joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401030
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44ede8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
push edi
mov eax, dword [0x468028]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, dword [0x469734]
mov edx, dword [eax + 0xc]
xor edi, edi
mov ecx, 0x469734
mov dword [esp + 0x24], edi
call edx
add eax, 0x10
mov dword [esp + 0x30], eax
mov eax, dword [0x469734]
mov edx, dword [eax + 0xc]
mov ecx, 0x469734
call edx
add eax, 0x10
mov dword [esp + 0x34], eax
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x38], edi
mov dword [esp + 0x2c], edi
push 0x3e8
push ebx
lea esi, [esp + 0x2c]
mov dword [esp + 0x50], edi
call fcn.004039c0
test eax, eax
je 0x40111e
mov eax, esi
call fcn.00403e00
cmp eax, 2
je 0x4010c5
cmp eax, 3
jne 0x40111e
push 4
lea ecx, [esp + 0x28]
call fcn.00403e50
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0xc], 2
call fcn.004060f0
push 2
lea esi, [esp + 0x10]
call 0x406160
call fcn.004060f0
push 3
call 0x406160
lea esi, [esp + 0x24]
call fcn.00403950
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402cd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
add dword [edi + 0x58], 1
mov eax, dword [edi + 0x58]
mov ecx, dword [edi + 0x5c]
cmp eax, ecx
push esi
jbe 0x402ce4
mov dword [edi + 0x58], ecx
jmp 0x402cf6
mov dword [edi + 0x1c], eax
call fcn.004060f0
lea esi, [edi + 0x18]
push 3
call 0x406160
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [edi + 4]
cmp eax, 0x2bf20
jbe 0x402d21
push str.CheckConnPer___Timeout
mov eax, 0xc
mov ecx, str..TAVUpdateBase.cpp
call fcn.0043d710
add esp, 4
xor eax, eax
pop esi
ret
mov eax, 1
pop esi
ret

Function at 0x416fb2
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x416fc6
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x416fc2
xor edx, edx
mov ecx, 0x10b
cmp word [eax + 0x18], cx
sete dl
mov eax, edx
pop ebp
ret
Function at 0x41e9c5
Capabilities:
Encode data using xor

Disassembly:
lodsb al, byte [esi]
or esi, dword [eax]
aad 0x59
cmp eax, 0x59052bd7
sbb ch, 0xfd
neg dword [ebp + 0x69]
xor byte [0x9c835220], bh
and byte [edx - 0x7d], dl
pushfd
inc eax
in eax, 0x4c
xchg edx, eax
and eax, 0x538b83ac
test dword [edx + 0xe], esp
bound ecx, qword [esi]
pop ebp
pushal
dec ebp
sbb ecx, dword [eax + 0xb722b8d]
or al, 0xe2
adc eax, 0xa90c288e
sub al, 0x8f
fcom qword [edi - 0x11]
fldcw word [edi]
cmp dl, byte [ebp - 0x3b]
add bl, bh
xchg esi, eax
mov dword [eax + edi], ecx
push es
mov word [ebp + 0x19], fs
add byte [edx - 0x75cf417c], cl
add eax, 0xdb4302a
adc dword [esi + 0x2f8c2], eax
lodsb al, byte [esi]
adc al, byte [eax]
xlatb
sub eax, 0x95ac000
mov dword [0xd7ac7370], eax
jae 0x41e973
xlatb
jae 0x41e973
xlatb
xchg ebx, eax
leave
sub al, byte [eax + edx*8 + 0x56b2ac0e]
cdq
and eax, 0x7f58f1bf
cwde
cmp esp, dword [edi - 0x23]
salc
jbe 0x41e961
inc edi
push ebp
jp 0x41e982
add dword [eax], esi
pop ss
push es
shr dword [ecx + 0x65], 1
jge 0x41ea1f
insd dword es:[edi], dx
popal
xor dword [edi], ebp
ljmp 0x747f
add byte [edi - 0x69], dl
outsb dx, byte [esi]
invalid

Function at 0x421b06
Capabilities:
Encode data using xor

Disassembly:
inc eax
pop esp
popfd
loop 0x421b0d
cli
sub ebx, dword [ebp + 0x250f7a]
add byte [eax + 0x5e], dh
popfd
jp 0x421b1f
and eax, 0x5e700000
salc
add eax, esp
cmp byte [eax + ecx + 0x73], bl
sbb eax, eax
salc
arpl word [ebx], ax
add byte [eax], bh
salc
das
or al, 0xe7
or dword [0x40112400], eax
aas
or esi, dword [ebx]
jge 0x421b30
xor edi, dword [ebp - 3]
sti
fld xword [eax - 9]
jbe 0x421b52
outsd dx, dword [esi]
xchg edi, eax
into
add edi, dword [eax - 0x48ae7b0b]
invalid
adc dh, cl
sbb ah, bl
or dword [esi], ebx
jp 0x421b92
adc al, 0xbe
and dl, dl
pop ss
test al, ch
sar esi, 0x6b
cmpsb byte [esi], byte es:[edi]
xor dword [edi], esi
inc ebx
imul edx, dword [edx - 0x26], 0x3cefbde0
inc ecx
xor bh, 0x53
aaa
insd dword es:[edi], dx
fisttp qword [edi + 0x74a024d]
and al, 0x11
leave
fisttp dword [eax + 8]
pop esi
stosb byte es:[edi], al
dec eax
or byte [esi - 0x56], bl
sbb ebx, dword [edx - 0x785ad460]
sub byte [edx - 0x6e33d0ba], cl
jl 0x421bee
mov ebx, 0x661c6bd8
push edx
fsubr dword [ebx + 0x1c]
push dx
add byte [ebp + 0x2b], 0xc8
push ss
pop eax
das
add byte [eax], ah
rol ebp, 1
imul ebx, ebx, 0xffffffff
lea eax, [eax]
add dword [edx + ecx*4 - 0x1f6a2d29], edi
cli
cmp al, 0x97
inc esp
test eax, 0xde0e8da6
in eax, dx
stc
and byte [ecx], al
scasd eax, dword es:[edi]
loopne 0x421b5f
jo 0x421b7f
add byte [eax], al
inc eax
retf 0x6c95
sahf
notrack call 0x5c46fb1d
jb 0x421c3d
inc eax
inc ecx
dec edx
add eax, 0x2bf23c22
aas
dec ebx
push edx
lodsd eax, dword [esi]
adc byte [ecx], al
and dl, byte [0x412868c1]
jb 0x421bff
rcr byte [edi - 0x4d], cl
dec edx
lcall 0xd407, 0x33ddef75
dec edx
xchg esp, eax
add dword [ecx], esp
dec edx
sbb esp, esi
adc eax, eax
sub byte [edi - 0x38a030d6], al
hlt
pushal
push esp
pop eax
mov esp, 0x96810512
pop ds
inc si
sbb dword [ecx + 0x68], eax
invalid
Function at 0x401690
Capabilities:
Check if file exists
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x456600]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push ebp
push edi
xor eax, eax
push 0x206
mov edi, ecx
push eax
lea ecx, [esp + 0x16]
push ecx
mov word [esp + 0x18], ax
call fcn.0042e640
push edi
lea edx, [esp + 0x1c]
push 0x104
push edx
call fcn.0042c4ff
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
add esp, 0x18
lea eax, [esp + 0xc]
push eax
call ebx
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCatW]
push str.GamePatch
lea ecx, [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0xc]
push edx
call ebx
push str.Config.ini
lea eax, [esp + 0x10]
push eax
call ebp
push edi
lea ecx, [esi + 4]
push 0x104
push ecx
call fcn.0042c4ff
add esp, 0xc
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401770
mov ecx, dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0xc]
push eax
push 0x104
add ecx, 4
push ecx
push 0x4497fc
push str.mainExe
push str.game_base
call edi
mov eax, dword [esi]
lea edx, [esp + 0xc]
push edx
push 0x104
add eax, 0x20c
push eax
push 0x4497fc
push str.param
push str.game_base
call edi
push 0
push str.succeed
push str.Init_base_value_from_config_file
call fcn.0040b6a0
mov ecx, dword [esp + 0x220]
add esp, 0xc
pop edi
pop ebp
pop ebx
xor ecx, esp
mov al, 1
call fcn.0042c4f0
add esp, 0x20c
ret
Function at 0x4017a0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x441c06
mov eax, dword fs:[0]
push eax
sub esp, 0x624
mov eax, dword [0x456600]
xor eax, esp
mov dword [esp + 0x620], eax
push ebp
push edi
mov eax, dword [0x456600]
xor eax, esp
push eax
lea eax, [esp + 0x630]
mov dword fs:[0], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1e]
push ecx
mov word [esp + 0x20], ax
call fcn.0042e640
lea edx, [esi + 4]
push edx
lea eax, [esp + 0x24]
push 0x104
push eax
call fcn.0042c4ff
add esp, 0x18
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov edx, dword [esi]
add edx, 4
push edx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x10]
call fcn.004050b0
mov dword [esp + 0x638], 0
mov edx, dword [esp + 0xc]
push 0x2e
push edx
call fcn.0042cc58
add esp, 8
test eax, eax
jne 0x401853
or eax, 0xffffffff
jmp 0x401859
sub eax, dword [esp + 0xc]
sar eax, 1
inc eax
push eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
call fcn.004042f0
mov byte [esp + 0x638], 1
mov edi, dword [esp + 0x10]
push 0x448fec
push edi
call fcn.0042caff
add esp, 8
test eax, eax
je 0x4018a0
push 0x448ff4
push edi
call fcn.0042caff
add esp, 8
test eax, eax
je 0x4018a0
mov ebp, 1
jmp 0x4018a2
xor ebp, ebp
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x226]
push edx
mov word [esp + 0x228], cx
call fcn.0042e640
lea eax, [esp + 0x228]
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.0040b5a0
mov eax, dword [esi]
add esp, 0x14
push ebp
lea edx, [esp + 0x220]
push edx
add eax, 0x20c
push eax
lea ecx, [esp + 0x20]
push ecx
push 0x448f1c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x42e]
push eax
mov word [esp + 0x430], dx
call fcn.0042e640
mov ecx, dword [esi]
add ecx, 0x20c
push ecx
lea edx, [esp + 0x24]
push edx
push str._s__s
lea edx, [esp + 0x43c]
call fcn.004044b0
push 0
lea eax, [esp + 0x440]
push eax
push str.Execute:
call fcn.0040b6a0
lea eax, [edi - 0x10]
add esp, 0x24
mov byte [esp + 0x638], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40196e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x638], 0xffffffff
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401999
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [esp + 0x630]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
mov ecx, dword [esp + 0x620]
xor ecx, esp
call fcn.0042c4f0
add esp, 0x630
ret
Function at 0x4019d0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x20c
mov eax, dword [0x456600]
xor eax, esp
mov dword [esp + 0x208], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xa]
push ecx
mov word [esp + 0xc], ax
call fcn.0042e640
add esp, 0xc
lea edx, [esp]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edx, 0x44
push esi
xor ecx, ecx
test eax, eax
jle 0x401a2e
lea esp, [esp]
movzx esi, word [esp + ecx*2 + 4]
cmp esi, edx
je 0x401a4b
inc ecx
cmp ecx, eax
jl 0x401a20
cmp edx, 0x5b
jl 0x401a6d
xor eax, eax
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0042c4f0
add esp, 0x20c
ret
cmp ecx, eax
jge 0x401a2e
inc edx
cmp edx, 0x5b
jl 0x401a13
xor eax, eax
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0042c4f0
add esp, 0x20c
ret
mov ecx, dword [esp + 0x20c]
pop esi
xor ecx, esp
mov eax, edx
call fcn.0042c4f0
add esp, 0x20c
ret

Function at 0x401a90
Capabilities:
Check if file exists
Create process on windows

Disassembly:
sub esp, 0x468
mov eax, dword [0x456600]
xor eax, esp
mov dword [esp + 0x464], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x6a]
push ecx
mov word [esp + 0x6c], ax
call fcn.0042e640
add esp, 0xc
lea edi, [esp + 0x60]
mov ecx, esi
call fcn.00401000
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov edx, edi
push edx
call esi
mov eax, edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrCatW]
push str.run.bat
push eax
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [esp + 0x60]
push ecx
call ebx
test eax, eax
je 0x401b4a
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x272]
push eax
mov word [esp + 0x274], dx
call fcn.0042e640
lea ecx, [esp + 0x274]
push ecx
lea edx, [esp + 0x70]
push edx
call fcn.0040b5a0
add esp, 0x14
push 0
lea eax, [esp + 0x26c]
push eax
push 0
lea ecx, [esp + 0x6c]
push ecx
push 0x448f1c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea edx, [esp + 0x60]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [esp + 0x60]
push eax
call esi
push str.run.vbs
lea ecx, [esp + 0x64]
push ecx
call edi
lea edx, [esp + 0x60]
push edx
call ebx
pop edi
pop esi
pop ebx
test eax, eax
je 0x401bfe
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x266]
push ecx
mov word [esp + 0x268], ax
call fcn.0042e640
lea edx, [esp + 0x60]
push edx
push str.wscript___s_
lea edx, [esp + 0x270]
call fcn.004044b0
push 0x40
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.0042e640
add esp, 0x20
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x20
push 0
push 0
mov ecx, 5
mov word [esp + 0x4c], cx
push 0
lea ecx, [esp + 0x27c]
push ecx
push 0
mov dword [esp + 0x28], 0x44
mov dword [esp + 0x54], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [esp + 0x464]
xor ecx, esp
mov al, 1
call fcn.0042c4f0
add esp, 0x468
ret
Function at 0x401c20
Capabilities:
Check if file exists
Create process on windows
Read .ini file

Disassembly:
sub esp, 0xa30
mov eax, dword [0x456600]
xor eax, esp
mov dword [esp + 0xa2c], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x222]
push ecx
mov word [esp + 0x224], ax
call fcn.0042e640
add esp, 0xc
lea ebx, [esp + 0x218]
call fcn.004010a0
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edx, ebx
push edx
push 0x104
lea eax, [esp + 0x428]
push eax
push 0x4497fc
push str.runFirstExe
push str.action_first
call edi
mov ecx, ebx
push ecx
push 0x104
lea edx, [esp + 0x838]
push edx
push 0x4497fc
push str.runFirstParam
push str.action_first
call edi
lea eax, [esp + 0x420]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401cb7
sub eax, edx
sar eax, 1
jne 0x401ce2
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0xa2c]
xor ecx, esp
call fcn.0042c4f0
add esp, 0xa30
ret
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.0042e640
add esi, 4
push esi
lea edx, [esp + 0x20]
push 0x104
push edx
call fcn.0042c4ff
add esp, 0x18
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea ecx, [esp + 0x420]
push ecx
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401d87
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x632]
push edx
mov word [esp + 0x634], cx
call fcn.0042e640
lea eax, [esp + 0x634]
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.0040b5a0
add esp, 0x14
push 1
lea edx, [esp + 0x62c]
push edx
lea eax, [esp + 0x838]
push eax
lea ecx, [esp + 0x1c]
push ecx
jmp 0x401d95
push 1
push 0
push 0
lea edx, [esp + 0x42c]
push edx
push 0x448f1c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0xa38]
pop edi
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.0042c4f0
add esp, 0xa30
ret
Function at 0x401dc0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x456600]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x16]
push ecx
mov word [esp + 0x18], ax
call fcn.0042e640
add esp, 0xc
lea ebx, [esp + 0xc]
call fcn.004010a0
mov edx, ebx
push edx
push 0
push str.setBits
push str.action_first
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
test edi, edi
jle 0x401eae
push 0xdc
call fcn.0040fe58
add esp, 4
mov esi, eax
push esi
push 0xffffffffffffffff
push 0
call dword [sym.imp.USER32.dll_EnumDisplaySettingsW]
cmp edi, dword [esi + 0xa8]
jne 0x401e59
push esi
call fcn.0040fe87
push 0
push str.false__current_bits_perpel_is_equal_to_set
push str.setBits
call fcn.0040b6a0
add esp, 0x10
jmp 0x401eae
push 0xdc
call fcn.0040fe58
mov esi, eax
add esp, 4
push 1
mov eax, 0xdc
push esi
mov dword [esi + 0xac], 0
mov dword [esi + 0xb0], 0
mov dword [esi + 0xa8], edi
mov dword [esi + 0xb8], 0
mov dword [esi + 0x48], 0x5c0000
mov word [esi + 0x44], ax
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsW]
push esi
call fcn.0040fe87
add esp, 4
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.0042c4f0
add esp, 0x20c
ret
Function at 0x402230
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x441bb6
mov eax, dword fs:[0]
push eax
sub esp, 0x630
mov eax, dword [0x456600]
xor eax, esp
mov dword [esp + 0x628], eax
push ebx
push esi
push edi
mov eax, dword [0x456600]
xor eax, esp
push eax
lea eax, [esp + 0x640]
mov dword fs:[0], eax
mov esi, ecx
lea edx, [esi + 4]
push esi
mov ecx, 0x449170
call fcn.00401ed0
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x436]
push ecx
mov word [esp + 0x438], ax
call fcn.0042e640
add esp, 0xc
lea ebx, [esp + 0x42c]
call fcn.004010a0
push 0x206
xor edi, edi
lea eax, [esp + 0x22]
xor edx, edx
push edi
push eax
mov word [esp + 0x28], dx
call fcn.0042e640
add esp, 0xc
mov ecx, ebx
push ecx
push 0x104
lea edx, [esp + 0x24]
push edx
push 0x4497fc
push str.assocGids
push str.action_first
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x1c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4022f1
sub eax, edx
sar eax, 1
je 0x40241e
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
call fcn.004050b0
mov dword [esp + 0x648], edi
call fcn.00410348
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x402335
push 0x80004005
call fcn.00404f30
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x648], 1
lea ecx, [ecx]
mov ecx, dword [esp + 0x18]
push 0x7c
push edi
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.004102cb
mov ebx, dword [esp + 0x14]
cmp dword [ebx - 0xc], 0
je 0x4023cf
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x22e]
push ecx
mov word [esp + 0x230], ax
call fcn.0042e640
add esp, 0xc
lea edx, [esp + 0x224]
push edx
push ebx
call fcn.00402450
push 0
lea eax, [esp + 0x228]
push eax
push str.Assis_gid_directory:
call fcn.0040b6a0
mov ecx, dword [esp + 0x20]
add esp, 0xc
push esi
lea edx, [esp + 0x228]
call fcn.00401ed0
inc edi
cmp edi, 0x104
jb 0x402350
mov ebx, dword [esp + 0x14]
lea eax, [ebx - 0x10]
mov byte [esp + 0x648], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4023f3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x648], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40241e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [esp + 0x640]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x628]
xor ecx, esp
call fcn.0042c4f0
mov esp, ebp
pop ebp
ret
Function at 0x402b10
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x441536
mov eax, dword fs:[0]
push eax
sub esp, 0x644
mov eax, dword [0x456600]
xor eax, esp
mov dword [esp + 0x63c], eax
push esi
push edi
mov eax, dword [0x456600]
xor eax, esp
push eax
lea eax, [esp + 0x650]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x23e]
push ecx
mov word [esp + 0x240], ax
call fcn.0042e640
add esp, 0xc
lea edi, [esp + 0x234]
mov ecx, esi
call fcn.00401000
mov edx, edi
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
push str..reg
mov eax, edi
push eax
call esi
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x446]
push edx
mov word [esp + 0x448], cx
call fcn.0042e640
add esp, 0xc
push 0
push 0x25
lea eax, [esp + 0x444]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [esp + 0x14]
call fcn.00411249
push 0
mov ecx, edi
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x660], 0
call fcn.004112e1
test eax, eax
je 0x402cec
lea ecx, [esp + 0x14]
call fcn.00410f2f
xor edx, edx
push 0x206
mov edi, eax
push edx
lea eax, [esp + 0x36]
push eax
mov word [esp + 0x38], dx
call fcn.0042e640
add esp, 0xc
push str._s__
lea ecx, [esp + 0x30]
push ecx
call esi
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0x18]
call fcn.004115b9
mov eax, dword [eax]
push eax
lea eax, [esp + 0x30]
push eax
call esi
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402c5f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x449248
lea ecx, [esp + 0x30]
push ecx
call esi
push 0
lea edx, [esp + 0x440]
push edx
lea eax, [esp + 0x34]
push eax
push 0x44924c
push 0x448f1c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x18]
call fcn.004115b9
mov byte [esp + 0x658], 1
mov eax, dword [eax]
push 0
push eax
push str.Regedit_succeed_
call fcn.0040b6a0
mov byte [esp + 0x664], 0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 0xc
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x402cdc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
test edi, edi
jne 0x402bf6
lea ecx, [esp + 0x14]
call fcn.00410e49
lea ecx, [esp + 0x14]
mov dword [esp + 0x658], 0xffffffff
call fcn.00411272
mov al, 1
mov ecx, dword [esp + 0x650]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x63c]
xor ecx, esp
call fcn.0042c4f0
mov esp, ebp
pop ebp
ret
Function at 0x403390
Capabilities:
Delete file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x441b16
mov eax, dword fs:[0]
push eax
sub esp, 0x638
mov eax, dword [0x456600]
xor eax, esp
mov dword [esp + 0x630], eax
push ebx
push esi
push edi
mov eax, dword [0x456600]
xor eax, esp
push eax
lea eax, [esp + 0x648]
mov dword fs:[0], eax
push 0x206
mov esi, ecx
xor edi, edi
lea ecx, [esp + 0x43a]
xor eax, eax
push edi
push ecx
mov word [esp + 0x440], ax
call fcn.0042e640
add esp, 0xc
lea ebx, [esp + 0x434]
call fcn.004010a0
push 0x206
lea eax, [esp + 0x232]
xor edx, edx
push edi
push eax
mov word [esp + 0x238], dx
call fcn.0042e640
add esp, 0xc
mov ecx, ebx
push ecx
push 0x104
lea edx, [esp + 0x234]
push edx
push 0x4497fc
push str.delFileOrDirs
push str.action_first
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x22c]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x403450
sub eax, edx
sar eax, 1
jne 0x403468
xor al, al
jmp 0x403599
lea eax, [esp + 0x22c]
push eax
lea ecx, [esp + 0x20]
call fcn.004050b0
mov dword [esp + 0x650], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov byte [esp + 0x650], 1
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x10]
call fcn.0040b410
xor ebx, ebx
cmp dword [esp + 0x14], edi
jle 0x403563
lea edi, [esi + 4]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x2e]
push edx
mov word [esp + 0x30], cx
call fcn.0042e640
add esp, 0xc
push edi
lea eax, [esp + 0x28]
push 0x104
push eax
call fcn.0042c4ff
add esp, 0xc
lea ecx, [esp + 0x24]
push ecx
call esi
test ebx, ebx
jl 0x4035bd
cmp ebx, dword [esp + 0x14]
jge 0x4035bd
mov edx, dword [esp + 0x10]
mov eax, dword [edx + ebx*4]
push eax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x403539
lea edx, [esp + 0x24]
push edx
call fcn.0040af20
add esp, 4
push 0
lea eax, [esp + 0x28]
push eax
push str.Delete_directory_succeed:
jmp 0x403550
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea edx, [esp + 0x28]
push edx
push str.Delete_file_succeed:
call fcn.0040b6a0
inc ebx
add esp, 0xc
cmp ebx, dword [esp + 0x14]
jl 0x4034b6
lea esi, [esp + 0x10]
call fcn.004044f0
mov dword [esp + 0x650], 0xffffffff
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403597
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [esp + 0x648]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x630]
xor ecx, esp
call fcn.0042c4f0
mov esp, ebp
pop ebp
ret
push 0
push 0
push 1
push 0xc000008c
call dword [sym.imp.KERNEL32.dll_RaiseException]