joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407f94
Capabilities:
Enumerate files on windows
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb54
push dword [ebp + 8]
lea eax, [ebp - 0x354]
push dword [ebp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
mov eax, dword [ebp + 0x24]
test eax, eax
je 0x407fba
and dword [eax], 0
push ebx
push esi
push edi
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x354]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x40816b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 0x1c]
lea eax, [ebp - 0x354]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea eax, [ebp - 0x354]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
xor edi, edi
cmp ebx, edi
mov dword [ebp - 4], ebx
je 0x40814a
push str.SetWinampHWND
push ebx
call esi
cmp eax, edi
je 0x40802b
push dword [0x4924ec]
call eax
pop ecx
cmp dword [ebp + 0x2c], edi
je 0x40807b
push str.GetAudioTypes3
push ebx
call esi
mov edi, eax
test edi, edi
je 0x408141
lea eax, [ebp - 0x754]
push eax
push 0
call edi
pop ecx
xor ebx, ebx
pop ecx
inc ebx
jmp 0x408072
push eax
lea eax, [ebp - 0x754]
push eax
mov eax, dword [ebp + 0x2c]
push dword [eax + 4]
call dword [eax]
lea eax, [ebp - 0x754]
push eax
push ebx
call edi
add esp, 0x14
inc ebx
test eax, eax
jne 0x408054
jmp 0x408141
push str.ExtAudio3
push ebx
call esi
cmp eax, edi
je 0x408094
push edi
push edi
push dword [0x4924ec]
call eax
add esp, 0xc
push str.CreateAudio3
push ebx
call esi
cmp dword [ebp + 0x20], 0
mov edi, eax
jne 0x4080d5
push str.ConfigAudio3
push ebx
call esi
test eax, eax
je 0x408141
mov ecx, dword [ebp + 0x30]
test ecx, ecx
jne 0x4080c0
mov ecx, 0x487000
push ecx
push dword [ebp + 0x18]
push ebx
push dword [ebp + 0x28]
call eax
add esp, 0x10
test eax, eax
jne 0x408174
cmp dword [ebp + 0x20], 1
jne 0x408107
test edi, edi
je 0x408141
mov eax, dword [ebp + 0x30]
test eax, eax
jne 0x4080eb
mov eax, 0x487000
push eax
lea eax, [ebp + 0x18]
push eax
push 0x204d4350
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call edi
add esp, 0x18
test eax, eax
jne 0x408174
cmp dword [ebp + 0x20], 2
jne 0x408141
push str.GetAudioTypes3
push ebx
call esi
mov edi, eax
test edi, edi
je 0x408141
lea eax, [ebp - 0xb54]
push eax
push 0
call edi
xor ebx, ebx
inc ebx
jmp 0x40813b
cmp eax, dword [ebp + 0x18]
je 0x408172
lea eax, [ebp - 0xb54]
push eax
push ebx
call edi
inc ebx
test eax, eax
pop ecx
pop ecx
jne 0x40812b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x407fe3
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x24]
mov dword [edx], ecx
jmp 0x40816d
Function at 0x40817e
Capabilities:
Get common file path
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp byte [0x488b58], bl
push edi
mov edi, 0x488b58
jne 0x40820b
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4081f7
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
push str.CommonFilesDir
push dword [ebp - 4]
mov dword [ebp - 8], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4081dc
cmp dword [ebp - 0xc], 1
je 0x4081e2
mov byte [0x488b58], bl
push 0x473e88
push edi
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [0x488b58], bl
jne 0x40820b
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 0x485760
push dword [esi]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.enc_.dll
call fcn.00407f94
add esp, 0x2c
cmp eax, ebx
jne 0x408284
push 0x487000
push ebx
push str.scannsv
push dword [0x496664]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x408282
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push edi
push dword [esi]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.nsv_coder_.dll
call fcn.00407f94
add esp, 0x2c
cmp eax, ebx
jne 0x408284
xor eax, eax
pop edi
pop ebx
leave
ret
Function at 0x408942
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
push ebx
push esi
push edi
mov esi, 0x800
push esi
push 0
mov ebx, 0x488358
push ebx
call sub.NSCRT.dll_memset
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 4]
xor eax, eax
add esp, 0xc
cmp ecx, eax
je 0x408992
mov edx, dword [edi]
cmp edx, eax
je 0x408992
push edx
push ecx
call dword [sym.imp.NSCRT.dll__stricmp]
test eax, eax
pop ecx
pop ecx
jne 0x408990
push esi
push ebx
push 0x140
jmp 0x408b2a
xor eax, eax
cmp dword [0x48b144], 1
jge 0x4089ce
mov ecx, dword [edi + 8]
cmp ecx, 0x6c33504d
jne 0x4089b2
push esi
push ebx
push 0x141
jmp 0x408b2a
cmp ecx, 0x48434141
je 0x4089c2
cmp ecx, 0x4841344d
jne 0x4089ce
push esi
push ebx
push 0x142
jmp 0x408b2a
push dword [edi]
fldz
or dword [ebp - 8], 0xffffffff
fstp dword [ebp - 0x10]
lea ecx, [ebp - 0x844]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
call fcn.004084cb
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [0x492580]
push eax
call fcn.0045bc4c
mov dword [ebp + 8], eax
mov eax, dword [ebp - 8]
test eax, eax
jne 0x408a10
or eax, 0xffffffff
cmp dword [ebp + 8], 0
mov dword [edi + 0x34], eax
jne 0x408a51
mov eax, dword [ebp - 4]
dec eax
dec eax
push esi
push ebx
je 0x408a47
dec eax
je 0x408a3d
dec eax
dec eax
je 0x408a33
push 0x146
jmp 0x408b2a
push 0x145
jmp 0x408b2a
push 0x144
jmp 0x408b2a
push 0x143
jmp 0x408b2a
push 0x100
lea eax, [edi + 0x40]
push 0
push eax
call sub.NSCRT.dll_memset
lea eax, [edi + 8]
add esp, 0xc
cmp dword [eax], 0x204d4350
je 0x408ac8
xor ecx, ecx
cmp dword [edi + 0x20], 0x20494e49
jne 0x408a7d
mov ecx, dword [edi + 0x24]
push ecx
push 0
push 0
lea ecx, [ebp - 0x20]
push ecx
push 1
push dword [ebp - 0x14]
mov esi, eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.0040817e
add esp, 0x20
test eax, eax
jne 0x408aba
push dword [ebp + 8]
mov ecx, dword [0x492580]
call fcn.0045baf9
push 0x800
push ebx
push 0x147
jmp 0x408b2a
mov dword [edi + 0x54], eax
mov eax, dword [ebp - 0x20]
mov dword [edi + 0x58], eax
mov esi, 0x800
mov ecx, dword [ebp + 8]
xor eax, eax
push eax
push 0x80
push 2
mov dword [edi + 0x40], ecx
mov ecx, dword [ebp - 0x1c]
push eax
mov dword [edi + 0x5c], ecx
mov ecx, dword [ebp - 0x18]
push 1
push 0x40000000
push dword [edi + 4]
mov dword [edi + 0x60], ecx
mov ecx, dword [ebp - 0x14]
mov dword [edi + 0x3c], eax
mov dword [edi + 0x64], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x408b39
push dword [ebp + 8]
mov ecx, dword [0x492580]
call fcn.0045baf9
mov ecx, dword [edi + 0x54]
test ecx, ecx
je 0x408b1f
mov eax, dword [ecx]
push 1
call dword [eax + 4]
and dword [edi + 0x54], 0
push esi
push ebx
push 0x148
call fcn.0045edbd
add esp, 0xc
mov dword [edi + 0x2c], eax
xor eax, eax
jmp 0x408b57
mov dword [edi + 0x50], eax
lea eax, [ebp - 0x24]
push eax
xor eax, eax
push eax
push edi
push 0x408541
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x4c], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408b5c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push 0x1000
xor ebx, ebx
push ebx
mov esi, 0x487358
push esi
call sub.NSCRT.dll_memset
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
add esp, 0xc
cmp eax, ebx
je 0x408ba9
mov ecx, dword [edi]
cmp ecx, ebx
je 0x408ba9
push ecx
push eax
call dword [sym.imp.NSCRT.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x408ba9
push 0x800
push esi
push 0x140
jmp 0x408d3f
cmp dword [0x48b144], 1
jge 0x408bea
mov eax, dword [edi + 8]
cmp eax, 0x6c33504d
jne 0x408bcc
push 0x800
push esi
push 0x141
jmp 0x408d3f
cmp eax, 0x48434141
je 0x408bda
cmp eax, 0x4841344d
jne 0x408bea
push 0x800
push esi
push 0x142
jmp 0x408d3f
mov ecx, dword [0x492580]
fldz
or dword [ebp - 0x10], 0xffffffff
fstp dword [ebp - 0x18]
lea eax, [ebp - 0x24]
push eax
push dword [edi]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
call fcn.0045bc4c
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x10]
cmp eax, ebx
jne 0x408c20
or eax, 0xffffffff
cmp dword [ebp + 8], ebx
mov dword [edi + 0x34], eax
jne 0x408c64
mov eax, dword [ebp - 0xc]
dec eax
dec eax
push 0x800
push esi
je 0x408c5a
dec eax
je 0x408c50
dec eax
dec eax
je 0x408c46
push 0x146
jmp 0x408d3f
push 0x145
jmp 0x408d3f
push 0x144
jmp 0x408d3f
push 0x143
jmp 0x408d3f
push 0x100
lea eax, [edi + 0x40]
push ebx
push eax
call sub.NSCRT.dll_memset
lea eax, [edi + 8]
add esp, 0xc
cmp dword [eax], 0x204d4350
je 0x408cdc
xor ecx, ecx
cmp dword [edi + 0x20], 0x20494e49
jne 0x408c8f
mov ecx, dword [edi + 0x24]
push ecx
push ebx
push ebx
lea ecx, [ebp - 4]
push ecx
push 1
push dword [ebp - 0x1c]
mov esi, eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.0040817e
add esp, 0x20
cmp eax, ebx
jne 0x408cce
push dword [ebp + 8]
mov ecx, dword [0x492580]
call fcn.0045baf9
push 0x800
push 0x487358
push 0x147
jmp 0x408d3f
mov dword [edi + 0x54], eax
mov eax, dword [ebp - 4]
mov dword [edi + 0x58], eax
mov esi, 0x487358
mov eax, dword [ebp + 8]
push ebx
push 0x80
push 2
mov dword [edi + 0x40], eax
mov eax, dword [ebp - 0x24]
push ebx
mov dword [edi + 0x5c], eax
mov eax, dword [ebp - 0x20]
push 1
push 0x40000000
push dword [edi + 4]
mov dword [edi + 0x60], eax
mov eax, dword [ebp - 0x1c]
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x64], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x408d4e
push dword [ebp + 8]
mov ecx, dword [0x492580]
call fcn.0045baf9
mov ecx, dword [edi + 0x54]
cmp ecx, ebx
je 0x408d31
mov eax, dword [ecx]
push 1
call dword [eax + 4]
push 0x800
push esi
mov dword [edi + 0x54], ebx
push 0x148
call fcn.0045ede1
add esp, 0xc
mov dword [edi + 0x2c], eax
xor eax, eax
jmp 0x408d6a
mov dword [edi + 0x50], eax
lea eax, [ebp - 8]
push eax
push ebx
push edi
push 0x408719
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x4c], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a6ad
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40a718
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push edi
mov edi, 0x400
jmp 0x40a6ee
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 4]
call fcn.0040a6ad
test eax, eax
pop ecx
pop ecx
jne 0x40a701
push edi
lea eax, [ebp - 0x804]
push eax
push 0
push dword [ebp - 4]
call esi
test eax, eax
je 0x40a6d9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
pop esi
leave
ret
Function at 0x40f33a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push edi
push 0x1f
pop ecx
xor eax, eax
mov byte [ebp - 0x80], 0
lea edi, [ebp - 0x7f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x487000
push 0x7f
stosb byte es:[edi], al
lea eax, [ebp - 0x7f]
push eax
push 0x472c3d
push 0x473df4
push str.winamp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x7f], 0
push 0x48a510
sete al
dec al
and eax, 0x2e
mov byte [ebp - 0x80], al
lea eax, [ebp - 0x80]
push eax
push 0x4838c0
push str.wa_s_s_s
push 0x100
push dword [ebp + 8]
call fcn.00402528
add esp, 0x18
pop edi
leave
ret
Function at 0x40fe61
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x580
push ebx
lea eax, [ebp - 0x580]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor ebx, ebx
cmp dword [0x48a72c], ebx
jne 0x41001c
push esi
push edi
push 0x7ff00
push ebx
mov dword [0x48a72c], 1
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x4c
pop edi
mov esi, eax
push edi
lea eax, [ebp - 0x54]
push ebx
push eax
mov word [esi], bx
call sub.NSCRT.dll_memset
mov dword [ebp - 0x54], edi
mov edi, dword [ebp + 0xc]
add esp, 0xc
mov dword [ebp - 0x50], edi
call fcn.00428a16
cmp dword [ebp + 8], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x170]
push 0x80
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], 0x3ff7f
push eax
je 0x40feef
push 0xfa
jmp 0x40fef4
push 0xfb
call fcn.0045ede1
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x18], 0x472c5c
mov dword [ebp - 0x28], eax
jne 0x40ff1e
mov ecx, dword [0x49257c]
call fcn.004560af
mov dword [ebp - 0x28], eax
cmp edi, dword [0x4924ec]
mov dword [ebp - 0x20], 0x81a04
jne 0x40ff32
call fcn.0040f82f
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.comdlg32.dll_GetOpenFileNameW]
test eax, eax
je 0x40ffcc
lea eax, [ebp - 0x378]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, dword [0x49257c]
lea eax, [ebp - 0x378]
push eax
call fcn.0045645e
cmp dword [ebp + 8], ebx
je 0x40ff77
mov dword [ebp - 4], ebx
call fcn.00432daa
jmp 0x40ff7f
call fcn.00431c56
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [esi + eax*2 + 2], bx
je 0x40ffaa
push esi
call fcn.004336b9
test byte [0x4867c8], 1
pop ecx
je 0x40ffc2
push dword [ebp - 4]
push 2
call fcn.00434a2b
pop ecx
jmp 0x40ffc1
push ebx
push 1
push esi
call fcn.00434671
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40ffc2
push esi
call fcn.0043335c
pop ecx
cmp dword [ebp + 8], ebx
je 0x40ffcc
call fcn.00419219
lea eax, [ebp - 0x580]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp edi, dword [0x4924ec]
jne 0x40ffe6
call fcn.0040f78a
push 1
push 0x20a
push 0x200
push dword [0x4924ec]
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x40ffe6
push dword [ebp - 8]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
call edi
push esi
call edi
pop edi
mov dword [0x48a72c], ebx
pop esi
pop ebx
leave
ret
Function at 0x410407
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push esi
mov esi, dword [ebp + 8]
mov byte [eax], cl
cmp byte [esi], cl
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], ecx
lea edi, [ebp - 0x110]
je 0x4105ee
push ebx
mov ebx, dword [sym.imp.USER32.dll_CharNextA]
jmp 0x41043b
xor ecx, ecx
mov al, byte [esi]
cmp al, 0x25
jne 0x4104c8
cmp dword [ebp - 4], ecx
je 0x41049b
push 0x104
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x110]
push eax
mov byte [edi], 0
mov byte [ebp - 0x214], 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp dword [ebp + 0x10], 0x7fffffff
ja 0x410488
lea eax, [ebp - 0x214]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00405663
push esi
lea edi, [ebp - 0x110]
call ebx
mov byte [esi], 0
mov dword [ebp + 8], eax
mov esi, eax
jmp 0x4104b8
push esi
call ebx
push dword [ebp + 8]
mov dword [ebp - 8], eax
push dword [ebp + 0x10]
mov byte [esi], 0
push dword [ebp + 0xc]
call fcn.00406c2d
mov esi, dword [ebp - 8]
mov dword [ebp + 8], esi
xor eax, eax
cmp dword [ebp - 4], eax
sete al
mov dword [ebp - 4], eax
jmp 0x4105e4
cmp al, 0x7b
jne 0x41052b
cmp dword [ebp - 4], ecx
push esi
je 0x410503
call ebx
sub eax, esi
je 0x4105e4
mov ecx, edi
lea edx, [ebp - 0x110]
sub ecx, edx
dec eax
cmp ecx, 0x104
jge 0x4105e4
mov dl, byte [esi]
mov byte [edi], dl
inc edi
inc ecx
inc esi
test eax, eax
jne 0x4104e6
jmp 0x4105e4
call ebx
push dword [ebp + 8]
mov dword [ebp - 8], eax
push dword [ebp + 0x10]
mov byte [esi], 0
push dword [ebp + 0xc]
call fcn.00406c2d
mov esi, dword [ebp - 8]
mov dword [ebp + 8], esi
mov dword [ebp - 0xc], 1
jmp 0x4105e4
cmp al, 0x7d
jne 0x4105ae
cmp dword [ebp - 4], ecx
je 0x41055b
push esi
call ebx
sub eax, esi
je 0x410559
mov ecx, edi
lea edx, [ebp - 0x110]
sub ecx, edx
dec eax
cmp ecx, 0x104
jge 0x410559
mov dl, byte [esi]
mov byte [edi], dl
inc edi
inc ecx
inc esi
test eax, eax
jne 0x410545
xor ecx, ecx
push ecx
lea eax, [ebp - 0x110]
push eax
mov byte [edi], 0
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
cmp dword [ebp + 0x10], 0x7fffffff
ja 0x410597
lea eax, [ebp - 0x214]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00405663
push esi
lea edi, [ebp - 0x110]
call ebx
and dword [ebp - 0xc], 0
mov byte [esi], 0
mov dword [ebp + 8], eax
mov esi, eax
jmp 0x4105e4
cmp dword [ebp - 4], ecx
jne 0x4105bf
cmp dword [ebp - 0xc], ecx
jne 0x4105bf
push esi
call ebx
mov esi, eax
jmp 0x4105e4
push esi
call ebx
sub eax, esi
je 0x4105e4
mov ecx, edi
lea edx, [ebp - 0x110]
sub ecx, edx
dec eax
cmp ecx, 0x104
jge 0x4105e4
mov dl, byte [esi]
mov byte [edi], dl
inc edi
inc ecx
inc esi
test eax, eax
jne 0x4105d0
cmp byte [esi], 0
jne 0x410439
pop ebx
push dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00406c2d
pop edi
pop esi
leave
ret
Function at 0x410635
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x508
push ebx
push esi
push edi
push str.paths.ini
push 0x4844d0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x108]
push eax
mov esi, 0x400
push esi
lea eax, [ebp - 0x508]
push eax
push 0x472c3d
push str.inidir
mov ebx, 0x472b24
push ebx
call edi
cmp byte [ebp - 0x508], 0
je 0x4106a9
lea eax, [ebp - 0x508]
push esi
push eax
call fcn.00410600
lea eax, [ebp - 0x508]
push eax
call fcn.00406762
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push esi
lea eax, [ebp - 0x508]
push eax
push 0x472c3d
push str.m3udir
push ebx
call edi
cmp byte [ebp - 0x508], 0
je 0x4106fe
lea eax, [ebp - 0x508]
push esi
push eax
call fcn.00410600
lea eax, [ebp - 0x508]
push 0
push eax
call fcn.00402cf8
push eax
mov dword [ebp - 4], eax
call fcn.0040678d
push dword [ebp - 4]
call dword [sym.imp.NSCRT.dll_free]
add esp, 0x18
lea eax, [ebp - 0x108]
push eax
push esi
lea eax, [ebp - 0x508]
push eax
push 0x472c3d
push str.m3ubase
push ebx
call edi
cmp byte [ebp - 0x508], 0
je 0x410753
lea eax, [ebp - 0x508]
push esi
push eax
call fcn.00410600
lea eax, [ebp - 0x508]
push 0
push eax
call fcn.00402cf8
push eax
mov dword [ebp - 4], eax
call fcn.004067b9
push dword [ebp - 4]
call dword [sym.imp.NSCRT.dll_free]
add esp, 0x18
lea eax, [ebp - 0x108]
push eax
push esi
lea eax, [ebp - 0x508]
push eax
push 0x472c3d
push str.inifile
push ebx
call edi
cmp byte [ebp - 0x508], 0
je 0x410794
lea eax, [ebp - 0x508]
push esi
push eax
call fcn.00410600
lea eax, [ebp - 0x508]
push eax
call fcn.00405469
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push esi
lea eax, [ebp - 0x508]
push eax
push 0x472c3d
push str.class
push ebx
call edi
cmp byte [ebp - 0x508], 0
je 0x4107f1
lea eax, [ebp - 0x508]
push esi
push eax
call fcn.00410600
lea eax, [ebp - 0x508]
push 0
push eax
call fcn.00402cf8
add esp, 0x10
push eax
push 0x40
push 0x4965c0
mov dword [ebp - 4], eax
call fcn.00467521
push dword [ebp - 4]
call dword [sym.imp.NSCRT.dll_free]
pop ecx
lea eax, [ebp - 0x108]
push eax
push esi
lea eax, [ebp - 0x508]
push eax
push 0x472c3d
push 0x4734c0
push ebx
call edi
cmp byte [ebp - 0x508], 0
je 0x41084e
lea eax, [ebp - 0x508]
push esi
push eax
call fcn.00410600
pop ecx
pop ecx
push 0x103
push 0x487108
push 0xffffffffffffffff
lea eax, [ebp - 0x508]
push eax
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x41084e
mov word [eax*2 + 0x487108], si
pop edi
pop esi
pop ebx
leave
ret

Function at 0x410e07
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
push 0x410de8
push 0x20000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret
Function at 0x411582
Capabilities:
Hide graphical window

Disassembly:
mov al, byte [0x4861ad]
cmp al, 1
je 0x41159f
cmp al, 2
je 0x41159f
cmp dword [0x48b0d8], 0
je 0x4115aa
call fcn.00414db8
jmp 0x4115aa
push 0x496740
call fcn.00414d30
pop ecx
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [0x4924ec]
call esi
mov al, byte [0x4861ad]
cmp al, 1
je 0x4115dd
cmp al, 3
je 0x4115dd
push 0xffffffffffffffec
push dword [0x4924ec]
call dword [sym.imp.USER32.dll_GetWindowLongA]
and eax, 0xffffff7f
jmp 0x4115f0
push 0xffffffffffffffec
push dword [0x4924ec]
call dword [sym.imp.USER32.dll_GetWindowLongA]
or eax, 0x80
push eax
push 0xffffffffffffffec
push dword [0x4924ec]
call dword [sym.imp.USER32.dll_SetWindowLongA]
cmp dword [0x48af70], 0
je 0x41161b
cmp dword [0x492544], 0
jne 0x41161b
push 8
push dword [0x4924ec]
call esi
mov dword [0x48af70], 1
pop esi
ret

Function at 0x412e64
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x960
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineA]
push edi
push 0x475bfc
push dword [ebp + 8]
lea eax, [ebp - 0x960]
push eax
call esi
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x960]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x412efb
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x550]
push eax
call esi
test byte [ebp - 0x140], 0x10
je 0x412ed5
cmp byte [ebp - 0x114], 0x2e
je 0x412ee2
lea eax, [ebp - 0x550]
push eax
call fcn.00412e64
pop ecx
jmp 0x412ee2
lea eax, [ebp - 0x550]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x140]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x412ea1
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
pop esi
leave
ret
Function at 0x412f08
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x664
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x474100
push dword [ebp + 8]
lea eax, [ebp - 0x664]
push eax
call edi
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x664]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x412ff3
push ebx
mov ebx, dword [sym.imp.NSCRT.dll_wcscmp]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [ebp - 0x228]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x45c]
push eax
call edi
test byte [ebp - 0x254], 0x10
je 0x412faa
lea eax, [ebp - 0x228]
push 0x4740fc
push eax
call ebx
test eax, eax
pop ecx
pop ecx
je 0x412fd0
lea eax, [ebp - 0x228]
push 0x4740f4
push eax
call ebx
test eax, eax
pop ecx
pop ecx
je 0x412fd0
lea eax, [ebp - 0x45c]
push eax
call fcn.00412f08
pop ecx
jmp 0x412fd0
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x412fd0
push 4
push eax
lea eax, [ebp - 0x45c]
push eax
call esi
push 4
push 0
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x412f57
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
pop ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
leave
ret