [eax + edx]
mov edx, eax
and edx, 0xf
movsx esi, cl
mov dl, byte [esp + edx + 0x18]
add dl, bl
mov ebx, esi
xor dl, cl
inc eax
mov cl, dl
lea edx, [ebp + 0x24]
cmp eax, 0x10
mov byte [eax + edx - 1], cl
jb 0x42eedf
mov byte [ebp + 0x33], 0
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x420
ret
Function at 0x42ef20
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
sub esp, 0x41c
push ebx
push ebp
mov ebp, ecx
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x5965b8
push str._sconfig_server.ini
lea eax, [esp + 0x32c]
push 0xff
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
lea ecx, [esp + 0x334]
push 0x581698
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
xor ebx, ebx
add esp, 0x18
cmp eax, ebx
mov dword [esp + 8], eax
je 0x42f024
push esi
push edi
lea esi, [ebp + 0x18]
mov ecx, 0xc2
lea edi, [esp + 0x24]
mov dword [ebp + 0x1c], 0x191
rep movsd dword es:[edi], dword [esi]
cmp dword [esp + 0x214], ebx
jne 0x42efaf
mov edi, dword [sym.imp.MSVCRT.dll_rand]
mov byte [esp + 0x30], bl
mov esi, 1
call edi
mov byte [esp + esi + 0x30], al
inc esi
cmp esi, 0x10
jb 0x42efa1
jmp 0x42eff3
lea edx, [esp + 0x230]
push 0x1e240
push edx
call fcn.00409920
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.00409920
add esp, 0x10
xor eax, eax
mov edx, eax
and edx, 0xf
mov cl, byte [esp + edx + 0x14]
add cl, bl
mov bl, byte [esp + eax + 0x30]
xor bl, cl
mov byte [esp + eax + 0x30], bl
inc eax
cmp eax, 0x10
movsx ebx, bl
jb 0x42efd5
mov edx, 0x308
lea ecx, [esp + 0x24]
call fcn.00433990
mov esi, dword [esp + 0x10]
lea edx, [esp + 0x24]
push esi
push 1
push 0x308
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
pop edi
pop esi
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebp
pop ebx
add esp, 0x41c
ret

Function at 0x42f130
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x100
push ebx
push esi
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea esi, [ebx + 0x9c4]
mov ecx, 0x292
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
push 0x5965b8
push str._sconfigevents.ini
lea eax, [esp + 0x14]
push 0xff
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
lea ecx, [esp + 0x1c]
push 0x581660
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 0x18
test edi, edi
je 0x42f1ad
push edi
push 1
push 0xa48
push esi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x42f1a3
mov dword [esi], 0
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
cmp dword [esi], 0x191
je 0x42f225
mov ecx, 0x292
xor eax, eax
mov edi, esi
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_strncpy]
rep stosd dword es:[edi], eax
mov dword [esi], 0x191
mov edi, str.connect.wav
lea esi, [ebx + 0x9e7]
lea edx, [edi - 0x20]
push 0x1f
lea eax, [esi - 0x1f]
push edx
push eax
call ebp
push 0x7f
lea ecx, [esi + 1]
push edi
push ecx
mov byte [esi], 0
call ebp
mov byte [esi + 0x80], 0
mov edx, dword [edi + 0x80]
mov dword [esi + 0x81], edx
add edi, 0xa4
add esp, 0x18
add esi, 0xa4
cmp edi, 0x56b1b8
jl 0x42f1d8
mov dword [ebx + 0x1408], 1
pop ebp
lea eax, [ebx + 0xa67]
mov ecx, 0x10
mov byte [eax - 0x80], 0
mov byte [eax], 0
add eax, 0xa4
dec ecx
jne 0x42f230
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
add esp, 0x100
ret
Function at 0x42f280
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x100
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebp
push esi
mov esi, dword [esp + 0x110]
mov ebp, ecx
test esi, esi
je 0x42f2cf
push edi
push ebp
call ebx
lea edi, [ebp + 0x9c4]
mov ecx, 0x292
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp + 0xa67]
mov ecx, 0x10
pop edi
mov byte [eax - 0x80], 0
mov byte [eax], 0
add eax, 0xa4
dec ecx
jne 0x42f2b9
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebp
call ebx
push 0x5965b8
push str._sconfigevents.ini
lea eax, [esp + 0x14]
push 0xff
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
lea ecx, [esp + 0x1c]
push 0x581698
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 0x18
test esi, esi
je 0x42f32a
push esi
lea eax, [ebp + 0x9c4]
push 1
push 0xa48
push eax
mov dword [eax], 0x191
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 4

Function at 0x42f340
Capabilities:
Create thread

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 0x1ab8]
test eax, eax
jl 0x42f3ea
cmp eax, 0x10
jge 0x42f3ea
mov eax, dword [esi + 0x1ab4]
test eax, eax
je 0x42f394
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 4], 0x103
je 0x42f3ea
mov edx, dword [esi + 0x1ab4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1ab4], 0
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x1408]
test eax, eax
je 0x42f3e3
mov eax, dword [esp + 0x10]
lea ecx, [eax + eax*4]
lea edx, [eax + ecx*8]
mov ecx, dword [esi + edx*4 + 0xa68]
test ecx, ecx
je 0x42f3e3
mov dword [esi + 0x1ab8], eax
lea eax, [esp + 8]
push eax
push 0
push esi
push 0x42f400
push 0x1f400
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0x1ab4], eax
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
add esp, 8
ret 4
Function at 0x42f42b
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x200
mov al, byte [0x5937a0]
push esi
mov esi, ecx
push edi
mov byte [esp + 8], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esi + 0x1ab8]
test eax, eax
jl 0x42f55a
cmp eax, 0x10
jge 0x42f55a
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x1ab8]
lea ecx, [eax + eax*4]
lea edx, [eax + ecx*8]
mov ecx, dword [esi + edx*4 + 0xa68]
test ecx, ecx
lea eax, [esi + edx*4]
je 0x42f4a6
mov ecx, dword [esi + 0x1408]
test ecx, ecx
je 0x42f4a6
add eax, 0x9e8
push 0xff
push eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
mov byte [esp + 0x107], 0
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, byte [esp + 8]
test al, al
je 0x42f55a
lea ecx, [esp + 8]
push str..wav
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x42f542
lea edx, [esp + 8]
push 0x3a
push edx
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
test eax, eax
jne 0x42f527
lea eax, [esp + 8]
lea ecx, [esp + 0x108]
push eax
push 0x5965b8
push str._s_sounds_s
push 0xff
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
lea edx, [esp + 0x108]
push 0x20001
push 0
push edx
call dword [sym.imp.WINMM.dll_PlaySoundA]
pop edi
pop esi
add esp, 0x200
ret
push 0x20001
lea eax, [esp + 0xc]
push 0
push eax
call dword [sym.imp.WINMM.dll_PlaySoundA]
pop edi
pop esi
add esp, 0x200
ret
push 5
push 0
lea ecx, [esp + 0x10]
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
add esp, 0x200
ret

Function at 0x42f570
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x100
push ebx
push esi
mov esi, ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ebx, [esi + 0x8a8]
mov ecx, 0x47
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
push 0x5965b8
push str._sconfigcharts.ini
lea eax, [esp + 0x14]
push 0xff
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
lea ecx, [esp + 0x1c]
push 0x581660
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 0x18
test edi, edi
je 0x42f5ed
push edi
push 1
push 0x11c
push ebx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x42f5e3
mov dword [ebx], 0
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
cmp dword [ebx], 0x190
je 0x42f632
mov ecx, 0x47
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov dword [esi + 0x8ac], 1
mov dword [esi + 0x8b4], 1
mov dword [esi + 0x8b8], 1
mov dword [esi + 0x8c0], 0x7d000
mov dword [esi + 0x8bc], 0xfde8
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
add esp, 0x100
ret
Function at 0x42f680
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x100
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov esi, dword [esp + 0x110]
mov ebx, ecx
test esi, esi
je 0x42f6b5
push edi
push ebx
call ebp
lea edi, [ebx + 0x8a8]
mov ecx, 0x47
rep movsd dword es:[edi], dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
push ebx
call ebp
push 0x5965b8
push str._sconfigcharts.ini
lea eax, [esp + 0x14]
push 0xff
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
lea ecx, [esp + 0x1c]
push 0x581698
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 0x18
test esi, esi
je 0x42f710
push esi
lea eax, [ebx + 0x8a8]
push 1
push 0x11c
push eax
mov dword [eax], 0x190
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 4

Function at 0x42f760
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x3a8
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov esi, dword [esp + 0x3b8]
push edi
test esi, esi
mov ebx, ecx
je 0x42f794
push ebx
call ebp
lea edi, [ebx + 0x320]
mov ecx, 0xaa
rep movsd dword es:[edi], dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebx
call ebp
push 0x5965b8
push str._sconfigemail.ini
lea eax, [esp + 0x18]
push 0xff
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
lea ecx, [esp + 0x20]
push 0x581698
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, eax
add esp, 0x18
test ebp, ebp
je 0x42f815
lea esi, [ebx + 0x320]
mov ecx, 0xaa
lea edi, [esp + 0x110]
mov edx, 0x2a4
mov dword [esi], 0x191
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x114]
call fcn.00433990
push ebp
push 1
lea edx, [esp + 0x118]
push 0x2a8
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3a8
ret 4
Function at 0x42f830
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x100
push ebx
push ebp
push esi
mov esi, ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ebp, [esi + 0x320]
mov ecx, 0xaa
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
push 0x5965b8
push str._sconfigemail.ini
lea eax, [esp + 0x18]
push 0xff
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
lea ecx, [esp + 0x20]
push 0x581660
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
xor ebx, ebx
add esp, 0x18
cmp edi, ebx
je 0x42f8ad
push edi
push 1
push 0x2a8
push ebp
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x42f8a3
mov dword [ebp], ebx
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
cmp dword [ebp], 0x191
jne 0x42f8c6
mov edx, 0x2a4
lea ecx, [esi + 0x324]
call fcn.004339d0
mov al, byte [esi + 0x4c8]
lea ecx, [esi + 0x4c8]
cmp al, bl
mov byte [esi + 0x3a7], bl
mov byte [esi + 0x3c7], bl
mov byte [esi + 0x447], bl
mov byte [esi + 0x4c7], bl
mov byte [esi + 0x547], bl
jne 0x42f917
mov dl, byte [esi + 0x448]
lea eax, [esi + 0x448]
cmp dl, bl
je 0x42f917
push 0x7f
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
mov byte [esi + 0x547], bl
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret

Function at 0x42f960
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x3e0
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov esi, dword [esp + 0x3f0]
push edi
test esi, esi
mov ebx, ecx
je 0x42f994
push ebx
call ebp
lea edi, [ebx + 0x5c8]
mov ecx, 0xb8
rep movsd dword es:[edi], dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebx
call ebp
push 0x5965b8
push str._sconfigpublish.ini
lea eax, [esp + 0x18]
push 0xff
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
lea ecx, [esp + 0x20]
push 0x581698
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, eax
add esp, 0x18
test ebp, ebp
je 0x42fa15
lea esi, [ebx + 0x5c8]
mov ecx, 0xb8
lea edi, [esp + 0x110]
mov edx, 0x2dc
mov dword [esi], 0x192
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x114]
call fcn.00433990
push ebp
push 1
lea edx, [esp + 0x118]
push 0x2e0
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3e0
ret 4
Function at 0x42fa30
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x100
push ebx
push ebp
push esi
mov esi, ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ebp, [esi + 0x5c8]
mov ecx, 0xb8
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
push 0x5965b8
push str._sconfigpublish.ini
lea eax, [esp + 0x18]
push 0xff
push eax
mov dword [esi + 0x7a4], 5
call dword [sym.imp.MSVCRT.dll__snprintf]
lea ecx, [esp + 0x20]
push 0x581660
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
xor ebx, ebx
add esp, 0x18
cmp edi, ebx
je 0x42fb20
push edi
push 1
push 0x2e0
push ebp
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x42fab4
mov dword [esi + 0x320], ebx
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [ebp]
add esp, 4
cmp eax, 0x192
jne 0x42fad8
mov edx, 0x2dc
lea ecx, [esi + 0x5cc]
call fcn.004339d0
mov ecx, dword [esi + 0x7a4]
mov eax, 5
cmp ecx, eax
mov byte [esi + 0x5e3], bl
mov byte [esi + 0x663], bl
mov byte [esi + 0x6a3], bl
mov byte [esi + 0x723], bl
mov byte [esi + 0x7a3], bl
jge 0x42fb0b
mov dword [esi + 0x7a4], eax
mov ecx, dword [esi + 0x7a4]
mov eax, 0x5a0
cmp ecx, eax
jle 0x42fb20
mov dword [esi + 0x7a4], eax
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret

Function at 0x42fb70
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x100
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov esi, dword [esp + 0x110]
mov ebx, ecx
test esi, esi
je 0x42fba5
push edi
push ebx
call ebp
lea edi, [ebx + 0x140c]
mov ecx, 0x4e
rep movsd dword es:[edi], dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
push ebx
call ebp
push 0x5965b8
push str._sconfig_trade.ini
lea eax, [esp + 0x14]
push 0xff
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
lea ecx, [esp + 0x1c]
push 0x581698
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 0x18
test esi, esi
je 0x42fc00
push esi
lea eax, [ebx + 0x140c]
push 1
push 0x138
push eax
mov dword [eax], 0x190
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 4
Function at 0x42fc20
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x100
push ebx
push ebp
push esi
mov esi, ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ebp, [esi + 0x140c]
mov ecx, 0x4e
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
push 0x5965b8
push str._sconfig_trade.ini
lea eax, [esp + 0x18]
push 0xff
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
lea ecx, [esp + 0x20]
push 0x581660
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
xor ebx, ebx
add esp, 0x18
cmp edi, ebx
je 0x42fcc5
push edi
push 1
push 0x138
push ebp
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x42fc93
mov dword [ebp], ebx
cmp dword [esi + 0x1418], ebx
jge 0x42fca1
mov dword [esi + 0x1418], ebx
cmp dword [esi + 0x1414], ebx
jge 0x42fcaf
mov dword [esi + 0x1414], ebx
push edi
mov byte [esi + 0x1437], bl
mov byte [esi + 0x142b], bl
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
cmp dword [ebp], 0x190
je 0x42fcf6
mov ecx, 0x4e
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
mov eax, 0x64
mov dword [esi + 0x1410], ebx
mov dword [esi + 0x1414], eax
mov dword [esi + 0x1418], eax
mov dword [esi + 0x141c], ebx
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret

Function at 0x42fd10
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x100
push ebx
push ebp
push esi
mov esi, ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ebx, [esi + 0x1544]
mov ecx, 0x49
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
push 0x5965b8
push str._sconfigexperts.ini
lea eax, [esp + 0x18]
push 0xff
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
lea ecx, [esp + 0x20]
push 0x581660
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 0x18
test edi, edi
mov ebp, 1
je 0x42fd91
push edi
push ebp
push 0x124
push ebx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, ebp
je 0x42fd87
mov dword [ebx], 0
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
cmp dword [ebx], 0x190
je 0x42fdc2
mov ecx, 0x49
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov dword [esi + 0x1548], ebp
mov dword [esi + 0x154c], ebp
mov dword [esi + 0x1550], ebp
mov dword [esi + 0x155c], ebp
mov dword [esi + 0x1560], ebp
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret
Function at 0x42fe10
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x100
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov esi, dword [esp + 0x110]
mov ebx, ecx
test esi, esi
je 0x42fe45
push edi
push ebx
call ebp
lea edi, [ebx + 0x1544]
mov ecx, 0x49
rep movsd dword es:[edi], dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
push ebx
call ebp
push 0x5965b8
push str._sconfigexperts.ini
lea eax, [esp + 0x14]
push 0xff
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
lea ecx, [esp + 0x1c]
push 0x581698
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 0x18
test esi, esi
je 0x42fea0
push esi
lea eax, [ebx + 0x1544]
push 1
push 0x124
push eax
mov dword [eax], 0x190
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 4

Function at 0x42fef0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x100
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov esi, dword [esp + 0x110]
mov ebx, ecx
test esi, esi
je 0x42ff25
push edi
push ebx
call ebp
lea edi, [ebx + 0x1668]
mov ecx, 0x46
rep movsd dword es:[edi], dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
push ebx
call ebp
push 0x5965b8
push str._sconfigobjects.ini
lea eax, [esp + 0x14]
push 0xff
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
lea ecx, [esp + 0x1c]
push 0x581698
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 0x18
test esi, esi
je 0x42ff80
push esi
lea eax, [ebx + 0x1668]
push 1
push 0x118
push eax
mov dword [eax], 0x190
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 4
Function at 0x4331a0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x4c
push ebx
push ebp
mov ebp, ecx
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov edx, dword [ebp + 0x1c]
cmp edx, ebx
je 0x4332c6
push esi
push edi
mov edi, str.Modules_____:_r_n
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov dword [esp + 0x18], eax
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x18]
dec edi
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0x38]
test eax, eax
jne 0x43320d
push 0x10800
call fcn.004c2e90
add esp, 4
mov dword [ebp + 0x38], eax
lea ecx, [esp + 0x38]
mov dword [ebp + 0x3c], 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [esp + 0x3c]
mov eax, 0x40000000
xor edx, edx
div esi
mov edi, eax
shl edi, 2
je 0x433299
mov eax, esi
lea edx, [esp + 0x1c]
imul eax, ebx
push 0x1c
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x43328a
mov eax, dword [esp + 0x28]
test eax, eax
jbe 0x43328a
xor edx, edx
div esi
add ebx, eax
mov eax, dword [esp + 0x2c]
cmp eax, 0x1000
jne 0x433295
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
cmp eax, ecx
jbe 0x433295
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], eax
push ecx
push eax
mov ecx, ebp
call fcn.004332d0
test al, al
je 0x433295
inc dword [esp + 0x10]
jmp 0x433295
mov eax, 0x10000
xor edx, edx
div esi
add ebx, eax
cmp ebx, edi
jb 0x433233
mov edi, 0x58368c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, dword [ebp + 0x1c]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret