joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c83d4
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.005c84c8
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 4], edx
mov byte [ebp - 0xd], 0
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
call fcn.005c8630
test al, al
je 0x5c84b4
call fcn.005c7fe0
mov eax, dword [eax + 8]
mov dword [ebp - 0x18], eax
push 4
lea eax, [ebp - 0x18]
push eax
push 0x1006
push 0xffff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.wsock32.dll_setsockopt
push 4
lea eax, [ebp - 0x18]
push eax
push 0x1005
push 0xffff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.wsock32.dll_setsockopt
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.005c6c18
test al, al
je 0x5c849b
mov word [ebp - 0x28], 2
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov ax, word [ebp - 0xc]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x26], ax
push 0x10
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.wsock32.dll_connect
inc eax
setne byte [ebp - 0xd]
call sub.wsock32.dll_WSAGetLastError
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
cmp byte [ebp - 0xd], 0
jne 0x5c84b4
mov eax, dword [ebp - 4]
call fcn.005c84c8
mov eax, dword [ebp - 4]
call fcn.005c8630
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret

Function at 0x5c8544
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.005c8630
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x5c85c9
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0xc]
jge 0x5c85c9
push 0
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x5c8599
cmp dword [ebp - 0x14], 0
jne 0x5c859d
xor eax, eax
jmp 0x5c859f
mov al, 1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x5c85b5
call sub.wsock32.dll_WSAGetLastError
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
jmp 0x5c85c9
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
add dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0xc]
jl 0x5c8571
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret
Function at 0x5c85d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
call fcn.005c8630
test al, al
je 0x5c8627
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
xor ecx, ecx
call fcn.00404e34
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x5c8627
call sub.wsock32.dll_WSAGetLastError
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x5c9fd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0xffffffff
cmp dword [ebp - 8], 0
jle 0x5ca014
mov al, byte [ebp - 0xc]
mov edx, dword [ebp - 4]
xor al, byte [edx]
and eax, 0xff
mov eax, dword [eax*4 + 0x5ecc58]
mov edx, dword [ebp - 0xc]
shr edx, 8
xor eax, edx
mov dword [ebp - 0xc], eax
dec dword [ebp - 8]
inc dword [ebp - 4]
cmp dword [ebp - 8], 0
jg 0x5c9fe9
xor dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x5d5530
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd48
lea eax, [ebp - 0x2b8]
xor ecx, ecx
mov edx, 0x2b4
call fcn.00404e34
push 0x4011
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0
push 0x5d5574
call sub.shell32.dll_SHGetFileInfoW
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x5d71e4
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd40
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0x4009
push 0x2b4
lea eax, [ebp - 0x2c0]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetFileInfoW
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x5e5564
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov eax, 0x5dc3a8
call fcn.0040b078
xor eax, eax
push ebp
push 0x5e5702
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.005c2118
test al, al
je 0x5e56e7
mov eax, dword [0x5ed698]
mov eax, dword [eax]
cmp byte [eax + 0x30], 1
jne 0x5e5631
mov eax, 0x6035e4
call fcn.00406e8c
push eax
call sub.kernel32.dll_GetCommandLineW_1
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.00407d50
mov eax, dword [ebp - 0x14]
mov edx, 0x5e571c
pop ecx
call fcn.005826d4
test al, al
je 0x5e55ee
mov eax, dword [0x5ed698]
mov eax, dword [eax]
mov edx, dword [0x6035e4]
call fcn.005c2e6c
jmp 0x5e5631
lea eax, [ebp - 0x18]
call fcn.0057324c
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
call fcn.0057243c
mov eax, dword [ebp - 0x1c]
pop edx
call fcn.0056cefc
test al, al
je 0x5e5627
push 0x10
push 0x5e5728
push 0x5e5734
push 0
call sub.user32.dll_MessageBoxW
jmp 0x5e56e7
call fcn.005bd734
jmp 0x5e56e7
mov eax, dword [0x5ed4ac]
mov eax, dword [eax]
call fcn.005622a8
mov eax, dword [0x5ed4ac]
mov eax, dword [eax]
mov dl, 1
call fcn.00563ea4
mov eax, dword [0x5ed4ac]
mov eax, dword [eax]
mov edx, 0x5e5770
call fcn.00561ca4
mov eax, dword [0x5ed698]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
call fcn.005c46d8
mov eax, dword [0x5ed698]
mov eax, dword [eax]
test byte [eax + 0x31], 8
je 0x5e56c3
mov eax, dword [0x5ed698]
mov eax, dword [eax]
mov dl, 1
call fcn.005c2c3c
mov eax, dword [0x5ed698]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
call fcn.00570358
test eax, eax
jle 0x5e56b5
lea edx, [ebp - 0x20]
mov eax, dword [0x5ed698]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
call fcn.005704c4
mov eax, dword [ebp - 0x20]
xor edx, edx
call fcn.005b7878
mov eax, dword [0x5ed698]
mov eax, dword [eax]
call fcn.005c248c
jmp 0x5e56e7
mov ecx, dword [0x5ed0d4]
mov eax, dword [0x5ed4ac]
mov eax, dword [eax]
mov edx, dword [0x5db018]
call fcn.005622c0
mov eax, dword [0x5ed4ac]
mov eax, dword [eax]
call fcn.00562424
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e5709
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00406eec
ret
Function at 0x404e90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ce602
mov eax, dword fs:[0]
push eax
sub esp, 0x410
mov eax, dword [0x65a000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x418], 0
mov dword [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
push 0x3fe
push eax
mov word [ebp - 0x410], ax
lea eax, [ebp - 0x40e]
push eax
mov dword [ebp - 0x418], 1
call fcn.005a7690
add esp, 0xc
mov ecx, esi
push 1
push 0x60e9c0
mov dword [ebp - 0x414], 0x400
call fcn.004058d0
cmp dword [ebp + 0x3c], 8
lea edx, [ebp + 0x28]
cmovae edx, dword [ebp + 0x28]
cmp word [edx], 0
jne 0x404f41
xor ecx, ecx
jmp 0x404f55
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404f46
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.004057a0
push 1
push 0x60e9c4
mov ecx, esi
call fcn.004057a0
cmp dword [ebp + 0x24], 8
lea ecx, [ebp - 0x414]
push ecx
lea ecx, [ebp - 0x410]
push ecx
push 0
lea eax, [ebp + 0x10]
cmovae eax, dword [ebp + 0x10]
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404fce
cmp word [ebp - 0x410], ax
jne 0x404fa2
xor ecx, ecx
jmp 0x404fbf
lea ecx, [ebp - 0x410]
lea edx, [ecx + 2]
jmp 0x404fb0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404fb0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x410]
push eax
mov ecx, esi
call fcn.004057a0
push 2
push 0x60e9c8
mov ecx, esi
call fcn.004057a0
cmp dword [ebp + 0x3c], 8
lea edx, [ebp + 0x28]
cmovae edx, dword [ebp + 0x28]
cmp word [edx], 0
jne 0x404ff1
xor ecx, ecx
jmp 0x405005
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404ff6
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.004057a0
push 1
push 0x60e9c4
mov ecx, esi
call fcn.004057a0
cmp dword [ebp + 0x24], 8
jb 0x40502d
push dword [ebp + 0x10]
call fcn.0048166b
add esp, 4
xor eax, eax
cmp dword [ebp + 0x3c], 8
mov dword [ebp + 0x24], 7
mov dword [ebp + 0x20], 0
mov word [ebp + 0x10], ax
jb 0x405052
push dword [ebp + 0x28]
call fcn.0048166b
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005a4646
mov esp, ebp
pop ebp
ret 0x38
Function at 0x406b50
Capabilities:
Check mutex on windows

Disassembly:
push esi
push edi
mov edi, ecx
mov dword [edi], vtable.CCDCMACRO.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.00408480
push 0
push 0
push 0
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push 0xffffffffffffffff
push eax
mov dword [edi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [edi + 4]
lea ecx, [edi + 4]
push dword [eax + 4]
call fcn.00408080
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], 0
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, edi
pop edi
pop esi
ret
Function at 0x408d80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x408d95
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x408dd4
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x408dd0
lea ebx, [ebx]
cmp esi, edx
jae 0x408dd4
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x408dc0
cmp esi, edx
jb 0x408dd9
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x410210
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
jne 0x41022d
pop edi
pop esi
pop ebx
mov dword [ebp + 8], str.CDownload::ClearDownloadList_param_error
pop ebp
jmp fcn.00415fc0
mov eax, dword [ebx]
test eax, eax
je 0x4102d3
xor edi, edi
test eax, eax
je 0x4102d3
mov eax, dword [ebx + 4]
mov esi, dword [eax + edi*4]
test esi, esi
je 0x4102d3
mov eax, dword [esi + 0x10]
mov dword [ebp + 8], eax
test eax, eax
je 0x41026f
push dword [eax + 4]
call fcn.005a5a32
add esp, 4
push dword [ebp + 8]
call fcn.005a5a32
add esp, 4
mov eax, dword [esi + 8]
mov dword [ebp + 8], eax
test eax, eax
je 0x41028f
push dword [eax + 4]
call fcn.005a5a32
add esp, 4
push dword [ebp + 8]
call fcn.005a5a32
add esp, 4
mov eax, dword [esi + 0xc]
mov dword [ebp + 8], eax
test eax, eax
je 0x4102af
push dword [eax + 4]
call fcn.005a5a32
add esp, 4
push dword [ebp + 8]
call fcn.005a5a32
add esp, 4
mov esi, dword [esi + 4]
test esi, esi
je 0x4102ca
push dword [esi + 4]
call fcn.005a5a32
add esp, 4
push esi
call fcn.005a5a32
add esp, 4
inc edi
cmp edi, dword [ebx]
jb 0x410241
mov esi, dword [ebx + 0x1c]
test esi, esi
je 0x4102ee
push dword [esi + 4]
call fcn.005a5a32
add esp, 4
push esi
call fcn.005a5a32
add esp, 4
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x410318
mov eax, dword [eax + 0xc]
test eax, eax
je 0x410305
push eax
call fcn.005a5a32
add esp, 4
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 8]
test eax, eax
je 0x410318
push eax
call fcn.005a5a32
add esp, 4
push ebx
call fcn.005a5a32
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4120a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cf992
mov eax, dword fs:[0]
push eax
mov eax, 0x2014
call fcn.005a9ad0
mov eax, dword [0x65a000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2014], ecx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x201c], 0
xor ecx, ecx
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], 0
mov dword [ebp - 0x2018], eax
mov dword [ebp - 0x2020], eax
mov word [eax], cx
xor eax, eax
mov dword [ebp - 4], ecx
push 0x1ffe
push eax
mov word [ebp - 0x2010], ax
lea eax, [ebp - 0x200e]
push eax
mov dword [ebp - 0x201c], 1
call fcn.005a7690
mov eax, dword [ebp - 0x2014]
add esp, 0xc
push 0xffffffffffffffff
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebx + 0x14], 8
jb 0x412150
mov ebx, dword [ebx]
cmp dword [edi + 0x14], 8
jb 0x412158
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x412160
mov esi, dword [esi]
push ebx
push 0x1000
lea eax, [ebp - 0x2010]
push eax
push 0x60ec18
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x2010], 0
jne 0x412188
xor ecx, ecx
jmp 0x4121a0
lea ecx, [ebp - 0x2010]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x412191
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x2018]
lea eax, [ebp - 0x2010]
push eax
call fcn.004058d0
mov eax, dword [ebp - 0x2014]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [ebp - 0x2018]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005a4646
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4159e0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [0x6faff4]
push 0
push 0
push 0x800c
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
je 0x415a3a
push 0
push 4
push 0
push 0
push esi
push 0x415a40
mov dword [esi + 4], eax
call fcn.0048babd
mov dword [esi + 0xc], eax
mov dword [eax + 0x28], 0
mov eax, dword [esi + 0xc]
push dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x415c90
Capabilities:
Delete file
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa7c
mov eax, dword [0x65a000]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x24c
lea eax, [ebp - 0xa74]
push 0
push eax
mov esi, edx
mov dword [ebp - 0xa78], 0
call fcn.005a7690
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.005a7690
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push eax
call fcn.005a7690
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x620], ax
lea eax, [ebp - 0x61e]
push eax
call fcn.005a7690
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x828], ax
lea eax, [ebp - 0x826]
push eax
call fcn.005a7690
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 0x3c
lea eax, [ebp - 0x210]
push esi
push 0x104
push eax
push 0
push 0
push 0
call edi
lea eax, [ebp - 0x210]
push esi
push 0x104
push eax
push 0x6130ec
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
cmp word [ebp - 0x210], 0
jne 0x415d8c
mov dword [0x6fb420], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a4646
mov esp, ebp
pop ebp
ret
push esi
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0x60ec18
push str.FORMAT
push 0x6130ec
call edi
mov cx, word [ebp - 0x210]
test cx, cx
jne 0x415dc2
mov dword [0x6fb420], 0
jmp 0x415ddf
xor eax, eax
mov edx, 1
cmp cx, 0x31
cmove eax, edx
mov dword [0x6fb420], 1
mov dword [0x6fb424], eax
push esi
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0x60ec18
push str.NOT_DELETE
push 0x6130ec
call edi
mov ax, word [ebp - 0x210]
test ax, ax
je 0x415e13
cmp ax, 0x31
je 0x415ec0
lea eax, [ebp - 0x418]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x418]
push eax
push str._sMS4.LOG
push 0xffffffffffffffff
lea eax, [ebp - 0x620]
push 0x104
push eax
call fcn.005a4e29
add esp, 0x14
lea eax, [ebp - 0xa78]
push eax
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x415ec0
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, edi
test byte [ebp - 0xa78], 0x10
jne 0x415eab
lea eax, [ebp - 0xa4c]
push eax
lea eax, [ebp - 0x418]
push eax
push str._s_s
push 0xffffffffffffffff
lea eax, [ebp - 0x828]
push 0x104
push eax
call fcn.005a4e29
add esp, 0x18
lea eax, [ebp - 0x828]
push eax
call ebx
lea eax, [ebp - 0xa78]
push eax
push esi
call edi
test eax, eax
jne 0x415e70
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0xffffffffffffffff
call fcn.00415ef0
push eax
push 0x104
push 0x6fd428
call fcn.005a54f5
add esp, 0x10
call fcn.004161a0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005a4646
mov esp, ebp
pop ebp
ret
Function at 0x415ef0
Capabilities:
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x65a000]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.005a7690
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x415fab
push 0x6fdb00
push 0
push 0x613134
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x415fab
push 0xffffffffffffffff
push 0x6fdb00
push 0x104
push 0x6fd8f8
call fcn.005a54f5
push 0x2e
push 0x6fd8f8
call fcn.005a5b5d
add esp, 0x18
test eax, eax
je 0x415fab
push 0xffffffffffffffff
push str..LOG
xor ecx, ecx
push 0x104
push 0x6fd8f8
mov word [eax], cx
call fcn.005a5c03
add esp, 0x10
push 0x6fd8f8
push 0x6fdb00
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x6fd8f8
call fcn.005a4646
mov esp, ebp
pop ebp
ret

Function at 0x415fc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x65a000]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
xor eax, eax
push edi
mov edi, dword [ebp + 8]
push 0x7fe
push eax
mov word [ebp - 0x81c], ax
mov dword [ebp - 0x812], eax
mov word [ebp - 0x80e], ax
mov word [ebp - 0x80c], ax
lea eax, [ebp - 0x80a]
xorps xmm0, xmm0
push eax
movq qword [ebp - 0x81a], xmm0
call fcn.005a7690
add esp, 0xc
cmp dword [0x6fb420], 0
mov dword [ebp - 0x820], 0
je 0x416124
lea eax, [ebp - 0x81c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp dword [0x6fb424], 1
jne 0x41610c
push 0x6fd630
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push 0x6fd428
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4160ef
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
movzx eax, word [ebp - 0x810]
push edi
push eax
movzx eax, word [ebp - 0x812]
push eax
movzx eax, word [ebp - 0x814]
push eax
movzx eax, word [ebp - 0x816]
push eax
movzx eax, word [ebp - 0x81a]
push eax
movzx eax, word [ebp - 0x81c]
push eax
push str.__d__02d__02d__02d:_02d:_02d__s_r_n
push 0xffffffffffffffff
lea eax, [ebp - 0x80c]
push 0x400
push eax
call fcn.005a4e29
add esp, 0x2c
lea ecx, [ebp - 0x820]
push 0
push ecx
add eax, eax
push eax
lea eax, [ebp - 0x80c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x6fd630
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005a4646
mov esp, ebp
pop ebp
ret 4
push 0x40000
push str.ERROR_LOG
push edi
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.005a4646
mov esp, ebp
pop ebp
ret 4
Function at 0x4161a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cfb08
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x65a000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x6131a0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
call fcn.00409390
mov dword [ebp - 4], 0
cmp dword [0x6fb424], 1
mov dword [ebp - 0x14], 0
jne 0x41626d
push 0x6fd630
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push 0x6fd428
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x416262
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp - 0x18]
cmp dword [ecx - 4], 1
mov edi, dword [ecx - 0xc]
jle 0x416249
push edi
lea ecx, [ebp - 0x18]
call fcn.00409070
mov ecx, dword [ebp - 0x18]
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [edi + edi]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x6fd630
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x416291
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005a4646
mov esp, ebp
pop ebp
ret