joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b610
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [esp + 0xe]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
mov edi, dword [esp + 0x28]
push eax
mov esi, dword [esp + 0x28]
push edi
push esi
call fcn.00429400
lea eax, [esp + 0xe]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push edi
push esi
call fcn.00429400
mov eax, dword [esp + 0x10]
push 0xe
mov ax, word [eax + 4]
push eax
call fcn.0042b010
or al, al
jne 0x42b6f3
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.0042be00
mov bx, ax
or bl, bl
jne 0x42b6c2
mov eax, dword [esp + 0x10]
mov ax, word [eax + 0xe]
push eax
mov eax, dword [esp + 0x14]
mov ax, word [eax + 0xc]
push eax
mov eax, dword [esp + 0x18]
mov ax, word [eax + 0xa]
push eax
mov eax, dword [esp + 0x1c]
mov al, byte [eax + 8]
push eax
mov eax, dword [esp + 0x20]
mov ax, word [eax + 6]
push eax
mov eax, dword [esp + 0x24]
mov ax, word [eax + 4]
push eax
mov eax, dword [esp + 0x2c]
push eax
push esi
call fcn.0042bd10
mov bx, ax
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.0042be50
push esi
call fcn.00429510
cmp ax, 0xd
jne 0x42b6d2
mov bx, 0xd
cmp bl, 0xd
je 0x42b6dd
cmp bx, 3
jne 0x42b6f0
mov ax, word [esp + 0xe]
dec word [esp + 0xe]
or ax, ax
jne 0x42b662
mov ax, bx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8

Function at 0x42d490
Capabilities:
Check if file exists

Disassembly:
sub esp, 0xc
push esi
mov byte [esp + 4], 0x52
mov byte [esp + 5], 0x4e
mov byte [esp + 6], 0x42
mov byte [esp + 7], 0x4f
mov byte [esp + 8], 0x44
mov byte [esp + 9], 0x52
mov byte [esp + 0xa], 0x56
mov ax, word [esp + 0x18]
add al, 0x30
mov byte [esp + 0xb], al
mov esi, dword [esp + 0x14]
mov byte [esp + 0xc], 0
mov dword [esi], 0
push 0
push 0x80
push 3
push 0
push 3
lea eax, [esp + 0x18]
push 0xc0000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x42d526
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jb 0x42d503
cmp eax, 3
jbe 0x42d51b
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x42d510
push eax
call sub.KERNEL32.dll_CloseHandle
mov ax, 0x80b
pop esi
add esp, 0xc
ret 8
mov ax, 0x80c
pop esi
add esp, 0xc
ret 8
mov ax, 0x800
pop esi
add esp, 0xc
ret 8

Function at 0x42d540
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 4
push ebx
push esi
push edi
mov esi, dword [esp + 0x18]
push esi
mov word [esi + 6], 0xffff
call fcn.0042d430
lea eax, [esp + 0xc]
push 0
push eax
xor eax, eax
mov ax, word [esi + 2]
push eax
mov edi, dword [esp + 0x20]
push esi
mov eax, dword [edi]
push eax
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
or ebx, ebx
je 0x42d590
lea eax, [esp + 0xc]
push 0
push eax
xor eax, eax
mov ax, word [esi + 2]
push eax
push esi
mov eax, dword [edi]
push eax
call sub.KERNEL32.dll_ReadFile
mov ebx, eax
push esi
call fcn.0042d3f0
or ebx, ebx
je 0x42d5a2
cmp word [esi + 6], 0xffff
jne 0x42d5a8
mov word [esi + 6], 0x83b
mov ax, word [esi + 6]
pop edi
pop esi
pop ebx
add esp, 4
ret 8
Function at 0x42d6d0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x10
push esi
mov al, byte [esp + 0x1c]
push eax
lea eax, [esp + 8]
push eax
call fcn.0042d690
push 0
push 0x80
push 3
push 0
push 3
lea eax, [esp + 0x18]
push 0xc0000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov esi, dword [esp + 0x18]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x42d740
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jb 0x42d719
cmp eax, 3
jbe 0x42d731
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x42d726
push eax
call sub.KERNEL32.dll_CloseHandle
mov ax, 0x20b
pop esi
add esp, 0x10
ret 8
mov ax, 0x20c
pop esi
add esp, 0x10
ret 8
mov ax, 0x200
pop esi
add esp, 0x10
ret 8

Function at 0x42d760
Capabilities:
Read file on windows

Disassembly:
sub esp, 4
push esi
push edi
mov esi, dword [esp + 0x14]
push esi
mov word [esi + 6], 0xffff
call fcn.0042d430
lea eax, [esp + 8]
push 0
push eax
xor eax, eax
mov ax, word [esi + 2]
push eax
mov eax, dword [esp + 0x1c]
push esi
mov eax, dword [eax]
push eax
call sub.KERNEL32.dll_ReadFile
mov edi, eax
push esi
call fcn.0042d3f0
cmp edi, 1
jne 0x42d7a5
cmp word [esi + 6], 0xffff
jne 0x42d7ab
mov word [esi + 6], 0x23b
mov ax, word [esi + 6]
pop edi
pop esi
add esp, 4
ret 8

Function at 0x42d890
Capabilities:
Contain obfuscated stackstrings
Read .ini file

Disassembly:
sub esp, 0x24
mov byte [esp + 8], 0x53
mov byte [esp + 9], 0x59
mov byte [esp + 0xa], 0x53
mov byte [esp + 0xb], 0x54
mov byte [esp + 0xc], 0x45
mov byte [esp + 0xd], 0x4d
mov byte [esp + 0xe], 0x2e
mov byte [esp + 0xf], 0x49
mov byte [esp + 0x10], 0x4e
mov byte [esp + 0x11], 0x49
mov byte [esp + 0x12], 0
mov byte [esp + 0x14], 0x53
mov byte [esp + 0x15], 0x65
mov byte [esp + 0x16], 0x6e
mov byte [esp + 0x17], 0x74
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], 0x6e
mov byte [esp + 0x1a], 0x65
mov byte [esp + 0x1b], 0x6c
mov byte [esp + 0x1c], 0x53
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x74
mov byte [esp + 0x1f], 0x75
mov byte [esp + 0x20], 0x70
mov byte [esp + 0x21], 0
mov byte [esp], 0x49
mov byte [esp + 1], 0x6f
lea eax, [esp + 8]
mov byte [esp + 2], 0x45
mov byte [esp + 3], 0x6e
mov byte [esp + 4], 0x74
mov byte [esp + 5], 0x72
mov byte [esp + 6], 0x79
mov byte [esp + 7], 0
push eax
lea eax, [esp + 4]
push 0
push eax
lea eax, [esp + 0x20]
push eax
call sub.KERNEL32.dll_GetPrivateProfileIntA
add esp, 0x24
ret
Function at 0x433470
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x518ccc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
mov ecx, dword [ebp + 8]
mov byte [ebp - 0x34], 0
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], fcn.00433998
mov dword [ebp - 0x28], 1
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 4], 1
push ecx
push dword [0x55d3e0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
test eax, eax
je 0x43352e
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 6
movzx eax, byte [ebp - 0x34]
test eax, eax
jne 0x433503
mov dword [ebp - 4], 7
push dword [ebp - 0x2c]
call dword [ebp - 0x30]
pop ecx
mov eax, dword [ebp - 0x20]
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.0043aa20
test eax, eax
je 0x43358c
push 0
push str.Can_not_start_thread:_error_writing_TLS.
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
push eax
call fcn.0043f5e4
pop ecx
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 2
movzx eax, byte [ebp - 0x34]
test eax, eax
jne 0x433570
mov dword [ebp - 4], 3
push dword [ebp - 0x2c]
call dword [ebp - 0x30]
pop ecx
mov eax, 0xffffffff
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov eax, str.Can_not_start_thread:_error_writing_TLS.
jmp 0x433545

Function at 0x43380c
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x10]
push eax
push 4
push dword [esp + 0x10]
push 0x433350
push dword [esp + 0x1c]
push 0
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 4], eax
test eax, eax
je 0x43384d
mov eax, dword [esi + 0xc]
cmp eax, 0x32
je 0x433844
push eax
mov ecx, esi
call fcn.004332d4
mov eax, 1
pop esi
ret 8
call fcn.0043aa20
test eax, eax
je 0x433871
push 0
push str.Cant_create_thread
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
push eax
call fcn.0043f5e4
xor eax, eax
pop ecx
pop esi
ret 8
mov eax, str.Cant_create_thread
jmp 0x433864

Function at 0x433930
Capabilities:
Resume thread

Disassembly:
push edi
mov edi, ecx
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x433957
mov eax, dword [edi + 8]
cmp eax, 4
je 0x433950
mov dword [edi + 8], 1
mov eax, 1
pop edi
ret
call fcn.0043aa20
test eax, eax
je 0x43397e
push 0
push str.Can_not_resume_thread__x
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
push dword [edi + 4]
push eax
call fcn.0043f5e4
xor eax, eax
add esp, 8
pop edi
ret
mov eax, str.Can_not_resume_thread__x
jmp 0x43396e
Function at 0x433bc4
Capabilities:
Terminate thread

Disassembly:
push edi
mov edi, ecx
push 0xffffffffffffffff
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x433bef
mov eax, dword [edi + 4]
test eax, eax
je 0x433beb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 4], 0
xor eax, eax
pop edi
ret
call fcn.0043aa20
test eax, eax
je 0x433c14
push 0
push str.Couldnt_terminate_thread
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
push eax
call fcn.0043f5e4
mov eax, 5
pop ecx
pop edi
ret
mov eax, str.Couldnt_terminate_thread
jmp 0x433c06
Function at 0x443034
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x44304b
test al, 0x10
jne 0x44304b
mov eax, 1
ret
xor eax, eax
ret

Function at 0x443c44
Capabilities:
Move file

Disassembly:
push edi
push esi
push ebp
sub esp, 0xc
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
movzx ebp, byte [esp + 0x24]
test ebp, ebp
jne 0x443c69
mov eax, esi
call fcn.00443034
movzx eax, al
test eax, eax
jne 0x443cab
push dword [esi]
push dword [edi]
call dword [sym.imp.MSVCR80.dll_rename]
add esp, 8
test eax, eax
jne 0x443c86
mov eax, 1
add esp, 0xc
pop ebp
pop esi
pop edi
ret
mov eax, edi
mov edx, esi
mov ecx, ebp
call fcn.00443ced
movzx eax, al
test eax, eax
je 0x443ccf
mov eax, edi
call fcn.00443d48
mov eax, 1
add esp, 0xc
pop ebp
pop esi
pop edi
ret
call fcn.0043aa20
test eax, eax
je 0x443cd8
push 0
push str.Failed_to_rename_the_file__s_to__s_because_the_destination_file_already_exists.
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
push dword [esi]
push dword [edi]
push eax
call fcn.0043f5e4
add esp, 0xc
xor eax, eax
add esp, 0xc
pop ebp
pop esi
pop edi
ret
mov eax, str.Failed_to_rename_the_file__s_to__s_because_the_destination_file_already_exists.
jmp 0x443cc2

Function at 0x443ced
Capabilities:
Copy file

Disassembly:
push edi
push ebx
mov ebx, edx
mov edi, eax
movzx ecx, cl
xor eax, eax
test ecx, ecx
sete al
push eax
push dword [ebx]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x443d14
mov eax, 1
pop ebx
pop edi
ret
call fcn.0043aa20
test eax, eax
je 0x443d3d
push 0
push str.Failed_to_copy_the_file__s_to__s
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
push dword [ebx]
push dword [edi]
push eax
call fcn.0043f5e4
xor eax, eax
add esp, 0xc
pop ebx
pop edi
ret
mov eax, str.Failed_to_copy_the_file__s_to__s
jmp 0x443d2b
Function at 0x44adc8
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51c962
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov eax, dword [0x55d358]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
lea eax, [ebp + 0x10]
push eax
lea ecx, [ebp - 0x24]
push dword [ebp + 0xc]
call fcn.0042f638
push 1
push 0x546140
lea ecx, [ebp - 0x24]
push 0x54613c
call fcn.004302c0
push 1
push 0x54614c
lea ecx, [ebp - 0x24]
push 0x5428bc
call fcn.004302c0
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x24]
mov eax, dword [edx - 0xc]
lea ecx, [edx - 0xc]
cmp eax, 0xffffffff
je 0x44ae70
add eax, 0xffffffff
mov dword [edx - 0xc], eax
jne 0x44ae70
push ecx
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x44c048
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
movsx eax, byte [edx]
test eax, eax
je 0x44c081
xor ecx, ecx
add eax, ecx
add edx, 1
mov ecx, eax
shl ecx, 0xa
add eax, ecx
mov ecx, eax
shr ecx, 6
xor ecx, eax
movsx eax, byte [edx]
test eax, eax
jne 0x44c055
lea eax, [ecx + ecx*8]
mov edx, eax
shr edx, 0xb
xor eax, edx
mov ecx, eax
shl ecx, 0xf
add eax, ecx
ret
xor ecx, ecx
jmp 0x44c06f

Function at 0x44c288
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, ecx
mov eax, dword [esp + 8]
test eax, eax
je 0x44c2b2
mov edx, dword [edi]
cmp edx, 0xffffffff
je 0x44c2b2
push dword [esp + 0xc]
push eax
push edx
call dword [sym.imp.MSVCR80.dll__read]
add esp, 0xc
cmp eax, 0xffffffff
je 0x44c2b8
pop edi
ret 8
xor eax, eax
pop edi
ret 8
call fcn.0043aa20
test eax, eax
je 0x44c2e3
push 0
push str.cant_read_from_file_descriptor__d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
push dword [edi]
push eax
call fcn.0043f5e4
mov eax, 0xffffffff
add esp, 8
pop edi
ret 8
mov eax, str.cant_read_from_file_descriptor__d
jmp 0x44c2cf

Function at 0x44c544
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, ecx
lea ecx, [ebp + 8]
call fcn.0044c36c
push dword [ebp]
call fcn.0044c4a4
pop ecx
movzx eax, al
test eax, eax
je 0x44c56d
push dword [ebp]
call dword [sym.imp.MSVCR80.dll_remove]
pop ecx
test eax, eax
jne 0x44c58a
push 1
push ebp
lea eax, [ebp + 4]
push eax
call fcn.00443c44
add esp, 0xc
movzx eax, al
test eax, eax
je 0x44c5b8
mov eax, 1
pop ebp
ret
call fcn.0043aa20
test eax, eax
je 0x44c5b1
push 0
push str.cant_remove_file__s
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
push dword [ebp]
push eax
call fcn.0043f5e4
xor eax, eax
add esp, 8
pop ebp
ret
mov eax, str.cant_remove_file__s
jmp 0x44c5a1
call fcn.0043aa20
test eax, eax
je 0x44c5df
push 0
push str.cant_commit_changes_to_file__s
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
push dword [ebp]
push eax
call fcn.0043f5e4
xor eax, eax
add esp, 8
pop ebp
ret
mov eax, str.cant_commit_changes_to_file__s
jmp 0x44c5cf
Function at 0x44c6c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, ecx
lea ecx, [ebp + 8]
call fcn.0044c36c
push dword [ebp + 4]
call dword [sym.imp.MSVCR80.dll_remove]
pop ecx
test eax, eax
jne 0x44c6db
pop ebp
ret
call fcn.0043aa20
test eax, eax
je 0x44c700
push 0
push str.cant_remove_temporary_file__s
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
push dword [ebp + 4]
push eax
call fcn.0043f5e4
add esp, 8
pop ebp
ret
mov eax, str.cant_remove_temporary_file__s
jmp 0x44c6f2
Function at 0x455640
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51e122
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
lea edx, [ebp + 0x10]
lea ecx, [ebp - 0x2c]
push edx
push dword [ebp + 0xc]
push ecx
call fcn.0042fa8c
add esp, 0xc
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x28]
push 0
push eax
push dword [edx - 8]
push edx
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx - 0xc]
lea ecx, [edx - 0xc]
cmp eax, 0xffffffff
je 0x4556d1
add eax, 0xffffffff
mov dword [edx - 0xc], eax
jne 0x4556d1
push ecx
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x45b32c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51ef94
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
mov eax, ecx
mov dword [ebp - 0x20], eax
mov dword [eax], 0x593844
mov dword [ebp - 4], 0
push 1
mov ecx, dword [eax + 0x18]
mov ebx, dword [eax + 0x20]
mov esi, dword [ebx + 8]
mov edx, dword [ecx]
sub esi, dword [ebx + 0xc]
xor edi, edi
xor eax, eax
sub eax, esi
sbb edi, 0
push edi
push eax
call dword [edx + 0x30]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x20]
test ecx, ecx
je 0x45b396
push 1
mov eax, dword [ecx]
call dword [eax]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
mov ecx, eax
call fcn.0045b3bc
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x45fb38
Capabilities:
Write file on windows

Disassembly:
push edi
push ebp
mov edi, ecx
mov edx, dword [esp + 0xc]
test edx, edx
je 0x45fb4a
mov eax, dword [edi]
test eax, eax
jne 0x45fb51
xor eax, eax
pop ebp
pop edi
ret 8
push eax
mov eax, dword [esp + 0x14]
push eax
push 1
push edx
call dword [sym.imp.MSVCR80.dll_fwrite]
add esp, 0x10
mov ebp, eax
mov eax, dword [esp + 0x10]
cmp ebp, eax
jb 0x45fb74
mov eax, ebp
pop ebp
pop edi
ret 8
call fcn.0043aa20
test eax, eax
je 0x45fb99
push 0
push str.Write_error_on_file__s
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
push dword [edi + 4]
push eax
call fcn.0043f5e4
add esp, 8
jmp 0x45fb6d
mov eax, str.Write_error_on_file__s
jmp 0x45fb8b
Function at 0x45fc18
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51fbfe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
test eax, eax
je 0x45fd34
mov eax, ecx
mov edx, dword [eax]
test edx, edx
jne 0x45fc67
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
call fcn.0045fe04
sub edx, 0
jl 0x45fd34
mov ecx, dword [ebp - 0x14]
call fcn.0045fe04
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x14]
call fcn.0045fe04
sub eax, dword [ebp - 0x24]
or eax, edx
je 0x45fca1
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x14]
push dword [eax]
call dword [sym.imp.MSVCR80.dll_clearerr]
mov eax, dword [ebp - 0x24]
lea edx, [eax + 2]
push edx
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 8
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x2c], eax
mov byte [eax + edx + 1], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
push dword [eax]
push edx
push 1
push dword [ebp - 0x2c]
call dword [sym.imp.MSVCR80.dll_fread]
mov ebx, eax
mov eax, dword [ebp - 0x14]
push dword [eax]
call dword [sym.imp.MSVCR80.dll_ferror]
add esp, 0x14
test eax, eax
je 0x45fd49
call fcn.0043aa20
test eax, eax
je 0x45fdf9
push 0
push str.Read_error_on_file__s
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
mov edx, dword [ebp - 0x14]
push dword [edx + 4]
push eax
call fcn.0043f5e4
push dword [ebp - 0x2c]
mov dword [ebp - 0x28], 0
call dword [sym.imp.MSVCR80.dll_free]
add esp, 0xc
mov ebx, dword [ebp - 0x18]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x2c]
mov byte [eax + ebx], 0
mov ecx, dword [ebp - 0x2c]
mov eax, dword [0x543670]
test ecx, ecx
je 0x45fd77
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x45fd75
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x45fd5e
add eax, 0xffffffff
jmp 0x45fd79
xor eax, eax
push eax
push 0
push ecx
lea ecx, [ebp - 0x34]
call fcn.00431a04
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x34]
push eax
call fcn.00430810
lea eax, [ebp - 0x34]
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 2
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x34]
mov eax, dword [edx - 0xc]
lea ecx, [edx - 0xc]
cmp eax, 0xffffffff
je 0x45fdca
add eax, 0xffffffff
mov dword [edx - 0xc], eax
jne 0x45fdca
push ecx
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x2c]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
mov eax, str.Read_error_on_file__s
jmp 0x45fd15
Function at 0x463208
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5207c2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
push 0
call fcn.00462ed8
movzx eax, al
test eax, eax
je 0x46330c
mov dword [ebp - 0x28], 4
test ebx, ebx
je 0x463259
movsx eax, byte [ebx]
test eax, eax
jne 0x463260
mov eax, 1
jmp 0x463262
xor eax, eax
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x24]
test eax, eax
lea eax, [ebp - 0x28]
je 0x463274
mov ebx, 0
push eax
push dword [ebp + 0xc]
push edx
push 0
push ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x10], eax
test eax, eax
je 0x463321
call fcn.0043aa20
test eax, eax
je 0x463339
push 0
push str.Cant_read_value_of_key__s
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x34]
push 1
push eax
call fcn.0046311c
mov dword [ebp - 4], 0
push dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x14]
push eax
push dword [edx + 0x10]
call fcn.0043f61c
add esp, 0xc
lea eax, [ebp - 0x34]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 1
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x34]
mov eax, dword [edx - 0xc]
lea ecx, [edx - 0xc]
cmp eax, 0xffffffff
je 0x46330c
add eax, 0xffffffff
mov dword [edx - 0xc], eax
jne 0x46330c
push ecx
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
mov ebx, dword [ebp - 0x18]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [ebp - 0x18]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
mov eax, str.Cant_read_value_of_key__s
mov dword [ebp - 0x30], eax
jmp 0x4632b0
Function at 0x4638f4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5208b2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
push 0
call fcn.00462ed8
movzx eax, al
test eax, eax
jne 0x463944
mov ebx, dword [ebp - 0x18]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
test ebx, ebx
je 0x46394f
movsx eax, byte [ebx]
test eax, eax
jne 0x463956
mov eax, 1
jmp 0x463958
xor eax, eax
mov ecx, dword [ebp - 0x14]
xor edx, edx
push edx
test eax, eax
lea eax, [ebp - 0x24]
push edx
push eax
je 0x46396c
mov ebx, 0
push edx
push ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x10], eax
test eax, eax
je 0x463a13
call fcn.0043aa20
test eax, eax
je 0x463a29
push 0
push str.Cant_read_value_of_key__s
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x30]
push 1
push eax
call fcn.0046311c
mov dword [ebp - 4], 0
push dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x14]
push eax
push dword [edx + 0x10]
call fcn.0043f61c
add esp, 0xc
lea eax, [ebp - 0x30]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 1
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x30]
mov eax, dword [edx - 0xc]
lea ecx, [edx - 0xc]
cmp eax, 0xffffffff
je 0x4639fe
add eax, 0xffffffff
mov dword [edx - 0xc], eax
jne 0x4639fe
push ecx
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
mov ebx, dword [ebp - 0x18]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov eax, str.Cant_read_value_of_key__s
mov dword [ebp - 0x2c], eax
jmp 0x4639a2