joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x64
mov eax, dword [ebp + 8]
mov dword [0x1003f73c], 0x2147
mov dword [ebp - 0x30], eax
call fcn.10002ee0
xor ecx, ecx
mov dword [0x1003f740], 0x715
mov dword [0x1003f73c], 0x266c
mov edx, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
lea edx, section..data
imul esi, eax, 0x118
mov edi, edx
add edi, esi
add edi, 0xc0
mov esi, dword [edi]
imul edi, eax, 0x118
add edx, edi
add edx, 0x9c
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
cmp eax, 0x357
mov ecx, edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], eax
jne 0x10003a3f
lea eax, [0x10004289]
mov ecx, 0xe
lea edx, [ebp - 0x2c]
mov esi, dword [0x1003f73c]
add esi, 0xffffe544
mov dword [0x1003f73c], esi
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], ecx
call fcn.10003600
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call fcn.10003080
mov ecx, eax
mov dword [0x1003f754], eax
mov eax, esp
mov edx, dword [ebp - 0x40]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
lea edx, section..data
imul esi, eax, 0x118
mov edi, edx
add edi, esi
add edi, 0xc0
mov esi, dword [edi]
imul edi, eax, 0x118
mov ebx, edx
add ebx, edi
add ebx, 0x88
mov edi, dword [ebx]
imul ebx, eax, 0x118
add edx, ebx
add edx, 0x9c
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x4c]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x60], edx
call fcn.10003010
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
add eax, ecx
mov edx, dword [ebp - 0x58]
add edx, 1
cmp edx, 0x357
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], edx
jne 0x10003b03
mov dword [0x1003f740], 0x1067
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x40]
mov dword [esp + 8], ecx
call fcn.10002f50
xor eax, eax
mov ecx, dword [ebp - 0x4c]
add ecx, 0x72428
mov edx, dword [ebp - 0x30]
mov dword [edx], ecx
mov dword [edx + 4], 0x113400
mov ecx, dword [ebp - 0x4c]
add ecx, 0x1a8c9
mov dword [edx + 8], ecx
mov dword [0x1003f740], 0x149a
mov dword [edx + 0xc], 0x1fd0
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406710
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [0x6044c4]
cmp byte [eax + 0x2df], 7
push edi
jne 0x406734
mov edi, 0x4b1aa0
call fcn.00402ac0
push eax
call fcn.00438e40
add esp, 4
pop edi
ret
mov ecx, dword [0x6043c0]
push 0x34
call fcn.004742e0
mov ecx, dword [0x6043c0]
push 2
push 0
call fcn.00474550
mov ecx, dword [0x6043c0]
push 1
push 0x2a
call fcn.00474550
mov ecx, dword [0x6043c0]
push 1
push 2
call fcn.00474550
mov ecx, dword [0x6043c0]
pop edi
jmp fcn.004745b0

Function at 0x406a80
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [0x6044c4]
cmp byte [eax + 0x2df], 7
push edi
jne 0x406aa4
mov edi, 0x4b1aa0
call fcn.00402ac0
push eax
call fcn.00438e40
add esp, 4
pop edi
ret
mov ecx, dword [0x6043c0]
push 0x34
call fcn.004742e0
mov ecx, dword [0x6043c0]
push 2
push 0
call fcn.00474550
mov ecx, dword [0x6043c0]
push 1
push 0x1f
call fcn.00474550
mov ecx, dword [0x6043c0]
push 1
push 2
call fcn.00474550
mov ecx, dword [0x6043c0]
pop edi
jmp fcn.004745b0

Function at 0x406d70
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406d75
sub eax, edx
push esi
lea esi, [eax + 1]
cmp esi, 0x33
jg 0x406dbb
mov ecx, dword [0x6043c0]
push 0xc
call fcn.004742e0
mov ecx, dword [0x6043c0]
push 2
push esi
call fcn.00474550
mov ecx, dword [0x6043c0]
push esi
push edi
call fcn.004744a0
mov ecx, dword [0x6043c0]
pop esi
jmp fcn.004745b0
pop esi
ret

Function at 0x4076d0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4076d5
mov ecx, dword [0x6043c0]
push esi
sub eax, edx
push 0x34
lea esi, [eax + 1]
call fcn.004742e0
mov ecx, dword [0x6043c0]
push 2
lea eax, [esi + 1]
push eax
call fcn.00474550
mov ecx, dword [0x6043c0]
push 1
push 0xe
call fcn.00474550
mov ecx, dword [0x6043c0]
push 1
push 9
call fcn.00474550
mov ecx, dword [0x6043c0]
push 1
push esi
call fcn.00474550
mov ecx, dword [0x6043c0]
push esi
push edi
call fcn.00474470
mov ecx, dword [0x6043c0]
pop esi
jmp fcn.004745b0
Function at 0x407750
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
mov edi, eax
mov ebx, ecx
mov esi, edx
call dword [0x604460]
cmp dword [0x4cb5ec], eax
jle 0x407785
test ebx, ebx
je 0x407785
movzx ecx, byte [esi + 0x45aec]
cmp ebx, ecx
jne 0x407785
test edi, edi
je 0x407785
movzx edx, byte [esi + 0x45aea]
cmp edi, edx
je 0x4077be
lea ecx, [eax + 0xea60]
mov dword [0x4cb5ec], ecx
test edi, edi
jne 0x40779a
mov edi, 1
test ebx, ebx
jne 0x4077a3
mov ebx, 1
cmp dword [0x4cb5f0], eax
jle 0x4077c2
mov edi, 0x4b1ac0
call fcn.00402ac0
push eax
call fcn.00438e40
add esp, 4
pop edi
pop esi
pop ebx
ret
mov ecx, dword [0x6043c0]
add eax, 0x64
push 0x34
mov dword [0x4cb5f0], eax
call fcn.004742e0
mov ecx, dword [0x6043c0]
push 2
push 2
call fcn.00474550
mov ecx, dword [0x6043c0]
push 1
push 0x22
call fcn.00474550
mov ecx, dword [0x6043c0]
push 1
push 1
call fcn.00474550
mov ecx, dword [0x6043c0]
push 1
push ebx
call fcn.00474550
mov ecx, dword [0x6043c0]
push 1
push edi
call fcn.00474550
mov ecx, dword [0x6043c0]
pop edi
pop esi
pop ebx
jmp fcn.004745b0

Function at 0x407830
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
mov edi, eax
mov esi, ecx
call dword [0x604460]
cmp dword [0x4cb5f4], eax
jle 0x407853
test edi, edi
je 0x407853
movzx ecx, byte [esi + 0x45aed]
cmp edi, ecx
je 0x40787a
cmp dword [0x4cb5f8], eax
lea edx, [eax + 0xea60]
mov dword [0x4cb5f4], edx
jle 0x40787d
mov edi, 0x4b1ac0
call fcn.00402ac0
push eax
call fcn.00438e40
add esp, 4
pop edi
pop esi
ret
mov ecx, dword [0x6043c0]
add eax, 0x64
push 0x34
mov dword [0x4cb5f8], eax
call fcn.004742e0
mov ecx, dword [0x6043c0]
push 2
push 1
call fcn.00474550
mov ecx, dword [0x6043c0]
push 1
push 0x21
call fcn.00474550
mov ecx, dword [0x6043c0]
push 1
push 1
call fcn.00474550
mov ecx, dword [0x6043c0]
push 1
push edi
call fcn.00474550
mov ecx, dword [0x6043c0]
pop edi
pop esi
jmp fcn.004745b0

Function at 0x407bf0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [0x6044c4]
cmp byte [eax + 0x2df], 7
push edi
jne 0x407c14
mov edi, 0x4b1aa0
call fcn.00402ac0
push eax
call fcn.00438e40
add esp, 4
pop edi
ret
mov ecx, dword [0x6043c0]
push 0x34
call fcn.004742e0
mov ecx, dword [0x6043c0]
push 2
push 0
call fcn.00474550
mov ecx, dword [0x6043c0]
push 1
push 0x23
call fcn.00474550
mov ecx, dword [0x6043c0]
push 1
push 3
call fcn.00474550
mov ecx, dword [0x6043c0]
pop edi
jmp fcn.004745b0

Function at 0x407c60
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [0x6044c4]
cmp byte [eax + 0x2df], 7
push edi
jne 0x407c84
mov edi, 0x4b1aa0
call fcn.00402ac0
push eax
call fcn.00438e40
add esp, 4
pop edi
ret
mov ecx, dword [0x6043c0]
push 0x34
call fcn.004742e0
mov ecx, dword [0x6043c0]
push 2
push 0
call fcn.00474550
mov ecx, dword [0x6043c0]
push 1
push 0x23
call fcn.00474550
mov ecx, dword [0x6043c0]
push 1
push 4
call fcn.00474550
mov ecx, dword [0x6043c0]
pop edi
jmp fcn.004745b0
Function at 0x408160
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [0x6044c4]
cmp byte [eax + 0x2df], 7
push edi
jne 0x408184
mov edi, 0x4b1aa0
call fcn.00402ac0
push eax
call fcn.00438e40
add esp, 4
pop edi
ret
mov ecx, dword [0x6043c0]
push 0x34
call fcn.004742e0
mov ecx, dword [0x6043c0]
push 2
push 0
call fcn.00474550
mov ecx, dword [0x6043c0]
push 1
push 0xe
call fcn.00474550
mov ecx, dword [0x6043c0]
push 1
push 8
call fcn.00474550
mov ecx, dword [0x6043c0]
pop edi
jmp fcn.004745b0

Function at 0x4081d0
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [0x6043c0]
push 0x34
call fcn.004742e0
mov ecx, dword [0x6043c0]
push 2
push 0
call fcn.00474550
mov ecx, dword [0x6043c0]
push 1
push 0xe
call fcn.00474550
mov ecx, dword [0x6043c0]
push 1
push 1
call fcn.00474550
mov ecx, dword [0x6043c0]
jmp fcn.004745b0

Function at 0x408350
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [0x6044c4]
cmp byte [eax + 0x2df], 7
push edi
jne 0x408374
mov edi, 0x4b1aa0
call fcn.00402ac0
push eax
call fcn.00438e40
add esp, 4
pop edi
ret
mov ecx, dword [0x6043c0]
push 0x34
call fcn.004742e0
mov ecx, dword [0x6043c0]
push 2
push 0
call fcn.00474550
mov ecx, dword [0x6043c0]
push 1
push 0x1a
call fcn.00474550
mov ecx, dword [0x6043c0]
push 1
push 1
call fcn.00474550
mov ecx, dword [0x6043c0]
pop edi
jmp fcn.004745b0

Function at 0x408520
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, eax
mov eax, dword [0x6044c4]
cmp byte [eax + 0x2df], 7
push edi
jne 0x408548
mov edi, 0x4b1aa0
call fcn.00402ac0
push eax
call fcn.00438e40
add esp, 4
pop edi
pop esi
ret
mov ecx, esi
call fcn.004043e0
test eax, eax
je 0x408545
mov ecx, dword [0x6043c0]
push 0x34
call fcn.004742e0
mov ecx, dword [0x6043c0]
push 2
push 0
call fcn.00474550
mov ecx, dword [0x6043c0]
push 1
push 0x16
call fcn.00474550
mov ecx, dword [0x6043c0]
push 1
push 3
call fcn.00474550
mov ecx, dword [0x6043c0]
pop edi
pop esi
jmp fcn.004745b0

Function at 0x4085a0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, eax
mov eax, dword [0x6044c4]
cmp byte [eax + 0x2df], 7
push edi
jne 0x4085c8
mov edi, 0x4b1aa0
call fcn.00402ac0
push eax
call fcn.00438e40
add esp, 4
pop edi
pop esi
ret
mov ecx, esi
call fcn.004043e0
test eax, eax
je 0x4085c5
mov ecx, dword [0x6043c0]
push 0x34
call fcn.004742e0
mov ecx, dword [0x6043c0]
push 2
push 0
call fcn.00474550
mov ecx, dword [0x6043c0]
push 1
push 0x16
call fcn.00474550
mov ecx, dword [0x6043c0]
push 1
push 4
call fcn.00474550
mov ecx, dword [0x6043c0]
pop edi
pop esi
jmp fcn.004745b0
Function at 0x408620
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
mov edi, eax
mov eax, dword [0x6044c4]
cmp byte [eax + 0x2df], 7
mov esi, ecx
jne 0x40864a
mov edi, 0x4b1aa0
call fcn.00402ac0
push eax
call fcn.00438e40
add esp, 4
pop edi
pop esi
ret
call fcn.004043e0
test eax, eax
je 0x408647
test edi, edi
jne 0x40866d
push edi
push ebx
push 0x32
call fcn.004063b0
mov ecx, dword [0x6043c0]
pop edi
pop esi
jmp fcn.004745b0
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408672
sub eax, edx
mov esi, eax
push esi
push ebx
push 0x32
call fcn.004063b0
mov ecx, dword [0x6043c0]
push esi
push edi
call fcn.004744a0
mov ecx, dword [0x6043c0]
pop edi
pop esi
jmp fcn.004745b0

Function at 0x4087d0
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [0x6043c0]
push 8
call fcn.004742e0
mov ecx, dword [0x6043c0]
push 2
push 2
call fcn.00474550
mov ecx, dword [0x6043c0]
jmp fcn.004745b0

Function at 0x40b450
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [0x6043c0]
push 0xff
call fcn.004742e0
mov ecx, dword [0x6043c0]
jmp fcn.004745b0
Function at 0x43c470
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
push 0x4b1b94
push str.metin.cfg
mov edi, eax
call fcn.004656f1
mov esi, eax
add esp, 8
test esi, esi
je 0x43c588
push ebx
push esi
push 1
lea eax, [edi + 0xacd]
push 1
push eax
call fcn.004787ff
push esi
push 1
lea ecx, [edi + 0xace]
push 1
push ecx
call fcn.004787ff
push esi
push 1
lea edx, [edi + 0xad0]
push 1
push edx
call fcn.004787ff
push esi
push 1
lea ebx, [edi + 0xad1]
push 1
push ebx
call fcn.004787ff
add esp, 0x40
push esi
push 1
lea eax, [edi + 0xae0]
push 1
push eax
call fcn.004787ff
push esi
push 1
lea ecx, [edi + 0xae1]
push 1
push ecx
call fcn.004787ff
push esi
push 1
lea edx, [edi + 0xae2]
push 1
push edx
call fcn.004787ff
push esi
push 1
lea eax, [edi + 0xae3]
push 1
push eax
call fcn.004787ff
add esp, 0x40
push esi
push 1
lea ecx, [edi + 0xacc]
push 1
push ecx
call fcn.004787ff
push esi
push 1
push 1
push 0x4bd529
call fcn.004787ff
push esi
push 1
push 1
push 0x4bd528
call fcn.004787ff
push esi
push 1
push 1
push 0x604116
call fcn.004787ff
add esp, 0x40
push esi
push 1
add edi, 0xad3
push 1
push edi
call fcn.004787ff
push esi
call fcn.0047766d
movzx eax, byte [edi]
add esp, 0x14
mov byte [edi], al
call fcn.00451ad0
mov byte [ebx], 1
pop ebx
pop edi
pop esi
ret

Function at 0x43c590
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
push 0x4b4518
push str.metin.cfg
mov edi, eax
call fcn.004656f1
mov esi, eax
add esp, 8
test esi, esi
je 0x43c699
push esi
push 1
lea eax, [edi + 0xacd]
push 1
push eax
call fcn.0047897e
push esi
push 1
lea ecx, [edi + 0xace]
push 1
push ecx
call fcn.0047897e
push esi
push 1
lea edx, [edi + 0xad0]
push 1
push edx
call fcn.0047897e
push esi
push 1
lea eax, [edi + 0xad1]
push 1
push eax
call fcn.0047897e
add esp, 0x40
push esi
push 1
lea ecx, [edi + 0xae0]
push 1
push ecx
call fcn.0047897e
push esi
push 1
lea edx, [edi + 0xae1]
push 1
push edx
call fcn.0047897e
push esi
push 1
lea eax, [edi + 0xae2]
push 1
push eax
call fcn.0047897e
push esi
push 1
lea ecx, [edi + 0xae3]
push 1
push ecx
call fcn.0047897e
add esp, 0x40
push esi
push 1
lea edx, [edi + 0xacc]
push 1
push edx
call fcn.0047897e
push esi
push 1
push 1
push 0x4bd529
call fcn.0047897e
push esi
push 1
push 1
push 0x4bd528
call fcn.0047897e
push esi
push 1
push 1
push 0x604116
call fcn.0047897e
add esp, 0x40
push esi
push 1
push 1
add edi, 0xad3
push edi
call fcn.0047897e
push esi
call fcn.0047766d
add esp, 0x14
pop edi
pop esi
ret
Function at 0x43c652
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
push 0x4b4518
push str.metin.cfg
mov edi, eax
call fcn.004656f1
mov esi, eax
add esp, 8
test esi, esi
je 0x43c699
push esi
push 1
lea eax, [edi + 0xacd]
push 1
push eax
call fcn.0047897e
push esi
push 1
lea ecx, [edi + 0xace]
push 1
push ecx
call fcn.0047897e
push esi
push 1
lea edx, [edi + 0xad0]
push 1
push edx
call fcn.0047897e
push esi
push 1
lea eax, [edi + 0xad1]
push 1
push eax
call fcn.0047897e
add esp, 0x40
push esi
push 1
lea ecx, [edi + 0xae0]
push 1
push ecx
call fcn.0047897e
push esi
push 1
lea edx, [edi + 0xae1]
push 1
push edx
call fcn.0047897e
push esi
push 1
lea eax, [edi + 0xae2]
push 1
push eax
call fcn.0047897e
push esi
push 1
lea ecx, [edi + 0xae3]
push 1
push ecx
call fcn.0047897e
add esp, 0x40
push esi
push 1
lea edx, [edi + 0xacc]
push 1
push edx
call fcn.0047897e
push esi
push 1
push 1
push 0x4bd529
call fcn.0047897e
push esi
push 1
push 1
push 0x4bd528
call fcn.0047897e
push esi
push 1
push 1
push 0x604116
call fcn.0047897e
add esp, 0x40
push esi
push 1
push 1
add edi, 0xad3
push edi
call fcn.0047897e
push esi
call fcn.0047766d
add esp, 0x14
pop edi
pop esi
ret

Function at 0x43e7e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a6aab
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x4bdcf8]
xor eax, esp
mov dword [esp + 0x124], eax
push ebx
mov eax, dword [0x4bdcf8]
xor eax, esp
push eax
lea eax, [esp + 0x130]
mov dword fs:[0], eax
xor ebx, ebx
push 0x103
lea eax, [esp + 0x2d]
push ebx
push eax
mov dword [esp + 0x30], ebx
mov byte [esp + 0x34], bl
call fcn.0047cbe0
add esp, 0xc
push 0x104
lea ecx, [esp + 0x2c]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x28]
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], ebx
mov byte [esp + 0xc], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x43e864
sub eax, edx
push eax
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x10]
call fcn.00402610
lea eax, [esp + 8]
push eax
mov ecx, esi
mov dword [esp + 0x13c], ebx
call fcn.0043e6d0
add esp, 4
cmp dword [esp + 0x20], 0x10
jb 0x43e8a6
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00476a7f
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x130]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.004768b9
add esp, 0x134
ret
Function at 0x43f700
Capabilities:
Create process on windows
Delete file
Move file
Set file attributes

Disassembly:
sub esp, 0x16c
mov eax, dword [0x4bdcf8]
xor eax, esp
mov dword [esp + 0x164], eax
push ebx
push ebp
push esi
push edi
push 0x4b1b94
push str.patch.exe
call fcn.004656f1
add esp, 8
test eax, eax
je 0x43f893
push eax
call fcn.0047766d
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 4
push str.metin.exe
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ebx, [ebx]
push str.metin.exe
push str.patch.exe
call esi
test eax, eax
jne 0x43f790
call ebx
sub eax, 2
je 0x43f790
sub eax, 0xb5
je 0x43f787
push 0xbb8
call edi
jmp 0x43f760
push str.metin.exe
call ebp
jmp 0x43f760
push 0x80
push str.metin.exe
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push str.Patch_program_was_changed._Restarting_the_program.
push str.Notice
call fcn.00465616
push 0x44
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.0047cbe0
add esp, 0x14
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov ecx, 5
mov eax, 0x4ca868
mov dword [esp + 0x20], 0x44
mov dword [esp + 0x4c], 1
mov word [esp + 0x50], cx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43f7f4
sub eax, edx
push 0x100
cmp eax, 0xa
jb 0x43f813
push 0x4ca872
lea edx, [esp + 0x70]
push edx
jmp 0x43f81d
push 0x4ca868
lea eax, [esp + 0x70]
push eax
call fcn.00476fc0
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x88]
push eax
push str.metin.exe
mov byte [esp + 0x190], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x43f873
call ebx
push eax
push str.could_not_execute_metin__d
push str.ERROR
call fcn.00465616
add esp, 0xc
xor eax, eax
jmp 0x43f8b7
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x43f884
push eax
call esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x43f88f
push eax
call esi
xor eax, eax
jmp 0x43f8b7
call fcn.0043f190
test eax, eax
jne 0x43f8b2
push str.Script_Error
push str.Error
call fcn.00465616
add esp, 8
xor eax, eax
jmp 0x43f8b7
mov eax, 1
mov ecx, dword [esp + 0x174]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004768b9
add esp, 0x16c
ret
Function at 0x4400f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
push ebx
push ebp
push esi
lea eax, [esp + 0x18]
push edi
push eax
call fcn.0043e8d0
mov ebp, 0x10
add esp, 4
cmp dword [esp + 0x34], ebp
jb 0x440122
mov ecx, dword [esp + 0x20]
push ecx
call fcn.00476a7f
add esp, 4
xor eax, eax
push str.MetinBlockMutex
push eax
lea edx, [esp + 0x18]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
push edx
mov dword [esp + 0x1c], 0xc
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0xa
push 0x4b4c34
push 0x4ca868
mov dword [0x6043bc], eax
call fcn.0047797d
add esp, 0xc
test eax, eax
jne 0x440175
mov bl, 1
jmp 0x440260
push 0xa
push str.__________
push 0x4ca868
call fcn.0047797d
add esp, 0xc
test eax, eax
je 0x440197
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x1c]
push eax
call fcn.0043e8d0
add esp, 4
cmp dword [eax + 0x18], ebp
jb 0x4401ae
mov eax, dword [eax + 4]
jmp 0x4401b1
add eax, 4
push eax
push 0x3e7
push str.bWindowMode
push str.Metin1
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esi, eax
cmp dword [esp + 0x34], ebp
jb 0x4401dc
mov ecx, dword [esp + 0x20]
push ecx
call fcn.00476a7f
add esp, 4
cmp esi, 0x3e7
jne 0x44025a
push 4
mov edi, 0x4b2818
call fcn.00402ac0
push eax
mov edi, 0x4b4c50
call fcn.00402ac0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
sete bl
mov esi, 0x4b4898
cmp bl, 1
je 0x440219
mov esi, 0x4b2dd0
lea edx, [esp + 0x1c]
push edx
call fcn.0043e8d0
add esp, 4
cmp dword [eax + 0x18], ebp
jb 0x440230
mov eax, dword [eax + 4]
jmp 0x440233
add eax, 4
push eax
push esi
push str.bWindowMode
push str.Metin1
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [esp + 0x34], ebp
jb 0x440260
mov eax, dword [esp + 0x20]
push eax
call fcn.00476a7f
add esp, 4
jmp 0x440260
cmp esi, 1
sete bl
push 0
mov dword [0x4c9270], 0x43fdc0
mov dword [0x4c8ca4], 0x43fd40
mov dword [0x4c8c9c], 0x43fd60
mov dword [0x4c8ca0], 0x43fd80
mov dword [0x4c927c], 0x43fda0
mov dword [0x4c89ac], 0x43fde0
mov dword [0x4c8c70], 0x43fd30
mov dword [0x4c8c68], 0x440030
mov dword [0x4c88e8], 0x473eb0
mov dword [0x4c9868], 0x4400a0
call dword [sym.imp.USER32.dll_SetCursor]
call fcn.00473ed0
mov ecx, 0x320
mov edx, 0x258
mov eax, ecx
mov word [0x4c02e8], cx
mov ecx, edx
mov word [0x4c02e4], dx
mov byte [0x4ca974], bl
mov word [0x4ca984], ax
mov word [0x4ca988], cx
test bl, bl
je 0x440326
push 0xca0000
push 0
push 0
push 0
push edx
push eax
push str.Metin1
call fcn.00474de0
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push str.Metin1
call fcn.004746f0
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4406b0
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x214c
call fcn.0047d1c0
mov eax, dword [0x4bdcf8]
xor eax, esp
mov dword [esp + 0x2144], eax
push ebx
push ebp
push esi
push edi
push 0x140
xor edi, edi
lea eax, [esp + 0x14]
push edi
push eax
call fcn.0047cbe0
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push str..upg
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x44071d
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
mov ecx, dword [esp + 0x2154]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004768b9
add esp, 0x214c
ret
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea esi, [esp + 0x150]
lea ebx, [ebx]
mov edx, esi
inc edi
lea ecx, [esp + 0x3c]
add esi, 0x20
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x440740
lea edx, [esp + 0x10]
push edx
push ebx
call ebp
test eax, eax
jne 0x440730
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
test edi, edi
je 0x4406ff
push 0x440680
push 0x20
lea eax, [esp + 0x158]
push edi
push eax
call fcn.004792f0
add esp, 0x10
xor esi, esi
test edi, edi
jle 0x4406ff
lea ebx, [esp + 0x150]
mov ecx, ebx
call fcn.004409c0
test eax, eax
je 0x44079e
inc esi
add ebx, 0x20
cmp esi, edi
jl 0x440786
jmp 0x4406ff
xor eax, eax
jmp 0x440704