joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40a272
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405066
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40a1b3
mov byte [ebp - 2], 0
jmp 0x40a1dd
call fcn.0040ddd8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40a1fc
cmp al, 0x7f
ja 0x40a1fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40a21b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call fcn.0040ddc0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call fcn.0040ddb4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.0040ddb4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40a190
pop edi
pop esi
pop ebx
leave
ret

Function at 0x702744
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec edi
mov dword [ebp - 0xc], eax
js 0x90cea3
jmp 0x6b2275
push ebx
push edi
cmc
mov dword [ebp - 0x10], eax
test ebp, 0x39cd6e98
cmc
mov dword [ebp - 8], 0xffffffff
cmp esi, 0xffff
jmp 0x665ee2
jne 0x90dcf9
mov edx, dword [eax + ecx + 0x78]
test cl, 0xf3
stc
mov dword [ebp - 4], edx
test edx, edx
je 0x90dcf9
mov eax, dword [eax + ecx + 0x7c]
jmp 0x5f0a39
ja 0x92f832
mov eax, esi
cmp esi, 0x650531bb
sub eax, dword [edx + ecx + 0x10]
mov dword [ebp - 8], eax
jmp 0x9332fc
push ebp
mov ebp, esp
bsr ecx, ecx
btc ecx, esi
mov ecx, dword [ebp + 8]
cmp esp, 0x735251f7
lea esp, [esp - 0x114]
cmp sp, bp
cmp dh, 0x3d
push esi
test dl, al
test dx, 0x66c3
test ecx, ecx
jmp 0x8a5298
je 0x90dcf9
mov esi, dword [ebp + 0xc]
test esi, esi
jmp 0x90dce0
ret
je 0x90cea3
mov eax, dword [edx + ecx + 0x20]
cmp si, 0x49c6
lea eax, [eax + ecx]
xor ebx, ebx
jmp 0x5d7c5c
je 0x90dcf9
mov eax, 0x5a4d
test cx, 0x863
cmp word [ecx], ax
je 0x937ab7
xor eax, eax
mov si, 0x4b62
mov si, cx
cmova esi, edi
pop esi
mov esp, ebp
xchg ebp, ebp
pop ebp
jmp 0x8b193b
mov edi, dword [edx + ecx + 0x18]
cmp edi, 0x16f063bd
test edi, edi
jmp 0x8e6ef4
jmp 0x90cea3
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
jmp 0x5f6bed
Function at 0x402310
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov ebx, ecx
push edi
push 0x422274
push 0x105
push dword [ebx + 4]
mov dword [ebp - 4], ebx
call esi
push 0x422288
push 0x106
push dword [ebx + 4]
call esi
push 0x4222c8
push 0x107
push dword [ebx + 4]
call esi
push 0x422304
push pe_nt_image_headers32
push dword [ebx + 4]
call esi
push 0x10c
push dword [ebx + 4]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
call ebx
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push eax
call edi
mov eax, dword [ebp - 4]
push 0x422208
push 0x10c
push dword [eax + 4]
call esi
mov esi, dword [ebp - 4]
push 0x10d
push dword [esi + 4]
call ebx
push 5
push eax
call edi
push 0x10b
push dword [esi + 4]
call ebx
push 0
push eax
call edi
push 0x301
push dword [esi + 4]
call ebx
push 0
push eax
call edi
push 0x302
push dword [esi + 4]
call ebx
push 0
push eax
call edi
push 0x303
push dword [esi + 4]
call ebx
push 0
push eax
call edi
push 0x304
push dword [esi + 4]
call ebx
push 0
push eax
call edi
push 0x305
push dword [esi + 4]
call ebx
push 0
push eax
call edi
push 0x306
push dword [esi + 4]
call ebx
push 0
push eax
call edi
push 0x401
push dword [esi + 4]
call ebx
push 0
push eax
call edi
pop edi
mov dword [esi + 0x44], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402430
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov ebx, ecx
push edi
push 0x422334
push 0x105
push dword [ebx + 4]
call esi
push 0x422348
push 0x106
push dword [ebx + 4]
call esi
push 0x422384
push 0x107
push dword [ebx + 4]
call esi
push 0x422304
push pe_nt_image_headers32
push dword [ebx + 4]
call esi
push 0x422208
push 0x10c
push dword [ebx + 4]
call esi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x10c
push dword [ebx + 4]
call edi
push 1
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x10b
push dword [ebx + 4]
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push eax
call esi
push 0x301
push dword [ebx + 4]
call edi
push 5
push eax
call esi
push 0x302
push dword [ebx + 4]
call edi
push 5
push eax
call esi
push 0x303
push dword [ebx + 4]
call edi
push 5
push eax
call esi
push 0x304
push dword [ebx + 4]
call edi
push 5
push eax
call esi
push 0x305
push dword [ebx + 4]
call edi
push 5
push eax
call esi
push 0x306
push dword [ebx + 4]
call edi
push 5
push eax
call esi
push 0x401
push dword [ebx + 4]
call edi
push 0
push eax
call esi
pop edi
pop esi
mov dword [ebx + 0x44], 1
pop ebx
ret
Function at 0x402530
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov ebx, ecx
push edi
push 0x4223ac
push 0x105
push dword [ebx + 4]
call esi
cmp dword [ebx + 0x30], 0
mov eax, dword [ebx + 4]
jne 0x40256b
push 0x4223c0
push 0x106
push eax
call esi
push 0x422400
jmp 0x40257d
push 0x42240c
push 0x106
push eax
call esi
push str._vz
push 0x107
push dword [ebx + 4]
call esi
push dword [ebx + 0x30]
lea ecx, [ebp - 1]
call fcn.00405220
push 0x422458
push pe_nt_image_headers32
push dword [ebx + 4]
call esi
push 0x422488
push 0x10c
push dword [ebx + 4]
call esi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x10c
push dword [ebx + 4]
call edi
push 1
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x10b
push dword [ebx + 4]
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push eax
call esi
push 0x301
push dword [ebx + 4]
call edi
push 0
push eax
call esi
push 0x302
push dword [ebx + 4]
call edi
push 0
push eax
call esi
push 0x303
push dword [ebx + 4]
call edi
push 0
push eax
call esi
push 0x304
push dword [ebx + 4]
call edi
push 0
push eax
call esi
push 0x305
push dword [ebx + 4]
call edi
push 0
push eax
call esi
push 0x306
push dword [ebx + 4]
call edi
push 0
push eax
call esi
push 0x401
push dword [ebx + 4]
call edi
push 5
push eax
call esi
pop edi
pop esi
mov dword [ebx + 0x44], 2
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405220
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41be8d
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x42a040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x64], 0
xor eax, eax
mov word [ebp - 0x60], ax
xor ecx, ecx
mov word [ebp - 0x5e], cx
xor edx, edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x58], edx
xor eax, eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x44]
call fcn.004044e0
lea ecx, [ebp - 0x2c]
call fcn.004044e0
mov dword [ebp - 4], 0
xor ecx, ecx
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 0x64]
push edx
call fcn.0040a1c0
add esp, 4
sub esp, 0x54
mov ecx, esp
mov dword [ebp - 0x6c], esp
lea eax, [ebp - 0x64]
push eax
call fcn.004033d0
mov ecx, dword [ebp - 0x68]
call fcn.004078b0
sub esp, 0x54
mov ecx, esp
mov dword [ebp - 0x70], esp
lea edx, [ebp - 0x64]
push edx
call fcn.004033d0
mov ecx, dword [ebp - 0x68]
call fcn.00405d60
sub esp, 0x54
mov ecx, esp
mov dword [ebp - 0x74], esp
lea eax, [ebp - 0x64]
push eax
call fcn.004033d0
mov ecx, dword [ebp - 0x68]
call fcn.00407d40
sub esp, 0x54
mov ecx, esp
mov dword [ebp - 0x78], esp
lea edx, [ebp - 0x64]
push edx
call fcn.004033d0
mov ecx, dword [ebp - 0x68]
call fcn.00407f30
mov ecx, dword [ebp - 0x68]
call fcn.00408610
sub esp, 0x54
mov ecx, esp
mov dword [ebp - 0x7c], esp
lea eax, [ebp - 0x64]
push eax
call fcn.004033d0
mov ecx, dword [ebp - 0x68]
call fcn.00408660
sub esp, 0x54
mov ecx, esp
mov dword [ebp - 0x80], esp
lea edx, [ebp - 0x64]
push edx
call fcn.004033d0
call fcn.0040a440
add esp, 0x54
cmp dword [ebp + 8], 0
je 0x405351
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.00402ab0
jmp 0x40538c
sub esp, 0x54
mov ecx, esp
mov dword [ebp - 0x84], esp
lea eax, [ebp - 0x64]
push eax
call fcn.004033d0
mov ecx, dword [ebp - 0x68]
call fcn.00407ca0
push 0x42303c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.00402ab0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040e852
mov esp, ebp
pop ebp
ret 4
Function at 0x405440
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x42a040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], ecx
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x40546b
xor eax, eax
jmp 0x4054bb
push str.GetNativeSystemInfo
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x40548c
lea ecx, [ebp - 0x28]
push ecx
call dword [ebp - 0x30]
jmp 0x405496
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx ecx, word [ebp - 0x28]
cmp ecx, 9
je 0x4054b2
movzx edx, word [ebp - 0x28]
cmp edx, 6
jne 0x4054b9
mov eax, 1
jmp 0x4054bb
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e852
mov esp, ebp
pop ebp
ret
Function at 0x405c30
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41bf9d
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x42a040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x228], ecx
mov dword [ebp - 4], 0
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.0040fb70
add esp, 0xc
lea ecx, [ebp + 0x28]
call fcn.004042c0
push eax
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x423424
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x218]
push edx
push 1
push 0x42343c
push 0x423450
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x405cf6
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.0040b130
add esp, 8
cmp dword [ebp - 0x21c], 0
jne 0x405d0b
mov dword [ebp - 0x220], 1
jmp 0x405d15
mov dword [ebp - 0x220], 0
mov ecx, dword [ebp - 0x220]
mov dword [ebp - 0x224], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00402ab0
mov eax, dword [ebp - 0x224]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040e852
mov esp, ebp
pop ebp
ret 0x54

Function at 0x405d60
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41bfdd
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x42a040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
push 0
mov ecx, dword [ebp - 0x14]
call fcn.004053b0
push 0x4234ac
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x405dc0
mov dword [ebp - 0x10], 1
jmp 0x405dc7
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00402ab0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x54
Function at 0x406000
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp + 0xc]
call fcn.0040c0e0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
push str.BUFFER_FILE_MAPPING
call fcn.0040b0b0
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x406042
mov eax, 1
jmp 0x40617c
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0040b0d0
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x406074
mov edx, dword [ebp - 0xc]
push edx
call fcn.0040b0f0
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, 1
jmp 0x40617c
mov eax, dword [ebp - 0x10]
push eax
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
call fcn.0040c0f0
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4060bf
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0040b110
add esp, 4
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0xc]
push edx
call fcn.0040b0f0
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, 3
jmp 0x40617c
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x406111
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0040b110
add esp, 4
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0xc]
push edx
call fcn.0040b0f0
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, 6
jmp 0x40617c
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x10]
push edx
call fcn.0040b110
add esp, 4
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
push eax
call fcn.0040b0f0
add esp, 4
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0x20], 0
je 0x406172
mov dword [ebp - 0x1c], 0
jmp 0x406179
mov dword [ebp - 0x1c], 7
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e852
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406190
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x42a040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x418], ecx
push 0x208
push 0
lea eax, [ebp - 0x414]
push eax
call fcn.0040fb70
add esp, 0xc
lea ecx, [ebp - 0x414]
push ecx
mov ecx, dword [ebp - 0x418]
call fcn.00408be0
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4061f1
push 0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x423580
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40622c
xor eax, eax
jmp 0x406272
lea edx, [ebp - 0x20c]
push edx
call fcn.00408fd0
add esp, 4
push 0x423594
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
push 0x4235ac
lea ecx, [ebp - 0x20c]
push ecx
push 0x4235b0
lea edx, [ebp - 0x414]
push edx
mov ecx, dword [ebp - 0x418]
call fcn.00408d30
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e852
mov esp, ebp
pop ebp
ret

Function at 0x406280
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x42a040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x418], ecx
push 0x208
push 0
lea eax, [ebp - 0x414]
push eax
call fcn.0040fb70
add esp, 0xc
lea ecx, [ebp - 0x414]
push ecx
mov ecx, dword [ebp - 0x418]
call fcn.00408be0
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4062e1
push 0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x4235c4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40631c
xor eax, eax
jmp 0x406362
lea edx, [ebp - 0x20c]
push edx
call fcn.00408fd0
add esp, 4
push 0x4235d8
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 1
push 0x4235f0
lea ecx, [ebp - 0x20c]
push ecx
push 0x4235f4
lea edx, [ebp - 0x414]
push edx
mov ecx, dword [ebp - 0x418]
call fcn.00408d30
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e852
mov esp, ebp
pop ebp
ret
Function at 0x406370
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x42a040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x418], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0040fb70
add esp, 0xc
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, dword [ebp - 0x418]
call fcn.00408be0
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4063d1
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x423608
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40640c
xor eax, eax
jmp 0x40644e
push 3
lea edx, [ebp - 0x414]
push edx
call fcn.0040ac90
add esp, 8
push 1
push 0x42361c
lea eax, [ebp - 0x414]
push eax
push str._T_rg
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, dword [ebp - 0x418]
call fcn.00408d30
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0x41c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e852
mov esp, ebp
pop ebp
ret

Function at 0x406460
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x42a040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x21c], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0040fb70
add esp, 0xc
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, dword [ebp - 0x21c]
call fcn.00408be0
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4064c1
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x423634
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4064eb
xor eax, eax
jmp 0x4065a9
lea eax, [ebp - 0x20c]
push eax
push str.http:__www.icesofts.com_
push 0x42367c
push 0x423684
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x406542
lea ecx, [ebp - 0x20c]
push ecx
push str.C:windows_system32SHELL32.dll
push str.IconFile
push 0x4236fc
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
test eax, eax
je 0x406542
mov dword [ebp - 0x214], 1
jmp 0x40654c
mov dword [ebp - 0x214], 0
mov edx, dword [ebp - 0x214]
mov dword [ebp - 0x210], edx
cmp dword [ebp - 0x210], 0
je 0x40658d
lea eax, [ebp - 0x20c]
push eax
push 0x423720
push str.IconIndex
push str.InternetShortcut
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
test eax, eax
je 0x40658d
mov dword [ebp - 0x218], 1
jmp 0x406597
mov dword [ebp - 0x218], 0
mov ecx, dword [ebp - 0x218]
mov dword [ebp - 0x210], ecx
mov eax, dword [ebp - 0x210]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e852
mov esp, ebp
pop ebp
ret
Function at 0x4075a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
mov eax, dword [0x42a040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x360], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0040fb70
add esp, 0xc
push 0xf
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0040ac90
add esp, 8
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40760c
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x360]
call fcn.00407820
cmp eax, 0x14e
je 0x40763c
push 1
lea ecx, [ebp - 0x35c]
push ecx
call fcn.00409e50
add esp, 0xfffffeb8
mov ecx, 0x53
lea esi, [ebp - 0x35c]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.00409d70
add esp, 0x150
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e852
mov esp, ebp
pop ebp
ret

Function at 0x407820
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x42a040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], ecx
xor eax, eax
mov word [ebp - 8], ax
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x407896
mov dword [ebp - 0xc], 0
push 0
lea edx, [ebp - 0xc]
push edx
push 2
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x407885
xor edx, edx
mov word [ebp - 8], dx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], 0
movzx eax, word [ebp - 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e852
mov esp, ebp
pop ebp
ret 4