joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47b627
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi], esi
je 0x47b69c
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x47b69c
cmp dword [edi + 8], esi
je 0x47b660
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x47b65b
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], esi
cmp dword [edi + 8], esi
jne 0x47b69c
mov eax, dword [edi]
push 0xc
mov dword [ebp + 8], eax
call fcn.00431d79
pop ecx
test eax, eax
je 0x47b690
mov ecx, dword [ebp + 8]
push esi
push esi
push eax
push 0x47b82e
push esi
push esi
mov dword [eax], ecx
mov dword [eax + 8], esi
mov dword [eax + 4], ebx
call fcn.005f3fd0
add esp, 0x18
mov esi, eax
xor eax, eax
mov dword [edi + 8], esi
test esi, esi
setne al
jmp 0x47b69e
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x47ba57
Capabilities:
Delete file

Disassembly:
mov eax, 0x6106f7
call fcn.0060c3a8
sub esp, 0x18
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
call fcn.00404f47
push eax
lea ecx, [ebp - 0x18]
call fcn.004065d8
push edi
push str.GetPacketData__d
push 0x6c88e0
mov dword [ebp - 4], edi
mov ebx, edi
call fcn.0048e513
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push ecx
mov ecx, esi
call fcn.0047bb70
mov esi, eax
push esi
push str.GetPacketData_return:_d
push 0x6c88e0
mov dword [ebp - 0x20], esi
call fcn.0048e513
add esp, 0xc
test esi, esi
mov esi, dword [ebp - 0x18]
jne 0x47bad1
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x1c], 1
jmp 0x47bb3a
push 0x24
call fcn.00431d79
pop ecx
test eax, eax
je 0x47bae8
mov ecx, eax
call fcn.0042bf7d
mov ebx, eax
jmp 0x47baea
mov ebx, edi
test ebx, ebx
je 0x47bb3a
push str.Extract...
push 0x6c88e0
call fcn.0048e513
mov eax, dword [ebx]
pop ecx
pop ecx
push dword [ebp + 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x20]
push ebx
call dword [eax]
xor ecx, ecx
mov edi, eax
test edi, edi
sete cl
push ecx
push str.Extract_return:_d
push 0x6c88e0
call fcn.0048e513
add esp, 0xc
test edi, edi
je 0x47bb31
xor edi, edi
jmp 0x47bb53
mov dword [ebp - 0x14], 1
xor edi, edi
cmp dword [esi - 0xc], edi
je 0x47bb46
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test ebx, ebx
je 0x47bb50
mov eax, dword [ebx]
push ebx
call dword [eax + 0xc]
mov edi, dword [ebp - 0x14]
lea ecx, [esi - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x47bc5b
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
lea eax, [ebp - 0x208]
push ebx
push esi
push edi
push 0x208
xor esi, esi
mov ebx, ecx
push esi
push eax
call fcn.005e1e60
add esp, 0xc
lea eax, [ebp - 0x208]
push 0x104
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x47bcdd
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LoadImageToMem_CreateFile_error:_d__path:_ws
push 0x6c88e0
call fcn.0048e513
add esp, 0x10
jmp 0x47bd51
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
push eax
push esi
push 2
push esi
push edi
mov dword [ebx + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebx], eax
test edi, edi
jne 0x47bd10
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateFileByMem_CreateFileMapping_error:_d__path:_ws
jmp 0x47bd38
push dword [ebx + 8]
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebx + 4], eax
test eax, eax
jne 0x47bd47
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateFileByMem_MapViewOfFile_error:_d__path:_ws
push 0x6c88e0
call fcn.0048e513
add esp, 0x10
jmp 0x47bd4a
xor esi, esi
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47d2a1
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x60da31
call fcn.0060c3a8
push ecx
push esi
push edi
xor edi, edi
xor esi, esi
push str.DownLoadFileFromAdder
inc edi
push 0x6c88e0
mov dword [ebp - 4], edi
call fcn.0048e513
push 0x12c
push esi
push esi
lea edx, [ebp + 0xc]
lea ecx, [ebp + 8]
call fcn.004745c4
add esp, 0x14
test eax, eax
jne 0x47d2ec
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
cmovne esi, edi
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00404ea9
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x47db3e
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x612599
call fcn.0060c3a8
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 4], 1
xor ebx, ebx
mov edi, dword [ebp + 8]
add edi, 0xfffffff0
push edi
call fcn.004067cf
pop ecx
mov dword [ebp - 0x14], eax
lea edx, [eax + 0x10]
mov dword [ebp - 0x18], edx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.0040b0eb
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 0x10]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00404ea9
test esi, esi
je 0x47dbce
push ecx
mov esi, esp
mov dword [ebp - 0x10], esp
push edi
mov dword [ebp - 0x1c], esi
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 3
mov esi, esp
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
mov dword [ebp - 0x1c], esi
push eax
call fcn.004067cf
add eax, 0x10
mov dword [esi], eax
pop ecx
mov byte [ebp - 4], 2
call fcn.0047d2a1
pop ecx
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x14]
call fcn.00404ea9
mov ecx, edi
call fcn.00404ea9
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47e097
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x61265d
call fcn.0060c3a8
mov eax, dword [0x6c888c]
sub esp, 0x18
cmp dword [eax - 0xc], 0
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
je 0x47e0c6
cmp dword [0x6c8858], 4
je 0x47e0c6
xor eax, eax
jmp 0x47e27c
call fcn.00404f47
push eax
lea ecx, [ebp - 0x1c]
call fcn.004065d8
and dword [ebp - 4], 0
call fcn.00404f47
push eax
lea ecx, [ebp - 0x18]
call fcn.004065d8
mov byte [ebp - 4], 1
mov eax, dword [0x6c8858]
mov dword [ebp - 0x24], 1
test eax, eax
je 0x47e1e2
cmp eax, 5
je 0x47e1e2
cmp eax, 4
je 0x47e1e2
cmp eax, 3
je 0x47e1f9
push str.http:__dubacdn.cmcmcdn.com_sem_installer_ald__d.png
lea ecx, [ebp - 0x14]
call fcn.00406173
mov byte [ebp - 4], 2
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47e1b4
call fcn.00404f47
push eax
lea ecx, [ebp - 0x10]
call fcn.004065d8
mov byte [ebp - 4], 3
call fcn.00404f47
push eax
lea ecx, [ebp - 0x20]
call fcn.004065d8
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 4
push eax
lea edx, [ebp - 0x10]
mov ecx, ebx
call fcn.0047dbfb
pop ecx
lea ecx, [ebp - 0x20]
call fcn.0047d314
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x10]
push 0
push esi
call fcn.0040a98a
cmp eax, 0xffffffff
je 0x47e190
mov dword [0x6c8864], 1
jmp 0x47e19d
push str.http:__dubacdn.cmcmcdn.com_sem_installer_ald2__d.png
lea ecx, [ebp - 0x14]
call fcn.004060f8
lea ecx, [esi - 0x10]
call fcn.00404ea9
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
push edi
push dword [ebp - 0x14]
lea eax, [ebp - 0x1c]
push eax
call fcn.00406cc8
add esp, 0xc
lea ecx, [ebp - 0x18]
push str.110.png
call fcn.004060f8
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
jmp 0x47e1f9
lea edx, [ebp - 0x1c]
mov ecx, edi
call fcn.0047e027
push str.100.png
lea ecx, [ebp - 0x18]
call fcn.004060f8
mov eax, dword [ebx]
sub eax, 0x10
push eax
call fcn.004067cf
add eax, 0x10
pop ecx
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x20]
mov esi, dword [ebp - 0x18]
push dword [esi - 0xc]
push esi
call fcn.00406668
push ecx
mov edi, esp
mov dword [ebp - 0x14], esp
mov dword [ebp - 0x24], edi
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
push eax
mov dword [ebp - 0x24], eax
call fcn.004067cf
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 6
mov edi, esp
mov dword [ebp - 0x10], edi
mov ebx, dword [ebp - 0x20]
add ebx, 0xfffffff0
push ebx
call fcn.004067cf
add eax, 0x10
mov dword [edi], eax
pop ecx
mov byte [ebp - 4], 5
call fcn.0047db3e
pop ecx
pop ecx
mov ecx, ebx
mov edi, eax
call fcn.00404ea9
lea ecx, [esi - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0x24]
call fcn.00404ea9
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x482fd9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x612555
call fcn.0060c3a8
sub esp, 0x224
push ebx
mov ebx, ecx
cmp dword [ebx + 0x14], 0
jne 0x482ff9
xor eax, eax
jmp 0x483190
push esi
push edi
call fcn.00404f47
push eax
lea ecx, [ebp - 0x10]
call fcn.004065d8
and dword [ebp - 4], 0
lea eax, [ebp - 0x230]
push 0x208
push 0
push eax
call fcn.005e1e60
add esp, 0xc
lea eax, [ebp - 0x230]
push 0x104
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x10]
call fcn.004060f8
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [ebp - 0x10]
call fcn.004060f8
mov esi, dword [ebp - 0x10]
push 0x2e
push esi
call fcn.005e3a70
mov dword [ebp - 0x1c], 1
pop ecx
pop ecx
test eax, eax
je 0x4830a8
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x4830a8
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.00405d36
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00406123
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
mov esi, dword [ebp - 0x10]
call fcn.00404f47
push eax
lea ecx, [ebp - 0x14]
call fcn.004065d8
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
movsd xmm0, qword [0x6a04a0]
push eax
lea eax, [ebp - 0x14]
movsd qword [ebp - 0x28], xmm0
push eax
push ecx
push dword [ebp + 8]
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
call fcn.00482dfb
mov edi, dword [ebp - 0x14]
test eax, eax
je 0x483177
push 0x69ed70
push edi
push dword [ebx + 0x14]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x483177
push eax
push dword [ebx + 0x14]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp + 8], eax
test eax, eax
je 0x483177
push dword [ebp - 0x18]
push dword [ebx + 0x14]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x483177
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x483177
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
inc eax
push eax
mov dword [ebp - 0x20], eax
call fcn.00406a4b
test eax, eax
je 0x483153
push dword [ebp + 8]
push dword [ebp - 0x18]
push eax
call fcn.005e0960
add esp, 0xc
push dword [ebp - 0x20]
mov ecx, dword [ebp + 0x10]
call fcn.00413e9a
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x48317b
movsd xmm0, qword [ebp - 0x28]
movsd qword [eax], xmm0
jmp 0x48317b
and dword [ebp - 0x1c], 0
lea ecx, [edi - 0x10]
call fcn.00404ea9
lea ecx, [esi - 0x10]
call fcn.00404ea9
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4851ab
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x61289f
call fcn.0060c3a8
push ecx
push ecx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], ecx
mov dword [ebp - 4], ecx
mov eax, vtable.CBkBitmap.0
movsd xmm0, qword [0x6a04a0]
mov dword [edi], vtable.CBkPngSkin.0
mov dword [edi + 8], ecx
mov dword [edi + 0xc], ecx
movsd qword [edi + 0x10], xmm0
mov dword [edi + 0x18], ecx
mov dword [edi + 0x1c], ecx
mov dword [edi + 0x20], ecx
mov dword [edi + 0x24], ecx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], ecx
mov dword [edi + 0x30], ecx
mov dword [edi + 0x34], ecx
mov dword [edi + 0x38], ecx
mov dword [edi + 0x3c], ecx
mov dword [edi + 0x40], ecx
mov dword [edi + 0x48], ecx
mov dword [edi + 0x44], eax
mov dword [edi + 0x54], ecx
mov dword [edi + 0x4c], ecx
mov dword [edi + 0x50], ecx
mov dword [edi + 0x58], ecx
mov dword [edi + 0x60], ecx
mov dword [edi + 0x5c], eax
mov dword [edi + 0x6c], ecx
mov dword [edi + 0x64], ecx
mov dword [edi + 0x68], ecx
mov byte [ebp - 4], 2
lea esi, [edi + 0x74]
mov dword [edi + 0x70], ecx
mov dword [ebp - 0x14], esi
mov dword [esi], ecx
mov dword [esi + 4], ecx
call fcn.004069f1
mov ecx, dword [ebp - 0xc]
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x48912d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x612a23
call fcn.0060c3a8
sub esp, 0x418
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x424], edi
push 0x60
push edi
push dword [ebp + 8]
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
call ebx
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
jne 0x48918f
push 2
push edi
push dword [ebp + 8]
call ebx
mov esi, eax
mov dword [ebp - 0x14], eax
test esi, esi
jne 0x48918f
call fcn.0046e5bd
mov edi, eax
jmp 0x48926e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x4891ac
call fcn.0046e5bd
jmp 0x489261
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0x10], eax
test eax, eax
je 0x4891a2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp + 8], ebx
lea ecx, [ebx + 1]
cmp ecx, ebx
jae 0x4891d9
mov edi, 0x8007000e
jmp 0x489263
push 2
pop edx
mov byte [ebp - 4], 2
call fcn.004883cd
cmp eax, 0x400
jbe 0x4891fa
push eax
lea ecx, [ebp - 0x424]
call fcn.00487ed1
jmp 0x489216
lea eax, [ebp - 0x420]
mov dword [ebp - 0x424], eax
jmp 0x489216
mov dword [ebp - 4], 1
cmp dword [ebp - 0x424], 0
je 0x4891cf
push ebx
push dword [ebp - 0x424]
push ebx
push dword [ebp + 0x10]
push edi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x4891a2
mov eax, dword [ebp - 0x424]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x424]
call fcn.00489003
mov edi, eax
test esi, esi
je 0x48926e
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x420]
cmp dword [ebp - 0x424], eax
je 0x489287
lea ecx, [ebp - 0x424]
call fcn.00487ebc
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x48990b
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
lea eax, [ebp - 0x20c]
push esi
push 0x208
xor esi, esi
push esi
push eax
call fcn.005e1e60
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x48994a
inc eax
jmp 0x4899af
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.jcqgxkg.ini
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 4]
call fcn.00406173
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x48999f
push dword [ebp - 4]
push 1
push str.switch
push str.updatecheck
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
jne 0x4899a2
xor esi, esi
inc esi
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00404ea9
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x489aed
Capabilities:
Delete file

Disassembly:
mov eax, 0x612a75
call fcn.0060c3a8
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
push edi
mov dword [ebp - 0x18], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 0x14], 1
and dword [ebp - 4], 0
call fcn.00404f47
push eax
lea ecx, [ebp - 0x10]
call fcn.004065d8
lea esi, [edi + 0x30]
mov byte [ebp - 4], 1
push esi
call fcn.004707cd
pop ecx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.DownloadNewVersion
push 0x6c88e0
call fcn.0048e513
push 0x12c
push 0
push dword [ebp + 0xc]
lea ecx, [edi + 0x28]
mov edx, esi
call fcn.004745c4
mov ecx, dword [ebp + 8]
add esp, 0x14
xor ebx, ebx
test eax, eax
sete bl
mov dword [ecx], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00404ea9
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x489b8e
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x612a75
call fcn.0060c3a8
sub esp, 0xc
push ebx
push esi
mov ebx, ecx
push edi
push ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 0x14], 1
lea esi, [ebx + 0x30]
xor edi, edi
push esi
mov dword [ebp - 4], edi
call fcn.004707cd
pop ecx
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x489c0f
call fcn.00404f47
push eax
lea ecx, [ebp - 0x10]
call fcn.004065d8
push dword [ebp + 8]
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push str._s__update:0
push eax
call fcn.00406cc8
mov esi, dword [ebp - 0x10]
mov edx, esi
pop ecx
pop ecx
mov ecx, dword [ebx + 0x30]
push edi
push 0xffffffffffffffff
call fcn.0046f770
add esp, 0xc
lea ecx, [esi - 0x10]
neg eax
sbb edi, edi
neg edi
call fcn.00404ea9
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x489c2b
Capabilities:
Get common file path

Disassembly:
mov eax, 0x612a8f
call fcn.0060c3a8
sub esp, 0x218
push ebx
push esi
push edi
mov edi, ecx
call fcn.00404f47
push eax
lea ecx, [ebp - 0x18]
call fcn.004065d8
xor esi, esi
mov dword [ebp - 4], esi
call fcn.00404f47
push eax
lea ecx, [ebp - 0x14]
call fcn.004065d8
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x224]
push esi
inc ebx
push eax
mov byte [ebp - 4], bl
call fcn.005e1e60
add esp, 0xc
push esi
call fcn.005f1a4f
pop ecx
push edx
push eax
lea eax, [ebp - 0x18]
push str.http:__2398.35go.net_defend_o1_jcqgx.ini
push eax
call fcn.00413d50
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
add esp, 0xc
mov ecx, esi
push eax
call fcn.0046eeef
pop ecx
pop ecx
test eax, eax
jne 0x489cf9
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x489cf9
lea eax, [ebp - 0x224]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x489cf9
push str.jcqgx.ini
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x224]
push eax
lea ecx, [edi + 0x24]
call fcn.004060f8
mov ecx, dword [edi + 0x24]
lea edx, [ebp - 0x14]
call fcn.0046f1dc
test eax, eax
jne 0x489cfb
xor ebx, ebx
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00404ea9
lea ecx, [esi - 0x10]
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x489d21
Capabilities:
Delete file
Read .ini file

Disassembly:
mov eax, 0x612ac1
call fcn.0060c3a8
sub esp, 0xc18
push ebx
push esi
push edi
push 0x800
xor esi, esi
lea eax, [ebp - 0xc24]
push esi
push eax
mov edi, ecx
call fcn.005e1e60
mov ebx, 0x208
lea eax, [ebp - 0x21c]
push ebx
push esi
push eax
call fcn.005e1e60
push ebx
lea eax, [ebp - 0x424]
push esi
push eax
call fcn.005e1e60
mov ebx, dword [ebp + 8]
add esp, 0x24
mov dword [ebx], esi
call fcn.00404f47
push eax
lea ecx, [ebp + 8]
call fcn.004065d8
mov dword [ebp - 4], esi
call fcn.00404f47
push eax
lea ecx, [ebp - 0x14]
call fcn.004065d8
mov byte [ebp - 4], 1
lea eax, [ebp - 0xc24]
push dword [edi + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x400
push eax
push 0x693da4
push 0x69f3c8
push dword [edi + 0x18]
call esi
push dword [edi + 0x24]
lea eax, [ebp - 0x21c]
push 0x104
push eax
push 0x693da4
push 0x69f3d0
push dword [edi + 0x18]
call esi
push dword [edi + 0x24]
lea eax, [ebp - 0x424]
push 0x104
push eax
push 0x693da4
push 0x69f3d8
push dword [edi + 0x18]
call esi
lea eax, [ebp - 0xc24]
push eax
call fcn.005f06f8
pop ecx
test eax, eax
jne 0x489e14
mov dword [ebx], 0x162
xor esi, esi
jmp 0x489f0e
lea eax, [ebp - 0x21c]
push eax
call fcn.005f06f8
pop ecx
test eax, eax
jne 0x489e2d
mov dword [ebx], 0x164
jmp 0x489e0d
lea eax, [ebp - 0x424]
push eax
call fcn.005f06f8
xor esi, esi
pop ecx
test eax, eax
jne 0x489e4b
mov dword [ebx], 0x163
jmp 0x489f0e
push dword [edi + 0x24]
push esi
push str.probability
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [edi + 0x34], eax
lea ecx, [edi + 0x28]
lea eax, [ebp - 0xc24]
push eax
call fcn.004060f8
lea eax, [ebp - 0x21c]
push eax
lea ecx, [edi + 0x2c]
call fcn.004060f8
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp + 8]
call fcn.004060f8
lea eax, [ebp + 8]
push eax
call fcn.004707cd
mov edx, dword [ebp + 8]
pop ecx
lea ecx, [ebp - 0x10]
call fcn.00470738
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.00406123
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
lea eax, [ebp - 0x10]
push eax
call fcn.00489f42
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00406123
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.0040b545
pop ecx
push eax
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 4
call fcn.00406123
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00404ea9
xor esi, esi
inc esi
push dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00404ea9
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00404ea9
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4