joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427ab0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x24
push ebp
push esi
test ecx, ecx
je 0x427abe
lea ebp, [ecx - 0x50]
jmp 0x427ac0
xor ebp, ebp
cmp dword [esp + 0x3c], 0
mov ecx, dword [ebp + 4]
je 0x427b47
mov eax, dword [esp + 0x30]
push ebx
push edi
push eax
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [esp + 0x3c]
mov edi, eax
push edi
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.0041b800
test eax, eax
je 0x427b3b
mov edx, dword [esi]
mov dword [edx - 8], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + edi*2], cx
mov eax, dword [esi]
test eax, eax
je 0x427b3b
lea edx, [edi + 1]
push edx
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, esi
mov dword [esp + 0x10], eax
call fcn.0041b900
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esi]
mov dword [ecx - 8], eax
mov edx, dword [esi]
xor ecx, ecx
mov word [edx + eax*2], cx
cmp dword [esp + 0x10], edi
pop edi
pop ebx
jge 0x427b96
xor esi, esi
jmp 0x427b60
mov edx, dword [esp + 0x34]
mov eax, dword [edx]
push eax
mov eax, dword [esp + 0x34]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov esi, eax
test esi, esi
jne 0x427b8c
push 0xffffffffffffffff
add ebp, 0x50
call dword [sym.imp.USER32.dll_MessageBeep]
test ebp, ebp
je 0x427b74
lea eax, [ebp - 0x50]
jmp 0x427b76
xor eax, eax
mov edx, dword [esp + 0x30]
mov eax, dword [eax + 4]
push edx
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, esi
pop esi
pop ebp
add esp, 0x24
ret 0x18
cmp dword [esp + 0x40], 0
je 0x427bc9
mov ecx, dword [esi]
mov edx, dword [ecx - 8]
cmp edx, dword [esp + 0x44]
jle 0x427bc9
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x30]
lea eax, [esp + 0xc]
push eax
push ecx
push edx
lea ecx, [ebp + 0x50]
call fcn.004270c0
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret 0x18
pop esi
mov eax, 1
pop ebp
add esp, 0x24
ret 0x18
Function at 0x428430
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x481b48
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4a60f8]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov eax, dword [0x4a60f8]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov eax, dword [0x49536c]
mov dx, word [esp + 0x3c]
mov esi, ecx
mov ecx, dword [0x495370]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], eax
mov ecx, esi
mov word [esp + 0x20], dx
call fcn.0043b2c0
test eax, eax
je 0x428620
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, esi
cmp eax, 3
je 0x428624
call fcn.0043b090
mov edi, eax
test edi, edi
je 0x428543
cmp dword [esp + 0x40], 0
jne 0x428543
push 0x96
lea ecx, [esp + 0x20]
call fcn.0041c430
mov ebx, eax
push 0x9f
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0
call fcn.0041c430
mov ebx, dword [ebx]
mov eax, dword [eax]
mov ecx, dword [esi + 4]
push 1
push 0x30
push ebx
push eax
push ecx
mov ecx, edi
mov byte [esp + 0x48], 1
call fcn.00440a60
lea ecx, [esp + 0x10]
call fcn.0041b2e0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xffffffff
call fcn.0041b2e0
mov ecx, edi
call fcn.00423f00
mov ecx, eax
call fcn.00423f00
cmp dword [eax], 0
je 0x428620
mov ecx, dword [esi + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20]
push 0xffffffffffffffff
call eax
xor eax, eax
jmp 0x42862f
push 0x9f
lea ecx, [esp + 0x14]
call fcn.0041c430
mov eax, dword [eax]
add esi, 0x58
push eax
mov ecx, esi
mov dword [esp + 0x38], 2
call fcn.0041be90
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
mov dword [esp + 0x34], 0xffffffff
cmp ecx, dword [0x4a4010]
je 0x42859d
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x42859d
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.00462471
add esp, 4
push 0xe2
lea ecx, [esp + 0x18]
call fcn.0041c430
mov eax, dword [eax]
push esi
push eax
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x40], 3
call fcn.0041d460
push eax
mov ecx, esi
mov byte [esp + 0x38], 4
call fcn.0041be30
mov eax, dword [esp + 0x18]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x4a4010]
je 0x4285f7
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x4285f7
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.00462471
add esp, 4
mov eax, dword [esp + 0x14]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x4a4010]
je 0x428620
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x428620
mov edx, dword [esp + 0x14]
add edx, 0xfffffff4
push edx
call fcn.00462471
add esp, 4
xor eax, eax
jmp 0x42862f
call fcn.0043b0f0
neg eax
sbb eax, eax
neg eax
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00461932
add esp, 0x28
ret 8
Function at 0x428650
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x481b86
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x4a60f8]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a60f8]
xor eax, esp
push eax
lea eax, [esp + 0x230]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x244]
mov esi, dword [esp + 0x248]
xor ebx, ebx
push 0x206
lea ecx, [esp + 0x2a]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov word [esp + 0x30], ax
call fcn.00461950
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0xc
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x24]
push ecx
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360Safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 0x104
mov dword [esp + 0x34], 1
call edi
test eax, eax
jne 0x42871f
cmp dword [esp + 0x14], ebx
jbe 0x42871f
mov eax, dword [ebp]
lea edx, [esp + 0x24]
push edx
push eax
call fcn.004626b1
add esp, 8
test eax, eax
jne 0x42871f
push 0x258
mov ecx, esi
call fcn.0041c340
mov ebx, 1
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x2e]
push ecx
mov word [esp + 0x30], ax
call fcn.00461950
add esp, 0xc
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x24]
push ecx
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360sd.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 0x104
mov dword [esp + 0x34], 1
call edi
test eax, eax
jne 0x42879b
cmp dword [esp + 0x14], eax
jbe 0x42879b
mov ebp, dword [ebp]
lea edx, [esp + 0x24]
push edx
push ebp
call fcn.004626b1
add esp, 8
test eax, eax
jne 0x42879b
push 0x259
mov ecx, esi
call fcn.0041c340
mov eax, 1
jmp 0x42879f
mov eax, dword [esp + 0x18]
test ebx, ebx
jne 0x4287ff
test eax, eax
jne 0x4287ff
mov eax, dword [esp + 0x240]
dec eax
cmp eax, 8
ja case.0x4287b4.8
jmp dword [eax*4 + 0x4288c0]
push 0x9e
jmp 0x4287f8
push 0xa0
jmp 0x4287f8
push 0xa1
jmp 0x4287f8
push 0xa2
jmp 0x4287f8
push 0xa3
jmp 0x4287f8
push 0xd5
jmp 0x4287f8
push 0x9d
jmp 0x4287f8
push 0xae
jmp 0x4287f8
push 0xd6
mov ecx, esi
call fcn.0041c340
push 0xe2
lea ecx, [esp + 0x1c]
call fcn.0041c430
mov eax, dword [eax]
push esi
push eax
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x244], 0
call fcn.0041d460
push eax
mov ecx, esi
mov byte [esp + 0x23c], 1
call fcn.0041be30
mov eax, dword [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x4a4010]
je 0x428865
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x428865
mov edx, dword [esp + 0x20]
add edx, 0xfffffff4
push edx
call fcn.00462471
add esp, 4
mov eax, dword [esp + 0x18]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x4a4010]
je 0x42888e
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x42888e
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.00462471
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.00461932
add esp, 0x228
ret 0xc
Function at 0x428df0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x481c53
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x4a60f8]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebp
push esi
push edi
mov eax, dword [0x4a60f8]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
mov edi, ecx
push 0x5c
lea ecx, [esp + 0x234]
mov dword [esp + 0x22c], 0
call fcn.00422e90
push 0x494630
push 0x494630
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea ecx, [esp + 0x238]
call fcn.0041b440
mov eax, dword [esp + 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
mov eax, dword [esp + 0x230]
je 0x428eae
lea ecx, [eax - 0xc]
cmp ecx, dword [0x4a4010]
je 0x428ea7
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x428ea7
mov edx, dword [esp + 0x230]
add edx, 0xfffffff4
push edx
call fcn.00462471
add esp, 4
xor eax, eax
jmp 0x42900d
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsURLW]
test eax, eax
mov eax, dword [esp + 0x230]
jne 0x428e7b
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsNetworkPathW]
test eax, eax
jne 0x42903f
mov ecx, dword [esp + 0x230]
mov eax, dword [ecx - 8]
xor esi, esi
test eax, eax
jle 0x428fdc
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea esp, [esp]
movzx eax, word [ecx + esi*2]
cmp ax, 0x5c
jne 0x428fcb
push esi
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x238]
call fcn.00428000
mov edx, dword [esp + 0x10]
push edx
mov byte [esp + 0x22c], 1
call ebp
test eax, eax
jne 0x428f96
mov eax, dword [esp + 0x10]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
test eax, eax
jne 0x429036
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0042b260
add esp, 4
lea edx, [esp + 0x10]
push edx
mov ecx, edi
call fcn.00428db0
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1e]
push ecx
mov word [esp + 0x20], ax
call fcn.00461950
mov edx, dword [esp + 0x1c]
push 0x104
push edx
lea eax, [esp + 0x28]
push eax
call fcn.0046426d
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x2c]
push ecx
push edx
call fcn.004626b1
add esp, 0x20
test eax, eax
jne 0x429036
mov eax, dword [esp + 0x10]
lea ecx, [eax - 0xc]
mov byte [esp + 0x228], 0
cmp ecx, dword [0x4a4010]
je 0x428fcb
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x428fcb
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.00462471
add esp, 4
mov ecx, dword [esp + 0x230]
inc esi
cmp esi, dword [ecx - 8]
jl 0x428ef0
lea eax, [ecx - 0xc]
cmp eax, dword [0x4a4010]
je 0x429008
lea eax, [ecx - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x429008
mov ecx, dword [esp + 0x230]
add ecx, 0xfffffff4
push ecx
call fcn.00462471
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00461932
add esp, 0x21c
ret 4
lea ecx, [esp + 0x10]
call fcn.0041b2e0
lea ecx, [esp + 0x230]
call fcn.0041b2e0
xor eax, eax
jmp 0x42900d
Function at 0x429050
Capabilities:
Delete file
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x481ca0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x4a60f8]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
xor ebx, ebx
lea ecx, [esp + 0x18]
mov dword [esp + 0x3c], ebx
call fcn.00428b30
mov eax, dword [esp + 0x44]
cmp dword [eax - 0xc], ebx
push ecx
mov byte [esp + 0x40], 1
mov dword [esp + 0x18], esp
mov ecx, esp
jl 0x4290ac
mov dword [ecx], eax
mov eax, dword [esp + 0x48]
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x4290be
mov edx, dword [0x4a4014]
mov dword [ecx], edx
mov eax, dword [esp + 0x48]
push eax
call fcn.0041be90
lea ecx, [esp + 0x1c]
call fcn.00428df0
cmp eax, ebx
jne 0x429116
lea ecx, [esp + 0x18]
call fcn.00428ce0
mov eax, dword [esp + 0x44]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x4a4010]
je 0x429101
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x429101
mov edx, dword [esp + 0x44]
add edx, 0xfffffff4
push edx
call fcn.00462471
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x30
ret
push str.wftest.tf
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.0041d3e0
mov edx, dword [esp + 0x10]
push ebx
push 0x80
push 2
push ebx
push 2
push 0x120116
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x429197
mov eax, str.wftest
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x429154
sub eax, edx
push ebx
mov esi, eax
lea eax, [esp + 0x18]
push eax
push esi
push str.wftest
push edi
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x429185
cmp esi, dword [esp + 0x14]
jne 0x429185
mov ebx, 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea edx, [eax - 0xc]
cmp edx, dword [0x4a4010]
je 0x4291c6
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4291c6
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.00462471
add esp, 4
lea ecx, [esp + 0x18]
call fcn.00428ce0
mov eax, dword [esp + 0x44]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x4a4010]
je 0x4291f8
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4291f8
mov edx, dword [esp + 0x44]
add edx, 0xfffffff4
push edx
call fcn.00462471
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x42a460
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x481dc8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4a60f8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov ecx, dword [sym.imp.USER32.dll_DefWindowProcW]
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ecx
lea ecx, [esi + 0x48]
mov dword [esp + 0x14], eax
mov dword [esi], vtable.CFadeInOutAnnimationPlayer.0
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
call fcn.0044d630
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x42b260
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x4a60f8]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
mov esi, dword [esp + 0x128]
push 0x11c
lea eax, [esp + 8]
push 0
push eax
call fcn.00461950
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 8], 6
jb 0x42b2b3
push esi
call fcn.0042b160
add esp, 4
mov ecx, dword [esp + 0x120]
pop esi
xor ecx, esp
mov eax, 1
call fcn.00461932
add esp, 0x120
ret

Function at 0x42b470
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x230
mov eax, dword [0x4a60f8]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebp
push esi
push 0
push 2
mov dword [esp + 0x10], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x42b4d8
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x42b4d1
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
push str.360tray.exe
lea ecx, [esp + 0x30]
push ecx
call ebp
test eax, eax
je 0x42b4f1
lea edx, [esp + 8]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x42b4b2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.00461932
add esp, 0x230
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov dword [edi], eax
push esi
mov dword [ebx], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x234]
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.00461932
add esp, 0x230
ret
Function at 0x42b520
Capabilities:
Get session user name
Move file

Disassembly:
push 0xffffffffffffffff
push 0x481e5b
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x4a60f8]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a60f8]
xor eax, esp
push eax
lea eax, [esp + 0x22c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x244]
mov ebp, dword [esp + 0x240]
mov ebx, dword [esp + 0x23c]
push eax
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x42b647
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x42b66d
lea ecx, [esp + 0x14]
call fcn.00423a00
push 0x1a
lea ecx, [esp + 0x18]
mov dword [esp + 0x238], 0
call fcn.00423da0
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, eax
test esi, esi
je 0x42b5d7
push 0xf003f
push esi
push 0x48b058
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x24]
call fcn.00423e40
push esi
call edi
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x20], 0x105
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
call fcn.00423a20
mov esi, eax
test esi, esi
je 0x42b61f
push 0xf003f
push esi
push 0x48b058
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x24]
call fcn.00423e40
push esi
call edi
mov ecx, dword [esp + 0x244]
push ecx
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x42b64e
lea ecx, [esp + 0x14]
mov dword [esp + 0x234], 0xffffffff
call fcn.00423a10
mov eax, 1
jmp 0x42b6c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x14]
cmp eax, 5
je 0x42b671
mov dword [esp + 0x234], 0xffffffff
call fcn.00423a10
xor eax, eax
jmp 0x42b6c2
push 1
call fcn.00423da0
mov esi, eax
test esi, esi
je 0x42b69a
push 0xf003f
push esi
push 0x48b058
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x24]
call fcn.00423e40
push esi
call edi
mov edx, dword [esp + 0x244]
push edx
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [esp + 0x14]
mov esi, eax
mov dword [esp + 0x234], 0xffffffff
call fcn.00423a10
mov eax, esi
mov ecx, dword [esp + 0x22c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.00461932
add esp, 0x224
ret
Function at 0x42b7a0
Capabilities:
Check if file exists
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4a60f8]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
mov esi, dword [esp + 0x214]
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
xor edi, edi
mov word [esp + 0x14], ax
call fcn.00461950
mov edx, dword [esi]
add esp, 0xc
push str.ACS.ini
push edx
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42b828
lea edx, [esp + 8]
push edx
push edi
push 0x48b0d0
push 0x48b0bc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00461932
add esp, 0x20c
ret
mov ecx, dword [esp + 0x210]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.00461932
add esp, 0x20c
ret

Function at 0x42bb50
Capabilities:
Set registry value

Disassembly:
mov eax, 0x1994
call fcn.00462bf0
mov eax, dword [0x4a60f8]
xor eax, esp
mov dword [esp + 0x1990], eax
push edi
mov edi, ecx
mov ecx, dword [0x4a7cf8]
test ecx, ecx
jne 0x42bb8d
xor eax, eax
pop edi
mov ecx, dword [esp + 0x1990]
xor ecx, esp
call fcn.00461932
add esp, 0x1994
ret
push esi
call fcn.00448340
mov esi, eax
test esi, esi
jne 0x42bbb0
pop esi
pop edi
mov ecx, dword [esp + 0x1990]
xor ecx, esp
call fcn.00461932
add esp, 0x1994
ret
mov eax, dword [esi]
mov ecx, dword [eax + 0x44]
push ebx
push esi
call ecx
push 0x800
lea edx, [esp + 0x1a0]
push 0
push edx
mov ebx, eax
call fcn.00461950
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
add esp, 0xc
push 0x400
lea ecx, [esp + 0x1a0]
push ecx
push esi
call edx
cmp word [esp + 0x19c], 0
jne 0x42bc0c
pop ebx
pop esi
xor eax, eax
pop edi
mov ecx, dword [esp + 0x1990]
xor ecx, esp
call fcn.00461932
add esp, 0x1994
ret
push ebp
push 0x800
lea eax, [esp + 0x11a4]
push 0
push eax
call fcn.00461950
mov ecx, dword [esi]
mov eax, dword [ecx + 0x4c]
add esp, 0xc
push 0x400
lea edx, [esp + 0x11a4]
push edx
push esi
call eax
mov eax, dword [edi + 0x14]
mov ecx, dword [eax - 8]
mov ebp, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
add ecx, ecx
push ecx
push eax
push 1
lea edx, [esp + 0x11ac]
push edx
lea eax, [esp + 0x1b0]
push eax
push ebx
call ebp
push 0x190
lea ecx, [esp + 0x14]
push 0
push ecx
call fcn.00461950
mov edx, dword [esi]
mov ecx, dword [edx + 0x3c]
add esp, 0xc
push 0xc8
lea eax, [esp + 0x14]
push eax
push esi
call ecx
push 0x800
lea edx, [esp + 0x9a4]
push 0
push edx
call fcn.00461950
mov ecx, dword [edi + 0x14]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x9a8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x9a0]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42bcc0
sub eax, edx
sar eax, 1
add eax, eax
push eax
lea ecx, [esp + 0x9a4]
push ecx
push 1
push 0
lea edx, [esp + 0x1b0]
push edx
push ebx
call ebp
mov ecx, dword [esp + 0x19a0]
pop ebp
pop ebx
pop esi
pop edi
xor ecx, esp
mov eax, 1
call fcn.00461932
add esp, 0x1994
ret
Function at 0x42ca10
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x908
mov eax, dword [0x4a60f8]
xor eax, esp
mov dword [esp + 0x904], eax
push ebx
mov ebx, dword [esp + 0x910]
push esi
mov esi, dword [esp + 0x918]
mov dword [esp + 8], 0
test esi, esi
jne 0x42ca51
push 0x494900
mov ecx, ebx
call fcn.0041d2c0
jmp 0x42cb0d
push edi
xor eax, eax
push 0xfe
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.00461950
xor edx, edx
push 0x7fe
push edx
lea eax, [esp + 0x126]
push eax
mov word [esp + 0x128], dx
call fcn.00461950
push esi
lea ecx, [esp + 0x12c]
push 0x400
push ecx
call fcn.00464fd8
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x24
xor esi, esi
call fcn.00401340
mov edx, dword [eax]
mov edx, dword [edx + 0x2c]
push 0x80
lea ecx, [esp + 0x14]
push ecx
push eax
call edx
push 0x48b118
lea eax, [esp + 0x114]
push 0x400
push eax
call fcn.00464fd8
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x120]
push 0x400
push edx
call fcn.00464fd8
add esp, 0x18
lea eax, [esp + 0x110]
push eax
call edi
test eax, eax
je 0x42cb28
inc esi
cmp esi, 0xa
jl 0x42caa4
push 0x494900
mov ecx, ebx
call fcn.0041d2c0
pop edi
mov ecx, dword [esp + 0x90c]
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.00461932
add esp, 0x908
ret 8
lea ecx, [esp + 0x110]
push ecx
jmp 0x42cb05