joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436d20
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, edx
push esi
push edi
mov esi, eax
mov eax, dword [ebx]
add esp, 0xfffffff0
cmp eax, 0xffffffff
jne 0x436d35
xor edx, edx
jmp 0x436d68
xor ecx, ecx
mov dword [esp + 4], ecx
push 0
lea eax, [esp + 8]
push eax
push 4
lea edx, [esp + 0xc]
push edx
push dword [ebx]
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x436d66
mov ecx, dword [ebx + 8]
mov eax, dword [esp + 4]
sub ecx, eax
mov dword [ebx + 8], ecx
mov edx, dword [esp + 4]
jmp 0x436d68
xor edx, edx
cmp edx, 4
je 0x436d74
xor eax, eax
jmp 0x436ed7
mov di, 0x400
mov al, byte [esp]
cmp al, 0xff
jne 0x436e6a
mov dl, byte [esp + 1]
cmp dl, 0xe0
jb 0x436e6a
xor ecx, ecx
mov cl, byte [esp + 1]
sar ecx, 3
and ecx, 3
mov eax, dword [ecx*4 + 0x4579d4]
mov dword [esi], eax
xor eax, eax
mov al, byte [esp + 1]
mov edx, eax
and edx, 6
cmp edx, 2
jne 0x436e6a
and eax, 1
xor ecx, ecx
mov dword [esi + 4], eax
mov eax, 1
mov cl, byte [esp + 2]
mov edx, dword [esi]
sar ecx, 4
test edx, edx
jne 0x436dd4
dec eax
shl eax, 6
add eax, 0x4579e4
mov eax, dword [eax + ecx*4]
mov dword [esi + 8], eax
test eax, eax
je 0x436e6a
xor edx, edx
mov dl, byte [esp + 2]
sar edx, 2
and edx, 3
mov dword [esi + 0xc], edx
xor ecx, ecx
mov cl, byte [esp + 2]
sar ecx, 1
and ecx, 1
mov dword [esi + 0x10], ecx
xor eax, eax
mov al, byte [esp + 3]
sar eax, 6
and eax, 3
mov dword [esi + 0x14], eax
xor edx, edx
mov dl, byte [esp + 3]
sar edx, 4
and edx, 3
mov dword [esi + 0x18], edx
mov ecx, dword [esi + 4]
test ecx, ecx
jne 0x436e66
mov eax, dword [ebx]
cmp eax, 0xffffffff
je 0x436e66
xor edx, edx
mov dword [esp + 8], edx
push 0
lea ecx, [esp + 0xc]
push ecx
push 2
lea eax, [esp + 0xc]
push eax
push dword [ebx]
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x436e64
mov edx, dword [ebx + 8]
mov ecx, dword [esp + 8]
sub edx, ecx
mov dword [ebx + 8], edx
mov eax, dword [esp + 8]
jmp 0x436e66
xor eax, eax
mov al, 1
jmp 0x436ed7
mov dl, byte [esp + 1]
mov byte [esp], dl
mov cl, byte [esp + 2]
mov byte [esp + 1], cl
mov al, byte [esp + 3]
mov byte [esp + 2], al
mov edx, dword [ebx]
cmp edx, 0xffffffff
jne 0x436e8c
xor ecx, ecx
jmp 0x436ebf
xor eax, eax
mov dword [esp + 0xc], eax
push 0
lea edx, [esp + 0x10]
push edx
push 1
lea ecx, [esp + 0xf]
push ecx
push dword [ebx]
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x436ebd
mov eax, dword [ebx + 8]
mov edx, dword [esp + 0xc]
sub eax, edx
mov dword [ebx + 8], eax
mov ecx, dword [esp + 0xc]
jmp 0x436ebf
xor ecx, ecx
dec ecx
je 0x436ec6
xor eax, eax
jmp 0x436ed7
mov edx, edi
add di, 0xffff
test dx, dx
jne 0x436d78
xor eax, eax
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x43ff5e
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffe74
mov esi, eax
push esp
push dword [esi]
call sub.USER32.dll_BeginPaint
mov ebx, eax
lea eax, [esp + 0x40]
push eax
push dword [esi]
call sub.USER32.dll_GetClientRect
push ebx
call sub.GDI32.dll_CreateCompatibleDC
mov edi, eax
push dword [esi + 4]
push edi
call sub.GDI32.dll_SelectObject
push 0xcc0020
push 0
push 0
push edi
push dword [esp + 0x5c]
push dword [esp + 0x5c]
push 0
push 0
push ebx
call sub.GDI32.dll_BitBlt
push edi
call sub.GDI32.dll_DeleteDC
lea eax, [esp + 0x50]
push eax
push 0x18
push dword [esi + 4]
call sub.GDI32.dll_GetObjectA
mov dword [esp + 0x68], 2
mov edx, dword [esp + 0x58]
inc edx
mov dword [esp + 0x6c], edx
mov ecx, dword [esp + 0x54]
add ecx, 0xfffffffc
mov dword [esp + 0x70], ecx
mov ecx, 4
mov eax, dword [esp + 0x6c]
add eax, 0x52
mov dword [esp + 0x74], eax
push esi
lea esi, [esp + 0x6c]
lea edi, [esp + 0x7c]
rep movsd dword es:[edi], dword [esi]
pop esi
push 0
push 0x20
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x2bc
push 0
push 0
push 0
push 0x10
call sub.GDI32.dll_CreateFontA
push eax
push ebx
call sub.GDI32.dll_SelectObject
mov edi, eax
push 0x810
lea eax, [esp + 0x7c]
push eax
push 0xffffffffffffffff
push 0x45a17e
push ebx
call sub.USER32.dll_DrawTextA
add dword [esp + 0x7c], eax
push 0
push 0x20
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x190
push 0
push 0
push 0
push 0x10
call sub.GDI32.dll_CreateFontA
push eax
push ebx
call sub.GDI32.dll_SelectObject
push eax
call sub.GDI32.dll_DeleteObject
push 0x810
lea edx, [esp + 0x7c]
push edx
push 0xffffffffffffffff
push 0x45a196
push ebx
call sub.USER32.dll_DrawTextA
add dword [esp + 0x7c], eax
mov eax, dword [0x45d9b4]
cmp eax, 1
je 0x4400a0
cmp eax, 2
je 0x4400a0
xor edx, edx
jmp 0x4400a5
mov edx, 1
test dl, dl
je 0x4400d1
push 0x45d8b0
push 0x103
lea ecx, [esp + 0x90]
push ecx
push 0x45a17d
push 0x45a1ce
push 0x45a1c5
call sub.KERNEL32.dll_GetPrivateProfileStringA
jmp 0x4400e6
push 0x45a1d3
lea eax, [esp + 0x8c]
push eax
call fcn.00446208
add esp, 8
push 0x810
lea edx, [esp + 0x7c]
push edx
push 0xffffffffffffffff
lea ecx, [esp + 0x94]
push ecx
push ebx
call sub.USER32.dll_DrawTextA
push esi
push edi
lea esi, [esp + 0x70]
lea edi, [esp + 0x80]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push 0x812
lea eax, [esp + 0x7c]
push eax
push 0xffffffffffffffff
push 0x45a1e7
push ebx
call sub.USER32.dll_DrawTextA
push edi
push ebx
call sub.GDI32.dll_SelectObject
push eax
call sub.GDI32.dll_DeleteObject
push esp
push dword [esi]
call sub.USER32.dll_EndPaint
add esp, 0x18c
pop edi
pop esi
pop ebx
ret
Function at 0x443971
Capabilities:
Terminate thread

Disassembly:
push ebx
mov ebx, eax
push esi
mov esi, edx
mov eax, dword [ebx + 4]
test eax, eax
je 0x4439b4
lea eax, [ebx + 8]
mov edx, dword [eax]
test edx, edx
je 0x44398d
push edx
call sub.KERNEL32.dll_SetEvent
push esi
push dword [ebx + 4]
call sub.KERNEL32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x4439a7
push 0
push dword [ebx + 4]
call sub.KERNEL32.dll_TerminateThread
push dword [ebx + 4]
call sub.KERNEL32.dll_CloseHandle
xor ecx, ecx
mov dword [ebx + 4], ecx
pop esi
pop ebx
ret

Function at 0x443a87
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, eax
push esi
push edi
add esp, 0xfffffff8
mov eax, dword [ebx + 4]
test eax, eax
mov edi, edx
je 0x443ab7
push esp
push eax
call sub.KERNEL32.dll_GetExitCodeThread
mov edx, dword [esp]
cmp edx, 0x103
je 0x443aec
push dword [ebx + 4]
call sub.KERNEL32.dll_CloseHandle
xor ecx, ecx
mov dword [ebx + 4], ecx
lea eax, [ebx + 8]
mov edx, dword [eax]
test edx, edx
je 0x443ac6
push edx
call sub.KERNEL32.dll_ResetEvent
lea ecx, [esp + 4]
push ecx
push 0
push ebx
push 0x443af2
push 0
push 0
call sub.KERNEL32.dll_CreateThread
mov esi, eax
mov dword [ebx + 4], esi
test esi, esi
je 0x443aec
push edi
push esi
call sub.KERNEL32.dll_SetThreadPriority
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x443b84
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
xor ebx, ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
mov dword [esp], esi
cmp esi, 0xffffffff
setne al
and eax, 1
test al, al
je 0x443c0f
push 0
push esi
call sub.KERNEL32.dll_GetFileSize
mov edi, eax
cmp edi, 0xffffffff
jne 0x443bca
xor edx, edx
jmp 0x443bcc
mov edx, edi
mov esi, edx
test esi, esi
jbe 0x443c0f
cmp esi, 0x7ffe
jbe 0x443bdf
mov esi, 0x7ffe
lea eax, [esi + 1]
push eax
call fcn.0044cdb4
pop ecx
mov ebx, eax
mov edi, ebx
mov ebp, esi
push 0
lea eax, [esp + 8]
push eax
push ebp
push edi
push dword [esp + 0x10]
call sub.KERNEL32.dll_ReadFile
mov eax, dword [esp + 4]
cmp esi, eax
jae 0x443c0b
mov eax, esi
mov byte [ebx + eax], 0
mov eax, ebx
push eax
mov edx, dword [esp + 4]
cmp edx, 0xffffffff
je 0x443c24
push dword [esp + 4]
call sub.KERNEL32.dll_CloseHandle
pop eax
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x443f23
Capabilities:
Create directory
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffbcc
mov ebx, eax
push 0x45a56a
push ebx
call fcn.00446208
add esp, 8
push esp
push 1
push 0
push 0x45a585
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x443fad
mov dword [esp + 4], pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
push 0
push 0
push 0x45a5af
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
jne 0x443fa5
push 0
push ebx
call sub.KERNEL32.dll_CreateDirectoryA
push 0x45a5bf
push ebx
call fcn.00446178
add esp, 8
push 0
push ebx
call sub.KERNEL32.dll_CreateDirectoryA
push 0x45a5d0
push ebx
call fcn.00446178
add esp, 8
push dword [esp]
call sub.ADVAPI32.dll_RegCloseKey
mov dword [esp + 0x14], 0xc
xor edx, edx
xor ecx, ecx
mov dword [esp + 0x18], edx
lea esi, [esp + 0x20]
mov dword [esp + 0x1c], ecx
push 1
push esi
call sub.ADVAPI32.dll_InitializeSecurityDescriptor
test eax, eax
je 0x444080
lea edi, [esp + 0x34]
push 2
push 0x400
push edi
call sub.ADVAPI32.dll_InitializeAcl
test eax, eax
je 0x444080
mov eax, dword [0x45a4e4]
mov dword [esp + 8], eax
mov ax, word [0x45a4e8]
mov word [esp + 0xc], ax
push 1
call sub.ADVAPI32.dll_GetSidLengthRequired
push eax
push 0x40
call sub.KERNEL32.dll_LocalAlloc
mov ebp, eax
test ebp, ebp
je 0x444080
push 1
lea eax, [esp + 0xc]
push eax
push ebp
call sub.ADVAPI32.dll_InitializeSid
push 0
push ebp
call sub.ADVAPI32.dll_GetSidSubAuthority
xor edx, edx
mov dword [eax], edx
push ebp
push 0x10000000
push 2
push edi
call sub.ADVAPI32.dll_AddAccessAllowedAce
test eax, eax
je 0x44407a
xor ecx, ecx
mov dword [esp + 0x10], ecx
lea eax, [esp + 0x10]
push eax
push 0
push edi
call sub.ADVAPI32.dll_GetAce
mov edx, dword [esp + 0x10]
test edx, edx
je 0x444067
mov ecx, dword [esp + 0x10]
or byte [ecx + 1], 3
push 0
push edi
push 1
push esi
call sub.ADVAPI32.dll_SetSecurityDescriptorDacl
test eax, eax
je 0x44407a
mov dword [esp + 0x18], esi
push ebp
call sub.KERNEL32.dll_LocalFree
lea eax, [esp + 0x14]
push eax
push ebx
call sub.KERNEL32.dll_CreateDirectoryA
add esp, 0x434
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x44411f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
push esp
push 1
push 0
push 0x45a5db
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x44417f
mov dword [esp + 4], 0x104
lea eax, [esp + 4]
push eax
push esi
push 0
push 0
test ebx, ebx
je 0x44415a
mov edx, ebx
jmp 0x44415f
mov edx, 0x45a60f
push edx
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
jne 0x444177
push dword [esp]
call sub.ADVAPI32.dll_RegCloseKey
jmp 0x4441a2
push dword [esp]
call sub.ADVAPI32.dll_RegCloseKey
mov eax, esi
call fcn.00443f23
test ebx, ebx
je 0x4441a2
push 0x45a619
push esi
call fcn.00446178
add esp, 8
push ebx
push esi
call fcn.00446178
add esp, 8
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x4447d1
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebx
push esi
add esp, 0xfffffcb4
mov ebx, eax
push ebx
lea eax, [esp + 4]
push eax
call fcn.00446208
add esp, 8
push 0x45a866
lea edx, [esp + 4]
push edx
call fcn.00446178
add esp, 8
lea ecx, [esp + 0x108]
push ecx
lea eax, [esp + 4]
push eax
call sub.KERNEL32.dll_FindFirstFileA
mov dword [esp + 0x104], eax
jmp 0x444999
push ebx
lea edx, [esp + 0x24c]
push edx
call fcn.00446208
add esp, 8
push 0x45a619
lea ecx, [esp + 0x24c]
push ecx
call fcn.00446178
add esp, 8
mov eax, dword [esp + 0x104]
cmp eax, 0xffffffff
je 0x444854
lea edx, [esp + 0x134]
jmp 0x444859
mov edx, 0x45a526
push edx
lea eax, [esp + 0x24c]
push eax
call fcn.00446178
add esp, 8
lea ecx, [esp + 0x248]
push ecx
call fcn.0044a704
pop ecx
push 0x45a86d
lea eax, [esp + 0x24c]
push eax
call fcn.004463f0
add esp, 8
test eax, eax
je 0x4448a6
lea edx, [esp + 0x248]
push edx
call sub.KERNEL32.dll_DeleteFileA
test eax, eax
setne cl
and ecx, 1
push 0x45a876
lea eax, [esp + 0x24c]
push eax
call fcn.004463f0
add esp, 8
test eax, eax
je 0x4448d4
lea edx, [esp + 0x248]
push edx
call sub.KERNEL32.dll_DeleteFileA
test eax, eax
setne cl
and ecx, 1
push 0x45a884
lea eax, [esp + 0x24c]
push eax
call fcn.004463f0
add esp, 8
test eax, eax
je 0x444902
lea edx, [esp + 0x248]
push edx
call sub.KERNEL32.dll_DeleteFileA
test eax, eax
setne cl
and ecx, 1
push 0x45a88f
lea eax, [esp + 0x24c]
push eax
call fcn.004463f0
add esp, 8
test eax, eax
je 0x444930
lea edx, [esp + 0x248]
push edx
call sub.KERNEL32.dll_DeleteFileA
test eax, eax
setne cl
and ecx, 1
push 0x45a896
lea eax, [esp + 0x24c]
push eax
call fcn.004463f0
add esp, 8
test eax, eax
je 0x44495e
lea edx, [esp + 0x248]
push edx
call sub.KERNEL32.dll_DeleteFileA
test eax, eax
setne cl
and ecx, 1
mov esi, dword [esp + 0x104]
cmp esi, 0xffffffff
je 0x444999
lea eax, [esp + 0x108]
push eax
push esi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x444997
push dword [esp + 0x104]
call sub.KERNEL32.dll_FindClose
mov dword [esp + 0x104], 0xffffffff
xor edx, edx
jmp 0x444999
mov dl, 1
mov eax, dword [esp + 0x104]
cmp eax, 0xffffffff
setne cl
and ecx, 1
test cl, cl
jne 0x444819
mov eax, dword [esp + 0x104]
cmp eax, 0xffffffff
je 0x4449c3
push eax
call sub.KERNEL32.dll_FindClose
add esp, 0x34c
pop esi
pop ebx
ret

Function at 0x4449cc
Capabilities:
Write file on windows

Disassembly:
push ebx
add esp, 0xfffffff8
mov dword [esp], edx
push 0
push 0x80
push 3
push 0
push 0
push 0x40000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x444a18
push 2
push 0
push 0
push ebx
call sub.KERNEL32.dll_SetFilePointer
push 0
lea eax, [esp + 8]
push eax
push 4
lea edx, [esp + 0xc]
push edx
push ebx
call sub.KERNEL32.dll_WriteFile
push ebx
call sub.KERNEL32.dll_CloseHandle
pop ecx
pop edx
pop ebx
ret
Function at 0x445c49
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
push esi
push edi
mov ebx, eax
lea eax, [ebp - 0x18]
push 0xa
push eax
mov edi, ecx
push dword [ebp + 8]
mov esi, edx
call fcn.0044b1a0
add esp, 0xc
lea ecx, [ebp - 0x11c]
mov edx, edi
mov eax, esi
push ebx
push 0x103
push ecx
lea ecx, [ebp - 0x18]
push ecx
push edx
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea eax, [ebp - 0x11c]
push eax
call fcn.0044af44
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x445c9e
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push esi
cmp byte [ebp + 8], 0
je 0x445cb5
mov esi, 0x45abcc
jmp 0x445cba
mov esi, 0x45abd0
push eax
lea eax, [ebp - 0x104]
push 0x103
push eax
push esi
push ecx
push edx
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x45abcc
lea edx, [ebp - 0x104]
push edx
call fcn.004462cc
add esp, 8
test eax, eax
sete al
and eax, 1
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x445d25
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
lea eax, [ebp + 8]
call fcn.00445b70
mov eax, edi
mov edx, dword [ebp + 0xc]
push esi
push 0x103
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edx
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x10]
call fcn.00445adc
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x445db0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0x18]
lea eax, [ebp + 8]
call fcn.004433a2
mov eax, edi
mov edx, dword [ebp + 0xc]
push esi
push 0x103
lea ecx, [ebp - 0x11c]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push edx
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea edx, [ebp - 0x11c]
lea eax, [ebp - 4]
call fcn.004431c0
mov eax, dword [ebp - 4]
mov dword [ebx], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x445e5b
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [ebp + 0xc]
mov edi, ecx
mov dword [ebp - 0xc], eax
mov esi, edx
mov al, byte [ebp + 8]
cmp al, 0x81
jg 0x445e8d
push 0x45abd1
lea edx, [ebp - 8]
push edx
call fcn.00446208
add esp, 8
jmp 0x445ea2
movsx ecx, al
push ecx
push 0x45abd6
lea eax, [ebp - 8]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
push esi
push 0x103
lea edx, [ebp - 0x110]
push edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 0xc]
push edi
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea edx, [ebp - 0x110]
mov eax, ebx
call fcn.0043dbfc
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x445f0c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea edx, [ebp - 0x14]
lea eax, [ebp + 8]
call fcn.0042fe28
push esi
push 0x103
lea edx, [ebp - 0x118]
push edx
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 4]
push edi
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea edx, [ebp - 0x118]
mov eax, ebx
call fcn.0043005d
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44a4d4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.00449f04
test byte [ebp + 0xd], 0xc0
jne 0x44a4f8
mov eax, dword [0x45c47c]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x44a505
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x44a532
je 0x44a544
sub ecx, 0x100
je 0x44a552
sub ecx, 0x100
je 0x44a559
sub ecx, 0x100
je 0x44a54b
jmp 0x44a560
sub ecx, 0x600
je 0x44a559
sub ecx, 0x100
je 0x44a544
jmp 0x44a560
mov edi, 1
jmp 0x44a565
mov edi, 2
jmp 0x44a565
mov edi, 4
jmp 0x44a565
mov edi, 5
jmp 0x44a565
mov edi, 3
test byte [ebp + 0xd], 1
je 0x44a58c
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x45c9c0]
test al, 0x80
je 0x44a585
mov ebx, 0x80
jmp 0x44a59e
mov ebx, 1
jmp 0x44a59e
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x44a59e
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x44a5b0
je 0x44a5b9
dec eax
je 0x44a5c2
jmp 0x44a5cb
mov dword [ebp - 4], 0x80000000
jmp 0x44a5da
mov dword [ebp - 4], 0x40000000
jmp 0x44a5da
mov dword [ebp - 4], 0xc0000000
jmp 0x44a5da
push 1
call fcn.0044a2c4
pop ecx
mov ebx, eax
jmp 0x44a6c6
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x44a5f6
sub eax, 0x10
je 0x44a5fd
sub eax, 0x10
je 0x44a606
sub eax, 0x10
je 0x44a60f
jmp 0x44a60f
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x44a616
mov dword [ebp - 8], 1
jmp 0x44a616
mov dword [ebp - 8], 2
jmp 0x44a616
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x44a67f
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x44a674
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x44a674
add ebx, 0xffffffb2
push ebx
call fcn.0044a2c4
pop ecx
mov ebx, eax
jmp 0x44a6c6
mov edi, esi
push edi
call fcn.0044a438
pop ecx
test eax, eax
je 0x44a693
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x44a69f
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0044a004
add esp, 8
mov ebx, eax
inc eax
jne 0x44a6c6
push 4
call fcn.0044a2c4
pop ecx
push esi
call sub.KERNEL32.dll_CloseHandle
call fcn.00449f38
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44cad0
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x44d1b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
cmp dword [0x45d040], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x44d268
cmp byte [0x450059], 0
je 0x44d222
push 0x50
lea eax, [ebp - 0x54]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x54]
push edx
call fcn.004463c4
add esp, 8
mov ebx, eax
test eax, eax
jne 0x44d20b
push 0x3a
lea edx, [ebp - 0x54]
push edx
call fcn.004463c4
add esp, 8
mov ebx, eax
test eax, eax
jne 0x44d20b
lea ebx, [ebp - 0x54]
jmp 0x44d20c
inc ebx
call fcn.0044d168
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.dll_MessageBoxA
jmp 0x44d289
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x45d044
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00446238
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x45d047
push ebx
call sub.KERNEL32.dll_WriteFile
jmp 0x44d289
cmp dword [0x45d040], 0xffffffff
je 0x44d289
mov eax, dword [0x45d040]
test eax, eax
je 0x44d289
cmp byte [eax], 0
je 0x44d289
push esi
push eax
call fcn.0044d318
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44d8e8
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push esi
call fcn.00446238
pop ecx
inc eax
push eax
call fcn.0044c7d0
pop ecx
mov ebx, eax
test eax, eax
jne 0x44d916
call fcn.0044d13c
mov dword [eax], 8
or eax, 0xffffffff
jmp 0x44d98f
xor eax, eax
push esi
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, ebx
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
push 0x3d
push ebx
call fcn.004461b4
add esp, 8
mov esi, eax
test eax, eax
jne 0x44d961
call fcn.0044d13c
mov dword [eax], 0x13
push ebx
call fcn.0044c6bc
pop ecx
or eax, 0xffffffff
jmp 0x44d98f
mov byte [esi], 0
cmp byte [esi + 1], 0
jne 0x44d96e
xor edx, edx
jmp 0x44d971
lea edx, [esi + 1]
push edx
push ebx
call sub.KERNEL32.dll_SetEnvironmentVariableA
dec eax
je 0x44d984
call fcn.0044a330
mov esi, eax
jmp 0x44d986
xor esi, esi
push ebx
call fcn.0044c6bc
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret