joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d750
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x230
mov eax, dword [0x482534]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
xor bl, bl
test esi, esi
jne 0x46d783
xor al, al
pop ebx
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0040470b
add esp, 0x230
ret
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x46d7ad
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0040470b
add esp, 0x230
ret
lea eax, [esp + 8]
push eax
push edi
mov dword [esp + 0x10], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x46d7f0
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jmp 0x46d7d0
push esi
lea ecx, [esp + 0x34]
push ecx
call ebp
test eax, eax
je 0x46d7ed
lea edx, [esp + 0xc]
push edx
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x46d7d0
jmp 0x46d7ef
mov bl, 1
pop ebp
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x234]
pop edi
mov al, bl
pop ebx
xor ecx, esp
call fcn.0040470b
add esp, 0x230
ret
Function at 0x471670
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x218
mov eax, dword [0x482534]
xor eax, esp
mov dword [esp + 0x210], eax
push edi
mov edi, ecx
call fcn.0044dc70
lea eax, [esp + 4]
push eax
push 0xf003f
push 0
push 0x47748c
push 0x80000002
mov dword [esp + 0x1c], 0x100
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x47170b
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push str.InstallDir
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x47170b
lea edx, [esp + 0x10]
push edx
push 0x4774d4
call fcn.00402fb0
add esp, 8
call fcn.0044c720
mov eax, 1
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0040470b
add esp, 0x218
ret
mov ecx, dword [esp + 0x214]
pop edi
xor ecx, esp
xor eax, eax
call fcn.0040470b
add esp, 0x218
ret
Function at 0xb52f6a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0b447b8
jmp 0xb542b4
push word [esp]
jl 0xb52f86
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edi
jmp 0xb52fc9
lea esp, [esp + 2]
jmp 0xb52f54
lea esp, [esp + 0x1c]
jmp 0xb52fb3
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edi
jmp 0xb52f70
pushfd
jmp 0xb52e43
lea esp, [esp + 0x1c]
jmp 0xb52fb3
btc edi, esp
mov esi, dword [esp + 0x2c]
xchg cl, bl
bsf ecx, edx
jae 0xb52ffd
jb 0xb52fe7
xchg al, dh
jmp 0xb53168
mov dl, byte [esp]
seto dl
call 0xb53144
lea esp, [esp + 4]
xor esi, 0x31d9c51f
mov ecx, dword [esp]
mov ax, word [esp]
lea eax, [ebp*4]
mov edx, ebp
jmp 0xb531a6
jmp 0xb5315d
bsr edx, ebp
mov cl, al
jmp 0xb531b6
xchg ecx, eax
add esi, 0x2e7adc7d
btc cx, ax
js 0xb53190
jns 0xb531ff
add esi, dword [ebp]
setge cl
jmp 0xb5327a
ror esi, 0
mov edx, 0xba30c37d
mov ch, bl
inc ecx
jg 0xb5318e
mov dl, byte [esp]
seto dl
jmp 0xb53163
bsr edx, ebp
mov cl, al
call fcn.00b531e9
push eax
aam 0x4a
sub eax, 0x41c61adc
sal dword [eax + reloc.WINMM.dll_midiStreamOut], 1
cli
lea edx, [eax + eax]
jmp 0xb531d1
jmp 0xb5312f
lea edx, [ecx + ebx]
xchg al, bl
shl cx, cl
jno 0xb53ac9
jo 0xb5312f

Function at 0xb53071
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
call fcn.00b52f43
btc edi, esp
jmp 0xb53000
lea ebp, [esp]
xchg ebx, edi
not dh
xchg bl, al
jmp 0xb5309b
xchg cx, ax
shr dx, 7
ja 0xb53063
neg dx
jmp 0xb5304d
jnp 0xb53042
xchg dx, ax
mov bx, 0xc605
jmp 0xb53049
xchg dx, ax
mov bx, 0xc605
mov ebx, esi
jmp 0xb5300e
stc
bsf cx, bx
jmp 0xb5306b
neg dx
stc
bsf cx, bx
call 0xb53071
ret 0x3c89
mov bx, word [esp]
sub esp, 0xc0
mov edi, esp
dec cx
jmp 0xb53024
Function at 0xb538ca
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg eax
jb 0xb53924
lea eax, [esp + eax]
inc eax
jmp 0xb53926
lea eax, [esp + eax]
inc eax
jmp 0xb53926
jmp 0xb5390e
lea esp, [esp + 8]
dec cl
mov dh, 0x31
sub esp, 0xc
jns 0xb53975
mov dword [esp + 2], ecx
xchg byte [esp + 0xa], dl
lea edx, [edi + ebp]
stc
sub esp, 0x1f
jmp 0xb5397b
mov dword [esp + 2], ecx
xchg byte [esp + 0xa], dl
lea edx, [edi + ebp]
jmp 0xb53977
jmp 0xb5395f
stc
sub esp, 0x1f
lea esp, [esp + 3]
jmp 0xb53a05
btr ax, dx
inc edx
jmp 0xb539c5
btr ax, dx
inc edx
lea esp, [esp + 0x1c]
dec cl
jmp 0xb539e7
mov dx, 0x5e00
lea edx, [ebp*4]
jmp 0xb53a71
inc dx
jle 0xb539cd
mov dx, 0x5e00
lea edx, [ebp*4]
mov edx, eax
jmp 0xb53a73
lea esp, [esp + 0x28]
xor cl, 0x7d
lea eax, [eax + ebp]
sub esp, 0x1c
jo 0xb539c0
jno 0xb539a8
lea esp, [esp + 0xa]
lea esp, [esp + 3]
jmp 0xb53a48
sub esp, 0xd
jp 0xb53a16
lea esp, [esp + 0xa]
lea esp, [esp + 3]
jmp 0xb53a48
sub ebp, 4
lea edx, [esp + edx]
sub esp, 6
jmp 0xb53a99
mov dh, byte [esp + 4]
not ax
lea esp, [esp + 2]
jmp 0xb53aa4
mov edx, eax
and ecx, 0x3c
mov edx, 0x6ae47408
lea edx, reloc.WINMM.dll_midiStreamOut
jmp 0xb53a35
lea esp, [esp + 2]
jmp 0xb53aa4
jle 0xb53a57
mov dh, byte [esp + 4]
not ax
jmp 0xb53a83
mov edx, dword [ecx + edi]
bswap eax
mov ax, 0x81fc
bsf ecx, ebx
jno 0xb53e3f
jo 0xb53bf3
sbb eax, 0x95660393
push eax
test dword [edx + ecx*4], edx
in eax, dx
sbb al, 0xa9
add ecx, ebp
popal
idiv bh
dec dword [edx + reloc.WINMM.dll_midiStreamOut]
mov dword [ebp], edx
lea ecx, [ecx*4]
jmp 0xb53bf3
Function at 0xb551f2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cl, dl
call 0xb54f8d
mov edx, 0x60ce893e
mov cx, word [esp]
mov eax, dword [esp]
xchg dx, cx
rol edi, 0
jmp 0xb55188
dec edi
rdtsc
mov eax, dword [esp]
mov edx, 0x566e255
xchg cx, ax
jmp 0xb55158
mov ax, word [esp]
mov edx, dword [esp]
jmp 0xb5511b
xchg ah, al
mov ah, byte [esp]
jmp 0xb55167
xor ax, 0x63bc
jmp 0xb5516b
inc dx
jno 0xb5513a
xchg ah, al
mov ah, byte [esp]
jmp 0xb55141
xor ax, 0x63bc
xor edi, 0x2c72b0e1
mov edx, dword [esp]
stc
jne 0xb551b5
dec ecx
rdtsc
jmp 0xb55198
inc ah
jae 0xb55131
mov ax, word [esp]
mov edx, dword [esp]
jmp 0xb5511b
dec ecx
rdtsc
add edi, dword [esi]
jmp 0xb551cd
push bx
lea esp, [esp + 1]
jmp 0xb551b7
jmp 0xb55195
sub esp, 3
jbe 0xb5519c
push bx
lea esp, [esp + 1]
jmp 0xb551b7
mov di, word [esp]
rdtsc
xchg dword [esp], edx
xchg ecx, ebp
jmp 0xb550e1
Function at 0xb5719b
Capabilities:
Execute anti-debugging instructions

Disassembly:
add ecx, 0xa4447168
jmp 0xb57bf2
call 0xb57185
clc
jmp 0xb5720c
xchg dx, bp
shr al, 6
btr edx, esi
jmp 0xb578e4
btr edx, esi
jmp 0xb578e4
ja 0xb571c6
xchg dx, bp
shr al, 6
jmp 0xb571f6
lea ecx, [ebp + 0xcd]
rdtsc
lea ebp, [esp]
call fcn.00b572aa
inc ebx
neg bx
jmp 0xb573f5
mov cl, ah
mov edx, esi
mov cx, word [esp]
lea edx, [edx*4]
jmp 0xb57438
btr cx, cx
pushal
add esp, 0x22
xchg byte [esp + 1], ch
mov edx, ebx
jmp 0xb57493
setge ch
sub esi, 0x620986a
sub esp, 7
jo 0xb57422
jno 0xb57466
xchg byte [esp + 1], ch
mov edx, ebx
jmp 0xb57493
mov dx, 0x50a2
setg bl
pushal
mov byte [esp + 0x12], cl
jmp 0xb57470
btr cx, cx
pushal
add esp, 0x22
jmp 0xb57448
mov cx, 0x804e
sub esp, 0x1a
jmp 0xb574bb
mov byte [esp + 0x2b], dl
lea esp, [esp + 2]
jmp 0xb574a5
add esp, 4
mov dx, bx
lea esp, [esp + 1]
not esi
mov cx, 0xe75f
jmp 0xb57450
lea esp, [esp + 0x38]
dec esi
mov ebx, 0x3940b532
mov bh, 0x20
mov cl, byte [esp]
jmp 0xb574fa
jno 0xb5747d
mov byte [esp + 0x2b], dl
lea esp, [esp + 2]
jmp 0xb574a5
lea ecx, [edi*4]
jmp 0xb57526
add esi, dword [ebp]
btr dx, di
jnp 0xb574e3
lea ecx, [edi*4]
mov ecx, 0x9f03d9f4
bsr cx, di
jmp fcn.00b57535
mov ecx, 0x9f03d9f4
bsr cx, di
jmp fcn.00b57535
mov edx, 0xcd700934
jmp 0xb573c1
mov esi, dword [esp + 0x2c]
bts edx, esp
jne 0xb5780b
mov edx, 0xcd700934
lea ecx, [ebp + 0xcd]
rdtsc
call fcn.00b57291
dec cl
sub esp, 0
stc
jmp 0xb57959
lea esp, [esp + 4]
sub bl, 0xe1
neg cx
jnp 0xb5795f
jp 0xb57966
loop 0xb57993
salc
mov cl, 0x40
invalid
pushfd
not dx
jmp 0xb57943
pushfd
jmp 0xb57adf
pushfd
mov ecx, dword [esp + 3]
lea esp, [esp + 2]
lea esp, [esp]
lea edx, [ebp - 0xc5]
jmp 0xb579c8
push word [esp + 1]
jne 0xb57a40
mov byte [esp + 1], al
clc
jmp 0xb57a5f
neg bl
mov dx, word [esp]
call 0xb57993
enter 0xffffffffffffde48, 0xffffffffffffffb9
dec eax
lea esp, [esi - 0x1b]
jne 0xb579da
out dx, eax
xchg esp, eax
pop es
lea edx, [ebp - 0xc5]
xchg byte [esp], cl
xchg byte [esp], dl
lea esp, [esp + 2]
jmp 0xb579a9
stc
lea ebx, [ebx - 0x3c]
mov cl, bh
jmp 0xb57a23
mov edx, dword [esp]
rcl dh, cl
xchg dword [esp], ebx
pushfd
xchg cl, dh
lea edx, [edi*4]
jmp 0xb57a8b
mov byte [esp + 1], al
call fcn.00b579ea
lea esp, [esp + 4]
not bl
dec ecx
jge 0xb57c87
btr ecx, esi
jmp 0xb57b80
mov edx, 0x2e943c52
lea edx, [eax + edx]
lea esp, [esp + 2]
jmp 0xb57a49
mov ch, 0x53
push dword [esp + 4]
ret 8
mov ecx, dword [esp + 3]
lea esp, [esp + 2]
lea esp, [esp]
jmp 0xb579c2
btr ecx, esi
call fcn.00b57b4f
not edx
mov edx, dword [esp]
bswap edx
jmp 0xb57ba8
not dl
mov ecx, dword [ecx - reloc.WINMM.dll_midiStreamOut]
bt edx, edx
jl 0xb57bea
jge 0xb57bd4
retf
not dx
jmp 0xb56efe
not dx
jmp 0xb56efe
push cx
mov dx, 0x970e
add esp, 1
jmp 0xb57c52
mov edx, dword [esp]
lea esp, [esp + 1]
jmp 0xb57c2f
mov esp, edi
bsf dx, si
jmp 0xb57c5d
not dx
inc dl
jmp 0xb57c6a
jns 0xb57c01
mov edx, dword [esp]
lea esp, [esp + 1]
jmp 0xb57c2f
ja 0xb57c3b
not dx
inc dl
jmp 0xb57c6a
push ecx
ret
jmp 0xb57b7d

Function at 0xb64180
Capabilities:
Encode data using xor

Disassembly:
push word [esp + 1]
js 0xb63fce
sete dl
lea esp, [esp + 2]
jmp 0xb63fb8
xchg dword [esp], edx
jmp 0xb64002
Function at 0xc572b6
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xb]
mov ax, 0xa29d
cmp eax, ebx
xchg byte [esp], dh
lea edx, [edx + ebx]
jmp 0xc57290

Function at 0xc5743a
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xc5749a
mov word [esp + 0x15], bx
lea esp, [esp + 5]
mov dword [esp + 0x12], ebx
stc
mov eax, esp
mov dword [esp + 0xf], eax
jmp 0xc57479
shl dh, 3
sub esp, 0x17
bsf ebx, esp
push dword [esp + 0x19]
bts ebx, edi
rdtsc
jmp 0xc5743c
Function at 0xc57d8c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [edx + edi]
pop word [esp]
mov byte [esp], dl
jmp 0xc57db4

Function at 0xc57f77
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
lea eax, [esp + ecx]
mov eax, dword [esp]
lea eax, [ecx + esi]
bsr ebx, eax
jmp 0xc57fa0
xchg byte [esp + 2], al
jmp 0xc57f61
mov dh, dl
add esp, 0
not eax
std
stc
xchg byte [esp], bh
jmp 0xc57fc6
cld
rdtsc
mov edx, dword [esp]
pop dx
xchg byte [esp], bh
mov byte [esp], ch
jmp 0xc57f7d
setle dh
sbb bx, sp
bsf ebx, edx
bsr dx, dx
xchg byte [esp], ah
jmp 0xc5851f
btr ax, dx
mov dx, bp
lea esp, [esp]
xchg edx, ebx
neg dx
clc
jmp 0xc57fb0
cmp dword [eax - 0x55], ebx
dec ebx
inc esi
retf 0x3f58
mov byte [ebx - 0x53], bh
fstp dword [edx - 0x38]
scasd eax, dword es:[edi]
pop edx
mov esp, 0x4a2fbf39
mov ecx, 0x6901126
popal
nop
jb 0xc5847e
or eax, 0xfc17e49d
sbb dword [esi + 0x46a66b0c], ebx
or al, 0x6b
cmpsb byte [esi], byte es:[edi]
inc esi
imul esi, ebx, 0x1df50663
jno 0xc584fc
push 0xd
cld
adc eax, 0x1071e169
jecxz 0xc58515
test eax, 0x22d7b022
test ecx, ebp
not dword [bp + si - reloc.WINMM.dll_midiStreamOut]
sbb cl, byte [edi]
xor eax, ebp
xlatb
and al, byte [ebp - 0x6d089817]
popal
mov ebx, 0xe8310f1a
rdtsc
call 0xc5843f
jge 0xc5851c
sbb edi, edi
invalid
push 0xd
cld
adc ebp, dword [ebp - 0x1f]
jno 0xc58540
jecxz 0xc58541
lodsd eax, dword [esi]
and dh, byte [eax - 0x123fdd29]
not dword [bp + si - reloc.WINMM.dll_midiStreamOut]
adc eax, 0x98690e98
jnp 0xc585aa
not dword [edx - reloc.WINMM.dll_midiStreamOut]
push cs
imul ebx, dword [eax + reloc.WINMM.dll_midiStreamOut], 0x751fff0c
out 0x74, al
adc ebp, esi
cmc
or al, 0xff
pop ds
jne 0xc58532
je 0xc58561
out dx, al
pop es
test dword [ebx], ebx
mov ebp, esi
sbb eax, 0x127cedbc
jne 0xc584df
jne 0xc5853a
dec ecx
fnstcw word [eax - 0x158203b5]
cld
jge 0xc5854e
js 0xc58585
ljmp 0x9fa:0x9f0f9d43
hlt
invalid

Function at 0xc58136
Capabilities:
Access peb ldr_data
Packed with generic packer
Parse pe header

Disassembly:
mov dword [esp + 0x34], edi
lea esp, [esp + 0x34]
jmp 0xc5816b
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0xc58155

Function at 0xc5814c
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
call fcn.00c57010
mov dword [esp + 0x34], esi
call fcn.00c58136
mov eax, dword [eax]
jmp 0xc58179
mov eax, dword [eax + 8]
jmp 0xc58251
push eax
jmp 0xc5700b
Function at 0x401380
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401399
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4013ad
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4013ce
cmp esi, eax
jae 0x4013a7
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4013c0
cmp esi, eax
jae 0x4013a7
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x403e70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x464834]
push ebx
push esi
push edi
push 0x4657a0
mov dword [esp + 0x220], eax
lea eax, [esp + 0x14]
mov esi, ecx
push str._sSetting.ini
push eax
mov dword [esp + 0x18], esi
call fcn.0041d7f8
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 0
push str.Loaduser
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [esi + 0x328], eax
je 0x403fa7
xor eax, eax
lea edx, [esp + 0x10]
push edx
push 0x80
mov ecx, 0x20
lea edi, [esp + 0x120]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x120]
push eax
push 0x4559f0
push str.User
push str.Setting
call ebx
push 0x40
add esi, 0x32c
push esi
push eax
lea ecx, [esp + 0x124]
push ecx
call fcn.0040f0d0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0x10
push 0
push esi
call edi
push eax
push esi
call section..text
add esp, 0xc
lea edx, [esp + 0x118]
push edx
call edi
test eax, eax
jle 0x403fa7
xor eax, eax
mov ecx, 0x20
lea edi, [esp + 0x198]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
push 0x80
lea ecx, [esp + 0x1a0]
push ecx
push 0x4559f0
push 0x44f4dc
push str.Setting
call ebx
mov esi, dword [esp + 0xc]
push 0x40
add esi, 0x36c
push esi
push eax
lea edx, [esp + 0x1a4]
push edx
call fcn.0040f0d0
add esp, 0x10
push 0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
call section..text
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0
push str.ProxyType
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
mov dword [0x4658a8], eax
je 0x403fcd
cmp eax, 2
jne 0x404044
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 0x465934
push 0x4559f0
push str.ProxyUser
push str.Setting
call ebx
lea edx, [esp + 0x10]
push edx
push 0x40
push 0x465974
push 0x4559f0
push str.ProxyPwd
push str.Setting
call ebx
lea eax, [esp + 0x10]
push eax
push 0x80
push 0x4658ac
push 0x4559f0
push str.Server
push str.Setting
call ebx
lea ecx, [esp + 0x10]
push ecx
push 8
push 0x46592c
push 0x4559f0
push str.Port
push str.Setting
call ebx
mov ecx, dword [esp + 0x21c]
mov eax, 1
call fcn.0041cfab
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409320
Capabilities:
Hash data using sha1

Disassembly:
mov eax, ecx
xor ecx, ecx
cmp eax, ecx
je 0x409359
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x60], ecx
mov dword [eax + 0x64], ecx
ret

Function at 0x40a430
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44c138
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
call fcn.00432ee8
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
mov ecx, dword [edi + 0x1c]
lea eax, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x30], 0
call dword [sym.imp.USER32.dll_GetClientRect]
lea edx, [esp + 0xc]
push edx
mov ecx, edi
call fcn.00430fb2
mov eax, dword [edi + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.0043013e
mov ecx, dword [eax + 0x1c]
push 0
push 0
push 0x31
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, dword [esp + 0x30]
mov ebx, dword [esi]
push eax
call fcn.0043981a
push eax
mov ecx, esi
call dword [ebx + 0x28]
mov edx, dword [esi]
mov ebx, eax
mov eax, dword [edi + 0x60]
test eax, eax
mov ecx, esi
je 0x40a4c8
mov eax, dword [edi + 0x68]
push eax
jmp 0x40a4cd
push 0x646464
call dword [edx + 0x30]
push 1
mov ecx, esi
call fcn.00438e1b
mov eax, dword [esp + 0xc]
mov ecx, dword [eax - 0xc]
mov edx, dword [esi]
push 0x25
lea edi, [esp + 0x14]
push edi
push ecx
push eax
mov ecx, esi
call dword [edx + 0x68]
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x28]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x28], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
pop esi
pop ebx
jg 0x40a521
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x14]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x40a750
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44c178
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x28], edi
call fcn.0040a6c0
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.004043b0
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x40a7e2
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40caa0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x44c3d4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.0040f480
mov dword [esp + 0x10], 0
mov dword [esi], 0x45070c
call fcn.00432ee8
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x10], eax
mov byte [esp + 0x10], 1
call fcn.00432ee8
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x18]
mov byte [esp + 0x10], 2
call fcn.004070a0
lea ecx, [esi + 0x20]
mov byte [esp + 0x10], 3
call fcn.004070a0
lea ecx, [esi + 0x28]
mov byte [esp + 0x10], 4
call fcn.004070a0
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 5
call fcn.004070a0
lea ecx, [esi + 0x38]
mov byte [esp + 0x10], 6
call fcn.004070a0
lea ecx, [esi + 0x40]
mov byte [esp + 0x10], 7
call fcn.004070a0
lea ecx, [esi + 0x74]
mov byte [esp + 0x10], 8
call fcn.004070a0
lea ecx, [esi + 0x7c]
mov byte [esp + 0x10], 9
call fcn.004070a0
lea ecx, [esi + 0x84]
mov byte [esp + 0x10], 0xa
call fcn.004070a0
lea ecx, [esi + 0x8c]
mov byte [esp + 0x10], 0xb
call fcn.004070a0
mov ecx, dword [esp + 8]
mov eax, 0xcfcfcf
mov dword [esi + 0x120], eax
mov dword [esi + 0x124], eax
mov dword [esi + 0x13c], 0
mov dword [esi + 0xe4], 0
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x40cbf0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x44c3d4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x45070c
lea ecx, [esi + 0x8c]
mov dword [esp + 0x10], 0xb
call fcn.004070c0
lea ecx, [esi + 0x84]
mov byte [esp + 0x10], 0xa
call fcn.004070c0
lea ecx, [esi + 0x7c]
mov byte [esp + 0x10], 9
call fcn.004070c0
lea ecx, [esi + 0x74]
mov byte [esp + 0x10], 8
call fcn.004070c0
lea ecx, [esi + 0x40]
mov byte [esp + 0x10], 7
call fcn.004070c0
lea ecx, [esi + 0x38]
mov byte [esp + 0x10], 6
call fcn.004070c0
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 5
call fcn.004070c0
lea ecx, [esi + 0x28]
mov byte [esp + 0x10], 4
call fcn.004070c0
lea ecx, [esi + 0x20]
mov byte [esp + 0x10], 3
call fcn.004070c0
lea ecx, [esi + 0x18]
mov byte [esp + 0x10], 2
call fcn.004070c0
mov eax, dword [esi + 0x14]
sub eax, 0x10
mov byte [esp + 0x10], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ccc0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 0x10]
sub eax, 0x10
mov byte [esp + 0x10], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cce2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
call fcn.0040f760
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40cd10
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x44c3f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4f0
mov eax, dword [0x464834]
push ebp
push esi
mov dword [esp + 0x4f4], eax
push edi
mov esi, dword [esp + 0x514]
mov ebp, dword [esp + 0x510]
mov edi, dword [esp + 0x50c]
push esi
push 0x3e8
lea eax, [esp + 0x118]
push eax
push 0x4559f0
push ebp
push edi
mov dword [esp + 0x51c], 2
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0x110]
test al, al
je 0x40ce65
push ebx
push 0
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x11c]
push edx
call fcn.0040f8d0
mov esi, eax
lea eax, [esp + 0x20]
push eax
call fcn.0041e10e
push 0
lea ecx, [esp + 0x28]
push ecx
push esi
mov ebx, eax
call fcn.0040f8d0
lea edx, [esp + 0x30]
push edx
mov esi, eax
call fcn.0041e10e
mov dword [esp + 0x30], eax
push 0
lea eax, [esp + 0x38]
push eax
push esi
call fcn.0040f8d0
lea ecx, [esp + 0x40]
push ecx
call fcn.0041e10e
xor edx, edx
mov dh, al
movzx eax, bl
add esp, 0x30
mov byte [esp + 0x508], 1
mov dl, byte [esp + 0x10]
shl edx, 8
or edx, eax
lea eax, [edi - 0x10]
mov esi, edx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop ebx
jg 0x40ce13
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [ebp - 0x10]
mov byte [esp + 0x504], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ce35
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x514]
add eax, 0xfffffff0
mov dword [esp + 0x504], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ce61
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, esi
jmp 0x40ced5
lea eax, [edi - 0x10]
mov byte [esp + 0x504], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ce87
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [ebp - 0x10]
mov byte [esp + 0x504], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cea9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [esi - 0x10]
mov dword [esp + 0x504], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cece
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x518]
mov ecx, dword [esp + 0x4fc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x4f0]
pop ebp
call fcn.0041cfab
add esp, 0x4fc
ret