joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439b00
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x94
xor eax, eax
mov edx, dword [esp + 0x98]
mov dword [esp + 9], eax
push ebx
mov dword [esp + 0x11], eax
mov ebx, ecx
mov ecx, dword [esp + 0xa8]
mov word [esp + 0x15], ax
mov byte [esp + 0x17], al
mov dword [esp + 8], eax
mov eax, dword [ebx + 8]
mov dword [esp + 0xc], ecx
test eax, eax
mov dword [esp + 0x14], edx
je 0x439c46
mov eax, dword [str.EPIPEMAGQQ]
mov ecx, dword [0x44a424]
mov dx, word [0x44a428]
mov dword [esp + 0x18], eax
mov al, byte [0x44a42a]
push ebp
push esi
push edi
mov dword [esp + 0x28], ecx
mov byte [esp + 0x2e], al
mov ecx, 0x1d
xor eax, eax
lea edi, [esp + 0x2f]
mov word [esp + 0x2c], dx
rep stosd dword es:[edi], eax
mov edx, dword [ebx + 0x24]
lea esi, [ebx + 0x24]
stosb byte es:[edi], al
mov edi, dword [esp + 0xac]
mov ecx, esi
push edi
call dword [edx]
push eax
mov dword [esp + 0x14], eax
call sub.MFC42.DLL_operatornew
add esp, 4
lea ecx, [esp + 0x10]
mov ebp, eax
mov eax, dword [esi]
push ecx
mov ecx, dword [esp + 0xb4]
lea edx, [esp + 0x28]
push ebp
push edx
push edi
push ecx
mov ecx, esi
call dword [eax + 4]
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [ebx + 0x10]
lea eax, [esp + 0x14]
push esi
mov dword [esp + 0x20], edx
mov edx, dword [ebx + 8]
push eax
lea ecx, [esp + 0x20]
push 0xc
push ecx
push edx
call edi
test eax, eax
jne 0x439c1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xc
push eax
mov ecx, ebx
call fcn.00439c80
cmp eax, 1
jne 0x439c3a
mov ecx, dword [esp + 0x10]
mov edx, dword [ebx + 8]
lea eax, [esp + 0x14]
push esi
push eax
push ecx
push ebp
push edx
call edi
test eax, eax
jne 0x439c27
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
push ecx
push eax
mov ecx, ebx
call fcn.00439c80
jmp 0x439c3a
cmp dword [esp + 0x14], 0xc
je 0x439bf3
jmp 0x439c33
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cmp edx, eax
je 0x439c3a
mov ecx, ebx
call fcn.00439cd0
push ebp
call sub.MFC42.DLL_operatordelete
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x94
ret 0x10

Function at 0x439d70
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 4], eax
mov dword [0x45b204], ecx
mov ecx, esi
call fcn.0043a0b0
mov eax, dword [esi + 4]
lea edx, [esp + 8]
push edx
push 0
push eax
push 0x439dc0
push 0
push 0
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
ret 8
Function at 0x43a420
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
mov eax, dword [edi]
push eax
call sub.WSOCK32.dll_ntohl
mov ecx, dword [edi + 4]
mov esi, eax
push ecx
call sub.WSOCK32.dll_ntohl
mov ebp, dword [esp + 0x28]
lea edx, [esp + 0x10]
mov edi, eax
lea ebx, [esp + 0x10]
sub ebp, edx
mov dword [esp + 0x24], 4
mov eax, dword [ebx + ebp]
push eax
call sub.WSOCK32.dll_ntohl
mov dword [ebx], eax
mov eax, dword [esp + 0x24]
add ebx, 4
dec eax
mov dword [esp + 0x24], eax
jne 0x43a456
mov ecx, dword [esp + 0x1c]
xor eax, eax
mov dword [esp + 0x24], 0x10
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
mov edx, edi
sub eax, 0x61c88647
shr edx, 5
add edx, ebx
mov ebx, edi
shl ebx, 4
add ebx, ebp
mov ebp, dword [esp + 0x18]
xor edx, ebx
lea ebx, [eax + edi]
xor edx, ebx
add esi, edx
mov edx, esi
mov ebx, esi
shr edx, 5
shl ebx, 4
add edx, ecx
add ebx, ebp
xor edx, ebx
lea ebx, [eax + esi]
xor edx, ebx
add edi, edx
mov edx, dword [esp + 0x24]
dec edx
mov dword [esp + 0x24], edx
jne 0x43a47d
push esi
call sub.WSOCK32.dll_htonl
mov esi, dword [esp + 0x2c]
push edi
mov dword [esi], eax
call sub.WSOCK32.dll_htonl
mov dword [esi + 4], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x43a4f0
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov eax, dword [esi]
push eax
call sub.WSOCK32.dll_ntohl
mov ecx, dword [esi + 4]
mov edi, eax
push ecx
call sub.WSOCK32.dll_ntohl
mov ebp, dword [esp + 0x28]
lea edx, [esp + 0x10]
mov esi, eax
lea ebx, [esp + 0x10]
sub ebp, edx
mov dword [esp + 0x24], 4
mov eax, dword [ebx + ebp]
push eax
call sub.WSOCK32.dll_ntohl
mov dword [ebx], eax
mov eax, dword [esp + 0x24]
add ebx, 4
dec eax
mov dword [esp + 0x24], eax
jne 0x43a526
mov ecx, dword [esp + 0x14]
mov eax, 0xe3779b90
mov dword [esp + 0x24], 0x10
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov edx, edi
shr edx, 5
add edx, ebx
mov ebx, edi
shl ebx, 4
add ebx, ebp
mov ebp, dword [esp + 0x10]
xor edx, ebx
lea ebx, [eax + edi]
xor edx, ebx
sub esi, edx
mov edx, esi
mov ebx, esi
shr edx, 5
shl ebx, 4
add edx, ecx
add ebx, ebp
xor edx, ebx
lea ebx, [eax + esi]
xor edx, ebx
add eax, 0x61c88647
sub edi, edx
mov edx, dword [esp + 0x24]
dec edx
mov dword [esp + 0x24], edx
jne 0x43a550
push edi
call sub.WSOCK32.dll_htonl
mov edi, dword [esp + 0x2c]
push esi
mov dword [edi], eax
call sub.WSOCK32.dll_htonl
mov dword [edi + 4], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4010c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45574d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x45994c
mov dword [esp + 0x14], 0
lea ecx, [esi + 0x60]
mov dword [esp + 8], ecx
mov dword [ecx], vtable.CGdiObject.0
mov byte [esp + 0x14], 7
call fcn.00444d82
lea ecx, [esi + 0x58]
mov dword [esp + 8], ecx
mov dword [ecx], vtable.CGdiObject.0
mov byte [esp + 0x14], 8
call fcn.00444d82
lea ecx, [esi + 0x50]
mov dword [esp + 8], ecx
mov dword [ecx], vtable.CGdiObject.0
mov byte [esp + 0x14], 9
call fcn.00444d82
lea ecx, [esi + 0x48]
mov dword [esp + 8], ecx
mov dword [ecx], vtable.CGdiObject.0
mov byte [esp + 0x14], 0xa
call fcn.00444d82
lea ecx, [esi + 0x40]
mov dword [esp + 8], ecx
mov dword [ecx], vtable.CGdiObject.0
mov byte [esp + 0x14], 0xb
call fcn.00444d82
lea ecx, [esi + 0x38]
mov dword [esp + 8], ecx
mov dword [ecx], vtable.CGdiObject.0
mov byte [esp + 0x14], 0xc
call fcn.00444d82
lea ecx, [esi + 0x30]
mov dword [esp + 8], ecx
mov dword [ecx], vtable.CGdiObject.0
mov byte [esp + 0x14], 0xd
call fcn.00444d82
lea ecx, [esi + 0x28]
mov dword [esp + 8], ecx
mov dword [ecx], vtable.CGdiObject.0
mov dword [esp + 0x14], 0xe
call fcn.00444d82
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x403cd0
Capabilities:
Copy file
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x455af0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [0x470a10]
push ebp
push esi
push edi
mov dword [esp + 0xc], eax
xor esi, esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], eax
mov ebp, dword [esp + 0x2c]
lea eax, [esp + 0xc]
push ebp
push 0x46d128
push eax
mov byte [esp + 0x2c], 2
call fcn.0043620d
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov eax, dword [ecx - 8]
cmp eax, esi
jle 0x403d9d
lea edi, [esi + 1]
lea edx, [esp + 0x2c]
push edi
push edx
lea ecx, [esp + 0x14]
call fcn.00435d97
mov eax, dword [eax]
lea ecx, [esp + 0x10]
push eax
push 0x46d128
push ecx
mov byte [esp + 0x2c], 3
call fcn.0043620d
add esp, 0xc
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 2
call fcn.0043f295
mov edx, dword [esp + 0xc]
cmp byte [esi + edx], 0x5c
jne 0x403d92
mov eax, dword [esp + 0x10]
push 0
push eax
call fcn.0041ffcf
add esp, 8
cmp eax, 0xffffffff
jne 0x403d92
mov ecx, dword [esp + 0x10]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x403dc8
mov edx, dword [esp + 0xc]
mov esi, edi
cmp esi, dword [edx - 8]
jl 0x403d29
mov eax, dword [esp + 0x28]
push 0
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x403e09
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x18]
push str.COPY_FAIL_CODE__d
push ecx
call fcn.0043620d
add esp, 0xc
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], 1
call fcn.0043f295
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 0
call fcn.0043f295
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
call fcn.0043f295
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], 1
call fcn.0043f295
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 0
call fcn.0043f295
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
call fcn.0043f295
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov eax, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x4043a0
Capabilities:
Print debug messages

Disassembly:
mov ecx, dword [esp + 4]
lea eax, [esp + 8]
push eax
push ecx
push 0x46d135
call fcn.00420138
add esp, 0xc
push 0x46d12c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
ret

Function at 0x4043d0
Capabilities:
Print debug messages

Disassembly:
mov ecx, dword [esp + 4]
lea eax, [esp + 8]
push eax
push ecx
push 0x46d53e
call fcn.00420189
add esp, 0xc
push str._UsbPlus_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
ret
Function at 0x404880
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x455bf3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x470a10]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea edi, [esi + 4]
mov dword [edi], eax
mov ecx, dword [0x470a10]
lea ebx, [esi + 8]
mov dword [esp + 0x1c], 0
mov dword [ebx], ecx
mov edx, dword [0x470a10]
lea ebp, [esi + 0xc]
mov dword [ebp], edx
mov eax, dword [0x470a10]
mov dword [esi + 0x10], eax
mov ecx, dword [0x470a10]
mov dword [esi + 0x14], ecx
mov edx, dword [0x470a10]
mov dword [esi + 0x18], edx
mov eax, dword [0x470a10]
mov dword [esi + 0x1c], eax
mov ecx, dword [0x470a10]
mov dword [esi + 0x20], ecx
mov edx, dword [0x470a10]
mov dword [esi + 0x24], edx
mov eax, dword [0x470a10]
mov dword [esi + 0x28], eax
mov ecx, dword [0x470a10]
mov dword [esi + 0x2c], ecx
push fcn.00439c28
push fcn.00439bf5
push 3
lea edx, [esi + 0x30]
push 0x14
push edx
mov byte [esp + 0x30], 0xa
call fcn.0042052c
push fcn.00439c28
push fcn.00439bf5
push 4
lea eax, [esi + 0x6c]
push 0x14
push eax
mov byte [esp + 0x30], 0xb
call fcn.0042052c
lea ecx, [esi + 0xbc]
mov byte [esp + 0x1c], 0xc
call fcn.00405910
mov ecx, edi
mov byte [esp + 0x1c], 0xd
mov dword [esi], 0x459d08
call fcn.0043f220
mov ecx, ebx
call fcn.0043f220
mov ecx, ebp
call fcn.0043f220
lea ecx, [esi + 0x10]
call fcn.0043f220
lea ecx, [esi + 0x14]
call fcn.0043f220
mov eax, esi
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 8]
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4049c0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x455cb3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x459d08
mov eax, dword [esi + 0x38]
mov dword [esp + 0x10], 0xd
test eax, eax
jle 0x404a16
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00439c88
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00439c88
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x58]
call fcn.00439c88
mov eax, dword [esi + 0x74]
test eax, eax
jle 0x404a56
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x6c]
call fcn.00439c88
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x80]
call fcn.00439c88
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x94]
call fcn.00439c88
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0xa8]
call fcn.00439c88
lea ecx, [esi + 0xbc]
mov byte [esp + 0x10], 0xc
call fcn.00405960
push fcn.00439c28
push 4
lea eax, [esi + 0x6c]
push 0x14
push eax
mov byte [esp + 0x20], 0xb
call fcn.00420438
push fcn.00439c28
push 3
lea ecx, [esi + 0x30]
push 0x14
push ecx
mov byte [esp + 0x20], 0xa
call fcn.00420438
lea ecx, [esi + 0x2c]
mov byte [esp + 0x10], 9
call fcn.0043f295
lea ecx, [esi + 0x28]
mov byte [esp + 0x10], 8
call fcn.0043f295
lea ecx, [esi + 0x24]
mov byte [esp + 0x10], 7
call fcn.0043f295
lea ecx, [esi + 0x20]
mov byte [esp + 0x10], 6
call fcn.0043f295
lea ecx, [esi + 0x1c]
mov byte [esp + 0x10], 5
call fcn.0043f295
lea ecx, [esi + 0x18]
mov byte [esp + 0x10], 4
call fcn.0043f295
lea ecx, [esi + 0x14]
mov byte [esp + 0x10], 3
call fcn.0043f295
lea ecx, [esi + 0x10]
mov byte [esp + 0x10], 2
call fcn.0043f295
lea ecx, [esi + 0xc]
mov byte [esp + 0x10], 1
call fcn.0043f295
lea ecx, [esi + 8]
mov byte [esp + 0x10], 0
call fcn.0043f295
lea ecx, [esi + 4]
mov dword [esp + 0x10], 0xffffffff
call fcn.0043f295
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x404c40
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x455cf3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x404
push ebx
push ebp
push esi
push edi
mov ebp, ecx
mov eax, dword [0x470a10]
xor ebx, ebx
mov dword [esp + 0x41c], ebx
mov dword [esp + 0x10], eax
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp + 0xbc]
mov byte [esp + 0x41c], 1
stosb byte es:[edi], al
call fcn.00405f60
mov ecx, dword [esp + 0x424]
lea edx, [esp + 0x14]
push ecx
push 0x400
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 1
jae 0x404d08
mov eax, dword [esp + 0x424]
push eax
push str.Cant_get_the_ini_section_value_in_the_file.___s_
call fcn.00404400
add esp, 8
lea ecx, [esp + 0x10]
mov byte [esp + 0x41c], bl
call fcn.0043f295
lea ecx, [esp + 0x424]
mov dword [esp + 0x41c], 0xffffffff
call fcn.0043f295
xor eax, eax
jmp 0x404e31
xor esi, esi
mov al, byte [esp + esi + 0x14]
cmp al, bl
je 0x404d21
push eax
lea ecx, [esp + 0x14]
call fcn.0043f698
jmp 0x404dec
lea ecx, [esp + 0x10]
call fcn.0043f811
mov ecx, dword [esp + 0x10]
push str.INFORMATION
push ecx
call fcn.0041fdfe
add esp, 8
test eax, eax
jne 0x404d58
mov edx, dword [esp + 0x424]
mov ecx, ebp
push edx
call fcn.00404e50
test eax, eax
je 0x404cda
jmp 0x404de3
mov eax, dword [esp + 0x10]
push str.FOLDER
push eax
call fcn.0041fdfe
add esp, 8
test eax, eax
jne 0x404d87
mov ecx, dword [esp + 0x424]
push ecx
mov ecx, ebp
call fcn.00404f90
test eax, eax
je 0x404cda
jmp 0x404de3
mov edx, dword [esp + 0x10]
push str.VARIABLE
push edx
call fcn.0041fdfe
add esp, 8
test eax, eax
jne 0x404db6
mov eax, dword [esp + 0x424]
mov ecx, ebp
push eax
call fcn.004050c0
test eax, eax
je 0x404cda
jmp 0x404de3
mov ecx, dword [esp + 0x10]
push str.EXECUTE
push ecx
call fcn.0041fdfe
add esp, 8
test eax, eax
jne 0x404de3
mov edx, dword [esp + 0x424]
mov ecx, ebp
push edx
call fcn.004055a0
test eax, eax
je 0x404cda
lea ecx, [esp + 0x10]
call fcn.0043f220
cmp byte [esp + esi + 0x14], bl
jne 0x404df8
cmp byte [esp + esi + 0x15], bl
je 0x404e05
inc esi
cmp esi, 0x400
jb 0x404d0a
lea ecx, [esp + 0x10]
mov byte [esp + 0x41c], bl
call fcn.0043f295
lea ecx, [esp + 0x424]
mov dword [esp + 0x41c], 0xffffffff
call fcn.0043f295
mov eax, 1
mov ecx, dword [esp + 0x414]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x410
ret 4
Function at 0x404e50
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x100
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
mov ebp, dword [esp + 0x114]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor esi, esi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x10]
push ebp
rep stosd dword es:[edi], eax
mov ecx, dword [esi*4 + 0x46de08]
lea eax, [esp + 0x14]
push 0x100
push eax
push str.THERE_IS_NO_VALUE
push ecx
push str.INFORMATION
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x10]
push str.THERE_IS_NO_VALUE
push edx
call fcn.0041fdfe
add esp, 8
test eax, eax
je 0x404f51
cmp esi, 5
ja case.default.0x404ec9
jmp dword [esi*4 + 0x404f70]
lea eax, [esp + 0x10]
lea ecx, [ebx + 4]
push eax
push 0x46d128
push ecx
jmp 0x404f2d
lea edx, [esp + 0x10]
lea eax, [ebx + 8]
push edx
push 0x46d128
push eax
jmp 0x404f2d
lea ecx, [esp + 0x10]
lea edx, [ebx + 0xc]
push ecx
push 0x46d128
jmp 0x404f2c
lea eax, [esp + 0x10]
lea ecx, [ebx + 0x10]
push eax
push 0x46d128
push ecx
jmp 0x404f2d
lea edx, [esp + 0x10]
lea eax, [ebx + 0x14]
push edx
push 0x46d128
push eax
jmp 0x404f2d
lea ecx, [esp + 0x10]
lea edx, [ebx + 0x18]
push ecx
push 0x46d128
push edx
call fcn.0043620d
add esp, 0xc
inc esi
cmp esi, 6
jl 0x404e7a
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x100
ret 4
push str.Cant_get_the_kye_value_in_the__INFORMATION__section.
call fcn.00404400
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 4

Function at 0x404f90
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x100
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
mov ebp, dword [esp + 0x114]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor esi, esi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x10]
push ebp
rep stosd dword es:[edi], eax
mov ecx, dword [esi*4 + 0x46de20]
lea eax, [esp + 0x14]
push 0x100
push eax
push str.THERE_IS_NO_VALUE
push ecx
push str.FOLDER
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x10]
push str.THERE_IS_NO_VALUE
push edx
call fcn.0041fdfe
add esp, 8
test eax, eax
je 0x40508d
cmp esi, 4
ja case.default.0x405009
jmp dword [esi*4 + 0x4050ac]
lea eax, [esp + 0x10]
lea ecx, [ebx + 0x1c]
push eax
push 0x46d128
push ecx
jmp 0x40505d
lea edx, [esp + 0x10]
lea eax, [ebx + 0x20]
push edx
push 0x46d128
jmp 0x40505c
lea ecx, [esp + 0x10]
lea edx, [ebx + 0x24]
push ecx
push 0x46d128
push edx
jmp 0x40505d
lea eax, [esp + 0x10]
lea ecx, [ebx + 0x28]
push eax
push 0x46d128
push ecx
jmp 0x40505d
lea edx, [esp + 0x10]
lea eax, [ebx + 0x2c]
push edx
push 0x46d128
push eax
call fcn.0043620d
add esp, 0xc
inc esi
cmp esi, 5
jl 0x404fba
push ebx
lea ecx, [ebx + 0xbc]
call fcn.004059e0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x100
ret 4
push str.Cant_get_the_key_value_in_the__FOLDER__section.
call fcn.00404400
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 4
Function at 0x4050c0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x455d2c
push eax
mov eax, 0x1014
mov dword fs:[0], esp
call fcn.004205b0
push ebx
push ebp
push esi
mov ebp, ecx
push edi
xor ebx, ebx
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x25]
mov byte [esp + 0x24], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x470a10]
mov dword [esp + 0x10], eax
mov dword [esp + 0x102c], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x1034]
lea ecx, [esp + 0x24]
push eax
push 0x1000
push ecx
push str.VARIABLE
mov byte [esp + 0x103c], 2
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
push ebx
lea edx, [esp + 0x28]
push ebx
lea eax, [esp + 0x18]
push edx
push eax
xor esi, esi
call fcn.0043f9f1
test eax, eax
je 0x405202
mov eax, dword [esp + 0x10]
cmp dword [eax - 8], ebx
je 0x405202
push 0x3d
push ebx
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.0043f9f1
test eax, eax
je 0x40529d
mov edx, dword [esp + 0x18]
cmp dword [edx - 8], ebx
je 0x40529d
mov eax, dword [esp + 0x10]
push 0x3d
push 1
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.0043f9f1
test eax, eax
je 0x405257
mov edx, dword [esp + 0x14]
cmp dword [edx - 8], ebx
je 0x405257
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0043f00a
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
mov byte [esp + 0x1038], 3
call fcn.0043f00a
lea ecx, [ebp + 0xbc]
mov byte [esp + 0x1034], 2
call fcn.00405cb0
inc esi
push ebx
lea eax, [esp + 0x28]
push esi
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.0043f9f1
test eax, eax
jne 0x405153
lea ecx, [esp + 0x18]
mov byte [esp + 0x102c], 1
call fcn.0043f295
lea ecx, [esp + 0x14]
mov byte [esp + 0x102c], bl
call fcn.0043f295
lea ecx, [esp + 0x10]
mov dword [esp + 0x102c], 0xffffffff
call fcn.0043f295
mov eax, 1
mov ecx, dword [esp + 0x1024]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x1020
ret 4
push str.Cant_get_the_key_value_in_the__INFORMATION__section.
call fcn.00404400
add esp, 4
lea ecx, [esp + 0x18]
mov byte [esp + 0x102c], 1
call fcn.0043f295
lea ecx, [esp + 0x14]
mov byte [esp + 0x102c], bl
call fcn.0043f295
lea ecx, [esp + 0x10]
mov dword [esp + 0x102c], 0xffffffff
call fcn.0043f295
xor eax, eax
jmp 0x40523c
push str.Cant_get_the_key_value_in_the__VARIABLE__section.
call fcn.00404400
add esp, 4
lea ecx, [esp + 0x18]
mov byte [esp + 0x102c], 1
call fcn.0043f295
lea ecx, [esp + 0x14]
mov byte [esp + 0x102c], bl
call fcn.0043f295
lea ecx, [esp + 0x10]
mov dword [esp + 0x102c], 0xffffffff
call fcn.0043f295
xor eax, eax
jmp 0x40523c
Function at 0x4068f0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x455fd6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
mov eax, dword [0x470a10]
push ebp
mov dword [esp + 4], eax
lea ecx, [esp + 4]
mov dword [esp + 0x21c], 0
call fcn.0043f220
mov eax, dword [esp + 0x224]
mov ebp, dword [eax + 8]
cmp ebp, 1
jge 0x40695e
push str.Delete_file_information_not_find
call fcn.00404400
add esp, 4
lea ecx, [esp + 4]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0043f295
jmp 0x406a5d
push esi
xor esi, esi
test ebp, ebp
jle 0x406a48
push edi
lea edi, [eax + 0x14]
lea ecx, [esp + 0x14]
push esi
push ecx
mov ecx, edi
call fcn.00405fe0
mov eax, dword [eax]
lea edx, [esp + 0x18]
lea ecx, [esp + 0x118]
push edx
push ecx
push 0
push 0
push eax
call fcn.004205df
add esp, 0x14
lea ecx, [esp + 0x14]
call fcn.0043f295
mov edx, dword [0x470a10]
mov dword [esp + 0x10], edx
lea eax, [esp + 0x18]
lea ecx, [esp + 0x118]
push eax
push ecx
lea edx, [esp + 0x18]
push 0x46e098
push edx
mov byte [esp + 0x234], 1
call fcn.0043620d
add esp, 0x10
lea ecx, [esp + 0xc]
call fcn.0043f220
mov eax, dword [esp + 0x10]
mov ecx, dword [0x475354]
push eax
push 0x46e1b8
push ecx
lea edx, [esp + 0x18]
push str._s_s_s
push edx
call fcn.0043620d
mov eax, dword [esp + 0x20]
push 0
push eax
call fcn.0041ffcf
add esp, 0x1c
test eax, eax
jne 0x406a2d
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x406a2d
mov edx, dword [esp + 0xc]
push edx
push str.File_delete_fail.___s_
call fcn.00404400
add esp, 8
lea ecx, [esp + 0x10]
mov byte [esp + 0x224], 0
call fcn.0043f295
inc esi
cmp esi, ebp
jl 0x40696d
pop edi
lea ecx, [esp + 8]
mov dword [esp + 0x220], 0xffffffff
call fcn.0043f295
pop esi
mov ecx, dword [esp + 0x214]
pop ebp
mov dword fs:[0], ecx
add esp, 0x21c
ret 4