joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411720
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xe9c
mov eax, dword [0x435028]
xor eax, esp
mov dword [esp + 0xe98], eax
push ebx
mov ebx, dword [sym.imp.MSVCR80.dll_wcscpy_s]
push esi
push edi
push 0x4298b0
lea eax, [esp + 0x2a]
push 0x14
push eax
mov esi, ecx
call ebx
add esp, 0xc
mov edi, 0x200
lea ecx, [esp + 0xaa0]
call fcn.004107e0
lea ecx, [esi + 0xe38]
xor edi, edi
push edi
mov dword [esp + 0x20], ecx
call sub.MFC80U.DLL_Ordinal_2155
lea ecx, [esi + 0x15a8]
push edi
mov dword [esp + 0x1c], ecx
call sub.MFC80U.DLL_Ordinal_2155
lea ecx, [esi + 0x1d18]
push edi
mov dword [esp + 0x18], ecx
call sub.MFC80U.DLL_Ordinal_2155
mov ecx, dword [esi + 0xd60]
push edi
push edi
push 0x1009
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x3fe
lea edx, [esp + 0x2a6]
push edi
push edx
mov word [esp + 0x2ac], di
call sub.MSVCR80.dll_memset
push 0x3fe
lea eax, [esp + 0x6b2]
push edi
push eax
mov word [esp + 0x6b8], di
call sub.MSVCR80.dll_memset
lea ecx, [esp + 0xab8]
push ecx
lea edx, [esp + 0x2bc]
push 0x200
push edx
mov dword [esp + 0x34], 1
call ebx
push str..qua
lea eax, [esp + 0x2c8]
push 0x200
push eax
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0x30
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x2a4]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x20], ebx
je 0x4118eb
nop
cmp dword [esp + 0x10], 0
je 0x4118eb
lea eax, [esp + 0xaa0]
push eax
lea ecx, [esp + 0x2a4]
push 0x200
push ecx
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
lea edx, [esp + 0x88]
push edx
lea eax, [esp + 0x2b0]
push 0x200
push eax
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0x18
lea ecx, [esp + 0x6a0]
push ecx
lea edx, [esp + 0x2a4]
push edx
call fcn.00410a60
test al, al
je 0x4118d6
push 0
push 0
push 0
push 0
lea eax, [esp + 0x6b0]
push eax
push edi
lea ebx, [esi + 0xd40]
push 3
mov ecx, ebx
call sub.MFC80U.DLL_Ordinal_3873
lea ecx, [esp + 0x2a0]
push ecx
push 1
push edi
mov ecx, ebx
call sub.MFC80U.DLL_Ordinal_5869
mov ebx, dword [esp + 0x20]
add edi, 1
lea edx, [esp + 0x50]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [esp + 0x10], eax
jmp 0x411840
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x1c]
push 1
call sub.MFC80U.DLL_Ordinal_2155
mov ecx, dword [esp + 0x18]
push 1
call sub.MFC80U.DLL_Ordinal_2155
mov ecx, dword [esp + 0x14]
push 1
call sub.MFC80U.DLL_Ordinal_2155
mov ecx, dword [esp + 0xea4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00422de8
mov esp, ebp
pop ebp
ret
Function at 0x411dd0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x430
mov eax, dword [0x435028]
xor eax, esp
mov dword [esp + 0x42c], eax
push esi
push edi
mov edi, edx
push 0
mov esi, ecx
mov dword [esp + 0xc], edi
call dword [sym.imp.MSVCP80.dll_public:_wchar_t____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator___unsigned_int_]
cmp word [eax], 0
jne 0x411e22
push 0x429b48
mov ecx, edi
call dword [0x4276d8]
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x42c]
xor ecx, esp
call fcn.00422de8
add esp, 0x430
ret
mov edi, dword [str.none]
push ebx
mov ebx, dword [0x4279f4]
push ebp
mov bp, word [0x4279f8]
push 0x3f6
lea eax, [esp + 0x4a]
push 0
push eax
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], ebx
mov word [esp + 0x50], bp
call sub.MSVCR80.dll_memset
xor eax, eax
add esp, 0xc
cmp dword [esi + 0x18], 8
mov word [esp + 0x1c], bp
pop ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov word [esp + 0x36], ax
pop ebx
jb 0x411e95
mov esi, dword [esi + 4]
jmp 0x411e98
add esi, 4
push esi
push 0x200
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x18]
push edx
push str.CurrentVersion
push str.VersionInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esp + 0xc]
lea eax, [esp + 0x34]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x411ee6
test dx, dx
je 0x411ee2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x411ee6
add eax, 4
add ecx, 4
test dx, dx
jne 0x411ec0
xor eax, eax
jmp 0x411eeb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
mov ecx, dword [esp + 8]
jne 0x411f17
push 0x429b48
call dword [0x4276d8]
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x42c]
xor ecx, esp
call fcn.00422de8
add esp, 0x430
ret
lea eax, [esp + 0x34]
push eax
call dword [0x4276d8]
mov ecx, dword [esp + 0x434]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.00422de8
add esp, 0x430
ret
Function at 0x411f40
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x42c
mov eax, dword [0x435028]
xor eax, esp
mov dword [esp + 0x428], eax
push esi
push 0
mov esi, ecx
call dword [sym.imp.MSVCP80.dll_public:_wchar_t____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator___unsigned_int_]
cmp word [eax], 0
jne 0x411f7d
xor al, al
pop esi
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.00422de8
add esp, 0x42c
ret
mov ecx, dword [str.none]
mov edx, dword [0x4279f4]
xor eax, eax
push edi
mov di, word [0x4279f8]
push 0x3f6
push eax
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov word [esp + 0x36], ax
lea eax, [esp + 0x42]
push eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov word [esp + 0x1c], di
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
mov word [esp + 0x44], di
call sub.MSVCR80.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 8
pop edi
jb 0x411fed
mov esi, dword [esi + 4]
jmp 0x411ff0
add esi, 4
push esi
push 0x200
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x10]
push edx
push str.Type
push str.AppType
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [str.business]
mov ecx, dword [0x429bb0]
mov edx, dword [0x429bb4]
mov dword [esp + 4], eax
mov eax, dword [0x429bb8]
mov dword [esp + 8], ecx
mov cx, word [0x429bbc]
mov dword [esp + 0x10], eax
xor eax, eax
mov word [esp + 0x14], cx
mov dword [esp + 0x16], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov word [esp + 0x2a], ax
mov dword [esp + 0xc], edx
lea ecx, [esp + 4]
lea eax, [esp + 0x2c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41208b
test dx, dx
je 0x412087
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41208b
add eax, 4
add ecx, 4
test dx, dx
jne 0x412065
xor eax, eax
jmp 0x412090
sbb eax, eax
sbb eax, 0xffffffff
mov ecx, dword [esp + 0x42c]
test eax, eax
sete al
pop esi
xor ecx, esp
call fcn.00422de8
add esp, 0x42c
ret
Function at 0x412710
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x42c
mov eax, dword [0x435028]
xor eax, esp
mov dword [esp + 0x428], eax
push esi
push 0
mov esi, ecx
call dword [sym.imp.MSVCP80.dll_public:_wchar_t____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator___unsigned_int_]
cmp word [eax], 0
je 0x412828
mov ecx, dword [str.none]
mov edx, dword [0x4279f4]
xor eax, eax
push edi
mov di, word [0x4279f8]
push 0x3f6
push eax
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov word [esp + 0x36], ax
lea eax, [esp + 0x42]
push eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov word [esp + 0x1c], di
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
mov word [esp + 0x44], di
call sub.MSVCR80.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 8
pop edi
jb 0x4127a9
mov esi, dword [esi + 4]
jmp 0x4127ac
add esi, 4
push esi
push 0x200
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x10]
push edx
push str.DonwloadLink
push str.GoodSecure
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esp + 4]
lea eax, [esp + 0x2c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4127fa
test dx, dx
je 0x4127f6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4127fa
add eax, 4
add ecx, 4
test dx, dx
jne 0x4127d4
xor eax, eax
jmp 0x4127ff
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x412828
lea eax, [esp + 0x2c]
push eax
mov ecx, ebx
call dword [0x4276d8]
mov al, 1
pop esi
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.00422de8
add esp, 0x42c
ret
push 0x427d0c
mov ecx, ebx
call dword [0x4276d8]
mov ecx, dword [esp + 0x42c]
pop esi
xor ecx, esp
xor al, al
call fcn.00422de8
add esp, 0x42c
ret
Function at 0x412850
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x430
mov eax, dword [0x435028]
xor eax, esp
mov dword [esp + 0x42c], eax
push ebp
mov ebp, dword [esp + 0x438]
push esi
push edi
mov edi, edx
push 0
mov esi, ecx
mov dword [esp + 0x10], edi
call dword [sym.imp.MSVCP80.dll_public:_wchar_t____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator___unsigned_int_]
cmp word [eax], 0
je 0x412972
test ebx, ebx
je 0x412972
test ebp, ebp
je 0x412972
mov ecx, dword [str.none]
mov edx, dword [0x4279f4]
mov di, word [0x4279f8]
xor eax, eax
push 0x3f6
push eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov dword [esp + 0x3a], eax
mov word [esp + 0x3e], ax
lea eax, [esp + 0x4a]
push eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov word [esp + 0x24], di
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], edx
mov word [esp + 0x4c], di
call sub.MSVCR80.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 8
jb 0x412906
mov esi, dword [esi + 4]
jmp 0x412909
add esi, 4
push esi
push 0x200
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x1c]
push edx
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esp + 0x10]
lea eax, [esp + 0x38]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x412956
test dx, dx
je 0x412952
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x412956
add eax, 4
add ecx, 4
test dx, dx
jne 0x412930
xor eax, eax
jmp 0x41295b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
mov ecx, dword [esp + 0xc]
je 0x412974
lea eax, [esp + 0x38]
push eax
call dword [0x4276d8]
mov al, 1
jmp 0x412981
mov ecx, edi
push 0x427d0c
call dword [0x4276d8]
xor al, al
mov ecx, dword [esp + 0x438]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00422de8
add esp, 0x430
ret 4
Function at 0x4129a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x425129
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x435028]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
mov eax, dword [0x435028]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push 0x427d0c
lea ecx, [esp + 0xc]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
push str.NotifyPerVersion
lea edx, [esp + 0xc]
mov ebx, str.GoodSecure
mov ecx, esi
mov dword [esp + 0x34], 0
call fcn.00412850
push 0x429c54
lea ecx, [esp + 0xc]
call dword [sym.imp.MSVCP80.dll_public:_int___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::compare_wchar_t_const__const]
test eax, eax
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 8]
jne 0x412a24
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov al, 1
jmp 0x412a2c
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00422de8
add esp, 0x2c
ret
Function at 0x4130d0
Capabilities:
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x426006
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x435028]
xor eax, esp
mov dword [esp + 0x238], eax
push ebx
push ebp
push esi
mov eax, dword [0x435028]
xor eax, esp
push eax
lea eax, [esp + 0x24c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x25c]
push 0xa
lea ecx, [esp + 0x14]
xor ebx, ebx
xor esi, esi
call sub.MFC80U.DLL_Ordinal_558
push 0xa
lea ecx, [esp + 0x30]
mov dword [esp + 0x258], ebx
call sub.MFC80U.DLL_Ordinal_558
push ebx
lea eax, [esp + 0x4c]
push eax
push 0x100
push ebx
push edi
push ebx
mov byte [esp + 0x26c], 1
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x41317d
lea ecx, [esp + 0x2c]
mov byte [esp + 0x254], bl
call sub.MFC80U.DLL_Ordinal_746
lea ecx, [esp + 0x10]
mov dword [esp + 0x254], 0xffffffff
call sub.MFC80U.DLL_Ordinal_746
xor eax, eax
jmp 0x413257
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x413152
lea ecx, [esp + 0x10]
push ecx
mov ebx, edi
mov ecx, str.open
call fcn.00413410
test al, al
je 0x4131a2
mov esi, 1
lea edx, [esp + 0x10]
push edx
mov ebx, edi
mov ecx, str.shellexecute
call fcn.00413410
test al, al
je 0x4131ba
add esi, 1
lea eax, [esp + 0x10]
push eax
mov ebx, edi
mov ecx, str.shell
call fcn.00413410
test al, al
je 0x4131d2
add esi, 1
lea ecx, [esp + 0x10]
push ecx
mov ebx, edi
mov ecx, str.shellopencommand
call fcn.00413410
test al, al
je 0x4131ea
add esi, 1
lea edx, [esp + 0x10]
push edx
mov ebx, edi
mov ecx, str.shellexplorecommand
call fcn.00413410
test al, al
je 0x413202
add esi, 1
lea eax, [esp + 0x10]
push eax
mov ebx, edi
mov ecx, str.shell_autoplaycommand
call fcn.00413410
test al, al
je 0x41321a
add esi, 1
lea ecx, [esp + 0x10]
lea ebx, [esp + 0x2c]
call fcn.00413690
mov ecx, ebx
mov ebx, ebp
call fcn.00413690
lea ecx, [esp + 0x2c]
mov byte [esp + 0x254], 0
call sub.MFC80U.DLL_Ordinal_746
lea ecx, [esp + 0x10]
mov dword [esp + 0x254], 0xffffffff
call sub.MFC80U.DLL_Ordinal_746
mov eax, esi
mov ecx, dword [esp + 0x24c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x238]
xor ecx, esp
call fcn.00422de8
add esp, 0x248
ret 4
Function at 0x413280
Capabilities:
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4250ec
mov eax, dword fs:[0]
push eax
sub esp, 0x808
mov eax, dword [0x435028]
xor eax, esp
mov dword [esp + 0x804], eax
push esi
mov eax, dword [0x435028]
xor eax, esp
push eax
lea eax, [esp + 0x810]
mov dword fs:[0], eax
cmp word [edi], 0x5c
mov ax, word [esp + 0x820]
mov word [esp + 0xc], ax
mov word [esp + 0xe], 0x3a
mov word [esp + 0x10], 0
jne 0x4132ef
push edi
lea ecx, [esp + 0x10]
push 0x200
push ecx
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
jmp 0x413316
mov esi, dword [sym.imp.MSVCR80.dll_wcscat_s]
push 0x427a08
lea edx, [esp + 0x10]
push 0x200
push edx
call esi
push edi
lea eax, [esp + 0x1c]
push 0x200
push eax
call esi
add esp, 0x18
lea eax, [esp + 0xc]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x413320
sub eax, edx
lea ecx, [esp + 0xc]
sar eax, 1
push ecx
lea ecx, [esp + 0xc]
mov esi, eax
call dword [sym.imp.MFC80U.DLL_Ordinal_283]
push 0x2e
lea ecx, [esp + 0xc]
mov dword [esp + 0x81c], 0
call dword [sym.imp.MFC80U.DLL_Ordinal_5524]
test eax, eax
jle 0x41337b
cmp eax, esi
jge 0x41337b
mov ecx, 0x20
cmp word [esp + eax*2 + 0xc], cx
je 0x413374
add eax, 1
cmp eax, esi
jl 0x413364
jmp 0x41337b
mov word [esp + eax*2 + 0xc], 0
push 0
lea edx, [esp + 0x410]
push edx
push 0x200
push 0
lea eax, [esp + 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
je 0x4133db
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x4133db
lea ecx, [esp + 0xc]
call fcn.0040e070
test eax, eax
je 0x4133db
lea edx, [esp + 0xc]
push edx
push 0x200
push edi
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0xc
lea ecx, [esp + 8]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov al, 1
jmp 0x4133e7
lea ecx, [esp + 8]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
xor al, al
mov ecx, dword [esp + 0x810]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.00422de8
add esp, 0x814
ret 4
Function at 0x413410
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x425fbc
mov eax, dword fs:[0]
push eax
sub esp, 0x608
mov eax, dword [0x435028]
xor eax, esp
mov dword [esp + 0x604], eax
push ebp
push esi
push edi
mov eax, dword [0x435028]
xor eax, esp
push eax
lea eax, [esp + 0x618]
mov dword fs:[0], eax
mov eax, dword [str.none]
mov dx, word [0x4279f8]
mov ebp, dword [esp + 0x628]
mov esi, ecx
mov ecx, dword [0x4279f4]
mov dword [esp + 0x18], ecx
push str.shell
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], eax
mov word [esp + 0x20], dx
call dword [sym.imp.MFC80U.DLL_Ordinal_283]
push esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x624], 0
call dword [sym.imp.MFC80U.DLL_Ordinal_1476]
test eax, eax
push ebx
je 0x413536
push 0x200
lea eax, [esp + 0x21c]
push eax
lea ecx, [esp + 0x20]
push ecx
push esi
push 0x429ed0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esp + 0x14]
lea eax, [esp + 0x214]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4134f6
test dx, dx
je 0x4134f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4134f6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4134d0
xor eax, eax
jmp 0x4134fb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41365b
movzx edx, word [ebx]
push edx
lea edi, [esp + 0x218]
call fcn.00413280
test al, al
je 0x41365b
mov eax, edi
push eax
mov ecx, ebp
call sub.MFC80U.DLL_Ordinal_1003
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov al, 1
jmp 0x413667
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x64
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x20]
push edx
push str.shell
push 0x429ed0
call edi
lea ecx, [esp + 0x14]
lea eax, [esp + 0x20]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x413586
test dx, dx
je 0x413582
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x413586
add eax, 4
add ecx, 4
test dx, dx
jne 0x413560
xor eax, eax
jmp 0x41358b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41365b
push str.shell_
lea eax, [esp + 0xec]
push 0x96
push eax
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
mov esi, dword [sym.imp.MSVCR80.dll_wcscat_s]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0xf8]
push 0x96
push edx
call esi
push str.command
lea eax, [esp + 0x104]
push 0x96
push eax
call esi
add esp, 0x24
push ebx
push 0x200
lea ecx, [esp + 0x21c]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0xf8]
push eax
push 0x429ed0
call edi
lea ecx, [esp + 0x14]
lea eax, [esp + 0x214]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x413636
test dx, dx
je 0x413632
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x413636
add eax, 4
add ecx, 4
test dx, dx
jne 0x413610
xor eax, eax
jmp 0x41363b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41365b
movzx ecx, word [ebx]
push ecx
lea edi, [esp + 0x218]
call fcn.00413280
test al, al
je 0x41365b
mov edx, edi
push edx
jmp 0x41351e
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
xor al, al
mov ecx, dword [esp + 0x618]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x604]
xor ecx, esp
call fcn.00422de8
add esp, 0x614
ret 4
Function at 0x413a50
Capabilities:
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x42507c
mov eax, dword fs:[0]
push eax
sub esp, 0x208
mov eax, dword [0x435028]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
push ebp
push esi
mov eax, dword [0x435028]
xor eax, esp
push eax
lea eax, [esp + 0x218]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x228]
mov esi, ecx
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC80U.DLL_Ordinal_293]
mov dword [esp + 0x220], 0
call fcn.0040ecd0
test al, al
jne 0x413ac2
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov al, 1
jmp 0x413b4b
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x80
push esi
call ebx
push 0
lea eax, [esp + 0x18]
push eax
push 0x100
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
je 0x413b2c
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x413b1d
push edi
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC80U.DLL_Ordinal_776]
push ebp
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC80U.DLL_Ordinal_899]
mov ecx, dword [esp + 0x10]
push ecx
push edi
call dword [sym.imp.MSVCR80.dll__wrename]
add esp, 8
jmp 0x413b2c
push 0x80
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
push esi
call dword [sym.imp.MSVCR80.dll__wrename]
add esp, 8
test eax, eax
lea ecx, [esp + 0x10]
je 0x413ab5
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
xor al, al
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.00422de8
add esp, 0x214
ret 4
Function at 0x417050
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x210
mov eax, dword [0x435028]
xor eax, esp
mov dword [esp + 0x20c], eax
cmp byte [0x435a01], 0
jne 0x41708f
push 0
lea ecx, [edi + 0x2060]
call sub.MFC80U.DLL_Ordinal_2155
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00422de8
add esp, 0x210
ret
mov eax, dword [str.none]
mov ecx, dword [0x4279f4]
mov dx, word [0x4279f8]
push esi
lea esi, [edi + 0x2c60]
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov word [esp + 0xc], dx
call fcn.0040ecd0
test al, al
je 0x417140
push esi
push 0x100
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [edi + 0x2b34]
push edx
lea eax, [edi + 0x2ad0]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [edi + 0x2bfc]
lea eax, [esp + 0x10]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x417116
test dx, dx
je 0x417112
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x417116
add eax, 4
add ecx, 4
test dx, dx
jne 0x4170f0
xor eax, eax
jmp 0x41711b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
push 0
jne 0x417130
mov ecx, dword [edi + 0x2080]
push eax
push 0xf1
push ecx
jmp 0x417150
mov edx, dword [edi + 0x2080]
push 1
push 0xf1
push edx
jmp 0x417150
mov eax, dword [edi + 0x2080]
push 0
push 1
push 0xf1
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x210]
pop esi
xor ecx, esp
call fcn.00422de8
add esp, 0x210
ret
Function at 0x4191f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc10
mov eax, dword [0x435028]
xor eax, esp
mov dword [esp + 0xc0c], eax
push ebx
push ebp
mov ebp, dword [esp + 0xc1c]
push 0x3fe
lea eax, [esp + 0x1a]
push 0
push eax
mov ebx, ecx
mov word [esp + 0x20], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
cmp ebx, 0x80000001
jne 0x41923a
push ebp
push str.HKEY_CURRENT_USER_s
jmp 0x419248
cmp ebx, 0x80000002
jne 0x419254
push ebp
push str.HKEY_LOCAL_MACHINE_s
lea edx, [esp + 0x1c]
call fcn.00419880
add esp, 8
lea ecx, [esp + 8]
push ecx
push 0x20019
push 0
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x419273
xor eax, eax
jmp 0x419336
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor ebx, ebx
jmp 0x419280
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x818]
push eax
mov eax, dword [esp + 0x10]
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x428]
push edx
push ebx
push eax
mov dword [esp + 0x2c], 0x200
mov dword [esp + 0x30], 0x400
call ebp
test eax, eax
jne 0x419326
add ebx, 1
cmp word [esp + 0x414], ax
je 0x419280
cmp word [esp + 0x814], ax
je 0x419280
mov edx, dword [esi + 0x6a0]
push eax
push eax
push eax
push eax
lea ecx, [esp + 0x424]
push ecx
push edx
push 3
mov ecx, edi
call sub.MFC80U.DLL_Ordinal_3873
mov ecx, dword [esi + 0x6a0]
lea eax, [esp + 0x814]
push eax
push 1
push ecx
mov ecx, edi
call sub.MFC80U.DLL_Ordinal_5869
mov eax, dword [esi + 0x6a0]
lea edx, [esp + 0x14]
push edx
push 2
push eax
mov ecx, edi
call sub.MFC80U.DLL_Ordinal_5869
add dword [esi + 0x6a0], 1
jmp 0x419280
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [esp + 0xc14]
pop ebp
pop ebx
xor ecx, esp
call fcn.00422de8
add esp, 0xc10
ret 4