joyce8/EMBER2024-capa huggingface dataset:
Function at 0x715d5e85
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
xor ebx, ebx
xor edi, edi
cmp dword [0x715e4528], ebx
jne 0x715d5edd
call fcn.715d6e5e
test eax, eax
je 0x715d5ecc
cmp word [0x715e4520], bx
je 0x715d5ecc
mov dword [0x715e4538], ebx
call fcn.715d6c18
test eax, eax
je 0x715d5f2b
push dword [ebp + 8]
call fcn.715d3a9a
test eax, eax
jl 0x715d5f2b
jmp 0x715d5edd
mov eax, dword [0x715e4538]
push 1
pop edi
mov dword [ebp - 4], eax
mov dword [0x715e4538], edi
cmp dword [0x715e4538], 1
jne 0x715d5efa
push dword [ebp + 8]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
jmp 0x715d5f24
lea eax, [ebp - 8]
mov byte [ebp - 0x6c], bl
push eax
lea eax, [ebp - 0x6c]
push 0x64
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.715d3b89
test eax, eax
jl 0x715d5f2b
cmp byte [ebp - 0x6c], bl
je 0x715d5f28
lea eax, [ebp - 0x6c]
push eax
call fcn.715e1c47
mov esi, eax
jmp 0x715d5f2b
mov esi, dword [ebp + 0x14]
cmp edi, ebx
je 0x715d5f37
mov eax, dword [ebp - 4]
mov dword [0x715e4538], eax
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x715d6513
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push esi
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x715d653f
xor esi, esi
push esi
push 0x10
push esi
push esi
push 0x46e
jmp 0x715d6596
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push 0x715d1f0c
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
push esi
jne 0x715d6580
push 0x10
push esi
push esi
push 0x46f
jmp 0x715d6596
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x715d65a0
push esi
push 0x10
push esi
push esi
push 0x470
push esi
call fcn.715d6f11
xor eax, eax
jmp 0x715d65a3
push 1
pop eax
pop esi
leave
ret

Function at 0x715d6e5e
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x715d6e8e
push eax
push 0x10
push eax
push eax
push 0x44d
jmp 0x715d6ea6
mov eax, dword [ebp - 0x84]
dec eax
je 0x715d6eff
dec eax
je 0x715d6eb5
xor eax, eax
push eax
push 0x10
push eax
push eax
push 0x457
push dword [0x715e4534]
call fcn.715d6f11
xor eax, eax
leave
ret
mov ecx, dword [ebp - 0x90]
push 1
pop eax
mov word [0x715e4520], 2
push 3
mov dword [0x715e452c], eax
pop edx
cmp ecx, edx
ja 0x715d6ef1
cmp ecx, edx
mov word [0x715e4520], ax
jb 0x715d6ee8
jne 0x715d6f0f
cmp dword [ebp - 0x8c], 0x33
jae 0x715d6f0f
and dword [0x715e452c], 0
leave
ret
cmp ecx, 5
jb 0x715d6f0f
mov word [0x715e4520], dx
leave
ret
and word [0x715e4520], 0
push 1
pop eax
mov dword [0x715e452c], eax
leave
ret
Function at 0x715d7586
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x104]
push 0x715d1fc0
push eax
call fcn.715e1804
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
push eax
push 0x4000080
push 1
push eax
push eax
lea eax, [ebp - 0x104]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x715d75fe
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x715d75fe
test al, 0x10
je 0x715d75fe
push 1
pop eax
jmp 0x715d7600
xor eax, eax
leave
ret 4

Function at 0x715d7920
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
push 0x715d2020
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x715d7950
mov eax, 0x80000000
jmp 0x715d798b
push 0x715d2018
push edi
call esi
test eax, eax
jne 0x715d7963
mov eax, 0x80000001
jmp 0x715d798b
push 0x715d14bc
push edi
call esi
test eax, eax
jne 0x715d7976
mov eax, 0x80000002
jmp 0x715d798b
push 0x715d2014
push edi
call esi
test eax, eax
jne 0x715d7a2e
mov eax, 0x80000003
lea ecx, [ebp - 8]
push ecx
push 0x20019
push ebx
push dword [ebp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x715d7a47
lea eax, [ebp - 4]
mov edi, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push dword [ebp + 8]
mov dword [ebp - 4], edi
push eax
push ebx
push dword [ebp + 0x18]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 8]
test eax, eax
je 0x715d79d4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x715d7a47
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], ebx
je 0x715d7a47
cmp dword [ebp - 0xc], 1
je 0x715d79eb
cmp dword [ebp - 0xc], 2
jne 0x715d7a47
cmp dword [ebp - 0xc], 2
jne 0x715d7a29
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, ebx
je 0x715d7a47
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 4], ebx
je 0x715d7a47
cmp dword [ebp - 4], edi
ja 0x715d7a47
push 1
pop eax
jmp 0x715d7a49
cmp byte [edi], bl
je 0x715d7a47
push ebx
push 0x10
push ebx
push ebx
push 0x465
push dword [0x715e4534]
call fcn.715d6f11
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x14

Function at 0x715d7f5b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x715d7f7a
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x715d7f7a
test al, 0x10
je 0x715d7f7a
push 1
pop eax
jmp 0x715d7f7c
xor eax, eax
ret 4
Function at 0x715d80dc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
push edi
push 1
pop eax
xor ebx, ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp + 0x14], ebx
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], ebx
mov esi, 0x100
je 0x715d813c
and eax, 0x10
mov dword [ebp - 0x14], eax
je 0x715d8135
push ebx
lea ecx, [ebp - 0x120]
mov eax, 0x715d19e0
push esi
push ecx
push eax
push dword [ebp + 0xc]
mov edi, eax
push dword [ebp + 8]
call fcn.715d5f40
test eax, eax
jge 0x715d814e
mov edi, 0x715d19d0
jmp 0x715d814e
and eax, 0x10
mov edi, 0x715d19d0
mov dword [ebp - 0x14], eax
jne 0x715d814e
mov edi, 0x715d19e0
push ebx
lea eax, [ebp - 0x120]
push esi
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.715d5f40
test eax, eax
jge 0x715d816f
push 1
pop eax
jmp 0x715d829f
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
test eax, eax
jge 0x715d817d
mov dword [ebp - 0x1c], ebx
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
xor esi, esi
cmp dword [ebp - 4], ebx
je 0x715d8192
push dword [ebp - 4]
call edi
mov dword [ebp - 4], ebx
lea eax, [ebp - 4]
push ebx
push eax
lea eax, [ebp - 0x120]
push esi
push eax
push dword [ebp + 8]
call fcn.715d60e4
test eax, eax
jl 0x715d8287
push ebx
lea eax, [ebp - 0x20]
push 1
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
call fcn.715d804e
cmp dword [0x715e4538], 1
jne 0x715d81e3
push dword [ebp - 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_OemToCharA]
cmp dword [ebp - 0x14], ebx
je 0x715d81fa
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x715d8255
test al, 0x10
jne 0x715d8255
cmp dword [ebp + 0x10], ebx
jne 0x715d8243
cmp dword [ebp + 0x14], ebx
je 0x715d820a
test byte [ebp + 0x18], 0x80
jne 0x715d8243
push esi
lea eax, [ebp - 0x10]
push dword [ebp + 0x14]
push 1
push eax
call fcn.715d85a6
test eax, eax
jne 0x715d8255
cmp dword [ebp - 0x14], ebx
jne 0x715d8255
cmp dword [ebp + 0x14], ebx
push ebx
push 0x10
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
jne 0x715d825b
push 0x46d
push dword [0x715e4534]
call fcn.715d6f11
jmp 0x715d8255
push esi
lea eax, [ebp - 0x10]
push dword [ebp + 0x14]
push ebx
push eax
call fcn.715d85a6
test eax, eax
je 0x715d826d
inc esi
jmp 0x715d8185
push 0x463
push dword [0x715e4534]
call fcn.715d6f11
jmp 0x715d8287
push ebx
push 0x10
push ebx
push dword [ebp - 0x10]
push 0x464
push dword [0x715e4534]
call fcn.715d6f11
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x1c], ebx
je 0x715d8292
call dword [sym.imp.ole32.dll_OleUninitialize]
cmp dword [ebp - 4], ebx
je 0x715d829c
push dword [ebp - 4]
call edi
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x715d833f
Capabilities:
Get common file path
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
push edi
mov edi, 0x104
lea eax, [ebp - 0x218]
push edi
push eax
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x218]
push 0x715d2078
push eax
call fcn.715e1804
lea eax, [ebp - 0xc]
push 1
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x218]
push eax
call sym.ADVPACK.dll_GetVersionFromFile
mov esi, 0x40047
cmp dword [ebp - 4], esi
ja 0x715d83a4
jne 0x715d8467
cmp dword [ebp - 0xc], 0xdb0000
jb 0x715d8467
lea eax, [ebp - 0x114]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x114]
push 0x715d2068
push eax
call fcn.715e1804
push 1
lea eax, [ebp - 0xc]
pop ebx
push ebx
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x114]
push eax
call sym.ADVPACK.dll_GetVersionFromFile
cmp dword [ebp - 4], esi
jb 0x715d83ef
jne 0x715d8467
cmp dword [ebp - 0xc], 0xdb0000
jae 0x715d8467
lea eax, [ebp - 0x10]
xor esi, esi
push eax
lea eax, [ebp - 8]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push 0x715d1d24
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x715d8467
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x114]
push 0x715d2044
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push esi
push 0x715d2038
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x715d845e
xor ebx, ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret

Function at 0x715d84df
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
inc dword [ebp + 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x715d84e2
pop ebp
ret 0x10
Function at 0x715d8b5d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
lea eax, [ebp - 0x104]
push 0x104
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x715d8bba
lea eax, [ebp - 0x104]
push 0x715d224c
push eax
call fcn.715e1804
lea eax, [ebp - 0x104]
push 0x40
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov esi, eax
cmp esi, 0xffffffff
je 0x715d8bba
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll__llseek]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x715d8bc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 8]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x715d8c09
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x715d8c00
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop esi
leave
ret 8

Function at 0x715d8c11
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 8]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x715d8c5e
push esi
push esi
push esi
lea eax, [ebp - 4]
push esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x715d8c55
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop esi
leave
ret 4
Function at 0x715d8cb9
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
cmp esi, ebx
push edi
je 0x715d8cd0
mov dword [esi], ebx
mov edi, dword [ebp + 0xc]
cmp edi, ebx
je 0x715d8d8e
mov eax, dword [ebp + 8]
mov cl, byte [eax + 1]
cmp cl, 0x3a
jne 0x715d8d84
push 4
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x104]
push eax
call fcn.715e208e
cmp eax, ebx
mov dword [ebp + 0xc], eax
push ebx
jne 0x715d8d1f
push 0x10
lea eax, [ebp - 0x104]
push ebx
push eax
push 0x46c
jmp 0x715d8d4c
lea eax, [ebp + 0x10]
push ebx
push eax
lea eax, [ebp + 8]
push eax
push ebx
push ebx
lea eax, [ebp - 0x104]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x715d8d5b
push ebx
push 0x10
lea eax, [ebp - 0x104]
push ebx
push eax
push 0x477
push ebx
call fcn.715d6f11
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp esi, ebx
je 0x715d8d61
mov dword [esi], edi
test byte [ebp + 0x11], 0x80
je 0x715d8d7c
cmp dword [0x715e453c], ebx
je 0x715d8d7c
mov eax, edi
shr eax, 2
add edi, eax
cmp esi, ebx
je 0x715d8d7c
mov dword [esi], edi
cmp dword [ebp + 0xc], edi
sbb eax, eax
inc eax
jmp 0x715d8d54
cmp byte [eax], 0x5c
jne 0x715d8d52
cmp cl, 0x5c
jne 0x715d8d52
push 1
pop eax
jmp 0x715d8d54

Function at 0x715d8e19
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [ebp + 8]
push edi
xor edi, edi
cmp byte [eax], 0
jne 0x715d8e31
xor eax, eax
jmp 0x715d8e5e
push esi
lea ecx, [ebp - 0x88]
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov esi, eax
cmp esi, 0xffffffff
je 0x715d8e5b
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, edi
pop esi
pop edi
leave
ret 4
Function at 0x715d8e63
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.715d8de9
test eax, eax
je 0x715d8f1e
push dword [ebp + 8]
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x10c]
push eax
call esi
cmp eax, 3
mov bl, 0x5c
jle 0x715d8edc
lea eax, [ebp - 0x10c]
push eax
call esi
lea eax, [ebp + eax - 0x10c]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_CharPrevA]
lea ecx, [ebp - 0x10c]
cmp eax, ecx
jbe 0x715d8edc
cmp byte [eax], bl
jne 0x715d8edc
and byte [eax], 0
cmp byte [ebp - 0x10c], bl
mov edi, dword [sym.imp.USER32.dll_CharNextA]
jne 0x715d8f2a
cmp byte [ebp - 0x10b], bl
jne 0x715d8f2a
lea eax, [ebp - 0x10a]
xor esi, esi
mov cl, byte [eax]
cmp cl, bl
je 0x715d8f09
test cl, cl
je 0x715d8f16
push eax
call edi
jmp 0x715d8efa
inc esi
cmp esi, 2
jl 0x715d8efa
push eax
call edi
mov esi, eax
jmp 0x715d8f30
test esi, esi
jne 0x715d8fc8
mov dword [ebp - 4], 0x800700a1
jmp 0x715d8fc8
lea esi, [ebp - 0x109]
mov al, byte [esi]
test al, al
je 0x715d8fc8
cmp al, bl
je 0x715d8f4b
test al, al
je 0x715d8f4b
push esi
call edi
mov esi, eax
mov al, byte [esi]
jmp 0x715d8f3a
cmp byte [esi], 0
jne 0x715d8f57
mov dword [ebp - 8], 1
and byte [esi], 0
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x715d8f9a
lea eax, [ebp - 0x10c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x715d8fa9
cmp dword [ebp - 8], 0
je 0x715d8fa0
cmp dword [ebp + 0xc], 0
je 0x715d8f9a
lea eax, [ebp - 0x10c]
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [ebp - 8], 0
jne 0x715d8fc8
push esi
mov byte [esi], bl
call edi
mov esi, eax
jmp 0x715d8f30
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x715d8fb9
call esi
jmp 0x715d8fc5
call esi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x715d8fd2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
push esi
push edi
push 0x10
xor esi, esi
pop ecx
xor eax, eax
lea edi, [ebp - 0x70]
mov dword [ebp - 0x74], esi
mov dword [ebp - 4], esi
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 0x10]
cmp edi, esi
je 0x715d8ff6
mov dword [edi], esi
push dword [ebp + 8]
push 0x715d2334
call fcn.715dd74c
mov eax, dword [ebp + 0x18]
pop ecx
pop ecx
mov dword [ebp - 0x74], 0x44
push 1
pop ebx
not al
and al, bl
or dword [ebp - 0x48], ebx
movzx ax, al
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp + 0xc]
push esi
push 0x4000020
push esi
push esi
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, esi
jne 0x715d904f
mov dword [ebp - 4], 0x80004005
jmp 0x715d90e0
push dword [ebp - 0x10]
mov dword [ebp + 0x10], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
cmp edi, esi
mov dword [ebp + 0xc], eax
je 0x715d9069
mov dword [edi], eax
jmp 0x715d90e0
test byte [ebp + 0x18], 2
jne 0x715d90e0
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
push 0xff
lea eax, [ebp + 0xc]
push dword [ebp + 0x14]
push esi
push eax
push ebx
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, esi
je 0x715d90b9
cmp eax, 0x102
je 0x715d90c0
push ebx
push esi
push esi
lea eax, [ebp - 0x30]
push esi
push eax
call edi
test eax, eax
je 0x715d90d2
cmp dword [ebp - 0x2c], 0x12
jne 0x715d90ad
mov dword [ebp + 0x10], ebx
jmp 0x715d9094
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x715d9094
cmp eax, 0x102
jne 0x715d90cf
push dword [ebp + 8]
push 0x715d2314
call fcn.715dd74c
pop ecx
pop ecx
mov dword [ebp + 0x10], ebx
cmp dword [ebp + 0x10], esi
je 0x715d9075
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 8]
push dword [ebp - 4]
push 0x715d22f0
call fcn.715dd74c
mov eax, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x715d90fd
Capabilities:
Check if file exists
Copy file
Delete file
Get common file path
Get file attributes
Read .ini file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
and dword [ebp - 0xc], 0
push ebx
push esi
push edi
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x715d91f9
test al, 1
je 0x715d91f9
mov esi, 0x80
push esi
push dword [ebp + 0x14]
call edi
test eax, eax
jne 0x715d91f9
lea eax, [ebp - 0x214]
mov ebx, 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x715d91f9
lea eax, [ebp - 0x214]
push eax
call fcn.715d7586
test eax, eax
jne 0x715d917c
lea eax, [ebp - 0x214]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x110]
push eax
push 0
lea eax, [ebp - 0x214]
push 0x715d234c
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x715d91f9
lea eax, [ebp - 0x110]
push esi
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x110]
push eax
call ebx
lea eax, [ebp - 0x110]
push 0
push eax
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x110]
push esi
push eax
call edi
lea eax, [ebp - 0x110]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x110]
push eax
mov dword [ebp - 0xc], 1
call ebx
cmp dword [ebp - 0xc], 0
jne 0x715d9214
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0xffffffff
je 0x715d9228
test byte [ebp - 4], 1
je 0x715d9228
push dword [ebp - 4]
push dword [ebp + 0x14]
call edi
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x715d929a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
lea eax, [ebp - 0x104]
push 0x104
push eax
xor esi, esi
call fcn.715d9232
test eax, eax
je 0x715d92f2
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call fcn.715e1804
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x715d92f2
test al, 0x10
jne 0x715d92f2
push 8
lea eax, [ebp - 0x104]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
test esi, esi
jne 0x715d9301
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
mov eax, esi
pop esi
leave
ret 4