joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404380
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
cmp eax, 1
push ebx
push esi
push edi
jne 0x4043aa
mov ecx, 7
mov esi, str.Itasca_Consulting_Group__Inc.
mov edi, section..bss
mov ebx, dword [str.Customer1]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x4043c2
mov ecx, 5
mov esi, str.Minneapolis__MN__USA
mov edi, section..bss
mov ebx, dword [str.Customer2]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x14]
push eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push ecx
push 0
push 0xf003f
push 0
push str.Goober
push 0
push str.Software
push 0x80000001
call esi
test eax, eax
jne 0x4044b3
lea edx, [esp + 0x20]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0xf003f
push 0
push str.Goober
push 0
push str.Itasca
push ecx
call esi
test eax, eax
jne 0x4044b3
lea edx, [esp + 0x20]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push 0xf003f
push 0
push str.Goober
push 0
push str.UDEC400
push ecx
call esi
test eax, eax
jne 0x4044b3
cmp dword [esp + 0x20], 1
je 0x404486
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x1c]
push section..bss
push eax
push 0
push ebx
push ecx
mov dword [esp + 0x38], 0xa0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4044b3
mov edx, dword [esp + 0x24]
mov dword [edx], eax
jmp 0x404490
mov eax, dword [esp + 0x24]
mov dword [eax], 1
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call esi
test eax, eax
jne 0x4044b3
mov edx, dword [esp + 0x10]
push edx
call esi
test eax, eax
jne 0x4044b3
mov eax, dword [esp + 0x14]
push eax
call esi
pop edi
pop esi
mov eax, section..bss
pop ebx
add esp, 0x10
ret

Function at 0x4046c0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
lea ecx, [esp + 0xc]
push esi
push eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push ecx
push 0
push 0xf003f
push 0
push str.Goober
push 0
push str.Software
push 0x80000001
call esi
test eax, eax
jne 0x404799
lea edx, [esp + 4]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push 0xf003f
push 0
push str.Goober
push 0
push str.Itasca
push ecx
call esi
test eax, eax
jne 0x404799
lea edx, [esp + 4]
mov ecx, dword [esp + 0xc]
lea eax, [esp + 8]
push edx
push eax
push 0
push 0xf003f
push 0
push str.Goober
push 0
push str.UDEC400
push ecx
call esi
test eax, eax
jne 0x404799
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 8]
push 0xdc
push edx
push 3
push eax
mov eax, dword [0x6c0020]
mov dword [esp + 0x14], 0xdc
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x404799
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
test eax, eax
jne 0x404799
mov eax, dword [esp + 0xc]
push eax
call esi
test eax, eax
jne 0x404799
mov ecx, dword [esp + 0x10]
push ecx
call esi
pop esi
add esp, 0x10
ret
Function at 0x404c40
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [esp + 4]
push 0x40
push 0x1000
mov eax, dword [eax]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
ret

Function at 0x404ee0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
lea eax, [esp]
lea ecx, [esp + 0xc]
push esi
push eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push ecx
push 0
push 0xf003f
push 0
push str.Goober
push 0
push str.Software
push 0x80000001
call esi
test eax, eax
je 0x404f1b
xor eax, eax
pop esi
add esp, 0x14
ret
lea edx, [esp + 4]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push 0xf003f
push 0
push str.Goober
push 0
push str.Itasca
push ecx
call esi
test eax, eax
je 0x404f4c
xor eax, eax
pop esi
add esp, 0x14
ret
lea edx, [esp + 4]
mov ecx, dword [esp + 0xc]
lea eax, [esp + 8]
push edx
push eax
push 0
push 0xf003f
push 0
push str.Goober
push 0
push str.UDEC400
push ecx
call esi
test eax, eax
je 0x404f7d
xor eax, eax
pop esi
add esp, 0x14
ret
cmp dword [esp + 4], 1
je 0x404fb8
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
lea eax, [esp + 4]
mov dword [esp + 4], edx
push eax
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x404fb8
xor eax, eax
pop esi
add esp, 0x14
ret
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
test eax, eax
je 0x404fd0
xor eax, eax
pop esi
add esp, 0x14
ret
mov eax, dword [esp + 0xc]
push eax
call esi
test eax, eax
je 0x404fe2
xor eax, eax
pop esi
add esp, 0x14
ret
mov ecx, dword [esp + 0x10]
push ecx
call esi
neg eax
sbb eax, eax
pop esi
inc eax
add esp, 0x14
ret
Function at 0x414860
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
test esi, esi
jbe 0x41488e
mov ecx, dword [esp + 8]
push ebx
push edi
mov edi, dword [str.2l41_90873rjfncvzxhfw0a897309842poias_mnvzx_klcjhvpasd89f7q_ldosasdflij298471oijaspojfzxcnvxmnbz_kasjhdfqpow7183uhfadfhak_sieoiu]
mov bl, byte [eax + ecx]
mov edx, eax
and edx, 0x7f
mov dl, byte [edx + edi]
xor bl, dl
mov byte [eax + ecx], bl
inc eax
cmp eax, esi
jb 0x414871
pop edi
pop ebx
pop esi
ret 8
Function at 0x414e50
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, dword [0x64948c]
sub esp, 0x560
push esi
push edi
xor edi, edi
cmp eax, edi
je 0x415085
cmp dword [0x6494e8], edi
je 0x414ee2
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
mov esi, eax
mov dword [0x64948c], edi
cmp esi, edi
je 0x415085
push edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x414ea1
push esi
call dword [sym.imp.GDI32.dll_DeleteEnhMetaFile]
pop edi
pop esi
add esp, 0x560
ret
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
push esi
jne 0x414ebb
call dword [sym.imp.GDI32.dll_DeleteEnhMetaFile]
pop edi
pop esi
add esp, 0x560
ret
push 0xe
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x414ed7
push esi
call dword [sym.imp.GDI32.dll_DeleteEnhMetaFile]
pop edi
pop esi
add esp, 0x560
ret
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x414fc8
cmp dword [0x6494ec], edi
je 0x414f03
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
push eax
mov dword [0x64948c], edi
call dword [sym.imp.GDI32.dll_DeleteEnhMetaFile]
jmp 0x414fc8
mov ecx, dword [0x6494f0]
push eax
cmp ecx, edi
je 0x414f9b
call sub.LTKRN11n.dll_Ordinal_120
lea eax, [esp + 8]
mov dword [0x64948c], edi
push eax
call sub.LTFIL11n.DLL_Ordinal_106
mov eax, dword [0x6494f8]
mov dword [esp + 0x18], edi
cmp eax, edi
je 0x414f4d
lea ecx, [esp + 8]
push ecx
push 0x32
push edi
push 0x54
push 0x6493f0
push 0x649334
call sub.LTFIL11n.DLL_Ordinal_103
cmp dword [0x6494f4], edi
je 0x414f6e
lea edx, [esp + 8]
push edx
push 0x32
push edi
push 1
push 0x6493f0
push 0x649334
call sub.LTFIL11n.DLL_Ordinal_103
cmp dword [0x6494fc], edi
je 0x414f8f
lea eax, [esp + 8]
push eax
push 2
push edi
push 0xa
push 0x6493f0
push 0x649334
call sub.LTFIL11n.DLL_Ordinal_103
push 0x6493f0
call sub.LTKRN11n.dll_Ordinal_125
jmp 0x414fc8
call dword [sym.imp.GDI32.dll_EndPage]
test eax, eax
jg 0x414fbb
mov ecx, dword [0x64948c]
push ecx
call dword [sym.imp.GDI32.dll_DeleteDC]
pop edi
pop esi
add esp, 0x560
ret
mov edx, dword [0x64948c]
push edx
call dword [sym.imp.GDI32.dll_EndDoc]
mov eax, dword [0x649494]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
cmp eax, edi
je 0x414ff6
mov eax, dword [0x649490]
mov ecx, dword [0x64948c]
push eax
push ecx
call ebx
mov edx, dword [0x649494]
push edx
call esi
mov eax, dword [0x64949c]
mov dword [0x649490], edi
cmp eax, edi
mov dword [0x649494], edi
je 0x415023
mov eax, dword [0x649498]
mov ecx, dword [0x64948c]
push eax
push ecx
call ebx
mov edx, dword [0x64949c]
push edx
call esi
mov eax, dword [0x6494a4]
mov dword [0x649498], edi
cmp eax, edi
mov dword [0x64949c], edi
je 0x415050
mov eax, dword [0x6494a0]
mov ecx, dword [0x64948c]
push eax
push ecx
call ebx
mov edx, dword [0x6494a4]
push edx
call esi
mov eax, dword [0x6494a8]
mov dword [0x6494a0], edi
cmp eax, edi
mov dword [0x6494a4], edi
pop ebx
je 0x415069
push eax
call esi
mov eax, dword [0x64948c]
mov dword [0x6494a8], edi
cmp eax, edi
je 0x41507f
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov dword [0x64948c], edi
pop edi
pop esi
add esp, 0x560
ret
Function at 0x41c4b0
Capabilities:
Terminate process

Disassembly:
push ecx
mov al, byte [0x64974d]
test al, al
je 0x41c4db
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x62
call fcn.00418c00
add esp, 4
call fcn.00418c30
mov byte [0x64974d], 0
push ebp
push esi
push edi
call fcn.0041c930
test eax, eax
je 0x41c580
mov cl, byte [0x64974c]
xor eax, eax
test cl, cl
mov dword [esp + 0xc], 1
jne 0x41c56d
mov ebp, dword [esp + 0x14]
call fcn.0041a1f0
push 0x5a
call fcn.00418c00
add esp, 4
call fcn.00418c30
lea eax, [esp + 0xc]
push eax
call fcn.0041c610
add esp, 4
test eax, eax
jne 0x41c517
call fcn.0041c930
test eax, eax
je 0x41c579
mov al, byte [0x64974c]
test al, al
je 0x41c503
mov edi, 0x649678
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, ecx
test eax, eax
jle 0x41c563
mov esi, 0x649678
mov edx, ebp
sub esi, ebp
mov edi, eax
mov cl, byte [esi + edx]
mov byte [edx], cl
inc edx
dec edi
jne 0x41c55a
mov cl, byte [0x64974c]
test cl, cl
je 0x41c503
pop edi
pop esi
mov byte [0x64974c], 0
pop ebp
pop ecx
ret
push 0
call fcn.00615015
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
Function at 0x41c610
Capabilities:
Set current directory

Disassembly:
call fcn.0041c930
test eax, eax
je case.0x41c64c.0
mov eax, dword [esp + 4]
cmp dword [eax], 0
jne 0x41c633
call fcn.00417550
test eax, eax
je case.0x41c64c.0
call fcn.00418da0
movsx eax, al
cmp eax, 0x63
ja case.0x41c64c.7
xor ecx, ecx
mov cl, byte [eax + 0x41c84c]
jmp dword [ecx*4 + 0x41c82c]
mov eax, 1
ret
call fcn.00418da0
movsx eax, al
dec eax
je 0x41c697
sub eax, 2
je 0x41c67c
sub eax, 0x60
jne case.0x41c64c.0
mov byte [0x64974d], 1
xor eax, eax
ret
push 0x649678
call fcn.00418e10
add esp, 4
push 0x649678
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
xor eax, eax
ret
push 0x649678
call fcn.00418e10
add esp, 4
mov byte [0x64974c], 1
xor eax, eax
ret
push ebx
call fcn.00418da0
test al, al
jne 0x41c6c4
mov eax, 1
mov ebx, 5
jmp 0x41c6c9
movsx eax, al
mov ebx, eax
cmp eax, ebx
jg 0x41c7c6
push esi
push edi
lea edi, [eax - 1]
cmp edi, 4
ja case.default.0x41c6df
jmp dword [edi*4 + 0x41c8b0]
push 7
call fcn.00418c00
push 1
call fcn.00418c00
call fcn.00419dc0
mov esi, eax
call fcn.00418e30
call fcn.00419d10
push esi
call fcn.00419fc0
call fcn.00419470
call fcn.00419520
call fcn.004190f0
call fcn.00418f60
call fcn.00419030
push 0x574014
call fcn.00418c40
add esp, 0x10
jmp case.default.0x41c6df
push 7
call fcn.00418c00
push 2
call fcn.00418c00
call fcn.004196c0
call fcn.00419640
call fcn.00419730
call fcn.004197e0
call fcn.00419860
call fcn.004198e0
call fcn.00419a80
call fcn.00419af0
call fcn.00419bd0
jmp 0x41c7ab
push 7
call fcn.00418c00
push 3
call fcn.00418c00
call fcn.0041a0f0
jmp 0x41c7ab
push 7
call fcn.00418c00
push 4
call fcn.00418c00
call fcn.0041a140
jmp 0x41c7ab
push 7
call fcn.00418c00
push 5
call fcn.00418c00
push 0x574014
call fcn.00418c40
add esp, 0xc
inc edi
lea edx, [edi + 1]
cmp edx, ebx
jle 0x41c6d6
pop edi
pop esi
push 7
call fcn.00418c00
push 6
call fcn.00418c00
add esp, 8
call fcn.00418c30
pop ebx
xor eax, eax
ret
mov dword [0x649748], 1
call fcn.0041c3f0
xor eax, eax
ret
call fcn.00418da0
movsx eax, al
mov dword [0x649744], eax
call fcn.0041a1f0
xor eax, eax
ret
push 0x62
call fcn.00418c00
add esp, 4
call fcn.00418c30
xor eax, eax
ret
push eax
push str.Unknown_code:_d___ignored_n
call fcn.00614bd8
add esp, 8
xor eax, eax
ret
Function at 0x4e6710
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x17c
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
lea esi, [esp + 0xe0]
lea edi, str.2l41_90873rjfncvzxhfw0a897309842
mov ebx, 8
mov eax, edi
mov ecx, esi
mov edx, ebx
nop
nop
nop
nop
nop
nop
mov esi, dword [eax]
add eax, 4
mov dword [ecx], esi
add ecx, 4
dec edx
jne 0x4e6740
lea esi, [esp + 0x100]
lea edi, str.poias_mnvzx_klcjhvpasd89f7q_ldos
mov eax, edi
mov ecx, esi
mov edx, ebx
mov esi, dword [eax]
add eax, 4
mov dword [ecx], esi
add ecx, 4
dec edx
jne 0x4e6760
lea esi, [esp + 0x120]
lea edi, str.asdflij298471oijaspojfzxcnvxmnbz
mov eax, edi
mov ecx, esi
mov edx, ebx
mov esi, dword [eax]
add eax, 4
mov dword [ecx], esi
add ecx, 4
dec edx
jne 0x4e6780
lea esi, [esp + 0x140]
lea edi, str._kasjhdfqpow7183uhfadfhak_sieoiu
mov eax, edi
mov ecx, esi
mov edx, ebx
mov ebx, dword [eax]
add eax, 4
mov dword [ecx], ebx
add ecx, 4
dec edx
jne 0x4e67a0
mov eax, 0x37
lea edx, [0x64b738]
mov esi, eax
mov ecx, 0
mov ebx, edx
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
sar edx, 0x1f
mov eax, ecx
mov edi, 0x20
idiv edi
inc edx
mov eax, dword [ebx - 4]
xor eax, dword [esp + edx*4 + 0xdc]
mov dword [ebx - 4], eax
add ebx, 4
inc ecx
dec esi
jg 0x4e67d0
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
add esp, 0x17c
ret
Function at 0x613ca9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x613cc9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00612c5b
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x613cec
test byte [esp + 8], 2
je 0x613cec
call fcn.00612cce
mov dword [eax], 0xd
call fcn.00612cd7
mov dword [eax], 5
jmp 0x613cc5
xor eax, eax
ret

Function at 0x616790
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
push esi
mov esi, dword [esp + 0x50]
mov bx, word [esp + 0x4c]
cmp bx, 4
mov word [esi], 0
jbe 0x6167b3
sub al, al
pop esi
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x38]
push 0x10
push eax
call fcn.006163f0
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.00616450
lea eax, [esp + 0x18]
push 0x10
push eax
call fcn.00616510
lea eax, [esp + 0x18]
push eax
call fcn.00615df0
add bl, 0x31
and eax, 0xffff
mov byte [esp + eax + 0x18], bl
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0xc]
push 0x10
push eax
lea eax, [esp + 0x24]
push 0x616780
push eax
lea eax, [esp + 0x3c]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
or eax, eax
je 0x616864
lea eax, [esp + 8]
push 0x2c
push eax
call fcn.00616760
or ax, ax
je 0x61682c
and eax, 0xffff
mov byte [esp + eax + 8], 0
cmp byte [esp + 8], 0x30
jne 0x616850
mov al, byte [esp + 9]
and al, 0xdf
cmp al, 0x58
jne 0x616850
lea eax, [esp + 0xa]
push esi
push eax
call fcn.00615f00
or al, al
jne 0x616864
jmp 0x61685f
lea eax, [esp + 8]
push esi
push eax
call fcn.00615e50
or al, al
jne 0x616864
mov word [esi], 0
mov ax, word [esi]
or ax, ax
je 0x61687c
cmp ax, 0xffff
je 0x61687c
mov al, 1
pop esi
pop ebx
add esp, 0x40
ret 8
sub al, al
pop esi
pop ebx
add esp, 0x40
ret 8

Function at 0x6168a0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
push esi
mov esi, dword [esp + 0x50]
mov bx, word [esp + 0x4c]
cmp bx, 4
mov word [esi], 0
jbe 0x6168c3
sub al, al
pop esi
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x38]
push 0x10
push eax
call fcn.006163f0
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.00616450
lea eax, [esp + 0x18]
push 0x10
push eax
call fcn.00616510
lea eax, [esp + 0x18]
push eax
call fcn.00615df0
add bl, 0x31
and eax, 0xffff
mov byte [esp + eax + 0x18], bl
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0xc]
push 0x10
push eax
lea eax, [esp + 0x24]
push 0x616890
push eax
lea eax, [esp + 0x3c]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
or eax, eax
je 0x616974
lea eax, [esp + 8]
push 0x2c
push eax
call fcn.00616760
or ax, ax
je 0x616974
and eax, 0xffff
mov cl, byte [esp + eax + 9]
and cl, 0xdf
cmp cl, 0x54
jne 0x616974
cmp byte [esp + eax + 0xa], 0x3a
jne 0x616974
push esi
lea eax, [esp + eax + 0xf]
push eax
call fcn.00615e50
or al, al
jne 0x616960
jmp 0x61696f
mov ax, word [esi]
cmp ax, 1
jl 0x61696f
cmp ax, 6
jle 0x616974
mov word [esi], 0
cmp word [esi], 1
sbb al, al
inc al
pop esi
pop ebx
add esp, 0x40
ret 8
Function at 0x6169a0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x50
push esi
lea eax, [esp + 0x44]
push 0x10
push eax
call fcn.006163f0
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.00616450
lea eax, [esp + 0x34]
push 0x10
push eax
call fcn.00616600
lea eax, [esp + 4]
push 0x10
push eax
call fcn.006165b0
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x18]
push 0x10
push eax
lea eax, [esp + 0x40]
push 0x616990
push eax
lea eax, [esp + 0x38]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
mov esi, eax
or esi, esi
je 0x616a0f
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 8]
push eax
call fcn.00615c70
mov ecx, dword [esp + 0x5c]
mov byte [ecx], al
cmp esi, 1
sbb al, al
inc al
pop esi
add esp, 0x50
ret 8

Function at 0x616a20
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x30
lea eax, [esp + 0x20]
push 0x10
push eax
call fcn.006163f0
lea eax, [esp]
push 0x10
push eax
call fcn.00616450
lea eax, [esp + 0x10]
push 0x10
push eax
call fcn.00616560
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x14]
push 0
push eax
lea eax, [esp + 0xc]
push eax
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov ecx, dword [esp + 0x34]
cmp eax, 1
mov word [ecx], ax
sbb cl, cl
inc cl
mov al, cl
add esp, 0x30
ret 4

Function at 0x616a90
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x70
push esi
mov esi, dword [esp + 0x78]
push 0x10
mov word [esi], 0
lea eax, [esp + 8]
push 0
push eax
call fcn.00615e10
lea eax, [esp + 0x64]
push 0x10
push eax
call fcn.006163f0
lea eax, [esp + 0x44]
push 0x10
push eax
call fcn.00616450
lea eax, [esp + 0x54]
push 0x10
push eax
call fcn.006164b0
lea eax, [esp + 0x34]
push 0x10
push eax
call fcn.00616660
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.00616710
lea eax, [esp + 0x14]
push 0x10
push eax
call fcn.006166c0
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 8]
push 0x10
push eax
lea eax, [esp + 0x60]
push 0x616a80
push eax
lea eax, [esp + 0x58]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
or eax, eax
je 0x616b63
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 8]
push eax
call fcn.00615c70
or al, al
je 0x616b31
mov word [esi], 2
jmp 0x616b63
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 8]
push eax
call fcn.00615c70
or al, al
je 0x616b4b
mov word [esi], 3
jmp 0x616b63
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 8]
push eax
call fcn.00615c70
or al, al
je 0x616b63
mov word [esi], 1
cmp word [esi], 1
sbb al, al
inc al
pop esi
add esp, 0x70
ret 4
Function at 0x616d50
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 4
push ebx
push esi
push edi
push ebp
mov esi, dword [esp + 0x18]
mov byte [esp + 0x13], 0
lea eax, [esi + 4]
mov edi, dword [esp + 0x1c]
mov dword [esi], eax
mov ax, word [edi + 4]
mov word [esi + 4], ax
mov ax, word [edi + 0xa]
mov word [esi + 6], ax
mov ax, word [edi + 0x14]
mov word [esi + 0x16], ax
mov ax, word [edi + 8]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
lea eax, [esi + 0x24]
mov dword [esi + 0x10], eax
lea eax, [esi + 4]
push eax
call fcn.00616c50
or al, al
jne 0x616eda
test byte [edi + 0x1c], 4
je 0x616db3
mov byte [esp + 0x13], 1
sub cx, cx
sub dx, dx
lea esp, [esp]
mov ebp, ecx
and ebp, 0xffff
lea eax, [ebp*8]
sub eax, ebp
shl eax, 2
lea eax, [eax + eax*4]
lea ebx, [esi + eax]
lea eax, [ebp*4]
mov word [ebx + 0x36], cx
lea eax, [eax + eax*8]
lea ebp, [edi + eax]
mov ax, word [ebp + 0xe]
mov word [ebx + 0x9c], ax
mov ax, word [ebp + 0x12]
mov word [ebx + 0x8e], ax
mov ax, word [ebp + 0x16]
mov word [ebx + 0x34], ax
mov ax, word [ebp + 0x18]
mov word [ebx + 0x32], ax
mov eax, dword [ebp + 0x1c]
mov dword [ebx + 0x2c], eax
cmp cx, 3
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0x24]
mov dword [ebx + 0x28], eax
lea eax, [esi + 4]
mov dword [ebx + 0xa4], eax
jne 0x616e40
mov dword [ebx + 0xa8], 0
jmp 0x616e4c
lea eax, [ebx + 0xb0]
mov dword [ebx + 0xa8], eax
or cx, cx
jne 0x616e60
mov dword [ebx + 0xac], 0
jmp 0x616e69
lea eax, [ebx - 0x68]
mov dword [ebx + 0xac], eax
cmp byte [esp + 0x13], 0
je 0x616e80
cmp word [ebp + 0xe], 0xffff
jne 0x616e80
or dword [ebx + 0x2c], 8
jmp 0x616e86
mov word [ebx + 0x36], dx
inc dx
inc cx
cmp cx, 4
jb 0x616dc0
push esi
call fcn.00616cc0
push esi
call fcn.00616c00
push esi
call fcn.00616bc0
mov eax, dword [esi + 0x10]
push eax
call fcn.00618080
mov word [esi + 0xc], ax
or ax, ax
je 0x616ed0
lea eax, [esi + 4]
push eax
call fcn.00617ed0
sub ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 8
push esi
call fcn.00616b90
mov ax, 9
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 8

Function at 0x618fd0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push esi
push edi
lea eax, [esp + 0xa]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
push eax
push esi
call fcn.00616ef0
mov eax, dword [esp + 0xc]
push 0xd
mov ax, word [eax + 4]
push eax
call fcn.00618b00
or al, al
jne 0x61905a
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.006198f0
or al, al
jne 0x61905a
mov eax, dword [esp + 0xc]
mov ax, word [eax + 0xa]
push eax
mov eax, dword [esp + 0x10]
mov al, byte [eax + 8]
push eax
mov eax, dword [esp + 0x14]
mov ax, word [eax + 6]
push eax
mov eax, dword [esp + 0x18]
mov ax, word [eax + 4]
push eax
mov eax, dword [esp + 0x20]
push eax
push esi
call fcn.006197b0
mov di, ax
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.00619940
or di, di
je 0x61905a
mov ax, di
pop edi
pop esi
add esp, 0xc
ret 8