joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48b3f0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x48b497
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.004046d4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x48b481
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.00404860
mov eax, dword [ebp - 0x10]
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
mov eax, esi
call fcn.004046d4
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x48b481
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x48b4a8
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x48b481
cmp dword [ebp - 8], 0x34
jne 0x48b481
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b49e
lea eax, [ebp - 0x10]
call fcn.00404214
ret

Function at 0x495368
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x495396
mov eax, ebx
call fcn.00495e1c
cmp dword [ebx + 0x40], 0
je 0x49538f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x495407
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4953f9
cmp dword [ebx + 8], 0
je 0x4953b8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4953ca
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4953f9
cmp dword [ebx + 8], 0
je 0x4953ab
cmp eax, 3
je 0x4953dd
dec eax
jne 0x4953ab
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4953ab
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4953ab
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x495425
cmp dword [ebx + 0x14], 0xcc
je 0x495425
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00495430
pop ebx
ret
Function at 0x4a6bc8
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x4a6cca
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [0x4ac7b8]
mov eax, dword [eax]
call fcn.0045e9b0
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00409284
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x4a6ce0
call fcn.00404520
mov dl, 1
mov eax, dword [0x419194]
call fcn.004033f4
mov ebx, eax
mov edx, 0x4a6cf0
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4a6d04
lea edx, [ebp - 0x14]
mov eax, dword [0x4ac7b8]
mov eax, dword [eax]
call fcn.0045e9b0
push dword [ebp - 0x14]
push 0x4a6d14
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404594
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x4a6d04
push dword [ebp - 4]
push 0x4a6d14
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404594
mov edx, dword [ebp - 0x18]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 4]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, ebx
call fcn.00403424
push 0
push 0x4a6d18
push 0x4a6d18
mov eax, dword [ebp - 4]
call fcn.004046d4
push eax
push 0x4a6d1c
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a6cd1
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00404238
ret
Function at 0x566830
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
push ebx
push esi
push edi
lea edi, [ebp - 0x24]
mov ecx, 9
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x62023c
call fcn.0049d4ea
call fcn.00564b00
mov dword [ebp - 8], eax
mov esi, esp
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp esi, esp
call fcn.0049c991
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
mov dword [ebp - 0x20], ecx
mov esi, esp
push 4
mov eax, dword [ebp - 8]
add eax, 0x24
push eax
push 0x20001004
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
cmp esi, esp
call fcn.0049c991
test eax, eax
jne 0x5668b1
mov eax, dword [ebp - 8]
mov dword [eax + 0x24], 0
pop edi
pop esi
pop ebx
add esp, 0xe4
cmp ebp, esp
call fcn.0049c991
mov esp, ebp
pop ebp
ret

Function at 0x568480
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push ebx
push esi
push edi
lea edi, [ebp - 4]
mov ecx, 1
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x62023c
call fcn.0049d4ea
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.0049c991
movsx ecx, ax
and ecx, 0x8000
je 0x5684cf
mov dword [ebp - 0xc4], 1
jmp 0x5684d9
mov dword [ebp - 0xc4], 0
movzx eax, byte [ebp - 0xc4]
pop edi
pop esi
pop ebx
add esp, 0xc4
cmp ebp, esp
call fcn.0049c991
mov esp, ebp
pop ebp
ret
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x401443
pop dword [ebp - 0x1c]
mov eax, 0xef272af0
add eax, 0x1118e953
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xa52371bf
sub dword [ebp - 0x2c], 0x56d12c74
mov dword [ebp - 0x28], 0x269b39ad
sub dword [ebp - 0x28], 0xf467ed68
mov dword [ebp - 0x24], 0x98c5a2c5
sub dword [ebp - 0x24], 0x4c795e97
mov dword [ebp - 0x20], 0xef42e660
add dword [ebp - 0x20], 0x10bd19a0
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xccd450be
add eax, 0x336c3046
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xd1802bd7
sub dword [ebp - 0x2c], 0x5d0dc281
mov dword [ebp - 0x28], 0xc803461a
add dword [ebp - 0x28], 0x79691b5b
mov dword [ebp - 0x24], 0xeb857a7c
sub dword [ebp - 0x24], 0x88160e10
mov dword [ebp - 0x20], 0xe7cead09
sub dword [ebp - 0x20], 0xe7cead09
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x2f0a9012
add eax, 0xd135f0ee
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3890e
push 0
call eax
mov ecx, 0x491a
mov edi, eax
mov ebx, 0x46e400
add ebx, dword [ebp - 0x1c]
mov esi, 0x427c458a
sub esi, 0xf2930d13
xor dword [ebp - 8], 0xc45b9d96
mov edx, dword [ebx]
add dword [ebp - 0x18], 0x8c5227e0
xor edx, esi
add dword [ebp - 0x18], esi
mov dword [edi], edx
xor dword [ebp - 0x14], 0x4c7768dc
add edi, 0xe6c0aeb2
add edi, 0x193f5152
add ebx, 0x15e84166
add ebx, 0xea17be9e
loop 0x401559
add eax, 0xe7fdfd05
add eax, 0x18031a36
mov ebx, eax
add eax, 0xf2590450
add eax, 0xda6fbb5
mov ecx, 0x88b7f41e
sub ecx, 0x8877f41e
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004065ec
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x401480
Capabilities:
Create thread

Disassembly:
sub esp, 0x10c
mov eax, dword [0x5f44b0]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x114]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x11c]
push 0x104
mov ebx, ecx
lea ecx, [esp + 0x14]
push 0
push ecx
mov dword [esp + 0x18], eax
call fcn.0049e690
add esp, 0xc
cmp dword [esi + 0x18], 8
lea ebp, [esi + 4]
jb 0x4014cd
mov eax, dword [ebp]
jmp 0x4014cf
mov eax, ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 1
call edi
cmp dword [esi + 0x18], 8
jb 0x4014f2
mov ecx, dword [ebp]
jmp 0x4014f4
mov ecx, ebp
xor ebp, ebp
push ebp
push ebp
push eax
lea edx, [esp + 0x20]
push edx
push 0xffffffffffffffff
push ecx
push ebp
push 1
call edi
mov eax, dword [esp + 0x10]
mov edi, dword [ebx + 4]
push eax
lea edx, [esp + 0x18]
call fcn.004012a0
mov esi, dword [ebx + 4]
lea ecx, [esp + 0x10]
push ecx
push ebp
push esi
push 0x401220
push ebp
push ebp
mov dword [esp + 0x28], ebp
call fcn.004a6bfd
add esp, 0x18
cmp eax, ebp
mov dword [esi + 0x10], eax
pop edi
je 0x401566
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40155e
mov edx, dword [esi + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], ebp
mov eax, dword [ebx + 4]
mov al, byte [eax + 4]
jmp 0x40156c
mov ecx, dword [ebx + 4]
mov al, byte [ecx + 4]
jmp 0x40156c
mov edx, dword [ebx + 4]
mov al, byte [edx + 4]
mov ecx, dword [esp + 0x114]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0049e381
add esp, 0x10c
ret 8
Function at 0x402330
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x58f768
mov eax, dword fs:[0]
push eax
sub esp, 0x628
mov eax, dword [0x5f44b0]
xor eax, esp
mov dword [esp + 0x624], eax
push ebx
push ebp
push edi
mov eax, dword [0x5f44b0]
xor eax, esp
push eax
lea eax, [esp + 0x638]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esi], ebx
mov eax, 7
mov dword [esi + 0x20], eax
mov dword [esi + 0x1c], ebx
mov dword [esp + 0x10], esi
mov word [esi + 0xc], bx
lea edi, [esi + 0x24]
mov dword [esp + 0x640], ebx
mov dword [edi + 0x18], eax
mov dword [edi + 0x14], ebx
mov word [edi + 4], bx
mov dword [esi + 0x58], eax
mov dword [esi + 0x54], ebx
mov word [esi + 0x44], bx
lea ecx, [esi + 0x5c]
mov byte [esp + 0x640], 2
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x5df248
mov byte [ecx + 4], bl
call fcn.00401840
push ebx
mov byte [esp + 0x644], 3
call fcn.004a10cc
push eax
call fcn.004a5ef8
push 0x20a
lea eax, [esp + 0x22]
push ebx
push eax
mov word [esp + 0x28], bx
call fcn.0049e690
add esp, 0x14
lea ecx, [esp + 0x14]
push ecx
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
add eax, 0xffffffff
cmp eax, 0x103
ja 0x402491
push 0x410
lea edx, [esp + 0x226]
push ebx
push edx
mov word [esp + 0x22a], bx
mov word [esp + 0x22c], bx
call fcn.0049e690
add esp, 0xc
push 0x208
lea eax, [esp + 0x224]
push eax
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x40246e
cmp eax, ebx
je 0x40246e
lea edx, [esp + 0x220]
push edx
mov ecx, edi
mov word [esp + eax*2 + 0x224], bx
call fcn.004036d0
jmp 0x402491
lea eax, [esp + 0x14]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x402475
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x18]
push eax
mov ecx, edi
call fcn.00401aa0
mov eax, dword [esi + 0x38]
cmp eax, ebx
je 0x4024c8
lea ebp, [eax - 1]
cmp ebp, dword [edi + 0x14]
jbe 0x4024a5
call fcn.0049ecc8
cmp dword [edi + 0x18], 8
jb 0x4024b0
mov eax, dword [edi + 4]
jmp 0x4024b3
lea eax, [edi + 4]
cmp word [eax + ebp*2], 0x5c
je 0x4024c8
push 1
push 0x5df24c
mov ecx, edi
call fcn.00403be0
cmp dword [esi + 0x38], ebx
jne 0x4024db
push 3
push 0x5df250
mov ecx, edi
call fcn.00401aa0
mov eax, esi
mov dword [esi + 4], ebx
mov ecx, dword [esp + 0x638]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x624]
xor ecx, esp
call fcn.0049e381
add esp, 0x634
ret
Function at 0x403f60
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x58f808
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x5f44b0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
xor edi, edi
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], di
call fcn.00401d80
mov edx, dword [esp + 0x44]
mov eax, edx
mov dword [esp + 0x34], edi
lea esi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x403fc0
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.00403be0
mov esi, dword [esp + 0x3c]
push 0xffffffffffffffff
push edi
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push eax
mov ecx, esi
mov word [esi + 4], di
call fcn.00401d80
cmp dword [esp + 0x28], 8
jb 0x40400b
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0047e27b
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret

Function at 0x404d30
Capabilities:
Get http content length

Disassembly:
mov eax, dword [eax + 4]
sub esp, 8
test eax, eax
je 0x404d6f
push 0
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 8]
push edx
push 0x20000005
push eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x404d6f
mov eax, dword [esp]
xor edx, edx
add esp, 8
ret
xor eax, eax
xor edx, edx
add esp, 8
ret
Function at 0x4060b0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586e0c
mov eax, dword fs:[0]
push eax
sub esp, 0x2b8
mov eax, dword [0x5f44b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2b4], ecx
cmp dword [ebp + 8], 0
jne 0x4060ec
jmp 0x4062c2
lea ecx, [ebp - 0x2c]
call fcn.00403660
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x2b4]
call fcn.00406480
movzx edx, al
test edx, edx
jne 0x406129
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00401640
jmp 0x4062c2
lea ecx, [ebp - 0x28c]
call fcn.00403660
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28c]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2ac], esp
lea edx, [ebp - 0x2c]
push edx
call fcn.00403680
mov dword [ebp - 0x2b8], eax
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x2bc], eax
mov byte [ebp - 4], 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2b0], esp
mov edx, dword [ebp + 8]
push edx
call fcn.00401600
mov dword [ebp - 0x2c0], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x2b4]
call fcn.004062e0
mov byte [ebp - 0x2c1], al
movzx eax, byte [ebp - 0x2c1]
test eax, eax
jne 0x4061c6
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28c]
call fcn.00401640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00401640
jmp 0x4062c2
lea ecx, [ebp - 0x48]
push ecx
call fcn.00448f20
add esp, 4
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28c]
call fcn.00401670
push eax
lea edx, [ebp - 0x2a8]
push edx
call fcn.00420be0
add esp, 8
mov byte [ebp - 4], 4
lea eax, [ebp - 0x2a8]
push eax
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x270]
push edx
call fcn.00403eb0
add esp, 0xc
mov byte [ebp - 4], 5
push 1
lea ecx, [ebp - 0x270]
call fcn.00401670
push eax
lea ecx, [ebp - 0x28c]
call fcn.00401670
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
call fcn.00405680
mov ecx, eax
call fcn.00416a50
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x28c]
call fcn.00401670
push eax
push str.SCWBSkinInst.exe
mov eax, dword [ebp - 0x4c]
push eax
push str._s_s__untie__s
lea ecx, [ebp - 0x254]
push ecx
call fcn.0049e5b6
add esp, 0x14
lea edx, [ebp - 0x254]
push edx
call fcn.0041e9c0
add esp, 4
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x270]
call fcn.00401640
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2a8]
call fcn.00401640
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.00401640
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28c]
call fcn.00401640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00401640
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049e381
mov esp, ebp
pop ebp
ret 4
Function at 0x4062e0
Capabilities:
Check if file exists
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586e54
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x5f44b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x25c], ecx
mov dword [ebp - 4], 1
lea ecx, [ebp + 0x24]
call fcn.00401670
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00420ab0
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
push ecx
call fcn.00449600
add esp, 4
mov byte [ebp - 4], 3
mov dx, word [0x591e58]
mov word [ebp - 0x254], dx
push 0x206
push 0
lea eax, [ebp - 0x252]
push eax
call fcn.0049e690
add esp, 0xc
lea ecx, [ebp - 0x48]
call fcn.00401670
push eax
lea ecx, [ebp + 8]
call fcn.00401670
push eax
lea ecx, [ebp - 0x2c]
call fcn.00401670
push eax
push str._sSkinTemp_s_s
lea ecx, [ebp - 0x254]
push ecx
call fcn.0049e5b6
add esp, 0x14
lea edx, [ebp - 0x254]
push edx
call fcn.00419f10
add esp, 4
push 0
push 0
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp + 0x24]
call fcn.00401670
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileW
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x254]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x406414
mov byte [ebp - 0x255], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
call fcn.00401640
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.00401640
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00401640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x24]
call fcn.00401640
mov al, byte [ebp - 0x255]
jmp 0x406463
lea edx, [ebp - 0x254]
push edx
mov ecx, dword [ebp + 0x40]
call fcn.004036d0
mov byte [ebp - 0x256], 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
call fcn.00401640
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.00401640
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00401640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x24]
call fcn.00401640
mov al, byte [ebp - 0x256]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049e381
mov esp, ebp
pop ebp
ret 0x3c
Function at 0x406480
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586e84
mov eax, dword fs:[0]
push eax
sub esp, 0x444
mov eax, dword [0x5f44b0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x450], ecx
lea eax, [ebp - 0x30]
push eax
call fcn.004496c0
add esp, 4
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00401670
push eax
push 0
push 0x591e7c
push 0x591e88
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x448], 1
jmp 0x4064fd
mov ecx, dword [ebp - 0x448]
add ecx, 1
mov dword [ebp - 0x448], ecx
mov edx, dword [ebp - 0x448]
cmp edx, dword [ebp - 0x10]
jg 0x4065c8
mov eax, dword [ebp - 0x448]
push eax
push 0x591e9c
lea ecx, [ebp - 0x444]
push ecx
call fcn.0049e5b6
add esp, 0xc
lea ecx, [ebp - 0x30]
call fcn.00401670
push eax
push 0x104
lea edx, [ebp - 0x23c]
push edx
push 0x591eb4
push 0x591ec0
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x23c]
push edx
call fcn.0049e720
add esp, 8
test eax, eax
jne 0x4065c3
lea ecx, [ebp - 0x30]
call fcn.00401670
push eax
push 0x104
lea eax, [ebp - 0x23c]
push eax
push str.null
push 0x591ed8
lea ecx, [ebp - 0x444]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x23c]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.004036d0
mov byte [ebp - 0x449], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00401640
mov al, byte [ebp - 0x449]
jmp 0x4065e4
jmp 0x4064ee
mov byte [ebp - 0x44a], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00401640
mov al, byte [ebp - 0x44a]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0049e381
mov esp, ebp
pop ebp
ret 8

Function at 0x40b3f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x587840
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x5f44b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
cmp dword [section.Shared], 0
je 0x40b446
mov eax, dword [section.Shared]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x40b446
push 4
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [section.Shared], eax
lea ecx, [ebp - 0x14]
call fcn.00410480
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x20]
add ecx, 4
call fcn.00401670
push eax
push str.ShowWeather
lea ecx, [ebp - 0x14]
call fcn.00410530
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004104a0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x411590
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x587c27
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5f44b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x40], ecx
lea eax, [ebp - 0x2c]
push eax
call fcn.004496c0
add esp, 4
mov dword [ebp - 4], 0
call fcn.0041bc10
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x2c]
call fcn.00401670
push eax
push 0xffffffffffffffff
push 0x593948
push 0x59395c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x34]
push ecx
call fcn.004a04b8
add esp, 4
cmp eax, 3
jl 0x411623
mov dword [ebp - 0x38], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00401640
mov eax, dword [ebp - 0x38]
jmp 0x41163c
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00401640
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049e381
mov esp, ebp
pop ebp
ret