joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45b635
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x47b000
call fcn.0045c38c
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x4b1224
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x45b3fa
cmp eax, esi
jne 0x45b3ed
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x45b3fd
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x45b3d4
xor esi, esi
inc esi
mov eax, dword [0x4b1220]
cmp eax, esi
jne 0x45b410
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x45b43f
mov eax, dword [0x4b1220]
test eax, eax
jne 0x45b439
mov dword [0x4b1220], esi
push 0x468690
push 0x468680
call fcn.0045b340
pop ecx
pop ecx
test eax, eax
je 0x45b43f
jmp 0x45b563
mov dword [0x48c0dc], esi
mov eax, dword [0x4b1220]
cmp eax, esi
jne 0x45b463
push 0x46867c
push 0x46849c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x4b1220], 2
cmp dword [ebp - 0x20], ebx
jne 0x45b470
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x4b1234], ebx
je 0x45b491
push 0x4b1234
call fcn.0045c314
pop ecx
test eax, eax
je 0x45b491
push ebx
push 2
push ebx
call dword [0x4b1234]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x45b563
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x45b4fb
cmp cx, bx
je 0x45b4b6
cmp dword [ebp - 0x1c], ebx
jne 0x45b4fb
movzx ecx, word [eax]
cmp cx, bx
je 0x45b4cb
cmp cx, 0x20
ja 0x45b4cb
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x45b4b6
test byte [ebp - 0x40], 1
je 0x45b4d7
movzx ecx, word [ebp - 0x3c]
jmp 0x45b4da
push 0xa
pop ecx
push ecx
push eax
push ebx
push sym.SocksCapEx.exe_Ordinal_381
call main
mov dword [0x48c0d8], eax
cmp dword [0x48c0cc], ebx
jne 0x45b540
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x45b50c
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x45b4a0
cmp dword [0x48c0dc], ebx
jne 0x45b54e
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x48c0d8]
jmp 0x45b56f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0045c3d1
ret
call fcn.0045c4bb
jmp 0x45b397
Function at 0x45e561
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x487010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.0045e505
mov eax, sym.SocksCapEx.exe_Ordinal_381
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x98]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x45e5d4
cmp dword [ebp - 0x94], 5
jb 0x45e5f5
jmp 0x45e5f1
cmp dword [ebp - 0x88], 1
jne 0x45e5f5
cmp dword [ebp - 0x94], 4
ja 0x45e5f1
jne 0x45e5f5
cmp dword [ebp - 0x90], 0
jbe 0x45e5f5
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x46884c
call fcn.0042230e
test eax, eax
jge 0x45e616
mov byte [0x48e5ac], 1
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0045b700
leave
ret

Function at 0x4b76f2
Capabilities:
Read .ini file

Disassembly:
add esi, eax
push ecx
dec word [esp + 8]
xadd word [esp + 0xa], dx
mov ebp, dword [ebp]
xadd dword [esp + 0xc], ecx
dec edx
pop eax
pop edx
pop eax
pop ecx
jb fcn.0068f3ca

Function at 0x4ca86b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
ror dl, 1
bts cx, cx
adc dl, 0x9c
call fcn.0053a066

Function at 0x4d2793
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x1c]
call fcn.0079131a

Function at 0x4d7735
Capabilities:
Read .ini file

Disassembly:
mov dword [esp + edx - 0x43ec0001], 0xf99febb2
neg ecx
pop eax
sal byte [esp + edx - 0x43ec0001], 0xe1
ror ecx, 3
dec ecx
bts edx, edx
add byte [esp + edx - 0x43ec0000], al
sub edx, 0xfe1bdd93
xor ebx, ecx
add edi, ecx
sar dx, 0x81
lea ecx, [eax + edx*4 - 0x1a41455b]
pop ecx
jnp fcn.0050cb56

Function at 0x4ddaa5
Capabilities:
Delete file

Disassembly:
mov dword [esp + 4], 0x45b66467
lea esp, [esp + 4]
call fcn.004303c5
shl edx, 0xdf
ror ecx, 2
sub al, dl
neg al
xchg al, dl
inc ecx
cdq
call fcn.0078f317
mov edx, dword [edi]
mov eax, 0x17a3caa5
lea edi, [edi + eax - 0x17a3caa1]
xor edx, ebx
movsx ecx, al
and al, 0x81
not edx
lea edx, [edx + eax*2 + 0x154805a1]
shr cx, 0xcc
neg eax
lea eax, [eax*8 - 0x20c3bf6c]
xor edx, 0x9d30e834
bswap ecx
call fcn.0072d122

Function at 0x4fbb56
Capabilities:
Packed with generic packer

Disassembly:
mov edi, 0x669a1f1f
mov byte [esp + edi - 0x669a1f17], 0
mov edi, dword [esp + edi - 0x669a1f1b]
not dword [esp + 8]
not byte [esp + 8]
lea esp, [esp + 0x14]
call fcn.0089c136
dec ebp
mov esi, 0xd4d6b8f8
jb 0x4fbb84
lds ebp, [0xf0c6456d]
sub eax, 0xf0c6456d
mov esi, 0xc53aef83
arpl word [0x7c9a3964], di
popfd
pop ebx
lds ecx, [eax + 0x46153edc]
invalid
Function at 0x51106a
Capabilities:
Check if file exists
Delete file
Resolve function by parsing pe exports

Disassembly:
mov byte [esp + 0x4c8], 3
jmp 0x792f55
call sub.MFC42u.dll_CString::TrimRight
lea ecx, [esp + 0x14]
jmp 0x5376a6
movzx edx, byte [ebp + ecx - 0x21f00000]
mov dword [esp + ecx - 0x21f00000], eax
xor dl, bl
xor dl, 0x28
neg dword [esp + ecx*2 - 0x43dffffc]
lea ecx, [eax + eax + 0x19246b1d]
dec dl
shr ax, 0x45
xchg byte [esp + ecx*4 - 0x648ee676], al
bswap ecx
not dl
pop eax
cmovne eax, ecx
inc dl
and word [esp + 1], 0xb111
jbe 0x73fe6e
xor bl, dl
cwde
ror cl, 0x65
call fcn.0040fecf
call sub.MFC42u.dll_CString::TrimLeft
mov eax, dword [esp + 0x10]
xor ecx, 0x61a0d299
bt ecx, 0xa7
mov eax, dword [eax - 8]
adc cx, dx
bt cx, 0
sub eax, esi
cmovb cx, si
inc ch
dec eax
movzx ecx, bp
push eax
lea eax, [esp + 0x7c]
cmovb cx, si
bswap cx
movsx ecx, di
push eax
movsx ecx, dx
lea ecx, [esp + 0x18]
jmp 0x5482bd
call sub.MFC42u.dll_CString::TrimLeft
mov eax, dword [esp + 0x20]
cmp dword [eax - 8], 0
jmp 0x735e3e
mov byte [esp + 0x4c8], 4
jmp 0x607fa4
call sub.MFC42u.dll_CString::Right
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x4cc], 6
jmp 0x930647
call sub.MFC42u.dll_CString::CString_4
push ecx
movzx eax, dx
mov byte [esp + 0x4d0], 7
cwde
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x44], esp
push eax
jmp 0x6eb43a
call sub.MFC42u.dll_CString::CString
lea ecx, [esp + 0x14]
jmp 0x5026f4
je 0x6702e5
inc dword [esp + 0x18]
movsx ecx, ax
lea ecx, [esp + 0x14]
jmp 0x4b91ff
call fcn.0043a037
test al, al
jmp 0x6702d8
call sub.MFC42u.dll_CString::CString_4
lea eax, [edi + 0x68]
jmp 0x95dfb5
mov byte [esp + 0x4c8], 2
jmp 0x77e168
je 0x6702e5
mov eax, dword [esp + 0x14]
cmp dword [eax - 8], 0
jmp 0x793934
lea esi, [edx + esi - 0x2c231e88]
dec edx
mov word [esi + edx*2 - 0x58463d12], ax
movsx eax, cl
add eax, edi
jmp eax
call sub.MFC42u.dll_CString::CString
call sub.MFC42u.dll_CString::CString
lea ecx, [esp + 0x20]
jmp 0x723c00
je 0x6702e5
push ecx
mov ecx, esp
cbw
lea eax, [esp + 0x18]
mov ch, dl
movzx ecx, bx
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
jmp 0x5e08d0
mov byte [esp + 0x4d4], 4
jmp 0x6a0461
call sub.MFC42u.dll_CString::operator_1
lea ecx, [esp + 0x78]
jmp 0x53f44c
push eax
jmp 0x8f3e05

Function at 0x52cb2f
Capabilities:
Check if file exists
Delete file

Disassembly:
call fcn.00405f3e
call sub.MFC42u.dll_CString::Format
pop ecx
pop ecx
cwde
lea eax, [esp + 0x20]
not cl
cmovge ecx, eax
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
jmp 0x8ec12d
call sub.MFC42u.dll_CString::CString_4
jmp 0x52d537

Function at 0x54745e
Capabilities:
Read .ini file

Disassembly:
push ecx
mov ecx, 0xa29cf2b9
pushfd
sub ecx, ecx
setns cl
neg ecx
sub ecx, 0x2219bba2
mov dword [esp + 8], 0xadd24e3b
mov ecx, dword [esp + ecx + 0x2219bba7]
popfd
lea esp, [esp + 4]
call fcn.008d84ad

Function at 0x5793a8
Capabilities:
Read .ini file

Disassembly:
mov dword [esp], edi
mov edi, 0xb82ef2a5
push esi
mov esi, edi
pushfd
or si, si
inc si
mov esi, edx
dec edi
sar edi, 0xa4
mov edi, eax
jne 0x93b2fc
call fcn.00726c75
cld
jmp 0x7b1d13
Function at 0x58af5e
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
bsr ax, bx
neg bp
mov ebp, esp
not ax
rcl al, cl
adc ax, 0x4280
and esp, 0xfffffff8
clc
and al, 0x3c
push 0xffffffffffffffff
ror ah, 0x98
sal eax, cl
push 0x464a35
mov ah, 0x86
shl al, 0xa1
cmovae eax, esp
mov eax, dword fs:[0]
push eax
lea esp, [esp - 0x900]
cwde
rcl eax, cl
mov eax, dword [0x487010]
xor eax, esp
test cx, di
cmp cx, di
clc
mov dword [esp + 0x8f8], eax
bt ax, 0x10
shr al, cl
sal ax, 0x2f
push ebx
sar ax, 0xa8
rcl ah, 8
push esi
shl al, 0xd
push edi
mov eax, dword [0x487010]
not di
xchg di, di
rcr di, 0x26
xor eax, esp
push eax
nop
setae al
cbw
lea eax, [esp + 0x910]
bswap edi
mov dword fs:[0], eax
movzx edi, si
mov edi, ecx
xchg cx, cx
lea ecx, [esp + 0x1c]
jmp 0x6ca8d6
call sub.MFC42u.dll_CString::CString_5
sub ebx, ebx
jmp 0x768ef7
mov dword [esp + 0x918], ebx
jmp 0x9da0b0
call fcn.0042cd49
push eax
lea esi, [esp + 0x28]
jmp fcn.0041ceb2

Function at 0x58df01
Capabilities:
Check if file exists
Delete file
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 4], 0xa27451c5
lea esp, [esp + 4]
call fcn.0079131a
add esi, 4
ror edx, 0x44
call fcn.00770791
mov eax, ecx
xchg ecx, eax
jno fcn.0080feb4

Function at 0x5af05b
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [edi + ecx*2 - 0x18e]
call fcn.007542e7
adc eax, dword [esp + ecx - 0x133b3e5e]
xor ebx, edx
pop ecx
jmp 0x9b799b
jle fcn.0050cb56
add edi, edx
lea edx, [eax*2 + 0x498c7585]
shl cl, 0xa1
je 0x80988e
or eax, 0xa20bc623
or al, 0xb7
pop es
pushfd
xor eax, esp
int1
add edi, edx
mov esi, 0x6b00b47b
setl al
and dword [esp + esi - 0x6b31b3d4], edi
sbb dword [ebx], 0x809483eb
popfd
or esi, dword [edi]
sub ebx, dword [esi]
add byte [0x6f56eb32], ah
lodsb al, byte [esi]
xor al, 0x1c
fdivr qword [ebp - 0x29888a01]
push ss
shl dword [edi - 0x1288f084], 1
in al, 0x55
inc edi
dec ebx
in eax, 0x94
cmp byte [ebp - 0x1fa069af], ah
insd dword es:[edi], dx
inc ebx
test eax, 0xe9108530
sal byte [eax + edi*2], 1
pop ss
iretd
Function at 0x5b0bb4
Capabilities:
Read .ini file

Disassembly:
dec cl
not cl
sar edx, 0xcc
pop edx
div word [esp + edx*2 - 4]
ror cl, 1
sub edx, eax
cdq
push edx
xor bl, cl
lea ebp, [ebp + edx*2 - 2]
sub al, 0x38
mov word [ebp + edx*2], cx
pop ecx
pop edx
jle fcn.00732732
or ecx, ecx
and edx, eax
mov dword [edi + ecx - 0x46840080], edx
pop ecx
mov eax, ecx
lea esi, [esi + eax - 0x56b60cab]
movzx edx, al
imul dx, cx
sbb eax, 0x84871909
mov eax, dword [esi + ecx - 0x56b60ca7]
call fcn.0072334c
mov ecx, 0x5393a32
movzx eax, cl
mov eax, dword [eax + edi - 0x32]
xor cl, cl
lea edi, [edi + ecx*4 - 0x14e4e7fc]
call fcn.00627509
call fcn.00808779
xor eax, ebx
pop edx
dec eax
xor eax, 0xc4b1cf2d
lea edx, [ecx*2 - 0x514a4870]
push ecx
xchg word [esp + edx - 0x5febb7dc], cx
rol eax, 1
lea ecx, [edx + edx*8 - 0x5243f942]
shr ecx, cl
push ecx
not eax
bswap eax
inc eax
dec edx
neg word [esp + ecx + 2]
neg eax
imul cx, word [esp + ecx + 3]
add dl, dl
add cx, dx
xor ebx, eax
add esi, eax
movsx eax, cl
add byte [esp + ecx - 0xc0e0], ch
movzx ecx, byte [edi + ecx - 0xc0e5]
sbb dx, 0xb585
jne 0x7bd0d9
call sub.MFC42u.dll_CString::CString_5
lea ecx, [esp + 0x2c]
jmp 0x747403
mov dword [ebx + 0x169c], eax
jmp 0x83ff38
adc ebx, dword [eax + eax]
movzx edx, word [esp]
mov dword [esp + edx*4], esi
ret 4
jle 0x40e4fb
aas
mov esi, 0xbee5f8a5
inc ebp
cmp dword [edx + ebx*4 + 0x1e], ebx
jp 0x6dad47
mov esi, 0x6796a872
invalid
mov byte [esp + 0x510], 2
jmp 0x7cff6a
cmovge ax, word [esp + edx - 0x5feb022d]
lea edi, [edi + edx - 0x5feb0230]
shr dx, 0x4f
mov al, byte [0x4feac166]
xor cl, bl
lea eax, [edx + eax*8 + 0x18b1ba85]
neg dl
adc ax, dx
not cl
jne 0x6dad6f
ror dword [edi], 1
test dword [esp + ebx*8 - 0xf], ebp
invalid
call fcn.008197a3
push 0xe687d13d
mov eax, 0xd91b3bbe
add byte [eax + 0x3d], ch
rol dword [edi + 0x3bbeb8e6], 1
sbb ebx, ecx
mov ecx, dword [edi]
add edi, 4
call fcn.006b43c6
push eax
jecxz 0x7bd19c
mov esp, 0x786c28
loop 0x7bd0e8
cmp dword [ebp], edx
xchg byte [esi - 0x343faaf4], al
push 0x805d3970
dec eax
xchg edi, eax
pop ebp
or byte [eax - 0x69], 0x5d
sub al, 0x27
into
stosd dword es:[edi], eax
aas
jnp 0x7bd0fc
test byte [esi + 0x687460ff], ah
into
mov dword [0x40b2107f], eax
sbb byte [0x10a2562b], 0x39
imul edi, dword [esi + 0x10], 0xc917cd67
jne 0x7bd107
int 0xf0
add al, 0x8d
dec edi
xchg ebx, eax
sbb byte [esi + 0x459d4934], 0x9a
mov cs, word [ecx]
ja 0x7bd137
movsb byte es:[edi], byte [esi]
std
in eax, 0x2f
jns 0x7bd173
push cs
mov eax, dword [0xd90e8293]
and eax, 0x49574025
dec edi
cmp byte [edx*8 + 0x2a78c3ac], 0x8f
invalid
sbb cl, ch
pop ecx
mul byte [esi + 0x33]
adc byte [eax], dl
push esp
mov byte [edi], cl
fsubr dword [edi + 0x79]
fstp xword [edi - 0x6e5f2607]
sub esp, ecx
pop ecx
mov edi, 0x55581e2b
sar bh, cl
push 0x7e0e0e6c
or edx, dword [ebp - 0x624dd57b]
or eax, 0xc9003512
scasb al, byte es:[edi]
outsd dx, dword [esi]
wait
test eax, 0x90c9cd57
xor al, 0xe0
adc dl, dl
fdivrp st(4)
ret
call dword [sym.imp.SocksCapExDLL32.dll_public:_void___thiscall_MCode::CAD::constructor_void_]
mov byte [esp + 0x510], 3
cbw
bswap ax
lea eax, [esp + 0x2c]
jmp 0x61f71c
Function at 0x5b320a
Capabilities:
Read .ini file

Disassembly:
neg eax
not ecx
mov dword [esp + edx - 0x57a01c80], 0xcc87c529
imul eax, eax
ror al, 7
xor ecx, 0x989789a3
lea edx, [edx*2 - 0x2c6b49e2]
not ecx
inc edx
lea eax, [edx + edx*2 + 0x1bb2828e]
lea ecx, [edx + ecx - 0x432c3883]
rol ecx, 3
push eax
or eax, eax
rol byte [esp + 7], 0xa5
not ecx
seta al
push edx
xor ebx, ecx
shl edx, 0x57
add edi, ecx
add eax, 0x1421e421
ror eax, 0xd5
xor dx, word [esi]
movsx ecx, al
jmp 0x9d218f

Function at 0x5c36fe
Capabilities:
Create thread

Disassembly:
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x14]
call fcn.008d84ad

Function at 0x5c438b
Capabilities:
Get graphical window text

Disassembly:
mov dx, word [ebp + eax*4 - 0x78]
lea ecx, [eax*4 + 0x4015b802]
mov dword [esp + eax - 0x1e], 0x30885193
mov ax, word [ebp + eax*2 - 0x3a]
add cx, cx
imul cx, word [esp + ecx - 0x401570f3]
mov cl, byte [ebp + ecx - 0x40155d30]
adc ebp, 3
sar byte [esp + 2], 0x83
ja 0x951ca6
push ebp
mov ebp, 0x10929611
mov bp, 0x2583
pushfd
test ebp, ebp
jl 0x851cb5
jae 0x851c9d
push 0xbc29d414
adc ebp, 6
not dword [esp]
push 0x68067898
shrd eax, edx, cl
push 0xf0852d9c
mov edx, dword [esp + 8]
mov dword [edx + ebp - 0x43d62beb], eax
mov dword [esp + edx - 0x43d62beb], esi
ret 8
shld dx, ax, cl
mov ecx, dword [esp]
mov word [ebp + ecx*2 - 0x61e2a326], dx
xchg dword [esp + ecx*2 - 0x61e2a326], ecx
not cl
lea esi, [esi + ecx - 0x30f15170]
mov ecx, dword [ecx + esi - 0x30f1516c]
call fcn.005af2e0
Function at 0x5e06ac
Capabilities:
Read .ini file

Disassembly:
ja 0x419621
mov edx, dword [edi + edx*2 - 0x1da7a]
btc ax, 0x29
neg dword [esp + 8]
mov ecx, eax
mov eax, dword [edi + 4]
not word [esp + 8]
mov cl, byte [edi + 8]
call fcn.007baf4d
mov ecx, 0x94810792
lea eax, [ecx + ecx + 0x2faec491]
ror ax, 0x6c
mov edx, dword [edi + eax - 0x58b03b5d]
lea edi, [eax + edi - 0x58b03b59]
shl cl, 3
imul cx, ax
div al
xor edx, ebx
xor edx, 0x6c00552e
bswap edx
dec ecx
bswap eax
not edx
shl ax, 0x4b
imul ecx, eax
bswap edx
shl al, 0x23
sal ecx, 0x12
imul eax, eax
xor ebx, edx
int1
adc cl, byte [edi]
scasd eax, dword es:[edi]
sal byte [ebx], 0xda
add esi, edx
mov edx, ebp
bts ax, ax
lea ebp, [ebp + ecx*2 - 2]
mov word [ebp + ecx], dx
lea edx, [ecx + eax*4 - 0x54c7186a]
jae fcn.00732732
sahf
pop ebp
add ecx, dword [ebx]
sbb dword [ebx - 0x71633d37], esi
sahf
xor al, 3
lodsb al, byte [esi]
pushfd
loopne 0x5e0719
lds ebp, [ebx + 0x45]
das
cmpsb byte [esi], byte es:[edi]
in al, 0xbc
xchg dword [edi + 0x32940b32], ebx
adc dword cs:[edi], 0x33
jb 0x5e07d8
sub ecx, dword [eax]
stosd dword es:[edi], eax
pop ebx
imul ebx
fisttp qword [edx - 0x44]
int1
fsub qword [edi - 0x6c9502ed]
xor dword [edi + 0x51ecbb86], edi
or eax, 0x66dfb4cb
inc ebp
clc
push 0xffffffffffffff98
out dx, eax
dec edx
and eax, 0x34943db5
push ebx
adc dword [esi + 0x46d9bbd6], edx
adc al, 0xc5
invalid
loope 0x5e081d
lea edi, [edi + ecx - 0x215520a4]
rol dword [esp + ecx*2 - 0x42aa4150], 0x19
mov edx, ecx
xor eax, ebx
push edx
neg dword [esp + ecx - 0x215520a5]
rol eax, 1
inc cx
sar byte [esp + ecx*2 - 0x42aa414d], 0xa6
xor ecx, dword [esp + edx*2 - 0x42aa414d]
sbb eax, 0x831b9b08
rol cl, 1
xor eax, 0x6c3f2586
call fcn.0074ccce
sbb byte [ebx - 0x74e3f3b4], cl
insb byte es:[edi], dx
and al, 0x20
Function at 0x602bbf
Capabilities:
Read .ini file

Disassembly:
mov ecx, dword [esp + 0xb]
mov dword [ebp + ecx*2 - 0x6ec10e04], edx
mov dword [esp + ecx - 0x37608702], ecx
mov dword [ebp + ecx*2 - 0x6ec10e00], eax
btr cx, cx
mov edx, ecx
lea esi, [esi + ecx*2 - 0x6ec10e08]
movsx eax, byte [esp + ecx*2 - 0x6ec10e04]
sub dword [esp + ecx - 0x37608702], edx
not dx
mov edx, dword [esi + edx - 0x376078fd]
xor edx, ebx
ror cx, cl
bts eax, 0xa
xor edx, 0x899bd28c
xor dword [esp + ecx - 0x3760a1c0], 0xa0910b4
lea edx, [ecx + edx + 0x3a80ff8]
setns cl
rol edx, 3
mov dword [esp + eax - 0x3fe], 0xc70c7d38
shl eax, cl
bts cx, cx
lea edx, [edx + ecx*2 - 0x4fa2b6f4]
jb 0x93049e
jb 0x8127da
sbb cx, ax
neg edx
lea edx, [edx + ecx + 0x2c54053b]
bswap edx
shr cl, 0x84
call fcn.00589648
push edx
shr edx, 0x4c
rol ecx, 3
not ax
neg edx
adc ecx, 0x36110d39
call fcn.0053ae3e
sal bh, 1
fiadd dword [ecx + 0x110d39d1]
call fcn.0053ae3e
jb 0x602c68
sar dword [edx + ebx*8 + 0x7fbda6d2], 0xea
or byte [ebp + 0x51c50a7f], bh
dec ebx
shr byte [ebp + 0x461b17], 0xae
cmpsb byte [esi], byte es:[edi]
loop 0x602ce2
inc ebx
cmp bl, 0xc7
cmpsd dword [esi], dword es:[edi]
aas
out 0x6c, eax
dec ebp
mov byte [0x2517ffb8], al
push ecx
mov ebp, 0x58da7d3f
inc eax
invalid
arpl word [esi + 0x6b6ac7e0], sp
mov cl, 0xde
mov dh, 0xef
ret
mov dword [esp + ecx*2 - 0x790be80], ecx
ror dl, 1
shr word [esp + ecx*2 - 0x790be7d], 1
adc dl, 0x83
neg al
xor bl, dl
lea ecx, [ecx + eax - 0x3c53d265]
sub ebp, 2
shl ecx, cl
mov word [ebp], dx
pop edx
pop eax
pop eax
js fcn.0050cb56
Function at 0x60f212
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, 0x7e349eb3
pushfd
add ebp, ebp
mov ebp, 0xa1019537
not ebp
sub ebp, 0x119e1d3c
mov dword [esp + 8], 0xd319bbe2
mov ebp, dword [esp + ebp - 0x4d604d88]
jne 0x625457
not edx
xor edx, 0x91ba0435
btc cx, 0x99
shr cx, 0xa6
mov dword [esp + eax - 0x15600000], eax
rol edx, 1
lea edx, [edx + ecx*2 - 0x664211d2]
or word [esp + eax*2 - 0x2ac00000], ax
mov dword [esp + eax - 0x155ffffc], ecx
sar ax, 0x8e
xor ebx, edx
push eax
sar dword [esp + eax - 0x155ffff8], 0x81
adc esi, edx
inc word [esp + eax - 0x155ffffc]
xor dword [esp + eax - 0x15600000], eax
jns 0x644962
push dword [esp + 0xc]
popfd
lea esp, [esp + 0x18]
call fcn.0089c136
lea ecx, [edx*8 - 0x104848ca]
rol eax, 1
jmp 0x9c0ee7
ror edx, cl
xor ebx, eax
xadd dword [esp + ecx - 0x10c5ac7e], ecx
adc esi, eax
or edx, dword [esp]
call fcn.00672887
sub eax, 0xb78fdd39
push edx
xchg byte [esp + ecx - 0x10c5ac7b], dh
shl word [esp + ecx*2 - 0x218b58fc], 0xa2
not eax
js 0x9a4c7b
lea ebp, [ebp + edx*2 - 0x16]
mov edx, dword [ebp + edx*2 - 0x12]
xor edx, ebx
xor edx, 0x59261e29
sub edx, 0x2f9a84be
push ecx
rol edx, 1
shr byte [esp + 3], 0x81
lea eax, [ecx*4 - 0x5c6b77ec]
lea ecx, [eax*2 + 0x7d0bdda9]
sbb edx, 0x979a5580
sal eax, 0xea
bt ax, 0
xor ebx, edx
inc al
add edi, edx
mov edx, dword [esi + ecx*4 - 0x4172f864]
sub al, 0x83
mov cl, byte [esi + ecx*4 - 0x4172f860]
and word [esp + 2], 0x83ae
adc esi, 2
not eax
dec al
sal edx, cl
idiv al
mov ecx, dword [esp + eax - 0x5e3f00c1]
btc ecx, 4
mov dword [eax + esi - 0x5e3f00c1], edx
neg byte [esp + eax - 0x5e3f00c0]
lea edx, [ecx*2 + 0x6088d0bf]
idiv dl
mov dword [esp + ecx*8 - 0x427d0c8], edi
ret

Function at 0x60fac7
Capabilities:
Read .ini file

Disassembly:
xchg al, cl
rol dl, 1
and eax, 0x8b291eb8
mov dword [esp + ecx*4 - 0x124], eax
sbb dl, 0x28
xadd ecx, eax
jl 0x8bf176
xor bl, dl
lea ebp, [ebp + eax*2 - 0x94]
add dword [esp + eax*2 - 0x8f], eax
shr ecx, cl
pop ecx
mov word [ebp + eax*2 - 0x92], dx
mov dword [esp + eax*4 - 0x124], ecx
rol cl, 0xa1
add al, ah
pop ecx
ja fcn.0050cb56
push ecx
arpl word [ecx - 5], bx
imul byte [ecx]
test byte [ecx - 0x1a25ba66], cl
sbb al, 0xe5
inc ecx
mov edx, 0xd5654a55
inc ebp
mov al, 0x9a
cmp al, dl
iretd

Function at 0x621427
Capabilities:
Authenticate hmac
Read .ini file

Disassembly:
sub edx, 0xe13aa60a
btr eax, 0x10
bts ecx, 0x1d
shl al, 0x86
rol edx, 3
lea ecx, [ecx + ecx*4 - 0x47d1c760]
sal cl, cl
mov dword [esp + 0xc], ecx
xor ebx, edx
shr cx, 0x2b
jbe 0x8e11b7
outsb dx, byte [esi]
mov ch, 6
or ebp, dword [edi]
add eax, 0xc5edbcc5
xchg ecx, eax
sub dl, byte [eax + ebp*2 - 0x537cf03a]
cmp dword [eax - 0x2a], edi
shr dword [ebx], cl
mov edi, ebp
clc
salc
jmp 0x6214ec
in eax, 0x5c
push edi
lcall 0x65d6, 0x8f0efdb8
invalid
cdq
in eax, 0x45
fadd qword [esi - 0x66]
leave
cmp eax, 0x7c65c053
loopne 0x621538
mov cl, 0x65
mov eax, dword [edx + 0x731a32da]
invalid
mul edx
xchg ebp, eax
popal
jnp 0x6214de
mov bl, 0xb
pop edi
retf
add ebp, edx
shr eax, cl
mov dword [esp + eax - 0x60d], 0x9d2248a8
mov dword [esp + eax - 0x60d], ebp
ret 0xc
Function at 0x624a89
Capabilities:
Read .ini file

Disassembly:
jge 0x81b855
lea esp, [esp + 0x10]
call fcn.0090f702
jle 0x706b63
call fcn.00706b5e
add byte [ecx + 0x13], dh
mov esp, 0xff582565
xor byte [eax + 0x7f5d6f94], 0x8d
stc
mov ecx, 0x730a4ec0
pushfd
cmpsb byte [esi], byte es:[edi]
add dh, ch
push edi
outsd dx, dword [esi]
mov dword [0x459c1cc0], eax
push dword [ecx]
cmpsb byte [esi], byte es:[edi]
leave
push 0xfcd6d6ff
push 0x4810683f
inc ebp
popal
mov edi, 0xe8fbdcc4
and al, 0x99
into
clc
in al, dx
dec edi
retf 0x33cc

Function at 0x62855b
Capabilities:
Get file attributes

Disassembly:
call fcn.0045a520
pop ecx
mov eax, esi
xchg esi, esi
pop esi
ret 4
jbe 0x69984a
mov eax, edx
not ecx
call fcn.00417bc5
call fcn.0080a1c8
test byte [esp + 8], 1
jmp 0x70a60f
mov ecx, dword [esp + ecx + 0xc]
mov dword [esp + 0xc], 0x601eb6c5
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.0079131a
je 0x61cd37
push esi
jmp 0x61cd31

Function at 0x639410
Capabilities:
Query environment variable

Disassembly:
not edx
and ecx, 0xb50835ab
lea edx, [edx + ecx*2 - 0x6dd617e1]
not cx
lea eax, [ecx + ecx*8 + 0x7cb74bbf]
not edx
jno 0x67d40a
mov edx, dword [edi]
rol dword [esp + 4], 0x5d
adc edi, 3
mov dword [esp], 0x2834db3e
dec word [esp + 4]
sar word [esp + 4], 0xaf
xor edx, ebx
pop ecx
xadd dword [esp + ecx - 0x2834db3e], ecx
jnp 0x5f975a
call sub.MFC42u.dll_CListCtrl::GetItemText
mov ecx, edi
cmovb eax, ebp
lahf
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
jmp 0x51e281
xor edx, 0xe1b32e3f
bt cx, cx
setae al
sub dword [esp], 0xd79d208e
xor ebx, edx
rol eax, cl
adc esi, edx
lea edx, [ecx - 0x1b488179]
mul eax
not ax
mov dword [esp + eax*2 - 0x62fd7ffe], esi
ret

Function at 0x63ba55
Capabilities:
Read .ini file

Disassembly:
pushfd
add dword [esp + 8], 0xffb2b76e
mov dword [esp + 8], 0xd2e3789c
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.008145be
and edx, 0x1d0e3c94
btc ecx, ecx
bswap eax
xor eax, 0xc61124a1
bswap edx
dec dl
xchg dh, cl
dec eax
or cx, 0xab16
xor ebx, eax
jmp 0x6ba64a
and edx, edx
adc esi, eax
jmp fcn.00732732