joyce8/EMBER2024-capa huggingface dataset:
Function at 0x524898
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, eax
cmp byte [ebx + 0x87], 0
je 0x5248d3
cmp dword [ebx + 0x5c], 0
je 0x5248d3
mov eax, dword [ebx + 0x5c]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb8]
mov edx, eax
mov eax, esi
call fcn.0051c9a4
xor eax, eax
mov dword [ebx + 0x5c], eax
mov byte [ebx + 0x87], 0
cmp dword [ebx + 0x5c], 0
jne 0x524a1e
cmp dword [ebx + 0x7c], 0
jne 0x5248f9
mov dl, 1
mov eax, dword [0x41b7f4]
call fcn.00403464
mov dword [ebx + 0x7c], eax
cmp dword [ebx + 0xc], 0
je 0x5249f7
mov eax, dword [ebx + 0xc]
push eax
mov al, byte [0x524a24]
push eax
mov al, byte [0x524a28]
push eax
push 0
mov eax, dword [ebx + 0x7c]
push eax
mov eax, dword [0x58f06c]
push eax
mov ecx, dword [ebx + 0x68]
mov dl, 1
mov eax, dword [0x4ad8f4]
call fcn.004af884
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x5249f0
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebx + 0x5c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
push eax
mov eax, dword [ebx + 0x64]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb4]
mov edx, eax
mov eax, esi
call fcn.0051c9a4
lea eax, [ebx + 0x10]
push eax
mov eax, dword [ebx + 0x5c]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xc0]
mov edx, eax
mov eax, esi
call fcn.0051c9a4
mov eax, dword [ebx + 0x40]
push eax
lea eax, [ebx + 0x70]
mov ecx, 1
mov edx, dword [0x51a260]
call fcn.004058c4
add esp, 4
mov eax, dword [ebx + 0x30]
cmp eax, 0x1a
jge 0x5249c3
mov edx, dword [0x58f2f4]
mov al, byte [edx + eax]
mov byte [ebx + 0x74], al
jmp 0x5249d4
cmp eax, 0x1007
jne 0x5249d0
mov byte [ebx + 0x74], 0x18
jmp 0x5249d4
mov byte [ebx + 0x74], 0
mov eax, dword [ebx + 0x40]
mov dword [ebx + 0x78], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x524a1e
mov eax, dword [ebp - 4]
call fcn.00403494
ret
lea eax, [ebx + 0x5c]
push eax
push 0
push 0
mov eax, dword [ebx + 0x64]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb4]
mov edx, eax
mov eax, esi
call fcn.0051c9a4
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5307fc
Capabilities:
Write file on windows

Disassembly:
add esp, 0xffffffb8
mov dword [esp], eax
mov eax, dword [0x58f244]
cmp byte [eax], 0
je 0x53085b
mov eax, dword [0x58ee70]
call fcn.00402afc
call fcn.00402948
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 8]
call fcn.00409810
push eax
lea eax, [esp + 0xc]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 8]
push eax
push 2
push 0x5308a0
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x530891
push 0x40
lea eax, [esp + 0xc]
push eax
mov eax, dword [0x58eddc]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x590668]
call fcn.00405acc
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 8]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x48
ret
Function at 0x532dc4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0x200
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.kernel32.dll_GetLocaleInfoA_1
push 0x58b88f
lea ecx, [ebp - 0x200]
push ecx
call fcn.005309ac
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.0053096c
pop ecx
mov edx, 0x200
sub edx, eax
push edx
lea ecx, [ebp - 0x200]
push ecx
call fcn.0053096c
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
push 0x58b891
lea ecx, [ebp - 0x200]
push ecx
call fcn.005309ac
add esp, 8
push 0xa
lea eax, [ebp - 0x200]
push eax
call fcn.0053096c
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.005348dc
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x532ed5
push esi
call fcn.0053096c
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.0053096c
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.005308a4
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x532eac
xor eax, eax
jmp 0x532f5c
push esi
call fcn.0053096c
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.0053096c
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.00530938
add esp, 0xc
jmp 0x532f15
mov edi, dword [ebx + 0x24]
push edi
call fcn.0053096c
pop ecx
push eax
push esi
call fcn.0053096c
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.0053096c
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.005308e0
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x532f15
xor eax, eax
jmp 0x532f5c
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.005309ac
add esp, 8
push 0x58b893
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.005309ac
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x24]
push edx
call fcn.005309ac
add esp, 8
push 0x58b895
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.005309ac
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5359ba
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 4]
push ecx
push 0
push 0x4001f
push 0
push 0
push 0
push eax
push 0x80000000
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x535a0e
push esi
call fcn.0053096c
pop ecx
inc eax
push eax
push esi
push 1
push 0
push edi
push dword [ebp - 4]
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x566db4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x2d4], 0
jne 0x566e00
mov ecx, ebx
mov dl, 1
mov eax, dword [0x4c493c]
call fcn.004c8744
mov esi, eax
mov dword [ebx + 0x2d4], esi
xor edx, edx
mov eax, esi
call fcn.00456018
mov edx, ebx
mov eax, dword [ebx + 0x2d4]
mov ecx, dword [eax]
call dword [ecx + 0x68]
push 0
mov eax, dword [ebx + 0x2d4]
call fcn.0045c9ac
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x2d4]
pop esi
pop ebx
ret

Function at 0x406d52
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4074d0
push 0x406e90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x40818c], 0xffffffff
or dword [0x408190], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x408178]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x408174]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x408194], eax
call fcn.00406e89
cmp dword [0x40801c], 0
jne 0x406dd5
push 0x406e86
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.00406e74
push 0x40800c
push 0x408008
call sub.MSVCRT.dll__initterm
mov eax, dword [0x408170]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x40816c]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x408004
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call fcn.00406850
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x403960
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
cmp dword [0x417164], 0
jne 0x4039f1
push str.GlobalSeP_Is_Vista_Semaphore
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4039a3
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x417160], 1
jmp 0x4039e7
push 0x94
push 0
lea ecx, [ebp - 0xa0]
push ecx
call fcn.004078c0
add esp, 0xc
mov dword [ebp - 0xa0], 0x94
lea edx, [ebp - 0xa0]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4039e7
cmp dword [ebp - 0x9c], 6
jne 0x4039e7
mov dword [0x417160], 1
mov dword [0x417164], 1
mov eax, dword [0x417160]
mov esp, ebp
pop ebp
ret
Function at 0x403ba0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
cmp dword [ebp + 8], 0
je 0x403d2d
cmp dword [ebp + 8], 0xffffffff
je 0x403d2d
push 4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x403d2d
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
movzx eax, word [edx]
cmp eax, 0x5a4d
jne 0x403d2d
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
jne 0x403d2d
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x78]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x14], 0
je 0x403d2d
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp + 8]
je 0x403d2d
cmp dword [ebp + 0xc], 0x10000
jae 0x403cd3
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp + 8]
je 0x403cd1
mov dword [ebp - 0x10], 0
jmp 0x403c9d
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x403cd1
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
movzx edx, word [ecx + eax*2]
cmp edx, dword [ebp + 0xc]
jne 0x403ccf
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0xc], ecx
jmp 0x403cd1
jmp 0x403c94
jmp 0x403d2d
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp + 8]
je 0x403d2d
mov dword [ebp - 0x10], 0
jmp 0x403ced
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp edx, dword [ecx + 0x18]
jae 0x403d2d
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx*4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x403d2b
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x20]
movzx eax, word [edx + ecx*2]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0xc], edx
jmp 0x403d2d
jmp 0x403ce4
cmp dword [ebp - 0xc], 0
jne 0x403d46
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
jmp 0x403d4c
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov esp, ebp
pop ebp
ret
Function at 0x4042e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x403d60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x41715c], eax
xor eax, eax
cmp dword [0x41715c], 0
setne al
mov esp, ebp
pop ebp
ret

Function at 0x404340
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
call fcn.00404aa0
test eax, eax
jne 0x4043ee
mov dword [ebp - 0x14], 0
mov eax, 0x11111111
and eax, 1
je 0x404379
push 0
push 4
call fcn.00404200
mov dword [ebp - 0x18], eax
jmp 0x404380
mov dword [ebp - 0x18], 4
mov ecx, 0x11111111
and ecx, 0x10
je 0x404398
push 0
push 2
call fcn.00404200
mov dword [ebp - 0x10], eax
jmp 0x40439f
mov dword [ebp - 0x10], 2
push 0x30
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x18]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x14], eax
mov ecx, 0x11111111
and ecx, 1
je 0x4043ce
cmp dword [ebp - 0x18], 0
je 0x4043ce
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 0x11111111
and eax, 0x10
je 0x4043e8
cmp dword [ebp - 0x10], 0
je 0x4043e8
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x40442b
call fcn.00407430
mov dword [0x417154], eax
lea edx, [ebp - 8]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
push 0x404320
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40442b
mov ecx, dword [ebp - 0xc]
push ecx
call dword [0x417144]
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x404b30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
jne 0x404be4
cmp dword [0x41716c], 0
jne 0x404be2
push 0x400
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x41716c], eax
cmp dword [0x41716c], 0
je 0x404be2
mov eax, dword [0x41716c]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x404b96
mov ecx, dword [0x41716c]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [0x41716c], 0
jmp 0x404be2
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], edx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 4]
push ecx
movzx edx, word [ebp - 0x10]
push edx
movzx eax, word [ebp - 8]
push eax
movzx ecx, word [ebp - 2]
push ecx
movzx edx, word [ebp - 6]
push edx
mov eax, dword [0x41716c]
push eax
push str._s__d_d_d_d_d._cf
mov ecx, dword [0x41716c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
jmp 0x404c04
cmp dword [0x41716c], 0
je 0x404c04
mov edx, dword [0x41716c]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [0x41716c], 0
mov eax, dword [0x41716c]
mov esp, ebp
pop ebp
ret
Function at 0x405b30
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push 0x41
push 0
lea eax, [ebp - 0x48]
push eax
call fcn.004078c0
add esp, 0xc
push 0x41
lea ecx, [ebp - 0x48]
push ecx
push 0x3e8
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
add ecx, 1
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0x4c]
mov al, byte [edx]
mov byte [ebp - 0x51], al
add dword [ebp - 0x4c], 1
cmp byte [ebp - 0x51], 0
jne 0x405b71
mov ecx, dword [ebp - 0x4c]
sub ecx, dword [ebp - 0x50]
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0x58]
add edx, 1
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x41712c], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x5c], eax
mov ecx, dword [0x41712c]
mov dword [ebp - 0x60], ecx
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x5c]
mov cl, byte [eax]
mov byte [ebp - 0x65], cl
mov edx, dword [ebp - 0x60]
mov al, byte [ebp - 0x65]
mov byte [edx], al
mov ecx, dword [ebp - 0x5c]
add ecx, 1
mov dword [ebp - 0x5c], ecx
mov edx, dword [ebp - 0x60]
add edx, 1
mov dword [ebp - 0x60], edx
cmp byte [ebp - 0x65], 0
jne 0x405bb5
mov esp, ebp
pop ebp
ret
Function at 0x4065d0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x406633
push 0x5c
mov ecx, dword [ebp + 8]
push ecx
call fcn.00407eb6
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x406633
mov edx, dword [ebp - 4]
mov byte [edx], 0
mov eax, dword [ebp + 8]
push eax
call fcn.004065d0
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov byte [ecx], 0x5c
cmp dword [ebp - 8], 0
je 0x406633
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x407150
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
cmp dword [0x41717c], 0
jne 0x4071a1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, 0xbb8
jae 0x4071a1
push 0
push 0
call fcn.004072e0
add esp, 8
mov dword [0x41717c], eax
cmp dword [0x41717c], 0
je 0x407197
jmp 0x4071a1
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40716b
cmp dword [0x41717c], 0
je case.0x4071ca.1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 4
ja case.0x4071ca.1
mov ecx, dword [ebp - 0x410]
jmp dword [ecx*4 + 0x4072cc]
mov edx, dword [0x41717c]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp case.0x4071ca.1
push 0
mov eax, dword [ebp + 0xc]
push eax
push 0x402
push 0x3ea
mov ecx, dword [0x41717c]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.0x4071ca.1
push 0
push 0
push 0x408
push 0x3ea
mov edx, dword [0x41717c]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
add eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
push 0
mov eax, dword [ebp + 0xc]
push eax
push 0x402
push 0x3ea
mov ecx, dword [0x41717c]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.0x4071ca.1
push 0
mov edx, dword [ebp + 0xc]
push edx
call fcn.00404200
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0
je 0x407295
mov eax, dword [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x408]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp - 0x40c]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x408]
push eax
push 0x3e9
mov ecx, dword [0x41717c]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov edx, dword [0x41717c]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [0x41717c]
mov esp, ebp
pop ebp
ret
Function at 0x407320
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
jne 0x4073d4
cmp dword [0x417188], 0
jne 0x4073d2
push 0x400
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x417188], eax
cmp dword [0x417188], 0
je 0x4073d2
mov eax, dword [0x417188]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x407386
mov ecx, dword [0x417188]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [0x417188], 0
jmp 0x4073d2
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], edx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 4]
push ecx
movzx edx, word [ebp - 0x10]
push edx
movzx eax, word [ebp - 8]
push eax
movzx ecx, word [ebp - 2]
push ecx
movzx edx, word [ebp - 6]
push edx
mov eax, dword [0x417188]
push eax
push str._s__d_d_d_d_d.exe
mov ecx, dword [0x417188]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
jmp 0x4073f4
cmp dword [0x417188], 0
je 0x4073f4
mov edx, dword [0x417188]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [0x417188], 0
mov eax, dword [0x417188]
mov esp, ebp
pop ebp
ret

Function at 0x407430
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.00403960
test eax, eax
je 0x40746c
push 1
push str._SeP_MAP_SCAtcBin_OutFilePath
push 0
push 4
call fcn.00403a00
add esp, 0x10
mov dword [ebp - 8], eax
jmp 0x40747e
push str._SeP_MAP_SCAtcBin_OutFilePath
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4074e5
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4074db
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x417150], eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [0x417150]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0xc], 1
mov edx, dword [ebp - 8]
push edx
call dword [0x417144]
call fcn.00403960
test eax, eax
je 0x407506
push 1
push str._SeP_Event_SCAtcBin
push 1
push 2
call fcn.00403ad0
add esp, 0x10
mov dword [ebp - 0x10], eax
jmp 0x407518
push str._SeP_Event_SCAtcBin
push 1
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x407532
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [0x417144]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret