joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424510
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret

Function at 0x424b01
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0x4e8
push 5
push 6
mov dword [ebp - 4], 0x10
call sub.WS2_32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
je 0x424b7f
push dword [ebp - 4]
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0043f310
add esp, 0xc
lea eax, [ebp - 0x14]
mov word [ebp - 0x14], 6
push dword [ebp - 4]
push eax
push esi
call sub.WS2_32.dll_bind
cmp eax, 0xffffffff
je 0x424b7f
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call sub.WS2_32.dll_getsockname
cmp eax, 0xffffffff
je 0x424b7f
lea eax, [ebp - 0x14]
push eax
call fcn.00424a97
push eax
push dword [ebp + 8]
call fcn.0043f254
add esp, 0xc
push esi
call sub.WS2_32.dll_closesocket
xor eax, eax
jmp 0x424b91
push str.00_00_00_00_FF_FF_FF_FF_FF_FF
push dword [ebp + 8]
call fcn.0043f254
pop ecx
pop ecx
push 1
pop eax
pop esi
leave
ret
Function at 0x424b94
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
call fcn.00425f7d
cmp eax, 1
jne 0x424ca0
lea eax, [ebp - 0x18]
push eax
call fcn.00425f91
test eax, eax
pop ecx
jne 0x424d16
lea eax, [ebp - 8]
mov ebx, 0xf003f
push eax
push ebx
push 0
mov esi, reloc.WS2_32.dll_bind
push str.SOFTWARENtpadHELPMENU
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x424bf5
push dword [ebp - 0x14]
push 4
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
mov edi, str.SOFTWARENtpadHELPMENUxtras
push eax
lea eax, [ebp - 0x38]
push eax
push edi
push esi
mov dword [ebp - 4], 0x1e
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x424c22
push dword [ebp + 8]
push 0x479b80
jmp 0x424d06
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
xor ebx, ebx
push ebx
push ebx
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x424d16
push ebx
call fcn.00452ff6
push eax
mov ebx, 0x479b80
lea eax, [ebp - 0x38]
push ebx
push eax
call fcn.0043f254
lea eax, [ebp - 0x38]
push eax
call fcn.00443200
add esp, 0x14
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 0x38]
push eax
push 1
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
test eax, eax
jne 0x424c90
push dword [ebp + 8]
lea eax, [ebp - 0x38]
push ebx
push eax
call fcn.0044203c
add esp, 0xc
xor esi, esi
jmp 0x424c93
or esi, 0xffffffff
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x424d19
lea eax, [ebp - 4]
mov edi, str.SOFTWARENtpadHELPMENUxtras
push eax
lea eax, [ebp - 0x38]
push eax
mov esi, reloc.WS2_32.dll_bind
push edi
push esi
mov dword [ebp - 4], 0x1e
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x424c15
push 0
call fcn.00452ff6
push eax
mov ebx, 0x479b80
lea eax, [ebp - 0x38]
push ebx
push eax
call fcn.0043f254
lea eax, [ebp - 0x38]
push eax
call fcn.00443200
add esp, 0x14
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 0x38]
push eax
push 1
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
test eax, eax
jne 0x424d16
push dword [ebp + 8]
push ebx
lea eax, [ebp - 0x38]
push eax
call fcn.0044203c
add esp, 0xc
xor eax, eax
jmp 0x424d19
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x426827
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
mov esi, 0x100
push esi
lea eax, [ebp - 0x100]
push 0
push eax
call fcn.0043f310
add esp, 0xc
lea eax, [ebp - 0x100]
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [ebp - 0x100]
test eax, eax
je 0x4268b9
cmp byte [ebp - 0x100], 0
je 0x4268b9
lea eax, [ebp - 0x100]
push eax
call fcn.00443200
inc eax
push eax
call fcn.0043e182
pop ecx
mov esi, eax
pop ecx
call fcn.00427b61
cmp eax, 1
lea eax, [ebp - 0x100]
push eax
jne 0x4268ad
call fcn.00443200
inc eax
push eax
lea eax, [ebp - 0x100]
push esi
push eax
call fcn.004267db
add esp, 0x10
jmp 0x4268b5
push esi
call fcn.00442ef0
pop ecx
pop ecx
mov eax, esi
jmp 0x4268bb
xor eax, eax
pop esi
leave
ret

Function at 0x426a24
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, 0xc6ef3720
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
mov dword [ebp + 8], 0x20
mov edi, dword [eax]
mov dword [ebp - 0xc], edi
mov edi, dword [eax + 4]
mov dword [ebp - 8], edi
mov edi, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], edi
mov dword [ebp + 0x10], eax
mov eax, edx
mov edi, edx
shr eax, 5
add eax, dword [ebp + 0x10]
shl edi, 4
add edi, dword [ebp - 4]
xor eax, edi
lea edi, [esi + edx]
xor eax, edi
sub ecx, eax
mov eax, ecx
mov edi, ecx
shr eax, 5
add eax, dword [ebp - 8]
shl edi, 4
add edi, dword [ebp - 0xc]
xor eax, edi
lea edi, [esi + ecx]
xor eax, edi
add esi, 0x61c88647
sub edx, eax
dec dword [ebp + 8]
jne 0x426a5a
mov eax, dword [ebp + 0xc]
pop edi
pop esi
mov dword [eax], edx
mov dword [eax + 4], ecx
leave
ret

Function at 0x4286a0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
push esi
mov esi, dword [esp + 0x50]
mov bx, word [esp + 0x4c]
cmp bx, 4
mov word [esi], 0
jbe 0x4286c3
sub al, al
pop esi
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x38]
push 0x10
push eax
call fcn.00428300
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.00428360
lea eax, [esp + 0x18]
push 0x10
push eax
call fcn.00428420
lea eax, [esp + 0x18]
push eax
call fcn.00427d00
add bl, 0x31
and eax, 0xffff
mov byte [esp + eax + 0x18], bl
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0xc]
push 0x10
push eax
lea eax, [esp + 0x24]
push 0x428690
push eax
lea eax, [esp + 0x3c]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
or eax, eax
je 0x428774
lea eax, [esp + 8]
push 0x2c
push eax
call fcn.00428670
or ax, ax
je 0x42873c
and eax, 0xffff
mov byte [esp + eax + 8], 0
cmp byte [esp + 8], 0x30
jne 0x428760
mov al, byte [esp + 9]
and al, 0xdf
cmp al, 0x58
jne 0x428760
lea eax, [esp + 0xa]
push esi
push eax
call fcn.00427e10
or al, al
jne 0x428774
jmp 0x42876f
lea eax, [esp + 8]
push esi
push eax
call fcn.00427d60
or al, al
jne 0x428774
mov word [esi], 0
mov ax, word [esi]
or ax, ax
je 0x42878c
cmp ax, 0xffff
je 0x42878c
mov al, 1
pop esi
pop ebx
add esp, 0x40
ret 8
sub al, al
pop esi
pop ebx
add esp, 0x40
ret 8
Function at 0x4287b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
push esi
mov esi, dword [esp + 0x50]
mov bx, word [esp + 0x4c]
cmp bx, 4
mov word [esi], 0
jbe 0x4287d3
sub al, al
pop esi
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x38]
push 0x10
push eax
call fcn.00428300
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.00428360
lea eax, [esp + 0x18]
push 0x10
push eax
call fcn.00428420
lea eax, [esp + 0x18]
push eax
call fcn.00427d00
add bl, 0x31
and eax, 0xffff
mov byte [esp + eax + 0x18], bl
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0xc]
push 0x10
push eax
lea eax, [esp + 0x24]
push 0x4287a0
push eax
lea eax, [esp + 0x3c]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
or eax, eax
je 0x428884
lea eax, [esp + 8]
push 0x2c
push eax
call fcn.00428670
or ax, ax
je 0x428884
and eax, 0xffff
mov cl, byte [esp + eax + 9]
and cl, 0xdf
cmp cl, 0x54
jne 0x428884
cmp byte [esp + eax + 0xa], 0x3a
jne 0x428884
push esi
lea eax, [esp + eax + 0xf]
push eax
call fcn.00427d60
or al, al
jne 0x428870
jmp 0x42887f
mov ax, word [esi]
cmp ax, 1
jl 0x42887f
cmp ax, 6
jle 0x428884
mov word [esi], 0
cmp word [esi], 1
sbb al, al
inc al
pop esi
pop ebx
add esp, 0x40
ret 8

Function at 0x4288b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x50
push esi
lea eax, [esp + 0x44]
push 0x10
push eax
call fcn.00428300
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.00428360
lea eax, [esp + 0x34]
push 0x10
push eax
call fcn.00428510
lea eax, [esp + 4]
push 0x10
push eax
call fcn.004284c0
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x18]
push 0x10
push eax
lea eax, [esp + 0x40]
push 0x4288a0
push eax
lea eax, [esp + 0x38]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
mov esi, eax
or esi, esi
je 0x42891f
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 8]
push eax
call fcn.00427b90
mov ecx, dword [esp + 0x5c]
mov byte [ecx], al
cmp esi, 1
sbb al, al
inc al
pop esi
add esp, 0x50
ret 8

Function at 0x428930
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x30
lea eax, [esp + 0x20]
push 0x10
push eax
call fcn.00428300
lea eax, [esp]
push 0x10
push eax
call fcn.00428360
lea eax, [esp + 0x10]
push 0x10
push eax
call fcn.00428470
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x14]
push 0
push eax
lea eax, [esp + 0xc]
push eax
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov ecx, dword [esp + 0x34]
cmp eax, 1
mov word [ecx], ax
sbb cl, cl
inc cl
mov al, cl
add esp, 0x30
ret 4
Function at 0x4289a0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x70
push esi
mov esi, dword [esp + 0x78]
push 0x10
mov word [esi], 0
lea eax, [esp + 8]
push 0
push eax
call fcn.00427d20
lea eax, [esp + 0x64]
push 0x10
push eax
call fcn.00428300
lea eax, [esp + 0x44]
push 0x10
push eax
call fcn.00428360
lea eax, [esp + 0x54]
push 0x10
push eax
call fcn.004283c0
lea eax, [esp + 0x34]
push 0x10
push eax
call fcn.00428570
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.00428620
lea eax, [esp + 0x14]
push 0x10
push eax
call fcn.004285d0
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 8]
push 0x10
push eax
lea eax, [esp + 0x60]
push 0x428990
push eax
lea eax, [esp + 0x58]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
or eax, eax
je 0x428a73
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 8]
push eax
call fcn.00427b90
or al, al
je 0x428a41
mov word [esi], 2
jmp 0x428a73
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 8]
push eax
call fcn.00427b90
or al, al
je 0x428a5b
mov word [esi], 3
jmp 0x428a73
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 8]
push eax
call fcn.00427b90
or al, al
je 0x428a73
mov word [esi], 1
cmp word [esi], 1
sbb al, al
inc al
pop esi
add esp, 0x70
ret 4
Function at 0x428c60
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 4
push ebx
push esi
push edi
push ebp
mov esi, dword [esp + 0x18]
mov byte [esp + 0x13], 0
lea eax, [esi + 4]
mov edi, dword [esp + 0x1c]
mov dword [esi], eax
mov ax, word [edi + 4]
mov word [esi + 4], ax
mov ax, word [edi + 0xa]
mov word [esi + 6], ax
mov ax, word [edi + 0x14]
mov word [esi + 0x16], ax
mov ax, word [edi + 8]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
lea eax, [esi + 0x24]
mov dword [esi + 0x10], eax
lea eax, [esi + 4]
push eax
call fcn.00428b60
or al, al
jne 0x428dea
test byte [edi + 0x1c], 4
je 0x428cc3
mov byte [esp + 0x13], 1
sub cx, cx
sub dx, dx
lea esp, [esp]
mov ebp, ecx
and ebp, 0xffff
lea eax, [ebp*8]
sub eax, ebp
shl eax, 2
lea eax, [eax + eax*4]
lea ebx, [esi + eax]
lea eax, [ebp*4]
mov word [ebx + 0x36], cx
lea eax, [eax + eax*8]
lea ebp, [edi + eax]
mov ax, word [ebp + 0xe]
mov word [ebx + 0x9c], ax
mov ax, word [ebp + 0x12]
mov word [ebx + 0x8e], ax
mov ax, word [ebp + 0x16]
mov word [ebx + 0x34], ax
mov ax, word [ebp + 0x18]
mov word [ebx + 0x32], ax
mov eax, dword [ebp + 0x1c]
mov dword [ebx + 0x2c], eax
cmp cx, 3
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0x24]
mov dword [ebx + 0x28], eax
lea eax, [esi + 4]
mov dword [ebx + 0xa4], eax
jne 0x428d50
mov dword [ebx + 0xa8], 0
jmp 0x428d5c
lea eax, [ebx + 0xb0]
mov dword [ebx + 0xa8], eax
or cx, cx
jne 0x428d70
mov dword [ebx + 0xac], 0
jmp 0x428d79
lea eax, [ebx - 0x68]
mov dword [ebx + 0xac], eax
cmp byte [esp + 0x13], 0
je 0x428d90
cmp word [ebp + 0xe], 0xffff
jne 0x428d90
or dword [ebx + 0x2c], 8
jmp 0x428d96
mov word [ebx + 0x36], dx
inc dx
inc cx
cmp cx, 4
jb 0x428cd0
push esi
call fcn.00428bd0
push esi
call fcn.00428b10
push esi
call fcn.00428ad0
mov eax, dword [esi + 0x10]
push eax
call fcn.00429f90
mov word [esi + 0xc], ax
or ax, ax
je 0x428de0
lea eax, [esi + 4]
push eax
call fcn.00429de0
sub ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 8
push esi
call fcn.00428aa0
mov ax, 9
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 8

Function at 0x42aee0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push esi
push edi
lea eax, [esp + 0xa]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
push eax
push esi
call fcn.00428e00
mov eax, dword [esp + 0xc]
push 0xd
mov ax, word [eax + 4]
push eax
call fcn.0042aa10
or al, al
jne 0x42af6a
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.0042b800
or al, al
jne 0x42af6a
mov eax, dword [esp + 0xc]
mov ax, word [eax + 0xa]
push eax
mov eax, dword [esp + 0x10]
mov al, byte [eax + 8]
push eax
mov eax, dword [esp + 0x14]
mov ax, word [eax + 6]
push eax
mov eax, dword [esp + 0x18]
mov ax, word [eax + 4]
push eax
mov eax, dword [esp + 0x20]
push eax
push esi
call fcn.0042b6c0
mov di, ax
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.0042b850
or di, di
je 0x42af6a
mov ax, di
pop edi
pop esi
add esp, 0xc
ret 8
Function at 0x42b010
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [esp + 0xe]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
mov edi, dword [esp + 0x28]
push eax
mov esi, dword [esp + 0x28]
push edi
push esi
call fcn.00428e00
lea eax, [esp + 0xe]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push edi
push esi
call fcn.00428e00
mov eax, dword [esp + 0x10]
push 0xe
mov ax, word [eax + 4]
push eax
call fcn.0042aa10
or al, al
jne 0x42b0f3
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.0042b800
mov bx, ax
or bl, bl
jne 0x42b0c2
mov eax, dword [esp + 0x10]
mov ax, word [eax + 0xe]
push eax
mov eax, dword [esp + 0x14]
mov ax, word [eax + 0xc]
push eax
mov eax, dword [esp + 0x18]
mov ax, word [eax + 0xa]
push eax
mov eax, dword [esp + 0x1c]
mov al, byte [eax + 8]
push eax
mov eax, dword [esp + 0x20]
mov ax, word [eax + 6]
push eax
mov eax, dword [esp + 0x24]
mov ax, word [eax + 4]
push eax
mov eax, dword [esp + 0x2c]
push eax
push esi
call fcn.0042b710
mov bx, ax
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.0042b850
push esi
call fcn.00428f10
cmp ax, 0xd
jne 0x42b0d2
mov bx, 0xd
cmp bl, 0xd
je 0x42b0dd
cmp bx, 3
jne 0x42b0f0
mov ax, word [esp + 0xe]
dec word [esp + 0xe]
or ax, ax
jne 0x42b062
mov ax, bx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8

Function at 0x42cea0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0xc
push esi
mov byte [esp + 4], 0x52
mov byte [esp + 5], 0x4e
mov byte [esp + 6], 0x42
mov byte [esp + 7], 0x4f
mov byte [esp + 8], 0x44
mov byte [esp + 9], 0x52
mov byte [esp + 0xa], 0x56
mov ax, word [esp + 0x18]
add al, 0x30
mov byte [esp + 0xb], al
mov esi, dword [esp + 0x14]
mov byte [esp + 0xc], 0
mov dword [esi], 0
push 0
push 0x80
push 3
push 0
push 3
lea eax, [esp + 0x18]
push 0xc0000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x42cf36
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jb 0x42cf13
cmp eax, 3
jbe 0x42cf2b
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x42cf20
push eax
call sub.KERNEL32.dll_CloseHandle
mov ax, 0x80b
pop esi
add esp, 0xc
ret 8
mov ax, 0x80c
pop esi
add esp, 0xc
ret 8
mov ax, 0x800
pop esi
add esp, 0xc
ret 8

Function at 0x42cf50
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 4
push ebx
push esi
push edi
mov esi, dword [esp + 0x18]
push esi
mov word [esi + 6], 0xffff
call fcn.0042ce40
lea eax, [esp + 0xc]
push 0
push eax
xor eax, eax
mov ax, word [esi + 2]
push eax
mov edi, dword [esp + 0x20]
push esi
mov eax, dword [edi]
push eax
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
or ebx, ebx
je 0x42cfa0
lea eax, [esp + 0xc]
push 0
push eax
xor eax, eax
mov ax, word [esi + 2]
push eax
push esi
mov eax, dword [edi]
push eax
call sub.KERNEL32.dll_ReadFile
mov ebx, eax
push esi
call fcn.0042ce00
or ebx, ebx
je 0x42cfb2
cmp word [esi + 6], 0xffff
jne 0x42cfb8
mov word [esi + 6], 0x83b
mov ax, word [esi + 6]
pop edi
pop esi
pop ebx
add esp, 4
ret 8
Function at 0x42d0e0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x10
push esi
mov al, byte [esp + 0x1c]
push eax
lea eax, [esp + 8]
push eax
call fcn.0042d0a0
push 0
push 0x80
push 3
push 0
push 3
lea eax, [esp + 0x18]
push 0xc0000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov esi, dword [esp + 0x18]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x42d150
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jb 0x42d129
cmp eax, 3
jbe 0x42d141
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x42d136
push eax
call sub.KERNEL32.dll_CloseHandle
mov ax, 0x20b
pop esi
add esp, 0x10
ret 8
mov ax, 0x20c
pop esi
add esp, 0x10
ret 8
mov ax, 0x200
pop esi
add esp, 0x10
ret 8

Function at 0x42d160
Capabilities:
Check if file exists
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
mov byte [esp + 4], 0x5c
mov byte [esp + 5], 0x5c
mov byte [esp + 6], 0x2e
mov byte [esp + 7], 0x5c
mov byte [esp + 8], 0x53
mov byte [esp + 9], 0x6e
mov byte [esp + 0xa], 0x74
mov byte [esp + 0xb], 0x6e
mov byte [esp + 0xc], 0x6c
mov byte [esp + 0xd], 0x55
mov byte [esp + 0xe], 0x73
mov byte [esp + 0xf], 0x62
mov byte [esp + 0x10], 0
push 0
push 0x80
push 3
push 0
push 3
lea eax, [esp + 0x18]
push 0xc0000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov esi, dword [esp + 0x18]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x42d200
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jb 0x42d1db
cmp eax, 3
jbe 0x42d1f3
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x42d1e8
push eax
call sub.KERNEL32.dll_CloseHandle
mov ax, 0x20b
pop esi
add esp, 0x10
ret 8
mov ax, 0x20c
pop esi
add esp, 0x10
ret 8
mov ax, 0x200
pop esi
add esp, 0x10
ret 8

Function at 0x42d220
Capabilities:
Read file on windows

Disassembly:
sub esp, 4
push esi
push edi
mov esi, dword [esp + 0x14]
push esi
mov word [esi + 6], 0xffff
call fcn.0042ce40
lea eax, [esp + 8]
push 0
push eax
xor eax, eax
mov ax, word [esi + 2]
push eax
mov eax, dword [esp + 0x1c]
push esi
mov eax, dword [eax]
push eax
call sub.KERNEL32.dll_ReadFile
mov edi, eax
push esi
call fcn.0042ce00
cmp edi, 1
jne 0x42d265
cmp word [esi + 6], 0xffff
jne 0x42d26b
mov word [esi + 6], 0x23b
mov ax, word [esi + 6]
pop edi
pop esi
add esp, 4
ret 8
Function at 0x42d420
Capabilities:
Contain obfuscated stackstrings
Read .ini file

Disassembly:
sub esp, 0x24
mov byte [esp + 8], 0x53
mov byte [esp + 9], 0x59
mov byte [esp + 0xa], 0x53
mov byte [esp + 0xb], 0x54
mov byte [esp + 0xc], 0x45
mov byte [esp + 0xd], 0x4d
mov byte [esp + 0xe], 0x2e
mov byte [esp + 0xf], 0x49
mov byte [esp + 0x10], 0x4e
mov byte [esp + 0x11], 0x49
mov byte [esp + 0x12], 0
mov byte [esp + 0x14], 0x53
mov byte [esp + 0x15], 0x65
mov byte [esp + 0x16], 0x6e
mov byte [esp + 0x17], 0x74
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], 0x6e
mov byte [esp + 0x1a], 0x65
mov byte [esp + 0x1b], 0x6c
mov byte [esp + 0x1c], 0x53
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x74
mov byte [esp + 0x1f], 0x75
mov byte [esp + 0x20], 0x70
mov byte [esp + 0x21], 0
mov byte [esp], 0x49
mov byte [esp + 1], 0x6f
lea eax, [esp + 8]
mov byte [esp + 2], 0x45
mov byte [esp + 3], 0x6e
mov byte [esp + 4], 0x74
mov byte [esp + 5], 0x72
mov byte [esp + 6], 0x79
mov byte [esp + 7], 0
push eax
lea eax, [esp + 4]
push 0
push eax
lea eax, [esp + 0x20]
push eax
call sub.KERNEL32.dll_GetPrivateProfileIntA
add esp, 0x24
ret

Function at 0x43439f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x4343d8
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00434362
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00433245
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]

Function at 0x435e09
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x435e4c
call fcn.00430400
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x435e4c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x435e67
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.004359c0
test ebx, ebx
mov esi, eax
je 0x435e65
test edi, edi
je 0x435e65
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x437d8c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x437da2
mov edi, dword [esi + 0xc]
jmp 0x437de2
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x437dbb
call fcn.00430606
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x437dd0
call fcn.00430606
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x437de2
call fcn.00430606
call fcn.00430400
cmp dword [eax + 0x3c], 0
je 0x437df7
push edi
mov ecx, ebx
call fcn.00436cde
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.00437ca6
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x437e15
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x5c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x437e21
mov edi, eax
mov dword [ebx + 0x5c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x438ce0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, 0xffff0000
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
jne 0x438d00
cmp dword [edi + 0x54], 0
jne 0x438d00
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00430400
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [esp + 0x18]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00438ca7
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
ret 8

Function at 0x439662
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x498f90]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x800
push ebx
push esi
mov esi, ecx
mov ebx, edx
lea eax, [ebp - 0x11c]
jne 0x4396a2
push 0x46ab80
push 4
push eax
call fcn.00447fe2
push eax
call fcn.00401000
add esp, 0x10
jmp 0x4396b4
push 4
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x439722
push edi
call fcn.004415c9
mov edi, dword [eax]
call fcn.004415c9
and dword [eax], 0
lea eax, [ebp - 0x11c]
push eax
push ebx
push esi
push 0x111
mov esi, 0x112
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.0043f2eb
add esp, 0x18
mov ebx, eax
call fcn.004415c9
cmp dword [eax], 0
je 0x439702
call fcn.004415c9
push dword [eax]
call fcn.0042fad3
pop ecx
jmp 0x439709
call fcn.004415c9
mov dword [eax], edi
cmp ebx, 0xffffffff
pop edi
je 0x439722
cmp ebx, esi
jae 0x439722
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x439724
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0043ec69
leave
ret