joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46fc40
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x485095
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x4b6018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str._ffmpeg.exe
push 0x4c8aec
lea eax, [ebp - 0x10]
push eax
call fcn.00401660
add esp, 0xc
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x9c], ecx
mov edx, dword [ebp - 0x9c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x46fde3
lea ecx, [ebp - 0x84]
call fcn.00469270
mov byte [ebp - 4], 1
mov eax, dword [0x4c7b14]
mov dword [ebp - 0x7c], eax
push ecx
mov ecx, esp
mov dword [ebp - 0x88], esp
push str.Downloading
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [ebp - 0xa8], eax
mov ecx, dword [ebp - 0xa8]
mov dword [ebp - 0xac], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [0x4c8c00]
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x8c], esp
push str.Download_completed__Converting_audio.._Please_wait.
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [ebp - 0xb0], eax
mov edx, dword [ebp - 0xb0]
mov dword [ebp - 0xb4], edx
mov byte [ebp - 4], 3
push ecx
mov ecx, esp
mov dword [ebp - 0x90], esp
push str.Downloading_updates_for_conversion..
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 4], 4
push ecx
mov ecx, esp
mov dword [ebp - 0x94], esp
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xc4], eax
mov byte [ebp - 4], 5
push str._download_updates_ffmpeg.exe
push 0x4c8bfc
lea ecx, [ebp - 0x98]
push ecx
call fcn.00401660
add esp, 0xc
mov dword [ebp - 0xc8], eax
mov edx, dword [ebp - 0xc8]
mov dword [ebp - 0xa0], edx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0xa0]
mov ecx, dword [eax]
mov dword [ebp - 0xa4], ecx
mov edx, dword [ebp - 0xa4]
push edx
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x84]
call fcn.00469360
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x98]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x84]
call fcn.004691b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4728f0
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x472920
Capabilities:
Read data from internet
Receive data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4b6018]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20c], 0
push 0x200
push 0
lea eax, [ebp - 0x208]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 0x10]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
lea ecx, [ebp - 0x20c]
push ecx
push 0x200
lea edx, [ebp - 0x208]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x47299b
mov dword [ebp - 0x20c], 0
cmp dword [ebp - 0x20c], 0
je 0x4729e7
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
add edx, dword [ebp - 0x20c]
cmp edx, dword [ebp + 0x10]
jbe 0x4729b8
xor al, al
jmp 0x472a1d
mov eax, dword [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
add eax, dword [edx]
push eax
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
add edx, dword [ebp - 0x20c]
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
cmp dword [ebp - 0x20c], 0
je 0x472a07
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.MSVCR90.dll_strchr]
add esp, 8
test eax, eax
je 0x472970
push 0xffffffffffffffff
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR90.dll_strchr]
add esp, 8
neg eax
sbb eax, eax
add eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408de6
mov esp, ebp
pop ebp
ret
Function at 0x472ab0
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x4b6018]
xor eax, ebp
mov dword [ebp - 0x10], eax
call sub.mfc90.dll_Ordinal_1137
mov eax, dword [eax + 8]
mov dword [ebp - 0x134], eax
push 0x104
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x472af7
xor eax, eax
jmp 0x472be2
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x118]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jne 0x472b1d
xor eax, eax
jmp 0x472be2
mov edx, dword [ebp - 0x120]
push edx
call sub.mfc90.dll_Ordinal_265
add esp, 4
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x120]
push edx
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x118]
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x472b76
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x128], edx
mov eax, dword [ebp - 0x128]
push eax
call sub.mfc90.dll_Ordinal_266
add esp, 4
xor eax, eax
jmp 0x472be2
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 8]
push edx
push 0x4aa438
mov eax, dword [ebp - 0xc]
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x472bc8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
mov dword [ecx], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x12c], ecx
mov edx, dword [ebp - 0x12c]
push edx
call sub.mfc90.dll_Ordinal_266
add esp, 4
mov eax, 1
jmp 0x472be2
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x130], eax
mov ecx, dword [ebp - 0x130]
push ecx
call sub.mfc90.dll_Ordinal_266
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00408de6
mov esp, ebp
pop ebp
ret
Function at 0x472c50
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483d99
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4b6018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 0
push 0x4ab1d4
lea ecx, [ebp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_1603]
neg eax
sbb eax, eax
neg eax
movzx eax, al
test eax, eax
je 0x472d55
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0x10]
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp + 0x10]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
push ecx
mov edx, dword [ebp + 8]
and edx, 0xffff
movzx eax, dx
push eax
mov ecx, dword [ebp + 8]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
push edx
push str.You_currently_use_version__u._u_of_this_program._The_newest_version__u._u_is_available_online_for_Free._Do_you_want_to_see_more_information_
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.mfc90.dll_Ordinal_2539]
add esp, 0x18
mov ecx, dword [0x4c8c00]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], edx
push 0x44
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x472d34
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
push 5
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.004728f0
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
jmp 0x472dc9
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [ebp - 4], 2
push str.This_version_has_expired__please_upgrade_to_the_latest_version._Exiting..
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.mfc90.dll_Ordinal_2539]
add esp, 8
mov eax, dword [0x4c8c00]
mov dword [ebp - 0x24], eax
push 0x40
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
mov dword [ebp - 0x28], ecx
push 5
mov edx, dword [ebp - 0x28]
push edx
call fcn.004728f0
add esp, 8
push 1
call dword [sym.imp.MSVCR90.dll_exit]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x473610
Capabilities:
Create http request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x4b6018]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [0x4c8c00]
mov dword [ebp - 0x428], eax
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x428]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 8], eax
push 0
push 0x84000101
push 0xffffffffffffffff
push 0
push str.http:__api.virtualaudiostreaming.net_c.txt
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4736c5
lea eax, [ebp - 0x414]
push eax
push 0x400
lea ecx, [ebp - 0x410]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00472920
add esp, 0x10
movzx eax, al
test eax, eax
je 0x4736bb
cmp dword [ebp - 0x414], 0
jbe 0x4736bb
mov dword [ebp - 0x420], 3
lea ecx, [ebp - 0x410]
push ecx
push str.doqnwekllhmtj.cloudfront.net
mov ecx, 0x4c8bfc
call dword [sym.imp.mfc90.dll_Ordinal_5924]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00408de6
mov esp, ebp
pop ebp
ret
Function at 0x4748b0
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x68], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], 0
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
mov esp, ebp
pop ebp
ret
Function at 0x47f220
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
cmp dword [0x4c7b64], 0
jne 0x47f24e
push 0
mov eax, dword [0x4c8c00]
push eax
push str.Please_upgrade_to_Pro_version_for_getting_the_converter.
push 0
call dword [sym.imp.BCGCBPRO120090.dll_int___cdecl_BCGPMessageBox_struct_HWND_____char_const___char_const___unsigned_int_]
add esp, 0x10
jmp 0x47f266
push 1
push 0
push 0
push str.http:__freevideoconverter.us_
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call sub.mfc90.dll_Ordinal_2592
mov dword [ebp - 4], eax
mov eax, dword [0x4c7b08]
mov dword [ebp - 8], eax
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0x465
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x483060
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484f5c
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x218
mov eax, dword [0x4b6018]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x11], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1f8]
call fcn.0047ab90
mov dword [ebp - 0x220], eax
mov byte [ebp - 4], 1
push 1
push 0x1d1
push str.hwsmtp.exmail.qq.com
lea ecx, [ebp - 0x1f8]
call fcn.00476480
mov dword [ebp - 0x28], 2
push str.support_xdownloader.org
lea ecx, [ebp - 0x1f8]
call fcn.00476500
push str.Goodpass6_
lea ecx, [ebp - 0x1f8]
call fcn.004764d0
push str.User
lea ecx, [ebp - 0x1f8]
call fcn.00476590
push str.support_xdownloader.org
lea ecx, [ebp - 0x1f8]
call fcn.004765c0
push str.support_xdownloader.org
lea ecx, [ebp - 0x1f8]
call fcn.004765f0
push str.The_error_data_for_analysis
lea ecx, [ebp - 0x1f8]
call fcn.00476560
push 0
push str.support_shiningmorning.com
lea ecx, [ebp - 0x1f8]
call fcn.0047a6b0
push 3
lea ecx, [ebp - 0x1f8]
call fcn.00476620
push str.The_Bat___v3.02__Professional
lea ecx, [ebp - 0x1f8]
call fcn.00476530
push str.Hello_
lea ecx, [ebp - 0x1f8]
call fcn.0047a5d0
push 0x4aa107
lea ecx, [ebp - 0x1f8]
call fcn.0047a5d0
push str.url:
lea ecx, [ebp - 0x1f8]
call fcn.0047a5d0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x1f8]
call fcn.0047a5d0
push 0x4aa107
lea ecx, [ebp - 0x1f8]
call fcn.0047a5d0
push str.See_attachment.
lea ecx, [ebp - 0x1f8]
call fcn.0047a5d0
push 0x4aa107
lea ecx, [ebp - 0x1f8]
call fcn.0047a5d0
push str.Regards
lea ecx, [ebp - 0x1f8]
call fcn.0047a5d0
push str.regards
push 5
lea ecx, [ebp - 0x1f8]
call fcn.0047a3e0
push 2
lea ecx, [ebp - 0x1f8]
call fcn.0047a4d0
push str.User
lea ecx, [ebp - 0x1f8]
call fcn.0047a5d0
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x1f8]
call fcn.0047a810
lea ecx, [ebp - 0x1f8]
call fcn.0047da70
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1f8]
call fcn.0047a8f0
jmp 0x4832e3
mov dword [ebp - 4], 0xffffffff
movzx ecx, byte [ebp - 0x11]
test ecx, ecx
jne 0x483313
push str.Mail_was_send_successfully._n
mov edx, dword [sym.imp.MSVCP90.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push edx
call fcn.004047e0
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCR90.dll_remove]
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00408de6
mov esp, ebp
pop ebp
ret
Function at 0x403960
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
cmp dword [0x417158], 0
jne 0x4039f1
push str.GlobalSeP_Is_Vista_Semaphore
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4039a3
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x417154], 1
jmp 0x4039e7
push 0x94
push 0
lea ecx, [ebp - 0xa0]
push ecx
call fcn.00407070
add esp, 0xc
mov dword [ebp - 0xa0], 0x94
lea edx, [ebp - 0xa0]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4039e7
cmp dword [ebp - 0x9c], 6
jne 0x4039e7
mov dword [0x417154], 1
mov dword [0x417158], 1
mov eax, dword [0x417154]
mov esp, ebp
pop ebp
ret

Function at 0x403d20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
call fcn.00404220
test eax, eax
jne 0x403d50
push 0x30
push 0x413aac
push 0x413b1c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x403d8d
call fcn.00406bf0
mov dword [0x41714c], eax
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0x403d00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x403d8d
mov edx, dword [ebp - 0xc]
push edx
call dword [0x41713c]
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4042b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
jne 0x404364
cmp dword [0x417160], 0
jne 0x404362
push 0x400
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x417160], eax
cmp dword [0x417160], 0
je 0x404362
mov eax, dword [0x417160]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x404316
mov ecx, dword [0x417160]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [0x417160], 0
jmp 0x404362
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], edx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 4]
push ecx
movzx edx, word [ebp - 0x10]
push edx
movzx eax, word [ebp - 8]
push eax
movzx ecx, word [ebp - 2]
push ecx
movzx edx, word [ebp - 6]
push edx
mov eax, dword [0x417160]
push eax
push str._s__d_d_d_d_d._cf
mov ecx, dword [0x417160]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
jmp 0x404384
cmp dword [0x417160], 0
je 0x404384
mov edx, dword [0x417160]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [0x417160], 0
mov eax, dword [0x417160]
mov esp, ebp
pop ebp
ret
Function at 0x4050a0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push 0x41
push 0
lea eax, [ebp - 0x48]
push eax
call fcn.00407070
add esp, 0xc
push 0x41
lea ecx, [ebp - 0x48]
push ecx
push 0x3e8
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
add ecx, 1
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0x4c]
mov al, byte [edx]
mov byte [ebp - 0x51], al
add dword [ebp - 0x4c], 1
cmp byte [ebp - 0x51], 0
jne 0x4050e1
mov ecx, dword [ebp - 0x4c]
sub ecx, dword [ebp - 0x50]
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0x58]
add edx, 1
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x417128], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x5c], eax
mov ecx, dword [0x417128]
mov dword [ebp - 0x60], ecx
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x5c]
mov cl, byte [eax]
mov byte [ebp - 0x65], cl
mov edx, dword [ebp - 0x60]
mov al, byte [ebp - 0x65]
mov byte [edx], al
mov ecx, dword [ebp - 0x5c]
add ecx, 1
mov dword [ebp - 0x5c], ecx
mov edx, dword [ebp - 0x60]
add edx, 1
mov dword [ebp - 0x60], edx
cmp byte [ebp - 0x65], 0
jne 0x405125
mov esp, ebp
pop ebp
ret
Function at 0x405b10
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x405b73
push 0x5c
mov ecx, dword [ebp + 8]
push ecx
call fcn.00407666
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405b73
mov edx, dword [ebp - 4]
mov byte [edx], 0
mov eax, dword [ebp + 8]
push eax
call fcn.00405b10
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov byte [ecx], 0x5c
cmp dword [ebp - 8], 0
je 0x405b73
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x406600
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x417170], 0
jne 0x40664e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, 0xbb8
jae 0x40664e
push 0
push 0
call fcn.00406750
add esp, 8
mov dword [0x417170], eax
cmp dword [0x417170], 0
je 0x406644
jmp 0x40664e
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x406618
cmp dword [0x417170], 0
je case.0x40666e.1
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
ja case.0x40666e.1
mov ecx, dword [ebp - 8]
jmp dword [ecx*4 + 0x406730]
mov edx, dword [0x417170]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp case.0x40666e.1
push 0
mov eax, dword [ebp + 0xc]
push eax
push 0x402
push 0x3ea
mov ecx, dword [0x417170]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.0x40666e.1
push 0
push 0
push 0x408
push 0x3ea
mov edx, dword [0x417170]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
add eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
push 0
mov eax, dword [ebp + 0xc]
push eax
push 0x402
push 0x3ea
mov ecx, dword [0x417170]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.0x40666e.1
mov edx, dword [ebp + 0xc]
push edx
push 0x3e9
mov eax, dword [0x417170]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [0x417170]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [0x417170]
mov esp, ebp
pop ebp
ret

Function at 0x406790
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
jne 0x406844
cmp dword [0x41717c], 0
jne 0x406842
push 0x400
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x41717c], eax
cmp dword [0x41717c], 0
je 0x406842
mov eax, dword [0x41717c]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x4067f6
mov ecx, dword [0x41717c]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [0x41717c], 0
jmp 0x406842
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], edx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 4]
push ecx
movzx edx, word [ebp - 0x10]
push edx
movzx eax, word [ebp - 8]
push eax
movzx ecx, word [ebp - 2]
push ecx
movzx edx, word [ebp - 6]
push edx
mov eax, dword [0x41717c]
push eax
push str._s__d_d_d_d_d.exe
mov ecx, dword [0x41717c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
jmp 0x406864
cmp dword [0x41717c], 0
je 0x406864
mov edx, dword [0x41717c]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [0x41717c], 0
mov eax, dword [0x41717c]
mov esp, ebp
pop ebp
ret
Function at 0x406bf0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.00403960
test eax, eax
je 0x406c2c
push 1
push str._SeP_MAP_SCAtcBin_OutFilePath
push 0
push 4
call fcn.00403a00
add esp, 0x10
mov dword [ebp - 8], eax
jmp 0x406c3e
push str._SeP_MAP_SCAtcBin_OutFilePath
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x406ca5
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x406c9b
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x417148], eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [0x417148]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0xc], 1
mov edx, dword [ebp - 8]
push edx
call dword [0x41713c]
call fcn.00403960
test eax, eax
je 0x406cc6
push 1
push str._SeP_Event_SCAtcBin
push 1
push 2
call fcn.00403ad0
add esp, 0x10
mov dword [ebp - 0x10], eax
jmp 0x406cd8
push str._SeP_Event_SCAtcBin
push 1
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x406cf2
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [0x41713c]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret