joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40656d
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, 0x4a8a07
call fcn.004a7044
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00405e5d
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4065b8
xor esi, esi
inc esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405cd9
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push dword [ebp + 8]
call esi
test eax, eax
jne 0x406599
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov ebx, 0xb7
cmp eax, ebx
je 0x406599
lea ecx, [ebp - 0x10]
call fcn.00457cbb
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
jne 0x4065ef
xor esi, esi
jmp 0x40659c
push eax
call fcn.0040656d
test eax, eax
pop ecx
je 0x4065eb
push 0
push dword [ebp + 8]
call esi
test eax, eax
jne 0x406599
call edi
cmp eax, ebx
jne 0x4065eb
jmp 0x406599

Function at 0x406651
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x406668
test al, 0x10
je 0x406668
xor eax, eax
inc eax
ret
xor eax, eax
ret

Function at 0x408f34
Capabilities:
Create directory

Disassembly:
mov eax, 0x4a9061
call fcn.004a7044
sub esp, 0x38
push ebx
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x28]
call fcn.0040907d
lea eax, [ebp + 8]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x28]
mov dword [ebp + 8], 0x5c
call fcn.0040910b
cmp eax, 0xffffffff
je 0x40902b
push eax
lea eax, [ebp - 0x28]
push eax
lea esi, [ebp - 0x44]
call fcn.004090a9
cmp dword [eax + 0x18], 8
jb 0x408f88
mov eax, dword [eax + 4]
jmp 0x408f8b
add eax, 4
push ebx
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push ebx
push 1
lea esi, [ebp - 0x44]
mov edi, eax
call fcn.004068a4
cmp edi, ebx
je 0x408fe0
cmp edi, 0x50
je 0x408fe0
cmp edi, 0xb7
je 0x408fe0
cmp edi, ebx
jle 0x408fc2
and edi, 0xffff
or edi, 0x80070000
push ebx
push 1
lea esi, [ebp - 0x28]
call fcn.004068a4
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x408fec
lea eax, [ebp - 0x24]
push ebx
push 0x80
push 1
push ebx
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x409020
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x40901c
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x408fc2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
jmp 0x408fc2
mov edi, 0x80070057
jmp 0x408fc2
Function at 0x40941b
Capabilities:
Set registry value

Disassembly:
push edi
xor edi, edi
cmp dword [esi], edi
je 0x409449
push dword [esp + 0xc]
call fcn.0047a28a
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0x10]
push 1
push edi
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x409449
inc edi
mov eax, edi
pop edi
ret 8

Function at 0x409463
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
mov dword [esi], eax
push ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
mov dword [edi], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x4094ec
push ebx
call fcn.00476743
pop ecx
push eax
push ebx
push dword [ebp - 8]
mov dword [ebp - 4], eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4094dd
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4b85bc
push dword [ebp - 4]
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4094dd
cmp dword [ebp - 0xc], ebx
je 0x4094dd
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
mov dword [edi], ecx
mov eax, dword [eax + 0xc]
mov dword [esi], eax
mov dword [ebp - 0x14], 1
cmp dword [ebp - 4], 0
je 0x4094ec
push dword [ebp - 4]
call fcn.004792c4
pop ecx
mov eax, dword [ebp - 0x14]
pop ebx
leave
ret

Function at 0x409528
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4a8c74
call fcn.004a7044
sub esp, 0x20c
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov ecx, 0x4d92a0
mov dword [ebp - 0x10], edi
call fcn.00405ea0
push 0x206
lea eax, [ebp - 0x216]
mov dword [ebp - 4], edi
push edi
push eax
mov dword [ebp - 0x10], 1
mov word [ebp - 0x218], di
call fcn.00477100
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.00406078
push esi
call fcn.0040a672
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x409683
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x11c
push esi
push edi
mov esi, 0x11c
push esi
xor edi, edi
lea eax, [ebp - 0xa4]
push edi
push eax
call fcn.00477100
add esp, 0xc
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
cmp eax, edi
jne 0x4096dc
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], 0x114
call esi
cmp eax, edi
je 0x40979f
mov eax, dword [ebp - 0x94]
dec eax
je 0x40978b
dec eax
jne 0x40979f
mov eax, dword [ebp - 0xa0]
mov esi, dword [ebp - 0x9c]
xor edx, edx
push 6
pop ecx
inc edx
cmp eax, ecx
jne 0x409729
cmp esi, edx
jne 0x409717
xor eax, eax
cmp byte [ebp + 0x76], dl
setne al
add eax, 8
jmp 0x409787
cmp esi, edi
jne 0x409761
xor eax, eax
cmp byte [ebp + 0x76], dl
setne al
lea eax, [eax + eax + 7]
jmp 0x409787
cmp eax, 5
jne 0x409753
cmp dword [ebp - 0x9c], 2
jne 0x40973a
push eax
jmp 0x40975a
cmp dword [ebp - 0x9c], 1
jne 0x409747
mov edi, ecx
jmp 0x40979f
cmp dword [ebp - 0x9c], edi
jne 0x40979f
push 3
jmp 0x40975a
cmp eax, 4
ja 0x40975d
push 4
pop edi
jmp 0x40979f
cmp eax, ecx
jb 0x40979f
cmp esi, 2
jae 0x40976a
cmp eax, ecx
jbe 0x409771
cmp byte [ebp + 0x76], dl
je 0x409782
cmp eax, ecx
jb 0x409778
cmp esi, 2
jae 0x40977c
cmp eax, ecx
jbe 0x40979f
cmp byte [ebp + 0x76], 3
jne 0x40979f
call fcn.004095ab
mov edi, eax
jmp 0x40979f
mov eax, dword [ebp - 0x98]
and eax, 0xffff0000
cmp eax, 0x45a0000
sbb edi, edi
inc edi
inc edi
mov eax, edi
pop edi
pop esi
add ebp, 0x78
leave
ret

Function at 0x409fa0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
call fcn.00408b05
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x40a04d
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0x200000
ja 0x40a04c
lea eax, [edi + 1]
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp + 8], edi
call fcn.00408b44
mov esi, eax
mov dword [ebp - 4], esi
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40a04c
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x40a04c
sub dword [ebp + 8], eax
add dword [ebp - 4], eax
cmp dword [ebp + 8], ebx
jne 0x409ffd
mov byte [esi + edi], bl
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
cmp eax, ebx
jne 0x40a037
xor eax, eax
jmp 0x40a03e
push eax
call fcn.004796d0
pop ecx
mov edx, esi
call fcn.00408b6a
mov dword [ebp - 0x10], 1
pop edi
cmp dword [ebp - 8], ebx
pop esi
pop ebx
je 0x40a05d
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 8
Function at 0x40a706
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x40a72b
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40a7ec
push edi
push 0x228
xor edi, edi
lea eax, [ebp - 0x22c]
push edi
push eax
mov dword [ebp - 4], 0x490
call fcn.00477100
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
push esi
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40a79b
lea eax, [ebp - 0x20c]
push 0x4b8798
push eax
call fcn.0047b994
test eax, eax
pop ecx
pop ecx
je 0x40a78f
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40a765
jmp 0x40a7a4
mov edi, dword [ebp - 0x228]
and dword [ebp - 4], 0
jmp 0x40a7a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x40a7c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40a7eb
push dword [ebp + 8]
push 0xf01ff
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40a7e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push edi
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret

Function at 0x40a8d1
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
test esi, esi
jne 0x40a8e3
or eax, 0xffffffff
leave
ret
push 0x110
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.00477100
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40a926
cmp dword [ebp - 0x110], 5
jne 0x40a926
cmp dword [ebp - 0x10c], 0
je 0x40a933
push esi
call fcn.0040a7ef
test eax, eax
pop ecx
jne 0x40a933
leave
ret
push esi
call fcn.0040a706
pop ecx
leave
ret
Function at 0x40a93c
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 1], bl
mov dword [ebp - 8], ebx
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], bl
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40a9fc
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push 2
push dword [ebp + 8]
call esi
test eax, eax
jne 0x40a9a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40a9fb
push edi
push dword [ebp - 0xc]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push edi
push 2
push dword [ebp + 8]
call esi
test eax, eax
je 0x40a9ef
cmp dword [edi], ebx
mov dword [ebp - 0x10], ebx
jbe 0x40a9ef
lea esi, [edi + 4]
push dword [esi]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x40a9eb
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add esi, 8
cmp eax, dword [edi]
jb 0x40a9cd
jmp 0x40a9ef
mov byte [ebp - 1], 1
cmp edi, ebx
je 0x40a9fa
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
cmp dword [ebp - 8], ebx
pop ebx
je 0x40aa0b
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov al, byte [ebp - 1]
leave
ret

Function at 0x40aa10
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
xor edi, edi
push 1
push edi
push edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
jne 0x40aa7e
push 0x110
lea eax, [ebp - 0x118]
push edi
push eax
call fcn.00477100
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 0x11c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40aa78
cmp dword [ebp - 0x118], 6
jne 0x40aa78
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40aab3
mov dword [esi], edi
xor eax, eax
jmp 0x40aab3
mov ecx, dword [ebp - 8]
xor eax, eax
cmp dword [ebp - 4], edi
push ebx
mov ebx, 0x490
jbe 0x40aaaa
lea edx, [ecx + 8]
cmp dword [edx], edi
je 0x40aaa0
inc eax
add edx, 0xc
cmp eax, dword [ebp - 4]
jb 0x40aa91
jmp 0x40aaaa
imul eax, eax, 0xc
mov eax, dword [eax + ecx]
mov dword [esi], eax
xor ebx, ebx
push ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, ebx
pop ebx
pop edi
leave
ret
Function at 0x40b448
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
xor eax, eax
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x6c], 0x67452301
mov dword [ebp - 0x68], 0xefcdab89
mov dword [ebp - 0x64], 0x98badcfe
mov dword [ebp - 0x60], 0x10325476
call fcn.0040b26f
lea eax, [ebp - 0x14]
push eax
lea esi, [ebp - 0x6c]
call fcn.0040b332
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.0040b3ce
mov eax, dword [ebp + 8]
add esp, 0x10
pop esi
leave
ret

Function at 0x40b606
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x230
push esi
mov esi, eax
cmp dword [esi + 0x14], 0x104
push edi
jb 0x40b626
xor al, al
jmp 0x40b6b3
and word [esp + 0x28], 0
push 0x208
lea eax, [esp + 0x2e]
push 0
push eax
call fcn.00477100
add esp, 0xc
cmp dword [esi + 0x18], 8
jb 0x40b64b
mov esi, dword [esi + 4]
jmp 0x40b64e
add esi, 4
push esi
lea eax, [esp + 0x2c]
push 0x105
push eax
call fcn.0047c23c
and dword [esp + 0x14], 0
add esp, 0xc
push 6
xor eax, eax
pop ecx
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x28]
mov dword [esp + 0x10], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0x10], 3
mov word [esp + 0x1c], 0x414
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp dword [esp + 0x1a], 0
jne 0x40b61f
test eax, eax
je 0x40b6b0
cmp eax, 2
je 0x40b6b0
cmp eax, 0x402
je 0x40b6b0
xor eax, eax
jmp 0x40b6b3
xor eax, eax
inc eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40e1f1
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
cmp dword [esi + 0xc], 0xffffffff
jne 0x40e255
push ebx
push edi
lea ebx, [ebp - 4]
call fcn.0040e7fe
push dword [eax]
xor ebx, ebx
push ebx
push 0x4b8c90
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00405cd9
cmp edi, ebx
je 0x40e244
lea eax, [ebp - 4]
push eax
push esi
mov dword [ebp - 4], ebx
call fcn.0040e342
test eax, eax
je 0x40e244
cmp dword [ebp - 4], ebx
jne 0x40e24d
call fcn.0040e901
test eax, eax
je 0x40e250
xor eax, eax
inc eax
pop edi
mov dword [esi + 0xc], eax
pop ebx
mov eax, dword [esi + 0xc]
pop esi
leave
ret
Function at 0x40e3e5
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x4a9b00
call fcn.004a7044
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x20]
add edi, 0x1c
test eax, eax
je 0x40e40f
mov ecx, dword [edi + 8]
sub ecx, eax
sar ecx, 3
jne 0x40e53a
mov eax, dword [0x4d92a0]
mov ecx, 0x4d92a0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
lea ebx, [ebp - 0x1c]
call fcn.0040e7fe
mov byte [ebp - 4], 1
push dword [eax]
mov eax, 0x104
push eax
push eax
lea esi, [ebp - 0x14]
call fcn.00405c04
push eax
push str.1.01.21.5
push str.supportrate
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ebx, ebx
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00405cd9
cmp dword [ebp - 0x14], ebx
jne 0x40e472
xor eax, eax
jmp 0x40e47b
push dword [ebp - 0x14]
call fcn.0047a28a
pop ecx
lea edx, [ebp - 0x14]
call fcn.00405be3
mov esi, 0x4b89a4
push esi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
push eax
lea ecx, [ebp - 0x1c]
lea ebx, [ebp - 0x14]
call fcn.0042e9cb
jmp 0x40e516
push eax
call fcn.0047cfe7
fstp qword [ebp - 0x24]
mov edx, dword [edi + 4]
test edx, edx
pop ecx
jne 0x40e4b2
xor ecx, ecx
jmp 0x40e4ba
mov ecx, dword [edi + 8]
sub ecx, edx
sar ecx, 3
test edx, edx
je 0x40e4da
mov eax, dword [edi + 0xc]
sub eax, edx
sar eax, 3
cmp ecx, eax
jae 0x40e4da
mov eax, dword [edi + 8]
fld qword [ebp - 0x24]
fstp qword [eax]
add eax, 8
mov dword [edi + 8], eax
jmp 0x40e4f7
mov ebx, dword [edi + 8]
cmp edx, ebx
jbe 0x40e4e6
call fcn.00478ccb
push ebx
push edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, edi
call fcn.0042fbef
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00405cd9
push esi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
lea ebx, [ebp - 0x14]
call fcn.0042e9cb
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], 0
jne 0x40e49d
add eax, 0xfffffff0
call fcn.00405cd9
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00405cd9
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x40e703
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi + 0x18], 0
jne 0x40e739
push ebx
lea ebx, [ebp - 4]
call fcn.0040e7fe
push dword [eax]
push 2
push 0x4b8ca0
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00405cd9
pop ebx
mov eax, dword [esi + 0x18]
leave
ret
Function at 0x40e7fe
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4a9486
call fcn.004a7044
push ecx
push ecx
and dword [ebp - 0x14], 0
push edi
lea edi, [ebp - 0x14]
call fcn.0040e73e
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
jne 0x40e83c
push 0x4b84e0
push ebx
call fcn.00405e5d
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00405cd9
jmp 0x40e8a7
add eax, 0xfffffff0
call fcn.00405b4d
add eax, 0x10
mov dword [ebp - 0x10], eax
push str.datadpiconfig.ini
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 1
call fcn.00406d75
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40e881
lea eax, [ebp - 0x14]
lea edi, [ebp - 0x10]
call fcn.00405daf
push str._ressrcchsdpisetting.ini
mov eax, edi
push eax
call fcn.00406d75
push esi
mov esi, dword [ebp - 0x10]
add esi, 0xfffffff0
mov eax, esi
call fcn.00405b4d
add eax, 0x10
mov dword [ebx], eax
mov eax, esi
call fcn.00405cd9
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00405cd9
pop esi
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
mov dword fs:[0], ecx
leave
ret

Function at 0x40e8b6
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, esi
call fcn.0040e68a
test eax, eax
jne 0x40e8ca
push 0x60
pop eax
leave
ret
cmp dword [esi + 8], 0xffffffff
jne 0x40e8fc
push ebx
lea ebx, [ebp - 4]
call fcn.0040e7fe
push dword [eax]
push 0x60
push str.debugdpi
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esi + 8], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00405cd9
pop ebx
mov eax, dword [esi + 8]
leave
ret

Function at 0x40e901
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi + 4], 0xffffffff
jne 0x40e937
push ebx
lea ebx, [ebp - 4]
call fcn.0040e7fe
push dword [eax]
push 0
push str.debug
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00405cd9
pop ebx
mov eax, dword [esi + 4]
leave
ret

Function at 0x40e93c
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x4a8a07
call fcn.004a7044
push ecx
and dword [ebp - 0x10], 0
push esi
mov esi, ecx
add esi, 0x14
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jne 0x40e9ae
push ebx
lea ebx, [ebp - 0x10]
call fcn.0040e7fe
and dword [ebp - 4], 0
push dword [eax]
mov eax, 0x104
push eax
push eax
call fcn.00405c04
push eax
push str.kxetray
push str.supportprocess
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405cd9
mov eax, dword [esi]
test eax, eax
pop ebx
je 0x40e9a7
push eax
call fcn.0047a28a
pop ecx
mov edx, esi
call fcn.00405be3
mov eax, dword [esi]
sub eax, 0x10
call fcn.00405b4d
mov ecx, dword [ebp - 0xc]
add eax, 0x10
mov dword [edi], eax
mov eax, edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x40eb38
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, word [ebp + 0xc]
push esi
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x40ebbb
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x40eb84
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x40eb84
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [ebp + 0xc], eax
jne 0x40eb88
xor eax, eax
jmp 0x40ebba
mov esi, dword [ebp + 0x10]
push edi
lea edi, [ebx + 1]
push edi
call fcn.00408b44
test eax, eax
je 0x40eba6
push ebx
push dword [ebp + 0xc]
push eax
call fcn.0047b520
add esp, 0xc
mov eax, edi
call fcn.0040a0e6
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
inc eax
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40eceb
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, 0x4a8fe6
call fcn.004a7044
push ecx
push ecx
mov eax, dword [0x4d92a0]
push ebx
push esi
push edi
mov edi, ecx
mov esi, 0x4d92a0
xor ebx, ebx
mov ecx, esi
mov dword [ebp - 0x14], ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x14], ebx
lea eax, [edi + 0xc]
jne 0x40ed23
mov eax, edi
lea edi, [ebp - 0x10]
call fcn.00405daf
mov edi, dword [ebp - 0x10]
cmp dword [edi - 0xc], ebx
je 0x40ee19
mov eax, dword [0x4d92a0]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0x14], eax
push dword [ebp + 0x10]
mov byte [ebp - 4], 1
push dword [ebp + 8]
lea eax, [ebp + 0x14]
push edi
push str._s_d._s
call fcn.004070b5
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp + 0x10], eax
je 0x40ee0e
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, ebx
je 0x40ee05
mov esi, dword [ebp + 0xc]
push ebx
lea eax, [ebp + 8]
push eax
push edi
lea eax, [edi + 0xa]
push eax
mov dword [ebp + 8], ebx
call fcn.00408b44
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x40edfc
cmp dword [ebp + 8], edi
jne 0x40edfc
mov eax, edi
call fcn.0040a0e6
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
call fcn.00405cd9
xor esi, esi
inc esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405cd9
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
xor eax, eax
mov edx, esi
call fcn.00408b6a
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
call fcn.00405cd9
mov esi, dword [ebp - 0x14]
jmp 0x40edde