joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4050cb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], edx
push edi
mov edx, ecx
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
mov edi, dword [ecx]
and edi, 7
cmp dword [ebp - 4], 5
jb 0x405210
sub dword [ebp - 4], 4
add dword [ebp + 8], 5
push ebx
push esi
mov ecx, dword [ebp - 4]
lea esi, [eax + edx]
lea ebx, [edx + ecx]
cmp esi, ebx
jae 0x405112
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x405112
inc esi
jmp 0x405101
mov ecx, esi
sub ecx, eax
mov eax, esi
sub ecx, edx
sub eax, edx
cmp esi, ebx
jae 0x4051fc
cmp ecx, 2
jbe 0x40512d
xor edi, edi
jmp 0x405157
shr edi, cl
test edi, edi
je 0x405157
cmp edi, 4
ja 0x4051f1
cmp edi, 3
je 0x4051f1
mov ecx, edi
shr ecx, 1
mov cl, byte [ecx + esi + 1]
inc ecx
test cl, 0xfe
je 0x4051f1
movzx ecx, byte [esi + 4]
lea ebx, [ecx + 1]
test bl, 0xfe
jne 0x4051f1
movzx ebx, byte [esi + 3]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [esi + 2]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [esi + 1]
shl ecx, 8
or ecx, ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
add ecx, eax
add eax, 5
cmp dword [ebp + 0x10], 0
mov dword [ebp - 8], ecx
je 0x405199
add ebx, ecx
jmp 0x40519b
sub ebx, ecx
test edi, edi
je 0x4051ce
and edi, 6
mov edx, ebx
shl edi, 2
mov ecx, edi
shr edx, cl
inc edx
test dl, 0xfe
jne 0x4051c9
mov edx, 0x100
shl edx, cl
dec edx
xor ebx, edx
cmp dword [ebp + 0x10], 0
je 0x4051c6
add ebx, dword [ebp - 8]
jmp 0x4051c9
sub ebx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
xor edi, edi
mov ecx, ebx
mov byte [esi + 1], bl
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, ebx
shr ebx, 0x18
and bl, 1
shr ecx, 0x10
neg bl
mov byte [esi + 3], cl
mov byte [esi + 4], bl
jmp 0x4050f8
or edi, 8
shr edi, 1
inc eax
jmp 0x4050f8
push 2
pop edx
pop esi
shr edi, cl
cmp edx, ecx
mov edx, dword [ebp + 0xc]
sbb ecx, ecx
pop ebx
not ecx
and ecx, edi
mov dword [edx], ecx
pop edi
leave
ret 0xc
Function at 0x401be0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40ac7f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x22c
mov eax, dword [0x4102bc]
push ebx
push esi
xor eax, ebp
mov esi, ecx
push edi
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x10], eax
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_2]
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], 0
call fcn.00406e00
mov bl, 1
push 0x80000002
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], bl
call fcn.00406e30
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x220], esp
push str.SoftwareTTODCAJViewer
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_3]
lea ecx, [ebp - 0x230]
call fcn.00406ef0
test eax, eax
je 0x401cf0
push ecx
mov ecx, esp
mov dword [ebp - 0x238], esp
push 0x40cadc
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_3]
push ecx
mov ecx, esp
mov dword [ebp - 0x234], esp
push str.TargetDir
mov byte [ebp - 4], 2
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_3]
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], bl
call fcn.00407020
push eax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 3
call dword [0x40c15c]
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], bl
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
push 0x104
lea ecx, [ebp - 0x21c]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetBuffer]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x21c]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::ReleaseBuffer]
lea edi, [esi + 0x120]
mov ecx, edi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
lea ecx, [ebp - 0x21c]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CompareNoCase]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendA]
jne 0x401d4b
push 0
push 0x2b
lea ecx, [ebp - 0x218]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x401d42
push str.TTKNBin
lea edx, [ebp - 0x218]
push edx
call ebx
jmp 0x401d5d
push 0
push 0
call sub.MSVCR71.dll__CxxThrowException
mov ecx, edi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
lea eax, [ebp - 0x218]
push eax
call esi
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x114]
push edx
call esi
push 0x40cb8c
lea eax, [ebp - 0x114]
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [ebp - 0x114]
push ecx
call edi
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x114]
push eax
call esi
push 0x40cb80
lea ecx, [ebp - 0x114]
push ecx
call ebx
lea edx, [ebp - 0x114]
push edx
call edi
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x114]
push ecx
call esi
push str.clientcc.dll
lea edx, [ebp - 0x114]
push edx
call ebx
lea eax, [ebp - 0x114]
push eax
call edi
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.00407290
lea ecx, [ebp - 0x21c]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a00a
mov esp, ebp
pop ebp
ret
Function at 0x401e90
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40acdf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x124
mov eax, dword [0x4102bc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, ebp
push edi
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x10], eax
call fcn.00406e00
xor ebx, ebx
push 0x80000001
lea ecx, [ebp - 0x130]
mov dword [ebp - 4], ebx
call fcn.00406e30
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x118], esp
push str.SoftwareTTKNCAJViewerConfig
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_3]
lea ecx, [ebp - 0x130]
call fcn.00406ef0
push ecx
mov ecx, esp
mov dword [ebp - 0x120], esp
push 0x40cadc
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_3]
push ecx
mov ecx, esp
mov dword [ebp - 0x11c], esp
push str.My_eBooks
mov byte [ebp - 4], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_3]
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], bl
call fcn.00407020
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call dword [0x40c15c]
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], bl
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::IsEmpty]
test al, al
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
je 0x401fd5
push 1
push 5
lea ecx, [ebp - 0x114]
push ecx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push str.My_eBooks
lea edx, [ebp - 0x114]
push edx
call edi
lea eax, [ebp - 0x114]
push eax
mov ecx, esi
call dword [0x40c150]
push ecx
mov ecx, esp
mov dword [ebp - 0x11c], esp
push esi
call dword [0x40c1e4]
push ecx
mov ecx, esp
mov dword [ebp - 0x120], esp
push str.My_eBooks
mov byte [ebp - 4], 3
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_3]
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], bl
call fcn.00407170
jmp 0x401feb
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x40200b
lea eax, [ebp - 0x114]
push eax
call fcn.00406a60
add esp, 4
push str.My_Notes
lea ecx, [ebp - 0x114]
push ecx
call edi
push ebx
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.My_Bookcase
lea ecx, [ebp - 0x114]
push ecx
call edi
push ebx
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x114]
push eax
mov ecx, esi
call dword [0x40c150]
lea ecx, [ebp - 0x130]
mov dword [ebp - 4], 0xffffffff
call fcn.00407290
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a00a
mov esp, ebp
pop ebp
ret 4
Function at 0x402760
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40ad69
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
push str.DLMNGR_MUTEX
push 1
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4028ca
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call sub.MFC71.DLL_CWnd::FromHandle
mov eax, dword [eax + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetWindow]
push 5
push eax
call edi
push eax
call sub.MFC71.DLL_CWnd::FromHandle
mov esi, eax
test esi, esi
je 0x4028ac
mov ebx, dword [sym.imp.USER32.dll_GetPropA]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x60]
mov eax, dword [esi + 0x20]
push edx
push eax
call ebx
test eax, eax
jne 0x402800
mov eax, dword [esi + 0x20]
push 2
push eax
call edi
push eax
call sub.MFC71.DLL_CWnd::FromHandle
mov esi, eax
test esi, esi
jne 0x4027d6
jmp 0x4028ac
mov ecx, dword [esi + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x402817
push 9
mov ecx, esi
call sub.MFC71.DLL_CWnd::ShowWindow
mov edx, dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_SetForegroundWindow]
push edx
call edi
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetLastActivePopup]
push eax
call sub.MFC71.DLL_CWnd::FromHandle
mov ecx, dword [eax + 0x20]
push ecx
call edi
lea ecx, [ebp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetLength]
test eax, eax
jle 0x4028ac
lea ecx, [ebp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetLength]
lea ecx, [ebp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
mov edx, 0x410360
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x402860
mov eax, 0x410360
mov dword [0x410b88], 1
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402880
sub eax, edx
push 0x410b88
inc eax
push 0
mov dword [0x410b8c], eax
mov dword [0x410b90], 0x410360
mov edx, dword [esi + 0x20]
push 0x4a
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [ebp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [ebp - 0xc]
mov eax, 1
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x406250
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40b219
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
push edi
xor edi, edi
mov ecx, esi
mov dword [esp + 8], edi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetManager]
push eax
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x24]
mov ecx, edi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetLength]
push eax
mov ecx, edi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetLength]
push eax
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::Concatenate]
mov esi, dword [esp + 0x30]
add esp, 0x14
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call dword [0x40c1e4]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x406a60
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x4102bc]
push ebx
xor eax, ebp
push esi
mov dword [esp + 0x220], eax
mov eax, dword [ebp + 8]
push edi
push eax
lea eax, [esp + 0x11c]
push eax
mov word [esp + 0x14], 0x5c
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, dword [sym.imp.MSVCR71.dll_strtok]
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x11c]
push edx
call ebx
add esp, 8
test eax, eax
je 0x406b41
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406ac5
lea edi, [esp + 0x10]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x406ad3
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x10]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x406af0
mov ax, word [0x40d9f4]
mov word [edi], ax
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406b08
sub eax, edx
cmp eax, 3
jbe 0x406b31
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x406b31
push eax
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [esp + 0xc]
push eax
push 0
call ebx
add esp, 8
test eax, eax
jne 0x406ac3
mov ecx, dword [esp + 0x224]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0040a00a
mov esp, ebp
pop ebp
ret
Function at 0x406e60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 4]
push eax
mov esi, ecx
push 1
push 0
lea ecx, [esi + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
mov ecx, dword [esi + 4]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov dword [esi], eax
lea ecx, [esp + 0x10]
jne 0x406ed8
push eax
push eax
lea edx, [esp + 0x10]
push edx
push eax
mov dword [esp + 0x18], 1
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 4]
push ecx
mov dword [esi], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esi], 0
lea ecx, [esp + 0x10]
jne 0x406ed8
mov esi, dword [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov eax, esi
pop esi
add esp, 8
ret 4
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
xor eax, eax
pop esi
add esp, 8
ret 4

Function at 0x407020
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x40b392
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
mov eax, dword [0x4102bc]
xor eax, esp
push ebx
push esi
push edi
mov edi, dword [esp + 0x12c]
mov dword [esp + 0x118], eax
mov esi, ecx
mov dword [esp + 0x10], 0
push ecx
lea eax, [esp + 0x134]
mov ebx, 1
mov ecx, esp
mov dword [esp + 0x10], esp
push eax
mov dword [esp + 0x12c], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], 0xff
call dword [0x40c1e4]
mov ecx, esi
call fcn.00406e60
cmp eax, ebx
mov dword [esp + 0x14], eax
je 0x40709e
cmp eax, 2
jne 0x407105
lea edx, [esp + 0xc]
push edx
push 0x20019
push 0
lea ecx, [esi + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov dword [esi], eax
jne 0x407105
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
lea ecx, [esp + 0x140]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
mov edx, dword [esp + 0x1c]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov dword [esi], eax
je 0x4070f6
xor ebx, ebx
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x407117
lea ecx, [esp + 0x134]
push ecx
mov ecx, edi
call dword [0x40c1e4]
jmp 0x407124
lea edx, [esp + 0x18]
push edx
mov ecx, edi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_3]
lea ecx, [esp + 0x130]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x134]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 0x11c]
mov eax, edi
pop edi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x114]
pop esi
pop ebx
xor ecx, esp
call fcn.0040a00a
add esp, 0x11c
ret 0xc
Function at 0x407170
Capabilities:
Set registry value

Disassembly:
sub esp, 0x108
mov eax, dword [0x4102bc]
xor eax, esp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x118]
mov dword [esp + 0x10c], eax
mov edi, 1
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetLength]
cmp eax, 0xfe
jg 0x4071e0
lea ecx, [esp + 0x118]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
lea edx, [esp + 0xc]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x4071b2
lea eax, [esp + 8]
push eax
push 0x20006
push 0
lea ecx, [esi + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
mov ecx, dword [esi + 4]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4071fe
lea ecx, [esp + 0x114]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x118]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
xor eax, eax
jmp 0x407271
lea eax, [esp + 0xc]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407205
sub eax, edx
inc eax
push eax
lea edx, [esp + 0x10]
push edx
push 1
push 0
lea ecx, [esp + 0x124]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x407238
xor edi, edi
mov eax, dword [esi + 8]
test eax, eax
jne 0x40724a
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x114]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x118]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov eax, edi
mov ecx, dword [esp + 0x10c]
pop edi
pop esi
xor ecx, esp
call fcn.0040a00a
add esp, 0x108
ret 8
Function at 0x407940
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40b3ac
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
mov eax, dword [0x4102bc]
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, ebp
push esi
mov dword [ebp - 0x10], eax
call fcn.00407630
mov edi, eax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4079cf
test edi, edi
je 0x4079cf
lea ecx, [ebp - 0x118]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_2]
push 0xb2
lea ecx, [ebp - 0x118]
mov dword [ebp - 4], 0
call dword [sym.imp.MFC71.DLL_ATL::CStringT::LoadStringA]
push 0x10
lea ecx, [ebp - 0x118]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x118]
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x407af7
push ebx
push 0x104
lea eax, [ebp - 0x114]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test edi, edi
je 0x407a59
push 0x40dbd0
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [ebp - 0x114]
sub edx, 3
add eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
lea ecx, [ebp - 0x128]
push ecx
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x410cd4]
test eax, eax
je 0x407af6
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x40dbcc
lea edx, [ebp - 0x114]
push edx
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], esi
mov dword [ebp - 0x11c], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x114]
sub ecx, 3
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
mov ebx, eax
neg esi
push 0
sbb esi, esi
lea eax, [ebp - 0x124]
and esi, eax
push esi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x410cd4]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
push edi
call sub.MFC71.DLL_operator_delete_1
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop edi
xor ecx, ebp
pop esi
call fcn.0040a00a
mov esp, ebp
pop ebp
ret 0xc

Function at 0x407cc0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, ecx
lea edi, [esi + 0x260]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
add esi, 0x115
push esi
push 0
push eax
push 0x40dbe4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x407de0
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
lea edi, [esi + 0x260]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add esi, 0x115
push esi
push 0
push str.PriorityPage
push 0x40dbe4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebx, eax
test ebx, ebx
je 0x407e27
push esi
push 0x40dbfc
push str.PriorityPage
push 0x40dbe4
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x407e40
Capabilities:
Read .ini file

Disassembly:
push esi
push edi
mov esi, ecx
lea edi, [esi + 0x260]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add esi, 0x115
push esi
push 0
push str.DownloadCurPage
push str.BookInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
ret

Function at 0x407ec0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40b3f9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], edi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_2]
push 0x104
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], edi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetBuffer]
lea edi, [esi + 0x260]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
add esi, 0x115
push esi
push 0x104
push ebx
push 0x40cadc
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::ReleaseBuffer]
mov esi, dword [ebp + 8]
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
call dword [0x40c1e4]
lea ecx, [ebp - 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x408140
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esi + 0x10]
push eax
call edi
add esi, 0x115
push esi
call edi
pop edi
pop esi
ret