joyce8/EMBER2024-capa huggingface dataset:
Function at 0x70002b2f
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x70005048]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 0x24], ecx
mov byte [ebp - 0x10], 1
mov byte [ebp - 0xf], 2
mov byte [ebp - 0xe], 4
mov byte [ebp - 0xd], 8
mov byte [ebp - 0xc], 0x10
mov byte [ebp - 0xb], 0x20
mov byte [ebp - 0xa], 0x40
mov byte [ebp - 9], 0x80
mov byte [ebp - 8], 0x1b
mov byte [ebp - 7], 0x36
xor edi, edi
mov ebx, eax
mov ecx, dword [ebp + 8]
xor esi, esi
lea edx, [edi + ecx]
mov cl, byte [edx]
mov byte [ebx + esi], cl
inc esi
add edx, 4
cmp esi, 4
jl 0x70002b7e
inc edi
add ebx, 4
cmp edi, 4
jl 0x70002b76
lea edi, [eax + 0x10]
lea eax, [ebp - 0x10]
dec eax
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], eax
and dword [ebp - 0x1c], 0
lea eax, [edi - 0xd]
mov ecx, eax
mov eax, dword [ebp - 0x1c]
lea esi, [edi + eax]
xor edx, edx
lea eax, [esi - 1]
cmp dword [ebp - 0x1c], 0
je 0x70002bc7
mov bl, byte [eax]
jmp 0x70002bc9
mov bl, byte [ecx]
mov byte [ebp + edx - 0x14], bl
inc edx
add eax, 4
add ecx, 4
cmp edx, 4
jl 0x70002bbd
xor edx, edx
cmp dword [ebp - 0x1c], edx
jne 0x70002c32
mov al, byte [ebp - 0x14]
xor edi, edi
mov byte [ebp - 0x15], al
inc edi
lea eax, [ebp - 0x14]
sub edi, eax
lea eax, [ebp + edx - 0x14]
lea ecx, [edi + eax]
and ecx, 0x80000003
jns 0x70002c02
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebp + ecx - 0x14]
mov ebx, dword [ebp - 0x24]
mov cl, byte [ecx + ebx + 4]
inc edx
cmp edx, 3
mov byte [eax], cl
jl 0x70002bee
movzx eax, byte [ebp - 0x15]
mov edi, dword [ebp - 0x28]
mov ecx, ebx
mov al, byte [eax + ecx + 4]
mov ecx, dword [ebp - 0x20]
mov byte [ebp - 0x11], al
mov eax, dword [ebp - 0x2c]
mov al, byte [eax + ecx]
xor byte [ebp - 0x14], al
xor edx, edx
mov eax, esi
mov cl, byte [ebp + edx - 0x14]
xor cl, byte [eax - 0x10]
inc edx
mov byte [eax], cl
add eax, 4
cmp edx, 4
jl 0x70002c36
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x70002bad
inc dword [ebp - 0x20]
add edi, 0x10
cmp dword [ebp - 0x20], 0xa
mov dword [ebp - 0x28], edi
jle 0x70002ba9
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.7000432d
leave
ret 8

Function at 0x70002e4a
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
xor ecx, ecx
sub esi, edi
push 4
lea eax, [ecx + edi]
pop edx
mov bl, byte [esi + eax]
xor byte [eax], bl
add eax, 4
dec edx
jne 0x70002e62
inc ecx
cmp ecx, 4
jl 0x70002e5c
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x100018e4
Capabilities:
Create process on windows
Get common file path

Disassembly:
push 0x21c
mov eax, 0x10009593
call fcn.100089a7
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [0x1000e04c]
cmp eax, 0x1000e04c
je 0x10001927
test dword [eax + 0x1c], 0x100
je 0x10001927
cmp byte [eax + 0x19], 6
jb 0x10001927
push ebx
push 0x1000a79c
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.10009220
xor edi, edi
test esi, esi
jne 0x10001937
mov eax, 0x80004005
jmp 0x10001b10
push dword [esi]
lea ecx, [ebp - 0x228]
call fcn.10002f0d
mov dword [ebp - 4], 1
call fcn.100012d5
push eax
lea ecx, [ebp - 0x224]
call fcn.10009220
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 2
push eax
mov esi, 0x104
mov dword [ebp - 0x21c], edi
push esi
call dword [sym.imp.kernel32.dll_GetTempPathW]
test eax, eax
jne 0x1000198f
push 0x1000a630
push esi
lea eax, [ebp - 0x218]
push eax
call fcn.10009220
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x220]
call fcn.10002f0d
push 0xd
push str.Join.ocsmeet
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 3
call fcn.10009220
push 0x1000a654
push dword [ebp - 0x220]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
add esp, 0xc
test eax, eax
jne 0x10001a17
cmp dword [ebp - 0x21c], eax
je 0x10001a17
push dword [ebp - 0x21c]
push dword [ebp - 0x228]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputws]
pop ecx
pop ecx
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x224]
call fcn.10009220
push dword [ebp - 0x21c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
mov dword [ebp - 0x21c], edi
mov esi, dword [ebp - 0x224]
cmp dword [esi - 0xc], edi
jne 0x10001a2c
mov edi, 0x80004005
jmp 0x10001abc
push 0xa
mov eax, 0x1000a798
push eax
push eax
push esi
push 0x1000a658
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x10001abc
cmp eax, 0x1b
ja 0x10001a8c
je 0x10001ab0
dec eax
sub eax, 1
je 0x10001a85
sub eax, 1
je 0x10001a7e
dec eax
sub eax, 1
je 0x10001a77
sub eax, 3
je 0x10001a70
sub eax, 3
jne 0x10001a22
mov edi, 0x8007000b
jmp 0x10001abc
mov edi, 0x8007000e
jmp 0x10001abc
mov edi, 0x80070005
jmp 0x10001abc
mov edi, 0x80070003
jmp 0x10001abc
mov edi, 0x80070002
jmp 0x10001abc
sub eax, 0x1c
je 0x10001ab7
sub eax, 1
je 0x10001ab7
sub eax, 1
je 0x10001ab7
sub eax, 1
je 0x10001ab0
sub eax, 1
jne 0x10001a22
mov edi, 0x80070485
jmp 0x10001abc
mov edi, 0x80070483
jmp 0x10001abc
mov edi, 0x80070484
mov eax, dword [0x1000e04c]
cmp eax, 0x1000e04c
je 0x10001aea
test dword [eax + 0x1c], 0x100
je 0x10001aea
cmp byte [eax + 0x19], 6
jb 0x10001aea
push ebx
push 0x1000a79c
push 0x1a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.10009220
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.10009220
lea ecx, [esi - 0x10]
call fcn.10009220
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
call fcn.10009220
mov eax, edi
call fcn.10008959
ret 8
Function at 0x10004f9f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x1000985d
call fcn.10008a15
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
push 0x60
push ebx
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1000501c
push 2
push ebx
push esi
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x1000501c
call fcn.10003697
mov esi, eax
jmp 0x1000512c
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x1000503f
call fcn.10003697
jmp 0x1000511f
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x10005035
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x420], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x10005072
mov esi, 0x8007000e
jmp 0x10005121
push 2
push eax
lea eax, [ebp - 0x41c]
mov byte [ebp - 4], 2
push eax
call fcn.10009220
test eax, eax
js 0x1000515a
cmp dword [ebp - 0x41c], 0x400
jbe 0x100050c2
push dword [ebp - 0x41c]
lea ecx, [ebp - 0x418]
call fcn.10009220
jmp 0x100050ce
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
je 0x10005068
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x428]
push ebx
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x10005035
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.10009220
mov esi, eax
test edi, edi
je 0x1000512c
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10005145
lea ecx, [ebp - 0x418]
call fcn.1000365f
lea ecx, [ebp - 0x42c]
call fcn.10003d3f
mov eax, esi
call fcn.10008966
ret 0x10
push eax
call fcn.10009220
int3
Function at 0x10009220
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1000922f
pop dword [ebp - 0x34]
mov eax, 0x1e3c1d80
add eax, 0xf1c474af
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x3534aa76
sub dword [ebp - 0x44], 0xe6e2652b
mov dword [ebp - 0x40], 0x8e5a3c11
add dword [ebp - 0x40], 0xa3d91034
mov dword [ebp - 0x3c], 0x9b1d7dc5
add dword [ebp - 0x3c], 0xb12ec669
mov dword [ebp - 0x38], 0x623c1868
sub dword [ebp - 0x38], 0x623c1868
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xe1adf4ea
add dword [ebp - 0x44], 0x92c4746c
mov dword [ebp - 0x40], 0xfe484720
add dword [ebp - 0x40], 0x43241a55
mov dword [ebp - 0x3c], 0xf1ef76b0
sub dword [ebp - 0x3c], 0x8e800a44
mov dword [ebp - 0x38], 0xc18018ee
sub dword [ebp - 0x38], 0xc18018ee
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xbadb20b3
add eax, 0x55257fbd
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x34c88
push 0
call eax
mov ecx, 0x3b16
mov edx, eax
mov esi, 0x10013200
add esi, dword [ebp - 0x34]
mov ebx, 0x4abfee60
add dword [ebp - 0xc], eax
mov edi, dword [esi]
xor dword [ebp - 0x30], eax
sub edi, ebx
add dword [ebp - 8], eax
mov dword [edx], edi
xor dword [ebp - 0x28], 0xe0c8e335
add edx, 0xa49c14d1
sub edx, 0xa49c14cd
add esi, 4
loop 0x1000933a
add eax, 0xca2a76f3
add eax, 0x35d66838
mov ebx, eax
add eax, 0xb147f27c
add eax, 0x4eb80d89
mov ecx, 0x895530d9
sub ecx, 0x795530d9
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x818058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x8181a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x81807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x81806a
add dl, dl
jne 0x818089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8180dc
xor eax, eax
add dl, dl
jne 0x818096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x81817d
add dl, dl
jne 0x8180a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8180b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8180bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8180c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8180d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x818075
mov eax, 1
add dl, dl
jne 0x8180ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8180f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8180e1
sub eax, ebx
mov ebx, 1
jne 0x818128
mov ecx, 1
add dl, dl
jne 0x81810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x818119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x818105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x818075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x81813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x81814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x818136
cmp eax, 0x7d00
jae 0x81816d
cmp eax, 0x500
jb 0x818168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x818075
cmp eax, 0x7f
ja 0x818170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x818075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x81819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x818075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x440d8f
Capabilities:
Encode data using xor

Disassembly:
sub al, al
pushal
push 0x12daacbd
cmp dh, bl
repne scasb al, byte es:[edi]
push edi
jmp 0x440274
Function at 0x40a3d0
Capabilities:
Terminate process

Disassembly:
xor al, 0xc0
mov ah, 0
test dword [edx + 0x75], esp
aad 0xa8
xor eax, 0xb5c498
imul edx, esi, 0xffffff85
sal byte [edi + edx*4 - 1], 0xd6
rol byte [eax + 0x5e270a1a], cl
pop ebp
ret 0xe3
inc eax
add byte [eax - 0x40], dl
jecxz 0x40a3ff
nop
jo 0x40a37b
nop
nop
nop
push ebp
mov ebp, esp
mov ebx, esi
mov cl, byte [ebx - 0x3f7aebc0]
jno 0x40a410
sahf
dec ebp
or al, 0x51
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop eax
jne 0x40a3a9
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push ebx
sal byte [ebp + 5], 8
pop ebp
ret 8
salc
jb 0x40a3cd
cld
or al, byte [eax]
pop esi
jg 0x40a3ca
or byte [eax], al
xor eax, eax
int3
lcall 0xc25d, 0x4e3b
dec eax
add byte [eax + 0x9709090], dl
adc al, 0x90
ret
Function at 0x405ee9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x405f0d
xor eax, eax
test eax, eax
je 0x405f1f
cmp byte [ebp + eax - 0x121], 0x5c
je 0x405f1f
xor ecx, ecx
jmp 0x405f22
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x409010]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x405fc6
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c634], 0
push esi
jne 0x405ffd
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405fd7
mov dword [ecx*4 + 0x42c630], eax
inc ecx
cmp ecx, 0x100
jl 0x405fd2
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40602e
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c630]
xor eax, esi
inc ecx
dec edx
jne 0x406010
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401040
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x580280]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x624], ecx
push 0x5498ac
mov eax, dword [ebp - 0x624]
add eax, 0x170
push eax
call fcn.00486b10
add esp, 8
mov ecx, dword [ebp - 0x624]
call fcn.004459c0
xor ecx, ecx
mov word [ebp - 0x418], cx
push 0x206
push 0
lea edx, [ebp - 0x416]
push edx
call fcn.00486c20
add esp, 0xc
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00486c20
add esp, 0xc
xor edx, edx
mov word [ebp - 0x620], dx
push 0x206
push 0
lea eax, [ebp - 0x61e]
push eax
call fcn.00486c20
add esp, 0xc
mov ecx, dword [ebp - 0x624]
add ecx, 0x90
call fcn.004012c0
push eax
lea ecx, [ebp - 0x418]
push ecx
call fcn.00486ae5
add esp, 8
push 0x5498e8
lea edx, [ebp - 0x418]
push edx
call fcn.00486ab7
add esp, 8
lea eax, [ebp - 0x418]
push eax
push 0x104
mov ecx, dword [ebp - 0x624]
add ecx, 0x274
push ecx
push 0x549910
push 0x549918
push 0x54992c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x418]
push edx
push 0x104
mov eax, dword [ebp - 0x624]
add eax, 0x47c
push eax
push str.lastgf
push 0x54994c
push 0x549968
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00486c08
mov esp, ebp
pop ebp
ret 4
Function at 0x401c00
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53cd3b
mov eax, dword fs:[0]
push eax
sub esp, 0x474
mov eax, dword [0x580280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x480], ecx
cmp dword [ebp + 8], 0
jne 0x401c3e
xor eax, eax
jmp 0x401df8
mov byte [ebp - 0x214], 0
push 0xff
push 0
lea eax, [ebp - 0x213]
push eax
call fcn.00486c20
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x214]
push edx
call fcn.00486b10
add esp, 8
mov dword [ebp - 0x218], 0
mov eax, dword [ebp + 8]
push eax
call fcn.00487780
add esp, 4
mov dword [ebp - 0x474], eax
lea ecx, [ebp - 0x470]
call fcn.00402870
mov dword [ebp - 4], 0
mov byte [ebp - 0x114], 0
push 0xff
push 0
lea ecx, [ebp - 0x113]
push ecx
call fcn.00486c20
add esp, 0xc
mov edx, dword [ebp - 0x474]
movsx eax, byte [ebp + edx - 0x215]
cmp eax, 0x5c
je 0x401cda
mov ecx, dword [ebp - 0x474]
mov byte [ebp + ecx - 0x214], 0x5c
mov edx, dword [ebp - 0x218]
movsx eax, byte [ebp + edx - 0x214]
test eax, eax
je 0x401dd6
mov ecx, dword [ebp - 0x218]
movsx edx, byte [ebp + ecx - 0x214]
cmp edx, 0x3a
jne 0x401d14
mov eax, dword [ebp - 0x218]
add eax, 2
mov dword [ebp - 0x218], eax
jmp 0x401cda
mov ecx, dword [ebp - 0x218]
movsx edx, byte [ebp + ecx - 0x214]
cmp edx, 0x5c
jne 0x401dc2
mov eax, dword [ebp - 0x218]
push eax
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x114]
push edx
call fcn.00487410
add esp, 0xc
mov eax, dword [ebp - 0x218]
mov byte [ebp + eax - 0x114], 0
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x470]
call fcn.004028b0
lea edx, [ebp - 0x46c]
push edx
lea ecx, [ebp - 0x470]
call fcn.00405cf0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x401dc2
push 0
lea ecx, [ebp - 0x470]
call fcn.00405cf0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401dc2
mov dword [ebp - 0x478], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x470]
call fcn.00402890
mov eax, dword [ebp - 0x478]
jmp 0x401df8
mov eax, dword [ebp - 0x218]
add eax, 1
mov dword [ebp - 0x218], eax
jmp 0x401cda
mov dword [ebp - 0x47c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x470]
call fcn.00402890
mov eax, dword [ebp - 0x47c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00486c08
mov esp, ebp
pop ebp
ret 4
Function at 0x407500
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d2a0
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x580280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004012c0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x407560
mov dword [ebp - 0x48], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00406040
mov eax, dword [ebp - 0x48]
jmp 0x4076bf
lea ecx, [ebp - 0x3c]
call fcn.0047bd4a
mov byte [ebp - 4], 1
push 0
push 0
lea ecx, [ebp + 8]
call fcn.004012c0
push eax
lea ecx, [ebp - 0x3c]
call fcn.0047c1c2
lea ecx, [ebp - 0x3c]
call fcn.0047bc35
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.0047b469
add esp, 4
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x18]
push edx
push 0
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00486c20
add esp, 0xc
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x3c]
call fcn.0047ba3e
push 0x549e3c
call fcn.00487780
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x44], 0
jmp 0x4075ec
mov eax, dword [ebp - 0x44]
add eax, 1
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
cmp ecx, dword [ebp - 0x18]
jge 0x40762b
mov edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x44]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x40]
movsx edx, byte [ecx + 0x549e44]
xor eax, edx
mov ecx, dword [ebp - 0x2c]
add ecx, dword [ebp - 0x44]
mov byte [ecx], al
mov edx, dword [ebp - 0x40]
add edx, 1
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x14]
jl 0x407629
mov dword [ebp - 0x40], 0
jmp 0x4075e3
lea ecx, [ebp - 0x3c]
call fcn.0047bce4
lea ecx, [ebp - 0x28]
call fcn.0047bd4a
mov byte [ebp - 4], 2
push 0
push 0x1001
lea ecx, [ebp + 8]
call fcn.004012c0
push eax
lea ecx, [ebp - 0x28]
call fcn.0047c1c2
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x28]
call fcn.0047ba80
lea ecx, [ebp - 0x28]
call fcn.0047bce4
cmp dword [ebp - 0x2c], 0
je 0x40768e
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.0047b474
add esp, 4
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x54], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.0047be52
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.0047be52
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00406040
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4076d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d2d3
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x580280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x70], ecx
mov ecx, dword [ebp - 0x70]
add ecx, 4
call fcn.00415020
mov ecx, dword [ebp - 0x70]
add ecx, 4
call fcn.004151d0
push 0xa
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax + 0x20]
call fcn.00416020
mov ecx, dword [ebp - 0x70]
add ecx, 0x40
call fcn.004012c0
push eax
mov ecx, dword [ebp - 0x70]
add ecx, 0x24
call fcn.004012c0
push eax
mov ecx, dword [ebp - 0x70]
add ecx, 4
call fcn.004158d0
test eax, eax
setne cl
mov edx, dword [ebp - 0x70]
mov byte [edx + 0x5c], cl
mov eax, dword [ebp - 0x70]
add eax, 0x40
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x34], esp
push eax
call fcn.00407860
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x70]
call fcn.00407500
call fcn.004058c0
mov ecx, eax
call fcn.00447840
push eax
lea ecx, [ebp - 0x2c]
call fcn.00401280
mov dword [ebp - 4], 0
push 0x549e4c
lea ecx, [ebp - 0x2c]
call fcn.004078c0
lea ecx, [ebp - 0x2c]
call fcn.004012c0
push eax
lea ecx, [ebp - 0x50]
call fcn.00401280
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x70]
add ecx, 0x40
call fcn.004012c0
push eax
lea ecx, [ebp - 0x6c]
call fcn.00401280
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x6c]
push edx
lea ecx, [ebp - 0x2d]
call fcn.0045cb70
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x6c]
call fcn.00406040
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x50]
call fcn.00406040
mov ecx, dword [ebp - 0x70]
add ecx, 0x40
call fcn.004012c0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x70]
mov byte [eax + 0x5d], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00406040
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00486c08
mov esp, ebp
pop ebp
ret
Function at 0x408d00
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x580280]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x220], ecx
call fcn.004058c0
mov ecx, eax
call fcn.00447800
mov dword [ebp - 0x21c], eax
mov byte [ebp - 0x218], 0
push 0x103
push 0
lea eax, [ebp - 0x217]
push eax
call fcn.00486c20
add esp, 0xc
lea ecx, [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x21c]
push edx
call fcn.0044a710
add esp, 8
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.00486c20
add esp, 0xc
push 0x54a190
lea ecx, [ebp - 0x218]
push ecx
call fcn.00486b20
add esp, 8
lea edx, [ebp - 0x218]
push edx
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0x54a1a0
push 0x54a1b0
push 0x54a1c0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [ebp + 8]
push ecx
call fcn.00487d3d
add esp, 4
mov edx, dword [ebp - 0x220]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 0x220]
call fcn.0040c3e0
mov ecx, dword [ebp - 0x220]
call fcn.0040bfc0
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00486c08
mov esp, ebp
pop ebp
ret 4