joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4663e6
Capabilities:
Read file on windows
Read from mailslot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
mov eax, dword [esi + 0x74]
cmp eax, 0xffffffff
je 0x466484
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
push edi
xor edi, edi
push edi
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 4]
push ecx
push edi
push eax
jmp 0x46647c
cmp dword [ebp - 0xc], edi
je 0x466482
cmp dword [ebp - 4], 0xffffffff
je 0x466482
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x1a0]
push eax
push dword [esi + 0x74]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x466482
xor eax, eax
cmp dword [ebp - 8], 4
jbe 0x466448
movsx eax, byte [ebp - 0x1a0]
dec eax
je 0x46645f
dec eax
jne 0x46646f
push dword [ebp - 8]
lea ecx, [ebp - 0x1a0]
push esi
call fcn.004667d6
jmp 0x46646f
push dword [ebp - 8]
lea ecx, [ebp - 0x1a0]
mov edx, esi
call fcn.00466486
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push edi
push dword [esi + 0x74]
call ebx
test eax, eax
jne 0x466412
pop edi
pop ebx
leave
ret
Function at 0x467017
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4a113e
call fcn.00497a30
sub esp, 0x824
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [esi + 8]
mov dword [esi], 0x4a7a24
call fcn.00483124
xor ebx, ebx
lea ecx, [esi + 0x2c]
mov dword [ebp - 4], ebx
call fcn.00483124
push 0x7fb
lea eax, [ebp - 0x830]
mov byte [ebp - 4], 1
push eax
mov dword [0x4bbb8c], esi
mov byte [esi + 0x50], bl
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push ebx
mov edi, 0x4a46f4
lea eax, [ebp - 0x830]
push edi
push eax
call fcn.0048400a
add esp, 0xc
test al, al
jne 0x4670a3
push 1
lea eax, [ebp - 0x830]
push 0x4a46f0
push eax
call fcn.0048400a
add esp, 0xc
test al, al
je 0x4670a3
mov byte [ebp - 0x82d], bl
jmp 0x467109
push ebx
lea eax, [ebp - 0x830]
push 0x4a478c
push eax
call fcn.0048400a
add esp, 0xc
test al, al
lea eax, [ebp - 0x830]
je 0x4670fc
push edi
push eax
call sub.MSVCR71.dll_strcat
push ebx
push ebx
lea eax, [ebp - 0x82e]
push 0x5c
push eax
call fcn.00483b18
add esp, 0x18
cmp eax, ebx
je 0x4670f6
push ebx
push ebx
inc eax
push 0x5c
push eax
call fcn.00483b18
add esp, 0x10
cmp eax, ebx
je 0x4670f6
mov byte [eax], bl
jmp 0x467109
lea eax, [ebp - 0x830]
push 0x4a4918
push eax
call sub.MSVCR71.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 0x830]
push eax
push 0x4b9334
call sub.MSVCR71.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 0x30]
push eax
push 2
pop ecx
mov edx, esi
call fcn.004673ae
mov byte [ebp - 4], 2
cmp dword [eax + 0x1c], 0x10
jb 0x467139
mov eax, dword [eax + 8]
jmp 0x46713c
add eax, 8
push eax
lea eax, [esi + 0x2c]
push 0x4ac
push eax
call fcn.00483704
add esp, 0xc
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.004833a3
cmp byte [ebp + 0xc], bl
je 0x467181
push 0x48
call sub.MSVCR71.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp + 0xc], eax
cmp eax, ebx
mov byte [ebp - 4], 3
je 0x46717a
push eax
call fcn.00430a18
jmp 0x46717c
xor eax, eax
mov dword [esi + 4], eax
jmp 0x467184
mov dword [esi + 4], ebx
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x467238
Capabilities:
Get file version info

Disassembly:
mov eax, 0x498052
call fcn.00497a30
sub esp, 0x13c
cmp dword [ebx + 0x20], 0
jne 0x467320
push esi
push edi
lea esi, [ebx + 8]
mov eax, dword [esi]
push 0x4a7b40
mov ecx, esi
call dword [eax + 8]
push 0x104
lea eax, [ebp - 0x148]
push eax
push dword [0x4bbb68]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x148]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
je 0x46731e
lea eax, [edi + 1]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
push edi
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x148]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push str.StringFileInfo040904b0FileVersion
push dword [ebp - 0x20]
xor edi, edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
call sub.VERSION.dll_VerQueryValueA
cmp eax, edi
je 0x46730c
cmp dword [ebp - 0x14], edi
je 0x46730c
mov ecx, dword [ebp - 0x10]
cmp ecx, edi
je 0x46730c
lea eax, [ebp - 0x44]
push eax
call fcn.0046733a
mov dword [ebp - 4], edi
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0xc]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.004833a3
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
cmp dword [ebx + 0x24], 0x10
jb 0x46732b
mov eax, dword [ebx + 0x10]
jmp 0x46732e
lea eax, [ebx + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x467669
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push 0xfa
lea eax, [ebp - 0x108]
push eax
push dword [0x4bbb68]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.00467a1c
test al, al
je 0x467768
push esi
push 2
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, esi
mov dword [ebp - 8], eax
je 0x467767
push ebx
push edi
push esi
push esi
push esi
push esi
push esi
lea ecx, [ebp - 0x108]
push ecx
push 1
push 2
push 0x10
push 0xf01ff
mov ebx, 0x4a50d0
push ebx
mov edi, str.Serv_U
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x467711
push 2
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
cmp eax, esi
mov dword [ebp - 4], eax
je 0x467711
push ebx
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x108]
push eax
push 1
push 2
push 0x10
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
cmp dword [ebp - 4], esi
mov dword [ebp - 0xc], str.Provides_FTP_services_and_allows_remote_FTP_clients_to_connect_to_this_computer
je 0x467750
push str.ADVAPI32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, esi
je 0x467750
push str.ChangeServiceConfig2A
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x467749
lea ecx, [ebp - 0xc]
push ecx
push 1
push dword [ebp - 4]
call eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 8]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
cmp dword [ebp - 4], esi
je 0x467765
push dword [ebp - 4]
call edi
pop edi
pop ebx
pop esi
leave
ret

Function at 0x46776a
Capabilities:
Delete service
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
call fcn.00467a1c
test al, al
je 0x46780d
push ebx
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x46780c
push edi
push 0xf01ff
push str.Serv_U
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
cmp edi, ebx
je 0x467802
push esi
call fcn.004678bb
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x20]
push eax
push edi
call esi
test eax, eax
je 0x4677fa
cmp dword [ebp - 0x1c], 1
jne 0x4677d2
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
jmp 0x4677fa
cmp dword [ebp - 0x1c], 3
jne 0x4677fa
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp dword [ebp - 0x1c], 3
jne 0x4677fa
lea eax, [ebp - 0x20]
push eax
push edi
call esi
test eax, eax
je 0x4677fa
cmp ebx, 0xa
jle 0x4677d8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop ebx
leave
ret
Function at 0x46780f
Capabilities:
Start service

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x9c
push ebx
call fcn.004679ae
xor ebx, ebx
cmp eax, 5
jne 0x467839
lea eax, [ebp - 0x24]
push str.Global_
push eax
call sub.MSVCR71.dll_strcpy
pop ecx
pop ecx
jmp 0x46783c
mov byte [ebp - 0x24], bl
lea eax, [ebp - 0x24]
push str.UniqueServUEvent_93570126297340819583
push eax
call sub.MSVCR71.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
cmp eax, ebx
je 0x467869
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4678b5
call fcn.00467aa7
test al, al
je 0x4678b5
push esi
mov esi, 0x20000000
push esi
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
mov dword [ebp + 0x74], eax
je 0x4678b4
push edi
push esi
push str.Serv_U
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
cmp edi, ebx
je 0x4678ae
push ebx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push edi
call esi
push dword [ebp + 0x74]
call esi
pop edi
pop esi
pop ebx
add ebp, 0x78
leave
ret

Function at 0x4678bb
Capabilities:
Stop service

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xbc
call fcn.004679ae
cmp eax, 5
jne 0x4678e2
lea eax, [ebp - 0x44]
push str.Global_
push eax
call sub.MSVCR71.dll_strcpy
pop ecx
pop ecx
jmp 0x4678e6
mov byte [ebp - 0x44], 0
push ebx
push esi
push edi
lea eax, [ebp - 0x44]
push str.UniqueServUEvent_93570126297340819583
push eax
call sub.MSVCR71.dll_strcat
mov edi, dword [sym.imp.KERNEL32.dll_OpenEventA]
pop ecx
pop ecx
lea eax, [ebp - 0x44]
push eax
xor esi, esi
push esi
mov ebx, 0x1f0003
push ebx
call edi
cmp eax, esi
mov dword [ebp + 0x70], eax
je 0x4679a6
call fcn.00467aa7
test al, al
je 0x46796a
push 2
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
je 0x4679a6
push 0x20
push str.Serv_U
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
test eax, eax
mov dword [ebp + 0x74], eax
je 0x467954
lea ecx, [ebp + 0x54]
push ecx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
cmp dword [ebp + 0x74], 0
je 0x467973
push dword [ebp + 0x74]
call esi
jmp 0x467973
push dword [ebp + 0x70]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [ebp + 0x70]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
and dword [ebp + 0x74], 0
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x44]
push eax
push 0
push ebx
call edi
test eax, eax
je 0x4679a6
push eax
call esi
inc dword [ebp + 0x74]
cmp dword [ebp + 0x74], 0xc
jl 0x467982
pop edi
pop esi
pop ebx
add ebp, 0x78
leave
ret
Function at 0x4679ae
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
mov eax, dword [0x4bbc30]
test eax, eax
jne 0x467a17
push esi
push 2
pop esi
lea eax, [ebp - 0x1c]
push eax
mov dword [0x4bbc30], esi
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x467a11
cmp dword [ebp - 0xc], esi
jne 0x467a0b
push 3
pop eax
cmp dword [ebp - 0x18], eax
je 0x4679f6
push 4
pop eax
cmp dword [ebp - 0x18], eax
jne 0x4679fd
mov dword [0x4bbc30], eax
jmp 0x467a11
cmp dword [ebp - 0x18], 5
sbb eax, eax
and eax, 0xfffffffd
add eax, 5
jmp 0x4679f6
mov dword [0x4bbc30], esi
mov eax, dword [0x4bbc30]
pop esi
add ebp, 0x78
leave
ret

Function at 0x467a36
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
xor ebx, ebx
call fcn.004679ae
cmp eax, 2
je 0x467a50
xor al, al
jmp 0x467aa4
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x467aa2
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.Serv_U
push dword [ebp - 4]
mov dword [ebp - 8], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x467a99
mov bl, 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret

Function at 0x467b81
Capabilities:
Terminate thread

Disassembly:
push ebx
xor ebx, ebx
cmp dword [0x4bbb84], ebx
push esi
je 0x467bac
mov ecx, dword [esp + 0xc]
push ebx
push dword [esp + 0x14]
xor eax, eax
inc eax
call fcn.00467af1
cmp dword [esp + 0x14], 0x64
pop ecx
pop ecx
jne 0x467bac
call fcn.004678bb
mov eax, dword [0x4bbb74]
cmp eax, ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x467bbe
push eax
call esi
mov eax, dword [0x4bbb78]
cmp eax, ebx
je 0x467bcf
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x4bbb70]
cmp eax, ebx
je 0x467bdb
push eax
call esi
pop esi
mov dword [0x4bbb74], ebx
mov dword [0x4bbb78], ebx
mov dword [0x4bbb84], ebx
mov dword [0x4bbb70], ebx
mov byte [0x4bbb7c], bl
mov byte [0x4bbb7d], bl
pop ebx
ret
Function at 0x468365
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [0x4bbb68], eax
mov eax, dword [ebp + 0x10]
push 0x32
mov edi, 0x4bb0d8
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call fcn.0046822e
mov dword [0x4bb0d4], eax
lea eax, [ebp + 8]
push eax
push ebx
push ebx
push 0x4680ce
push 0x1000
push ebx
call dword [sym.imp.MSVCR71.dll__beginthreadex]
add esp, 0x20
cmp eax, ebx
jbe 0x4683b5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4bb0d4]
xor esi, esi
inc esi
cmp eax, esi
jle 0x468404
mov eax, dword [esi*4 + 0x4bb0d8]
mov cl, byte [eax]
cmp cl, 0x2f
je 0x4683d4
cmp cl, 0x2d
jne 0x4683fb
movsx eax, byte [eax + 1]
push eax
call dword [sym.imp.MSVCR71.dll_tolower]
sub eax, 0x64
pop ecx
je 0x468471
sub eax, 3
je 0x46845c
dec eax
dec eax
je 0x468455
dec eax
dec eax
je 0x468439
sub eax, 8
je 0x468432
inc esi
cmp esi, dword [0x4bb0d4]
jl 0x4683c1
call fcn.00467aa7
cmp al, bl
mov byte [0x4bbb6c], al
je 0x468478
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], str.Serv_U
mov dword [ebp - 0x10], fcn.00467d30
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
jmp 0x468486
call fcn.004678bb
jmp 0x468486
lea eax, [esi + 1]
cmp eax, dword [0x4bb0d4]
jge 0x468486
push dword [esi*4 + 0x4bb0dc]
call fcn.004682e1
mov dword [ebp - 4], eax
jmp 0x468485
call fcn.00467669
jmp 0x468486
call fcn.00467aa7
test al, al
je 0x468478
call fcn.00467669
call fcn.0046780f
jmp 0x468486
call fcn.0046776a
jmp 0x468486
push edi
push dword [0x4bb0d4]
call fcn.00467d30
pop ecx
pop ecx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x468cc7
Capabilities:
Create thread

Disassembly:
mov eax, 0x49c3b4
call fcn.00497a30
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.004843b0
xor ebx, ebx
mov dword [ebp - 4], ebx
lea ecx, [edi + 0x24]
mov dword [edi], 0x4a7b44
call fcn.00483124
mov dword [edi + 0x4c], ebx
mov dword [edi + 0x50], ebx
mov dword [edi + 0x54], ebx
lea esi, [edi + 0x58]
mov byte [ebp - 4], 2
call fcn.0047c8ae
lea eax, [edi + 0x64]
push eax
mov byte [ebp - 4], 3
call fcn.00402290
lea eax, [edi + 0x10c]
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
lea eax, [edi + 0x11c]
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
push fcn.0040fa7b
push 0x468e75
push 0x400
push 0x28
lea eax, [edi + 0x12c]
push eax
mov byte [ebp - 4], 6
call fcn.004975ce
lea eax, [edi + 0xa134]
mov byte [ebp - 4], 7
call fcn.004261a2
lea ecx, [edi + 0xa14c]
call fcn.00483124
lea esi, [edi + 0xa174]
mov byte [ebp - 4], 8
call fcn.0047c3dc
mov byte [ebp - 4], 9
push dword [ebp + 0xc]
lea ecx, [edi + 0x24]
mov dword [edi + 0xa180], ebx
mov eax, dword [ecx]
call dword [eax + 8]
push ebx
push 0x7d0
mov ecx, edi
call fcn.004842d1
mov eax, dword [ebp + 0x10]
push 0x48
mov dword [0x4bbb90], edi
mov dword [edi + 0x20], eax
mov dword [edi + 0xa130], ebx
mov dword [edi + 0xa12c], ebx
call sub.MSVCR71.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp + 0xc], eax
cmp eax, ebx
mov byte [ebp - 4], 0xa
je 0x468dd1
push edi
push eax
call fcn.00464f21
jmp 0x468dd3
xor eax, eax
push ebx
mov dword [edi + 0xa170], eax
call dword [sym.imp.MSVCR71.dll_time]
push eax
call dword [sym.imp.MSVCR71.dll_srand]
pop ecx
pop ecx
push 0x4bb1a0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, ebx
mov dword [0x4bbb94], eax
je 0x468e41
lea eax, [ebp + 8]
push eax
push ebx
push ebx
push 0x47afc8
push 0x1000
push ebx
call dword [sym.imp.MSVCR71.dll__beginthreadex]
add esp, 0x18
cmp eax, ebx
ja 0x468e3a
push dword [0x4bbb94]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4bbb94], ebx
jmp 0x468e41
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x46d6e8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
push esi
push dword [ebx + 0xc0]
mov esi, dword [sym.imp.MSVCR71.dll_sprintf]
push str.Domain
lea eax, [ebp - 0x3c]
push str._s_d
push eax
mov dword [ebp - 4], 1
call esi
mov eax, dword [ebx]
add esp, 0x10
cmp eax, 1
je 0x46d728
cmp eax, 4
jne 0x46d897
push dword [ebp - 4]
lea eax, [ebp - 0x20]
push str.Group
push str._s_d
push eax
call esi
add esp, 0x10
cmp dword [edi + 0x40], 0x10
jb 0x46d749
mov eax, dword [edi + 0x2c]
jmp 0x46d74c
lea eax, [edi + 0x2c]
push eax
push 0x12c
lea eax, [ebp - 0x168]
push eax
push 0x4a4630
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x168], 0
je 0x46d7dc
push 0
push 0
lea eax, [ebp - 0x168]
push 0x7c
push eax
call fcn.00483b18
add esp, 0x10
test eax, eax
je 0x46d791
mov byte [eax], 0
push dword [ebx + 0xc0]
lea eax, [ebp - 0x168]
push eax
push str.GROUP
lea eax, [ebp - 0x294]
push str._s_s_d
push eax
call esi
add esp, 0x14
cmp dword [edi + 0x40], 0x10
jb 0x46d7bf
mov eax, dword [edi + 0x2c]
jmp 0x46d7c2
lea eax, [edi + 0x2c]
push eax
push 0
push 0
lea eax, [ebp - 0x294]
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
inc dword [ebp - 4]
jmp 0x46d728
mov dword [ebp - 4], 1
push dword [ebp - 4]
lea eax, [ebp - 0x20]
push str.User
push str._s_d
push eax
call esi
add esp, 0x10
cmp dword [edi + 0x40], 0x10
jb 0x46d804
mov eax, dword [edi + 0x2c]
jmp 0x46d807
lea eax, [edi + 0x2c]
push eax
push 0x12c
lea eax, [ebp - 0x168]
push eax
push 0x4a4630
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x168], 0
je 0x46d897
push 0
push 0
lea eax, [ebp - 0x168]
push 0x7c
push eax
call fcn.00483b18
add esp, 0x10
test eax, eax
je 0x46d84c
mov byte [eax], 0
push dword [ebx + 0xc0]
lea eax, [ebp - 0x168]
push eax
push 0x4a7d00
lea eax, [ebp - 0x294]
push str._s_s_d
push eax
call esi
add esp, 0x14
cmp dword [edi + 0x40], 0x10
jb 0x46d87a
mov eax, dword [edi + 0x2c]
jmp 0x46d87d
lea eax, [edi + 0x2c]
push eax
push 0
push 0
lea eax, [ebp - 0x294]
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
inc dword [ebp - 4]
jmp 0x46d7e3
cmp dword [edi + 0x40], 0x10
jb 0x46d8a2
mov eax, dword [edi + 0x2c]
jmp 0x46d8a5
lea eax, [edi + 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push eax
push 0
push 0
lea eax, [ebp - 0x3c]
push eax
call esi
cmp dword [ebx], 3
jne 0x46d8c8
mov eax, dword [edi + 0xa170]
mov edx, ebx
call fcn.0046534c
cmp dword [edi + 0x40], 0x10
mov dword [ebp - 4], 1
jb 0x46d8da
mov eax, dword [edi + 0x2c]
jmp 0x46d8dd
lea eax, [edi + 0x2c]
push eax
push 0
push 0
push str.DOMAINS
call esi
mov esi, dword [edi + 0x4c]
jmp 0x46d92a
mov eax, dword [esi + 0xc0]
test eax, eax
je 0x46d924
cmp eax, dword [ebx + 0xc0]
je 0x46d924
mov eax, dword [esi]
cmp eax, 1
je 0x46d911
cmp eax, 3
je 0x46d911
cmp eax, 4
jne 0x46d924
mov eax, dword [ebp - 4]
mov dword [esi + 0xc4], eax
mov eax, edi
call fcn.0046d5c7
inc dword [ebp - 4]
add esi, 0xd8
cmp esi, dword [edi + 0x50]
jne 0x46d8ee
pop esi
leave
ret
Function at 0x46fde4
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x49a150
call fcn.00497a30
sub esp, 0x18c
push ebx
push edi
push dword [ebp + 0xc]
mov edi, dword [sym.imp.MSVCR71.dll_sprintf]
push str.Domain
mov ebx, str._s_d
lea eax, [ebp - 0x50]
push ebx
push eax
mov dword [ebp - 0x10], 1
call edi
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
add esp, 0x10
push eax
push ecx
lea eax, [ebp + 0xc]
push eax
mov ecx, esi
call fcn.00402f3b
push dword [ebp - 0x10]
lea eax, [ebp - 0x6c]
push str.Group
push ebx
push eax
call edi
mov eax, dword [ebp + 8]
add esp, 0x10
cmp dword [eax + 0x40], 0x10
jb 0x46fe4d
mov eax, dword [eax + 0x2c]
jmp 0x46fe50
add eax, 0x2c
push eax
push 0x12c
lea eax, [ebp - 0x198]
push eax
push 0x4a4630
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x198], 0
je 0x46fec7
push 0
push 0
lea eax, [ebp - 0x198]
push 0x7c
push eax
call fcn.00483b18
add esp, 0x10
test eax, eax
je 0x46fe95
mov byte [eax], 0
lea eax, [ebp - 0x198]
push eax
lea ecx, [ebp - 0x34]
call fcn.00483141
and dword [ebp - 4], 0
lea eax, [ebp - 0x34]
push eax
mov ecx, esi
call fcn.00402efb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.004833a3
inc dword [ebp - 0x10]
jmp 0x46fe2d
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x46fed7
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x49abce
call fcn.00497a30
sub esp, 0x198
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 4]
push ebx
push esi
push eax
push edx
lea eax, [ebp - 0x10]
push eax
call fcn.00402f3b
mov esi, dword [ebp + 0x10]
mov ebx, dword [esi + 8]
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.0046446b
push dword [eax + 4]
push dword [eax]
xor eax, eax
push ebx
push eax
lea ebx, [ebp - 0x1c]
mov eax, esi
call fcn.004644b3
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push eax
push ecx
lea ebx, [ebp - 0x10]
mov esi, edi
call fcn.004649bb
push dword [ebp + 0x14]
mov ebx, dword [sym.imp.MSVCR71.dll_sprintf]
push str.Domain
lea eax, [ebp - 0x78]
push str._s_d
push eax
mov dword [ebp - 0x18], 1
call ebx
add esp, 0x10
push dword [ebp - 0x18]
lea eax, [ebp - 0x5c]
push str.User
push str._s_d
push eax
call ebx
mov eax, dword [ebp + 8]
add esp, 0x10
cmp dword [eax + 0x40], 0x10
jb 0x46ff79
mov eax, dword [eax + 0x2c]
jmp 0x46ff7c
add eax, 0x2c
push eax
push 0x12c
lea eax, [ebp - 0x1a4]
push eax
push 0x4a4630
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x1a4], 0
je 0x47003d
xor esi, esi
push esi
push esi
lea eax, [ebp - 0x1a4]
push 0x7c
push eax
mov byte [ebp - 0x10], 1
mov dword [ebp + 0x14], esi
call fcn.00483b18
add esp, 0x10
cmp eax, esi
je 0x46fff6
cmp byte [eax + 1], 0x30
mov byte [eax], 0
jne 0x46ffd6
mov byte [ebp - 0x10], 0
cmp byte [eax + 2], 0x7c
jne 0x46fff6
add eax, 3
cmp byte [eax], 0x30
je 0x46fff6
push eax
call dword [sym.imp.MSVCR71.dll_atol]
cmp eax, esi
pop ecx
mov dword [ebp + 0x14], eax
jge 0x46fff6
mov dword [ebp + 0x14], esi
lea eax, [ebp - 0x1a4]
push eax
lea ecx, [ebp - 0x40]
call fcn.00483141
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 4], esi
call fcn.00402efb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.004833a3
push dword [ebp - 0x10]
push dword [ebp + 0x10]
call fcn.00464489
lea esi, [ebp + 0x14]
mov eax, edi
call fcn.00464436
inc dword [ebp - 0x18]
jmp 0x46ff55
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10