joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414c20
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ae39
mov eax, dword fs:[0]
push eax
mov eax, 0x1478
call fcn.00436d20
mov eax, dword [0x45d520]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x103c]
call fcn.00403dc0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
push 0x44f29e
mov ecx, dword [ebp + 8]
call fcn.0040acc0
push 0x44f29f
mov ecx, dword [ebp + 0xc]
call fcn.0040acc0
push 0x400
push 0
lea eax, [ebp - 0x143c]
push eax
call fcn.004340c0
add esp, 0xc
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x1020], eax
cmp dword [ebp - 0x1020], 0xffffffff
jne 0x414cd7
push str.AF_INET
call fcn.00401010
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x103c]
call fcn.00401940
jmp 0x414e44
push 0
push 0
lea ecx, [ebp - 0x10]
push ecx
push 0x1000
lea edx, [ebp - 0x101c]
push edx
push 0
push 0
push 0x48000016
mov eax, dword [ebp - 0x1020]
push eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
cmp eax, 0xffffffff
jne 0x414d2a
push 0x44f5c0
call fcn.00401010
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x103c]
call fcn.00401940
jmp 0x414e44
lea ecx, [ebp - 0x101c]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
cmp dword [edx], 0
jle 0x414e25
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push 0x44f5d8
lea eax, [ebp - 0x143c]
push eax
call fcn.00434444
add esp, 0xc
mov ecx, dword [ebp - 0x14]
cmp dword [ecx], 1
jl 0x414db2
lea edx, [ebp - 0x143c]
push edx
lea ecx, [ebp - 0x1458]
call fcn.004018c0
mov dword [ebp - 0x1478], eax
mov eax, dword [ebp - 0x1478]
mov dword [ebp - 0x147c], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x147c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00405740
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1458]
call fcn.00401940
mov edx, dword [ebp - 0x14]
cmp dword [edx], 2
jl 0x414e25
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push 0x44f5dc
lea eax, [ebp - 0x143c]
push eax
call fcn.00434444
add esp, 0xc
lea ecx, [ebp - 0x143c]
push ecx
lea ecx, [ebp - 0x1474]
call fcn.004018c0
mov dword [ebp - 0x1480], eax
mov edx, dword [ebp - 0x1480]
mov dword [ebp - 0x1484], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x1484]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00405740
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1474]
call fcn.00401940
mov ecx, dword [ebp - 0x1020]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x103c]
call fcn.00401940
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00433b5e
mov esp, ebp
pop ebp
ret
Function at 0x414e60
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x45d520]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x44f2b1
mov eax, dword [ebp + 8]
push eax
call fcn.00404150
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x414ea3
push 0x44f2b2
mov edx, dword [ebp + 0xc]
push edx
call fcn.00404150
add esp, 8
movzx eax, al
test eax, eax
je 0x414ea8
jmp 0x414f33
mov ecx, dword [ebp + 0xc]
call fcn.00401960
push eax
mov ecx, dword [ebp + 8]
call fcn.00401960
push eax
mov ecx, 0x45ea68
call fcn.00416330
push eax
mov ecx, dword [0x45eb08]
push ecx
push str.7.48
push str.http:__www.pmang.com_clientmall_pv5_log2.nwz_ver_sssn_dusn_sextra1_sextra2_s
lea edx, [ebp - 0x808]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
push str._pv5_error_ip.nwz
lea eax, [ebp - 0x408]
push eax
call fcn.00435ff0
add esp, 8
push 0
push 0x10
push 0xff
lea ecx, [ebp - 0x408]
push ecx
lea edx, [ebp - 0x808]
push edx
push 0
call sub.urlmon.dll_URLDownloadToCacheFileA
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x808]
push ecx
push str.PV5_LOG2
call fcn.00401010
add esp, 0xc
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00433b5e
mov esp, ebp
pop ebp
ret
Function at 0x417430
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x44]
push ecx
mov ecx, dword [ebp + 8]
add ecx, 8
call fcn.00401960
push eax
push str.StartPlugin__s___d__begins._n
call fcn.00401010
add esp, 0xc
cmp dword [ebp + 8], 0
jne 0x417470
push str.StartPlugin___failed._pItem__NULL._n
call fcn.00401010
add esp, 4
xor eax, eax
jmp 0x4174f0
mov edx, dword [ebp + 8]
mov dword [edx + 0x2c], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x30], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x44]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x28]
mov edx, dword [ecx]
mov ecx, eax
mov eax, dword [edx]
call eax
mov dword [ebp - 8], 0
lea ecx, [ebp - 8]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
push 0x416c10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x60], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x44]
push eax
mov ecx, dword [ebp + 8]
add ecx, 8
call fcn.00401960
push eax
push str.StartPlugin__s___d__finished._n
call fcn.00401010
add esp, 0xc
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x419650
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov eax, 1
test eax, eax
je 0x4196bb
mov ecx, 1
test ecx, ecx
je 0x4196a1
push 1
push 0
push 0
push 0
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x41969d
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x41969f
jmp 0x4196a1
jmp 0x419668
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, dword [ebp + 8]
jle 0x4196b9
jmp 0x4196bb
jmp 0x41965f
mov esp, ebp
pop ebp
ret
Function at 0x4196c0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x45d520]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x450674
lea eax, [ebp - 0x220]
push eax
call fcn.00435ff0
add esp, 8
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
je 0x419703
push 0x4506a4
lea edx, [ebp - 0x220]
push edx
call fcn.00436000
add esp, 8
lea eax, [ebp - 0x114]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x220]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
je 0x41973a
mov eax, dword [ebp - 0x224]
jmp 0x419795
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x110]
push eax
call fcn.00435ff0
add esp, 8
lea ecx, [ebp - 0x110]
push ecx
call fcn.00433ce0
add esp, 4
add eax, 1
push eax
lea edx, [ebp - 0x110]
push edx
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
je 0x419793
mov eax, dword [ebp - 0x224]
jmp 0x419795
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00433b5e
mov esp, ebp
pop ebp
ret

Function at 0x4197b0
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x45d520]
xor eax, ebp
mov dword [ebp - 8], eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
lea eax, [ebp - 0x110]
push eax
call fcn.00435ff0
add esp, 8
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
je 0x4197f3
push str.Once
lea edx, [ebp - 0x110]
push edx
call fcn.00436000
add esp, 8
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x110]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
je 0x419827
mov eax, dword [ebp - 0x114]
jmp 0x41984e
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
je 0x41984c
mov eax, dword [ebp - 0x114]
jmp 0x41984e
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00433b5e
mov esp, ebp
pop ebp
ret
Function at 0x419b30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b40e
mov eax, dword fs:[0]
push eax
mov eax, 0x21a4
call fcn.00436d20
mov eax, dword [0x45d520]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
push 0x100
push 0
lea eax, [ebp - 0x134]
push eax
call fcn.004340c0
add esp, 0xc
lea ecx, [ebp - 0x30]
call fcn.00432ca0
mov byte [ebp - 4], 1
push 0x100
lea ecx, [ebp - 0x134]
push ecx
push 0
lea ecx, [ebp - 0x30]
call fcn.00414200
lea ecx, [ebp - 0x2c]
call fcn.00403dc0
mov byte [ebp - 4], 2
cmp dword [ebp + 0x24], 0
je 0x419bfe
mov edx, dword [ebp + 0x24]
push edx
push str.http:__www.pmang.com_game_home.nwz_ssn_d
lea eax, [ebp - 0x2184]
push eax
call fcn.00402dd0
add esp, 0xc
mov dword [ebp - 0x21a4], eax
mov ecx, dword [ebp - 0x21a4]
mov dword [ebp - 0x21a8], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x21a8]
push edx
lea ecx, [ebp - 0x2c]
call fcn.00405740
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2184]
call fcn.00401940
jmp 0x419c0a
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00405740
movsx ecx, byte [ebp - 0x134]
test ecx, ecx
je 0x419d25
push str.__updatemanager____
lea edx, [ebp - 0x2c]
push edx
push str.window.open_
lea eax, [ebp - 0x21a0]
push eax
call fcn.004053f0
add esp, 0xc
mov dword [ebp - 0x21ac], eax
mov ecx, dword [ebp - 0x21ac]
mov dword [ebp - 0x21b0], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x21b0]
push edx
lea eax, [ebp - 0x2168]
push eax
call fcn.00405480
add esp, 0xc
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x21a0]
call fcn.00401940
lea ecx, [ebp - 0x1144]
call fcn.004163f0
mov byte [ebp - 4], 7
push 0x4506a2
push 0
push 0
lea ecx, [ebp - 0x214c]
call fcn.004163b0
push 0xff8
lea ecx, [ebp - 0x2168]
call fcn.00401960
push eax
lea ecx, [ebp - 0x2144]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea edx, [ebp - 0x1148]
push edx
lea eax, [ebp - 0x214c]
push eax
push 0x450744
lea ecx, [ebp - 0x134]
push ecx
lea ecx, [ebp - 0x1144]
call fcn.00416560
test eax, eax
jne 0x419cfa
push 5
push 0
lea ecx, [ebp - 0x2c]
call fcn.00401960
push eax
push 0x450768
push 0x450774
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x1144]
call fcn.00414540
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1144]
call fcn.004164c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2168]
call fcn.00401940
jmp 0x419d44
push 5
push 0
lea ecx, [ebp - 0x2c]
call fcn.00401960
push eax
push str.iexplore
push 0x450788
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00401940
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00416540
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401940
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00433b5e
mov esp, ebp
pop ebp
ret
Function at 0x41a0d0
Capabilities:
Download url
Get common file path
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b526
mov eax, dword fs:[0]
push eax
sub esp, 0x314
mov eax, dword [0x45d520]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x320], 0
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x45082c
lea eax, [ebp - 0x314]
push eax
call fcn.00434444
add esp, 0xc
lea ecx, [ebp - 0x114]
push ecx
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x314]
push eax
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov dword [ebp - 0x318], 0
jmp 0x41a176
mov edx, dword [ebp - 0x318]
add edx, 1
mov dword [ebp - 0x318], edx
cmp dword [ebp - 0x318], 3
jge 0x41a1fa
push 0
push 0x10
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp + 0xc]
call fcn.00401960
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileA
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0
jne 0x41a1f5
lea ecx, [ebp - 0x214]
push ecx
lea ecx, [ebp + 0xc]
call fcn.00401960
push eax
push str.DownloadToTempFile__s__Success___s_n
call fcn.00401010
add esp, 0xc
lea edx, [ebp - 0x214]
push edx
mov ecx, dword [ebp + 8]
call fcn.004018c0
mov eax, dword [ebp - 0x320]
or eax, 1
mov dword [ebp - 0x320], eax
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401940
mov eax, dword [ebp + 8]
jmp 0x41a23b
jmp 0x41a167
lea ecx, [ebp + 0xc]
call fcn.00401960
push eax
push str.DownloadToTempFile__s__Fail_n
call fcn.00401010
add esp, 8
push 0x4506a9
mov ecx, dword [ebp + 8]
call fcn.004018c0
mov ecx, dword [ebp - 0x320]
or ecx, 1
mov dword [ebp - 0x320], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00401940
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00433b5e
mov esp, ebp
pop ebp
ret
Function at 0x41c610
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x44]
push ecx
mov ecx, dword [ebp + 8]
add ecx, 8
call fcn.00401960
push eax
push str.WaitPluginForStartRet___begins.__s___d_n
call fcn.00401010
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov edx, 1
test edx, edx
je 0x41c795
lea ecx, [ebp - 0xc]
call fcn.00410370
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
push ecx
mov ecx, 0x45f1ec
call fcn.00408940
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, 0x45f1ec
call fcn.004307e0
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.0041cad0
add esp, 0x18
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, 0x45f1ec
call fcn.00408940
push eax
lea ecx, [ebp - 0xc]
call fcn.00410440
movzx edx, al
test edx, edx
je 0x41c6cb
push str.WaitPluginForStartRet___losted___n
call fcn.00401010
add esp, 4
xor eax, eax
jmp 0x41c795
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, 0x3e8
jbe 0x41c708
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x44]
push ecx
mov ecx, dword [ebp + 8]
add ecx, 8
call fcn.00401960
push eax
mov edx, dword [ebp + 8]
push edx
push str.WaitPluginForStartRet___Item__0x_08X___s___d_n
call fcn.00401010
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov eax, dword [0x45f1e8]
cmp dword [eax + 0x74], 0
je 0x41c724
push str.WaitPluginForStartRet___Terminate._n
call fcn.00401010
add esp, 4
xor eax, eax
jmp 0x41c795
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x50], 0
je 0x41c73e
push str.WaitPluginForStartRet___finished._bStopping__TRUE_n
call fcn.00401010
add esp, 4
xor eax, eax
jmp 0x41c795
mov edx, dword [ebp + 8]
cmp dword [edx + 0x2c], 0
je 0x41c762
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
push ecx
push str.WaitPluginForStartRet___finished._StartRet___d_n
call fcn.00401010
add esp, 8
mov eax, 1
jmp 0x41c795
mov edx, dword [ebp + 8]
cmp dword [edx + 0x30], 0
je 0x41c783
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x30]
push ecx
push str.WaitPluginForStartRet___finished._StopRet___d_n
call fcn.00401010
add esp, 8
xor eax, eax
jmp 0x41c795
push 0x1f4
call fcn.00419650
add esp, 4
jmp 0x41c63f
mov esp, ebp
pop ebp
ret
Function at 0x41c7a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x44]
push ecx
mov ecx, dword [ebp + 8]
add ecx, 8
call fcn.00401960
push eax
mov edx, dword [ebp + 8]
push edx
push str.WaitPluginForStopRet___begins._PluginItem__0x_08X___s___d_n
call fcn.00401010
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov eax, 1
test eax, eax
je 0x41c945
lea ecx, [ebp - 0x10]
call fcn.00410370
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0x18]
push edx
mov ecx, 0x45f1ec
call fcn.00408940
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x45f1ec
call fcn.004307e0
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x28]
push eax
call fcn.0041cad0
add esp, 0x18
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
lea eax, [ebp - 0x30]
push eax
mov ecx, 0x45f1ec
call fcn.00408940
push eax
lea ecx, [ebp - 0x10]
call fcn.00410440
movzx ecx, al
test ecx, ecx
je 0x41c868
push str.WaitPluginForStopRet___losted___n
call fcn.00401010
add esp, 4
xor eax, eax
jmp 0x41c945
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
cmp eax, 0x3e8
jbe 0x41c8a5
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x44]
push eax
mov ecx, dword [ebp + 8]
add ecx, 8
call fcn.00401960
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.WaitPluginForStopRet___PluginItem__0x_08X___s___d_n
call fcn.00401010
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov edx, dword [0x45f1e8]
cmp dword [edx + 0x74], 0
je 0x41c8c5
push str.WaitPluginForStopRet___Terminate._n
call fcn.00401010
add esp, 4
xor eax, eax
jmp 0x41c945
cmp dword [ebp + 0xc], 0
je 0x41c8ea
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jbe 0x41c8ea
push str.WaitPluginForStopRet___Terminate._MaxTime_over._n
call fcn.00401010
add esp, 4
xor eax, eax
jmp 0x41c945
mov eax, dword [ebp + 8]
cmp dword [eax + 0x2c], 0
je 0x41c90f
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x2c]
push edx
mov eax, dword [ebp + 8]
push eax
push str.WaitPluginForStopRet___finished._PluginItem__0x_08X__StartRet___d_n
call fcn.00401010
add esp, 0xc
xor eax, eax
jmp 0x41c945
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x30], 0
je 0x41c933
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x30]
push eax
push str.WaitPluginForStopRet___StopRet___d_n
call fcn.00401010
add esp, 8
mov eax, 1
jmp 0x41c945
push 0x1f4
call fcn.00419650
add esp, 4
jmp 0x41c7dc
mov esp, ebp
pop ebp
ret
Function at 0x41d3f0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x45d520]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x318]
push eax
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x218]
push edx
call fcn.00437d28
add esp, 0x14
lea eax, [ebp - 0x10c]
push eax
push 0x451604
mov ecx, dword [ebp + 8]
push ecx
call fcn.00434444
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x41d47a
mov eax, dword [ebp - 4]
and eax, 0x10
je 0x41d47a
mov eax, 1
jmp 0x41d47c
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00433b5e
mov esp, ebp
pop ebp
ret

Function at 0x41d490
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x45d520]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x408]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
jne 0x41d4c0
xor eax, eax
jmp 0x41d590
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 4]
movsx edx, byte [ebp + ecx - 0x408]
test edx, edx
je 0x41d58e
mov eax, dword [ebp - 4]
lea ecx, [ebp + eax - 0x408]
push ecx
lea edx, [ebp - 0x43c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x43c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 1]
mov dword [ebp - 4], edx
lea eax, [ebp - 0x43c]
push eax
push str._sProgram_Files
mov ecx, dword [ebp + 8]
push ecx
call fcn.00434444
add esp, 0xc
movsx edx, byte [ebp - 0x43c]
push edx
call fcn.004342d7
add esp, 4
cmp eax, 0x42
jg 0x41d538
jmp 0x41d4c7
lea eax, [ebp - 0x43c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 0x444], eax
mov ecx, dword [ebp - 0x444]
and ecx, 5
cmp ecx, 5
jne 0x41d55e
jmp 0x41d4c7
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0xffffffff
je 0x41d589
mov eax, dword [ebp - 0x440]
and eax, 0x10
je 0x41d589
mov eax, 1
jmp 0x41d590
jmp 0x41d4c7
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00433b5e
mov esp, ebp
pop ebp
ret

Function at 0x41dd60
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
call fcn.0041dd30
test eax, eax
jne 0x41dd7d
or eax, 0xffffffff
or edx, 0xffffffff
jmp 0x41ddb6
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
shl eax, 0x20
add eax, dword [ebp - 4]
xor ecx, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41dfb0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
mov ecx, dword [ebp - 4]
add ecx, 8
call fcn.00401960
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov esp, ebp
pop ebp
ret 4
Function at 0x41f0b0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
je 0x41f0c2
cmp dword [ebp + 0xc], 0
jne 0x41f0cc
mov eax, 0x80070057
jmp 0x41f18d
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x41f188
mov edx, dword [ebp - 8]
push edx
call fcn.004335c8
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x41f10b
mov eax, 0x8007000e
jmp 0x41f18d
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x41f176
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0x4517c8
mov eax, dword [ebp - 0xc]
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x41f176
cmp dword [ebp - 0x10], 0
je 0x41f176
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.004335de
add esp, 4
xor eax, eax
jmp 0x41f18d
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.004335de
add esp, 4
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret