joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4018d0
Capabilities:
Check if file exists
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push esi
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4018ee
xor eax, eax
xor edx, edx
jmp 0x401a35
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
add edx, 4
push edx
call fcn.00426698
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x401a2f
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x401a1c
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0x43d754
mov edx, dword [ebp - 0x14]
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x401a1c
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
xor edx, edx
mov cl, 0x20
call fcn.004264f0
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0xc]
xor esi, esi
or eax, ecx
or edx, esi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
cmp dword [ebp + 0xc], 0
je 0x401a1c
lea edx, [ebp - 0x3c]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x401a1c
mov eax, dword [ebp - 0x34]
xor edx, edx
mov cl, 0x20
call fcn.004264f0
mov ecx, dword [ebp - 0x38]
xor esi, esi
or eax, ecx
or edx, esi
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x24]
xor edx, edx
mov cl, 0x20
call fcn.004264f0
mov ecx, dword [ebp - 0x28]
xor esi, esi
or eax, ecx
or edx, esi
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
mov edx, dword [ebp - 0x4c]
cmp edx, dword [ebp - 0x44]
jb 0x401a02
ja 0x4019f4
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x48]
jbe 0x401a02
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 0x54], edx
jmp 0x401a0e
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x58]
mov dword [edx], eax
mov ecx, dword [ebp - 0x54]
mov dword [edx + 4], ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004265bb
add esp, 4
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401a40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43ae38
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x4b249c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x140], 0
lea ecx, [ebp - 0x30]
call fcn.00405120
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
call fcn.004052b0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x401ac6
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp + 8]
call fcn.004051d0
mov ecx, dword [ebp - 0x140]
or ecx, 1
mov dword [ebp - 0x140], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00405210
mov eax, dword [ebp + 8]
jmp 0x401b95
xor edx, edx
mov word [ebp - 0x134], dx
push 0xfe
push 0
lea eax, [ebp - 0x132]
push eax
call fcn.00426300
add esp, 0xc
push 0
mov ecx, dword [ebp + 0xc]
call fcn.004052b0
push eax
call fcn.004018d0
add esp, 8
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], edx
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
and eax, 0xffff
movzx ecx, ax
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
and eax, 0xffff
movzx ecx, ax
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
push ecx
push 0x43d758
push 0xffffffffffffffff
push 0x80
lea edx, [ebp - 0x134]
push edx
call fcn.004262dd
add esp, 0x20
lea eax, [ebp - 0x134]
push eax
mov ecx, dword [ebp + 8]
call fcn.00405190
mov ecx, dword [ebp - 0x140]
or ecx, 1
mov dword [ebp - 0x140], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00405210
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042624f
mov esp, ebp
pop ebp
ret
Function at 0x402790
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4027d1
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esp, ebp
pop ebp
ret

Function at 0x4027e0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x664
mov eax, dword [0x4b249c]
xor eax, ebp
mov dword [ebp - 0xc], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x664], eax
cmp dword [ebp - 0x664], 0
jne 0x402812
xor eax, eax
jmp 0x402913
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x660], 0x22c
push 0x228
push 0
lea eax, [ebp - 0x65c]
push eax
call fcn.00426300
add esp, 0xc
lea ecx, [ebp - 0x660]
push ecx
mov edx, dword [ebp - 0x664]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x402903
mov eax, dword [ebp + 8]
push eax
push 0x104
lea ecx, [ebp - 0x220]
push ecx
call fcn.00426dd5
add esp, 0xc
push 0x104
lea edx, [ebp - 0x220]
push edx
call fcn.00426dbe
add esp, 8
lea eax, [ebp - 0x63c]
push eax
push 0x104
lea ecx, [ebp - 0x430]
push ecx
call fcn.00426dd5
add esp, 0xc
push 0x104
lea edx, [ebp - 0x430]
push edx
call fcn.00426dbe
add esp, 8
mov eax, dword [ebp - 0x658]
cmp eax, dword [ebp - 4]
je 0x4028e8
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x430]
push edx
call fcn.00426b46
add esp, 8
test eax, eax
jne 0x4028e8
mov eax, dword [ebp - 0x658]
mov dword [ebp - 8], eax
jmp 0x402903
lea ecx, [ebp - 0x660]
push ecx
mov edx, dword [ebp - 0x664]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40285d
mov eax, dword [ebp - 0x664]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0042624f
mov esp, ebp
pop ebp
ret
Function at 0x4031b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [ebp + 0x14], 0
jne 0x4031c6
mov eax, 0x80070057
jmp 0x403320
xor eax, eax
mov ecx, dword [ebp + 0x14]
mov word [ecx], ax
mov dword [ebp - 0xc], 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x18]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x403200
mov eax, 0x80004005
jmp 0x403320
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
lea ecx, [ebp - 8]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x403245
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80004005
jmp 0x403320
mov edx, dword [ebp - 4]
add edx, 1
push edx
call fcn.00425db2
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x403277
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80004005
jmp 0x403320
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4032bf
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00426979
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80004005
jmp 0x403320
cmp dword [ebp - 8], 4
jne 0x4032dd
mov ecx, 0x13
mov edx, dword [ebp + 0x14]
mov word [edx], cx
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov dword [eax + 8], edx
jmp 0x403302
cmp dword [ebp - 8], 1
jne 0x403302
mov eax, 8
mov ecx, dword [ebp + 0x14]
mov word [ecx], ax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov ecx, dword [ebp + 0x14]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.00426979
add esp, 4
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x403c10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x403c19
xor ecx, ecx
jne 0x403c19
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shl eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x403c60
mov eax, dword [ebp - 0xc]
jmp 0x403cbd
cmp dword [ebp - 4], 1
je 0x403c73
cmp dword [ebp - 4], 2
je 0x403c73
mov eax, 0xd
jmp 0x403cbd
cmp dword [ebp + 0xc], 0
je 0x403cb1
cmp dword [ebp - 8], 0
je 0x403ca9
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x403ca0
mov edx, dword [ebp - 8]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x403ca7
mov eax, 0xd
jmp 0x403cbd
jmp 0x403cb1
xor edx, edx
mov eax, dword [ebp + 0xc]
mov word [eax], dx
mov ecx, dword [ebp - 8]
shr ecx, 1
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x408720
Capabilities:
Accept command line arguments
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x4b249c]
xor eax, ebp
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x2b8], ecx
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x260], ebp
push 0
mov eax, dword [ebp - 0x260]
push eax
push str.bool___thiscall_CKKPSetupModule::ParseCommandLine_const_wchar_t__long___throw__
call fcn.00412a50
add esp, 0xc
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0
jne 0x408782
mov dword [ebp - 0x25c], 0x43dbd8
push 0
push 0
push 0
mov ecx, dword [ebp - 0x2b8]
push ecx
push 0x43dbd8
push 0x43db90
mov edx, dword [ebp - 0x25c]
push edx
lea ecx, [ebp - 0x278]
call fcn.0040e100
cmp dword [ebp - 0x25c], 0
jne 0x4087b6
push ebp
pop ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x2b8]
mov dword [ecx + 0x48], eax
xor edx, edx
mov word [ebp - 0x258], dx
push 0x208
push 0
lea eax, [ebp - 0x256]
push eax
call fcn.00426300
add esp, 0xc
push 0xa
lea ecx, [ebp - 0x258]
push ecx
mov edx, dword [ebp - 0x2b8]
mov eax, dword [edx + 0x48]
push eax
call fcn.00418440
add esp, 0xc
lea ecx, [ebp - 0x258]
push ecx
push str.SetupStartTick
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
lea ecx, [ebp - 0x40]
call fcn.004088d0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x40]
call fcn.00408a30
lea ecx, [ebp - 0x40]
call fcn.00408b10
push eax
lea ecx, [ebp - 0x294]
call fcn.00405190
push 1
push 0
lea eax, [ebp - 0x294]
push eax
lea ecx, [ebp - 0x2b0]
push ecx
call fcn.00401c60
add esp, 8
mov ecx, eax
call fcn.004052b0
push eax
push 0x43db50
call fcn.004241c0
mov ecx, eax
call fcn.00424250
lea ecx, [ebp - 0x2b0]
call fcn.00405210
lea ecx, [ebp - 0x294]
call fcn.00405210
push 0x43db4c
push str.SetupState
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov byte [ebp - 0x2b1], 1
lea ecx, [ebp - 0x40]
call fcn.00408960
lea ecx, [ebp - 0x278]
call fcn.0040e4a0
mov al, byte [ebp - 0x2b1]
mov ecx, dword [ebp - 0x44]
xor ecx, ebp
call fcn.0042624f
mov esp, ebp
pop ebp
ret 8
Function at 0x408a30
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
call fcn.004089e0
cmp dword [ebp + 8], 0
je 0x408a57
mov eax, dword [ebp + 8]
push eax
call fcn.00426a1b
add esp, 4
test eax, eax
ja 0x408a5e
xor eax, eax
jmp 0x408b01
mov ecx, dword [ebp + 8]
push ecx
call fcn.00426a1b
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 1
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00425db2
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [eax + 0x38], ecx
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x38], 0
jne 0x408aa5
xor eax, eax
jmp 0x408b01
cmp dword [ebp + 8], 0
je 0x408ac7
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
add ecx, 1
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x38]
push eax
call fcn.00426dd5
add esp, 0xc
jmp 0x408ae4
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
mov ecx, dword [ebp - 4]
add ecx, 1
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x38]
push eax
call fcn.00426dd5
add esp, 0xc
mov ecx, dword [ebp - 0xc]
call fcn.00408df0
test eax, eax
jne 0x408afc
mov ecx, dword [ebp - 0xc]
call fcn.004089e0
xor eax, eax
jmp 0x408b01
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x40a610
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x28], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], ebp
push 0
mov eax, dword [ebp - 8]
push eax
push str.long___thiscall_CKKPSetupModule::PostMessageLoop_void__throw__
call fcn.00412a50
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40a64d
mov dword [ebp - 4], 0x43e098
push 0
push 0
push 0
mov ecx, dword [ebp - 0x28]
push ecx
push 0x43e098
push 0x43e050
mov edx, dword [ebp - 4]
push edx
lea ecx, [ebp - 0x20]
call fcn.0040e100
cmp dword [ebp - 4], 0
jne 0x40a675
push ebp
pop ebp
push 0x43e008
call fcn.0040de50
add esp, 4
test eax, eax
jne 0x40a711
push 2
push 0x43dff8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0
fild qword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 0x48]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], 0
fild qword [ebp - 0x38]
fsubp st(1)
fdiv qword [0x43dff0]
sub esp, 8
fstp qword [esp]
push str.__Running_Duration_
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.KKPSetup_Process_Exit_TickCount_
mov edx, dword [ebp - 0x28]
push edx
push 0x43e008
call fcn.0040e820
add esp, 8
mov ecx, eax
call fcn.0040d970
mov ecx, eax
call fcn.0040d7c0
mov ecx, eax
call fcn.0040d970
mov ecx, eax
call fcn.0040d890
mov ecx, eax
call fcn.0040d970
mov ecx, eax
call fcn.0040de00
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0x40], 0
je 0x40a743
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx + 0x40]
call fcn.00420a30
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x40]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 0x40]
mov eax, dword [eax]
push edx
mov ecx, dword [eax + 0x14]
call ecx
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x40], 0
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0x44], 0
je 0x40a755
mov dword [ebp - 0x3c], str.launch_succ
jmp 0x40a75c
mov dword [ebp - 0x3c], str.launch_failed
push 1
push 0
mov ecx, dword [ebp - 0x3c]
push ecx
push str.setup_exit
call fcn.004241c0
mov ecx, eax
call fcn.00424250
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x20]
call fcn.0040e4a0
mov eax, dword [ebp - 0x24]
mov esp, ebp
pop ebp
ret
Function at 0x40de50
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b61a
mov eax, dword fs:[0]
push eax
sub esp, 0x2f8
mov eax, dword [0x4b249c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x4b568c], 0
je 0x40e06a
xor eax, eax
mov word [ebp - 0x22c], ax
push 0x1fe
push 0
lea ecx, [ebp - 0x22a]
push ecx
call fcn.00426300
add esp, 0xc
call fcn.0040f3d0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__d___WARN____s_
push 0x100
lea edx, [ebp - 0x22c]
push edx
call fcn.0042934a
add esp, 0x14
push 0x43e298
push 0x43e294
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x248]
call fcn.00405190
mov dword [ebp - 0x2d8], eax
mov ecx, dword [ebp - 0x2d8]
mov dword [ebp - 0x2dc], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x2dc]
push edx
push 0x43e290
lea ecx, [ebp - 0x264]
call fcn.00405190
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0x2e0]
mov dword [ebp - 0x2e4], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x2e4]
push ecx
lea edx, [ebp - 0x22c]
push edx
lea ecx, [ebp - 0x280]
call fcn.00405190
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x2ec], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2ec]
push ecx
lea edx, [ebp - 0x29c]
push edx
call fcn.00418270
add esp, 0xc
mov dword [ebp - 0x2f0], eax
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x2f4], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x2f4]
push ecx
lea edx, [ebp - 0x2b8]
push edx
call fcn.00418270
add esp, 0xc
mov dword [ebp - 0x2f8], eax
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x2fc], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x2fc]
push ecx
lea edx, [ebp - 0x2d4]
push edx
call fcn.00418300
add esp, 0xc
mov dword [ebp - 0x300], eax
mov eax, dword [ebp - 0x300]
mov dword [ebp - 0x304], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x304]
push ecx
lea edx, [ebp - 0x2c]
push edx
call fcn.00418300
add esp, 0xc
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2d4]
call fcn.00405210
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x2b8]
call fcn.00405210
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x29c]
call fcn.00405210
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x280]
call fcn.00405210
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x264]
call fcn.00405210
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x248]
call fcn.00405210
lea ecx, [ebp - 0x2c]
call fcn.004052b0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00405210
mov eax, dword [0x4b568c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042624f
mov esp, ebp
pop ebp
ret
Function at 0x411190
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
cmp dword [0x4b568c], 0
je 0x4111b0
xor eax, eax
jmp 0x4112bb
mov eax, dword [ebp - 8]
cmp dword [eax + 0x24], 0xffffffff
jne 0x411232
push 0x11
push 0
push str.C:T_CONFIG_
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x24], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 0x24], 0xffffffff
je 0x411228
push str.C:T_CONFIGTSLOG.ini
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41121e
push str.C:T_CONFIGTSLOG.txt
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41121e
push str.C:T_CONFIGTSLOG.ini
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41121e
push str.C:T_CONFIGTSLOG.txt
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41121e
xor eax, eax
jmp 0x4112bb
push 0
mov ecx, dword [ebp - 8]
call fcn.0040f900
mov eax, 1
jmp 0x4112bb
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
je 0x41125b
cmp dword [ebp - 0xc], 0x102
je 0x41129e
jmp 0x4112a4
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov edx, dword [ebp - 8]
mov dword [edx + 0x24], 0xffffffff
push 0
mov ecx, dword [ebp - 8]
call fcn.0040f900
test eax, eax
je 0x411295
push 0x11
push 0
push str.C:T_CONFIG_
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x24], eax
mov eax, 1
jmp 0x4112bb
xor eax, eax
jmp 0x4112bb
push 0x11
push 0
push str.C:T_CONFIG_
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
mov edx, dword [ebp - 8]
mov dword [edx + 0x24], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x411bf0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x4b249c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x11c], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x114], ecx
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea edx, [ebp - 0x10f]
push edx
call fcn.00426300
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [ebp - 0x114], 0
jne 0x411c4f
xor eax, eax
jmp 0x411cef
mov eax, dword [ebp - 0x114]
add eax, 1
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp - 0x114]
movsx edx, byte [ecx]
test edx, edx
je 0x411cea
mov eax, dword [ebp - 0x114]
movsx ecx, byte [eax]
cmp ecx, 0x5c
jne 0x411ce5
mov edx, dword [ebp - 0x114]
sub edx, dword [ebp - 0x118]
push edx
mov eax, dword [ebp - 0x118]
push eax
lea ecx, [ebp - 0x110]
push ecx
call fcn.00429420
add esp, 0xc
mov edx, dword [ebp - 0x114]
sub edx, dword [ebp - 0x118]
mov byte [ebp + edx - 0x110], 0
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x411cce
mov ecx, dword [ebp - 4]
and ecx, 0x10
jne 0x411ce5
push 0
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x411ce5
xor eax, eax
jmp 0x411cef
jmp 0x411c4f
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0042624f
mov esp, ebp
pop ebp
ret 4

Function at 0x411d00
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4b249c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x21c], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x218], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x214], ecx
xor edx, edx
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00426300
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [ebp - 0x214], 0
jne 0x411d61
xor eax, eax
jmp 0x411e0d
mov ecx, dword [ebp - 0x214]
add ecx, 2
mov dword [ebp - 0x214], ecx
mov edx, dword [ebp - 0x214]
movzx eax, word [edx]
test eax, eax
je 0x411e08
mov ecx, dword [ebp - 0x214]
movzx edx, word [ecx]
cmp edx, 0x5c
jne 0x411e03
mov eax, dword [ebp - 0x214]
sub eax, dword [ebp - 0x218]
sar eax, 1
shl eax, 1
push eax
mov ecx, dword [ebp - 0x218]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.00429420
add esp, 0xc
mov eax, dword [ebp - 0x214]
sub eax, dword [ebp - 0x218]
sar eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x210], cx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x411dec
mov eax, dword [ebp - 4]
and eax, 0x10
jne 0x411e03
push 0
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x411e03
xor eax, eax
jmp 0x411e0d
jmp 0x411d61
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0042624f
mov esp, ebp
pop ebp
ret 4