joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e370
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x1004
call fcn.004ac5b0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1000], eax
mov edx, 0x4b3e70
mov ecx, str.FILE
call fcn.00478640
push eax
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x4e5e28
push 0x400
lea eax, [esp + 0x808]
push eax
push 0
push str.Folder
push str.SFOPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x800]
push eax
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp]
push eax
push 0
push 0xc
push 0x278b
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.0048ea75
add esp, 0x1004
ret

Function at 0x40f390
Capabilities:
Read .ini file

Disassembly:
sub esp, 0xad4
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xad0], eax
push ebx
push ebp
mov ebp, edx
mov ebx, ecx
mov edx, 0x4b3f08
mov ecx, str.FILE
call fcn.00478640
push eax
lea eax, [esp + 0xd4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0xd0]
mov edx, 0x4b3f1c
push 0x24
push eax
mov ecx, str.FILE
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x40f40c
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xad0]
xor ecx, esp
call fcn.0048ea75
add esp, 0xad4
ret
push esi
push edi
push 0x4e5e28
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
push 0xc4
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0x30
push 0
push eax
call fcn.0048fb10
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x2ec]
add esp, 0xc
xor esi, esi
push 0x4e5e28
push 0x400
push eax
push esi
lea eax, [esp + 0x20]
push eax
push ebp
call edi
test eax, eax
je 0x40f4ac
nop
push 0x4e5e28
lea eax, [esp + 0x2e4]
inc esi
push eax
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0xa
push 0xa
lea eax, [esp + 0x18]
push eax
push esi
call fcn.0049099e
add esp, 0x10
lea eax, [esp + 0x2e0]
push 0x4e5e28
push 0x400
push eax
push 0
lea eax, [esp + 0x20]
push eax
push ebp
call edi
test eax, eax
jne 0x40f460
mov ecx, dword [esp + 0xae0]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048ea75
add esp, 0xad4
ret
Function at 0x40f4d0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0xad4
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xad0], eax
cmp byte [esp + 0xad8], 0
push ebx
push edi
mov ebx, edx
mov edi, ecx
je 0x40f556
mov edx, 0x4b3f08
mov ecx, str.FILE
call fcn.00478640
push eax
lea eax, [esp + 0xd4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0xd0]
mov edx, 0x4b3f1c
push 0x24
push eax
mov ecx, str.FILE
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x40f556
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xad0]
xor ecx, esp
call fcn.0048ea75
add esp, 0xad4
ret
push ebp
push esi
push 0x4e5e28
push 0
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
push 0xc4
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0x30
push 0
push eax
call fcn.0048fb10
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x2ec]
add esp, 0xc
xor esi, esi
push 0x4e5e28
push 0x400
push eax
push esi
lea eax, [esp + 0x20]
push eax
push ebx
call ebp
test eax, eax
je 0x40f5fc
nop dword [eax]
push 0x4e5e28
lea eax, [esp + 0x2e4]
inc esi
push eax
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0xa
push 0xa
lea eax, [esp + 0x18]
push eax
push esi
call fcn.0049099e
add esp, 0x10
lea eax, [esp + 0x2e0]
push 0x4e5e28
push 0x400
push eax
push 0
lea eax, [esp + 0x20]
push eax
push ebx
call ebp
test eax, eax
jne 0x40f5b0
mov ecx, dword [esp + 0xae0]
mov eax, 1
pop esi
pop ebp
pop edi
pop ebx
xor ecx, esp
call fcn.0048ea75
add esp, 0xad4
ret
Function at 0x410c40
Capabilities:
Copy file
Hide graphical window

Disassembly:
mov eax, 0x1044
call fcn.004ac5b0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1040], eax
mov eax, dword [esp + 0x104c]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], eax
mov edi, edx
xor eax, eax
mov ebx, ecx
push 0x7fe
push eax
mov word [esp + 0x858], ax
lea eax, [esp + 0x85a]
push eax
call fcn.0048fb10
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x64], ax
lea eax, [esp + 0x66]
push eax
call fcn.0048fb10
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 0x18
push 0
push 0
push 0x1004
push ebx
call esi
mov ebp, eax
test ebp, ebp
je 0x410df9
nop
lea eax, [esp + 0x850]
mov dword [esp + 0x1c], 2
mov dword [esp + 0x28], eax
dec ebp
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0x400
push eax
push 0
push 0x1073
push ebx
call esi
lea eax, [esp + 0x50]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push eax
push 0
push 0x1073
push ebx
mov dword [esp + 0x3c], 0x400
call esi
push str.Directory
lea eax, [esp + 0x854]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
mov dword [esp + 0x2c], 0
xorps xmm0, xmm0
mov word [esp + 0x30], 0
lea eax, [esp + 0x50]
movq qword [esp + 0x24], xmm0
push eax
movups xmmword [esp + 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
cmp word [esp + eax*2 + 0x4e], 0x5c
jne 0x410d60
mov word [esp + eax*2 + 0x4e], cx
jmp 0x410d65
mov word [esp + eax*2 + 0x52], cx
mov eax, dword [0x4e6030]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1060]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], eax
mov ax, word [esp + 0x1058]
mov word [esp + 0x24], ax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push 0
push 0
push 0x1008
push ebx
call esi
cmp dword [0x4e5c1c], 2
jne 0x410ddc
push 0
push 0
push 0x130b
push 0x2763
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call esi
cmp eax, 5
je 0x410ddc
push 5
jmp 0x410dde
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x405
push edi
call esi
test ebp, ebp
jne 0x410cc0
mov ecx, dword [esp + 0x1050]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048ea75
add esp, 0x1044
ret
Function at 0x411ab0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x7c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x276f
push dword [0x4e6030]
call edi
push 0
push 0x27a7
push dword [0x4e6030]
mov ebp, eax
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1004
push ebp
call esi
test eax, eax
je 0x411c1a
push 1
push 0x276c
push dword [0x4e6030]
call edi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebx
push 1
push 0x276b
push dword [0x4e6030]
call edi
push eax
call ebx
push 1
push 0x276d
push dword [0x4e6030]
call edi
push eax
call ebx
push 0xa
push 0xa
lea eax, [esp + 0x54]
push eax
push 0
push 0
push 0x1004
push ebp
call esi
push eax
call fcn.0049099e
add esp, 0x10
lea eax, [esp + 0x4c]
push eax
push ecx
push dword [0x4d5834]
push dword [0x4d5830]
call fcn.00465af0
add esp, 0xc
mov edx, 0x4b3f94
mov ecx, str.FILE
push eax
call fcn.00478640
push eax
push 0x400
push 0x4d6040
call fcn.0040a420
add esp, 0x14
cmp dword [0x4e5c1c], 2
jne 0x411bd9
push 0
push 0
push 0x130b
push 0x2763
push dword [0x4e6030]
call edi
push eax
call esi
cmp eax, 5
je 0x411bd9
push 0x4d6040
push 1
push 0x40b
push dword [0x4e5c10]
call esi
lea eax, [esp + 0x10]
mov dword [esp + 0x20], 0xb
push eax
push 0
push 0x102b
push ebp
mov dword [esp + 0x2c], 2
call esi
mov edx, 0x4b3f6c
mov ecx, str.FILE
call fcn.00478640
push eax
push 0
push 0x40b
push dword [0x4e5c10]
jmp 0x411d12
mov edx, 0x4b3f6c
mov ecx, str.FILE
call fcn.00478640
push eax
push 0
push 0x40b
push dword [0x4e5c10]
call esi
mov edx, 0x4b3f3c
mov ecx, str.FILE
call fcn.00478640
push eax
push 0x4d6040
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
cmp dword [0x4e5c1c], 2
jne 0x411c8f
push 0
push 0
push 0x130b
push 0x2763
push dword [0x4e6030]
call edi
push eax
call esi
cmp eax, 5
je 0x411c8f
push 0x4d6040
push 1
push 0x40b
push dword [0x4e5c10]
call esi
push 0
push 0x276c
push dword [0x4e6030]
call edi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebx
push 0
push 0x276b
push dword [0x4e6030]
call edi
push eax
call ebx
push 0
push 0x276d
push dword [0x4e6030]
call edi
push eax
call ebx
push 0
push ebp
call ebx
mov eax, dword [0x4e6034]
cdq
sub eax, edx
sar eax, 1
add eax, 0x1a4
movzx eax, ax
push eax
push 0
push 0x101e
push ebp
call esi
mov eax, dword [0x4e6034]
cdq
sub eax, edx
sar eax, 1
add eax, 0x35
movzx eax, ax
push eax
push 1
push 0x101e
push ebp
call esi
push 0x39
push 2
push 0x101e
push ebp
call esi
push 1
push 0x276a
push dword [0x4e6030]
mov dword [0x4cc1c8], 2
call edi
push eax
call ebx
push 1
push 0x2769
push dword [0x4e6030]
call edi
push eax
call ebx
mov ecx, dword [esp + 0x88]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048ea75
add esp, 0x7c
ret
Function at 0x41bcb0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1248
call fcn.004ac5b0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1244], eax
push esi
push 0x7fc
lea eax, [esp + 0x250]
mov dword [esp + 0x24c], 0
push 0
push eax
call fcn.0048fb10
add esp, 0xc
mov dword [esp + 0xc], 0
lea eax, [esp + 0x248]
mov dword [esp + 0x1c], 0x400
mov dword [esp + 0x18], eax
lea eax, [esp + 4]
push eax
push 2
push 0xffffffffffffffff
push 0x100c
push 0x27e2
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push eax
push 0x1073
push 0x27e2
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call esi
cmp word [esp + 0x248], 0
jne 0x41bda7
mov edx, 0x4b32cc
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x40]
mov edx, 0x4b48a4
push 0x30
push eax
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
pop esi
mov ecx, dword [esp + 0x1244]
xor ecx, esp
call fcn.0048ea75
add esp, 0x1248
ret
push 0x4e6040
lea eax, [esp + 0xa4c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0xa48]
push str.undo_
push eax
call esi
lea eax, [esp + 0x248]
push eax
lea eax, [esp + 0xa4c]
push eax
call esi
mov eax, dword [0x4e6030]
xorps xmm0, xmm0
mov dword [esp + 0xc], eax
lea eax, [esp + 0xa48]
mov dword [esp + 0x14], eax
lea eax, [esp + 4]
movlpd qword [esp + 0x28], xmm0
movlpd qword [esp + 0x30], xmm0
movlpd qword [esp + 0x38], xmm0
movaps xmm0, xmmword [0x4c7840]
push eax
mov dword [esp + 8], 0x3c
mov dword [esp + 0xc], 0x4c
mov dword [esp + 0x14], str.explore
movups xmmword [esp + 0x1c], xmm0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [esp + 0x1248]
pop esi
xor ecx, esp
call fcn.0048ea75
add esp, 0x1248
ret
Function at 0x426050
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1040
call fcn.004ac5b0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x103c], eax
push ebx
push esi
push edi
xor eax, eax
mov edi, edx
push 0x7fe
push eax
mov word [esp + 0x50], ax
mov ebx, ecx
lea eax, [esp + 0x52]
push eax
call fcn.0048fb10
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push ebx
call esi
lea ecx, [esp + 0x48]
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0xc]
push ecx
push eax
push 0x1073
push ebx
mov dword [esp + 0x34], 0x400
call esi
lea edx, [esp + 0x48]
mov ecx, edx
call fcn.0045e940
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x850], ax
lea eax, [esp + 0x852]
push eax
call fcn.0048fb10
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x54]
add esp, 0xc
push eax
lea eax, [esp + 0x84c]
push eax
call esi
push 0
lea eax, [esp + 0x4c]
push eax
push 0x400
push 0
lea eax, [esp + 0x858]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x42612e
lea eax, [esp + 0x848]
push eax
lea eax, [esp + 0x4c]
push eax
call esi
mov eax, dword [0x4e6030]
xorps xmm0, xmm0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0xc]
movlpd qword [esp + 0x30], xmm0
movlpd qword [esp + 0x38], xmm0
movlpd qword [esp + 0x40], xmm0
movaps xmm0, xmmword [0x4c7840]
push eax
mov dword [esp + 0x10], 0x3c
mov dword [esp + 0x14], 0x4c
mov dword [esp + 0x1c], str.properties
movups xmmword [esp + 0x24], xmm0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [esp + 0x1048]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0048ea75
add esp, 0x1040
ret
Function at 0x43a680
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xa48
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xa44], eax
push 0x7fc
lea eax, [esp + 0x24c]
mov dword [esp + 0x248], 0
push 0
push eax
call fcn.0048fb10
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x290a
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0x244]
mov dword [esp + 8], 2
mov dword [esp + 0x14], ecx
lea ecx, [esp]
push ecx
push eax
push 0x1073
push 0x290a
push dword [0x4e6030]
mov dword [esp + 0x2c], 0x400
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp word [esp + 0x244], 0
jne 0x43a774
mov edx, 0x4b32e4
mov ecx, str.TWEAK
call fcn.00478640
push eax
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x3c]
mov edx, 0x4b730c
push 0x30
push eax
mov ecx, str.TWEAK
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, dword [esp + 0xa44]
xor ecx, esp
call fcn.0048ea75
add esp, 0xa48
ret
mov eax, dword [0x4e6030]
xorps xmm0, xmm0
mov dword [esp + 8], eax
lea eax, [esp + 0x244]
mov dword [esp + 0x10], eax
lea eax, [esp]
movlpd qword [esp + 0x24], xmm0
movlpd qword [esp + 0x2c], xmm0
movlpd qword [esp + 0x34], xmm0
movaps xmm0, xmmword [0x4c7840]
push eax
mov dword [esp + 4], 0x3c
mov dword [esp + 8], 0x4c
mov dword [esp + 0x10], 0
movups xmmword [esp + 0x18], xmm0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [esp + 0xa44]
mov eax, 1
xor ecx, esp
call fcn.0048ea75
add esp, 0xa48
ret
Function at 0x44ce90
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x450
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x44c], eax
push 0x204
lea eax, [esp + 0x44]
mov dword [esp + 0x40], 0
push 0
push eax
call fcn.0048fb10
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x296e
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0x3c]
mov dword [esp + 8], 2
mov dword [esp + 0x14], ecx
lea ecx, [esp]
push ecx
push eax
push 0x1073
push 0x296e
push dword [0x4e6030]
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp word [esp + 0x3c], 0
jne 0x44cf7c
mov edx, 0x4b3f00
mov ecx, str.PRVCY
call fcn.00478640
push eax
lea eax, [esp + 0x248]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x244]
mov edx, 0x4b3f44
push 0x30
push eax
mov ecx, str.PRVCY
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0x44c]
xor ecx, esp
call fcn.0048ea75
add esp, 0x450
ret
mov eax, dword [0x4e6030]
xorps xmm0, xmm0
mov dword [esp + 8], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x10], eax
lea eax, [esp]
movlpd qword [esp + 0x24], xmm0
movlpd qword [esp + 0x2c], xmm0
movlpd qword [esp + 0x34], xmm0
movaps xmm0, xmmword [0x4c7840]
push eax
mov dword [esp + 4], 0x3c
mov dword [esp + 8], 0x4c
mov dword [esp + 0x10], 0
movups xmmword [esp + 0x18], xmm0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [esp + 0x44c]
xor ecx, esp
call fcn.0048ea75
add esp, 0x450
ret
Function at 0x45fbb0
Capabilities:
Create thread
Delete file
Download url
Read .ini file
Receive data

Disassembly:
sub esp, 0x620
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x61c], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
push 0x29cd
push dword [0x4e6030]
call esi
mov ecx, eax
call fcn.00460130
push 0x29ae
push dword [0x4e6030]
call esi
mov ecx, eax
call fcn.00460130
push 0
push 0x29ae
push dword [0x4e6030]
mov dword [0x4e28d4], 0
call esi
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call edi
xor eax, eax
push 0x206
push eax
mov word [esp + 0x18], ax
lea eax, [esp + 0x1a]
push eax
call fcn.0048fb10
add esp, 0xc
lea eax, [esp + 0x10]
push 0
push 0x10
push 0x104
push eax
push str.http:__www.wintools.net_wintools.ini
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToCacheFileW]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x10]
push 0x4e6040
push eax
call ebx
push str.Updates.ini
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x10
lea eax, [esp + 0x18]
push eax
push str.http:__www.wintools.net_wintools.ini
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
jne 0x45fd24
lea eax, [esp + 0x10]
push eax
push 0
push str.AppVersion
push str.WINTOOLS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 0x5e1b
jle 0x45fcfa
push 0
push 0x45fd90
push dword [0x4e6030]
push str.IDD_UPDATEBOX
push dword [0x4e5c0c]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
cmp dword [0x4e28d4], 0
jne 0x45fd64
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x45fb30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x45fd64
mov edx, 0x4b57e0
mov ecx, str.MAINPAGE
call fcn.00478640
push eax
lea eax, [esp + 0x21c]
push eax
call ebx
push 0x40
lea eax, [esp + 0x21c]
mov edx, 0x4b57d8
jmp 0x45fd4c
mov edx, 0x4b57f0
mov ecx, str.MAINPAGE
call fcn.00478640
push eax
lea eax, [esp + 0x424]
push eax
call ebx
push 0x10
lea eax, [esp + 0x424]
mov edx, 0x4b57e8
push eax
mov ecx, str.MAINPAGE
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
push 0x29ae
push dword [0x4e6030]
call esi
push eax
call edi
mov ecx, dword [esp + 0x628]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0048ea75
add esp, 0x620
ret
Function at 0x468520
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, ecx
push ebx
push 0x2738
push dword [0x4e6030]
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push ebx
push 0x2739
push dword [0x4e6030]
call edi
push eax
call esi
push ebx
push 0x273a
push dword [0x4e6030]
call edi
push eax
call esi
push ebx
push 0x273b
push dword [0x4e6030]
call edi
push eax
call esi
push ebx
push 0x273c
push dword [0x4e6030]
call edi
push eax
call esi
pop edi
pop esi
mov ecx, ebx
pop ebx
jmp fcn.00467f90

Function at 0x468690
Capabilities:
Create thread

Disassembly:
sub esp, 0x21c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetDlgItem]
push esi
push edi
push 0
push 0
push 0x130b
push 0x271c
push dword [0x4e6030]
call ebp
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call ebx
cmp eax, 3
ja case.default.0x4686d6
jmp dword [eax*4 + 0x4688c8]
mov edx, 0x4b4540
mov ecx, 0x4b32d0
call fcn.00478640
push eax
push 0
push 0x40b
push dword [0x4e5c10]
call ebx
push 0x4b34dc
push 1
push 0x40b
push dword [0x4e5c10]
call ebx
jmp case.default.0x4686d6
mov edx, 0x4b4548
mov ecx, 0x4b32d0
call fcn.00478640
push eax
push 0
push 0x40b
push dword [0x4e5c10]
call ebx
xor eax, eax
push 0x206
push eax
mov word [esp + 0x20], ax
lea eax, [esp + 0x22]
push eax
call fcn.0048fb10
add esp, 0xc
push 0
push 0
push 0x1004
push 0x2744
push dword [0x4e6030]
call ebp
push eax
call ebx
push 0
push 0
push 0x1004
push 0x2743
push dword [0x4e6030]
mov esi, eax
call ebp
push eax
call ebx
push 0
push 0
push 0x1004
push 0x2742
push dword [0x4e6030]
add esi, eax
call ebp
push eax
call ebx
push 0
push 0
push 0x1004
push 0x2741
push dword [0x4e6030]
add esi, eax
call ebp
push eax
call ebx
add eax, esi
push eax
push 0
push 0
push 0x1004
push 0x2740
push dword [0x4e6030]
call ebp
push eax
call ebx
push eax
push 0
push 0
push 0x1004
push 0x2745
push dword [0x4e6030]
call ebp
push eax
call ebx
push eax
mov edx, 0x4b37a0
mov ecx, 0x4b32d0
call fcn.00478640
push eax
lea eax, [esp + 0x28]
push 0x104
push eax
call fcn.0040a420
add esp, 0x18
lea eax, [esp + 0x18]
push eax
push 1
push 0x40b
push dword [0x4e5c10]
call ebx
jmp case.default.0x4686d6
mov edx, 0x4b4550
jmp 0x4686e2
mov edx, 0x4b6e1c
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
push 0
push 0x40b
push dword [0x4e5c10]
call ebx
cmp dword [0x4d7bc8], 0
jne 0x468863
call fcn.0041a930
jmp 0x468882
mov edx, 0x4b4ae4
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
push 1
push 0x40b
push dword [0x4e5c10]
call ebx
cmp dword [0x4e4e90], 0
jne case.default.0x4686d6
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x41cb80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4e4e90], 1
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048ea75
add esp, 0x21c
ret