joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b624
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
sub esp, 0x438
lea ebp, [esp - 4]
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0x438], eax
push 8
mov eax, 0x5e0329
call fcn.0059ca24
mov esi, ecx
lea ecx, [ebp]
call fcn.00427139
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
call fcn.00567d0d
push eax
lea ecx, [ebp - 0x14]
call fcn.00402440
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00571fa8
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0xc8]
push eax
mov ecx, 0x66e868
call fcn.00477dd1
test eax, eax
je 0x46b77c
push dword [ebp - 0x10]
call fcn.0059bf90
inc eax
pop ecx
inc eax
push eax
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x46b6fb
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x46b6f4
push dword [ebp - 0x10]
call fcn.0059bf90
inc eax
push eax
push dword [ebp - 0x10]
push ebx
call fcn.0059d730
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test esi, esi
jne 0x46b6e6
xor eax, eax
jmp 0x46b6e9
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x46b732
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test esi, esi
je 0x46b702
mov esi, dword [esi + 0x20]
push 0xd4
mov ecx, 0x66ea90
call fcn.0047ddbd
push eax
push 0x16
push esi
call fcn.00428d53
add esp, 0xc
cmp dword [ebp - 0x10], 0
je 0x46b77c
push dword [ebp - 0x10]
call fcn.00564e3f
and dword [ebp - 0x10], 0
pop ecx
jmp 0x46b77c
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
cmp dword [ebp - 0x10], 0
je 0x46b75a
push dword [ebp - 0x10]
call fcn.00564e3f
and dword [ebp - 0x10], 0
pop ecx
test esi, esi
je 0x46b761
mov esi, dword [esi + 0x20]
push 0xd5
mov ecx, 0x66ea90
call fcn.0047ddbd
push eax
push 0x13
push esi
call fcn.00428d53
add esp, 0xc
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00402490
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.0042719c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x438]
xor ecx, ebp
call fcn.0059ca15
add ebp, 0x43c
leave
ret
Function at 0x46c759
Capabilities:
Create process on windows

Disassembly:
push 4
mov eax, 0x5e04f0
call fcn.0059ca24
mov esi, ecx
call fcn.00567d0d
push eax
lea ecx, [ebp - 0x10]
call fcn.00402440
mov eax, dword [ebp + 0xc]
and dword [eax], 0
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
and dword [ebp - 4], 0
push 2
push 0xffffffffffffffff
mov ebx, 0x100c
push ebx
push dword [esi + 0xe8]
call edi
test eax, eax
jge 0x46c7a6
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
jmp 0x46c8a4
push 2
push 0xffffffffffffffff
push ebx
push dword [esi + 0xe8]
call edi
push 2
push eax
lea eax, [ebp + 0xc]
push eax
lea ecx, [esi + 0xc8]
call fcn.0057ad5c
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00402340
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00402490
mov edi, dword [ebp - 0x10]
xor ebx, ebx
cmp dword [edi - 0xc], ebx
je 0x46c8a1
push edi
call fcn.00428548
pop ecx
test eax, eax
jne 0x46c83f
push edi
call fcn.00428769
pop ecx
test eax, eax
jne 0x46c83f
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 0xc]
call fcn.00401b50
push str.www.
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00401ec0
mov edi, dword [ebp + 0xc]
push dword [edi - 0xc]
lea ecx, [ebp - 0x10]
push edi
call fcn.0040d8b0
lea ecx, [edi - 0x10]
mov byte [ebp - 4], bl
call fcn.00402490
mov edi, dword [ebp - 0x10]
mov eax, dword [esi + 0x20]
push 1
push ebx
push ebx
push edi
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ebx, eax
cmp ebx, 0x20
ja 0x46c8a1
push 0x113
mov ecx, 0x66ea90
call fcn.0047ddbd
push eax
lea ecx, [ebp - 0x10]
call fcn.00401ec0
push 0x5f5834
lea ecx, [ebp - 0x10]
call fcn.0040d820
push ebx
call fcn.0042848c
pop ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.0040d820
mov edi, dword [ebp - 0x10]
mov esi, dword [esi + 0x20]
push edi
push 0x16
push esi
call fcn.00428d53
add esp, 0xc
lea ecx, [edi - 0x10]
call fcn.00402490
call fcn.0059cafc
ret 8
Function at 0x4714c3
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0xbc]
sub esp, 0x13c
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0xb8], eax
push ebx
push esi
mov esi, dword [ebp + 0xc4]
push edi
xor ebx, ebx
push 0xff
lea eax, [ebp - 0x47]
push ebx
push eax
mov edi, ecx
mov byte [ebp - 0x48], bl
call fcn.0059cb30
add esp, 0xc
mov ecx, esi
call fcn.00401f80
push 5
push dword [edi + 0x94]
call dword [sym.imp.USER32.dll_GetWindow]
push eax
call fcn.00570840
mov dword [ebp - 0x4c], eax
cmp eax, ebx
je 0x47155d
mov eax, dword [eax + 0x20]
cmp eax, ebx
je 0x47155d
push 0x100
lea ecx, [ebp - 0x48]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetClassNameA]
lea eax, [ebp - 0x48]
push 0x6033dc
push eax
call fcn.0059fbe0
pop ecx
pop ecx
test eax, eax
jne 0x47155d
mov ecx, dword [ebp - 0x4c]
push esi
call fcn.00571fa8
mov eax, dword [esi]
cmp dword [eax - 0xc], ebx
jne 0x4715d0
push 0x34
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.0059cb30
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x164
push dword [edi + 0x94]
mov dword [ebp - 0x80], 0x34
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [ebp - 0x54], ebx
je 0x4715b2
push 0x100
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x54]
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x48]
push eax
mov ecx, esi
call fcn.00401ec0
mov eax, dword [esi]
cmp dword [eax - 0xc], ebx
jne 0x4715d0
add edi, 0x74
mov ecx, edi
call fcn.00429da0
test eax, eax
jl 0x4715d0
push esi
mov ecx, edi
call fcn.00429da0
push eax
mov ecx, edi
call fcn.0056bf96
mov ecx, dword [ebp + 0xb8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0059ca15
add ebp, 0xbc
leave
ret 4
Function at 0x472f9e
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
sub esp, 0x438
lea ebp, [esp - 4]
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0x438], eax
push 8
mov eax, 0x5e0d6d
call fcn.0059ca24
mov esi, ecx
lea ecx, [ebp]
call fcn.00427139
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
call fcn.00567d0d
push eax
lea ecx, [ebp - 0x14]
call fcn.00402440
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00571fa8
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0xc8]
push eax
mov ecx, 0x66e868
call fcn.00477dd1
test eax, eax
je 0x4730f6
push dword [ebp - 0x10]
call fcn.0059bf90
inc eax
pop ecx
inc eax
push eax
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x473075
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x47306e
push dword [ebp - 0x10]
call fcn.0059bf90
inc eax
push eax
push dword [ebp - 0x10]
push ebx
call fcn.0059d730
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test esi, esi
jne 0x473060
xor eax, eax
jmp 0x473063
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x4730ac
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test esi, esi
je 0x47307c
mov esi, dword [esi + 0x20]
push 0xd4
mov ecx, 0x66ea90
call fcn.0047ddbd
push eax
push 0x16
push esi
call fcn.00428d53
add esp, 0xc
cmp dword [ebp - 0x10], 0
je 0x4730f6
push dword [ebp - 0x10]
call fcn.00564e3f
and dword [ebp - 0x10], 0
pop ecx
jmp 0x4730f6
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
cmp dword [ebp - 0x10], 0
je 0x4730d4
push dword [ebp - 0x10]
call fcn.00564e3f
and dword [ebp - 0x10], 0
pop ecx
test esi, esi
je 0x4730db
mov esi, dword [esi + 0x20]
push 0xd5
mov ecx, 0x66ea90
call fcn.0047ddbd
push eax
push 0x13
push esi
call fcn.00428d53
add esp, 0xc
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00402490
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.0042719c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x438]
xor ecx, ebp
call fcn.0059ca15
add ebp, 0x43c
leave
ret
Function at 0x4746cb
Capabilities:
Create process on windows

Disassembly:
push 4
mov eax, 0x5e0fe6
call fcn.0059ca24
mov esi, ecx
call fcn.00567d0d
push eax
lea ecx, [ebp - 0x10]
call fcn.00402440
mov eax, dword [ebp + 0xc]
and dword [eax], 0
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
and dword [ebp - 4], 0
push 2
push 0xffffffffffffffff
mov ebx, 0x100c
push ebx
push dword [esi + 0xe8]
call edi
test eax, eax
jge 0x474718
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
jmp 0x474814
push 2
push 0xffffffffffffffff
push ebx
push dword [esi + 0xe8]
call edi
xor ebx, ebx
push ebx
push eax
lea eax, [ebp + 0xc]
push eax
lea ecx, [esi + 0xc8]
call fcn.0057ad5c
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00402340
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.00402490
mov edi, dword [ebp - 0x10]
cmp dword [edi - 0xc], ebx
je 0x474811
push edi
call fcn.00428548
pop ecx
test eax, eax
jne 0x4747af
push edi
call fcn.00428769
pop ecx
test eax, eax
jne 0x4747af
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 0xc]
call fcn.00401b50
push str.www.
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00401ec0
mov edi, dword [ebp + 0xc]
push dword [edi - 0xc]
lea ecx, [ebp - 0x10]
push edi
call fcn.0040d8b0
lea ecx, [edi - 0x10]
mov byte [ebp - 4], bl
call fcn.00402490
mov edi, dword [ebp - 0x10]
mov eax, dword [esi + 0x20]
push 1
push ebx
push ebx
push edi
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ebx, eax
cmp ebx, 0x20
ja 0x474811
push 0x113
mov ecx, 0x66ea90
call fcn.0047ddbd
push eax
lea ecx, [ebp - 0x10]
call fcn.00401ec0
push 0x5f5834
lea ecx, [ebp - 0x10]
call fcn.0040d820
push ebx
call fcn.0042848c
pop ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.0040d820
mov edi, dword [ebp - 0x10]
mov esi, dword [esi + 0x20]
push edi
push 0x16
push esi
call fcn.00428d53
add esp, 0xc
lea ecx, [edi - 0x10]
call fcn.00402490
call fcn.0059cafc
ret 8
Function at 0x47bbd8
Capabilities:
Read .ini file

Disassembly:
push 4
mov eax, 0x5e1b31
call fcn.0059ca57
mov esi, ecx
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp + 8], eax
jne 0x47bc04
mov dword [esi + 0x418], 1
xor eax, eax
call fcn.0059cafc
ret 8
mov dword [esi + 0x418], eax
mov ebx, 0x100
lea eax, [ebx + 1]
push eax
call fcn.00564e4a
mov edi, eax
pop ecx
test edi, edi
jne 0x47bc2b
mov dword [esi + 0x418], 2
jmp 0x47bc51
and dword [edi], 0
lea eax, [esi + 0x18]
push eax
push ebx
push edi
push 0
push dword [ebp + 8]
lea eax, [esi + 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x47bc7c
push edi
call fcn.00564e3f
pop ecx
cmp dword [ebp + 0xc], 0
je 0x47bbfa
push dword [ebp + 0xc]
call fcn.0059bf90
inc eax
push eax
call fcn.00564e4a
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x47bc78
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, esi
jmp 0x47bbfc
lea ecx, [eax + 1]
cmp ecx, ebx
jne 0x47bc95
push edi
call fcn.00564e3f
pop ecx
add ebx, 0x100
jmp 0x47bc0f
cmp eax, ebx
jb 0x47bc9b
mov eax, ebx
mov byte [eax + edi], 0
mov eax, edi
jmp 0x47bbfc

Function at 0x47c372
Capabilities:
Read .ini file

Disassembly:
push 4
mov eax, 0x5e1cde
call fcn.0059ca57
mov edi, ecx
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp + 8], eax
jne 0x47c39e
mov dword [edi + 0x418], 1
xor eax, eax
call fcn.0059cafc
ret 4
mov dword [edi + 0x418], eax
mov ebx, 0x100
push ebx
call fcn.00564e4a
mov esi, eax
pop ecx
test esi, esi
jne 0x47c3c2
mov dword [edi + 0x418], 2
jmp 0x47c394
and dword [esi], 0
lea eax, [edi + 0x18]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
lea ecx, [eax + 2]
cmp ecx, ebx
jne 0x47c3e7
push esi
call fcn.00564e3f
pop ecx
add ebx, 0x1000
jmp 0x47c3a9
push dword [ebp + 8]
mov ecx, edi
push eax
push esi
call fcn.0047c1a1
push esi
test eax, eax
jne 0x47c40a
call fcn.00564e3f
pop ecx
mov dword [edi + 0x418], 3
jmp 0x47c394
call fcn.00564e3f
xor eax, eax
pop ecx
inc eax
jmp 0x47c396

Function at 0x47c691
Capabilities:
Get keyboard layout

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push edi
test eax, eax
je 0x47c6a7
push eax
call fcn.00564e3f
and dword [esi + 4], 0
pop ecx
mov edi, dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
and dword [esi + 8], 0
push 0
push 0
call edi
mov dword [esi + 8], eax
test eax, eax
jne 0x47c6c9
mov dword [esi + 0xc], 2
xor eax, eax
jmp 0x47c706
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00564e4a
pop ecx
mov dword [esi + 4], eax
test eax, eax
jne 0x47c6ee
mov dword [esi + 0xc], 3
jmp 0x47c6c5
push eax
push dword [esi + 8]
call edi
cmp eax, dword [esi + 8]
je 0x47c703
mov dword [esi + 0xc], 4
mov dword [esi + 8], eax
xor eax, eax
inc eax
pop edi
pop esi
ret
Function at 0x47c8d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
xor ecx, ecx
test eax, eax
jbe 0x47c93b
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x18]
shl ecx, 2
shl ebx, 2
mov dword [ebp + 0x14], ecx
sub esi, edi
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push dword [eax + ebx]
mov ecx, dword [ebp + 0x14]
push dword [ecx + eax]
movzx eax, byte [esi + edi]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanExA]
mov ecx, dword [ebp - 4]
movzx eax, ax
push eax
call fcn.0047c4e4
test al, al
jne 0x47c92d
mov al, byte [esi + edi]
mov byte [edi], al
inc edi
dec dword [ebp + 0xc]
jne 0x47c900
mov ecx, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov eax, dword [ebp + 0x18]
mov byte [ecx + eax], 0
leave
ret 0x14

Function at 0x47efc3
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
lea ebx, [edi + 0x25c]
push ebx
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp + 8]
call fcn.0059bf90
add eax, 0x14
push eax
call fcn.00564e4a
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x47f00b
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push dword [ebp + 8]
movzx eax, word [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
movzx eax, word [ebp - 0xc]
push eax
push str._02u:_02u:_02u__s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push esi
call fcn.0042806f
pop ecx
cmp al, 0xd
je 0x47f04c
push esi
call fcn.0042806f
pop ecx
cmp al, 0xa
jne 0x47f05a
push esi
call fcn.0059bf90
pop ecx
mov byte [eax + esi - 1], 0
jmp 0x47f036
push 0x5f5778
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
add edi, 4
mov ecx, edi
call fcn.004b06fc
test eax, eax
je 0x47f07f
push esi
mov ecx, edi
call fcn.004b07a6
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.00564e3f
pop ecx
mov ecx, edi
call fcn.004b06fc
test eax, eax
je 0x47f09f
mov ecx, edi
call fcn.004b06ee
mov esi, dword [ebp - 4]
jmp 0x47effb

Function at 0x47f0a7
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
lea edi, [esi + 0x25c]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add esi, 4
mov ecx, esi
call fcn.004b06fc
mov ebx, 0x6050f0
test eax, eax
je 0x47f0d4
push ebx
mov ecx, esi
call fcn.004b07a6
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, esi
call fcn.004b06fc
test eax, eax
je 0x47f0ed
mov ecx, esi
call fcn.004b06ee
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
ret
Function at 0x4811eb
Capabilities:
Persist via run registry key
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
lea ecx, [ebp - 0x19c]
call fcn.004759dd
cmp dword [ebp - 0x18c], 2
je 0x481235
push dword [ebp + 0xc]
mov ecx, edi
push esi
push str.AppData
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocStringLen
call fcn.0047fa94
jmp 0x481294
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.0059cb30
add esp, 0xc
push 0x104
lea eax, [ebp - 0x108]
push eax
push str.ProfilesDirectory
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, edi
call fcn.0047fa94
test eax, eax
je 0x481292
push dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x481292
xor eax, eax
inc eax
jmp 0x481294
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0059ca15
leave
ret 8

Function at 0x4812a4
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x98]
call fcn.004759dd
cmp dword [ebp - 0x88], 2
je 0x4812d3
xor eax, eax
jmp 0x4812e8
push dword [ebp + 0xc]
push esi
push str._USERPROFILE_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0059ca15
leave
ret 8
Function at 0x481b77
Capabilities:
Read .ini file

Disassembly:
push ebp
sub esp, 0x438
lea ebp, [esp - 4]
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0x438], eax
push 8
mov eax, 0x5e238c
call fcn.0059ca24
mov eax, dword [ebp + 0x444]
mov edi, dword [ebp + 0x448]
mov dword [ebp - 0x10], ecx
lea ecx, [ebp]
mov dword [ebp - 0x14], eax
call fcn.00427139
and dword [ebp - 4], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov byte [0x670650], 0
mov esi, 0x670650
test edi, edi
je 0x481c67
push edi
push 0x400
push esi
push 0x631718
push str.Global_History_File
push str.User_Prefs
call ebx
push esi
lea ecx, [ebp]
call fcn.00498be1
lea ecx, [ebp]
call fcn.004992e9
test eax, eax
jne 0x481c67
push edi
lea ecx, [ebp]
call fcn.00498be1
push 0
push 0
lea ecx, [ebp]
call fcn.00498d2a
push str.global_history.dat
push 0
lea ecx, [ebp]
call fcn.00499340
lea ecx, [ebp]
call fcn.004992e9
test eax, eax
jne 0x481cf2
push edi
lea ecx, [ebp]
call fcn.00498be1
xor edi, edi
push edi
push edi
lea ecx, [ebp]
call fcn.00498d2a
push str.global.dat
push edi
lea ecx, [ebp]
call fcn.00499340
lea ecx, [ebp]
call fcn.004992e9
test eax, eax
jne 0x481cf2
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
push edi
call fcn.0048147a
push eax
push 0x400
push esi
push 0x631718
push str.Global_History_File
push str.User_Prefs
call ebx
push esi
lea ecx, [ebp]
call fcn.00498be1
lea ecx, [ebp]
call fcn.004992e9
test eax, eax
jne 0x481cfd
test edi, edi
je 0x481cfd
push str.global_history.dat
push edi
lea ecx, [ebp]
call fcn.00499340
lea ecx, [ebp]
call fcn.004992e9
test eax, eax
jne 0x481cf2
push str.global.dat
push edi
lea ecx, [ebp]
call fcn.00499340
lea ecx, [ebp]
call fcn.004992e9
test eax, eax
jne 0x481cf2
push str.profileglobal.dat
push edi
lea ecx, [ebp]
call fcn.00499340
lea ecx, [ebp]
call fcn.004992e9
test eax, eax
je 0x481cfd
lea eax, [ebp]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.0042719c
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x438]
xor ecx, ebp
call fcn.0059ca15
add ebp, 0x43c
leave
ret 8
Function at 0x481dc4
Capabilities:
Read .ini file

Disassembly:
push ebp
sub esp, 0x438
lea ebp, [esp - 4]
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0x438], eax
push 8
mov eax, 0x5e23ef
call fcn.0059ca24
mov eax, dword [ebp + 0x444]
mov edi, dword [ebp + 0x448]
mov dword [ebp - 0x10], ecx
lea ecx, [ebp]
mov dword [ebp - 0x14], eax
call fcn.00427139
and dword [ebp - 4], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov byte [0x670e50], 0
mov esi, 0x670e50
test edi, edi
je 0x481eb4
push edi
push 0x400
push esi
push 0x631718
push str.Hot_List_File_Ver2
push str.User_Prefs
call ebx
push esi
lea ecx, [ebp]
call fcn.00498be1
lea ecx, [ebp]
call fcn.004992e9
test eax, eax
jne 0x481eb4
push edi
lea ecx, [ebp]
call fcn.00498be1
push 0
push 0
lea ecx, [ebp]
call fcn.00498d2a
push str.bookmarks.adr
push 0
lea ecx, [ebp]
call fcn.00499340
lea ecx, [ebp]
call fcn.004992e9
test eax, eax
jne 0x481f3f
push edi
lea ecx, [ebp]
call fcn.00498be1
xor edi, edi
push edi
push edi
lea ecx, [ebp]
call fcn.00498d2a
push str.opera6.adr
push edi
lea ecx, [ebp]
call fcn.00499340
lea ecx, [ebp]
call fcn.004992e9
test eax, eax
jne 0x481f3f
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
push edi
call fcn.0048147a
push eax
push 0x400
push esi
push 0x631718
push str.Hot_List_File_Ver2
push str.User_Prefs
call ebx
push esi
lea ecx, [ebp]
call fcn.00498be1
lea ecx, [ebp]
call fcn.004992e9
test eax, eax
jne 0x481f4a
test edi, edi
je 0x481f4a
push str.bookmarks.adr
push edi
lea ecx, [ebp]
call fcn.00499340
lea ecx, [ebp]
call fcn.004992e9
test eax, eax
jne 0x481f3f
push str.profileopera6.adr
push edi
lea ecx, [ebp]
call fcn.00499340
lea ecx, [ebp]
call fcn.004992e9
test eax, eax
jne 0x481f3f
push str.opera6.adr
push edi
lea ecx, [ebp]
call fcn.00499340
lea ecx, [ebp]
call fcn.004992e9
test eax, eax
je 0x481f4a
lea eax, [ebp]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.0042719c
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x438]
xor ecx, ebp
call fcn.0059ca15
add ebp, 0x43c
leave
ret 8
Function at 0x481f7d
Capabilities:
Read .ini file

Disassembly:
push ebp
sub esp, 0x438
lea ebp, [esp - 4]
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0x438], eax
push 8
mov eax, 0x5e241f
call fcn.0059ca24
mov eax, dword [ebp + 0x444]
mov edi, dword [ebp + 0x448]
mov dword [ebp - 0x10], ecx
lea ecx, [ebp]
mov dword [ebp - 0x14], eax
call fcn.00427139
and dword [ebp - 4], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov byte [0x671250], 0
mov esi, 0x671250
test edi, edi
je 0x48206d
push edi
push 0x400
push esi
push 0x631718
push str.Direct_History_File
push str.User_Prefs
call ebx
push esi
lea ecx, [ebp]
call fcn.00498be1
lea ecx, [ebp]
call fcn.004992e9
test eax, eax
jne 0x48206d
push edi
lea ecx, [ebp]
call fcn.00498be1
push 0
push 0
lea ecx, [ebp]
call fcn.00498d2a
push str.typed_history.xml
push 0
lea ecx, [ebp]
call fcn.00499340
lea ecx, [ebp]
call fcn.004992e9
test eax, eax
jne 0x4820f8
push edi
lea ecx, [ebp]
call fcn.00498be1
xor edi, edi
push edi
push edi
lea ecx, [ebp]
call fcn.00498d2a
push str.opera.dir
push edi
lea ecx, [ebp]
call fcn.00499340
lea ecx, [ebp]
call fcn.004992e9
test eax, eax
jne 0x4820f8
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
push edi
call fcn.0048147a
push eax
push 0x400
push esi
push 0x631718
push str.Direct_History_File
push str.User_Prefs
call ebx
push esi
lea ecx, [ebp]
call fcn.00498be1
lea ecx, [ebp]
call fcn.004992e9
test eax, eax
jne 0x482103
test edi, edi
je 0x482103
push str.profileopera.dir
push edi
lea ecx, [ebp]
call fcn.00499340
lea ecx, [ebp]
call fcn.004992e9
test eax, eax
jne 0x4820f8
push str.typed_history.xml
push edi
lea ecx, [ebp]
call fcn.00499340
lea ecx, [ebp]
call fcn.004992e9
test eax, eax
jne 0x4820f8
push str.opera.dir
push edi
lea ecx, [ebp]
call fcn.00499340
lea ecx, [ebp]
call fcn.004992e9
test eax, eax
je 0x482103
lea eax, [ebp]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.0042719c
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x438]
xor ecx, ebp
call fcn.0059ca15
add ebp, 0x43c
leave
ret 8

Function at 0x486a54
Capabilities:
Hash data with md5

Disassembly:
and dword [ecx + 0x18], 0
and dword [ecx + 0x14], 0
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
ret