joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408b9b
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4d9d6c
call fcn.004d0500
sub esp, 0x2b8
mov eax, dword [0x52d320]
xor eax, ebp
cmp dword [0x52edc0], 0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x2b8], eax
jne 0x408bde
mov eax, 0x40000006
jmp 0x408d6b
push esi
push edi
lea ecx, [ebp - 0x48]
call dword [0x4ea6a8]
and dword [ebp - 4], 0
push 0
push 0x4eb6e0
lea ecx, [ebp - 0x48]
call dword [0x4ea714]
mov esi, eax
mov eax, dword [0x4ea6dc]
cmp esi, dword [eax]
je 0x408d43
add esi, 8
push esi
push 0x24
lea ecx, [ebp - 0x48]
call dword [0x4ea708]
mov ecx, dword [0x4ea6dc]
cmp eax, dword [ecx]
je 0x408d43
sub eax, esi
push eax
push esi
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x48]
call dword [0x4ea6d8]
lea eax, [ebp - 0x2b4]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call dword [0x4ea6a4]
push eax
call dword [0x4ea374]
mov esi, eax
cmp esi, 0xffffffff
je 0x408d36
cmp dword [ebp - 0x2b4], 0x10
je 0x408d2f
mov eax, dword [0x52edc0]
push 1
add eax, 0x50
push eax
lea ecx, [ebp - 0x2c4]
call fcn.00407fb2
push str..backup
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x64]
push eax
mov byte [ebp - 4], 2
call fcn.00407770
add esp, 0xc
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 3
call dword [0x4ea6a4]
push eax
call dword [0x4eaadc]
cmp eax, 1
jne 0x408cf2
mov ecx, dword [0x52edc0]
lea eax, [ebp - 0x2c]
push eax
call fcn.0040842d
test al, al
jne 0x408cf2
lea ecx, [ebp - 0x2c]
call dword [0x4ea6a4]
push eax
call dword [0x4ea364]
lea ecx, [ebp - 0x2c]
call dword [0x4ea6a4]
push eax
lea ecx, [ebp - 0x64]
call dword [0x4ea6a4]
push eax
call dword [0x4ea384]
mov ecx, dword [0x52edc0]
lea eax, [ebp - 0x2c]
push eax
call fcn.0040842d
test al, al
jne 0x408d17
mov ecx, dword [0x52edc0]
lea eax, [ebp - 0x2c]
push eax
add ecx, 0x24
call fcn.00402b27
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 2
call dword [0x4ea4f8]
lea ecx, [ebp - 0x2c4]
call fcn.004a9b58
push esi
call dword [0x4ea370]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call dword [0x4ea4f8]
push dword [ebp - 0x2b8]
push dword [ebp + 0x10]
push edi
push dword [ebp - 0x2bc]
call dword [sym.imp.XLFSIO.dll_long_int___stdcall_XLFS_MountDir_wchar_t_const___wchar_t_const___long_int__wchar_t_const__]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
mov esi, eax
call dword [0x4ea4f8]
mov eax, esi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
pop edi
call fcn.004d0557
leave
ret
Function at 0x408f2f
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ecx
mov eax, esp
push ebx
mov esi, ecx
push closesocket
xor edi, edi
push ebx
inc edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], 0x7d0
mov byte [esi + 0x70], bl
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
push ecx
mov dword [eax], ebx
mov eax, esp
push ebx
mov dword [eax], ebx
call fcn.00407f56
cmp dword [esi + 4], ebx
je 0x408fa7
push ebx
push ebx
push edi
mov edi, dword [0x4ea390]
push ebx
call edi
cmp eax, ebx
mov dword [esi + 0x40], eax
je 0x408fa7
push ebx
push ebx
push ebx
push ebx
call edi
cmp eax, ebx
mov dword [esi + 0x44], eax
je 0x408fa7
lea eax, [esi + 0x4c]
push eax
push 4
push esi
push 0x408504
push ebx
push ebx
call dword [0x4ea7f8]
add esp, 0x18
cmp eax, ebx
mov dword [esi + 0x48], eax
jne 0x408fb2
mov ecx, esi
call fcn.00408d82
xor al, al
jmp 0x408fbb
push eax
call dword [0x4ea38c]
mov al, 1
pop edi
pop esi
pop ebx
ret

Function at 0x40e8b7
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4da293
call fcn.004d0500
push ecx
push ebx
push esi
xor ebx, ebx
mov esi, ecx
inc ebx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi + 0xc], ebx
xor edi, edi
lea ecx, [esi + 0x14]
mov dword [ebp - 4], edi
mov dword [esi], vtable.xl::xml::basic_xml_element_char_.0
call dword [0x4ea6d4]
lea ecx, [esi + 0x30]
mov byte [ebp - 4], bl
call dword [0x4ea6d4]
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 2
call dword [0x4ea6d4]
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
lea eax, [esi + 0x80]
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
push dword [ebp + 8]
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 5
mov dword [esi + 8], ebx
call dword [0x4ea768]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x78], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0x7c], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x40f500
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x4da35a
call fcn.004d0500
mov eax, 0x4010
call fcn.004d06c0
mov eax, dword [0x52d320]
push ebx
push esi
xor eax, ebp
push edi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov edi, ecx
push 0x4eb7f8
push eax
mov dword [ebp - 0x4018], edi
mov dword [ebp - 0x401c], eax
mov byte [ebp - 0x4011], 1
call dword [0x4ea814]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
pop ecx
pop ecx
jne 0x40f556
xor al, al
jmp 0x40f606
push ebx
add edi, 4
push ebx
mov ecx, edi
call fcn.0040f4aa
test byte [esi + 0xc], 0x10
jne 0x40f5ac
cmp byte [ebp - 0x4011], bl
je 0x40f5f8
push esi
push 0x4000
lea eax, [ebp - 0x4010]
push 1
push eax
call dword [0x4ea818]
add esp, 0x10
push ebx
push eax
lea eax, [ebp - 0x4010]
push eax
mov ecx, edi
call fcn.0040dd7e
test byte [esi + 0xc], 0x10
mov byte [ebp - 0x4011], al
je 0x40f568
cmp al, bl
je 0x40f5f8
mov edi, dword [ebp - 0x4018]
cmp dword [edi + 0x18], ebx
je 0x40f5f8
push 0x48
call fcn.004d00ba
pop ecx
mov dword [ebp - 0x4018], eax
cmp eax, ebx
mov dword [ebp - 4], ebx
je 0x40f5d5
mov ecx, eax
call fcn.0040dc6f
mov ebx, eax
push dword [ebp - 0x401c]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebx + 0x10]
call dword [0x4ea730]
mov ecx, dword [edi + 0x18]
push ebx
call fcn.0040e3e6
mov ecx, ebx
call fcn.0040d957
push esi
call dword [0x4ea80c]
mov al, byte [ebp - 0x4011]
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.004d0557
leave
ret 4
Function at 0x411c86
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4db294
call fcn.004d0500
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esi + 0x10], 0x4f5c64
mov dword [esi], 0x4edcc8
mov dword [esi + 4], 0x4edcb4
mov dword [esi + 8], 0x4edc9c
mov dword [esi + 0xc], 0x4edc68
mov dword [esi + 0x10], 0x4edc64
mov byte [esi + 0x17], bl
mov byte [esi + 0x18], bl
mov byte [esi + 0x19], bl
mov byte [esi + 0x1a], bl
mov byte [esi + 0x1b], bl
push edi
mov dword [ebp - 0x10], esi
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov byte [ebp - 4], 0xc
mov dword [esi + 0x98], ebx
mov dword [esi + 0x2a4], 0xfefefefe
call fcn.00420607
push 0x104
lea edi, [esi + 0x9c]
push edi
push ebx
call dword [0x4ea3cc]
push str...ThunderMonitor.exe
push edi
call dword [0x4eaacc]
push ebx
push 0x4eb254
push edi
call sub.XLBugHandler.dll__XL_AddCrashProcess_12
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x418ec0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x488
mov eax, dword [0x52d320]
push ebx
xor eax, ebp
push esi
push edi
mov dword [ebp + 0x404], eax
mov ebx, 0x81
xor esi, esi
mov word [ebp - 0x20], si
xor eax, eax
mov ecx, ebx
lea edi, [ebp - 0x1e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [0x4ea27c]
mov dword [ebp - 0x28], eax
call dword [0x4ea2bc]
mov edi, eax
cmp edi, esi
je 0x418f46
lea eax, [ebp - 0x2c]
push eax
push 4
lea eax, [ebp - 0x24]
push eax
push edi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x418f3f
push 0x104
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
jne 0x418f3f
push edi
call dword [0x4ea2b4]
jmp 0x41904c
push edi
call dword [0x4ea2b4]
push closesocket
call dword [0x4ea284]
cmp dword [ebp + 0x410], esi
je 0x418f71
push dword [ebp + 0x414]
mov ecx, 0x530f60
call fcn.0041a0d9
test eax, eax
jne 0x41904c
xor eax, eax
mov word [ebp + 0x1e8], si
mov ecx, ebx
mov ebx, dword [0x4ea848]
lea edi, [ebp + 0x1ea]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0x1e8]
push eax
call ebx
cmp dword [ebp + 0x418], esi
pop ecx
pop ecx
lea eax, [ebp + 0x1e8]
je 0x418fb0
push str.__Activate:Thunder__Restart:
jmp 0x418fb5
push str.__Restart:
push eax
call ebx
xor eax, eax
mov word [ebp + 0x3f0], si
lea edi, [ebp + 0x3f2]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop ecx
stosd dword es:[edi], eax
pop ecx
stosw word es:[edi], ax
push 0xa
lea eax, [ebp + 0x3f0]
push eax
push dword [ebp - 0x28]
call dword [0x4ea84c]
lea eax, [ebp + 0x3f0]
push eax
lea eax, [ebp + 0x1e8]
push eax
call ebx
push 0x44
pop edi
push edi
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.004d05b6
push 0x10
lea eax, [ebp - 0x3c]
push esi
push eax
mov dword [ebp - 0x80], edi
call fcn.004d05b6
add esp, 0x2c
lea eax, [ebp + 0x1e8]
push eax
call dword [0x4ea324]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp + 0x1e8]
push eax
push esi
call dword [0x4ea280]
test eax, eax
je 0x41904c
push esi
call dword [0x4ea2bc]
push eax
call dword [0x4ea288]
mov ecx, dword [ebp + 0x404]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d0557
add ebp, 0x408
leave
ret
Function at 0x41b2a8
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4dbf69
call fcn.004d0500
mov eax, 0x1250
call fcn.004d06c0
mov eax, dword [0x52d320]
and word [ebp - 0x628], 0
push ebx
xor eax, ebp
push esi
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1240], ecx
mov esi, 0x81
xor eax, eax
mov ecx, esi
lea edi, [ebp - 0x626]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x628]
push eax
mov ebx, 0x104
push ebx
call dword [0x4ea2a0]
push str.Thunder_Networkxl7_
lea eax, [ebp - 0x628]
push eax
call dword [0x4eaacc]
lea eax, [ebp - 0x628]
push eax
call sub.XLBugHandler.dll__XL_SetBugReportRootDir_4
and word [ebp - 0x218], 0
xor eax, eax
mov ecx, esi
lea edi, [ebp - 0x216]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
lea eax, [ebp - 0x218]
push eax
push 0
call dword [0x4ea3cc]
lea eax, [ebp - 0x218]
push eax
call dword [0x4eaaa8]
xor eax, eax
xor ebx, ebx
mov word [ebp - 0x420], bx
mov ecx, esi
mov esi, dword [0x4eaad8]
lea edi, [ebp - 0x41e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str...XLDoctorxldoctorname.ini
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push eax
call esi
lea eax, [ebp - 0x420]
push eax
push 0x400
lea eax, [ebp - 0x1238]
push eax
push 0x4eb254
push 0x4eb520
push str.xldoctor
call dword [0x4ea33c]
lea eax, [ebp - 0x1238]
push eax
call dword [0x4ea7b4]
xor edi, edi
inc edi
test eax, eax
pop ecx
je 0x41b472
lea ecx, [ebp - 0x123c]
call fcn.004316a3
lea eax, [ebp - 0x1238]
push eax
lea eax, [ebp - 0x123c]
push str..._sProgramXLDCOnLine.exe
push eax
mov dword [ebp - 4], ebx
call fcn.00405be2
add esp, 0xc
push dword [ebp - 0x123c]
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x830]
push eax
call esi
push str...XLDoctorUI.exe
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0xa38]
push eax
call esi
lea eax, [ebp - 0xa38]
push eax
call dword [0x4eaadc]
test eax, eax
push ebx
push str._starttype:crash
je 0x41b441
lea eax, [ebp - 0xa38]
push eax
push edi
call sub.XLBugHandler.dll__XL_EnableXLDoctor_16
lea eax, [ebp - 0xa38]
jmp 0x41b454
lea eax, [ebp - 0x830]
push eax
push edi
call sub.XLBugHandler.dll__XL_EnableXLDoctor_16
lea eax, [ebp - 0x830]
push edi
push str.__crash:_dir_
push eax
call sub.XLBugHandler.dll__XL_AddCrashProcess_12
mov ecx, dword [ebp - 0x123c]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.004015bd
mov ecx, dword [ebp - 0x1240]
lea eax, [ebp - 0x125c]
push eax
call fcn.00419eaf
mov ebx, eax
mov dword [ebp - 4], edi
call dword [0x4ea854]
mov ecx, ebx
mov esi, eax
call dword [0x4ea6a4]
push eax
mov eax, dword [esi]
push str.thunder7
push 0x4ef6f4
push dword [eax]
push 0x4ef6ec
call sub.XLBugHandler.dll__XL_InitBugHandler_20
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x125c]
call dword [0x4ea4f8]
push edi
call sub.XLBugHandler.dll__XL_SetReportShowMode_4
push edi
call sub.XLBugHandler.dll__XL_SetAlwaysSendReport_4
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.004d0557
leave
ret
Function at 0x41b6e0
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x4dbfab
call fcn.004d0500
sub esp, 0x234
mov eax, dword [0x52d320]
push esi
push edi
push dword [ebp + 8]
xor eax, ebp
push 0
push 0x1f0fff
mov dword [ebp - 0x10], eax
call dword [0x4ea2c0]
mov esi, eax
test esi, esi
je 0x41b806
and word [ebp - 0x218], 0
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x216]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x224]
push eax
push 4
lea eax, [ebp - 0x220]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x41b769
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x220]
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x41b7ff
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.004522b2
pop ecx
pop ecx
and dword [ebp - 4], 0
mov ecx, eax
call dword [0x4ea6a4]
push eax
lea ecx, [ebp - 0x21c]
call fcn.00402fae
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 2
call dword [0x4ea4f8]
push 0x4ef89c
push dword [ebp - 0x21c]
call dword [0x4ea834]
test eax, eax
pop ecx
pop ecx
jne 0x41b7e4
call dword [0x4ea27c]
cmp dword [ebp + 8], eax
je 0x41b7e4
push 0xbb8
push esi
call dword [0x4ea388]
cmp eax, 0x102
jne 0x41b7e4
push 0
push esi
call dword [0x4ea288]
push esi
call dword [0x4ea2b4]
mov ecx, dword [ebp - 0x21c]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.004015bd
jmp 0x41b806
push esi
call dword [0x4ea2b4]
call fcn.0041bd20
test al, al
jne 0x41b806
mov edi, dword [0x4eabf4]
mov esi, str.XLShellCommandWindow
push esi
push esi
call edi
test eax, eax
jne 0x41b81a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop edi
xor ecx, ebp
pop esi
call fcn.004d0557
leave
ret
Function at 0x41c860
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x52d320]
and word [ebp - 0x20c], 0
xor eax, ebp
push edi
mov dword [ebp - 4], eax
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [0x4ea3cc]
push 5
push 0
push str._task:newtask
lea eax, [ebp - 0x20c]
push eax
push str.open
push 0
call dword [0x4eaa3c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004d0557
leave
ret

Function at 0x41c8cb
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x52d320]
and word [ebp - 0x20c], 0
xor eax, ebp
push edi
mov dword [ebp - 4], eax
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [0x4ea3cc]
push 5
push 0
push str._task:startall
lea eax, [ebp - 0x20c]
push eax
push str.open
push 0
call dword [0x4eaa3c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004d0557
leave
ret

Function at 0x41c936
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x52d320]
and word [ebp - 0x20c], 0
xor eax, ebp
push edi
mov dword [ebp - 4], eax
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [0x4ea3cc]
push 5
push 0
push str._task:pauseall
lea eax, [ebp - 0x20c]
push eax
push str.open
push 0
call dword [0x4eaa3c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004d0557
leave
ret
Function at 0x424d1e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4dc90e
call fcn.004d0500
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esi], 0x4f0b38
push edi
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
lea ecx, [esi + 0x14]
mov dword [ebp - 4], ebx
call dword [0x4ea6d4]
mov byte [esi + 0x30], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
lea edi, [esi + 0x48]
mov ecx, edi
mov byte [ebp - 4], 2
mov byte [esi + 0x44], bl
call dword [0x4ea6b0]
push dword [ebp + 8]
mov ecx, edi
mov byte [ebp - 4], 3
call dword [0x4ea730]
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x425172
Capabilities:
Check if file exists
Create directory

Disassembly:
mov eax, 0x4dca2c
call fcn.004d0500
sub esp, 0x24
mov eax, dword [0x52d320]
xor eax, ebp
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], eax
xor eax, eax
push edi
mov dword [ebp - 0x30], esi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
lea edi, [esi + 0x48]
push 0x4eb254
mov ecx, edi
mov byte [ebp - 4], 3
mov dword [esi + 0x40], eax
mov byte [esi + 0x44], al
mov byte [esi + 0x45], al
call dword [0x4ea6a8]
lea ebx, [esi + 0x64]
push 0x4eb79e
mov ecx, ebx
mov byte [ebp - 4], 4
call dword [0x4ea4e4]
push 0x52d970
mov ecx, edi
mov byte [ebp - 4], 5
call dword [0x4ea730]
push 0x4f0b48
mov ecx, edi
call dword [0x4ea734]
mov ecx, edi
call dword [0x4ea6a4]
push eax
call dword [0x4eaadc]
test eax, eax
jne 0x425217
mov ecx, edi
call dword [0x4ea6a4]
push eax
call dword [0x4ea860]
pop ecx
lea eax, [ebp - 0x2c]
push eax
call fcn.0041906e
pop ecx
push ebx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 6
call dword [0x4ea6d0]
push eax
lea ecx, [ebp - 0x2c]
call dword [0x4ea6a4]
push eax
call fcn.0044f54c
add esp, 0xc
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 5
call dword [0x4ea4f8]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d0557
leave
ret
Function at 0x42532a
Capabilities:
Check if file exists
Create directory

Disassembly:
mov eax, 0x4dca50
call fcn.004d0500
sub esp, 0x4c
mov eax, dword [0x52d320]
push ebx
mov ebx, dword [ebp + 8]
xor eax, ebp
test ebx, ebx
push esi
mov dword [ebp - 0x10], eax
mov esi, ecx
jne 0x425353
xor al, al
jmp 0x425523
mov ecx, dword [ebx + 0x78]
test ecx, ecx
push edi
jne 0x42535f
xor edi, edi
jmp 0x42536b
push 0x4eb7f0
call fcn.0040e737
mov edi, eax
push edi
lea ecx, [esi + 4]
call dword [0x4ea768]
lea ecx, [ebp - 0x2c]
call dword [0x4ea6b0]
and dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
push edi
call fcn.004d05da
pop ecx
push eax
push edi
call fcn.0044f5c2
push 0x4eb7e4
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00407770
add esp, 0x18
lea edi, [esi + 0xac]
push eax
mov ecx, edi
mov byte [ebp - 4], 1
call dword [0x4ea6b8]
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0
call dword [0x4ea4f8]
mov ecx, edi
call dword [0x4ea6a4]
push eax
call dword [0x4eaadc]
test eax, eax
jne 0x4253ec
mov ecx, edi
call dword [0x4ea6a4]
push eax
call dword [0x4ea860]
pop ecx
mov ecx, dword [ebx + 0x78]
test ecx, ecx
jne 0x4253f7
xor eax, eax
jmp 0x425401
push 0x4f0b90
call fcn.0040e737
push eax
lea ecx, [esi + 0x20]
call dword [0x4ea768]
lea ecx, [ebx + 0x80]
call fcn.0045fdf8
and dword [ebp - 0x34], 0
test eax, eax
mov dword [ebp - 0x3c], eax
jbe 0x425513
push dword [ebp - 0x34]
mov ecx, ebx
call fcn.0040e6ef
mov edi, eax
mov dword [ebp - 0x38], edi
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 2
call dword [0x4ea4e0]
mov ecx, edi
mov dword [ebp - 0x30], eax
call fcn.0040e9e6
push str.link_url
push dword [ebp - 0x30]
mov edi, eax
call fcn.004d06fe
test eax, eax
pop ecx
pop ecx
jne 0x42546f
lea ecx, [esi + 0x58]
push edi
call dword [0x4ea768]
jmp 0x4254f4
push str.logo_url
push dword [ebp - 0x30]
call fcn.004d06fe
test eax, eax
pop ecx
pop ecx
jne 0x425499
lea eax, [esi + 0x74]
push eax
push edi
call fcn.004d05da
pop ecx
push eax
push edi
call fcn.0044f5c2
add esp, 0xc
jmp 0x4254f4
push str.demo_img
push dword [ebp - 0x30]
call fcn.004d06fe
test eax, eax
pop ecx
pop ecx
jne 0x4254b4
lea eax, [esi + 0x90]
jmp 0x425485
push 0x4f0b64
push dword [ebp - 0x30]
call fcn.004d06fe
test eax, eax
pop ecx
pop ecx
jne 0x4254cc
lea ecx, [esi + 0x3c]
jmp 0x425463
push str.open_tab
push dword [ebp - 0x30]
call fcn.004d06fe
test eax, eax
pop ecx
pop ecx
jne 0x4254f4
push edi
call dword [0x4ea864]
dec eax
neg eax
sbb al, al
inc al
pop ecx
mov byte [esi + 0xc8], al
mov ecx, dword [ebp - 0x38]
test ecx, ecx
mov byte [ebp - 4], 0
je 0x425504
call fcn.0040d957
inc dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x3c]
jb 0x425425
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call dword [0x4ea4f8]
mov al, 1
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.004d0557
leave
ret 4
Function at 0x425873
Capabilities:
Check if file exists
Create directory

Disassembly:
mov eax, 0x4dca8f
call fcn.004d0500
sub esp, 0x38
mov eax, dword [0x52d320]
push ebx
xor eax, ebp
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ebx, ecx
push str.OpenApp_
lea eax, [ebx + 0x48]
push eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x3c], esi
call fcn.00407770
add esp, 0xc
and dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call dword [0x4ea6a4]
push eax
call dword [0x4eaadc]
test eax, eax
jne 0x4258d2
lea ecx, [ebp - 0x2c]
call dword [0x4ea6a4]
push eax
call dword [0x4ea860]
pop ecx
lea ecx, [esi + 0x80]
call fcn.0045fdf8
and dword [ebp - 0x34], 0
test eax, eax
mov dword [ebp - 0x40], eax
jbe 0x4259c3
push edi
jmp 0x4258f2
mov esi, dword [ebp - 0x3c]
push dword [ebp - 0x34]
mov ecx, esi
call fcn.0040e6ef
mov edi, eax
mov dword [ebp - 0x44], edi
mov ecx, dword [edi + 0x78]
test ecx, ecx
mov byte [ebp - 4], 1
jne 0x425910
xor esi, esi
jmp 0x42591c
push str.begin_ver
call fcn.0040e737
mov esi, eax
mov ecx, dword [edi + 0x78]
test ecx, ecx
jne 0x425927
xor eax, eax
jmp 0x425931
push str.end_ver
call fcn.0040e737
push eax
push esi
lea ecx, [ebx + 0x64]
call dword [0x4ea4e0]
push eax
mov ecx, ebx
call fcn.00423c87
test al, al
jne 0x4259a8
push 0xf4
call fcn.004d00ba
pop ecx
mov dword [ebp - 0x30], eax
test eax, eax
mov byte [ebp - 4], 2
je 0x425974
lea ecx, [ebp - 0x2c]
call dword [0x4ea6a4]
mov ecx, dword [ebp - 0x30]
push eax
call fcn.00424848
mov esi, eax
jmp 0x425976
xor esi, esi
mov dword [ebp - 0x30], esi
push edi
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.0042532a
test al, al
je 0x42599c
and dword [ebp - 0x30], 0
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebx + 0x10]
mov dword [ebp - 0x38], esi
call fcn.004252a5
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.004252e5
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.0040d957
inc dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x40]
jb 0x4258ef
pop edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call dword [0x4ea4f8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.004d0557
leave
ret 4