joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10025280
Capabilities:
Create thread

Disassembly:
jae 0x1002527e
jmp 0x10025279
call fcn.10025280
jae 0x10025279
add esp, 4
jmp 0x10025285
dec dword [esp]
jno 0x1002528a
jns 0x10025275
jp 0x1002528e
add esp, 4
popf
jmp 0x10025295
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100252ae
jne 0x100252ae
call 0x1fc28602
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0
push 0
push 0
push 0x10025220
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
clc
jae 0x100252dc
pop ss
add byte [esi - 0x64], ah
pushf
push 0xa
jae 0x100252e9
jmp 0x100252e4
call 0x100252eb
jae 0x100252e4
add esp, 4
jmp 0x100252f0
dec dword [esp]
jno 0x100252f5
jns 0x100252e0
jp 0x100252f9
add esp, 4
popf
jmp 0x10025300
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10025319
jne 0x10025319
add byte [ebx + eax - 0x15], bh
add eax, dword [eax]
jl 0x1002531e
jmp 0x10025320
je 0x1002531b
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1002533a
jne 0x10025339
call 0x930643c1
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10025348
jne 0x10025348
call 0x10fed0cf
cmp dword [ebp - 4], 0
jne 0x10025417
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4f
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x21
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x30
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x35
mov byte [ebp - 6], 0x21
mov byte [ebp - 5], 0
call fcn.10010f70
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100252eb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jae 0x1002527e
jmp 0x10025279
call fcn.10025280
jae 0x10025279
add esp, 4
jmp 0x10025285
dec dword [esp]
jno 0x1002528a
jns 0x10025275
jp 0x1002528e
add esp, 4
popf
jmp 0x10025295
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100252ae
jne 0x100252ae
call 0x1fc28602
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0
push 0
push 0
push 0x10025220
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
clc
jae 0x100252dc
pop ss
add byte [esi - 0x64], ah
pushf
push 0xa
jae 0x100252e9
jmp 0x100252e4
call 0x100252eb
jae 0x100252e4
add esp, 4
jmp 0x100252f0
dec dword [esp]
jno 0x100252f5
jns 0x100252e0
jp 0x100252f9
add esp, 4
popf
jmp 0x10025300
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10025319
jne 0x10025319
add byte [ebx + eax - 0x15], bh
add eax, dword [eax]
jl 0x1002531e
jmp 0x10025320
je 0x1002531b
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1002533a
jne 0x10025339
call 0x930643c1
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10025348
jne 0x10025348
call 0x10fed0cf
cmp dword [ebp - 4], 0
jne 0x10025417
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4f
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x21
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x30
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x35
mov byte [ebp - 6], 0x21
mov byte [ebp - 5], 0
call fcn.10010f70
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003a556
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003a3d5

Function at 0x1004158e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1004124e
Function at 0x401058
Capabilities:
Encode data using xor

Disassembly:
pop ebx
mov ecx, 0x49e
xor byte [ecx + ebx], 0x2b
loop 0x40105e
jmp 0x40106c

Function at 0x404fd0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
lea ecx, [ebp + 0xc]
call fcn.0045e910
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx], 0
jne 0x405027
push str.ERROR_:_LoadLibrary
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x405089
push str.CreateDll
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x405043
jmp 0x405089
mov edx, dword [ebp - 0x18]
push edx
call dword [ebp - 0x10]
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x14]
call dword [edx + 4]
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
call dword [edx + 0xc]
test eax, eax
je 0x405079
push str.ERROR_:_pDLL__Device_Init
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp - 0x14]
push eax
call fcn.00409cd0
mov ecx, eax
call fcn.0040a9a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00417ed0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x406d10
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48db64
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 0
push 0x494da1
lea ecx, [ebp - 0x10]
call fcn.00409660
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0xd8]
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0x138c
jg 0x406da2
cmp dword [ebp - 0x20], 0x138c
je 0x406e36
cmp dword [ebp - 0x20], 0x138a
jg 0x406d94
cmp dword [ebp - 0x20], 0x138a
je 0x406de6
cmp dword [ebp - 0x20], 0xfa0
je 0x406dc2
cmp dword [ebp - 0x20], 0x1389
je 0x406dd4
jmp case.default.0x406dbb
cmp dword [ebp - 0x20], 0x138b
je 0x406df8
jmp case.default.0x406dbb
mov edx, dword [ebp - 0x20]
sub edx, 0x138d
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], 3
ja case.default.0x406dbb
mov eax, dword [ebp - 0x20]
jmp dword [eax*4 + 0x406ec5]
push 0x494da4
lea ecx, [ebp - 0x10]
call fcn.004096f0
jmp 0x406e8e
push 0x494dac
lea ecx, [ebp - 0x10]
call fcn.004096f0
jmp 0x406e8e
push 0x494db4
lea ecx, [ebp - 0x10]
call fcn.004096f0
jmp 0x406e8e
push 0x494dc0
push 0
push 0x494ddc
push 0x494de4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jne 0x406e27
push 0x494de8
lea ecx, [ebp - 0x10]
call fcn.004096f0
jmp 0x406e34
push 0x494df4
lea ecx, [ebp - 0x10]
call fcn.004096f0
jmp 0x406e8e
push str.Happy
lea ecx, [ebp - 0x10]
call fcn.004096f0
jmp 0x406e8e
push 0x494e0c
lea ecx, [ebp - 0x10]
call fcn.004096f0
jmp 0x406e8e
push 0x494e18
lea ecx, [ebp - 0x10]
call fcn.004096f0
jmp 0x406e8e
push 0x494e24
lea ecx, [ebp - 0x10]
call fcn.004096f0
jmp 0x406e8e
push 0x494e2c
lea ecx, [ebp - 0x10]
call fcn.004096f0
jmp 0x406e8e
push 0x494e37
lea ecx, [ebp - 0x10]
call fcn.004096f0
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00409640
mov edx, dword [ebp - 0x18]
or edx, 1
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00417ed0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x40eb00
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0x495bd0
lea ecx, [ebp - 4]
call fcn.00409660
push 0x495bd4
push 3
lea ecx, [ebp - 4]
call fcn.0045e910
push eax
push 0x495bf4
push str.KEYDOWNLOAD
push 0x495c04
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 4]
call fcn.0045e910
push eax
call fcn.004725e8
add esp, 4
mov dword [ebp - 8], eax
lea ecx, [ebp - 4]
call fcn.00417ed0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x411170
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e416
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp + 8]
push eax
push str.__Speaker_PlayWave_____s
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + 0xc0]
push edx
call fcn.0040b4f0
add esp, 0xc
cmp dword [ebp + 8], 0
jne 0x4111cb
push str.Speaker_PlayWave_wav_file_NULL_ERROR
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 0xc0]
push ecx
call fcn.0040b4f0
add esp, 8
jmp 0x411326
push 0x496424
push 0
push str.ADJUST_USE
push 0x49644c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x10], 1
jne 0x41129b
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ecx, [ebp - 0x30]
call fcn.00417eb0
mov dword [ebp - 4], 0
movzx eax, word [ebp - 0x20]
push eax
push 0x496454
lea ecx, [ebp - 0x30]
push ecx
call fcn.00404380
add esp, 0xc
push str.C:_sk_odtiniVolAdjust.ini
push 0x15
push str.START_TIME
push 0x496484
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x18], eax
push str.C:_sk_odtiniVolAdjust.INI
push 9
push str.END_TIME
push str.SOUND
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x30]
call fcn.0045e910
push eax
call fcn.004725e8
add esp, 4
cmp eax, dword [ebp - 0x18]
jge 0x411285
lea ecx, [ebp - 0x30]
call fcn.0045e910
push eax
call fcn.004725e8
add esp, 4
cmp eax, dword [ebp - 0x2c]
jg 0x41128c
mov dword [ebp - 0x14], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00417ed0
cmp dword [ebp - 0x14], 1
jne 0x4112da
mov edx, dword [ebp - 0x34]
mov eax, dword [edx + 0xd8]
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x34]
add ecx, 0xb0
push ecx
mov edx, dword [ebp - 0x34]
mov eax, dword [edx + 0xac]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ecx + 0xac]
mov edx, dword [eax]
call dword [edx + 0x90]
jmp 0x41130b
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 0xd8]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x34]
add eax, 0xb0
push eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + 0xac]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 0xac]
mov edx, dword [edx]
call dword [edx + 0x90]
mov eax, dword [ebp + 8]
push eax
push str.__Speaker_PlayWave
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + 0xc0]
push edx
call fcn.0040b4f0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x414da0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e65c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0xa8], 0
jne 0x414dff
mov ecx, dword [ebp + 8]
push ecx
push str.__s_DLL_IC_Off
mov ecx, dword [ebp - 0x18]
call fcn.0040d750
push eax
call fcn.0040b4f0
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00417ed0
jmp 0x414ecb
lea ecx, [ebp + 8]
call fcn.00417e70
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
push str.__IC_End____CALL
push str._s_____s
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0xc0]
push ecx
call fcn.0040b4f0
add esp, 0x10
push 0xffffffffffffffff
lea ecx, [ebp + 8]
call fcn.00418490
mov edx, dword [ebp - 0x18]
add edx, 0xb0
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0xac]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0xac]
mov edx, dword [ecx]
mov ecx, eax
call dword [edx + 0xa4]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x414e89
mov eax, dword [ebp - 0x18]
mov dword [eax + 0xa8], 1
push str.__IC_End____ERROR
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0xc0]
push edx
call fcn.0040b4f0
add esp, 8
jmp 0x414ead
mov eax, dword [ebp - 0x18]
mov dword [eax + 0xa8], 0
push str.__IC_End____SUCCESS
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0xc0]
push edx
call fcn.0040b4f0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0xa0], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00417ed0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x414fc0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e66e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x10], 0
movzx eax, byte [ebp + 8]
test eax, eax
je 0x415155
mov ecx, dword [ebp - 0x2c]
call fcn.0040d730
mov ecx, eax
call fcn.004076f0
cmp eax, 2
jne 0x415124
mov ecx, dword [ebp - 0x2c]
call fcn.0040d730
mov ecx, eax
call fcn.00406a80
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x2c]
call fcn.0040d730
mov ecx, eax
call fcn.00405cf0
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x24]
call fcn.00417eb0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x20]
push ecx
push 0x497b2c
lea edx, [ebp - 0x24]
push edx
call fcn.00404380
add esp, 0xc
push 0x497b34
push 0
lea ecx, [ebp - 0x24]
call fcn.0045e910
push eax
push 0x497b4c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x2c]
call fcn.0040d730
mov ecx, eax
call fcn.004069f0
test eax, eax
jle 0x4150ae
mov ecx, dword [ebp - 0x2c]
call fcn.0040d730
mov ecx, eax
call fcn.004069f0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
push 0x497b54
mov ecx, dword [ebp - 0x2c]
call fcn.0040d750
push eax
call fcn.0040b4f0
add esp, 0xc
mov ecx, dword [ebp - 0x2c]
call fcn.0040d730
mov ecx, eax
call fcn.00407760
cdq
mov ecx, 0x3e8
idiv ecx
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
imul edx, dword [ebp - 0x18]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
push 0x497b74
mov ecx, dword [ebp - 0x2c]
call fcn.0040d750
push eax
call fcn.0040b4f0
add esp, 0x10
mov edx, dword [ebp - 0x10]
push edx
push 0x497ba4
mov ecx, dword [ebp - 0x2c]
call fcn.0040d750
push eax
call fcn.0040b4f0
add esp, 0xc
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00417ed0
mov eax, dword [ebp - 0x28]
jmp 0x415184
mov ecx, dword [ebp - 0x2c]
call fcn.0040d730
mov ecx, eax
call fcn.00407760
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0x497bc8
mov ecx, dword [ebp - 0x2c]
call fcn.0040d750
push eax
call fcn.0040b4f0
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x415184
mov ecx, dword [ebp - 0x2c]
call fcn.0040d730
mov ecx, eax
call fcn.00407760
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
push 0x497bf0
mov ecx, dword [ebp - 0x2c]
call fcn.0040d750
push eax
call fcn.0040b4f0
add esp, 0xc
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x418c60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48eae2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 4], 0
cmp dword [ebp + 0x10], 0
je 0x418cf8
lea edx, [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.00418ed0
test eax, eax
je 0x418cf8
push str.VerifyData
push str.ERROR_:__s
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x818]
call fcn.0040d750
push eax
call fcn.0040b4f0
add esp, 0xc
lea ecx, [ebp + 0xc]
push ecx
call fcn.00431420
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00417ed0
mov eax, dword [ebp - 0x10]
jmp 0x418e4e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x18]
sub eax, dword [ecx + 0x10]
cmp eax, 0x64
jae 0x418d11
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
sub eax, 7
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x5c
ja case.0x418d34.1
mov ecx, dword [ebp - 0x1c]
movzx edx, byte [ecx + 0x418e72]
jmp dword [edx*4 + 0x418e5e]
lea eax, [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.0041d430
jmp case.0x418d34.1
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx + 0x818]
call fcn.0040d730
mov ecx, eax
call fcn.00406c10
push eax
push str.Select_Card_GetInt:__d__1:
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x818]
call fcn.0040d750
push eax
call fcn.0040b4f0
add esp, 0xc
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 0x818]
call fcn.0040d730
mov ecx, eax
call fcn.00406c10
cmp eax, 2
jne 0x418dc3
push 0x4e
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx + 0x818]
call fcn.0040d730
mov ecx, eax
call fcn.00406370
lea eax, [ebp + 0xc]
push eax
push 0x19
mov ecx, dword [ebp - 0x18]
call fcn.0041c8b0
jmp 0x418dd1
lea ecx, [ebp + 0xc]
push ecx
push 0x28
mov ecx, dword [ebp - 0x18]
call fcn.0041c8b0
jmp case.0x418d34.1
lea edx, [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.0041d840
jmp case.0x418d34.1
lea ecx, [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.0041c8b0
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
push eax
push str.ParsingElse_:__page_____d____dll_____d
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 0x818]
call fcn.0040d750
push eax
call fcn.0040b4f0
add esp, 0x10
lea edx, [ebp + 0xc]
push edx
call fcn.00431420
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00417ed0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41ed00
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48f0d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [ebp - 0x24], ecx
push 0x800
push 0
mov eax, dword [ebp - 0x24]
add eax, 0x14
push eax
call fcn.00472500
add esp, 0xc
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 0x818]
call fcn.0040d730
mov ecx, eax
call fcn.00406410
push eax
lea ecx, [ebp - 0x1c]
call fcn.00409660
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00404880
mov dword [ebp - 0x10], eax
push 0x800
push 0
mov edx, dword [ebp - 0x24]
add edx, 0x14
push edx
call fcn.00472500
add esp, 0xc
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x818]
call fcn.0040d730
mov ecx, eax
call fcn.00407660
mov dword [ebp - 0x18], eax
push 0x498d2c
push 0
push 0x498d4c
push 0x498d50
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x18], 0
jl 0x41ee7a
cmp dword [ebp - 0x14], 1
jne 0x41ee7a
push 3
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0x498d60
push 0x1c
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 0x818]
call fcn.0040d730
mov ecx, eax
call fcn.00406040
push eax
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx + 0x818]
call fcn.0040d730
mov ecx, eax
call fcn.00406060
push eax
push 0x498d64
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x818]
call fcn.0040d730
mov ecx, eax
call fcn.00407760
push eax
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 0x818]
call fcn.0040d730
mov ecx, eax
call fcn.00407710
movsx edx, al
push edx
push 0x498d68
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x818]
call fcn.0040d730
mov ecx, eax
call fcn.00405cf0
push eax
push 0x498d6c
push 2
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x814]
push edx
push str._s_c_s_02d_s_c_07d_s_02d__38s_c_s_02d__38s_02d_c
mov eax, dword [ebp - 0x24]
add eax, 0x14
push eax
call fcn.0047329d
add esp, 0x48
jmp 0x41ef2b
push 3
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 0x498da4
push 0x1c
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x818]
call fcn.0040d730
mov ecx, eax
call fcn.00406040
push eax
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx + 0x818]
call fcn.0040d730
mov ecx, eax
call fcn.00406060
push eax
push 0x498da8
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx + 0x818]
call fcn.0040d730
mov ecx, eax
call fcn.00407760
push eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x818]
call fcn.0040d730
mov ecx, eax
call fcn.00407710
movsx ecx, al
push ecx
push 0x498dac
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx + 0x818]
call fcn.0040d730
mov ecx, eax
call fcn.00405cf0
push eax
push 0x498db0
push 2
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x814]
push ecx
push str._s_c_s_02d_s_c_07d_s_02d__38s_c_s_02d__38s_c
mov edx, dword [ebp - 0x24]
add edx, 0x14
push edx
call fcn.0047329d
add esp, 0x44
mov eax, dword [ebp - 0x24]
add eax, 0x14
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00417ed0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret