joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47b910
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
sub esp, 0x12c
test dl, dl
jne 0x47b932
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
je 0x47b9e6
mov al, 1
add esp, 0x12c
ret
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x28]
push eax
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea ecx, [esp + 0x24]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47b950
sub ecx, edx
je 0x47b966
cmp byte [esp + ecx + 0x23], 0x5c
jne 0x47b966
mov byte [esp + ecx + 0x23], al
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x47b9e6
test al, 0x10
je 0x47b9e6
lea ecx, [esp + 0x24]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47b981
sub ecx, edx
mov dword [esp + 0xc], 0
mov dword [esp + 0x16], 0
mov dword [esp + 0x1a], 0
mov dword [esp + 0x12], 0
mov byte [esp + ecx + 0x25], al
lea eax, [esp + 0x24]
mov dword [esp + 8], eax
mov eax, 0x614
mov word [esp + 0x10], ax
lea eax, [esp]
push eax
mov dword [esp + 4], 0
mov dword [esp + 8], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
sete al
add esp, 0x12c
ret
xor al, al
add esp, 0x12c
ret
Function at 0x47be80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x148
push esi
mov esi, ecx
push 0x2a
push esi
call fcn.004ca733
add esp, 8
test eax, eax
jne 0x47bebd
push 0x3f
push esi
call fcn.004ca733
add esp, 8
test eax, eax
jne 0x47bebd
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x47bece
mov al, 1
pop esi
add esp, 0x148
ret
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x47bed8
xor al, al
pop esi
add esp, 0x148
ret
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
pop esi
add esp, 0x148
ret

Function at 0x47bef0
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push esi
push eax
push 0x28
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x47bf63
lea eax, [esp + 0xc]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push 0
push 0
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 1
push eax
push 0
push dword [esp + 0x18]
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x47bf63
push eax
push esi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x47bf63
mov al, 1
pop esi
add esp, 0x14
ret
xor al, al
pop esi
add esp, 0x14
ret
Function at 0x47bf70
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x554
push ebx
push ebp
push esi
push edi
push 0
mov ebx, ecx
mov dword [esp + 0x1c], 0x128
push 2
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebp, eax
lea eax, [esp + 0x18]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_Process32First]
push 0
push 0
push 1
xor edx, edx
mov ecx, ebx
call fcn.004ab8c0
add esp, 0xc
test eax, eax
je 0x47c016
mov ecx, ebx
mov al, byte [ecx]
cmp al, 0x20
je 0x47bfc2
cmp al, 9
jne 0x47bfc5
inc ecx
jmp 0x47bfb8
test al, al
je 0x47c009
cmp al, 0x2d
je 0x47bfd1
cmp al, 0x2b
jne 0x47bfd8
lea eax, [ecx + 1]
mov ecx, eax
mov al, byte [eax]
cmp al, 0x30
jne 0x47c009
mov al, byte [ecx + 1]
cmp al, 0x78
je 0x47bfe7
cmp al, 0x58
jne 0x47c009
movsx eax, byte [ecx + 2]
push eax
call fcn.004c4410
add esp, 4
test eax, eax
je 0x47c009
push 0x10
push 0
push ebx
call fcn.004c4c8d
add esp, 0xc
mov ebx, eax
jmp 0x47c018
push ebx
call fcn.004c4db1
add esp, 4
mov ebx, eax
jmp 0x47c018
xor ebx, ebx
lea eax, [esp + 0x18]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x47c0c7
nop dword [eax]
test ebx, ebx
je 0x47c03e
cmp ebx, dword [esp + 0x20]
je 0x47c0db
lea eax, [esp + 0x248]
push eax
lea eax, [esp + 0x144]
push eax
lea eax, [esp + 0x358]
push eax
lea eax, [esp + 0x464]
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.004cdea6
lea eax, [esp + 0x25c]
add esp, 0x14
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47c074
lea edi, [esp + 0x140]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x47c085
push dword [esp + 0x14]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x144]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.004c408e
add esp, 8
test eax, eax
je 0x47c0ef
lea eax, [esp + 0x18]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x47c030
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x554
ret
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x554
ret
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x554
ret
Function at 0x491240
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 4], 0
je 0x49142f
mov eax, dword [esi + 0x10]
xor edi, edi
test eax, eax
je 0x4912c5
xor ebx, ebx
mov eax, dword [esi + 0x18]
add eax, ebx
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x491285
cmp byte [eax + 4], 6
je 0x491285
push str.Submit
push eax
push ecx
mov ecx, esi
call fcn.004914e0
jmp 0x4912ba
cmp dword [eax + 0x3c], 0
je 0x4912ba
cmp byte [eax + 4], 6
je 0x4912ba
mov ecx, dword [esi + 0xd4]
push 0x4e3371
test ecx, ecx
jne 0x4912b1
push str.No_object_to_invoke.
mov ecx, 0x4fda88
call fcn.0044dd10
jmp 0x4912ba
push eax
push ecx
mov ecx, esi
call fcn.00491fd0
mov eax, dword [esi + 0x10]
inc edi
add ebx, 0x40
cmp edi, eax
jb 0x491263
xor ebx, ebx
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x14], ebx
xor edi, edi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], edx
mov ebx, ecx
mov dword [esp + 0x1c], ecx
cmp ecx, eax
mov dword [esp + 0x18], ecx
je 0x491304
mov eax, dword [esi + 0x18]
mov ecx, dword [esp + 0x18]
push 0xfffffffffffffff0
push dword [eax + ecx]
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x20000
je 0x491357
mov edx, dword [esp + 0x10]
cmp edi, 1
jne 0x491338
cmp edx, edi
jle 0x491338
push 0xa
lea eax, [esp + 0x2c]
push eax
xor eax, eax
cmp ebx, 0xffffffff
cmovne eax, ebx
push eax
call fcn.004c3fb8
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x34]
add esp, 0xc
push edi
push 0
push 0xffffffffffffffff
push eax
call fcn.004b01a0
mov eax, dword [esp + 0x1c]
cmp eax, dword [esi + 0x10]
je 0x49141e
xor edi, edi
mov dword [esp + 0x14], 0
xor ecx, ecx
mov dword [esp + 0x10], ecx
jmp 0x49135b
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
add edx, dword [esi + 0x18]
cmp byte [edx + 4], 6
jne 0x4913fd
mov ebx, dword [edx + 8]
inc ecx
test ebx, ebx
mov dword [esp + 0x10], ecx
mov eax, ebx
cmove eax, dword [esp + 0xc]
push 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x28], eax
lea eax, [edi + 1]
push 0
cmove eax, edi
push 0xf0
push dword [edx]
mov edi, eax
mov dword [esp + 0x30], edi
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 1
jne 0x4913d3
cmp dword [esp + 0x14], 0
mov ecx, 0xffffffff
mov eax, dword [esp + 0x10]
cmovne eax, ecx
mov dword [esp + 0x14], eax
test ebx, ebx
je 0x4913fd
push 1
push 0
push ecx
push 0x4e37f8
mov ecx, ebx
call fcn.004b01a0
jmp 0x4913fd
mov edx, dword [esp + 0xc]
mov dword [esp + 0xc], edx
test ebx, ebx
je 0x4913fd
push 1
push 0
push 0xffffffffffffffff
push 0x4e33f8
mov ecx, ebx
call fcn.004b01a0
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x1c]
add dword [esp + 0x18], 0x40
inc ecx
mov eax, dword [esi + 0x10]
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x1c], ecx
cmp ecx, eax
jbe 0x4912e5
cmp byte [ebp + 8], 0
je 0x49142f
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x495620
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
mov esi, ecx
xor bl, bl
mov al, byte [esi]
test al, al
je 0x49564f
nop dword [eax]
cmp al, 0x21
je 0x495644
cmp al, 0x2b
je 0x495640
cmp al, 0x5e
jne 0x49564f
mov al, 2
jmp 0x495646
mov al, 1
jmp 0x495646
mov al, 4
inc esi
or bl, al
mov al, byte [esi]
test al, al
jne 0x495630
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push ecx
push 0
xor edx, edx
mov ecx, esi
call fcn.0041d8d0
mov bh, al
add esp, 0xc
test bh, bh
jne 0x495672
pop esi
xor eax, eax
pop ebx
ret
xor edx, edx
mov ecx, esi
call fcn.0041d7e0
movzx edx, ax
test dx, dx
jne 0x49568f
xor dl, dl
mov cl, bh
call fcn.0041de90
movzx edx, ax
mov al, bl
or al, 8
and edx, 0x100
movzx ecx, al
movzx eax, bl
cmove ecx, eax
movzx eax, cl
movzx ecx, bh
shl ax, 8
pop esi
or ax, cx
pop ebx
ret
Function at 0x496cd0
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esp + 8], connect
movzx eax, byte [esi + 4]
add eax, 0xfffffff7
cmp eax, 8
ja case.0x496cf6.12
jmp dword [eax*4 + 0x496dec]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x19f
push dword [esi]
call edi
cmp eax, 0xffffffff
je case.0x496cf6.12
lea ecx, [esp + 8]
push ecx
push eax
push 0x198
push dword [esi]
call edi
jmp case.0x496cf6.12
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 1
push 0xffffffffffffffff
push 0x100c
push dword [esi]
call edi
cmp eax, 0xffffffff
je case.0x496cf6.12
lea ecx, [esp + 8]
mov dword [esp + 8], 2
push ecx
push eax
push 0x100e
push dword [esi]
call edi
jmp case.0x496cf6.12
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 9
push 0x110a
push dword [esi]
call edi
test eax, eax
je case.0x496cf6.12
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 1
push 0x1104
push dword [esi]
call edi
jmp case.0x496cf6.12
lea eax, [esp + 8]
push eax
push 0
push 0x419
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [esp + 8], 0x80000000
lea ecx, [esp + 8]
mov eax, dword [esi]
jne 0x496db6
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x496dc2
push 2
push ecx
push 0
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov esi, dword [ebp + 0xc]
mov eax, dword [esp + 8]
pop edi
mov dword [esi], eax
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 8]
cdq
sub eax, edx
sar eax, 1
add eax, 2
add eax, dword [esp + 8]
mov dword [esi + 4], eax
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4972f0
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x14], edx
mov esi, ecx
nop dword [eax]
mov al, byte [esi]
cmp al, 0x20
je 0x49730a
cmp al, 9
jne 0x49730d
inc esi
jmp 0x497300
test al, al
je 0x497465
cmp byte [esi + 1], 0
lea ecx, [esi + 1]
jne 0x497332
pop edi
pop esi
movzx eax, al
pop ebp
mov word [edx + 2], ax
mov al, 1
mov byte [edx], 0
pop ebx
add esp, 8
ret
push 0x2b
xor bl, bl
mov byte [edx], 1
push ecx
mov byte [esp + 0x1b], bl
call fcn.004ca733
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x4973ed
lea edi, [ebp - 1]
cmp edi, esi
jbe 0x497366
mov al, byte [edi]
cmp al, 0x20
je 0x497361
cmp al, 9
jne 0x497366
dec edi
cmp edi, esi
ja 0x497357
sub edi, esi
inc edi
push edi
push str.Ctrl
push esi
call fcn.004c4e4b
add esp, 0xc
test eax, eax
jne 0x497381
or bl, 1
jmp 0x4973b3
push edi
push 0x4e8714
push esi
call fcn.004c4e4b
add esp, 0xc
test eax, eax
jne 0x497399
or bl, 4
jmp 0x4973b3
push edi
push str.Shift
push esi
call fcn.004c4e4b
add esp, 0xc
test eax, eax
jne 0x497465
or bl, 0x10
mov byte [esp + 0x13], bl
lea esi, [ebp + 1]
nop word [eax + eax]
mov al, byte [esi]
cmp al, 0x20
je 0x4973ca
cmp al, 9
jne 0x4973cd
inc esi
jmp 0x4973c0
test al, al
je 0x497465
lea eax, [esi + 1]
push 0x2b
push eax
call fcn.004ca733
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x497350
cmp byte [esi + 1], 0
push 0
jne 0x49741e
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx ecx, byte [esi]
mov edi, eax
push ecx
call dword [sym.imp.USER32.dll_CharLowerA]
push 1
push edi
lea edx, [esp + 0x1b]
mov cl, al
call fcn.0041d9e0
mov bl, byte [esp + 0x1b]
add esp, 8
jmp 0x497434
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push ecx
push 0
xor edx, edx
mov ecx, esi
call fcn.0041d8d0
add esp, 0xc
movzx ecx, al
mov eax, dword [esp + 0x14]
mov word [eax + 2], cx
test bl, 1
je 0x497447
or byte [eax], 8
test bl, 4
je 0x49744f
or byte [eax], 0x10
test bl, 0x10
je 0x497457
or byte [eax], 4
pop edi
pop esi
test cx, cx
pop ebp
setne al
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret
Function at 0x499460
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
push ebx
mov ebx, dword [esp + 0x70]
mov edx, ebx
push ebp
push esi
push edi
mov edi, ecx
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x499472
sub edx, ecx
cmp edx, 0x104
ja 0x499617
mov esi, dword [esp + 0x78]
xor edx, edx
mov cl, byte [ebx]
mov ebp, 0x800
test cl, cl
mov byte [esp + 0x7c], cl
movzx eax, word [esi + 0x1e]
cmovne ebp, edx
mov edx, dword [edi + 0x20]
and eax, 0xfffff6fb
or ebp, eax
test edx, edx
jne 0x4994c4
push ebx
push esi
mov word [esi + 0x1e], bp
call fcn.00499630
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret 8
xor ecx, ecx
mov dword [esp + 0x10], 0x30
mov dword [esp + 0x14], ecx
cmp byte [esp + 0x7c], cl
je 0x4994f2
movzx eax, word [esi + 0x1e]
test eax, 0x800
je 0x499527
movzx eax, word [esi + 0x1c]
mov ecx, 1
mov dword [esp + 0x1c], eax
jmp 0x499527
cmp dword [edi + 0xc], esi
jne 0x499527
push 0
cmp edi, dword [0x4fe11c]
jne 0x499513
or eax, 0xffffffff
mov ecx, 0xff14
cmp byte [edi + 0x10], 0
cmovne eax, ecx
push eax
jmp 0x499515
push 0xffffffffffffffff
push edx
call dword [sym.imp.USER32.dll_SetMenuDefaultItem]
mov ecx, dword [esp + 0x14]
mov dword [edi + 0xc], 0
push 9
push dword [esi]
or ecx, 0x10
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x3c], ebx
call fcn.004ca733
push 9
push ebx
mov ebp, eax
call fcn.004ca733
add esp, 0x10
mov ecx, eax
test ebp, ebp
je 0x499564
test ecx, ecx
je 0x499564
push ecx
push ebp
call fcn.004c408e
add esp, 8
mov ebp, eax
jmp 0x499571
xor eax, eax
cmp ebp, ecx
setne al
mov dword [esp + 0x7c], eax
mov ebp, eax
lea eax, [esp + 0x10]
push eax
push 0
push dword [esi + 0x14]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SetMenuItemInfoA]
cmp dword [edi + 0x24], 2
mov dword [esp + 0x7c], eax
jne 0x4995a3
cmp dword [0x4fb960], 0
je 0x4995a3
mov ecx, dword [edi + 0x20]
call fcn.004871f0
mov eax, dword [esp + 0x7c]
test eax, eax
je 0x499617
push ebx
push esi
call fcn.00499630
test eax, eax
je 0x499617
mov ax, word [esp + 0x18]
mov word [esi + 0x1e], ax
test ebp, ebp
je 0x4995c6
mov ecx, edi
call fcn.00499df0
cmp byte [ebx], 0
je 0x499608
mov eax, dword [esi + 0x24]
test eax, eax
je 0x499608
cmp byte [0x4fe263], 0
mov ecx, 0xffffffff
mov dword [esp + 0x40], 0x30
cmovne ecx, eax
mov dword [esp + 0x44], 0x80
lea eax, [esp + 0x40]
mov dword [esp + 0x6c], ecx
push eax
push 0
push dword [esi + 0x14]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SetMenuItemInfoA]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x64
ret 8
Function at 0x49d9b0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dd36d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
mov ebx, ecx
mov dword [ebp - 0x14], 0
push esi
xor edx, edx
mov dword [ebp - 0x24], ebx
lea esi, [ebp - 0x24]
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebx + 4]
mov eax, dword [ebx + 8]
push edi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], eax
mov dword [ebx + 4], esi
mov dword [ebp - 4], edx
test eax, eax
jle 0x49dad8
nop dword [eax]
cmp edx, dword [ebp + 0x10]
jl 0x49da52
cmp dword [0x4fb964], 0
mov ecx, 0x3a
mov eax, dword [0x4f898c]
mov esi, 0x4fb850
mov edi, eax
xorps xmm0, xmm0
rep movsd dword es:[edi], dword [esi]
mov dword [eax + 0x2c], 0
movlpd qword [0x4fe0c8], xmm0
je 0x49da4f
mov eax, dword [0x4fa378]
mov ecx, 0x4e3371
test eax, eax
je 0x49da48
mov eax, dword [eax]
test eax, eax
cmovne ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebx]
add edx, edx
push 0
mov ecx, dword [eax + edx*8]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
mov edx, ecx
push dword [ebp + 8]
push str.call
call fcn.0049a410
add esp, 0x14
test eax, eax
je 0x49daba
cmp dword [ebp - 0x14], 0
jne 0x49da99
mov edx, dword [ebp - 0x1c]
inc edx
mov dword [ebp - 0x1c], edx
cmp edx, dword [ebp - 0x18]
jl 0x49da00
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
mov dword [ecx + 4], edx
jmp 0x49dadb
mov ecx, dword [ebp - 0x24]
mov eax, 3
mov edx, dword [ebp - 0x20]
mov dword [ecx + 4], edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 0x24]
xor eax, eax
mov edx, dword [ebp - 0x20]
mov dword [ecx + 4], edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov dword [ebx + 4], ecx
mov ecx, dword [ebp - 0xc]
mov eax, 1
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4a2dd0
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x1010c
call fcn.004db810
push esi
mov esi, dword [esp + 0x10120]
test esi, esi
je 0x4a2deb
cmp byte [esi], 0
jne 0x4a2df0
mov esi, str.ERROR
lea eax, [esp + 8]
mov byte [esp + 0x110], 0
push eax
lea eax, [esp + 0x10]
mov byte [esp + 0xb], 0
push eax
push 0x104
push dword [esp + 0x10120]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov eax, dword [esp + 0x1011c]
mov ecx, dword [esp + 0x10118]
cmp byte [eax], 0
mov dl, byte [ecx]
je 0x4a2e77
push edi
lea edi, [esp + 0x10]
test dl, dl
push edi
push 0xffff
lea edi, [esp + 0x11c]
push edi
push esi
push eax
lea eax, [esp + 0x1f]
cmovne eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
pop edi
mov ecx, dword [0x4fd110]
lea eax, [esp + 0x110]
push 1
push 0
push 0xffffffffffffffff
push eax
call fcn.004b01a0
pop esi
add esp, 0x1010c
ret 0x10
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x114]
push 0xffff
push eax
test dl, dl
je 0x4a2e96
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
jmp 0x4a2e9c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
test eax, eax
je 0x4a2e54
lea eax, [esp + 0x110]
cmp byte [eax], 0
jne 0x4a2eb5
cmp byte [eax + 1], 0
je 0x4a2e54
mov byte [eax], 0xa
inc eax
jmp 0x4a2ea7
Function at 0x4a3750
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x110
push ebx
push ebp
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea eax, [esp + 0x10]
push esi
push edi
push eax
push 0
push 0
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0xff
push eax
lea eax, [esp + 0x34]
mov edi, ecx
push eax
push 0
push edi
call ebx
cmp eax, 0x103
je 0x4a3816
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
nop dword [eax + eax]
lea eax, [esp + 0x14]
push eax
mov eax, dword [0x4f898c]
mov eax, dword [eax + 0xb0]
or eax, 0x20019
push eax
push 0
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4a3820
mov ecx, dword [esp + 0x14]
call fcn.004a3750
push dword [esp + 0x14]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4a3820
lea eax, [esp + 0x20]
push eax
push edi
call ebp
mov esi, eax
test esi, esi
jne 0x4a3820
lea eax, [esp + 0x18]
mov dword [esp + 0x10], 0xff
push eax
push esi
push esi
push esi
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push esi
push edi
call ebx
cmp eax, 0x103
jne 0x4a37a0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a3830
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov dword [esp + 8], ecx
push esi
push edi
test ebp, ebp
je 0x4a3924
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
test edi, edi
je 0x4a3856
cmp byte [edi], 0
jne 0x4a385e
test ebx, ebx
je 0x4a3924
lea eax, [esp + 0x18]
push eax
mov eax, dword [0x4f898c]
mov eax, dword [eax + 0xb0]
or eax, 0x2001f
push eax
push 0
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4a3929
test ebx, ebx
jne 0x4a390b
mov ecx, dword [esp + 0x18]
call fcn.004a3750
push dword [esp + 0x18]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4a3929
mov eax, dword [0x51f8e4]
test al, 1
jne 0x4a38db
push str.RegDeleteKeyExA
or eax, 1
push str.advapi32
mov dword [0x51f8e4], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov dword [0x51f8e8], ecx
jmp 0x4a38e1
mov ecx, dword [0x51f8e8]
mov eax, dword [0x4f898c]
mov eax, dword [eax + 0xb0]
test eax, eax
je 0x4a38ff
test ecx, ecx
je 0x4a38ff
push 0
push eax
push edi
push ebp
call ecx
mov esi, eax
jmp 0x4a3929
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
jmp 0x4a3929
push ebx
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [esp + 0x18]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4a3929
mov esi, 0x57
mov ecx, dword [esp + 0x10]
test esi, esi
push esi
setne al
movzx eax, al
push eax
call fcn.0044d680
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x4ac7f0
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x148
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x4ac89f
cmp byte [edi], 0
je 0x4ac89f
push 4
push 0x4f0748
push edi
call fcn.004cc747
add esp, 0xc
test eax, eax
je 0x4ac828
mov eax, edi
mov esi, eax
jmp 0x4ac831
lea eax, [edi + 4]
mov esi, eax
test eax, eax
je 0x4ac854
mov dl, byte [eax]
test dl, dl
je 0x4ac854
mov ecx, 0x4eecb4
mov al, 0x3f
nop
cmp dl, al
je 0x4ac871
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4ac840
mov dl, byte [esi + 1]
inc esi
test dl, dl
jne 0x4ac837
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test ebx, ebx
je 0x4ac861
mov dword [ebx], eax
cmp eax, 0xffffffff
setne al
pop edi
pop esi
pop ebx
add esp, 0x148
ret
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4ac89f
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
je 0x4ac893
mov eax, dword [esp + 0x10]
mov dword [ebx], eax
mov al, 1
pop edi
pop esi
pop ebx
add esp, 0x148
ret
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x148
ret

Function at 0x4acdc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push edi
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x1c]
or eax, 1
push eax
push 0
push str.SOFTWAREAutoHotkey
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [esp + 0x10]
test eax, eax
jne 0x4ace62
push esi
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x104
push eax
push edi
push 0
push 0
push str.InstallDir
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x4ace62
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4ace62
dec ecx
mov dword [esp + 0x18], ecx
cmp byte [ecx + edi], 0
jne 0x4ace4a
mov eax, ecx
test ecx, ecx
je 0x4ace67
cmp byte [ecx + edi - 1], 0
jne 0x4ace67
add ecx, 0xffffffff
mov eax, ecx
mov dword [esp + 0x18], ecx
jne 0x4ace35
pop edi
pop ecx
ret
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, 0x104
jae 0x4ace62
mov byte [ecx + edi], 0
mov eax, dword [esp + 0x18]
pop edi
pop ecx
ret
mov byte [edi], 0
xor eax, eax
pop edi
pop ecx
ret