joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a8535e0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
dec dword [ebx + 0x3b660c45]
inc edi
push es
jne 0x4a8535f9
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4a853617
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4a853675
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x4a85365c
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x4a853665
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x4a85366f
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x4a853651
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4a8535db
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4a8536c2
dec eax
je 0x4a8536b9
sub eax, 3
je 0x4a8536b0
mov dword [ebp - 4], 0x40
jmp 0x4a8536df
mov dword [ebp - 4], 4
jmp 0x4a8536c5
mov dword [ebp - 4], 0x20
jmp 0x4a8536c5
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x4a853711
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x4a853691
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.4a852f22
sbb ecx, ecx
push 0x1475ff7a
push 1
push esi
call edi
mov eax, esi
jmp 0x4a85371d

Function at 0x4a8543c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
invalid
invalid
Function at 0x4a859707
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a89c5b8]
jne 0x4a859711
repz ret
jmp fcn.4a85d865

Function at 0x4a86874c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.4a85eb75
xor ebx, ebx
cmp dword [0x4a89f310], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x4a868821
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x4a86878c
xor eax, eax
jmp 0x4a8688e5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x4a868785
push eax
call fcn.4a85eb12
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4a89f310], eax
call esi
push eax
call fcn.4a85eb12
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4a89f314], eax
call esi
push eax
call fcn.4a85eb12
mov dword [0x4a89f318], eax
lea eax, [ebp - 8]
push eax
call fcn.4a862226
test eax, eax
pop ecx
pop ecx
je 0x4a8687ef
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.4a8603ee
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x4a868821
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.4a85eb12
cmp eax, ebx
pop ecx
mov dword [0x4a89f320], eax
je 0x4a868821
push 0x4a8845d8
push edi
call esi
push eax
call fcn.4a85eb12
pop ecx
mov dword [0x4a89f31c], eax
mov eax, dword [0x4a89f31c]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x4a86889a
cmp dword [0x4a89f320], esi
je 0x4a86889a
push eax
call fcn.4a85eb7e
pop ecx
call eax
cmp eax, ebx
je 0x4a868867
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4a89f320]
call fcn.4a85eb7e
pop ecx
call eax
test eax, eax
je 0x4a868867
test byte [ebp - 0x18], 1
jne 0x4a86889a
lea eax, [ebp - 0xc]
push eax
call fcn.4a86225d
test eax, eax
pop ecx
je 0x4a868882
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.4a8603ee
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x4a868891
or dword [ebp + 0x10], 0x200000
jmp 0x4a8688cb
or dword [ebp + 0x10], 0x40000
jmp 0x4a8688cb
mov eax, dword [0x4a89f314]
cmp eax, esi
je 0x4a8688cb
push eax
call fcn.4a85eb7e
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4a8688cb
mov eax, dword [0x4a89f318]
cmp eax, esi
je 0x4a8688cb
push dword [ebp - 4]
push eax
call fcn.4a85eb7e
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x4a89f310]
call fcn.4a85eb7e
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4099ec
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409abf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409ad8
push ebx
push 0x409ae4
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a6c
mov al, 0x6a
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.004099c0
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a75
call fcn.004099c0
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409ac6
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b78
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409c2c
jmp 0x409c21
cmp dword [esi + 0x10], 0x1000
jne 0x409c0d
test byte [esi + 0x15], 1
jne 0x409c0d
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409bcc
cmp eax, 2
je 0x409bcc
cmp eax, 0x10
je 0x409bcc
cmp eax, 0x20
jne 0x409be1
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409be1
mov bl, 1
xor ebp, ebp
jmp 0x409bf2
mov eax, dword [esi]
add eax, ebp
call fcn.00409b70
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409be5
test bl, bl
je 0x409c0d
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409c2c
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409ba4
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x41be10
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41be16
ret
Function at 0x4010b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4010cb
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401104
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x401100
jmp 0x4010f0
cmp esi, eax
jae 0x401104
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4010f0
cmp esi, eax
jb 0x40110b
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4023a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43fdd9
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x453d50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
call fcn.0041657f
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x4023ea
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [ebp + 8]
add eax, 0x10
mov dword [ecx], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, eax
cmp edi, ebx
je 0x40248a
push 0x20a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
je 0x40248a
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_HeapSize]
push eax
push ebx
push esi
call fcn.00428e00
add esp, 0xc
push 1
push 0x23
push esi
push ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, 1
jne 0x40246e
lea edi, [ebp - 0x10]
mov ecx, 0x105
mov edx, esi
call fcn.004020b0
cmp eax, ebx
jge 0x402463
xor ecx, ecx
jmp 0x402466
mov ecx, dword [ebp - 0x10]
cmp eax, ebx
jne 0x402477
cmp ecx, ebx
je 0x402477
mov ecx, dword [ebp + 8]
push esi
call fcn.00401a60
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp eax, ebx
je 0x40248a
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebp + 8]
mov edx, dword [esi]
cmp dword [edx - 0xc], ebx
je 0x4024a2
push 0x1f
push str.EPSONPrinterConnectionChecker
mov ecx, esi
call fcn.00402980
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402fe0
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push edi
xor esi, esi
call ebx
mov edi, eax
test edi, edi
je 0x40301c
push 0x82
push esi
push edi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40306f
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_HeapSize]
push eax
push 0
push esi
call fcn.00428e00
add esp, 0xc
test esi, esi
je 0x40306f
push 0x40
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, eax
test edi, edi
jne 0x403044
call ebx
test eax, eax
je 0x40303e
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
xor eax, eax
pop ebx
ret
cmp edi, 0x40
jb 0x40306f
lea ebx, [edi + edi + 2]
call fcn.004020f0
mov esi, eax
test esi, esi
je 0x40306f
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x40306f
call fcn.00402140
pop edi
pop esi
xor eax, eax
pop ebx
ret
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x403180
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440856
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x453d50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
push 0x208
lea eax, [ebp - 0x218]
push edi
push eax
mov dword [ebp - 0x21c], edi
call fcn.00428e00
add esp, 0xc
push 0x446d7f
lea ecx, [ebp - 0x21c]
call fcn.004019a0
push esi
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push 0x4470e4
push str.EBAPIB6Namex86
mov dword [ebp - 4], edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push str.PrinterDriverData
call edi
push 0x4470e4
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x403249
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00428e00
add esp, 0xc
push esi
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push 0x4470e4
push str.EBAPIB6Name
push str.PrinterDriverData
call edi
push 0x4470e4
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x403298
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
push eax
call fcn.00401f10
add eax, 0x10
mov dword [ebx], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x40332a
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x220]
call fcn.004018e0
push eax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 1
call fcn.00401d40
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4032e0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x21c]
push ecx
push str.EBAPI_Name___s__r_n
push 0x4582a0
call fcn.004024c0
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
push eax
call fcn.00401f10
add eax, 0x10
mov dword [ebx], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
add esp, 0x10
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403336
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00425035
mov esp, ebp
pop ebp
ret
Function at 0x404cf0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x800
push 0x40
mov dword [ebp - 4], 0
mov ebx, 0x400
call edi
mov esi, eax
test esi, esi
je 0x404d66
lea ebx, [ebx]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
push 0
push esi
call fcn.00428e00
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
add esp, 0xc
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
lea ecx, [ebx - 2]
mov dword [ebp - 8], eax
cmp ecx, eax
jne 0x404d71
push esi
add ebx, 0x400
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea edx, [ebx + ebx]
push edx
push 0x40
call edi
mov esi, eax
test esi, esi
jne 0x404d20
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
test eax, eax
jne 0x404d87
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx + ebx]
push eax
push 0x40
call edi
mov edi, eax
test edi, edi
je 0x404d75
push edi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
push 0
push edi
call fcn.00428e00
add esp, 0xc
cmp dword [ebp - 8], 0
jle 0x404e26
mov eax, esi
cmp word [eax], 0
jne 0x404dc0
inc dword [ebp - 4]
cmp word [eax + 2], 0
je 0x404dc5
add eax, 2
jmp 0x404db0
cmp dword [ebp - 4], 0
jle 0x404e26
mov dword [ebp + 0xc], esi
mov dword [ebp - 8], esi
mov ecx, dword [ebp + 0xc]
cmp word [ecx], 0
jne 0x404e20
push edi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
push 0
push edi
call fcn.00428e00
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
sub edx, eax
sar edx, 1
inc edx
push edx
push eax
push ebx
push edi
call fcn.0042611d
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov edx, dword [ecx + 8]
add esp, 0x1c
push edi
add eax, 2
push edx
mov dword [ebp - 8], eax
call fcn.0041e270
mov eax, dword [ebp - 8]
cmp word [eax], 0
je 0x404e26
add dword [ebp + 0xc], 2
jmp 0x404dd1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
call esi
push edi
call esi
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp eax, dword [ecx + 8]
je 0x404e40
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x404f90
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4407d9
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x453d50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 3
mov ecx, dword [ebp + 8]
push 0x446d80
call fcn.004018e0
mov dword [ebp - 0x14], 1
mov edi, 0x400
call fcn.0041657f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x4050a6
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 4
mov eax, dword [esi - 8]
mov ebx, dword [ebp + 0xc]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x405026
push edi
lea ecx, [ebp - 0x10]
call fcn.00401ec0
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push ebx
push edi
push esi
push 0x446d80
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ebx, eax
mov eax, dword [esi - 8]
push eax
push esi
call fcn.004254e0
add esp, 8
test eax, eax
jl 0x40515d
cmp eax, dword [esi - 8]
jg 0x40515d
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
lea eax, [edi - 1]
lea edx, [eax - 1]
cmp ebx, edx
je 0x405073
cmp ebx, eax
jne 0x4050b0
add esi, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x405093
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add edi, 0x400
call fcn.0041657f
test eax, eax
jne 0x404ff3
push 0x80004005
call fcn.00401090
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push ecx
mov ecx, edi
call fcn.00401d40
add esi, 0xfffffff0
mov byte [ebp - 4], 3
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x4050de
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405101
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405124
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405147
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x80070057
call fcn.00401090
int3
Function at 0x4052b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440779
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x453d50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp + 8]
push 0x446d80
call fcn.004018e0
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], 1
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, eax
cmp ebx, esi
je 0x40532e
push 0x208
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
cmp edi, esi
je 0x4053cc
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSize]
push eax
push esi
push edi
call fcn.00428e00
add esp, 0xc
cmp edi, esi
je 0x4053cc
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ebx, eax
cmp ebx, esi
je 0x405350
cmp ebx, 0x104
jbe 0x405399
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp eax, esi
je 0x405363
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, esi
je 0x4053cc
lea esi, [ebx + 1]
lea ebx, [esi + esi]
call fcn.004020f0
mov edi, eax
test edi, edi
je 0x4053cc
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x405388
cmp eax, esi
jbe 0x405397
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x4053cc
push edi
push 0
jmp 0x4053c5
xor esi, esi
mov eax, edi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x4053a0
mov ecx, dword [ebp + 8]
sub eax, edx
sar eax, 1
push eax
push edi
call fcn.00401e10
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp eax, esi
je 0x4053cc
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebp + 8]
call fcn.004053f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x405a60
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f7e8
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x453d50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [ebp + 8], edi
je 0x405aee
mov ecx, dword [ebp + 0xc]
cmp dword [ecx - 0xc], edi
je 0x405aee
mov eax, 1
sub eax, dword [ecx - 4]
mov ecx, dword [ecx - 8]
or ecx, eax
jge 0x405aae
push edi
lea ecx, [ebp + 0xc]
call fcn.00401ec0
mov eax, dword [ebp + 0xc]
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
cmp esi, edi
je 0x405aee
cmp ebx, edi
je 0x405ac7
push ebx
jmp 0x405ac9
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, edi
je 0x405ae4
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405aee
mov ecx, dword [ebp + 8]
mov edi, 1
mov dword [ecx], esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x405b14
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x406370
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push edi
push 0x448668
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 8
call fcn.004164a2
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x4063cd
mov dword [edi], vtable.CErisDLL.0
mov dword [edi + 4], ebx
cmp dword [0x458258], ebx
jne 0x4063c3
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x458258], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.00406270
mov dword [edi + 4], eax
jmp 0x4063cf
xor edi, edi
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0xc], edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0x4486a8
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop edi
mov eax, esi
pop ebx
pop ebp
ret 4