joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ab711
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2c4
mov eax, 0x5c7ac5
call fcn.00496753
mov esi, ecx
mov ebx, dword [ebp + 8]
call fcn.004abaa0
call fcn.00498e1e
push eax
lea ecx, [ebp - 0x94]
call fcn.0049e910
xor edi, edi
mov dword [ebp - 4], edi
call fcn.00498e24
mov ecx, eax
call fcn.0049f13f
test al, al
je 0x4ab827
push ebx
lea ecx, [ebp - 0x94]
call fcn.0049eba8
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocStringLen
lea ecx, [ebp - 0x94]
call fcn.0049efe1
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2d0], eax
push edi
cmp eax, 0xffffffff
jne 0x4ab798
push str.Error_opening_file
jmp 0x4ab908
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
je 0x4ab8a1
cmp edi, 0x400000
ja 0x4ab8b2
and dword [ebp - 0x2c8], 0
push edi
call fcn.00495ecb
pop ecx
mov ebx, eax
lea eax, [ebp - 0x2c8]
push 0
push eax
push edi
push ebx
push dword [ebp - 0x2d0]
mov dword [ebp - 0x2cc], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x2d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c8], edi
je 0x4ab810
push ebx
call fcn.00495c1d
pop ecx
mov ecx, esi
call fcn.004abaa0
push 0
push str.Could_not_read_file
jmp 0x4ab908
push dword [ebp + 0xc]
mov ecx, esi
push edi
push ebx
call fcn.004ab953
push dword [ebp - 0x2cc]
jmp 0x4ab936
call fcn.00498e24
push eax
lea ecx, [ebp - 0x94]
call fcn.0049eb8b
call fcn.00498f57
test al, al
je 0x4ab848
call fcn.00498e2a
jmp 0x4ab85f
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.0049efe1
push eax
call fcn.004c0c14
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x4ab870
push eax
push str.Error_opening_zip_file
jmp 0x4ab908
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2cc]
push eax
push 1
push ebx
push edi
call fcn.004c0655
add esp, 0x14
test eax, eax
je 0x4ab897
push 0
push str.Could_not_find_ziped_file
jmp 0x4ab908
mov ebx, dword [ebp - 0x98]
test ebx, ebx
jne 0x4ab8aa
push 0
push str.File_is_empty
jmp 0x4ab908
cmp ebx, 0x400000
jbe 0x4ab8bb
push 0
push str.File_too_large
jmp 0x4ab908
push ebx
call fcn.00495ecb
push 3
push ebx
push eax
push dword [ebp - 0x2cc]
mov dword [ebp - 0x2c8], eax
push edi
call fcn.004c0fd4
add esp, 0x18
test eax, eax
je 0x4ab913
cmp eax, 0x600
je 0x4ab913
push dword [ebp - 0x2c8]
call fcn.00495c1d
pop ecx
call fcn.00498f57
test al, al
jne 0x4ab901
push edi
call fcn.004c04af
pop ecx
push 0
push str.Could_not_unzip_file
mov ecx, esi
call fcn.004abac8
mov bl, al
jmp 0x4ab93e
call fcn.00498f57
test al, al
jne 0x4ab923
push edi
call fcn.004c04af
pop ecx
push dword [ebp + 0xc]
mov edi, dword [ebp - 0x2c8]
mov ecx, esi
push ebx
push edi
call fcn.004ab953
push edi
mov bl, al
call fcn.00495c1d
pop ecx
lea ecx, [ebp - 0x94]
call fcn.0049ea6b
mov al, bl
call fcn.004966fd
ret 8
Function at 0x4acfd2
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x70c0f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x24], 0
je 0x4ad03f
cmp dword [esi + 0x1c], 0
je 0x4ad03f
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.004968b0
mov ebx, esp
test ebx, ebx
je 0x4ad03f
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x1c]
push ebx
add ecx, 0x1bc
call fcn.0049eb09
mov ecx, dword [esi + 0x1c]
xor eax, eax
push eax
push eax
push eax
mov eax, dword [ecx]
push 0x5e0da8
push ecx
call dword [eax + 0x2c]
mov ecx, eax
call fcn.0049b3e5
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00495c0c
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4b79cf
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0x40]
cmp eax, dword [ebp + 8]
jne 0x4b7a2e
cmp byte [esi + 0x3a], 0
je 0x4b7a00
add dword [esi + 0x3c], 0xf
mov ecx, 0xff
cmp dword [esi + 0x3c], ecx
jle 0x4b7a23
push eax
push dword [esi + 4]
mov dword [esi + 0x3c], ecx
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x4b7a23
add dword [esi + 0x3c], 0xfffffffb
cmp dword [esi + 0x3c], 0
jg 0x4b7a23
and dword [esi + 0x3c], 0
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x3c]
lea ecx, [esi + 0x48]
call fcn.0049bb70
pop esi
pop ebp
ret 4
Function at 0x4ba363
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x4ba377
xor eax, eax
pop ebp
ret
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x4ba389
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x4ba373
push esi
push dword [ebp + 0x14]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x4ba3a4
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x4ba3db
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call fcn.004e0db0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
test eax, eax
jne 0x4ba3df
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x4ba3e2
xor eax, eax
inc eax
pop esi
pop ebp
ret

Function at 0x4bc369
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x88
mov eax, 0x5c7156
call fcn.00496753
mov esi, ecx
cmp dword [esi + 0x4f0], 0
mov ebx, dword [ebp + 0x14]
je 0x4bc45d
cmp dword [ebp + 8], 0x100
jne 0x4bc443
cmp word [ebp + 0xc], 0xd
jne 0x4bc3dc
cmp byte [esi + 0x4f6], 0
je 0x4bc3bd
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4bc3dc
cmp byte [esi + 0x4f7], 0
jne 0x4bc3dc
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x4bc3d5
push 0
push 0
push 0
push 0x5e0d98
push esi
call fcn.0049b3e5
xor eax, eax
jmp 0x4bc460
cmp dword [ebp + 0xc], 0x43
jne 0x4bc443
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4bc443
lea eax, [ebp - 0x94]
mov ecx, esi
push eax
call fcn.004bab53
and dword [ebp - 4], 0
lea ecx, [ebp - 0x94]
call fcn.0049efeb
lea ecx, [ebp - 0x94]
lea eax, [eax*2 + 2]
push eax
call fcn.0049efe1
mov ecx, dword [esi + 0x40]
push eax
push 0x2042
call fcn.0049eff4
push eax
call fcn.004ba363
add esp, 0x10
lea ecx, [ebp - 0x94]
call fcn.0049ea6b
jmp 0x4bc3d5
mov eax, dword [esi + 0x4f0]
push ebx
push dword [ebp + 0x10]
mov ecx, dword [eax + 0xc]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0xc]
jmp 0x4bc460
xor eax, eax
inc eax
call fcn.004966fd
ret 0x10
Function at 0x4c0501
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x70c0f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4c05b7
movzx eax, word [esi]
test ax, ax
je 0x4c05b7
push edi
mov edi, esi
mov ecx, esi
cmp ax, 0x2f
je 0x4c0541
cmp ax, 0x5c
jne 0x4c0543
mov edi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x4c0535
cmp edi, esi
je 0x4c058a
sub edi, esi
lea eax, [ebp - 0x20c]
sar edi, 1
push edi
push esi
push eax
call fcn.004f6085
add edi, edi
add esp, 0xc
cmp edi, 0x208
jae 0x4c05c7
xor eax, eax
mov word [ebp + edi - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.004c0501
pop ecx
pop ecx
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.004e67ab
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.004eb8ca
add esp, 0x10
lea eax, [ebp - 0x414]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00495c0c
mov esp, ebp
pop ebp
ret
call fcn.00496028
int3

Function at 0x4c0b8c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x4c0c08
cmp dword [edi + 4], 0xffffffff
jne 0x4c0c08
push esi
lea esi, [edi + 0x138]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x5e3ea4
push esi
call fcn.004eb8ca
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop esi
jne 0x4c0bda
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x4c0bda
mov eax, 0x2000000
jmp 0x4c0c0d
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004c30a7
add esp, 0x10
test eax, eax
jne 0x4c0bf8
mov eax, dword [ebp - 4]
jmp 0x4c0c0d
push eax
call fcn.004c37af
mov dword [edi], eax
mov eax, dword [0x724430]
pop ecx
jmp 0x4c0c0d
mov eax, 0x1000000
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4c31b4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
imul esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp byte [edi], 0
je 0x4c31e8
push 0
lea eax, [ebp + 0x10]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4c31e3
mov byte [edi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x4c320f
mov edx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, dword [edi + 0x14]
jbe 0x4c31f8
mov esi, dword [edi + 0x14]
sub esi, edx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.004e0db0
add esp, 0xc
mov eax, esi
add dword [edi + 0x18], esi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x4c3382
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4c3390
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not ecx
cmp esi, 8
jb 0x4c344f
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5e2670]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5e2670]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5e2670]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5e2670]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5e2670]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5e2670]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5e2670]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5e2670]
sub edi, 1
jne 0x4c33a8
pop edi
test esi, esi
je 0x4c346b
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5e2670]
inc edx
sub esi, 1
jne 0x4c3453
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x4c9774
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2cc
mov eax, 0x5c8863
call fcn.00496753
mov dword [ebp - 0x2d8], ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2cc], ebx
call fcn.00498e1e
push eax
lea ecx, [ebp - 0x94]
call fcn.0049e910
xor edi, edi
mov dword [ebp - 4], edi
call fcn.00498e24
mov ecx, eax
call fcn.0049f13f
test al, al
je 0x4c9862
push ebx
lea ecx, [ebp - 0x94]
call fcn.0049eba8
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocStringLen
lea ecx, [ebp - 0x94]
call fcn.0049efe1
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4c9805
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0049ea6b
jmp 0x4c9943
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x4c97f1
push esi
mov dword [ebp - 0x2c8], edi
call fcn.00495ecb
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x2c8]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c8], esi
je 0x4c992e
push edi
call fcn.00495c1d
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0049ea6b
jmp 0x4c9941
call fcn.00498e24
push eax
lea ecx, [ebp - 0x94]
call fcn.0049eb8b
call fcn.00498f57
test al, al
je 0x4c9883
call fcn.00498e2a
jmp 0x4c989a
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.0049efe1
push eax
call fcn.004c0c14
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x4c97f1
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2d4]
push eax
push 1
push dword [ebp - 0x2cc]
push ebx
call fcn.004c0655
add esp, 0x14
test eax, eax
jne 0x4c97f1
mov esi, dword [ebp - 0x98]
test esi, esi
je 0x4c97f1
push esi
call fcn.00495ecb
push 3
push esi
mov edi, eax
push edi
push dword [ebp - 0x2d4]
push ebx
call fcn.004c0fd4
add esp, 0x18
test eax, eax
je 0x4c991e
cmp eax, 0x600
je 0x4c991e
push edi
call fcn.00495c1d
pop ecx
call fcn.00498f57
test al, al
jne 0x4c984e
push ebx
call fcn.004c04af
jmp 0x4c984d
call fcn.00498f57
test al, al
jne 0x4c992e
push ebx
call fcn.004c04af
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0049ea6b
test edi, edi
jne 0x4c99b5
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocStringLen
push dword [ebp - 0x2cc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4c99b1
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x4c99b1
push esi
mov dword [ebp - 0x2d0], edi
call fcn.00495ecb
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x2d0]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2d0], esi
je 0x4c99ad
push edi
call fcn.00495c1d
pop ecx
xor edi, edi
test edi, edi
jne 0x4c99b5
xor eax, eax
jmp 0x4c99d0
mov ecx, dword [ebp - 0x2d8]
push esi
push edi
call fcn.004c99d8
push 1
push edi
mov esi, eax
call fcn.00495ebd
pop ecx
pop ecx
mov eax, esi
call fcn.004966fd
ret 4
Function at 0x4d2577
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 8]
and edi, 7
je 0x4d259b
cmp dword [esi + 8], edi
jge 0x4d2593
push esi
call fcn.004d0818
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x4d25c4
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x4d25a7
mov dword [esi + 8], edx
cmp ecx, 4
jge 0x4d25e1
mov edx, dword [esi]
cmp edx, dword [esi + 4]
jb 0x4d25cf
xor eax, eax
jmp 0x4d25d7
mov al, byte [edx]
inc edx
mov dword [esi], edx
movzx eax, al
mov byte [ebp + ecx + 8], al
inc ecx
cmp ecx, 4
jl 0x4d25c6
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x4d2616
push str.zlib_corrupt
call fcn.004d06d3
add esp, 4
jmp 0x4d2653
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x4d2626
push str.read_past_buffer
jmp 0x4d260c
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x4d263d
push edi
push esi
call fcn.004d06e2
pop ecx
pop ecx
test eax, eax
je 0x4d2653
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.004e0db0
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret

Function at 0x4d625d
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x70c0f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
xor esi, esi
push esi
push 0x1a
push eax
push esi
call fcn.004d787d
lea eax, [ebp - 0x20c]
push eax
call fcn.004e608a
pop ecx
test eax, eax
je 0x4d6312
push ebx
mov ebx, 0x5e3ea4
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004eb8ca
lea eax, [ebp - 0x20c]
push 0x5e6840
push eax
call fcn.004eb8ca
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004eb8ca
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ebx
test eax, eax
jne 0x4d62eb
lea eax, [ebp - 0x20c]
push eax
call fcn.004d85c8
pop ecx
cmp word [ebp - 0x20c], si
je 0x4d6303
lea eax, [ebp - 0x20c]
push eax
call fcn.004e608a
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.00446930
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00495c0c
mov esp, ebp
pop ebp
ret 4
Function at 0x4d642c
Capabilities:
Read .ini file

Disassembly:
push 0x838
mov eax, 0x5c9190
call fcn.00496753
mov edi, ecx
mov ecx, dword [ebp + 0xc]
lea eax, [edi + 0x84]
cmp dword [eax + 0x14], 8
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x844], ecx
jb 0x4d6457
mov eax, dword [eax]
push eax
push dword [ebp + 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
cmp esi, dword [ebp + 0x10]
jne 0x4d6535
xor esi, esi
mov dword [ebp - 0x814], 7
push esi
xor eax, eax
mov dword [ebp - 0x818], esi
push 0x6e478c
lea ecx, [ebp - 0x828]
mov word [ebp - 0x828], ax
call fcn.00446930
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 4], esi
push esi
push eax
call fcn.004e1330
push dword [ebp + 0x10]
lea eax, [ebp - 0x810]
push 0x5e6b04
push eax
call fcn.0045c670
add esp, 0x18
lea eax, [ebp - 0x810]
cmp byte [edi + 1], 0
mov ecx, edi
push eax
push dword [ebp - 0x844]
lea eax, [ebp - 0x840]
push ebx
push eax
je 0x4d64ea
call fcn.004d6348
jmp 0x4d64ef
call fcn.004d6402
push eax
lea ecx, [ebp - 0x828]
call fcn.0044ecc0
push esi
push 1
lea ecx, [ebp - 0x840]
call fcn.00446840
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.004e6036
pop ecx
push 0
push 1
lea ecx, [ebp - 0x828]
mov esi, eax
call fcn.00446840
mov eax, esi
call fcn.004966fd
ret 0xc

Function at 0x4d653f
Capabilities:
Read .ini file

Disassembly:
push 0x82c
mov eax, 0x5c8c60
call fcn.00496753
mov edi, ecx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x10]
push 0x800
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x810]
push ecx
push eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], ecx
call fcn.004e1330
lea eax, [edi + 0x84]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x4d659c
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.00446660
and dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x834], 1
jb 0x4d65e2
mov eax, dword [esi]
jmp 0x4d65e4
mov eax, esi
push ebx
push eax
call fcn.004e664e
pop ecx
pop ecx
test eax, eax
jne 0x4d6630
cmp byte [edi + 1], 0
lea eax, [ebp - 0x828]
push ebx
push dword [ebp - 0x82c]
mov ecx, edi
push dword [ebp - 0x830]
push eax
je 0x4d6614
call fcn.004d6348
jmp 0x4d6619
call fcn.004d6402
push eax
mov ecx, esi
call fcn.0044ecc0
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.00446840
mov eax, esi
call fcn.004966fd
ret 0x10
Function at 0x4d676a
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x70c0f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea eax, [esi + 0xc]
cmp dword [eax + 0x14], 8
jb 0x4d678b
mov eax, dword [eax]
push 0x5e6a20
push eax
lea eax, [ebp - 0x20c]
push str._s_s_
push eax
call fcn.0045c670
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4d67c3
lea eax, [ebp - 0x20c]
push eax
call fcn.004d85c8
pop ecx
lea eax, [ebp - 0x20c]
push str.Related.ini
push eax
call fcn.004eb8ca
cmp word [ebp - 0x20c], 0
pop ecx
pop ecx
jne 0x4d67e4
xor eax, eax
jmp 0x4d67f1
lea eax, [ebp - 0x20c]
push eax
call fcn.004e608a
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x6c]
call fcn.00446930
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00495c0c
mov esp, ebp
pop ebp
ret
Function at 0x4d6810
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc3c
mov eax, dword [0x70c0f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0xc34]
push esi
push edi
push 0x208
xor edi, edi
mov esi, ecx
push edi
push eax
mov dword [ebp - 0xc3c], esi
call fcn.004e1330
push 0x208
lea eax, [ebp - 0x824]
push edi
push eax
call fcn.004e1330
push 0x208
lea eax, [ebp - 0x61c]
push edi
push eax
call fcn.004e1330
push 0x208
lea eax, [ebp - 0xa2c]
push edi
push eax
call fcn.004e1330
push 0x208
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.004e1330
push 0x208
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.004e1330
add esp, 0x48
lea eax, [ebp - 0xc34]
mov ecx, esi
push edi
push 0x1a
push eax
push edi
call fcn.004d787d
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004e67ab
lea eax, [ebp - 0x20c]
push eax
call fcn.004e608a
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.004e3f25
add esp, 0x14
test eax, eax
jne 0x4d68ef
mov ecx, esi
jmp 0x4d6a31
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push eax
call fcn.004e67ab
lea eax, [ebp - 0x824]
push 0x5e6808
push eax
call fcn.004eb8ca
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
mov esi, edi
inc ecx
test eax, eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
cmovne esi, ecx
push eax
call fcn.004e67ab
lea eax, [ebp - 0x61c]
push str.LocalLow
push eax
call fcn.004eb8ca
add esp, 0x10
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov ecx, edi
push 1
pop eax
cmovne ecx, eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa2c]
mov dword [ebp - 0xc38], ecx
push eax
call fcn.004e67ab
lea eax, [ebp - 0xa2c]
push str.Roaming
push eax
call fcn.004eb8ca
add esp, 0x10
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov ecx, edi
push 1
pop eax
cmovne ecx, eax
test esi, esi
je 0x4d6a2b
cmp dword [ebp - 0xc38], edi
je 0x4d6a2b
test ecx, ecx
je 0x4d6a2b
push 0x5e6840
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push 0x5e6858
push eax
call fcn.0045c670
add esp, 0x10
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4d6a02
lea eax, [ebp - 0x414]
push eax
call fcn.004d85c8
pop ecx
cmp word [ebp - 0x414], di
je 0x4d6a1a
lea eax, [ebp - 0x414]
push eax
call fcn.004e608a
pop ecx
mov edi, eax
push edi
lea eax, [ebp - 0x414]
mov ecx, ebx
push eax
call fcn.00446930
jmp 0x4d6a37
mov ecx, dword [ebp - 0xc3c]
push ebx
call fcn.004d625d
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00495c0c
mov esp, ebp
pop ebp
ret 4
Function at 0x4d6adb
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x70c0f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push eax
mov esi, ecx
call fcn.004e1330
add esp, 0xc
lea eax, [ebp - 0x20c]
push edi
push 0x26
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [ebp - 0x20c], di
je 0x4d6b32
lea eax, [ebp - 0x20c]
push eax
call fcn.004e608a
pop ecx
mov edi, eax
push edi
lea eax, [ebp - 0x20c]
add esi, 0xe4
push eax
mov ecx, esi
call fcn.00446930
mov edi, 0x5e3ea4
push edi
call fcn.004e608a
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00446ed0
cmp dword [esi + 0x14], 8
jb 0x4d6b66
mov eax, dword [esi]
jmp 0x4d6b68
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4d6b88
mov edi, str.C:Program_Files_
push edi
call fcn.004e608a
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00446930
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00495c0c
mov esp, ebp
pop ebp
ret