joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403180
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.00438720
mov eax, dword [0x45504c]
xor eax, ebp
mov dword [ebp - 4], eax
push ecx
lea eax, [ebp - 0x2004]
push 0x1000
push eax
call fcn.0040ce7b
lea ecx, [ebp - 0x2004]
add esp, 0xc
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4031b5
push ebx
sub ecx, edx
lea eax, [ebp - 0x2004]
sar ecx, 1
lea ebx, [ebp - 0x2004]
push 0x5c
push eax
lea ebx, [ebx + ecx*2]
call fcn.0040a80d
add esp, 8
test eax, eax
je 0x40328e
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x2004]
push 0x5c
push eax
call fcn.0040a80d
add esp, 8
test eax, eax
je 0x40321b
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x2004]
push 0x5c
push eax
call fcn.0040a80d
add esp, 8
test eax, eax
jne 0x403201
lea ecx, [ebp - 0x2004]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403224
sub ecx, edx
sar ecx, 1
push esi
lea esi, [ebp - 0x2004]
lea esi, [esi + ecx*2]
cmp esi, ebx
je 0x40328d
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop dword [eax + eax]
push 0
lea eax, [ebp - 0x2004]
push eax
call edi
test esi, esi
je 0x40328c
mov eax, 0x5c
mov word [esi], ax
lea eax, [ebp - 0x2004]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403270
sub eax, edx
lea esi, [ebp - 0x2004]
sar eax, 1
lea esi, [esi + eax*2]
cmp esi, ebx
jne 0x403250
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00408f46
mov esp, ebp
pop ebp
ret
Function at 0x4032a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4020
call fcn.00438720
mov eax, dword [0x45504c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
lea ebx, [esi + 0x10]
mov dword [ebp - 0x4018], ebx
cmp edi, 0x1c
jb 0x4034ab
mov eax, dword [esi]
mov dword [ebp - 0x401c], eax
cmp eax, 0x80000001
je 0x4032ea
cmp eax, 0x80000002
jne 0x4034ab
cmp dword [esi + 4], 0
mov dword [ebp - 0x4014], 0
jbe 0x403465
nop
mov eax, dword [ebx]
cmp edi, eax
jbe 0x403311
cmp byte [esi + eax], 0
je 0x403311
inc eax
cmp edi, eax
ja 0x403306
mov ecx, dword [ebx + 8]
add ecx, dword [ebx + 4]
cmp edi, ecx
jb 0x4034ab
cmp edi, eax
je 0x4034ab
xor eax, eax
push 0x2000
push eax
mov word [ebp - 0x2004], ax
lea eax, [ebp - 0x4004]
push eax
call fcn.0040b420
mov eax, dword [ebx]
push 0x1000
add eax, esi
mov dword [ebp - 0x4008], 0
push eax
push 0x1000
lea eax, [ebp - 0x4004]
push eax
lea eax, [ebp - 0x4008]
push eax
call fcn.0040fac8
lea eax, [ebp - 0x4004]
push eax
lea eax, [ebp - 0x2004]
push 0x1000
push eax
call fcn.0040cedf
add esp, 0x2c
cmp dword [ebp - 0x401c], 0x80000002
jne 0x4033b5
lea eax, [ebp - 0x4004]
push 0x5c
push eax
call fcn.0040a746
add esp, 8
test eax, eax
je 0x4033b5
lea ecx, [ebp - 0x2004]
call fcn.00403180
mov eax, dword [ebx + 8]
mov dword [ebp - 0x4010], eax
mov eax, dword [ebx + 4]
add eax, esi
mov dword [ebp - 0x4020], eax
lea eax, [ebp - 0x2004]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [ebp + eax*2 - 0x2006], 0x5c
je 0x403446
push 0
push 0x8000080
push 2
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x2004]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x403495
push 0
lea eax, [ebp - 0x400c]
push eax
push dword [ebp - 0x4010]
push dword [ebp - 0x4020]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403478
mov eax, dword [ebp - 0x4010]
cmp dword [ebp - 0x400c], eax
jne 0x403478
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x4018]
mov ecx, dword [ebp - 0x4014]
add ebx, 0xc
inc ecx
mov dword [ebp - 0x4018], ebx
mov dword [ebp - 0x4014], ecx
cmp ecx, dword [esi + 4]
jb 0x403300
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408f46
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 0x1d
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408f46
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x52
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408f46
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0xd
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408f46
mov esp, ebp
pop ebp
ret
Function at 0x405bc0
Capabilities:
Create directory

Disassembly:
sub esp, 0x14
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x28]
test edi, edi
je 0x405be2
mov dword [edi], 0
mov byte [edi + 4], 0
mov dword [edi + 8], 0x443328
mov eax, dword [esp + 0x24]
test eax, eax
je 0x405c08
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x405bf4
mov ecx, dword [esi]
cmp dword [eax + 0x14], 8
jb 0x405bfc
mov eax, dword [eax]
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
jmp 0x405c1b
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x405c12
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x405c27
pop edi
mov al, 1
pop esi
add esp, 0x14
ret
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [esp + 0x14], 0
lea eax, [esp + 0x14]
mov byte [esp + 0x18], 0
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x20], 0x443328
push esi
push eax
call fcn.00405fe0
add esp, 0xc
cmp dword [esp + 0xc], 3
je 0x405c6f
push str.boost::filesystem::create_directory
push edi
push esi
push ebx
call fcn.004065e0
add esp, 0x10
pop ebx
pop edi
xor al, al
pop esi
add esp, 0x14
ret
Function at 0x405fe0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440bf0
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x45504c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x60], eax
mov eax, ebx
cmp dword [ebx + 0x14], 8
jb 0x406021
mov eax, dword [ebx]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x406041
push dword [ebp - 0x60]
push ebx
push edi
call fcn.00405db0
add esp, 0xc
jmp 0x40615b
mov eax, dword [ebp - 0x60]
test eax, eax
je 0x406059
mov dword [eax], 0
mov byte [eax + 4], 0
mov dword [eax + 8], 0x443328
push esi
push ebx
call fcn.00404960
add esp, 8
mov ecx, eax
mov dword [ebp - 0x64], ecx
test esi, 0x400
je 0x406138
push ebx
call fcn.00405ca0
add esp, 4
test al, al
jne 0x406092
mov eax, dword [ebp - 0x64]
mov dword [edi], 9
mov dword [edi + 4], eax
jmp 0x40615b
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x40609c
mov eax, dword [ebx]
push eax
lea ecx, [ebp - 0x28]
call fcn.00405850
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x2000000
push 3
push 0
push 7
push 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x68], esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00401090
cmp esi, 0xffffffff
jne 0x4060f2
push dword [ebp - 0x60]
push ebx
push edi
call fcn.00405db0
add esp, 0xc
jmp 0x40615b
lea eax, [ebp - 0x5c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x40611e
push dword [ebp - 0x60]
push ebx
push edi
call fcn.00405db0
add esp, 0xc
push esi
mov dword [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40615b
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
push esi
mov dword [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x64]
and esi, 0x10
je 0x406142
mov edx, dword [ebp - 0x68]
jmp 0x406147
mov edx, ecx
mov ecx, dword [ebp - 0x68]
xor eax, eax
test esi, esi
setne al
add eax, 2
test esi, esi
mov dword [edi], eax
cmove ecx, edx
mov dword [edi + 4], ecx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00408f46
mov esp, ebp
pop ebp
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x401c66
pop dword [ebp - 0x28]
mov eax, 0x7660960a
add eax, 0x89df865c
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xfb1ac197
sub dword [ebp - 0x38], 0xacc87c4c
mov dword [ebp - 0x34], 0xa9e7e9d1
add dword [ebp - 0x34], 0x884b6274
mov dword [ebp - 0x30], 0x1fcd195
sub dword [ebp - 0x30], 0xb5b08d67
mov dword [ebp - 0x2c], 0x2c2587aa
add dword [ebp - 0x2c], 0xd3da7856
lea eax, [ebp - 0x38]
push eax
mov eax, 0xfda0d384
add eax, 0x29f5cd0
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x1d4e3af8
sub dword [ebp - 0x38], 0xa8dbd1a2
mov dword [ebp - 0x34], 0x55eb50d2
add dword [ebp - 0x34], 0xeb8110a3
mov dword [ebp - 0x30], 0xeb3e671f
sub dword [ebp - 0x30], 0x87cefab3
mov dword [ebp - 0x2c], 0xfba195b1
sub dword [ebp - 0x2c], 0xfba195b1
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xf95203c6
add eax, 0x6ee2c66
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x341f6
push 0
call eax
mov ecx, 0xc5df1413
add ecx, 0x3a212a7e
mov edx, eax
mov esi, 0x7abacee7
add esi, 0x8585a119
add esi, dword [ebp - 0x28]
mov ebx, 0x9b14390
add ebx, 0xffb01508
xor dword [ebp - 0x18], 0x836b746b
mov edi, dword [esi]
add dword [ebp - 0x10], edi
add edi, ebx
sub dword [ebp - 8], 0xaed32aee
mov dword [edx], edi
sub dword [ebp - 8], 0x8c20c416
add edx, 4
add esi, 0x6f0027f4
add esi, 0x90ffd810
loop 0x401d88
add eax, 0x994ee28d
add eax, 0x66b20a8a
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x417470
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0x12000]
push edi
or ebp, 0xffffffff
jmp 0x417492
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x417499
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x417488
mov eax, 1
add ebx, ebx
jne 0x4174ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4174bc
jne 0x4174cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4174cc
dec eax
add ebx, ebx
jne 0x4174c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4174a0
xor ecx, ecx
sub eax, 3
jb 0x4174e4
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x417556
sar eax, 1
mov ebp, eax
jmp 0x4174ef
add ebx, ebx
jne 0x4174ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4174fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x417520
inc ecx
add ebx, ebx
jne 0x41750c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x417501
jne 0x41751d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417501
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x417540
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x417531
jmp 0x41748e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x417540
add edi, ecx
jmp 0x41748e
pop esi
mov edi, esi
mov ecx, 0xe
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41755e
cmp byte [edi], 3
jne 0x41755e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x417563
lea edi, [esi + 0x15000]
mov eax, dword [edi]
or eax, eax
je 0x4175db
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1c978]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1c9b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x417590
mov ecx, edi
jns 0x4175bf
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1c9b8]
or eax, eax
je 0x4175d5
mov dword [ebx], eax
add ebx, 4
jmp 0x4175ad
call dword [esi + 0x1c9bc]
popal
jmp 0x4011a0

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10014820
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1001482f
pop dword [ebp - 0x44]
mov eax, 0x8d6f064b
add eax, 0x829241e4
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x5fb4c0ed
sub dword [ebp - 0x54], 0x11627ba2
mov dword [ebp - 0x50], 0x2673426a
sub dword [ebp - 0x50], 0xf43ff625
mov dword [ebp - 0x4c], 0xf5cf2d3c
sub dword [ebp - 0x4c], 0xa982e90e
mov dword [ebp - 0x48], 0x29768f17
sub dword [ebp - 0x48], 0x29768f17
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x6b6759ff
sub dword [ebp - 0x54], 0xf6f4f0a9
mov dword [ebp - 0x50], 0xa5757c69
add dword [ebp - 0x50], 0x9bf6e50c
mov dword [ebp - 0x4c], 0x7e047b7
sub dword [ebp - 0x4c], 0xa470db4b
mov dword [ebp - 0x48], 0x352198b6
sub dword [ebp - 0x48], 0x352198b6
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3c270
push 0
call eax
mov ecx, 0x87708afc
sub ecx, 0x87704b5f
mov edx, eax
mov ebx, 0x752f7c6b
sub ebx, 0x652ccc6b
add ebx, dword [ebp - 0x44]
mov edi, 0x88fd58ba
sub edi, 0xad3b3215
add dword [ebp - 8], 0x443335ea
mov esi, dword [ebx]
sub dword [ebp - 0x20], 0x2f12ede2
xor esi, edi
add dword [ebp - 0xc], eax
mov dword [edx], esi
add edx, 4
add ebx, 0xc507e081
sub ebx, 0xc507e07d
loop 0x10014947
add eax, 0x89118efd
add eax, 0x76ef624a
mov ebx, eax
add eax, 5
mov ecx, 0x4e52d65d
sub ecx, 0x3e52d65d
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x404628
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40463f
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x404674
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x404670
cmp edi, eax
jae 0x404674
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x404662
cmp edi, eax
jb 0x404678
xor eax, eax
jmp 0x404682
mov ax, word [edi]
neg ax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x405d5a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, eax
cmp dword [edi + 0xc], 0xffffffff
jne 0x405daf
push esi
lea esi, [ebp - 4]
call fcn.00405db5
push dword [eax]
push 0
push 0x4ae6e0
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004012f9
test esi, esi
pop esi
je 0x405da0
push edi
call fcn.0040605c
test eax, eax
jne 0x405da9
call fcn.00406286
test eax, eax
je 0x405dac
xor eax, eax
inc eax
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0xc]
pop edi
leave
ret

Function at 0x4061bc
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [edi + 0x18], 0
jne 0x4061f2
push esi
lea esi, [ebp - 4]
call fcn.00405db5
push dword [eax]
push 2
push 0x4ae708
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [edi + 0x18], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004012f9
pop esi
mov eax, dword [edi + 0x18]
leave
ret

Function at 0x406286
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [edi + 4], 0xffffffff
jne 0x4062bc
push esi
lea esi, [ebp - 4]
call fcn.00405db5
push dword [eax]
push 0
push str.debug
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [edi + 4], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004012f9
pop esi
mov eax, dword [edi + 4]
leave
ret

Function at 0x406460
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, edi
call fcn.004064ab
test eax, eax
jne 0x406474
push 0x60
pop eax
leave
ret
cmp dword [edi + 8], 0xffffffff
jne 0x4064a6
push esi
lea esi, [ebp - 4]
call fcn.00405db5
push dword [eax]
push 0x60
push str.debugdpi
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [edi + 8], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004012f9
pop esi
mov eax, dword [edi + 8]
leave
ret
Function at 0x406519
Capabilities:
Read .ini file

Disassembly:
push 4
mov eax, 0x4a2af9
call fcn.004878f8
and dword [ebp - 0x10], 0
mov edi, ecx
add edi, 0x14
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jne 0x40658c
lea esi, [ebp - 0x10]
call fcn.00405db5
and dword [ebp - 4], 0
push dword [eax]
mov eax, 0x104
push eax
push eax
mov esi, edi
call fcn.00401923
push eax
push 0x4ae7e0
push str.supportprocess
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, dword [edi]
test eax, eax
je 0x406585
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
pop ecx
mov edx, edi
call fcn.00401390
mov eax, dword [edi]
sub eax, 0x10
call fcn.00401311
add eax, 0x10
mov dword [ebx], eax
mov eax, ebx
call fcn.004879d0
ret

Function at 0x4068c8
Capabilities:
Read .ini file

Disassembly:
push 0x1c
mov eax, 0x4a2a62
call fcn.004878f8
mov edi, ecx
mov eax, dword [edi + 0x20]
add edi, 0x1c
xor ebx, ebx
cmp eax, ebx
je 0x4068f0
mov ecx, dword [edi + 8]
sub ecx, eax
sar ecx, 3
jne 0x406a1b
mov eax, dword [0x4e0530]
mov ecx, 0x4e0530
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.00405db5
mov byte [ebp - 4], 1
push dword [eax]
mov eax, 0x104
push eax
push eax
lea esi, [ebp - 0x10]
call fcn.00401923
push eax
push str.1.01.21.5
push str.supportrate
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004012f9
cmp dword [ebp - 0x10], ebx
jne 0x406950
xor eax, eax
jmp 0x40695a
push dword [ebp - 0x10]
call dword [sym.imp.MSVCR80.dll_wcslen]
pop ecx
lea edx, [ebp - 0x10]
call fcn.00401390
mov esi, 0x4ae7dc
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], ebx
push eax
lea ecx, [ebp - 0x18]
lea ebx, [ebp - 0x10]
call fcn.00406a23
jmp 0x4069f7
push eax
call dword [sym.imp.MSVCR80.dll__wtof]
fstp qword [ebp - 0x20]
mov edx, dword [edi + 4]
test edx, edx
pop ecx
jne 0x406992
xor ecx, ecx
jmp 0x40699a
mov ecx, dword [edi + 8]
sub ecx, edx
sar ecx, 3
test edx, edx
je 0x4069ba
mov eax, dword [edi + 0xc]
sub eax, edx
sar eax, 3
cmp ecx, eax
jae 0x4069ba
mov eax, dword [edi + 8]
fld qword [ebp - 0x20]
fstp qword [eax]
add eax, 8
mov dword [edi + 8], eax
jmp 0x4069d8
mov ebx, dword [edi + 8]
cmp edx, ebx
jbe 0x4069c7
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
push ebx
push edi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
mov eax, edi
call fcn.00406b14
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004012f9
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x18]
lea ebx, [ebp - 0x10]
call fcn.00406a23
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
jne 0x40697c
add eax, 0xfffffff0
call fcn.004012f9
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004012f9
mov eax, edi
call fcn.004879d0
ret
Function at 0x408d6b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408dce
cmp dword [ebp + 0xc], 1
je 0x408da7
cmp dword [ebp + 0xc], 2
je 0x408da7
push 0xd
pop eax
jmp 0x408dce
test edi, edi
mov eax, dword [ebp - 4]
je 0x408dc8
test eax, eax
je 0x408dc4
test al, 1
jne 0x408da2
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x408dc8
jmp 0x408da2
and word [edi], 0
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8

Function at 0x408ed7
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x4a293c
call fcn.004878f8
mov esi, ecx
call fcn.00408c76
push dword [esi]
lea eax, [ebp - 0x10]
push eax
push esi
call fcn.00409004
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], edi
je 0x408ff6
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x408ff3
lea eax, [ebp - 0x24]
mov ebx, vtable.Gdiplus::PrivateFontCollection.0
push eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], edi
call sub.gdiplus.dll_GdipNewPrivateFontCollection
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 1
push dword [ebp - 0x10]
push dword [ebp - 0x24]
call sub.gdiplus.dll_GdipPrivateAddFontFile
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x24]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call sub.gdiplus.dll_GdipGetFontCollectionFamilyCount
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
cmp eax, edi
jle 0x408fe0
xor ecx, ecx
push 8
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call sub.gdiplus.dll_GdipAlloc
mov dword [ebp - 0x1c], eax
test eax, eax
mov byte [ebp - 4], 2
je 0x408fa9
mov ecx, dword [ebp - 0x14]
push 0x408cae
push 0x409242
push ecx
lea edi, [eax + 4]
push 8
push edi
mov dword [eax], ecx
call fcn.00486e99
mov eax, edi
jmp 0x408fab
xor eax, eax
test eax, eax
mov byte [ebp - 4], 1
mov dword [esi + 4], eax
je 0x408fe0
push eax
push dword [ebp - 0x14]
lea edi, [ebp - 0x18]
lea eax, [ebp - 0x28]
call fcn.0040924c
test eax, eax
jne 0x408fdb
mov eax, dword [ebp - 0x18]
test eax, eax
jle 0x408fdb
mov ecx, dword [ebp - 0x14]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
jmp 0x408fe0
call fcn.00408c76
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x28], ebx
call sub.gdiplus.dll_GdipDeletePrivateFontCollection
mov dword [ebp - 0x28], vtable.Gdiplus::FontCollection.0
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004012f9
call fcn.004879d0
ret
Function at 0x409175
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x4dc0a8]
xor eax, ebp
mov dword [ebp + 0x194], eax
xor eax, eax
push 0x20e
push eax
mov dword [ebp - 0x80], eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x7c]
push eax
push esi
call fcn.00405f0e
mov ecx, dword [ebp + 0x194]
xor ecx, ebp
mov eax, esi
call fcn.00486d86
add ebp, 0x198
leave
ret