joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408aa0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x43ac91
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], 0
call fcn.00430a84
mov ebp, 0x43d760
mov dword [esp + 0x18], ebp
mov ebx, 1
mov dword [esp + 0x30], ebx
call fcn.00431cfd
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x3c]
mov eax, dword [eax]
push 0
push 0
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x3c], 2
call fcn.0041a230
test eax, eax
jne 0x408b4a
mov edi, dword [esp + 0x38]
push 0x43d75c
mov ecx, edi
call fcn.00406d20
lea eax, [esi - 0x10]
mov dword [esp + 0x14], ebx
mov byte [esp + 0x30], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408b41
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov dword [esp + 0x18], ebp
jmp 0x408c17
lea ecx, [esp + 0x18]
call fcn.0041a440
mov ebp, eax
push ebp
call fcn.00431cf3
mov esi, eax
mov ecx, ebp
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
add esp, 4
mov ecx, edx
and ecx, 3
push ebp
rep stosb byte es:[edi], al
push esi
lea ecx, [esp + 0x20]
call fcn.0041a380
lea ecx, [esp + 0x18]
mov edi, eax
call fcn.00430a22
call fcn.00431cfd
push eax
push edi
push esi
lea ecx, [esp + 0x48]
call fcn.00403130
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 3
call fcn.00405420
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
mov byte [esp + 0x30], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408bd1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push esi
call fcn.00431cf8
mov esi, dword [esp + 0x14]
add esi, 0xfffffff0
push esi
call fcn.004030d0
mov edi, dword [esp + 0x40]
add eax, 0x10
mov dword [edi], eax
add esp, 8
mov dword [esp + 0x14], ebx
mov byte [esp + 0x30], bl
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x408c0f
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov dword [esp + 0x18], method.CFile.virtual_0
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 0
call fcn.00430ac3
mov ecx, dword [esp + 0x28]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x408d30
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43aceb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd8
push ebx
push esi
push edi
lea eax, [ebp - 0x20]
mov dword [ebp - 0x10], esp
push eax
call fcn.00415680
push str.DataHotfixUpdateHotFix.ini
push eax
lea ecx, [ebp - 0x1c]
xor edi, edi
push ecx
mov dword [ebp - 4], edi
call fcn.00405580
add esp, 0x10
push eax
lea edx, [ebp - 0x24]
push edx
mov byte [ebp - 4], 1
call fcn.004026a0
mov ecx, eax
call fcn.0041b490
mov eax, dword [eax]
sub eax, 0x10
push eax
mov byte [ebp - 4], 2
call fcn.004030d0
add esp, 4
add eax, 0x10
push 0x80
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 4], 6
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408dd0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
mov byte [ebp - 4], 5
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408df0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
mov byte [ebp - 4], 4
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408e10
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [ebp - 0x18]
push eax
push str.NeedFix
push str.General
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], edi
call fcn.00410b40
mov esi, dword [sym.imp.USER32.dll_ClipCursor]
push edi
call esi
cmp dword [ebp - 0x18], edi
je 0x408f3c
push 0x43
call fcn.004026a0
mov ecx, eax
call fcn.0041b150
test eax, eax
jne 0x408f3c
push 0x45
call fcn.004026a0
mov ecx, eax
call fcn.0041b150
test eax, eax
jne 0x408f3c
push 0x310
push str..BarClientTask.cpp
call fcn.00402180
mov ecx, eax
call fcn.00406c80
push str.Need_UpdateHotFix
push 4
call fcn.00411820
mov bl, 7
add esp, 8
mov byte [ebp - 4], bl
call fcn.00408c40
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
push edi
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0x28], eax
call fcn.0040eee0
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], 8
call fcn.00432604
lea ecx, [ebp - 0x34]
push ecx
call esi
push edi
push str.NeedFix
push str.General
lea ecx, [ebp - 0x14]
call fcn.00410bf0
call fcn.004013b0
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], bl
call fcn.0040e230
mov dword [ebp - 4], 4
call fcn.00408c40
call fcn.004013b0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x408f4f
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov dword [ebp - 4], ebx
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebx
dec ebx
test ebx, ebx
jg 0x408f59
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408f70
Capabilities:
Access peb ldr_data
Get hostname
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43ad16
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x128
mov eax, dword [0x449a98]
push ebx
push esi
xor esi, esi
push edi
mov dword [esp + 0x12c], eax
mov dword [esp + 0x14], esi
call fcn.00431cfd
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
xor ebx, ebx
mov dword [esp + 0x13c], esi
mov dword [esp + 0x18], ebx
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
push eax
push 0x20019
push esi
push str.SYSTEMCurrentControlSetControlComputerNameComputerName
push 0x80000002
mov byte [esp + 0x150], 1
mov dword [esp + 0x28], 0x104
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
jne 0x40905a
mov ebx, dword [esp + 0x1c]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x24]
push edx
push str.ComputerName
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], ebx
call fcn.004012f0
test eax, eax
jne 0x409049
lea eax, [esp + 0x20]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409031
sub eax, edx
push eax
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x18]
call fcn.00404950
cmp ebx, esi
je 0x40905a
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov ecx, dword [esp + 0x10]
cmp dword [ecx - 0xc], esi
jne 0x4090a8
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x20]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [esp + 0x20]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409090
sub eax, edx
push eax
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x18]
call fcn.00404950
lea ecx, [esp + 0x10]
call fcn.00404a20
push 0x3ba
push str..BarClientTask.cpp
call fcn.00402180
mov ecx, eax
call fcn.00406c80
mov esi, dword [esp + 0x10]
push esi
push str.ComputerName_s
push 4
call fcn.00411820
add esi, 0xfffffff0
push esi
call fcn.004030d0
mov edi, dword [ebp + 8]
add eax, 0x10
add esp, 0x10
test ebx, ebx
mov dword [edi], eax
je 0x4090f7
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x13c], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x409119
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0x134]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x12c]
mov eax, edi
call fcn.0042193c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40a980
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x43af3c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1cc
mov eax, dword [0x449a98]
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c8], eax
call fcn.0041e720
lea ecx, [esp + 0x50]
mov dword [esp + 0x1d4], 0
call fcn.00403f50
mov byte [esp + 0x1d4], 1
call fcn.00402510
add eax, 0x58
push eax
lea ecx, [esp + 0x10]
call fcn.0040a2a0
push 0x13
lea ecx, [esp + 0x10]
call fcn.0041d5e0
mov dword [esp + 0x50], eax
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x10]
call fcn.00406740
test eax, eax
je 0x40aae3
lea ecx, [esp + 4]
push ecx
lea ecx, [esp + 0x54]
call fcn.00406f10
push str.run.bat
push eax
lea edx, [esp + 0x10]
push edx
mov byte [esp + 0x1e0], 2
call fcn.00405580
add esp, 0xc
mov eax, dword [esp + 4]
add eax, 0xfffffff0
mov byte [esp + 0x1d4], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40aa52
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 4]
push esi
push eax
call fcn.0041a9f0
mov eax, dword [eax]
add esp, 8
push 0
push eax
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [esp + 4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40aa98
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push 0x1c8
push str..BarClientTask.cpp
call fcn.00402180
mov ecx, eax
call fcn.00406c80
push esi
push str.ProcessStartTask__s_.
push 4
call fcn.00411820
lea eax, [esi - 0x10]
add esp, 0xc
mov byte [esp + 0x1d8], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop esi
jg 0x40ab08
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
jmp 0x40ab08
push 0x1cb
push str..BarClientTask.cpp
call fcn.00402180
mov ecx, eax
call fcn.00406c80
push str.StartTask_Not_Found.
push 4
call fcn.00411820
add esp, 8
lea ecx, [esp + 0x50]
mov byte [esp + 0x1d4], 0
call fcn.00403ff0
lea ecx, [esp + 0xc]
mov dword [esp + 0x1d4], 0xffffffff
call fcn.0041e860
mov ecx, dword [esp + 0x1cc]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x1c8]
call fcn.0042193c
add esp, 0x1d8
ret
Function at 0x40cad0
Capabilities:
Get disk size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43b196
push eax
mov al, byte [0x44aaa0]
mov dword fs:[0], esp
sub esp, 0xc
push ebx
xor ebx, ebx
test al, 1
jne 0x40cb53
or dword [0x44aaa0], 1
push 0x43da14
lea ecx, [esp + 8]
mov dword [esp + 0x1c], ebx
call fcn.00406d20
lea eax, [esp + 4]
push eax
push 0x44aa9c
mov byte [esp + 0x20], 1
call fcn.0040f1b0
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
add esp, 8
mov byte [esp + 0x18], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cb46
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push 0x43cf90
call fcn.00422c38
add esp, 4
mov ecx, dword [0x44aa9c]
push ebx
push ebx
lea eax, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x40cb83
cmp dword [esp + 0xc], ebx
ja 0x40cb83
cmp dword [esp + 8], 0x32000000
jb 0x40cb98
mov eax, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x10]
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x40dbb0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x43b360
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push esi
mov edi, 1
push ecx
mov dword [esp + 0x30], edi
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov ebx, dword [esp + 0x2c]
jne 0x40dc49
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
push eax
push 0
push 0
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40dc71
push 0x317
push 0x43dff0
xor edi, edi
call fcn.00402180
mov ecx, eax
call fcn.00406c80
push ebx
push esi
push str.RegQueryValueEx_error:_s____Value:_s
push 4
call fcn.00411820
add esp, 0x10
jmp 0x40dc71
push 0x31d
push 0x43dff0
xor edi, edi
call fcn.00402180
mov ecx, eax
call fcn.00406c80
push esi
push str.RegOpenKeyEx_error:_s
push 4
call fcn.00411820
add esp, 0xc
lea eax, [esi - 0x10]
mov byte [esp + 0x1c], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40dc90
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [ebx - 0x10]
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40dcb2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x14]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x40dcd0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x43b360
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
mov eax, dword [0x449a98]
push ebx
push esi
mov dword [esp + 0x114], eax
push edi
mov esi, dword [esp + 0x130]
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x12c]
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push esi
mov ebx, 1
push ecx
mov dword [esp + 0x138], ebx
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov edi, dword [esp + 0x134]
jne 0x40ddb5
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
push 0
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40dd91
push 0x32f
push 0x43dff0
xor ebx, ebx
call fcn.00402180
mov ecx, eax
call fcn.00406c80
push edi
push esi
push str.RegQueryValueEx_error:_s__Value:_s
push 4
call fcn.00411820
add esp, 0x10
jmp 0x40dddd
lea eax, [esp + 0x14]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40dd98
mov ecx, dword [esp + 0x138]
sub eax, edx
push eax
lea edx, [esp + 0x18]
push edx
call fcn.00404950
jmp 0x40dddd
push 0x337
push 0x43dff0
xor ebx, ebx
call fcn.00402180
mov ecx, eax
call fcn.00406c80
push esi
push str.RegOpenKeyEx_error:_s
push 4
call fcn.00411820
add esp, 0xc
lea eax, [esi - 0x10]
mov byte [esp + 0x124], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ddff
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [edi - 0x10]
mov dword [esp + 0x124], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40de24
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x110]
mov eax, ebx
pop ebx
call fcn.0042193c
add esp, 0x11c
ret
Function at 0x410350
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x41037f
mov ecx, dword [esp + 8]
push edi
xor edx, edx
mov dl, byte [ecx]
xor edx, eax
and edx, 0xff
mov edi, dword [edx*4 + 0x43e8b0]
shr eax, 8
xor eax, edi
inc ecx
dec esi
jne 0x410362
pop edi
not eax
pop esi
ret
Function at 0x410aa0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x10008
call fcn.00422e20
mov eax, dword [0x449a98]
push esi
push edi
mov edx, ecx
mov edx, dword [edx]
push edx
mov dword [esp + 0x10010], eax
xor eax, eax
push 0x10000
mov ecx, 0x4000
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 8]
lea esi, [esp + 0x10]
mov eax, esi
push eax
push 0x43d75c
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jbe 0x410b23
mov al, byte [esp + 8]
test al, al
je 0x410b23
mov edi, dword [ebp + 0xc]
lea esp, [esp]
mov edx, dword [edi + 8]
push esi
push edx
mov ecx, edi
call fcn.0042fdb8
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410b11
sub eax, edx
lea esi, [esi + eax + 1]
cmp byte [esi], 0
jne 0x410b00
mov ecx, dword [esp + 0x1000c]
call fcn.0042193c
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x410b40
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x24
mov eax, dword [0x449a98]
mov ecx, dword [ecx]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
push ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
push 0x20
mov dword [esp + 0x1c], eax
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0x24], eax
push 0x43d75c
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jbe 0x410bb1
lea ecx, [esp]
push ecx
call fcn.00422f01
mov edx, dword [esp + 0x34]
add esp, 4
mov dword [edx], eax
mov ecx, dword [esp + 0x20]
call fcn.0042193c
add esp, 0x24
ret 0xc
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
mov dword [eax], 0
call fcn.0042193c
add esp, 0x24
ret 0xc

Function at 0x410c40
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1008
call fcn.00422e20
mov eax, dword [0x449a98]
push esi
push edi
mov esi, ecx
mov dword [esp + 0x100c], eax
xor eax, eax
mov ecx, 0x400
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 0x10]
mov ecx, edi
call fcn.00403010
mov esi, dword [esi]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
push 0x1000
lea eax, [esp + 0x10]
push eax
push 0x43d75c
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jbe 0x410cb8
lea eax, [esp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410ca2
sub eax, edx
push eax
lea eax, [esp + 0xc]
push eax
mov ecx, edi
call fcn.00404950
mov ecx, dword [esp + 0x100c]
call fcn.0042193c
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x411000
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43b837
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x250
mov eax, dword [0x449a98]
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x254], eax
mov dword [esp + 0xc], esi
call fcn.004015d0
xor edi, edi
push 0x43d75c
lea ecx, [esi + 0x30]
mov dword [esp + 0x268], edi
mov dword [esi + 0x20], 0xf
mov dword [esi + 0x24], 3
mov dword [esi + 0x28], 0x3f
mov dword [esi + 0x2c], 0x1e
call fcn.00406d20
mov byte [esp + 0x264], 1
mov dword [esi + 0x34], edi
call fcn.00431cfd
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x38], eax
lea ebx, [esi + 0x3c]
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
xor eax, eax
mov ecx, 0x80
lea edi, [esp + 0x50]
rep stosd dword es:[edi], eax
mov ecx, 0x10
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
push 0x200
lea eax, [esp + 0x54]
push eax
push 0
mov byte [esp + 0x270], 2
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x50]
xor edi, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4110d3
sub eax, edx
test eax, eax
jle 0x41110d
movsx ecx, byte [esp + edi + 0x50]
push ecx
call fcn.00423b9d
mov byte [esp + edi + 0x54], al
lea eax, [esp + 0x54]
add esp, 4
inc edi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411100
sub eax, edx
cmp edi, eax
jl 0x4110e0
lea eax, [esp + 0x50]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411114
sub eax, edx
js 0x41115e
nop
cmp byte [esp + eax + 0x50], 0x2e
jne 0x41112c
mov byte [esp + eax + 0x50], 0
cmp byte [esp + eax + 0x50], 0x5c
je 0x411138
dec eax
jns 0x411120
jmp 0x41115e
lea edi, [esp + eax + 0x50]
lea edx, [esp + 0x10]
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x411144
mov edx, dword [str.Log]
mov al, byte [0x43ed6c]
mov dword [edi], edx
mov byte [edi + 4], al
lea ecx, [esp + 0x50]
push ecx
call fcn.0042fa7c
lea eax, [esp + 0x54]
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411172
sub eax, edx
push eax
lea edx, [esp + 0x54]
push edx
lea ecx, [esi + 0x38]
call fcn.00404950
push 0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
call fcn.00410dd0
mov ecx, dword [esp + 0x25c]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x254]
mov eax, esi
call fcn.0042193c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412160
Capabilities:
Hash data with md5

Disassembly:
mov edx, ecx
push esi
push edi
xor eax, eax
lea esi, [edx + 0x5c]
mov edi, esi
mov dword [edx + 0x18], eax
mov dword [edx + 0x14], eax
mov ecx, 0x10
mov dword [edx], 0x43ed80
mov dword [edx + 4], 0x67452301
mov dword [edx + 8], 0xefcdab89
mov dword [edx + 0xc], 0x98badcfe
mov dword [edx + 0x10], 0x10325476
rep stosd dword es:[edi], eax
pop edi
mov byte [esi], 0x80
mov eax, edx
pop esi
ret

Function at 0x412280
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0xc
mov eax, dword [0x449a98]
push ebp
push esi
mov esi, ecx
mov dword [esp + 0x10], eax
push edi
xor ecx, ecx
lea eax, [esi + 0x16]
mov dl, byte [eax - 2]
mov byte [esp + ecx + 0xc], dl
mov dl, byte [eax - 1]
mov byte [esp + ecx + 0xd], dl
mov dl, byte [eax]
mov byte [esp + ecx + 0xe], dl
mov dl, byte [eax + 1]
mov byte [esp + ecx + 0xf], dl
add ecx, 4
add eax, 4
cmp ecx, 8
jb 0x412296
mov ecx, dword [esi + 0x14]
shr ecx, 3
and ecx, 0x3f
cmp ecx, 0x38
mov eax, 0x38
jb 0x4122d4
mov eax, 0x78
sub eax, ecx
push eax
lea ebp, [esi + 0x5c]
push ebp
mov ecx, esi
call fcn.004121b0
push 8
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.004121b0
mov ecx, dword [esp + 0x1c]
inc ecx
lea eax, [esi + 6]
mov edi, 4
lea ecx, [ecx]
mov dl, byte [eax - 2]
mov byte [ecx - 1], dl
mov dl, byte [eax - 1]
mov byte [ecx], dl
mov dl, byte [eax]
mov byte [ecx + 1], dl
mov dl, byte [eax + 1]
mov byte [ecx + 2], dl
add eax, 4
add ecx, 4
dec edi
jne 0x412300
xor eax, eax
mov edi, esi
mov ecx, 0x27
rep stosd dword es:[edi], eax
mov edi, ebp
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov byte [ebp], 0x80
pop ebp
call fcn.0042193c
add esp, 0xc
ret 4

Function at 0x412bb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x43b90e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
xor eax, eax
push esi
mov esi, ecx
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esp + 4], esi
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov edx, 0x11
mov ecx, 0xa
mov dword [esp + 0x10], eax
mov dword [esi + 0x20], 0x43ed84
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], edx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], 0x43ed90
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], edx
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], ecx
push ecx
lea ecx, [esi + 0x58]
mov byte [esp + 0x14], 2
call fcn.004300e9
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret