joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433d60
Capabilities:
Copy file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x878
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push 0x104
lea ecx, [ebp - 0x460]
push ecx
call fcn.0041cf60
push 0x530c50
push 0x104
lea edx, [ebp - 0x460]
push edx
call fcn.0043a910
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x460]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x464], eax
cmp dword [ebp - 0x464], 0xffffffff
jne 0x433dc6
jmp 0x433f2a
mov edx, dword [ebp + 0xc]
push edx
call fcn.00430310
add esp, 4
mov eax, dword [ebp + 0xc]
push eax
push 0x104
lea ecx, [ebp - 0x878]
push ecx
call fcn.0041cf60
lea edx, [ebp - 0x878]
push edx
call fcn.004f7670
add esp, 4
movzx eax, word [ebp + eax*2 - 0x878]
cmp eax, 0x5c
je 0x433e19
push 0x530c5c
push 0x104
lea ecx, [ebp - 0x878]
push ecx
call fcn.0043a910
lea edx, [ebp - 0x22c]
push edx
push 0x104
lea eax, [ebp - 0x878]
push eax
call fcn.0043a910
mov ecx, dword [ebp + 8]
push ecx
push 0x104
lea edx, [ebp - 0x670]
push edx
call fcn.0041cf60
lea eax, [ebp - 0x670]
push eax
call fcn.004f7670
add esp, 4
movzx ecx, word [ebp + eax*2 - 0x670]
cmp ecx, 0x5c
je 0x433e78
push 0x530c60
push 0x104
lea edx, [ebp - 0x670]
push edx
call fcn.0043a910
lea eax, [ebp - 0x22c]
push eax
push 0x104
lea ecx, [ebp - 0x670]
push ecx
call fcn.0043a910
mov edx, dword [ebp - 0x258]
and edx, 0x10
je 0x433eeb
cmp dword [ebp + 0x10], 0
je 0x433ee9
push 0x530c64
lea eax, [ebp - 0x22c]
push eax
call fcn.004f9f0c
add esp, 8
test eax, eax
je 0x433ee9
push 0x530c68
lea ecx, [ebp - 0x22c]
push ecx
call fcn.004f9f0c
add esp, 8
test eax, eax
je 0x433ee9
push 1
lea edx, [ebp - 0x878]
push edx
lea eax, [ebp - 0x670]
push eax
call fcn.00433d60
add esp, 0xc
jmp 0x433f01
push 0
lea ecx, [ebp - 0x878]
push ecx
lea edx, [ebp - 0x670]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0x258]
push eax
mov ecx, dword [ebp - 0x464]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x433dd2
mov edx, dword [ebp - 0x464]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret
Function at 0x4341c0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4341f5
xor eax, eax
jmp 0x434284
mov dword [ebp - 0x438], 0x428
lea ecx, [ebp - 0x438]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
jne 0x434221
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x434284
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x418]
push edx
call fcn.004f845d
add esp, 8
test eax, eax
jne 0x434263
lea eax, [ebp - 0x218]
push eax
call fcn.004f7670
add esp, 4
add eax, 1
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x218]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.0041cf60
jmp 0x434277
lea ecx, [ebp - 0x438]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x434221
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret

Function at 0x4346d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x555230]
and eax, 1
jne 0x434713
mov ecx, dword [0x555230]
or ecx, 1
mov dword [0x555230], ecx
mov ecx, 0x55522c
call fcn.0041d080
push 0x52b600
call fcn.004f8227
add esp, 4
mov ecx, 0x55522c
call fcn.0041d2e0
test eax, eax
jne 0x43480f
xor edx, edx
mov word [ebp - 0x88], dx
push 0x7e
push 0
lea eax, [ebp - 0x86]
push eax
call fcn.004f7580
add esp, 0xc
push str.updatecfg.ini
push 0
lea ecx, [ebp - 0x8c]
push ecx
call fcn.00416040
add esp, 8
push eax
lea edx, [ebp - 0x90]
push edx
call fcn.0041bc20
add esp, 0xc
mov ecx, eax
call fcn.0041d2b0
push eax
push 0x40
lea eax, [ebp - 0x88]
push eax
push 0
push 0x530dc8
push 0x530dd0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x90]
call fcn.0041d100
lea ecx, [ebp - 0x8c]
call fcn.0041d100
movzx ecx, word [ebp - 0x88]
test ecx, ecx
jne 0x4347fe
push 0x55522c
push str.SDVersion.dll
push 0
lea edx, [ebp - 0x94]
push edx
call fcn.00416040
add esp, 8
push eax
lea eax, [ebp - 0x98]
push eax
call fcn.0041bc20
add esp, 0xc
mov ecx, eax
call fcn.0041d2b0
push eax
call fcn.0041b5b0
add esp, 8
lea ecx, [ebp - 0x98]
call fcn.0041d100
lea ecx, [ebp - 0x94]
call fcn.0041d100
jmp 0x43480f
lea ecx, [ebp - 0x88]
push ecx
mov ecx, 0x55522c
call fcn.0041d140
push 0x55522c
mov ecx, dword [ebp + 8]
call fcn.0041d0a0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret
Function at 0x4364c0
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x648
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x418], ax
push 0x206
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.004f7580
add esp, 0xc
xor edx, edx
mov word [ebp - 0x628], dx
push 0x206
push 0
lea eax, [ebp - 0x626]
push eax
call fcn.004f7580
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x210], cx
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.004f7580
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0x630], eax
push 0x104
lea ecx, [ebp - 0x628]
push ecx
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov dword [ebp - 0x62c], eax
push 0x104
lea eax, [ebp - 0x210]
push eax
push str._userprofile_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x630], 0
je 0x43660a
mov ecx, dword [ebp - 0x630]
sub ecx, 1
push ecx
mov ecx, dword [ebp + 8]
call fcn.0041d2b0
push eax
lea edx, [ebp - 0x418]
push edx
call fcn.004f780c
add esp, 0xc
test eax, eax
jne 0x43660a
mov ecx, dword [ebp + 8]
call fcn.0041d2e0
sub eax, dword [ebp - 0x630]
push eax
lea eax, [ebp - 0x634]
push eax
mov ecx, dword [ebp + 8]
call fcn.00439280
push eax
push 0x532280
lea ecx, [ebp - 0x638]
push ecx
call fcn.0041d250
add esp, 0xc
push eax
mov ecx, dword [ebp + 8]
call fcn.0041d120
lea ecx, [ebp - 0x638]
call fcn.0041d100
lea ecx, [ebp - 0x634]
call fcn.0041d100
jmp 0x43670e
cmp dword [ebp - 0x62c], 0
je 0x43668d
mov edx, dword [ebp - 0x62c]
push edx
mov ecx, dword [ebp + 8]
call fcn.0041d2b0
push eax
lea eax, [ebp - 0x628]
push eax
call fcn.004f780c
add esp, 0xc
test eax, eax
jne 0x43668d
mov ecx, dword [ebp + 8]
call fcn.0041d2e0
sub eax, dword [ebp - 0x62c]
push eax
lea ecx, [ebp - 0x63c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00439280
push eax
push str._temp__
lea edx, [ebp - 0x640]
push edx
call fcn.0041d250
add esp, 0xc
push eax
mov ecx, dword [ebp + 8]
call fcn.0041d120
lea ecx, [ebp - 0x640]
call fcn.0041d100
lea ecx, [ebp - 0x63c]
call fcn.0041d100
jmp 0x43670e
cmp dword [ebp - 0x41c], 0
je 0x43670e
mov eax, dword [ebp - 0x41c]
sub eax, 1
push eax
mov ecx, dword [ebp + 8]
call fcn.0041d2b0
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.004f780c
add esp, 0xc
test eax, eax
jne 0x43670e
mov ecx, dword [ebp + 8]
call fcn.0041d2e0
sub eax, dword [ebp - 0x41c]
push eax
lea edx, [ebp - 0x644]
push edx
mov ecx, dword [ebp + 8]
call fcn.00439280
push eax
push str._userprofile__
lea eax, [ebp - 0x648]
push eax
call fcn.0041d250
add esp, 0xc
push eax
mov ecx, dword [ebp + 8]
call fcn.0041d120
lea ecx, [ebp - 0x648]
call fcn.0041d100
lea ecx, [ebp - 0x644]
call fcn.0041d100
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret
Function at 0x436a20
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c0
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x436a51
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x436a5a
xor eax, eax
xor edx, edx
jmp 0x436c62
xor edx, edx
mov word [ebp - 0x450], dx
push 0x21a
push 0
lea eax, [ebp - 0x44e]
push eax
call fcn.004f7580
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x230], cx
push 0x21a
push 0
lea edx, [ebp - 0x22e]
push edx
call fcn.004f7580
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
push 0x21c
lea ecx, [ebp - 0x450]
push ecx
call fcn.0042d420
lea edx, [ebp - 0x450]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x450]
push eax
push str._s.
push 0x21c
lea ecx, [ebp - 0x230]
push ecx
call fcn.0043a970
add esp, 0x10
mov dword [ebp - 0x6a8], 0
push 0x24c
push 0
lea edx, [ebp - 0x6a4]
push edx
call fcn.004f7580
add esp, 0xc
lea eax, [ebp - 0x6a8]
push eax
lea ecx, [ebp - 0x230]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x454], eax
xor edx, edx
cmp dword [ebp - 0x454], 0xffffffff
setne dl
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
je 0x436c46
mov dword [ebp - 0x6ac], 0
movzx eax, word [ebp - 0x67c]
cmp eax, 0x2e
jne 0x436b6f
movzx ecx, word [ebp - 0x67a]
test ecx, ecx
je 0x436b65
movzx edx, word [ebp - 0x67a]
cmp edx, 0x2e
jne 0x436b6f
movzx eax, word [ebp - 0x678]
test eax, eax
jne 0x436b6f
mov dword [ebp - 0x6ac], 1
cmp dword [ebp - 0x6ac], 0
jne 0x436c2a
mov ecx, dword [ebp - 0x6a8]
and ecx, 0x10
je 0x436bec
xor edx, edx
mov word [ebp - 0x8b8], dx
push 0x206
push 0
lea eax, [ebp - 0x8b6]
push eax
call fcn.004f7580
add esp, 0xc
lea ecx, [ebp - 0x67c]
push ecx
lea edx, [ebp - 0x450]
push edx
push 0x5322d4
push 0x208
lea eax, [ebp - 0x8b8]
push eax
call fcn.0043a970
add esp, 0x14
lea ecx, [ebp - 0x8b8]
push ecx
call fcn.00436a20
add esp, 4
add eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
adc ecx, edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
jmp 0x436c2a
xor edx, edx
mov dword [ebp - 0x8c0], edx
mov dword [ebp - 0x8bc], edx
mov eax, dword [ebp - 0x688]
mov dword [ebp - 0x8c0], eax
mov ecx, dword [ebp - 0x68c]
mov dword [ebp - 0x8bc], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x8c0]
mov eax, dword [ebp - 4]
adc eax, dword [ebp - 0x8bc]
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x6a8]
push ecx
mov edx, dword [ebp - 0x454]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [ebp - 0xc], eax
jmp 0x436b23
cmp dword [ebp - 0x454], 0xffffffff
je 0x436c5c
mov eax, dword [ebp - 0x454]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret
Function at 0x4377e0
Capabilities:
Check if file exists
Copy file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.004f7580
add esp, 0xc
lea ecx, [ebp - 8]
call fcn.0041d080
push 0x53258c
push 0
lea edx, [ebp - 0x21c]
push edx
call fcn.00416040
add esp, 8
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.0041bc20
add esp, 0xc
push eax
lea ecx, [ebp - 8]
call fcn.0041d120
lea ecx, [ebp - 0x220]
call fcn.0041d100
lea ecx, [ebp - 0x21c]
call fcn.0041d100
push str.repair.exe
lea ecx, [ebp - 0x224]
push ecx
call fcn.00438340
add esp, 4
push eax
lea edx, [ebp - 4]
push edx
call fcn.0041bc20
add esp, 0xc
lea ecx, [ebp - 0x224]
call fcn.0041d100
push 0
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
lea ecx, [ebp - 8]
call fcn.0041d2b0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [ebp - 8]
call fcn.0041d2b0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43797e
cmp dword [ebp + 8], 0
je 0x4378cd
mov eax, dword [ebp + 8]
mov dword [ebp - 0x238], eax
jmp 0x4378d7
mov dword [ebp - 0x238], 0x532638
lea ecx, [ebp - 0x228]
push ecx
call fcn.00418f20
add esp, 4
mov ecx, eax
call fcn.0041d2b0
push eax
push 0x104
lea edx, [ebp - 0x218]
push edx
push str._URL:http:__pinst.qihucdn.com_360safebeta_safebeta_home.cab
mov eax, dword [ebp - 0x238]
push eax
push str.Installer
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x228]
call fcn.0041d100
push 1
push 0
push 0x64
push 0
lea ecx, [ebp - 0x230]
push ecx
call fcn.00416040
add esp, 8
mov ecx, eax
call fcn.0041d2b0
push eax
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
push 0
call fcn.0042f500
add esp, 0x1c
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x230]
call fcn.0041d100
lea ecx, [ebp - 4]
call fcn.0041d100
lea ecx, [ebp - 8]
call fcn.0041d100
mov eax, dword [ebp - 0x22c]
jmp 0x43799e
mov dword [ebp - 0x234], 0
lea ecx, [ebp - 4]
call fcn.0041d100
lea ecx, [ebp - 8]
call fcn.0041d100
mov eax, dword [ebp - 0x234]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret
Function at 0x438290
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.004f7580
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.firstaidSuperKiller.exe
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x438313
lea edx, [ebp - 0x210]
push edx
mov ecx, dword [ebp + 8]
call fcn.0041d0c0
mov eax, dword [ebp + 8]
jmp 0x438327
push str._firstaidSuperKiller.exe
mov eax, dword [ebp + 8]
push eax
call fcn.00415de0
add esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret

Function at 0x4383a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x15
call fcn.004383e0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4383c5
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x4383d2
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x438440
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x130], 0
jb 0x4384e0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x130]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4384e0
push 8
call fcn.00438520
mov ecx, eax
call fcn.004384f0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4384ce
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
call dword [ebp - 0xc]
mov byte [ebp - 0xd], al
movzx ecx, byte [ebp - 0xd]
test ecx, ecx
je 0x4384ce
cmp dword [ebp - 0x14], 0x10001049
jb 0x4384ce
push 7
call fcn.00438520
mov ecx, eax
call fcn.004384f0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4384ce
push 1
call dword [ebp - 0x18]
push 1
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4387c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x4388c9
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 2]
cmp ecx, 0x5c
je 0x4387f5
mov edx, dword [ebp + 8]
movzx eax, word [edx + 4]
cmp eax, 0x5c
jne 0x438809
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x4388cb
xor edx, edx
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.004f7580
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.system32
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x4388c1
push 0x532808
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x532808
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
jmp 0x4388cb
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret

Function at 0x4389a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x555114], 0
jne 0x4389c2
mov dword [0x555110], 0x11c
push 0x555110
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [0x555120], 2
jne 0x4389dd
cmp dword [0x555114], 6
jb 0x4389dd
mov dword [ebp - 4], 1
jmp 0x4389e4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x438a70
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 8
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xb7
je 0x438aae
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 5
jne 0x438acf
mov edx, dword [ebp - 4]
cmp dword [edx], 0
je 0x438acb
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx], 0
xor al, al
jmp 0x438ad1
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x440ec0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 0x44], ecx
lea eax, [ebp - 0x18]
push eax
call fcn.00419480
add esp, 4
mov ecx, eax
call fcn.0041d2b0
push eax
push 0
push 0x532cb4
push 0x532cc0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x18]
call fcn.0041d100
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x44]
add ecx, 0x100
call fcn.004437a0
jmp 0x440f2a
push 0
lea edx, [ebp - 0x20]
push edx
lea ecx, [ebp - 0x14]
call fcn.00443d30
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x44]
add ecx, 0x100
call fcn.004437d0
push eax
lea ecx, [ebp - 0x14]
call fcn.00443dd0
movzx ecx, al
test ecx, ecx
je 0x4410a3
mov edx, dword [ebp - 0xc]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00443cf0
sub esp, 0xc0
mov ecx, esp
push eax
call fcn.00443230
mov ecx, dword [ebp - 0x44]
call fcn.00442660
test eax, eax
je 0x440ff9
cmp dword [ebp - 4], 0
je 0x440fba
lea ecx, [ebp - 0x14]
call fcn.00443d10
cmp dword [eax + 0x68], 0
jne 0x440fba
push 1
push 1
lea ecx, [ebp - 0x14]
call fcn.00443cf0
sub esp, 0xc0
mov ecx, esp
push eax
call fcn.00443230
mov ecx, dword [ebp - 0x44]
add ecx, 0xa0
call fcn.004a9850
cmp dword [ebp - 8], 0
je 0x440ff9
lea ecx, [ebp - 0x14]
call fcn.00443d10
cmp dword [eax + 0x98], 0
jne 0x440ff9
push 1
push 0
lea ecx, [ebp - 0x14]
call fcn.00443cf0
sub esp, 0xc0
mov ecx, esp
push eax
call fcn.00443230
mov ecx, dword [ebp - 0x44]
add ecx, 0xa0
call fcn.004a9850
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x14]
call fcn.00443cf0
sub esp, 0xc0
mov ecx, esp
push eax
call fcn.00443230
mov ecx, dword [ebp - 0x44]
call fcn.00442790
test eax, eax
je 0x44109e
cmp dword [ebp - 4], 0
je 0x44105f
lea ecx, [ebp - 0x14]
call fcn.00443d10
cmp dword [eax + 0x68], 0
jne 0x44105f
push 0
push 1
lea ecx, [ebp - 0x14]
call fcn.00443cf0
sub esp, 0xc0
mov ecx, esp
push eax
call fcn.00443230
mov ecx, dword [ebp - 0x44]
add ecx, 0xa0
call fcn.004a9850
cmp dword [ebp - 8], 0
je 0x44109e
lea ecx, [ebp - 0x14]
call fcn.00443d10
cmp dword [eax + 0x98], 0
jne 0x44109e
push 0
push 0
lea ecx, [ebp - 0x14]
call fcn.00443cf0
sub esp, 0xc0
mov ecx, esp
push eax
call fcn.00443230
mov ecx, dword [ebp - 0x44]
add ecx, 0xa0
call fcn.004a9850
jmp 0x440f1c
push 1
mov ecx, dword [ebp - 0x44]
add ecx, 0xa0
call fcn.004a9c80
mov esp, ebp
pop ebp
ret
Function at 0x4410c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x53c
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x53c], ecx
mov dword [ebp - 0x510], 0
push 1
push 0
push 0
lea ecx, [ebp - 0x508]
call fcn.00416730
lea eax, [ebp - 0x51c]
push eax
call fcn.00419480
add esp, 4
mov ecx, eax
call fcn.0041d2b0
push eax
push 0
push 0x532cd4
push 0x532ce0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x51c]
call fcn.0041d100
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x510], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0x50c], 0
lea edx, [ebp - 0x518]
push edx
mov ecx, dword [ebp - 0x53c]
add ecx, 0x100
call fcn.004437a0
jmp 0x441173
push 0
lea eax, [ebp - 0x524]
push eax
lea ecx, [ebp - 0x518]
call fcn.00443d30
lea ecx, [ebp - 0x52c]
push ecx
mov ecx, dword [ebp - 0x53c]
add ecx, 0x100
call fcn.004437d0
push eax
lea ecx, [ebp - 0x518]
call fcn.00443dd0
movzx edx, al
test edx, edx
je 0x441248
mov eax, dword [ebp - 0x510]
push eax
lea ecx, [ebp - 0x50c]
push ecx
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0x518]
call fcn.00443cf0
sub esp, 0xc0
mov ecx, esp
push eax
call fcn.00443230
mov ecx, dword [ebp - 0x53c]
call fcn.00442820
test eax, eax
je 0x441243
cmp dword [ebp - 8], 0
je 0x44120e
push 1
lea ecx, [ebp - 0x518]
call fcn.00443cf0
sub esp, 0xc0
mov ecx, esp
push eax
call fcn.00443230
mov ecx, dword [ebp - 0x53c]
add ecx, 0xd0
call fcn.004ab6a0
cmp dword [ebp - 0x50c], 0
je 0x441243
push 0
lea ecx, [ebp - 0x518]
call fcn.00443cf0
sub esp, 0xc0
mov ecx, esp
push eax
call fcn.00443230
mov ecx, dword [ebp - 0x53c]
add ecx, 0xd0
call fcn.004ab6a0
jmp 0x44115f
lea ecx, [ebp - 0x508]
call fcn.004170c0
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret