joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420568
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x4cb0b83
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4205a3
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4205bc
lea eax, [ebp - 0x10]
mov edx, dword [0x4cce5f0]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x4205cf
lea eax, [ebp - 0x10]
mov edx, dword [0x4cce5f0]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x4205db
adc edx, 0
mov edx, dword [edx*4 + 0x4ccd3fc]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x420755
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x420748
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420748
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dec
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x420748
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420748
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x4206e6
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x4206e6
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4206e6
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4206e6
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420748
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420748
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420748
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x420748
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420748
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x42076d
inc ebx
cmp ebx, 0x19
jne 0x420595
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb0b8a
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x401140
Capabilities:
Load windows common language runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x411d5c
call esi
push 0x411d70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40116e
push 0x800
call eax
push 0x411d8c
call esi
push str.CLRCreateInstance
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], 0
test eax, eax
je 0x4011e8
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push 0x411e2c
push 0x411e3c
call eax
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4011e0
mov eax, dword [ecx]
lea edx, [esp + 0x10]
push edx
push 0x411e4c
push str.v4.0.30319
push ecx
call dword [eax + 0xc]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4011e0
mov eax, dword [ecx]
lea edx, [esp + 4]
push edx
push 0x411dfc
push 0x411e1c
push ecx
call dword [eax + 0x24]
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x401207
lea eax, [esp + 4]
push eax
push 0x411dfc
push 0x411e1c
push 0
push 0
push 0
call dword [sym.imp.mscoree.dll_CorBindToRuntimeEx]
mov ecx, dword [esp + 4]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x28]
mov eax, dword [esp + 4]
lea edx, [esp + 0x14]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0xc]
push edx
push 0x411e0c
push eax
mov ecx, dword [eax]
call dword [ecx]
mov edx, dword [esp + 0xc]
mov ecx, dword [ebp + 8]
push str._RESOLVER
call fcn.00401010
mov edx, dword [esp + 0x10]
add esp, 4
mov ecx, dword [ebp + 8]
push str._ENTRYPOINT
call fcn.00401010
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401a94
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401ad3
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401ad3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401ad3
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401ad3
cmp dword [ecx + 0x74], 0xe
jbe 0x401ad3
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40bf80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40bfad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40bfad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, reloc.kernel32.dll_OutputDebugStringW
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d7a
nop
nop
sub eax, 0x403d20
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x404650
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x28
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x6c4]
push 0
push eax
call edi
mov ecx, dword [esi + 0x6c8]
push 0
push ecx
call edi
mov edx, dword [esi + 0x6cc]
push 0
push edx
call edi
mov eax, dword [esi + 0x6d0]
push 5
push eax
call edi
mov ecx, dword [esi + 0x6d8]
push 0
push ecx
call edi
mov edx, dword [esi + 0x6dc]
push 0
push edx
call edi
mov eax, dword [esi + 0x6e0]
push 0
push eax
call edi
mov ecx, dword [esi + 0x6e4]
push 0
push ecx
call edi
mov edx, dword [esi + 0x6e8]
push 0
push edx
call edi
mov eax, dword [esi + 0x6ec]
push 0
push eax
call edi
mov ecx, dword [esi + 0x6f0]
push 0
push ecx
call edi
mov edx, dword [esi + 0x6d4]
push 0
push edx
call edi
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x404752
mov eax, dword [esi + 0x6d8]
push 5
push eax
call edi
mov ecx, dword [esi + 0x6dc]
push 5
push ecx
call edi
mov edx, dword [esi + 0x6e0]
push 5
push edx
call edi
mov eax, dword [esi + 0x6cc]
push 5
push eax
call edi
mov ecx, dword [esi + 0x6d4]
push 5
push ecx
call edi
mov eax, 2
lea edx, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x6d8]
push edx
push 0
push 0x102b
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 0x6d8]
push ecx
jmp 0x4047e8
cmp eax, 1
jne 0x404793
mov edx, dword [esi + 0x6c4]
push 5
push edx
call edi
mov eax, dword [esi + 0x6c8]
push 5
push eax
call edi
mov ecx, dword [esi + 0x6cc]
push 5
push ecx
call edi
mov edx, dword [esi + 0x6d4]
push 5
push edx
call edi
mov ecx, esi
call fcn.00405310
mov eax, dword [esi + 0x6c4]
push eax
jmp 0x4047e8
cmp eax, 2
jne 0x4047ee
mov ecx, dword [esi + 0x6c8]
push 5
push ecx
call edi
mov edx, dword [esi + 0x6e4]
push 5
push edx
call edi
mov eax, dword [esi + 0x6e8]
push 5
push eax
call edi
mov ecx, dword [esi + 0x6ec]
push 5
push ecx
call edi
mov edx, dword [esi + 0x6f0]
push 5
push edx
call edi
mov eax, dword [esi + 0x6e4]
mov ecx, dword [esi + 4]
push eax
push ecx
mov ecx, esi
call fcn.00404600
mov edx, dword [esi + 0x6e4]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esi + 4]
push 1
push 0
push eax
call fcn.004d3c20
add esp, 0xc
pop edi
pop esi
add esp, 0x28
ret 4
Function at 0x406e70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d7dde
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004b7050
xor edi, edi
lea ecx, [esi + 0x232c]
mov dword [esp + 0x18], edi
call fcn.004ac570
mov ebx, 1
lea ecx, [esi + 0x2344]
mov byte [esp + 0x18], bl
call fcn.004ac570
lea ecx, [esi + 0x2368]
mov byte [esp + 0x18], 2
call fcn.0049b880
lea ecx, [esi + 0x37e0]
mov byte [esp + 0x18], 3
call fcn.004ce440
lea ecx, [esi + 0x3ea0]
mov byte [esp + 0x18], 4
call fcn.004ac570
lea ecx, [esi + 0x3eb8]
mov byte [esp + 0x18], 5
call fcn.004ac570
lea ecx, [esi + 0x3e80]
xor eax, eax
mov dword [esi], 0x4ddbc4
mov dword [esi + 0x28], 0x4ddbbc
mov dword [esi + 0x30], 0x4ddbb8
mov dword [esi + 0x3ee4], edi
mov dword [esi + 0x3ee8], edi
mov dword [esi + 0x3eec], edi
mov dword [esi + 0x3ef0], edi
mov dword [esi + 0x26c], edi
mov dword [esi + 0x3ee0], edi
mov dword [esi + 0x3ed4], ebx
mov dword [esi + 0x3ed8], edi
mov dword [ecx], eax
xor edx, edx
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
lea eax, [esi + 0x3e90]
mov ecx, 0x412
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [esi + 0x235c], edi
mov dword [esi + 0x2360], edi
xor eax, eax
lea edi, [esi + 0x2794]
mov dword [esi + 0x3e78], 4
mov dword [esi + 0x2364], ebx
mov dword [esi + 0x37dc], ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
or eax, 0xffffffff
mov dword [esi + 0x3ef8], eax
mov dword [esi + 0x3ef4], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x406e87
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d7dde
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004b7050
xor edi, edi
lea ecx, [esi + 0x232c]
mov dword [esp + 0x18], edi
call fcn.004ac570
mov ebx, 1
lea ecx, [esi + 0x2344]
mov byte [esp + 0x18], bl
call fcn.004ac570
lea ecx, [esi + 0x2368]
mov byte [esp + 0x18], 2
call fcn.0049b880
lea ecx, [esi + 0x37e0]
mov byte [esp + 0x18], 3
call fcn.004ce440
lea ecx, [esi + 0x3ea0]
mov byte [esp + 0x18], 4
call fcn.004ac570
lea ecx, [esi + 0x3eb8]
mov byte [esp + 0x18], 5
call fcn.004ac570
lea ecx, [esi + 0x3e80]
xor eax, eax
mov dword [esi], 0x4ddbc4
mov dword [esi + 0x28], 0x4ddbbc
mov dword [esi + 0x30], 0x4ddbb8
mov dword [esi + 0x3ee4], edi
mov dword [esi + 0x3ee8], edi
mov dword [esi + 0x3eec], edi
mov dword [esi + 0x3ef0], edi
mov dword [esi + 0x26c], edi
mov dword [esi + 0x3ee0], edi
mov dword [esi + 0x3ed4], ebx
mov dword [esi + 0x3ed8], edi
mov dword [ecx], eax
xor edx, edx
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
lea eax, [esi + 0x3e90]
mov ecx, 0x412
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [esi + 0x235c], edi
mov dword [esi + 0x2360], edi
xor eax, eax
lea edi, [esi + 0x2794]
mov dword [esi + 0x3e78], 4
mov dword [esi + 0x2364], ebx
mov dword [esi + 0x37dc], ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
or eax, 0xffffffff
mov dword [esi + 0x3ef8], eax
mov dword [esi + 0x3ef4], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4083a6
Capabilities:
Get common file path

Disassembly:
sub esp, 0x618
push esi
mov esi, ecx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x212]
mov word [esp + 0x210], 0
push str.theworld.ac
rep stosd dword es:[edi], eax
mov ecx, dword [0x73ff2c]
push 0x103
stosw word es:[edi], ax
lea eax, [esp + 0x218]
push eax
push ecx
call fcn.004a8e10
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], 0
rep stosd dword es:[edi], eax
lea edx, [esp + 0x18]
push 0x104
push edx
stosw word es:[edi], ax
call fcn.00432fc0
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x432]
mov word [esp + 0x430], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x430]
push 0x104
push eax
call fcn.00433120
add esp, 0x20
cmp word [esp + 8], 0
jne 0x408453
push 1
lea ecx, [esp + 0xc]
push 6
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edi, [esi + 0x2368]
lea edx, [esp + 0x210]
push edx
mov ecx, edi
call fcn.0049c970
cmp eax, 0xffffffff
jne 0x4084b5
lea eax, [esp + 8]
mov ecx, esi
push eax
call fcn.00408c20
mov ecx, esi
call fcn.004089e0
lea ecx, [esp + 0x418]
push ecx
mov ecx, esi
call fcn.00408c20
mov ecx, esi
call fcn.00408e90
push 0xa052
call fcn.004afb70
add esp, 4
mov ecx, 0x6fe6b8
push eax
call fcn.004c8840
mov ecx, edi
call fcn.0049c320
mov dword [esi + 0x2364], 1
pop edi
pop esi
add esp, 0x618
ret
Function at 0x4084d0
Capabilities:
Create thread
Delete file

Disassembly:
mov eax, dword [0x727958]
sub esp, 0x20c
test eax, eax
push esi
mov esi, ecx
je 0x40857f
mov eax, dword [esi + 0x2364]
test eax, eax
je 0x40857f
mov eax, dword [esp + 0x218]
mov dword [esi + 0x2364], 0
mov dword [esi + 0x37dc], eax
mov eax, dword [esp + 0x214]
test eax, eax
je 0x408557
mov edx, dword [0x73ff2c]
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
push str.theworld.ac
lea ecx, [esp + 0x10]
push 0x103
push ecx
push edx
stosw word es:[edi], ax
call fcn.004a8e10
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
lea ecx, [esp + 4]
mov dword [esp + 4], 0
push ecx
push 0
push esi
push 0x408380
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0x2360], eax
pop esi
add esp, 0x20c
ret 8
Function at 0x408c20
Capabilities:
Enumerate files on windows
Enumerate files recursively
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d7e90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x18b4
call fcn.004d4ce0
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
cmp esi, ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ecx
je 0x408e2c
cmp word [esi], bx
je 0x408e2c
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x672]
mov word [ebp - 0x674], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
push 0x4ed84c
lea eax, [ebp - 0x674]
push 0x104
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea ecx, [ebp - 0x264]
lea edx, [ebp - 0x674]
mov dword [ebp - 4], ebx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x408e2c
mov edi, dword [sym.imp.MSVCRT.dll_wcscmp]
lea eax, [ebp - 0x238]
push 0x4ed42c
push eax
call edi
add esp, 8
test eax, eax
je 0x408e09
lea ecx, [ebp - 0x238]
push 0x4ed424
push ecx
call edi
add esp, 8
test eax, eax
je 0x408e09
test byte [ebp - 0x264], 0x10
je 0x408d42
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x46a]
mov word [ebp - 0x46c], bx
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x238]
push edx
push esi
stosw word es:[edi], ax
push 0x4ed83c
lea eax, [ebp - 0x46c]
push 0x104
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
lea ecx, [ebp - 0x46c]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.00408c20
cmp word [ebp - 0x238], bx
je 0x408e09
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x87a]
mov word [ebp - 0x87c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x411
xor eax, eax
lea edi, [ebp - 0x18c2]
mov word [ebp - 0x18c4], bx
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x238]
push edx
push esi
stosw word es:[edi], ax
push 0x4ed130
lea eax, [ebp - 0x87c]
push 0x104
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
lea ecx, [ebp - 0x87c]
lea edx, [ebp - 0x18c4]
push ecx
push 0x824
push edx
push 0x500df0
push 0x4ed834
push str.InternetShortcut
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x18c4], bx
je 0x408e09
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
cmp eax, 4
jle 0x408e09
push ebx
push ebx
lea ecx, [ebp - 0x238]
push 2
lea edx, [ebp - 0x18c4]
push ecx
mov ecx, dword [ebp - 0x14]
push edx
mov word [ebp + eax*2 - 0x240], bx
call fcn.00408840
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x264]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x408cb8
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x415802
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 8]
call fcn.004a3700
mov al, byte [esp + 0xf]
lea ebx, [esi + 0x6288c]
mov byte [esi + 0x62a94], al
xor eax, eax
mov dword [esi + 0x62a98], eax
mov dword [esi + 0x62a9c], eax
mov dword [esi + 0x62aa0], eax
mov ecx, 0x82
mov edi, ebx
mov dword [esi], eax
mov dword [esi + 0x62aa4], eax
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x62aa8], eax
mov dword [esi + 0x62aac], eax
push ebx
push 0x104
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.TheWorldUpdate_
push ebx
call dword [sym.imp.MSVCRT.dll_wcscat]
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret
mov ecx, 0x68e4c0
jmp 0x415800
Function at 0x416f00
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
push esi
test eax, eax
mov esi, ecx
je 0x416f31
lea eax, [esi + 0x62aa8]
push eax
push 0
push esi
push 0x417090
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0x62aac], eax
pop esi
ret 8
mov ecx, dword [0x73ff2c]
push 0xa5
push ecx
call dword [sym.imp.USER32.dll_LoadIconW]
mov edx, dword [esp + 8]
push esi
mov dword [esi], eax
mov eax, dword [0x73ff28]
push 0x416a00
push edx
push pe_nt_image_headers32
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_DestroyIcon]
mov ecx, esi
mov dword [esi], 0
call fcn.00416f80
pop esi
ret 8

Function at 0x416f80
Capabilities:
Delete directory
Delete file

Disassembly:
sub esp, 0x20c
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
push edi
xor edi, edi
mov ebx, ecx
xor esi, esi
mov eax, dword [ebx + 0x62a98]
test eax, eax
je 0x416fe8
mov ecx, dword [ebx + 0x62a9c]
sub ecx, eax
mov eax, 0x8fe086e3
imul ecx
add edx, ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edi, edx
jae 0x416fe8
mov ecx, dword [ebx + 0x62a98]
lea edx, [ecx + esi + 0xa28]
push edx
call ebp
mov eax, dword [ebx + 0x62a98]
lea ecx, [eax + esi + 0x820]
push ecx
call ebp
inc edi
add esi, 0x1c78
jmp 0x416f96
mov dword [ebx + 4], 0xffffffff
mov ebp, dword [ebx + 0x62a9c]
mov edx, dword [ebx + 0x62a98]
mov eax, ebp
cmp eax, ebp
je 0x41701b
mov esi, eax
mov edi, edx
add eax, 0x1c78
mov ecx, 0x71e
add edx, 0x1c78
cmp eax, ebp
rep movsd dword es:[edi], dword [esi]
jne 0x417001
mov eax, dword [ebx + 0x62a9c]
mov dword [ebx + 0x62a9c], edx
mov cx, word [0x500df0]
mov dword [esp + 0x10], eax
mov word [esp + 0x14], cx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
rep stosd dword es:[edi], eax
lea esi, [ebx + 0x6288c]
push 0
push esi
stosw word es:[edi], ax
call fcn.004b2280
add esp, 8
lea edx, [esp + 0x14]
push 0x4ee430
push esi
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
mov dword [ebx + 0x62aa4], 0
pop ebp
pop ebx
add esp, 0x20c
ret
Function at 0x41a2b0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
mov ax, word [0x500df0]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov word [esp + 0x10], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push 0x104
push ecx
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
add esi, 0x89c
push reloc.DSOUND.dll_DirectSoundCreate
push 0x103
push esi
push str.DefautlPath
push str.Download
call fcn.004af1b0
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
mov ebx, dword [sym.imp.MSVCRT.dll__snwprintf]
mov ebp, dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
add esp, 0x18
test eax, eax
je 0x41a328
push esi
call ebp
cmp eax, 0xffffffff
jne 0x41a353
mov ecx, 0x82
xor eax, eax
mov edi, esi
lea edx, [esp + 0x10]
push str.Downloads
push edx
rep stosd dword es:[edi], eax
call ebp
add eax, 0x41
push eax
push str._c:_s_
push 0x103
push esi
call ebx
add esp, 0x14
mov eax, dword [esp + 0x220]
mov ecx, dword [esp + 0x21c]
push esi
dec eax
push 0x4ed128
push eax
push ecx
call ebx
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
Function at 0x420c40
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x1458
call fcn.004d4ce0
mov eax, dword [esp + 0x1460]
cmp ax, 0x406
jne 0x420d58
mov ax, word [0x500df0]
push esi
mov edx, dword [esp + 0x1468]
push edi
mov word [esp + 0x418], ax
mov ecx, 0x411
xor eax, eax
lea edi, [esp + 0x41a]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x418]
push 0x824
push ecx
push edx
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ax, word [0x500df0]
mov ecx, 0x81
mov word [esp + 8], ax
xor eax, eax
lea edi, [esp + 0xa]
push 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push 0x104
lea edx, [esp + 0x420]
push ecx
push edx
stosw word es:[edi], ax
call fcn.00424ed0
mov esi, dword [esp + 0x1474]
add esp, 0x10
lea eax, [esp + 8]
push eax
push 0x409
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov cx, word [0x500df0]
xor eax, eax
mov word [esp + 0x210], cx
mov ecx, 0x81
lea edi, [esp + 0x212]
lea edx, [esp + 0x210]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [esp + 0xc]
push edx
push eax
call fcn.00425300
add esp, 0xc
lea ecx, [esp + 0x210]
push ecx
push 0x429
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, dword [esp + 0x1470]
pop edi
xor eax, eax
pop esi
mov dword [edx + 0x2f0c], 1
add esp, 0x1458
ret
cmp ax, 0x409
jne 0x420d6f
mov eax, dword [esp + 0x1468]
mov dword [eax + 0x2f0c], 0
xor eax, eax
add esp, 0x1458
ret