joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48c498
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x4c57b0
push edi
mov ecx, esi
call fcn.00402612
mov ecx, dword [0x4c5810]
mov eax, dword [ecx + eax*4]
mov ebx, dword [eax]
cmp dword [ebp + 0xc], edi
jne 0x48c4f2
xor esi, esi
cmp dword [ebx + 0x1a0], esi
je 0x48c556
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push esi
push edi
push dword [ebp - 4]
push dword [ebp - 8]
push esi
push dword [ebx + 0x1a0]
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
jmp 0x48c574
push dword [ebp + 0xc]
mov ecx, esi
call fcn.004025db
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x48c556
mov ecx, dword [0x4c5824]
mov ecx, dword [ecx + eax*4]
mov eax, dword [ecx]
mov cl, byte [eax + 0x90]
cmp cl, 0xe
je 0x48c556
cmp cl, 0xf
je 0x48c556
cmp cl, 0x13
je 0x48c556
cmp cl, 0x10
je 0x48c556
xor esi, esi
cmp dword [eax + 0xc], esi
je 0x48c556
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x4c5824]
mov ecx, dword [ebp + 8]
push esi
push dword [ebx]
push dword [ebp - 4]
mov eax, dword [eax + ecx*4]
push dword [ebp - 8]
push esi
mov eax, dword [eax]
push dword [eax + 0xc]
jmp 0x48c4e7
mov eax, dword [ebp + 0x14]
movzx ecx, ax
mov eax, dword [ebp + 0x10]
shl ecx, 0x10
movzx eax, ax
or ecx, eax
push ecx
push dword [ebp + 0xc]
push 0x7b
push edi
call dword [sym.imp.USER32.dll_DefDlgProcW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401460
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
xor edx, edx
xor ecx, ecx
call fcn.0040fe40
mov esi, eax
test esi, esi
je 0x4014d9
xorps xmm0, xmm0
mov dword [ebp - 0xa], 0
mov eax, 2
movq qword [ebp - 0x12], xmm0
push 0xfff2
mov word [ebp - 6], 0
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push esi
mov dword [ebp - 0x10], edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4014eb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x4014eb
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00451570
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00451570
mov esp, ebp
pop ebp
ret
Function at 0x4024e0
Capabilities:
Get file size
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2194
call fcn.00456fe0
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 0x80
push 4
push 0
push 1
push SysReAllocString
push ecx
mov dword [ebp - 0x2190], edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x402549
lea eax, [ebp - 0x212c]
mov dword [ebp - 0x212c], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0x40000000
jbe 0x40255c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00451570
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0x218c], 0
push 0xc6
push eax
mov word [ebp - 0x128], ax
lea eax, [ebp - 0x126]
push eax
call fcn.00452270
push 0x1fff
lea eax, [ebp - 0x2127]
mov byte [ebp - 0x2128], 0
push 0
push eax
call fcn.00452270
push 0x54
lea eax, [ebp - 0x2184]
push 0
push eax
call fcn.00452270
xor eax, eax
mov byte [ebp - 0x14], 0
push 0x42
push eax
mov word [ebp - 0x60], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x5e]
movq qword [ebp - 0x13], xmm0
push eax
mov dword [ebp - 0xb], 0
mov word [ebp - 7], 0
mov byte [ebp - 5], 0
call fcn.00452270
add esp, 0x30
mov dword [ebp - 0x2174], 0
mov dword [ebp - 0x2178], 0
mov dword [ebp - 0x2188], 0x67452301
mov dword [ebp - 0x2184], 0xefcdab89
mov dword [ebp - 0x2180], 0x98badcfe
mov dword [ebp - 0x217c], 0x10325476
test ebx, ebx
je 0x40269a
mov ecx, 0x2000
xor eax, eax
push 0
push 0
push eax
cmp ebx, 0x2000
mov esi, ebx
push edi
cmova esi, ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x402542
push 0
lea eax, [ebp - 0x2130]
mov dword [ebp - 0x2130], 0
push eax
push esi
lea eax, [ebp - 0x2128]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402542
push esi
lea edx, [ebp - 0x2128]
lea ecx, [ebp - 0x2188]
call fcn.00407bd0
mov eax, dword [ebp - 0x218c]
add esp, 4
add eax, esi
mov ecx, 0x2000
mov dword [ebp - 0x218c], eax
sub ebx, esi
jne 0x402624
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x2188]
lea ecx, [ebp - 0x14]
call fcn.00407ca0
xor esi, esi
lea edi, [ebp - 0x5e]
mov bl, byte [ebp + esi - 0x14]
movzx eax, bl
push eax
push str._02x
lea eax, [edi - 2]
push 2
push eax
call fcn.00401420
shl bl, 4
movzx eax, bl
push eax
push str._02x
push 2
push edi
call fcn.00401420
inc esi
add esp, 0x20
add edi, 4
cmp esi, 0x10
jl 0x4026b4
xor eax, eax
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x128]
push 0x21
push eax
call fcn.004545dc
mov esi, dword [ebp - 0x2190]
push 0x64
push 0
push esi
call fcn.00452270
lea eax, [ebp - 0x128]
push eax
push 0x48276c
push esi
call fcn.004573bf
mov ecx, dword [ebp - 4]
add esp, 0x24
xor ecx, ebp
mov eax, 1
pop edi
pop esi
pop ebx
call fcn.00451570
mov esp, ebp
pop ebp
ret
Function at 0x402740
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push esi
test eax, eax
je 0x4027cc
lea ecx, [ebp + 0xc]
push ecx
push eax
call fcn.00457887
add esp, 8
lea esi, [eax + 1]
cmp esi, 0x200
jg 0x4027cc
push 0x3ff
lea eax, [ebp - 0x40b]
mov byte [ebp - 0x40c], 0
push 0
push eax
call fcn.00452270
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x40c]
push esi
push esi
push eax
call fcn.0045750d
add esp, 0x20
lea eax, [ebp - 0x40c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x40c]
push eax
call fcn.004580ba
add esp, 4
lea ecx, [ebp - 0x40c]
call fcn.0040d400
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.00451570
mov esp, ebp
pop ebp
ret

Function at 0x402870
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
call fcn.0040fa20
mov esi, edx
mov ebx, eax
mov dword [ebp - 0x20c], esi
call fcn.0040fa20
sub eax, ebx
sbb edx, esi
test edx, edx
jg 0x4028f1
jl 0x4028ad
cmp eax, 0x7530
ja 0x4028f1
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x482778
call esi
push 0x482778
call fcn.004580ba
add esp, 4
mov ecx, edi
call fcn.0040cd40
cmp eax, 1
je 0x402904
call fcn.0040fa20
sub eax, ebx
sbb edx, dword [ebp - 0x20c]
mov dword [ebp - 0x214], edx
js 0x4028b3
jg 0x4028f1
cmp eax, 0x7530
jbe 0x4028b3
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00451570
mov esp, ebp
pop ebp
ret
push 0x1ff
lea eax, [ebp - 0x207]
mov byte [ebp - 0x208], 0
push 0
push eax
call fcn.00452270
add esp, 0xc
call fcn.0040fa20
sub eax, ebx
sbb edx, dword [ebp - 0x20c]
push edx
push eax
lea eax, [ebp - 0x208]
push 0x482794
push eax
call fcn.004573bf
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call esi
lea eax, [ebp - 0x208]
push eax
call fcn.004580ba
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov eax, 1
pop edi
pop esi
pop ebx
call fcn.00451570
mov esp, ebp
pop ebp
ret

Function at 0x402d90
Capabilities:
Check mutex on windows

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x402dd0
push edx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi], eax
test eax, eax
je 0x402dcc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x402dd0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
xor eax, eax
pop esi
ret
mov eax, 1
pop esi
ret
Function at 0x402de0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor esi, esi
mov edi, eax
cmp dword [ebp - 8], esi
jbe 0x402e2d
push 0x482910
push dword [edi + esi*4]
call fcn.00453691
add esp, 8
test eax, eax
je 0x402e3f
inc esi
cmp esi, dword [ebp - 8]
jb 0x402e13
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00451570
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00451570
mov esp, ebp
pop ebp
ret

Function at 0x402e60
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor esi, esi
mov edi, eax
cmp dword [ebp - 8], esi
jbe 0x402ead
push str.__SDK
push dword [edi + esi*4]
call fcn.00453691
add esp, 8
test eax, eax
je 0x402ebf
inc esi
cmp esi, dword [ebp - 8]
jb 0x402e93
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00451570
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00451570
mov esp, ebp
pop ebp
ret

Function at 0x402ee0
Capabilities:
Accept command line arguments
Check if file exists
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 8], 0
mov ebx, eax
mov dword [ebp - 0xc], ebx
jbe 0x402f45
mov esi, 1
mov edi, ebx
lea ecx, [ecx]
push str.__DEL
push dword [edi]
call fcn.00453691
mov ecx, dword [ebp - 8]
add esp, 8
test eax, eax
jne 0x402f3a
cmp esi, ecx
jb 0x402f5d
inc esi
add edi, 4
lea eax, [esi - 1]
cmp eax, ecx
jb 0x402f20
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00451570
mov esp, ebp
pop ebp
ret
mov esi, dword [ebx + esi*4]
test esi, esi
je 0x402f45
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edi, edi
lea esp, [esp]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402fa3
push esi
call ebx
test eax, eax
jne 0x402f9d
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call ebx
test eax, eax
jne 0x402f9d
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x1e
jl 0x402f70
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
push dword [ebp - 0xc]
jmp 0x402f46
Function at 0x402fc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c0
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x263]
push esi
push edi
push 0x257
push 0
push eax
mov dword [ebp - 0x2c0], ecx
mov byte [ebp - 0x264], 0
call fcn.00452270
lea edi, [ebp - 0x264]
add esp, 0xc
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x403003
mov ax, word [0x482934]
mov esi, ebx
mov word [edi], ax
mov cl, byte [ebx]
inc ebx
test cl, cl
jne 0x403018
lea edi, [ebp - 0x264]
sub ebx, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x403028
mov ecx, ebx
lea edx, [ebp - 0x264]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
dec edx
rep movsb byte es:[edi], byte [esi]
mov cl, byte [edx + 1]
lea edx, [edx + 1]
test cl, cl
jne 0x403045
mov ecx, dword [str.____UP___DEL__]
mov dword [edx], ecx
mov ecx, dword [0x48293c]
mov dword [edx + 4], ecx
mov ecx, dword [0x482940]
mov dword [edx + 8], ecx
mov cx, word [0x482944]
mov word [edx + 0xc], cx
mov cl, byte [0x482946]
mov byte [edx + 0xe], cl
mov edx, dword [ebp - 0x2c0]
mov esi, edx
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x403085
lea edi, [ebp - 0x264]
sub edx, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x403095
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x264]
dec edi
mov cl, byte [edi + 1]
lea edi, [edi + 1]
test cl, cl
jne 0x4030b2
push 0x40
mov word [edi], ax
lea eax, [ebp - 0x2a8]
push 0
push eax
call fcn.00452270
add esp, 0xc
mov dword [ebp - 0x2ac], 0x44
lea eax, [ebp - 0x2bc]
mov dword [ebp - 0x280], 0
xorps xmm0, xmm0
mov edi, 1
mov word [ebp - 0x27c], di
push eax
lea eax, [ebp - 0x2ac]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x264]
push eax
push 0
movdqu xmmword [ebp - 0x2bc], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, edi
jne 0x403140
push dword [ebp - 0x2b8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x2bc]
call esi
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00451570
mov esp, ebp
pop ebp
ret
Function at 0x403160
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b4
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x257
lea eax, [ebp - 0x25b]
mov byte [ebp - 0x25c], 0
push 0
push eax
mov edi, ecx
call fcn.00452270
add esp, 0xc
lea eax, [ebp - 0x25c]
push 0x258
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x25c]
push 0x5c
push eax
call fcn.00457750
add esp, 8
test eax, eax
je 0x4031d1
lea eax, [ebp - 0x25c]
push 0x5c
push eax
call fcn.00457750
add esp, 8
mov byte [eax], 0
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [ebp - 0x25c]
push 0x4a8890
push eax
push str.Start
push str.PATH
call esi
push 0x257
lea eax, [ebp - 0x4b3]
mov byte [ebp - 0x4b4], 0
push 0
push eax
call fcn.00452270
add esp, 0xc
lea eax, [ebp - 0x4b4]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x4b4]
push eax
call fcn.004572e3
add esp, 8
push 0x4a8890
test eax, eax
jne 0x403241
push edi
jmp 0x403248
lea eax, [ebp - 0x25c]
push eax
push str.Start
push str.PATH
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00451570
mov esp, ebp
pop ebp
ret
Function at 0x403990
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x63
lea eax, [ebp - 0x67]
mov byte [ebp - 0x68], 0
push 0
push eax
call fcn.00452270
add esp, 0xc
lea eax, [ebp - 0x68]
push 0x4a8890
push 0x64
push eax
push 0
push str.isReleaseEnableSpecifyingReleaseDir
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x4039fd
lea eax, [ebp - 0x68]
push 0x4829dc
push eax
call fcn.004572e3
add esp, 8
test eax, eax
jne 0x4039fd
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00451570
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00451570
mov esp, ebp
pop ebp
ret

Function at 0x403a10
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x63
lea eax, [ebp - 0x67]
mov byte [ebp - 0x68], 0
push 0
push eax
call fcn.00452270
add esp, 0xc
lea eax, [ebp - 0x68]
push 0x4a8890
push 0x64
push eax
push 0
push str.isEnableSearchKeyword
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x403a7d
lea eax, [ebp - 0x68]
push 0x4829dc
push eax
call fcn.004572e3
add esp, 8
test eax, eax
jne 0x403a7d
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00451570
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00451570
mov esp, ebp
pop ebp
ret

Function at 0x403a90
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x63
lea eax, [ebp - 0x67]
mov byte [ebp - 0x68], 0
push 0
push eax
call fcn.00452270
add esp, 0xc
lea eax, [ebp - 0x68]
push 0x4a8890
push 0x64
push eax
push 0
push str.IsReleaseCurrentDir
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x403b00
lea eax, [ebp - 0x68]
push 0x4829dc
push eax
call fcn.004572e3
add esp, 8
test eax, eax
jne 0x403b00
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00451570
mov esp, ebp
pop ebp
ret
push 0x63
lea eax, [ebp - 0xcb]
mov byte [ebp - 0xcc], 0
push 0
push eax
call fcn.00452270
add esp, 0xc
lea eax, [ebp - 0xcc]
push 0x4a8890
push 0x64
push eax
push 0
push str.isReleaseEnableSpecifyingReleaseDir
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x403b56
lea eax, [ebp - 0xcc]
push 0x4829dc
push eax
call fcn.004572e3
add esp, 8
test eax, eax
je 0x403b5f
call fcn.00403a10
test eax, eax
je 0x403aed
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00451570
mov esp, ebp
pop ebp
ret
Function at 0x4041e0
Capabilities:
Copy file
Get common file path
Persist via lnk shortcut

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58c
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x257
lea eax, [ebp - 0x32f]
mov byte [ebp - 0x330], 0
push 0
push eax
mov ebx, ecx
call fcn.00452270
add esp, 0xc
mov byte [ebp - 0x588], 0
lea eax, [ebp - 0x587]
push 0x257
push 0
push eax
call fcn.00452270
add esp, 0xc
mov byte [ebp - 0x70], 0
lea eax, [ebp - 0x6f]
push 0x63
push 0
push eax
call fcn.00452270
add esp, 0xc
mov byte [ebp - 0xd8], 0
lea eax, [ebp - 0xd7]
push 0x63
push 0
push eax
call fcn.00452270
add esp, 0xc
lea eax, [ebp - 0x588]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [ebp - 0x588]
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x404280
mov ax, word [0x482998]
mov edx, 0x6b054c
mov word [edi], ax
mov esi, edx
lea ebx, [ebx]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x4042a0
lea edi, [ebp - 0x588]
sub edx, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4042b0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp - 0x588]
and ecx, 3
dec edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ecx]
mov cl, byte [edx + 1]
lea edx, [edx + 1]
test cl, cl
jne 0x4042d0
mov ecx, dword [str..lnk]
mov esi, ebx
mov dword [edx], ecx
mov cl, byte [0x482a20]
mov byte [edx + 4], cl
lea ecx, [ecx]
mov cl, byte [ebx]
inc ebx
test cl, cl
jne 0x4042f0
lea edi, [ebp - 0x330]
sub ebx, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x404300
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x330]
dec edi
lea ecx, [ecx]
mov cl, byte [edi + 1]
lea edi, [edi + 1]
test cl, cl
jne 0x404320
mov edx, 0x6b054c
mov word [edi], ax
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x404334
lea edi, [ebp - 0x330]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404344
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x330]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x404361
mov eax, dword [str..lnk]
lea edx, [ebp - 0x70]
mov dword [ecx], eax
mov al, byte [0x482a20]
mov byte [ecx + 4], al
lea ecx, [ebp - 0x588]
call fcn.004024e0
cmp eax, 1
jne 0x4043ba
lea edx, [ebp - 0xd8]
lea ecx, [ebp - 0x330]
call fcn.004024e0
cmp eax, 1
jne 0x4043ba
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.004572e3
add esp, 8
test eax, eax
je 0x4043d0
push 0
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x588]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00451570
mov esp, ebp
pop ebp
ret
Function at 0x4047c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 8
mov ebx, edx
mov edi, ecx
call fcn.00452a93
mov esi, eax
add esp, 4
test esi, esi
je 0x40482c
lea eax, [ebp - 8]
mov dword [esi], edi
push eax
push 0
push esi
push 0x404530
push 0
push 0
mov dword [esi + 4], ebx
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x404816
push eax
call ebx
cmp dword [ebp - 8], 0
jne 0x40482c
test edi, edi
je 0x404823
push edi
call ebx
push esi
call fcn.00453c4d
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00451570
mov esp, ebp
pop ebp
ret
Function at 0x405460
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3aa4
call fcn.00456fe0
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov ebx, ecx
push 0x95e
push eax
mov word [ebp - 0xbbc], ax
lea eax, [ebp - 0xbba]
push eax
mov dword [ebp - 0x3aa4], ebx
call fcn.00452270
add esp, 0xc
lea eax, [ebp - 0xbbc]
push 0x4b0
push eax
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [0x4ab490]
test eax, eax
je 0x4054d5
lea ecx, [ebp - 0xbbc]
push ecx
push str._STS_DUILIB_SearchUpdateProcessChange
call eax
call eax
add esp, 4
mov ecx, 0xbb8
lea edi, [ebp - 0x3a9c]
mov esi, 0x4ab630
rep movsd dword es:[edi], dword [esi]
cmp byte [ebp - 0x3a9c], 0
je 0x405619
push 0x257
lea eax, [ebp - 0x25b]
mov byte [ebp - 0x25c], 0
push 0
push eax
call fcn.00452270
add esp, 0xc
mov dword [ebp - 0x3aa0], 0
lea ebx, [ebp - 0x3a9c]
cmp byte [ebx], 0
je 0x4055e3
push 0x258
lea eax, [ebp - 0x25c]
push 0
push eax
call fcn.00452270
mov eax, dword [ebp - 0x3aa4]
add esp, 0xc
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405548
lea edi, [ebp - 0x25c]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x405558
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x25c]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x405575
mov ax, word [0x482998]
mov edx, ebx
mov word [edi], ax
mov esi, edx
lea esp, [esp]
mov al, byte [edx]
inc edx
test al, al
jne 0x405590
lea edi, [ebp - 0x25c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4055a0
mov ecx, edx
lea eax, [ebp - 0x25c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x405619
mov eax, dword [ebp - 0x3aa0]
add ebx, 0x258
inc eax
mov dword [ebp - 0x3aa0], eax
cmp eax, 0x14
jb 0x405521
mov ecx, dword [ebp - 0x3aa4]
lea edi, [ecx - 1]
lea esp, [esp]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x4055f0
mov ax, word [0x482998]
push 0x4a8890
push ecx
push str.Game
push str.PATH
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00451570
mov esp, ebp
pop ebp
ret