joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4177ed
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x220
mov eax, 0x469822
call fcn.004517f7
xor esi, esi
mov ecx, edi
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x224], esi
call fcn.0040279b
lea eax, [ebp - 0x21c]
push eax
push 0x20019
push esi
push str.SOFTWAREEPSONEpsonScanManager
mov dword [ebp - 4], esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x224], 1
mov dword [ebp - 0x21c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x417894
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x228]
push eax
push esi
push str.InstallFolder
push dword [ebp - 0x21c]
mov dword [ebp - 0x220], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x417888
lea eax, [ebp - 0x218]
push eax
mov ecx, edi
call fcn.0040247a
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.0045187a
ret

Function at 0x41789c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x220
mov eax, 0x469822
call fcn.004517f7
xor esi, esi
mov ecx, edi
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x224], esi
call fcn.0040279b
lea eax, [ebp - 0x21c]
push eax
push 0x20019
push esi
push str.SOFTWAREEPSONEpsonScanManager
mov dword [ebp - 4], esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x224], 1
mov dword [ebp - 0x21c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x417943
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x228]
push eax
push esi
push str.InstallPath
push dword [ebp - 0x21c]
mov dword [ebp - 0x220], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x417937
lea eax, [ebp - 0x218]
push eax
mov ecx, edi
call fcn.0040247a
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.0045187a
ret

Function at 0x417972
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x48c7d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x418]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWAREEPSONDocument_Capture
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x418], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4179f2
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x420]
push eax
push ebx
push str.InstallPath
push dword [ebp - 0x418]
mov dword [ebp - 0x41c], 0x410
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4179e6
mov bl, 1
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0044d1dc
leave
ret
Function at 0x418158
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esi
push edi
push 0x40
xor esi, esi
lea eax, [ebp - 0x58]
push esi
push eax
call fcn.0044de40
mov dword [ebp - 0x18], esi
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
lea edi, [ebp - 4]
mov dword [ebp - 0x5c], 0x44
mov dword [ebp - 8], esi
call fcn.00417006
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4181c7
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x14]
call esi
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.0040285d
pop edi
xor eax, eax
pop esi
leave
ret
Function at 0x4188e0
Capabilities:
Read .ini file

Disassembly:
push 8
mov eax, 0x46d7fa
call fcn.0045178e
call fcn.0042a8d7
push eax
lea ecx, [ebp - 0x10]
call fcn.00402773
mov edi, dword [ebp + 8]
push edi
lea eax, [ebp - 0x10]
push 0x477a1c
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.0040314f
mov ebx, dword [ebp - 0x10]
add esp, 0xc
cmp dword [ebx - 0xc], esi
je 0x41898c
cmp edi, esi
jl 0x41898c
lea eax, [edi - 0xa]
cmp eax, 9
ja 0x41893b
lea edi, [ebp - 0x14]
call fcn.00408353
push dword [eax]
push esi
push ebx
push str.WatchFolder
jmp 0x418957
lea eax, [edi - 0x3e8]
cmp eax, 0x63
ja 0x418972
lea edi, [ebp - 0x14]
call fcn.00408353
push dword [eax]
push esi
push ebx
push str.WatchFolderV2
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov edi, eax
call fcn.0040285d
cmp edi, 0xffffffff
jne 0x418980
mov edi, dword [ebp + 8]
push esi
push esi
push esi
push edi
call fcn.00418d59
add esp, 0x10
mov edi, eax
lea ecx, [ebx - 0x10]
call fcn.0040285d
mov eax, edi
jmp 0x418997
lea ecx, [ebx - 0x10]
call fcn.0040285d
or eax, 0xffffffff
call fcn.00451866
ret

Function at 0x418a7e
Capabilities:
Read .ini file

Disassembly:
push 8
mov eax, 0x46d7d7
call fcn.0045178e
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.0042a8d7
push eax
lea ecx, [ebp - 0x10]
call fcn.00402773
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push 0x477a1c
push eax
mov byte [ebp - 4], 1
call fcn.0040314f
mov esi, dword [ebp - 0x10]
add esp, 0xc
cmp dword [esi - 0xc], ebx
je 0x418b1b
cmp dword [ebp + 8], ebx
jl 0x418b1b
mov eax, dword [ebp + 0xc]
cmp dword [eax - 0xc], ebx
je 0x418af2
lea edi, [ebp - 0x14]
call fcn.00408353
push dword [eax]
push 0xffffffffffffffff
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov edi, eax
call fcn.0040285d
cmp edi, 0xffffffff
jne 0x418b04
push ebx
push dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
call fcn.00418d59
add esp, 0x10
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.0040285d
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0040285d
mov eax, edi
jmp 0x418b31
lea ecx, [esi - 0x10]
call fcn.0040285d
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0040285d
or eax, 0xffffffff
call fcn.00451866
ret
Function at 0x419246
Capabilities:
Read .ini file

Disassembly:
push 0x2c
mov eax, 0x4697e5
call fcn.0045178e
mov edi, ecx
xor ebx, ebx
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x18], ebx
call fcn.0042be99
xor esi, esi
inc esi
mov dword [ebp - 4], esi
call fcn.0042a8d7
push eax
lea ecx, [ebp - 0x14]
call fcn.00402773
push str..plg
push edi
mov byte [ebp - 4], 2
call fcn.0041cf2d
mov edi, dword [edi]
push ebx
push edi
lea ecx, [ebp - 0x38]
call fcn.0042bf31
cmp eax, ebx
je 0x41931e
lea ecx, [ebp - 0x38]
call fcn.0042bb7b
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x38]
call fcn.0042c130
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.0040270e
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0040285d
lea ecx, [ebp - 0x38]
call fcn.0042be5a
mov edi, dword [ebp - 0x14]
test eax, eax
jne 0x419301
mov eax, dword [ebp - 0x38]
push 0x10
lea ecx, [ebp - 0x38]
call dword [eax + 0x38]
test eax, eax
jne 0x419301
push edi
push 0xffffffffffffffff
push str.ProjectID
push str.Launch
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [ebp + 0xc], eax
je 0x419308
cmp dword [ebp - 0x20], ebx
jne 0x419298
jmp 0x419321
lea ecx, [ebp - 0x38]
call fcn.0042ba95
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call fcn.0040283c
jmp 0x419331
mov edi, dword [ebp - 0x14]
lea ecx, [ebp - 0x38]
call fcn.0042ba95
mov ecx, dword [ebp + 8]
call fcn.0040279b
lea ecx, [edi - 0x10]
mov dword [ebp - 0x18], esi
call fcn.0040285d
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], bl
call fcn.0042bec2
mov eax, dword [ebp + 8]
call fcn.00451866
ret
Function at 0x419412
Capabilities:
Read .ini file

Disassembly:
push 0x40
mov eax, 0x46b811
call fcn.0045178e
and dword [ebp - 0x20], 0
call fcn.0042a8d7
push eax
lea ecx, [ebp - 0x14]
call fcn.00402773
lea ecx, [ebp - 0x4c]
mov dword [ebp - 4], 1
call fcn.0042be99
mov byte [ebp - 4], 2
call fcn.0042a8d7
push eax
lea ecx, [ebp - 0x18]
call fcn.00402773
mov byte [ebp - 4], 3
push dword [ebp + 0x10]
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.Model
call fcn.004024c3
lea edi, [ebp - 0x1c]
call fcn.00429b27
add esp, 4
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0x24], esp
push 0x47741c
call fcn.004024c3
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x34]
push eax
call fcn.0040735d
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 5
call fcn.00407480
movzx eax, al
test eax, eax
je 0x4194d1
lea ebx, [ebp + 0x10]
call fcn.004084ad
mov byte [ebp - 4], 6
push dword [ebp - 0x1c]
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x18]
push str._s_sAppInfo1.plg
push eax
call fcn.0040314f
mov byte [ebp - 4], 5
mov ecx, dword [ebp + 0x10]
add esp, 0x10
jmp 0x41950e
lea ebx, [ebp - 0x24]
call fcn.004084ad
push 0x477378
push eax
lea eax, [ebp + 0x10]
push eax
mov byte [ebp - 4], 7
call fcn.004017f8
add esp, 0xc
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 8
call fcn.0040270e
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.0040285d
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.0040285d
mov ebx, dword [ebp - 0x18]
push 0
push ebx
lea ecx, [ebp - 0x4c]
call fcn.0042bf31
test eax, eax
je 0x4195b0
lea ecx, [ebp - 0x4c]
call fcn.0042bb7b
mov esi, eax
lea eax, [ebp + 0x10]
push eax
lea ecx, [ebp - 0x4c]
call fcn.0042c130
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 9
call fcn.0040270e
mov byte [ebp - 4], 5
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.0040285d
lea ecx, [ebp - 0x4c]
call fcn.0042be5a
mov edi, dword [ebp - 0x14]
test eax, eax
jne 0x419594
mov eax, dword [ebp - 0x4c]
push 0x10
lea ecx, [ebp - 0x4c]
call dword [eax + 0x38]
test eax, eax
jne 0x419594
push edi
push 0xffffffffffffffff
push str.ProjectID
push str.Launch
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [ebp + 0xc], eax
je 0x41959a
test esi, esi
jne 0x41952c
jmp 0x4195b3
lea ecx, [ebp - 0x4c]
call fcn.0042ba95
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call fcn.0040283c
jmp 0x4195bb
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
call fcn.0040279b
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x20], 1
call fcn.00407460
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0040285d
lea ecx, [ebx - 0x10]
call fcn.0040285d
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.0042bec2
lea ecx, [edi - 0x10]
call fcn.0040285d
mov eax, dword [ebp + 8]
call fcn.00451866
ret
Function at 0x419680
Capabilities:
Read .ini file

Disassembly:
push 0x28
mov eax, 0x46d701
call fcn.0045178e
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push ecx
mov dword [ebp + 0x10], esp
mov ecx, esp
push eax
call fcn.0040283c
mov edi, dword [ebp + 8]
push 1
lea esi, [ebp + 0x10]
call fcn.004195fa
add esp, 0xc
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0x10]
cmp dword [eax - 0xc], ebx
jne 0x41981d
lea ecx, [ebp - 0x34]
call fcn.0042be99
mov byte [ebp - 4], 2
call fcn.0042a8d7
push eax
lea ecx, [ebp - 0x18]
call fcn.00402773
mov byte [ebp - 4], 3
call fcn.0042a8d7
push eax
lea ecx, [ebp - 0x14]
call fcn.00402773
mov byte [ebp - 4], 4
call fcn.0042a8d7
push eax
lea ecx, [ebp - 0x10]
call fcn.00402773
lea esi, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.0040830b
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 6
call fcn.0040270e
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0040285d
push str.Epson_SoftwareCommonAppInfo1.plg
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004017f8
add esp, 0xc
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 7
call fcn.0040270e
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0040285d
mov esi, dword [ebp - 0x18]
push ebx
push esi
lea ecx, [ebp - 0x34]
call fcn.0042bf31
test eax, eax
je 0x4197db
lea ecx, [ebp - 0x34]
call fcn.0042bb7b
mov edi, eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x34]
call fcn.0042c130
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 8
call fcn.0040270e
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0040285d
lea ecx, [ebp - 0x34]
call fcn.0042be5a
test eax, eax
jne 0x4197d2
mov eax, dword [ebp - 0x34]
push 0x10
lea ecx, [ebp - 0x34]
call dword [eax + 0x38]
test eax, eax
jne 0x4197d2
push dword [ebp - 0x10]
push 0xffffffffffffffff
push str.ProjectID
push str.Launch
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [ebp + 8], eax
je 0x4197d8
test edi, edi
jne 0x41976b
jmp 0x4197db
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x34]
call fcn.0042ba95
test ebx, ebx
je 0x4197f3
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 0x10]
call fcn.0040270e
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040285d
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0040285d
lea ecx, [esi - 0x10]
call fcn.0040285d
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.0042bec2
mov eax, dword [ebp + 0x10]
xor esi, esi
cmp dword [eax - 0xc], esi
jne 0x419845
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.0040285d
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0040285d
mov eax, esi
call fcn.00451866
ret
push 1
push ecx
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
call fcn.0040283c
call fcn.00415328
pop ecx
pop ecx
mov esi, eax
jmp 0x419827
Function at 0x41ab25
Capabilities:
Create thread

Disassembly:
push 0x20
mov eax, 0x46e7e1
call fcn.0045178e
mov edi, ecx
mov eax, dword [ebp + 8]
or dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x20], eax
xor esi, esi
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x24]
push eax
push 0x41aae4
push esi
push esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x24], edi
call fcn.0044f092
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push 0x41ab02
push esi
push esi
call fcn.0044f092
add esp, 0x30
push 0xffffffffffffffff
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], eax
push 1
lea eax, [ebp - 0x2c]
push eax
push 2
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 0x10], esi
je 0x41abdc
push 0x47741c
lea ecx, [ebp + 8]
call fcn.004024c3
lea eax, [ebp - 0x18]
push eax
mov eax, edi
mov dword [ebp - 4], esi
call fcn.00408745
push 1
lea edx, [ebp + 8]
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0041584d
pop ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040285d
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040285d
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call edi
push dword [ebp - 0x1c]
call edi
xor eax, eax
cmp dword [ebp - 0x10], esi
sete al
call fcn.00451866
ret 4

Function at 0x41b036
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push 0x10
pop eax
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
mov byte [ebp - 1], bl
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], eax
call fcn.0044de40
add esp, 0xc
push 0xf0000020
push 1
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x41b0d3
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x8003
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x41b0c9
push ebx
push dword [ebp + 8]
call fcn.0044d7d0
pop ecx
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x41b0c0
push ebx
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x41b0c0
mov byte [ebp - 1], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, byte [ebp - 1]
pop ebx
leave
ret
Function at 0x41b5f2
Capabilities:
Read .ini file

Disassembly:
push 0xb0
mov eax, 0x46e001
call fcn.0045178e
call fcn.0042a8d7
push eax
lea ecx, [ebp - 0x28]
call fcn.00402773
and dword [ebp - 4], 0
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2c]
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x18], esp
push eax
mov eax, ebx
call fcn.00408745
call fcn.00416a12
add esp, 0xc
mov dword [ebp - 0x14], 0xc9
push dword [ebp - 0x14]
lea eax, [ebp - 0x28]
push 0x477a1c
push eax
call fcn.0040314f
add esp, 0xc
cmp dword [ebp - 0x14], 0xc9
jne 0x41b662
mov dword [ebp - 0x24], 0x2bd
jmp 0x41b696
lea eax, [ebp - 0x34]
push eax
mov eax, ebx
call fcn.00408745
mov byte [ebp - 4], 1
push dword [ebp - 0x2c]
mov eax, dword [eax]
push eax
push 1
push dword [ebp - 0x14]
call fcn.00418d59
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
add esp, 0x10
add ecx, 0xfffffff0
mov dword [ebp - 0x24], eax
call fcn.0040285d
lea edi, [ebp - 0x18]
call fcn.00408353
mov esi, eax
lea eax, [ebp - 0x20]
push eax
mov eax, ebx
mov byte [ebp - 4], 2
call fcn.00408745
push eax
lea eax, [ebp - 0x30]
push str.DCEX.
push eax
mov byte [ebp - 4], 3
call fcn.004069c6
mov esi, dword [esi]
mov edi, dword [ebp - 0x28]
mov eax, dword [eax]
add esp, 0xc
push esi
push dword [ebp - 0x24]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x30]
mov esi, eax
test esi, esi
setg byte [ebp - 0xd]
add ecx, 0xfffffff0
call fcn.0040285d
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0040285d
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040285d
cmp byte [ebp - 0xd], 0
je 0x41b718
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb8], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xe6
jle 0x41b63c
lea eax, [ebp - 0x20]
push eax
mov eax, ebx
call fcn.00408745
mov esi, eax
lea eax, [ebp - 0x18]
push ebx
push eax
mov byte [ebp - 4], 4
call fcn.00419964
pop ecx
pop ecx
lea ecx, [ebp - 0xb8]
push ecx
push dword [ebp - 0x1c]
mov byte [ebp - 4], 5
push dword [ebp + 8]
mov edx, dword [esi]
mov ecx, dword [eax]
call fcn.00401239
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040285d
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0040285d
lea ecx, [edi - 0x10]
call fcn.0040285d
call fcn.00451866
ret 4
Function at 0x41b785
Capabilities:
Read .ini file

Disassembly:
push 0x1c
mov eax, 0x46dfb6
call fcn.0045178e
call fcn.0042a8d7
push eax
lea ecx, [ebp - 0x14]
call fcn.00402773
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x18]
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x28], esp
push eax
mov eax, dword [ebp + 8]
call fcn.00408745
call fcn.00416a12
add esp, 0xc
mov dword [ebp - 0x10], 0xc9
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push 0x477a1c
push eax
call fcn.0040314f
add esp, 0xc
cmp dword [ebp - 0x10], 0xc9
jne 0x41b7ed
mov ebx, 0x2bd
jmp 0x41b821
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp + 8]
call fcn.00408745
mov byte [ebp - 4], 1
push dword [ebp - 0x18]
mov eax, dword [eax]
push eax
push 1
push dword [ebp - 0x10]
call fcn.00418d59
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
add esp, 0x10
add ecx, 0xfffffff0
mov ebx, eax
call fcn.0040285d
lea edi, [ebp - 0x28]
call fcn.00408353
mov esi, eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 2
call fcn.00408745
push eax
lea eax, [ebp - 0x20]
push str.DCEX.
push eax
mov byte [ebp - 4], 3
call fcn.004069c6
mov esi, dword [esi]
mov edi, dword [ebp - 0x14]
mov eax, dword [eax]
add esp, 0xc
push esi
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x20]
mov esi, eax
test esi, esi
setg bl
add ecx, 0xfffffff0
call fcn.0040285d
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.0040285d
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0040285d
test bl, bl
je 0x41b89f
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x24]
mov dword [eax + ecx*4 + 0x28], esi
inc dword [eax + 0x24]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xe6
jle 0x41b7c9
lea ecx, [edi - 0x10]
call fcn.0040285d
call fcn.00451866
ret
Function at 0x41bd0f
Capabilities:
Create thread

Disassembly:
push 0x18
mov eax, 0x46e746
call fcn.0045178e
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push eax
mov eax, esi
call fcn.00408745
call fcn.00416a12
add esp, 0xc
push dword [ebp - 0x10]
call fcn.0041b9c9
mov dword [esp], 0xfd4
call fcn.0042a525
xor ebx, ebx
pop ecx
cmp eax, ebx
je 0x41bd65
mov esi, eax
call fcn.0041b348
mov esi, dword [ebp + 8]
mov edi, eax
jmp 0x41bd67
xor edi, edi
lea eax, [ebp + 8]
push eax
mov eax, esi
call fcn.00408745
push eax
lea ecx, [edi + 4]
mov dword [ebp - 4], ebx
call fcn.0040275e
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040285d
lea eax, [ebp + 8]
push eax
mov eax, esi
call fcn.00408cf2
push eax
lea ecx, [edi + 8]
mov dword [ebp - 4], 1
call fcn.0040275e
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040285d
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.00419964
pop ecx
pop ecx
push eax
mov ecx, edi
mov dword [ebp - 4], 2
call fcn.0040275e
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0040285d
push ecx
mov eax, esp
mov dword [ebp + 8], esp
push eax
mov eax, esi
mov dword [edi + 0x24], ebx
mov dword [edi + 0x20], ebx
call fcn.00408745
call fcn.00417393
pop ecx
cmp al, bl
jne 0x41be1b
push ecx
mov eax, esp
mov dword [ebp + 8], esp
push eax
mov eax, esi
call fcn.00408745
call fcn.00416fb0
pop ecx
cmp al, bl
jne 0x41be1b
xor eax, eax
jmp 0x41be1e
xor eax, eax
inc eax
push edi
push esi
mov byte [edi + 0xfd0], al
call fcn.0041b785
push dword [ebp - 0x10]
push esi
call fcn.0041b8bd
add esp, 0x10
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push ebx
push ebx
mov dword [ebp - 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x20], eax
push 8
lea eax, [ebp - 0x24]
push eax
lea eax, [edi + 0xfc4]
push eax
call fcn.0044df20
add esp, 0xc
test byte [esi + 0x4c], 0x10
jbe 0x41be76
mov dword [edi + 0xfcc], 0x1a
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
push 0x41b378
push ebx
push ebx
mov dword [ebp - 0x18], ebx
call fcn.0044f092
add esp, 0x18
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x733c
push ebx
lea eax, [ebp - 0x24]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x41beb2
mov esi, dword [esi + 0x50]
jmp 0x41beb5
mov esi, dword [esi + 0x54]
cmp esi, ebx
je 0x41bec0
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
call fcn.00451866
ret 4
Function at 0x41c9c1
Capabilities:
Read .ini file

Disassembly:
push 4
mov eax, 0x469062
call fcn.0045178e
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040283c
push dword [0x491100]
mov esi, dword [ebp - 0x10]
push 1
push str.FirstRun
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea ecx, [esi - 0x10]
mov edi, eax
call fcn.0040285d
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040285d
mov eax, edi
call fcn.00451866
ret

Function at 0x41ca11
Capabilities:
Read .ini file

Disassembly:
push 4
mov eax, 0x469062
call fcn.0045178e
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040283c
push dword [0x491104]
mov esi, dword [ebp - 0x10]
push 1
push str.FirstRun
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea ecx, [esi - 0x10]
mov edi, eax
call fcn.0040285d
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040285d
mov eax, edi
call fcn.00451866
ret