joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4118e0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [ebx + 0x38]
mov edx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
lea ecx, [eax + edx]
cmp ecx, 0x10
mov dword [esi], ecx
mov esi, dword [esp + 0x10]
push edi
jae 0x41192e
lea edi, [eax + ebx + 0x28]
mov ecx, edx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x38]
mov ecx, dword [esp + 0x20]
pop edi
add eax, edx
mov dword [ebx + 0x38], eax
pop esi
mov dword [ecx], 0
xor eax, eax
pop ebp
pop ecx
ret
cmp esi, ebp
jne 0x41193c
pop edi
pop esi
mov eax, 0x1001
pop ebp
pop ecx
ret
mov ecx, 0x10
sub ecx, eax
mov dword [esp + 0xc], ecx
mov edx, ecx
shr ecx, 2
lea edi, [eax + ebx + 0x28]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x14]
mov ecx, edx
mov edx, dword [esp + 0x18]
add esi, ecx
mov dword [esp + 0x14], esi
lea edi, [edx + eax - 0x10]
lea esi, [ebx + 0x18]
lea eax, [ebx + 0x3c]
push esi
push eax
mov dword [esp + 0x20], edi
call fcn.00410380
mov eax, dword [ebx + 0x28]
mov ecx, dword [esi]
mov edx, dword [ebx + 0x1c]
xor ecx, eax
mov dword [esi], ecx
mov eax, ecx
mov ecx, dword [ebx + 0x2c]
xor edx, ecx
mov ecx, dword [ebx + 0x20]
mov dword [ebx + 0x1c], edx
mov edx, dword [ebx + 0x30]
xor ecx, edx
mov edx, dword [ebx + 0x24]
mov dword [ebx + 0x20], ecx
mov ecx, dword [ebx + 0x34]
xor edx, ecx
mov dword [ebx + 0x24], edx
mov dword [ebp], eax
mov edx, dword [ebx + 0x1c]
mov dword [ebp + 4], edx
mov eax, dword [ebx + 0x20]
mov dword [ebp + 8], eax
mov ecx, dword [ebx + 0x24]
mov dword [ebp + 0xc], ecx
add esp, 8
add ebp, 0x10
cmp edi, 0x10
jb 0x411a40
mov eax, edi
shr eax, 4
mov dword [esp + 0x18], eax
lea eax, [ebx + 0x3c]
push esi
push eax
call fcn.00410380
mov eax, dword [esp + 0x1c]
mov edx, dword [eax]
mov ecx, dword [esi]
xor ecx, edx
mov edx, dword [ebx + 0x1c]
mov dword [esi], ecx
mov ecx, dword [eax + 4]
xor edx, ecx
mov ecx, dword [ebx + 0x20]
mov dword [ebx + 0x1c], edx
mov edx, dword [eax + 8]
xor ecx, edx
mov edx, dword [ebx + 0x24]
mov dword [ebx + 0x20], ecx
mov ecx, dword [eax + 0xc]
xor edx, ecx
mov dword [ebx + 0x24], edx
mov edx, dword [esi]
mov dword [ebp], edx
mov ecx, dword [ebx + 0x1c]
mov dword [ebp + 4], ecx
mov edx, dword [ebx + 0x20]
add eax, 0x10
mov dword [ebp + 8], edx
mov ecx, dword [ebx + 0x24]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
mov dword [ebp + 0xc], ecx
add esp, 8
add ebp, 0x10
sub edi, 0x10
dec eax
mov dword [esp + 0x18], eax
jne 0x4119d3
mov dword [esp + 0x18], edi
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, edi
mov edx, ecx
shr ecx, 2
lea edi, [ebx + 0x28]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x38]
and ecx, 0xf0000000
add ecx, eax
mov dword [ebx + 0x38], ecx
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx]
pop edi
sub edx, eax
pop esi
mov dword [ecx], edx
xor eax, eax
pop ebp
pop ecx
ret
Function at 0x411cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [eax + 0x38]
push edi
lea edi, [eax + 0x18]
add eax, 0x3c
push edi
push eax
mov dword [ebp], 0x10
call fcn.00410380
add esp, 8
test esi, esi
jbe 0x411d0c
mov ecx, dword [esp + 0x10]
mov eax, edi
mov edi, esi
lea ecx, [ecx]
mov dl, byte [eax + 0x10]
xor dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
dec edi
jne 0x411d00
pop edi
mov dword [ebp], esi
pop esi
xor eax, eax
pop ebp
ret

Function at 0x41cf71
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x4441c0
call fcn.0041e750
mov edi, 0x94
mov eax, edi
call fcn.0041c530
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [0x43b2dc]
mov ecx, dword [esi + 0x10]
mov dword [0x6e6de8], ecx
mov eax, dword [esi + 4]
mov dword [0x6e6df4], eax
mov edx, dword [esi + 8]
mov dword [0x6e6df8], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x6e6dec], esi
cmp ecx, 2
je 0x41cfd1
or esi, 0x8000
mov dword [0x6e6dec], esi
shl eax, 8
add eax, edx
mov dword [0x6e6df0], eax
xor esi, esi
push esi
mov edi, dword [0x43b2bc]
call edi
cmp word [eax], 0x5a4d
jne 0x41d00c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41d00c
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x41d024
cmp eax, 0x20b
je 0x41d011
mov dword [ebp - 0x1c], esi
jmp 0x41d038
cmp dword [ecx + 0x84], 0xe
jbe 0x41d00c
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x41d032
cmp dword [ecx + 0x74], 0xe
jbe 0x41d00c
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.00422b08
pop ecx
test eax, eax
jne 0x41d04c
push 0x1c
call fcn.0041cf4d
pop ecx
call fcn.00420991
test eax, eax
jne 0x41d05d
push 0x10
call fcn.0041cf4d
pop ecx
call fcn.00424841
mov dword [ebp - 4], esi
call fcn.00424643
test eax, eax
jge 0x41d076
push 0x1b
call fcn.0041cf28
pop ecx
call dword [0x43b274]
mov dword [0x6e86d0], eax
call fcn.00424521
mov dword [0x6e6dd8], eax
call fcn.0042447f
test eax, eax
jge 0x41d09c
push 8
call fcn.0041cf28
pop ecx
call fcn.0042424c
test eax, eax
jge 0x41d0ad
push 9
call fcn.0041cf28
pop ecx
push 1
call fcn.0041d7c6
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x41d0c3
push eax
call fcn.0041cf28
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [0x43b124]
call fcn.004241ef
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x41d0e4
movzx eax, word [ebp - 0x40]
jmp 0x41d0e7
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00429a46
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x41d105
push edi
call fcn.0041d8f3
call fcn.0041d915
jmp 0x41d137
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0041e78b
ret
Function at 0x423697
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x4236c5
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x4236cc
cmp ebx, dword [eax + 4]
jae 0x4236cc
xor eax, eax
jmp 0x4238bc
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x4236dd
xor eax, eax
inc eax
jmp 0x4238bb
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x4236f3
cmp ecx, edx
jae 0x423838
cmp dword [eax + 4], 0
je 0x4236fc
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x4236e4
cmp dword [ebp + 8], 0
je 0x42371e
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x423838
cmp eax, esi
jae 0x423838
mov eax, dword [0x6e7098]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x423743
cmp dword [esi*4 + 0x6e70a0], edi
je 0x42383c
inc esi
cmp esi, eax
jl 0x423731
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x43b120]
test eax, eax
je 0x4238b8
cmp dword [ebp - 8], 0x1000000
jne 0x4238b8
test byte [ebp - 0xc], 0xcc
je 0x4237c1
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x4238b8
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4238b8
cmp word [eax + 0x18], 0x10b
jne 0x4238b8
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x4238b8
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x4237c1
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x4237c1
test byte [ecx + 0x27], 0x80
jne 0x423838
push 1
push 0x6e70e0
call dword [0x43b2ec]
test eax, eax
jne 0x4236d5
mov ecx, dword [0x6e7098]
test ecx, ecx
mov edx, ecx
jle 0x4237f5
lea eax, [ecx*4 + 0x6e709c]
cmp dword [eax], edi
je 0x4237f5
dec edx
sub eax, 4
test edx, edx
jg 0x4237e9
test edx, edx
jne 0x423826
push 0xf
pop ebx
cmp ecx, ebx
jg 0x423802
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x42381a
lea eax, [edx*4 + 0x6e70a0]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x423808
cmp ecx, 0x10
jge 0x423826
inc ecx
mov dword [0x6e7098], ecx
push 0
push 0x6e70e0
call dword [0x43b2ec]
jmp 0x4236d5
xor eax, eax
jmp 0x4238bb
test esi, esi
jle 0x4236d5
mov ebx, dword [0x43b2ec]
push 1
push 0x6e70e0
call ebx
test eax, eax
jne 0x4236d5
cmp dword [esi*4 + 0x6e70a0], edi
je 0x423892
mov eax, dword [0x6e7098]
lea esi, [eax - 1]
test esi, esi
jl 0x423880
cmp dword [esi*4 + 0x6e70a0], edi
je 0x42387c
dec esi
jns 0x423870
test esi, esi
jge 0x423890
cmp eax, 0x10
jge 0x42388b
inc eax
mov dword [0x6e7098], eax
lea esi, [eax - 1]
jmp 0x423892
je 0x4238aa
xor ecx, ecx
test esi, esi
jl 0x4238aa
lea eax, [ecx*4 + 0x6e70a0]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x423898
push 0
push 0x6e70e0
call ebx
jmp 0x4236d5
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x434a42
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x43a2f3
call fcn.0041deac
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00431873
xor edi, edi
lea ecx, [esi + 0x24]
mov dword [ebp - 4], edi
mov dword [esi], 0x442cdc
call fcn.00401a30
mov ebx, dword [ebp + 0x10]
push dword [ebx + 0xc]
mov ecx, 0x6e6a84
push dword [ebp + 8]
mov byte [ebp - 4], 1
call fcn.00434238
push dword [ebp + 0xc]
lea ecx, [esi + 0xc]
call fcn.00401f50
mov eax, dword [ebx + 8]
mov dword [esi + 0x1c], eax
lea eax, [ebp + 0x10]
push eax
mov ecx, ebx
call fcn.00413a8d
push eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.00403720
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.004013e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x18], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x402237
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x402249
xor eax, eax
jmp 0x40235b
cmp dword [0x4061c0], 0
je 0x402257
call fcn.004021e6
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x10], 8
push edi
mov ecx, 0xff
not eax
jb 0x402337
mov edi, dword [ebp + 0x10]
push ebx
shr edi, 3
movzx ebx, byte [esi]
mov edx, eax
sub dword [ebp + 0x10], 8
and edx, ecx
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x4074ac]
xor eax, ebx
inc esi
mov edx, eax
movzx ebx, byte [esi]
and edx, ecx
xor edx, ebx
movzx ebx, byte [esi + 1]
mov edx, dword [edx*4 + 0x4074ac]
shr eax, 8
xor edx, eax
inc esi
mov eax, edx
and eax, ecx
xor eax, ebx
movzx ebx, byte [esi + 1]
mov eax, dword [eax*4 + 0x4074ac]
shr edx, 8
xor eax, edx
inc esi
mov edx, eax
and edx, ecx
xor edx, ebx
movzx ebx, byte [esi + 1]
mov edx, dword [edx*4 + 0x4074ac]
shr eax, 8
xor edx, eax
inc esi
mov eax, edx
and eax, ecx
xor eax, ebx
movzx ebx, byte [esi + 1]
mov eax, dword [eax*4 + 0x4074ac]
shr edx, 8
xor eax, edx
inc esi
mov edx, eax
and edx, ecx
xor edx, ebx
movzx ebx, byte [esi + 1]
mov edx, dword [edx*4 + 0x4074ac]
shr eax, 8
xor edx, eax
inc esi
mov eax, edx
and eax, ecx
xor eax, ebx
movzx ebx, byte [esi + 1]
mov eax, dword [eax*4 + 0x4074ac]
shr edx, 8
xor eax, edx
inc esi
mov edx, eax
and edx, ecx
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4074ac]
xor eax, edx
inc esi
dec edi
jne 0x402273
pop ebx
cmp dword [ebp + 0x10], 0
je 0x402358
movzx edi, byte [esi]
mov edx, eax
and edx, ecx
xor edx, edi
shr eax, 8
mov edx, dword [edx*4 + 0x4074ac]
xor eax, edx
inc esi
dec dword [ebp + 0x10]
jne 0x40233d
not eax
pop edi
pop esi
pop ebp
ret

Function at 0x403c24
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
xor eax, eax
push esi
push eax
push eax
push 3
push eax
push eax
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
shr eax, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
leave
ret

Function at 0x414ddd
Capabilities:
Encode data using xor

Disassembly:
xor dword [ecx], esi
sub ebx, 0x4d2e9569
add ecx, 4
sub eax, 0xf4760e78
inc eax
inc eax
cmp ecx, edi
jne fcn.00414ddd
sub eax, 0x85b214c1
ret
Function at 0x401ca0
Capabilities:
Check mutex on windows

Disassembly:
push esi
push edi
mov esi, ecx
call sub.mfc90.dll_Ordinal_4993
push 0
push 0x80000000
push 0xc40080
mov ecx, esi
call sub.mfc90.dll_Ordinal_4513
push 0
push 0x80000
push 0x40001
mov ecx, esi
call sub.mfc90.dll_Ordinal_4516
mov eax, dword [esi + 0x78]
mov ecx, dword [esi + 0x20]
push 1
push 0
push eax
push ecx
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov edx, dword [esi + 0x78]
push edx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push str.UpdateLogin
push 0
push 0
mov dword [esi + 0x74], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401d16
mov eax, dword [esi]
mov edx, dword [eax + 0x160]
mov ecx, esi
call edx
mov eax, dword [esi + 0x88]
mov ecx, dword [esi + 0x20]
push eax
push 1
push 0x80
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push str.GXDCompress.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x401d5c
push str.uncompress
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40edd4], eax
test eax, eax
je 0x401d5c
mov dword [0x40edc8], 0xffffffff
call fcn.00401dd0
lea edi, [esi + 0x84]
push str.http:__www.lozhu.com.cn_mod_luncherlozhu.html
mov ecx, edi
call dword [sym.imp.mfc90.dll_Ordinal_820]
push 0
mov ecx, esi
call sub.mfc90.dll_Ordinal_6740
mov edx, dword [edi]
push 0
push 0
push 0
push 0
push edx
push 0x40d200
push 0
push 0
push 1
lea eax, [esi + 0x90]
push 0x68
push eax
call sub.mfc90.dll_Ordinal_4281
add esp, 0x2c
push 0
push 0
push 0
push 0
push esi
push 0x4023d0
call sub.mfc90.dll_Ordinal_1062
push esi
mov dword [esi + 0x7c], eax
call fcn.00401f70
pop edi
mov eax, 1
pop esi
ret
Function at 0x401dd0
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x406c68
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x40d018]
xor eax, esp
mov dword [esp + 0x274], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x40d018]
xor eax, esp
push eax
lea eax, [esp + 0x28c]
mov dword fs:[0], eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_316]
push 0x190
lea eax, [esp + 0xfc]
xor ebx, ebx
push eax
push ebx
mov dword [esp + 0x2a0], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0xfc]
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
jne 0x401e56
push ebx
push ebx
push str.None_VerSion_Supprot
call sub.mfc90.dll_Ordinal_1183
push esi
call sub.mfc90.dll_Ordinal_265
add esp, 4
mov edi, eax
push edi
push esi
push ebx
lea eax, [esp + 0x104]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x28]
push edx
push str.VarFileInfoTranslation
push edi
mov dword [esp + 0x28], ebx
call sub.VERSION.dll_VerQueryValueA
xor esi, esi
test dword [esp + 0x18], 0xfffffffc
jbe 0x401f1e
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esp + 0x24]
movzx ecx, word [eax + esi*4 + 2]
movzx edx, word [eax + esi*4]
push ecx
push edx
lea eax, [esp + 0x38]
push str.StringFileInfo_04x_04xFileVersion
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x38]
push eax
push edi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x38], ebx
call sub.VERSION.dll_VerQueryValueA
mov ecx, dword [esp + 0x1c]
push ecx
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_310]
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x18]
mov byte [esp + 0x298], 1
call dword [sym.imp.mfc90.dll_Ordinal_941]
lea ecx, [esp + 0x20]
mov byte [esp + 0x294], bl
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x18]
inc esi
shr eax, 2
cmp esi, eax
jb 0x401ea0
push edi
call sub.mfc90.dll_Ordinal_800
add esp, 4
lea ecx, [esp + 0x14]
push ecx
mov ecx, 0x40ee20
call dword [sym.imp.mfc90.dll_Ordinal_817]
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x28c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x274]
xor ecx, esp
call fcn.00405fb6
add esp, 0x284
ret
Function at 0x4035e0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x40706c
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push ebp
push esi
push edi
mov eax, dword [0x40d018]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_316]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x6c], 0
call sub.mfc90.dll_Ordinal_579
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_316]
lea eax, [esp + 0x40]
push eax
mov byte [esp + 0x70], 2
call fcn.00404ef0
mov ecx, dword [esp + 0x7c]
push 0
mov byte [esp + 0x70], 3
mov eax, dword [ecx]
push 2
push eax
lea ecx, [esp + 0x38]
call sub.mfc90.dll_Ordinal_5528
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x30]
call sub.mfc90.dll_Ordinal_5776
test eax, eax
je 0x403694
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_6670]
lea eax, [esp + 0x18]
push eax
lea edi, [esp + 0x24]
lea ebx, [esp + 0x44]
call fcn.00404e00
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x30]
call sub.mfc90.dll_Ordinal_5776
test eax, eax
jne 0x403666
lea ecx, [esp + 0x2c]
call sub.mfc90.dll_Ordinal_1568
mov eax, dword [esp + 0x5c]
test eax, eax
jle 0x403759
cmp eax, 1
jne 0x4036ec
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x58]
mov esi, dword [edx]
mov edi, dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
test eax, eax
jne 0x4036e8
call edi
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x4036cd
call edi
mov ecx, dword [esp + 0x78]
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov ecx, dword [esp + 0x74]
push eax
call dword [sym.imp.mfc90.dll_Ordinal_817]
jmp 0x403767
mov eax, dword [eax]
jmp 0x4036c6
mov eax, dword [esp + 0x58]
mov ebx, dword [eax]
mov edi, dword [esp + 0x40]
lea esi, [esp + 0x20]
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ebx
call fcn.004054f0
mov ebp, dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
test edi, edi
jne 0x403751
call ebp
xor edi, edi
cmp ebx, dword [edi + 0x18]
jne 0x40371c
call ebp
mov ecx, dword [esp + 0x74]
add ebx, 0xc
push ebx
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x403755
call ebp
xor eax, eax
mov esi, dword [esp + 0x24]
cmp esi, dword [eax + 0x18]
jne 0x403741
call ebp
mov ecx, dword [esp + 0x78]
add esi, 0xc
push esi
call dword [sym.imp.mfc90.dll_Ordinal_817]
jmp 0x403767
mov edi, dword [edi]
jmp 0x403715
mov eax, dword [eax]
jmp 0x403736
push 0
push 0
push 0x409e28
call sub.mfc90.dll_Ordinal_1183
push str.SERVERVER.INI
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea esi, [esp + 0x40]
mov byte [esp + 0x6c], 4
call fcn.00405200
mov ecx, dword [esp + 0x40]
push ecx
call sub.mfc90.dll_Ordinal_800
add esp, 4
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ecx, [esp + 0x2c]
mov byte [esp + 0x6c], 0
call sub.mfc90.dll_Ordinal_780
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, 1
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret 0xc
Function at 0x403900
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x406b4b
mov eax, dword fs:[0]
push eax
sub esp, 0x40c
mov eax, dword [0x40d018]
xor eax, esp
mov dword [esp + 0x404], eax
push esi
push edi
mov eax, dword [0x40d018]
xor eax, esp
push eax
lea eax, [esp + 0x418]
mov dword fs:[0], eax
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.PRESENTVERSION.DAT
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4039bf
push 0x1001
push str.PRESENTVERSION.DAT
lea ecx, [esp + 0x1c]
mov dword [0x40edbc], 1
call sub.mfc90.dll_Ordinal_403
push 5
push str.00001
lea ecx, [esp + 0x1c]
mov dword [esp + 0x428], 0
call sub.mfc90.dll_Ordinal_6793
lea ecx, [esp + 0x14]
call sub.mfc90.dll_Ordinal_1555
mov ecx, edi
call fcn.00403900
lea ecx, [esp + 0x14]
mov dword [esp + 0x420], esi
call sub.mfc90.dll_Ordinal_663
jmp 0x403a1b
push 0
lea eax, [esp + 0x14]
push eax
push 5
lea ecx, [esp + 0x30]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403a0a
cmp dword [esp + 0x10], 5
jne 0x403a0a
mov edi, dword [sym.imp.MSVCR90.dll_atoi]
lea edx, [esp + 0x24]
push edx
mov byte [esp + 0x2d], 0
call edi
mov dword [0x40edc0], eax
lea eax, [esp + 0x28]
push eax
call edi
add esp, 8
cmp eax, 1
mov dword [0x40edbc], eax
jge 0x403a14
mov dword [0x40edbc], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [esp + 0x418]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.00405fb6
mov esp, ebp
pop ebp
ret
Function at 0x404d40
Capabilities:
Delete file
Write file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push esi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x404d79
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
push ecx
push edx
lea eax, [esp + 0x1c]
push eax
push esi
call dword [0x40edd4]
add esp, 0x10
test eax, eax
je 0x404d80
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
pop esi
pop ecx
ret 0xc
push edi
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x404dc7
mov edx, dword [esp + 0x18]
push 0
lea ecx, [esp + 0xc]
push ecx
push edx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
test eax, eax
jne 0x404dd6
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
xor eax, eax
pop esi
pop ecx
ret 0xc
mov eax, dword [esp + 0xc]
cmp eax, dword [esp + 0x1c]
jne 0x404dba
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x404dc0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, 1
pop esi
pop ecx
ret 0xc

Function at 0x405fb6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40d018]
jne 0x405fc0
repz ret
jmp fcn.004064b0