joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47b599
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x840
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x840], ecx
cmp dword [ebp + 8], 0
je 0x47b5c4
cmp dword [ebp + 0xc], 0
je 0x47b5c4
cmp dword [ebp + 0x10], 0
jne 0x47b5c9
jmp 0x47b735
push 2
pop eax
imul eax, eax, 0
xor ecx, ecx
mov edx, dword [ebp + 0xc]
mov word [edx + eax], cx
push 0x410
push 0
lea eax, [ebp - 0x41c]
push eax
call fcn.004b0090
add esp, 0xc
lea eax, [ebp - 0x41c]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
jne 0x47b609
jmp 0x47b735
mov eax, dword [0x5399b8]
mov dword [ebp - 0xc], eax
mov ax, word [0x5399bc]
mov word [ebp - 8], ax
and dword [ebp - 0x834], 0
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x830], eax
cmp dword [ebp - 0x834], 0
jne 0x47b735
mov eax, dword [ebp - 0x830]
movzx eax, word [eax]
test eax, eax
je 0x47b735
push 2
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x830]
mov cx, word [ecx]
mov word [ebp + eax - 0xc], cx
push 0x208
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x47b705
lea eax, [ebp - 0x82c]
push eax
call fcn.004cc4f3
pop ecx
mov dword [ebp - 0x838], eax
cmp dword [ebp - 0x838], 0x208
jae 0x47b705
push dword [ebp - 0x838]
lea eax, [ebp - 0x82c]
push eax
push dword [ebp + 8]
call fcn.004d7559
add esp, 0xc
test eax, eax
jne 0x47b6c5
mov dword [ebp - 0x83c], 1
jmp 0x47b6cc
and dword [ebp - 0x83c], 0
mov eax, dword [ebp - 0x83c]
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 0
je 0x47b705
mov eax, dword [ebp - 0x838]
mov ecx, dword [ebp + 8]
lea eax, [ecx + eax*2]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x531260
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004077b0
add esp, 0x14
mov eax, dword [ebp - 0x830]
movzx eax, word [eax]
test eax, eax
je 0x47b722
mov eax, dword [ebp - 0x830]
inc eax
inc eax
mov dword [ebp - 0x830], eax
jmp 0x47b705
mov eax, dword [ebp - 0x830]
inc eax
inc eax
mov dword [ebp - 0x830], eax
jmp 0x47b62e
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 0xc
Function at 0x47beff
Capabilities:
Enumerate processes
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe74
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xe68], ecx
and dword [ebp - 0xe64], 0
push 0x410
push 0
lea eax, [ebp - 0x414]
push eax
call fcn.004b0090
add esp, 0xc
cmp dword [ebp - 0xe68], 0
je 0x47bf4f
mov eax, dword [ebp - 0xe68]
sub eax, 0x6a
mov dword [ebp - 0xe70], eax
jmp 0x47bf56
and dword [ebp - 0xe70], 0
push 0x208
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0xe70]
add ecx, 0x58
call fcn.0047b743
cmp dword [ebp - 0xe68], 0
je 0x47bf8d
mov eax, dword [ebp - 0xe68]
sub eax, 0x6a
mov dword [ebp - 0xe74], eax
jmp 0x47bf94
and dword [ebp - 0xe74], 0
push 0x208
lea eax, [ebp - 0x414]
push eax
mov ecx, dword [ebp - 0xe74]
add ecx, 0x58
call fcn.0047de92
push 0x410
push 0
lea eax, [ebp - 0x824]
push eax
call fcn.004b0090
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0xe6c], eax
cmp dword [ebp - 0xe6c], 0xffffffff
je 0x47c0ff
push 0x22c
push 0
lea eax, [ebp - 0xe60]
push eax
call fcn.004b0090
add esp, 0xc
mov dword [ebp - 0xe60], 0x22c
lea eax, [ebp - 0xe60]
push eax
push dword [ebp - 0xe6c]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x47c0ec
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xe3c]
push eax
call fcn.004d5f0c
pop ecx
pop ecx
test eax, eax
jne 0x47c0d2
push dword [ebp - 0xe58]
push 0
push 0x100411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0xe64], eax
cmp dword [ebp - 0xe64], 0
je 0x47c0d2
push 0x208
lea eax, [ebp - 0x824]
push eax
push dword [ebp - 0xe64]
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x47c0bf
push 0x410
push 0
lea eax, [ebp - 0xc34]
push eax
call fcn.004b0090
add esp, 0xc
push 0x208
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0x824]
push eax
mov ecx, dword [ebp - 0xe68]
call fcn.0047b599
push dword [ebp + 8]
lea eax, [ebp - 0xc34]
push eax
call fcn.004d5f0c
pop ecx
pop ecx
test eax, eax
jne 0x47c0bf
jmp 0x47c0ec
push dword [ebp - 0xe64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0xe64], 0
lea eax, [ebp - 0xe60]
push eax
push dword [ebp - 0xe6c]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x47c01a
push dword [ebp - 0xe6c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0xe6c], 0xffffffff
mov eax, dword [ebp - 0xe64]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 4
Function at 0x47c763
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa18
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xa10], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004b0090
add esp, 0xc
push 0x800
push 0
lea eax, [ebp - 0xa0c]
push eax
call fcn.004b0090
add esp, 0xc
push dword [ebp + 8]
push 0x400
lea eax, [ebp - 0xa0c]
push eax
push 0
push 0x52eef8
push 0x52ef00
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x104
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa0c]
push eax
mov ecx, dword [ebp - 0xa10]
call fcn.0047fde3
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0xa10]
call fcn.0047cef8
test eax, eax
jne 0x47c871
and dword [ebp - 0xa18], 0
cmp dword [ebp + 0xc], 0
je 0x47c86f
cmp dword [ebp + 0x10], 0
jle 0x47c86f
lea eax, [ebp - 0x20c]
test eax, eax
je 0x47c86f
and dword [ebp - 0xa14], 0
lea eax, [ebp - 0x20c]
test eax, eax
je 0x47c847
lea eax, [ebp - 0x20c]
push eax
call fcn.004cc4f3
pop ecx
cmp eax, dword [ebp + 0x10]
jae 0x47c847
mov dword [ebp - 0xa14], 1
cmp dword [ebp - 0xa14], 0
je 0x47c86f
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004cc3b7
add esp, 0xc
mov dword [ebp - 0xa18], 1
jmp 0x47c88c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0xa10]
call fcn.0047f897
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 0xc

Function at 0x47c89a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa18
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xa10], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004b0090
add esp, 0xc
push 0x800
push 0
lea eax, [ebp - 0xa0c]
push eax
call fcn.004b0090
add esp, 0xc
push dword [ebp + 8]
push 0x400
lea eax, [ebp - 0xa0c]
push eax
push 0
push 0x52eef8
push 0x52ef00
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x104
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa0c]
push eax
mov ecx, dword [ebp - 0xa10]
call fcn.0047ff26
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0xa10]
call fcn.0047cf40
test eax, eax
jne 0x47c9a8
and dword [ebp - 0xa18], 0
cmp dword [ebp + 0xc], 0
je 0x47c9a6
cmp dword [ebp + 0x10], 0
jle 0x47c9a6
lea eax, [ebp - 0x20c]
test eax, eax
je 0x47c9a6
and dword [ebp - 0xa14], 0
lea eax, [ebp - 0x20c]
test eax, eax
je 0x47c97e
lea eax, [ebp - 0x20c]
push eax
call fcn.004cc4f3
pop ecx
cmp eax, dword [ebp + 0x10]
jae 0x47c97e
mov dword [ebp - 0xa14], 1
cmp dword [ebp - 0xa14], 0
je 0x47c9a6
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004cc3b7
add esp, 0xc
mov dword [ebp - 0xa18], 1
jmp 0x47c9c3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0xa10]
call fcn.0047fa5b
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 0xc
Function at 0x47c9d1
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa18
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xa10], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004b0090
add esp, 0xc
push 0x800
push 0
lea eax, [ebp - 0xa0c]
push eax
call fcn.004b0090
add esp, 0xc
push dword [ebp + 8]
push 0x400
lea eax, [ebp - 0xa0c]
push eax
push 0
push 0x52eef8
push 0x52ef00
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x104
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa0c]
push eax
mov ecx, dword [ebp - 0xa10]
call fcn.00480069
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0xa10]
call fcn.0047cf88
test eax, eax
jne 0x47cadf
and dword [ebp - 0xa18], 0
cmp dword [ebp + 0xc], 0
je 0x47cadd
cmp dword [ebp + 0x10], 0
jle 0x47cadd
lea eax, [ebp - 0x20c]
test eax, eax
je 0x47cadd
and dword [ebp - 0xa14], 0
lea eax, [ebp - 0x20c]
test eax, eax
je 0x47cab5
lea eax, [ebp - 0x20c]
push eax
call fcn.004cc4f3
pop ecx
cmp eax, dword [ebp + 0x10]
jae 0x47cab5
mov dword [ebp - 0xa14], 1
cmp dword [ebp - 0xa14], 0
je 0x47cadd
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004cc3b7
add esp, 0xc
mov dword [ebp - 0xa18], 1
jmp 0x47cafa
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0xa10]
call fcn.0047fc1f
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 0xc

Function at 0x47cd13
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], ecx
and dword [ebp - 0x210], 0
cmp dword [ebp + 8], 0
je 0x47cde3
push dword [ebp + 8]
call fcn.004cc4f3
pop ecx
test eax, eax
jbe 0x47cde3
mov dword [ebp - 0x210], 1
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004b0090
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0x218]
call fcn.0047e24e
cmp dword [ebp + 0xc], 0
jne 0x47cda7
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0x10
je 0x47cda7
and dword [ebp - 0x210], 0
cmp dword [ebp - 0x210], 0
je 0x47cdd0
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004cc50e
pop ecx
pop ecx
test eax, eax
jne 0x47cdd0
mov dword [ebp - 0x214], 1
jmp 0x47cdd7
and dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x210]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 8
Function at 0x47d3e1
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x658
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x644], ecx
and dword [ebp - 0x648], 0
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004b0090
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x414]
push eax
call fcn.004b0090
add esp, 0xc
cmp dword [ebp - 0x644], 0
je 0x47d447
mov eax, dword [ebp - 0x644]
sub eax, 0x6a
mov dword [ebp - 0x650], eax
jmp 0x47d44e
and dword [ebp - 0x650], 0
push 0x104
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0x650]
add ecx, 0x58
call fcn.0047b743
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x64c], eax
cmp dword [ebp - 0x64c], 0xffffffff
je 0x47d5e6
push 0x22c
push 0
lea eax, [ebp - 0x640]
push eax
call fcn.004b0090
add esp, 0xc
mov dword [ebp - 0x640], 0x22c
lea eax, [ebp - 0x640]
push eax
push dword [ebp - 0x64c]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x47d5da
cmp dword [ebp - 0x644], 0
je 0x47d4db
mov eax, dword [ebp - 0x644]
sub eax, 0x6a
mov dword [ebp - 0x654], eax
jmp 0x47d4e2
and dword [ebp - 0x654], 0
push 0x104
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push eax
mov ecx, dword [ebp - 0x654]
add ecx, 0x58
call fcn.0047b743
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004d5f0c
pop ecx
pop ecx
test eax, eax
jne 0x47d5c0
push dword [ebp - 0x638]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x648], eax
cmp dword [ebp - 0x648], 0
je 0x47d5c0
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
push dword [ebp - 0x648]
call sub.PSAPI.DLL_GetModuleFileNameExW
cmp dword [ebp - 0x644], 0
je 0x47d575
mov eax, dword [ebp - 0x644]
sub eax, 0x6a
mov dword [ebp - 0x658], eax
jmp 0x47d57c
and dword [ebp - 0x658], 0
push 0x104
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x658]
add ecx, 0x58
call fcn.0047e6c6
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call fcn.004d5f0c
pop ecx
pop ecx
test eax, eax
jne 0x47d5ad
jmp 0x47d5da
push dword [ebp - 0x648]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x648], 0
lea eax, [ebp - 0x640]
push eax
push dword [ebp - 0x64c]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x47d4c1
push dword [ebp - 0x64c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x648]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 4
Function at 0x47e300
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
and dword [ebp - 0x210], 0
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004b0090
add esp, 0xc
cmp dword [ebp + 8], 0
je 0x47e3b0
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0x214]
call fcn.0047e24e
push 1
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x214]
call fcn.0047cd13
test eax, eax
je 0x47e3b0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
and eax, 1
je 0x47e3a6
push 0x80
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 0x210], eax
jmp 0x47e3b0
mov dword [ebp - 0x210], 1
mov eax, dword [ebp - 0x210]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 4

Function at 0x47f20d
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x800
push 0
lea eax, [ebp - 0x804]
push eax
call fcn.004b0090
add esp, 0xc
and dword [ebp - 0x808], 0
lea eax, [ebp + 0x10]
mov dword [ebp - 0x808], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x810], eax
push dword [ebp - 0x808]
push 0
push dword [ebp - 0x810]
push 0x3ff
push 0x400
lea eax, [ebp - 0x804]
push eax
call fcn.00407770
push dword [eax + 4]
push dword [eax]
call fcn.004cc171
add esp, 0x20
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
jge 0x47f298
or dword [ebp - 0x814], 0xffffffff
jmp 0x47f2a4
mov eax, dword [ebp - 0x80c]
mov dword [ebp - 0x814], eax
and dword [ebp - 0x808], 0
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret

Function at 0x47f2c4
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x800
push 0
lea eax, [ebp - 0x804]
push eax
call fcn.004b0090
add esp, 0xc
and dword [ebp - 0x808], 0
lea eax, [ebp + 0x10]
mov dword [ebp - 0x808], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x810], eax
push dword [ebp - 0x808]
push 0
push dword [ebp - 0x810]
push 0x3ff
push 0x400
lea eax, [ebp - 0x804]
push eax
call fcn.00407770
push dword [eax + 4]
push dword [eax]
call fcn.004cc171
add esp, 0x20
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
jge 0x47f34f
or dword [ebp - 0x814], 0xffffffff
jmp 0x47f35b
mov eax, dword [ebp - 0x80c]
mov dword [ebp - 0x814], eax
and dword [ebp - 0x808], 0
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret
Function at 0x47f37b
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x800
push 0
lea eax, [ebp - 0x804]
push eax
call fcn.004b0090
add esp, 0xc
and dword [ebp - 0x808], 0
lea eax, [ebp + 0x10]
mov dword [ebp - 0x808], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x810], eax
push dword [ebp - 0x808]
push 0
push dword [ebp - 0x810]
push 0x3ff
push 0x400
lea eax, [ebp - 0x804]
push eax
call fcn.00407770
push dword [eax + 4]
push dword [eax]
call fcn.004cc171
add esp, 0x20
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
jge 0x47f406
or dword [ebp - 0x814], 0xffffffff
jmp 0x47f412
mov eax, dword [ebp - 0x80c]
mov dword [ebp - 0x814], eax
and dword [ebp - 0x808], 0
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret

Function at 0x47f432
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004b0090
add esp, 0xc
push dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x52ef08
push str.Redirect
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x218], 1
cmp dword [ebp - 0x210], 0
je 0x47f4e3
mov eax, dword [ebp - 0x210]
movzx eax, word [eax]
test eax, eax
je 0x47f4e3
mov eax, dword [ebp - 0x210]
movzx eax, word [eax]
cmp eax, 0x20
je 0x47f4d3
mov eax, dword [ebp - 0x210]
movzx eax, word [eax]
cmp eax, 9
je 0x47f4d3
and dword [ebp - 0x218], 0
jmp 0x47f4e3
mov eax, dword [ebp - 0x210]
inc eax
inc eax
mov dword [ebp - 0x210], eax
jmp 0x47f4a1
cmp dword [ebp - 0x218], 0
jne 0x47f539
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x214]
call fcn.0047cef8
test eax, eax
je 0x47f51f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0x214]
call fcn.0047ad53
jmp 0x47f537
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x214]
call fcn.0047f432
jmp 0x47f59b
and dword [ebp - 0x220], 0
cmp dword [ebp + 0xc], 0
je 0x47f59b
cmp dword [ebp + 0x10], 0
jle 0x47f59b
cmp dword [ebp + 8], 0
je 0x47f59b
and dword [ebp - 0x21c], 0
cmp dword [ebp + 8], 0
je 0x47f577
push dword [ebp + 8]
call fcn.004cc4f3
pop ecx
cmp eax, dword [ebp + 0x10]
jae 0x47f577
mov dword [ebp - 0x21c], 1
cmp dword [ebp - 0x21c], 0
je 0x47f59b
push dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004cc3b7
add esp, 0xc
mov dword [ebp - 0x220], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 0xc
Function at 0x47f5a9
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004b0090
add esp, 0xc
push dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x52ef08
push str.Redirect
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x218], 1
cmp dword [ebp - 0x210], 0
je 0x47f65a
mov eax, dword [ebp - 0x210]
movzx eax, word [eax]
test eax, eax
je 0x47f65a
mov eax, dword [ebp - 0x210]
movzx eax, word [eax]
cmp eax, 0x20
je 0x47f64a
mov eax, dword [ebp - 0x210]
movzx eax, word [eax]
cmp eax, 9
je 0x47f64a
and dword [ebp - 0x218], 0
jmp 0x47f65a
mov eax, dword [ebp - 0x210]
inc eax
inc eax
mov dword [ebp - 0x210], eax
jmp 0x47f618
cmp dword [ebp - 0x218], 0
jne 0x47f6b0
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x214]
call fcn.0047cf40
test eax, eax
je 0x47f696
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0x214]
call fcn.0047aeac
jmp 0x47f6ae
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x214]
call fcn.0047f5a9
jmp 0x47f712
and dword [ebp - 0x220], 0
cmp dword [ebp + 0xc], 0
je 0x47f712
cmp dword [ebp + 0x10], 0
jle 0x47f712
cmp dword [ebp + 8], 0
je 0x47f712
and dword [ebp - 0x21c], 0
cmp dword [ebp + 8], 0
je 0x47f6ee
push dword [ebp + 8]
call fcn.004cc4f3
pop ecx
cmp eax, dword [ebp + 0x10]
jae 0x47f6ee
mov dword [ebp - 0x21c], 1
cmp dword [ebp - 0x21c], 0
je 0x47f712
push dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004cc3b7
add esp, 0xc
mov dword [ebp - 0x220], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 0xc
Function at 0x47f720
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.004b0090
add esp, 0xc
push dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x52ef08
push str.Redirect
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x218], 1
cmp dword [ebp - 0x210], 0
je 0x47f7d1
mov eax, dword [ebp - 0x210]
movzx eax, word [eax]
test eax, eax
je 0x47f7d1
mov eax, dword [ebp - 0x210]
movzx eax, word [eax]
cmp eax, 0x20
je 0x47f7c1
mov eax, dword [ebp - 0x210]
movzx eax, word [eax]
cmp eax, 9
je 0x47f7c1
and dword [ebp - 0x218], 0
jmp 0x47f7d1
mov eax, dword [ebp - 0x210]
inc eax
inc eax
mov dword [ebp - 0x210], eax
jmp 0x47f78f
cmp dword [ebp - 0x218], 0
jne 0x47f827
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x214]
call fcn.0047cf88
test eax, eax
je 0x47f80d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0x214]
call fcn.0047b005
jmp 0x47f825
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x214]
call fcn.0047f720
jmp 0x47f889
and dword [ebp - 0x220], 0
cmp dword [ebp + 0xc], 0
je 0x47f889
cmp dword [ebp + 0x10], 0
jle 0x47f889
cmp dword [ebp + 8], 0
je 0x47f889
and dword [ebp - 0x21c], 0
cmp dword [ebp + 8], 0
je 0x47f865
push dword [ebp + 8]
call fcn.004cc4f3
pop ecx
cmp eax, dword [ebp + 0x10]
jae 0x47f865
mov dword [ebp - 0x21c], 1
cmp dword [ebp - 0x21c], 0
je 0x47f889
push dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004cc3b7
add esp, 0xc
mov dword [ebp - 0x220], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 0xc