joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b0f0
Capabilities:
Delete directory

Disassembly:
sub esp, 0x41c
push esi
mov esi, ecx
mov eax, dword [esi + 0x60]
test eax, eax
je 0x40b13f
mov ecx, dword [esi + 0x5c]
mov esi, dword [esi + 0x3c]
xor eax, eax
lea edx, [esp + 4]
mov dword [esp + 8], eax
push edx
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x29
mov dword [esp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov eax, dword [0x5e30f0]
push esi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
add esp, 0x41c
ret 8
mov eax, dword [esp + 0x428]
test eax, eax
je 0x40b155
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [esp + 0x42c]
push 0
lea ecx, [esp + 0x1c]
push 0x103
push ecx
push edi
mov ecx, esi
call fcn.0040aff0
lea edx, [esp + 0x18]
push 1
push edx
call fcn.00433970
push 0
push 0
lea eax, [esp + 0x28]
push 0
push eax
call fcn.0048e170
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
add esp, 0x18
cmp edi, 0xffffffff
je 0x40b1da
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x18]
push eax
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1c]
push 0x103
push ecx
push 0xffffffffffffffff
mov ecx, esi
call fcn.0040aff0
lea edx, [esp + 0x18]
push edx
call ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x222]
mov word [esp + 0x220], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
lea eax, [esp + 0x224]
push 0x103
push eax
mov ecx, esi
call fcn.0040af70
lea ecx, [esp + 0x220]
push ecx
call ebx
pop edi
pop ebx
pop esi
add esp, 0x41c
ret 8

Function at 0x40b230
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x60a524]
sub esp, 0x208
test eax, eax
je 0x40b274
push 0
push 0x4efa2c
call fcn.0040ad90
mov ecx, dword [esp + 0x20c]
push eax
mov eax, dword [esp + 0x214]
push 0x4ee160
dec eax
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
add esp, 0x208
ret 8
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
push edx
push 0x103
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, dword [esp + 0x214]
mov edx, dword [esp + 0x210]
lea eax, [esp + 4]
push 0x4efa2c
push eax
dec ecx
push 0x4ef374
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
pop edi
add esp, 0x208
ret 8
Function at 0x40b3b3
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
push 1
call fcn.004847e0
add esp, 4
mov ecx, esi
call fcn.00409f30
call fcn.004501f0
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40b431
lea ecx, [esp + 0xc]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 4]
push 0
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x1f0fff
mov dword [esi + 0x48], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esi + 0x14], eax
call fcn.00452de0
mov ecx, eax
call fcn.00452e30
call fcn.0047b190
mov ecx, eax
call fcn.0047b1e0
push str.Extensions
call fcn.00423e30
mov ecx, eax
call fcn.00425ea0
mov ecx, esi
call fcn.0040b300
mov ecx, 0x5e3898
call fcn.004a1cd0
mov ecx, esi
call fcn.0040b5f0
pop esi
add esp, 0x14
ret

Function at 0x40b4e0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x208
add ecx, 0x64
push ecx
call fcn.00489c90
add esp, 4
test eax, eax
jne 0x40b5df
push edi
mov ecx, 0x81
lea edi, [esp + 6]
mov word [esp + 4], ax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x214]
pop edi
test eax, eax
je 0x40b583
mov ecx, dword [0x5e6a08]
lea eax, [esp]
push 0x103
push eax
push 0xc389
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x44
push 0xc38b
call fcn.0047f2c0
add esp, 4
lea edx, [esp + 4]
push eax
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x40b569
push str.http:__se.360.cn
call fcn.004429e0
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
add esp, 0x208
ret 8
mov eax, dword [0x4ef3fc]
test eax, eax
je 0x40b5d4
mov ecx, dword [0x5e6a08]
lea eax, [esp]
push 0x103
push eax
push 0xc38a
push ecx
mov dword [0x4ef3fc], 0
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x40
push 0xc38b
call fcn.0047f2c0
add esp, 4
lea edx, [esp + 4]
push eax
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
add esp, 0x208
ret 8
mov eax, 1
add esp, 0x208
ret 8
Function at 0x40b600
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x208
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
push 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 8]
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
pop edi
je 0x40b681
lea ecx, [esp]
push str.360SE
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [esp]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40b681
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40b681
test al, 0x10
jne 0x40b681
lea ecx, [esp]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x208
ret

Function at 0x40b780
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x40b7af
push 0
push esi
call fcn.00433340
add esp, 8
test eax, eax
je 0x40b7af
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x40b7af
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
ret

Function at 0x40bc10
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
xor ebx, ebx
push esi
cmp ebp, ebx
push edi
jne 0x40bc23
mov ebp, str.Main
mov esi, dword [esp + 0x20]
lea eax, [esi + esi]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [0x50f39c]
mov edi, dword [esp + 0x1c]
add esp, 4
cmp ecx, ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], ebx
je 0x40bc80
mov eax, dword [0x50f3bc]
test eax, eax
jne 0x40bc67
push str.GetAppValue
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x50f3bc], eax
je 0x40bc78
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
push esi
push edx
push edi
push ebp
call eax
mov ebx, eax
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x40bca6
mov ecx, 0x50b1e0
call fcn.0040ab70
push eax
mov eax, dword [esp + 0x18]
push esi
push eax
push 0x50b1d0
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ecx, ecx
cmp ecx, eax
sbb ebx, ebx
neg ebx
test ebx, ebx
je 0x40bcf0
test esi, esi
je 0x40bcf0
cmp esi, 0x7fffffff
ja 0x40bcf0
mov eax, dword [esp + 0x1c]
mov edi, SysReAllocString
mov edx, esi
sub edi, esi
mov esi, dword [esp + 0x14]
sub esi, eax
lea ecx, [edi + edx]
test ecx, ecx
je 0x40bce4
mov cx, word [esi + eax]
test cx, cx
je 0x40bce4
mov word [eax], cx
add eax, 2
dec edx
jne 0x40bcc9
jmp 0x40bce8
test edx, edx
jne 0x40bceb
sub eax, 2
mov word [eax], 0
mov edx, dword [esp + 0x14]
push edx
call fcn.004d2e69
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x40bd90
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x20c
test eax, eax
je 0x40be79
push ebx
mov ebx, dword [esp + 0x214]
push esi
push edi
test ebx, ebx
jne 0x40bdb5
mov ebx, str.Main
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
mov ecx, dword [0x50f39c]
xor esi, esi
stosw word es:[edi], ax
mov edi, dword [esp + 0x220]
mov dword [esp + 0xc], esi
test ecx, ecx
je 0x40be1d
mov eax, dword [0x50f3c4]
test eax, eax
jne 0x40be00
push str.GetAppValue
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x50f3c4], eax
je 0x40be15
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push 0x103
push edx
push edi
push ebx
call eax
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x40be47
mov ecx, 0x50b1e0
call fcn.0040ab70
push eax
lea eax, [esp + 0x14]
push 0x103
push eax
push 0x50b1d0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ecx, ecx
cmp ecx, eax
sbb esi, esi
neg esi
pop edi
test esi, esi
pop esi
pop ebx
je 0x40be79
cmp word [esp + 4], 0
je 0x40be79
lea edx, [esp + 4]
push edx
call dword [sym.imp.MSVCRT.dll__wtoi]
mov ecx, dword [esp + 0x21c]
add esp, 4
mov dword [ecx], eax
mov eax, 1
add esp, 0x20c
ret
xor eax, eax
add esp, 0x20c
ret
Function at 0x40bfe0
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x20004
call fcn.004d2e90
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20014]
test esi, esi
push edi
jne 0x40bffe
mov esi, str.Main
mov ebp, dword [esp + 0x2002c]
mov ebx, 1
test ebp, ebp
je 0x40c1f6
mov edi, dword [esp + 0x20030]
test edi, edi
je 0x40c1f6
cmp dword [edi], 0
jbe 0x40c1f6
mov eax, dword [esp + 0x20028]
mov dword [esp + 0x10], 0
mov dword [eax], ebx
mov ecx, dword [0x50f39c]
test ecx, ecx
je 0x40c098
mov eax, dword [0x50f3d0]
test eax, eax
jne 0x40c063
push str.EnumAppValue
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x50f3d0], eax
je 0x40c08c
mov edx, dword [esp + 0x20024]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x20024]
push edi
push ebp
push edx
mov edx, dword [esp + 0x2002c]
push ecx
push edx
push esi
call eax
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x40c1e9
mov ecx, 0x7fff
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x50b1e0
xor edi, edi
call fcn.0040ab70
push eax
lea eax, [esp + 0x18]
push 0x10000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
test eax, eax
jbe 0x40c1e9
cmp word [esp + 0x14], di
lea esi, [esp + 0x14]
je 0x40c1e9
mov ebp, dword [sym.imp.MSVCRT.dll_wcschr]
push 0x3d
push esi
call ebp
add esp, 8
test eax, eax
je 0x40c10a
mov ecx, dword [esp + 0x2001c]
mov word [eax], 0
cmp edi, ecx
je 0x40c135
mov word [eax], 0x3d
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc edi
lea esi, [esi + eax*2 + 2]
cmp edi, 0xbb8
jae 0x40c1e9
cmp word [esi], 0
jne 0x40c0e9
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x20004
ret
mov ecx, dword [esp + 0x20024]
mov edx, dword [ecx]
test edx, edx
je 0x40c183
cmp edx, 0x7fffffff
ja 0x40c183
mov ecx, dword [esp + 0x20020]
mov ebx, SysReAllocString
sub ebx, edx
mov edi, edx
sub esi, ecx
lea edx, [ebx + edi]
test edx, edx
je 0x40c177
mov dx, word [esi + ecx]
test dx, dx
je 0x40c177
mov word [ecx], dx
add ecx, 2
dec edi
jne 0x40c15c
jmp 0x40c17b
test edi, edi
jne 0x40c17e
sub ecx, 2
mov word [ecx], 0
mov ecx, dword [esp + 0x20030]
mov edx, dword [ecx]
shr edx, 1
je 0x40c1e7
cmp edx, 0x7fffffff
ja 0x40c1e7
mov ecx, dword [esp + 0x2002c]
mov esi, SysReAllocString
sub esi, edx
sub eax, ecx
lea edi, [eax + 2]
lea eax, [esi + edx]
test eax, eax
je 0x40c1db
mov ax, word [edi + ecx]
test ax, ax
je 0x40c1db
mov word [ecx], ax
add ecx, 2
dec edx
jne 0x40c1ab
sub ecx, 2
xor ebx, ebx
pop edi
pop esi
mov eax, ebx
pop ebp
mov word [ecx], 0
pop ebx
add esp, 0x20004
ret
test edx, edx
jne 0x40c1e2
sub ecx, 2
mov word [ecx], 0
xor ebx, ebx
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x20004
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20004
ret
Function at 0x40c210
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x220
push ebx
push edi
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x22]
mov word [esp + 0x20], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [esp + 0x22c]
lea eax, [esp + 0x20]
push edi
push 0x4ee160
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov ecx, dword [0x50f39c]
add esp, 0x10
test ecx, ecx
mov dword [esp + 8], ebx
je 0x40c290
mov eax, dword [0x50f3d4]
test eax, eax
jne 0x40c27a
push str.AppKeyExists
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x50f3d4], eax
je 0x40c288
lea ecx, [esp + 8]
lea edx, [esp + 0x20]
push ecx
push edx
call eax
mov ebx, eax
mov eax, dword [esp + 8]
test eax, eax
jne 0x40c2d8
xor eax, eax
mov ecx, 0x50b1e0
mov dword [esp + 0xe], eax
mov word [esp + 0xc], 0
mov dword [esp + 0x12], eax
mov dword [esp + 0x16], eax
mov dword [esp + 0x1a], eax
mov word [esp + 0x1e], ax
call fcn.0040ab70
push eax
lea ecx, [esp + 0x10]
push 8
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
xor edx, edx
pop edi
cmp edx, eax
pop ebx
sbb eax, eax
neg eax
add esp, 0x220
ret
mov eax, ebx
pop edi
pop ebx
add esp, 0x220
ret

Function at 0x40c6c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d5f38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.004d1340
xor edi, edi
lea ecx, [esi + 0x34]
mov dword [esp + 0x14], edi
call fcn.0041be30
mov dword [esi + 0x24], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov ecx, 0x82
xor eax, eax
lea edi, [esi + 0x62cd8]
mov dword [esi], 0x4dabcc
rep stosd dword es:[edi], eax
mov ecx, 0x412
lea edi, [esi + 0x630e8]
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esi + 0x62ee0]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x40c930
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x25c
mov ax, word [0x50b1d0]
mov edx, dword [0x5e6a0c]
push edi
mov word [esp + 0x58], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x5a]
push str.seup.exe
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x5c]
push 0x104
push ecx
push edx
stosw word es:[edi], ax
call fcn.00433350
lea eax, [esp + 0x68]
push eax
call fcn.00443650
add esp, 0x14
test eax, eax
je 0x40c9ea
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 4], eax
rep stosd dword es:[edi], eax
xor ecx, ecx
lea edx, [esp + 4]
mov dword [esp + 8], ecx
lea eax, [esp + 0x14]
mov dword [esp + 0xc], ecx
push edx
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [esp + 0x2c], ecx
push ecx
lea ecx, [esp + 0x78]
mov dword [esp + 0x34], 0x44
push ecx
push 0
mov word [esp + 0x6c], 5
mov dword [esp + 0x68], 0x80
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40c9ea
mov edx, dword [esp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 8]
push eax
call esi
pop esi
pop edi
add esp, 0x25c
ret 4
Function at 0x40cb0e
Capabilities:
Delete file
Read .ini file

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x210]
push esi
mov esi, ecx
push edi
push ebx
lea edi, [esi + 0x62ee0]
push 0x103
push edi
push 0x50b1d0
push str.TheWorld.exe
push 0x4efc74
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push str.3.6.1.0
push edi
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
test eax, eax
jle 0x40cb6d
push ebx
mov ecx, esi
call fcn.0040ccb0
test eax, eax
je 0x40cb6d
mov ecx, esi
call fcn.0040cbe0
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
pop ebx
add esp, 0x208
ret 4
mov eax, dword [esi + 0x24]
test eax, eax
je 0x40cbc5
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
mov ecx, dword [0x5e6a08]
push 0x104
stosw word es:[edi], ax
lea eax, [esp + 0x10]
push eax
push 0xc37a
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x40
push 0x32
call fcn.0047f2c0
add esp, 4
lea edx, [esp + 0x10]
push eax
push edx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
pop ebx
add esp, 0x208
ret 4

Function at 0x40ccb0
Capabilities:
Get geographical location
Read .ini file

Disassembly:
sub esp, 0x21c
xor eax, eax
push ebx
mov dword [esp + 6], eax
push esi
mov dword [esp + 0xe], eax
mov esi, ecx
mov dword [esp + 0x12], eax
push edi
mov dword [esp + 0x1a], eax
mov ecx, 0x81
lea edi, [esp + 0x22]
mov word [esp + 0x1e], ax
mov word [esp + 0x20], ax
push 9
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
mov word [esp + 0x10], 0
push ecx
push 3
push 0x50b244
stosw word es:[edi], ax
call fcn.00442bd0
add esp, 4
and eax, 0xffff
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea edx, [esp + 0xc]
push edx
call fcn.0048cbe0
add esp, 4
lea eax, [esp + 0xc]
lea ecx, [esp + 0x20]
push eax
push str.url__s
push 0x103
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov edi, dword [esp + 0x23c]
add esp, 0x10
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esi, 0x630e8
push edi
push 0x823
push esi
lea edx, [esp + 0x2c]
push 0x50b1d0
push edx
push str.TheWorld.exe
call ebx
cmp word [esi], 0
jne 0x40cd80
push edi
push 0x823
push esi
push 0x50b1d0
push 0x4ef36c
push str.TheWorld.exe
call ebx
xor eax, eax
pop edi
cmp word [esi], ax
pop esi
pop ebx
setne al
add esp, 0x21c
ret 4
Function at 0x40cef0
Capabilities:
Delete file
Hide graphical window

Disassembly:
sub esp, 0x208
push ebx
mov ebx, ecx
push esi
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x40cf14
mov ecx, 0x50b1e0
call fcn.004094b0
pop esi
pop ebx
add esp, 0x208
ret
push ebp
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
lea esi, [ebx + 0x62cd8]
push 0x103
push esi
mov ecx, ebx
stosw word es:[edi], ax
call fcn.0040d180
push esi
call fcn.00433c00
mov ebp, dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 4
lea eax, [esp + 0x10]
push esi
push str._stheworld.zip
push 0x103
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esi, [ebx + 0x34]
mov ecx, esi
call fcn.0041c400
mov ecx, esi
call fcn.0041c750
mov ecx, esi
call fcn.0041c420
lea edx, [esi + 0x5d0d0]
mov ecx, 0x82
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
push 0x4ee160
push 0x104
push edx
call ebp
lea edx, [esi + 0x5d4e0]
mov ecx, 0x412
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
add esp, 0x10
lea ecx, [ebx + 0x630e8]
push ecx
push 0x4ee160
push 0x824
push edx
call ebp
add esp, 0x10
mov ecx, esi
mov dword [esi + 0x269c], 0x40d1e0
mov dword [esi + 0x2698], ebx
call fcn.0041c350
pop edi
pop ebp
test eax, eax
je 0x40d054
mov edx, dword [ebx + 0x28]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 1
push edx
call esi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [ebx + 0x28]
push 0
push 0
push 0x402
push 0x3f0
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebx + 0x28]
push 5
push 0x3f0
push ecx
call esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xc36c
call fcn.0047f2c0
mov edx, dword [ebx + 0x28]
add esp, 4
push eax
push 0x42e
push edx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
pop esi
pop ebx
add esp, 0x208
ret

Function at 0x40d180
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 4]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edx, dword [esp + 0x214]
mov eax, dword [esp + 0x210]
lea ecx, [esp + 4]
push ecx
push str._sTheWorld_
push edx
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
pop edi
add esp, 0x208
ret 8
Function at 0x40d21c
Capabilities:
Create process on windows
Delete directory
Delete file
Hide graphical window

Disassembly:
mov eax, 0x128c
call fcn.004d2e90
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 0
mov eax, dword [esi + 0x28]
push 0x3f0
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea ebx, [esi + 0x62cd8]
lea ebp, [esi + 0x5d104]
push ebx
push ebp
call fcn.004d1e50
add esp, 8
test eax, eax
je 0x40d3ad
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x4e]
mov word [esp + 0x4c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x411
xor eax, eax
lea edi, [esp + 0x256]
mov word [esp + 0x254], 0
rep stosd dword es:[edi], eax
push str.TheWorld.exe
push ebx
stosw word es:[edi], ax
mov edi, dword [sym.imp.MSVCRT.dll__snwprintf]
push 0x4ef374
lea ecx, [esp + 0x58]
push 0x103
push ecx
call edi
add esp, 0x14
lea edx, [esp + 0x4c]
lea eax, [esp + 0x254]
push edx
push 0x4ef6d8
push 5
push str._tp:
push str._s_d__s_s
push 0x823
push eax
call edi
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0x30]
add esp, 0x1c
rep stosd dword es:[edi], eax
mov eax, dword [0x5e27b0]
lea ecx, [esp + 0x254]
test eax, eax
mov dword [esp + 0x10], 0x3c
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x20], 0x50b244
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], str.open
je 0x40d319
mov dword [esp + 0x1c], str.runas
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40d3ad
mov eax, dword [esp + 0x48]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc366
mov dword [esi + 0x30], 1
call fcn.0047f2c0
mov edx, dword [esi + 0x28]
mov edi, dword [sym.imp.USER32.dll_SetDlgItemTextW]
add esp, 4
push eax
push 0x42e
push edx
call edi
push 0xc368
call fcn.0047f2c0
add esp, 4
push eax
mov eax, dword [esi + 0x28]
push 1
push eax
call edi
push 0xc369
call fcn.0047f2c0
mov ecx, dword [esi + 0x28]
add esp, 4
push eax
push 2
push ecx
call edi
mov edx, dword [esi + 0x28]
push 1
push 1
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x40d3b4
mov ecx, esi
call fcn.0040d3d0
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x128c
ret