joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412dd6
Capabilities:
Create process on windows
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x465c14]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x400
lea eax, [ebp - 0x404]
push eax
push dword [ecx]
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x412e1a
push 1
xor ecx, ecx
lea eax, [ebp - 0x404]
push ecx
push ecx
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042345f
leave
ret

Function at 0x414c11
Capabilities:
Check mutex on windows

Disassembly:
push 8
mov eax, 0x44baeb
call fcn.004234cc
mov eax, dword fs:[0x2c]
or esi, 0xffffffff
mov ecx, dword [0x4b543c]
xor ebx, ebx
mov edi, dword [eax + ecx*4]
mov eax, dword [0x46891c]
cmp eax, dword [edi + 4]
jg 0x414d7d
mov eax, dword [0x46892c]
cmp eax, dword [edi + 4]
jg 0x414dd1
mov eax, dword [0x4656e8]
mov edi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, esi
jne 0x414c6c
push ebx
push ebx
push ebx
call edi
mov dword [0x4656e8], eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x414d75
lea eax, [ebp + 8]
mov ecx, 0x468914
push eax
call fcn.00413cb9
mov edx, dword [0x468914]
cmp eax, edx
je 0x414c9c
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x10]
jae 0x414c9e
mov eax, edx
cmp dword [ebp + 0xc], 0
jne 0x414cfe
cmp eax, edx
je 0x414cb3
inc dword [eax + 0x18]
mov esi, dword [eax + 0x14]
jmp 0x414d69
cmp dword [0x468928], 0
jle 0x414cd0
mov eax, dword [0x468920]
mov ecx, 0x468920
mov esi, dword [eax + 8]
call fcn.0041571d
jmp 0x414cdd
push ebx
push ebx
push ebx
call edi
inc dword [0x468930]
mov esi, eax
lea eax, [ebp + 8]
mov ecx, 0x468914
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00413ecd
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x14], esi
mov dword [eax + 0x18], 1
jmp 0x414d69
cmp eax, edx
je 0x414d69
sub dword [eax + 0x18], 1
jne 0x414d69
mov edi, dword [eax + 0x14]
mov ecx, 0x468914
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00416fa3
mov eax, dword [0x468928]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
cmp eax, dword [0x468930]
jl 0x414d32
call ebx
jmp 0x414d3c
mov ecx, 0x468920
call fcn.00414a6b
mov eax, dword [0x468930]
cdq
sub eax, edx
sar eax, 1
cmp dword [0x468928], eax
jle 0x414d69
mov edx, dword [0x468920]
push dword [edx + 8]
call ebx
mov ecx, 0x468920
call fcn.0041571d
dec dword [0x468930]
push dword [0x4656e8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
call fcn.004234a6
ret
push 0x46891c
call fcn.00423d38
pop ecx
cmp dword [0x46891c], esi
jne 0x414c42
mov ecx, 0x468914
mov dword [ebp - 4], ebx
mov dword [0x468914], ebx
mov dword [0x468918], ebx
call fcn.00415870
push 0x44bdd3
mov dword [0x468914], eax
call fcn.00423836
mov dword [ebp - 4], esi
mov dword [esp], 0x46891c
call fcn.00423cee
pop ecx
jmp 0x414c42
mov edi, 0x46892c
push edi
call fcn.00423d38
pop ecx
cmp dword [0x46892c], esi
jne 0x414c53
push 0x44bdb3
mov dword [0x468928], ebx
mov dword [0x468920], ebx
mov dword [0x468924], ebx
call fcn.00423836
push edi
call fcn.00423cee
pop ecx
pop ecx
jmp 0x414c53
Function at 0x414e88
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
lea eax, [ebp - 0x20]
push esi
push eax
lea eax, [ebp - 0xc]
xor esi, esi
push eax
inc esi
call fcn.00407889
pop ecx
pop ecx
push 0x4686c0
push esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x4686b4], eax
test eax, eax
je 0x414ee0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x414ecb
xor esi, esi
jmp 0x414ee3
push dword [0x4686b4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [0x4686b4], 0
jmp 0x414ee3
or esi, 0xffffffff
mov eax, esi
pop esi
leave
ret

Function at 0x414ee8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4688ec], 0
jne 0x414f35
push 5
push dword [ebp + 8]
mov dword [0x4688ec], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x41617b
push dword [ebp + 8]
push 0x70
push dword [0x4686a4]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
and dword [0x4688ec], 0
pop ebp
ret
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetActiveWindow]
pop ebp
ret

Function at 0x414f49
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x465c14]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x108
xor ebx, ebx
lea eax, [ebp - 0x10c]
push ebx
push eax
call fcn.00427a90
lea eax, [ebp - 0x310]
push eax
push 0xc
call fcn.0041c73a
lea ecx, [ebp - 0x30c]
add esp, 0x14
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x414f8b
sub ecx, edx
lea eax, [ecx - 1]
cmp eax, 0xfe
ja 0x415006
lea eax, [ebp - 0x30c]
push 0x44f974
push eax
call fcn.00425ef0
pop ecx
pop ecx
test eax, eax
jne 0x414fef
lea eax, [ebp - 0x30c]
push str.mailto:
push eax
call fcn.004110c5
pop ecx
pop ecx
test eax, eax
jne 0x414fef
lea eax, [ebp - 0x30c]
push eax
push dword [0x4655d0]
lea eax, [ebp - 0x10c]
push 0x44c94c
push eax
call fcn.004026f3
add esp, 0x10
jmp 0x41501c
mov ecx, ebx
mov al, byte [ebp + ecx - 0x30c]
mov byte [ebp + ecx - 0x10c], al
inc ecx
test al, al
jne 0x414ff1
jmp 0x41501c
push esi
push edi
push 5
pop ecx
mov esi, str.http:__www.kaseya.com
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
pop esi
push 1
push ebx
push ebx
lea eax, [ebp - 0x10c]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0042345f
leave
ret

Function at 0x41505e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4688f0], 0
jne 0x4150b2
push 5
push dword [ebp + 8]
mov dword [0x4688f0], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push 0
push 0x41a0dc
push dword [ebp + 8]
push 0x73
push dword [0x4686a4]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
and dword [0x4688f0], 0
pop ebp
ret
Function at 0x415940
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x465c14]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x4159c2
cmp byte [esi + 0x3d], 0
je 0x4159c2
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x415994
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x415998
sub eax, 1
je 0x41599c
dec eax
sub eax, 1
je 0x4159c2
xor al, al
jmp 0x4159c4
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4159b9
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00433b83
add esp, 0x10
cmp edi, eax
jne 0x415994
cmp byte [esi + 0x3d], 0
sete al
jmp 0x4159c4
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0042345f
leave
ret

Function at 0x417bb6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x465c14]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x417bd9
xor eax, eax
jmp 0x417c9e
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x417c05
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x417c05
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x417c96
cmp dword [esi + 0x4c], 0
je 0x417c9a
mov ecx, esi
call fcn.00416071
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x417c25
push dword [esi + 0x4c]
push eax
jmp 0x417c5d
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x2c]
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x417c9a
cmp eax, 1
jle 0x417c6d
cmp eax, 3
jne 0x417c9a
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.004132f7
pop ecx
pop ecx
test al, al
jne 0x417c96
or ebx, 0xffffffff
jmp 0x417c96
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x417c8a
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00433b83
add esp, 0x10
cmp edi, eax
jne 0x417c9a
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x417c9a
mov eax, ebx
jmp 0x417c9d
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0042345f
leave
ret 4
Function at 0x4192a5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x465c14]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
push edi
push 6
pop edx
mov ecx, edx
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov ecx, edx
lea edi, [ebp - 0x34]
xor esi, esi
rep stosd dword es:[edi], eax
mov ecx, dword [ebx]
mov edi, esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], esi
cmp ecx, 0x5cd0009
jne 0x41936c
cmp dword [ebx + 8], edx
jne 0x41936c
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebx + 0xc]
push eax
push edx
push dword [ebp + 0x10]
push ebx
call fcn.0040dda1
add esp, 0x18
mov dword [ebp - 0x38], eax
test eax, eax
jne 0x41934f
cmp dword [ebp - 0x20], 4
jne 0x41934f
cmp dword [ebp - 0x30], esi
jle 0x41931c
mov edi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
cmp dword [ebp - 0x2c], esi
jg 0x419326
mov ecx, esi
mov edx, dword [ebp - 0x10]
cmp dword [ebp - 0x28], esi
jg 0x419330
mov edx, esi
cmp dword [ebp - 0x24], esi
jle 0x41933b
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 8]
push dword [eax]
push dword [ebp - 0x44]
push edx
push ecx
push edi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x419354
mov eax, 0x7d0
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebx + 8]
call fcn.0040de82
mov eax, dword [ebp - 0x38]
pop ecx
pop ecx
mov ecx, dword [ebx]
jmp 0x419374
mov eax, 0x7d0
mov dword [ebp - 0x38], eax
lea edx, [ebp - 0x38]
mov dword [ebp - 0x48], 4
mov dword [ebp - 0x4c], edx
lea edx, [ebp - 0x40]
push edx
lea edx, [ebp - 0x3c]
push edx
lea edx, [ebp - 0x48]
push edx
lea edx, [ebp - 0x4c]
push edx
push 1
push dword [ebx + 4]
push eax
push ecx
call fcn.0040dc9b
add esp, 0x20
mov dword [ebp - 0x38], eax
test eax, eax
mov eax, dword [ebp - 0x3c]
jne 0x4193d5
test eax, eax
jne 0x4193b3
cmp dword [ebp - 0x40], esi
jg 0x4193d5
push 3
push dword [ebp - 0x40]
push eax
push dword [ebp + 8]
call fcn.0040d558
add esp, 0x10
mov dword [ebp - 0x38], eax
test eax, eax
mov eax, dword [ebp - 0x3c]
je 0x4193da
mov esi, 0x7d3
jmp 0x4193da
mov esi, 0x7d2
test eax, eax
je 0x4193e5
push eax
call fcn.0042a45a
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042345f
leave
ret
Function at 0x41af20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x41af42
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00410d36
jmp 0x41aff9
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x41af63
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x41af65
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x41afed
jg 0x41af78
test esi, esi
je 0x41afed
test ecx, ecx
jl 0x41afba
jg 0x41af82
test eax, eax
je 0x41afba
cmp ebx, ecx
jg 0x41af94
jl 0x41af8c
cmp esi, eax
jae 0x41af94
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.00427510
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x41afc0
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x41afed
jg 0x41afca
test esi, esi
je 0x41afed
cmp dword [edi + 0x4c], 0
je 0x41afed
mov ecx, edi
call fcn.00416071
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call fcn.0042d919
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
leave
ret 0xc

Function at 0x41affe
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x41b020
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00410e05
jmp 0x41b0cd
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x41b041
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x41b043
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x41b0c1
jg 0x41b056
test esi, esi
je 0x41b0c1
test ecx, ecx
jl 0x41b09a
jg 0x41b060
test eax, eax
je 0x41b09a
cmp edi, ecx
jg 0x41b072
jl 0x41b06a
cmp esi, eax
jae 0x41b072
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.00427510
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x41b09d
mov edx, dword [ebp + 8]
test edi, edi
jl 0x41b0c1
jg 0x41b0a7
test esi, esi
je 0x41b0c1
cmp dword [ebx + 0x4c], 0
je 0x41b0c1
push dword [ebx + 0x4c]
push esi
push 1
push edx
call fcn.00433b83
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x41bb20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x465c14]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x90], 0
and dword [ebp - 0x88], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
call fcn.004027f3
lea edx, [ebp - 0x84]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x41bb54
lea eax, [ebp - 0x8c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x84]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41bbf2
mov esi, str.ConfigurationFile
lea edi, [ebp - 0x84]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x105
push esi
push eax
push ebx
call fcn.00427a90
add esp, 0xc
mov dword [ebp - 0x88], esi
lea eax, [ebp - 0x88]
push eax
push ebx
lea eax, [ebp - 0x90]
push eax
push 0
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x8c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x8c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x41bbf2
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41bbe4
sub ecx, edx
cmp ecx, 1
jae 0x41bbfe
mov edi, ebx
mov esi, str..kaseyad.ini
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x41bc03
sub esi, ecx
mov ecx, dword [0x465bc4]
test ecx, ecx
js 0x41bca4
cmp esi, 4
jle 0x41bca4
cmp byte [ebx + esi - 4], 0x2e
jne 0x41bca4
mov al, byte [ebx + esi - 3]
or al, 0x20
cmp al, 0x69
jne 0x41bca4
mov al, byte [ebx + esi - 2]
or al, 0x20
cmp al, 0x6e
jne 0x41bca4
mov al, byte [ebx + esi - 1]
or al, 0x20
cmp al, 0x69
jne 0x41bca4
push ecx
lea eax, [ebp - 0x84]
push str._03d
push eax
call fcn.004026f3
lea edx, [ebp - 0x84]
mov byte [ebx + esi - 4], 0
add esp, 0xc
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x41bc6a
sub edx, esi
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41bc76
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
dec ebx
rep movsb byte es:[edi], byte [esi]
mov al, byte [ebx + 1]
inc ebx
test al, al
jne 0x41bc8d
mov eax, dword [str..ini]
mov dword [ebx], eax
mov al, byte [0x44fecc]
mov byte [ebx + 4], al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042345f
leave
ret
Function at 0x41bcb3
Capabilities:
Get common file path
Write file on windows

Disassembly:
push 0x240
mov eax, 0x44bce0
call fcn.00423500
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x24c]
xor esi, esi
mov dword [ebp - 0x230], 0xd
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x21c], esi
call fcn.004111cf
mov dword [ebp - 4], esi
call fcn.00402722
push eax
lea ecx, [ebp - 0x24c]
call fcn.004116d6
test eax, eax
je 0x41be0c
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x24c]
call fcn.00411772
test eax, eax
je 0x41be01
cmp dword [ebp - 0x224], esi
jne 0x41bdec
cmp dword [ebp - 0x220], esi
jbe 0x41bdec
lea eax, [ebp - 0x218]
mov edi, 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp eax, edi
ja 0x41bdec
lea eax, [ebp - 0x114]
push eax
push esi
push 0x44fed0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x41bdec
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x41bdec
push esi
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x220]
push dword [ebp - 0x21c]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41bdcd
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x41bdec
lea ecx, [ebp - 0x114]
mov eax, ecx
sub ebx, eax
mov al, byte [ecx]
mov byte [ebx + ecx], al
inc ecx
test al, al
jne 0x41bde2
cmp dword [ebp - 0x21c], 0
je 0x41be01
push dword [ebp - 0x21c]
call fcn.0042a45a
pop ecx
lea ecx, [ebp - 0x24c]
call fcn.004115a5
lea ecx, [ebp - 0x24c]
call fcn.004111e6
mov eax, esi
call fcn.004234bb
ret
Function at 0x41be1f
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb1c
mov eax, dword [0x465c14]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0xb1c], 0
lea eax, [ebp - 0x10c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push eax
mov byte [ebx], 0
call fcn.0041bb20
lea eax, [ebp - 0x10c]
mov dword [esp], 0x44ca20
push eax
call fcn.0042d736
mov dword [ebp - 0xb18], eax
pop ecx
pop ecx
test eax, eax
jne 0x41bee1
lea eax, [ebp - 0x10c]
push eax
call fcn.0041bcb3
pop ecx
test eax, eax
je 0x41beab
lea eax, [ebp - 0x10c]
mov dword [ebp - 0xb1c], 1
push 0x44ca20
push eax
call fcn.0042d736
mov dword [ebp - 0xb18], eax
pop ecx
pop ecx
test eax, eax
jne 0x41bee1
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0xb10]
push str.ERROR:_Could_not_open__s_in_getConfigValue__n
push eax
call fcn.004026f3
lea eax, [ebp - 0xb14]
mov dword [ebp - 0xb14], 1
push eax
call fcn.0040c3b6
add esp, 0x10
jmp 0x41bf97
push edi
push eax
call fcn.0041b9e3
pop ecx
pop ecx
test eax, eax
je 0x41bf2d
push dword [ebp - 0xb18]
call fcn.0042d5ea
lea eax, [ebp - 0x10c]
push eax
push edi
lea eax, [ebp - 0xb10]
push str.ERROR:_Could_not_find__s_header_in__s_in_getConfigValue__n
push eax
call fcn.004026f3
lea eax, [ebp - 0xb14]
mov dword [ebp - 0xb14], 1
push eax
call fcn.0040c3b6
add esp, 0x18
jmp 0x41bf81
mov edi, dword [ebp - 0xb18]
push edi
lea eax, [ebp - 0x910]
push 0x800
push eax
call fcn.00435838
mov edx, esi
mov dword [ebp - 0xb18], eax
add esp, 0xc
lea eax, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x41bf53
sub edx, eax
lea eax, [ebp - 0x910]
push edx
push esi
push eax
call fcn.0042e020
add esp, 0xc
test eax, eax
je 0x41bfa6
cmp dword [ebp - 0xb18], 0
jne 0x41bf33
push edi
call fcn.0042d5ea
pop ecx
cmp dword [ebp - 0xb1c], 0
je 0x41bf97
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042345f
leave
ret
xor edx, edx
mov ecx, esi
lea eax, [ecx + 1]
mov dword [ebp - 0xb18], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41bfb3
sub ecx, dword [ebp - 0xb18]
lea eax, [ecx + edx]
cmp byte [ebp + eax - 0x910], 0x20
je 0x41bff2
mov ecx, esi
lea eax, [ecx + 1]
mov dword [ebp - 0xb18], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41bfd8
sub ecx, dword [ebp - 0xb18]
lea eax, [ecx + edx]
cmp byte [ebp + eax - 0x910], 9
jne 0x41bff5
inc edx
jmp 0x41bfa8
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x41bff8
sub esi, ecx
lea ecx, [ebp - 0x910]
lea eax, [esi + edx]
mov edx, ebx
add ecx, eax
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x41c010
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41c01f
sub ecx, edx
cmp byte [ebx + ecx - 1], 0xa
je 0x41c048
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41c034
sub ecx, edx
cmp byte [ebx + ecx - 1], 0xd
jne 0x41bf7a
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41c04d
sub ecx, edx
mov byte [ebx + ecx - 1], al
jmp 0x41c01a
Function at 0x41caa2
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x465c14]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x10c]
xor ebx, ebx
push edi
push eax
call fcn.0041bb20
mov esi, 0x450174
lea eax, [ebp - 0x10c]
push esi
push eax
call fcn.0042d736
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x41cb0d
lea eax, [ebp - 0x10c]
push eax
call fcn.0041bcb3
pop ecx
test eax, eax
je 0x41cb08
lea eax, [ebp - 0x10c]
inc ebx
push esi
push eax
call fcn.0042d736
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x41cb0d
or eax, 0xffffffff
jmp 0x41cb3c
call fcn.0041d7f8
push edi
call fcn.0041c0ca
push edi
mov esi, eax
call fcn.0042d5ea
pop ecx
pop ecx
test ebx, ebx
je 0x41cb33
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg esi
sbb esi, esi
and esi, 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042345f
leave
ret

Function at 0x41d333
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x465c14]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
xor eax, eax
push 0x90
push eax
or dword [esi + 4], 0xffffffff
mov dword [esi + 8], eax
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x94]
push eax
call fcn.00427a90
add esp, 0xc
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x41d3a0
cmp dword [ebp - 0x94], 5
jb 0x41d399
jne 0x41d3a0
cmp dword [ebp - 0x90], 0
jne 0x41d3a0
mov dword [esi + 0x10], 1
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0042345f
leave
ret