joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b070
Capabilities:
Delete directory

Disassembly:
sub esp, 0x41c
push esi
mov esi, ecx
mov eax, dword [esi + 0x60]
test eax, eax
je 0x40b0bf
mov ecx, dword [esi + 0x5c]
mov esi, dword [esi + 0x3c]
xor eax, eax
lea edx, [esp + 4]
mov dword [esp + 8], eax
push edx
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x29
mov dword [esp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov eax, dword [0x5e30a0]
push esi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
add esp, 0x41c
ret 8
mov eax, dword [esp + 0x428]
test eax, eax
je 0x40b0d5
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [esp + 0x42c]
push 0
lea ecx, [esp + 0x1c]
push 0x103
push ecx
push edi
mov ecx, esi
call fcn.0040af70
lea edx, [esp + 0x18]
push 1
push edx
call fcn.00433730
push 0
push 0
lea eax, [esp + 0x28]
push 0
push eax
call fcn.0048d950
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
add esp, 0x18
cmp edi, 0xffffffff
je 0x40b15a
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x18]
push eax
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1c]
push 0x103
push ecx
push 0xffffffffffffffff
mov ecx, esi
call fcn.0040af70
lea edx, [esp + 0x18]
push edx
call ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x222]
mov word [esp + 0x220], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
lea eax, [esp + 0x224]
push 0x103
push eax
mov ecx, esi
call fcn.0040aef0
lea ecx, [esp + 0x220]
push ecx
call ebx
pop edi
pop ebx
pop esi
add esp, 0x41c
ret 8

Function at 0x40b1b0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x60a524]
sub esp, 0x208
test eax, eax
je 0x40b1f4
push 0
push 0x4efa20
call fcn.0040ad10
mov ecx, dword [esp + 0x20c]
push eax
mov eax, dword [esp + 0x214]
push 0x4ef254
dec eax
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
add esp, 0x208
ret 8
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
push edx
push 0x103
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, dword [esp + 0x214]
mov edx, dword [esp + 0x210]
lea eax, [esp + 4]
push 0x4efa20
push eax
dec ecx
push 0x4ef368
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
pop edi
add esp, 0x208
ret 8
Function at 0x40b333
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
push 1
call fcn.00484650
add esp, 4
mov ecx, esi
call fcn.00409eb0
call fcn.0044fd10
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40b3b1
lea ecx, [esp + 0xc]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 4]
push 0
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x1f0fff
mov dword [esi + 0x48], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esi + 0x14], eax
call fcn.00452970
mov ecx, eax
call fcn.004529c0
call fcn.0047ac80
mov ecx, eax
call fcn.0047acd0
push str.Extensions
call fcn.00423c70
mov ecx, eax
call fcn.00425cf0
mov ecx, esi
call fcn.0040b280
mov ecx, 0x5e3848
call fcn.004a14c0
mov ecx, esi
call fcn.00428910
pop esi
add esp, 0x14
ret

Function at 0x40b460
Capabilities:
Terminate process

Disassembly:
sub esp, 0x208
add ecx, 0x64
push ecx
call fcn.004894d0
add esp, 4
test eax, eax
jne 0x40b55f
push edi
mov ecx, 0x81
lea edi, [esp + 6]
mov word [esp + 4], ax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x214]
pop edi
test eax, eax
je 0x40b503
mov ecx, dword [0x5e69b8]
lea eax, [esp]
push 0x103
push eax
push 0xc389
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x44
push 0xc38b
call fcn.0047edb0
add esp, 4
lea edx, [esp + 4]
push eax
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x40b4e9
push str.http:__se.360.cn
call fcn.00442740
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
add esp, 0x208
ret 8
mov eax, dword [0x4ef3f0]
test eax, eax
je 0x40b554
mov ecx, dword [0x5e69b8]
lea eax, [esp]
push 0x103
push eax
push 0xc38a
push ecx
mov dword [0x4ef3f0], 0
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x40
push 0xc38b
call fcn.0047edb0
add esp, 4
lea edx, [esp + 4]
push eax
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
add esp, 0x208
ret 8
mov eax, 1
add esp, 0x208
ret 8
Function at 0x40b570
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x208
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
push 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 8]
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
pop edi
je 0x40b5f1
lea ecx, [esp]
push str.360SE
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [esp]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40b5f1
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40b5f1
test al, 0x10
jne 0x40b5f1
lea ecx, [esp]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x208
ret

Function at 0x40b6f0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x40b71f
push 0
push esi
call fcn.00433100
add esp, 8
test eax, eax
je 0x40b71f
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x40b71f
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
ret

Function at 0x40bb80
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
xor ebx, ebx
push esi
cmp ebp, ebx
push edi
jne 0x40bb93
mov ebp, str.Main
mov esi, dword [esp + 0x20]
lea eax, [esi + esi]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [0x50f34c]
mov edi, dword [esp + 0x1c]
add esp, 4
cmp ecx, ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], ebx
je 0x40bbf0
mov eax, dword [0x50f36c]
test eax, eax
jne 0x40bbd7
push str.GetAppValue
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x50f36c], eax
je 0x40bbe8
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
push esi
push edx
push edi
push ebp
call eax
mov ebx, eax
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x40bc16
mov ecx, 0x50b190
call fcn.0040aaf0
push eax
mov eax, dword [esp + 0x18]
push esi
push eax
push 0x50b180
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ecx, ecx
cmp ecx, eax
sbb ebx, ebx
neg ebx
test ebx, ebx
je 0x40bc60
test esi, esi
je 0x40bc60
cmp esi, 0x7fffffff
ja 0x40bc60
mov eax, dword [esp + 0x1c]
mov edi, SysReAllocString
mov edx, esi
sub edi, esi
mov esi, dword [esp + 0x14]
sub esi, eax
lea ecx, [edi + edx]
test ecx, ecx
je 0x40bc54
mov cx, word [esi + eax]
test cx, cx
je 0x40bc54
mov word [eax], cx
add eax, 2
dec edx
jne 0x40bc39
jmp 0x40bc58
test edx, edx
jne 0x40bc5b
sub eax, 2
mov word [eax], 0
mov edx, dword [esp + 0x14]
push edx
call fcn.004d2909
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x40bd00
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x20c
test eax, eax
je 0x40bde9
push ebx
mov ebx, dword [esp + 0x214]
push esi
push edi
test ebx, ebx
jne 0x40bd25
mov ebx, str.Main
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
mov ecx, dword [0x50f34c]
xor esi, esi
stosw word es:[edi], ax
mov edi, dword [esp + 0x220]
mov dword [esp + 0xc], esi
test ecx, ecx
je 0x40bd8d
mov eax, dword [0x50f374]
test eax, eax
jne 0x40bd70
push str.GetAppValue
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x50f374], eax
je 0x40bd85
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push 0x103
push edx
push edi
push ebx
call eax
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x40bdb7
mov ecx, 0x50b190
call fcn.0040aaf0
push eax
lea eax, [esp + 0x14]
push 0x103
push eax
push 0x50b180
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ecx, ecx
cmp ecx, eax
sbb esi, esi
neg esi
pop edi
test esi, esi
pop esi
pop ebx
je 0x40bde9
cmp word [esp + 4], 0
je 0x40bde9
lea edx, [esp + 4]
push edx
call dword [sym.imp.MSVCRT.dll__wtoi]
mov ecx, dword [esp + 0x21c]
add esp, 4
mov dword [ecx], eax
mov eax, 1
add esp, 0x20c
ret
xor eax, eax
add esp, 0x20c
ret
Function at 0x40bf50
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x20004
call fcn.004d2930
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20014]
test esi, esi
push edi
jne 0x40bf6e
mov esi, str.Main
mov ebp, dword [esp + 0x2002c]
mov ebx, 1
test ebp, ebp
je 0x40c166
mov edi, dword [esp + 0x20030]
test edi, edi
je 0x40c166
cmp dword [edi], 0
jbe 0x40c166
mov eax, dword [esp + 0x20028]
mov dword [esp + 0x10], 0
mov dword [eax], ebx
mov ecx, dword [0x50f34c]
test ecx, ecx
je 0x40c008
mov eax, dword [0x50f380]
test eax, eax
jne 0x40bfd3
push str.EnumAppValue
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x50f380], eax
je 0x40bffc
mov edx, dword [esp + 0x20024]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x20024]
push edi
push ebp
push edx
mov edx, dword [esp + 0x2002c]
push ecx
push edx
push esi
call eax
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x40c159
mov ecx, 0x7fff
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x50b190
xor edi, edi
call fcn.0040aaf0
push eax
lea eax, [esp + 0x18]
push 0x10000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
test eax, eax
jbe 0x40c159
cmp word [esp + 0x14], di
lea esi, [esp + 0x14]
je 0x40c159
mov ebp, dword [sym.imp.MSVCRT.dll_wcschr]
push 0x3d
push esi
call ebp
add esp, 8
test eax, eax
je 0x40c07a
mov ecx, dword [esp + 0x2001c]
mov word [eax], 0
cmp edi, ecx
je 0x40c0a5
mov word [eax], 0x3d
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc edi
lea esi, [esi + eax*2 + 2]
cmp edi, 0xbb8
jae 0x40c159
cmp word [esi], 0
jne 0x40c059
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x20004
ret
mov ecx, dword [esp + 0x20024]
mov edx, dword [ecx]
test edx, edx
je 0x40c0f3
cmp edx, 0x7fffffff
ja 0x40c0f3
mov ecx, dword [esp + 0x20020]
mov ebx, SysReAllocString
sub ebx, edx
mov edi, edx
sub esi, ecx
lea edx, [ebx + edi]
test edx, edx
je 0x40c0e7
mov dx, word [esi + ecx]
test dx, dx
je 0x40c0e7
mov word [ecx], dx
add ecx, 2
dec edi
jne 0x40c0cc
jmp 0x40c0eb
test edi, edi
jne 0x40c0ee
sub ecx, 2
mov word [ecx], 0
mov ecx, dword [esp + 0x20030]
mov edx, dword [ecx]
shr edx, 1
je 0x40c157
cmp edx, 0x7fffffff
ja 0x40c157
mov ecx, dword [esp + 0x2002c]
mov esi, SysReAllocString
sub esi, edx
sub eax, ecx
lea edi, [eax + 2]
lea eax, [esi + edx]
test eax, eax
je 0x40c14b
mov ax, word [edi + ecx]
test ax, ax
je 0x40c14b
mov word [ecx], ax
add ecx, 2
dec edx
jne 0x40c11b
sub ecx, 2
xor ebx, ebx
pop edi
pop esi
mov eax, ebx
pop ebp
mov word [ecx], 0
pop ebx
add esp, 0x20004
ret
test edx, edx
jne 0x40c152
sub ecx, 2
mov word [ecx], 0
xor ebx, ebx
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x20004
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20004
ret
Function at 0x40c180
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x220
push ebx
push edi
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x22]
mov word [esp + 0x20], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [esp + 0x22c]
lea eax, [esp + 0x20]
push edi
push 0x4ef254
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov ecx, dword [0x50f34c]
add esp, 0x10
test ecx, ecx
mov dword [esp + 8], ebx
je 0x40c200
mov eax, dword [0x50f384]
test eax, eax
jne 0x40c1ea
push str.AppKeyExists
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x50f384], eax
je 0x40c1f8
lea ecx, [esp + 8]
lea edx, [esp + 0x20]
push ecx
push edx
call eax
mov ebx, eax
mov eax, dword [esp + 8]
test eax, eax
jne 0x40c248
xor eax, eax
mov ecx, 0x50b190
mov dword [esp + 0xe], eax
mov word [esp + 0xc], 0
mov dword [esp + 0x12], eax
mov dword [esp + 0x16], eax
mov dword [esp + 0x1a], eax
mov word [esp + 0x1e], ax
call fcn.0040aaf0
push eax
lea ecx, [esp + 0x10]
push 8
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
xor edx, edx
pop edi
cmp edx, eax
pop ebx
sbb eax, eax
neg eax
add esp, 0x220
ret
mov eax, ebx
pop edi
pop ebx
add esp, 0x220
ret

Function at 0x40c630
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d59d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.004d0de0
xor edi, edi
lea ecx, [esi + 0x34]
mov dword [esp + 0x14], edi
call fcn.0041bcd0
mov dword [esi + 0x24], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov ecx, 0x82
xor eax, eax
lea edi, [esi + 0x62cd8]
mov dword [esi], 0x4dabcc
rep stosd dword es:[edi], eax
mov ecx, 0x412
lea edi, [esi + 0x630e8]
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esi + 0x62ee0]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x40c8a0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x25c
mov ax, word [0x50b180]
mov edx, dword [0x5e69bc]
push edi
mov word [esp + 0x58], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x5a]
push str.seup.exe
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x5c]
push 0x104
push ecx
push edx
stosw word es:[edi], ax
call fcn.00433110
lea eax, [esp + 0x68]
push eax
call fcn.004433b0
add esp, 0x14
test eax, eax
je 0x40c95a
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 4], eax
rep stosd dword es:[edi], eax
xor ecx, ecx
lea edx, [esp + 4]
mov dword [esp + 8], ecx
lea eax, [esp + 0x14]
mov dword [esp + 0xc], ecx
push edx
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [esp + 0x2c], ecx
push ecx
lea ecx, [esp + 0x78]
mov dword [esp + 0x34], 0x44
push ecx
push 0
mov word [esp + 0x6c], 5
mov dword [esp + 0x68], 0x80
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40c95a
mov edx, dword [esp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 8]
push eax
call esi
pop esi
pop edi
add esp, 0x25c
ret 4
Function at 0x40ca7e
Capabilities:
Delete file
Read .ini file

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x210]
push esi
mov esi, ecx
push edi
push ebx
lea edi, [esi + 0x62ee0]
push 0x103
push edi
push 0x50b180
push str.TheWorld.exe
push 0x4efc00
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push str.3.6.1.0
push edi
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
test eax, eax
jle 0x40cadd
push ebx
mov ecx, esi
call fcn.0040cc20
test eax, eax
je 0x40cadd
mov ecx, esi
call fcn.0040cb50
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
pop ebx
add esp, 0x208
ret 4
mov eax, dword [esi + 0x24]
test eax, eax
je 0x40cb35
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
mov ecx, dword [0x5e69b8]
push 0x104
stosw word es:[edi], ax
lea eax, [esp + 0x10]
push eax
push 0xc37a
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x40
push 0x32
call fcn.0047edb0
add esp, 4
lea edx, [esp + 0x10]
push eax
push edx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
pop ebx
add esp, 0x208
ret 4

Function at 0x40cc20
Capabilities:
Get geographical location
Read .ini file

Disassembly:
sub esp, 0x21c
xor eax, eax
push ebx
mov dword [esp + 6], eax
push esi
mov dword [esp + 0xe], eax
mov esi, ecx
mov dword [esp + 0x12], eax
push edi
mov dword [esp + 0x1a], eax
mov ecx, 0x81
lea edi, [esp + 0x22]
mov word [esp + 0x1e], ax
mov word [esp + 0x20], ax
push 9
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
mov word [esp + 0x10], 0
push ecx
push 3
push 0x50b1f4
stosw word es:[edi], ax
call fcn.00442930
add esp, 4
and eax, 0xffff
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea edx, [esp + 0xc]
push edx
call fcn.0048c3c0
add esp, 4
lea eax, [esp + 0xc]
lea ecx, [esp + 0x20]
push eax
push str.url__s
push 0x103
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov edi, dword [esp + 0x23c]
add esp, 0x10
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esi, 0x630e8
push edi
push 0x823
push esi
lea edx, [esp + 0x2c]
push 0x50b180
push edx
push str.TheWorld.exe
call ebx
cmp word [esi], 0
jne 0x40ccf0
push edi
push 0x823
push esi
push 0x50b180
push 0x4ef360
push str.TheWorld.exe
call ebx
xor eax, eax
pop edi
cmp word [esi], ax
pop esi
pop ebx
setne al
add esp, 0x21c
ret 4
Function at 0x40ce60
Capabilities:
Delete file
Hide graphical window

Disassembly:
sub esp, 0x208
push ebx
mov ebx, ecx
push esi
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x40ce84
mov ecx, 0x50b190
call fcn.00409430
pop esi
pop ebx
add esp, 0x208
ret
push ebp
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
lea esi, [ebx + 0x62cd8]
push 0x103
push esi
mov ecx, ebx
stosw word es:[edi], ax
call fcn.0040d0f0
push esi
call fcn.004339c0
mov ebp, dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 4
lea eax, [esp + 0x10]
push esi
push str._stheworld.zip
push 0x103
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esi, [ebx + 0x34]
mov ecx, esi
call fcn.0041c2a0
mov ecx, esi
call fcn.0041c5f0
mov ecx, esi
call fcn.0041c2c0
lea edx, [esi + 0x5d0d0]
mov ecx, 0x82
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
push 0x4ef254
push 0x104
push edx
call ebp
lea edx, [esi + 0x5d4e0]
mov ecx, 0x412
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
add esp, 0x10
lea ecx, [ebx + 0x630e8]
push ecx
push 0x4ef254
push 0x824
push edx
call ebp
add esp, 0x10
mov ecx, esi
mov dword [esi + 0x269c], 0x40d150
mov dword [esi + 0x2698], ebx
call fcn.0041c1f0
pop edi
pop ebp
test eax, eax
je 0x40cfc4
mov edx, dword [ebx + 0x28]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 1
push edx
call esi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [ebx + 0x28]
push 0
push 0
push 0x402
push 0x3f0
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebx + 0x28]
push 5
push 0x3f0
push ecx
call esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xc36c
call fcn.0047edb0
mov edx, dword [ebx + 0x28]
add esp, 4
push eax
push 0x42e
push edx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
pop esi
pop ebx
add esp, 0x208
ret

Function at 0x40d0f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 4]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edx, dword [esp + 0x214]
mov eax, dword [esp + 0x210]
lea ecx, [esp + 4]
push ecx
push str._sTheWorld_
push edx
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
pop edi
add esp, 0x208
ret 8
Function at 0x40d18c
Capabilities:
Create process on windows
Delete directory
Delete file
Hide graphical window

Disassembly:
mov eax, 0x128c
call fcn.004d2930
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 0
mov eax, dword [esi + 0x28]
push 0x3f0
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea ebx, [esi + 0x62cd8]
lea ebp, [esi + 0x5d104]
push ebx
push ebp
call fcn.004d18f0
add esp, 8
test eax, eax
je 0x40d31d
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x4e]
mov word [esp + 0x4c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x411
xor eax, eax
lea edi, [esp + 0x256]
mov word [esp + 0x254], 0
rep stosd dword es:[edi], eax
push str.TheWorld.exe
push ebx
stosw word es:[edi], ax
mov edi, dword [sym.imp.MSVCRT.dll__snwprintf]
push 0x4ef368
lea ecx, [esp + 0x58]
push 0x103
push ecx
call edi
add esp, 0x14
lea edx, [esp + 0x4c]
lea eax, [esp + 0x254]
push edx
push 0x4ef6cc
push 5
push str._tp:
push str._s_d__s_s
push 0x823
push eax
call edi
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0x30]
add esp, 0x1c
rep stosd dword es:[edi], eax
mov eax, dword [0x5e2760]
lea ecx, [esp + 0x254]
test eax, eax
mov dword [esp + 0x10], 0x3c
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x20], 0x50b1f4
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], str.open
je 0x40d289
mov dword [esp + 0x1c], str.runas
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40d31d
mov eax, dword [esp + 0x48]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc366
mov dword [esi + 0x30], 1
call fcn.0047edb0
mov edx, dword [esi + 0x28]
mov edi, dword [sym.imp.USER32.dll_SetDlgItemTextW]
add esp, 4
push eax
push 0x42e
push edx
call edi
push 0xc368
call fcn.0047edb0
add esp, 4
push eax
mov eax, dword [esi + 0x28]
push 1
push eax
call edi
push 0xc369
call fcn.0047edb0
mov ecx, dword [esi + 0x28]
add esp, 4
push eax
push 2
push ecx
call edi
mov edx, dword [esi + 0x28]
push 1
push 1
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x40d324
mov ecx, esi
call fcn.0040d340
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x128c
ret