joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d8cbc
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffc8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1038], edx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d8ec3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, 0x4d8edc
call fcn.00404978
mov esi, dword [ebx + 0x80]
cmp dword [esi + 4], 0
je 0x4d8ea2
cmp dword [esi + 8], 0
je 0x4d8ea2
lea eax, [ebp - 0x31]
mov edx, 0x4d8f14
call fcn.0040a270
push 0
push 0
push 0
push 0
push 0x4d8f1c
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 4], eax
push 1
push 0
push 3
push 0
push 0
push 0x50
mov eax, dword [ebx + 0x80]
mov eax, dword [eax + 4]
call fcn.00404da0
push eax
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetConnectA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4d8e87
push 1
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x80]
mov eax, dword [eax + 8]
call fcn.00404da0
push eax
push 0x4d8f28
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_HttpOpenRequestA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4d8e6a
mov eax, dword [ebx + 0x80]
add eax, 0x14
call fcn.004048e0
mov eax, dword [ebx + 0x80]
mov eax, dword [eax + 0xc]
call fcn.00404ba0
push eax
mov eax, dword [ebx + 0x80]
mov eax, dword [eax + 0xc]
call fcn.00404da0
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404ba0
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404da0
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_HttpSendRequestA
test eax, eax
je 0x4d8e5f
mov dword [ebp - 0x14], 0x1000
cmp dword [ebp - 0x14], 0
jbe 0x4d8e5f
mov eax, dword [0x512408]
mov eax, dword [eax]
call fcn.00496fa0
lea eax, [ebp - 0x14]
push eax
push 0x1000
lea eax, [ebp - 0x1031]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetReadFile
test eax, eax
je 0x4d8e5f
cmp dword [ebp - 0x14], 0
jbe 0x4d8e59
cmp dword [ebp - 0x14], 0x1000
ja 0x4d8e59
mov edi, dword [ebp - 0x14]
dec edi
test edi, edi
jl 0x4d8e59
inc edi
lea esi, [ebp - 0x1031]
lea eax, [ebp - 0x1038]
mov dl, byte [esi]
call fcn.00404ac8
mov edx, dword [ebp - 0x1038]
mov eax, dword [ebx + 0x80]
add eax, 0x14
call fcn.00404ba8
inc esi
dec edi
jne 0x4d8e34
cmp dword [ebp - 0x14], 0
ja 0x4d8ded
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
jmp 0x4d8e7c
push 0x11
push 5
xor ecx, ecx
mov edx, 0x3b8
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
jmp 0x4d8e99
push 0x10
push 5
xor ecx, ecx
mov edx, 0x3b7
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d8eca
lea eax, [ebp - 0x1038]
call fcn.004048e0
lea eax, [ebp - 0x10]
call fcn.004048e0
ret
Function at 0x4db800
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4db955
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x171], 0
je 0x4db836
mov dword [ebp - 4], 0xffffffff
jmp 0x4db937
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x80]
cmp byte [eax + 0x10], 0
je 0x4db86d
mov eax, ebx
call fcn.004d8cbc
mov byte [ebp - 9], 1
cmp word [ebx + 0xe2], 0
je 0x4db86d
lea ecx, [ebp - 9]
mov edx, ebx
mov eax, dword [ebx + 0xe4]
call dword [ebx + 0xe0]
cmp byte [ebx + 0x39], 0
je 0x4db886
push dword [ebx + 0x154]
push dword [ebx + 0x150]
mov eax, ebx
call fcn.004dc084
mov ecx, dword [ebx + 0x3c]
mov dl, 1
mov eax, dword [0x42c5f4]
call fcn.0042c6a4
mov esi, eax
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x4db970
mov edx, 0x4db984
mov eax, esi
mov edi, dword [eax]
call dword [edi]
cmp dword [ebp - 8], 0
je 0x4db8cf
push 3
push 0
xor ecx, ecx
mov edx, 0x3ad
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x38]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004dbe1c
cmp dword [ebx + 0x134], 0
je 0x4db8e5
cmp byte [ebx + 0x56], 0
je 0x4db8e5
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x40]
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4db994
mov edx, 0x4db984
mov eax, esi
mov edi, dword [eax]
call dword [edi]
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 8]
mov eax, ebx
call fcn.004d7ed4
cmp dword [ebp - 8], 0
je 0x4db91e
push 1
mov eax, dword [ebp - 8]
call fcn.00404da0
push eax
call sub.kernel32.dll_WinExec
mov eax, esi
call fcn.00403b0c
push 3
push 0
xor ecx, ecx
mov edx, 0x3b4
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db95c
lea eax, [ebp - 0x10]
call fcn.004048e0
lea eax, [ebp - 8]
call fcn.004048e0
ret
Function at 0x4dbb60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb90
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x470], edx
mov dword [ebp - 0x464], edx
mov dword [ebp - 0x468], edx
mov dword [ebp - 0x46c], edx
mov dword [ebp - 0x460], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4dbd62
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 2], 0
cmp word [ebx + 0xaa], 0
je 0x4dbbba
lea ecx, [ebp - 2]
mov edx, ebx
mov eax, dword [ebx + 0xac]
call dword [ebx + 0xa8]
cmp byte [ebp - 2], 0
jne 0x4dbd44
mov byte [ebp - 1], 1
cmp word [ebx + 0xc2], 0
je 0x4dbbe5
lea ecx, [ebp - 1]
mov edx, ebx
mov eax, dword [ebx + 0xc4]
call dword [ebx + 0xc0]
jmp 0x4dbc1b
cmp byte [ebx + 0xfe], 0
jne 0x4dbc1b
push 0
lea edx, [ebp - 0x460]
mov eax, 0x38f
call fcn.00409bc4
mov eax, dword [ebp - 0x460]
mov cx, word [0x4dbd70]
mov dl, 3
call fcn.00454654
cmp eax, 6
sete byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x4dbd44
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x3c]
call sub.kernel32.dll_GetCurrentProcessId
mov esi, eax
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.004032a4
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], 1
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x30
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x468]
call fcn.004d7bf4
push dword [ebp - 0x468]
push 0x4dbd7c
mov eax, esi
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x46c]
call fcn.0040982c
push dword [ebp - 0x46c]
push 0x4dbd90
push dword [ebx + 0xf4]
push 0x4dbd90
push dword [ebx + 0xf8]
lea eax, [ebp - 0x464]
mov edx, 7
call fcn.00404c60
mov eax, dword [ebp - 0x464]
call fcn.00404da0
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4dbd1e
call sub.kernel32.dll_GetLastError_1
mov esi, eax
push 0
push 0x401
lea eax, [ebp - 0x459]
push eax
push 0
push esi
push 0
push 0x1000
call sub.kernel32.dll_FormatMessageA
push 9
push esi
lea edx, [ebp - 0x470]
lea eax, [ebp - 0x459]
call fcn.0040a3c4
mov ecx, dword [ebp - 0x470]
mov edx, 0x3b6
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x38]
cmp word [ebx + 0xca], 0
je 0x4dbd38
mov edx, ebx
mov eax, dword [ebx + 0xcc]
call dword [ebx + 0xc8]
jmp 0x4dbd44
mov eax, dword [0x512408]
mov eax, dword [eax]
call fcn.00497238
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dbd69
lea eax, [ebp - 0x470]
mov edx, 5
call fcn.00404904
ret

Function at 0x4df0ac
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
call sub.kernel32.dll_GetTickCount
mov ebx, eax
jmp 0x4df0c2
mov eax, dword [0x512408]
mov eax, dword [eax]
call fcn.00496fa0
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x15e
jb 0x4df0b6
pop ebx
ret
Function at 0x4eb2b0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x4eb2cc
cmp dword [esi + 4], 0
je 0x4eb2f9
test byte [ebx + 0x55], 1
jne 0x4eb2eb
mov eax, ebx
call fcn.0047a814
test eax, eax
jne 0x4eb2eb
mov edx, esi
mov eax, ebx
call fcn.0047f870
jmp 0x4eb3ea
mov edx, esi
mov eax, ebx
call fcn.0047b798
jmp 0x4eb3ea
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
call fcn.00476b70
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x54]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x4eb3e3
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0047db1c
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, eax
mov edx, 0x14
mov eax, ebx
call fcn.0047839c
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.004eb2b0
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x54]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0047db1c
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eb3ea
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4eb8cc
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov ecx, 0x514108
mov eax, ebx
mov edx, 8
test al, 1
je 0x4eb8e8
shr eax, 1
xor eax, 0xedb88320
jmp 0x4eb8ea
shr eax, 1
dec edx
jne 0x4eb8db
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x4eb8d4
pop ebx
ret

Function at 0x4ee52c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d90
xor eax, eax
push ebp
push 0x4ee571
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
mov eax, dword [ebp - 4]
call fcn.00404da0
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ee578
lea eax, [ebp - 4]
call fcn.004048e0
ret

Function at 0x4ee57c
Capabilities:
Terminate process

Disassembly:
push ecx
push esp
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_GetWindowThreadProcessId
cmp dword [esp], 0
je 0x4ee5a3
push 0xffffffffffffffff
mov eax, dword [esp + 4]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
pop edx
ret
Function at 0x4ee654
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
push 0x4ee678
call sub.kernel32.dll_LoadLibraryA
push esp
push 0x201
call sub.wsock32.dll_WSAStartup
add esp, 0x190
ret

Function at 0x4ee6a8
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ee798
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004ee654
push 0x14
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x4ee684]
call fcn.00405e9c
add esp, 4
push 0x40
lea eax, [ebp - 0x48]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x48]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x4ee716
push 0
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x4ee684]
call fcn.00405e9c
add esp, 4
jmp 0x4ee77c
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x4ee732
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, dword [ebp - 8]
lea eax, [eax + ebx*4]
call fcn.00404ad8
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
je 0x4ee73e
cmp ebx, 0x14
jl 0x4ee71d
push ebx
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x4ee684]
call fcn.00405e9c
add esp, 4
xor ebx, ebx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
jmp 0x4ee770
mov eax, dword [ebp - 8]
mov edx, dword [eax + ebx*4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
mov eax, dword [ebp - 8]
call fcn.00405ce8
cmp ebx, eax
jle 0x4ee761
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ee79f
lea eax, [ebp - 8]
mov edx, dword [0x4ee684]
call fcn.00405ea8
ret

Function at 0x4ee7e8
Capabilities:
Clear file content
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, ecx
mov byte [esp], 0
push eax
push edx
mov eax, dword [0x513668]
push eax
call sub.kernel32.dll_FindResourceA
mov edi, eax
test edi, edi
je 0x4ee8b3
push edi
mov eax, dword [0x513668]
push eax
call sub.kernel32.dll_LoadResource
mov ebx, eax
test ebx, ebx
je 0x4ee8b3
push ebx
call sub.kernel32.dll_LockResource
mov ebp, eax
test ebp, ebp
jne 0x4ee836
push ebx
call sub.kernel32.dll_FreeResource
jmp 0x4ee8b3
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push esi
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
jne 0x4ee864
mov eax, ebx
call fcn.00407cc4
push ebx
call sub.kernel32.dll_FreeResource
jmp 0x4ee8b3
push edi
mov eax, dword [0x513668]
push eax
call sub.kernel32.dll_SizeofResource
mov edi, eax
push 0
lea eax, [esp + 8]
push eax
push edi
push ebp
push esi
call sub.kernel32.dll_WriteFile_1
cmp edi, dword [esp + 4]
je 0x4ee896
mov eax, ebx
call fcn.00407cc4
push ebx
call sub.kernel32.dll_FreeResource
jmp 0x4ee8b3
push esi
call sub.kernel32.dll_SetEndOfFile_1
push esi
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
call fcn.00407cc4
push ebx
call sub.kernel32.dll_FreeResource
mov byte [esp], 1
mov al, byte [esp]
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4fc154
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x4fc183
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x4fc202
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.004fa878
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4fc1d0
mov cx, word [esp]
sub cx, si
jmp 0x4fc1d2
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4fc1b9
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4fc1f8
mov cx, word [esp]
sub cx, si
jmp 0x4fc1fa
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4fc1e1
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x4fc25f
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.004fbe28
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x4fc24a
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x4fc25f
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4fc15e
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5012c8
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
lea edx, [eax + 0x2cc]
mov eax, ebx
call fcn.00500c50
test al, al
je 0x5013fa
mov eax, dword [ebp - 4]
call fcn.00501050
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x78]
mov word [ebp - 8], ax
mov dx, 0xfff5
mov eax, dword [ebp - 4]
call fcn.004773dc
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2e4]
call fcn.00404da0
push eax
mov eax, ebx
call fcn.00404da0
push eax
call sub.kernel32.dll_CopyFileA
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2e4]
call fcn.00404da0
push eax
call sub.kernel32.dll_SetFileAttributesA
push 2
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x2e4]
mov dl, 1
mov eax, dword [0x418fc4]
call fcn.0041dc10
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x2bc], esi
xor eax, eax
push ebp
push 0x5013f3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, esi
call fcn.0041d77c
mov eax, dword [ebp - 4]
add eax, 0x2e0
mov edx, ebx
call fcn.00404934
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5013fa
mov dx, word [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004773dc
mov eax, dword [ebp - 4]
call fcn.005038d0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2e8]
xor edx, edx
call fcn.0041b79c
mov eax, dword [ebp - 4]
call fcn.00501450
mov eax, dword [ebp - 4]
mov byte [eax + 0x339], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x320], 0
push 1
push 1
xor ecx, ecx
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.004b26fc
ret
mov al, byte [ebp - 5]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4045b0
Capabilities:
Check if file exists

Disassembly:
push 0x268
mov eax, 0x5f0bdc
call fcn.0044ea40
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x264], eax
call fcn.00403028
mov ecx, eax
call fcn.0052f788
push eax
lea ecx, [ebp - 0x260]
call fcn.00404479
lea eax, [ebp - 0x248]
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.0040451c
pop ecx
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 1
mov dword [ebp - 0x26c], esi
mov dword [ebp - 0x268], esi
call fcn.0051a959
mov dword [ebp - 0x26c], eax
push 7
mov dword [ebp - 0x220], esi
xor eax, eax
pop ebx
mov esi, str..wnpf
mov byte [ebp - 4], 2
push esi
mov dword [ebp - 0x21c], ebx
mov word [ebp - 0x230], ax
call fcn.00546031
pop ecx
push eax
push esi
lea ecx, [ebp - 0x230]
call fcn.00403bdf
push dword [ebp - 0x264]
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 3
push eax
push 0
lea eax, [ebp - 0x274]
push eax
lea ecx, [ebp - 0x26c]
call fcn.00404398
push 0
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.004037bf
and dword [ebp - 0x220], 0
xor eax, eax
mov esi, str..swnpf
mov dword [ebp - 0x21c], ebx
push esi
mov word [ebp - 0x230], ax
call fcn.00546031
pop ecx
push eax
push esi
lea ecx, [ebp - 0x230]
call fcn.00403bdf
push dword [ebp - 0x264]
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 4
push eax
push 0
lea eax, [ebp - 0x274]
push eax
lea ecx, [ebp - 0x26c]
call fcn.00404398
push 0
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.004037bf
mov ecx, dword [ebp - 0x26c]
mov eax, dword [ecx]
mov dword [ebp - 0x270], eax
cmp eax, ecx
je 0x4047c6
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea esi, [eax + 0x10]
cmp dword [esi + 0x14], 8
jb 0x404713
mov edx, dword [esi]
jmp 0x404715
mov edx, esi
cmp dword [edi + 0x14], 8
jb 0x40471f
mov ecx, dword [edi]
jmp 0x404721
mov ecx, edi
cmp dword [ebp - 0x24c], 8
lea eax, [ebp - 0x260]
push edx
cmovae eax, dword [ebp - 0x260]
push ecx
push eax
lea eax, [ebp - 0x218]
push str._sSkin_s_s
push eax
call fcn.00404de4
add esp, 0x14
lea eax, [ebp - 0x218]
push eax
call ebx
test eax, eax
jne 0x4047f9
cmp dword [esi + 0x14], 8
jb 0x404765
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x40476f
mov ecx, dword [edi]
jmp 0x404771
mov ecx, edi
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
push esi
cmovae eax, dword [ebp - 0x248]
push ecx
push eax
lea eax, [ebp - 0x218]
push 0x5faf40
push eax
call fcn.00404de4
add esp, 0x14
lea eax, [ebp - 0x218]
push eax
call ebx
test eax, eax
jne 0x4047f9
lea ecx, [ebp - 0x270]
call fcn.0051fd9e
mov eax, dword [ebp - 0x270]
cmp eax, dword [ebp - 0x26c]
jne 0x404706
xor esi, esi
lea ecx, [ebp - 0x26c]
call fcn.0040449e
push 0
push 1
lea ecx, [ebp - 0x248]
call fcn.004037bf
push 0
push 1
lea ecx, [ebp - 0x260]
call fcn.004037bf
mov eax, esi
call fcn.0044e9ea
ret
cmp word [ebp - 0x218], 0
jne 0x404807
xor eax, eax
jmp 0x404814
lea eax, [ebp - 0x218]
push eax
call fcn.00546031
pop ecx
mov ecx, dword [ebp - 0x264]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00403bdf
xor esi, esi
inc esi
jmp 0x4047c8
Function at 0x404e67
Capabilities:
Read .ini file

Disassembly:
push 0x258
mov eax, 0x5f0c25
call fcn.0044ea40
mov edi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x404e8f
xor al, al
jmp 0x404fef
call fcn.0040524b
push 0x208
mov esi, eax
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00543220
add esp, 0xc
lea eax, [ebp - 0x248]
mov ecx, edi
push dword [ebp - 0x264]
push eax
call fcn.004055fa
and dword [ebp - 4], 0
lea ecx, [ebp - 0x218]
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
push esi
cmovae eax, dword [ebp - 0x248]
mov esi, 0x5faef8
push 0x104
push ecx
push esi
push eax
push 0x5fb004
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.0054ab2b
pop ecx
pop ecx
test eax, eax
jne 0x404f9e
and dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x230]
push ecx
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0x248]
mov ecx, edi
push eax
push 0x5fb004
call fcn.004050c1
test al, al
jne 0x404f68
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.004037bf
xor bl, bl
jmp 0x404fde
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0054ab6b
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.004037bf
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.004054b9
lea eax, [ebp - 0x260]
mov byte [ebp - 4], 2
cmp ebx, eax
je 0x404fcd
push 0xffffffffffffffff
push 0
push eax
mov ecx, ebx
call fcn.00403b4a
push 0
push 1
lea ecx, [ebp - 0x260]
mov bl, 1
call fcn.004037bf
push 0
push 1
lea ecx, [ebp - 0x248]
call fcn.004037bf
mov al, bl
call fcn.0044e9ea
ret 8

Function at 0x40503d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x6a1564]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
call fcn.00403028
mov ecx, eax
call fcn.0052f6f4
push eax
push 0x64
lea eax, [ebp - 0xcc]
push eax
push 0x5faef8
push str.MainID
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0xcc], 0
jne 0x40508d
xor eax, eax
jmp 0x40509a
lea eax, [ebp - 0xcc]
push eax
call fcn.00546031
pop ecx
push eax
lea eax, [ebp - 0xcc]
mov ecx, esi
push eax
call fcn.00403bdf
cmp dword [esi + 0x10], 0
mov ecx, dword [ebp - 4]
seta al
xor ecx, ebp
pop esi
call fcn.0044e9c4
mov esp, ebp
pop ebp
ret 4
Function at 0x4051c7
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x6a1564]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
call fcn.00403028
mov ecx, eax
call fcn.0052f6f4
push eax
push 0x64
lea eax, [ebp - 0xcc]
push eax
push 0x5faef8
push 0x5fafe4
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0xcc], 0
jne 0x405217
xor eax, eax
jmp 0x405224
lea eax, [ebp - 0xcc]
push eax
call fcn.00546031
pop ecx
push eax
lea eax, [ebp - 0xcc]
mov ecx, esi
push eax
call fcn.00403bdf
cmp dword [esi + 0x10], 0
mov ecx, dword [ebp - 4]
seta al
xor ecx, ebp
pop esi
call fcn.0044e9c4
mov esp, ebp
pop ebp
ret 4

Function at 0x40527a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x6a1564]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00403028
mov ecx, eax
call fcn.0052f6f4
push eax
push 0x64
lea eax, [ebp - 0xcc]
push eax
push 0x5faef8
push 0x5fafe4
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0xcc]
push eax
call fcn.00546031
cmp eax, 1
pop ecx
mov ecx, dword [ebp - 4]
setg al
xor ecx, ebp
call fcn.0044e9c4
mov esp, ebp
pop ebp
ret