joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425f00
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56bedc
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x5e2500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
push 0x587480
lea ecx, [ebp - 0x10]
call fcn.00404670
mov dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x5e3e60
call fcn.0042f470
mov byte [ebp - 4], 1
push 0x5874bc
push 0x5874c0
lea ecx, [ebp - 0x18]
call fcn.00402a70
mov ecx, dword [ebp - 0x1c]
add ecx, 0xa0
call fcn.004018f0
push eax
push 0
push str.MultiPartDownload
push 0x5874f0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jne 0x425fda
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0xe8], 1
mov ecx, dword [ebp - 0x1c]
add ecx, 0xa0
call fcn.004018f0
push eax
push 0x400
push 0x400
lea ecx, [ebp - 0x18]
call fcn.004025f0
push eax
push 0x587500
push 0x587504
push 0x587528
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.00401cf0
jmp 0x425fe1
mov dword [ebp - 0x14], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00402000
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00402000
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x426050
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0xa0
call fcn.004018f0
push eax
push 0x400
push 0x400
mov ecx, dword [ebp - 4]
add ecx, 0xa4
call fcn.004025f0
push eax
push 0x587538
push 0x58753c
push 0x587548
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
add ecx, 0xa4
call fcn.00401cf0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xa4]
push ecx
push 0x587558
push str.PackageName
push 8
push 0x5e3e78
call fcn.0042b490
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x4261e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56bf32
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x5e2500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x18]
call fcn.00401fd0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00401fd0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00401fd0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1c]
add ecx, 0xa0
call fcn.004018f0
push eax
push 0x400
push 0x400
lea ecx, [ebp - 0x10]
call fcn.004025f0
push eax
push 0x5875a0
push str.NameDispl
push 0x5875b8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00401cf0
mov ecx, dword [ebp - 0x1c]
add ecx, 0xa0
call fcn.004018f0
push eax
push 0x400
push 0x400
lea ecx, [ebp - 0x14]
call fcn.004025f0
push eax
push 0x5875c8
push str.VersionString
push 0x5875e8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.00401cf0
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push str._s__s
lea edx, [ebp - 0x18]
push edx
call fcn.00403430
add esp, 0x10
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0xa8
call fcn.00403d00
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00402000
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00402000
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00402000
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x426360
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56bf6d
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5e2500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x10]
call fcn.00401fd0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00401fd0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00401fd0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x24]
call fcn.004276d0
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx]
push eax
push str._sDefaultx.ulf
lea ecx, [ebp - 0x10]
push ecx
call fcn.00403430
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.00402000
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x5e3e60
call fcn.0042e250
lea ecx, [ebp - 0x10]
call fcn.004018f0
push eax
push 0x400
push 0x400
lea ecx, [ebp - 0x18]
call fcn.004025f0
push eax
push 0x587624
lea ecx, [ebp - 0x14]
call fcn.004018f0
push eax
push str.RADIOBUTTONSTRING
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.00401cf0
lea ecx, [ebp - 0x18]
call fcn.00401f20
movzx ecx, al
test ecx, ecx
je 0x42645f
push str.Unknown_Language
lea ecx, [ebp - 0x18]
call fcn.00403fc0
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp + 8]
call fcn.004025c0
mov eax, dword [ebp - 0x20]
or eax, 1
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00402000
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00402000
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00402000
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x4264b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56bfa0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5e2500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x14]
call fcn.00401fd0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00401fd0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x24]
call fcn.004276d0
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
push ecx
push 0x587670
lea edx, [ebp - 0x14]
push edx
call fcn.00403430
add esp, 0x10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00402000
lea ecx, [ebp - 0x14]
call fcn.004018f0
push eax
push 0x400
push 0x400
lea ecx, [ebp - 0x18]
call fcn.004025f0
push eax
push 0x587690
push str.LangName
push 0x5876a8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.00401cf0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
call fcn.004025c0
mov ecx, dword [ebp - 0x20]
or ecx, 1
mov dword [ebp - 0x20], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00402000
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00402000
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x426ff0
Capabilities:
Get memory capacity
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56c0ad
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x5e2500]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x58], ecx
push 0x58773c
lea ecx, [ebp - 0x48]
call fcn.00404670
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x58]
add ecx, 0xa0
call fcn.004018f0
push eax
mov eax, dword [0x5dd658]
push eax
push str.128MB
push 0x587764
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
push str.BufferSize_in_ToolSettings_:__u
lea ecx, [ebp - 0x48]
call fcn.004018f0
push eax
push 0xb
push 0x5e3e78
call fcn.0042b490
add esp, 0x14
cmp dword [ebp - 0x18], 0
jne 0x42708e
mov edx, dword [0x5dd658]
mov dword [ebp - 0x18], edx
push 0x20
push 0
lea eax, [ebp - 0x3c]
push eax
call fcn.0054cf20
add esp, 0xc
mov dword [ebp - 0x3c], 0x20
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
fld qword [0x588ee0]
fstp qword [ebp - 0x44]
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x5c], 0
fild qword [ebp - 0x60]
fdiv qword [ebp - 0x44]
fstp qword [ebp - 0x14]
sub esp, 8
fld qword [ebp - 0x14]
fstp qword [esp]
call fcn.0042b1b0
add esp, 8
fstp qword [ebp - 0x54]
fld qword [ebp - 0x54]
fnstcw word [ebp - 0x62]
movzx eax, word [ebp - 0x62]
or eax, 0xc00
mov dword [ebp - 0x68], eax
fldcw word [ebp - 0x68]
fistp qword [ebp - 0x70]
fldcw word [ebp - 0x62]
mov eax, dword [ebp - 0x70]
imul eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x58]
mov dword [ecx + 0xd8], eax
mov edx, dword [ebp - 0x58]
mov eax, dword [edx + 0xd8]
push eax
push str.Calculated_BufferSize_:__u
lea ecx, [ebp - 0x48]
call fcn.004018f0
push eax
push 0xb
push 0x5e3e78
call fcn.0042b490
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00402000
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0054dc83
mov esp, ebp
pop ebp
ret
Function at 0x4289d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56c435
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5e2500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x20]
call fcn.00401fd0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
add ecx, 0xa0
call fcn.004018f0
push eax
push 0x400
push 0x400
lea ecx, [ebp - 0x20]
call fcn.004025f0
push eax
push 0x58850c
push 0x588578
push 0x588590
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x20]
call fcn.00401cf0
cmp dword [ebp - 0x10], 0
jbe 0x428a7f
lea eax, [ebp - 0x1c]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
lea edx, [ebp - 0x20]
push edx
call fcn.004025c0
mov dword [ebp - 0x34], eax
mov ecx, 0x5e3e60
call fcn.0042e0b0
lea ecx, [ebp - 0x20]
call fcn.004018f0
push eax
push str.PackageSize
push 0xb
push 0x5e3e78
call fcn.0042b490
add esp, 0x10
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00402000
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x42a520
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56c761
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x5e2500]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x88], ecx
lea ecx, [ebp - 0x10]
call fcn.00401fd0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x88]
add ecx, 0xa0
call fcn.004018f0
push eax
push 0x400
push 0x400
lea ecx, [ebp - 0x10]
call fcn.004025f0
push eax
push 0x588af8
push str.GUID2
push 0x588b08
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00401cf0
lea ecx, [ebp - 0x10]
call fcn.00401ce0
push eax
lea ecx, [ebp - 0x10]
call fcn.004018f0
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.0054f753
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.0042b2d0
push eax
call fcn.0054f4e1
add esp, 4
mov word [ebp - 0x14], ax
mov ecx, dword [ebp - 0x88]
mov dx, word [ebp - 0x14]
mov word [ecx + 0xc8], dx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00402000
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0054dc83
mov esp, ebp
pop ebp
ret
Function at 0x42a630
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56c7ae
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x5e2500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x40]
call fcn.004289d0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
cmp dword [ebp + 0x10], 0
jne 0x42a789
push 2
push 0
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp + 0xc]
call fcn.004030d0
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x48], ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x48]
call fcn.004018f0
push eax
push 2
push 0
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp + 8]
call fcn.004030d0
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x50]
call fcn.00401ad0
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x25], al
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
call fcn.00402000
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.00402000
movzx ecx, byte [ebp - 0x25]
test ecx, ecx
je 0x42a789
lea ecx, [ebp - 0x18]
call fcn.00401fd0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x40]
add ecx, 0xa0
call fcn.004018f0
push eax
push 0x400
push 0x400
lea ecx, [ebp - 0x18]
call fcn.004025f0
push eax
push 0x588b14
push str.CabSize
push 0x588b28
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.00401cf0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
lea edx, [ebp - 0x24]
push edx
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
lea eax, [ebp - 0x18]
push eax
call fcn.004025c0
mov dword [ebp - 0x54], eax
mov ecx, 0x5e3e60
call fcn.0042e0b0
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x10]
adc edx, dword [ebp - 0x20]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00402000
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x38], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00402000
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00402000
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42af00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56c944
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5e2500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.CSiWAInitalizer.0
mov dword [ebp - 4], 0xd
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.00401720
test eax, eax
jle 0x42af4f
mov ecx, 0x5e3ca4
call fcn.004553fa
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.00401720
test eax, eax
jle 0x42af68
mov ecx, 0x5e3cdc
call fcn.004553fa
mov ecx, dword [ebp - 0x10]
add ecx, 0x68
call fcn.00401720
test eax, eax
jle 0x42af81
mov ecx, 0x5e3cf8
call fcn.004553fa
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.00401720
test eax, eax
jle 0x42af9a
mov ecx, 0x5e3ca4
call fcn.004553fa
mov ecx, 0x5e3e0c
call fcn.00401720
test eax, eax
jle 0x42afb2
mov ecx, 0x5e3e0c
call fcn.004039a0
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x10]
add ecx, 0xb0
call fcn.00402000
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x10]
add ecx, 0xac
call fcn.00402000
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x10]
add ecx, 0xa8
call fcn.00402000
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.00402000
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x10]
add ecx, 0xa0
call fcn.00402000
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x10]
add ecx, 0x9c
call fcn.00402000
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0x88
call fcn.004020d0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x68
call fcn.00455440
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.00455440
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00455440
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.00455440
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.00402000
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00402000
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.00402000
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x42bf10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x10]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
call fcn.004018f0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0xc]
call fcn.00402000
cmp dword [ebp - 8], 0
jne 0x42bf5b
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x42c060
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56cb44
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5e2500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], 0
push 0x5c
lea ecx, [ebp + 8]
call fcn.0041a8b0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
push 0
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp + 8]
call fcn.004030d0
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x38], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x38]
push eax
lea ecx, [ebp + 8]
call fcn.00403d00
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00402000
mov dword [ebp - 0x14], 0
lea ecx, [ebp + 8]
call fcn.00401f20
movzx ecx, al
test ecx, ecx
jne 0x42c1fd
lea ecx, [ebp - 0x18]
call fcn.00401fd0
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x14]
add edx, 3
push edx
push 0x5890ac
lea ecx, [ebp + 8]
call fcn.00401eb0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x42c19c
mov eax, dword [ebp - 0x14]
push eax
push 0
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp + 8]
call fcn.004030d0
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x40], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x40]
push eax
lea ecx, [ebp - 0x18]
call fcn.00403d00
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.00402000
push 0
lea ecx, [ebp - 0x18]
call fcn.004018f0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x42c19a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x42c19a
mov dword [ebp - 0x24], 0xffffffff
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00402000
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00402000
mov eax, dword [ebp - 0x24]
jmp 0x42c216
jmp 0x42c1ec
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00403d00
push 0
lea ecx, [ebp + 8]
call fcn.004018f0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x42c1e4
mov dword [ebp - 0x28], 0xffffffff
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00402000
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00402000
mov eax, dword [ebp - 0x28]
jmp 0x42c216
lea ecx, [ebp + 8]
call fcn.00401d70
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00402000
jmp 0x42c0da
mov dword [ebp - 0x2c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00402000
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x42d7b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56ce7b
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push esi
mov eax, dword [0x5e2500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x18]
call fcn.00401fd0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0x40
push 1
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x34]
call fcn.0042ca90
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x3c]
push edx
push 0x5896b0
lea eax, [ebp - 0x20]
push eax
call fcn.0041bfd0
add esp, 0xc
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x44]
push edx
lea ecx, [ebp - 0x18]
call fcn.00403d00
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.00402000
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00402000
mov ecx, dword [ebp - 0x34]
call fcn.0042d580
mov esi, eax
mov ecx, dword [ebp - 0x34]
call fcn.0042d5b0
add esi, eax
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], 0
jle 0x42d98d
push 0x5896c4
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x34]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x4c], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x4c]
push edx
push 0x5896c8
lea eax, [ebp - 0x28]
push eax
call fcn.0041bfd0
add esp, 0xc
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x54], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x54]
push edx
lea eax, [ebp - 0x2c]
push eax
call fcn.00403880
add esp, 0xc
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x58]
mov dword [ebp - 0x5c], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x5c]
push edx
lea ecx, [ebp - 0x18]
call fcn.004118f0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c]
call fcn.00402000
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
call fcn.00402000
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.00402000
mov ecx, dword [ebp - 0x34]
call fcn.0042d580
test eax, eax
je 0x42d918
mov dword [ebp - 0x14], 0x10
jmp 0x42d91f
mov dword [ebp - 0x14], 0x30
cmp dword [ebp + 8], 0x212
jne 0x42d931
cmp dword [ebp + 8], 0x212
je 0x42d98d
mov eax, dword [ebp - 0x14]
or eax, 4
push eax
push 0x5896d8
lea ecx, [ebp - 0x18]
call fcn.004018f0
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x42d98d
push 3
push 0
push 0
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x34]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x34]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
call fcn.004018f0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x30]
call fcn.00402000
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00402000
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8