joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458a23
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x49a02c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
mov esi, ecx
push eax
mov dword [ebp - 0x14], esi
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x458ae3
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push 2
push esi
call edi
test eax, eax
jne 0x458a8a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x458ae2
push dword [ebp - 0x18]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push esi
push 2
push dword [ebp - 0x14]
call edi
test eax, eax
je 0x458ad7
mov edi, ebx
cmp dword [esi], ebx
jbe 0x458ad7
lea eax, [esi + 4]
mov dword [ebp - 0x14], eax
push dword [eax]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x458ad5
mov eax, dword [ebp - 0x14]
inc edi
add eax, 8
mov dword [ebp - 0x14], eax
cmp edi, dword [esi]
jb 0x458ab6
jmp 0x458ad7
mov bl, 1
test esi, esi
je 0x458ae2
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
cmp dword [ebp - 0x10], 0
je 0x458af2
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.004261a3
mov esp, ebp
pop ebp
ret
Function at 0x458b8f
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x49a02c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x244], ecx
push edi
push 0x22c
push eax
mov ebx, eax
mov dword [ebp - 0x238], eax
mov edi, eax
mov dword [ebp - 0x234], eax
mov esi, eax
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x230]
push eax
call fcn.0042ac90
add esp, 0xc
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x240], eax
test eax, eax
je 0x458d5b
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x458c35
lea eax, [ebp - 0x20c]
push eax
push str.explorer.exe
call fcn.004399d2
pop ecx
pop ecx
test eax, eax
je 0x458c3e
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x240]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x458c0b
jmp 0x458d4f
cmp dword [ebp - 0x228], ebx
je 0x458d4f
push dword [ebp - 0x228]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x458d4f
lea eax, [ebp - 0x234]
push eax
push 8
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x458d4f
lea eax, [ebp - 0x23c]
push eax
push 0
push 0
push 1
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x458d4f
push dword [ebp - 0x23c]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x458d4f
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x23c]
push esi
push 1
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ebx, eax
test ebx, ebx
je 0x458d4f
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x458d4f
push str.ConvertSidToStringSidW
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x458d4f
lea ecx, [ebp - 0x238]
push ecx
push dword [esi]
call eax
mov ebx, eax
test ebx, ebx
je 0x458d4f
cmp dword [ebp - 0x238], 0
je 0x458d4f
push dword [ebp - 0x238]
mov ecx, dword [ebp - 0x244]
call fcn.004064f3
push dword [ebp - 0x238]
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [ebp - 0x238], 0
push dword [ebp - 0x240]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x234], 0
je 0x458d77
push dword [ebp - 0x234]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x234], 0
test edi, edi
je 0x458d82
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x458d96
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004261a3
mov esp, ebp
pop ebp
ret
Function at 0x45901e
Capabilities:
Get proxy
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x49a02c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
lea eax, [ebp - 0x404]
mov ebx, 0x400
mov dword [ebp - 0x408], esi
push ebx
push esi
push eax
mov edi, ecx
mov dword [ebp - 0x40c], esi
call fcn.0042ac90
add esp, 0xc
lea eax, [ebp - 0x408]
push eax
push 1
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4590cc
lea eax, [ebp - 0x40c]
mov dword [ebp - 0x40c], ebx
push eax
lea eax, [ebp - 0x404]
push eax
push esi
push esi
push str.ProxyServer
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4590cc
cmp byte [ebp - 0x404], al
je 0x4590ba
lea eax, [ebp - 0x404]
push eax
call fcn.0042ed50
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0x404]
mov ecx, edi
push eax
call fcn.00402f70
xor esi, esi
inc esi
cmp dword [ebp - 0x408], 0
je 0x4590e1
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004261a3
mov esp, ebp
pop ebp
ret

Function at 0x4590f4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 1
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push connect
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x459146
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push str.ProxyEnable
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
cmove esi, dword [ebp - 0xc]
cmp dword [ebp - 4], 0
je 0x459155
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4599c7
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
call fcn.00406f5d
xor esi, esi
push esi
push 0x80
push 3
push esi
push 7
push connect
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x459a38
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0x7d000
ja 0x459a30
mov ecx, dword [ebp + 0xc]
push ebx
mov dword [ebp - 4], esi
call fcn.00407158
mov ecx, dword [ebp + 0xc]
mov esi, eax
push ebx
call fcn.004070c2
push 0
lea eax, [ebp - 4]
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x45a2ac
Capabilities:
Check if file exists

Disassembly:
push 0x40
mov eax, 0x4715a4
call fcn.0044f632
mov edi, ecx
lea ecx, [ebp - 0x30]
call fcn.0046ddc6
xor esi, esi
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call fcn.0046de16
test eax, eax
jne 0x45a2e8
push str.KUpdateProtocol::AddChannelList_ini_Parse_Error__
push edi
call fcn.00459271
pop ecx
pop ecx
jmp 0x45a493
mov ebx, 0x48a9dc
lea ecx, [ebp - 0x10]
push ebx
call fcn.0040651c
push ebx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0040651c
push ebx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.0040651c
lea ecx, [ebp - 0x4c]
call fcn.00406baf
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 4
push eax
call fcn.0045b489
mov ecx, eax
call fcn.0045b43a
push ecx
push str.ChannelCount
push str.Common
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 5
call fcn.0046de8a
mov dword [ebp - 0x24], eax
test eax, eax
je 0x45a45c
push esi
lea eax, [ebp - 0x10]
push str.Channel_d
push eax
call fcn.00406873
pop ecx
pop ecx
push str.IndexName
push dword [ebp - 0x10]
lea ecx, [ebp - 0x30]
call fcn.0046df21
push eax
lea ecx, [ebp - 0x4c]
call fcn.004064f3
push ecx
push 0x488208
push dword [ebp - 0x10]
lea ecx, [ebp - 0x30]
call fcn.0046de8a
push dword [ebp - 0x4c]
mov ecx, edi
mov dword [ebp - 0x48], eax
call fcn.00459bdb
test eax, eax
je 0x45a452
push ecx
push str.CheckFile
push dword [ebp - 0x10]
lea ecx, [ebp - 0x30]
call fcn.0046df21
push eax
lea ecx, [ebp - 0x14]
call fcn.004064f3
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x45a413
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x20]
call fcn.0040404b
mov byte [ebp - 4], 6
lea ecx, [ebp + 8]
mov edx, eax
mov dword [esp], str..kid
call fcn.00406651
pop ecx
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp + 8]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
call fcn.0040630c
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0040630c
add bl, 1
jne 0x45a452
push ecx
push str.Method
push dword [ebp - 0x10]
lea ecx, [ebp - 0x30]
call fcn.0046df21
push eax
lea ecx, [ebp - 0x18]
call fcn.004064f3
push dword [ebp - 0x18]
mov ecx, edi
call fcn.00459b82
test eax, eax
je 0x45a452
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x48]
push eax
lea ecx, [edi + 0x10]
call fcn.00406d90
mov ecx, eax
call fcn.00406c6f
inc esi
cmp esi, dword [ebp - 0x24]
jb 0x45a34e
mov ecx, dword [ebp - 0x1c]
xor esi, esi
inc esi
lea ecx, [ecx - 0x10]
call fcn.0040630c
lea ecx, [ebp - 0x4c]
call fcn.00406c4b
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.0040630c
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.0040630c
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040630c
lea ecx, [ebp - 0x30]
call fcn.0046de00
mov eax, esi
call fcn.0044f60c
ret 4
Function at 0x45b066
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 0x21c
mov eax, 0x4717df
call fcn.0044f666
mov esi, ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x224]
push 0x48a9dc
xor ebx, ebx
call fcn.0040651c
and dword [ebp - 4], ebx
lea eax, [ebp - 0x220]
push eax
mov ecx, esi
call fcn.0045b2b6
push eax
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 1
call fcn.004042c7
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.0040630c
push dword [edi + 4]
push dword [edi]
call fcn.0040456c
mov eax, dword [edi]
push dword [ebp - 0x224]
mov dword [edi + 4], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45b225
and dword [ebp - 0x220], ebx
lea eax, [ebp - 0x218]
push 0x208
push ebx
push eax
call fcn.0042ac90
add esp, 0xc
lea ecx, [ebp - 0x21c]
mov esi, 0x48a9dc
push esi
call fcn.0040651c
push ebx
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 2
push str.name_d
push eax
call fcn.00406873
add esp, 0xc
lea eax, [ebp - 0x218]
push dword [ebp - 0x224]
push 0x104
push eax
push esi
push dword [ebp - 0x21c]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push str.rebootfilelist
call esi
test eax, eax
je 0x45b217
inc ebx
mov dword [ebp - 0x228], ebx
mov ebx, dword [ebp - 0x220]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x220]
call fcn.0040651c
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 3
push eax
mov ecx, edi
call fcn.00403fd1
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.0040630c
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.0040630c
push 0x208
lea eax, [ebp - 0x218]
inc ebx
push 0
push eax
call fcn.0042ac90
add esp, 0xc
lea ecx, [ebp - 0x21c]
push 0x48a9dc
call fcn.0040651c
push ebx
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 2
push str.name_d
push eax
call fcn.00406873
add esp, 0xc
lea eax, [ebp - 0x218]
push dword [ebp - 0x224]
push 0x104
push eax
push 0x48a9dc
push dword [ebp - 0x21c]
push str.rebootfilelist
call esi
test eax, eax
jne 0x45b161
mov ebx, dword [ebp - 0x228]
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.0040630c
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.0040630c
mov eax, ebx
call fcn.0044f621
ret 4

Function at 0x45b74a
Capabilities:
Read .ini file

Disassembly:
push 8
mov eax, 0x47197f
call fcn.0044f632
mov esi, ecx
push 0x48a9dc
lea ecx, [ebp - 0x10]
call fcn.0040651c
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.0045b6db
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004042c7
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.0040630c
push dword [ebp - 0x10]
push 0x1f41
push str.tryno
push str.common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x10]
mov esi, eax
add ecx, 0xfffffff0
call fcn.0040630c
mov eax, esi
call fcn.0044f60c
ret
Function at 0x45bbc8
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
mov edi, ecx
cmp dword [eax + 0x14], 8
mov dword [ebp - 8], edi
mov dword [ebp - 4], esi
jb 0x45bbe5
mov eax, dword [eax]
push esi
push esi
push 3
push esi
push 1
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x45bca0
test ebx, ebx
je 0x45bca0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
add edi, 0xc
inc eax
push eax
mov ecx, edi
call fcn.00402b7a
push 0x80000
call fcn.0042eacc
mov dword [ebp + 8], eax
pop ecx
test eax, eax
je 0x45bc99
push 0x80000
push esi
push eax
jmp 0x45bc55
cmp dword [ebp - 4], esi
je 0x45bc75
push dword [ebp - 4]
mov ecx, edi
push dword [ebp + 8]
call fcn.00402bb1
push 0x80000
push esi
push dword [ebp + 8]
call fcn.0042ac90
add esp, 0xc
lea eax, [ebp - 4]
push esi
push eax
push 0x80000
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x45bc3a
cmp dword [edi + 0x14], 0x10
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 0x1c]
jb 0x45bc83
mov edi, dword [edi]
add eax, edi
mov dword [ecx], edi
xor esi, esi
mov dword [ecx + 4], eax
mov dword [ecx + 8], edi
inc esi
push dword [ebp + 8]
call fcn.0042eac7
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45cd65
Capabilities:
Check mutex on windows

Disassembly:
push esi
push str.GlobalKUpdateInstanceBFE33241_6374_4991_A4D3_5E3F8AD2D7BA
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
jne 0x45cd82
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x45cd9a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
ret
xor eax, eax
mov dword [0x49d9e4], esi
inc eax
pop esi
ret
Function at 0x45d55a
Capabilities:
Read .ini file

Disassembly:
push 0x18
mov eax, 0x471dd4
call fcn.0044f632
mov esi, ecx
mov dword [ebp - 0x24], esi
mov edi, 0x48a9dc
lea ecx, [ebp - 0x10]
push edi
call fcn.0040651c
xor ebx, ebx
lea ecx, [ebp - 0x18]
push edi
mov dword [ebp - 4], ebx
call fcn.0040651c
push edi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0040651c
mov byte [ebp - 4], 2
cmp dword [0x49d9cc], ebx
jne 0x45d671
lea eax, [ebp - 0x1c]
push eax
call fcn.0045fd68
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.004042c7
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.0040630c
push dword [esi + 8]
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x20]
call fcn.0040404b
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1c]
mov edx, eax
mov dword [esp], str..txt
call fcn.00406651
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.004042c7
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.0040630c
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.0040630c
push str..old.txt
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x20]
call fcn.00406651
pop ecx
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 6
call fcn.004042c7
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.0040630c
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push ebx
push 0x48a7f0
push 0x48a364
call esi
push dword [ebp - 0x10]
mov edi, eax
push ebx
push 0x48a7f0
push 0x48a364
call esi
mov esi, dword [ebp - 0x24]
cmp edi, eax
setg bl
mov eax, dword [esi + 8]
push ebx
push dword [eax]
push str.KChannel::IsScrollBack_name:_ws_return:_d
push 0x49db70
call fcn.0046ad90
mov ecx, dword [ebp - 0x14]
add esp, 0x10
lea ecx, [ecx - 0x10]
call fcn.0040630c
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040630c
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040630c
mov eax, ebx
call fcn.0044f60c
ret
Function at 0x45db65
Capabilities:
Copy file

Disassembly:
push 0x10
mov eax, 0x471f12
call fcn.0044f632
mov edi, ecx
lea eax, [ebp - 0x14]
push eax
call fcn.0045fddc
xor esi, esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], esi
call fcn.0046d5a0
push str.updateksbrowser_
lea ecx, [ebp - 0x14]
call fcn.00406715
push dword [edi + 8]
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x1c]
call fcn.0040404b
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
mov edx, eax
mov dword [esp], str..txt
call fcn.00406651
pop ecx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.0040630c
push str..old.txt
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x18]
call fcn.00406651
pop ecx
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.0045d55a
test eax, eax
jne 0x45dc2b
push esi
push dword [ebp - 0x18]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x45dc1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x10]
mov esi, eax
push esi
push str.KChannel::RecursiveBackupIndex_fail__error:_d__path:_ws
push 0x49db70
call fcn.0046ad90
add esp, 0x10
jmp 0x45dc2b
push 0x48a9dc
push dword [ebp - 0x10]
mov ecx, edi
call fcn.0045d7d0
mov esi, eax
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.0040630c
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.0040630c
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.0040630c
mov eax, esi
call fcn.0044f60c
ret
Function at 0x45e737
Capabilities:
Copy file
Delete file
Set file attributes

Disassembly:
push 4
mov eax, 0x47212f
call fcn.0044f632
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push esi
or ebx, 0xffffffff
call fcn.0040651c
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00462345
mov ecx, dword [ebp - 0x10]
call fcn.0046239d
push 0
push dword [ebp + 0xc]
call fcn.0043a7bc
pop ecx
pop ecx
test eax, eax
jne 0x45e7f0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x45e7a8
mov ecx, dword [ebp + 0xc]
mov edx, esi
call fcn.0046243b
test eax, eax
jne 0x45e7f0
mov dword [0x49d950], 1
jmp 0x45e7ee
push esi
lea ecx, [ebp + 8]
call fcn.0040651c
push 0x48a3bc
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.00406715
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
push ecx
call fcn.00464f6d
push esi
call fcn.0046b6e7
mov ecx, eax
call fcn.0046b60c
mov byte [ebp - 4], 0
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.0040630c
xor ebx, ebx
push 0
push ebx
push 0x14
mov ecx, 0x49db40
call fcn.00467293
push esi
push dword [ebp + 0xc]
push ebx
push 0x48a3c0
push 0x49db70
call fcn.0046ad90
mov ecx, dword [ebp - 0x10]
add esp, 0x14
add ecx, 0xfffffff0
call fcn.0040630c
mov eax, ebx
call fcn.0044f60c
ret 8
Function at 0x45f5cd
Capabilities:
Read .ini file

Disassembly:
push 0xc
mov eax, 0x472449
call fcn.0044f632
mov esi, 0x48a9dc
lea ecx, [ebp - 0x14]
push esi
call fcn.0040651c
xor ebx, ebx
lea ecx, [ebp - 0x10]
push esi
mov dword [ebp - 4], ebx
call fcn.0040651c
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
call fcn.0045b489
mov ecx, eax
call fcn.0045b2b6
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.004042c7
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.0040630c
lea eax, [ebp - 0x18]
push eax
call fcn.0045b489
mov ecx, eax
call fcn.0045b23d
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.004042c7
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.0040630c
push ebx
push dword [ebp - 0x10]
call fcn.0043a7bc
pop ecx
pop ecx
push dword [ebp - 0x14]
push ebx
test eax, eax
je 0x45f676
push 0x48a8f8
push str.common
mov esi, ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, eax
jmp 0x45f6e8
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, str.forcereboot
push edi
push str.common
call esi
push dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
push ebx
push edi
mov edi, str.common
push edi
call esi
push dword [ebp - 0x14]
mov ebx, eax
push 0
push str.alertreboot
push edi
call esi
push dword [ebp - 0x10]
mov edi, eax
push 0
push str.alertreboot
push str.common
call esi
push dword [ebp - 0x10]
mov esi, eax
push 0
push 0x48a8f8
push str.common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, eax
xor eax, eax
cmp dword [ebp - 0x18], ebx
setne al
xor ebx, ebx
cmp edi, esi
mov dword [ebp - 0x18], eax
mov esi, eax
setne bl
mov eax, dword [0x49d954]
test eax, eax
mov dword [0x49d9ac], ecx
mov ecx, dword [ebp - 0x10]
cmove eax, esi
mov dword [0x49d94c], ebx
mov dword [0x49d954], eax
lea ecx, [ecx - 0x10]
call fcn.0040630c
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.0040630c
call fcn.0044f60c
ret

Function at 0x460798
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push esi
push edi
mov esi, edx
mov edi, ecx
mov ecx, esi
call fcn.00460745
test eax, eax
jne 0x4607c2
mov ecx, esi
call fcn.004606f2
test eax, eax
jne 0x4607c2
mov edx, dword [esi]
push ecx
mov ecx, dword [edi]
call fcn.00461a33
pop ecx
pop edi
pop esi
ret
mov edx, dword [edi]
mov ecx, dword [esi]
pop edi
pop esi
jmp fcn.0046f1df