joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e2ff
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
push edi
cmp esi, 0x7ff80000
jbe 0x45e31b
lea eax, [esi - 0x7ff80000]
mov dword [ebp - 4], eax
jmp 0x45e322
mov dword [ebp - 4], 0x10000
lea ebx, [esi + 0x7ff80000]
cmp esi, 0x80000000
jb 0x45e335
mov ebx, 0xfff80000
mov eax, dword [0x54953c]
mov ecx, dword [0x549538]
test eax, eax
jne 0x45e34f
test ecx, ecx
je 0x45e363
mov eax, ecx
mov dword [0x54953c], eax
mov edx, dword [eax + 8]
test edx, edx
je 0x45e363
cmp edx, dword [ebp - 4]
jb 0x45e363
cmp edx, ebx
jbe 0x45e448
mov eax, ecx
test ecx, ecx
jmp 0x45e386
test eax, eax
je 0x45e381
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x45e381
cmp ecx, dword [ebp - 4]
jb 0x45e381
cmp ecx, ebx
jbe 0x45e448
mov eax, dword [eax + 4]
test eax, eax
mov dword [0x54953c], eax
jne 0x45e369
mov eax, esi
and eax, 0xffff
sub esi, eax
mov edi, 0x40000000
cmp esi, edi
jbe 0x45e3b4
push dword [ebp - 4]
lea eax, [esi - 0x40000000]
call fcn.0045e269
pop ecx
test eax, eax
jne 0x45e411
cmp esi, edi
jae 0x45e3c9
lea eax, [esi + 0x40000000]
push ebx
push eax
call fcn.0045e1db
pop ecx
pop ecx
test eax, eax
jne 0x45e411
cmp esi, edi
jbe 0x45e3e2
lea eax, [esi - 0x40000000]
push esi
push eax
call fcn.0045e1db
pop ecx
pop ecx
test eax, eax
jne 0x45e411
cmp esi, edi
jae 0x45e3f5
lea eax, [esi + 0x40000000]
push esi
call fcn.0045e269
pop ecx
test eax, eax
jne 0x45e411
push dword [ebp - 4]
mov eax, esi
call fcn.0045e269
pop ecx
test eax, eax
jne 0x45e411
push ebx
push esi
call fcn.0045e1db
pop ecx
pop ecx
test eax, eax
je 0x45e46e
xor edx, edx
mov dword [eax], 0x52727464
mov dword [eax + 8], edx
mov ecx, dword [0x549538]
mov dword [eax + 4], ecx
mov dword [0x54953c], eax
mov dword [0x549538], eax
lea ecx, [eax + 0xffa8]
mov esi, 0x38b
mov dword [ecx + 0x40], edx
mov edx, ecx
sub ecx, 0x48
dec esi
jne 0x45e43a
mov dword [eax + 8], edx
mov esi, dword [eax + 8]
cmp esi, dword [ebp - 4]
jb 0x45e46e
cmp esi, ebx
ja 0x45e46e
mov ecx, dword [esi + 0x40]
push 0x48
push 0xcc
push esi
mov dword [eax + 8], ecx
call fcn.004de430
add esp, 0xc
mov eax, esi
jmp 0x45e470
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x45e496
Capabilities:
Hook routines via microsoft detours

Disassembly:
cmp dword [eax], 0x52727464
je 0x45e4a1
xor eax, eax
ret
push esi
push edi
lea esi, [eax + 0x10000]
xor edi, edi
lea ecx, [eax + 0x88]
mov edx, dword [ecx]
test edx, edx
je 0x45e4bf
cmp edx, eax
jb 0x45e4d1
cmp edx, esi
jae 0x45e4d1
inc edi
add ecx, 0x48
cmp edi, 0x38d
jb 0x45e4b1
xor eax, eax
inc eax
pop edi
pop esi
ret
xor eax, eax
jmp 0x45e4ce
Function at 0x45e575
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x549548], eax
je 0x45e58e
mov eax, 0x10dd
leave
ret
push ebx
push esi
mov esi, dword [0x549558]
xor ebx, ebx
push edi
cmp esi, ebx
je 0x45e5d8
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 0x10]
push dword [esi + 0x14]
movzx eax, byte [eax + 0x36]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [esi + 4], ebx
jne 0x45e5c9
mov edi, dword [esi + 0x10]
cmp edi, ebx
je 0x45e5c9
call fcn.0045e475
mov dword [esi + 0x10], ebx
mov edi, dword [esi]
push esi
call fcn.004ddae9
pop ecx
mov esi, edi
cmp edi, ebx
jne 0x45e59d
mov dword [0x549558], ebx
call fcn.0045e16d
mov esi, dword [0x549554]
cmp esi, ebx
je 0x45e605
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, dword [esi]
push esi
call fcn.004ddae9
pop ecx
mov esi, edi
cmp edi, ebx
jne 0x45e5ed
pop edi
pop esi
mov dword [0x549554], ebx
mov dword [0x549548], ebx
xor eax, eax
pop ebx
leave
ret
Function at 0x45e8cc
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x54954c]
test eax, eax
jne 0x45e93e
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, dword [ebp + 8]
cmp edi, eax
jne 0x45e8ea
xor eax, eax
jmp 0x45e93d
push esi
push 8
call fcn.004de4e4
mov esi, eax
pop ecx
test esi, esi
jne 0x45e8fe
push 8
pop edi
jmp 0x45e919
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x45e92a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call fcn.004ddae9
pop ecx
and dword [0x549550], 0
mov dword [0x54954c], edi
mov eax, edi
jmp 0x45e93c
mov eax, dword [0x549554]
mov dword [esi], eax
mov dword [esi + 4], edi
mov dword [0x549554], esi
xor eax, eax
pop esi
pop edi
pop ebp
ret 4
Function at 0x45ebbf
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x549548], eax
je 0x45ebdb
mov eax, 0x10dd
jmp 0x45ecc8
mov eax, dword [0x54954c]
test eax, eax
jne 0x45ecc8
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x45ebf8
push 6
pop eax
jmp 0x45ecc7
cmp dword [edi], 0
jne 0x45ec10
push 6
pop eax
mov dword [0x54954c], eax
mov dword [0x549550], edi
jmp 0x45ecc7
push ebx
push esi
push 0x18
call fcn.004de4e4
mov esi, eax
pop ecx
test esi, esi
jne 0x45ec28
push 8
pop edi
jmp 0x45ecaa
push 0
push dword [edi]
call fcn.0045e517
push 0
push dword [ebp + 0xc]
mov ebx, eax
call fcn.0045e517
movzx ecx, byte [ebx + 0x36]
mov edi, dword [ebx + 0x40]
xor edx, edx
sub edi, ecx
cmp ecx, edx
je 0x45ec9f
cmp ecx, 0x1e
ja 0x45ec9f
cmp dword [ebx + 0x44], eax
jne 0x45ec9f
lea eax, [ebp - 4]
push eax
push 0x40
push ecx
push edi
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x45ec75
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x45ecaa
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov dword [esi + 0x10], ebx
mov dword [esi + 0xc], edi
mov eax, dword [ebp - 4]
mov dword [esi + 0x14], eax
mov eax, dword [0x549558]
mov dword [esi], eax
mov dword [0x549558], esi
xor eax, eax
jmp 0x45ecc5
push 9
pop edi
cmp dword [0x549540], edx
jne 0x45ecb0
mov dword [0x54954c], edi
test esi, esi
je 0x45ecbb
push esi
call fcn.004ddae9
pop ecx
mov eax, dword [ebp + 8]
mov dword [0x549550], eax
mov eax, edi
pop esi
pop ebx
pop edi
leave
ret 8

Function at 0x45eceb
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x53d500
call fcn.004e6730
mov eax, dword [ebp + 8]
test eax, eax
mov esi, 0x10000
je 0x45ed09
lea esi, [eax + 0x10000]
push 0x1c
push 0
lea eax, [ebp - 0x34]
push eax
call fcn.004de430
add esp, 0xc
push 0xfffffffffffffffe
pop edi
push 0x1c
lea eax, [ebp - 0x34]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x45ed35
call fcn.004e6775
ret 4
cmp dword [ebp - 0x24], 0x1000
jne 0x45ed85
cmp byte [ebp - 0x20], 1
je 0x45ed85
test dword [ebp - 0x20], 0x100
jne 0x45ed85
and dword [ebp - 4], 0
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x45ed82
mov eax, dword [esi + 0x3c]
cmp eax, dword [ebp - 0x28]
ja 0x45ed82
cmp eax, 0x40
jb 0x45ed82
cmp dword [eax + esi], 0x4550
jne 0x45ed82
mov dword [ebp - 4], edi
mov eax, esi
jmp 0x45ed2d
mov dword [ebp - 4], edi
mov esi, dword [ebp - 0x28]
add esi, dword [ebp - 0x34]
jmp 0x45ed1c
Function at 0x45ed8d
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x53d520
call fcn.004e6730
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
xor edi, edi
cmp eax, edi
jne 0x45edaf
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp + 8], eax
mov dword [ebp - 4], edi
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x45edc6
push 0xc1
jmp 0x45ee5e
mov esi, dword [eax + 0x3c]
add esi, eax
cmp dword [esi], 0x4550
je 0x45eddd
push 0xbf
jmp 0x45ee5e
movzx eax, word [esi + 0x14]
cmp ax, di
je 0x45ee59
lea ebx, [eax + esi + 0x18]
mov dword [ebp - 0x1c], edi
movzx eax, word [esi + 6]
cmp dword [ebp - 0x1c], eax
jae 0x45ee59
mov edi, dword [ebp - 0x1c]
imul edi, edi, 0x28
add edi, ebx
push str..detour
push edi
call fcn.004dee10
pop ecx
pop ecx
test eax, eax
jne 0x45ee4d
mov eax, dword [edi + 0xc]
xor ecx, ecx
cmp eax, ecx
je 0x45ee59
cmp dword [edi + 0x10], ecx
je 0x45ee59
mov edx, dword [ebp + 8]
lea esi, [eax + edx]
mov eax, dword [esi]
cmp eax, 0x40
jb 0x45ee59
cmp dword [esi + 4], 0x727444
jne 0x45ee59
cmp dword [esi + 8], ecx
jne 0x45ee3b
mov dword [esi + 8], eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x45ee6d
inc dword [ebp - 0x1c]
jmp 0x45eded
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
call fcn.004e6775
ret 4

Function at 0x45efa4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x678
cmp dword [esi], eax
jne 0x45f084
cmp dword [ebp + 0xc], eax
jb 0x45f084
or dword [ebp - 8], 0xffffffff
or dword [ebp + 0xc], 0xffffffff
or dword [ebp + 8], 0xffffffff
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push dword [esi + 4]
xor ebx, ebx
push dword [esi + 0x10]
call edi
test eax, eax
je 0x45f07e
lea eax, [ebp + 0xc]
push eax
push 0x40
push dword [esi + 8]
push dword [esi + 0x14]
call edi
test eax, eax
je 0x45f06f
push dword [esi + 4]
lea eax, [esi + 0x1c]
push eax
push dword [esi + 0x10]
call fcn.004ddd50
push dword [esi + 8]
lea eax, [esi + 0x5c]
push eax
push dword [esi + 0x14]
call fcn.004ddd50
mov eax, dword [esi + 0x18]
add esp, 0x18
test eax, eax
je 0x45f05d
lea ecx, [ebp + 8]
push ecx
push 0x40
push dword [esi + 0xc]
push eax
call edi
test eax, eax
je 0x45f060
push dword [esi + 0xc]
lea eax, [esi + 0x664]
push eax
push dword [esi + 0x18]
call fcn.004ddd50
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push dword [esi + 0xc]
push dword [esi + 0x18]
call edi
xor ebx, ebx
inc ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [esi + 8]
push dword [esi + 0x14]
call edi
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push dword [esi + 4]
push dword [esi + 0x10]
call edi
pop edi
mov eax, ebx
pop ebx
jmp 0x45f091
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
leave
ret 8
Function at 0x4632b0
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [edx]
xor eax, eax
test cl, cl
je 0x4632d4
push esi
movzx ecx, cl
movzx ecx, byte [ecx + 0x51d3d8]
mov esi, eax
shl esi, 3
xor ecx, esi
inc edx
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x4632b9
pop esi
ret
Function at 0x46f196
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046c0b8

Function at 0x46f8b9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
test ebx, ebx
jne 0x46f8c7
xor eax, eax
leave
ret
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push 8
call fcn.0046bc38
mov edi, eax
pop ecx
pop ecx
mov dword [ebp - 0xc], edi
test edi, edi
je 0x46f916
test byte [ebp + 0xc], 1
mov eax, dword [ebx]
mov dword [edi], eax
jne 0x46f8f9
mov ecx, dword [ebx]
xor eax, eax
inc eax
cmp ecx, eax
jle 0x46f8f9
add eax, eax
cmp eax, ecx
jl 0x46f8f3
imul eax, eax, 0x18
push 0
push eax
call fcn.0046bc38
pop ecx
pop ecx
mov dword [edi + 4], eax
test eax, eax
jne 0x46f91a
mov edx, edi
mov ecx, esi
call fcn.004622de
xor eax, eax
jmp 0x46f997
and dword [ebp - 4], 0
cmp dword [ebx], 0
mov esi, dword [ebx + 4]
jle 0x46f995
lea edi, [eax + 0x10]
sub eax, esi
add eax, 0xfffffff8
mov dword [ebp - 8], eax
push dword [ebp + 0xc]
mov eax, dword [esi]
push eax
push dword [ebp + 8]
call fcn.00475b9f
mov ecx, dword [ebp - 8]
mov dword [ecx + esi + 8], eax
push dword [esi + 4]
push dword [ebp + 8]
call fcn.0046bd8a
mov dword [edi - 0xc], eax
push dword [esi + 8]
push dword [ebp + 8]
call fcn.0046bd8a
mov dword [edi - 8], eax
mov al, byte [esi + 0xc]
and dword [edi], 0xfffffffe
mov byte [edi - 4], al
mov eax, dword [edi]
mov ecx, dword [esi + 0x10]
xor ecx, eax
and ecx, 2
xor ecx, eax
mov dword [edi], ecx
mov eax, dword [esi + 0x14]
add esp, 0x1c
inc dword [ebp - 4]
mov dword [edi + 4], eax
mov eax, dword [ebp - 4]
add edi, 0x18
add esi, 0x18
cmp eax, dword [ebx]
jl 0x46f931
mov edi, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x49a343
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 0x10], 0
push ebx
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x49], 4
mov esi, dword [edi]
mov ebx, dword [esi + 4]
mov dword [ebp - 4], eax
jne 0x49a368
mov eax, dword [edi + 0x44]
jmp 0x49a4f6
mov ecx, dword [edi + 0x3c]
push edi
mov eax, ebx
call fcn.00499bf1
xor edx, edx
pop ecx
cmp eax, edx
jne 0x49a4f6
cmp dword [edi + 0x10], edx
jne 0x49a3be
push edx
push dword [ebp + 0x10]
mov eax, esi
push dword [ebp + 0xc]
call fcn.00465dc8
add esp, 0xc
test byte [edi + 0x48], 2
je 0x49a3be
mov ecx, dword [ebp + 0x10]
cmp ecx, edx
jl 0x49a3be
jg 0x49a3a8
cmp dword [ebp + 0xc], edx
jbe 0x49a3be
mov eax, dword [ebp + 0xc]
sub eax, 1
sbb ecx, edx
cmp dword [edi + 0x18], eax
jne 0x49a3be
cmp dword [edi + 0x1c], ecx
jne 0x49a3be
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 4], edx
jne 0x49a3e4
push dword [ebp + 0x20]
lea ecx, [ebp - 4]
push dword [ebp + 0x10]
mov esi, edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00499c27
add esp, 0x10
test eax, eax
jne 0x49a4f6
movsx eax, word [edi + 0x4c]
mov esi, dword [edi + eax*4 + 0x78]
mov ebx, dword [ebx + 0x50]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x1c]
mov eax, esi
push dword [ebp + 0x18]
mov dword [ebp - 0x14], ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call fcn.00492dad
xor ecx, ecx
add esp, 0x20
mov dword [ebp - 8], eax
cmp eax, ecx
jne 0x49a4f6
movsx eax, word [edi + 0x4c]
lea eax, [edi + eax*2 + 0x4e]
movzx ebx, word [eax]
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 4], ecx
jne 0x49a4a1
mov eax, dword [esi + 0x44]
call fcn.0048e593
test eax, eax
jne 0x49a4f6
mov eax, dword [esi + 0x40]
lea eax, [eax + ebx*2]
movzx ebx, byte [eax]
movzx eax, byte [eax + 1]
shl ebx, 8
or ebx, eax
movzx eax, word [esi + 0x14]
and ebx, eax
add ebx, dword [esi + 0x38]
cmp byte [esi + 5], 0
jne 0x49a472
push 4
push ebx
push dword [ebp - 0x14]
call fcn.004ddd50
add esp, 0xc
lea eax, [ebp - 4]
push eax
mov eax, ebx
mov ecx, esi
call fcn.00492c87
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
movzx eax, word [ebp - 4]
push eax
push dword [ebp - 0xc]
call fcn.00481d7e
mov eax, dword [ebp - 8]
add esp, 0x10
test eax, eax
jne 0x49a4f6
xor ecx, ecx
jmp 0x49a4b2
jge 0x49a4b2
cmp word [esi + 0x12], cx
jbe 0x49a4b2
inc word [eax]
movzx eax, word [eax]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push ecx
push ecx
push dword [ebp - 0x10]
mov ecx, esi
push dword [ebp - 0x14]
call fcn.0048f07e
xor eax, eax
mov word [edi + 0x2c], ax
mov eax, dword [ebp - 8]
add esp, 0x14
test eax, eax
jne 0x49a4f6
cmp byte [esi + 1], al
je 0x49a4f6
and byte [edi + 0x48], 0xfd
call fcn.004967d6
movsx ecx, word [edi + 0x4c]
mov ecx, dword [edi + ecx*4 + 0x78]
mov byte [ecx + 1], 0
mov byte [edi + 0x49], 0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x49a4fb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, eax
mov eax, dword [edi]
movsx ebx, word [edi + 0x4c]
mov ecx, dword [edi + ebx*4 + 0x78]
mov dx, word [edi + ebx*2 + 0x4e]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
xor eax, eax
inc eax
mov dword [ebp - 0x1c], ebx
cmp dx, word [ecx + 0x12]
jae 0x49a6ca
cmp byte [edi + 0x49], al
jne 0x49a6ca
mov esi, ecx
mov ecx, dword [esi + 0x40]
movzx eax, dx
lea ecx, [ecx + eax*2]
mov dword [ebp - 0x10], eax
movzx eax, byte [ecx]
movzx ecx, byte [ecx + 1]
shl eax, 8
or eax, ecx
movzx ecx, word [esi + 0x14]
and eax, ecx
add eax, dword [esi + 0x38]
cmp byte [esi + 5], 0
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], eax
jne 0x49a57e
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push edi
call fcn.0049a2fa
pop ecx
pop ecx
test eax, eax
jne 0x49a6ca
mov ecx, dword [edi + 0x3c]
mov eax, dword [ebp - 0xc]
push edi
call fcn.00499bf1
pop ecx
test eax, eax
jne 0x49a6ca
cmp dword [edi + 0x10], eax
jne 0x49a5aa
push eax
push dword [edi + 0x1c]
mov eax, dword [ebp - 4]
push dword [edi + 0x18]
call fcn.00465dc8
add esp, 0xc
mov eax, dword [esi + 0x44]
call fcn.0048e593
test eax, eax
jne 0x49a6ca
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
mov ecx, esi
call fcn.00492c87
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
movzx eax, word [ebp - 4]
push eax
push dword [ebp - 0x10]
call fcn.00481d7e
mov eax, dword [ebp - 8]
add esp, 0x10
test eax, eax
jne 0x49a6ca
cmp byte [esi + 5], al
jne 0x49a686
movsx eax, word [edi + 0x4c]
mov esi, dword [edi + eax*4 + 0x78]
mov eax, dword [edi + ebx*4 + 0x7c]
mov eax, dword [eax + 0x48]
mov ecx, dword [esi + 0x40]
mov dword [ebp - 0x14], eax
movzx eax, word [esi + 0x12]
lea eax, [ecx + eax*2]
movzx ebx, byte [eax - 2]
movzx eax, byte [eax - 1]
shl ebx, 8
or ebx, eax
movzx eax, word [esi + 0x14]
and ebx, eax
add ebx, dword [esi + 0x38]
mov edx, esi
push ebx
call fcn.0046600f
movzx eax, ax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x44]
call fcn.0048e593
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x14]
mov eax, dword [ebp - 4]
push dword [ebp - 0xc]
add eax, 4
push eax
mov eax, dword [ebp - 0x10]
add ebx, 0xfffffffc
push ebx
call fcn.0048f07e
lea eax, [ebp - 8]
push eax
movzx eax, word [esi + 0x12]
push dword [ebp - 4]
dec eax
push eax
call fcn.00481d7e
mov eax, dword [ebp - 8]
add esp, 0x24
test eax, eax
jne 0x49a6ca
mov ebx, dword [ebp - 0x1c]
call fcn.004967d6
mov esi, eax
test esi, esi
jne 0x49a6c8
movsx eax, word [edi + 0x4c]
cmp eax, ebx
jle 0x49a6c1
movzx ecx, word [edi + 0x4c]
movsx eax, cx
mov eax, dword [edi + eax*4 + 0x78]
dec ecx
mov word [edi + 0x4c], cx
call fcn.00491641
movsx eax, word [edi + 0x4c]
cmp eax, ebx
jg 0x49a699
call fcn.004967d6
mov esi, eax
test esi, esi
jne 0x49a6c8
mov eax, edi
call fcn.00495537
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4ad862
Capabilities:
Delete file

Disassembly:
push 0x47c
mov eax, 0x5085c9
call fcn.004dead8
lea eax, [ebp - 0x488]
push eax
mov esi, ecx
call fcn.004dfb68
mov dword [ebp - 0x488], eax
lea eax, [ebp - 0x488]
push eax
mov dword [ebp - 0x484], edx
call fcn.004dfb41
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
xor ebx, ebx
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.004de430
add esi, 0x208
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.004e081c
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.004e06a4
xor ecx, ecx
mov word [eax], cx
add esp, 0x24
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x250]
call fcn.00406d28
mov esi, str..
push esi
mov dword [ebp - 4], ebx
call fcn.004df380
pop ecx
push eax
push esi
lea ecx, [ebp - 0x250]
call fcn.004082b9
cmp dword [ebp - 0x23c], 8
mov eax, dword [ebp - 0x250]
jae 0x4ad920
lea eax, [ebp - 0x250]
lea ecx, [ebp - 0x480]
push ecx
push eax
call fcn.004e0863
pop ecx
pop ecx
mov edi, eax
mov esi, 0x50bac0
test byte [ebp - 0x480], 0x10
jne 0x4ad9e4
mov ecx, dword [ebp - 0x488]
mov eax, dword [ebp - 0x484]
sub ecx, 0x3f480
sbb eax, ebx
cmp dword [ebp - 0x474], eax
jg 0x4ad9e4
jl 0x4ad96d
cmp dword [ebp - 0x478], ecx
jae 0x4ad9e4
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x234]
call fcn.00406d28
push esi
mov byte [ebp - 4], 1
call fcn.004df380
pop ecx
push eax
push esi
lea ecx, [ebp - 0x234]
call fcn.004082b9
lea eax, [ebp - 0x45c]
push eax
call fcn.004df380
pop ecx
push eax
lea eax, [ebp - 0x45c]
push eax
lea ecx, [ebp - 0x234]
call fcn.004082b9
cmp dword [ebp - 0x220], 8
mov eax, dword [ebp - 0x234]
jae 0x4ad9cc
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push 1
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], bl
call fcn.00406991
lea eax, [ebp - 0x480]
push eax
push edi
call fcn.004e098a
pop ecx
pop ecx
cmp eax, 0xffffffff
jne 0x4ad936
cmp edi, eax
je 0x4ada07
push edi
call fcn.004e083d
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x250]
call fcn.00406991
call fcn.004deb5b
ret
Function at 0x4ada1b
Capabilities:
Read .ini file

Disassembly:
push 0x74
mov eax, 0x508611
call fcn.004dead8
lea eax, [ebp - 0x2c]
push 0x1a
push eax
call fcn.00441178
pop ecx
pop ecx
mov eax, dword [ebp - 0x2c]
xor edi, edi
cmp dword [ebp - 0x18], 8
mov dword [ebp - 4], edi
jae 0x4ada45
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.004405e3
pop ecx
pop ecx
cmp dword [ebp - 0x50], 8
mov eax, dword [ebp - 0x64]
mov byte [ebp - 4], 1
jae 0x4ada61
lea eax, [ebp - 0x64]
push eax
call fcn.00440d1f
lea eax, [ebp - 0x80]
push 0x15
push eax
call fcn.00441178
add esp, 0xc
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 2
jb 0x4ada81
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x48]
call fcn.0040ccd0
push edi
push 1
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 4
call fcn.00406991
cmp dword [ebp - 0x34], 8
mov eax, dword [ebp - 0x48]
jae 0x4adaa5
lea eax, [ebp - 0x48]
push eax
push 4
push str.LogLevel
push str.Update
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [ebp - 0x18], 8
mov ecx, dword [ebp - 0x2c]
jae 0x4adac4
lea ecx, [ebp - 0x2c]
push 3
push 0x10000001
push eax
push ecx
push str.wpsnotify
call fcn.004086c6
add esp, 0x14
push edi
push 1
lea ecx, [ebp - 0x48]
call fcn.00406991
push edi
push 1
lea ecx, [ebp - 0x64]
call fcn.00406991
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00406991
call fcn.004deb5b
ret

Function at 0x4add1e
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x547240]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov esi, ecx
mov ecx, dword [ebp + 0x10]
mov edi, 0x104
push edi
mov dword [esi + 0x410], ecx
mov ecx, dword [ebp + 8]
push eax
push esi
mov dword [esi + 0x414], ecx
call fcn.004e27a9
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x41c], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004de430
add esp, 0x18
push edi
lea eax, [ebp - 0x20c]
push eax
push dword [esi + 0x414]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test ebx, ebx
je 0x4adddb
lea edi, [esi + 0x208]
push ebx
push edi
call fcn.004e081c
push str.dump_
push edi
call fcn.004e07eb
add esp, 0x10
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.004e06a4
add eax, 2
push eax
push edi
call fcn.004e07eb
add esp, 0x10
jmp 0x4addf0
lea eax, [ebp - 0x20c]
push eax
lea eax, [esi + 0x208]
push eax
call fcn.004e081c
pop ecx
pop ecx
mov ecx, esi
call fcn.004ad862
push 0x4adb01
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004dea60
leave
ret 0x14