joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45def0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
call fcn.00415eb0
test eax, eax
je 0x45df14
push str.https:__tools.soft.360.cn_jump_id118
call fcn.0042fb00
add esp, 4
jmp 0x45e11d
push str.Utils360Feedback.exe
lea eax, [ebp - 8]
push eax
call fcn.00415de0
add esp, 8
push str.PopWndTrackerLogpop.log
lea ecx, [ebp - 0x10]
push ecx
call fcn.0044d3c0
add esp, 4
push eax
lea edx, [ebp - 0xc]
push edx
call fcn.0041bc20
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.0041d100
push str._catlogOther__desc_
lea ecx, [ebp - 4]
call fcn.0041d0c0
push 0x533f88
lea ecx, [ebp - 4]
call fcn.0041d180
push str._file
lea ecx, [ebp - 4]
call fcn.0041d180
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 4]
call fcn.0041d160
lea ecx, [ebp - 8]
call fcn.0041d2b0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45e007
lea ecx, [ebp - 8]
call fcn.0041d2b0
push eax
call fcn.0045ff30
add esp, 4
test eax, eax
je 0x45e007
push 0
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.00416040
add esp, 8
mov ecx, eax
call fcn.0041d2b0
push eax
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
lea ecx, [ebp - 8]
call fcn.0041d2b0
push eax
call fcn.00430d60
add esp, 0x10
lea ecx, [ebp - 0x14]
call fcn.0041d100
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 4]
call fcn.0041d100
lea ecx, [ebp - 0xc]
call fcn.0041d100
lea ecx, [ebp - 8]
call fcn.0041d100
mov eax, dword [ebp - 0x18]
jmp 0x45e129
push str.feedback.exe
push 0
lea edx, [ebp - 0x1c]
push edx
call fcn.00416040
add esp, 8
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0041bc20
add esp, 0xc
push eax
lea ecx, [ebp - 8]
call fcn.0041d120
lea ecx, [ebp - 0x20]
call fcn.0041d100
lea ecx, [ebp - 0x1c]
call fcn.0041d100
lea ecx, [ebp - 8]
call fcn.0041d2b0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45e0f8
lea ecx, [ebp - 8]
call fcn.0041d2b0
push eax
call fcn.0045ff30
add esp, 4
test eax, eax
je 0x45e0f8
push 0
push 0
lea ecx, [ebp - 0x24]
push ecx
call fcn.00416040
add esp, 8
mov ecx, eax
call fcn.0041d2b0
push eax
push ecx
mov ecx, esp
push str.IDS_FEEDBACK_TILE
call fcn.0043f2e0
lea edx, [ebp - 0x2c]
push edx
mov ecx, dword [ebp - 0x34]
add ecx, 0x5c
call fcn.0043ca80
mov ecx, eax
call fcn.0043fa60
mov ecx, eax
call fcn.00446370
push eax
lea ecx, [ebp - 8]
call fcn.0041d2b0
push eax
call fcn.00430d60
add esp, 0x10
lea ecx, [ebp - 0x2c]
call fcn.0043f340
lea ecx, [ebp - 0x24]
call fcn.0041d100
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 4]
call fcn.0041d100
lea ecx, [ebp - 0xc]
call fcn.0041d100
lea ecx, [ebp - 8]
call fcn.0041d100
mov eax, dword [ebp - 0x30]
jmp 0x45e129
push str.http:__bbs.360safe.com_forum.php
call fcn.0042fb00
add esp, 4
lea ecx, [ebp - 4]
call fcn.0041d100
lea ecx, [ebp - 0xc]
call fcn.0041d100
lea ecx, [ebp - 8]
call fcn.0041d100
push 0
mov ecx, dword [ebp - 0x34]
call fcn.0045de10
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x460d20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
call fcn.00415eb0
test eax, eax
je 0x460d4b
mov eax, dword [ebp - 4]
jmp 0x460e45
push str.360leakfixer.exe
lea eax, [ebp - 8]
push eax
call fcn.00415de0
add esp, 8
lea ecx, [ebp - 8]
call fcn.0041d2b0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x460e3a
lea ecx, [ebp - 0x10]
call fcn.0041d080
push 0x53439c
lea ecx, [ebp - 0xc]
push ecx
call fcn.00415de0
add esp, 8
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0xc]
call fcn.0041d2b0
push eax
call fcn.0041b5b0
add esp, 8
test eax, eax
je 0x460e2a
xor eax, eax
mov word [ebp - 0x220], ax
push 0x206
push 0
lea ecx, [ebp - 0x21e]
push ecx
call fcn.004f7580
add esp, 0xc
push 0x103
lea edx, [ebp - 0x220]
push edx
push str.8.9.0.0
push str.safe_minver
push 0x52f1c4
call fcn.00428150
add esp, 0x14
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x10]
call fcn.0041d2b0
push eax
call fcn.0041b3f0
add esp, 8
test eax, eax
jge 0x460e2a
lea ecx, [ebp - 0x220]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
push str.IsSafeNeedUpdate__s__s__s
call fcn.0042d4d0
add esp, 0x10
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc]
call fcn.0041d100
lea ecx, [ebp - 0x10]
call fcn.0041d100
lea ecx, [ebp - 8]
call fcn.0041d100
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret

Function at 0x469710
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.004f78e0
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1014], ecx
mov eax, dword [ebp - 0x1014]
cmp dword [eax + 0xc], 0
jne 0x469866
xor ecx, ecx
mov word [ebp - 0x808], cx
push 0x7fe
push 0
lea edx, [ebp - 0x806]
push edx
call fcn.004f7580
add esp, 0xc
xor eax, eax
mov word [ebp - 0x1010], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x100e]
push ecx
call fcn.004f7580
add esp, 0xc
lea edx, [ebp - 0x80c]
push edx
call fcn.0044d400
add esp, 4
lea ecx, [ebp - 0x80c]
call fcn.0041d2b0
push eax
push 0x400
lea eax, [ebp - 0x808]
push eax
push 0x5345c0
push str.system
push 0x5345d4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x80c]
call fcn.0041d2b0
push eax
push 0x400
lea ecx, [ebp - 0x1010]
push ecx
push 0x5345e8
push 0x5345ec
push str.NoPopWnd
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x80c]
call fcn.0041d2b0
push eax
push 0x1f4
push str.sleeptime
push 0x534628
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 0x1014]
mov dword [edx + 4], eax
lea eax, [ebp - 0x808]
push eax
mov ecx, dword [ebp - 0x1014]
add ecx, 8
call fcn.0041d140
lea ecx, [ebp - 0x1010]
push ecx
mov ecx, dword [ebp - 0x1014]
call fcn.0041d140
mov ecx, dword [ebp - 0x1014]
add ecx, 8
call fcn.004390b0
mov ecx, dword [ebp - 0x1014]
call fcn.004390b0
mov edx, dword [ebp - 0x1014]
mov dword [edx + 0xc], 1
lea ecx, [ebp - 0x80c]
call fcn.0041d100
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret
Function at 0x469950
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x228], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 8]
call fcn.0041d0c0
lea ecx, [ebp - 8]
push ecx
push 0x534648
lea edx, [ebp - 0x21c]
push edx
call fcn.0041d250
add esp, 0xc
push eax
lea ecx, [ebp - 8]
call fcn.0041d120
lea ecx, [ebp - 0x21c]
call fcn.0041d100
push 0x53464c
lea ecx, [ebp - 8]
call fcn.0041d180
push 0x534658
lea ecx, [ebp - 8]
call fcn.0041d180
lea ecx, [ebp - 8]
call fcn.004390b0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0xc]
call fcn.0041d0c0
lea ecx, [ebp - 0xc]
call fcn.004390b0
xor ecx, ecx
mov word [ebp - 0x218], cx
push 0x206
push 0
lea edx, [ebp - 0x216]
push edx
call fcn.004f7580
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 4]
call fcn.0041d0c0
lea ecx, [ebp - 4]
call fcn.004390b0
push 0
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
lea ecx, [ebp - 0xc]
call fcn.004264c0
cmp eax, 0xffffffff
je 0x469a81
push 0
lea ecx, [ebp - 8]
call fcn.0041d2b0
push eax
mov ecx, dword [ebp - 0x228]
add ecx, 8
call fcn.004264c0
cmp eax, 0xffffffff
je 0x469a81
mov dword [ebp - 0x220], 1
lea ecx, [ebp - 4]
call fcn.0041d100
lea ecx, [ebp - 0xc]
call fcn.0041d100
lea ecx, [ebp - 8]
call fcn.0041d100
mov eax, dword [ebp - 0x220]
jmp 0x469ac3
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 4]
call fcn.0041d100
lea ecx, [ebp - 0xc]
call fcn.0041d100
lea ecx, [ebp - 8]
call fcn.0041d100
mov eax, dword [ebp - 0x224]
jmp 0x469ac3
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret 8
Function at 0x4759e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x2a4], ecx
mov ecx, dword [ebp - 0x2a4]
call fcn.0047b000
mov eax, dword [ebp - 0x2a4]
cmp dword [eax + 0x1640], 1
jne 0x475a2a
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0
mov ecx, dword [ebp - 0x2a4]
call fcn.00479ef0
jmp 0x475a4e
mov edx, dword [ebp - 0x2a4]
cmp dword [edx + 0x1640], 2
jne 0x475a4e
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x2a4]
call fcn.00479ef0
call fcn.00415eb0
test eax, eax
jne 0x475bc0
call fcn.004333b0
test eax, eax
jne 0x475bc0
call fcn.004c4370
test eax, eax
jne 0x475bc0
lea ecx, [ebp - 0x90]
call fcn.004573f0
push 1
mov ecx, dword [ebp - 0x2a4]
call fcn.00477ea0
push 2
lea ecx, [ebp - 0x90]
call fcn.00457a90
push 0
mov ecx, dword [ebp - 0x2a4]
mov edx, dword [ecx + 0x30]
push edx
lea ecx, [ebp - 0x64]
call fcn.0047d230
cmp eax, 1
jne 0x475ba8
xor eax, eax
mov word [ebp - 0x298], ax
push 0x206
push 0
lea ecx, [ebp - 0x296]
push ecx
call fcn.004f7580
add esp, 0xc
mov dword [ebp - 0x29c], 1
mov dword [ebp - 0x2a0], 0x208
cmp dword [0x55661c], 0
je 0x475b44
lea edx, [ebp - 0x2a0]
push edx
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x29c]
push ecx
push 0x535288
push 0x535298
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push str.360safe.exe
lea edx, [ebp - 0x298]
push edx
push 0x535330
push 0x104
lea eax, [ebp - 0x298]
push eax
call fcn.0042d470
add esp, 0x14
jmp 0x475b93
lea ecx, [ebp - 0x2a0]
push ecx
lea edx, [ebp - 0x298]
push edx
lea eax, [ebp - 0x29c]
push eax
push 0x53533c
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360sd.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push 0x5353c4
lea ecx, [ebp - 0x298]
push ecx
push 0x5353d8
push 0x104
lea edx, [ebp - 0x298]
push edx
call fcn.0042d470
add esp, 0x14
push 0
push 0
push 0
lea eax, [ebp - 0x298]
push eax
call fcn.00430d60
add esp, 0x10
push 0
mov ecx, dword [ebp - 0x2a4]
call fcn.00477ea0
lea ecx, [ebp - 0x90]
call fcn.00457460
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret 0x10
Function at 0x477ce0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x1b0], 1
jne 0x477d1c
push 0x535818
push 0x53581c
push 0x535820
push str.normal_show
push 0x53583c
call fcn.004c08b0
mov ecx, eax
call fcn.004c0940
jmp 0x477d74
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x1b0], 2
jne 0x477d4f
push 0x535850
push 0x535854
push 0x535858
push str.powermode_show
push 0x53587c
call fcn.004c08b0
mov ecx, eax
call fcn.004c0940
jmp 0x477d74
push 0x535890
push 0x535894
push 0x535898
push str.closed_show
push 0x5358b4
call fcn.004c08b0
mov ecx, eax
call fcn.004c0940
mov ecx, dword [ebp - 0x10]
call fcn.004757b0
mov ecx, dword [ebp - 0x10]
call fcn.004756c0
mov ecx, dword [ebp - 0x10]
call fcn.0047abd0
mov ecx, dword [ebp - 0x10]
call fcn.004786d0
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x1b0]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.0047a9a0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x1b0]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0
jl 0x477df8
cmp dword [ebp - 0x14], 1
jle 0x477dc6
cmp dword [ebp - 0x14], 2
je 0x477ddf
jmp 0x477df8
push 0x5358c8
push 0x5358f4
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004c3d30
add esp, 0xc
jmp 0x477df8
push 1
push str.advtool_PopWndTracker
push str.SOFTWARE360Safe_stat
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004c3c90
add esp, 0x10
push 0x535978
lea ecx, [ebp - 4]
call fcn.0041d0c0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x1b0]
push ecx
push 0x53597c
lea edx, [ebp - 4]
push edx
call fcn.0041e770
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
call fcn.00419480
add esp, 4
mov ecx, eax
call fcn.0041d2b0
push eax
lea ecx, [ebp - 4]
call fcn.0041d2b0
push eax
push 0x535984
push 0x535990
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0xc]
call fcn.0041d100
call fcn.00415eb0
test eax, eax
je 0x477e8e
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x1b0]
xor eax, eax
test edx, edx
setne al
mov dword [ebp - 8], eax
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push str.Enable
push str.SOFTWAREPalmInputExtensionsPopWndBlocker
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [ebp - 4]
call fcn.0041d100
mov esp, ebp
pop ebp
ret
Function at 0x478200
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x83c
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x834], ecx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x81c], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x820], ecx
cmp dword [ebp - 0x820], 0
jne 0x47823b
xor eax, eax
jmp 0x478403
xor edx, edx
mov word [ebp - 0x808], dx
push 0x7fe
push 0
lea eax, [ebp - 0x806]
push eax
call fcn.004f7580
add esp, 0xc
lea ecx, [ebp - 0x818]
push ecx
call fcn.0044d6f0
add esp, 4
push 0x535a98
lea ecx, [ebp - 0x818]
call fcn.0041d180
lea ecx, [ebp - 0x818]
call fcn.0041d2b0
push eax
push 0x400
lea edx, [ebp - 0x808]
push edx
push 0
push 0x535aac
mov ecx, dword [ebp - 0x820]
call fcn.0041d2b0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
jbe 0x4782ef
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4782ef
lea ecx, [ebp - 0x818]
call fcn.0041d2b0
push eax
push 0
push 0x535ab8
mov ecx, dword [ebp - 0x820]
call fcn.0041d2b0
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push ecx
mov ecx, esp
mov edx, dword [ebp - 0x820]
push edx
call fcn.0041d0a0
push 0
lea eax, [ebp - 0x814]
push eax
mov ecx, dword [ebp - 0x834]
call fcn.00478800
mov ecx, dword [ebp - 0x81c]
mov dword [ebp - 0x838], ecx
cmp dword [ebp - 0x838], 1
je 0x478332
cmp dword [ebp - 0x838], 2
je 0x47836e
jmp 0x4783a8
push 1
mov edx, dword [ebp - 0x810]
push edx
mov eax, dword [ebp - 0x814]
push eax
mov ecx, dword [ebp - 0x834]
call fcn.00478dd0
push 0
push 0
push 1
mov ecx, dword [ebp - 0x810]
push ecx
mov edx, dword [ebp - 0x814]
push edx
mov ecx, dword [ebp - 0x834]
call fcn.00478990
jmp 0x4783a8
push 1
mov eax, dword [ebp - 0x810]
push eax
mov ecx, dword [ebp - 0x814]
push ecx
mov ecx, dword [ebp - 0x834]
call fcn.00478e40
push 0
push 0
push 1
mov edx, dword [ebp - 0x810]
push edx
mov eax, dword [ebp - 0x814]
push eax
mov ecx, dword [ebp - 0x834]
call fcn.00478bb0
mov ecx, dword [ebp - 0x820]
mov dword [ebp - 0x82c], ecx
mov edx, dword [ebp - 0x82c]
mov dword [ebp - 0x828], edx
cmp dword [ebp - 0x828], 0
je 0x4783de
push 1
mov ecx, dword [ebp - 0x828]
call fcn.00443510
mov dword [ebp - 0x83c], eax
jmp 0x4783e8
mov dword [ebp - 0x83c], 0
mov dword [ebp - 0x830], 0
lea ecx, [ebp - 0x818]
call fcn.0041d100
mov eax, dword [ebp - 0x830]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret 0x10
Function at 0x478420
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x83c
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x834], ecx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x81c], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x820], ecx
cmp dword [ebp - 0x820], 0
jne 0x47845b
xor eax, eax
jmp 0x4785e5
xor edx, edx
mov word [ebp - 0x808], dx
push 0x7fe
push 0
lea eax, [ebp - 0x806]
push eax
call fcn.004f7580
add esp, 0xc
lea ecx, [ebp - 0x818]
push ecx
call fcn.0044d6f0
add esp, 4
push 0x535ac4
lea ecx, [ebp - 0x818]
call fcn.0041d180
lea ecx, [ebp - 0x818]
call fcn.0041d2b0
push eax
push 0x400
lea edx, [ebp - 0x808]
push edx
push 0
push 0x535ad8
mov ecx, dword [ebp - 0x820]
call fcn.0041d2b0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
jbe 0x47850f
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x47850f
lea ecx, [ebp - 0x818]
call fcn.0041d2b0
push eax
push 0
push 0x535ae4
mov ecx, dword [ebp - 0x820]
call fcn.0041d2b0
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push ecx
mov ecx, esp
mov edx, dword [ebp - 0x820]
push edx
call fcn.0041d0a0
push 0
lea eax, [ebp - 0x814]
push eax
mov ecx, dword [ebp - 0x834]
call fcn.00478800
mov ecx, dword [ebp - 0x81c]
mov dword [ebp - 0x838], ecx
cmp dword [ebp - 0x838], 1
je 0x478552
cmp dword [ebp - 0x838], 2
je 0x47856f
jmp 0x47858a
push 0
mov edx, dword [ebp - 0x810]
push edx
mov eax, dword [ebp - 0x814]
push eax
mov ecx, dword [ebp - 0x834]
call fcn.00478dd0
jmp 0x47858a
push 0
mov ecx, dword [ebp - 0x810]
push ecx
mov edx, dword [ebp - 0x814]
push edx
mov ecx, dword [ebp - 0x834]
call fcn.00478e40
mov eax, dword [ebp - 0x820]
mov dword [ebp - 0x82c], eax
mov ecx, dword [ebp - 0x82c]
mov dword [ebp - 0x828], ecx
cmp dword [ebp - 0x828], 0
je 0x4785c0
push 1
mov ecx, dword [ebp - 0x828]
call fcn.00443510
mov dword [ebp - 0x83c], eax
jmp 0x4785ca
mov dword [ebp - 0x83c], 0
mov dword [ebp - 0x830], 0
lea ecx, [ebp - 0x818]
call fcn.0041d100
mov eax, dword [ebp - 0x830]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret 0x10
Function at 0x479bd0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x104], ecx
lea ecx, [ebp - 0xf8]
call fcn.00451f50
lea ecx, [ebp - 0x100]
call fcn.0041d080
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
jne 0x479c34
lea ecx, [ebp - 0x100]
call fcn.0041d100
lea ecx, [ebp - 0xf8]
call fcn.004520c0
jmp 0x479cb2
cmp dword [ebp - 4], 2
jl 0x479c8f
mov edx, dword [ebp - 0xfc]
mov eax, dword [edx]
push eax
lea ecx, [ebp - 0x100]
call fcn.0041d140
push str._ShowSetting
lea ecx, [ebp - 0x100]
push ecx
call fcn.0047ca90
add esp, 8
movzx edx, al
test edx, edx
je 0x479c8f
mov eax, dword [ebp - 0x104]
push eax
lea ecx, [ebp - 0xf8]
call fcn.00452f00
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0xcc]
call fcn.0047cc10
mov ecx, dword [ebp - 0xfc]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 0x100]
call fcn.0041d100
lea ecx, [ebp - 0xf8]
call fcn.004520c0
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret 8

Function at 0x47a650
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0xa4], ecx
lea eax, [ebp - 0x94]
push eax
call fcn.00419480
add esp, 4
mov ecx, eax
call fcn.0041d2b0
push eax
push 1
push 0x535c88
push 0x535ca4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x90], eax
lea ecx, [ebp - 0x94]
call fcn.0041d100
cmp dword [ebp - 0x90], 0
je 0x47a798
lea ecx, [ebp - 1]
call fcn.004bc670
push ecx
push esp
call fcn.00453c10
add esp, 4
lea ecx, [ebp - 1]
call fcn.004bc7b0
test eax, eax
jne 0x47a790
lea ecx, [ebp - 0x88]
call fcn.004573f0
push 1
mov ecx, dword [ebp - 0xa4]
call fcn.00477ea0
push 1
lea ecx, [ebp - 0x88]
call fcn.00457a90
lea ecx, [ebp - 0x9c]
push ecx
call fcn.00419480
add esp, 4
mov ecx, eax
call fcn.0041d2b0
push eax
push 0x535cb8
push 0x535cbc
push 0x535cd8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x9c]
call fcn.0041d100
push 0
mov edx, dword [ebp - 0xa4]
mov eax, dword [edx + 0x30]
push eax
lea ecx, [ebp - 0x5c]
call fcn.0047d230
cmp eax, 1
jne 0x47a778
lea ecx, [ebp - 0x8c]
push ecx
call fcn.00453c10
add esp, 4
push ecx
mov ecx, esp
lea edx, [ebp - 0x8c]
push edx
call fcn.0041d0a0
lea ecx, [ebp - 1]
call fcn.004bc690
lea ecx, [ebp - 0x8c]
call fcn.0041d100
push 0
mov ecx, dword [ebp - 0xa4]
call fcn.00477ea0
lea ecx, [ebp - 0x88]
call fcn.00457460
lea ecx, [ebp - 1]
call fcn.004bc680
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret 0x10
Function at 0x47a8a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x34]
call fcn.00475380
mov ecx, dword [ebp - 0x34]
call fcn.004757b0
push 0
push 0x535d30
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x47a99a
mov dword [ebp - 8], 0
lea eax, [ebp - 0x30]
push eax
call fcn.00419480
add esp, 4
mov ecx, eax
call fcn.0041d2b0
push eax
push 1
push 0x535d48
push 0x535d54
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x30]
call fcn.0041d100
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x20], 0
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x20], 3
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + 0x184]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 0x18c]
mov edx, dword [ebp - 0x34]
mov eax, dword [edx + 0x188]
add ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x2c], 0
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x28], 0x10
lea edx, [ebp - 0x20]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 0x7d0
push 0
lea ecx, [ebp - 0x2c]
push ecx
push 0
push 0x4a
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
mov esp, ebp
pop ebp
ret
Function at 0x481ab0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x552a7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x430], ecx
push 0x5360d8
lea ecx, [ebp - 0x214]
call fcn.0041d0c0
push 0x208
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.004f7580
add esp, 0xc
lea ecx, [ebp - 0x210]
push ecx
push 0
push 0
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x481caa
push 0x5360dc
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call fcn.004fab1e
add esp, 4
xor ecx, ecx
mov word [ebp - 0x420], cx
push 0x206
push 0
lea edx, [ebp - 0x41e]
push edx
call fcn.004f7580
add esp, 0xc
push 0x104
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.SysWOW64
lea ecx, [ebp - 0x420]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x53610c
lea edx, [ebp - 0x420]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x420]
push eax
call fcn.004fab1e
add esp, 4
lea ecx, [ebp + 0xc]
call fcn.004390b0
lea ecx, [ebp + 0x10]
call fcn.004390b0
push 0
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [ebp + 0x10]
call fcn.004264c0
cmp eax, 0xffffffff
jne 0x481bd1
push 0
lea edx, [ebp - 0x420]
push edx
lea ecx, [ebp + 0x10]
call fcn.004264c0
cmp eax, 0xffffffff
je 0x481caa
push 0
push 0x536128
lea ecx, [ebp + 0xc]
call fcn.004264c0
cmp eax, 0xffffffff
je 0x481caa
push 0
push str.rundll32.exe
lea ecx, [ebp + 0xc]
call fcn.004264c0
mov dword [ebp - 0x424], eax
mov eax, dword [ebp - 0x424]
add eax, 0xd
push eax
lea ecx, [ebp - 0x428]
push ecx
lea ecx, [ebp + 0xc]
call fcn.004833e0
push eax
lea ecx, [ebp + 0xc]
call fcn.0041d120
lea ecx, [ebp - 0x428]
call fcn.0041d100
lea ecx, [ebp + 0xc]
call fcn.00483320
push 0x22
lea ecx, [ebp + 0xc]
call fcn.004391c0
push 0
push str..dll
lea ecx, [ebp + 0xc]
call fcn.004264c0
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0xffffffff
je 0x481c88
mov edx, dword [ebp - 0x424]
add edx, 4
push edx
lea eax, [ebp - 0x42c]
push eax
lea ecx, [ebp + 0xc]
call fcn.004392f0
push eax
lea ecx, [ebp + 0xc]
call fcn.0041d120
lea ecx, [ebp - 0x42c]
call fcn.0041d100
lea ecx, [ebp + 0xc]
call fcn.0041d2b0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x481caa
lea ecx, [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x214]
call fcn.0041d120
lea edx, [ebp - 0x214]
push edx
mov ecx, dword [ebp + 8]
call fcn.0041d0a0
lea ecx, [ebp - 0x214]
call fcn.0041d100
lea ecx, [ebp + 0xc]
call fcn.0041d100
lea ecx, [ebp + 0x10]
call fcn.0041d100
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f7567
mov esp, ebp
pop ebp
ret 0xc