joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41eb49
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
sub eax, ebx
mov dword [ebp - 4], ebx
je 0x41eb83
dec eax
je 0x41eb7c
dec eax
je 0x41eb75
dec eax
je 0x41eb6e
dec eax
jne 0x41eb83
mov ecx, 0x80000003
jmp 0x41eb88
mov ecx, 0x80000002
jmp 0x41eb88
mov ecx, 0x80000001
jmp 0x41eb88
mov ecx, 0x80000005
jmp 0x41eb88
mov ecx, 0x80000000
mov eax, dword [ebp + 0x10]
sub eax, ebx
je 0x41eb9e
dec eax
je 0x41eb95
dec eax
je 0x41eb9a
xor esi, esi
inc esi
jmp 0x41eba1
push 2
jmp 0x41eba0
push 4
pop esi
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x41ec0d
push dword [ebp + 0x18]
cmp esi, 4
jne 0x41ebd9
call fcn.0045dc5c
pop ecx
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push esi
push eax
push esi
jmp 0x41ebe5
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp + 0x18]
push esi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x41ebfd
mov dword [ebp - 4], 1
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x41ec0d
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret

Function at 0x41ec88
Capabilities:
Delete registry key

Disassembly:
mov eax, dword [esp + 4]
push esi
xor esi, esi
sub eax, esi
je 0x41ecbb
dec eax
je 0x41ecb4
dec eax
je 0x41ecad
dec eax
je 0x41eca6
dec eax
jne 0x41ecbb
mov eax, 0x80000003
jmp 0x41ecc0
mov eax, 0x80000002
jmp 0x41ecc0
mov eax, 0x80000001
jmp 0x41ecc0
mov eax, 0x80000005
jmp 0x41ecc0
mov eax, 0x80000000
push dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x41ecd2
xor esi, esi
inc esi
mov eax, esi
pop esi
ret
Function at 0x41ecd6
Capabilities:
Create directory

Disassembly:
mov eax, 0x47cae0
call fcn.0045c5c4
sub esp, 0x1c
push edi
xor edi, edi
push edi
mov dword [ebp - 4], edi
push dword [ebp + 8]
call fcn.0045de34
pop ecx
test eax, eax
pop ecx
jne 0x41ecfe
inc edi
jmp 0x41ee52
mov eax, dword [0x4a94a4]
push ebx
push esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
push 0xc
lea eax, [ebp - 0x28]
pop esi
mov byte [ebp - 4], 2
push esi
push edi
push eax
call fcn.0045c6e0
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], edi
push 0x5c
mov dword [ebp - 0x20], edi
mov cl, byte [eax]
pop ebx
cmp cl, bl
mov dword [ebp - 0x18], 1
jne 0x41ed7c
cmp byte [eax + 1], bl
jne 0x41ed7c
push 2
push ebx
lea ecx, [ebp + 8]
call fcn.0046c911
mov esi, eax
cmp esi, 0xffffffff
je 0x41edb9
lea eax, [ebp - 0x1c]
push esi
push eax
lea ecx, [ebp + 8]
call fcn.00469aa1
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.0046c575
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.0046c488
inc esi
jmp 0x41edb9
cmp byte [eax + 1], 0x3a
jne 0x41ee38
cmp byte [eax + 2], bl
jne 0x41ee38
lea eax, [ebp - 0x1c]
push 2
push eax
lea ecx, [ebp + 8]
call fcn.00469aa1
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.0046c575
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.0046c488
push 3
pop esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 8]
cmp byte [ecx + eax - 1], bl
je 0x41edd2
push 0x49f918
lea ecx, [ebp + 8]
call fcn.0046c818
push esi
jmp 0x41ee20
lea eax, [ebp - 0x1c]
push esi
push eax
lea ecx, [ebp + 8]
call fcn.00469aa1
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.0046c575
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.0046c488
push edi
push dword [ebp - 0x10]
call fcn.0045de34
pop ecx
cmp eax, 0xffffffff
pop ecx
jne 0x41ee1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x41ee32
lea eax, [esi + 1]
push eax
lea ecx, [ebp + 8]
push ebx
call fcn.0046c911
mov esi, eax
cmp esi, 0xffffffff
jg 0x41edd5
jmp 0x41ee35
mov dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0046c488
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0046c488
pop esi
pop ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0046c488
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
leave
ret
Function at 0x41f702
Capabilities:
Copy file
Delete file
Set file attributes

Disassembly:
mov eax, 0x47ccbc
call fcn.0045c5c4
push ecx
mov eax, dword [0x4a94a4]
push esi
push edi
mov dword [ebp - 0x10], eax
mov edi, dword [ebp + 0xc]
xor esi, esi
push 0x80
push edi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x41f7c7
push esi
lea eax, [ebp + 0xc]
push esi
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push str.Error_copying_file:_n
lea ecx, [ebp - 0x10]
call fcn.0046c5c5
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.0046c818
push str._nFrom:_t
lea ecx, [ebp - 0x10]
call fcn.0046c818
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.0046c818
push str._nTo:_t
lea ecx, [ebp - 0x10]
call fcn.0046c818
push edi
lea ecx, [ebp - 0x10]
call fcn.0046c818
push 0x10
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call fcn.0041fb77
mov ecx, eax
call fcn.0046f7a7
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
inc esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0046c488
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x41fae6
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push str.GetDiskFreeSpaceExA
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor esi, esi
cmp eax, esi
je 0x41fb31
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x28]
push ecx
push dword [ebp + 8]
call eax
test eax, eax
mov eax, dword [ebp + 0xc]
je 0x41fb6c
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
xor eax, eax
jmp 0x41fb74
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x41fb69
mov eax, dword [ebp - 4]
push esi
mul dword [ebp - 8]
push dword [ebp - 0xc]
push edx
push eax
call fcn.0045c9e0
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], edx
jmp 0x41fb2d
mov eax, dword [ebp + 0xc]
mov dword [eax + 4], esi
mov dword [eax], esi
xor eax, eax
inc eax
pop esi
leave
ret
Function at 0x4206fe
Capabilities:
Delete file
Set file attributes

Disassembly:
mov eax, 0x47cf74
call fcn.0045c5c4
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
push 0x80
push dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x34], ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [esi + 4]
push ebx
push 0x9011
mov eax, dword [ecx]
push dword [ebp + 0xc]
call dword [eax + 0x20]
test eax, eax
jne 0x420746
push 5
pop edi
jmp 0x4207ff
cmp dword [esi + 0x20], ebx
je 0x420773
cmp dword [esi + 0x38], ebx
push esi
push dword [ebp + 0x10]
je 0x42075f
call fcn.0042081c
pop ecx
pop ecx
mov edi, eax
jmp 0x420775
push fcn.00420656
push fcn.004205eb
call fcn.00450030
add esp, 0x10
jmp 0x42075b
xor edi, edi
mov eax, dword [esi + 0x34]
cmp eax, ebx
jbe 0x42078d
xor ecx, ecx
cmp eax, 0xd
setne cl
dec ecx
and ecx, 7
add ecx, 6
mov edi, ecx
cmp dword [esi + 0x20], ebx
je 0x420795
push 6
pop edi
cmp edi, ebx
jne 0x4207a9
mov eax, dword [esi + 0x24]
not eax
cmp dword [esi + 0x28], eax
mov dword [esi + 0x24], eax
je 0x4207a9
push 7
pop edi
cmp dword [0x4ad0fc], ebx
jne 0x4207e7
cmp dword [esi + 0xc], ebx
je 0x4207e7
mov ecx, dword [esi]
mov byte [ebp - 4], 1
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
jmp 0x4207e7
mov ecx, dword [esi + 4]
mov dword [ebp - 4], ebx
mov eax, dword [ecx]
call dword [eax + 0x4c]
cmp edi, ebx
jle 0x4207ff
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0046c488
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x420e7a
Capabilities:
Delete file
Set file attributes

Disassembly:
mov eax, 0x47d07c
call fcn.0045c5c4
sub esp, 0x4c
push ebx
push esi
push edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x10], esp
call fcn.0046bb33
and dword [ebp - 4], 0
lea ecx, [ebp - 0x50]
call fcn.0046bb33
mov ecx, dword [0x4a94a4]
and dword [ebp - 0x18], 0
xor edi, edi
mov eax, 0x8000
inc edi
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], edi
mov esi, dword [ebp + 0x20]
push 2
pop ebx
mov dword [ebp - 0x1c], edi
and dword [esi], 0
push eax
mov byte [ebp - 4], bl
call fcn.0045c821
test eax, eax
pop ecx
mov dword [ebp - 0x14], eax
jne 0x420edf
mov dword [esi], edi
xor esi, esi
jmp 0x421042
push 0
push 0x8020
push dword [ebp + 8]
lea ecx, [ebp - 0x40]
call fcn.0046bce5
test eax, eax
jne 0x420f02
push dword [ebp - 0x14]
call fcn.0045c738
pop ecx
mov dword [esi], ebx
jmp 0x420ed8
push 0x80
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push 0x9011
push dword [ebp + 0xc]
lea ecx, [ebp - 0x50]
call fcn.0046bce5
test eax, eax
jne 0x420f3f
push dword [ebp - 0x14]
call fcn.0045c738
pop ecx
lea ecx, [ebp - 0x40]
call fcn.0046bf00
mov dword [esi], 3
jmp 0x420ed8
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp + 0x14]
jae 0x421019
test edi, edi
jbe 0x421019
mov eax, 0x8000
lea ecx, [ebp - 0x40]
push eax
mov byte [ebp - 4], 3
push dword [ebp - 0x14]
call fcn.0046be02
mov edi, eax
mov dword [ebp - 4], ebx
push edi
lea ecx, [ebp - 0x50]
push dword [ebp - 0x14]
mov byte [ebp - 4], 5
call fcn.0046be3c
add dword [ebp - 0x18], edi
cmp dword [ebp + 0x10], 0
mov dword [ebp - 4], ebx
je 0x420f42
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x18]
and dword [ebp - 0x20], 0
and dword [ebp - 0x2c], 0
add ecx, eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x30], eax
fild qword [ebp - 0x24]
fild qword [ebp - 0x30]
fdivp st(1)
fmul qword [0x486a50]
call fcn.0045de7c
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0044fb16
mov ecx, dword [ebp + 0x10]
call fcn.0044fb85
test eax, eax
je 0x420f42
call fcn.00420d03
cmp dword [0x4ad0fc], 0
je 0x420f42
xor edi, edi
mov dword [esi], 0x63
mov dword [ebp - 0x1c], edi
jmp 0x420f42
lea ecx, [ebp - 0x40]
call fcn.0046bf00
lea ecx, [ebp - 0x50]
call fcn.0046bf00
push dword [ebp - 0x14]
call fcn.0045c738
mov esi, dword [ebp - 0x1c]
pop ecx
test esi, esi
jne 0x421042
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0046c488
and byte [ebp - 4], 0
lea ecx, [ebp - 0x50]
call fcn.0046bc28
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0046bc28
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x4248a8
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x47d62c
call fcn.0045c5c4
sub esp, 0xc
mov eax, dword [0x4a94a4]
push esi
mov dword [ebp - 0x18], eax
and dword [ebp - 4], 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
lea eax, [ebp + 8]
mov byte [ebp - 4], 2
push dword [esi + 0xc]
push eax
call fcn.0044ee28
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.0046c575
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.0046c488
push dword [esi + 0x2c]
mov ecx, dword [ebp + 0xc]
lea eax, [ebp + 8]
push eax
call fcn.0044ee28
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.0046c575
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.0046c488
push dword [esi + 0x30]
mov ecx, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
call fcn.0044ee28
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.0046c575
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 2
call fcn.0046c488
push dword [esi + 0x38]
push dword [esi + 0x34]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.0041c434
mov esi, eax
add esp, 0x14
neg esi
sbb esi, esi
lea ecx, [ebp - 0x10]
inc esi
mov byte [ebp - 4], 1
call fcn.0046c488
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0046c488
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0046c488
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x424998
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x47d668
call fcn.0045c5c4
sub esp, 0xc
mov eax, dword [0x4a94a4]
push esi
mov dword [ebp - 0x18], eax
and dword [ebp - 4], 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
lea eax, [ebp + 8]
mov byte [ebp - 4], 2
push dword [esi + 0xc]
push eax
call fcn.0044ee28
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.0046c575
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.0046c488
push dword [esi + 0x3c]
mov ecx, dword [ebp + 0xc]
lea eax, [ebp + 8]
push eax
call fcn.0044ee28
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.0046c575
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.0046c488
push dword [esi + 0x30]
mov ecx, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
call fcn.0044ee28
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.0046c575
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 2
call fcn.0046c488
mov esi, dword [esi + 0x38]
sub esi, 0
je 0x424a4e
dec esi
je 0x424a4a
dec esi
jne 0x424a4e
push 3
pop esi
jmp 0x424a51
push 6
jmp 0x424a47
xor esi, esi
inc esi
call fcn.0041fb77
test eax, eax
je 0x424a5d
mov eax, dword [eax + 0x1c]
push esi
push dword [ebp - 0x10]
push 0
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jle 0x424a79
xor esi, esi
jmp 0x424adb
cmp eax, 0x1b
jg 0x424ab3
je 0x424aaf
push 2
pop esi
sub eax, esi
je 0x424aaa
dec eax
je 0x424adb
sub eax, esi
je 0x424aa6
push 3
pop esi
sub eax, esi
je 0x424aa2
sub eax, esi
je 0x424adb
sub eax, 0xf
jne 0x424ac4
push 0xc
jmp 0x424ada
push 0xb
jmp 0x424ada
push 4
jmp 0x424ada
xor esi, esi
inc esi
jmp 0x424adb
push 5
jmp 0x424ada
sub eax, 0x1c
je 0x424ad8
dec eax
je 0x424ad4
dec eax
je 0x424ad0
dec eax
je 0x424acc
dec eax
je 0x424ac8
push 0x63
jmp 0x424ada
push 9
jmp 0x424ada
push 0xa
jmp 0x424ada
push 6
jmp 0x424ada
push 7
jmp 0x424ada
push 8
pop esi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0046c488
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0046c488
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0046c488
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x424f70
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x47d77c
call fcn.0045c5c4
sub esp, 0x118
mov eax, dword [0x4a94a4]
push esi
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 3
call fcn.0047740b
mov ecx, dword [eax + 4]
call fcn.00470c75
mov esi, dword [ebp + 8]
and dword [ebp - 0x1c], 0
test esi, esi
mov byte [ebp - 4], 4
jne 0x424fcd
mov byte [ebp - 4], 3
call fcn.0047740b
mov ecx, dword [eax + 4]
call fcn.00470c8a
inc esi
jmp 0x425140
push edi
mov edi, dword [ebp + 0xc]
push dword [esi + 0x64]
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.0044ee28
mov eax, dword [eax]
mov ecx, dword [esi + 0x60]
push eax
push ecx
mov ecx, edi
mov byte [ebp - 4], 5
call fcn.0044ec5d
lea ecx, [ebp + 8]
mov byte [ebp - 4], 4
call fcn.0046c488
push dword [esi + 0xc]
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.0044ee28
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.0046c575
lea ecx, [ebp + 8]
mov byte [ebp - 4], 4
call fcn.0046c488
push dword [esi + 0x70]
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.0044ee28
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 7
call fcn.0046c575
lea ecx, [ebp + 8]
mov byte [ebp - 4], 4
call fcn.0046c488
push dword [esi + 0x68]
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.0044ee28
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 8
call fcn.0046c575
lea ecx, [ebp + 8]
mov byte [ebp - 4], 4
call fcn.0046c488
push dword [esi + 0x64]
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.0044ee28
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 9
call fcn.0046c575
lea ecx, [ebp + 8]
mov byte [ebp - 4], 4
call fcn.0046c488
push dword [ebp - 0x10]
call fcn.0041ca73
test eax, eax
pop ecx
jne 0x4250af
mov dword [ebp - 0x1c], 1
jmp 0x4250ff
push ebx
lea eax, [ebp - 0x124]
push dword [ebp - 0x10]
mov ebx, str.______
push 0x104
push eax
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x124]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
pop ebx
je 0x4250f8
mov esi, dword [esi + 0x60]
lea eax, [ebp - 0x124]
push eax
push esi
mov ecx, edi
call fcn.0044ec5d
jmp 0x42512b
mov dword [ebp - 0x1c], 2
push dword [esi + 0x64]
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.0044ee28
mov eax, dword [eax]
mov esi, dword [esi + 0x60]
push eax
push esi
mov ecx, edi
mov byte [ebp - 4], 0xa
call fcn.0044ec5d
lea ecx, [ebp + 8]
mov byte [ebp - 4], 4
call fcn.0046c488
mov byte [ebp - 4], 3
call fcn.0047740b
mov ecx, dword [eax + 4]
call fcn.00470c8a
mov esi, dword [ebp - 0x1c]
pop edi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.0046c488
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0046c488
and byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.0046c488
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0046c488
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4279e6
Capabilities:
Delete file

Disassembly:
mov eax, 0x47de6c
call fcn.0045c5c4
sub esp, 0x20
push esi
push edi
lea ecx, [ebp - 0x2c]
call fcn.00427be6
mov eax, dword [0x4a94a4]
and dword [ebp - 4], 0
mov dword [ebp - 0x10], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 8]
mov ecx, edi
push dword [esi + 0x58]
mov byte [ebp - 4], 1
push eax
call fcn.0044ee28
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.0046c575
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.0046c488
push dword [esi + 0xc]
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.0044ee28
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.0046c575
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.0046c488
push dword [esi + 0x2c]
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.0044ee28
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.0046c575
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.0046c488
push dword [esi + 0x30]
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.0044ee28
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 5
call fcn.0046c575
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.0046c488
cmp dword [esi + 0x98], 0
mov ecx, edi
lea eax, [ebp + 8]
je 0x427acf
push dword [esi + 0xa4]
push eax
call fcn.0044ee28
mov byte [ebp - 4], 6
jmp 0x427adc
push dword [esi + 0xc]
push eax
call fcn.0044ee28
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x20]
push eax
call fcn.0046c575
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.0046c488
push dword [esi + 0xa0]
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.0044ee28
push dword [eax]
call fcn.0045dce7
pop ecx
mov dword [ebp - 0x1c], eax
lea ecx, [ebp + 8]
call fcn.0046c488
mov eax, dword [esi + 0x38]
sub eax, 0
je 0x427b35
dec eax
je 0x427b2c
dec eax
jne 0x427b3c
mov dword [ebp - 0x18], 3
jmp 0x427b3c
mov dword [ebp - 0x18], 7
jmp 0x427b3c
mov dword [ebp - 0x18], 1
push dword [ebp - 0x10]
call fcn.0041ca73
test eax, eax
pop ecx
jne 0x427b67
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp + 8], esp
push eax
call fcn.0046c1fd
call fcn.0041be86
test eax, eax
pop ecx
jne 0x427b67
xor esi, esi
inc esi
jmp 0x427bbe
push dword [esi + 0x68]
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.0044ee28
push dword [eax]
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 8
push dword [ebp - 0x10]
push str._s_s.lnk
push eax
call fcn.00469ec1
add esp, 0x10
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.0046c488
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x2c]
push eax
call fcn.0041fb77
push eax
call fcn.00444fdb
test eax, eax
jl 0x427bbb
xor esi, esi
jmp 0x427bbe
push 2
pop esi
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0046c488
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00427c15
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret
Function at 0x427c71
Capabilities:
Delete file

Disassembly:
mov eax, 0x47dec4
call fcn.0045c5c4
push ecx
push ecx
mov eax, dword [0x4a94a4]
push esi
push edi
mov dword [ebp - 0x10], eax
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push dword [esi + 0x68]
push eax
call fcn.0044ee28
mov edi, eax
push dword [esi + 0x58]
mov ecx, dword [ebp + 0xc]
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
call fcn.0044ee28
push dword [edi]
mov byte [ebp - 4], 2
push dword [eax]
lea eax, [ebp - 0x10]
push str._s_s.lnk
push eax
call fcn.00469ec1
add esp, 0x10
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.0046c488
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0046c488
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor esi, esi
test eax, eax
jne 0x427cf3
inc esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0046c488
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4282ce
Capabilities:
Set file attributes

Disassembly:
mov eax, 0x47df88
call fcn.0045c5c4
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x1c]
push dword [ebp + 8]
xor edi, edi
xor esi, esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov dword [ebx], edi
call fcn.0041ca73
test eax, eax
pop ecx
jne 0x428301
mov dword [ebp - 0x10], 1
jmp 0x428347
cmp dword [ebp + 0xc], edi
je 0x428309
push 2
pop esi
cmp dword [ebp + 0x10], edi
je 0x428311
or esi, 4
cmp dword [ebp + 0x14], edi
je 0x428319
or esi, 0x20
cmp dword [ebp + 0x18], edi
je 0x428321
or esi, 1
cmp esi, edi
jne 0x42832a
mov esi, 0x80
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x428347
mov dword [ebp - 0x10], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0046c488
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret