joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4024e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push edi
mov edi, dword [esp + 0x14]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebp, eax
test ebp, ebp
jne 0x40250a
pop edi
pop ebp
xor eax, eax
pop ebx
ret
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402504
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40254a
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x402546
cmp esi, ecx
jae 0x40254a
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x402534
cmp esi, ecx
jb 0x402551
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
pop ebx
ret

Function at 0x402560
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push edi
mov edi, dword [esp + 0x10]
mov ebp, ecx
push edi
call fcn.004310c8
mov ebx, eax
test ebx, ebx
jne 0x40257b
pop edi
pop ebp
pop ebx
ret 4
mov eax, edi
shr eax, 4
push esi
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [esp + 0x14], eax
test eax, eax
je 0x40264a
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40264a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40264a
push dword [esp + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x4025e2
nop
cmp esi, ecx
jae 0x40264a
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x4025d0
cmp esi, ecx
jae 0x40264a
movzx eax, word [esi]
test ax, ax
je 0x40264a
mov edx, dword [ebp]
mov edi, eax
mov ebx, eax
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x402614
push edi
mov ecx, ebp
call fcn.00402b70
mov edx, dword [ebp]
movzx ebx, word [esi]
movzx ecx, bx
lea eax, [esi + 2]
push ecx
push eax
push edi
push edx
call fcn.0044ef63
push eax
call fcn.00402cb0
mov eax, dword [ebp]
add esp, 0x14
cmp edi, dword [eax - 8]
jg 0x402653
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebp]
pop esi
mov word [eax + edi*2], cx
lea eax, [ecx + 1]
pop edi
pop ebp
pop ebx
ret 4
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
ret 4
push 0x80070057
call fcn.00402d40
int3
Function at 0x402660
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
xor dl, dl
push ebx
push ebp
mov ebp, ecx
push esi
push edi
test eax, eax
je 0x402754
test eax, 0xffff0000
jne 0x402754
movzx edi, ax
push edi
call fcn.004310c8
mov ebx, eax
test ebx, ebx
je 0x402752
mov eax, edi
shr eax, 4
push 6
inc eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [esp + 0x14], eax
test eax, eax
je 0x402752
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402752
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402752
push dword [esp + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x4026f4
cmp esi, ecx
jae 0x402752
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x4026e2
cmp esi, ecx
jae 0x402752
movzx eax, word [esi]
test ax, ax
je 0x402752
mov edx, dword [ebp]
mov edi, eax
mov ebx, eax
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x402726
push edi
mov ecx, ebp
call fcn.00402b70
mov edx, dword [ebp]
movzx ebx, word [esi]
movzx ecx, bx
lea eax, [esi + 2]
push ecx
push eax
push edi
push edx
call fcn.0044ef63
push eax
call fcn.00402cb0
mov eax, dword [ebp]
add esp, 0x14
cmp edi, dword [eax - 8]
jg 0x40275d
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebp]
mov word [eax + edi*2], cx
mov dl, 1
pop edi
pop esi
pop ebp
mov al, dl
pop ebx
ret 4
push 0x80070057
call fcn.00402d40
int3
Function at 0x402d60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46578d
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x486540]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x32], 0
mov dword [ebp - 0x2e], 0
mov dword [ebp - 0x2a], 0
mov dword [ebp - 0x26], 0
mov word [ebp - 0x22], ax
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 0x38], 1
mov word [ebp - 0x34], ax
call fcn.00430fae
mov ecx, eax
test ecx, ecx
je 0x402f54
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x14]
push str.CrystalDiskMark_08X
push eax
call fcn.00408310
mov esi, dword [ebp - 0x14]
add esp, 0xc
push esi
push 8
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
mov dword [ebp - 0x14], edi
test edi, edi
je 0x402f1e
push 8
push 0
push 0
push 0xf001f
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x402f1e
push 0x48ab40
lea eax, [ebp - 0x64]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x1c]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
je 0x402eb9
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
jmp 0x402f21
push 0xffffffffffffffff
push dword [0x48ab40]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push 0xffffffffffffffff
push dword [0x48ab40]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x18]
push eax
push dword [0x48ab40]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [0x48ab44]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [0x48ab40]
call edi
mov eax, dword [ebp + 8]
mov dword [0x48ab40], 0
fld qword [ebx]
fmul qword [0x47baf0]
push ebx
fstp qword [eax]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x14]
call edi
mov edi, dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x402f40
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00402d40
int3
Function at 0x407ac0
Capabilities:
Delete directory
Delete file

Disassembly:
push edi
push dword [0x48ab78]
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [0x48ab7c]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, dword fs:[0x2c]
mov edx, dword [eax]
mov eax, dword [0x48ad10]
cmp eax, dword [edx + 4]
jle 0x407b39
push 0x48ad10
call fcn.0044b47b
add esp, 4
cmp dword [0x48ad10], 0xffffffff
jne 0x407b39
call fcn.00430fae
mov ecx, eax
test ecx, ecx
je 0x407ba3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
push 0x469aa0
mov dword [0x48ad14], eax
call fcn.0044b78d
push 0x48ad10
call fcn.0044b431
add esp, 8
push 0
push 0x4733b8
mov ecx, 0x48ad14
call fcn.00402840
cmp dword [edi + 0x4b4], 1
jne 0x407b64
push 7
push str._0Fill_
mov ecx, 0x48ad14
call fcn.00402840
push 0x48ad14
push 0
push 0x9002
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0
push 0x9003
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [edi + 0x234], 0
xor eax, eax
mov dword [edi + 0x230], 0
pop edi
ret
push 0x80004005
call fcn.00402d40
int3
Function at 0x408e60
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465d4d
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x486540]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.00425090
lea eax, [edi + 0x170]
push eax
lea eax, [edi + 0x16c]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00418ce0
push str._theme.ini
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
call fcn.00418c10
mov dword [ebp - 4], 0xffffffff
or ebx, 0xffffffff
mov edx, dword [ebp - 0x14]
add esp, 0x18
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408ee3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 4
push str.ButtonTop
push str.Margin
call esi
push dword [ebp - 0x10]
mov dword [edi + 0x4c0], eax
push 0
push str.ButtonLeft
push str.Margin
call esi
push dword [ebp - 0x10]
mov dword [edi + 0x4c4], eax
push 4
push str.ButtonBottom
push str.Margin
call esi
push dword [ebp - 0x10]
mov dword [edi + 0x4c8], eax
push 0
push str.ButtonRight
push str.Margin
call esi
push dword [ebp - 0x10]
mov dword [edi + 0x4cc], eax
push 0
push str.MeterTop
push str.Margin
call esi
push dword [ebp - 0x10]
mov dword [edi + 0x4d0], eax
push 0
push str.MeterLeft
push str.Margin
call esi
push dword [ebp - 0x10]
mov dword [edi + 0x4d4], eax
push 0
push str.MeterBottom
push str.Margin
call esi
push dword [ebp - 0x10]
mov dword [edi + 0x4d8], eax
push 4
push str.MeterRight
push str.Margin
call esi
push dword [ebp - 0x10]
mov dword [edi + 0x4dc], eax
push 0
push str.CommentTop
push str.Margin
call esi
push dword [ebp - 0x10]
mov dword [edi + 0x4e0], eax
push 8
push str.CommentLeft
push str.Margin
call esi
push dword [ebp - 0x10]
mov dword [edi + 0x4e4], eax
push 0
push str.CommentBottom
push str.Margin
call esi
push dword [ebp - 0x10]
mov dword [edi + 0x4e8], eax
push 8
push str.CommentRight
push str.Margin
call esi
push dword [ebp - 0x10]
mov dword [edi + 0x4ec], eax
push 8
push str.DemoTop
push str.Margin
call esi
push dword [ebp - 0x10]
mov dword [edi + 0x4f0], eax
push 8
push str.DemoLeft
push str.Margin
call esi
push dword [ebp - 0x10]
mov dword [edi + 0x4f4], eax
push 8
push str.DemoBottom
push str.Margin
call esi
push dword [ebp - 0x10]
mov dword [edi + 0x4f8], eax
push 8
push str.DemoRight
push str.Margin
call esi
mov edx, dword [ebp - 0x10]
mov dword [edi + 0x4fc], eax
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x409071
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41fb30
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x18
push esi
push edi
push str.RtlGetNtVersionNumbers
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
test eax, eax
je 0x41fcf6
push 0x48ab50
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
push ecx
call eax
mov eax, dword [0x48ab50]
and eax, 0xfffffff
cmp dword [esp + 0xc], 0xa
mov dword [0x48ab50], eax
jne 0x41fcf6
cmp dword [esp + 0x10], 0
jne 0x41fcf6
cmp eax, 0x4563
jb 0x41fcf6
push 0x800
push 0
push str.uxtheme.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x41fcf6
push 0x31
push edi
call esi
push 0x68
push edi
mov dword [0x48ab5c], eax
call esi
push 0x6a
push edi
mov dword [0x48ab64], eax
call esi
push 0x84
push edi
call esi
push 0x85
push edi
mov dword [0x48ab70], eax
call esi
push 0x87
push edi
mov dword [0x48ab6c], eax
call esi
cmp dword [0x48ab50], 0x47ba
jae 0x41fc01
mov dword [0x48ab68], eax
jmp 0x41fc06
mov dword [0x48ab58], eax
push 0x89
push edi
call esi
push str.SetWindowCompositionAttribute
push str.user32.dll
mov dword [0x48ab60], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call esi
cmp dword [0x48ab5c], 0
mov dword [0x48ab74], eax
je 0x41fcf6
cmp dword [0x48ab64], 0
je 0x41fcf6
cmp dword [0x48ab70], 0
je 0x41fcf6
cmp dword [0x48ab6c], 0
je 0x41fcf6
mov ecx, dword [0x48ab68]
mov eax, dword [0x48ab58]
test ecx, ecx
jne 0x41fc76
test eax, eax
je 0x41fcf6
cmp dword [0x48ab60], 0
je 0x41fcf6
mov byte [0x48ab55], 1
test ecx, ecx
je 0x41fc90
push 1
call ecx
jmp 0x41fc98
test eax, eax
je 0x41fc98
push 1
call eax
call dword [0x48ab64]
call dword [0x48ab70]
test al, al
je 0x41fce6
xor eax, eax
mov dword [esp + 0x14], 0xc
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
push eax
push 0xc
push 0x42
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
je 0x41fcd6
mov al, byte [esp + 0x18]
and al, 1
jne 0x41fce6
mov al, 1
pop edi
mov byte [0x48ab54], al
movzx eax, al
pop esi
add esp, 0x18
ret
xor al, al
pop edi
mov byte [0x48ab54], al
movzx eax, al
pop esi
add esp, 0x18
ret
mov al, byte [0x48ab54]
pop edi
movzx eax, al
pop esi
add esp, 0x18
ret
Function at 0x4211b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4678d7
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
mov eax, dword [0x486540]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x218], edi
mov dword [ebp - 0x214], 0
mov dword [ebp - 4], 2
call fcn.00430fae
mov ecx, eax
test ecx, ecx
je 0x42135a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
cmp dword [ebp + 0x14], 0
lea eax, [ebp - 0x210]
mov dword [ebp - 0x214], 1
je 0x421260
push dword [esi + 0x194]
push 0x100
push eax
push 0x4733b8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x421250
jmp 0x4212eb
push dword [esi + 0x190]
push 0x100
push eax
push 0x4733b8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x421286
sub ecx, edx
lea eax, [ebp - 0x210]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00402840
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jne 0x4212fe
push dword [esi + 0x194]
lea eax, [ebp - 0x210]
push 0x100
push eax
push 0x4733b8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
jmp 0x4212e0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4212e0
sub ecx, edx
lea eax, [ebp - 0x210]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00402840
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov edx, dword [ebp + 0xc]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42131f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x42133b
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044b35e
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.00402d40
int3
Function at 0x421370
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x467925
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x486540]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 1
push 0
push 0
mov dword [ebp - 4], 0
push dword [ebp + 8]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
or edi, 0xffffffff
cmp eax, 0x20
jg 0x421421
call fcn.00430fae
mov ecx, eax
test ecx, ecx
je 0x421453
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x10]
push dword [ebp + 8]
push str.url.dll_FileProtocolHandler__s
push eax
call fcn.00408310
mov esi, dword [ebp - 0x10]
add esp, 0xc
push 1
push 0
push esi
push str.rundll32.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x421421
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x421440
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00402d40
int3
Function at 0x4264d0
Capabilities:
Read .ini file

Disassembly:
movzx ecx, byte [esp + 8]
push esi
mov eax, ecx
shl eax, 8
push edi
push dword [esp + 0x14]
or eax, ecx
shl eax, 8
or eax, ecx
push eax
push dword [esp + 0x14]
push str.Color
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [esp + 0xc]
or edi, 0xffffffff
movzx esi, al
add edx, 0xfffffff0
movzx ecx, ax
shl esi, 8
shr ecx, 8
or esi, ecx
shr eax, 0x10
movzx eax, al
shl esi, 8
or esi, eax
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42652e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x426547
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
pop edi
mov eax, esi
pop esi
ret 0xc

Function at 0x426550
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x467ecf
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
mov eax, dword [0x486540]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], 0
mov dword [ebp - 4], 1
call fcn.00430fae
mov ecx, eax
test ecx, ecx
je 0x426651
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push dword [ebp + 0xc]
mov dword [ebp - 0x214], 1
push str.ParentTheme_d
push esi
call fcn.00408310
add esp, 0xc
lea eax, [ebp - 0x210]
push dword [ebp + 0x10]
push 0x100
push eax
push 0x4733b8
push dword [esi]
push str.Info
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4265f5
sub eax, edx
mov ecx, esi
sar eax, 1
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00402840
mov byte [ebp - 4], 0
or eax, 0xffffffff
mov edi, dword [ebp + 0x10]
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x426632
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044b35e
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.00402d40
int3

Function at 0x426fe0
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x486540]
xor eax, esp
mov dword [esp + 0x11c], eax
mov eax, dword [0x486f8c]
cmp eax, 0xffffffff
jne 0x427064
push 0x118
lea eax, [esp + 8]
mov dword [0x486f8c], 0
push 0
push eax
call fcn.0044d4e0
add esp, 0xc
mov dword [esp], 0x11c
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 5
jne 0x42705f
cmp dword [esp + 8], 0
jne 0x42705f
mov dword [0x486f8c], 1
mov eax, 1
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0044b35e
add esp, 0x120
ret
mov eax, dword [0x486f8c]
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0044b35e
add esp, 0x120
ret
Function at 0x429cc0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x210
mov eax, dword [0x486540]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push esi
xor eax, eax
mov dword [esp + 0x10], 0
push edi
mov word [esp + 0x18], ax
mov esi, ecx
lea eax, [esp + 0x14]
mov dword [esp + 0xc], 0
push eax
push esi
mov ebx, edx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
xor ecx, ecx
mov dword [esp + 0x10], eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004308df
add esp, 4
mov edi, eax
push edi
push dword [esp + 0x14]
push 0
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x429dc3
mov esi, dword [sym.imp.VERSION.dll_VerQueryValueW]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
push 0x473a80
push edi
call esi
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
push 0x479350
push edi
call esi
mov eax, dword [esp + 0xc]
push str.FileVersion
mov ecx, dword [eax]
mov eax, ecx
shr eax, 0x10
push eax
movzx eax, cx
push eax
lea eax, [esp + 0x24]
push str.StringFileInfo_04X_04X_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x20]
push eax
push edi
call esi
push dword [esp + 0xc]
lea eax, [esp + 0x1c]
push 0x100
push eax
call fcn.0045210f
add esp, 0xc
test ebx, ebx
je 0x429dc3
push dword [esp + 0xc]
push 0x100
push ebx
call fcn.0045210f
add esp, 0xc
push edi
call fcn.004308da
add esp, 4
lea eax, [esp + 0x18]
mov ecx, 0x4733b8
pop edi
pop esi
pop ebx
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x429dfe
test dx, dx
je 0x429dfa
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x429dfe
add eax, 4
add ecx, 4
test dx, dx
jne 0x429dd8
xor eax, eax
jmp 0x429e03
sbb eax, eax
or eax, 1
test eax, eax
je 0x429e34
lea eax, [esp + 0xc]
push eax
call fcn.0045607f
fmul qword [0x47bae0]
add esp, 4
call fcn.0044bd70
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.0044b35e
add esp, 0x210
ret
mov ecx, dword [esp + 0x20c]
xor eax, eax
xor ecx, esp
call fcn.0044b35e
add esp, 0x210
ret