joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406e50
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
mov eax, dword [0x42f4cc]
push ebx
mov ebx, dword [ebp + 8]
xor eax, ebp
push esi
mov esi, ecx
mov dword [esp + 0x120], eax
mov eax, dword [esi + 8]
push edi
xor edi, edi
cmp eax, edi
je 0x406e88
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 8], edi
mov dword [esi + 4], edi
mov dword [esp + 0x14], edi
xor eax, eax
test ebx, ebx
mov byte [esp + 0x18], 0
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
je 0x406ea9
mov edi, ebx
jmp 0x406eb1
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [eax*4 + 4]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
call dword [sym.imp.USER32.dll_CharUpperA]
push 0x104
lea ecx, [esp + 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [edi], 0
jne 0x406efa
lea edx, [esp + 0x18]
mov dword [esp + 0x10], edx
jmp 0x406efe
mov dword [esp + 0x10], ebx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
lea edi, [esi + 4]
push edi
push 0
push 0
push ecx
mov ecx, esi
call fcn.00406bb0
mov edx, dword [edi]
mov eax, dword [esp + 0x14]
lea ecx, [eax + edx*4 + 4]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [esi + 8], eax
jne 0x406f52
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, ebp
call fcn.004199fa
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [edi]
lea edx, [esp + 0x14]
push edx
push edi
lea edx, [eax + ecx*4]
push edx
push eax
mov eax, dword [esp + 0x20]
push eax
mov ecx, esi
call fcn.00406bb0
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [esp + 0x124]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004199fa
mov esp, ebp
pop ebp
ret 4
Function at 0x407830
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x42f4cc]
push ebx
mov ebx, dword [0x42acf0]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [0x42acec]
lea edx, [esp + 0x10]
push edx
push 0x20019
xor eax, ebp
push 0
mov dword [esp + 0x148], eax
mov eax, dword [0x42ace4]
mov dword [esp + 0x24], ecx
mov ecx, dword [0x42ace8]
push str.CLSIDCAA2D3B1_4BB5_4a45_A17A_122773379D99
push SysReAllocString
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407924
mov byte [esp + 0x30], al
mov ecx, 0x40
lea edi, [esp + 0x31]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push eax
mov eax, dword [edi + 0x10]
lea ecx, [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push edx
push 0
push eax
push ecx
mov dword [esp + 0x34], 0x104
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4078fe
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x34]
push eax
mov ecx, edi
call fcn.00407640
mov ebx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, esi
mov dword [edx], eax
mov eax, dword [esp + 0x28]
mov dword [edx + 4], ecx
mov dword [edx + 8], eax
mov dword [edx + 0xc], ebx
jmp 0x407939
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov ecx, esi
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], ebx
mov ecx, dword [esp + 0x13c]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004199fa
mov esp, ebp
pop ebp
ret 4
Function at 0x407960
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x42f4cc]
push ebx
mov ebx, dword [ebp + 0x14]
xor eax, ebp
push esi
push edi
mov dword [esp + 0x13c], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x14], ecx
mov edx, dword [ebp + 0x10]
mov byte [esp + 0x30], 0
mov ecx, 0x40
lea edi, [esp + 0x31]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, dword [ebp + 8]
mov eax, ebx
shr eax, 0x10
movzx ecx, ah
push ecx
movzx eax, al
push eax
movzx ecx, bh
push ecx
movzx eax, bl
push eax
mov eax, edx
mov ecx, edx
shr ecx, 0x18
push ecx
shr eax, 0x10
movzx eax, al
push eax
movzx eax, word [esp + 0x36]
movzx ecx, dh
push ecx
movzx ecx, word [esp + 0x38]
mov dword [esp + 0x3c], edx
movzx edx, dl
push edx
push eax
push ecx
push esi
push str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X
lea edx, [esp + 0x60]
push 0x104
push edx
mov dword [esp + 0x5c], ebx
call fcn.0041a7fa
add esp, 0x38
lea eax, [esp + 0x10]
push eax
push str.CLSIDCAA2D3B1_4BB5_4a45_A17A_122773379D99
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x407a49
lea ecx, [esp + 0x10]
push ecx
push str.CLSIDCAA2D3B1_4BB5_4a45_A17A_122773379D99
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x407a49
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, ebp
call fcn.004199fa
mov esp, ebp
pop ebp
ret 0x10
lea eax, [esp + 0x30]
mov esi, 1
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407a55
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x10]
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x18]
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x407a82
xor esi, esi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x13c]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004199fa
mov esp, ebp
pop ebp
ret 0x10
Function at 0x407ab0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, eax
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407b1e
push esi
lea ecx, [esp + 0xc]
push ecx
push edi
lea edx, [esp + 0x18]
push edx
push eax
mov eax, dword [esp + 0x28]
push str.ProgramFilesDir
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x18]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
je 0x407b64
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp eax, 2
jbe 0x407b6f
mov byte [edi + 2], 0
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x407b30
mov edx, dword [str.Program_Files]
mov dword [edi], edx
mov eax, dword [0x428ae8]
mov dword [edi + 4], eax
mov ecx, dword [0x428aec]
mov dword [edi + 8], ecx
mov dx, word [0x428af0]
mov word [edi + 0xc], dx
mov al, byte [0x428af2]
mov byte [edi + 0xe], al
pop edi
mov eax, 1
pop ebp
add esp, 8
ret
pop edi
xor eax, eax
pop ebp
add esp, 8
ret
Function at 0x4088e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x42f4cc]
xor eax, ebp
mov dword [esp + 0x120], eax
xor eax, eax
cmp edx, eax
push edi
je 0x4089df
cmp esi, eax
je 0x4089df
mov byte [esp + 0x18], al
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
push str.SOFTWARERising_s
stosb byte es:[edi], al
lea eax, [esp + 0x20]
push 0x104
push eax
mov dword [esp + 0x20], 1
call fcn.00403400
add esp, 0x10
lea ecx, [esp + 8]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x24]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4089be
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 0
push str.datapath
push edx
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408990
sub eax, edx
mov dword [esp + 0x14], eax
je 0x4089b3
cmp ebx, 0x7fffffff
ja 0x4089b3
push 0x428428
push ebx
push esi
call fcn.00403430
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4089c3
sub eax, edx
pop edi
mov ecx, dword [esp + 0x120]
xor ecx, ebp
call fcn.004199fa
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x124]
xor ecx, ebp
xor eax, eax
pop edi
call fcn.004199fa
mov esp, ebp
pop ebp
ret
Function at 0x408a00
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
mov eax, dword [0x42f4cc]
xor eax, ebp
mov dword [esp + 0x118], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
xor eax, eax
mov byte [esp + 0x18], 0
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
or ebx, 0xffffffff
test esi, esi
mov dword [esp + 0x14], esi
stosb byte es:[edi], al
je 0x408b0b
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408a54
sub eax, edi
cmp eax, 2
jb 0x408b0b
cmp byte [esi + 1], 0x3a
jne 0x408a9d
lea eax, [esp + 0x18]
mov ecx, eax
mov edx, 0x104
sub esi, ecx
lea esp, [esp]
mov cl, byte [esi + eax]
test cl, cl
je 0x408a93
mov byte [eax], cl
inc eax
dec edx
jne 0x408a80
dec eax
mov byte [eax], 0
jmp 0x408add
test edx, edx
jne 0x408a98
dec eax
mov byte [eax], 0
jmp 0x408add
mov ebx, 0x104
lea esi, [esp + 0x18]
call fcn.004088e0
mov ecx, ebx
mov eax, esi
nop
cmp byte [eax], 0
je 0x408abb
inc eax
dec ecx
jne 0x408ab0
jmp 0x408add
test ecx, ecx
je 0x408add
mov edx, dword [esp + 0x14]
mov eax, 0x104
sub eax, ecx
push edx
mov ecx, 0x104
sub ecx, eax
push ecx
lea edx, [esp + eax + 0x20]
push edx
call fcn.004030a0
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x14]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, ebp
call fcn.004199fa
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x124]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.004199fa
mov esp, ebp
pop ebp
ret
Function at 0x408b30
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x42f4cc]
xor eax, ebp
mov dword [esp + 0x228], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ecx
xor eax, eax
test esi, esi
mov byte [esp + 0x20], 0
mov ecx, 0x40
lea edi, [esp + 0x21]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], 0xffffffff
stosb byte es:[edi], al
je 0x408cdc
mov eax, esi
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408b90
sub eax, edi
cmp eax, 2
jb 0x408cdc
cmp byte [esi + 1], 0x3a
jne 0x408bd4
lea eax, [esp + 0x20]
mov edx, esi
mov ecx, eax
mov edi, 0x104
sub edx, ecx
mov cl, byte [edx + eax]
test cl, cl
je 0x408bca
mov byte [eax], cl
inc eax
dec edi
jne 0x408bb7
dec eax
mov byte [eax], 0
jmp 0x408c13
test edi, edi
jne 0x408bcf
dec eax
mov byte [eax], 0
jmp 0x408c13
mov ebx, 0x104
lea esi, [esp + 0x20]
call fcn.004088e0
mov ecx, ebx
mov eax, esi
cmp byte [eax], 0
je 0x408bf1
inc eax
dec ecx
jne 0x408be6
jmp 0x408c13
test ecx, ecx
je 0x408c13
mov edx, dword [esp + 0x10]
mov eax, 0x104
sub eax, ecx
push edx
mov ecx, 0x104
sub ecx, eax
push ecx
lea edx, [esp + eax + 0x28]
push edx
call fcn.004030a0
mov edx, dword [esp + 0x14]
xor eax, eax
xor ebx, ebx
mov byte [esp + 0x128], bl
mov ecx, 0x41
lea edi, [esp + 0x129]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
push 0x104
lea ecx, [esp + 0x130]
push ecx
push 0x428d90
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [esp + 0x18], eax
cmp byte [esp + 0x128], bl
je 0x408cdc
lea ecx, [esp + 0x128]
push ecx
call dword [sym.imp.USER32.dll_CharUpperA]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x12c]
push 0x428d8c
push eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
call fcn.0041aff6
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, ebx
ja 0x408cdf
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x12c]
push str.0X_X
push edx
call fcn.0041aff6
mov eax, dword [esp + 0x1c]
add esp, 0xc
cmp eax, ebx
ja 0x408cdf
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x12c]
push 0x428d80
push ecx
call fcn.0041aff6
mov eax, dword [esp + 0x24]
add esp, 0xc
cmp eax, ebx
ja 0x408cdf
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 0x234]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004199fa
mov esp, ebp
pop ebp
ret
Function at 0x408d00
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x42f4cc]
xor eax, ebp
mov dword [esp + 0x120], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
xor eax, eax
mov byte [esp + 0x20], 0
mov ecx, 0x40
lea edi, [esp + 0x21]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
or ebx, 0xffffffff
test esi, esi
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 0x18]
mov dword [esp + 0x1c], esi
stosb byte es:[edi], al
je 0x408e1b
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408d62
sub eax, edi
cmp eax, 2
jb 0x408e1b
cmp byte [esi + 1], 0x3a
jne 0x408da4
lea eax, [esp + 0x20]
mov ecx, eax
mov edx, 0x104
sub esi, ecx
mov cl, byte [esi + eax]
test cl, cl
je 0x408d9a
mov byte [eax], cl
inc eax
dec edx
jne 0x408d87
dec eax
mov byte [eax], 0
jmp 0x408de3
test edx, edx
jne 0x408d9f
dec eax
mov byte [eax], 0
jmp 0x408de3
mov ebx, 0x104
lea esi, [esp + 0x20]
call fcn.004088e0
mov ecx, ebx
mov eax, esi
cmp byte [eax], 0
je 0x408dc1
inc eax
dec ecx
jne 0x408db6
jmp 0x408de3
test ecx, ecx
je 0x408de3
mov edx, dword [esp + 0x1c]
mov eax, 0x104
sub eax, ecx
push edx
mov ecx, 0x104
sub ecx, eax
push ecx
lea edx, [esp + eax + 0x28]
push edx
call fcn.004030a0
mov ecx, dword [ebp + 0x10]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x24]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, ebp
call fcn.004199fa
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.004199fa
mov esp, ebp
pop ebp
ret
Function at 0x408ef0
Capabilities:
Delete file
Get file size
Move file
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x42f4cc]
xor eax, ebp
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [esp + 0x224], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [esp + 0x10], eax
xor eax, eax
test ebx, ebx
mov ecx, 0x41
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
je 0x408f88
cmp byte [ebx], 0
je 0x408f88
push 0x5c
push ebx
call fcn.0041a681
add esp, 8
test eax, eax
jne 0x408fd4
push 0x105
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x18]
push 0x5c
push edx
call fcn.0041a78f
add esp, 8
test eax, eax
je 0x408f6d
mov byte [eax + 1], 0
mov ecx, 0x105
lea eax, [esp + 0x18]
cmp byte [eax], 0
je 0x408f81
inc eax
dec ecx
jne 0x408f76
jmp 0x408fd0
test ecx, ecx
je 0x408fd0
push ebx
jmp 0x408fb7
push 0x105
lea eax, [esp + 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0x105
lea eax, [esp + 0x18]
cmp byte [eax], 0
je 0x408fae
inc eax
dec ecx
jne 0x408fa3
jmp 0x408fd0
test ecx, ecx
je 0x408fd0
push str..log
mov eax, 0x105
sub eax, ecx
mov ecx, 0x105
sub ecx, eax
lea edx, [esp + eax + 0x1c]
push ecx
push edx
call fcn.004030a0
lea ebx, [esp + 0x18]
push 0
push 0x20
push 4
push 0
push 3
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40911f
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp + 0x10]
shl ecx, 0xa
cmp eax, ecx
jbe 0x4090e8
cmp eax, 0xffffffff
je 0x4090e8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x105
push ebx
lea edx, [esp + 0x128]
xor eax, eax
mov byte [esp + 0x128], 0
mov ecx, 0x41
lea edi, [esp + 0x129]
push edx
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [esp + 0x120]
push 0x2e
push eax
call fcn.0041a78f
add esp, 8
test eax, eax
je 0x409061
mov byte [eax], 0
mov ecx, 0x105
lea eax, [esp + 0x120]
lea ecx, [ecx]
cmp byte [eax], 0
je 0x40907b
inc eax
dec ecx
jne 0x409070
jmp 0x4090a0
test ecx, ecx
je 0x4090a0
mov eax, 0x105
sub eax, ecx
push str.2.log
mov ecx, 0x105
sub ecx, eax
push ecx
lea edx, [esp + eax + 0x128]
push edx
call fcn.004030a0
push 0x80
lea eax, [esp + 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x120]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
push 0x20
push 4
push 0
push 3
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [esp + 0x10]
push 0
lea eax, [esp + 0x18]
push eax
push edi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004199fa
mov esp, ebp
pop ebp
ret
Function at 0x40c330
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x426880
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
mov dword [esp + 0xc], 0
mov eax, dword [0x430588]
mov ecx, 0x430588
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
mov ecx, dword [esi + 0x454]
push ecx
lea edx, [esp + 0x10]
push str._s_rsmsginfo.ini
push edx
mov dword [esp + 0x24], 0
call fcn.0040c120
mov eax, dword [0x430588]
add esp, 0xc
mov ecx, 0x430588
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 8], esi
mov ebp, dword [esi - 4]
mov eax, dword [esi - 8]
mov ecx, 1
mov byte [esp + 0x18], cl
sub ecx, ebp
sub eax, 0x104
or eax, ecx
jge 0x40c3c9
push 0x104
lea ecx, [esp + 0xc]
call fcn.004085c0
mov esi, dword [esp + 8]
mov ebp, dword [esp + 0xc]
push ebp
push 0x104
push esi
push 0x428d90
push str.sguid
push str.rsmsg
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test esi, esi
jne 0x40c3f1
xor eax, eax
jmp 0x40c401
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c3f6
sub eax, edx
js 0x40c477
cmp eax, dword [esi - 8]
jg 0x40c477
mov dword [esi - 0xc], eax
mov byte [eax + esi], 0
push edi
add esi, 0xfffffff0
push esi
call fcn.00408610
mov edi, dword [esp + 0x28]
add eax, 0x10
add esp, 4
mov dword [edi], eax
mov byte [esp + 0x1c], 0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c43f
mov ecx, dword [esi]
mov eax, dword [ecx]
push esi
call dword [eax + 4]
lea eax, [ebp - 0x10]
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c461
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x14]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret 4
push 0x80070057
call fcn.004011d0
int3
Function at 0x40ebd0
Capabilities:
Access peb ldr_data
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x426bf8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
add ecx, 0x22c
push edi
push ecx
lea ecx, [esp + 0x14]
call fcn.0040d3a0
push 0xd
xor ebx, ebx
push str.RsMgrSvc.ini
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], ebx
call fcn.004095b0
mov eax, dword [esp + 0x10]
push eax
push ebx
push str.COUNT
push str.DELETEFILE
call fcn.00410e80
mov edx, dword [0x430588]
add esp, 0x10
mov ecx, 0x430588
mov dword [esp + 0x1c], eax
call dword [edx + 0xc]
lea edi, [eax + 0x10]
mov dword [esp + 0x18], edi
mov eax, dword [0x430588]
mov ecx, 0x430588
mov byte [esp + 0x28], 1
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x1c]
mov ebp, 1
cmp eax, ebp
mov byte [esp + 0x28], 2
jl 0x40ed2a
push ebp
lea ecx, [esp + 0x1c]
push str.ITEM_d
push ecx
call fcn.0040c120
mov edi, dword [esi - 4]
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, edi
mov edi, 0x208
sub eax, edi
add esp, 0xc
or eax, ecx
jge 0x40ecab
push edi
lea ecx, [esp + 0x18]
call fcn.004085c0
mov esi, dword [esp + 0x14]
cmp dword [esi - 8], edi
jl 0x40edb3
mov dword [esi - 0xc], edi
mov byte [esi + 0x208], bl
mov edx, dword [esp + 0x10]
push edx
push edi
mov edi, dword [esp + 0x20]
push esi
push 0x428d90
push edi
push str.DELETEFILE
call fcn.00410ea0
mov eax, esi
add esp, 0x18
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40ece0
sub eax, edx
js 0x40edb3
cmp eax, dword [esi - 8]
jg 0x40edb3
mov dword [esi - 0xc], eax
mov byte [eax + esi], bl
cmp dword [esi - 0xc], ebx
je 0x40ed1d
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
push str.DeleteFile:__s.
push 0x80
call fcn.00409a50
add esp, 0xc
mov eax, dword [esp + 0x1c]
inc ebp
cmp ebp, eax
jle 0x40ec72
mov eax, dword [esp + 0x10]
push eax
push ebx
push str.DELETEFILE
call fcn.00410f50
lea eax, [esi - 0x10]
add esp, 0xc
mov byte [esp + 0x28], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ed5c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [edi - 0x10]
mov byte [esp + 0x28], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ed7a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x28], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40eda0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
push 0x80070057
call fcn.004011d0
int3