joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bb320
Capabilities:
Write file on windows

Disassembly:
push ebp
sub esp, 0x18
mov edx, dword [esp + 0x20]
mov eax, dword [0x573f40]
test eax, eax
jne 0x4bb336
add esp, 0x18
pop ebp
ret
mov dword [esp], edx
mov dword [esp + 4], 0x76d7e0
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, eax
test ebp, ebp
je 0x4bb3e8
mov ecx, 1
mov dword [esp + 0x10], ecx
lea edx, [esp + 0x10]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 4
mov dword [esp + 0xc], ebp
call dword [sym.imp.MSVCRT.dll_fwrite]
mov ecx, 1
mov dword [esp + 0x14], ecx
lea edx, [esp + 0x14]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 4
mov dword [esp + 0xc], ebp
call dword [sym.imp.MSVCRT.dll_fwrite]
mov dword [esp], 0x573f40
mov dword [esp + 4], 1
mov dword [esp + 8], 4
mov dword [esp + 0xc], ebp
call dword [sym.imp.MSVCRT.dll_fwrite]
mov dword [esp], 0x6e5020
mov dword [esp + 4], 1
mov dword [esp + 8], 0x1900
mov dword [esp + 0xc], ebp
call dword [sym.imp.MSVCRT.dll_fwrite]
mov dword [esp], ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x18
pop ebp
ret

Function at 0x4bb3f0
Capabilities:
Read file on windows

Disassembly:
push edi
sub esp, 0x20
mov edi, dword [esp + 0x28]
mov dword [0x573f40], 0
call fcn.004bb130
mov dword [esp + 0x10], 0
mov dword [esp], edi
mov dword [esp + 4], 0x76d6c0
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
test edi, edi
je 0x4bb56f
mov dword [esp + 0x14], 0
lea edx, [esp + 0x14]
mov dword [esp], edx
mov dword [esp + 4], 1
mov dword [esp + 8], 4
mov dword [esp + 0xc], edi
call dword [sym.imp.MSVCRT.dll_fread]
cmp eax, 4
jne 0x4bb489
mov edx, dword [esp + 0x14]
cmp edx, 1
je 0x4bb499
mov dword [esp], 0x1f
mov dword [esp + 4], 0x76d800
mov dword [esp + 8], edx
call fcn.005041f0
mov dword [esp], edi
call dword [sym.imp.MSVCRT.dll_fclose]
xor eax, eax
add esp, 0x20
pop edi
ret
mov dword [esp], edi
call dword [sym.imp.MSVCRT.dll_fclose]
xor eax, eax
add esp, 0x20
pop edi
ret
mov dword [esp + 0x18], 0
lea edx, [esp + 0x18]
mov dword [esp], edx
mov dword [esp + 4], 1
mov dword [esp + 8], 4
mov dword [esp + 0xc], edi
call dword [sym.imp.MSVCRT.dll_fread]
cmp eax, 4
jne 0x4bb4f8
mov edx, dword [esp + 0x18]
cmp edx, 1
je 0x4bb508
mov dword [esp], 0x20
mov dword [esp + 4], 0x76d840
mov dword [esp + 8], edx
call fcn.005041f0
mov dword [esp], edi
call dword [sym.imp.MSVCRT.dll_fclose]
xor eax, eax
add esp, 0x20
pop edi
ret
mov dword [esp], edi
call dword [sym.imp.MSVCRT.dll_fclose]
xor eax, eax
add esp, 0x20
pop edi
ret
lea edx, [esp + 0x10]
mov dword [esp], edx
mov dword [esp + 4], 1
mov dword [esp + 8], 4
mov dword [esp + 0xc], edi
call dword [sym.imp.MSVCRT.dll_fread]
cmp eax, 4
je 0x4bb53e
mov dword [esp], edi
call dword [sym.imp.MSVCRT.dll_fclose]
xor eax, eax
add esp, 0x20
pop edi
ret
mov dword [esp], 0x6e5020
mov dword [esp + 4], 1
mov dword [esp + 8], 0x1900
mov dword [esp + 0xc], edi
call dword [sym.imp.MSVCRT.dll_fread]
cmp eax, 0x1900
je 0x4bb576
mov dword [esp], edi
call dword [sym.imp.MSVCRT.dll_fclose]
xor eax, eax
add esp, 0x20
pop edi
ret
mov eax, dword [esp + 0x10]
mov dword [0x573f40], eax
call fcn.004bb130
mov eax, 1
add esp, 0x20
pop edi
ret
Function at 0x4bbcc0
Capabilities:
Read file on windows

Disassembly:
push edi
push ebp
sub esp, 0x34
mov edi, dword [esp + 0x40]
mov dword [esp], edi
mov dword [esp + 4], 0x76d6c0
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, eax
test ebp, ebp
je 0x4bbe05
mov dword [esp], ebp
mov dword [esp + 4], 0x18
mov dword [esp + 8], 0
call dword [sym.imp.MSVCRT.dll_fseek]
mov dword [esp + 0x10], 0
lea edx, [esp + 0x10]
mov dword [esp], edx
mov dword [esp + 4], 1
mov dword [esp + 8], 2
mov dword [esp + 0xc], ebp
call dword [sym.imp.MSVCRT.dll_fread]
mov dword [esp + 0x14], 0
call fcn.004bbc40
xor edi, edi
mov edx, dword [esp + 0x10]
test edx, edx
jle 0x4bbdcd
lea edx, [esp + 0x14]
mov dword [esp], edx
mov dword [esp + 4], 1
mov dword [esp + 8], 2
mov dword [esp + 0xc], ebp
call dword [sym.imp.MSVCRT.dll_fread]
lea edx, [esp + 0x18]
mov dword [esp], edx
mov dword [esp + 4], 1
mov dword [esp + 8], 0xc
mov dword [esp + 0xc], ebp
call dword [sym.imp.MSVCRT.dll_fread]
mov byte [esp + 0x24], 0
lea edx, [esp + 0x28]
mov dword [esp], edx
mov dword [esp + 4], 1
mov dword [esp + 8], 8
mov dword [esp + 0xc], ebp
call dword [sym.imp.MSVCRT.dll_fread]
mov byte [esp + 0x30], 0
lea edx, [esp + 0x28]
lea ecx, [esp + 0x18]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.004bb650
inc edi
cmp edi, dword [esp + 0x10]
jl 0x4bbd41
xor edi, edi
mov edx, dword [0x573f40]
test edx, edx
jle 0x4bbdf1
lea esi, [esi]
mov dword [esp], edi
call fcn.004bbc90
inc edi
cmp edi, dword [0x573f40]
jl 0x4bbde0
mov dword [esp], ebp
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, 1
add esp, 0x34
pop ebp
pop edi
ret
mov dword [esp], 6
mov dword [esp + 4], 0x7749c0
mov dword [esp + 8], edi
call fcn.005041f0
xor eax, eax
add esp, 0x34
pop ebp
pop edi
ret
Function at 0x4c3500
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c3650
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x24], ecx
mov dword [ecx], 0x779b40
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x24]
xor eax, eax
mov dword [edx], 0x779b60
mov dword [edx + 8], 0x779b80
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], 0x11
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [edx + 0x20], 0xa
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x24]
xor eax, eax
mov dword [edx + 0x24], 0x779ba0
mov dword [edx + 0x28], eax
mov dword [edx + 0x2c], 0x11
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], 0xa
mov dword [ebp - 4], 2
mov edx, dword [ebp - 0x24]
xor eax, eax
mov dword [edx + 0x40], 0x779ba0
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], 0x11
mov dword [edx + 0x4c], eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], 0xa
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x24]
add ecx, 0x64
call fcn.0054beb8
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x60], reloc.WSOCK32.dll_accept
add ecx, 0x64
push 0x76acc0
call fcn.0054bebe
mov edx, dword [ebp - 0x24]
xor eax, eax
mov byte [edx + 0x68], al
mov dword [edx + 4], eax
mov byte [edx + 0x5c], al
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4ca520
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ca680
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edi
lea eax, [ecx + 0xa4]
xor edx, edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ecx
mov byte [ecx + 0x60], 1
mov dword [ebp - 0x14], eax
mov eax, dword [ecx + 0xc4]
push edx
push edx
push 0x1009
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [ebp - 0x50]
call fcn.0054beb8
mov dword [ebp - 4], 0
xor ebx, ebx
mov eax, dword [0x573814]
test eax, eax
jle 0x4ca63e
mov dword [ebp - 0x4c], 0xd
xor eax, eax
mov esi, ebx
mov dword [ebp - 0x48], ebx
shl esi, 4
mov edi, ebx
mov dword [ebp - 0x44], eax
shl edi, 6
lea edx, [edi + esi + 0x7673bc]
mov dword [ebp - 0x2c], ebx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edx
mov ecx, dword [ecx + 0xc4]
lea edx, [ebp - 0x4c]
push edx
push eax
push 0x1007
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov al, byte [edi + esi + 0x7673ac]
test al, al
je 0x4ca5e3
mov eax, 1
jmp 0x4ca5e5
xor eax, eax
push eax
mov ecx, dword [ebp - 0x14]
push ebx
call sub.MFC42.DLL_CListCtrl::SetCheck
lea eax, [edi + esi + 0x7673d0]
mov ecx, dword [ebp - 0x14]
push eax
push 1
push ebx
call sub.MFC42.DLL_CListCtrl::SetItemText
mov al, byte [edi + esi + 0x7673ac]
test al, al
je 0x4ca614
mov eax, 0x45
jmp 0x4ca619
mov eax, 0x44
lea ecx, [ebp - 0x50]
push eax
call fcn.0054c194
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x14]
push eax
push 2
push ebx
call sub.MFC42.DLL_CListCtrl::SetItemText
inc ebx
cmp ebx, dword [0x573814]
jl 0x4ca58b
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x60], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call sub.MFC42.DLL_CString::CString
mov ebx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4ce200
Capabilities:
Get graphical window text

Disassembly:
push esi
push ebx
sub esp, 0x34
mov esi, ecx
mov byte [esi + 0x60], 1
lea ebx, [esi + 0x64]
mov edx, dword [esi + 0x84]
xor eax, eax
push eax
push eax
push 0x1009
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
xor edx, edx
mov eax, dword [0x573f40]
test eax, eax
jle 0x4ce310
mov eax, edx
shl eax, 6
mov dword [esp + 0x2c], esi
mov esi, edx
mov dword [esp + 0x30], edi
mov edi, ebx
mov ebx, eax
lea esi, [esi]
lea edi, [edi]
mov dword [esp + 4], 0xd
xor eax, eax
lea edx, [ebx + 0x6e5020]
mov dword [esp + 8], esi
lea ecx, [esp + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x2c]
mov edx, dword [edx + 0x84]
push ecx
push eax
push 0x1007
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov al, byte [ebx + 0x6e505e]
test al, al
je 0x4ce2b0
mov eax, 1
jmp 0x4ce2b2
xor eax, eax
push eax
mov ecx, edi
push esi
call sub.MFC42.DLL_CListCtrl::SetCheck
lea eax, [ebx + 0x6e5034]
mov ecx, edi
push eax
push 1
push esi
call sub.MFC42.DLL_CListCtrl::SetItemText
mov al, byte [ebx + 0x6e505e]
test al, al
je 0x4ce2e0
mov al, 0x45
jmp 0x4ce2e2
mov al, 0x44
mov byte [esp], al
mov ecx, edi
mov byte [esp + 1], 0
lea eax, [esp]
push eax
push 2
push esi
call sub.MFC42.DLL_CListCtrl::SetItemText
add ebx, 0x40
inc esi
cmp esi, dword [0x573f40]
jl 0x4ce250
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov byte [esi + 0x60], 0
add esp, 0x34
pop ebx
pop esi
ret
Function at 0x4d53a0
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebp
sub esp, 0x658
mov edi, ecx
mov esi, dword [esp + 0x668]
mov dword [esp], esi
mov dword [esp + 4], 0x76d7e0
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, eax
test ebp, ebp
je 0x4d55c8
lea edx, [esp + 0x610]
xor ecx, ecx
and ecx, 0xff
mov esi, ecx
shl esi, 8
or ecx, esi
mov esi, ecx
shl esi, 0x10
or ecx, esi
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov dword [edx + 0x14], ecx
mov dword [edx + 0x18], ecx
mov dword [edx + 0x1c], ecx
mov dword [edx + 0x20], ecx
mov dword [edx + 0x24], ecx
mov dword [edx + 0x28], ecx
mov dword [edx + 0x2c], ecx
mov dword [edx + 0x30], ecx
mov dword [edx + 0x34], ecx
mov byte [esp + 0x610], 0x42
mov byte [esp + 0x611], 0x4d
lea edx, [esp + 0x612]
mov dword [esp], edx
mov dword [esp + 4], 0x10e38
call fcn.004acc90
lea edx, [esp + 0x61a]
mov dword [esp], edx
mov dword [esp + 4], 0x38
call fcn.004acc90
lea edx, [esp + 0x61e]
mov dword [esp], edx
mov dword [esp + 4], 0x28
call fcn.004acc90
lea edx, [esp + 0x622]
mov dword [esp], edx
mov dword [esp + 4], 0xa0
call fcn.004acc90
lea edx, [esp + 0x626]
mov dword [esp], edx
mov dword [esp + 4], 0x90
call fcn.004acc90
lea edx, [esp + 0x62a]
mov dword [esp], edx
mov dword [esp + 4], 1
call fcn.004acc90
lea edx, [esp + 0x62c]
mov dword [esp], edx
mov dword [esp + 4], 0x18
call fcn.004acc90
lea edx, [esp + 0x632]
mov dword [esp], edx
mov dword [esp + 4], 0x5a00
call fcn.004acc90
lea edx, [esp + 0x610]
mov dword [esp], edx
mov dword [esp + 4], 1
mov dword [esp + 8], 0x38
mov dword [esp + 0xc], ebp
call dword [sym.imp.MSVCRT.dll_fwrite]
lea edx, [esp + 0x10]
lea eax, [edi + 0x5a00]
xor esi, esi
mov dword [esp + 0x650], ebx
mov ebx, edi
mov edi, eax
xor ecx, ecx
mov dword [esp + 0x64c], esi
mov dword [esp + 0x648], ebp
lea esi, [esi]
lea edi, [edi]
movzx ebp, byte [edi]
mov esi, dword [ebx + 0x9c]
mov al, byte [esi + ebp*4 + 0x28]
mov byte [edx], al
mov esi, dword [ebx + 0x9c]
mov al, byte [esi + ebp*4 + 0x29]
mov byte [edx + 1], al
mov esi, dword [ebx + 0x9c]
mov al, byte [esi + ebp*4 + 0x2a]
mov byte [edx + 2], al
inc edi
add edx, 3
inc ecx
cmp ecx, 0xa0
jl 0x4d5530
mov esi, dword [esp + 0x64c]
mov ebp, dword [esp + 0x648]
add edi, 0xfffffec0
lea edx, [esp + 0x10]
mov dword [esp], edx
mov dword [esp + 4], 1
mov dword [esp + 8], 0x1e0
mov dword [esp + 0xc], ebp
call dword [sym.imp.MSVCRT.dll_fwrite]
lea edx, [esp + 0x10]
inc esi
cmp esi, 0x90
jl 0x4d5516
mov ebx, dword [esp + 0x650]
mov dword [esp], ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x658
pop ebp
pop esi
pop edi
ret 4
mov dword [esp], 0x10
mov dword [esp + 4], 0x774860
mov dword [esp + 8], esi
call fcn.005041f0
add esp, 0x658
pop ebp
pop esi
pop edi
ret 4
Function at 0x4e0770
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x114
mov esi, edx
mov ebp, ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x100
jb 0x4e07a8
mov dword [esp], 0x787260
mov dword [esp + 4], 0x98
mov dword [esp + 8], 0x7872a0
call fcn.004e05d0
lea eax, [esp + 0x10]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ebx, [esp + 0x10]
lea edx, [esp + 0x10]
mov al, byte [esp + 0x10]
test al, al
je 0x4e07e5
lea esi, [esi]
lea edi, [edi]
cmp al, 0x5c
je 0x4e07d8
cmp al, 0x2f
jne 0x4e07dd
mov edx, ebx
lea esi, [ebx + 1]
mov al, byte [ebx + 1]
inc ebx
test al, al
jne 0x4e07d0
mov al, byte [0x569f00]
test al, al
je 0x4e0891
xor bl, bl
lea eax, [esp + 0x10]
cmp edx, eax
je 0x4e0820
mov byte [edx], 0
lea eax, [esp + 0x10]
lea edx, [esp + 0x110]
push edx
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4e0884
mov ebp, dword [esp + 0x110]
mov bl, 1
mov eax, dword [esp + 0x134]
push eax
mov edi, dword [esp + 0x134]
push edi
mov edx, dword [esp + 0x134]
push edx
mov eax, dword [esp + 0x134]
push eax
push esi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test bl, bl
je 0x4e0875
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4e0875
mov dword [esp], 0x787260
mov dword [esp + 4], 0xc4
mov dword [esp + 8], 0x787300
call fcn.004e05d0
mov eax, esi
add esp, 0x114
pop ebx
pop ebp
pop esi
pop edi
ret 0x10
add esp, 0x114
pop ebx
pop ebp
pop esi
pop edi
ret 0x10
call fcn.00500830
mov ecx, dword [esp + 0x134]
mov edx, dword [ecx]
push eax
push edx
mov eax, dword [esp + 0x138]
push eax
push esi
push 0x7872e0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
test eax, eax
je 0x4e08d5
mov edx, dword [esp + 0x12c]
xor eax, eax
mov dword [edx], 3
add esp, 0x114
pop ebx
pop ebp
pop esi
pop edi
ret 0x10
mov eax, 0xffffffff
add esp, 0x114
pop ebx
pop ebp
pop esi
pop edi
ret 0x10
Function at 0x4e6630
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x2c
mov esi, ecx
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 4], 0x76d7e0
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, eax
test ebx, ebx
je 0x4e6892
mov byte [esp + 0x10], 0x52
mov dl, 0x46
mov byte [esp + 0x11], 0x49
mov byte [esp + 0x12], dl
mov byte [esp + 0x13], dl
lea edx, [esp + 0x10]
mov dword [esp], edx
mov dword [esp + 4], 1
mov dword [esp + 8], 4
mov dword [esp + 0xc], ebx
call dword [sym.imp.MSVCRT.dll_fwrite]
lea edx, [esp + 0x10]
mov dword [esp], edx
mov dword [esp + 4], 0x410
call fcn.004acc90
lea edx, [esp + 0x10]
mov dword [esp], edx
mov dword [esp + 4], 1
mov dword [esp + 8], 4
mov dword [esp + 0xc], ebx
call dword [sym.imp.MSVCRT.dll_fwrite]
mov byte [esp + 0x14], 0x50
mov byte [esp + 0x15], 0x41
mov byte [esp + 0x16], 0x4c
mov byte [esp + 0x17], 0x20
lea edx, [esp + 0x14]
mov dword [esp], edx
mov dword [esp + 4], 1
mov dword [esp + 8], 4
mov dword [esp + 0xc], ebx
call dword [sym.imp.MSVCRT.dll_fwrite]
mov byte [esp + 0x18], 0x64
mov dl, 0x61
mov byte [esp + 0x19], dl
mov byte [esp + 0x1a], 0x74
mov byte [esp + 0x1b], dl
lea edx, [esp + 0x18]
mov dword [esp], edx
mov dword [esp + 4], 1
mov dword [esp + 8], 4
mov dword [esp + 0xc], ebx
call dword [sym.imp.MSVCRT.dll_fwrite]
lea edx, [esp + 0x10]
mov dword [esp], edx
mov dword [esp + 4], 0x404
call fcn.004acc90
lea edx, [esp + 0x10]
mov dword [esp], edx
mov dword [esp + 4], 1
mov dword [esp + 8], 4
mov dword [esp + 0xc], ebx
call dword [sym.imp.MSVCRT.dll_fwrite]
lea edx, [esp + 0x10]
mov dword [esp], edx
mov edx, 0x300
mov word [esp + 4], dx
call fcn.004accc0
lea edx, [esp + 0x12]
mov dword [esp], edx
mov edx, 0x100
mov word [esp + 4], dx
call fcn.004accc0
lea edx, [esp + 0x10]
mov dword [esp], edx
mov dword [esp + 4], 1
mov dword [esp + 8], 4
mov dword [esp + 0xc], ebx
call dword [sym.imp.MSVCRT.dll_fwrite]
xor edx, edx
mov eax, dword [esi + 0x48]
test eax, eax
jle 0x4e6832
mov dword [esp + 0x28], ebx
mov ebx, edx
mov dword [esp + 0x24], esi
mov eax, dword [esp + 0x24]
movzx edx, word [eax + ebx*2 + 0x80]
mov eax, edx
and eax, 0x1f
add eax, eax
add eax, eax
add eax, eax
mov ecx, edx
and ecx, 0x3e0
sar ecx, 2
and edx, 0x7c00
sar edx, 7
mov byte [esp + 0x1f], 0
mov esi, dword [esp + 0x28]
mov byte [esp + 0x1c], al
mov byte [esp + 0x1d], cl
mov byte [esp + 0x1e], dl
lea eax, [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 4], 1
mov dword [esp + 8], 4
mov dword [esp + 0xc], esi
call dword [sym.imp.MSVCRT.dll_fwrite]
inc ebx
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0x48]
cmp ebx, eax
jl 0x4e67c3
mov ebx, esi
cmp eax, 0x100
jge 0x4e687c
jge 0x4e687c
mov esi, eax
lea esi, [esi]
xor dl, dl
mov byte [esp + 0x20], dl
mov byte [esp + 0x21], dl
mov byte [esp + 0x22], dl
mov byte [esp + 0x23], dl
lea ecx, [esp + 0x20]
mov dword [esp], ecx
mov dword [esp + 4], 1
mov dword [esp + 8], 4
mov dword [esp + 0xc], ebx
call dword [sym.imp.MSVCRT.dll_fwrite]
inc esi
cmp esi, 0x100
jl 0x4e6840
mov dword [esp], ebx
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, 1
add esp, 0x2c
pop ebx
pop esi
ret 4
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
ret 4
Function at 0x4e68a0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x28
mov ebx, ecx
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], 0x76d7e0
call dword [sym.imp.MSVCRT.dll_fopen]
mov edx, eax
test edx, edx
je 0x4e69b3
xor ecx, ecx
mov eax, dword [ebx + 0x48]
test eax, eax
jle 0x4e694b
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ebx
mov ebx, ecx
lea esi, [esi]
mov eax, dword [esp + 0x18]
movzx ecx, word [eax + ebx*2 + 0x80]
mov edx, ecx
and edx, 0x1f
add edx, edx
add edx, edx
add edx, edx
mov eax, ecx
and eax, 0x3e0
sar eax, 2
and ecx, 0x7c00
sar ecx, 7
mov byte [esp + 0x10], dl
mov byte [esp + 0x11], al
mov byte [esp + 0x12], cl
lea edx, [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov dword [esp], edx
mov dword [esp + 4], 1
mov dword [esp + 8], 3
mov dword [esp + 0xc], eax
call dword [sym.imp.MSVCRT.dll_fwrite]
inc ebx
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x48]
cmp ebx, eax
jl 0x4e68e0
mov edx, dword [esp + 0x1c]
cmp eax, 0x100
jge 0x4e699e
jge 0x4e699e
mov dword [esp + 0x20], esi
mov ebx, eax
mov esi, edx
lea esi, [esi]
xor cl, cl
mov byte [esp + 0x14], cl
mov byte [esp + 0x15], cl
mov byte [esp + 0x16], cl
lea ecx, [esp + 0x14]
mov dword [esp], ecx
mov dword [esp + 4], 1
mov dword [esp + 8], 3
mov dword [esp + 0xc], esi
call dword [sym.imp.MSVCRT.dll_fwrite]
inc ebx
cmp ebx, 0x100
jl 0x4e6960
mov edx, esi
mov esi, dword [esp + 0x20]
mov dword [esp], edx
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, 1
add esp, 0x28
pop ebx
ret 4
xor eax, eax
add esp, 0x28
pop ebx
ret 4
Function at 0x500020
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push edi
push ebp
push ebx
sub esp, 8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov dl, byte [0x569f00]
test dl, dl
je 0x500083
xor ebp, ebp
mov edi, dword [0x5745e0]
mov dword [esp], ebp
lea ecx, [esp]
mov dword [esp + 4], 0x800
lea edx, [esp + 4]
push edx
push 0x574600
push ecx
push ebp
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x50007a
mov eax, dword [esp]
cmp eax, 1
jne 0x50007a
mov eax, 0x574600
add esp, 8
pop ebx
pop ebp
pop edi
ret
mov eax, ebx
add esp, 8
pop ebx
pop ebp
pop edi
ret
mov edx, dword [0x5745e4]
push edx
push 0x800
push 0x574600
push ebx
push eax
push 0x791240
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x50007a
mov eax, 0x574600
add esp, 8
pop ebx
pop ebp
pop edi
ret

Function at 0x5000c0
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0xc
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov cl, byte [esp + 0x28]
mov dl, byte [0x569f00]
test dl, dl
jne 0x5000e1
test cl, cl
je 0x500131
xor esi, esi
mov edi, dword [0x5745e0]
mov dword [esp], esi
lea ebp, [esp]
mov dword [esp + 4], 4
lea edx, [esp + 4]
mov dword [esp + 8], esi
lea ecx, [esp + 8]
push edx
push ecx
push ebp
push esi
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x500127
mov eax, dword [esp]
cmp eax, 4
jne 0x500127
mov eax, dword [esp + 8]
add esp, 0xc
pop ebx
pop ebp
pop esi
pop edi
ret
mov eax, ebx
add esp, 0xc
pop ebx
pop ebp
pop esi
pop edi
ret
mov edx, dword [0x5745e4]
push edx
push ebx
push eax
push 0x791240
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
add esp, 0xc
pop ebx
pop ebp
pop esi
pop edi
ret

Function at 0x500290
Capabilities:
Set registry value

Disassembly:
push edi
push ebp
push esi
mov ebp, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
mov al, byte [0x569f00]
test al, al
je 0x5002d1
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x5002b6
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x5002ae
mov edx, dword [0x5745e0]
inc eax
push eax
push edi
push 1
push 0
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add esp, 4
pop ebp
pop edi
ret
mov eax, dword [0x5745e4]
push eax
push edi
push ebp
push 0x791240
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
add esp, 4
pop ebp
pop edi
ret