joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dc5e0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x618
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 8]
push eax
call fcn.004ce530
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 0xc
test eax, eax
jbe 0x4dc6c7
mov dx, word [0x52a480]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x20e]
mov word [esp + 0x20c], dx
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x418]
push 0x104
push eax
call fcn.004babe0
add esp, 8
lea ecx, [esp + 0x210]
lea edx, [esp + 8]
push 0x104
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, dword [esp + 0x624]
lea eax, [esp + 0x210]
lea ecx, [esp + 0x418]
push eax
push ecx
push esi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 1
push esi
call fcn.0042be80
mov eax, dword [esp + 0x634]
add esp, 8
test eax, eax
je 0x4dc6b9
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x4dc6b9
push esi
call fcn.0042c110
add esp, 4
pop esi
mov eax, 1
pop edi
add esp, 0x618
ret
xor eax, eax
pop edi
add esp, 0x618
ret

Function at 0x4dc6e0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x410
push esi
mov esi, dword [esp + 0x420]
push edi
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
push esi
call edi
add esp, 4
test eax, eax
jbe 0x4dc7a5
push esi
call edi
add esp, 4
cmp eax, 0x104
jae 0x4dc7a5
mov ax, word [0x52a480]
mov ecx, 0x81
mov word [esp + 8], ax
xor eax, eax
lea edi, [esp + 0xa]
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x214]
push ecx
stosw word es:[edi], ax
call fcn.004babe0
add esp, 8
lea edx, [esp + 8]
push 0x104
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, dword [esp + 0x41c]
lea eax, [esp + 8]
lea ecx, [esp + 0x210]
push eax
push ecx
push esi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 1
push esi
call fcn.0042be80
add esp, 8
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x4dc797
push esi
call fcn.0042c110
add esp, 4
pop edi
pop esi
add esp, 0x410
ret
pop edi
mov eax, 1
pop esi
add esp, 0x410
ret
pop edi
xor eax, eax
pop esi
add esp, 0x410
ret
Function at 0x4dc7b0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x410
push ebx
push esi
mov esi, dword [esp + 0x41c]
push edi
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
cmp eax, 0x104
ja 0x4dc8f5
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x216]
mov word [esp + 0x214], 0
rep stosd dword es:[edi], eax
mov ebx, dword [sym.imp.MSVCRT.dll__snwprintf]
push esi
stosw word es:[edi], ax
push 0x50f4e4
lea eax, [esp + 0x21c]
push 0x103
push eax
call ebx
push esi
lea ecx, [esp + 0x228]
push 0x104
push ecx
call fcn.004dc6e0
add esp, 0x1c
test eax, eax
je 0x4dc8f5
lea edx, [esp + 0x214]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x4dc8f5
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
push 0x104
push eax
call fcn.004babe0
lea ecx, [esp + 0x14]
push 0
push ecx
call fcn.004f1940
lea edx, [esp + 0x1c]
push 0x104
push edx
call fcn.004babe0
add esp, 0x18
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4dc8d8
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
lea edx, [esi + eax*2]
lea eax, [esp + 0xc]
push edx
push 0x50f4e4
push 0x103
push eax
call ebx
lea ecx, [esp + 0x1c]
push 0x104
push ecx
call fcn.004ce510
add esp, 0x18
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x410
ret
push 0x104
push esi
call fcn.004ce510
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x410
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x410
ret
Function at 0x4dc910
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
push esi
lea eax, [esp + 4]
push edi
push eax
mov dword [esp + 0xc], 0
call fcn.004ce5e0
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 4
test eax, eax
jne 0x4dc999
push 0
push 6
push 0x6ceeb4
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4dca56
push 1
push 0x6ceeb4
call fcn.004f1940
mov eax, dword [esp + 0x220]
add esp, 8
test eax, eax
je 0x4dca89
mov ecx, dword [esp + 0x21c]
push 0x6ceeb4
dec ecx
push 0x50f4e4
push ecx
push eax
call esi
add esp, 0x10
mov eax, 0x6ceeb4
pop edi
pop esi
add esp, 0x20c
ret
cmp eax, 3
jne 0x4dca48
push 1
push 0x104
push 0x6ceeb4
call fcn.004dc5e0
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], 0
add esp, 0xc
lea edx, [esp + 0xc]
rep stosd dword es:[edi], eax
push 0x6ceeb4
push 0x50f4e4
push 0x103
push edx
stosw word es:[edi], ax
call esi
push 0x6ceeb4
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 0x14
test eax, eax
jne 0x4dca56
push eax
push 6
push 0x6ceeb4
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4dca56
push 1
push 0x6ceeb4
call fcn.004f1940
mov eax, dword [esp + 0x220]
add esp, 8
test eax, eax
je 0x4dca89
mov ecx, dword [esp + 0x21c]
push 0x6ceeb4
dec ecx
push 0x50f4e4
push ecx
push eax
call esi
add esp, 0x10
mov eax, 0x6ceeb4
pop edi
pop esi
add esp, 0x20c
ret
mov ecx, 0x82
xor eax, eax
mov edi, 0x6ceeb4
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x218]
test eax, eax
je 0x4dca7a
mov edx, dword [esp + 0x21c]
push 0x6ceeb4
dec edx
push 0x50f4e4
push edx
push eax
call esi
add esp, 0x10
push 1
push 0x6ceeb4
call fcn.004f1940
add esp, 8
pop edi
mov eax, 0x6ceeb4
pop esi
add esp, 0x20c
ret
Function at 0x4dced0
Capabilities:
Check if file exists
Create thread
Terminate thread

Disassembly:
sub esp, 0x20c
push ebx
mov ebx, dword [esp + 0x214]
push ebp
xor ebp, ebp
push esi
cmp ebx, ebp
push edi
mov esi, ecx
jne 0x4dcef9
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x20c
ret 4
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, 1
cmp eax, ecx
jne 0x4dcf11
mov dword [esi + 0x62790], ecx
jmp 0x4dcf17
mov dword [esi + 0x62790], ebp
mov eax, dword [esi + 0x62788]
cmp eax, ebp
je 0x4dcf7b
push 0x1388
push eax
mov dword [esi + 0x6278c], ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4dcf62
mov ecx, dword [esi + 0x62788]
lea eax, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x62788]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x62788]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x62788], ebp
mov dword [esi + 0x6278c], ebp
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], bp
rep stosd dword es:[edi], eax
push ebx
push 0x50f4e4
lea edx, [esp + 0x1c]
push 0x103
push edx
stosw word es:[edi], ax
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea eax, [esp + 0x24]
push ebp
push eax
call fcn.004f1940
lea edi, [esi + 0x3d0]
push ebp
push edi
call fcn.004f1940
add esp, 0x20
lea ecx, [esp + 0x14]
push edi
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x4dcfe6
cmp dword [esi + 0x14], 2
jne 0x4dcfe6
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x20c
ret 4
push 1
mov ecx, esi
call fcn.004d1b30
mov eax, dword [esi + 0x6277c]
cmp eax, ebp
je 0x4dd008
push eax
call fcn.004ba355
add esp, 4
mov dword [esi + 0x6277c], ebp
mov ecx, esi
mov dword [esi + 0x62780], ebp
mov dword [esi + 0x62784], ebp
call fcn.004d0400
push ebx
push 0x50f4e4
push 0x104
push edi
mov dword [esi + 0x14], 2
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
mov ecx, esi
push ebp
push 2
push ebx
call fcn.004dcaa0
mov ecx, esi
call fcn.004dea60
push ebp
push ebp
push esi
push 0x4dc5c0
push ebp
push ebp
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0x62788], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret 4
Function at 0x4dd200
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4fbe68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebp
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x6274c]
push edi
mov dword [esp + 0x14], edi
call ebx
mov ebp, 1
mov dword [esp + 0x14], ebp
push ebp
mov ecx, esi
mov dword [esp + 0x24], 0
call fcn.004d1960
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4dd26f
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, esi
mov dword [esp + 0x14], 0
call fcn.004d0400
push edi
call ebx
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x28]
mov ecx, esi
push eax
call fcn.004dd360
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x30], eax
mov dword [esi + 0x624], ecx
mov ecx, esi
call fcn.004dea60
cmp dword [esi + 0x14], ebp
jne 0x4dd2c2
lea ebx, [esi + 0x76]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4dd2af
push 2
push ebx
push 0
mov ecx, esi
call fcn.004d8280
mov ecx, esi
mov dword [esi + 0x5fc], ebp
call fcn.004cff10
mov dword [esi + 0x384], ebp
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc
Function at 0x4de890
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x62764]
test eax, eax
jne 0x4de8c0
lea eax, [esi + 0x62768]
push eax
push 0
push 0
push 0x4de790
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0x62764], eax
mov eax, dword [esi + 0x62764]
pop esi
neg eax
sbb eax, eax
and eax, 2
dec eax
ret

Function at 0x4e4d60
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
lea eax, [esp]
mov dword [esp], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x10], 2
jne 0x4e4d93
cmp dword [esp + 4], 5
jbe 0x4e4d93
mov eax, 1
add esp, 0x114
ret
xor eax, eax
add esp, 0x114
ret
Function at 0x4ea1a0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x208
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
mov dword [esi + 0x490], 1
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4ea2ab
mov eax, dword [esp + 0x210]
test eax, eax
je 0x4ea2ab
push ebx
push ebp
push edi
push 4
mov ecx, esi
call fcn.004ea2c0
mov edx, dword [0x607afc]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
push 0x103
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push ecx
push 0xea81
push edx
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_LoadStringW]
mov ecx, dword [esi + 0xc]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
lea eax, [esp + 0x10]
push eax
push 1
push ecx
call edi
mov ebp, dword [sym.imp.USER32.dll_SetWindowTextW]
push eax
call ebp
mov edx, dword [esi + 0xc]
push 1
push 1
push edx
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [esi + 0xc]
push 0
push 2
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov ecx, dword [esi + 0xc]
push 0
push 0x41b
push ecx
call edi
push eax
call ebx
mov edx, dword [esi + 0xc]
push 0
push 0x41c
push edx
call edi
push eax
call ebx
mov eax, dword [esi + 0xc]
push 0
push 0x41a
push eax
call edi
push eax
call ebx
mov ecx, dword [esi + 0xc]
push 0
push 0x3ec
push ecx
call edi
push eax
call ebx
mov edx, dword [esp + 0x21c]
mov eax, dword [esi + 0xc]
push edx
push 0x419
push eax
call edi
push eax
call ebp
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x208
ret 4

Function at 0x4ea340
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x4eb3e0
Capabilities:
Copy file
Delete file
Move file

Disassembly:
sub esp, 0x20
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov eax, dword [esi]
cmp eax, ebx
je 0x4eb459
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
jbe 0x4eb459
push edi
call fcn.004eb320
mov ecx, 7
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi]
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x26], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x2a], ebx
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], eax
mov word [esp + 0x20], 0x454
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [esi + 8]
mov edi, dword [esi]
shl ecx, 1
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov dword [esi + 4], ebx
pop edi
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x4eba00
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x410
push esi
push edi
mov edi, dword [esp + 0x41c]
mov esi, ecx
test edi, edi
je 0x4ebad2
call fcn.004cf160
cmp dword [eax + 0x14], 2
jne 0x4ebad2
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call fcn.004cf160
lea eax, [esp + 8]
push 0x103
push eax
call fcn.004dc910
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 0xc
test eax, eax
jbe 0x4ebad5
lea edx, [esp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4ebad5
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x212]
mov word [esp + 0x210], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str..url.dat
push 0x50f4e4
lea eax, [esp + 0x218]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
push 0
lea ecx, [esp + 0x224]
push 1
push ecx
lea edx, [esp + 0x24]
push 0
push edx
call fcn.004eb560
add esp, 0x24
pop edi
pop esi
add esp, 0x410
ret 4
mov dword [esi + 8], edi
pop edi
pop esi
add esp, 0x410
ret 4
Function at 0x4ec2e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push edi
push 1
mov esi, ecx
push 4
push eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], 0
call ebx
add esp, 0x10
cmp eax, 1
je 0x4ec326
or eax, 0xffffffff
lea esp, [ebp - 0x254]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push edi
push 1
lea ecx, [esi + 0x1c]
push 4
push ecx
call ebx
add esp, 0x10
cmp eax, 1
je 0x4ec34b
or eax, 0xffffffff
lea esp, [ebp - 0x254]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ebx, [esi + 0x20]
mov ecx, 0x19
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov edx, dword [ebp + 8]
mov ecx, 0xc
lea edi, [ebp - 0x3f]
mov byte [ebp - 0x40], al
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push edx
push 0x32
lea eax, [ebp - 0x40]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
lea ecx, [ebp - 0x40]
add esp, 0x10
test ecx, ecx
mov dword [ebp - 4], eax
jne 0x4ec38a
xor edi, edi
jmp 0x4ec3c0
lea edx, [ebp - 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.004ba380
mov edi, esp
push esi
push edi
lea eax, [ebp - 0x40]
push 0xffffffffffffffff
push eax
push 0
push 0
mov word [edi], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, dword [ebp - 0xc]
push edi
push 0x50f4e4
push 0x31
push ebx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
add esi, 0x28c
push str.1.0.0.3
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpW]
call esi
test eax, eax
jl 0x4ec479
lea ecx, [ebp + 8]
xor edi, edi
push ecx
mov dword [ebp + 8], edi
call fcn.004ce5e0
mov eax, dword [ebp + 8]
add esp, 4
cmp eax, 2
jne 0x4ec45b
mov word [ebp - 0x248], di
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x246]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x248]
push 0x103
push edx
stosw word es:[edi], ax
call fcn.004c6670
mov ecx, eax
call fcn.004cc8d0
lea eax, [ebp - 0x248]
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x4ec479
or eax, 0xffffffff
lea esp, [ebp - 0x254]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x52a480
push ebx
call esi
test eax, eax
je 0x4ec479
or eax, 0xffffffff
lea esp, [ebp - 0x254]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
lea esp, [ebp - 0x254]
sub eax, 0x32
neg eax
pop edi
pop esi
sbb eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4ec4a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
cmp eax, ecx
jle 0x4ec4c6
mov ecx, 0x64
mov edi, dword [esi + 0x18]
add edi, ecx
mov edx, edi
mov dword [esi + 0x18], edi
cmp eax, edx
jg 0x4ec4b8
mov edi, dword [esi + 0x18]
lea eax, [edi + edi*4]
lea eax, [eax + eax*4]
shl eax, 7
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
xor ebx, ebx
add esp, 4
or ebp, 0xffffffff
cmp eax, ebx
mov dword [esp + 0x14], eax
je 0x4ec595
dec edi
cmp edi, ebx
jl 0x4ec591
inc edi
lea edx, [eax + 0x48]
mov dword [esp + 0x10], edi
mov ecx, 0x28b
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, 0x30e
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, 0x30e
mov edi, edx
rep stosd dword es:[edi], eax
lea eax, [edx - 0x2c]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
lea eax, [edx - 0x1c]
add edx, 0xc80
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, dword [esp + 0x10]
mov dword [edx - 0xcc8], ebp
mov dword [edx - 0xcc4], ebp
mov dword [edx - 0xcc0], ebx
mov dword [edx - 0xcb4], ebx
mov dword [edx - 0xcbc], 1
mov dword [edx - 0xcb8], ebx
mov dword [edx - 0xc84], ebp
mov dword [edx - 0xc88], ebp
mov dword [edx - 0xc8c], ebp
mov dword [edx - 0xcb0], ebx
dec eax
mov dword [esp + 0x10], eax
jne 0x4ec4fd
mov eax, dword [esp + 0x14]
mov edi, eax
jmp 0x4ec597
xor edi, edi
cmp edi, ebx
mov dword [esi + 0x14], edi
jne 0x4ec5aa
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [esi + 0x18]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
xor eax, eax
shl ecx, 7
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x1c]
cmp eax, 0x2710
jge 0x4ec5fb
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 0x14]
push ecx
push eax
push 0xc80
push edx
call dword [sym.imp.MSVCRT.dll_fread]
mov ecx, dword [esi + 0x1c]
add esp, 0x10
cmp eax, ecx
je 0x4ec631
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [esp + 0x1c]
mov ecx, dword [esi + 0x14]
push eax
push 0x2710
push 0xc80
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 0x2710
je 0x4ec62a
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov dword [esi + 0x1c], 0x2710
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret 4
Function at 0x4ec7b0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4fc33b
push eax
mov eax, 0x1b98
mov dword fs:[0], esp
call fcn.004ba380
push ebx
mov ebx, ecx
push esi
push edi
lea ecx, [esp + 0x218]
call fcn.004f2180
mov eax, dword [esp + 0x1bb4]
push 1
push eax
lea ecx, [esp + 0x220]
mov dword [esp + 0x1bb4], 0
call fcn.004f21e0
mov edi, 1
push 0
lea ecx, [esp + 0x21c]
mov dword [esp + 0x10], edi
call fcn.004f3240
mov esi, eax
test esi, esi
je 0x4ec937
push ebp
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4ec8eb
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
rep stosd dword es:[edi], eax
lea ecx, [esi + 0x201a]
lea edx, [esp + 0x14]
push ecx
push 0x50f4e4
push 0x103
push edx
stosw word es:[edi], ax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea eax, [esp + 0x14]
push eax
push 0
push str.BEST
push str.InternetShortcut
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebp, eax
mov ecx, 0x411
xor eax, eax
lea edi, [esp + 0xb62]
mov word [esp + 0xb60], 0
lea edx, [esp + 0xb60]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push ecx
push 0x824
push edx
push 0x52a480
push 0x5236c0
push str.InternetShortcut
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x1bbc]
mov eax, dword [ebx]
push ecx
push ebp
push edx
lea ecx, [esp + 0xb6c]
push 1
add esi, 0x81a
push ecx
push esi
mov ecx, ebx
call dword [eax + 4]
mov edi, dword [esp + 0x10]
jmp 0x4ec917
mov eax, dword [esp + 0x1bbc]
mov edx, dword [ebx]
push edi
push 0
push eax
push 2
lea ecx, [esi + 0x81a]
push 0
push ecx
mov ecx, ebx
call dword [edx + 4]
add esi, 0x201a
push eax
push esi
mov ecx, ebx
call fcn.004ec7b0
inc edi
lea ecx, [esp + 0x21c]
mov dword [esp + 0x10], edi
lea edx, [edi - 1]
push edx
call fcn.004f3240
mov esi, eax
test esi, esi
jne 0x4ec823
pop ebp
lea ecx, [esp + 0x218]
mov dword [esp + 0x1bac], 0xffffffff
call fcn.004f21d0
mov ecx, dword [esp + 0x1ba4]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1ba4
ret 8
Function at 0x4ed4d0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
push edi
push 0x51b1ec
push eax
call dword [sym.imp.MSVCRT.dll__wfopen]
mov ebx, eax
add esp, 8
test ebx, ebx
mov edi, 3
jne 0x4ed4fb
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov esi, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push 0
push ebx
call esi
push ebx
call dword [sym.imp.MSVCRT.dll_ftell]
push 0
push 0
push ebx
mov ebp, eax
call esi
add esp, 0x1c
test ebp, ebp
jle 0x4ed5a5
lea edi, [ebp + 2]
push edi
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x4ed542
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
ret 4
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebx
and ecx, 3
push 1
push ebp
push esi
rep stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_fread]
xor eax, eax
add esp, 0x10
mov ah, byte [esi + 1]
mov al, byte [esi]
mov edi, eax
cmp di, 0xbbef
jne 0x4ed57a
cmp byte [esi + 2], 0xbf
je 0x4ed588
push ebp
push esi
call fcn.0043a350
add esp, 8
test eax, eax
je 0x4ed58f
mov edi, 2
jmp 0x4ed59b
xor ecx, ecx
cmp di, 0xfeff
sete cl
mov edi, ecx
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 4