joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408fed
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, 0x401068
cmp eax, ebx
je 0x409097
cmp dword [ebp + 0xc], eax
je 0x409097
push esi
push edi
push 0x208
mov edi, 0x104
call dword [sym.imp.cmutil.dll_CmMalloc]
mov esi, eax
test esi, esi
je 0x409091
push dword [ebp + 0xc]
push edi
push esi
push ebx
push 0x402a4c
push 0x401498
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edx, eax
lea ecx, [edi - 2]
cmp edx, ecx
jne 0x409052
xor eax, eax
cmp eax, 0x401498
je 0x409069
cmp eax, 0x402a4c
je 0x409069
lea eax, [edi - 1]
cmp edx, eax
jne 0x409084
xor eax, eax
cmp eax, 0x401498
je 0x409084
cmp eax, 0x402a4c
je 0x409084
add edi, edi
cmp edi, 0x100000
ja 0x409091
lea eax, [edi + edi]
push eax
push esi
call dword [sym.imp.cmutil.dll_CmRealloc]
test eax, eax
jne 0x40901d
jmp 0x409088
test edx, edx
jne 0x409091
push esi
call dword [sym.imp.cmutil.dll_CmFree]
xor esi, esi
pop edi
mov eax, esi
pop esi
jmp 0x409099
xor eax, eax
pop ebx
pop ebp
ret 8

Function at 0x4090a3
Capabilities:
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x413004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x18]
xor esi, esi
push eax
push 0x28
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40911c
lea eax, [ebp - 0x10]
push eax
push 0x402ac0
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push esi
push esi
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push esi
push dword [ebp - 0x18]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40911c
push 1
push esi
push 0x14
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownW]
test eax, eax
jne 0x409133
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x409147
movzx esi, si
or esi, 0x80070000
jmp 0x409147
push esi
push esi
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 8], esi
push eax
push esi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp dword [ebp - 0x18], 0
je 0x409156
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00411980
mov esp, ebp
pop ebp
ret
Function at 0x4099cc
Capabilities:
Query environment variable
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x413004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push edx
push ecx
push 0x402cec
push 0x900
xor esi, esi
mov ebx, 0x105
push esi
push esi
push ebx
push eax
mov dword [ebp - 0x62c], esi
call fcn.00410f98
add esp, 0x20
lea eax, [ebp - 0x628]
push 0x104
push eax
push 0x402d00
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x409b34
cmp eax, 0x104
ja 0x409b34
sub esp, 0xc
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea eax, [ebp - 0x210]
mov edx, ebx
push eax
lea ecx, [ebp - 0x41c]
call fcn.00410ef7
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x409b34
push 0x900
push ecx
push ecx
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x210]
mov edx, ebx
lea eax, [ecx + eax*2]
push eax
lea ecx, [ebp - 0x41c]
call fcn.00410ebe
push 0x900
push ecx
push ecx
push 0x402d00
mov edx, ebx
lea ecx, [ebp - 0x210]
call fcn.00410ebe
sub esp, 0xc
lea eax, [ebp - 0x41c]
mov edx, ebx
lea ecx, [ebp - 0x210]
push eax
call fcn.00410f31
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x62c]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x401588
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x409b34
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x210]
push eax
push 1
push esi
push edi
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x409b34
inc esi
cmp dword [ebp - 0x62c], 0
je 0x409b49
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411980
mov esp, ebp
pop ebp
ret 4
Function at 0x409fd3
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x413004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x224], eax
push ebx
mov ebx, edx
mov dword [ebp - 0x228], ebx
test ecx, ecx
je 0x40a212
xor edx, edx
cmp dx, word [ecx]
je 0x40a212
test ebx, ebx
je 0x40a212
xor ecx, ecx
cmp cx, word [ebx]
je 0x40a212
test eax, eax
je 0x40a212
cmp cx, word [eax]
je 0x40a212
push esi
push edi
push 0x208
xor esi, esi
mov edi, 0x104
call dword [sym.imp.cmutil.dll_CmMalloc]
mov dword [ebp - 0x218], eax
test eax, eax
je 0x40a086
push ebx
push edi
push eax
push 0x401068
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, eax
lea eax, [edi - 2]
cmp ecx, eax
jne 0x40a0a4
add edi, edi
cmp edi, 0x100000
ja 0x40a086
lea eax, [edi + edi]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.cmutil.dll_CmRealloc]
test eax, eax
jne 0x40a045
mov edi, esi
push dword [ebp - 0x218]
call dword [sym.imp.cmutil.dll_CmFree]
push edi
call dword [sym.imp.cmutil.dll_CmFree]
pop edi
mov eax, esi
pop esi
jmp 0x40a214
test ecx, ecx
je 0x40a086
mov ebx, dword [ebp - 0x218]
mov edi, 0x104
push 0x208
mov dword [ebp - 0x21c], edi
call dword [sym.imp.cmutil.dll_CmMalloc]
mov dword [ebp - 0x214], eax
xor ecx, ecx
cmp cx, word [ebx]
je 0x40a1f5
mov dword [ebp - 0x220], esi
test eax, eax
je 0x40a207
push dword [ebp - 0x228]
push edi
push eax
push 0x401068
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, eax
lea eax, [edi - 2]
cmp ecx, eax
jne 0x40a142
add edi, edi
mov dword [ebp - 0x21c], edi
cmp edi, 0x100000
ja 0x40a207
lea eax, [edi + edi]
mov edi, dword [ebp - 0x214]
push eax
push edi
call dword [sym.imp.cmutil.dll_CmRealloc]
test eax, eax
je 0x40a088
mov ecx, dword [ebp - 0x220]
mov edi, dword [ebp - 0x21c]
mov dword [ebp - 0x214], eax
jmp 0x40a159
test ecx, ecx
je 0x40a207
mov eax, dword [ebp - 0x214]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x220], ecx
test ecx, ecx
je 0x40a0db
mov edi, eax
test eax, eax
je 0x40a1d6
mov esi, dword [ebp - 0x224]
xor eax, eax
cmp ax, word [edi]
je 0x40a1d4
push esi
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0x401068
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jne 0x40a1c5
push dword [ebp - 0x228]
lea eax, [ebp - 0x210]
push 0x104
push eax
push 0x401068
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x40a1c5
push esi
lea eax, [ebp - 0x210]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [edi + eax*2]
add edi, 2
jne 0x40a16d
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, dword [ebp - 0x21c]
lea ebx, [ebx + eax*2]
mov eax, dword [ebp - 0x214]
add ebx, 2
jne 0x40a0ca
push dword [ebp - 0x224]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor esi, esi
inc esi
mov edi, dword [ebp - 0x214]
jmp 0x40a088
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00411980
mov esp, ebp
pop ebp
ret 4
Function at 0x40a22a
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1470
call fcn.00412030
mov eax, dword [0x413004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x1470], edx
mov dword [ebp - 0x146c], ecx
push edi
mov edi, dword [ebp + 8]
test esi, esi
je 0x40a45c
xor eax, eax
cmp ax, word [esi]
je 0x40a45c
test edi, edi
je 0x40a45c
cmp ax, word [edi]
je 0x40a45c
and dword [ebp - 0x1464], eax
push ebx
push 0x410
push eax
mov word [ebp - 0x624], ax
xor ebx, ebx
lea eax, [ebp - 0x622]
mov dword [ebp - 0x1468], 0x104
push eax
inc ebx
call sub.msvcrt.dll_memset
xor eax, eax
push 0x410
push eax
mov word [ebp - 0xc44], ax
lea eax, [ebp - 0xc42]
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
lea eax, [ebp - 0x1464]
push eax
xor eax, eax
cmp dword [ebp - 0x1470], eax
push 0x20019
push 0
setne al
push 0x401588
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a400
lea eax, [ebp - 0x1468]
push eax
lea eax, [ebp - 0x624]
push eax
push 0
push 0
push edi
push dword [ebp - 0x1464]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40a400
mov eax, dword [ebp - 0x1468]
and eax, 0xfffffffe
cmp eax, 0x412
jae 0x40a470
xor ecx, ecx
mov word [ebp + eax - 0x624], cx
lea eax, [ebp - 0x210]
push 0x104
push eax
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x40a400
lea ecx, [ebp - 0x210]
call fcn.00410767
test eax, eax
je 0x40a400
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x1460]
call fcn.0040eb66
lea eax, [ebp - 0x104a]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40a41a
cmp dword [ebp + 0x10], 0
jne 0x40a3fd
push 0x209
lea eax, [ebp - 0x624]
push eax
push 0xe9
push dword [ebp - 0x146c]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x40a3fd
push edi
lea eax, [ebp - 0x104a]
xor ebx, ebx
push eax
push esi
lea eax, [ebp - 0x624]
push eax
push 0x900
push ebx
push ebx
lea eax, [ebp - 0xc44]
push 0x209
push eax
call fcn.00410f98
add esp, 0x24
lea eax, [ebp - 0xc44]
push ebx
push edi
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
or ebx, 0xffffffff
cmp dword [ebp - 0x1464], 0
je 0x40a415
push dword [ebp - 0x1464]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
jmp 0x40a45e
push esi
push 0x4134a8
push 0x402ec4
push 0x900
push 0
push 0
lea eax, [ebp - 0x830]
push 0x105
push eax
call fcn.00410f98
add esp, 0x20
lea eax, [ebp - 0x830]
lea edx, [ebp - 0x210]
mov ecx, esi
push eax
call fcn.00409fd3
test eax, eax
jne 0x40a400
jmp 0x40a3fd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00411980
mov esp, ebp
pop ebp
ret 0xc
call fcn.00411ad9
int3
Function at 0x40a8ab
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa40
mov eax, dword [0x413004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0xa30], 0
push ebx
push esi
push edi
mov dword [ebp - 0xa40], eax
xor esi, esi
lea eax, [ebp - 0xa30]
mov ebx, edx
push eax
push 0x20019
push 0
push 0x4010e8
push 0x80000002
mov edi, ecx
inc esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40aa35
and dword [ebp - 0xa3c], eax
lea eax, [ebp - 0xa38]
push eax
lea eax, [ebp - 0xa34]
mov dword [ebp - 0xa38], 4
push eax
lea eax, [ebp - 0xa3c]
push eax
push 0
push 0x402f54
push dword [ebp - 0xa30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40a9b5
push dword [ebp - 0xa40]
lea ecx, [ebp - 0xa2c]
call fcn.0040eb66
push 0x401578
lea eax, [ebp - 0x616]
push eax
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x822]
push eax
push 0x401748
push 0x900
push 0
push 0
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.00410f98
add esp, 0x28
test eax, eax
jns 0x40a994
xor esi, esi
jmp 0x40aa35
lea eax, [ebp - 0x210]
push eax
push 0xffffffffffffffff
push 0x402860
push 0x4028d4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [ebp - 0xa34], eax
ja 0x40a98d
lea eax, [ebp - 0xa38]
mov dword [ebp - 0xa38], 4
push eax
lea eax, [ebp - 0xa34]
push eax
lea eax, [ebp - 0xa3c]
push eax
push 0
push 0x402f08
push dword [ebp - 0xa30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40a9f3
cmp dword [ebp - 0xa34], edi
ja 0x40a98d
lea eax, [ebp - 0xa38]
mov dword [ebp - 0xa38], 4
push eax
lea eax, [ebp - 0xa34]
push eax
lea eax, [ebp - 0xa3c]
push eax
push 0
push 0x402f2c
push dword [ebp - 0xa30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40aa35
cmp ebx, dword [ebp - 0xa34]
sbb eax, eax
not eax
and esi, eax
cmp dword [ebp - 0xa30], 0
je 0x40aa4a
push dword [ebp - 0xa30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411980
mov esp, ebp
pop ebp
ret 4
Function at 0x40aa64
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebx
push esi
push edi
push 0
push 0
mov esi, 0x8000ffff
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, eax
test edi, edi
je 0x40ab1d
push 0x402f80
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add edi, eax
lea eax, [edi + 1]
push eax
call dword [sym.imp.cmutil.dll_CmMalloc]
mov ebx, eax
test ebx, ebx
je 0x40ab18
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x40ab0f
sub esp, 0x10
lea edx, [edi + 1]
mov ecx, ebx
call fcn.00410f68
push ebx
mov esi, eax
call dword [sym.imp.cmutil.dll_SzToWzWithAlloc]
mov edi, eax
test esi, esi
js 0x40ab05
test edi, edi
je 0x40ab05
mov ecx, edi
call fcn.00410767
test eax, eax
je 0x40ab05
mov ecx, dword [0x4136c0]
mov edx, edi
push 0x100
push 0x402d44
call fcn.00410123
mov esi, eax
push esi
push 0x402f98
push dword [0x4130e8]
call fcn.0040e818
add esp, 0xc
jmp 0x40ab08
xor esi, esi
inc esi
push edi
call dword [sym.imp.cmutil.dll_CmFree]
push ebx
call dword [sym.imp.cmutil.dll_CmFree]
jmp 0x40ab1d
mov esi, 0x8007000e
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x40b0c8
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc44
mov eax, dword [0x413004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 0xc44], eax
mov edi, edx
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x618
push eax
mov word [ebp - 0xc40], ax
lea eax, [ebp - 0xc3e]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x410
push eax
mov word [ebp - 0x624], ax
lea eax, [ebp - 0x622]
push eax
call sub.msvcrt.dll_memset
add esp, 0x24
mov ecx, edi
call fcn.00410767
test eax, eax
je 0x40b1ef
push edi
push 0x105
lea eax, [ebp - 0x210]
push eax
push 0x401068
push 0x402870
push 0x401498
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x40b1ef
cmp dword [ebp + 0x14], 0
jne 0x40b1eb
push 0x208
lea eax, [ebp - 0x624]
push eax
push 0xe8
push ebx
call dword [sym.imp.USER32.dll_LoadStringW]
push dword [ebp - 0xc44]
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push esi
lea eax, [ebp - 0x624]
push eax
push 0x900
push ebx
push ebx
lea eax, [ebp - 0xc40]
push 0x30d
push eax
call fcn.00410f98
add esp, 0x24
lea eax, [ebp - 0xc40]
push 0x41000
push esi
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x40b1f2
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411980
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40b80c
Capabilities:
Enumerate files on windows
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x958
mov eax, dword [0x413004]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x24c
push eax
mov dword [ebp - 0x950], eax
mov esi, edx
mov dword [ebp - 0x958], eax
mov ebx, ecx
mov dword [ebp - 0x94c], eax
lea eax, [ebp - 0x948]
push eax
mov dword [ebp - 0x954], esi
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
push esi
push ebx
push 0x4032e0
push 0x900
push eax
push eax
lea eax, [ebp - 0x6fc]
push 0x209
push eax
call fcn.00410f98
mov esi, eax
add esp, 0x20
test esi, esi
js 0x40ba78
push edi
push 2
lea eax, [ebp - 0x950]
push eax
push 0x401068
push 0x4010c0
push 0x4010d8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, 0x4011bc
lea eax, [ebp - 0x950]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40b8d8
test dx, dx
je 0x40b8d4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40b8d8
add eax, 4
add ecx, 4
test dx, dx
jne 0x40b8b2
xor eax, eax
jmp 0x40b8dd
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40ba78
lea eax, [ebp - 0x94c]
push eax
lea eax, [ebp - 0x6fc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40b90a
mov esi, 0x80070006
jmp 0x40ba78
test byte [ebp - 0x94c], 0x10
jne 0x40ba5b
lea ecx, [ebp - 0x920]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x958]
jne 0x40b920
sub ecx, edx
lea eax, [ebp - 0x928]
sar ecx, 1
mov edx, 0x4032f0
lea eax, [eax + ecx*2]
mov cx, word [eax]
cmp cx, word [edx]
jne 0x40b969
test cx, cx
je 0x40b963
mov cx, word [eax + 2]
cmp cx, word [edx + 2]
jne 0x40b969
add eax, 4
add edx, 4
test cx, cx
jne 0x40b941
xor ecx, ecx
mov eax, ecx
jmp 0x40b970
sbb eax, eax
or eax, 1
xor ecx, ecx
test eax, eax
jne 0x40ba5b
lea eax, [ebp - 0x920]
push eax
push dword [ebp - 0x954]
lea eax, [ebp - 0x6fc]
push ebx
push 0x4032fc
push 0x900
push ecx
push ecx
push 0x209
push eax
call fcn.00410f98
mov esi, eax
add esp, 0x24
test esi, esi
js 0x40ba78
xor eax, eax
xor esi, esi
push 0x2d0
mov word [ebp - 0x2e4], ax
lea eax, [ebp - 0x2e2]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x6fc]
push eax
push 0x403310
push 0x900
push esi
push esi
lea eax, [ebp - 0x2e4]
push 0x169
push eax
call fcn.00410f98
mov esi, eax
add esp, 0x1c
test esi, esi
js 0x40ba78
mov ecx, dword [0x4136c0]
test ecx, ecx
je 0x40ba26
xor eax, eax
mov edx, 0x40337c
push eax
push 0x40
push 0x401068
lea eax, [ebp - 0x2e4]
push eax
call fcn.0040ff87
mov esi, eax
jmp 0x40ba57
call fcn.0040916c
test eax, eax
je 0x40ba73
mov ecx, dword [0x4136c0]
xor eax, eax
push eax
push 0x40
push 0x401068
lea eax, [ebp - 0x2e4]
mov edx, 0x40337c
push eax
call fcn.0040ff87
mov esi, eax
call fcn.0040929a
test esi, esi
js 0x40ba78
lea eax, [ebp - 0x94c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40b90a
jmp 0x40ba78
mov esi, 0x80070005
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411980
mov esp, ebp
pop ebp
ret 4
Function at 0x40c877
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
mov edi, dword [ecx + 8]
xor esi, esi
test edi, edi
je 0x40c8e5
push 0x3c
lea eax, [ebp - 0x3c]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], 0x403624
push eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x30], 0x403634
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x40c8e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40c8e5
movzx esi, si
or esi, 0x80070000
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40c9db
Capabilities:
Get common file path
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xf84
mov eax, dword [0x413004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, edx
test ecx, ecx
je 0x40cbbd
test esi, esi
je 0x40cbbd
xor eax, eax
cmp ax, word [ecx]
je 0x40cbbd
cmp ax, word [esi]
je 0x40cbbd
lea ecx, [ebp - 0x764]
call fcn.0040fa55
push esi
lea ecx, [ebp - 0xf80]
call fcn.0040eb66
push esi
xor esi, esi
push esi
push 0x402860
push 0x4028d4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 4
jae 0x40cbb9
push ebx
push edi
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x403760
lea eax, [ebp - 0xb6a]
mov edi, 0x900
push eax
lea eax, [ebp - 0x210]
mov ebx, 0x105
push eax
push 0x40376c
push edi
push esi
push esi
lea eax, [ebp - 0x628]
push ebx
push eax
call fcn.00410f98
add esp, 0x24
test eax, eax
js 0x40cbb7
lea ecx, [ebp - 0x628]
call fcn.00410767
test eax, eax
je 0x40cbb7
push 0x20a
lea eax, [ebp - 0x41c]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x628]
push eax
push 0x104
lea eax, [ebp - 0x41c]
push eax
push 0x401068
push 0x403640
push 0x4010d8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
cmp ax, word [ebp - 0x41c]
je 0x40cbb4
lea eax, [ebp - 0x41c]
push eax
push 0x40377c
push edi
push esi
push esi
lea eax, [ebp - 0x210]
push ebx
push eax
call fcn.00410f98
add esp, 0x1c
test eax, eax
js 0x40cbb7
lea eax, [ebp - 0xf84]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x210]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40cbb7
push dword [ebp - 0xf84]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x764]
call fcn.0040fa90
test eax, eax
jne 0x40cbb4
lea eax, [ebp - 0x41c]
push eax
push 0x403790
push edi
push esi
push esi
lea eax, [ebp - 0x210]
push ebx
push eax
call fcn.00410f98
add esp, 0x1c
test eax, eax
js 0x40cbb7
lea eax, [ebp - 0xf84]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x210]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40cbb4
push dword [ebp - 0xf84]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40cbb7
xor esi, esi
inc esi
pop edi
pop ebx
mov eax, esi
jmp 0x40cbbf
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00411980
mov esp, ebp
pop ebp
ret