joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462e50
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [eax + 4]
test eax, eax
je 0x462e60
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
ret

Function at 0x462e70
Capabilities:
Hide graphical window

Disassembly:
cmp dword [eax + 0x24], 0
mov eax, dword [eax + 4]
jne 0x462e8c
test eax, eax
je 0x462e9f
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
ret
push 0
push 0x2af80006
push 0x414
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, 1
ret

Function at 0x462ee0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x34
cmp dword [edi + 4], 0
push ebx
push ebp
push esi
je 0x463036
xor ebp, ebp
cmp dword [edi + 0x10], ebp
jbe 0x462f26
xor esi, esi
mov eax, dword [edi + 0x18]
cmp dword [eax + esi + 8], 0
je 0x462f1d
cmp byte [eax + esi + 4], 6
je 0x462f1d
mov edx, dword [esi + eax + 8]
lea ecx, [esi + eax]
push edx
push edi
mov eax, str.Submit
call fcn.004630e0
inc ebp
add esi, 0x14
cmp ebp, dword [edi + 0x10]
jb 0x462ef9
xor esi, esi
xor ebx, ebx
xor ebp, ebp
cmp esi, dword [edi + 0x10]
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], esi
je 0x462f5b
mov eax, dword [edi + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [eax + ecx]
push 0xfffffffffffffff0
push edx
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x20000
je 0x462fa4
cmp dword [esp + 0x10], 1
jne 0x462f93
cmp ebx, 1
jle 0x462f93
cmp ebp, 0xffffffff
jne 0x462f6e
xor ebp, ebp
push 0xa
lea eax, [esp + 0x24]
push eax
push ebp
call fcn.004b9d8d
mov edx, dword [esp + 0x24]
add esp, 0xc
push 1
push 0
push 0xffffffffffffffff
lea ecx, [esp + 0x2c]
push ecx
push edx
call fcn.004a5c20
cmp esi, dword [edi + 0x10]
je 0x463023
xor ebx, ebx
xor ebp, ebp
mov dword [esp + 0x10], ebx
mov eax, dword [edi + 0x18]
mov ecx, dword [esp + 0x14]
cmp byte [eax + ecx + 4], 6
jne 0x46300c
mov esi, dword [eax + ecx + 8]
inc ebx
test esi, esi
je 0x462fc3
inc dword [esp + 0x10]
mov dword [esp + 0x18], esi
mov edx, dword [eax + ecx]
push 0
push 0
push 0xf0
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 1
jne 0x462ff7
test ebp, ebp
je 0x462fe4
or ebp, 0xffffffff
jmp 0x462fe6
mov ebp, ebx
test esi, esi
je 0x46300c
push 1
push 0
push 0xffffffffffffffff
push 0x4d9220
jmp 0x463006
test esi, esi
je 0x46300c
push 1
push 0
push 0xffffffffffffffff
push 0x4d69c8
push esi
call fcn.004a5c20
mov esi, dword [esp + 0x1c]
add dword [esp + 0x14], 0x14
inc esi
mov dword [esp + 0x1c], esi
cmp esi, dword [edi + 0x10]
jbe 0x462f3f
cmp byte [esp + 0x44], 0
je 0x463036
mov eax, dword [edi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x34
ret 4
Function at 0x4659d0
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, eax
mov al, byte [esi]
xor cl, cl
mov byte [esp + 0xb], cl
test al, al
je 0x465a08
cmp al, 0x21
je 0x4659f9
cmp al, 0x2b
je 0x4659f4
cmp al, 0x5e
jne 0x465a04
or cl, 2
jmp 0x4659fc
or cl, 1
jmp 0x4659fc
or cl, 4
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x4659e3
mov byte [esp + 0xb], cl
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 0
xor ecx, ecx
mov eax, esi
call fcn.00412c00
mov bl, al
add esp, 8
mov byte [esp + 0xc], bl
test bl, bl
jne 0x465a31
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, esi
call fcn.00412b50
movzx eax, ax
test ax, ax
jne 0x465a56
mov eax, dword [esp + 0xc]
push eax
xor bl, bl
call fcn.004131c0
mov bl, byte [esp + 0x10]
add esp, 4
movzx eax, ax
test eax, 0x100
je 0x465a62
or byte [esp + 0xb], 8
movzx eax, byte [esp + 0xb]
movzx ecx, bl
shl eax, 8
pop esi
or eax, ecx
pop ebx
add esp, 8
ret
Function at 0x466fb0
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x10
movzx eax, byte [esi + 4]
push ebp
mov ebp, dword [esp + 0x18]
add eax, 0xfffffff7
push edi
mov dword [esp + 8], CreateStatusWindowA
cmp eax, 8
ja case.0x466fd1.12
jmp dword [eax*4 + 0x4670d0]
mov eax, dword [esi]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x19f
push eax
call edi
cmp eax, 0xffffffff
je 0x46707e
mov edx, dword [esi]
lea ecx, [esp + 8]
push ecx
push eax
push 0x198
push edx
call edi
jmp 0x46707e
mov eax, dword [esi]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 1
push 0xffffffffffffffff
push 0x100c
push eax
call edi
cmp eax, 0xffffffff
je 0x46707e
mov edx, dword [esi]
lea ecx, [esp + 8]
push ecx
push eax
push 0x100e
push edx
mov dword [esp + 0x18], 2
call edi
jmp 0x46707e
mov eax, dword [esi]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 9
push 0x110a
push eax
call edi
test eax, eax
je 0x46707e
mov edx, dword [esi]
lea ecx, [esp + 8]
push ecx
push 1
push 0x1104
push edx
mov dword [esp + 0x18], eax
call edi
jmp 0x46707e
mov ecx, dword [esi]
lea eax, [esp + 8]
push eax
push 0
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [esp + 8], 0x80000000
jne 0x467098
mov eax, dword [esi]
lea edx, [esp + 8]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x4670aa
mov edx, dword [esi]
push 2
lea ecx, [esp + 0xc]
push ecx
push 0
push edx
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [ebp], eax
mov eax, dword [esp + 0x14]
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
lea ecx, [eax + ecx + 2]
pop edi
mov dword [ebp + 4], ecx
pop ebp
add esp, 0x10
ret 4
Function at 0x467660
Capabilities:
Get keyboard layout

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, eax
lea esp, [esp]
mov al, byte [esi]
cmp al, 0x20
je 0x46767a
cmp al, 9
jne 0x46767d
inc esi
jmp 0x467670
mov cl, byte [esi]
test cl, cl
jne 0x467689
pop esi
xor al, al
pop ebp
pop ecx
ret
cmp byte [esi + 1], 0
lea eax, [esi + 1]
jne 0x4676a3
movzx eax, cl
mov word [ebp + 2], ax
pop esi
mov byte [ebp], 0
mov al, 1
pop ebp
pop ecx
ret
push ebx
push edi
push 0x2b
push eax
mov byte [ebp], 1
mov byte [esp + 0x1b], 0
call fcn.004bb121
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x46775f
lea eax, [ebx - 1]
cmp eax, esi
jbe 0x4676e1
lea ebx, [ebx]
mov cl, byte [eax]
cmp cl, 0x20
je 0x4676dc
cmp cl, 9
jne 0x4676e1
dec eax
cmp eax, esi
ja 0x4676d0
sub eax, esi
lea edi, [eax + 1]
push edi
push str.Ctrl
push esi
call fcn.004babb4
add esp, 0xc
test eax, eax
jne 0x467700
or byte [esp + 0x13], 1
jmp 0x467732
push edi
push 0x4e2878
push esi
call fcn.004babb4
add esp, 0xc
test eax, eax
jne 0x46771a
or byte [esp + 0x13], 4
jmp 0x467732
push edi
push str.Shift
push esi
call fcn.004babb4
add esp, 0xc
test eax, eax
jne 0x46778e
or byte [esp + 0x13], 0x10
lea esi, [ebx + 1]
mov al, byte [esi]
cmp al, 0x20
je 0x46773f
cmp al, 9
jne 0x467742
inc esi
jmp 0x467735
cmp byte [esi], 0
je 0x46778e
lea ecx, [esi + 1]
push 0x2b
push ecx
call fcn.004bb121
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4676c3
cmp byte [esi + 1], 0
jne 0x467796
push 1
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx edx, byte [esi]
push eax
push edx
call dword [sym.imp.USER32.dll_CharLowerA]
lea esi, [esp + 0x1b]
mov bl, al
call fcn.00412ce0
movzx eax, al
mov word [ebp + 2], ax
jmp 0x4677b1
pop edi
pop ebx
pop esi
xor al, al
pop ebp
pop ecx
ret
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 0
xor ecx, ecx
mov eax, esi
call fcn.00412c00
movzx ecx, al
mov word [ebp + 2], cx
mov al, byte [esp + 0x1b]
add esp, 8
test al, 1
je 0x4677c0
or byte [ebp], 8
test al, 4
je 0x4677c8
or byte [ebp], 0x10
test al, 0x10
je 0x4677d0
or byte [ebp], 4
cmp word [ebp + 2], 0
pop edi
pop ebx
pop esi
setne al
pop ebp
pop ecx
ret
Function at 0x46ae80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov al, byte [str.___0123456789ABCDEF]
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
mov byte [esp + 0xd], al
lea edi, [esp + 0xc]
mov eax, ebx
mov byte [esp + 0xc], 0x20
mov dword [esp + 0xe], 0x3e3c0928
mov dword [esp + 0x12], 0x2d2b3d3a
mov dword [esp + 0x16], 0x7e212f2a
mov dword [esp + 0x1a], 0x5b5e7c26
mov dword [esp + 0x1e], 0x7b3f2e
call fcn.004099e0
test eax, eax
je 0x46aed6
cmp eax, ebx
jbe 0x46aeed
dec eax
jmp 0x46aeed
mov eax, ebx
lea edx, [eax + 1]
jmp 0x46aee0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46aee0
sub eax, edx
lea eax, [eax + ebx - 1]
mov edi, eax
cmp eax, ebx
jbe 0x46af02
mov al, byte [edi]
cmp al, 0x20
je 0x46aefd
cmp al, 9
jne 0x46af02
dec edi
cmp edi, ebx
ja 0x46aef3
mov esi, edi
sub esi, ebx
inc esi
cmp esi, 0xfd
jbe 0x46af39
cmp byte [esp + 0x30], 0
je 0x46af2e
push ebx
push 0x4e2c10
call fcn.0049be50
mov ecx, dword [esp + 0x30]
add esp, 4
push eax
call fcn.00473b40
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x18
ret 0xc
push esi
push ebx
push ebp
call fcn.004bd1c0
add esp, 0xc
mov eax, edi
pop edi
mov byte [esi + ebp], 0
pop esi
pop ebp
add esp, 0x18
ret 0xc
Function at 0x477f40
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4cc630
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x18
push edi
mov edi, ecx
test eax, eax
je 0x4780cb
cmp ebx, 1
jb 0x4780cb
push esi
mov esi, dword [eax + 4]
mov eax, dword [esi]
cmp eax, 0x4034b50
je 0x477f97
cmp eax, 0xfbfcb4af
je 0x477f97
pop esi
xor al, al
pop edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
test edi, edi
jne 0x477fa0
mov edi, 0x4d6959
push ebp
push 0x4e3cc0
call fcn.0049be50
add esp, 4
lea ecx, [esp + 0xc]
mov ebp, vtable.CKuStringT_char__class_CKuStringUtilA_.0
push ecx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 0
call fcn.0047eac0
push edi
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x38], 0
call fcn.0047e940
add esp, 0xc
mov byte [esp + 0x2c], 2
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
test eax, eax
je 0x478021
lea ecx, [eax + 0x10]
mov eax, dword [ecx]
dec eax
mov dword [ecx], eax
jne 0x478021
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 4]
test eax, eax
je 0x478018
push eax
call fcn.004ba14c
add esp, 4
push edi
call fcn.004b9d3f
add esp, 4
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x47802f
mov ebp, dword [eax]
test ebp, ebp
jne 0x478034
mov ebp, 0x4d6959
mov eax, ebp
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x478040
mov ecx, dword [esi]
not ecx
mov dword [esi], ecx
sub eax, edx
mov ecx, 4
mov edi, eax
cmp ebx, ecx
jbe 0x47807a
lea ebx, [ebx]
xor edx, edx
mov eax, ecx
div edi
or al, 0xff
inc ecx
mov dl, byte [edx + ebp]
xor dl, byte [ecx + esi - 1]
sub al, dl
mov byte [ecx + esi - 1], al
cmp ecx, ebx
jb 0x478060
mov dword [esp + 0x2c], 0xffffffff
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], vtable.CKuStringT_char__class_CKuStringUtilA_.0
pop ebp
test eax, eax
je 0x4780b8
lea ecx, [eax + 0x10]
mov esi, eax
mov eax, dword [ecx]
dec eax
mov dword [ecx], eax
jne 0x4780b8
mov eax, dword [esi + 4]
test eax, eax
je 0x4780af
push eax
call fcn.004ba14c
add esp, 4
push esi
call fcn.004b9d3f
add esp, 4
pop esi
mov al, 1
pop edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
mov ecx, dword [esp + 0x1c]
xor al, al
pop edi
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x478690
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0xaaaaaaab
mul dword [esp + 0xc]
shr edx, 1
lea ecx, [edx + edx*2 + 3]
add ecx, ecx
add ecx, ecx
mov eax, 0xaaaaaaab
mul ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, edx
shr edi, 1
inc edi
xor ebx, ebx
call fcn.00413990
mov ecx, eax
test ecx, ecx
jne 0x4786f5
fldz
sub esp, 8
fstp qword [esp]
push eax
push eax
push 0x10000
push 0x4dc098
call fcn.0049be50
add esp, 4
push eax
call fcn.004a77b0
add esp, 0x18
lea eax, [ebx + 0x64]
pop edi
pop esi
pop ebp
pop ebx
ret
mov edi, dword [esp + 0x1c]
cmp edi, 2
jbe 0x478774
lea edx, [edi - 3]
mov eax, 0xaaaaaaab
mul edx
mov esi, edx
shr esi, 1
inc esi
lea ecx, [ecx]
movzx eax, byte [ebp]
shr eax, 2
movzx edx, byte [eax + 0x4ec390]
mov byte [ecx + ebx], dl
movzx eax, byte [ebp]
movzx edx, byte [ebp + 1]
and eax, 3
add eax, eax
shr edx, 4
mov al, byte [edx + eax*8 + 0x4ec390]
mov byte [ecx + ebx + 1], al
movzx edx, byte [ebp + 1]
movzx eax, byte [ebp + 2]
shr eax, 6
and edx, 0xf
movzx edx, byte [eax + edx*4 + 0x4ec390]
mov byte [ecx + ebx + 2], dl
movzx eax, byte [ebp + 2]
and eax, 0x3f
movzx edx, byte [eax + 0x4ec390]
mov byte [ecx + ebx + 3], dl
add ebx, 4
add ebp, 3
sub edi, 3
dec esi
jne 0x478710
test edi, edi
je 0x4787ed
movzx eax, byte [ebp]
shr eax, 2
mov dl, byte [eax + 0x4ec390]
mov byte [ecx + ebx], dl
cmp edi, 1
jbe 0x4787cf
movzx eax, byte [ebp]
movzx edx, byte [ebp + 1]
and eax, 3
shr edx, 4
add eax, eax
movzx eax, byte [edx + eax*8 + 0x4ec390]
mov byte [ecx + ebx + 1], al
movzx edx, byte [ebp + 1]
and edx, 0xf
movzx eax, byte [edx*4 + 0x4ec390]
mov byte [ecx + ebx + 2], al
mov byte [ecx + ebx + 3], 0x3d
add ebx, 4
mov byte [ecx + ebx], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
movzx edx, byte [ebp]
and edx, 3
shl edx, 4
mov al, byte [edx + 0x4ec390]
mov byte [ecx + ebx + 1], al
mov word [ecx + ebx + 2], 0x3d3d
add ebx, 4
pop edi
pop esi
pop ebp
mov byte [ecx + ebx], 0
xor eax, eax
pop ebx
ret
Function at 0x47df00
Capabilities:
Create pipe
Create process on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, eax
mov ebx, ecx
test ebp, ebp
je 0x47dfcc
cmp byte [ebp], 0
je 0x47dfcc
test edi, edi
je 0x47dfcc
test esi, esi
je 0x47dfcc
cmp dword [esi], 0
je 0x47dfcc
test ebx, ebx
je 0x47df44
cmp byte [ebx], 0
jne 0x47df44
xor ebx, ebx
push 0xa00000
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x20], 0xc
mov dword [esp + 0x28], 1
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x47dfcc
or dword [esi + 0x2c], 0x100
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push edi
mov dword [esi + 0x38], eax
mov eax, dword [esp + 0x24]
push esi
push ebx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
xor eax, eax
push eax
push eax
push 1
push eax
push eax
mov dword [edi], eax
mov dword [edi + 4], eax
push ebp
mov dword [edi + 8], eax
push eax
mov dword [edi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
mov eax, dword [esp + 0xc]
jne 0x47dfce
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x20]
push ecx
call esi
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x47e240
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4cc3eb
push eax
mov eax, 0x10124
mov dword fs:[0], esp
call fcn.004c6f60
push ebx
xor ebx, ebx
push edi
mov edi, ecx
cmp dword [esp + 0x10140], ebx
jne 0x47e28a
push str.4_799
call fcn.0049be50
add esp, 4
mov dword [esp + 0x10140], eax
cmp eax, ebx
je 0x47e46a
mov eax, dword [esp + 0x10140]
cmp byte [eax], bl
je 0x47e46a
mov eax, dword [esp + 0x10144]
cmp eax, ebx
je 0x47e46a
cmp byte [eax], bl
je 0x47e46a
push ebp
push 0x2f8
push ebx
lea ebp, [esp + 0x20]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], 0x17c
call fcn.004bb6d7
add esp, 8
cmp eax, ebx
jne 0x47e2e6
push ebx
call fcn.004ba14c
add esp, 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
jmp 0x47e2f0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
mov byte [eax], bl
push esi
mov dword [esp + 0x1013c], ebx
cmp edi, ebx
je 0x47e371
cmp byte [edi], bl
je 0x47e371
push 0x5c
push edi
call fcn.004bb121
add esp, 8
lea ecx, [esp + 0x1c]
test eax, eax
jne 0x47e35f
push 0x106
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x1c]
push 0x5c
push edx
call fcn.004bc514
add esp, 8
cmp eax, ebx
je 0x47e336
mov byte [eax + 1], bl
push 1
push ebx
lea eax, [esp + 0x24]
push eax
lea esi, [esp + 0x1c]
call fcn.00414160
push 1
push ebx
push edi
call fcn.00414160
mov ebp, dword [esp + 0x14]
mov eax, esi
call fcn.004146f0
mov edi, eax
jmp 0x47e3ba
push ebx
push ecx
push 0x118
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov edi, eax
jmp 0x47e3ba
mov eax, dword [0x4f22d4]
push ebx
lea edx, [esp + 0x20]
push edx
push 0x118
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea ecx, [esp + 0x1c]
push 0x2e
push ecx
mov edi, eax
call fcn.004bc514
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x47e3ba
push str.__.
call fcn.0049be50
mov edx, esi
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x47e3b0
cmp edi, 0x104
ja 0x47e45d
mov edx, dword [esp + 0x1014c]
cmp byte [edx], bl
je 0x47e45d
push 0x4dbe0c
mov byte [esp + 0x138], bl
call fcn.0049be50
mov ecx, dword [esp + 0x10150]
mov edx, dword [esp + 0x1014c]
add esp, 4
push ebp
push 0xffff
mov esi, eax
lea eax, [esp + 0x13c]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x134]
push esi
push eax
call fcn.004ba135
add esp, 8
test eax, eax
je 0x47e45d
mov eax, dword [esp + 0x10144]
lea ecx, [esp + 0x134]
push ecx
call fcn.00413c90
lea ecx, [esp + 0x10]
call fcn.004138f0
mov al, 1
pop esi
pop ebp
pop edi
pop ebx
mov ecx, dword [esp + 0x10124]
mov dword fs:[0], ecx
add esp, 0x10130
ret
lea ecx, [esp + 0x10]
call fcn.004138f0
xor al, al
jmp 0x47e444
mov ecx, dword [esp + 0x1012c]
pop edi
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x10130
ret
Function at 0x499150
Capabilities:
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x4ccb38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x28]
mov edx, dword [ebp + 4]
mov ecx, dword [ebp + 8]
push esi
push edi
xor ebx, ebx
xor eax, eax
lea edi, [esp + 0x10]
mov esi, 1
mov dword [esp + 0x30], ebx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov dword [ebp + 4], edi
mov dword [esp + 0x28], ebx
cmp ecx, ebx
jg 0x4991c2
mov dword [ebp + 4], edx
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x10
xor ebx, ebx
cmp eax, dword [esp + 0x3c]
jl 0x499201
mov eax, dword [0x4ec48c]
mov ecx, 0x3a
mov esi, 0x4ef870
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov dword [eax + 0x2c], ebx
mov dword [0x4f22f0], ebx
mov dword [0x4f22f4], ebx
cmp dword [0x4f0d74], ebx
je 0x4991fd
push 0x4f13e0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [esp + 0x18]
mov ecx, dword [ebp]
lea eax, [eax + eax*2]
mov ecx, dword [ecx + eax*4]
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x30]
push edx
mov edx, dword [esp + 0x38]
push eax
push edx
push str.call
xor eax, eax
mov ebx, ecx
call fcn.00496190
add esp, 0x10
test eax, eax
je 0x49926d
cmp dword [esp + 0x30], 0
jne 0x49928f
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
cmp eax, dword [esp + 0x1c]
jl 0x4991c0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], eax
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x10
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [ecx + 4], edx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x10
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
pop edi
pop esi
mov dword [ecx + 4], edx
mov ecx, dword [esp + 0x18]
pop ebp
mov eax, 3
mov dword fs:[0], ecx
pop ebx
add esp, 0x1c
ret 0x10
Function at 0x49a580
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x10110
call fcn.004c6f60
push ebp
mov ebp, dword [esp + 0x1011c]
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x10120]
test esi, esi
je 0x49a5a6
cmp byte [esi], 0
jne 0x49a5ab
mov esi, str.ERROR
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0x104
push edx
mov byte [esp + 0x12c], 0
mov byte [esp + 0x1f], 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
cmp byte [ebp], 0
je 0x49a61e
cmp byte [edi], 0
jne 0x49a5dd
lea edi, [esp + 0xf]
lea eax, [esp + 0x14]
push eax
push 0xffff
lea ecx, [esp + 0x124]
push ecx
push esi
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [0x4f0b10]
push 1
push 0
push 0xffffffffffffffff
lea eax, [esp + 0x128]
push eax
push ecx
call fcn.004a5c20
pop edi
pop esi
pop ebp
add esp, 0x10110
ret 8
cmp byte [edi], 0
je 0x49a63e
lea edx, [esp + 0x14]
push edx
push 0xffff
lea eax, [esp + 0x124]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
jmp 0x49a656
lea ecx, [esp + 0x14]
push ecx
push 0xffff
lea edx, [esp + 0x124]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
test eax, eax
je 0x49a5f8
lea eax, [esp + 0x11c]
cmp byte [eax], 0
jne 0x49a66f
cmp byte [eax + 1], 0
je 0x49a5f8
mov byte [eax], 0xa
inc eax
jmp 0x49a661
Function at 0x49ae40
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x110
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push ebp
push esi
push edi
mov edi, dword [esp + 0x124]
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push 0
push edi
mov dword [esp + 0x30], 0xff
call ebx
cmp eax, 0x103
je 0x49af07
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [0x4ec48c]
mov edx, dword [ecx + 0xb0]
lea eax, [esp + 0x14]
push eax
or edx, 0x20019
push edx
push 0
lea eax, [esp + 0x2c]
push eax
push edi
call ebp
mov esi, eax
test esi, esi
jne 0x49af14
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0049ae40
mov edx, dword [esp + 0x18]
add esp, 4
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x49af14
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
test esi, esi
jne 0x49af14
lea ecx, [esp + 0x18]
push ecx
push eax
push eax
push eax
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x34]
push eax
push esi
push edi
mov dword [esp + 0x30], 0xff
call ebx
cmp eax, 0x103
jne 0x49ae8a
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret

Function at 0x49af30
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
push esi
test ebx, ebx
je 0x49b01f
test edi, edi
je 0x49af48
cmp byte [edi], 0
jne 0x49af50
test ebp, ebp
je 0x49b01f
mov ecx, dword [0x4ec48c]
mov edx, dword [ecx + 0xb0]
lea eax, [esp + 0x14]
push eax
or edx, 0x2001f
push edx
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x49aff1
mov eax, dword [esp + 0x14]
test ebp, ebp
jne 0x49b008
push eax
call fcn.0049ae40
mov ecx, dword [esp + 0x18]
add esp, 4
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x49aff1
mov eax, 1
test byte [0x4f4dc0], al
jne 0x49afcf
or dword [0x4f4dc0], eax
push str.RegDeleteKeyExA
push str.advapi32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4f4dbc], eax
jmp 0x49afd4
mov eax, dword [0x4f4dbc]
mov edx, dword [0x4ec48c]
mov ecx, dword [edx + 0xb0]
test ecx, ecx
je 0x49affe
test eax, eax
je 0x49affe
push 0
push ecx
push edi
push ebx
call eax
mov esi, eax
cmp esi, 0xffffffff
jne 0x49b024
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x49b026
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x49afef
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esp + 0x14]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x49aff1
mov esi, 0x57
mov eax, esi
mov edx, dword [0x4ec48c]
mov dword [edx + 0x30], eax
mov edx, dword [esp + 0x10]
test esi, esi
setne al
movzx ecx, al
push ecx
push edx
call fcn.0042d120
pop esi
pop ebp
pop ecx
ret 8