joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48b6c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x824], ecx
mov dword [ebp - 0x810], 1
push 0x536f50
lea ecx, [ebp - 4]
call fcn.0041d0c0
lea eax, [ebp - 0x80c]
push eax
call fcn.0044d400
add esp, 4
xor ecx, ecx
mov word [ebp - 0x808], cx
push 0x7fe
push 0
lea edx, [ebp - 0x806]
push edx
call fcn.004f7580
add esp, 0xc
lea ecx, [ebp - 0x80c]
call fcn.0041d2b0
push eax
push 0x104
lea eax, [ebp - 0x808]
push eax
push 0
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
push 0x536f54
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 1
jbe 0x48b840
push 0x3b
lea ecx, [ebp - 0x808]
push ecx
call fcn.004162a0
add esp, 8
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x48b7df
mov edx, dword [ebp - 0x814]
movzx eax, word [edx + 2]
test eax, eax
je 0x48b7bb
mov ecx, dword [ebp - 0x814]
add ecx, 2
push ecx
lea ecx, [ebp - 0x818]
call fcn.0041d0c0
lea edx, [ebp - 0x818]
push edx
mov ecx, dword [ebp - 0x824]
add ecx, 0xc4
call fcn.00439610
lea ecx, [ebp - 0x818]
call fcn.0041d100
xor eax, eax
mov ecx, dword [ebp - 0x814]
mov word [ecx], ax
push 0x3b
lea edx, [ebp - 0x808]
push edx
call fcn.004162a0
add esp, 8
mov dword [ebp - 0x814], eax
jmp 0x48b76c
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x81c]
call fcn.0041d0c0
lea ecx, [ebp - 0x81c]
push ecx
mov ecx, dword [ebp - 0x824]
add ecx, 0xc4
call fcn.00439610
lea ecx, [ebp - 0x81c]
call fcn.0041d100
mov edx, dword [ebp - 0x810]
add edx, 1
mov dword [ebp - 0x810], edx
mov eax, dword [ebp - 0x810]
push eax
push 0x536f6c
lea ecx, [ebp - 4]
push ecx
call fcn.0041e770
add esp, 0xc
jmp 0x48b71e
mov ecx, dword [ebp - 0x824]
add ecx, 0xc4
call fcn.0048ea80
xor edx, edx
cmp edx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x820], eax
lea ecx, [ebp - 0x80c]
call fcn.0041d100
lea ecx, [ebp - 4]
call fcn.0041d100
mov eax, dword [ebp - 0x820]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret
Function at 0x48bbc0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x414], 1
push 0x536f9c
lea ecx, [ebp - 0x40c]
call fcn.0048e810
lea eax, [ebp - 0x424]
push eax
call fcn.0044d400
add esp, 4
push eax
lea ecx, [ebp - 0x410]
push ecx
call fcn.004e1ab0
add esp, 8
lea ecx, [ebp - 0x424]
call fcn.0041d100
mov byte [ebp - 0x408], 0
push 0x3ff
push 0
lea edx, [ebp - 0x407]
push edx
call fcn.004f7580
add esp, 0xc
lea ecx, [ebp - 0x410]
call fcn.00403120
push eax
push 0x400
lea eax, [ebp - 0x408]
push eax
push 0
lea ecx, [ebp - 0x40c]
call fcn.00403120
push eax
push str.WinSna
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 1
jbe 0x48bd68
push 0x3b
lea ecx, [ebp - 0x408]
push ecx
call fcn.0048e070
add esp, 8
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
je 0x48bd00
mov edx, dword [ebp - 0x418]
movsx eax, byte [edx + 1]
test eax, eax
je 0x48bcde
mov ecx, dword [ebp - 0x418]
add ecx, 1
push ecx
lea edx, [ebp - 0x420]
push edx
call fcn.004e1910
add esp, 8
lea eax, [ebp - 0x420]
push eax
mov ecx, dword [ebp - 0x42c]
add ecx, 0x118
call fcn.00439610
lea ecx, [ebp - 0x420]
call fcn.0041d100
mov ecx, dword [ebp - 0x418]
mov byte [ecx], 0
push 0x3b
lea edx, [ebp - 0x408]
push edx
call fcn.0048e070
add esp, 8
mov dword [ebp - 0x418], eax
jmp 0x48bc8b
lea eax, [ebp - 0x408]
push eax
lea ecx, [ebp - 0x41c]
push ecx
call fcn.004e1910
add esp, 8
lea edx, [ebp - 0x41c]
push edx
mov ecx, dword [ebp - 0x42c]
add ecx, 0x118
call fcn.00439610
mov eax, dword [ebp - 0x414]
add eax, 1
mov dword [ebp - 0x414], eax
mov ecx, dword [ebp - 0x414]
push ecx
push 0x536fa8
lea edx, [ebp - 0x40c]
push edx
call fcn.004045f0
add esp, 0xc
lea ecx, [ebp - 0x41c]
call fcn.0041d100
jmp 0x48bc3a
mov ecx, dword [ebp - 0x42c]
add ecx, 0x118
call fcn.0048ea80
xor ecx, ecx
cmp ecx, eax
sbb edx, edx
neg edx
mov dword [ebp - 0x428], edx
lea ecx, [ebp - 0x410]
call fcn.00403030
lea ecx, [ebp - 0x40c]
call fcn.00403030
mov eax, dword [ebp - 0x428]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret
Function at 0x48c6f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x410], 1
push 0x536ff0
lea ecx, [ebp - 4]
call fcn.0048e810
lea eax, [ebp - 0x420]
push eax
call fcn.0044d400
add esp, 4
push eax
lea ecx, [ebp - 0x40c]
push ecx
call fcn.004e1ab0
add esp, 8
lea ecx, [ebp - 0x420]
call fcn.0041d100
mov byte [ebp - 0x408], 0
push 0x3ff
push 0
lea edx, [ebp - 0x407]
push edx
call fcn.004f7580
add esp, 0xc
lea ecx, [ebp - 0x40c]
call fcn.00403120
push eax
push 0x400
lea eax, [ebp - 0x408]
push eax
push 0
lea ecx, [ebp - 4]
call fcn.00403120
push eax
push str.NeedCloudFs
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 1
jbe 0x48c88f
push 0x3b
lea ecx, [ebp - 0x408]
push ecx
call fcn.0048e070
add esp, 8
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
je 0x48c82a
mov edx, dword [ebp - 0x414]
movsx eax, byte [edx + 1]
test eax, eax
je 0x48c808
mov ecx, dword [ebp - 0x414]
add ecx, 1
push ecx
lea edx, [ebp - 0x41c]
push edx
call fcn.004e1910
add esp, 8
lea eax, [ebp - 0x41c]
push eax
mov ecx, dword [ebp - 0x428]
add ecx, 0x150
call fcn.00439610
lea ecx, [ebp - 0x41c]
call fcn.0041d100
mov ecx, dword [ebp - 0x414]
mov byte [ecx], 0
push 0x3b
lea edx, [ebp - 0x408]
push edx
call fcn.0048e070
add esp, 8
mov dword [ebp - 0x414], eax
jmp 0x48c7b5
lea eax, [ebp - 0x408]
push eax
lea ecx, [ebp - 0x418]
push ecx
call fcn.004e1910
add esp, 8
lea edx, [ebp - 0x418]
push edx
mov ecx, dword [ebp - 0x428]
add ecx, 0x150
call fcn.00439610
mov eax, dword [ebp - 0x410]
add eax, 1
mov dword [ebp - 0x410], eax
mov ecx, dword [ebp - 0x410]
push ecx
push 0x537000
lea edx, [ebp - 4]
push edx
call fcn.004045f0
add esp, 0xc
lea ecx, [ebp - 0x418]
call fcn.0041d100
jmp 0x48c767
mov ecx, dword [ebp - 0x428]
add ecx, 0x150
call fcn.0048ea80
xor ecx, ecx
cmp ecx, eax
sbb edx, edx
neg edx
mov dword [ebp - 0x424], edx
lea ecx, [ebp - 0x40c]
call fcn.00403030
lea ecx, [ebp - 4]
call fcn.00403030
mov eax, dword [ebp - 0x424]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret
Function at 0x48c8e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x414], 1
push 0x537004
lea ecx, [ebp - 0x40c]
call fcn.0048e810
lea eax, [ebp - 0x424]
push eax
call fcn.0044d400
add esp, 4
push eax
lea ecx, [ebp - 0x410]
push ecx
call fcn.004e1ab0
add esp, 8
lea ecx, [ebp - 0x424]
call fcn.0041d100
mov byte [ebp - 0x408], 0
push 0x3ff
push 0
lea edx, [ebp - 0x407]
push edx
call fcn.004f7580
add esp, 0xc
lea ecx, [ebp - 0x410]
call fcn.00403120
push eax
push 0x400
lea eax, [ebp - 0x408]
push eax
push 0
lea ecx, [ebp - 0x40c]
call fcn.00403120
push eax
push str.WinSnaFs
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 1
jbe 0x48ca88
push 0x3b
lea ecx, [ebp - 0x408]
push ecx
call fcn.0048e070
add esp, 8
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
je 0x48ca20
mov edx, dword [ebp - 0x418]
movsx eax, byte [edx + 1]
test eax, eax
je 0x48c9fe
mov ecx, dword [ebp - 0x418]
add ecx, 1
push ecx
lea edx, [ebp - 0x420]
push edx
call fcn.004e1910
add esp, 8
lea eax, [ebp - 0x420]
push eax
mov ecx, dword [ebp - 0x42c]
add ecx, 0x16c
call fcn.00439610
lea ecx, [ebp - 0x420]
call fcn.0041d100
mov ecx, dword [ebp - 0x418]
mov byte [ecx], 0
push 0x3b
lea edx, [ebp - 0x408]
push edx
call fcn.0048e070
add esp, 8
mov dword [ebp - 0x418], eax
jmp 0x48c9ab
lea eax, [ebp - 0x408]
push eax
lea ecx, [ebp - 0x41c]
push ecx
call fcn.004e1910
add esp, 8
lea edx, [ebp - 0x41c]
push edx
mov ecx, dword [ebp - 0x42c]
add ecx, 0x16c
call fcn.00439610
mov eax, dword [ebp - 0x414]
add eax, 1
mov dword [ebp - 0x414], eax
mov ecx, dword [ebp - 0x414]
push ecx
push 0x537014
lea edx, [ebp - 0x40c]
push edx
call fcn.004045f0
add esp, 0xc
lea ecx, [ebp - 0x41c]
call fcn.0041d100
jmp 0x48c95a
mov ecx, dword [ebp - 0x42c]
add ecx, 0x16c
call fcn.0048ea80
xor ecx, ecx
cmp ecx, eax
sbb edx, edx
neg edx
mov dword [ebp - 0x428], edx
lea ecx, [ebp - 0x410]
call fcn.00403030
lea ecx, [ebp - 0x40c]
call fcn.00403030
mov eax, dword [ebp - 0x428]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret
Function at 0x48cae0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x410], 1
push 0x537018
lea ecx, [ebp - 4]
call fcn.0048e810
lea eax, [ebp - 0x420]
push eax
call fcn.0044d400
add esp, 4
push eax
lea ecx, [ebp - 0x40c]
push ecx
call fcn.004e1ab0
add esp, 8
lea ecx, [ebp - 0x420]
call fcn.0041d100
mov byte [ebp - 0x408], 0
push 0x3ff
push 0
lea edx, [ebp - 0x407]
push edx
call fcn.004f7580
add esp, 0xc
lea ecx, [ebp - 0x40c]
call fcn.00403120
push eax
push 0x400
lea eax, [ebp - 0x408]
push eax
push 0
lea ecx, [ebp - 4]
call fcn.00403120
push eax
push str.FsModeWhiteProc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 1
jbe 0x48cc7f
push 0x3b
lea ecx, [ebp - 0x408]
push ecx
call fcn.0048e070
add esp, 8
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
je 0x48cc1a
mov edx, dword [ebp - 0x414]
movsx eax, byte [edx + 1]
test eax, eax
je 0x48cbf8
mov ecx, dword [ebp - 0x414]
add ecx, 1
push ecx
lea edx, [ebp - 0x41c]
push edx
call fcn.004e1910
add esp, 8
lea eax, [ebp - 0x41c]
push eax
mov ecx, dword [ebp - 0x430]
add ecx, 0x188
call fcn.00439610
lea ecx, [ebp - 0x41c]
call fcn.0041d100
mov ecx, dword [ebp - 0x414]
mov byte [ecx], 0
push 0x3b
lea edx, [ebp - 0x408]
push edx
call fcn.0048e070
add esp, 8
mov dword [ebp - 0x414], eax
jmp 0x48cba5
lea eax, [ebp - 0x408]
push eax
lea ecx, [ebp - 0x418]
push ecx
call fcn.004e1910
add esp, 8
lea edx, [ebp - 0x418]
push edx
mov ecx, dword [ebp - 0x430]
add ecx, 0x188
call fcn.00439610
mov eax, dword [ebp - 0x410]
add eax, 1
mov dword [ebp - 0x410], eax
mov ecx, dword [ebp - 0x410]
push ecx
push 0x53702c
lea edx, [ebp - 4]
push edx
call fcn.004045f0
add esp, 0xc
lea ecx, [ebp - 0x418]
call fcn.0041d100
jmp 0x48cb57
mov ecx, dword [ebp - 0x430]
add ecx, 0x188
call fcn.0048eaa0
movzx eax, al
test eax, eax
je 0x48ccfd
push str.explorer.exe
lea ecx, [ebp - 0x424]
call fcn.0041d0c0
lea ecx, [ebp - 0x424]
push ecx
mov ecx, dword [ebp - 0x430]
add ecx, 0x188
call fcn.00439610
lea ecx, [ebp - 0x424]
call fcn.0041d100
push str.360pic.exe
lea ecx, [ebp - 0x428]
call fcn.0041d0c0
lea edx, [ebp - 0x428]
push edx
mov ecx, dword [ebp - 0x430]
add ecx, 0x188
call fcn.00439610
lea ecx, [ebp - 0x428]
call fcn.0041d100
mov ecx, dword [ebp - 0x430]
add ecx, 0x188
call fcn.0048ea80
xor ecx, ecx
cmp ecx, eax
sbb edx, edx
neg edx
mov dword [ebp - 0x42c], edx
lea ecx, [ebp - 0x40c]
call fcn.00403030
lea ecx, [ebp - 4]
call fcn.00403030
mov eax, dword [ebp - 0x42c]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret
Function at 0x48da70
Capabilities:
Check for time delay via gettickcount
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
cmp dword [0x5562d0], 0
jne 0x48dac6
mov dword [0x5562d0], 1
mov dword [ebp - 0x34], 0
push 0x2c
push 0
lea eax, [ebp - 0x30]
push eax
call fcn.004f7580
add esp, 0xc
mov dword [ebp - 0x34], 0x30
mov dword [ebp - 0x20], 0x400000
mov dword [ebp - 0xc], 0x537198
mov dword [ebp - 0x2c], 0x48dbd0
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
push 0x400000
push 0
push 0xfffffffffffffffd
push 0
push 0
push 0
push 0
push 0
push 0
push str.C579A2E8_9F83_4375_AB58_21A25ABB45B9
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x48dbc5
push 0xfffffffffffffff0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
and ecx, 0x7fffffff
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x3c]
or edx, 0x40000000
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
push eax
push 0xfffffffffffffff0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetParent]
mov dword [ebp - 0x5c], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x38], eax
push 1
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x58]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x48db9a
cmp dword [ebp - 0x54], 0x12
jne 0x48db86
jmp 0x48dbc5
lea edx, [ebp - 0x58]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x48dbaa
jmp 0x48dbc5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x38]
cmp eax, 0x3e8
jb 0x48dbbc
jmp 0x48dbc5
mov edx, 1
test edx, edx
jne 0x48db66
mov esp, ebp
pop ebp
ret
Function at 0x48dbf0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 8]
push eax
call fcn.00448fe0
add esp, 4
lea ecx, [ebp - 8]
call fcn.0041d2b0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x48dc26
push 0
lea ecx, [ebp - 8]
call fcn.0041d2b0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 4]
call fcn.0041d080
mov ecx, dword [ebp + 8]
push ecx
push 0x537238
lea edx, [ebp - 4]
push edx
call fcn.0041e770
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
call fcn.0041d160
push 0x537240
lea ecx, [ebp - 8]
call fcn.0041d180
lea ecx, [ebp + 0xc]
push ecx
lea ecx, [ebp - 8]
call fcn.0041d160
cmp dword [ebp + 0x20], 0
je 0x48dc7b
push 0x537244
lea ecx, [ebp - 8]
call fcn.0041d180
push 0x537250
lea ecx, [ebp - 8]
call fcn.0041d180
lea edx, [ebp + 0x14]
push edx
lea ecx, [ebp - 8]
call fcn.0041d160
push 0x537254
lea ecx, [ebp - 8]
call fcn.0041d180
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 8]
call fcn.0041d160
push 0x537258
lea ecx, [ebp - 8]
call fcn.0041d180
push ecx
mov ecx, esp
lea edx, [ebp - 8]
push edx
call fcn.0041d0a0
mov eax, dword [ebp + 8]
push eax
call fcn.0048dd20
add esp, 8
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 4]
call fcn.0041d100
lea ecx, [ebp - 8]
call fcn.0041d100
lea ecx, [ebp + 0xc]
call fcn.0041d100
lea ecx, [ebp + 0x10]
call fcn.0041d100
lea ecx, [ebp + 0x14]
call fcn.0041d100
lea ecx, [ebp + 0x18]
call fcn.0041d100
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x496270
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push edi
push str.pop.log
lea eax, [ebp - 0x3c]
push eax
call fcn.0044d6f0
add esp, 4
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.0041bc20
add esp, 0xc
lea ecx, [ebp - 0x3c]
call fcn.0041d100
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
push 1
push str.WeekCleanEnable
push 0x5375ac
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
call fcn.0045cb20
movzx edx, al
test edx, edx
jne 0x4963c4
cmp dword [ebp - 8], 1
jne 0x4963c4
xor eax, eax
mov word [ebp - 0x20], ax
xor ecx, ecx
mov dword [ebp - 0x1e], ecx
mov dword [ebp - 0x1a], ecx
mov dword [ebp - 0x16], ecx
mov word [ebp - 0x12], cx
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor eax, eax
mov word [ebp - 0x30], ax
xor ecx, ecx
mov dword [ebp - 0x2e], ecx
mov dword [ebp - 0x2a], ecx
mov dword [ebp - 0x26], ecx
mov word [ebp - 0x22], cx
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.00459420
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp + 8]
call fcn.00459450
push eax
lea ecx, [ebp - 0x10]
call fcn.00459580
movzx ecx, al
test ecx, ecx
je 0x4963c4
push 0
call fcn.004963e0
add esp, 4
mov esi, eax
mov edi, edx
lea ecx, [ebp - 0x10]
call fcn.00459520
mov edx, dword [eax]
sub esi, dword [edx + 0x748]
sbb edi, dword [edx + 0x74c]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], edi
cmp dword [ebp - 0x34], 0
jl 0x4963b7
jg 0x496374
cmp dword [ebp - 0x38], 0x127500
jb 0x4963b7
lea ecx, [ebp - 0x10]
call fcn.00459520
mov eax, dword [eax]
add eax, 4
push eax
call fcn.00496520
add esp, 4
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x4c]
push ecx
lea edx, [ebp - 0x54]
push edx
mov ecx, dword [ebp + 8]
call fcn.0045d150
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
jmp 0x4963bf
lea ecx, [ebp - 0x10]
call fcn.0045a3a0
jmp 0x496319
lea ecx, [ebp - 4]
call fcn.0041d100
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x496520
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x49658f
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 4]
call fcn.0041d0c0
push str..delete
lea ecx, [ebp - 4]
call fcn.0041d180
push 1
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x496579
push 4
push 0
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x496587
push 4
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 4]
call fcn.0041d100
mov esp, ebp
pop ebp
ret
Function at 0x49b6b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
call fcn.0044d400
add esp, 4
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
push 0x258
push str.checkmaxX
push 0x53780c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x5562f8], eax
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
push 0x258
push str.checkmaxY
push 0x537830
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x5562fc], eax
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
push 0x32
push str.checkminY
push 0x537854
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x556300], eax
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
push 0x258
push str.checkExplmaxX
push 0x537880
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x556304], eax
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
push 0x258
push str.checkExplmaxY
push str.PopWnd
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x556308], eax
mov dword [ebp - 8], 1
lea ecx, [ebp - 4]
call fcn.0041d100
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x49d610
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x14]
push eax
push 0
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x49d66b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
je 0x49d64d
xor eax, eax
jmp 0x49d6f1
lea ecx, [ebp - 0x14]
push ecx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x49d66b
xor eax, eax
jmp 0x49d6f1
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x18], 2
lea edx, [ebp - 0x20]
push edx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0x10
lea edx, [ebp - 0x24]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x49d6c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x49d6f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
jne 0x49d6ec
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x49d6f1
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x49d700
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x49d739
mov ecx, dword [ebp - 0xc]
call fcn.0049d610
mov ecx, dword [ebp + 8]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x49d743
xor eax, eax
jmp 0x49d772
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x49d76f
mov ecx, dword [ebp - 0xc]
call fcn.0049d610
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x49d9a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.004f7580
add esp, 0xc
mov dword [ebp - 0x214], 0
lea edx, [ebp - 0x214]
push edx
push 0x20019
push 0
push 0x537a08
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x49da53
mov dword [ebp - 0x220], 0x204
mov dword [ebp - 0x21c], 1
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x21c]
push edx
push 0
push 0x5379f8
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x210]
push edx
mov ecx, dword [ebp + 8]
call fcn.0041d0c0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret

Function at 0x49dcb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 1
push 0
push 0x537ab0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x49dcf5
cmp dword [ebp - 8], 0
je 0x49dd48
mov dword [ebp - 4], 4
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 4
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 4]
push eax
push 0
push 0x537af4
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x49dd37
mov dword [ebp - 0xc], 1
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret