joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463890
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x14]
movzx edx, byte [ecx]
test edx, edx
je 0x4638df
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4638d5
mov edx, dword [ebp + 0x14]
mov byte [edx + 8], 1
mov eax, dword [ebp - 0x10]
xor edx, edx
div dword [ebp + 0xc]
jmp 0x463939
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x1c]
add ecx, dword [ebp - 8]
mov edx, dword [ebp + 0x14]
cmp ecx, dword [edx + 0x18]
jbe 0x4638ff
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x14]
mov edx, dword [eax + 0x18]
sub edx, dword [ecx + 0x1c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x14]
mov eax, dword [ebp + 0x14]
add edx, dword [eax + 0x1c]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.004170c0
add esp, 0xc
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x1c]
add ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov dword [edx + 0x1c], ecx
mov eax, dword [ebp - 4]
xor edx, edx
div dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x463f20
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor eax, dword [ecx]
and eax, 0xff
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
shr ecx, 8
xor ecx, dword [eax*4 + 0x48ba88]
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
and ecx, 0xff
mov edx, dword [ebp + 8]
add ecx, dword [edx + 4]
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
imul edx, edx, 0x8088405
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
shr edx, 0x18
mov eax, dword [ebp + 8]
xor edx, dword [eax + 8]
and edx, 0xff
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x48ba88]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
pop ebp
ret
Function at 0x463fa0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x463fb0
xor eax, eax
jmp 0x46414d
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x46410e
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x48ba88]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x48ba88]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x48ba88]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x48ba88]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x48ba88]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x48ba88]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x48ba88]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x48ba88]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x463fb9
cmp dword [ebp + 0x10], 0
je 0x464147
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x48ba88]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x464114
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x469d70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
jne 0x469d8a
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 4], 0xffffffff
je 0x469d94
mov eax, 0x1000000
jmp 0x469e73
mov edx, dword [ebp - 0x18]
add edx, 0x244
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, dword [ebp - 0x18]
add eax, 0x244
push eax
call fcn.00416af7
add esp, 4
mov ecx, dword [ebp - 0x18]
mov dx, word [ecx + eax*2 + 0x242]
mov word [ebp - 8], dx
movzx eax, word [ebp - 8]
cmp eax, 0x5c
je 0x469df7
movzx ecx, word [ebp - 8]
cmp ecx, 0x2f
je 0x469df7
push 0x48bf3c
push 0x104
mov edx, dword [ebp - 0x18]
add edx, 0x244
push edx
call fcn.0041b9aa
add esp, 0xc
cmp dword [ebp + 0x10], 1
jne 0x469e2b
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x10], eax
xor ecx, ecx
cmp dword [ebp - 0x10], 0xffffffff
setne cl
mov byte [ebp - 0x11], cl
movzx edx, byte [ebp - 0x11]
test edx, edx
jne 0x469e2b
mov eax, 0x2000000
jmp 0x469e73
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00463ae0
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x469e51
mov eax, dword [ebp - 0xc]
jmp 0x469e73
mov ecx, dword [ebp - 4]
push ecx
call fcn.00469040
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [edx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
jne 0x469e71
mov eax, 0x200
jmp 0x469e73
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46e5c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
cmp dword [ebp + 8], 0
jne 0x46e5e6
push 0
push 0
push 0
push 2
mov ecx, dword [ebp - 0x24]
call fcn.0046b580
xor al, al
jmp 0x46e76d
mov ecx, dword [ebp - 0x24]
call fcn.0046dc70
mov ecx, dword [ebp - 0x24]
add ecx, 4
call fcn.00412020
mov dword [ebp - 8], 0
push 2
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.004180f2
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
call fcn.0041a4a1
add esp, 4
mov dword [ebp - 8], eax
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.004180f2
add esp, 0xc
cmp dword [ebp - 8], 0
jg 0x46e64c
push 0
push 0
push 0
push 0xc
mov ecx, dword [ebp - 0x24]
call fcn.0046b580
xor al, al
jmp 0x46e76d
mov eax, dword [ebp - 8]
add eax, 1
push eax
call fcn.00417a33
add esp, 4
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov byte [edx], 0
mov eax, dword [ebp + 8]
push eax
push 1
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.0041a7af
add esp, 0x10
cmp eax, 1
je 0x46e6ae
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0041794e
add esp, 4
push 0
push 0
push 0
push 2
mov ecx, dword [ebp - 0x24]
call fcn.0046b580
xor al, al
jmp 0x46e76d
mov edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x12], 0xd
mov byte [ebp - 0x11], 0xa
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 8]
mov byte [ecx], 0
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
je 0x46e72c
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0xd
jne 0x46e70e
mov eax, dword [ebp - 0xc]
mov byte [eax], 0xa
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0xa
jne 0x46e70c
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x46e72a
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov dl, byte [ecx]
mov byte [eax], dl
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x46e6cb
mov edx, dword [ebp - 0xc]
mov byte [edx], 0
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x24]
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.0041794e
add esp, 4
mov ecx, dword [ebp - 0x24]
call fcn.004124e0
movzx eax, al
neg eax
sbb eax, eax
add eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x46fec0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
sete dl
movzx eax, dl
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4700e0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x470159
mov dword [ebp - 0x18], 1
lea ecx, [ebp - 0x14]
push ecx
push 0x48d294
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov edx, dword [ebp + 8]
neg edx
sbb edx, edx
and edx, 2
mov dword [ebp - 0xc], edx
push 0
push 0
push 0x10
lea eax, [ebp - 0x18]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x470160
Capabilities:
Check mutex on windows
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push str.XYUpdateMutex
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4701c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4701bd
push str.Launcher
push str.LauncherWindow
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4701ae
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0x48d24c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov al, 1
jmp 0x4701ce
xor al, al
jmp 0x4701ce
push 0x48d26c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x472a40
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x334], 1
jne 0x472aa5
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x334], 0
push 0x7d0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x338]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x102
jne 0x472a95
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x338]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x338]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x472dd0
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x870
mov eax, dword [0x499078]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x808], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x806]
push ecx
call fcn.00416c80
add esp, 0xc
push str.cmd.exe__C
lea edx, [ebp - 0x808]
push edx
call fcn.00416f66
add esp, 8
lea ecx, [ebp + 8]
call fcn.00401950
push eax
lea eax, [ebp - 0x808]
push eax
call fcn.00416f38
add esp, 8
mov dword [ebp - 0x868], 0x44
lea ecx, [ebp - 0x868]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor edx, edx
mov word [ebp - 0x838], dx
mov dword [ebp - 0x83c], 0x101
lea eax, [ebp - 0x818]
push eax
lea ecx, [ebp - 0x868]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
lea edx, [ebp - 0x808]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x81c], eax
cmp dword [ebp - 0x81c], 0
jne 0x472eaa
mov dword [ebp - 0x86c], 0
lea ecx, [ebp + 8]
call fcn.00401880
mov eax, dword [ebp - 0x86c]
jmp 0x472f00
mov dword [ebp - 0x820], 0x7530
mov eax, dword [ebp - 0x820]
push eax
mov ecx, dword [ebp - 0x818]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x472ece
jmp 0x472eb4
mov edx, dword [ebp - 0x814]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x818]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x870], 1
lea ecx, [ebp + 8]
call fcn.00401880
mov eax, dword [ebp - 0x870]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041694e
mov esp, ebp
pop ebp
ret
Function at 0x472f10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47c207
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x499078]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x58], ecx
mov ecx, dword [ebp - 0x58]
add ecx, 0x14
call fcn.00401990
movzx eax, al
test eax, eax
je 0x472f52
jmp 0x47300b
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x10]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x472f82
jmp 0x47300b
lea edx, [ebp - 0x18]
push edx
push str.XYClient
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x473001
push str.DisplayVersion
lea ecx, [ebp - 0x54]
call fcn.00401800
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x58]
add ecx, 0x14
push ecx
lea ecx, [ebp - 0x38]
call fcn.00401840
lea ecx, [ebp - 0x38]
call fcn.00401970
shl eax, 1
push eax
lea ecx, [ebp - 0x38]
call fcn.00401950
push eax
push 1
push 0
lea ecx, [ebp - 0x54]
call fcn.00401950
push eax
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x38]
call fcn.00401880
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.00401880
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0041694e
mov esp, ebp
pop ebp
ret
Function at 0x473280
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x499078]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x248], ecx
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x23c], 0
mov ecx, dword [ebp + 8]
call fcn.00401d00
push 0x22c
push 0
lea eax, [ebp - 0x238]
push eax
call fcn.00416c80
add esp, 0xc
mov dword [ebp - 0x238], 0x22c
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x244]
push edx
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
sete al
movzx ecx, al
mov dword [ebp - 0x240], ecx
cmp dword [ebp - 0x240], 1
jne 0x47339c
push 0x22c
call fcn.00416ff2
add esp, 4
mov dword [ebp - 0x23c], eax
push 0x22c
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp - 0x23c]
push eax
call fcn.004170c0
add esp, 0xc
lea ecx, [ebp - 0x23c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004114d0
push 0x22c
push 0
lea edx, [ebp - 0x238]
push edx
call fcn.00416c80
add esp, 0xc
mov dword [ebp - 0x238], 0x22c
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp - 0x244]
push ecx
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
sete dl
movzx eax, dl
test eax, eax
jne 0x473309
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x4733cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4733bd
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x4733cc
mov eax, dword [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041694e
mov esp, ebp
pop ebp
ret 4
Function at 0x4751b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x334], 1
mov ecx, dword [ebp - 4]
add ecx, 0x33c
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
push 0x474f40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x338], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x338], 0
jne 0x4751fc
xor eax, eax
jmp 0x475201
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x47a390
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47ce8f
mov eax, dword fs:[0]
push eax
sub esp, 0x274
mov eax, dword [0x499078]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x278], 0
lea ecx, [ebp - 0x258]
call fcn.004017d0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x274]
push eax
call fcn.0047a2d0
add esp, 4
mov dword [ebp - 0x27c], eax
mov ecx, dword [ebp - 0x27c]
mov dword [ebp - 0x280], ecx
mov byte [ebp - 4], 1
push 0x48c660
mov edx, dword [ebp - 0x280]
push edx
lea eax, [ebp - 0x30]
push eax
call fcn.00404ef0
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x274]
call fcn.00401880
xor ecx, ecx
mov word [ebp - 0x23c], cx
push 0x206
push 0
lea edx, [ebp - 0x23a]
push edx
call fcn.00416c80
add esp, 0xc
lea ecx, [ebp - 0x30]
call fcn.00401950
push eax
push 0x104
lea eax, [ebp - 0x23c]
push eax
push str.ClientUpdate_
push 0x48c694
push str.Update
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x23c]
push ecx
lea ecx, [ebp - 0x258]
call fcn.004018c0
lea edx, [ebp - 0x258]
push edx
mov ecx, dword [ebp + 8]
call fcn.00401840
mov eax, dword [ebp - 0x278]
or eax, 1
mov dword [ebp - 0x278], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00401880
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x258]
call fcn.00401880
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041694e
mov esp, ebp
pop ebp
ret
Function at 0x47a4e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d33e
mov eax, dword fs:[0]
push eax
sub esp, 0x2d0
mov eax, dword [0x499078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x8005
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x47a539
push 0x48c638
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x21c]
push edx
lea ecx, [ebp - 0x2c8]
call fcn.00401800
mov dword [ebp - 4], 0
push str.testconfig.txt
lea ecx, [ebp - 0x2c8]
call fcn.00401920
push 1
lea ecx, [ebp - 0x2ac]
call fcn.004143e0
mov byte [ebp - 4], 1
push 0x40
push 1
lea ecx, [ebp - 0x2c8]
call fcn.00401950
push eax
lea ecx, [ebp - 0x2ac]
call fcn.00414490
lea ecx, [ebp - 0x2ac]
call fcn.00414550
movzx eax, al
test eax, eax
je 0x47a5fb
lea ecx, [ebp - 0x2d8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x2ac]
push eax
call fcn.00416090
add esp, 8
lea ecx, [ebp - 0x2ac]
call fcn.00414570
mov byte [ebp - 0x2d9], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2ac]
call fcn.00413f20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c8]
call fcn.00401880
mov al, byte [ebp - 0x2d9]
jmp 0x47a629
mov byte [ebp - 0x2da], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2ac]
call fcn.00413f20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c8]
call fcn.00401880
mov al, byte [ebp - 0x2da]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041694e
mov esp, ebp
pop ebp
ret
Function at 0x47a760
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d3b7
mov eax, dword fs:[0]
push eax
sub esp, 0x1e0
mov eax, dword [0x499078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x11c]
push eax
push 0
push 0
push 0x8005
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jl 0x47a7b9
push 0x48d0e8
lea ecx, [ebp - 0x11c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [ebp - 0x11c]
push edx
lea ecx, [ebp - 0x138]
call fcn.004016f0
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 0x138]
call fcn.004017b0
push eax
call fcn.00417e3a
add esp, 8
cmp eax, 0xffffffff
jne 0x47a801
lea ecx, [ebp - 0x138]
call fcn.004017b0
push eax
call fcn.00417e52
add esp, 4
push 0x48d0f0
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp - 0x154]
push ecx
call fcn.004072c0
add esp, 0xc
mov byte [ebp - 4], 1
push 1
lea ecx, [ebp - 0x1dc]
call fcn.0040c3b0
mov byte [ebp - 4], 2
push 0x40
push 0xa
lea ecx, [ebp - 0x154]
call fcn.004017b0
push eax
lea ecx, [ebp - 0x1dc]
call fcn.0040c4f0
lea ecx, [ebp - 0x1dc]
call fcn.0040c4d0
movzx edx, al
test edx, edx
je 0x47a9cd
lea eax, [ebp - 0x1ec]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x40b9e0
push 0x48d104
movzx ecx, word [ebp - 0x1e6]
push ecx
push 0x48d108
movzx edx, word [ebp - 0x1ea]
push edx
push 0x48d10c
movzx eax, word [ebp - 0x1ec]
push eax
push 0x48d110
lea ecx, [ebp - 0x1dc]
push ecx
call fcn.00410120
add esp, 8
mov ecx, eax
call fcn.0040bb20
push eax
call fcn.00410120
add esp, 8
mov ecx, eax
call fcn.0040bb20
push eax
call fcn.00410120
add esp, 8
mov ecx, eax
call fcn.0040bb20
push eax
call fcn.00410120
add esp, 8
mov ecx, eax
call fcn.0040bb00
push 0x40b9c0
push 0x48d118
movzx edx, word [ebp - 0x1e0]
push edx
push 0x48d11c
movzx eax, word [ebp - 0x1e2]
push eax
push 0x48d120
movzx ecx, word [ebp - 0x1e4]
push ecx
push 0x48d124
lea edx, [ebp - 0x1dc]
push edx
call fcn.00410120
add esp, 8
mov ecx, eax
call fcn.0040bb20
push eax
call fcn.00410120
add esp, 8
mov ecx, eax
call fcn.0040bb20
push eax
call fcn.00410120
add esp, 8
mov ecx, eax
call fcn.0040bb20
push eax
call fcn.00410120
add esp, 8
mov ecx, eax
call fcn.0040bb00
push 0x40b9c0
mov eax, dword [ebp + 0xc]
push eax
push 0x48d12c
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x1dc]
push edx
call fcn.004103b0
add esp, 8
push eax
call fcn.00410120
add esp, 8
mov ecx, eax
call fcn.0040bcb0
mov ecx, eax
call fcn.0040bb00
push 0x40b9c0
mov eax, dword [ebp + 0x10]
push eax
push str.message:
lea ecx, [ebp - 0x1dc]
push ecx
call fcn.00410120
add esp, 8
push eax
call fcn.004103b0
add esp, 8
mov ecx, eax
call fcn.0040bb00
lea ecx, [ebp - 0x1dc]
call fcn.0040c540
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1dc]
call fcn.0040ba80
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x154]
call fcn.00401770
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call fcn.00401770
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041694e
mov esp, ebp
pop ebp
ret