joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430a48
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1fb4]
mov eax, 0x2034
call fcn.00461c80
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x1fb0], eax
push esi
push edi
mov esi, 0x206
xor edi, edi
push esi
lea eax, [ebp + 0x1ba2]
push edi
push eax
mov word [ebp + 0x1ba0], di
call fcn.0045fa70
lea eax, [ebp + 0x1ba0]
push str.C:log_
push eax
call fcn.0045fd44
push 0x7fe
lea eax, [ebp + 0xf92]
push edi
push eax
mov word [ebp + 0xf90], di
call fcn.0045fa70
lea eax, [ebp + 0x1ba0]
push eax
lea eax, [ebp + 0x1998]
push str._sgswb.log
push eax
call fcn.00460936
push esi
lea eax, [ebp + 0x1792]
push edi
push eax
mov word [ebp + 0x1790], di
call fcn.0045fa70
push esi
lea eax, [ebp + 0x1daa]
push edi
push eax
mov word [ebp + 0x1da8], di
call fcn.0045fa70
add esp, 0x44
push 0x104
lea eax, [ebp + 0x1da8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp + 0x1da8]
push 0x5c
push eax
call fcn.0045fc14
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ecx
mov word [eax], di
pop ecx
lea eax, [ebp + 0x1998]
push eax
call esi
test eax, eax
je 0x430c6f
lea eax, [ebp + 0x1da8]
push ebx
push eax
call fcn.0045fe9a
lea eax, [ebp + eax*2 + 0x1daa]
push eax
lea eax, [ebp + 0x1790]
push eax
call fcn.0045fd44
lea eax, [ebp + 0x1790]
push eax
lea eax, [ebp + 0x1ba0]
push eax
lea eax, [ebp + 0x1998]
push str._s_s.txt
push eax
call fcn.00460936
lea eax, [ebp + 0x1fc0]
push eax
push dword [ebp + 0x1fbc]
lea eax, [ebp + 0xf90]
push 0x3ff
push eax
call fcn.004671b5
push edi
call fcn.00461b43
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x7c], edx
call fcn.0046468b
push dword [ebp + 0x1fbc]
mov ecx, dword [eax + 0x10]
push dword [eax]
inc ecx
push dword [eax + 4]
push dword [eax + 8]
push dword [eax + 0xc]
mov eax, dword [eax + 0x14]
push ecx
add eax, 0x76c
push eax
lea eax, [ebp - 0x70]
push str.__d__d__d__d__d__d_:_s
push eax
call fcn.00460936
add esp, 0x58
lea eax, [ebp + 0x1998]
push eax
mov word [ebp + 0x178e], di
mov dword [ebp - 0x74], edi
call esi
xor ebx, ebx
inc ebx
test eax, eax
je 0x430bf1
mov dword [ebp - 0x74], ebx
lea eax, [ebp + 0x1998]
push 0x4cc100
push eax
call fcn.00463f4f
mov esi, eax
cmp esi, edi
pop ecx
pop ecx
je 0x430c6e
cmp dword [ebp - 0x74], edi
jne 0x430c26
push esi
push 2
lea eax, [ebp - 0x78]
push ebx
push eax
mov dword [ebp - 0x78], 0xfeff
call fcn.00467061
add esp, 0x10
lea eax, [ebp - 0x70]
push eax
call fcn.0045fe9a
push esi
add eax, eax
push eax
lea eax, [ebp - 0x70]
push ebx
push eax
call fcn.00467061
push esi
push 2
lea eax, [ebp - 0x74]
push ebx
push eax
mov dword [ebp - 0x74], 0xd
call fcn.00467061
push esi
push 2
lea eax, [ebp - 0x74]
push ebx
push eax
mov dword [ebp - 0x74], 0xa
call fcn.00467061
push esi
call fcn.00463844
add esp, 0x38
pop ebx
mov ecx, dword [ebp + 0x1fb0]
pop edi
xor ecx, ebp
pop esi
call fcn.0045fa14
add ebp, 0x1fb4
leave
ret
Function at 0x4310ae
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4310f2
cmp byte [ebp - 0x194], 2
jne 0x4310ec
cmp byte [ebp - 0x193], 2
jne 0x4310ec
inc eax
jmp 0x4310f4
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045fa14
leave
ret

Function at 0x431129
Capabilities:
Connect socket

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x431148
call fcn.00430de4
xor eax, eax
ret
xor eax, eax
inc eax
ret
Function at 0x435aad
Capabilities:
Enumerate files on windows

Disassembly:
push 0x2f0
mov eax, 0x4bf843
call fcn.00460420
mov dword [ebp - 0x2c4], ecx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x2c0], eax
mov eax, dword [ebp + 0xc]
push ebx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x2bc], eax
call fcn.00401eb0
xor edi, edi
inc edi
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x2b8]
xor esi, esi
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], esi
mov dword [ebp - 0x2b8], 0x5c
call fcn.00402040
inc eax
push eax
push esi
lea eax, [ebp - 0x2e0]
push eax
lea ecx, [ebp - 0x48]
call fcn.00401f10
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.004018a0
push esi
push edi
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 0
call fcn.00401330
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00401eb0
push 0x4c5758
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.00401f50
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x435b5d
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x2b4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push dword [ebp - 0x2bc]
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x2b8], eax
call fcn.00401eb0
cmp dword [ebp - 0x2b8], 0xffffffff
mov byte [ebp - 4], 3
jne 0x435bb4
push esi
push edi
lea ecx, [ebp - 0x64]
call fcn.00401330
push esi
push edi
lea ecx, [ebp - 0x2c]
call fcn.00401330
push esi
push edi
lea ecx, [ebp - 0x48]
call fcn.00401330
xor eax, eax
call fcn.004604a3
ret 0x10
test byte [ebp - 0x2b4], 0x10
jne 0x435c38
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x2fc]
push eax
call fcn.00402450
mov ebx, eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x2e0]
push eax
mov byte [ebp - 4], 4
call fcn.00402450
add esp, 0x18
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x2c4]
push ebx
push eax
push dword [ebp - 0x2c0]
mov byte [ebp - 4], 5
call fcn.0043572f
mov ebx, eax
neg ebx
push esi
sbb bl, bl
push edi
lea ecx, [ebp - 0x2e0]
inc bl
call fcn.00401330
push esi
push edi
lea ecx, [ebp - 0x2fc]
mov byte [ebp - 4], 3
call fcn.00401330
test bl, bl
jne 0x435c63
lea eax, [ebp - 0x2b4]
push eax
push dword [ebp - 0x2b8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x435bb4
push dword [ebp - 0x2b8]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, edi
jmp 0x435c65
xor ebx, ebx
push esi
push edi
lea ecx, [ebp - 0x64]
call fcn.00401330
push esi
push edi
lea ecx, [ebp - 0x2c]
call fcn.00401330
push esi
push edi
lea ecx, [ebp - 0x48]
call fcn.00401330
mov eax, ebx
jmp 0x435bac
Function at 0x436179
Capabilities:
Create directory

Disassembly:
push 0x60
mov eax, 0x4bf923
call fcn.00460420
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push ebx
push eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x50], ecx
call fcn.0043566d
cmp dword [ebp - 0x30], 0x10
mov eax, dword [ebp - 0x44]
mov dword [ebp - 4], ebx
jae 0x4361aa
lea eax, [ebp - 0x44]
push eax
call fcn.004aa6e0
mov edi, eax
cmp edi, ebx
pop ecx
mov dword [ebp - 0x4c], edi
jne 0x4361cf
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.004012b0
xor eax, eax
call fcn.004604a3
ret 8
push edi
lea eax, [ebp - 0x6c]
push 0x4aa700
push eax
call fcn.0043562e
lea eax, [ebp - 0x60]
push eax
push edi
mov byte [ebp - 4], 1
call fcn.004a95e0
add esp, 0x14
test eax, eax
je 0x4361ff
lea eax, [ebp - 0x6c]
push eax
call fcn.0043557e
pop ecx
jmp 0x4361ba
push esi
lea ecx, [ebp - 0x2c]
call fcn.00401eb0
cmp dword [esi + 0x18], 8
mov byte [ebp - 4], 2
jb 0x436217
mov esi, dword [esi + 4]
jmp 0x43621a
add esi, 4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x436246
dec eax
push eax
lea ecx, [ebp - 0x2c]
call fcn.00401ee0
cmp word [eax], 0x5c
je 0x436246
push 0x4df450
lea ecx, [ebp - 0x2c]
call fcn.00401f50
xor edi, edi
cmp dword [ebp - 0x5c], ebx
jb 0x4362a6
ja 0x436254
cmp dword [ebp - 0x60], ebx
jbe 0x4362a6
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x436260
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x50]
push eax
push dword [ebp - 0x4c]
call fcn.00435e0d
test eax, eax
je 0x4362ab
mov esi, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
add esi, 0xffffffff
mov eax, edi
cdq
adc ecx, 0xffffffff
cmp edx, ecx
ja 0x436296
jb 0x436289
cmp eax, esi
jae 0x436296
push dword [ebp - 0x4c]
call fcn.004a9c60
test eax, eax
pop ecx
jne 0x4362bb
inc edi
mov eax, edi
cdq
cmp edx, dword [ebp - 0x5c]
jb 0x436254
ja 0x4362a6
cmp eax, dword [ebp - 0x60]
jb 0x436254
xor esi, esi
inc esi
jmp 0x4362bd
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401330
jmp 0x4361f3
xor esi, esi
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401330
lea eax, [ebp - 0x6c]
push eax
call fcn.0043557e
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.004012b0
mov eax, esi
jmp 0x4361c7

Function at 0x436f98
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x14]
push eax
push 0
push esi
push 0x436ee8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x18], eax
pop esi
je 0x436fc7
cmp eax, 0xffffffff
je 0x436fc7
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret

Function at 0x436fc8
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x14]
push eax
push 0
push esi
push 0x436ef7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x18], eax
pop esi
je 0x436ff7
cmp eax, 0xffffffff
je 0x436ff7
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret
Function at 0x43719f
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x190], eax
push esi
xor esi, esi
push 0x206
lea eax, [ebp - 0x76]
push esi
push eax
mov word [ebp - 0x78], si
call fcn.0045fa70
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
push esi
push esi
push 0x25
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x437256
push 0x4c46d8
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x437256
push ebx
push esi
lea eax, [ebp - 0x78]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
cmp ebx, esi
jbe 0x437255
push edi
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
cmp edi, esi
je 0x437254
push edi
push ebx
push esi
lea eax, [ebp - 0x78]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x43724d
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x4df450
push edi
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x7c], esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x43724d
mov eax, dword [ebp - 0x7c]
mov esi, dword [eax + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop ebx
mov ecx, dword [ebp + 0x190]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0045fa14
add ebp, 0x194
leave
ret

Function at 0x43726e
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
lea ebp, [esp - 0x240]
sub esp, 0x2c0
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x23c], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push dword [ebp + 0x248]
mov byte [ebp - 0x79], bl
push ebx
mov dword [ebp - 0x80], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
jne 0x4372f9
push esi
push 0x2b0
lea eax, [ebp - 0x74]
push ebx
push eax
mov dword [ebp - 0x78], ebx
call fcn.0045fa70
add esp, 0xc
mov esi, 0x208
push esi
push 0x2b4
lea eax, [ebp - 0x78]
push eax
push ebx
push dword [ebp - 0x80]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
setne byte [ebp - 0x79]
cmp byte [ebp - 0x79], bl
je 0x4372ef
push esi
lea eax, [ebp - 0x6c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push dword [ebp - 0x80]
call dword [sym.imp.SHELL32.dll_ILFree]
pop esi
mov ecx, dword [ebp + 0x23c]
mov al, byte [ebp - 0x79]
xor ecx, ebp
pop ebx
call fcn.0045fa14
add ebp, 0x240
leave
ret 4
Function at 0x4388f2
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x194], eax
push esi
push edi
mov edi, dword [ebp + 0x1a0]
xor esi, esi
push 0x206
lea eax, [ebp - 0x72]
push esi
push eax
mov word [ebp - 0x74], si
call fcn.0045fa70
add esp, 0xc
push esi
push 0x19
lea eax, [ebp - 0x74]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x78], esi
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
jl 0x4389a2
mov eax, dword [ebp - 0x78]
push esi
lea edx, [ebp - 0x80]
push edx
push esi
lea edx, [ebp - 0x74]
push edx
push esi
push esi
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x80], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x4389a2
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
lea edx, [ebp - 0x7c]
push edx
push 0x4d4748
push esi
push dword [ebp - 0x80]
push eax
call dword [ecx + 0x14]
test eax, eax
jl 0x4389a2
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push edi
push dword [ebp - 0x7c]
call fcn.00438798
mov eax, dword [ebp - 0x7c]
pop ecx
pop ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp + 0x194]
pop edi
xor ecx, ebp
pop esi
call fcn.0045fa14
add ebp, 0x198
leave
ret

Function at 0x4389b9
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x194], eax
push esi
push edi
mov edi, dword [ebp + 0x1a0]
xor esi, esi
push 0x206
lea eax, [ebp - 0x72]
push esi
push eax
mov word [ebp - 0x74], si
call fcn.0045fa70
add esp, 0xc
push esi
push 0x10
lea eax, [ebp - 0x74]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x78], esi
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
jl 0x438a69
mov eax, dword [ebp - 0x78]
push esi
lea edx, [ebp - 0x80]
push edx
push esi
lea edx, [ebp - 0x74]
push edx
push esi
push esi
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x80], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x438a69
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
lea edx, [ebp - 0x7c]
push edx
push 0x4d4748
push esi
push dword [ebp - 0x80]
push eax
call dword [ecx + 0x14]
test eax, eax
jl 0x438a69
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push edi
push dword [ebp - 0x7c]
call fcn.00438798
mov eax, dword [ebp - 0x7c]
pop ecx
pop ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp + 0x194]
pop edi
xor ecx, ebp
pop esi
call fcn.0045fa14
add ebp, 0x198
leave
ret
Function at 0x439679
Capabilities:
Copy file

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0xe8], 8
jb 0x43968d
mov eax, dword [esi + 0xd4]
jmp 0x439693
lea eax, [esi + 0xd4]
push ebx
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push eax
mov ebp, 0x4c4484
push ebp
push str.ModifySetConfig
mov ebx, str.SetModify
push ebx
call edi
cmp dword [esi + 0xe8], 8
jb 0x4396c1
mov eax, dword [esi + 0xd4]
jmp 0x4396c7
lea eax, [esi + 0xd4]
push eax
push ebp
push str.ModifySetConfig64
push ebx
call edi
cmp dword [esi + 0xe8], 8
jb 0x4396e2
mov eax, dword [esi + 0xd4]
jmp 0x4396e8
lea eax, [esi + 0xd4]
push eax
push ebp
push str.TempModifySetConfig
push ebx
call edi
cmp dword [esi + 0xe8], 8
jb 0x439703
mov eax, dword [esi + 0xd4]
jmp 0x439709
lea eax, [esi + 0xd4]
push eax
push ebp
push 0x4cc96c
push ebx
call edi
pop edi
lea eax, [esi + 0xb4]
cmp dword [eax + 0x18], 8
pop ebp
pop ebx
jb 0x439727
mov eax, dword [eax + 4]
jmp 0x43972a
add eax, 4
add esi, 0x98
cmp dword [esi + 0x18], 8
jb 0x43973b
mov esi, dword [esi + 4]
jmp 0x43973e
add esi, 4
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
pop esi
ret
Function at 0x43974a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x244]
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor ebx, ebx
push 0x206
lea eax, [ebp - 0x232]
push ebx
push eax
mov word [ebp - 0x234], bx
call fcn.0045fa70
xor eax, eax
mov word [ebp - 0x2c], bx
lea edi, [ebp - 0x2a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x18], bx
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
stosw word es:[edi], ax
lea eax, [ebp - 0x2c]
push 0x4c4cf4
push eax
call fcn.00460936
movzx eax, word [ebp - 0x23e]
push eax
movzx eax, word [ebp - 0x242]
push eax
movzx eax, word [ebp - 0x244]
push eax
lea eax, [ebp - 0x18]
push str._.4d_.2d_.2d
push eax
call fcn.00460936
add esp, 0x2c
cmp dword [esi + 0x104], 8
jb 0x4397f1
mov eax, dword [esi + 0xf0]
jmp 0x4397f7
lea eax, [esi + 0xf0]
push eax
push ebx
mov ebx, str.LastUseDay
push ebx
mov edi, str.Setting
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
movzx ecx, word [ebp - 0x244]
movzx edx, word [ebp - 0x242]
imul ecx, ecx, 0x64
add ecx, edx
movzx edx, word [ebp - 0x23e]
imul ecx, ecx, 0x64
add ecx, edx
cmp eax, ecx
je 0x4398dc
cmp dword [esi + 0x104], 8
jb 0x439843
mov eax, dword [esi + 0xf0]
jmp 0x439849
lea eax, [esi + 0xf0]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ebx, str.UseDayTotal
lea eax, [ebp - 0x234]
push ebx
push eax
call fcn.0045fd44
cmp dword [esi + 0x104], 8
pop ecx
pop ecx
jb 0x43987b
mov eax, dword [esi + 0xf0]
jmp 0x439881
lea eax, [esi + 0xf0]
push eax
push 0
lea eax, [ebp - 0x234]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
inc eax
push eax
lea eax, [ebp - 0x18]
push 0x4c4cf4
push eax
call fcn.00460936
lea eax, [ebp - 0x234]
push ebx
push eax
call fcn.0045fd44
add esp, 0x14
cmp dword [esi + 0x104], 8
jb 0x4398c3
mov esi, dword [esi + 0xf0]
jmp 0x4398c9
add esi, 0xf0
push esi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x234]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045fa14
leave
ret
Function at 0x439c9f
Capabilities:
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x3a8]
sub esp, 0x428
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x3a4], eax
push ebx
push esi
push edi
mov edi, 0x206
xor ebx, ebx
push edi
lea eax, [ebp - 0x6a]
push ebx
push eax
mov esi, ecx
mov word [ebp - 0x6c], bx
call fcn.0045fa70
push edi
lea eax, [ebp + 0x19e]
push ebx
push eax
mov word [ebp + 0x19c], bx
call fcn.0045fa70
mov eax, dword [esi + 0x24]
add esp, 0x18
push eax
mov eax, dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x78]
call fcn.00422c4c
mov eax, dword [esi + 0x24]
push eax
push dword [eax + 4]
lea ecx, [ebp - 0x80]
call fcn.00422c4c
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x78]
call fcn.004335b3
test al, al
jne 0x439e5e
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ebx, str.HotKey
lea ecx, [ebp - 0x78]
call fcn.00422c28
mov eax, dword [eax + 4]
mov dword [ebp - 0x70], eax
add eax, 0xc
push eax
call fcn.0045fe9a
test eax, eax
pop ecx
jle 0x439e33
mov eax, dword [ebp - 0x70]
add eax, 0xc
push eax
lea eax, [ebp - 0x6c]
push str.Is_s
push eax
call fcn.00460936
add esp, 0xc
cmp dword [esi + 0xb0], 8
jb 0x439d75
mov eax, dword [esi + 0x9c]
jmp 0x439d7b
lea eax, [esi + 0x9c]
push eax
push 0x104
lea eax, [ebp + 0x19c]
push eax
push 0x4c9468
lea eax, [ebp - 0x6c]
push eax
push ebx
call edi
lea eax, [ebp + 0x19c]
push 0x4c9468
push eax
call fcn.004615f0
test eax, eax
pop ecx
pop ecx
je 0x439dc0
lea eax, [ebp + 0x19c]
push eax
call fcn.00460ebc
pop ecx
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ecx + 4]
mov byte [ecx], al
mov eax, dword [ebp - 0x70]
add eax, 0xc
push eax
lea eax, [ebp - 0x6c]
push str.Use_s
push eax
call fcn.00460936
add esp, 0xc
cmp dword [esi + 0xb0], 8
jb 0x439de9
mov eax, dword [esi + 0x9c]
jmp 0x439def
lea eax, [esi + 0x9c]
push eax
push 0x104
lea eax, [ebp + 0x19c]
push eax
push str.nothing
lea eax, [ebp - 0x6c]
push eax
push ebx
call edi
lea eax, [ebp + 0x19c]
push str.nothing
push eax
call fcn.004615f0
test eax, eax
pop ecx
pop ecx
je 0x439e33
lea eax, [ebp + 0x19c]
push eax
mov eax, dword [ebp - 0x70]
push dword [eax + 8]
call fcn.0045fd44
pop ecx
pop ecx
lea ecx, [ebp - 0x78]
call fcn.004395dd
mov eax, dword [esi + 0x24]
push eax
push dword [eax + 4]
lea ecx, [ebp - 0x80]
call fcn.00422c4c
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x78]
call fcn.004335b3
test al, al
je 0x439d2c
mov ecx, dword [ebp + 0x3a4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045fa14
add ebp, 0x3a8
leave
ret
Function at 0x439e76
Capabilities:
Copy file

Disassembly:
push ebp
lea ebp, [esp - 0x3ac]
sub esp, 0x42c
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x3a8], eax
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x24]
push edi
push eax
mov eax, dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x70]
call fcn.00422c4c
mov eax, dword [esi + 0x24]
push eax
push dword [eax + 4]
lea ecx, [ebp - 0x7c]
call fcn.00422c4c
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x70]
call fcn.004335b3
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x439fba
lea ecx, [ebp - 0x70]
call fcn.00422c28
mov ebx, dword [eax + 4]
mov eax, dword [ebx + 8]
mov dword [ebp - 0x74], eax
mov eax, dword [ebx + 4]
cmp byte [eax], 0
lea eax, [ebp + 0x1a0]
je 0x439ef3
push 0x4c4484
jmp 0x439ef8
push 0x4c4480
push 0x4c3d68
push eax
call fcn.00460936
add esp, 0xc
add ebx, 0xc
push ebx
lea eax, [ebp - 0x68]
push str.Is_s
push eax
mov dword [ebp - 0x80], ebx
call fcn.00460936
add esp, 0xc
cmp dword [esi + 0xb0], 8
jb 0x439f2f
mov eax, dword [esi + 0x9c]
jmp 0x439f35
lea eax, [esi + 0x9c]
push eax
lea eax, [ebp + 0x1a0]
push eax
lea eax, [ebp - 0x68]
push eax
mov ebx, str.HotKey
push ebx
call edi
push dword [ebp - 0x80]
lea eax, [ebp - 0x68]
push str.Use_s
push eax
call fcn.00460936
push dword [ebp - 0x74]
lea eax, [ebp + 0x1a0]
push 0x4c3d68
push eax
call fcn.00460936
add esp, 0x18
cmp dword [esi + 0xb0], 8
jb 0x439f82
mov eax, dword [esi + 0x9c]
jmp 0x439f88
lea eax, [esi + 0x9c]
push eax
lea eax, [ebp + 0x1a0]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
call edi
lea ecx, [ebp - 0x70]
call fcn.004395dd
mov eax, dword [esi + 0x24]
push eax
push dword [eax + 4]
lea ecx, [ebp - 0x7c]
call fcn.00422c4c
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x70]
call fcn.004335b3
test al, al
je 0x439ecd
cmp dword [esi + 0xe8], 8
jb 0x439fd3
mov eax, dword [esi + 0xd4]
jmp 0x439fd9
lea eax, [esi + 0xd4]
push eax
push 0x4c4484
push str.ModifyHotKey
mov ebx, str.SetModify
push ebx
call edi
cmp dword [esi + 0xe8], 8
jb 0x439ffd
mov eax, dword [esi + 0xd4]
jmp 0x43a003
lea eax, [esi + 0xd4]
push eax
push 0x4c4484
push str.ModifyHotKey64
push ebx
call edi
cmp dword [esi + 0xe8], 8
jb 0x43a022
mov eax, dword [esi + 0xd4]
jmp 0x43a028
lea eax, [esi + 0xd4]
push eax
push 0x4c4484
push str.TempModifyHotKey
push ebx
call edi
cmp dword [esi + 0xe8], 8
jb 0x43a047
mov eax, dword [esi + 0xd4]
jmp 0x43a04d
lea eax, [esi + 0xd4]
push eax
push 0x4c4484
push str.TempModifyHotKey64
push ebx
call edi
lea eax, [esi + 0xb4]
cmp dword [eax + 0x18], 8
jb 0x43a06c
mov eax, dword [eax + 4]
jmp 0x43a06f
add eax, 4
add esi, 0x98
cmp dword [esi + 0x18], 8
jb 0x43a080
mov esi, dword [esi + 4]
jmp 0x43a083
add esi, 4
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp + 0x3a8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045fa14
add ebp, 0x3ac
leave
ret