joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1534434
Capabilities:
Encode data using base64

Disassembly:
ror dx, 0xef
inc ecx
rol ah, 1
inc ecx
push ebx
inc ecx
add ah, 0x82
dec edx
sub edx, dword [esp + edx - 0x4409058f]
movzx ecx, bp
or dl, 0x1a
inc ecx
neg ah
inc ecx
add ah, 0xb0
dec eax
ror dword [esp + ebx*4 - 0xb0], cl
inc ecx
rol ah, 1
mov esi, 0xe053189
dec eax
sub esi, 0x508c9fbd
jp 0x1453d9f
push ebp
lea esi, [ecx + 0xd]
cmpsd dword [esi], dword es:[edi]
aaa
push edx
push esp
invalid
inc ecx
add ah, 0x9d
inc ecx
ror ah, 1
bswap edx
inc eax
shr ch, 1
dec eax
not eax
inc ecx
neg ah
jmp 0x1439e62
inc dx
or dword [esp + edx - 0x4409058e], ebx
inc ecx
sbb ah, 0x8d
jmp 0xbc5e62
dec esp
mov dword [esp + ebx - 0x2c], ebx
dec eax
sar dword [esp + ebx*8 - 0x160], 0x19
inc esi
mov ecx, dword [edi + edx - 0x44090590]
inc cx
or ebx, 0x80425833
mov ah, 0x14
je 0x1534450
inc edx
xor byte [esp + edx - 0x4409058c], 0xa7
dec eax
lea edx, [ebx*4 - 0x494c72dc]
idiv byte [ebx + 0x148d48a7]
popfd
and al, 0x8d
mov bl, 0xb6
dec eax
lea edi, [edi + ebx*2 - 0x54]
inc cx
inc edi
mov word [esp + ebx - 0x2b], dx
dec edi
lea eax, [eax + edx - 0x44090591]
inc ebp
movzx esp, byte [eax + ebx*2 - 0x58]
inc ebp
xor ah, dh
movsx eax, dl
jmp 0x14c809a

Function at 0x153b335
Capabilities:
Encode data using base64

Disassembly:
dec esi
mov ebx, dword [esp + edi - 0xffae]
call fcn.014529c4
inc ecx
mov ecx, 0xa61f66b5
dec edi
lea esp, [ecx + ecx - 0x71e617f1]
inc ecx
movzx esi, cx
dec ebp
lea eax, [eax + esi - 0x66b9]
inc ecx
mov eax, dword [eax + esi*4 - 0x19ad4]
inc ecx
mov edi, 0x243fbaa1
inc ecx
xor eax, esi
bswap eax
rol eax, 1
inc esp
mov edx, esi
jmp 0xc0718d

Function at 0x15405f9
Capabilities:
Encode data using base64

Disassembly:
xor ebx, eax
sub dx, 0xc72c
jg 0x14a4e1a
jmp 0x1451acc
pop edx
inc ecx
movsx ecx, bx
popfd
inc ecx
pop ecx
inc esp
movzx edi, cx
inc ecx
push edi
call fcn.0153b335
shr bp, 8
sbb esi, 0xe6b8fc1e
inc ecx
push esi
dec esi
lea ecx, [0xbf293d03]
inc cx
dec ecx
xor dword [esp + edx - 0x1ca2], esi
inc ecx
pop esi
shl bl, 0xa2
dec eax
add ebp, ebp
dec eax
arpl si, si
inc ecx
setp cl
dec esp
adc ebp, esi
inc ebp
or cl, cl
inc ecx
jmp ebp
add ebp, eax
rol ecx, cl
shr edx, cl
xor edx, 0xc18721a6
mov edx, dword [edi]
ror byte [esp + 5], cl
xadd word [esp + 2], cx
mov ax, word [edi + 4]
inc ecx
adc byte [esp + 5], 0xa4
add edi, 6
mov word ss:[edx], ax
pop eax
pop edx
jmp ebp
dec ebp
lea eax, [eax + edx*2 - 0x3312be18]
pop edx
inc ecx
movzx ebx, di
inc edi
mov esp, dword [eax + ebx*8 - 0x2f850]
inc ecx
mov edx, 0x3e95988d
call fcn.00bd5d30
ror byte [esp + 3], 7
rol eax, 3
ror dx, 0xe4
shr dx, 0x8d
jbe 0xbe3722
Function at 0x4039c1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x4039d0
pop dword [ebp - 0x4c]
mov eax, 0x41ba236
sub eax, 0x3db6866
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x1d3e9223
sub dword [ebp - 0x5c], 0xceec4cd8
mov dword [ebp - 0x58], 0x10617f3f
add dword [ebp - 0x58], 0x21d1cd06
mov dword [ebp - 0x54], 0x64b6f6c4
sub dword [ebp - 0x54], 0x186ab296
mov dword [ebp - 0x50], 0x83e0cf19
sub dword [ebp - 0x50], 0x83e0cf19
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x52b176c0
sub dword [ebp - 0x5c], 0xde3f0d6a
mov dword [ebp - 0x58], 0x1b67aafc
sub dword [ebp - 0x58], 0xd9fb4987
mov dword [ebp - 0x54], 0x18d01583
sub dword [ebp - 0x54], 0xb560a917
mov dword [ebp - 0x50], 0xeb565e18
sub dword [ebp - 0x50], 0xeb565e18
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xe9c57c10
add eax, 0x167ac478
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x37920
push 0
call eax
mov ecx, 0x9cbd6866
add ecx, 0x6342e309
xor edi, edi
add edi, eax
mov ebx, 0xc5bc0f1e
sub ebx, 0xc57b871e
add ebx, dword [ebp - 0x4c]
mov esi, 0x52fb2818
sub esi, 0x2a4198e5
add dword [ebp - 0x44], 0x7532c6de
mov edx, dword [ebx]
xor dword [ebp - 0x38], 0x599fc889
xor edx, esi
mov dword [edi], edx
sub dword [ebp - 0x30], edx
add edi, 4
add ebx, 4
loop 0x403aef
add eax, 0x1208f
xor ebx, ebx
add ebx, eax
add eax, 0x4c6bb699
add eax, 0xb394496c
mov ecx, 0xfe1bf26a
add ecx, 0x2240d96
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
push esi
xor esi, esi
inc esi
cmp dword [esp + 8], esi
jle 0x40102c
mov eax, dword [esp + 0xc]
push 0x51d53c
push dword [eax + esi*4]
call sub.MSVCR80.dll_strcmp
test eax, eax
pop ecx
pop ecx
je 0x40112f
inc esi
cmp esi, dword [esp + 8]
jl 0x40100a
push ebx
push edi
push 0x58a25c
push 0x589fe0
push 0
push 0
call fcn.0048c2b0
push dword [0x527008]
mov esi, eax
push section..data
push dword [0x58a25c]
call fcn.0048bcb0
mov ebx, dword [sym.imp.MSVCR80.dll_printf]
add esp, 0x1c
test esi, esi
mov edi, eax
jne 0x40106c
test edi, edi
je 0x401088
push str.Composite_Hostid_FAILED_to_initialize
push dword [0x58a25c]
call fcn.0048b8d0
push edi
push esi
push str._n_d___d_n
call ebx
add esp, 0x14
push ebp
mov edi, 0x5425a0
push edi
push 2
push dword [0x58a25c]
call fcn.0048b170
mov esi, 0x5415a0
push esi
push 0xffffffffffffffff
push dword [0x58a25c]
mov ebp, eax
call fcn.0048b170
push esi
push edi
mov dword [esp + 0x34], eax
call sub.MSVCR80.dll_strcmp
add esp, 0x20
test eax, eax
jne 0x4010cd
test ebp, ebp
jne 0x4010cd
cmp dword [esp + 0x14], ebp
je 0x4010e5
push str.Error_retrieving_composite_hostid.__SNH__n
call ebx
push dword [esp + 0x18]
push ebp
push esi
push edi
push str.__s_____s_____d_____d___n
call ebx
add esp, 0x18
push edi
push dword [section..data]
push dword [0x58a25c]
call fcn.0048b170
push esi
push dword [0x527004]
push dword [0x58a25c]
call fcn.0048b170
mov esi, 0x5435a0
push esi
push 0x1f
push dword [0x58a25c]
call fcn.0048b170
add esp, 0x24
test eax, eax
pop ebp
jne 0x401143
push esi
push str.The_UGS_Licensing_composite_hostid_is_:_n__s__n
call ebx
pop ecx
jmp 0x40114e
push str.Siemens_PLM_Composite_HostID_Tool_v._3.0_n
call dword [sym.imp.MSVCR80.dll_printf]
pop ecx
push 0
call dword [sym.imp.MSVCR80.dll_exit]
push dword [0x58a25c]
call fcn.0048ad80
pop ecx
push dword [0x58a25c]
call fcn.0048a040
mov dword [esp], str.Press_the_ENTER_key_to_continue..._n
call ebx
pop ecx
call dword [sym.imp.MSVCR80.dll_getchar]
push 0
call dword [sym.imp.MSVCR80.dll_exit]
pop edi
pop ebx
Function at 0x401207
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, 0x3900
mov edi, 0xb359
mov esi, 0xceb2
mov dword [ebp - 0xc], 5
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
movzx eax, word [eax]
push eax
push 0x5445a0
call fcn.00413b50
movzx eax, ax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
cmp word [eax], 1
jne 0x401268
lea eax, [ebp - 4]
push eax
push 8
push 0x5445a0
call fcn.00413b50
cmp word [ebp - 4], 0
je 0x401268
movzx eax, word [ebp - 4]
mov dword [ebp - 8], eax
or ecx, 0xffffffff
lea eax, [ecx + edi]
xor eax, ebx
inc eax
sub eax, ecx
mov edx, eax
xor edx, ebx
dec edx
lea edi, [ecx + esi]
xor edi, edx
inc edi
lea esi, [ecx + edx]
xor esi, edi
xor eax, edi
inc esi
dec eax
lea ebx, [ecx + esi]
mov edi, eax
xor ebx, edi
inc ecx
cmp ecx, 3
jl 0x40126b
lea esi, [ecx + ebx]
xor esi, edi
cmp word [ebp - 0x10], 0
jne 0x4012b9
mov eax, dword [ebp + 0xc]
mov cx, word [ebp - 8]
mov ebx, 0x3900
mov edi, 0xb359
mov word [eax], cx
mov esi, 0xceb2
dec dword [ebp - 0xc]
jne 0x401226
cmp word [ebp - 0x10], 0
pop edi
pop esi
pop ebx
je 0x4012de
push 0x5445a0
call fcn.00414040
movzx eax, ax
mov dword [0x5449a4], eax
xor eax, eax
leave
ret

Function at 0x40df90
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
push esi
mov esi, dword [esp + 0x50]
mov bx, word [esp + 0x4c]
cmp bx, 4
mov word [esi], 0
jbe 0x40dfb3
sub al, al
pop esi
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x38]
push 0x10
push eax
call fcn.0040dbf0
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.0040dc50
lea eax, [esp + 0x18]
push 0x10
push eax
call fcn.0040dd10
lea eax, [esp + 0x18]
push eax
call fcn.0040d5f0
add bl, 0x31
and eax, 0xffff
mov byte [esp + eax + 0x18], bl
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0xc]
push 0x10
push eax
lea eax, [esp + 0x24]
push 0x40df80
push eax
lea eax, [esp + 0x3c]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
or eax, eax
je 0x40e064
lea eax, [esp + 8]
push 0x2c
push eax
call fcn.0040df60
or ax, ax
je 0x40e02c
and eax, 0xffff
mov byte [esp + eax + 8], 0
cmp byte [esp + 8], 0x30
jne 0x40e050
mov al, byte [esp + 9]
and al, 0xdf
cmp al, 0x58
jne 0x40e050
lea eax, [esp + 0xa]
push esi
push eax
call fcn.0040d700
or al, al
jne 0x40e064
jmp 0x40e05f
lea eax, [esp + 8]
push esi
push eax
call fcn.0040d650
or al, al
jne 0x40e064
mov word [esi], 0
mov ax, word [esi]
or ax, ax
je 0x40e07c
cmp ax, 0xffff
je 0x40e07c
mov al, 1
pop esi
pop ebx
add esp, 0x40
ret 8
sub al, al
pop esi
pop ebx
add esp, 0x40
ret 8
Function at 0x40e0a0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
push esi
mov esi, dword [esp + 0x50]
mov bx, word [esp + 0x4c]
cmp bx, 4
mov word [esi], 0
jbe 0x40e0c3
sub al, al
pop esi
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x38]
push 0x10
push eax
call fcn.0040dbf0
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.0040dc50
lea eax, [esp + 0x18]
push 0x10
push eax
call fcn.0040dd10
lea eax, [esp + 0x18]
push eax
call fcn.0040d5f0
add bl, 0x31
and eax, 0xffff
mov byte [esp + eax + 0x18], bl
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0xc]
push 0x10
push eax
lea eax, [esp + 0x24]
push 0x40e090
push eax
lea eax, [esp + 0x3c]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
or eax, eax
je 0x40e174
lea eax, [esp + 8]
push 0x2c
push eax
call fcn.0040df60
or ax, ax
je 0x40e174
and eax, 0xffff
mov cl, byte [esp + eax + 9]
and cl, 0xdf
cmp cl, 0x54
jne 0x40e174
cmp byte [esp + eax + 0xa], 0x3a
jne 0x40e174
push esi
lea eax, [esp + eax + 0xf]
push eax
call fcn.0040d650
or al, al
jne 0x40e160
jmp 0x40e16f
mov ax, word [esi]
cmp ax, 1
jl 0x40e16f
cmp ax, 6
jle 0x40e174
mov word [esi], 0
cmp word [esi], 1
sbb al, al
inc al
pop esi
pop ebx
add esp, 0x40
ret 8

Function at 0x40e1a0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x50
push esi
lea eax, [esp + 0x44]
push 0x10
push eax
call fcn.0040dbf0
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.0040dc50
lea eax, [esp + 0x34]
push 0x10
push eax
call fcn.0040de00
lea eax, [esp + 4]
push 0x10
push eax
call fcn.0040ddb0
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x18]
push 0x10
push eax
lea eax, [esp + 0x40]
push 0x40e190
push eax
lea eax, [esp + 0x38]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
mov esi, eax
or esi, esi
je 0x40e20f
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 8]
push eax
call fcn.0040d480
mov ecx, dword [esp + 0x5c]
mov byte [ecx], al
cmp esi, 1
sbb al, al
inc al
pop esi
add esp, 0x50
ret 8

Function at 0x40e220
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x30
lea eax, [esp + 0x20]
push 0x10
push eax
call fcn.0040dbf0
lea eax, [esp]
push 0x10
push eax
call fcn.0040dc50
lea eax, [esp + 0x10]
push 0x10
push eax
call fcn.0040dd60
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x14]
push 0
push eax
lea eax, [esp + 0xc]
push eax
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov ecx, dword [esp + 0x34]
cmp eax, 1
mov word [ecx], ax
sbb cl, cl
inc cl
mov al, cl
add esp, 0x30
ret 4
Function at 0x40e290
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x70
push esi
mov esi, dword [esp + 0x78]
push 0x10
mov word [esi], 0
lea eax, [esp + 8]
push 0
push eax
call fcn.0040d610
lea eax, [esp + 0x64]
push 0x10
push eax
call fcn.0040dbf0
lea eax, [esp + 0x44]
push 0x10
push eax
call fcn.0040dc50
lea eax, [esp + 0x54]
push 0x10
push eax
call fcn.0040dcb0
lea eax, [esp + 0x34]
push 0x10
push eax
call fcn.0040de60
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.0040df10
lea eax, [esp + 0x14]
push 0x10
push eax
call fcn.0040dec0
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 8]
push 0x10
push eax
lea eax, [esp + 0x60]
push 0x40e280
push eax
lea eax, [esp + 0x58]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
or eax, eax
je 0x40e363
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 8]
push eax
call fcn.0040d480
or al, al
je 0x40e331
mov word [esi], 2
jmp 0x40e363
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 8]
push eax
call fcn.0040d480
or al, al
je 0x40e34b
mov word [esi], 3
jmp 0x40e363
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 8]
push eax
call fcn.0040d480
or al, al
je 0x40e363
mov word [esi], 1
cmp word [esi], 1
sbb al, al
inc al
pop esi
add esp, 0x70
ret 4
Function at 0x40e550
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 4
push ebx
push esi
push edi
push ebp
mov esi, dword [esp + 0x18]
mov byte [esp + 0x13], 0
lea eax, [esi + 4]
mov edi, dword [esp + 0x1c]
mov dword [esi], eax
mov ax, word [edi + 4]
mov word [esi + 4], ax
mov ax, word [edi + 0xa]
mov word [esi + 6], ax
mov ax, word [edi + 0x14]
mov word [esi + 0x16], ax
mov ax, word [edi + 8]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
lea eax, [esi + 0x24]
mov dword [esi + 0x10], eax
lea eax, [esi + 4]
push eax
call fcn.0040e450
or al, al
jne 0x40e6da
test byte [edi + 0x1c], 4
je 0x40e5b3
mov byte [esp + 0x13], 1
sub cx, cx
sub dx, dx
lea esp, [esp]
mov ebp, ecx
and ebp, 0xffff
lea eax, [ebp*8]
sub eax, ebp
shl eax, 2
lea eax, [eax + eax*4]
lea ebx, [esi + eax]
lea eax, [ebp*4]
mov word [ebx + 0x36], cx
lea eax, [eax + eax*8]
lea ebp, [edi + eax]
mov ax, word [ebp + 0xe]
mov word [ebx + 0x9c], ax
mov ax, word [ebp + 0x12]
mov word [ebx + 0x8e], ax
mov ax, word [ebp + 0x16]
mov word [ebx + 0x34], ax
mov ax, word [ebp + 0x18]
mov word [ebx + 0x32], ax
mov eax, dword [ebp + 0x1c]
mov dword [ebx + 0x2c], eax
cmp cx, 3
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0x24]
mov dword [ebx + 0x28], eax
lea eax, [esi + 4]
mov dword [ebx + 0xa4], eax
jne 0x40e640
mov dword [ebx + 0xa8], 0
jmp 0x40e64c
lea eax, [ebx + 0xb0]
mov dword [ebx + 0xa8], eax
or cx, cx
jne 0x40e660
mov dword [ebx + 0xac], 0
jmp 0x40e669
lea eax, [ebx - 0x68]
mov dword [ebx + 0xac], eax
cmp byte [esp + 0x13], 0
je 0x40e680
cmp word [ebp + 0xe], 0xffff
jne 0x40e680
or dword [ebx + 0x2c], 8
jmp 0x40e686
mov word [ebx + 0x36], dx
inc dx
inc cx
cmp cx, 4
jb 0x40e5c0
push esi
call fcn.0040e4c0
push esi
call fcn.0040e400
push esi
call fcn.0040e3c0
mov eax, dword [esi + 0x10]
push eax
call fcn.0040f880
mov word [esi + 0xc], ax
or ax, ax
je 0x40e6d0
lea eax, [esi + 4]
push eax
call fcn.0040f6d0
sub ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 8
push esi
call fcn.0040e390
mov ax, 9
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 8

Function at 0x4107d0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push esi
push edi
lea eax, [esp + 0xa]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
push eax
push esi
call fcn.0040e6f0
mov eax, dword [esp + 0xc]
push 0xd
mov ax, word [eax + 4]
push eax
call fcn.00410300
or al, al
jne 0x41085a
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.004110f0
or al, al
jne 0x41085a
mov eax, dword [esp + 0xc]
mov ax, word [eax + 0xa]
push eax
mov eax, dword [esp + 0x10]
mov al, byte [eax + 8]
push eax
mov eax, dword [esp + 0x14]
mov ax, word [eax + 6]
push eax
mov eax, dword [esp + 0x18]
mov ax, word [eax + 4]
push eax
mov eax, dword [esp + 0x20]
push eax
push esi
call fcn.00410fb0
mov di, ax
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.00411140
or di, di
je 0x41085a
mov ax, di
pop edi
pop esi
add esp, 0xc
ret 8
Function at 0x410900
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [esp + 0xe]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
mov edi, dword [esp + 0x28]
push eax
mov esi, dword [esp + 0x28]
push edi
push esi
call fcn.0040e6f0
lea eax, [esp + 0xe]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push edi
push esi
call fcn.0040e6f0
mov eax, dword [esp + 0x10]
push 0xe
mov ax, word [eax + 4]
push eax
call fcn.00410300
or al, al
jne 0x4109e3
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.004110f0
mov bx, ax
or bl, bl
jne 0x4109b2
mov eax, dword [esp + 0x10]
mov ax, word [eax + 0xe]
push eax
mov eax, dword [esp + 0x14]
mov ax, word [eax + 0xc]
push eax
mov eax, dword [esp + 0x18]
mov ax, word [eax + 0xa]
push eax
mov eax, dword [esp + 0x1c]
mov al, byte [eax + 8]
push eax
mov eax, dword [esp + 0x20]
mov ax, word [eax + 6]
push eax
mov eax, dword [esp + 0x24]
mov ax, word [eax + 4]
push eax
mov eax, dword [esp + 0x2c]
push eax
push esi
call fcn.00411000
mov bx, ax
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.00411140
push esi
call fcn.0040e800
cmp ax, 0xd
jne 0x4109c2
mov bx, 0xd
cmp bl, 0xd
je 0x4109cd
cmp bx, 3
jne 0x4109e0
mov ax, word [esp + 0xe]
dec word [esp + 0xe]
or ax, ax
jne 0x410952
mov ax, bx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8

Function at 0x412790
Capabilities:
Check if file exists

Disassembly:
sub esp, 0xc
push esi
mov byte [esp + 4], 0x52
mov byte [esp + 5], 0x4e
mov byte [esp + 6], 0x42
mov byte [esp + 7], 0x4f
mov byte [esp + 8], 0x44
mov byte [esp + 9], 0x52
mov byte [esp + 0xa], 0x56
mov ax, word [esp + 0x18]
add al, 0x30
mov byte [esp + 0xb], al
mov esi, dword [esp + 0x14]
mov byte [esp + 0xc], 0
mov dword [esi], 0
push 0
push 0x80
push 3
push 0
push 3
lea eax, [esp + 0x18]
push 0xc0000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x412826
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jb 0x412803
cmp eax, 3
jbe 0x41281b
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x412810
push eax
call sub.KERNEL32.dll_CloseHandle
mov ax, 0x80b
pop esi
add esp, 0xc
ret 8
mov ax, 0x80c
pop esi
add esp, 0xc
ret 8
mov ax, 0x800
pop esi
add esp, 0xc
ret 8

Function at 0x412840
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 4
push ebx
push esi
push edi
mov esi, dword [esp + 0x18]
push esi
mov word [esi + 6], 0xffff
call fcn.00412730
lea eax, [esp + 0xc]
push 0
push eax
xor eax, eax
mov ax, word [esi + 2]
push eax
mov edi, dword [esp + 0x20]
push esi
mov eax, dword [edi]
push eax
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
or ebx, ebx
je 0x412890
lea eax, [esp + 0xc]
push 0
push eax
xor eax, eax
mov ax, word [esi + 2]
push eax
push esi
mov eax, dword [edi]
push eax
call sub.KERNEL32.dll_ReadFile
mov ebx, eax
push esi
call fcn.004126f0
or ebx, ebx
je 0x4128a2
cmp word [esi + 6], 0xffff
jne 0x4128a8
mov word [esi + 6], 0x83b
mov ax, word [esi + 6]
pop edi
pop esi
pop ebx
add esp, 4
ret 8
Function at 0x4129d0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x10
push esi
mov al, byte [esp + 0x1c]
push eax
lea eax, [esp + 8]
push eax
call fcn.00412990
push 0
push 0x80
push 3
push 0
push 3
lea eax, [esp + 0x18]
push 0xc0000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov esi, dword [esp + 0x18]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x412a40
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jb 0x412a19
cmp eax, 3
jbe 0x412a31
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x412a26
push eax
call sub.KERNEL32.dll_CloseHandle
mov ax, 0x20b
pop esi
add esp, 0x10
ret 8
mov ax, 0x20c
pop esi
add esp, 0x10
ret 8
mov ax, 0x200
pop esi
add esp, 0x10
ret 8

Function at 0x412a50
Capabilities:
Check if file exists
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
mov byte [esp + 4], 0x5c
mov byte [esp + 5], 0x5c
mov byte [esp + 6], 0x2e
mov byte [esp + 7], 0x5c
mov byte [esp + 8], 0x53
mov byte [esp + 9], 0x6e
mov byte [esp + 0xa], 0x74
mov byte [esp + 0xb], 0x6e
mov byte [esp + 0xc], 0x6c
mov byte [esp + 0xd], 0x55
mov byte [esp + 0xe], 0x73
mov byte [esp + 0xf], 0x62
mov byte [esp + 0x10], 0
push 0
push 0x80
push 3
push 0
push 3
lea eax, [esp + 0x18]
push 0xc0000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov esi, dword [esp + 0x18]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x412af0
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jb 0x412acb
cmp eax, 3
jbe 0x412ae3
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x412ad8
push eax
call sub.KERNEL32.dll_CloseHandle
mov ax, 0x20b
pop esi
add esp, 0x10
ret 8
mov ax, 0x20c
pop esi
add esp, 0x10
ret 8
mov ax, 0x200
pop esi
add esp, 0x10
ret 8

Function at 0x412b10
Capabilities:
Read file on windows

Disassembly:
sub esp, 4
push esi
push edi
mov esi, dword [esp + 0x14]
push esi
mov word [esi + 6], 0xffff
call fcn.00412730
lea eax, [esp + 8]
push 0
push eax
xor eax, eax
mov ax, word [esi + 2]
push eax
mov eax, dword [esp + 0x1c]
push esi
mov eax, dword [eax]
push eax
call sub.KERNEL32.dll_ReadFile
mov edi, eax
push esi
call fcn.004126f0
cmp edi, 1
jne 0x412b55
cmp word [esi + 6], 0xffff
jne 0x412b5b
mov word [esi + 6], 0x23b
mov ax, word [esi + 6]
pop edi
pop esi
add esp, 4
ret 8
Function at 0x412d10
Capabilities:
Contain obfuscated stackstrings
Read .ini file

Disassembly:
sub esp, 0x24
mov byte [esp + 8], 0x53
mov byte [esp + 9], 0x59
mov byte [esp + 0xa], 0x53
mov byte [esp + 0xb], 0x54
mov byte [esp + 0xc], 0x45
mov byte [esp + 0xd], 0x4d
mov byte [esp + 0xe], 0x2e
mov byte [esp + 0xf], 0x49
mov byte [esp + 0x10], 0x4e
mov byte [esp + 0x11], 0x49
mov byte [esp + 0x12], 0
mov byte [esp + 0x14], 0x53
mov byte [esp + 0x15], 0x65
mov byte [esp + 0x16], 0x6e
mov byte [esp + 0x17], 0x74
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], 0x6e
mov byte [esp + 0x1a], 0x65
mov byte [esp + 0x1b], 0x6c
mov byte [esp + 0x1c], 0x53
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x74
mov byte [esp + 0x1f], 0x75
mov byte [esp + 0x20], 0x70
mov byte [esp + 0x21], 0
mov byte [esp], 0x49
mov byte [esp + 1], 0x6f
lea eax, [esp + 8]
mov byte [esp + 2], 0x45
mov byte [esp + 3], 0x6e
mov byte [esp + 4], 0x74
mov byte [esp + 5], 0x72
mov byte [esp + 6], 0x79
mov byte [esp + 7], 0
push eax
lea eax, [esp + 4]
push 0
push eax
lea eax, [esp + 0x20]
push eax
call sub.KERNEL32.dll_GetPrivateProfileIntA
add esp, 0x24
ret
Function at 0x415ca3
Capabilities:
Encode data using base64

Disassembly:
pop dword [esp - 4]
jno 0x439f44
shl cl, 0x20
jo 0x415cb5
invalid
jo 0x439f44
or byte [edi], 0x8d
inc ebp
cld
push 0
jmp 0x415cc3
push eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
push 6
push ecx
lea edx, [ebp - 0xc]
push 0x447ee5
ret
push esi
ja 0x41fb77
xchg bl, ch
xchg ch, bl
jbe 0x439f53
jecxz 0x439fba
xchg bx, di
xchg ebx, edi
xchg di, bx
mov esi, dword [ebp + 8]
shl dx, 0x20
mov ebp, ebp
jmp fcn.0042e105
add byte [eax - 0x627df0fe], ch
retf 0

Function at 0x418911
Capabilities:
Check os version
Encode data using base64

Disassembly:
pop dword [esp - 4]
mov eax, dword [0x534071]
test eax, eax
jb 0x448773
xchg dl, dh
xchg dh, dl
jne 0x449abb
je 0x418931
fadd st(0), st(0)
std
call fcn.00430a77
test eax, eax
jb 0x42f951
xchg bx, di
xchg di, bx
jne 0x449abb
je 0x41894f
js 0x418993
adc eax, 0x89665e5f
rcr byte [ebx + 0x5d], 0xc3
ret 0xf1d
pop edi
pop esi
mov ax, ax
pop ebx
pop ebp
ret
mov ebp, dword [esi + 0x61000043]
add byte [eax + 0x38], al
add byte [ecx], ah
add byte [eax], al
mov esp, 0
adc byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
xor byte [eax], al
add byte [eax], al
or byte [edi], ch
inc esp
add dh, dl
enter 0x43, 0x30
add byte [eax], al
add byte [eax + eax], dh
add byte [eax], al
adc al, 0x87
inc edx
add byte [eax], ah
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [edi + eax*4], dl
inc edx
add byte [eax + eax], cl
add byte [eax], al
xor al, 0
add byte [eax], al
outsb dx, byte [esi]
rol byte [ebx], cl
xor al, 0
add byte [eax], al
cmp byte [eax], al
add byte [eax], al
outsb dx, byte [esi]
rol byte [ebx], cl
cmp byte [eax], al
add byte [eax], al
xor al, 0
add byte [eax], al
and esi, edi
inc edx
add byte [eax], cl
mov ah, 0x42
add byte [edx + 0x50044bc], dh
mov al, byte [ecx]
pop esp
ret
add eax, 0xff5e8d57