joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c766a
Capabilities:
Persist via run registry key

Disassembly:
push 0xc
mov eax, 0x51341e
call fcn.00506098
mov esi, ecx
mov bx, word [ebp + 0xc]
xor edi, edi
inc edi
cmp bx, di
jne 0x4c77df
push ecx
push edi
call fcn.004c698b
push 0
push 0
push 0x147
push dword [esi + 0x2444]
call dword [sym.imp.USER32.dll_SendMessageA]
xor ecx, ecx
cmp dword [esi + 0x2440], ecx
sete cl
add eax, ecx
mov ecx, dword [esi + 0x2648]
mov dword [esi + 0x243c], eax
cmp ecx, edi
jne 0x4c76c6
cmp eax, 2
jne 0x4c76f0
cmp ecx, 2
jne 0x4c77df
cmp dword [esi + 0x2a4c], eax
jne 0x4c76f0
lea eax, [esi + 0x30]
push eax
lea eax, [esi + 0x264c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4c77df
push edi
push ecx
lea eax, [esi + 0x30]
mov dword [ebp + 0xc], esp
mov ecx, esp
push eax
call fcn.004094e6
and dword [ebp - 4], 0
push ecx
mov ecx, esp
push str.SoftwareMicrosoftWindowsCurrentVersionRun
call fcn.004094e6
mov edx, dword [esi + 0x243c]
lea ecx, [ebp - 0x10]
neg edx
sbb edx, edx
or edi, 0xffffffff
add edx, reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], edi
call fcn.0041472c
add esp, 0xc
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x4c77c7
lea eax, [esi + 0x430]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040d992
test eax, eax
je 0x4c77c4
lea eax, [esi + 0x30]
push eax
lea eax, [ebp - 0x14]
push str.Entry__s_already_exists._r_nReplace_
push eax
call fcn.00423158
add esp, 0xc
push 0x31
push str.New_Entry
push dword [eax]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [ebp - 0x14]
cmp eax, 1
mov eax, edi
setne byte [ebp + 0xf]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4c77a1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp + 0xf], 0
je 0x4c77c4
mov dword [ebp - 4], edi
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x4c77f3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4c77f3
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], edi
lea edx, [eax - 0x10]
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x4c77df
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
and dword [esi + 0x2444], 0
movzx eax, bx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
xor eax, eax
call fcn.00506061
ret 0x10
Function at 0x4c7a47
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0xaba010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
push dword [esi + 0x30]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowTextA]
push dword [esi + 0x34]
push 0x48c
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
cmp dword [esi + 0x38], 0
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
je 0x4c7b00
mov ecx, dword [0xd58f54]
push 2
mov ecx, dword [ecx + 0x58]
call fcn.004560cf
push dword [esi + 0x38]
mov ecx, eax
lea eax, [ecx - 0x58]
neg ecx
sbb ecx, ecx
and ecx, eax
call fcn.0044b191
test eax, eax
je 0x4c7ac4
mov ecx, dword [eax + 0xc]
sub ecx, 0x10
call fcn.004098e7
add eax, 0x10
mov dword [ebp - 8], eax
jmp 0x4c7ad4
push 0x51e784
lea ecx, [ebp - 8]
call fcn.004094e6
mov eax, dword [ebp - 8]
push eax
push 0x48f
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov edx, dword [ebp - 8]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4c7b0f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4c7b0f
push 0x48d
push dword [esi + 4]
call ebx
push 0
push eax
call edi
mov eax, dword [esi + 0x3c]
cmp dword [eax - 0xc], 0
je 0x4c7b30
push eax
push 0x490
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov dword [esi + 0x40], 1
jmp 0x4c7b3f
push 0x48e
push dword [esi + 4]
call ebx
push 0
push eax
call edi
cmp dword [esi + 0x44], 0
jne 0x4c7b56
push 0x49a
push dword [esi + 4]
call ebx
push 0
push eax
call edi
jmp 0x4c7b6c
cmp dword [esi + 0x48], 0
je 0x4c7b6c
push 1
push 0x49a
push dword [esi + 4]
call dword [sym.imp.USER32.dll_CheckDlgButton]
mov edi, 0x100
mov eax, edi
call fcn.004f0800
cmp dword [esi + 0x44], 0
mov ecx, esp
mov edx, edi
je 0x4c7b86
push 0x5d
jmp 0x4c7b8b
push 0x20e
push dword [0xd584c8]
call fcn.004e1a81
pop ecx
pop ecx
push 1
push dword [esi + 4]
mov edi, eax
call ebx
push edi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, esi
call fcn.004c7c2c
mov eax, dword [ebp + 0x14]
and dword [eax], 0
xor eax, eax
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004efcea
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4c9146
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0xaba010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0xa4], eax
push edi
push dword [esi + 0x30]
push 0x4ee
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov ecx, dword [esi + 4]
mov edx, 0x4f0
push 0x12c
push 0
push 0x4ef
call fcn.0046e349
mov ecx, dword [esi + 4]
mov edx, 0x452
push 0x3b
push 0
push 0x4c8
call fcn.0046e349
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0x18
push 0x4a1
push dword [esi + 4]
call ebx
mov dword [esi + 0x34], eax
mov edi, 0x14f
mov eax, 0x100
call fcn.004f0800
mov ecx, esp
mov edx, 0x100
push edi
push dword [0xd584c8]
call fcn.004e1a81
pop ecx
pop ecx
push eax
push 0
push 0x143
push dword [esi + 0x34]
call dword [sym.imp.USER32.dll_SendMessageA]
dec edi
cmp edi, 0x14a
jge 0x4c91c2
push 0
push 5
pop eax
sub eax, dword [esi + 0x48]
push eax
push 0x14e
push dword [esi + 0x34]
call dword [sym.imp.USER32.dll_SendMessageA]
push ecx
push 0
mov ecx, esi
call fcn.004c7080
mov ecx, esi
call fcn.004c93a0
push 0x41f
push dword [esi + 4]
call ebx
mov ecx, dword [esi + 0x44]
neg ecx
sbb ecx, ecx
and ecx, 5
push ecx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, 0x100
mov eax, ebx
call fcn.004f0800
mov eax, ebx
mov dword [ebp - 0x9c], esp
call fcn.004f0800
mov edi, dword [0xd58f54]
mov ebx, dword [0xd584c8]
mov dword [ebp - 0xa0], esp
test edi, edi
je 0x4c9271
add edi, 0x5c
mov ecx, dword [ebp - 0x9c]
mov edx, 0x100
push 0x2c4
push ebx
call fcn.004e1a81
pop ecx
pop ecx
push eax
mov eax, dword [edi + 0x208]
push 0x3c
pop ecx
cdq
idiv ecx
mov ecx, dword [ebp - 0xa0]
push edx
push 0x2c3
push ebx
mov edx, 0x100
call fcn.004e1a81
pop ecx
pop ecx
push eax
mov eax, dword [edi + 0x208]
push 0x3c
pop edi
cdq
idiv edi
push eax
lea eax, [ebp - 0x9c]
push str._d__s_:__02d__s
push eax
call fcn.00423158
add esp, 0x18
push dword [eax]
push 0x4f4
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov edx, dword [ebp - 0x9c]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4c92ff
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [0xd5b274], 0
jne 0x4c9353
push 0x90
lea eax, [ebp - 0x94]
mov dword [0xd5b274], 1
push 0
push eax
mov dword [ebp - 0x98], 0x94
call fcn.004f1a90
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
imul eax, dword [ebp - 0x94], 0xa
add eax, dword [ebp - 0x90]
mov dword [0xd5b270], eax
jmp 0x4c9358
mov eax, dword [0xd5b270]
xor ebx, ebx
cmp eax, edi
push 0x4cd
push dword [esi + 4]
setge bl
call dword [sym.imp.USER32.dll_GetDlgItem]
neg ebx
sbb ebx, ebx
and ebx, 5
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0xa4]
and dword [eax], 0
xor eax, eax
lea esp, [ebp - 0xb0]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004efcea
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4c96e3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0xaba010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.004c96bf
mov esi, eax
test esi, esi
jne 0x4c97a9
push edi
mov esi, str.services.msc
lea edi, [ebp - 0x108]
push 0xf7
push eax
lea eax, [ebp - 0xfb]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.004f1a90
push 0x38
lea eax, [ebp - 0x140]
mov dword [ebp - 0x144], 0x3c
push 0
push eax
call fcn.004f1a90
add esp, 0x18
mov dword [ebp - 0x140], 0x40
lea eax, [ebp - 0x108]
mov dword [ebp - 0x138], str.open
mov dword [ebp - 0x134], eax
lea eax, [ebp - 0x144]
mov dword [ebp - 0x128], 1
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
push 0x4e20
push dword [ebp - 0x10c]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004c96bf
mov esi, eax
pop edi
test esi, esi
jne 0x4c97a9
xor eax, eax
jmp 0x4c97bc
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindowAsync]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004efcea
mov esp, ebp
pop ebp
ret
Function at 0x4cf97c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, ecx
push 0
mov eax, dword [edi + 0x14]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [edi + 0x10]
mov esi, dword [eax]
mov dword [ebp - 4], esi
cmp esi, eax
je 0x4cf9e9
lea eax, [esi + 0x10]
push eax
lea ecx, [ebp + 8]
call fcn.0041cf44
mov eax, dword [esi + 0x14]
push 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ecx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 4]
call fcn.0040fc9f
mov esi, dword [ebp - 4]
cmp esi, dword [edi + 0x10]
jne 0x4cf9ad
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4cfb49
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0xd58f54]
push ebx
push esi
push edi
xor edi, edi
cmp dword [eax + 0x1184], 1
mov dword [ebp - 4], edi
je 0x4cfb6c
xor eax, eax
jmp 0x4cfd18
mov eax, dword [ebp + 8]
mov esi, dword [eax]
jmp 0x4cfd0d
mov ecx, dword [0xd58f54]
push 2
mov ecx, dword [ecx + 0x58]
call fcn.004560cf
push dword [esi + 0x10]
mov ecx, eax
lea eax, [ecx - 0x58]
neg ecx
sbb ecx, ecx
and ecx, eax
call fcn.0044b191
test eax, eax
je 0x4cfd07
lea ebx, [eax + 0x44]
mov ecx, dword [ebx]
cmp dword [ecx - 0xc], 3
jl 0x4cfd07
push ecx
mov edi, esp
add ecx, 0xfffffff0
mov dword [ebp - 0xc], edi
call fcn.004098e7
add eax, 0x10
mov dword [edi], eax
call fcn.004cf8d2
test eax, eax
je 0x4cfd04
push ebx
mov ecx, 0xd5aec4
call fcn.0041aca5
test eax, eax
jne 0x4cfd04
mov edi, dword [0xd5aec0]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x4e20
jbe 0x4cfc72
mov edi, 0xd5aecc
push ebx
mov ecx, edi
call fcn.0041aca5
test eax, eax
je 0x4cfd04
push ebx
lea eax, [ebp - 8]
mov ecx, edi
push eax
call fcn.00410044
mov edi, dword [ebp - 8]
cmp edi, dword [0xd5aecc]
je 0x4cfc32
push dword [edi + 0x10]
mov ecx, ebx
call fcn.0040d992
test eax, eax
jns 0x4cfc5c
push ecx
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
push ecx
mov ecx, 0xd5aecc
call fcn.00412e24
push eax
add eax, 0x10
mov ecx, 0xd5aecc
push eax
push edi
lea eax, [ebp - 0x10]
push eax
call fcn.00412e80
mov edi, dword [ebp - 0x10]
mov edi, dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x2710
ja 0x4cfd04
push ecx
mov edi, esp
mov dword [ebp - 0xc], edi
mov ecx, dword [ebx]
sub ecx, 0x10
call fcn.004098e7
add eax, 0x10
mov dword [edi], eax
call fcn.004cf8d2
sub eax, 1
je 0x4cfcb9
sub eax, 1
jne 0x4cfd04
mov ecx, dword [0xd58f54]
push 1
mov ecx, dword [ecx + 0x58]
call fcn.004560cf
mov ecx, eax
push esi
lea eax, [ecx - 0x58]
neg ecx
sbb ecx, ecx
and ecx, eax
call fcn.00429223
jmp 0x4cfce9
mov ecx, dword [0xd58f54]
push 1
mov ecx, dword [ecx + 0x58]
call fcn.004560cf
push dword [esi + 8]
test eax, eax
mov edx, 0x4258
push 0
push dword [esi + 0x10]
lea ecx, [eax + 0x4200]
push dword [esi + 0xc]
cmove ecx, edx
call fcn.004dc207
push dword [ebp + 8]
xor edi, edi
lea eax, [ebp - 0x18]
push ebx
push ecx
inc edi
mov ecx, 0xd5aec4
push eax
mov dword [ebp - 4], edi
call fcn.0044fd66
jmp 0x4cfd07
mov edi, dword [ebp - 4]
mov eax, dword [ebp + 8]
add esi, 0x28
cmp esi, dword [eax + 4]
jne 0x4cfb76
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4d5ec0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x608
mov eax, dword [0xaba010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
lea eax, [ebp - 0x104]
push esi
push edi
mov edi, 0x100
mov esi, ecx
push edi
push 0
push eax
call fcn.004f1a90
push edi
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.004f1a90
add esp, 0x18
lea eax, [ebp - 0x104]
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowTextA]
push eax
push dword [esi + 0x34]
call edi
test eax, eax
je 0x4d5f73
push 0x100
lea eax, [ebp - 0x204]
push eax
push dword [esi + 4]
call edi
test eax, eax
je 0x4d5f73
push 0x400
lea eax, [ebp - 0x604]
push 0
push eax
call fcn.004f1a90
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x604]
push str._s____s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
lea eax, [ebp - 0x604]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [esi + 0x34]
xor edx, edx
inc edx
call fcn.004241b6
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x4d5f95
push eax
push 1
push 0x80
push dword [esi + 4]
call edi
mov ecx, dword [esi + 0x34]
xor edx, edx
call fcn.004241b6
test eax, eax
je 0x4d5fb0
push eax
push 0
push 0x80
push dword [esi + 4]
call edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call fcn.0042a64b
test eax, eax
je 0x4d5fd8
lea ecx, [esi + 0x20]
mov dword [ebp - 0x608], ecx
lea ecx, [ebp - 0x608]
push ecx
lea ecx, [eax + 4]
call fcn.004390ed
mov ecx, dword [ebp - 4]
xor eax, eax
and dword [ebx], 0
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004efcea
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4d6293
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
or dword [ebp - 4], 0xffffffff
push edi
push 0x80
push 4
mov edi, ecx
lea ecx, [ebp - 4]
push 0
push 0x40000000
push dword [edi + 4]
call fcn.0040b961
test eax, eax
je 0x4d63b3
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x5ccaae9
push eax
lea ecx, [ebp - 4]
call fcn.0040b34a
test eax, eax
je 0x4d63b3
mov eax, dword [edi + 0xc]
lea ecx, [ebp - 4]
push esi
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push 4
push eax
call fcn.0040b34a
mov ecx, dword [edi + 8]
mov eax, dword [ecx]
mov dword [ebp - 8], eax
cmp eax, ecx
je 0x4d6344
lea esi, [eax + 0x14]
push esi
lea ecx, [ebp - 4]
call fcn.004733a7
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 4]
call fcn.004733a7
lea eax, [esi + 8]
push eax
lea ecx, [ebp - 4]
call fcn.004733a7
lea eax, [esi + 0xc]
push eax
lea ecx, [ebp - 4]
call fcn.004733a7
push ecx
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
call fcn.0040fc9f
mov eax, dword [ebp - 8]
cmp eax, dword [edi + 8]
jne 0x4d62ff
mov eax, dword [edi + 0x14]
lea ecx, [ebp - 4]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push 4
push eax
call fcn.0040b34a
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx]
mov dword [ebp - 8], eax
cmp eax, ecx
je 0x4d63a9
lea esi, [eax + 0x14]
push esi
lea ecx, [ebp - 4]
call fcn.004733a7
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 4]
call fcn.004733a7
lea eax, [esi + 8]
push eax
lea ecx, [ebp - 4]
call fcn.004733a7
lea eax, [esi + 0xc]
push eax
lea ecx, [ebp - 4]
call fcn.004733a7
push ecx
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
call fcn.0040fc9f
mov eax, dword [ebp - 8]
cmp eax, dword [edi + 0x10]
jne 0x4d6364
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop esi
cmp dword [ebp - 4], 0xffffffff
pop edi
je 0x4d63c3
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x4d7ae3
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
or dword [ebp - 4], 0xffffffff
push edi
push 0x80
push 4
mov edi, ecx
lea ecx, [ebp - 4]
push 0
push 0x40000000
push dword [edi + 4]
call fcn.0040b961
test eax, eax
je 0x4d7bb2
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x94443ec
push eax
lea ecx, [ebp - 4]
call fcn.0040b34a
test eax, eax
je 0x4d7bb2
mov eax, dword [edi + 0xc]
lea ecx, [ebp - 4]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push 4
push eax
call fcn.0040b34a
mov ecx, dword [edi + 8]
mov eax, dword [ecx]
mov dword [ebp - 8], eax
cmp eax, ecx
je 0x4d7ba9
push esi
lea esi, [eax + 0x14]
push esi
lea ecx, [ebp - 4]
call fcn.004733a7
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 4]
call fcn.004733a7
lea eax, [esi + 8]
push eax
lea ecx, [ebp - 4]
call fcn.004733a7
lea eax, [esi + 0xc]
push eax
lea ecx, [ebp - 4]
call fcn.004733a7
mov eax, dword [esi + 0x10]
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push 4
push eax
call fcn.0040b34a
push ecx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
call fcn.0040fc9f
mov eax, dword [ebp - 8]
cmp eax, dword [edi + 8]
jne 0x4d7b4f
pop esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp dword [ebp - 4], 0xffffffff
pop edi
je 0x4d7bc2
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x4d8d8f
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
or dword [ebp - 4], 0xffffffff
push edi
push 0x80
push 4
mov edi, ecx
lea ecx, [ebp - 4]
push 0
push 0x40000000
push dword [edi + 0x14]
call fcn.0040b961
test eax, eax
je 0x4d8e0a
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x73bc86
push eax
lea ecx, [ebp - 4]
call fcn.0040b34a
test eax, eax
je 0x4d8e0a
mov eax, dword [edi + 4]
lea ecx, [ebp - 4]
sub eax, dword [edi]
sar eax, 2
push esi
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push 4
push eax
call fcn.0040b34a
mov esi, dword [edi]
jmp 0x4d8dfb
push esi
lea ecx, [ebp - 4]
call fcn.004733a7
add esi, 4
cmp esi, dword [edi + 4]
jne 0x4d8def
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop esi
cmp dword [ebp - 4], 0xffffffff
pop edi
je 0x4d8e1a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x4d99a6
Capabilities:
Read .ini file

Disassembly:
push 0x220
mov eax, 0x515e05
call fcn.005060cc
mov esi, ecx
mov dword [ebp - 0x220], esi
and dword [ebp - 4], 0
or edi, 0xffffffff
test esi, esi
je 0x4d9bec
push 0x1bd0
push 0
push esi
call fcn.004f1a90
xor ecx, ecx
xor ebx, ebx
add esp, 0xc
mov dword [ebp - 0x214], ecx
inc ebx
cmp ecx, 0xf
jge 0x4d9bec
push 0x100
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.004f1a90
push ebx
lea eax, [ebp - 0x224]
push str.cmd_d
push eax
call fcn.00423158
add esp, 0x18
lea ecx, [ebp - 0x110]
push dword [ebp + 8]
push 0xff
push ecx
push 0x51e784
push dword [eax]
push str.DirMenu
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edx, dword [ebp - 0x224]
neg eax
mov ecx, edi
sbb al, al
add edx, 0xfffffff0
inc al
mov dword [ebp - 0x21c], eax
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4d9a68
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x21c]
test al, al
jne 0x4d9bdc
push 0
mov edx, 0xa42a64
lea ecx, [ebp - 0x110]
call fcn.00422c56
pop ecx
test eax, eax
je 0x4d9bdc
lea eax, [ebp - 0x10d]
push eax
lea ecx, [ebp - 0x218]
call fcn.004094e6
mov byte [ebp - 4], 1
mov edx, 0xa42a50
mov ecx, dword [ebp - 0x218]
push 1
call fcn.00422c56
pop ecx
test eax, eax
je 0x4d9ada
mov byte [ebp - 4], 0
mov eax, edi
mov edx, dword [ebp - 0x218]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4d9bdc
jmp 0x4d9bd4
push 0x100
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004f1a90
push ebx
lea eax, [ebp - 0x228]
push str.menu_d
push eax
call fcn.00423158
add esp, 0x18
lea ecx, [ebp - 0x210]
push dword [ebp + 8]
push 0xff
push ecx
push 0x51e784
push dword [eax]
push str.DirMenu
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edx, dword [ebp - 0x228]
neg eax
mov ecx, edi
sbb al, al
add edx, 0xfffffff0
inc al
mov dword [ebp - 0x21c], eax
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4d9b52
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x21c]
test al, al
jne 0x4d9ab8
push ecx
lea eax, [ebp - 0x210]
mov dword [ebp - 0x21c], esp
mov ecx, esp
push eax
call fcn.004094e6
push ecx
mov byte [ebp - 4], 2
mov esi, esp
mov ecx, dword [ebp - 0x218]
mov dword [ebp - 0x22c], esi
lea ecx, [ecx - 0x10]
call fcn.004098e7
add eax, 0x10
mov dword [esi], eax
mov esi, dword [ebp - 0x220]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.004d9259
pop ecx
pop ecx
mov ecx, dword [ebp - 0x214]
add esi, 0x164
mov byte [ebp - 4], 0
inc ecx
mov edx, dword [ebp - 0x218]
mov eax, edi
mov dword [ebp - 0x214], ecx
add edx, 0xfffffff0
mov dword [ebp - 0x220], esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4d9be2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x214]
inc ebx
cmp ebx, 0x28
jl 0x4d99e7
mov dword [ebp - 4], edi
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x4d9c07
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00506076
ret
Function at 0x4d9c0d
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 4
mov eax, 0x515e39
call fcn.00506098
mov ebx, ecx
mov esi, dword [0xd5c16c]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, esi
cmp eax, 0x3e80
jb 0x4d9c44
lea ecx, [ebx + 0x39a4]
call fcn.004d93c5
call edi
mov dword [0xd5c16c], eax
mov esi, dword [0xd5c168]
call edi
sub eax, esi
cmp eax, 0x92ba8
jb 0x4d9ccf
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0xd5cc38]
cmp eax, dword [ecx + 4]
jle 0x4d9c9e
mov esi, 0xd5cc38
push esi
call fcn.004efe9f
cmp dword [0xd5cc38], 0xffffffff
pop ecx
jne 0x4d9c9e
and dword [ebp - 4], 0
call fcn.004d94b9
push 0x51871c
call fcn.004f0205
or dword [ebp - 4], 0xffffffff
pop ecx
push esi
call fcn.004efe55
pop ecx
mov eax, dword [0xd5cc3c]
cmp dword [eax - 0xc], 0
je 0x4d9cc8
push ecx
mov esi, esp
lea ecx, [eax - 0x10]
mov dword [ebp - 0x10], esi
call fcn.004098e7
add eax, 0x10
lea ecx, [ebx + 0x5574]
mov dword [esi], eax
call fcn.004d99a6
pop ecx
call edi
mov dword [0xd5c168], eax
call fcn.00506061
ret