joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442410
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov ecx, dword [0x4ae1b8]
sub esp, 0x80
push esi
mov esi, eax
call fcn.00414da0
test esi, esi
je 0x4424c5
cmp byte [esi], 0
je 0x4424c5
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x44247c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [0x4aa988]
test byte [ecx + 0xe0], 1
mov dword [ecx + 0x30], eax
jne 0x4424f9
mov eax, dword [0x4aea7c]
push 1
push 0
push esi
push 0x49cf30
push eax
call fcn.00477bd0
pop esi
add esp, 0x80
ret
mov edx, dword [0x4aea7c]
mov ecx, dword [0x4aa988]
push 1
push 0
push 0xffffffffffffffff
push 0x49b8d8
push edx
mov dword [ecx + 0x30], 0
call fcn.00477bd0
mov edx, esi
lea eax, [esp + 4]
call fcn.004759a0
push 1
push 0
push 0xffffffffffffffff
push eax
mov eax, dword [0x4ae1b8]
push eax
call fcn.00477bd0
pop esi
add esp, 0x80
ret
mov eax, dword [0x4aa988]
test byte [eax + 0xe0], 1
mov dword [eax + 0x30], 0x57
jne 0x4424f9
mov ecx, dword [0x4aea7c]
push 1
push 0
push 0xffffffffffffffff
push 0x49cf30
push ecx
call fcn.00477bd0
pop esi
add esp, 0x80
ret
push 0x49b8bd
push 0
push 0x49cf30
mov ecx, edi
call fcn.0042f7e0
pop esi
add esp, 0x80
ret
Function at 0x442e60
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [0x4ae1b8]
sub esp, 0x148
push ebx
push esi
call fcn.00414da0
test edi, edi
je 0x442fce
cmp byte [edi], 0
je 0x442fce
push 0
push 0
push 3
push 0
push 7
push 0x80
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x442ec0
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test ebx, ebx
jne 0x442f2b
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x442f0c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [0x4aa988]
test byte [ecx + 0xe0], 1
mov dword [ecx + 0x30], eax
jne 0x443002
mov edx, dword [0x4aea7c]
push 1
push 0
push 0xffffffffffffffff
push 0x49cf30
push edx
call fcn.00477bd0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov eax, dword [esp + 0x2c]
xor ecx, ecx
or ecx, dword [esp + 0x30]
xor esi, esi
or eax, esi
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
jmp 0x442f33
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [ebp + 0xc]
movzx esi, byte [edx]
test esi, 0xffffff80
jne 0x442f5b
push 2
push esi
call fcn.0048940e
mov ecx, dword [esp + 0x10]
add esp, 8
test eax, eax
mov eax, dword [esp + 0xc]
je 0x442f5b
and esi, 0xffffffdf
mov edx, esi
movsx edx, dl
sub edx, 0x4b
je 0x442f72
sub edx, 2
jne 0x442f88
push edx
push 0x100000
jmp 0x442f79
push 0
push 0x400
push eax
push ecx
call fcn.00496670
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov ecx, dword [0x4aea7c]
mov eax, dword [0x4aa988]
push 1
push 0
push 0xffffffffffffffff
push 0x49b8d8
push ecx
mov dword [eax + 0x30], 0
call fcn.00477bd0
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push 0x18
push edx
push eax
mov eax, dword [0x4ae1b8]
call fcn.00401130
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x4aa988]
test byte [eax + 0xe0], 1
mov dword [eax + 0x30], 0x57
jne 0x443002
mov ecx, dword [0x4aea7c]
push 1
push 0
push 0xffffffffffffffff
push 0x49cf30
push ecx
call fcn.00477bd0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x49b8bd
push 0
push 0x49cf30
call fcn.0042f7e0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x450360
Capabilities:
Get disk information

Disassembly:
sub esp, 0x108
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_OpenProcess]
push ebp
push esi
push edi
mov esi, ecx
push esi
push 0
mov edi, eax
push 0x410
mov byte [edi], 0
call ebx
mov ebp, eax
test ebp, ebp
jne 0x4503a1
push esi
push eax
push 0x1000
call ebx
mov ebp, eax
test ebp, ebp
jne 0x4503a1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
cmp byte [esp + 0x11c], 0
push 0x104
push edi
push 0
push ebp
je 0x4503bc
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameA]
jmp 0x4503c2
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
test byte [0x4b0310], 1
mov ebx, eax
jne 0x4503f2
or dword [0x4b0310], 1
push str.GetProcessImageFileNameA
push str.psapi
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x4b030c], eax
jmp 0x4503f7
mov eax, dword [0x4b030c]
test ebx, ebx
jne 0x4504f4
test eax, eax
je 0x4504f4
push 0x104
push edi
push ebp
call eax
mov ebx, eax
test ebx, ebx
je 0x4504f4
cmp byte [esp + 0x11c], 0
je 0x450469
push 0x5c
push edi
call fcn.0048a253
add esp, 8
test eax, eax
je 0x4504f4
mov ecx, eax
lea esi, [ecx + 1]
lea esp, [esp]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x450440
sub ecx, esi
push ecx
inc eax
push eax
push edi
call fcn.00488ab0
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x108
ret
mov word [esp + 0x11], 0x3a
mov byte [esp + 0x10], 0x41
push 0x104
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.DLL_QueryDosDeviceA]
mov esi, eax
cmp esi, 2
jbe 0x4504ad
sub esi, 2
push esi
lea edx, [esp + 0x18]
push edi
push edx
call fcn.0048a18f
add esp, 0xc
test eax, eax
jne 0x4504ad
cmp byte [esi + edi], 0x5c
je 0x4504cf
mov al, byte [esp + 0x10]
inc al
mov byte [esp + 0x10], al
cmp al, 0x5a
jle 0x450475
push ebp
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x108
ret
mov al, byte [esp + 0x10]
mov cl, byte [esp + 0x11]
sub ebx, esi
lea edx, [ebx + 1]
push edx
add esi, edi
mov byte [edi], al
mov byte [edi + 1], cl
push esi
add edi, 2
push edi
call fcn.00488ab0
add esp, 0xc
add ebx, 2
push ebp
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x108
ret
Function at 0x4536d0
Capabilities:
Delete file

Disassembly:
sub esp, 0x12c
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x453784
cmp byte [eax], bl
je 0x453784
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x2c]
push edx
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetFullPathNameA]
lea eax, [esp + 0x28]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x453706
sub eax, edx
cmp eax, ebx
je 0x453720
cmp byte [esp + eax + 0x27], 0x5c
lea eax, [esp + eax + 0x27]
jne 0x453720
mov byte [eax], bl
lea eax, [esp + 0x28]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x453727
sub eax, edx
mov byte [esp + eax + 0x29], bl
lea edx, [esp + 4]
lea eax, [esp + 0x28]
mov ecx, 0x4054
push edx
mov dword [esp + 0x1e], ebx
mov dword [esp + 0x22], ebx
mov dword [esp + 0x1a], ebx
mov dword [esp + 8], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 3
mov word [esp + 0x18], cx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
setne al
movzx ecx, al
push ecx
push esi
call fcn.0042f880
pop ebx
add esp, 0x12c
ret
mov edx, dword [0x4aa988]
test byte [edx + 0xe0], 1
jne 0x4537b0
mov eax, dword [0x4aea7c]
push 1
push ebx
push 0xffffffffffffffff
push 0x49cf30
push eax
call fcn.00477bd0
pop ebx
add esp, 0x12c
ret
push 0x49b8bd
push ebx
push 0x49cf30
mov ecx, esi
call fcn.0042f7e0
pop ebx
add esp, 0x12c
ret
Function at 0x4537d0
Capabilities:
Get file version info

Disassembly:
mov ecx, dword [0x4ae1b8]
sub esp, 0x8c
push ebp
mov ebp, dword [esp + 0x94]
push edi
mov edi, eax
call fcn.00414da0
test edi, edi
je 0x453948
cmp byte [edi], 0
je 0x453948
push esi
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov esi, eax
test esi, esi
jne 0x453869
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [0x4aa988]
test byte [ecx + 0xe0], 1
mov dword [ecx + 0x30], eax
jne 0x45384a
mov ecx, dword [0x4aea7c]
push 1
push esi
push 0xffffffffffffffff
push 0x49cf30
push ecx
call fcn.00477bd0
pop esi
pop edi
pop ebp
add esp, 0x8c
ret 4
push 0x49b8bd
push 0
push 0x49cf30
mov ecx, ebp
call fcn.0042f7e0
pop esi
pop edi
pop ebp
add esp, 0x8c
ret 4
push ebx
push esi
call fcn.004882a7
add esp, 4
mov ebx, eax
push ebx
push esi
push 0
push edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x45391d
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push 0x49de7c
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x45391d
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
movzx edx, cx
push edx
shr ecx, 0x10
push ecx
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
push str._u._u._u._u
mov esi, 0x80
lea edi, [esp + 0x30]
call fcn.00474a60
push ebx
call fcn.00487ee8
mov eax, dword [0x4aea7c]
mov edx, dword [0x4aa988]
add esp, 0x18
push 1
push 0
push 0xffffffffffffffff
push 0x49b8d8
push eax
mov dword [edx + 0x30], 0
call fcn.00477bd0
mov edx, dword [0x4ae1b8]
push 1
push 0
push 0xffffffffffffffff
mov ecx, edi
push ecx
push edx
call fcn.00477bd0
pop ebx
pop esi
pop edi
pop ebp
add esp, 0x8c
ret 4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [0x4aa988]
push ebx
mov dword [ecx + 0x30], eax
call fcn.00487ee8
add esp, 4
push ebp
call fcn.004321e0
pop ebx
pop esi
pop edi
pop ebp
add esp, 0x8c
ret 4
mov eax, dword [0x4aa988]
test byte [eax + 0xe0], 1
mov dword [eax + 0x30], 0x57
jne 0x45397f
mov edx, dword [0x4aea7c]
push 1
push 0
push 0xffffffffffffffff
push 0x49cf30
push edx
call fcn.00477bd0
pop edi
pop ebp
add esp, 0x8c
ret 4
push 0x49b8bd
push 0
push 0x49cf30
mov ecx, ebp
call fcn.0042f7e0
pop edi
pop ebp
add esp, 0x8c
ret 4
Function at 0x453c30
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
sub esp, 0x12c
push ebx
xor ebx, ebx
cmp byte [eax], bl
jne 0x453c47
xor al, al
pop ebx
add esp, 0x12c
ret
cmp byte [esp + 0x134], bl
jne 0x453c64
push eax
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
test eax, eax
setne al
pop ebx
add esp, 0x12c
ret
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x2c]
push edx
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetFullPathNameA]
lea eax, [esp + 0x28]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x453c81
sub eax, edx
cmp eax, ebx
je 0x453c9b
cmp byte [esp + eax + 0x27], 0x5c
lea eax, [esp + eax + 0x27]
jne 0x453c9b
mov byte [eax], bl
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x453c3d
test al, 0x10
je 0x453c3d
lea eax, [esp + 0x28]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x453cb6
sub eax, edx
mov byte [esp + eax + 0x29], bl
lea eax, [esp + 4]
lea ecx, [esp + 0x28]
mov edx, 0x614
push eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1e], ebx
mov dword [esp + 0x22], ebx
mov dword [esp + 0x1a], ebx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 3
mov word [esp + 0x18], dx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
neg eax
sbb eax, eax
inc eax
pop ebx
add esp, 0x12c
ret
Function at 0x4541c0
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x18
lea eax, [esp + 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4541e1
xor al, al
add esp, 0x18
ret
lea ecx, [esp + 0xc]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp + 4]
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
push 0
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x4541db
mov ecx, dword [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
setne al
add esp, 0x18
ret

Function at 0x454240
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push esi
mov esi, eax
lea eax, [esp + 8]
push eax
push 0x1f4
push 2
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
test eax, eax
jne 0x45429f
lea ecx, [esp + 4]
push ecx
push esi
mov dword [esp + 0xc], eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 4]
test eax, eax
je 0x45429f
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
test esi, esi
je 0x45429f
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop esi
add esp, 8
ret
Function at 0x4543d0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x550
push ebp
push esi
push edi
push 0
push 2
mov dword [esp + 0x18], 0x128
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.DLL_Process32First]
push 0
push 0
push 1
push 0
mov eax, ebx
call fcn.004748f0
add esp, 0x10
test eax, eax
je 0x45443c
mov eax, ebx
call fcn.0040edf0
test al, al
je 0x45442f
push 0x10
push 0
push ebx
call fcn.00489f2e
add esp, 0xc
mov ebp, eax
jmp 0x45443e
push ebx
call fcn.00489461
add esp, 4
mov ebp, eax
jmp 0x45443e
xor ebp, ebp
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_Process32Next]
test eax, eax
je 0x4544f0
test ebp, ebp
je 0x454460
cmp ebp, dword [esp + 0x18]
je 0x454503
lea edx, [esp + 0x240]
push edx
lea eax, [esp + 0x13c]
push eax
lea ecx, [esp + 0x458]
push ecx
lea edx, [esp + 0x354]
push edx
lea eax, [esp + 0x44]
push eax
call fcn.0048ab36
lea eax, [esp + 0x254]
add esp, 0x14
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x454496
lea edi, [esp + 0x138]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4544a7
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x138]
push ebx
push ecx
call fcn.00487ed1
add esp, 8
test eax, eax
je 0x454516
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_Process32Next]
mov esi, dword [esp + 0xc]
test eax, eax
jne 0x454452
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x550
ret
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, ebp
pop edi
pop esi
pop ebp
add esp, 0x550
ret
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x550
ret
Function at 0x46fe70
Capabilities:
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x4984a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov ecx, dword [ebx + 8]
push ebp
push esi
mov esi, dword [ebx + 4]
push edi
xor ebp, ebp
mov edx, ebx
xor eax, eax
lea edi, [esp + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov dword [ebx + 4], edi
mov dword [esp + 0x2c], ebp
cmp ecx, ebp
jle 0x46ffa4
mov edi, edi
cmp eax, dword [esp + 0x3c]
jl 0x46ff0f
mov eax, dword [0x4aa988]
mov ecx, 0x3a
mov esi, 0x4acf30
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov dword [eax + 0x2c], ebp
mov dword [0x4af858], ebp
mov dword [0x4af85c], ebp
cmp dword [0x4ae41c], ebp
je 0x46ff0b
mov eax, dword [0x4ababc]
cmp eax, ebp
je 0x46feff
mov eax, dword [eax]
cmp eax, ebp
jne 0x46ff04
mov eax, 0x49b8bd
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
mov eax, dword [esp + 0x18]
mov ecx, dword [ebx]
lea eax, [eax + eax*2]
mov ecx, dword [ecx + eax*4]
mov eax, dword [esp + 0x34]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x3c]
push eax
push str.call
push ecx
xor eax, eax
call fcn.0046ce30
add esp, 0x10
test eax, eax
je 0x46ff5f
cmp dword [esp + 0xc], ebp
jne 0x46ff80
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
cmp eax, dword [esp + 0x1c]
jl 0x46fec0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov dword [edx + 4], ecx
jmp 0x46ffa7
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
xor eax, eax
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, 3
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret 0xc
mov dword [edx + 4], esi
mov ecx, dword [esp + 0x24]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebp
add esp, 0x24
ret 0xc
Function at 0x4712a0
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x1010c
call fcn.004943d0
push ebp
mov ebp, dword [esp + 0x10118]
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x1011c]
test esi, esi
je 0x4712c6
cmp byte [esi], 0
jne 0x4712cb
mov esi, str.ERROR
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0x104
push edx
mov byte [esp + 0x128], 0
mov byte [esp + 0x1f], 0
call dword [sym.imp.KERNEL32.DLL_GetFullPathNameA]
cmp byte [ebp], 0
je 0x47133e
cmp byte [edi], 0
jne 0x4712fd
lea edi, [esp + 0xf]
lea eax, [esp + 0x14]
push eax
push 0xffff
lea ecx, [esp + 0x120]
push ecx
push esi
push ebp
push edi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
mov ecx, dword [0x4ae1b8]
push 1
push 0
push 0xffffffffffffffff
lea eax, [esp + 0x124]
push eax
push ecx
call fcn.00477bd0
pop edi
pop esi
pop ebp
add esp, 0x1010c
ret 8
cmp byte [edi], 0
je 0x47135e
lea edx, [esp + 0x14]
push edx
push 0xffff
lea eax, [esp + 0x120]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileSectionA]
jmp 0x471376
lea ecx, [esp + 0x14]
push ecx
push 0xffff
lea edx, [esp + 0x120]
push edx
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileSectionNamesA]
test eax, eax
je 0x471318
lea eax, [esp + 0x118]
cmp byte [eax], 0
jne 0x47138f
cmp byte [eax + 1], 0
je 0x471318
mov byte [eax], 0xa
inc eax
jmp 0x471381
Function at 0x471b50
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x110
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push ebp
push esi
push edi
mov edi, dword [esp + 0x124]
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push 0
push edi
mov dword [esp + 0x30], 0xff
call ebx
cmp eax, 0x103
je 0x471c17
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [0x4aa988]
mov edx, dword [ecx + 0xb0]
lea eax, [esp + 0x14]
push eax
or edx, 0x20019
push edx
push 0
lea eax, [esp + 0x2c]
push eax
push edi
call ebp
mov esi, eax
test esi, esi
jne 0x471c24
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00471b50
mov edx, dword [esp + 0x18]
add esp, 4
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x471c24
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
test esi, esi
jne 0x471c24
lea ecx, [esp + 0x18]
push ecx
push eax
push eax
push eax
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x34]
push eax
push esi
push edi
mov dword [esp + 0x30], 0xff
call ebx
cmp eax, 0x103
jne 0x471b9a
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret

Function at 0x471c40
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
push esi
test ebx, ebx
je 0x471d2f
test edi, edi
je 0x471c58
cmp byte [edi], 0
jne 0x471c60
test ebp, ebp
je 0x471d2f
mov ecx, dword [0x4aa988]
mov edx, dword [ecx + 0xb0]
lea eax, [esp + 0x14]
push eax
or edx, 0x2001f
push edx
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x471d01
mov eax, dword [esp + 0x14]
test ebp, ebp
jne 0x471d18
push eax
call fcn.00471b50
mov ecx, dword [esp + 0x18]
add esp, 4
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x471d01
mov eax, 1
test byte [0x4b033c], al
jne 0x471cdf
or dword [0x4b033c], eax
push str.RegDeleteKeyExA
push str.advapi32
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x4b0338], eax
jmp 0x471ce4
mov eax, dword [0x4b0338]
mov edx, dword [0x4aa988]
mov ecx, dword [edx + 0xb0]
test ecx, ecx
je 0x471d0e
test eax, eax
je 0x471d0e
push 0
push ecx
push edi
push ebx
call eax
mov esi, eax
cmp esi, 0xffffffff
jne 0x471d34
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x471d36
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x471cff
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esp + 0x14]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x471d01
mov esi, 0x57
mov eax, esi
mov edx, dword [0x4aa988]
mov dword [edx + 0x30], eax
mov edx, dword [esp + 0x10]
test esi, esi
setne al
movzx ecx, al
push ecx
push edx
call fcn.0042f880
pop esi
pop ebp
pop ecx
ret 8
Function at 0x4723a0
Capabilities:
Clear file content

Disassembly:
mov eax, dword [esi + 0x2c]
push ebx
xor ebx, ebx
push ebp
push edi
cmp eax, ebx
je 0x4723c6
sub eax, dword [esi + 0x30]
mov edi, dword [esi]
sub eax, dword [esi + 8]
push 1
cdq
push edx
push eax
mov eax, dword [edi + 0x14]
mov ecx, esi
call eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 8], ebx
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x4723e3
cmp dword [esi + 0x2c], ebx
jne 0x4723e3
mov edx, dword [esi]
mov edx, dword [edx + 0x10]
push eax
mov eax, dword [esi + 0x30]
push eax
mov ecx, esi
call edx
mov dword [esi + 8], ebx
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
mov ecx, esi
mov byte [esi + 0x28], bl
call edx
mov ecx, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x18]
mov edi, eax
mov eax, dword [esi]
push ebx
mov ebp, edx
mov edx, dword [eax + 0x14]
push ecx
mov ecx, esi
call edx
test al, al
je 0x47244d
mov eax, dword [esi + 0x34]
push eax
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
je 0x47244d
cmp ebx, ebp
jg 0x47242d
jl 0x472425
cmp dword [esp + 0x10], edi
jae 0x47242d
mov eax, dword [esp + 0x10]
mov ecx, ebx
jmp 0x472431
mov eax, edi
mov ecx, ebp
mov edx, dword [esi]
push 0
push ecx
push eax
mov eax, dword [edx + 0x14]
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x1c]
mov ecx, esi
call eax
pop edi
pop ebp
pop ebx
ret 8
pop edi
or eax, 0xffffffff
pop ebp
or edx, eax
pop ebx
ret 8

Function at 0x475750
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x148
push edi
test esi, esi
je 0x4757d0
cmp byte [esi], 0
je 0x4757d0
push 4
push 0x4a3ac0
push esi
call fcn.0048a18f
add esp, 0xc
test eax, eax
mov eax, esi
jne 0x475779
lea eax, [esi + 4]
mov edi, 0x4a131c
call fcn.00409bf0
test eax, eax
je 0x4757b3
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4757d0
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
test ebx, ebx
je 0x4757a9
mov ecx, dword [esp + 8]
mov dword [ebx], ecx
mov al, 1
pop edi
add esp, 0x148
ret
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test ebx, ebx
je 0x4757c0
mov dword [ebx], eax
xor edx, edx
cmp eax, 0xffffffff
setne al
pop edi
add esp, 0x148
ret
xor al, al
pop edi
add esp, 0x148
ret

Function at 0x475a20
Capabilities:
Get file size

Disassembly:
sub esp, 0xc
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov dword [esp], eax
cmp eax, 0xffffffff
jne 0x475a57
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
je 0x475a54
or eax, 0xffffffff
or edx, 0xffffffff
add esp, 0xc
ret
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
ret
Function at 0x475e00
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x8000
call fcn.004943d0
push esi
push 0x7fff
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
mov esi, eax
test esi, esi
je 0x475e45
lea eax, [esi + 1]
cmp eax, 0x7fff
ja 0x475e45
push eax
lea edx, [esp + 8]
push edx
push edi
call fcn.00490500
add esp, 0xc
mov eax, esi
pop esi
add esp, 0x8000
ret
mov eax, esi
mov byte [edi], 0
pop esi
add esp, 0x8000
ret