joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4092e0
Capabilities:
Check if file exists
Delete file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x427898
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebp
push esi
mov esi, ecx
call fcn.004090b0
or ebp, 0xffffffff
cmp eax, 1
mov dword [esi + 0x6c], eax
mov dword [esi + 0x88], ebp
je 0x409325
xor eax, eax
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop esi
pop ebp
add esp, 0x30
ret
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], 0
call fcn.0041fb70
lea eax, [esi + 0x70]
lea ecx, [esp + 8]
push eax
mov byte [esp + 0x38], 1
call sub.MFC42.DLL_CString::operator_1
push str.iphlpapi.dll
lea ecx, [esp + 0xc]
call fcn.00426a0a
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x1c]
call fcn.0041fbd0
test eax, eax
je 0x409412
lea ecx, [esp + 0x18]
call fcn.0041fcf0
mov edx, dword [eax + 8]
shr edx, 0x10
cmp edx, 5
jne 0x4093d3
cmp word [eax + 8], 0
jne 0x4093d3
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
cmp ecx, 0x6b5
jne 0x4093d3
cmp word [eax + 0xc], 2
jne 0x4093d3
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 0
call fcn.0041fb90
lea ecx, [esp + 8]
mov dword [esp + 0x34], ebp
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop esi
pop ebp
add esp, 0x30
ret
lea edx, [esp + 0xc]
lea ecx, [esp + 0x18]
push edx
call fcn.0041fe50
push str._Export
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 2
call sub.MFC42.DLL_CString::Find
xor ecx, ecx
mov byte [esp + 0x34], 1
test eax, eax
setl cl
dec ecx
mov dword [esi + 0x88], ecx
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
jmp 0x40941c
mov dword [esi + 0x88], 0
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 0
call fcn.0041fb90
mov eax, dword [esi + 0x88]
test eax, eax
jne 0x4094b2
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40944e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4094b2
push str.http:__plugin.inicis.com_repair_iphlpapi.dll
lea ecx, [esp + 0x14]
call fcn.0042687e
push 0
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
mov byte [esp + 0x40], 3
call sub.MFC42.DLL_CString::CString_2
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
mov byte [esp + 0x44], 4
call sub.MFC42.DLL_CString::CString_2
mov ecx, esi
mov byte [esp + 0x40], 3
call fcn.004107f0
test eax, eax
je 0x4094a4
mov dword [esi + 0x88], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x34], ebp
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x2c]
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebp
add esp, 0x30
ret
Function at 0x4094e0
Capabilities:
Delete file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4278d0
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
call fcn.004090b0
cmp eax, 1
mov dword [esi + 0x6c], eax
mov dword [esi + 0x8c], 0xffffffff
je 0x409526
xor eax, eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x38
ret
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_1
lea eax, [esi + 0x70]
xor ebx, ebx
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x40], ebx
call sub.MFC42.DLL_CString::operator_1
push str.Dhcpcsvc.dll
lea ecx, [esp + 0xc]
call fcn.00426a0a
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CFileFind::CFileFind
mov ecx, dword [esp + 8]
push ebx
push ecx
lea ecx, [esp + 0x20]
mov byte [esp + 0x44], 1
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
je 0x4095a2
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], bl
call fcn.00426a64
lea ecx, [esp + 8]
mov dword [esp + 0x3c], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x38
ret
mov edx, dword [esp + 8]
mov dword [esi + 0x8c], ebx
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.http:__plugin.inicis.com_repair_Dhcpcsvc.dll
lea ecx, [esp + 0x10]
call fcn.0042687e
push ebx
push ecx
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
mov byte [esp + 0x48], 2
call sub.MFC42.DLL_CString::CString_2
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
mov byte [esp + 0x4c], 3
call sub.MFC42.DLL_CString::CString_2
mov ecx, esi
mov byte [esp + 0x48], 2
call fcn.004107f0
cmp eax, ebx
je 0x409608
mov dword [esi + 0x8c], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], bl
call fcn.00426a64
lea ecx, [esp + 8]
mov dword [esp + 0x3c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x34]
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x38
ret
Function at 0x409650
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x427900
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString_1
lea eax, [esi + 0x70]
lea ecx, [esp + 4]
push eax
mov dword [esp + 0x3c], 0
call sub.MFC42.DLL_CString::operator_1
push str.msjava.dll
lea ecx, [esp + 8]
call fcn.00426a0a
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CFileFind::CFileFind
mov ecx, dword [esp + 4]
push 0
push ecx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x40], 1
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
je 0x4096ea
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 0
call fcn.00426a64
lea ecx, [esp + 4]
mov dword [esp + 0x38], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop esi
add esp, 0x38
ret
mov edx, dword [esp + 4]
mov dword [esi + 0x90], 0
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.http:__plugin.inicis.com_repair_msjava.dll
lea ecx, [esp + 0xc]
call fcn.0042687e
push 0
push ecx
lea eax, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
mov byte [esp + 0x44], 2
call sub.MFC42.DLL_CString::CString_2
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
mov byte [esp + 0x48], 3
call sub.MFC42.DLL_CString::CString_2
mov ecx, esi
mov byte [esp + 0x44], 2
call fcn.004107f0
test eax, eax
je 0x409755
mov dword [esi + 0x90], 1
lea ecx, [esp + 8]
mov byte [esp + 0x38], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 0
call fcn.00426a64
lea ecx, [esp + 4]
mov dword [esp + 0x38], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x30]
mov eax, 1
mov dword fs:[0], ecx
pop esi
add esp, 0x38
ret
Function at 0x4097a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x1c
lea eax, [esp + 0x14]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
push eax
push 0x20019
push 0
push str.SOFTWARE
push SysReAllocString
call esi
test eax, eax
jne 0x4098f5
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push eax
push str.Microsoft
push edx
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4098ee
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.Windows
push ecx
call esi
test eax, eax
jne 0x4098e7
lea edx, [esp + 0x10]
push edx
push 0x20019
push eax
mov eax, dword [esp + 0x20]
push str.CurrentVersion
push eax
call esi
test eax, eax
jne 0x4098e0
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
push 0x2001f
push eax
push str.Internet_Settings
push edx
call esi
test eax, eax
jne 0x4098d9
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x20]
lea ecx, [esp + 8]
push eax
push ecx
push 0
push 0
mov esi, 4
push str.SyncMode5
push edx
mov dword [esp + 0x20], esi
mov dword [esp + 0x38], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4098d2
mov eax, dword [esp + 8]
test eax, eax
jne 0x4098d2
mov ecx, dword [esp + 0xc]
lea eax, [esp + 8]
push esi
push eax
push esi
push 0
push str.SyncMode5
push ecx
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0xc]
mov esi, edi
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call esi
mov edx, dword [esp + 0x18]
push edx
call esi
mov eax, dword [esp + 0x1c]
push eax
call esi
pop edi
mov eax, 1
pop esi
add esp, 0x1c
ret
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call edi
mov eax, dword [esp + 0x14]
push eax
call edi
mov ecx, dword [esp + 0x18]
push ecx
call edi
mov edx, dword [esp + 0x1c]
push edx
call edi
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret
Function at 0x40b450
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x427b18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebx
push ebp
push esi
mov esi, ecx
push edi
push str.INIcrypto10.dll
lea ecx, [esp + 0x18]
call fcn.0042687e
xor ebp, ebp
push str.INIcrypto20.dll
lea ecx, [esp + 0x1c]
mov dword [esp + 0x64], ebp
call fcn.0042687e
push str.INIcrypto22.dll
lea ecx, [esp + 0x20]
mov byte [esp + 0x64], 1
call fcn.0042687e
push str.Nsldap32v11.dll
lea ecx, [esp + 0x24]
mov byte [esp + 0x64], 2
call fcn.0042687e
push str.INICertMan.dll
lea ecx, [esp + 0x28]
mov byte [esp + 0x64], 3
call fcn.0042687e
lea ecx, [esp + 0x3c]
mov byte [esp + 0x60], 4
mov dword [esp + 0x28], 0x94000
mov dword [esp + 0x2c], 0xace00
mov dword [esp + 0x30], 0xbd000
mov dword [esp + 0x34], 0x12200
mov dword [esp + 0x38], 0xa000
call sub.MFC42.DLL_CFileFind::CFileFind
lea ecx, [esp + 0x10]
mov byte [esp + 0x60], 5
call sub.MFC42.DLL_CString::CString_1
lea edi, [esi + 0x84]
mov byte [esp + 0x60], 6
mov ecx, edi
call sub.MFC42.DLL_CString::Empty
lea ebx, [esi + 0x70]
xor esi, esi
push ebx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator_1
push 0x432860
lea ecx, [esp + 0x14]
call fcn.00426a0a
lea eax, [esp + esi + 0x14]
lea ecx, [esp + 0x10]
push eax
call sub.MFC42.DLL_CString::operator
mov ecx, dword [esp + 0x10]
push 0
push ecx
lea ecx, [esp + 0x44]
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
je 0x40b5c3
lea ecx, [esp + 0x3c]
call sub.MFC42.DLL_CFileFind::FindNextFileA
lea ecx, [esp + 0x3c]
call sub.MFC42.DLL_CFileFind::GetLength
cmp eax, dword [esp + esi + 0x28]
je 0x40b5c3
lea ecx, [esp + 0x3c]
call sub.MFC42.DLL_CFileFind::Close
mov edx, dword [esp + 0x10]
push 0x80
push edx
call dword [sym.imp.MSVCRT.dll__chmod]
mov eax, dword [esp + 0x18]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [edi]
mov eax, dword [ecx - 8]
test eax, eax
je 0x40b5b2
push 0x432a8c
mov ecx, edi
call fcn.00426a0a
lea edx, [esp + 0x10]
mov ecx, edi
push edx
call sub.MFC42.DLL_CString::operator
mov ebp, 1
add esi, 4
cmp esi, 0x14
jl 0x40b524
lea ecx, [esp + 0x10]
mov byte [esp + 0x60], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x3c]
mov byte [esp + 0x60], 4
call fcn.00426a64
lea ecx, [esp + 0x24]
mov byte [esp + 0x60], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x60], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x60], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x60], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov dword [esp + 0x60], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x58]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x54
ret
Function at 0x410650
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x428091
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe8
push 0
lea ecx, [esp + 0xc]
call fcn.00415340
lea ecx, [esp + 4]
mov dword [esp + 0xf0], 0
call sub.MFC42.DLL_CString::CString_1
push 0x104
push 0x104
lea ecx, [esp + 0xc]
mov byte [esp + 0xf8], 1
call sub.MFC42.DLL_CString::GetBuffer
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::ReleaseBuffer
push 0x43286c
lea ecx, [esp + 8]
call fcn.00426a0a
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x41072a
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CDialog::DoModal
mov esi, eax
lea ecx, [esp + 8]
dec esi
mov byte [esp + 0xf4], 0
neg esi
sbb esi, esi
inc esi
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0xf4], 0xffffffff
call fcn.00415460
mov eax, esi
pop esi
mov ecx, dword [esp + 0xe8]
mov dword fs:[0], ecx
add esp, 0xf4
ret
lea ecx, [esp]
call sub.MFC42.DLL_CString::CString_1
push 0x433040
lea ecx, [esp + 4]
mov byte [esp + 0xf4], 2
call fcn.00426980
push 0x432ff0
lea ecx, [esp + 4]
call fcn.00426a0a
push 0x432fac
lea ecx, [esp + 4]
call fcn.00426a0a
push 0x432f54
lea ecx, [esp + 4]
call fcn.00426a0a
push 0x432f38
lea ecx, [esp + 4]
call fcn.00426a0a
mov ecx, dword [esp]
push 0
push 0
push 5
push 0
push ecx
push 0x432efc
push 0x432ed0
call fcn.0041f890
add esp, 0x1c
lea ecx, [esp]
mov byte [esp + 0xf0], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov byte [esp + 0xf0], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0xf0], 0xffffffff
call fcn.00415460
mov ecx, dword [esp + 0xe8]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0xf4
ret
Function at 0x411900
Capabilities:
Check for time delay via gettickcount
Terminate thread

Disassembly:
sub esp, 0x20
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
push esi
test ebx, ebx
push edi
mov dword [esp + 0x10], 0
jl 0x411993
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, ebx
jae 0x41197e
mov ebp, dword [sym.imp.USER32.dll_PeekMessageA]
mov ecx, dword [esp + 0x34]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x41198b
cmp dword [esp + 0x10], 0x103
jne 0x41198b
push 1
push 0
push 0
lea edx, [esp + 0x20]
push 0
push edx
call ebp
test eax, eax
je 0x411976
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
call esi
sub eax, edi
cmp eax, ebx
jb 0x41192f
mov edx, dword [esp + 0x34]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov edi, dword [esp + 0x34]
mov ebx, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebp, dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x10]
push eax
push edi
call ebx
test eax, eax
je 0x41198b
cmp dword [esp + 0x10], 0x103
jne 0x41198b
push 1
push 0
push 0
lea ecx, [esp + 0x20]
push 0
push ecx
call esi
test eax, eax
je 0x4119a9
lea edx, [esp + 0x14]
push edx
call ebp
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x4119a9
Function at 0x4185b0
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4289e1
push eax
mov dword fs:[0], esp
sub esp, 0x114
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.004187e0
test eax, eax
je 0x4187c2
mov ecx, esi
call fcn.004189c0
test eax, eax
je 0x4187c2
mov eax, dword [esi + 0xc]
mov ebp, dword [sym.imp.MSVCRT.dll_atoi]
lea ebx, [esi + 0xc]
push eax
call ebp
lea edi, [esi + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [edi]
push eax
call ebp
mov ecx, dword [esp + 0x20]
add esp, 8
cmp ecx, eax
jle 0x4187bd
mov eax, dword [esi + 0x14]
xor ebp, ebp
test eax, eax
jle 0x418639
mov eax, dword [esi + 0x20]
push 0x43261c
lea ecx, [eax + ebp*8 + 4]
call fcn.00426980
mov eax, dword [esi + 0x14]
inc ebp
cmp ebp, eax
jl 0x418620
lea ecx, [esp + 0x20]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
ja 0x41871c
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x1c]
mov esi, eax
call sub.MFC42.DLL_CString::CString_1
push 0
lea edx, [esp + 0x1c]
push 0
push edx
push 0x400
push esi
push 0
push 0x1300
mov dword [esp + 0x148], 0
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push eax
call fcn.0042687e
lea ecx, [esp + 0x14]
mov byte [esp + 0x12c], 1
call sub.MFC42.DLL_CString::TrimLeft
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::TrimRight
mov ecx, dword [esp + 0x14]
push esi
push ecx
lea edx, [esp + 0x24]
push str._s__d__n_n_
push edx
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x2c]
push 0
push 0
push 1
push 0
push eax
push 0x4339ec
push 0x4339c8
call fcn.0041f890
mov ecx, dword [esp + 0x44]
add esp, 0x2c
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [esp + 0x14]
mov byte [esp + 0x12c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov dword [esp + 0x12c], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
jmp 0x4187c2
lea ecx, [esp + 0x10]
mov byte [esp + eax + 0x20], 0
call sub.MFC42.DLL_CString::CString_1
lea edx, [esp + 0x20]
push 0x432cec
push edx
lea eax, [esp + 0x18]
push 0x4339b4
push eax
mov dword [esp + 0x13c], 2
call sub.MFC42.DLL_CString::Format
add esp, 0x10
mov ecx, edi
push ebx
call sub.MFC42.DLL_CString::operator_1
mov ecx, dword [esp + 0x10]
mov eax, dword [edi]
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push ecx
push eax
push str.total
push str.VERSION
call esi
test eax, eax
jne 0x4187a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4187a9
mov edx, dword [esp + 0x10]
push 0x80
push edx
call dword [sym.imp.MSVCRT.dll__chmod]
mov eax, dword [esp + 0x18]
mov edi, dword [edi]
add esp, 8
push eax
push edi
push str.total
push str.VERSION
call esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x12c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x120
ret
Function at 0x4187e0
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x428a27
push eax
mov dword fs:[0], esp
sub esp, 0x120
lea eax, [esp + 0x1c]
push ebx
push esi
push edi
push 0x104
mov esi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor ebx, ebx
cmp eax, ebx
ja 0x4188da
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x14]
mov esi, eax
call sub.MFC42.DLL_CString::CString_1
push ebx
lea ecx, [esp + 0x1c]
push ebx
push ecx
push 0x400
push esi
push ebx
push 0x1300
mov dword [esp + 0x150], ebx
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push edx
call fcn.0042687e
lea ecx, [esp + 0x10]
mov byte [esp + 0x134], 1
call sub.MFC42.DLL_CString::TrimLeft
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::TrimRight
mov eax, dword [esp + 0x10]
push esi
push eax
lea ecx, [esp + 0x1c]
push str._s__d__n_n_
push ecx
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x24]
push ebx
push ebx
push 1
push ebx
push edx
push 0x4339ec
push 0x4339c8
call fcn.0041f890
mov eax, dword [esp + 0x44]
add esp, 0x2c
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [esp + 0x10]
mov byte [esp + 0x134], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov dword [esp + 0x134], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
jmp 0x4189a8
lea ecx, [esp + 0xc]
mov byte [esp + eax + 0x28], bl
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x28]
push 0x432cec
push ecx
lea edx, [esp + 0x14]
mov ebx, 2
push 0x4339b4
push edx
mov dword [esp + 0x144], ebx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
mov ecx, esp
mov dword [esp + 0x28], esp
push str.total
call fcn.0042687e
push ecx
mov byte [esp + 0x13c], 3
mov ecx, esp
mov dword [esp + 0x28], esp
push str.VERSION
call fcn.0042687e
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
mov byte [esp + 0x144], 4
call sub.MFC42.DLL_CString::CString_2
mov ecx, esi
mov byte [esp + 0x140], bl
call fcn.00418fe0
mov edi, eax
lea ecx, [esi + 0x10]
push edi
call fcn.00426980
push edi
call dword [sym.imp.MSVCRT.dll_free]
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call sub.MFC42.DLL_CString::CString_2
lea eax, [esi + 0x20]
mov ecx, esi
push eax
call fcn.00418d00
lea ecx, [esp + 0xc]
mov dword [esi + 0x14], eax
mov dword [esp + 0x134], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x12c
ret
Function at 0x418fe0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x428b40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x104
push ebx
push esi
push edi
mov edx, dword [esp + 0x128]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x120]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0x128]
push 0x104
push ecx
push 0x437480
push edx
push eax
mov dword [esp + 0x130], 1
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x104
call dword [sym.imp.MSVCRT.dll_malloc]
mov ebx, eax
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x120]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x124]
mov byte [esp + 0x118], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x128]
mov dword [esp + 0x118], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x110]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x110
ret 0xc

Function at 0x419bb0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x6c
lea eax, [esp]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.SystemCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x419c30
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x14]
push str.ProductType
push eax
mov dword [esp + 0x20], 0x64
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x419c25
push edi
lea edi, [esp + 0x10]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x78]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
pop edi
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x6c
ret

Function at 0x419eb0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x8c
lea eax, [esp]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x419f38
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x10]
push edx
push eax
push esi
push str.CSDVersion
push ecx
mov dword [esp + 0x20], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x419f2d
mov eax, dword [esp + 0xc]
cmp eax, 1
jne 0x419f1e
lea edx, [esp + 0x10]
push edx
call fcn.00419e50
add esp, 4
mov esi, eax
jmp 0x419f2d
cmp eax, 4
jne 0x419f2d
xor eax, eax
mov al, byte [esp + 0x11]
movzx si, al
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, si
pop esi
add esp, 0x8c
ret