joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455326
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push edi
test esi, esi
jne 0x45533f
call fcn.00408a65
mov esi, dword [eax + 0xc]
push 0x59b1a8
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x455381
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x455381
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x455381
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.0045538a
jmp 0x455383
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x47020b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ecx
mov ecx, 0x104
mov eax, dword [esi + 4]
cmp eax, ecx
ja 0x47039e
je 0x4703c4
cmp eax, 0xa1
jb 0x470402
cmp eax, 0xa2
jbe 0x4703c4
cmp eax, 0xa3
jbe 0x470402
cmp eax, 0xa5
jbe 0x4703c4
cmp eax, 0xa6
jbe 0x470402
cmp eax, 0xa8
jbe 0x4703c4
cmp eax, 0x100
jne 0x470402
cmp dword [edi + 0xc0], 0xffffffff
je 0x4703c4
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x4703c4
mov eax, dword [esi + 8]
sub eax, 0x21
je 0x4702f3
sub eax, 1
jne 0x4703c4
mov eax, dword [edi + 0xc0]
lea ebx, [eax + 1]
jmp 0x4702e2
mov eax, ebx
cdq
idiv ecx
mov eax, dword [edi]
mov ecx, edx
mov dword [ebp - 4], ecx
push ecx
mov esi, dword [eax + 0x27c]
mov ecx, esi
call dword [0x590a2c]
mov ecx, edi
call esi
test eax, eax
jne 0x47033f
mov eax, dword [edi + 0xc0]
inc ebx
mov ecx, dword [edi + 0xbc]
add eax, ecx
cmp ebx, eax
jl 0x4702b8
jmp 0x47041c
mov ecx, dword [edi + 0xc0]
lea ebx, [ecx - 1]
add ebx, dword [edi + 0xbc]
cmp ebx, ecx
jle 0x47041c
mov eax, ebx
cdq
idiv dword [edi + 0xbc]
mov eax, dword [edi]
mov ecx, edx
mov dword [ebp - 4], ecx
push ecx
mov esi, dword [eax + 0x27c]
mov ecx, esi
call dword [0x590a2c]
mov ecx, edi
call esi
test eax, eax
jne 0x47033f
dec ebx
cmp ebx, dword [edi + 0xc0]
jg 0x47030a
jmp 0x47041c
mov eax, dword [edi]
push dword [ebp - 4]
mov dword [edi + 0x24c], 1
mov esi, dword [eax + 0x214]
mov ecx, esi
call dword [0x590a2c]
mov ecx, edi
call esi
mov eax, dword [edi]
mov esi, dword [eax + 0x210]
mov ecx, esi
call dword [0x590a2c]
mov ecx, edi
call esi
mov ecx, eax
call fcn.004092fe
mov eax, dword [edi]
push dword [edi + 0xc0]
mov esi, dword [eax + 0x270]
mov ecx, esi
call dword [0x590a2c]
mov ecx, edi
call esi
and dword [edi + 0x24c], 0
jmp 0x47041c
cmp eax, 0x200
jb 0x470402
cmp eax, 0x202
jbe 0x4703c4
cmp eax, 0x203
jbe 0x470402
cmp eax, 0x205
jbe 0x4703c4
add eax, 0xfffffdf9
cmp eax, 1
ja 0x470402
mov eax, dword [edi + 0xfc]
test eax, eax
je 0x4703e3
cmp dword [eax + 0x20], ebx
je 0x4703e3
push esi
push ebx
push 0x407
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0xf8]
test eax, eax
je 0x470402
cmp dword [eax + 0x20], ebx
je 0x470402
push esi
push ebx
push 0x407
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esi + 4], 0x203
jne 0x470421
lea eax, [edi + 0x2250]
test eax, eax
je 0x470418
mov ebx, dword [eax + 0x20]
cmp dword [esi], ebx
jne 0x470421
xor eax, eax
inc eax
jmp 0x470429
push esi
mov ecx, edi
call fcn.004682e4
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4740df
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x5ebfc4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [esi - 0x60]
cmp eax, 9
ja 0x47410e
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x47413b
cmp dword [0x5f2774], 0
jne 0x47413b
lea eax, [esi - 0x41]
cmp eax, 0x19
jbe 0x474137
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x474137
push esi
call fcn.0054df40
pop ecx
jmp 0x4741ae
mov eax, esi
jmp 0x4741ae
push 4
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.0053eae0
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x4741be
call fcn.004163f5
push dword [eax + 0x30]
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 1
push 2
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push esi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
xor eax, eax
mov word [ebp - 0x106], ax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
movzx eax, word [ebp - 0x108]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0053c0f2
leave
ret 4
call fcn.00406d90
int3

Function at 0x49c2fa
Capabilities:
Get file system object information

Disassembly:
push 0x4cc
mov eax, 0x586971
call fcn.0053c7d0
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00401f10
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x4d0], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x4d0]
push 0
push 0x5914c8
call fcn.00405520
cmp eax, 0xffffffff
jne 0x49c3d4
push 0
push 0x59b164
lea ecx, [ebp - 0x4d0]
call fcn.00405520
cmp eax, 0xffffffff
jne 0x49c3d4
push 0
push 0x59397c
lea ecx, [ebp - 0x4d0]
call fcn.00405520
cmp eax, 0xffffffff
jne 0x49c3d4
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00401f10
mov edi, eax
pop ecx
mov dword [ebp - 0x4d4], edi
lea ecx, [edi + 0x10]
mov dword [ebp - 0x4d8], ecx
xor edx, edx
mov byte [ebp - 4], 1
push edx
lea eax, [ebp - 0x218]
push eax
push 0x104
push edx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x49c3a3
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x590a2c]
mov ecx, ebx
call edi
mov ecx, dword [ebp - 0x4d4]
mov edi, eax
call fcn.004029d0
jmp 0x49c40d
lea eax, [ebp - 0x218]
push eax
call fcn.00543ea5
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4d0]
call fcn.00402430
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.004029d0
mov esi, dword [ebp - 0x4d0]
push 0x105
push 0x2b4
lea eax, [ebp - 0x4cc]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x49c3fa
mov edi, dword [ebp - 0x4cc]
jmp 0x49c40d
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x590a2c]
mov ecx, ebx
call edi
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.004029d0
mov eax, edi
call fcn.0053c77a
ret
Function at 0x4c3b2b
Capabilities:
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x5ebfc4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0x230
xor edi, edi
push edi
push esi
call fcn.0053eae0
push 0xffffffffffffffff
push dword [ebx + 0xc]
lea eax, [esi + 0x24]
push 0x104
push eax
call fcn.0054975a
push eax
call fcn.00402a20
mov eax, dword [ebx + 4]
add esp, 0x20
cmp eax, dword [0x596c68]
je 0x4c3c95
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x4c3ca9
lea eax, [ebp - 0x30]
push eax
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x4c3ca9
mov eax, dword [ebp - 0x30]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x2c]
mov dword [esi + 0x1c], eax
mov eax, dword [ebx + 0xc]
cmp dword [eax - 0xc], edi
jne 0x4c3bc4
mov eax, edi
jmp 0x4c3bf3
mov ecx, dword [ebx + 0x10]
test ecx, ecx
je 0x4c3be1
lea edx, [ebp - 0x28]
push edx
push edi
push eax
call fcn.004c3926
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0x28]
jmp 0x4c3bea
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
lea eax, [ecx + 1]
neg eax
sbb eax, eax
and eax, ecx
mov dword [esi + 0x20], eax
lea eax, [ebp - 0x38]
push eax
call fcn.004c3dec
test eax, eax
je 0x4c3c18
push 0xffffffffffffffff
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x50]
call fcn.004c37b2
mov ecx, dword [eax]
mov eax, dword [eax + 4]
jmp 0x4c3c1c
mov ecx, edi
mov eax, edi
mov dword [esi], ecx
mov dword [esi + 4], eax
lea eax, [ebp - 0x40]
push eax
call fcn.004c3dec
test eax, eax
je 0x4c3c43
push 0xffffffffffffffff
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x50]
call fcn.004c37b2
mov ecx, dword [eax]
mov eax, dword [eax + 4]
jmp 0x4c3c47
mov ecx, edi
mov eax, edi
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x48]
push eax
call fcn.004c3dec
test eax, eax
je 0x4c3c6f
push 0xffffffffffffffff
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x50]
call fcn.004c37b2
mov edi, dword [eax]
mov ecx, dword [eax + 4]
jmp 0x4c3c71
mov ecx, edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov eax, dword [esi]
or eax, dword [esi + 4]
jne 0x4c3c83
mov dword [esi], edi
mov dword [esi + 4], ecx
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
jne 0x4c3c95
mov eax, edi
mov dword [esi + 0x10], eax
mov eax, ecx
mov dword [esi + 0x14], eax
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053c0f2
leave
ret 4
xor eax, eax
jmp 0x4c3c98
Function at 0x4c5def
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5ebfc4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
je 0x4c5ed2
cmp dword [ebp + 0xc], 0
je 0x4c5ed2
xor edi, edi
call fcn.00408a65
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4c5ed2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4c5ed2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x4c5ee8
push ebx
call fcn.00549770
pop ecx
lea edx, [eax + 1]
lea eax, [edx + edx]
mov dword [ebp - 8], edx
lea ecx, [eax + 8]
cmp eax, ecx
sbb eax, eax
and eax, ecx
je 0x4c5ea9
cmp eax, 0x400
ja 0x4c5e8e
call fcn.0053ce50
mov esi, esp
test esi, esi
je 0x4c5ea4
mov dword [esi], 0xcccc
jmp 0x4c5ea1
push eax
call fcn.005415b0
mov esi, eax
pop ecx
test esi, esi
je 0x4c5ea4
mov dword [esi], 0xdddd
add esi, 8
mov edx, dword [ebp - 8]
jmp 0x4c5eab
mov esi, edi
test esi, esi
je 0x4c5ee8
push edx
push ebx
push esi
call fcn.0040725a
test eax, eax
je 0x4c5ec7
mov ecx, dword [ebp - 0xc]
push eax
call fcn.004c776a
xor edi, edi
inc edi
push esi
call fcn.004c7786
pop ecx
mov eax, edi
jmp 0x4c5ed4
xor eax, eax
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053c0f2
leave
ret 8
call fcn.00406d90
int3

Function at 0x4eeeea
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 4], esi
push edi
test ebx, ebx
je 0x4eef9e
mov eax, dword [esi + 0x34c]
test eax, eax
je 0x4eef9a
mov eax, dword [eax + 0x20]
test eax, eax
je 0x4eef9a
cmp dword [ebx], eax
jne 0x4eef9a
mov eax, dword [ebx + 4]
sub eax, 1
je 0x4eef69
sub eax, 1
je 0x4eef37
sub eax, 1
jne 0x4eef9a
mov edi, 0x428e
jmp 0x4eef6e
push 0x11
mov edi, 0x3ea1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x4eef6e
mov eax, dword [esi]
mov esi, dword [eax + 0x340]
mov ecx, esi
call dword [0x590a2c]
mov ecx, dword [ebp - 4]
call esi
test eax, eax
je 0x4eef6e
add edi, 3
jmp 0x4eef6e
mov edi, 0x3ea0
push edi
call fcn.00407445
test eax, eax
je 0x4eef9e
push edi
push eax
mov ecx, 0x5f3d44
call fcn.004020a0
test eax, eax
je 0x4eef9e
mov eax, dword [0x5f3d44]
mov dword [ebx + 0xc], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
xor eax, eax
jmp 0x4eef93
call fcn.00406d90
int3
Function at 0x4f8d9d
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.0054e529
pop ecx
test eax, eax
jne 0x4f8ddf
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0041766a
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4f8da5
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
leave
ret
Function at 0x55757e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00557220
Function at 0x562740
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58cb26
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5ebfc4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
push dword [ebp + 8]
push 0x84
call fcn.00562ee0
lea esi, [ebx + 0x388]
mov dword [ebp - 4], 0
mov ecx, esi
mov dword [ebx], vtable.CCommentDlg.0
mov dword [ebp - 0x10], esi
call fcn.0040956f
mov dword [esi], vtable.CEditEx.0
mov dword [esi + 0x84], 0
mov dword [esi + 0x80], vtable.CFont.0
mov esi, dword [ebp + 8]
mov byte [ebp - 4], 1
mov edi, dword [ebx + 0xd4]
sub edi, 0x10
mov ecx, dword [esi + 0xd4]
lea eax, [ecx - 0x10]
mov dword [ebp - 0x10], eax
cmp eax, edi
je 0x56280e
cmp dword [edi + 0xc], 0
jl 0x5627ff
mov eax, dword [eax]
cmp eax, dword [edi]
jne 0x5627ff
push dword [ebp - 0x10]
call fcn.00401f10
add esp, 4
mov ecx, edi
mov esi, eax
call fcn.004029d0
lea eax, [esi + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebx + 0xd4], eax
jmp 0x56280e
push dword [ecx - 0xc]
push ecx
lea ecx, [ebx + 0xd4]
call fcn.00402430
mov ecx, dword [esi + 0xd8]
mov edi, dword [ebx + 0xd8]
sub edi, 0x10
lea eax, [ecx - 0x10]
mov dword [ebp - 0x10], eax
cmp eax, edi
je 0x562864
cmp dword [edi + 0xc], 0
jl 0x562855
mov eax, dword [eax]
cmp eax, dword [edi]
jne 0x562855
push dword [ebp - 0x10]
call fcn.00401f10
add esp, 4
mov ecx, edi
mov esi, eax
call fcn.004029d0
lea eax, [esi + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebx + 0xd8], eax
jmp 0x562864
push dword [ecx - 0xc]
push ecx
lea ecx, [ebx + 0xd8]
call fcn.00402430
lea eax, [esi + 0xf8]
push eax
push 0
push 0x5c6fdc
push 0x5c6ff0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebx + 0x308], eax
mov eax, dword [esi + 0x568]
mov dword [ebx + 0x380], eax
mov ecx, dword [esi + 0xd0]
mov edi, dword [ebx + 0xd0]
sub edi, 0x10
lea eax, [ecx - 0x10]
mov dword [ebp - 0x10], eax
cmp eax, edi
je 0x5628e5
cmp dword [edi + 0xc], 0
jl 0x5628d6
mov eax, dword [eax]
cmp eax, dword [edi]
jne 0x5628d6
push dword [ebp - 0x10]
call fcn.00401f10
add esp, 4
mov ecx, edi
mov esi, eax
call fcn.004029d0
lea eax, [esi + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebx + 0xd0], eax
jmp 0x5628e5
push dword [ecx - 0xc]
push ecx
lea ecx, [ebx + 0xd0]
call fcn.00402430
mov eax, dword [esi + 0x558]
mov dword [ebx + 0x384], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5641b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58cd73
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5ebfc4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 1
push 0
push 0
mov dword [ebp - 4], 0
push dword [ebp + 8]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x5c2c4c
push 0
call esi
cmp eax, 0x20
jg 0x564273
push 1
push 0
push dword [ebp + 8]
push str.iexplore.exe
push 0x5c2c74
push 0
call esi
cmp eax, 0x20
jg 0x564273
call fcn.00407271
mov ecx, eax
test ecx, ecx
je 0x5642da
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, 0x5940e4
jne 0x5642e4
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x10]
push dword [ebp + 8]
push str.url.dll_FileProtocolHandler__s
push eax
call fcn.00404950
add esp, 0xc
push 1
push 0
push dword [ebp - 0x10]
push str.rundll32.exe
push str.open
push 0
call esi
lea ecx, [ebp - 0x10]
call fcn.00402930
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x5642c8
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, 0x5940e4
jne 0x5642eb
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x5642eb
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00402ab0
call edx
jmp 0x564238
mov ecx, edx
call esi
jmp 0x5642c8

Function at 0x565170
Capabilities:
Delete directory
Delete file

Disassembly:
push edi
push dword [0x5f4d28]
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [0x5f4d2c]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, dword fs:[0x2c]
mov edx, dword [eax]
mov eax, dword [0x5f4e70]
cmp eax, dword [edx + 4]
jg 0x56521c
push 0
push 0x5c2fa8
mov ecx, 0x5f4e74
call fcn.00402430
mov eax, dword [edi + 0x55c]
mov ecx, str._0Fill_
cmp eax, 1
je 0x5651c6
mov ecx, 0x5c2fbc
dec eax
neg eax
sbb eax, eax
and eax, 0xfffffff9
add eax, 7
push eax
push ecx
mov ecx, 0x5f4e74
call fcn.00402430
push 0x5f4e74
push 0
push 0x402
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0
push 0x403
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [edi + 0x414], 0
xor eax, eax
mov dword [edi + 0x410], 0
pop edi
ret
push 0x5f4e70
call fcn.0053c212
add esp, 4
cmp dword [0x5f4e70], 0xffffffff
jne 0x5651a0
call fcn.00407271
test eax, eax
jne 0x565249
push 0x80004005
call fcn.00402ab0
mov edx, dword [eax]
cmp edx, 0x5940e4
jne 0x56525c
lock inc dword [eax + 0x14]
add eax, 8
jmp 0x565263
mov ecx, eax
call dword [edx + 0xc]
jmp 0x565263
add eax, 0x10
push 0x58ea70
mov dword [0x5f4e74], eax
call fcn.0053c524
push 0x5f4e70
call fcn.0053c1c8
add esp, 8
jmp 0x5651a0
Function at 0x56ef50
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
call fcn.00407271
test eax, eax
je 0x56f1e5
mov edx, dword [eax]
cmp edx, 0x5940e4
jne 0x56f1ef
lock inc dword [eax + 0x14]
add eax, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push edi
lea edi, [esi + 0xf8]
mov dword [ebp - 4], eax
push edi
push 1
push 0x5c4034
push 0x5c4054
call ebx
mov dword [esi + 0x510], eax
test eax, eax
jle 0x56efa8
cmp eax, 8
jle 0x56efb2
mov dword [esi + 0x510], 1
push edi
push 8
push 0x5c4064
push 0x5c4088
call ebx
mov dword [esi + 0x514], eax
test eax, eax
jle 0x56efd2
cmp eax, 0x200
jle 0x56efdc
mov dword [esi + 0x514], 8
push edi
push 1
push 0x5c4098
push 0x5c40c0
call ebx
mov dword [esi + 0x518], eax
test eax, eax
jle 0x56effa
cmp eax, 0x40
jle 0x56f004
mov dword [esi + 0x518], 1
push edi
push 1
push 0x5c40d0
push 0x5c40f0
call ebx
mov dword [esi + 0x51c], eax
test eax, eax
jle 0x56f022
cmp eax, 8
jle 0x56f02c
mov dword [esi + 0x51c], 1
push edi
push 1
push 0x5c4100
push 0x5c4124
call ebx
mov dword [esi + 0x520], eax
test eax, eax
jle 0x56f04c
cmp eax, 0x200
jle 0x56f056
mov dword [esi + 0x520], 1
push edi
push 1
push 0x5c4134
push 0x5c415c
call ebx
mov dword [esi + 0x524], eax
test eax, eax
jle 0x56f074
cmp eax, 0x40
jle 0x56f07e
mov dword [esi + 0x524], 1
push edi
push 4
push 0x5c416c
push 0x5c4184
call ebx
mov dword [esi + 0x528], eax
cmp eax, 4
jl 0x56f09f
cmp eax, 0x200
jle 0x56f0a9
mov dword [esi + 0x528], 4
push edi
push 0x20
push 0x5c4194
push 0x5c41b0
call ebx
mov dword [esi + 0x52c], eax
test eax, eax
jle 0x56f0c9
cmp eax, 0x200
jle 0x56f0d3
mov dword [esi + 0x52c], 0x20
push edi
push 0x10
push 0x5c41c0
push 0x5c41e0
call ebx
mov dword [esi + 0x530], eax
test eax, eax
jle 0x56f0f1
cmp eax, 0x40
jle 0x56f0fb
mov dword [esi + 0x530], 0x10
push edi
push 4
push 0x5c41f0
push 0x5c4208
call ebx
mov dword [esi + 0x534], eax
cmp eax, 4
jl 0x56f11c
cmp eax, 0x200
jle 0x56f126
mov dword [esi + 0x534], 4
push edi
push 1
push 0x5c4218
push 0x5c4234
call ebx
mov dword [esi + 0x538], eax
test eax, eax
jle 0x56f146
cmp eax, 0x200
jle 0x56f150
mov dword [esi + 0x538], 1
push edi
push 1
push 0x5c4244
push 0x5c4264
call ebx
mov dword [esi + 0x53c], eax
test eax, eax
jle 0x56f16e
cmp eax, 0x40
jle 0x56f178
mov dword [esi + 0x53c], 1
push edi
push 0
push 0x5c4274
push 0x5c4288
call ebx
mov dword [esi + 0x554], eax
pop edi
pop ebx
test eax, eax
js 0x56f198
cmp eax, 1
jle 0x56f1a2
mov dword [esi + 0x554], 0
mov edx, dword [ebp - 4]
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x56f1e0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov esi, dword [eax + 4]
cmp eax, 0x5940e4
jne 0x56f1f9
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x56f1f9
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
mov esp, ebp
pop ebp
ret
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00402ab0
mov ecx, eax
call dword [edx + 0xc]
jmp 0x56ef79
call esi
jmp 0x56f1e0
Function at 0x570280
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x5ebfc4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5ec928]
mov dword [ebp - 0x124], ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
cmp eax, 0xffffffff
jne 0x57032c
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call fcn.0053eae0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x120]
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
push eax
call esi
test eax, eax
jne 0x5702f2
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x114
push eax
call esi
cmp dword [ebp - 0x11c], 5
jne 0x570320
cmp dword [ebp - 0x118], 0
jne 0x570320
pop esi
mov dword [0x5ec928], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053c0f2
mov esp, ebp
pop ebp
ret 8
mov dword [0x5ec928], 0
jmp 0x570330
test eax, eax
jne 0x570382
push 0xffffffffffffffec
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov esi, dword [sym.imp.USER32.dll_SetWindowLongW]
xor eax, 0x80000
push eax
push 0xffffffffffffffec
push ebx
call esi
push 0xffffffffffffffec
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x80000
push eax
push 0xffffffffffffffec
push ebx
call esi
mov eax, dword [ebp - 0x124]
push 2
cmp dword [eax + 0x30c], 0
je 0x570376
push 0xff
jmp 0x570379
push dword [ebp + 0xc]
push 0
push ebx
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0053c0f2
mov esp, ebp
pop ebp
ret 8