joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43592e
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x17c
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0x10]
call fcn.00442433
pop ecx
pop ecx
test eax, eax
jne 0x435a9d
push 0x200
call fcn.0043f4d3
pop ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x435963
push ebx
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 8]
sub eax, ecx
inc eax
call fcn.00435d23
mov ebx, eax
mov edi, ebx
mov dword [ebp - 0xc], ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x435982
mov ecx, dword [ebp + 0x14]
push esi
mov esi, 0x45886c
movsw word es:[edi], word [esi]
mov edx, ecx
mov al, byte [ecx]
inc ecx
test al, al
jne 0x435997
sub ecx, edx
mov edi, ebx
mov esi, edx
mov edx, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4359a7
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x17c]
mov ecx, edx
push eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x435a85
mov dword [ebp - 4], 0x200
mov dword [ebp + 0x14], 0x80
lea eax, [ebp - 0x150]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4359ee
push dword [ebp + 0x10]
mov edi, dword [ebp + 8]
sub eax, edx
inc eax
call fcn.00435d23
mov ebx, eax
mov edi, ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x435a08
mov esi, 0x45886c
lea eax, [ebp - 0x150]
movsw word es:[edi], word [esi]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x435a1f
mov edi, ebx
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x435a2d
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp dword [ebp + 0x14], 2
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0xc]
jae 0x435a69
add dword [ebp - 4], 0x200
push dword [ebp - 4]
sub dword [ebp + 0x14], 0xffffff80
push dword [esi]
call fcn.0043fed6
pop ecx
pop ecx
test eax, eax
je 0x435aa3
mov dword [esi], eax
mov eax, dword [esi]
mov dword [eax], ebx
lea eax, [ebp - 0x17c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4359e5
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
call fcn.00435e5c
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
pop edi
pop ebx
xor eax, eax
leave
ret 0x10
mov eax, dword [esi]
test eax, eax
je 0x435ab0
push eax
call fcn.0043fe48
pop ecx
and dword [esi], 0
jmp 0x435a9a
Function at 0x43618c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
and dword [ebp - 8], 0
push esi
lea eax, [ebp - 0x40]
push eax
push dword [ebp + 8]
mov byte [ebp - 1], 1
call fcn.00442433
pop ecx
pop ecx
test eax, eax
jne 0x4361dc
push 0x459b44
push dword [ebp + 8]
call fcn.00440b2e
pop ecx
pop ecx
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x4361e3
push dword [ebp + 8]
push str.ERROR:_Unable_to_open__s_for_reading_n
call fcn.00442b4d
mov eax, dword [ebp + 0xc]
pop ecx
pop ecx
test eax, eax
je 0x4361dc
and dword [eax], 0
xor al, al
pop esi
leave
ret 8
mov eax, dword [ebp - 0x2c]
inc eax
push eax
call fcn.0043f4d3
pop ecx
mov dword [edi], eax
test eax, eax
je 0x4361dc
mov ecx, dword [ebp - 0x2c]
mov byte [eax + ecx], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x2c]
test ecx, ecx
je 0x43620a
mov dword [ecx], eax
test eax, eax
jbe 0x436271
sub eax, dword [ebp - 8]
mov esi, eax
cmp esi, 0x8000
jbe 0x436220
mov esi, 0x8000
push dword [ebp - 0x10]
push esi
push 1
push dword [ebp - 0xc]
call fcn.00440de5
add esp, 0x10
cmp eax, esi
jne 0x436245
add dword [ebp - 8], eax
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 8], eax
jb 0x43620e
jmp 0x436271
push dword [ebp + 8]
push dword [ebp - 8]
push esi
push str.Unable_to_read__li_bytes_at_offset__li_from_file__s_n
call fcn.00442b4d
push dword [edi]
call fcn.0043fe48
mov eax, dword [ebp + 0xc]
and dword [edi], 0
add esp, 0x14
test eax, eax
je 0x43626d
and dword [eax], 0
mov byte [ebp - 1], 0
push dword [ebp - 0x10]
call fcn.004412af
mov al, byte [ebp - 1]
pop ecx
jmp 0x4361de
Function at 0x437537
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
push 0x40
pop eax
cmp dword [ebp + 0x10], eax
jbe 0x43754e
mov dword [ebp + 0x10], eax
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc], ebx
cmp dword [ebp + 0x14], ebx
je 0x4375a7
push dword [0x470d6c]
call fcn.00437216
pop ecx
push ebx
push 1
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push eax
push dword [ebp + 0x14]
call fcn.004376dd
add esp, 0x18
push dword [0x470d6c]
test al, al
je 0x43764e
call fcn.0043722a
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
jmp 0x4375c4
mov eax, dword [0x470d6c]
mov esi, 0x471738
mov dword [esp + 0xc], eax
mov edi, 0x470d70
jmp 0x4375c5
push dword [ebp + 0x14]
call fcn.00437252
pop ecx
mov eax, dword [ebp + 0x10]
cmp dword [esi], eax
jae 0x4375bc
push dword [esp + 0xc]
call fcn.00437216
pop ecx
push ebx
push 4
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push ebx
call fcn.0043fc93
mov ecx, dword [esi]
mov dword [esp + 0x28], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x18
mov dword [edi + ecx*4], eax
mov eax, dword [esi]
cmp dword [edi + eax*4], 0xffffffff
jne 0x437629
push 0x32
call ebx
xor eax, eax
push eax
push 4
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push eax
call fcn.0043fc93
mov ecx, dword [esi]
add esp, 0x18
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 5
mov dword [edi + ecx*4], eax
jl 0x4375f8
mov eax, dword [esi]
cmp dword [edi + eax*4], 0xffffffff
jne 0x437639
dec eax
mov dword [esi], eax
or eax, 0xffffffff
jmp 0x437656
push 0
call ebx
mov eax, dword [esi]
push dword [edi + eax*4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
inc dword [esi]
push dword [esp + 0xc]
call fcn.0043722a
xor eax, eax
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x437f46
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, esi
push edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x437f5a
sub eax, edx
cmp eax, 0x104
jae 0x4380dd
lea eax, [ebp - 0x3c]
push eax
push esi
call fcn.00442433
pop ecx
pop ecx
test eax, eax
jne 0x437f8e
test dword [ebp - 0x36], 0x4000
je 0x437f8e
mov al, 1
jmp 0x4380df
lea edx, [ebp - 0x144]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x437f98
push 0x5c
pop ebx
lea eax, [ebp - 0x144]
push ebx
push eax
call fcn.0043f640
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4380a7
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x437fc1
sub eax, edx
cmp eax, 3
jbe 0x438002
cmp byte [esi + 1], bl
jne 0x438002
push ebx
add esi, 2
push esi
call fcn.0043f640
pop ecx
pop ecx
test eax, eax
je 0x4380a7
inc eax
push ebx
push eax
call fcn.0043f640
pop ecx
pop ecx
test eax, eax
je 0x4380a7
push ebx
inc eax
push eax
jmp 0x43809a
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x438007
sub eax, edx
mov edi, eax
lea eax, [ebp - 0x144]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x43801b
sub eax, ecx
cmp edi, eax
je 0x4380a3
mov al, byte [esi - 1]
cmp al, 0x3a
je 0x438097
cmp al, bl
jne 0x4380a3
jmp 0x438097
lea eax, [ebp - 0x144]
mov byte [esi], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x438041
sub eax, edx
je 0x438095
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x144]
push eax
call fcn.00442433
pop ecx
pop ecx
test eax, eax
jne 0x438084
test dword [ebp - 0x36], 0x4000
jne 0x438095
lea eax, [ebp - 0x144]
push eax
push dword [ebp + 8]
push str.Cant_create_dir__s:_non_dir__s_in_the_way
call fcn.00442b4d
add esp, 0xc
jmp 0x4380dd
lea eax, [ebp - 0x144]
push eax
call fcn.00441fc3
pop ecx
test eax, eax
jne 0x4380e4
mov byte [esi], bl
push ebx
inc esi
push esi
call fcn.0043f640
pop ecx
mov esi, eax
pop ecx
test esi, esi
jne 0x438035
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4380bd
test al, 0x10
jne 0x437f87
push dword [ebp + 8]
call fcn.00441fc3
pop ecx
test eax, eax
je 0x437f87
push dword [ebp + 8]
push str.Unable_to_create_dir__s
call fcn.00442b4d
pop ecx
pop ecx
xor al, al
pop edi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x144]
push eax
push str.Cant_create_dir__s:_mkdir_fails
jmp 0x4380d6
Function at 0x438178
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x118
push ebx
push esi
push edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x43818a
sub eax, ecx
cmp eax, 0x104
jbe 0x4381a1
xor al, al
jmp 0x43823b
push dword [ebp + 8]
lea eax, [ebp - 0x118]
call fcn.00437e6b
pop ecx
lea eax, [ebp - 0x118]
push eax
call fcn.00437f46
pop ecx
test al, al
je 0x43819a
xor ebx, ebx
mov byte [ebp - 1], bl
mov edi, str.__s__n
push 0x45c004
push dword [ebp + 8]
call fcn.00440b2e
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x438240
push dword [ebp + 8]
push str.Unable_to_open__s_for_writing__will_try_again_in_1_sec
call fcn.00442b4d
and dword [ebp - 8], 0
lea esi, [ebp - 8]
call fcn.004380f2
push dword [ebp - 8]
push edi
call fcn.00442b4d
push dword [ebp - 8]
call fcn.0043fe48
add esp, 0x14
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x19
jb 0x4381cb
push dword [ebp + 8]
push str.ERROR:_Couldnt_open__s_for_writing_n
call fcn.004408b5
add eax, 0x40
push eax
call fcn.00440e02
add esp, 0xc
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov byte [ebp - 1], 1
mov dword [ebp - 8], eax
cmp dword [ebp + 0x10], ebx
jbe 0x4382c1
mov esi, dword [ebp + 0x10]
sub esi, ebx
mov eax, 0x8000
cmp esi, eax
jbe 0x438261
mov esi, eax
push dword [ebp - 0xc]
push esi
push 1
push dword [ebp - 8]
call fcn.00442286
add esp, 0x10
cmp eax, esi
jne 0x438282
add dword [ebp - 8], esi
add ebx, esi
cmp ebx, dword [ebp + 0x10]
jb 0x438251
jmp 0x4382c1
push dword [ebp + 8]
push ebx
push esi
push str.ERROR:_Unable_to_write__li_bytes_at_offset__li_to__s_n
call fcn.004408b5
add eax, 0x40
push eax
call fcn.00440e02
and dword [ebp - 8], 0
add esp, 0x14
lea esi, [ebp - 8]
call fcn.004380f2
push dword [ebp - 8]
push edi
call fcn.00442b4d
push dword [ebp - 8]
call fcn.0043fe48
add esp, 0xc
mov byte [ebp - 1], 0
push dword [ebp - 0xc]
call fcn.004412af
pop ecx
jmp 0x438238
Function at 0x4382cf
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
lea eax, [ebp - 0x40]
push eax
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 1], 1
call fcn.00442433
pop ecx
pop ecx
test eax, eax
jne 0x438341
push 0x459b44
push dword [ebp + 8]
call fcn.00440b2e
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
cmp eax, ebx
jne 0x438347
push dword [ebp + 8]
push str.ERROR:_Unable_to_open__s_for_reading_n
call fcn.00442b4d
lea esi, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.004380f2
push dword [ebp - 8]
push str.__s__n
call fcn.00442b4d
push dword [ebp - 8]
call fcn.0043fe48
mov eax, dword [ebp + 0xc]
add esp, 0x14
cmp eax, ebx
je 0x438341
mov dword [eax], ebx
xor al, al
pop esi
pop ebx
leave
ret
mov dword [edi], ebx
xor esi, esi
push dword [ebp - 0x2c]
call fcn.0043f4d3
pop ecx
mov dword [edi], eax
cmp eax, ebx
jne 0x43838a
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x1e
jl 0x43834b
cmp dword [edi], ebx
jne 0x43838a
push dword [ebp + 8]
push str.Cabby:_Unable_to_allocate_memory_to_read__s_to_mem_n
call fcn.004408b5
add eax, 0x40
push eax
call fcn.00440e02
add esp, 0xc
jmp 0x438341
mov ecx, dword [ebp + 0xc]
mov ebx, dword [edi]
mov eax, dword [ebp - 0x2c]
test ecx, ecx
je 0x438398
mov dword [ecx], eax
test eax, eax
jbe 0x438430
sub eax, dword [ebp - 8]
mov esi, eax
mov eax, 0x8000
cmp esi, eax
jbe 0x4383b0
mov esi, eax
push dword [ebp - 0xc]
push esi
push 1
push ebx
call fcn.00440de5
add esp, 0x10
cmp eax, esi
jne 0x4383d2
add dword [ebp - 8], eax
add ebx, eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 8], eax
jb 0x4383a0
jmp 0x438430
push dword [ebp + 8]
push dword [ebp - 8]
push esi
push str.Cabby:_Unable_to_read__li_bytes_at_offset__li_from_file__s_n
call fcn.004408b5
add eax, 0x40
push eax
call fcn.00440e02
and dword [ebp - 8], 0
add esp, 0x14
lea esi, [ebp - 8]
call fcn.004380f2
push dword [ebp - 8]
push str.__s__n
call fcn.004408b5
add eax, 0x40
push eax
call fcn.00440e02
push dword [ebp - 8]
call fcn.0043fe48
push edi
call fcn.0043fe48
mov eax, dword [ebp + 0xc]
add esp, 0x14
test eax, eax
je 0x43842c
and dword [eax], 0
mov byte [ebp - 1], 0
push dword [ebp - 0xc]
call fcn.004412af
mov al, byte [ebp - 1]
pop ecx
jmp 0x438343

Function at 0x439c8c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push edx
push esi
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, ecx
cmp edx, 4
jl 0x439cd3
cmp edx, 0x10
jl 0x439cbf
shr ecx, 4
nop
xor eax, dword [ebx]
mov esi, dword [ebx + 4]
xor eax, dword [ebx + 8]
xor esi, dword [ebx + 0xc]
add ebx, 0x10
xor eax, esi
dec ecx
jne 0x439cac
mov ecx, edx
shr ecx, 2
and ecx, 3
test ecx, ecx
je 0x439cd3
xor eax, dword [ebx]
add ebx, 4
dec ecx
jne 0x439ccb
and edx, 3
cmp edx, 3
jne 0x439ce7
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 0x10
xor eax, ecx
jmp 0x439cec
cmp edx, 2
jne 0x439cf8
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 8
xor eax, ecx
jmp 0x439cfd
cmp edx, 1
jne 0x439d03
xor ecx, ecx
mov cl, byte [ebx]
xor eax, ecx
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x44363d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4618e8]
jne 0x443647
repz ret
jmp fcn.0044c60c

Function at 0x44c712
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00443727
and dword [ebp - 4], 0
cmp dword [0x4705fc], 0
mov ebx, eax
jne 0x44c7c3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x44c874
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4568c0
push edi
call esi
test eax, eax
je 0x44c874
push eax
call fcn.004436b5
mov dword [esp], 0x4568b0
push edi
mov dword [0x4705fc], eax
call esi
push eax
call fcn.004436b5
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x470600], eax
call esi
push eax
call fcn.004436b5
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x470604], eax
call esi
push eax
call fcn.004436b5
pop ecx
mov dword [0x47060c], eax
test eax, eax
je 0x44c7c3
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004436b5
pop ecx
mov dword [0x470608], eax
mov eax, dword [0x470608]
cmp eax, ebx
je 0x44c81b
cmp dword [0x47060c], ebx
je 0x44c81b
push eax
call fcn.00443730
push dword [0x47060c]
mov esi, eax
call fcn.00443730
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x44c81b
test edi, edi
je 0x44c81b
call esi
test eax, eax
je 0x44c812
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x44c812
test byte [ebp - 0xc], 1
jne 0x44c81b
or dword [ebp + 0x10], 0x200000
jmp 0x44c854
mov eax, dword [0x470600]
cmp eax, ebx
je 0x44c854
push eax
call fcn.00443730
pop ecx
test eax, eax
je 0x44c854
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x44c854
mov eax, dword [0x470604]
cmp eax, ebx
je 0x44c854
push eax
call fcn.00443730
pop ecx
test eax, eax
je 0x44c854
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4705fc]
call fcn.00443730
pop ecx
test eax, eax
je 0x44c874
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x44c876
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x453ea8
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x453ed9
call fcn.004428f0
mov dword [eax], esi
call fcn.004428dd
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00442a5d
add esp, 0x14
or eax, 0xffffffff
jmp 0x453f14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x453ef6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00442903
pop ecx
jmp 0x453ed4
test byte [ebp + 0xc], 0x80
je 0x453f01
and eax, 0xfffffffe
jmp 0x453f04
or eax, 1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x453ee7
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4013d0
Capabilities:
Get common file path
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4768ae
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x4995d0]
xor eax, esp
mov dword [esp + 0x24c], eax
mov eax, dword [0x4995d0]
xor eax, esp
push eax
lea eax, [esp + 0x254]
mov dword fs:[0], eax
push 0
mov ecx, 0x49e950
mov dword [esp + 8], 0x49e950
call fcn.00435250
mov dword [esp + 0x25c], 0
push 0x49e9f4
mov dword [0x49e950], 0x480e84
call fcn.00425c60
push 0x480f44
mov ecx, 0x49f880
mov byte [esp + 0x260], 1
call fcn.0040a4d0
push 0x480f44
mov ecx, 0x49f884
mov byte [esp + 0x260], 2
call fcn.0040a4d0
xor eax, eax
push 0x206
mov byte [esp + 0x260], 3
push eax
lea ecx, [esp + 0x52]
push ecx
mov dword [0x49f87c], 0
mov dword [0x49f878], 0
mov word [esp + 0x54], ax
call fcn.00458440
xor edx, edx
push 0x3e
push edx
lea eax, [esp + 0x1e]
push eax
mov word [esp + 0x20], dx
call fcn.00458440
add esp, 0x18
lea ecx, [esp + 0x48]
push ecx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x480204
lea edx, [esp + 0x4c]
push 0x104
push edx
call fcn.0045456e
add esp, 0xc
lea eax, [esp + 0x48]
push eax
push 0x20
lea ecx, [esp + 0x10]
push ecx
push 0x480f44
push 0x480240
call fcn.004133b0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor edx, edx
cmp dx, word [esp + 8]
je 0x40151b
lea eax, [esp + 8]
push eax
push 0x20
push 0x49aac0
call fcn.004544ff
add esp, 0xc
mov eax, 0x49e950
mov ecx, dword [esp + 0x254]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x24c]
xor ecx, esp
call fcn.004541a5
add esp, 0x25c
ret
Function at 0x403e50
Capabilities:
Get common file path

Disassembly:
sub esp, 0x234
mov eax, dword [0x4995d0]
xor eax, esp
mov dword [esp + 0x230], eax
mov eax, dword [0x480710]
mov ecx, dword [0x480714]
mov edx, dword [0x480718]
mov dword [esp], eax
mov eax, dword [0x48071c]
mov dword [esp + 4], ecx
mov ecx, dword [0x480720]
mov dword [esp + 0xc], eax
xor eax, eax
push 0x206
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], edx
mov dx, word [0x480724]
push eax
lea ecx, [esp + 0x32]
push ecx
mov word [esp + 0x20], dx
mov dword [esp + 0x24], 0x31
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov word [esp + 0x34], ax
call fcn.00458440
add esp, 0xc
lea edx, [esp + 0x28]
push edx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x480204
lea eax, [esp + 0x2c]
push 0x104
push eax
call fcn.0045456e
add esp, 0xc
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 8]
push eax
call fcn.004133b0
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [esp + 0x230]
xor ecx, esp
call fcn.004541a5
add esp, 0x234
ret
Function at 0x4044d0
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x350
mov eax, dword [0x4995d0]
xor eax, esp
mov dword [esp + 0x34c], eax
push ebx
push ebp
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x15a]
push ecx
xor esi, esi
mov word [esp + 0x15c], ax
call fcn.00458440
add esp, 0xc
xor edx, edx
push 0x3e
push edx
lea eax, [esp + 0xda]
push eax
mov word [esp + 0xdc], dx
call fcn.00458440
add esp, 0xc
xor ecx, ecx
push 0x3e
push ecx
lea edx, [esp + 0x11a]
push edx
mov word [esp + 0x11c], cx
call fcn.00458440
mov edi, dword [esp + 0x370]
add esp, 0xc
jmp dword [edi*4 + 0x404c58]

Function at 0x404c80
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x47591b
mov eax, dword fs:[0]
push eax
sub esp, 0x294
mov eax, dword [0x4995d0]
xor eax, esp
mov dword [esp + 0x290], eax
push esi
mov eax, dword [0x4995d0]
xor eax, esp
push eax
lea eax, [esp + 0x29c]
mov dword fs:[0], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x9a]
push ecx
mov word [esp + 0x9c], ax
call fcn.00458440
xor edx, edx
push 0x7e
push edx
lea eax, [esp + 0x26]
push eax
mov word [esp + 0x28], dx
call fcn.00458440
add esp, 0x18
push 0x104
lea ecx, [esp + 0x94]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x90]
push 0x5c
push edx
call fcn.004546ac
add eax, 2
push eax
lea eax, [esp + 0x1c]
push 0x40
push eax
call fcn.004544ff
add esp, 0x14
push 0x480878
lea ecx, [esp + 0xc]
call fcn.0040a4d0
mov esi, eax
mov dword [esp + 0x2a4], 0
call fcn.004133b0
push eax
lea ecx, [esp + 0x10]
push esi
push ecx
call fcn.00408ae0
mov eax, dword [eax]
add esp, 0xc
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404d80
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x2a4], 0xffffffff
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404dab
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x10]
push ecx
push 0x4808b0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
xor eax, eax
mov ecx, dword [esp + 0x29c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x290]
xor ecx, esp
call fcn.004541a5
add esp, 0x2a0
ret