joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449554
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4496ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x4496e0
mov dl, 1
mov eax, dword [0x412494]
call fcn.00403bc8
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404930
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4496cf
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00437588
test al, al
je 0x4496c2
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x449710
lea eax, [ebp - 0x254]
call fcn.0040925c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4496c2
xor eax, eax
push ebp
push 0x4496bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x449748
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4496a4
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404ba0
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4496a4
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404ba0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4496c2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4495c5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00415f70
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449706
lea eax, [ebp - 0x260]
call fcn.00404930
ret

Function at 0x44a034
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x453b9c]
cmp byte [eax + 0xa5], 0
jne 0x44a0a5
cmp dword [0x453bb4], 0
jne 0x44a066
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x449ff0
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x453bb4], eax
cmp dword [0x453bb0], 0
jne 0x44a081
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x453bb0], eax
cmp dword [0x453bb8], 0
jne 0x44a0a5
push esp
push 0
push 0
push 0x449f94
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x453bb8], eax
pop edx
ret
Function at 0x44a19c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44a1b3
add esp, 0xfffffff0
call fcn.00403f04
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00419d80
mov eax, dword [0x451f48]
cmp word [eax + 2], 0
jne 0x44a1db
mov eax, dword [0x451f48]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044b6f0
mov eax, dword [0x451fec]
cmp word [eax + 2], 0
jne 0x44a1f5
mov eax, dword [0x451fec]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044b8e8
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x412078]
call fcn.00403bc8
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x412078]
call fcn.00403bc8
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41bf54]
call fcn.00421b9c
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x44a37c
mov eax, dword [0x451e70]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00421f6c
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x44be88
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x451e70]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c96c
test eax, eax
je 0x44a2ea
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408c50
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c994
test eax, eax
je 0x44a2fe
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404ba0
mov eax, dword [0x451d78]
cmp byte [eax], 0
jne 0x44a332
mov eax, ebx
call fcn.0044a4a4
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0044c064
mov eax, ebx
call fcn.0044ca28
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44a372
call fcn.00403f5c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44a724
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x453b9c]
cmp dword [eax + 0x30], 0
je 0x44a7ce
cmp dword [ebx + 0x94], 0
jne 0x44a7c8
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44a6b4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44a7c8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44a78e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44a7c8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004143e0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44a79d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44b330
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44b365
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404a20
jmp 0x44b372
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404984
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44c240
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x44c281
mov eax, esi
call fcn.00432d90
test al, al
je 0x44c281
mov eax, dword [ebx + 0x84]
call fcn.00432b30
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44c281
push 0
mov eax, dword [ebx + 0x84]
call fcn.00432b30
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x44d1ec
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x11c], ebx
mov byte [ebp - 1], cl
mov ebx, edx
xor eax, eax
push ebp
push 0x44d308
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x44d2cc
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x105
lea eax, [ebp - 0x115]
push eax
lea eax, [ebp - 0x11c]
mov edx, ebx
call fcn.00404b18
lea eax, [ebp - 0x11c]
mov edx, 0x44d320
call fcn.00404bf8
mov eax, dword [ebp - 0x11c]
call fcn.00404df0
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov al, byte [ebp - 1]
dec al
je 0x44d278
dec al
je 0x44d2a0
jmp 0x44d2b5
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x124], eax
mov byte [ebp - 0x120], 0
lea edx, [ebp - 0x124]
xor ecx, ecx
mov eax, 0x44d32c
call fcn.004092dc
jmp 0x44d2c2
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x115]
mov ecx, 0x105
call fcn.00404ba0
jmp 0x44d2c2
mov eax, dword [ebp + 8]
mov edx, 0x44d33c
call fcn.00404984
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44d2ef
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d30f
lea eax, [ebp - 0x11c]
call fcn.00404930
ret
Function at 0x403970
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x51df40], ecx
inc edx
cmp edx, 0x100
jb 0x403972
cmp edx, 0x800
jae 0x403a49
lea esp, [esp]
mov eax, dword [edx*4 + 0x51db40]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x51df40]
inc edx
mov dword [edx*4 + 0x51df3c], eax
cmp edx, 0x800
jb 0x403a20
mov dword [0x51d668], 0x404490
call fcn.00404660
test eax, eax
jne 0x403a66
mov dword [0x51d668], 0x404540
ret
Function at 0x406410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov ecx, dword [esp + 0x14]
push ebp
mov ebp, dword [ecx]
mov ecx, dword [esp + 0x10]
xor eax, eax
and ebp, 7
cmp ecx, 5
jae 0x406429
pop ebp
pop ecx
ret
mov edx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x1c]
add esi, 5
lea edx, [edx + ecx - 4]
push edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x10], edx
jmp 0x406450
mov ecx, dword [esp + 0x18]
lea edi, [eax + ecx]
cmp edi, edx
jae 0x40646d
jmp 0x406460
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x40646d
inc edi
cmp edi, edx
jb 0x406460
mov eax, edi
sub eax, ecx
mov ecx, eax
sub ecx, dword [esp + 0x1c]
cmp edi, edx
jae 0x406582
cmp ecx, 3
jbe 0x4064a1
xor ebp, ebp
mov cl, byte [edi + 4]
mov dword [esp + 0x1c], eax
test cl, cl
je 0x4064db
cmp cl, 0xff
je 0x4064db
and ebp, 3
add ebp, ebp
or ebp, 1
inc eax
jmp 0x406450
dec ecx
shl ebp, cl
and ebp, 7
je 0x406486
movzx ecx, byte [ebp + 0x4fb204]
mov ebx, edi
sub ebx, ecx
cmp byte [ebp + 0x4fb1fc], 0
mov cl, byte [ebx + 4]
je 0x4064c9
test cl, cl
je 0x4064c9
cmp cl, 0xff
jne 0x406486
and ebp, 3
add ebp, ebp
mov dword [esp + 0x1c], eax
or ebp, 1
inc eax
jmp 0x406450
movzx edx, cl
movzx ecx, byte [edi + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, ecx
lea esp, [esp]
cmp dword [esp + 0x28], 0
je 0x40650e
lea ebx, [edx + eax]
add ebx, esi
jmp 0x406514
sub edx, eax
sub edx, esi
mov ebx, edx
test ebp, ebp
je 0x406554
movzx esi, byte [ebp + 0x4fb204]
add esi, esi
add esi, esi
add esi, esi
mov ecx, 0x18
sub ecx, esi
mov edx, ebx
shr edx, cl
test dl, dl
je 0x406539
cmp dl, 0xff
jne 0x406550
mov ecx, 0x20
sub ecx, esi
mov esi, dword [esp + 0x20]
mov edx, 1
shl edx, cl
dec edx
xor edx, ebx
jmp 0x406500
mov esi, dword [esp + 0x20]
mov edx, ebx
shr edx, 0x18
and dl, 1
dec dl
not dl
mov byte [edi + 4], dl
mov edx, ebx
shr edx, 8
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 2], dl
mov edx, dword [esp + 0x10]
mov byte [edi + 3], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x406450
pop edi
pop esi
pop ebx
cmp ecx, 3
jbe 0x406595
mov ecx, dword [esp + 0x18]
xor ebp, ebp
mov dword [ecx], ebp
pop ebp
pop ecx
ret
dec ecx
shl ebp, cl
mov ecx, dword [esp + 0x18]
and ebp, 7
mov dword [ecx], ebp
pop ebp
pop ecx
ret
Function at 0x40a7e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e1a26
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x51a230]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push esi
mov byte [ebp - 4], 1
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x40a88c
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x40a88c
call fcn.00409800
mov esi, eax
jmp 0x40a97c
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x40a8af
call fcn.00409800
jmp 0x40a96f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x40a8cd
call fcn.00409800
jmp 0x40a96f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x40a8ee
mov esi, 0x8007000e
jmp 0x40a971
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.00409630
jmp 0x40a918
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x40a92f
mov esi, 0x8007000e
jmp 0x40a971
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x40a94f
call fcn.00409800
jmp 0x40a96f
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.0040a640
mov esi, eax
test edi, edi
je 0x40a97c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x40a9a0
lea ecx, [ebp - 0x418]
call fcn.00409e40
nop word [eax + eax]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00490604
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40c1d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e1b39
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x51a230]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi], vtable.CRunSoftUpd.0
mov dword [ebp - 4], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
lea ecx, [esi + 0x34]
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
xor eax, eax
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 7
mov word [esi + 0x4c], ax
push eax
xorps xmm0, xmm0
mov byte [ebp - 4], 3
push 0x4ea437
mov dword [esi + 0x20], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
movsd qword [esi + 0x10], xmm0
call fcn.00410410
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40e230
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x1c]
push eax
push 0
push esi
push 0x40e410
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x18], eax
pop esi
ret

Function at 0x40ead0
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e1e30
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
mov eax, dword [0x51a230]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0xd0], esi
xor eax, eax
mov dword [ebp - 4], 0
push eax
push 0x4e8798
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00407d80
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 1
call fcn.0041765f
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
cmovae eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40ec86
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
push 0
cmovae eax, dword [ebp + 0xc]
push 0x80
push 4
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
push 0
cmp edi, 0xffffffff
jne 0x40eba9
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov ecx, esi
push 0x4e8798
mov word [esi], ax
call fcn.00407d80
jmp 0x40ecb9
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc8], eax
inc eax
push eax
mov dword [ebp - 0xd0], eax
call fcn.00490862
add esp, 4
mov dword [ebp - 0xcc], eax
test eax, eax
jne 0x40ebe1
push 0x4e8798
mov ecx, esi
call fcn.0040c180
jmp 0x40ecb9
push dword [ebp - 0xd0]
push 0
push eax
call fcn.004bac70
add esp, 0xc
lea eax, [ebp - 0xd4]
push 0
push eax
push dword [ebp - 0xc8]
push dword [ebp - 0xcc]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc8]
mov edi, dword [ebp - 0xcc]
lea ecx, [ebp - 0xc4]
push edi
call fcn.00418c4c
push edi
call fcn.00490615
add esp, 4
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0xc4]
push eax
call fcn.004184bc
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
call fcn.0041c53f
add esp, 8
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 4
call fcn.0040c3c0
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x40ec7e
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push ecx
cmovae eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x28]
push eax
call fcn.00407d80
lea ecx, [ebp - 0x40]
call fcn.00407230
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
mov word [ebp - 0x28], ax
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
lea ecx, [ebp - 0x28]
call fcn.00407230
lea ecx, [ebp + 0xc]
call fcn.00407230
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490604
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x410a10
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e20e3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x51a230]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x51c800
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ebp - 4], 0
mov dword [ecx], 0x51c800
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x4ea940
mov byte [ebp - 4], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.004145b0
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x414c9a
Capabilities:
Read .ini file

Disassembly:
push 0x838
mov eax, 0x4e2574
call fcn.004908c5
mov edi, ecx
mov ecx, dword [ebp + 0xc]
lea eax, [edi + 0x8c]
cmp dword [eax + 0x14], 8
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x844], ecx
jb 0x414cc5
mov eax, dword [eax]
push eax
push dword [ebp + 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
cmp esi, dword [ebp + 0x10]
jne 0x414d82
push 0x4e8798
lea ecx, [ebp - 0x828]
call fcn.0040c180
and dword [ebp - 4], 0
lea eax, [ebp - 0x810]
push 0x800
push 0
push eax
call fcn.004bac70
push dword [ebp + 0x10]
lea eax, [ebp - 0x810]
push 0x4eb1f4
push eax
call fcn.00407ea0
add esp, 0x18
lea eax, [ebp - 0x810]
cmp byte [edi + 5], 0
mov ecx, edi
push eax
push dword [ebp - 0x844]
lea eax, [ebp - 0x840]
push ebx
push eax
je 0x414d3e
call fcn.00414bcb
jmp 0x414d43
call fcn.00414c77
push eax
lea ecx, [ebp - 0x828]
call fcn.00414ae3
lea ecx, [ebp - 0x840]
call fcn.00407230
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.004c2baf
pop ecx
lea ecx, [ebp - 0x828]
mov esi, eax
call fcn.00407230
mov eax, esi
call fcn.00490880
ret 0xc
Function at 0x414d8c
Capabilities:
Read .ini file

Disassembly:
push 0x82c
mov eax, 0x4e25be
call fcn.004908c5
mov edi, ecx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x10]
push 0x800
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x810]
push ecx
mov dword [ebp - 0x838], esi
push eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x834], ecx
call fcn.004bac70
lea eax, [edi + 0x8c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x414de9
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.0040c180
and dword [ebp - 4], 0
mov eax, esi
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x834], 1
jb 0x414e2f
mov eax, dword [esi]
push ebx
push eax
call fcn.004ca099
pop ecx
pop ecx
test eax, eax
jne 0x414e77
cmp byte [edi + 5], 0
lea eax, [ebp - 0x828]
push ebx
push dword [ebp - 0x82c]
mov ecx, edi
push dword [ebp - 0x830]
push eax
je 0x414e5f
call fcn.00414bcb
jmp 0x414e64
call fcn.00414c77
push eax
mov ecx, esi
call fcn.00414ae3
lea ecx, [ebp - 0x828]
call fcn.00407230
mov eax, esi
call fcn.00490880
ret 0x10