joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d380
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x314
push esi
push edi
xor dl, dl
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], dl
mov byte [esp + 0x114], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x115]
mov byte [esp + 0x218], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x219]
mov esi, dword [esp + 0x324]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.MSVCRT.dll__snprintf]
push esi
push 0x51b230
lea eax, [esp + 0x220]
push 0x103
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], 0x104
call edi
add esp, 0x10
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
lea eax, [esp + 0xc]
push ecx
push edx
push eax
lea ecx, [esp + 0x224]
push 0x5265c0
push ecx
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov edx, dword [0x51af80]
push esi
push edx
push 0x51b234
lea eax, [esp + 0x120]
push 0x103
push eax
call edi
lea ecx, [esp + 0x128]
lea edx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 0x1c
test eax, eax
je 0x42d4d6
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x10]
push ecx
mov ecx, dword [0x51af84]
push eax
push 1
lea edx, [esp + 0x224]
push ecx
push edx
push SysReAllocStringLen
call esi
lea edi, [esp + 0x114]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x114]
push ecx
push eax
push 1
lea ecx, [esp + 0x224]
push 0x5265c0
push ecx
push SysReAllocStringLen
call esi
pop edi
mov eax, 1
pop esi
add esp, 0x314
ret 8
pop edi
xor eax, eax
pop esi
add esp, 0x314
ret 8
Function at 0x42d4f0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4d7160
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
push edi
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 8]
mov byte [esp + 0x3c], 1
call sub.MFC42.DLL_CString::CString_3
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x4c]
mov byte [esp + 0x3c], 2
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push eax
push 2
push esi
call fcn.004b88a0
add esp, 0xc
test eax, eax
je 0x42d5a6
push 0
lea ecx, [esp + 0x50]
push 0
push ecx
call fcn.00420140
add esp, 0xc
mov eax, dword [esp + 0x4c]
lea edx, [esp + 0x14]
push edx
push eax
lea ecx, [esp + 0x10]
push 0x51b24c
push ecx
mov byte [esp + 0x4c], 3
call sub.MFC42.DLL_CString::Format
add esp, 0x10
lea ecx, [esp + 0x4c]
mov byte [esp + 0x3c], 2
call sub.MFC42.DLL_CString::CString
jmp 0x42d5b0
push esi
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::operator_2
mov edx, dword [esp + 0x48]
mov eax, dword [0x51af80]
push edx
push eax
lea ecx, [esp + 0x18]
push 0x51b234
push ecx
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x20]
add esp, 0x10
lea eax, [esp + 0xc]
push edx
push 0x51b23c
push eax
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x14]
add esp, 0xc
mov ecx, dword [eax - 8]
push ecx
mov ecx, dword [esp + 0x10]
push eax
push 1
push 0x5265c0
push ecx
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea ecx, [esp + 8]
mov byte [esp + 0x3c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x34]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 0xc
Function at 0x42d650
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4d7178
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esp + 0x38]
mov esi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x28]
mov ebp, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
mov dword [esp + 0x1c], 0
je 0x42d6cb
mov eax, dword [0x51af80]
push ebx
push eax
lea ecx, [esp + 0x18]
push 0x51b288
push ecx
call sub.MFC42.DLL_CString::Format
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
dec ecx
push ecx
push esi
push 1
push 0x5265c0
push edx
push SysReAllocStringLen
call ebp
mov eax, dword [0x51af80]
push esi
push ebx
push eax
lea ecx, [esp + 0x1c]
push 0x51b278
push ecx
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x44]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 1
push 0x5265c0
push edx
push SysReAllocStringLen
call ebp
mov eax, dword [0x51af80]
push esi
push ebx
push eax
lea ecx, [esp + 0x1c]
push 0x51b260
push ecx
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x48]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 1
push 0x5265c0
push edx
push SysReAllocStringLen
call ebp
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x42d780
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4d7198
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esp + 0x38]
mov esi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x28]
mov ebp, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
mov dword [esp + 0x1c], 0
je 0x42d7fb
mov eax, dword [0x51af80]
push ebx
push eax
lea ecx, [esp + 0x18]
push 0x51b288
push ecx
call sub.MFC42.DLL_CString::Format
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
dec ecx
push ecx
push esi
push 1
push 0x5265c0
push edx
push SysReAllocStringLen
call ebp
mov eax, dword [0x51af80]
push esi
push ebx
push eax
lea ecx, [esp + 0x1c]
push 0x51b278
push ecx
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x44]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 1
push 0x5265c0
push edx
push SysReAllocStringLen
call ebp
mov eax, dword [0x51af80]
push esi
push ebx
push eax
lea ecx, [esp + 0x1c]
push 0x51b29c
push ecx
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x48]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 1
push 0x51b294
push edx
push SysReAllocStringLen
call ebp
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x462e30
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4de0a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push edi
mov edi, ecx
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 1
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [edi + 0x90]
mov byte [esp + 0x2c], 2
neg eax
sbb eax, eax
test eax, eax
mov dword [esp + 0x14], eax
je 0x462f2b
push ebx
push esi
lea esi, [edi + 0x84]
mov bl, 4
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call sub.MFC42.DLL_CMapStringToString::GetNextAssoc
lea eax, [esp + 0x18]
push 0x3b
lea ecx, [esp + 0x2c]
push eax
push ecx
call sub.MFC42.DLL_operator_1
lea edx, [esp + 0x14]
mov byte [esp + 0x34], 3
push edx
push eax
lea eax, [esp + 0x2c]
push eax
call sub.MFC42.DLL_operator_3
push 0x3b
lea ecx, [esp + 0x24]
push eax
push ecx
mov byte [esp + 0x40], bl
call sub.MFC42.DLL_operator_1
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 5
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x20]
mov byte [esp + 0x34], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x34], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x34], 2
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x462e98
pop esi
pop ebx
push 0x3b
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::TrimRight
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_3
mov edx, dword [edi + 0x3c]
lea eax, [esp + 8]
push edx
push 0x51dfd0
push eax
mov byte [esp + 0x38], 6
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x10]
add esp, 0xc
mov ecx, dword [eax - 8]
push ecx
mov ecx, dword [esp + 0xc]
push eax
push 1
push 0x51dfc8
push ecx
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov dword [esp + 0x2c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x24]
pop edi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x49f750
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x418
push ebx
push ebp
push esi
push edi
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov cx, word [0x521af4]
mov dl, byte [0x521af6]
mov word [esp + 0x10], cx
mov byte [esp + 0x12], dl
mov cl, byte [eax]
mov esi, eax
test cl, cl
je 0x49f7ab
mov edi, dword [sym.imp.USER32.dll_CharNextA]
mov cl, byte [esp + 0x10]
test cl, cl
lea eax, [esp + 0x10]
je 0x49f7a3
cmp byte [esi], cl
je 0x49f7b8
push eax
call edi
mov cl, byte [eax]
test cl, cl
jne 0x49f792
mov cl, byte [esp + 0x10]
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x49f78a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x418
ret
push esi
call edi
mov esi, eax
test esi, esi
je 0x49f7ab
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x521ae8
push esi
call ebx
test eax, eax
je 0x49f823
push 0x521adc
push esi
call ebx
test eax, eax
je 0x49f8a7
cmp byte [esi], 0
je 0x49f7ab
mov cl, byte [esp + 0x10]
test cl, cl
lea eax, [esp + 0x10]
je 0x49f805
cmp byte [esi], cl
je 0x49f80f
push eax
call edi
mov cl, byte [eax]
test cl, cl
jne 0x49f7f4
mov cl, byte [esp + 0x10]
mov al, byte [esi + 1]
inc esi
test al, al
je 0x49f7ab
jmp 0x49f7ec
push esi
call edi
mov esi, eax
test esi, esi
jne 0x49f7c7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x418
ret
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 8]
mov dword [0x52c5f0], 0x521978
push eax
push 0x5218f8
push 0x52c580
mov dword [0x52c620], 0x52c580
mov dword [0x52c580], 0x84
mov dword [0x52c5e4], 0x300
call fcn.0049fb80
push 0
push 0
push 0
push 0x67
push 0x52c580
call fcn.0049fef0
push 0
push 1
push 0x52c580
call fcn.0049fd30
push 0
mov ecx, ebp
call fcn.0049e130
mov eax, dword [ebp + 0x6c]
mov ecx, ebp
push eax
call fcn.0049f9b0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x418
ret
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 8]
mov dword [0x52c5f0], 0x521978
push eax
push 0x5218f8
push 0x52c580
mov dword [0x52c620], 0x52c580
mov dword [0x52c580], 0x84
mov dword [0x52c5e4], 0x300
call fcn.0049fb80
push 0
push 0
push 1
push 0x67
push 0x52c580
call fcn.0049fef0
mov edx, dword [0x52c584]
lea ecx, [esp + 0x18]
push 0x104
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x11c]
push 0x104
lea ecx, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea edx, [esp + 0x220]
push 0x104
push edx
lea eax, [esp + 0x124]
push 0xffffffffffffffff
push eax
push 0
push 0
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x220]
push ecx
push edx
call dword [sym.imp.OLEAUT32.dll_LoadRegTypeLib]
test eax, eax
jl 0x49f97d
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x220]
push 0
push eax
push ecx
call dword [sym.imp.OLEAUT32.dll_QueryPathOfRegTypeLib]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x49f98b
mov edx, dword [eax]
push eax
call dword [edx + 8]
push 1
mov ecx, ebp
call fcn.0049e130
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x418
ret
Function at 0x49f9b0
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
sub esp, 0x234
push ebx
mov eax, 0x51b2b8
push ebp
mov ecx, 1
push esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], eax
push edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x248]
lea eax, [esp + 0x140]
push 0x104
xor ebx, ebx
push eax
push ecx
mov dword [esp + 0x20], 0x521b08
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], 0x521af8
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x140]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov byte [eax], bl
lea esi, [esp + 0x14]
mov dword [esp + 0x10], 2
mov edi, dword [esi]
cmp edi, ebx
je 0x49fad5
lea eax, [esp + 0x140]
lea ecx, [esp + 0x3c]
push eax
push ecx
call ebp
lea edx, [esp + 0x3c]
push edi
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
mov dword [esi + 0x10], eax
jne 0x49fa83
lea ecx, [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [esi + 0x10], eax
je 0x49fad5
mov dword [esi + 0xc], 1
mov edx, dword [esi + 4]
mov edi, dword [esi + 0x10]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x49fa97
call eax
cmp dword [esi + 0xc], ebx
je 0x49faa3
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [esi + 8], ebx
je 0x49fad5
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x49fad5
lea ecx, [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x49fad5
push 4
lea edx, [esp + 0x40]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov eax, dword [esp + 0x10]
add esi, 0x14
dec eax
mov dword [esp + 0x10], eax
jne 0x49fa33
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x234
ret 4
Function at 0x4b8980
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x30c
push ebx
push ebp
mov ebp, dword [esp + 0x318]
push esi
test ebp, ebp
push edi
je 0x4b89f5
push 0x104
lea eax, [esp + 0x14]
push ebp
push eax
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
push 6
lea ecx, [esp + 0x20]
push 0x520624
push ecx
call dword [sym.imp.MSVCRT.dll__mbsnbicmp]
add esp, 0x18
test eax, eax
jne 0x4b89f5
mov ebx, dword [sym.imp.MSVCRT.dll__mbstok]
lea edx, [esp + 0x16]
push 0x523f5c
push edx
mov esi, 1
call ebx
add esp, 8
test eax, eax
je 0x4b89f5
mov ecx, esi
inc esi
cmp ecx, 1
je 0x4b8a02
push 0x523f5c
push 0
call ebx
add esp, 8
test eax, eax
jne 0x4b89dd
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x30c
ret
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x114]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x104
mov eax, ecx
mov esi, edi
mov edi, edx
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
push 6
lea edx, [esp + 0x20]
push 0x520624
push edx
call dword [sym.imp.MSVCRT.dll__mbsnbicmp]
add esp, 0x18
test eax, eax
jne 0x4b89f5
lea eax, [esp + 0x16]
push 0x523f5c
push eax
mov esi, 1
call ebx
add esp, 8
test eax, eax
je 0x4b89f5
mov ecx, esi
inc esi
cmp ecx, 2
je 0x4b8a8d
push 0x523f5c
push 0
call ebx
add esp, 8
test eax, eax
jne 0x4b8a6a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30c
ret
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x218]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x114]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
and eax, 0xffff
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x4b89f5
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4b89f5
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x324]
push edi
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30c
ret
Function at 0x4bce20
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x4e63b2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
push edi
push 0
push 0x524464
push 6
mov edi, ecx
push 0x52445c
push 0x524458
push 1
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CFileDialog::CFileDialog
lea ecx, [esp + 0x14]
mov dword [esp + 0x218], 0
call sub.MFC42.DLL_CFileDialog::DoModal
cmp eax, 1
jne 0x4bcfef
lea eax, [esp + 4]
push ebx
push eax
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CFileDialog::GetPathName
lea ecx, [esp + 0xc]
push 4
push ecx
lea ecx, [esp + 0x10]
mov byte [esp + 0x224], 1
call sub.MFC42.DLL_CString::Right
mov eax, dword [eax]
push 0x51a340
push eax
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
lea ecx, [esp + 0xc]
test eax, eax
sete bl
call sub.MFC42.DLL_CString::CString
test bl, bl
je 0x4bcfca
push esi
push 0
lea edx, [esp + 0x18]
push 0x51a338
push edx
call fcn.00420140
add esp, 0xc
push 0x5c
lea ecx, [esp + 0x10]
mov byte [esp + 0x224], 2
call sub.MFC42.DLL_CString::ReverseFind
lea ecx, [esp + 0x10]
mov esi, eax
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esp + 0xc]
mov bl, 3
mov byte [esp + 0x220], bl
mov ecx, dword [eax - 8]
cmp esi, ecx
jge 0x4bcfa5
mov eax, ecx
lea ecx, [esp + 0xc]
sub eax, esi
dec eax
push eax
lea eax, [esp + 0x1c]
push eax
call sub.MFC42.DLL_CString::Right
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x224], 4
call fcn.004ceb40
lea ecx, [esp + 0x18]
mov byte [esp + 0x220], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::operator_1
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
push 1
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4bcfa5
push 0
push 0
push 0x52444c
mov ecx, edi
call sub.MFC42.DLL_CWnd::MessageBoxA
mov ecx, dword [esp + 0x14]
push ecx
lea ecx, [edi + 0x160]
call fcn.004bf520
test eax, eax
je 0x4bcfa5
mov edx, dword [edi + 0x180]
push eax
push 9
push 0x110b
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x10]
mov byte [esp + 0x220], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x220], 1
call sub.MFC42.DLL_CString::CString
pop esi
jmp 0x4bcfdd
push 0x30
push 0x518420
push 0x524428
mov ecx, edi
call sub.MFC42.DLL_CWnd::MessageBoxA
lea ecx, [esp + 8]
mov byte [esp + 0x21c], 0
call sub.MFC42.DLL_CString::CString
pop ebx
lea ecx, [esp + 0xc4]
mov dword [esp + 0x218], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov dword [esp + 0x218], 0xffffffff
call fcn.004ceab0
mov ecx, dword [esp + 0x210]
pop edi
mov dword fs:[0], ecx
add esp, 0x218
ret
Function at 0x4ca4a0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4e7a6b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x194
push esi
mov esi, ecx
push edi
mov ecx, 0x64
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
push eax
lea eax, [esp + 0xc]
push 0x5250c0
push eax
call fcn.00420140
mov ecx, dword [esp + 0x14]
push 0
push ecx
mov dword [esp + 0x1b8], 0
call dword [sym.imp.MSVCRT.dll__access]
add esp, 0x14
cmp eax, 0xffffffff
je 0x4ca5f7
mov edx, dword [esp + 8]
mov ecx, 0x64
xor eax, eax
lea edi, [esp + 0xc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x14]
push 0x190
push eax
push 0x5265c0
push 0x51bc90
push 0x524514
call ebx
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esi + 0x24]
call sub.MFC42.DLL_CString::operator_2
mov edx, dword [esp + 0xc]
mov ecx, 0x64
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x14]
push 0x190
push eax
push 0x5265c0
push 0x525020
push 0x524514
call ebx
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esi + 0x1c]
call sub.MFC42.DLL_CString::operator_2
mov edx, dword [esp + 0xc]
mov ecx, 0x64
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x14]
push 0x190
push eax
push 0x5265c0
push 0x52502c
push 0x524514
call ebx
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esi + 0x18]
call sub.MFC42.DLL_CString::operator_2
mov edx, dword [esp + 0xc]
mov ecx, 0x64
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x14]
push 0x190
push eax
push 0x5265c0
push 0x525018
push 0x524514
call ebx
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esi + 0x28]
call sub.MFC42.DLL_CString::operator_2
mov dword [esi + 0x2c], 1
pop ebx
lea ecx, [esp + 8]
mov dword [esp + 0x1a4], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x19c]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1a0
ret
Function at 0x5d81b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.005d8140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.005d8140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.005d8140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.005d8140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x5d8bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5d8c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x5ea87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5d8c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x5d8c52
xor eax, eax
pop esi
leave
ret 4