joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409e50
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x45984b
push eax
mov eax, dword [0x4970c8]
mov dword fs:[0], esp
sub esp, 0x20c
test eax, eax
push esi
mov esi, ecx
jg 0x409f67
mov eax, dword [0x49741c]
and eax, 0xff
sub eax, 0
je 0x409ea3
dec eax
jne 0x409f02
mov eax, dword [0x4973b4]
mov ecx, dword [0x497624]
push eax
push ecx
mov ecx, esi
call fcn.00408f80
jmp 0x409f02
mov eax, dword [esp + 0x220]
test eax, eax
je 0x409eb8
call fcn.0044c010
call fcn.0044c220
push ecx
mov ecx, esp
mov dword [esp + 8], esp
push 0x497624
call fcn.0045822c
mov edx, dword [0x497620]
mov ecx, 0x4973b4
push edx
mov dword [esp + 0x220], 0xffffffff
call fcn.00409f80
push eax
push str.1234
push str.9380
call fcn.0044cc10
add esp, 0x14
test eax, eax
jne 0x409f02
inc dword [0x4970c8]
mov eax, dword [0x4970c8]
test eax, eax
jle 0x409f67
call fcn.0040ee10
mov eax, dword [esi + 0x20]
push 8
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
lea ecx, [esp + 8]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [esi + 0x3db8]
lea edx, [esp + 8]
push edx
push eax
lea ecx, [esp + 0x114]
push str._sReRun.exe__E:_s
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea edx, [esp + 0x10c]
push 5
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
call dword [sym.imp.MSVCRT.dll_exit]
mov ecx, dword [esp + 0x210]
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x40b9ac
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x2a08
call fcn.00458590
push ebx
push ebp
push esi
mov esi, ecx
lea ecx, [esp + 0x214]
push edi
mov bl, byte [esi + 0x68]
push ecx
cmp bl, 0x86
setne al
dec eax
and eax, 0x10
add eax, 4
mov byte [esp + 0x14], al
mov eax, dword [esp + 0x14]
mov edx, eax
and edx, 0xff
push edx
push 0
push 0
push 0
push 0
push eax
mov eax, dword [esi + 0x64]
push 0
push 0x11
push 0xfa
push eax
call fcn.0043f1c0
add esp, 0x2c
test eax, eax
je 0x40bb56
mov al, byte [esi + 0x68]
mov cl, al
sub cl, 0x86
neg cl
sbb ecx, ecx
and ecx, 0xffffe07a
add ecx, 0x2680
cmp al, 0x92
jne 0x40bab8
xor bl, bl
mov word [esp + 0x14], 0x7f0
mov word [esp + 0x16], 0x7fa
mov dl, 1
mov byte [esp + 0x10], bl
mov ecx, dword [esp + 0x10]
xor eax, eax
and ecx, 0xff
mov ax, word [esp + ecx*2 + 0x14]
movzx cx, byte [esp + eax + 0x21a]
movzx si, byte [esp + eax + 0x21b]
shl ecx, 8
add ecx, esi
mov esi, ecx
and esi, 0xffff
and esi, 0x8000001f
jns 0x40ba72
dec esi
or esi, 0xffffffe0
inc esi
jne 0x40ba9a
movzx si, byte [esp + eax + 0x218]
movzx ax, byte [esp + eax + 0x219]
shl esi, 8
add esi, eax
lea eax, [ecx - 1]
not eax
cmp si, ax
jne 0x40ba9a
test cx, cx
ja 0x40baa7
inc bl
cmp bl, 2
mov byte [esp + 0x10], bl
jb 0x40ba35
jmp 0x40baa9
mov dl, bl
neg dl
sbb edx, edx
and edx, 0xa
add edx, 0x6f0
mov ecx, edx
lea esi, [esp + ecx + 0x218]
mov ecx, 0x60
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov al, byte [esp + 0x10f]
mov cl, byte [esp + 0xe0]
mov dl, byte [esp + 0x9a]
add al, cl
mov cl, byte [esp + 0xb5]
mov bl, al
add bl, cl
add cl, dl
add bl, dl
cmp cl, al
mov byte [esp + 0x10], bl
mov dl, cl
ja 0x40bafc
mov dl, al
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x2a24]
and ecx, 0xff
lea edi, [esp + 0x18]
xor ebp, ebp
lea esi, [esp + ecx + 0x218]
mov ecx, 0x80
test eax, eax
rep movsd dword es:[edi], dword [esi]
jbe 0x40bb56
mov ecx, dword [esp + 0x2a20]
lea esi, [esp + 0x18]
lea eax, [ecx + ebp]
mov edi, 0x200
mov bl, byte [eax]
xor bl, dl
xor bl, byte [esi]
inc esi
mov byte [eax], bl
inc eax
dec edi
jne 0x40bb38
mov eax, dword [esp + 0x2a24]
add ebp, 0x200
cmp ebp, eax
jb 0x40bb2c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a08
ret 0xc
Function at 0x40d790
Capabilities:
Get disk information via ioctl

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x46c
cmp eax, 2
push ebx
push ebp
push esi
push edi
jb 0x40d92d
cmp eax, 3
jbe 0x40d7bf
cmp eax, 5
jne 0x40d92d
mov dword [esp + 0x10], 0x4606e8
jmp 0x40d7c7
mov dword [esp + 0x10], 0x4606f8
mov eax, dword [esp + 0x10]
push 0x12
push 0
push 0
push eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40d92d
mov ebx, dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailA]
xor ebp, ebp
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x64]
rep stosd dword es:[edi], eax
mov eax, 0x1c
mov dword [esp + 0x60], eax
mov dword [esp + 0x44], eax
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
lea ecx, [esp + 0x60]
push ecx
push ebp
push edx
push 0
push esi
call edi
test eax, eax
je 0x40d926
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x44]
push eax
push ebp
push ecx
push 0
push esi
call edi
lea edx, [esp + 0x14]
push 0
push edx
push 0
lea eax, [esp + 0x50]
push 0
push eax
push esi
mov dword [esp + 0x2c], 0
call ebx
mov edx, dword [esp + 0x14]
test edx, edx
je 0x40d903
cmp edx, 0x400
ja 0x40d903
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x7c], 5
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x28]
lea eax, [esp + 0x14]
push ecx
push eax
push edx
lea ecx, [esp + 0x88]
lea edx, [esp + 0x50]
push ecx
push edx
push esi
mov dword [esp + 0x40], 0x1c
call ebx
test eax, eax
je 0x40d903
push 0
push 0
push 3
push 0
push 3
lea eax, [esp + 0x94]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40d903
lea ecx, [esp + 0x18]
push 0
push ecx
lea edx, [esp + 0x24]
push 0xc
push edx
push 0
push 0
push 0x2d1080
push edi
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x40d8fc
mov eax, dword [esp + 0x480]
mov ecx, dword [esp + 0x20]
cmp eax, ecx
je 0x40d909
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebp
jmp 0x40d805
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov eax, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x46c
ret
push esi
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x46c
ret
Function at 0x40e410
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x459f1b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x138
mov eax, dword [0x49306c]
mov edx, dword [0x493068]
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0x18], eax
xor ecx, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 8], ecx
mov dword [esp + 0x20], eax
mov eax, dword [0x4971ec]
push esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], edx
xor edx, edx
push eax
mov eax, dword [0x493048]
mov dword [esp + 0x18], ecx
mov ecx, dword [0x493064]
mov dword [esp + 0x30], edx
and eax, 0xff
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x34], edx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x154]
push 0x104
shl eax, 4
push ecx
push 0x4970cc
lea ecx, [esp + eax + 0x18]
xor esi, esi
push edx
push ecx
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x38]
push 0x49222c
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x40e53c
lea eax, [esp + 0x38]
lea ecx, [esp + 4]
push eax
call sub.MFC42.DLL_CString::CString_2
push 0x49222c
push 0x493060
lea ecx, [esp + 0xc]
mov dword [esp + 0x14c], esi
call sub.MFC42.DLL_CString::Replace
push 0x49305c
push 0x493058
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::Replace
push 0x493054
push 0x493050
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::Replace
mov esi, dword [esp + 0x14c]
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.0045822c
lea ecx, [esp + 4]
mov dword [esp + 0x144], 0xffffffff
call sub.MFC42.DLL_CString::CString
jmp 0x40e54f
mov esi, dword [esp + 0x14c]
lea edx, [esp + 0x38]
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov ecx, dword [esp + 0x13c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x144
ret
Function at 0x40ef70
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x459ffe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x220
push ebx
push esi
push edi
mov al, byte [0x4970cc]
mov ecx, 0x40
mov byte [esp + 0x128], al
xor eax, eax
lea edi, [esp + 0x129]
xor ebx, ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0xc]
mov dword [esp + 0x234], ebx
stosb byte es:[edi], al
call sub.MFC42.DLL_CString::CString_1
mov ecx, dword [esp + 0x23c]
mov byte [esp + 0x234], 1
push ecx
push ebx
push str.Count
push str.FLASHLIST
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x18], esi
jbe 0x40f11e
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x20]
push 0xa
push edx
push ebx
call dword [sym.imp.MSVCRT.dll__itoa]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x34]
add esp, 0xc
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x240]
lea ecx, [esp + 0x28]
push eax
push 0x104
lea edx, [esp + 0x134]
push ecx
push edx
lea eax, [esp + 0x30]
push str.FlashName
push eax
call ebp
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CString::CString_2
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x23c], 2
call fcn.004581c0
lea ecx, [esp + 0x24]
mov byte [esp + 0x238], 1
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 0x240]
lea eax, [esp + 0x28]
push edx
push 0x104
push eax
push 0x4970cc
lea ecx, [esp + 0x30]
push 0x4930a4
push ecx
call ebp
lea edx, [esp + 0x19]
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x1b]
push eax
lea edx, [esp + 0x1e]
push ecx
lea eax, [esp + 0x21]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
lea edx, [esp + 0x40]
push str.0x_02hx_0x_02hx_0x_02hx_0x_02hx_0x_02hx_0x_02hx
push edx
call dword [sym.imp.MSVCRT.dll_sscanf]
mov esi, dword [0x4971f8]
add esp, 0x20
cmp esi, esi
jl 0x40f0d8
lea eax, [esi + 1]
push 0xffffffffffffffff
push eax
mov ecx, 0x4971f0
call fcn.0040f410
mov edx, dword [0x4971f4]
lea ecx, [esi + esi*2]
lea eax, [esp + 0x10]
lea esi, [edx + ecx*4]
push eax
mov ecx, esi
call fcn.004581c0
lea ecx, [esp + 0x10]
mov edi, 0xfffffffc
sub ecx, esi
lea eax, [esi + 4]
sub edi, esi
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
lea edx, [edi + eax]
cmp edx, 6
jb 0x40f100
mov eax, dword [esp + 0x1c]
inc ebx
cmp ebx, eax
jb 0x40eff5
mov esi, eax
pop ebp
lea ecx, [esp + 0xc]
mov byte [esp + 0x234], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x23c]
mov dword [esp + 0x234], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x22c]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x22c
ret
Function at 0x415310
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2cc
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0xdc]
rep stosd dword es:[edi], eax
mov ecx, 0x10
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov ecx, 0x10
lea edi, [esp + 0x9c]
rep stosd dword es:[edi], eax
mov ecx, 0x10
lea edi, [esp + 0x5c]
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
lea edx, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov eax, dword [ebx + 8]
mov dword [esp + 0x18], ebx
mov ecx, dword [eax + 0xf8]
push ecx
push edx
call esi
mov eax, dword [ebx + 8]
lea edx, [esp + 0x64]
mov ecx, dword [eax + 0xfc]
push ecx
push edx
call esi
lea eax, [esp + 0xac]
push str.AlcorMicro
push eax
call esi
push 0
call dword [sym.imp.MSVCRT.dll_time]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 0x20
call dword [sym.imp.MSVCRT.dll_rand]
mov dl, al
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + 0x10], dl
cmp cl, 1
mov byte [esp + 0x14], cl
jne 0x4153c6
mov cl, 2
mov byte [esp + 0x14], cl
mov ebp, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
xor esi, esi
and ebp, 0xff
mov byte [esp + 0x15c], dl
mov byte [esp + 0x15d], cl
jle 0x415404
push 1
push esi
push ebx
call fcn.00417d90
mov cl, byte [esp + esi + 0x28]
add esp, 0xc
xor cl, al
mov byte [esp + esi + 0x15e], cl
inc esi
cmp esi, ebp
jl 0x4153e6
lea edi, [esp + 0x9c]
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + ebp + 0x15e], 0xaa
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor esi, esi
mov byte [esp + 0x14], cl
mov byte [esp + ebp + 0x15f], 0x55
mov edi, dword [esp + 0x14]
mov byte [esp + ebp + 0x160], cl
and edi, 0xff
jle 0x415462
push 1
push esi
push ebx
call fcn.00417d90
mov dl, byte [esp + esi + 0xa8]
add esp, 0xc
xor dl, al
lea eax, [esp + ebp + 0x161]
mov byte [eax + esi], dl
inc esi
cmp esi, edi
jl 0x41543e
mov cl, byte [esp + 0x10]
lea eax, [edi + ebp]
lea edi, [esp + 0x5c]
mov byte [esp + eax + 0x161], 0xaa
mov byte [esp + eax + 0x162], 0x55
mov byte [esp + eax + 0x163], cl
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + 0x10], cl
mov byte [esp + 0x1dc], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
jle 0x4154be
mov edx, ecx
lea esi, [esp + 0x5c]
lea edi, [esp + 0x1dd]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xdc]
push eax
call fcn.00418320
pop edi
pop esi
pop ebp
pop ebx
test eax, eax
jne 0x4154ee
lea ecx, [esp + 8]
push 0x48d780
push ecx
mov dword [esp + 0x10], 0x92200
call sub.MSVCRT.dll__CxxThrowException
add esp, 0x2cc
ret
Function at 0x41b7f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
mov bl, byte [ecx + 0x134]
test bl, bl
push ebp
push esi
mov esi, dword [esp + 0x24]
push edi
setne al
inc eax
and esi, 0xffff
mov byte [esp + 0x10], al
mov eax, esi
mov ebp, dword [esp + 0x10]
mov edi, dword [esp + 0x1c]
cdq
and ebp, 0xff
idiv ebp
mov edx, eax
mov dword [esp + 0x14], eax
and edx, 0xffff
xor eax, eax
mov ecx, edx
mov dword [esp + 0x10], edx
mov ebx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
cmp word [esp + 0x28], 0
rep stosb byte es:[edi], al
jbe 0x41b897
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
xor ecx, ecx
sub edi, eax
mov dword [esp + 0x28], esi
mov edx, dword [esp + 0x24]
mov eax, ecx
xor ebx, ebx
lea esi, [ecx + edx]
cdq
idiv ebp
mov edx, dword [esp + 0x1c]
mov bl, byte [esi]
add eax, edx
xor edx, edx
mov dl, byte [edi + esi]
xor edx, ebx
mov bl, byte [eax]
mov dl, byte [edx + 0x469b14]
add bl, dl
inc ecx
mov byte [eax], bl
mov eax, dword [esp + 0x28]
dec eax
mov dword [esp + 0x28], eax
jne 0x41b85e
mov edx, dword [esp + 0x10]
xor eax, eax
cmp word [esp + 0x14], ax
jbe 0x41b8ae
mov ecx, dword [esp + 0x1c]
cmp byte [ecx], 0
je 0x41b8aa
inc eax
inc ecx
dec edx
jne 0x41b8a4
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x10
Function at 0x41bae0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x42c
push ebx
push ebp
mov ebp, ecx
push esi
push edi
push 0
mov al, byte [ebp + 0x592c]
push eax
call fcn.00433c60
mov bl, al
mov eax, 0x100
mov byte [esp + 0x10], bl
mov ecx, dword [esp + 0x10]
cdq
and ecx, 0xff
lea edi, [esp + 0x3c]
idiv ecx
mov ecx, 0x80
mov byte [esp + 0x14], 0
mov dword [esp + 0x18], eax
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, 0x80
or eax, 0xffffffff
lea edi, [esp + 0x23c]
rep stosd dword es:[edi], eax
test bl, bl
mov byte [esp + 0x3c], bl
jbe 0x41bc70
mov edi, dword [esp + 0x14]
mov dl, byte [ebp + 0x592c]
push edi
push edx
mov ecx, ebp
call fcn.00433cc0
mov ecx, dword [esp + 0x444]
mov edx, dword [esp + 0x440]
push eax
mov eax, dword [esp + 0x44c]
push eax
push ecx
push edx
mov ecx, ebp
call fcn.0041bde0
and eax, 0xff
mov ecx, eax
shl ecx, 7
add ecx, eax
lea edx, [eax + ecx*2]
mov eax, dword [ebp + 0x5938]
mov cx, word [esp + 0x18]
cmp word [eax + edx*2 + 4], cx
lea esi, [eax + edx*2]
jae 0x41bc90
lea edx, [esp + 0x24]
lea eax, [esp + 0x1c]
push edx
lea ecx, [esp + 0x30]
push eax
push ecx
push esi
mov ecx, ebp
call fcn.0041b900
mov eax, edi
xor edx, edx
mov dl, byte [esi + 5]
and eax, 0xff
lea edi, [esp + 0x2c]
mov byte [esp + eax*2 + 0x4c], dl
mov cl, byte [esi + 4]
mov edx, eax
mov byte [esp + eax*2 + 0x4d], cl
shl edx, 4
lea ecx, [esp + edx + 0x5c]
mov edx, 8
sub edi, ecx
xor ebx, ebx
mov bl, byte [edi + ecx + 1]
mov byte [ecx], bl
mov bl, byte [edi + ecx]
mov byte [ecx + 1], bl
add ecx, 2
dec edx
jne 0x41bbe2
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov dword [esp + eax*8 + 0x7c], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + eax*8 + 0x80], edx
mov dword [esp + eax*8 + 0x8c], ecx
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x28]
and ecx, 0xffff
mov dword [esp + eax*8 + 0x90], edx
imul ecx, eax
lea edi, [esp + ecx*2 + 0x23c]
xor ecx, ecx
cmp word [esi + 4], cx
jbe 0x41bc5a
mov eax, ecx
and eax, 0xffff
mov dl, byte [esi + eax*2 + 6]
mov byte [edi + eax*2], dl
xor edx, edx
mov dl, byte [esi + eax*2 + 7]
inc ecx
mov byte [edi + eax*2 + 1], dl
cmp cx, word [esi + 4]
jb 0x41bc3b
mov al, byte [esp + 0x14]
mov cl, byte [esp + 0x10]
inc al
cmp al, cl
mov byte [esp + 0x14], al
jb 0x41bb45
lea ecx, [esp + 0x3c]
push ecx
push 2
mov ecx, ebp
call fcn.0041bea0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x42c
ret 0xc
lea eax, [esp + 0x10]
push 0x48d780
push eax
mov dword [esp + 0x18], 0xffffffee
call sub.MSVCRT.dll__CxxThrowException
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x41c0d0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x45a8db
push eax
mov eax, dword [0x4971e8]
mov dword fs:[0], esp
sub esp, 0x110
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
xor ebp, ebp
push eax
push ebp
push str.SetSortClass
mov esi, ecx
push str.DBG_SetSortClass
call edi
test eax, eax
je 0x41c2af
mov ecx, dword [0x4971e8]
push ecx
push 1
push str.UsedOfWL
push str.DBG_SetSortClass
call edi
mov byte [esi + 0x592c], al
mov edx, dword [0x4971e8]
push edx
push 1
push str.SortMain
push str.DBG_SetSortClass
call edi
mov byte [esi + 0xea], al
mov eax, dword [0x4971e8]
push eax
push 0xffff
push str.SortSub
push str.DBG_SetSortClass
call edi
lea ecx, [esp + 0x10]
mov word [esi + 0xec], ax
call sub.MFC42.DLL_CString::CString_1
mov ecx, 0xc0
or eax, 0xffffffff
lea edi, [esi + 0x52f6]
mov dword [esp + 0x124], ebp
rep stosd dword es:[edi], eax
mov ax, word [esi + 0x126]
xor ecx, ecx
cmp ax, bp
mov dword [esp + 0xc], ecx
jbe 0x41c273
push ebx
mov ecx, ebp
and eax, 0xffff
and ecx, 0xffff
sub eax, ecx
cmp eax, 0x10
mov ebx, eax
jl 0x41c1b9
mov ebx, 0x10
push ecx
lea ecx, [esp + 0x18]
push str.PMT_03d
push ecx
call sub.MFC42.DLL_CString::Format
mov edx, dword [0x4971e8]
mov ecx, dword [esp + 0x20]
add esp, 0xc
lea eax, [esp + 0x1c]
push edx
push 0x104
push eax
push 0x4970cc
push ecx
push str.DBG_SetSortClass
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
mov edx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
and edx, 0xffff
cmp ecx, edx
jae 0x41c218
push eax
push eax
push str.ERR_SET_PMT
call sub.MFC42.DLL_AfxMessageBox
xor eax, eax
test bx, bx
jbe 0x41c25b
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x18]
cmp byte [edx], 0x31
jne 0x41c24c
mov ecx, dword [esp + 0x10]
lea edx, [eax + ebp]
mov edi, ecx
and edi, 0xffff
inc ecx
mov dword [esp + 0x10], ecx
mov word [esi + edi*2 + 0x52f6], dx
mov edx, dword [esp + 0x18]
inc eax
inc edx
cmp ax, bx
mov dword [esp + 0x18], edx
jb 0x41c227
mov ax, word [esi + 0x126]
add ebp, 0x10
cmp bp, ax
jb 0x41c19e
mov ecx, dword [esp + 0x10]
pop ebx
test cx, cx
jbe 0x41c296
mov eax, ecx
and eax, 0xffff
mov ecx, eax
add eax, 7
shr eax, 3
cmp ecx, 8
jge 0x41c290
mov dword [esp + 0xc], ecx
sub ecx, 8
dec eax
jne 0x41c287
lea ecx, [esp + 0x10]
mov dword [esp + 0x124], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x11c
ret
Function at 0x41c3c0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x45a914
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov esi, ecx
push ebp
push eax
mov dword [esp + 0x18], esi
call fcn.00412450
xor ebx, ebx
lea ecx, [esi + 0x100]
mov dword [esp + 0x1c], ebx
call fcn.00428820
lea edi, [esi + 0x4654]
mov ecx, 0x11
or eax, 0xffffffff
mov byte [esp + 0x1c], 1
rep stosd dword es:[edi], eax
lea ecx, [esi + 0x46c0]
stosb byte es:[edi], al
call sub.MFC42.DLL_CString::CString_1
mov eax, 1
mov dword [esi], 0x46ec80
mov dword [esi + 0x46b4], eax
mov dword [esi + 0x46b8], eax
mov ecx, dword [0x4971e8]
mov byte [esp + 0x1c], 2
push ecx
push ebx
push str.UseOldId
push str.Scan
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov byte [esi + 0x46bc], al
mov dword [esi + 0x5914], ebx
mov byte [esi + 0x52f5], bl
mov byte [esi + 0x46c4], 0xff
mov dl, byte [ebp + 0x423]
mov ecx, esi
neg dl
sbb dl, dl
mov dword [esi + 0x5938], ebx
and edx, 0xff
mov byte [esi + 0x590c], dl
call fcn.0041c660
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x420390
Capabilities:
Access peb ldr_data
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x45ab30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [0x4971e8]
push ebx
push esi
push edi
xor ebx, ebx
push eax
push ebx
push str.SeparateSLC
mov esi, ecx
push str.Debug
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dl, byte [esi + 0xe4]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x80
push edx
push ecx
mov ecx, esi
mov edi, eax
call fcn.00421bb0
mov al, byte [esi + 0xea]
mov cl, byte [esi + 0xe4]
push 0x80
push eax
lea edx, [esp + 0x18]
push ecx
push edx
mov ecx, esi
call fcn.00421ca0
lea eax, [esp + 0x18]
lea edx, [esp + 0xc]
push eax
push 0x80
push ecx
mov dword [esp + 0x44], ebx
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.0045822c
mov ax, word [esi + 0x20]
mov cl, byte [esi + 0x23]
push eax
push ecx
push ecx
mov byte [esp + 0x50], 1
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x49770c
call fcn.0045822c
lea ecx, [esi + 0x100]
mov byte [esp + 0x50], bl
call fcn.00428e40
mov al, byte [esi + 0x12f]
cmp al, bl
je 0x42049b
mov dl, byte [esi + 0x592c]
and dl, 1
cmp dl, 1
jne 0x42049b
cmp edi, ebx
je 0x420478
cmp al, 3
jne 0x420478
mov ecx, esi
call fcn.00426e50
jmp 0x4204a3
cmp dword [esi + 0x6024], ebx
je 0x42048c
cmp dword [esi + 0x6028], ebx
je 0x42048c
mov bl, 8
jmp 0x4204a8
mov al, byte [esp + 0x29]
imul byte [esp + 0x28]
mov bl, al
add bl, 0xc
jmp 0x4204a8
mov al, byte [esp + 0x29]
imul byte [esp + 0x28]
mov bl, al
add bl, 8
mov al, byte [esi + 0x16d]
mov ecx, dword [esp + 0x40]
inc al
mov dword [esp + 0x38], 0xffffffff
mov byte [ecx], al
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x30]
pop edi
mov al, bl
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x30
ret 4