joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b1f5
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x14], 1
jmp 0x41b216
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x13
jge 0x41b29b
mov ecx, dword [ebp - 0x14]
push ecx
push 0x59e1dc
lea edx, [ebp - 0x10]
push edx
call fcn.0054c6e3
add esp, 0xc
mov byte [ebp - 0x114], 0
mov eax, dword [ebp - 0x11c]
add eax, 0xac
push eax
push 0xff
lea ecx, [ebp - 0x114]
push ecx
push 0
lea edx, [ebp - 0x10]
push edx
push 0x59e1e8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x118], eax
movsx eax, byte [ebp - 0x114]
test eax, eax
je 0x41b285
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x11c]
mov dword [edx + ecx*4 + 0x60], 1
jmp 0x41b296
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x11c]
mov dword [ecx + eax*4 + 0x60], 0
jmp 0x41b20d
mov esp, ebp
pop ebp
ret

Function at 0x41b29f
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x571ac9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
mov dword [ebp - 0x6c], ecx
mov eax, dword [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x64]
call fcn.00569179
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x6c]
cmp dword [ecx + 0x5c], 0
je 0x41b3a1
push 0x4c
push 0
mov edx, dword [ebp - 0x6c]
add edx, 0x60
push edx
call fcn.0054bf90
add esp, 0xc
mov eax, dword [ebp - 0x6c]
add eax, 0xac
push eax
call fcn.00529440
add esp, 4
push 0x59e1f0
mov ecx, dword [ebp - 0x6c]
add ecx, 0xac
push ecx
call fcn.0054bea0
add esp, 8
push 0x59e1fc
mov edx, dword [ebp - 0x6c]
add edx, 0xac
push edx
call fcn.0054bea0
add esp, 8
mov eax, dword [ebp - 0x6c]
add eax, 0xac
push eax
push 0
push 0x59e208
push 0x59e214
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 0x6c]
mov dword [ecx + 0x2b0], eax
call fcn.0053c9e3
mov dword [ebp - 0x10], eax
push 0x444
mov ecx, dword [ebp - 0x6c]
call fcn.005654d4
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x10], 0
jne 0x41b37d
push 0
mov ecx, dword [ebp - 0x68]
call fcn.005657c0
jmp 0x41b38f
mov edx, dword [ebp - 0x6c]
mov eax, dword [edx + 0x2b0]
push eax
mov ecx, dword [ebp - 0x68]
call fcn.00404950
mov ecx, dword [ebp - 0x6c]
call fcn.0041b3be
mov ecx, dword [ebp - 0x6c]
mov dword [ecx + 0x5c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.005691eb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x423b7f
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5720d5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x11a4
call fcn.0054c740
push edi
mov dword [ebp - 0x11ac], ecx
mov dword [ebp - 0x9a0], 0
mov al, byte [0x5cfe78]
mov byte [ebp - 0x11a0], al
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x119f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0x5cfe7c]
mov byte [ebp - 0x99c], cl
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x99b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, byte [0x5cfe80]
mov byte [ebp - 0x18], dl
xor eax, eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov word [ebp - 0xf], ax
mov byte [ebp - 0xd], al
push 1
mov ecx, dword [ebp - 0x11ac]
add ecx, 0x11064
call fcn.0047a9d1
push 0x59ede0
lea ecx, [ebp - 0x11a4]
push ecx
call fcn.0053922f
add esp, 8
mov dword [ebp - 0x11b0], eax
mov edx, dword [ebp - 0x11b0]
mov eax, dword [edx]
push eax
push 0x59ede8
lea ecx, [ebp - 0x19c]
push ecx
call fcn.0054c6e3
add esp, 0xc
lea ecx, [ebp - 0x11a4]
call fcn.0056206c
push str.FlashType_350_
lea edx, [ebp - 0x11a0]
push edx
call fcn.0054c6e3
add esp, 8
mov dword [ebp - 0x9a0], 1
jmp 0x423c89
mov eax, dword [ebp - 0x9a0]
add eax, 1
mov dword [ebp - 0x9a0], eax
cmp dword [ebp - 0x9a0], 0x400
jg 0x423d45
mov ecx, dword [ebp - 0x9a0]
mov edx, dword [ebp - 0x11ac]
cmp dword [edx + ecx*4 + 0x860], 0
je 0x423d40
mov eax, dword [ebp - 0x9a0]
push eax
push 0x59edfc
lea ecx, [ebp - 0x98]
push ecx
call fcn.0054c6e3
add esp, 0xc
lea edx, [ebp - 0x19c]
push edx
push 0x800
lea eax, [ebp - 0x99c]
push eax
push 0x5cfe84
lea ecx, [ebp - 0x98]
push ecx
push 0x59ee00
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x99c]
push edx
call fcn.0054ce70
add esp, 4
test eax, eax
jbe 0x423d40
lea eax, [ebp - 0x99c]
push eax
call fcn.0054ce70
add esp, 4
imul eax, eax, 0xa
push eax
lea ecx, [ebp - 0x99c]
push ecx
lea edx, [ebp - 0x11a0]
push edx
push str._s_s___d_
lea eax, [ebp - 0x11a0]
push eax
call fcn.0054c6e3
add esp, 0x14
jmp 0x423c7a
lea ecx, [ebp - 0x11a0]
push ecx
lea ecx, [ebp - 0x11a8]
call fcn.005620da
mov dword [ebp - 4], 0
lea edx, [ebp - 0x11a8]
push edx
mov ecx, dword [ebp - 0x11ac]
add ecx, 0x11064
call fcn.0047a76d
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11a8]
call fcn.0056206c
push 1
mov ecx, dword [ebp - 0x11ac]
add ecx, 0x11064
call fcn.0047acee
mov ecx, dword [ebp - 0x11ac]
call fcn.004255f4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x42cc8c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [ebp - 0x78], ecx
mov ecx, dword [ebp - 0x78]
call fcn.00426df4
mov ecx, dword [ebp - 0x78]
mov dword [ecx + 0x60], eax
mov edx, dword [ebp - 0x78]
cmp dword [edx + 0x60], 0
jne 0x42ccb1
jmp 0x42ce7f
push 0x10
lea eax, [ebp - 0x28]
push eax
push 0x44f
mov ecx, dword [ebp - 0x78]
call fcn.005654d4
mov ecx, eax
call fcn.005656a4
lea ecx, [ebp - 0x28]
push ecx
call fcn.0054c571
add esp, 4
mov dword [ebp - 0x70], eax
push 0x465
mov ecx, dword [ebp - 0x78]
call fcn.005654d4
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x18], 0
push 0x3e9
mov ecx, dword [ebp - 0x78]
call fcn.005654d4
mov dword [ebp - 4], eax
push 0x10
lea edx, [ebp - 0x28]
push edx
mov ecx, dword [ebp - 4]
call fcn.005656a4
lea eax, [ebp - 0x28]
push eax
call fcn.005294d0
add esp, 4
mov dword [ebp - 0x10], eax
push 0x414
mov ecx, dword [ebp - 0x78]
call fcn.005654d4
mov dword [ebp - 4], eax
push 0x10
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp - 4]
call fcn.005656a4
lea edx, [ebp - 0x28]
push edx
call fcn.005294d0
add esp, 4
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
shl eax, 9
push eax
call fcn.0054cfd4
add esp, 4
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x2c]
shl ecx, 9
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, 0x5dfef8
call fcn.0045b638
mov ecx, dword [ebp - 0x78]
call fcn.0042d22b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x70]
push eax
push 0x2a
mov ecx, dword [ebp - 0x2c]
shl ecx, 9
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x78]
mov edx, dword [ecx + 0x6c]
push edx
mov eax, dword [ebp - 0x78]
mov cl, byte [eax + 0x65]
push ecx
mov edx, dword [ebp - 0x78]
mov al, byte [edx + 0x64]
push eax
mov ecx, dword [ebp - 0x78]
mov edx, dword [ecx + 0x68]
push edx
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax + 0x78]
push ecx
mov edx, dword [ebp - 0x78]
mov eax, dword [edx + 0x74]
push eax
mov ecx, dword [ebp - 0x78]
mov edx, dword [ecx + 0x5c]
push edx
call fcn.004bede2
add esp, 0x30
mov ecx, dword [ebp - 0x78]
mov dword [ecx + 0x60], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], edx
push 0x59fa18
mov ecx, dword [ebp - 0x74]
call fcn.0056567d
mov eax, dword [ebp - 0x18]
push eax
push 0x59fa24
lea ecx, [ebp - 0x6c]
push ecx
call fcn.0054c6e3
add esp, 0xc
lea edx, [ebp - 0x6c]
push edx
mov ecx, dword [ebp - 0x74]
call fcn.0056567d
push 1
mov ecx, dword [ebp - 0x78]
call fcn.00564b39
push 0
mov eax, dword [ebp - 0x2c]
shl eax, 9
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, 0x5dfef8
call fcn.0045b573
push 1
push 1
push 1
push 1
mov ecx, 0x5dfef8
call fcn.004598b3
push 0x105
push 0
push 0
mov ecx, 0x5dfef8
call fcn.00411670
mov ecx, dword [ebp - 0x78]
call fcn.00427253
mov edx, dword [ebp - 0xc]
push edx
call fcn.0054ccb2
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x43ad09
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 0x60], ecx
mov eax, dword [ebp - 0x60]
add eax, 0x84
push eax
push 0x10
lea ecx, [ebp - 0x10]
push ecx
push 0x5a0dc4
push 0x5a0dc8
push 0x5a0dd8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x10]
push edx
call fcn.0054c571
add esp, 4
test eax, eax
je 0x43add5
push 0x5a0de4
lea eax, [ebp - 0x10]
push eax
call fcn.0054c6e3
add esp, 8
push 1
mov ecx, dword [ebp - 0x60]
call fcn.005654d4
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x38]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.00411570
mov ecx, dword [ebp - 0x14]
call fcn.00401600
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x38]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.00568f03
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.00411570
push 1
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x30]
add edx, 0xa
push edx
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.005656ee
push 0x5a0de8
push 0x524
mov ecx, dword [ebp - 0x60]
call fcn.005654d4
mov ecx, eax
call fcn.0056567d
jmp 0x43ae5e
push 0x65a
mov ecx, dword [ebp - 0x60]
call fcn.005654d4
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x5c]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.00411570
mov ecx, dword [ebp - 0x14]
call fcn.00401600
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x5c]
push eax
mov ecx, dword [ebp - 0x3c]
call fcn.00568f03
lea ecx, [ebp - 0x4c]
push ecx
mov ecx, dword [ebp - 0x3c]
call fcn.00411570
push 1
mov edx, dword [ebp - 0x40]
sub edx, dword [ebp - 0x48]
push edx
mov eax, dword [ebp - 0x54]
add eax, 0xa
push eax
mov ecx, dword [ebp - 0x48]
push ecx
mov edx, dword [ebp - 0x4c]
push edx
mov ecx, dword [ebp - 0x3c]
call fcn.005656ee
push 0x5a0dec
push 0x524
mov ecx, dword [ebp - 0x60]
call fcn.005654d4
mov ecx, eax
call fcn.0056567d
push 0x5a0df0
lea eax, [ebp - 0x10]
push eax
call fcn.0054c6e3
add esp, 8
cmp dword [ebp + 8], 0
jne 0x43ae82
mov ecx, dword [ebp - 0x60]
add ecx, 0x84
push ecx
lea edx, [ebp - 0x10]
push edx
push str.EXTENDWINDOW
push str.UISETTING
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov esp, ebp
pop ebp
ret 4
Function at 0x45626b
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0xc]
call fcn.00456720
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, dword [ebp - 8]
push ecx
push 0x10
call dword [sym.imp.USER32.dll_SetClipboardData]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov esp, ebp
pop ebp
ret 4
Function at 0x460300
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57334d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1dc
mov dword [ebp - 0x1dc], ecx
lea ecx, [ebp - 0x144]
call fcn.00401420
mov dword [ebp - 4], 0
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x140]
push eax
call fcn.00529440
add esp, 4
push 0x5b0184
lea ecx, [ebp - 0x140]
push ecx
call fcn.0054bea0
add esp, 8
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
push eax
push 0x5b019c
lea ecx, [ebp - 0x30]
push ecx
call fcn.0054c6e3
add esp, 0xc
lea edx, [ebp - 0x140]
push edx
push 0
lea eax, [ebp - 0x30]
push eax
push 0x5b01a4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x3c], 1
jmp 0x4603ab
mov ecx, dword [ebp - 0x3c]
add ecx, 1
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x3c]
cmp edx, dword [ebp - 0x10]
jg 0x4604f8
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
push 0x5b01b0
lea edx, [ebp - 0x30]
push edx
call fcn.0054c6e3
add esp, 0x10
lea eax, [ebp - 0x140]
push eax
push 0x80
lea ecx, [ebp - 0x1c4]
push ecx
push 0x5e0730
lea edx, [ebp - 0x30]
push edx
push 0x5b01c0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x4604f3
lea eax, [ebp - 0x1c4]
push eax
lea ecx, [ebp - 0x144]
push ecx
call fcn.0055f827
add esp, 8
push 0x2c
call fcn.00562630
add esp, 4
mov dword [ebp - 0x1d0], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1d0], 0
je 0x46046c
push ecx
mov ecx, esp
mov dword [ebp - 0x1d4], esp
lea edx, [ebp - 0x144]
push edx
call fcn.00561de1
mov dword [ebp - 0x1e0], eax
mov ecx, dword [ebp - 0x1d0]
call fcn.004606b0
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x1e8], eax
jmp 0x460476
mov dword [ebp - 0x1e8], 0
mov ecx, dword [ebp - 0x1e8]
mov dword [ebp - 0x1cc], ecx
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x1cc]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
mov ecx, dword [ebp - 0x1dc]
add ecx, 0x5c
call fcn.00483f10
mov edx, dword [ebp - 0x3c]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 0x5b01cc
lea ecx, [ebp - 0x30]
push ecx
call fcn.0054c6e3
add esp, 0x10
lea edx, [ebp - 0x140]
push edx
push 0
lea eax, [ebp - 0x30]
push eax
push 0x5b01dc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x4604f3
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x38]
push edx
mov ecx, dword [ebp - 0x1dc]
call fcn.00460300
mov dword [ebp - 0x1c8], eax
jmp 0x4603a2
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144]
call fcn.0056206c
mov eax, dword [ebp - 0x1d8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x46d9de
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], 0
cmp dword [ebp + 0xc], 0
je 0x46da20
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test eax, eax
je 0x46da20
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x20c]
push edx
call fcn.0054be90
add esp, 8
jmp 0x46da43
lea eax, [ebp - 0x20c]
push eax
call fcn.00529440
add esp, 4
push 0x5b0ad4
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0054bea0
add esp, 8
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x46db95
push 0x5b0ae8
mov eax, dword [ebp + 8]
push eax
call fcn.0054cc9f
add esp, 8
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
je 0x46db95
push 0x80
push 0
lea ecx, [ebp - 0x84]
push ecx
call fcn.0054bf90
add esp, 0xc
mov dword [ebp - 4], 0
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x46dab6
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x20c]
push ecx
push 0x5b0aec
push 0x5b0af0
push 0x5b0afc
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea edx, [ebp - 0x20c]
push edx
push 0x5b0b04
push 0x5b0b08
push 0x5b0b14
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [ebp - 0x108]
push eax
push 0x80
lea ecx, [ebp - 0x84]
push ecx
call fcn.0054e601
add esp, 0xc
test eax, eax
je 0x46db50
mov edx, dword [ebp - 4]
push edx
push 0x5b0b1c
lea eax, [ebp - 0x104]
push eax
call fcn.0054c6e3
add esp, 0xc
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x84]
push edx
lea eax, [ebp - 0x104]
push eax
push 0x5b0b24
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x46daee
mov edx, dword [ebp - 4]
push edx
push 0x5b0b2c
lea eax, [ebp - 0x84]
push eax
call fcn.0054c6e3
add esp, 0xc
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x84]
push edx
push 0x5b0b30
push 0x5b0b3c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [ebp - 0x108]
push eax
call fcn.0054cbf2
add esp, 4
mov eax, dword [ebp - 0x210]
mov esp, ebp
pop ebp
ret 8
Function at 0x46f375
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x1a4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x1a8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x1ac]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x1b0]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x1b4]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x1b8]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 4]
call fcn.0046656d
mov ecx, dword [ebp - 0xc]
call fcn.00461705
mov ecx, dword [ebp - 0x10]
call fcn.004630bd
mov ecx, dword [ebp - 0x18]
call fcn.00463b23
mov ecx, dword [ebp - 0x14]
call fcn.0046b569
mov ecx, dword [ebp - 8]
call fcn.00471b9a
push 0x324
mov eax, dword [ebp - 4]
add eax, 0x368
push eax
push 0x67c494
call fcn.0054c7e0
add esp, 0xc
push 0x128
mov ecx, dword [ebp - 4]
add ecx, 0x1764
push ecx
push 0x67af58
call fcn.0054c7e0
add esp, 0xc
push 0xf74
mov edx, dword [ebp - 4]
add edx, 0x68c
push edx
push 0x67b520
call fcn.0054c7e0
add esp, 0xc
push 0x58
mov eax, dword [ebp - 0xc]
add eax, 0x3220
push eax
push 0x67d30c
call fcn.0054c7e0
add esp, 0xc
push 0x11c
mov ecx, dword [ebp - 0x10]
add ecx, 0x174
push ecx
push 0x67f8d0
call fcn.0054c7e0
add esp, 0xc
push 0xb0
mov edx, dword [ebp - 0x10]
add edx, 0xc4
push edx
push 0x67aab8
call fcn.0054c7e0
add esp, 0xc
push 0x160
mov eax, dword [ebp - 0x18]
add eax, 0x60
push eax
push 0x67d364
call fcn.0054c7e0
add esp, 0xc
push 0xb54
mov ecx, dword [ebp - 0x14]
add ecx, 0x60
push ecx
push 0x67c7b8
call fcn.0054c7e0
add esp, 0xc
push 0x240c
mov edx, dword [ebp - 8]
add edx, 0x60
push edx
push 0x67d4c4
call fcn.0054c7e0
add esp, 0xc
mov eax, dword [0x67f7a4]
push eax
mov ecx, 1
sub ecx, dword [0x67f7a8]
push ecx
mov ecx, dword [0x67aa58]
call fcn.004862a4
mov edx, dword [ebp - 0xc]
add edx, 0x68
push edx
push 0
mov ecx, dword [ebp - 0x1c]
call fcn.004700ae
cmp dword [0x67abcc], 0
je 0x46f53b
push 0x67ae40
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test eax, eax
jb 0x46f53b
push 0x67ae40
push 0
mov ecx, dword [ebp - 0x1c]
call fcn.0046fc8b
jmp 0x46f547
push 0
push 0
mov ecx, dword [ebp - 0x1c]
call fcn.0046fc8b
mov ecx, dword [ebp - 0x1c]
call fcn.00566615
mov esp, ebp
pop ebp
ret
Function at 0x474100
Capabilities:
Enumerate files on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x573e55
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x160
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 0x168], 0
lea ecx, [ebp - 0x160]
call fcn.00401420
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.00401420
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x16c]
call fcn.0047451c
mov byte [ebp - 4], 3
push 0x5b1124
lea ecx, [ebp - 0x18]
call fcn.005620da
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1c]
call fcn.005287a0
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea ecx, [ebp - 0x15c]
push ecx
push 0x5b1130
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0xffffffff
jne 0x4741f7
push 0x5e07f8
mov ecx, dword [ebp + 8]
call fcn.005620da
mov edx, dword [ebp - 0x168]
or edx, 1
mov dword [ebp - 0x168], edx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.0056206c
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.0056206c
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.0056206c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x160]
call fcn.0056206c
mov eax, dword [ebp + 8]
jmp 0x4742fc
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0
jne 0x47429e
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x160]
call fcn.005621f5
lea ecx, [ebp - 0x160]
call fcn.0056256e
lea ecx, [ebp - 0x18]
call fcn.005287a0
push eax
lea ecx, [ebp - 0x160]
call fcn.0055f4a1
cmp eax, 0xffffffff
je 0x47426f
push 0x5b1134
lea ecx, [ebp - 0x160]
call fcn.0055f4a1
cmp eax, 0xffffffff
je 0x47426f
mov ecx, dword [ebp - 0x160]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
push 0x5b113c
lea eax, [ebp - 0x10]
push eax
call fcn.0055f827
add esp, 0x10
lea ecx, [ebp - 0x15c]
push ecx
mov edx, dword [ebp - 0x164]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x474299
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x474299
mov dword [ebp - 0x14], 1
jmp 0x4741fe
mov eax, dword [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00561de1
mov edx, dword [ebp - 0x168]
or edx, 1
mov dword [ebp - 0x168], edx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.0056206c
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.0056206c
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.0056206c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x160]
call fcn.0056206c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x47430c
Capabilities:
Enumerate files on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x573e89
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x170
mov dword [ebp - 0x174], ecx
mov dword [ebp - 0x164], 0
lea ecx, [ebp - 0x15c]
call fcn.00401420
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00401420
mov byte [ebp - 4], 1
push 0x5b1144
lea eax, [ebp - 0x168]
push eax
mov ecx, dword [ebp - 0x174]
call fcn.0047451c
mov dword [ebp - 0x178], eax
mov ecx, dword [ebp - 0x178]
mov dword [ebp - 0x17c], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x17c]
push edx
lea eax, [ebp - 0x18]
push eax
call fcn.00562301
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x168]
call fcn.0056206c
lea ecx, [ebp - 0x18]
call fcn.005287a0
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x4744c3
lea ecx, [ebp - 0x158]
push ecx
push 0x5b1150
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xffffffff
jne 0x47441b
mov dword [ebp - 0x16c], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0056206c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0056206c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x15c]
call fcn.0056206c
mov eax, dword [ebp - 0x16c]
jmp 0x47450c
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0
jne 0x4744c3
lea edx, [ebp - 0x12c]
push edx
lea ecx, [ebp - 0x15c]
call fcn.005621f5
lea ecx, [ebp - 0x15c]
call fcn.0056256e
push 0x5b1154
lea ecx, [ebp - 0x15c]
call fcn.0055f4a1
cmp eax, 0xffffffff
je 0x474494
mov eax, dword [ebp - 0x15c]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
push 0x5b115c
mov edx, dword [ebp - 0x164]
shl edx, 9
mov eax, dword [ebp + 8]
add eax, edx
push eax
call fcn.0054c6e3
add esp, 0x10
mov ecx, dword [ebp - 0x164]
add ecx, 1
mov dword [ebp - 0x164], ecx
lea edx, [ebp - 0x158]
push edx
mov eax, dword [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4744be
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4744be
mov dword [ebp - 0x14], 1
jmp 0x474422
mov ecx, dword [ebp - 0x160]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [ebp - 0x164]
mov dword [ebp - 0x170], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0056206c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0056206c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x15c]
call fcn.0056206c
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4