joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d0c0
Capabilities:
Get uefi variable
Set uefi variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
mov word [ebp - 0x50], 0
push 0x3e
push 0
lea eax, [ebp - 0x4e]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
movzx ecx, word [ebp + 8]
push ecx
push str.Boot_04X
push 0x40
lea edx, [ebp - 0x50]
push edx
call fcn.00410bf0
add esp, 0x10
push 0x1000
call fcn.0043acf2
add esp, 4
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x58], eax
push 0x1000
mov ecx, dword [ebp - 0x58]
push ecx
push 0x4697d0
lea edx, [ebp - 0x50]
push edx
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
test eax, eax
jne 0x43d139
xor al, al
jmp 0x43d259
mov eax, dword [ebp - 0x58]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x58]
cdq
mov esi, eax
mov edi, edx
add esi, 8
adc edi, 0
mov ecx, dword [ebp - 4]
add ecx, 6
push ecx
call dword [sym.imp.MSVCR80.dll_wcslen]
add esp, 4
shl eax, 1
xor edx, edx
add esi, eax
adc edi, edx
add esi, 0x2a
adc edi, 0
mov dword [ebp - 0x54], esi
mov eax, dword [ebp - 4]
add eax, 6
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
add esp, 4
lea ecx, [eax + eax + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x54]
movzx eax, word [edx + 2]
mov ecx, dword [ebp - 0xc]
lea edx, [ecx + eax + 0x2e]
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0xc]
and eax, 1
je 0x43d1ab
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
or edx, 1
mov eax, dword [ebp - 4]
mov dword [eax], edx
mov ecx, dword [ebp + 0xc]
and ecx, 8
je 0x43d1c0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
or eax, 8
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x58]
push eax
push 0x4697d0
lea ecx, [ebp - 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableW]
test eax, eax
jne 0x43d1df
xor al, al
jmp 0x43d259
mov edx, dword [ebp + 0xc]
and edx, 4
je 0x43d207
push 2
lea eax, [ebp + 8]
push eax
push 0x4697d0
push 0x46bfd8
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableW]
test eax, eax
jne 0x43d205
xor al, al
jmp 0x43d259
jmp 0x43d257
mov word [ebp - 0x5c], 0
push 2
lea ecx, [ebp - 0x5c]
push ecx
push 0x4697d0
push 0x46bfec
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
test eax, eax
je 0x43d257
movzx edx, word [ebp - 0x5c]
movzx eax, word [ebp + 8]
cmp edx, eax
jne 0x43d257
mov word [ebp - 0x5c], 0xffff
push 2
lea ecx, [ebp - 0x5c]
push ecx
push 0x4697d0
push str.BootNext
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableW]
test eax, eax
jne 0x43d257
xor al, al
jmp 0x43d259
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret
Function at 0x43d5f0
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x43d6d4
push 0x46da88
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR80.dll_wcscmp]
add esp, 8
test eax, eax
je 0x43d6d4
mov word [ebp - 0x210], 0
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 0x46da8c
lea eax, [ebp - 0x210]
push eax
call fcn.00407740
add esp, 0xc
mov word [ebp - 0x418], 0
push 0x206
push 0
lea ecx, [ebp - 0x416]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
push str.echo_Ychkdsk__s__f__x
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x418]
push ecx
push 0x46dad8
push 0x1d2
push str.e:_amwork_branches_brcloudv2_src_bootentrymgrMyLogic.hpp
call fcn.0043d410
add esp, 8
push eax
call fcn.0043c830
add esp, 0xc
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.MSVCR80.dll__wsystem]
add esp, 4
mov al, 1
jmp 0x43d6d6
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret

Function at 0x43d8f0
Capabilities:
Get uefi variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 0xc], eax
push 0x200
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x200
mov ecx, dword [ebp + 8]
push ecx
push 0x4697d0
push 0x4698f0
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
test eax, eax
jne 0x43d937
xor al, al
jmp 0x43d9fe
mov dword [ebp - 4], 0
jmp 0x43d949
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0x100
jge 0x43d976
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2]
cmp edx, 0xffff
jne 0x43d974
mov eax, dword [ebp + 8]
mov cx, word [ebp - 4]
mov word [eax + 0x200], cx
jmp 0x43d976
jmp 0x43d940
mov dword [ebp - 8], 0
jmp 0x43d988
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x200]
cmp dword [ebp - 8], ecx
jae 0x43d9fc
mov word [ebp - 0x2c], 0
xor edx, edx
mov dword [ebp - 0x2a], edx
mov dword [ebp - 0x26], edx
mov dword [ebp - 0x22], edx
mov dword [ebp - 0x1e], edx
mov dword [ebp - 0x1a], edx
mov dword [ebp - 0x16], edx
mov dword [ebp - 0x12], edx
mov word [ebp - 0xe], dx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2]
push edx
push 0x469904
push 0x20
lea eax, [ebp - 0x2c]
push eax
call fcn.00410bf0
add esp, 0x10
lea ecx, [ebp - 0x2c]
push ecx
push 0x469910
push 0x99
push 0x469928
call fcn.0043d410
add esp, 8
push eax
call fcn.0043c830
add esp, 0xc
jmp 0x43d97f
mov al, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret
Function at 0x43da10
Capabilities:
Get uefi variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov word [ebp - 4], 0
push 2
lea eax, [ebp - 4]
push eax
push 0x4697d0
push str.Timeout
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
test eax, eax
jne 0x43da71
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
je 0x43da6d
mov ecx, dword [ebp - 8]
push ecx
push 0x7e
push 0x469840
push 0x46987c
push 0x7e
push 0x4698b4
call fcn.0043d410
add esp, 8
push eax
call fcn.0043c830
add esp, 0x14
xor al, al
jmp 0x43da73
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x43e610
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x664
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x448], 0
xor eax, eax
mov dword [ebp - 0x440], eax
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x428], 0x20
mov word [ebp - 0x660], 0
push 0x206
push 0
lea ecx, [ebp - 0x65e]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov word [ebp - 0x210], 0
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx ecx, word [ebp - 0x210]
push ecx
push 0x4691b4
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0
push 0x20000080
push 3
push 0
push 3
push bind
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0xffffffff
jne 0x43e6ff
xor al, al
jmp 0x43e850
push 0
lea ecx, [ebp - 0x44c]
push ecx
mov edx, dword [ebp - 0x428]
push edx
lea eax, [ebp - 0x448]
push eax
push 0
push 0
push 0x560000
mov ecx, dword [ebp - 0x424]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x43e737
xor al, al
jmp 0x43e850
mov word [ebp - 0x420], 0
push 0x206
push 0
lea edx, [ebp - 0x41e]
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
call sub.Comn.dll_GetObjectGpt
mov dword [ebp - 0x450], eax
mov eax, dword [ebp - 0x440]
push eax
mov ecx, dword [ebp - 0x450]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x450]
mov eax, dword [edx]
call eax
test eax, eax
jne 0x43e785
xor al, al
jmp 0x43e850
mov dword [ebp - 0x454], 0
mov ecx, dword [ebp - 0x450]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x450]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x664], 0
jmp 0x43e7c3
mov ecx, dword [ebp - 0x664]
add ecx, 1
mov dword [ebp - 0x664], ecx
mov edx, dword [ebp - 0x664]
cmp edx, dword [ebp - 0x214]
jae 0x43e800
mov eax, dword [ebp - 0x664]
push eax
mov ecx, dword [ebp - 0x450]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x450]
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x454], eax
mov ecx, dword [ebp - 0x454]
cmp dword [ecx], 1
jne 0x43e7fe
jmp 0x43e800
jmp 0x43e7b4
mov edx, dword [ebp - 0x424]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp - 0x454], 0
setne al
push eax
push 0xe7
push 0x4691c4
push str._S:__d__Check__isGptSystem:_d
push 0xe7
push str.e:_amwork_branches_brcloudv2_src_bootentrymgrMyDiskMgr.hpp
call fcn.0043d410
add esp, 8
push eax
call fcn.0043c830
add esp, 0x14
xor eax, eax
cmp dword [ebp - 0x454], 0
setne al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret
Function at 0x43f3b0
Capabilities:
Get uefi variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1280
call fcn.004646d0
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov word [ebp - 0x210], 0
push 0x1fe
push 0
lea eax, [ebp - 0x20e]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x10], cx
lea edx, [ebp - 0x210]
push edx
call fcn.0043d8f0
add esp, 4
movzx eax, al
test eax, eax
jne 0x43f43c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf6
push 0x46a424
push 0x46a460
push 0xf6
push 0x46a498
call fcn.0043d410
add esp, 8
push eax
call fcn.0043c830
add esp, 0x14
xor al, al
jmp 0x43f648
mov dword [ebp - 0x214], 0
jmp 0x43f457
mov ecx, dword [ebp - 0x214]
add ecx, 1
mov dword [ebp - 0x214], ecx
movzx edx, word [ebp - 0x10]
cmp dword [ebp - 0x214], edx
jae 0x43f4f4
mov word [ebp - 0x234], 0
xor eax, eax
mov dword [ebp - 0x232], eax
mov dword [ebp - 0x22e], eax
mov dword [ebp - 0x22a], eax
mov dword [ebp - 0x226], eax
mov dword [ebp - 0x222], eax
mov dword [ebp - 0x21e], eax
mov dword [ebp - 0x21a], eax
mov word [ebp - 0x216], ax
mov ecx, dword [ebp - 0x214]
movzx edx, word [ebp + ecx*2 - 0x210]
push edx
push 0x46a4d4
push 0x20
lea eax, [ebp - 0x234]
push eax
call fcn.00410bf0
add esp, 0x10
lea ecx, [ebp - 0x234]
push ecx
push 0x46a4e0
push 0xfe
push 0x46a4f8
call fcn.0043d410
add esp, 8
push eax
call fcn.0043c830
add esp, 0xc
jmp 0x43f448
mov dword [ebp - 0x238], 0
jmp 0x43f50f
mov edx, dword [ebp - 0x238]
add edx, 1
mov dword [ebp - 0x238], edx
movzx eax, word [ebp - 0x10]
cmp dword [ebp - 0x238], eax
jae 0x43f646
mov word [ebp - 0x278], 0
push 0x3e
push 0
lea ecx, [ebp - 0x276]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0x238]
movzx eax, word [ebp + edx*2 - 0x210]
push eax
push 0x46a534
push 0x40
lea ecx, [ebp - 0x278]
push ecx
call fcn.00410bf0
add esp, 0x10
mov byte [ebp - 0x1278], 0
push 0xfff
push 0
lea edx, [ebp - 0x1277]
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x1000
lea eax, [ebp - 0x1278]
push eax
push 0x4697d0
lea ecx, [ebp - 0x278]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
test eax, eax
jne 0x43f5d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x108
push 0x46a548
push 0x46a584
push 0x108
push 0x46a5bc
call fcn.0043d410
add esp, 8
push eax
call fcn.0043c830
add esp, 0x14
xor al, al
jmp 0x43f648
mov edx, dword [ebp - 0x238]
movzx eax, word [ebp + edx*2 - 0x210]
movzx ecx, word [ebp + 8]
cmp eax, ecx
jne 0x43f641
lea edx, [ebp - 0x1278]
mov dword [ebp - 0x127c], edx
lea eax, [ebp - 0x1278]
cdq
mov esi, eax
mov edi, edx
add esi, 8
adc edi, 0
mov eax, dword [ebp - 0x127c]
add eax, 6
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
add esp, 4
shl eax, 1
xor ecx, ecx
add esi, eax
adc edi, ecx
mov dword [ebp - 0x1280], esi
push 0x2a
mov edx, dword [ebp - 0x1280]
push edx
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR80.dll_memcpy
add esp, 0xc
mov al, 1
jmp 0x43f648
jmp 0x43f500
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret
Function at 0x440340
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 4], eax
mov word [ebp - 0x420], 0
push 0x206
push 0
lea eax, [ebp - 0x41e]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov word [ebp - 0x210], 0
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x218], 0
mov word [ebp - 0x214], 0x15be
mov dx, word [ebp - 0x214]
push edx
call fcn.0043eb10
add esp, 4
movzx eax, al
test eax, eax
jne 0x4403f9
push 0x10a
push 0x46cb8c
push 0x46cbc8
push 0x10a
push 0x46cc18
call fcn.0043d410
add esp, 8
push eax
call fcn.0043c830
add esp, 0x10
mov dword [ebp - 0x218], 4
jmp 0x440526
lea ecx, [ebp - 0x44c]
push ecx
mov dx, word [ebp - 0x214]
push edx
call fcn.0043f3b0
add esp, 8
movzx eax, al
test eax, eax
je 0x440447
push 0x104
lea ecx, [ebp - 0x420]
push ecx
mov edx, dword [ebp - 0x438]
push edx
mov eax, dword [ebp - 0x43c]
push eax
mov ecx, dword [ebp - 0x440]
push ecx
mov edx, dword [ebp - 0x444]
push edx
call fcn.0043cb00
add esp, 0x18
push 0x46cc54
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.MSVCR80.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x44049e
push 0x116
push 0x46cc58
push 0x46cc94
push 0x116
push 0x46ccd0
call fcn.0043d410
add esp, 8
push eax
call fcn.0043c830
add esp, 0x10
mov dword [ebp - 0x218], 6
jmp 0x440526
lea ecx, [ebp - 0x420]
push ecx
push 0x46cd10
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push str.Delete_EfiBoox64:_s
push 0x11b
push 0x46cd7c
call fcn.0043d410
add esp, 8
push eax
call fcn.0043c830
add esp, 0xc
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x440526
push 0x11e
push 0x46cdb8
push 0x46cdf4
push 0x11e
push 0x46ce28
call fcn.0043d410
add esp, 8
push eax
call fcn.0043c830
add esp, 0x10
mov dword [ebp - 0x218], 8
cmp dword [ebp - 0x218], 4
je 0x44058a
cmp dword [ebp - 0x218], 1
je 0x44058a
mov dx, word [ebp - 0x214]
push edx
call fcn.0043ef60
add esp, 4
movzx eax, al
test eax, eax
jne 0x44058a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x129
push 0x46ce64
push 0x46cea0
push 0x129
push 0x46ced8
call fcn.0043d410
add esp, 8
push eax
call fcn.0043c830
add esp, 0x14
mov dword [ebp - 0x218], 0xa
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret
Function at 0x441d20
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
cmp dword [eax + 4], 0
jne 0x441e34
mov ecx, dword [ebp - 0x18]
add ecx, 0x14
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edx, dword [ebp - 0x18]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 4], 0
jne 0x441e34
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x563
je 0x441dcb
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
jne 0x441dc9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
push 0xd0
push 0x46f3dc
call fcn.00441c90
add esp, 8
push eax
push 0x46f3f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401020
add esp, 0xc
jmp 0x441e6d
jmp 0x441e34
mov edx, dword [ebp - 0x18]
add edx, 0x14
push edx
push 1
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x18]
xor eax, eax
cmp dword [edx + 4], 0
setne al
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jne 0x441e34
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
push 0xd6
push str..ShareMemory.cpp
call fcn.00441c90
add esp, 8
push eax
push 0x46f40c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401020
add esp, 0xc
jmp 0x441e6d
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x441e60
cmp dword [ebp - 4], 0x80
je 0x441e60
mov dword [ebp - 0x1c], 0
jmp 0x441e67
mov dword [ebp - 0x1c], 1
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x442130
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
push eax
push 1
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0xc], eax
xor ecx, ecx
cmp dword [ebp - 0xc], 0
setne cl
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0
jne 0x4421b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
push 0x66
push 0x46f2f8
call fcn.00441c90
add esp, 8
push eax
push 0x46f30c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401020
add esp, 0xc
jmp 0x44229d
push 0x1388
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x24]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4421fe
push 0x67
push 0x46f314
call fcn.00441c90
add esp, 8
push eax
push 0x46f328
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401020
add esp, 0xc
jmp 0x44229d
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
push 6
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x10], eax
xor ecx, ecx
cmp dword [ebp - 0x10], 0
setne cl
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], 0
jne 0x44226d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
push 0x6c
push 0x46f340
call fcn.00441c90
add esp, 8
push eax
push 0x46f354
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401020
add esp, 0xc
jmp 0x44229d
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call sub.MSVCR80.dll_memcpy
add esp, 0xc
mov eax, dword [ebp + 0x14]
push eax
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 0xc], 0xffffffff
je 0x4422b4
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xc], 0xffffffff
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x24]
mov eax, dword [edx + 0x1c]
call eax
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x442810
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x41c], 1
mov word [ebp - 0x418], 0
push 0x206
push 0
lea eax, [ebp - 0x416]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov word [ebp - 0x210], 0
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea edx, [ebp - 0x418]
push edx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x470d00
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.MSVCR80.dll_wcscat]
add esp, 8
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4428bb
push 0
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x418]
push eax
push str._sOther.ini
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.MSVCR80.dll__swprintf]
add esp, 0xc
mov word [ebp - 0x42c], 0
xor edx, edx
mov dword [ebp - 0x42a], edx
mov dword [ebp - 0x426], edx
mov dword [ebp - 0x422], edx
mov word [ebp - 0x41e], dx
lea eax, [ebp - 0x210]
push eax
push 8
lea ecx, [ebp - 0x42c]
push ecx
mov edx, dword [ebp - 0x430]
mov eax, dword [edx + 0x198c]
push eax
call dword [sym.imp.MSVCR80.dll__itow]
add esp, 0xc
push eax
push str.CheckBackup
push str.BackupSetting
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [ebp - 0x41c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret
Function at 0x442cd0
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x250], ecx
mov eax, dword [ebp + 8]
push eax
call sub.NTHelp.dll_int___cdecl_Help32::FileIsExist_wchar_t__
add esp, 4
test eax, eax
je 0x442d03
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
call sub.Amnet.dll_void___cdecl_Amnet::InitAdapter_bool_
add esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 0x24c], 0
jmp 0x442d2f
mov edx, dword [ebp - 0x24c]
add edx, 1
mov dword [ebp - 0x24c], edx
call sub.Amnet.dll_int___cdecl_Amnet::GetAdapterCount_void_
cmp dword [ebp - 0x24c], eax
jge 0x442d82
lea eax, [ebp - 0x248]
push eax
mov ecx, dword [ebp - 0x24c]
push ecx
call sub.Amnet.dll_bool___cdecl_Amnet::GetAdapterAt_unsigned_int__struct_Amnet::TAdapter__
add esp, 8
movzx edx, al
test edx, edx
je 0x442d80
push 0x23c
lea eax, [ebp - 0x248]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.NTHelp.dll_unsigned_long_int___cdecl_Help32::WriteFile_wchar_t___unsigned_long_int__void___unsigned_long_int_
add esp, 0x10
mov eax, dword [ebp - 4]
add eax, 0x23c
mov dword [ebp - 4], eax
jmp 0x442d20
mov ecx, dword [ebp + 8]
push ecx
call sub.NTHelp.dll_int___cdecl_Help32::FileIsExist_wchar_t__
add esp, 4
test eax, eax
je 0x442d9e
push 2
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret 4
Function at 0x443b20
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push str.shutdown__r__t_0
call dword [sym.imp.MSVCR80.dll_system]
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
push str.call_system_shutdown__r__t_0__:_d
mov ecx, dword [ebp - 8]
push ecx
call fcn.00443590
add esp, 0xc
xor eax, eax
cmp dword [ebp - 4], 0xffffffff
setne al
mov esp, ebp
pop ebp
ret

Function at 0x443f10
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x41c], ecx
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call fcn.0044fa90
add esp, 8
push 0x4713ac
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call sub.NTHelp.dll_int___cdecl_Help32::IsEmpty_wchar_t__
add esp, 4
test eax, eax
jne 0x443feb
mov word [ebp - 0x418], 0
push 0x206
push 0
lea ecx, [ebp - 0x416]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
push 0x104
lea eax, [ebp - 0x418]
push eax
push 0x4713c0
push 0x4713c4
push 0x4713d8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.MSVCR80.dll__wtoi]
add esp, 4
xor edx, edx
test eax, eax
setg dl
mov al, dl
jmp 0x443fed
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret