joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425c52
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.00494e40
push 0xffffffffffffffff
push 0x49ed4f
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x4de270]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x100c]
and dword [ebp - 0x38], 0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1010]
mov ebx, edx
push str.CINIReader::GetText___start
lea esi, [ebp - 0x34]
mov edi, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], eax
call fcn.00404db2
and dword [ebp - 4], 0
call fcn.00404e64
or dword [ebp - 4], 0xffffffff
push 0
push 1
call fcn.00404f5a
cmp dword [edi + 0x1c], 8
jb 0x425cda
mov eax, dword [edi + 8]
jmp 0x425cdd
lea eax, [edi + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x425cf2
push 0x4aec58
jmp 0x425df4
push str.CINIReader::GetText___sSection
lea esi, [ebp - 0x34]
call fcn.00404db2
mov eax, esi
push eax
mov dword [ebp - 4], 1
call fcn.00404975
or dword [ebp - 4], 0xffffffff
pop ecx
push 0
push 1
call fcn.00404f5a
push str.CINIReader::GetText___sParamName
lea esi, [ebp - 0x34]
call fcn.00404db2
mov ebx, dword [ebp - 0x14]
mov eax, esi
push eax
mov dword [ebp - 4], 2
call fcn.00404975
or dword [ebp - 4], 0xffffffff
pop ecx
push 0
push 1
call fcn.00404f5a
xor eax, eax
push 0xffe
push eax
mov word [ebp], ax
lea eax, [ebp + 2]
push eax
call fcn.004864e0
add esp, 0xc
cmp dword [edi + 0x1c], 8
jb 0x425d6c
mov edi, dword [edi + 8]
jmp 0x425d6f
add edi, 8
mov eax, ebx
cmp dword [eax + 0x18], 8
jb 0x425d7c
mov ecx, dword [eax + 4]
jmp 0x425d7f
lea ecx, [eax + 4]
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x18], 8
jb 0x425d8d
mov eax, dword [eax + 4]
jmp 0x425d90
add eax, 4
push edi
push 0x800
lea edx, [ebp]
push edx
push 0x4aec58
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push str.CINIReader::GetText___result
lea esi, [ebp - 0x54]
call fcn.00404db2
lea eax, [ebp]
push eax
lea esi, [ebp - 0x70]
mov dword [ebp - 4], 3
call fcn.00404db2
lea ecx, [ebp - 0x54]
push ecx
mov ebx, eax
mov byte [ebp - 4], 4
call fcn.00404975
pop ecx
push 0
push 1
call fcn.00404f5a
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea esi, [ebp - 0x54]
call fcn.00404f5a
lea eax, [ebp]
push eax
mov esi, dword [ebp - 0x10]
call fcn.00404db2
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.004812cc
add ebp, 0x1004
leave
ret 8
Function at 0x4260a4
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, eax
cmp byte [esi + 0x24], 0
je 0x426145
cmp dword [esi + 0x1c], 8
jb 0x4260bc
mov eax, dword [esi + 8]
jmp 0x4260bf
lea eax, [esi + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x426145
push ebx
push edi
lea edi, [esi + 0x20]
mov eax, edi
xor bl, bl
call fcn.004704fe
test al, al
je 0x42613f
push 8
pop ebx
cmp dword [esi + 0x1c], ebx
jb 0x4260e9
mov esi, dword [esi + 8]
jmp 0x4260ec
add esi, 8
mov eax, dword [esp + 0x18]
cmp dword [eax + 0x18], ebx
jb 0x4260fa
mov edx, dword [eax + 4]
jmp 0x4260fd
lea edx, [eax + 4]
mov eax, dword [esp + 0x14]
cmp dword [eax + 0x18], ebx
jb 0x42610b
mov ecx, dword [eax + 4]
jmp 0x42610e
lea ecx, [eax + 4]
mov eax, dword [esp + 0x10]
cmp dword [eax + 0x18], ebx
jb 0x42611c
mov eax, dword [eax + 4]
jmp 0x42611f
add eax, 4
push esi
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ebx, eax
mov eax, dword [edi]
dec ebx
neg ebx
sbb bl, bl
inc bl
test eax, eax
je 0x42613f
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov al, bl
pop ebx
jmp 0x426147
xor al, al
pop esi
ret 0xc
Function at 0x4265eb
Capabilities:
Check if file exists

Disassembly:
push 0x24
mov eax, 0x49dfb7
call fcn.00486a61
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
cmp byte [esi + 0x24], bl
je 0x42673c
cmp dword [esi + 0x1c], 8
jb 0x426613
mov eax, dword [esi + 8]
jmp 0x426616
lea eax, [esi + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42673c
lea eax, [esi + 0x20]
mov dword [ebp - 0x20], eax
call fcn.004704fe
test al, al
je 0x42673c
mov eax, dword [0x4e0b2c]
mov ecx, 0x4e0b2c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov edi, dword [ebp + 0x14]
mov dword [ebp - 4], ebx
mov ebx, dword [edi + 0xc]
lea esi, [ebp - 0x28]
call fcn.0042c38a
mov ebx, dword [edi + 0x10]
lea esi, [ebp - 0x30]
call fcn.0042c38a
mov edi, esi
lea esi, [ebp - 0x28]
call fcn.00406591
test al, al
je 0x426721
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
add eax, 4
add edi, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edi
jmp 0x426693
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 0x18], 8
jb 0x42669e
mov eax, dword [eax]
push dword [ebp - 0x10]
push eax
push str._s_d
lea eax, [ebp - 0x14]
call fcn.00406988
mov eax, dword [ebp + 8]
add esp, 0xc
cmp dword [eax + 0x1c], 8
jb 0x4266c0
mov ebx, dword [eax + 8]
jmp 0x4266c3
lea ebx, [eax + 8]
lea esi, [ebp - 0x28]
call fcn.0042d85c
cmp dword [eax + 0x18], 8
jb 0x4266d6
mov eax, dword [eax + 4]
jmp 0x4266d9
add eax, 4
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x18], 8
jb 0x4266e4
mov edi, dword [edi]
push ebx
push eax
lea esi, [ebp - 0x14]
call fcn.004032dc
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
inc dword [ebp - 0x10]
lea esi, [ebp - 0x28]
call fcn.00406566
mov edi, dword [ebp + 0x14]
mov ebx, dword [edi + 0x10]
lea esi, [ebp - 0x30]
call fcn.0042c38a
mov edi, esi
lea esi, [ebp - 0x28]
call fcn.00406591
test al, al
jne 0x42668d
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
test eax, eax
je 0x426731
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004049bf
call fcn.00486b39
ret 0x10
Function at 0x428290
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49dadb
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x4de270]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push esi
push edi
mov eax, dword [0x4de270]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x4282f3
xor eax, eax
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.004812cc
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
xor edi, edi
cmp ecx, edi
je 0x42831b
mov eax, dword [esi + 0x34]
mov edx, dword [eax]
add edx, ecx
cmp ecx, edx
jae 0x42831b
dec dword [eax]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 1]
mov dword [esi], ecx
mov byte [eax], bl
mov eax, ebx
jmp 0x4282d3
mov eax, dword [esi + 0x4c]
cmp eax, edi
jne 0x428327
or eax, 0xffffffff
jmp 0x4282d3
cmp dword [esi + 0x3c], edi
jne 0x42833b
push eax
push ebx
call fcn.00427097
pop ecx
pop ecx
test al, al
je 0x428322
jmp 0x428317
push edi
push 8
lea ecx, [esp + 0x4c]
mov byte [esp + 0x18], bl
call fcn.004289bc
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 0x74], edi
call fcn.00428a30
mov ecx, eax
call fcn.004290f9
mov edi, dword [esp + 0x58]
mov ebx, eax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x48]
call fcn.00428a30
mov ecx, eax
call fcn.004290f9
lea edx, [esp + 0x18]
add edi, ebx
push edx
lea ebx, [esi + 0x44]
jmp 0x42844b
cmp eax, 1
jg 0x428473
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x48]
call fcn.00428a30
mov ecx, eax
call fcn.004290f9
mov edi, dword [esp + 0x18]
sub edi, eax
je 0x4283e0
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x48]
call fcn.00428a30
mov ecx, eax
call fcn.004290f9
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004843ac
add esp, 0x10
cmp edi, eax
jne 0x42848a
lea eax, [esp + 0x10]
mov byte [esi + 0x41], 1
cmp dword [esp + 0x1c], eax
jne 0x4284a1
test edi, edi
ja 0x42840e
cmp dword [esp + 0x58], 0x20
jae 0x42848a
push 0
push 8
lea ecx, [esp + 0x4c]
call fcn.004289e2
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x48]
call fcn.00428a30
mov ecx, eax
call fcn.004290f9
mov edi, dword [esp + 0x58]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x48]
call fcn.00428a30
mov ecx, eax
call fcn.004290f9
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x24]
add edi, edx
mov ecx, dword [esi + 0x3c]
push edi
push eax
lea edx, [esp + 0x28]
push edx
lea edx, [esp + 0x21]
push edx
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x2c], eax
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
test eax, eax
jge 0x42838e
jmp 0x42848a
cmp eax, 3
jne 0x42848a
push dword [esi + 0x4c]
push dword [esp + 0x14]
call fcn.00427097
pop ecx
pop ecx
test al, al
jne 0x4284a1
or esi, 0xffffffff
push 0
push 1
lea ecx, [esp + 0x4c]
call fcn.004042f5
mov eax, esi
jmp 0x4282d3
mov esi, dword [ebp + 8]
jmp 0x42848d
Function at 0x428cf1
Capabilities:
Write file on windows

Disassembly:
push 0x4c
mov eax, 0x49dc37
call fcn.00486aca
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x3c], edi
je 0x428dfd
cmp byte [esi + 0x41], 0
je 0x428dfd
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x428d27
xor al, al
jmp 0x428dff
push edi
push 8
lea ecx, [ebp - 0x30]
call fcn.004289bc
mov dword [ebp - 4], edi
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x30]
call fcn.00428a30
mov ecx, eax
call fcn.004290f9
mov edi, dword [ebp - 0x1c]
mov ebx, eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x30]
call fcn.00428a30
mov ecx, eax
call fcn.004290f9
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x34]
push eax
add edi, ebx
push edi
push dword [ebp - 0x38]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x428d97
dec eax
je 0x428d9b
dec eax
dec eax
je 0x428df9
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.004042f5
mov al, bl
jmp 0x428dff
mov byte [esi + 0x41], 0
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x30]
call fcn.00428a30
mov ecx, eax
call fcn.004290f9
mov edi, dword [ebp - 0x34]
sub edi, eax
je 0x428ddb
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x30]
call fcn.00428a30
mov ecx, eax
call fcn.004290f9
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004843ac
add esp, 0x10
cmp edi, eax
jne 0x428d85
cmp byte [esi + 0x41], 0
je 0x428df9
test edi, edi
jne 0x428d35
push edi
push 8
lea ecx, [ebp - 0x30]
call fcn.004289e2
jmp 0x428d35
mov bl, 1
jmp 0x428d87
mov al, 1
call fcn.00486b4d
ret
Function at 0x4297b4
Capabilities:
Check if file exists

Disassembly:
push 0x38
mov eax, 0x49efda
call fcn.00486a61
push str.CFFConfig::Initialize__
lea esi, [ebp - 0x28]
call fcn.00404db2
and dword [ebp - 4], 0
call fcn.00404e64
or dword [ebp - 4], 0xffffffff
xor ebx, ebx
push 0
inc ebx
push ebx
call fcn.00404f5a
cmp dword [edi + 0x18], 0
jne 0x4297f2
xor al, al
jmp 0x429979
push str.APPDATA
lea ecx, [ebp - 0x28]
call fcn.0040b6ee
pop ecx
mov dword [ebp - 4], ebx
push 0xffffffffffffffff
lea ebx, [edi + 0x20]
push 0
mov ecx, ebx
call fcn.00404ae1
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea esi, [ebp - 0x28]
call fcn.00404f5a
push 0x4aec58
mov eax, ebx
call fcn.00404e3a
test eax, eax
je 0x4297eb
push str.MozillaFirefoxProfiles_
push ebx
call fcn.004048a5
push 0xffffffffffffffff
lea ebx, [edi + 0x3c]
push 0
lea eax, [edi + 0x20]
mov ecx, ebx
call fcn.00404ae1
push 0xffffffffffffffff
lea eax, [edi + 4]
push 0
mov ecx, ebx
call fcn.004048ce
push 0x4ad4a0
push ebx
call fcn.004048a5
push str.prefs.js
push ebx
call fcn.004048a5
push str.CFFConfig::Initialize_____FullProfilePath
lea esi, [ebp - 0x28]
call fcn.00404db2
mov eax, esi
push eax
mov dword [ebp - 4], 2
call fcn.00404975
or dword [ebp - 4], 0xffffffff
pop ecx
push 0
push 1
call fcn.00404f5a
push 0xffffffffffffffff
lea esi, [edi + 0x58]
push 0
lea eax, [edi + 0x20]
mov ecx, esi
call fcn.00404ae1
push 0xffffffffffffffff
push 0
lea eax, [edi + 4]
mov ecx, esi
call fcn.004048ce
mov esi, 0x4ad4a0
push esi
lea eax, [edi + 0x58]
push eax
call fcn.004048a5
push str.prefs.js.tmp
lea eax, [edi + 0x58]
push eax
call fcn.004048a5
push 0xffffffffffffffff
lea ecx, [edi + 0x74]
push 0
lea eax, [edi + 0x20]
call fcn.00404ae1
push 0xffffffffffffffff
push 0
lea eax, [edi + 4]
lea ecx, [edi + 0x74]
call fcn.004048ce
push esi
lea esi, [edi + 0x74]
push esi
call fcn.004048a5
push str.localstore.rdf
push esi
call fcn.004048a5
cmp dword [ebx + 0x18], 8
jb 0x429915
mov eax, dword [ebx + 4]
jmp 0x429918
lea eax, [ebx + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42994e
push str.CFFConfig::ParsePreferences___Initialize_FAILED:
lea esi, [ebp - 0x28]
call fcn.00404db2
mov eax, esi
push eax
mov dword [ebp - 4], 3
call fcn.00404975
pop ecx
push 0
push 1
call fcn.00404f5a
jmp 0x4297eb
push str.CFFConfig::ParsePreferences___Initialize_OK:
lea esi, [ebp - 0x44]
call fcn.00404db2
mov eax, esi
push eax
mov dword [ebp - 4], 4
call fcn.00404975
pop ecx
push 0
push 1
call fcn.00404f5a
mov byte [edi], 1
mov al, 1
call fcn.00486b39
ret
Function at 0x429a5f
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a269b
mov eax, dword fs:[0]
push eax
sub esp, 0x2a0
mov eax, dword [0x4de270]
xor eax, esp
mov dword [esp + 0x298], eax
push esi
mov eax, dword [0x4de270]
xor eax, esp
push eax
lea eax, [esp + 0x2a8]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push str.CFFConfig::GetNextFFProfile
lea esi, [esp + 0x18]
mov dword [esp + 0x14], eax
call fcn.00404db2
and dword [esp + 0x2b0], 0
call fcn.00404e64
or dword [esp + 0x2b0], 0xffffffff
push 0
push 1
call fcn.00404f5a
push 0x4aec58
push dword [esp + 0x14]
call fcn.00404d8d
lea eax, [esp + 0x30]
push eax
call fcn.0042997f
mov dword [esp + 0x2b4], 1
lea eax, [esp + 0x34]
mov dword [esp], 0x4b3d78
push eax
call fcn.004048a5
mov eax, dword [edi]
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x429b50
cmp dword [esp + 0x48], 8
mov eax, dword [esp + 0x34]
jae 0x429b1f
lea eax, [esp + 0x34]
lea ecx, [esp + 0x4c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [edi], eax
cmp dword [edi], 0xffffffff
je 0x429b5c
cmp word [esp + 0x78], 0x2e
je 0x429b41
test byte [esp + 0x4c], 0x10
jne 0x429b9c
lea eax, [esp + 0x4c]
push eax
push dword [edi]
call esi
test eax, eax
jne 0x429b32
jmp 0x429b5c
lea ecx, [esp + 0x4c]
push ecx
push eax
call esi
test eax, eax
jne 0x429b2d
push dword [edi]
mov byte [esp + 0x13], 0
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push 1
lea esi, [esp + 0x38]
call fcn.00404f5a
mov al, byte [esp + 0xf]
mov ecx, dword [esp + 0x2a8]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x298]
xor ecx, esp
call fcn.004812cc
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x78]
push eax
push dword [esp + 0x14]
call fcn.00404d8d
mov byte [esp + 0xf], 1
jmp 0x429b69
Function at 0x42ac61
Capabilities:
Write file on windows

Disassembly:
push 0x40
mov eax, 0x49f3cb
call fcn.00486a61
mov esi, ecx
mov edi, edx
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [edi + 0x70], 8
jb 0x42ac85
mov eax, dword [edi + 0x5c]
jmp 0x42ac88
lea eax, [edi + 0x5c]
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x14], edi
cmp edi, 0xffffffff
jne 0x42acd5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.CFFConfig::ReWritePrefFile___CreateFile_failed._GetLastError
lea esi, [ebp - 0x30]
mov edi, eax
call fcn.00404db2
push edi
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.00408b56
pop ecx
push ebx
push 1
call fcn.00404f5a
xor al, al
call fcn.00486b39
ret
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [esi + 0x18], 0x10
mov ecx, dword [esi + 0x14]
mov dword [ebp - 0x10], ebx
jb 0x42aced
mov eax, dword [esi + 4]
jmp 0x42acf0
lea eax, [esi + 4]
push ebx
lea edx, [ebp - 0x10]
push edx
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42ad3c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.CFFConfig::ReWritePrefFile___WriteFile_failed._GetLastError
lea esi, [ebp - 0x30]
mov edi, eax
call fcn.00404db2
xor esi, esi
inc esi
push edi
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], esi
call fcn.00408b56
pop ecx
push ebx
push esi
lea esi, [ebp - 0x30]
call fcn.00404f5a
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42accd
mov esi, dword [esi + 0x14]
cmp dword [ebp - 0x10], esi
jae 0x42ad79
push str.CFFConfig::ReWritePrefFile_____WriteFile_failed._size_written_too_small
lea esi, [ebp - 0x4c]
call fcn.00404db2
mov dword [ebp - 4], 2
push dword [ebp - 0x10]
mov ecx, esi
call fcn.00408b56
pop ecx
push ebx
push 1
call fcn.00404f5a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
jmp 0x42accf
mov bl, 1
jmp 0x42ad6b
Function at 0x42ca34
Capabilities:
Parse credit card information

Disassembly:
push ecx
mov ecx, dword [esi + 0x40]
push ebx
xor al, al
push edi
mov bl, 1
cmp ecx, 0xffffffff
je 0x42cbca
mov edi, 0x10000000
cmp ecx, 0x7c
je 0x42cbca
cmp ecx, 0x29
jne 0x42ca76
cmp dword [esi + 0x10], 0
jne 0x42cbca
test dword [esi + 0x44], edi
jne 0x42ca76
push 5
call fcn.00480e5a
pop ecx
jmp 0x42cbb3
cmp ecx, 0x2e
jne 0x42ca92
push 5
lea eax, [esi + 0x18]
push eax
call fcn.0042ccad
mov eax, esi
call fcn.0042ca0c
jmp 0x42cbb3
cmp ecx, 0x5c
jne 0x42caf1
mov eax, esi
call fcn.0042ca0c
mov eax, dword [esi + 0x44]
and eax, 0x80
je 0x42cac5
cmp byte [esi + 0x3e], 0x62
jne 0x42cac5
push 4
lea eax, [esi + 0x18]
push eax
call fcn.0042ccad
mov eax, esi
call fcn.0042ca0c
jmp 0x42cbba
test eax, eax
je 0x42cae5
cmp byte [esi + 0x3e], 0x42
jne 0x42cae5
push 4
lea eax, [esi + 0x18]
push eax
call fcn.0042ccad
mov eax, dword [esi + 0x1c]
add eax, 8
or dword [eax], 1
jmp 0x42cab9
mov eax, esi
call fcn.0042d48d
jmp 0x42cbb3
cmp ecx, 0x5b
jne 0x42cb1b
mov eax, esi
call fcn.0042ca0c
mov eax, esi
call fcn.0042d442
cmp dword [esi + 0x40], 0x5d
je 0x42ca86
push 4
call fcn.00480e5a
pop ecx
jmp 0x42ca86
cmp ecx, 0x28
jne 0x42cb47
mov eax, esi
call fcn.0042ca0c
mov eax, esi
call fcn.0042d559
cmp dword [esi + 0x40], 0x29
mov bl, al
je 0x42cb3e
push 5
call fcn.00480e5a
pop ecx
mov eax, esi
call fcn.0042ca0c
jmp 0x42cbaf
cmp ecx, 0x5e
jne 0x42cb53
push 2
jmp 0x42cab0
cmp ecx, 0x24
jne 0x42cb5f
push 3
jmp 0x42cab0
cmp ecx, 0x2a
je 0x42cba7
cmp ecx, 0x2b
je 0x42cba7
cmp ecx, 0x3f
je 0x42cba7
cmp ecx, 0x7b
je 0x42cba7
cmp ecx, 0x7d
jne 0x42cb84
test dword [esi + 0x44], edi
jne 0x42cb84
push 6
jmp 0x42ca6b
cmp ecx, 0x5d
jne 0x42cb95
test dword [esi + 0x44], edi
jne 0x42cb95
push 4
jmp 0x42ca6b
movzx eax, byte [esi + 0x3e]
push eax
lea eax, [esi + 0x18]
call fcn.0042d6ef
jmp 0x42ca86
push 0xa
call fcn.00480e5a
pop ecx
test bl, bl
je 0x42cbba
mov eax, esi
call fcn.0042d627
mov ecx, dword [esi + 0x40]
mov al, 1
mov bl, al
cmp ecx, 0xffffffff
jne 0x42ca4c
pop edi
pop ebx
pop ecx
ret

Function at 0x432da6
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp dword [esp + 4], eax
jle 0x432dcf
push esi
movzx edx, byte [ecx]
movzx edx, byte [edx + 0x4c3228]
mov esi, eax
shl esi, 3
xor edx, esi
xor eax, edx
inc ecx
dec dword [esp + 8]
cmp dword [esp + 8], 0
jg 0x432daf
pop esi
ret
Function at 0x4333b4
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x20]
push esi
push edi
test eax, eax
je 0x4333f4
cdq
mov esi, eax
add eax, dword [ebp + 0xc]
mov edi, edx
mov ecx, edx
adc ecx, dword [ebp + 0x10]
push edi
sub eax, 1
push esi
sbb ecx, 0
push ecx
push eax
call fcn.0048f6e0
push edi
push esi
push edx
push eax
call fcn.004945a0
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], edx
push dword [ebp + 0x10]
mov edi, ebx
push dword [ebp + 0xc]
call fcn.00433255
pop ecx
pop ecx
test eax, eax
jne 0x43341d
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x433424
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0x10], eax
mov dword [ebp - 4], 0x60a
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433450
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp + 8]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x433480
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x433480
mov dword [esi + 0x10], eax
mov eax, 0x70a
jmp 0x4334a0
push 1
push 0
push 0
push dword [ebp + 8]
call fcn.004945a0
mov ecx, eax
xor eax, eax
add ecx, edi
adc edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x433e8c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x4de270]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4e1e14]
push ebx
push esi
test eax, eax
je 0x433ec6
push eax
push 0x4c81ec
lea eax, [ebp - 0x110]
push eax
push 0xe6
call fcn.00431aa5
add esp, 0x10
jmp 0x433f3e
call fcn.0043306c
mov esi, 0xe6
test eax, eax
je 0x433f06
lea eax, [ebp - 0x318]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x318]
push eax
call fcn.00433119
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x433f22
push 7
pop eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004812cc
leave
ret
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x218]
push eax
call fcn.004331da
jmp 0x433eee
push ebx
push 0x4c81ec
lea eax, [ebp - 0x110]
push eax
push esi
call fcn.00431aa5
push ebx
call fcn.00482ae9
add esp, 0x14
mov ecx, str.etilqs_
call fcn.00432249
lea ecx, [ebp - 0x110]
mov edx, eax
call fcn.00432249
lea eax, [edx + eax + 0x11]
cmp eax, 0x105
jl 0x433f65
xor eax, eax
inc eax
jmp 0x433ef8
lea ecx, [ebp - 0x110]
call fcn.00432249
test eax, eax
jbe 0x433f7e
dec ecx
cmp byte [ecx + eax], 0x5c
jne 0x433f7e
dec eax
jne 0x433f75
mov byte [ebp + eax - 0x110], 0
lea eax, [ebp - 0x110]
push eax
push str._setilqs_
push edi
push 0xf4
call fcn.00431aa5
mov ecx, edi
call fcn.00432249
mov esi, eax
lea eax, [edi + esi]
push eax
push 0xf
call fcn.00431ca4
add esp, 0x18
push 0xf
pop ecx
movzx eax, byte [edi + esi]
xor edx, edx
push 0x3e
pop ebx
div ebx
mov al, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi], al
inc esi
dec ecx
jne 0x433fb7
mov byte [edi + esi], cl
xor eax, eax
jmp 0x433ef8

Function at 0x43425d
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebx
push ebp
push edi
push dword [esp + 0x14]
xor ebp, ebp
xor ebx, ebx
call fcn.00433e55
mov edi, eax
pop ecx
test edi, edi
jne 0x43427c
push 7
pop eax
jmp 0x434305
push esi
call fcn.0043306c
test eax, eax
je 0x4342b8
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4342a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 5
jne 0x4342ea
inc ebp
cmp ebp, 5
jge 0x4342ea
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x434286
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4342da
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 5
jne 0x4342ea
inc ebp
cmp ebp, 5
jge 0x4342ea
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4342b8
push edi
call fcn.00482ae9
pop ecx
cmp esi, 0xffffffff
pop esi
jne 0x434300
cmp ebx, 2
jne 0x434300
xor eax, eax
jmp 0x434305
mov eax, 0xa0a
pop edi
pop ebp
pop ebx
ret