joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416d30
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x43d064]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x4c], ecx
cmp dword [ebp + 8], 0
jne 0x416d50
xor eax, eax
jmp 0x416ef3
mov dword [ebp - 4], 0
push 0x1f4
lea eax, [ebp - 0x48]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, dword [ebp - 0x4c]
add edx, 0x4808
push edx
push 0
lea eax, [ebp - 0x48]
push eax
push str.OptionFlag
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x416ef0
push 6
push str.PF_760
mov ecx, dword [ebp + 8]
push ecx
call fcn.004035da
add esp, 0xc
test eax, eax
je 0x416dc9
push 6
push str.PF_750
mov edx, dword [ebp + 8]
push edx
call fcn.004035da
add esp, 0xc
test eax, eax
jne 0x416dd0
mov dword [ebp - 4], 0x100
push 6
push str.PF_650
mov eax, dword [ebp + 8]
push eax
call fcn.004035da
add esp, 0xc
test eax, eax
jne 0x416dee
mov dword [ebp - 4], 0x200
push 6
push str.PF_660
mov ecx, dword [ebp + 8]
push ecx
call fcn.004035da
add esp, 0xc
test eax, eax
jne 0x416e0c
mov dword [ebp - 4], 0x400
push 6
push str.DF_780
mov edx, dword [ebp + 8]
push edx
call fcn.004035da
add esp, 0xc
test eax, eax
je 0x416e3a
push 6
push str.DF_730
mov eax, dword [ebp + 8]
push eax
call fcn.004035da
add esp, 0xc
test eax, eax
jne 0x416e41
mov dword [ebp - 4], 0x8000000
push 6
push str.DF_670
mov ecx, dword [ebp + 8]
push ecx
call fcn.004035da
add esp, 0xc
test eax, eax
je 0x416e86
push 6
push str.DF_720
mov edx, dword [ebp + 8]
push edx
call fcn.004035da
add esp, 0xc
test eax, eax
je 0x416e86
push 6
push str.DF_470
mov eax, dword [ebp + 8]
push eax
call fcn.004035da
add esp, 0xc
test eax, eax
jne 0x416e8d
mov dword [ebp - 4], 0x1000000
push 6
push str.DF_760
mov ecx, dword [ebp + 8]
push ecx
call fcn.004035da
add esp, 0xc
test eax, eax
je 0x416ee9
push 6
push str.DF_710
mov edx, dword [ebp + 8]
push edx
call fcn.004035da
add esp, 0xc
test eax, eax
je 0x416ee9
push 6
push str.DF_650
mov eax, dword [ebp + 8]
push eax
call fcn.004035da
add esp, 0xc
test eax, eax
je 0x416ee9
push 6
push str.DF_420
mov ecx, dword [ebp + 8]
push ecx
call fcn.004035da
add esp, 0xc
test eax, eax
jne 0x416ef0
mov dword [ebp - 4], 0x100000
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00401f44
mov esp, ebp
pop ebp
ret 4
Function at 0x4175e0
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2260
call fcn.0040ff90
mov eax, dword [0x43d064]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2260], ecx
mov eax, dword [ebp - 0x2260]
mov ecx, dword [eax + 0xb08]
call fcn.00401330
test eax, eax
jne 0x41767a
push 0x208
push 0
lea ecx, [ebp - 0x2258]
push ecx
call fcn.00401f60
add esp, 0xc
push 0x104
lea edx, [ebp - 0x2258]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jbe 0x41764b
lea eax, [ebp - 0x2258]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 1
lea ecx, [ebp - 0x2258]
push ecx
push 0
mov edx, dword [ebp - 0x2260]
mov ecx, dword [edx + 0xb08]
call fcn.00414b90
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x41777e
push 0x44
push 0
lea eax, [ebp - 0x2050]
push eax
call fcn.00401f60
add esp, 0xc
mov dword [ebp - 0x2050], 0x44
mov dword [ebp - 0x2024], 1
mov ecx, 1
mov word [ebp - 0x2020], cx
mov dword [ebp - 0x2040], 0x80000000
mov dword [ebp - 0x203c], 0x80000000
mov dword [ebp - 0x2038], 0x80000000
mov dword [ebp - 0x2034], 0x80000000
mov edx, dword [ebp - 0x2260]
add edx, 0x2e38
push edx
mov eax, dword [ebp - 0x2260]
add eax, 0x8f0
push eax
push str._s__P:_s
push 0x1000
lea ecx, [ebp - 0x2008]
push ecx
call fcn.00402385
add esp, 0x14
mov edx, dword [ebp - 0x2260]
add edx, 0xaf8
push edx
lea eax, [ebp - 0x2050]
push eax
mov ecx, dword [ebp - 0x2260]
add ecx, 0x6e8
push ecx
push 0
push 0x4000020
push 0
push 0
push 0
lea edx, [ebp - 0x2008]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x41776e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x225c], eax
push 0x10
push 0
mov eax, dword [ebp - 0x2260]
add eax, 0xaf8
push eax
call fcn.00401f60
add esp, 0xc
jmp 0x41777e
mov ecx, dword [ebp - 0x2260]
mov dword [ecx + 0xb18], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401f44
mov esp, ebp
pop ebp
ret

Function at 0x417790
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
call fcn.004168b0
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x6e4]
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0x1002
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
je 0x417801
cmp dword [ebp - 4], 0
je 0x417801
mov eax, dword [ebp - 8]
mov dword [eax + 0x4a24], 0xffffffff
push 0
push 0x32
push 0x84
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x6e4]
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x4a1c], eax
jmp 0x417831
mov edx, dword [ebp - 8]
cmp dword [edx + 0x4a2c], 0
je 0x41781f
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x6e4]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x417831
push 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x6e4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret
Function at 0x417840
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
push 8
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x6e4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x6e4]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0x45f8
call fcn.0042dba0
cmp dword [ebp - 8], 0
je 0x417895
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x6e4]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0x43
push 0
push 0
push 0
push 0
xor ecx, ecx
cmp dword [ebp - 8], 0
setne cl
add ecx, 0xfffffffe
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x6e4]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
push 0
push 0x1002
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
je 0x417911
cmp dword [ebp - 4], 0
je 0x417911
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x4a24], 1
push 0
push 0x32
push 0x84
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x6e4]
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x4a1c], eax
jmp 0x417963
push 1
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x6e4]
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x45f8
call fcn.0042dab0
mov eax, dword [ebp - 0x10]
imul eax, eax, 0xff
xor edx, edx
mov ecx, 0x64
div ecx
mov byte [ebp - 9], al
push 3
movzx edx, byte [ebp - 9]
push edx
push 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x6e4]
push ecx
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov esp, ebp
pop ebp
ret

Function at 0x418480
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x6c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x6e0]
push ecx
call dword [sym.imp.USER32.dll_LoadIconW]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0x3b8
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x6e4]
mov dword [edx + 0xc], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], 7
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], 0x468
push 1
push 0x80
mov ecx, dword [ebp - 4]
add ecx, 0x20
push ecx
mov ecx, dword [ebp - 4]
call fcn.00418240
mov edx, dword [ebp - 4]
add edx, 8
push edx
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
test eax, eax
jne 0x41850f
xor eax, eax
jmp 0x418514
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x419a00
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70c
mov eax, dword [0x43d064]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x70c], ecx
mov dword [ebp - 8], 0
push str._BTN_
mov eax, dword [ebp + 8]
push eax
call fcn.00401050
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x419b4c
mov ecx, dword [ebp - 0x70c]
add ecx, 0x4808
push ecx
push 0x12c
lea edx, [ebp - 0x708]
push edx
push 0x4389a0
push 0x4389a4
mov eax, dword [ebp - 0x70c]
add eax, 0x2bcc
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x708]
push ecx
call fcn.00402006
add esp, 4
test eax, eax
jbe 0x419ab6
mov edx, dword [ebp - 0x70c]
add edx, 0x4808
push edx
push 0x104
lea eax, [ebp - 0x258]
push eax
push str.BLN_ERR_BODY_BUTTON_OK
push str.ButtonOverride
lea ecx, [ebp - 0x708]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x20
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x258]
push eax
mov ecx, dword [ebp - 0x70c]
add ecx, 0x40c8
call fcn.0042e720
lea ecx, [ebp - 0x50]
push ecx
call fcn.00402006
add esp, 4
test eax, eax
jne 0x419af7
push 0x438a04
push 0x20
lea edx, [ebp - 0x50]
push edx
call fcn.004023ae
add esp, 0xc
mov eax, dword [ebp - 4]
add eax, 0xa
push eax
push 0x12c
lea ecx, [ebp - 0x4b0]
push ecx
call fcn.004023ae
add esp, 0xc
xor edx, edx
mov eax, dword [ebp - 4]
mov word [eax], dx
lea ecx, [ebp - 0x50]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00402588
add esp, 0xc
lea ecx, [ebp - 0x4b0]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00402588
add esp, 0xc
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00401f44
mov esp, ebp
pop ebp
ret 8
Function at 0x422bb0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
mov eax, dword [0x43d064]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x444], ecx
cmp dword [ebp + 8], 0
je 0x422bd1
jmp 0x422be4
mov eax, dword [ebp - 0x444]
cmp dword [eax + 0x10], 0
je 0x422be4
xor eax, eax
jmp 0x422e1f
mov ecx, dword [ebp - 0x444]
call fcn.00422980
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x422e1c
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push 0x91
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x94
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
cmp eax, 1
jne 0x422ca9
mov eax, dword [ebp - 8]
add eax, 0x410
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.0040241d
add esp, 8
test eax, eax
jne 0x422c63
mov dword [ebp - 4], 0
jmp 0x422c87
mov dword [ebp - 4], 1
lea edx, [ebp - 0x218]
push edx
push 0x104
mov eax, dword [ebp - 8]
add eax, 0x410
push eax
call fcn.004023ae
add esp, 0xc
lea ecx, [ebp - 0x218]
push ecx
call fcn.00402006
add esp, 4
xor edx, edx
cmp edx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x43c], eax
jmp 0x422d30
lea ecx, [ebp - 0x218]
push ecx
mov ecx, dword [ebp - 0x444]
call fcn.004228d0
mov dword [ebp - 0x43c], eax
mov edx, dword [ebp - 8]
add edx, 0x208
push edx
lea eax, [ebp - 0x218]
push eax
call fcn.0040241d
add esp, 8
test eax, eax
jne 0x422ce7
mov dword [ebp - 4], 0
jmp 0x422d30
cmp dword [ebp - 0x43c], 0
jne 0x422d03
lea ecx, [ebp - 0x218]
push ecx
call fcn.00402006
add esp, 4
test eax, eax
jne 0x422d29
mov dword [ebp - 4], 1
lea edx, [ebp - 0x218]
push edx
push 0x104
mov eax, dword [ebp - 8]
add eax, 0x208
push eax
call fcn.004023ae
add esp, 0xc
jmp 0x422d30
mov dword [ebp - 4], 0
push 0x8f
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x434], eax
push 0
push 0
push 0x1042
mov eax, dword [ebp - 0x434]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0xffffffff
jle 0x422d9d
mov ecx, dword [ebp - 0x440]
push ecx
mov edx, dword [ebp - 0x440]
push edx
push 0x1015
mov eax, dword [ebp - 0x434]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x434]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 0x3c3c]
push eax
lea ecx, [ebp - 0x430]
call fcn.00422430
lea ecx, [ebp - 0x430]
call fcn.00422290
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x43c], 0
je 0x422de4
cmp dword [ebp - 0x438], 0
je 0x422de4
mov dword [ebp - 0x448], 1
jmp 0x422dee
mov dword [ebp - 0x448], 0
mov ecx, dword [ebp - 0x448]
push ecx
push 0x92
mov edx, dword [ebp - 0x444]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
lea ecx, [ebp - 0x430]
call fcn.00422410
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00401f44
mov esp, ebp
pop ebp
ret 4
Function at 0x42d780
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42d848
mov dword [ebp - 0xc], 1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x14]
shl ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 0xc], 0
je 0x42d817
mov edx, dword [ebp + 0x14]
shl edx, 1
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
call fcn.00401f60
add esp, 0xc
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x10]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42d815
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x42d84a
jmp 0x42d848
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x42d848
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x42d84a
xor eax, eax
mov esp, ebp
pop ebp
ret 0x14

Function at 0x42d850
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42d900
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], 4
cmp dword [ebp + 0xc], 0
je 0x42d8cf
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42d8cd
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x42d902
jmp 0x42d900
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x42d900
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x42d902
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42e560
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x43d064]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x424], ecx
mov eax, dword [ebp - 0x424]
mov dword [eax], vtable.CAppLocalesIni.0
push 0x208
push 0
mov ecx, dword [ebp - 0x424]
add ecx, 4
push ecx
call fcn.00401f60
add esp, 0xc
push 0x208
push 0
lea edx, [ebp - 0x210]
push edx
call fcn.00401f60
add esp, 0xc
push 0x104
lea eax, [ebp - 0x418]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
lea ecx, [ebp - 0x418]
push ecx
call fcn.00401070
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42e5fd
lea edx, [ebp - 0x210]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
jmp 0x42e649
lea eax, [ebp - 0x418]
push eax
call fcn.00402006
add esp, 4
mov dword [ebp - 0x41c], eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00402006
add esp, 4
mov dword [ebp - 0x420], eax
mov edx, dword [ebp - 0x41c]
sub edx, dword [ebp - 0x420]
shl edx, 1
push edx
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.00402020
add esp, 0xc
push str.KMSTMNWS.ini
lea edx, [ebp - 0x210]
push edx
push str._s_s
push 0x104
mov eax, dword [ebp - 0x424]
add eax, 4
push eax
call fcn.00402385
add esp, 0x14
mov ecx, dword [ebp - 0x424]
mov dword [ecx + 0x52c], 0xffffffff
mov eax, dword [ebp - 0x424]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00401f44
mov esp, ebp
pop ebp
ret

Function at 0x42e6a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00401000
movzx eax, ax
push eax
movzx ecx, word [ebp + 0xc]
push ecx
push 5
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42e6e8
push 0x409
movzx eax, word [ebp + 0xc]
push eax
push 5
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42e713
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x42e715
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x42e720
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x33c
mov eax, dword [0x43d064]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x33c], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00402006
add esp, 4
cmp eax, 1
jae 0x42e79c
push 0x4398f0
push 0x190
mov ecx, dword [ebp - 0x33c]
add ecx, 0x20c
push ecx
call fcn.004023ae
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x42e78c
mov edx, dword [ebp - 0x33c]
add edx, 0x20c
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004023ae
add esp, 0xc
mov eax, dword [ebp - 0x33c]
add eax, 0x20c
jmp 0x42e938
mov ecx, dword [ebp - 0x33c]
call fcn.0042e310
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp - 0x33c]
call fcn.0042de20
mov dword [ebp - 0xc], eax
push 0x409
mov ecx, dword [ebp - 0x33c]
call fcn.0042de20
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x33c]
add eax, 4
push eax
push 0x190
lea ecx, [ebp - 0x338]
push ecx
push 0x4398f4
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push str._fail_
lea ecx, [ebp - 0x338]
push ecx
call fcn.0040241d
add esp, 8
test eax, eax
jne 0x42e839
mov edx, dword [ebp - 0x33c]
add edx, 4
push edx
push 0x190
lea eax, [ebp - 0x338]
push eax
push 0x439914
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x439918
lea eax, [ebp - 0x338]
push eax
call fcn.00401050
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42e8ea
push 0x190
mov ecx, dword [ebp - 0x33c]
add ecx, 0x20c
push ecx
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x338]
push eax
mov ecx, dword [ebp - 0x33c]
call fcn.0042e230
mov ecx, dword [ebp - 0x33c]
add ecx, 0x20c
push ecx
push 0x190
lea edx, [ebp - 0x338]
push edx
call fcn.004023ae
add esp, 0xc
push str._r_n
lea eax, [ebp - 0x338]
push eax
call fcn.00401050
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42e8e8
push 0x190
mov ecx, dword [ebp - 0x33c]
add ecx, 0x20c
push ecx
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x338]
push eax
mov ecx, dword [ebp - 0x33c]
call fcn.0042e230
jmp 0x42e90b
lea ecx, [ebp - 0x338]
push ecx
push 0x190
mov edx, dword [ebp - 0x33c]
add edx, 0x20c
push edx
call fcn.004023ae
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x42e92d
mov eax, dword [ebp - 0x33c]
add eax, 0x20c
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.004023ae
add esp, 0xc
mov eax, dword [ebp - 0x33c]
add eax, 0x20c
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00401f44
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4067f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x41fa3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x404594
call fcn.00409384
push 4
mov dword [esp + 0x18], 0
call fcn.0040ac36
mov edi, eax
add esp, 4
test edi, edi
je 0x406864
push ebx
call fcn.0040917f
mov dword [edi], eax
call fcn.00408f3e
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00409345
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406858
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.0040936d
pop ebx
jmp 0x406866
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x40b72e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4233dc]
jne 0x40b738
repz ret
jmp fcn.0041283c