joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9bfc05
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x9bfc2c
call fcn.00962138
mov dword [eax], esi
call fcn.00962125
push 0x16
pop esi
mov dword [eax], esi
call fcn.00962d7a
mov eax, esi
jmp 0x9bfc81
test dword [ebp + 0xc], 0xfffffff9
jne 0x9bfc12
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9bfc59
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0096214b
pop ecx
call fcn.00962125
mov eax, dword [eax]
jmp 0x9bfc81
test al, 0x10
jne 0x9bfc7f
test al, 1
je 0x9bfc7f
test byte [ebp + 0xc], 2
je 0x9bfc7f
call fcn.00962138
mov dword [eax], 5
call fcn.00962125
mov dword [eax], 0xd
jmp 0x9bfc50
xor eax, eax
pop esi
pop ebp
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40df30
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x7c]
push ebx
push esi
push edi
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x14], 0x10
mov dword [ebp - 0x10], pe_nt_image_headers32
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 8], reloc.ole32.dll_CoInitialize
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], eax
mov edx, dword [eax + 0x30]
mov eax, dword [ecx + 0x3c]
lea eax, [edx + eax]
movzx edx, word [eax + 6]
add eax, 0xf8
mov dword [ebp - 0x74], eax
lea eax, [edx - 1]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x6c]
jb 0x40e0b5
sub dword [ebp - 0x6c], 1
lea esi, [esi]
add dword [ebp - 0x6c], 1
imul eax, dword [ebp - 0x6c], 0x28
mov edx, dword [ebp - 0x74]
lea esi, [eax + edx]
lea edi, [ebp - 0x4c]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x7c]
or edx, eax
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
test dword [ebp - 0x50], 0xffffffff
je 0x40e0a9
mov ebx, dword [ebp - 0x28]
mov eax, ebx
and eax, 0x2000000
je 0x40e00c
push 0x4000
push dword [ebp - 0x50]
push dword [ebp - 0x58]
mov esi, dword [ebp - 0x78]
call dword [esi + 8]
jmp 0x40e0a9
mov eax, ebx
and eax, 0x20000000
je 0x40e01e
mov dword [ebp - 0x68], 1
jmp 0x40e025
mov dword [ebp - 0x68], 0
mov eax, ebx
and eax, 0x40000000
je 0x40e037
mov dword [ebp - 0x64], 1
jmp 0x40e03e
mov dword [ebp - 0x64], 0
mov eax, ebx
and eax, 0x80000000
je 0x40e050
mov dword [ebp - 0x60], 1
jmp 0x40e057
mov dword [ebp - 0x60], 0
mov eax, ebx
and eax, 0x4000000
je 0x40e069
mov dword [ebp - 0x5c], 1
jmp 0x40e070
mov dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x68]
shl eax, 4
lea eax, [ebp + eax - 0x24]
mov edx, dword [ebp - 0x64]
lea ecx, [eax + edx*8]
mov eax, dword [ebp - 0x60]
mov eax, dword [ecx + eax*4]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x5c], 1
jne 0x40e096
or dword [ebp - 0x54], 0x200
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x54]
push dword [ebp - 0x50]
push dword [ebp - 0x58]
mov esi, dword [ebp - 0x78]
call dword [esi + reloc.ole32.dll_CoDisconnectObject]
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x6c]
ja 0x40dfb4
pop edi
pop esi
pop ebx
leave
ret

Function at 0x414b30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 4]
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
mov edx, dword [edx + 0x14]
mov eax, dword [eax]
lea eax, [edx + eax]
mov edx, eax
mov edi, ebx
nop
lea eax, [edx + edi]
mov ebx, dword [eax]
mov esi, ecx
xor esi, ebx
mov dword [eax], esi
lea eax, [edi + 4]
mov edi, eax
cmp edi, dword [ebp - 4]
jb 0x414b50
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x401720
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40173b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401774
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x401770
jmp 0x401760
cmp esi, eax
jae 0x401774
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401760
cmp esi, eax
jb 0x40177b
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x403950
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x587ba9
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5ef60c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
call fcn.0045e972
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x40399a
push 0x80004005
call fcn.00401fd0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [ebp + 8]
add eax, 0x10
mov dword [ecx], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, eax
cmp edi, ebx
je 0x403a3a
push 0x20a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
je 0x403a3a
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_HeapSize]
push eax
push ebx
push esi
call fcn.0055b030
add esp, 0xc
push 1
push 0x23
push esi
push ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, 1
jne 0x403a1e
lea edi, [ebp - 0x10]
mov ecx, 0x105
mov edx, esi
call fcn.00403660
cmp eax, ebx
jge 0x403a13
xor ecx, ecx
jmp 0x403a16
mov ecx, dword [ebp - 0x10]
cmp eax, ebx
jne 0x403a27
cmp ecx, ebx
je 0x403a27
mov ecx, dword [ebp + 8]
push esi
call fcn.004019e0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp eax, ebx
je 0x403a3a
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebp + 8]
mov edx, dword [esi]
cmp dword [edx - 0xc], ebx
je 0x403a52
push 0x16
push str.EPSONSoftwareUpdater
mov ecx, esi
call fcn.00403ed0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4056d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x588490
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5ef60c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0045e972
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x405711
push 0x80004005
call fcn.00401fd0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x40574b
push 0x104
lea ecx, [ebp - 0x10]
call fcn.00401de0
mov esi, dword [ebp - 0x10]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
mov eax, dword [esi - 8]
push eax
push esi
call fcn.005581e8
add esp, 8
test eax, eax
jl 0x405848
cmp eax, dword [esi - 8]
jg 0x405848
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
test edi, edi
jne 0x4057ba
lea eax, [esi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4057a7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x5b95a8
lea ecx, [ebp - 0x14]
call fcn.00401a30
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0040ec20
mov esi, eax
add esp, 4
test esi, esi
je 0x4057ec
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x14]
push edx
call fcn.00401f40
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40580f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405835
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00401fd0
int3
Function at 0x407b50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
lea eax, [ebp - 0x14]
push eax
push 0x20019
xor esi, esi
push esi
push str.SOFTWAREEPSONCXGA
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x18], vtable.Registry.0
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], 0x20019
je 0x407bda
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
push esi
push esi
push str.Accepted
push eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 4]
test eax, eax
je 0x407bd3
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], vtable.Registry.0
test eax, eax
je 0x407be8
push eax
call ebx
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ace0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x587fe8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x5ef60c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.CMonitoringExe::ADD_STARTUP__r_n
push 0x5f80f8
call fcn.00403a70
add esp, 8
push str.IsWow64Process
push str.kernel32
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
xor esi, esi
mov dword [ebp - 0x18], esi
test edi, edi
je 0x40ad59
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
mov esi, dword [ebp - 0x18]
push 0x5b95a8
lea ecx, [ebp - 0x10]
call fcn.00401a30
dec esi
neg esi
sbb esi, esi
and esi, 0xffffff00
lea ecx, [ebp - 0x14]
push ecx
add esi, 0x100
or esi, 0x20006
push esi
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push SysReAllocStringLen
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40adb5
push str.Error_RegOpenKeyEx__r_n
push 0x5f80f8
call fcn.00403a70
add esp, 8
xor esi, esi
jmp 0x40ae13
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
lea ecx, [ebp - 0x10]
push 0x5bb140
push ecx
call fcn.00402810
mov edx, dword [ebp - 0x10]
mov eax, edx
add esp, 0xc
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40add4
sub eax, esi
sar eax, 1
cmp dword [edx - 4], 1
lea esi, [eax + eax]
jle 0x40adfb
mov edx, dword [edx - 0xc]
push edx
lea ecx, [ebp - 0x10]
call fcn.00401d10
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
push esi
push edx
push 1
push 0
push str.EPSDNMON
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x40ae21
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ae47
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40ae60
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
push str.CMonitoringExe::REMOVE_STARTUP__r_n
push 0x5f80f8
call fcn.00403a70
add esp, 8
push str.IsWow64Process
push str.kernel32
mov edi, 1
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
xor eax, eax
mov dword [ebp - 8], eax
test esi, esi
je 0x40aeb8
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov eax, dword [ebp - 8]
dec eax
neg eax
sbb eax, eax
and eax, 0xffffff00
lea ecx, [ebp - 4]
push ecx
add eax, 0x100
or eax, 0x20006
push eax
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40aefd
push str.Error_RegOpenKeyEx__r_n
push 0x5f80f8
call fcn.00403a70
add esp, 8
xor edi, edi
jmp 0x40af0c
mov edx, dword [ebp - 4]
push str.EPSDNMON
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 4]
test eax, eax
je 0x40af1a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40c060
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x585d10
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5ef60c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
movzx eax, word [ebp + 0xc]
push 0x5bbb44
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x40c0bf
push 0x5de4dc
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], 0x5bb468
call fcn.0055ad30
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
jne 0x40c0e3
push 0x5de4dc
lea ecx, [ebp - 0x18]
push ecx
mov dword [ebp - 0x18], 0x5bb484
call fcn.0055ad30
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x40c10e
push 0x5de4dc
lea edx, [ebp - 0x1c]
push edx
mov dword [ebp - 0x1c], 0x5bb49c
call fcn.0055ad30
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x40c139
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x5de4dc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x5bb4bc
call fcn.0055ad30
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x40c181
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x5de4dc
lea ecx, [ebp - 0x24]
push ecx
mov dword [ebp - 0x24], 0x5bb4e0
call fcn.0055ad30
mov eax, 0x40c16d
ret
push edi
push ebx
push eax
call fcn.0055d8d0
add esp, 0xc
lea edx, [ebp + 0xc]
push edx
push 0
push esi
mov dword [ebp + 0xc], 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x40c1b0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
call fcn.0040c990
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40ef30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584940
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5ef60c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, dword [eax]
xor esi, esi
cmp dword [eax - 0xc], ecx
mov dword [ebp - 0x18], esi
jg 0x40ef9d
mov dword [ebp - 0x14], ecx
push 0x5de3a0
lea ecx, [ebp - 0x14]
push ecx
call fcn.0055ad30
mov eax, 0x40ef86
ret
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40efb2
test al, 0x10
jne 0x40efb2
mov esi, 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40efd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584920
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5ef60c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, dword [eax]
xor esi, esi
cmp dword [eax - 0xc], ecx
mov dword [ebp - 0x18], esi
jg 0x40f03d
mov dword [ebp - 0x14], ecx
push 0x5de3a0
lea ecx, [ebp - 0x14]
push ecx
call fcn.0055ad30
mov eax, 0x40f026
ret
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40f052
test al, 0x10
je 0x40f052
mov esi, 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f920
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 6
push 0x40
mov dword [ebp - 8], 0
mov edi, 3
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x40f98e
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
push 0
push esi
call fcn.0055b030
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
add esp, 0xc
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
mov ebx, eax
lea ecx, [edi - 2]
cmp ecx, ebx
jne 0x40f997
push esi
add edi, 0x400
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea edx, [edi + edi]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x40f945
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
jne 0x40f9ab
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [edi + edi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x40f99b
push edi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
push 0
push edi
call fcn.0055b030
add esp, 0xc
test ebx, ebx
jle 0x40fa4e
mov eax, esi
cmp word [eax], 0
jne 0x40f9e6
inc dword [ebp - 8]
cmp word [eax + 2], 0
je 0x40f9eb
add eax, 2
jmp 0x40f9d6
cmp dword [ebp - 8], 0
jle 0x40fa4e
mov dword [ebp - 4], esi
mov ebx, esi
mov ecx, dword [ebp - 4]
cmp word [ecx], 0
jne 0x40fa48
push edi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
push 0
push edi
call fcn.0055b030
mov edx, dword [ebp - 4]
sub edx, ebx
add esp, 0xc
sar edx, 1
inc edx
push edx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
shr eax, 1
push eax
push edi
call fcn.00559a9f
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
mov ebx, dword [ebp - 4]
add esp, 0x10
push edi
push eax
add ebx, 2
call fcn.0046bf83
cmp word [ebx], 0
je 0x40fa4e
add dword [ebp - 4], 2
jmp 0x40f9f6
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
call esi
push edi
call esi
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ecx + 8]
je 0x40fa68
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40fa70
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5848f0
mov eax, dword fs:[0]
push eax
sub esp, 0x538
mov eax, dword [0x5ef60c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
push 0x11c
lea eax, [ebp - 0x130]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0055b030
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea ecx, [ebp - 0x130]
push ecx
mov dword [ebp - 0x130], 0x11c
call esi
cmp eax, ebx
jne 0x40fb06
lea edx, [ebp - 0x130]
push edx
mov dword [ebp - 0x130], 0x114
call esi
cmp eax, ebx
jne 0x40fb06
push 0x5de3a0
lea eax, [ebp - 0x4a0]
push eax
mov dword [ebp - 0x4a0], ebx
call fcn.0055ad30
mov eax, 2
cmp dword [ebp - 0x120], eax
jne 0x40fb3b
cmp dword [ebp - 0x12c], 5
jne 0x40fb3b
cmp dword [ebp - 0x128], ebx
jne 0x40fb3b
push ebx
push ebx
call fcn.0055ad30
mov eax, 0x40fb31
ret
lea ecx, [ebp - 0x48c]
mov dword [ebp - 4], eax
push ecx
mov dword [ebp - 0x494], ebx
mov dword [ebp - 0x498], ebx
mov dword [ebp - 0x490], ebx
mov dword [ebp - 0x28c], ebx
call sub.IPHLPAPI.DLL_GetIfEntry
lea edx, [ebp - 0x4e8]
push edx
call sub.IPHLPAPI.DLL_GetTcpStatistics
lea eax, [ebp - 0x544]
push eax
call sub.IPHLPAPI.DLL_GetIpStatistics
push ebx
lea ecx, [ebp - 0x490]
push ecx
push ebx
call sub.IPHLPAPI.DLL_GetIfTable
mov eax, dword [ebp - 0x490]
xor edx, edx
cmp edx, eax
sbb ecx, ecx
neg ecx
jne 0x40fbaf
push 0x5de3a0
lea edx, [ebp - 0x4a4]
push edx
mov dword [ebp - 0x4a4], ebx
call fcn.0055ad30
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
mov dword [ebp - 0x498], esi
cmp esi, ebx
jne 0x40fbdb
push 0x5de3a0
lea eax, [ebp - 0x49c]
push eax
mov dword [ebp - 0x49c], ebx
call fcn.0055ad30
push ebx
lea ecx, [ebp - 0x490]
push ecx
push esi
call sub.IPHLPAPI.DLL_GetIfTable
cmp eax, ebx
je 0x40fc14
push 0x5de3a0
lea edx, [ebp - 0x4a8]
push edx
mov dword [ebp - 0x4a8], ebx
call fcn.0055ad30
mov eax, 0x40fc0a
ret
mov edi, dword [esi]
xor edx, edx
lea ecx, [esi + 0x224]
mov edi, edi
cmp edx, edi
jge 0x40fc55
mov eax, dword [ecx - 0x1c]
cmp eax, 6
je 0x40fc36
cmp eax, 0xf
je 0x40fc36
cmp eax, 0x17
jne 0x40fc42
mov eax, dword [ecx]
cmp eax, 4
je 0x40fc4b
cmp eax, 5
je 0x40fc4b
inc edx
add ecx, 0x35c
jmp 0x40fc20
mov dword [ebp - 0x494], 1
cmp esi, ebx
je 0x40fc60
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x494]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0055799e
mov esp, ebp
pop ebp
ret