joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ba50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0x45baa0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 8]
mov dword [edx + 0xcac], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xcac]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x45c480
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54fe47
mov eax, dword fs:[0]
push eax
sub esp, 0x4d4
mov eax, dword [0x5be094]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4d0], ecx
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.00488f20
add esp, 0xc
xor edx, edx
mov word [ebp - 0x424], dx
push 0x206
push 0
lea eax, [ebp - 0x422]
push eax
call fcn.00488f20
add esp, 0xc
lea ecx, [ebp - 0x4ac]
push ecx
call dword [0x5880b0]
add esp, 4
mov dword [ebp - 0x4d4], eax
mov edx, dword [ebp - 0x4d4]
mov dword [ebp - 0x4d8], edx
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x4d8]
sub esp, 0x84
mov ecx, 0x21
mov edi, esp
rep movsd dword es:[edi], dword [esi]
push 0x5662d0
lea eax, [ebp - 0x21c]
push eax
call fcn.00410850
add esp, 0x8c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4ac]
call dword [0x5880a4]
lea ecx, [ebp - 0x21c]
push ecx
push 0x104
lea edx, [ebp - 0x424]
push edx
push 0x5662ec
push 0x5662f0
push 0x56630c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movzx eax, word [ebp - 0x424]
test eax, eax
jne 0x45c59b
push 0
mov ecx, dword [ebp - 0x4d0]
call fcn.0045c280
jmp 0x45c5b6
lea ecx, [ebp - 0x424]
push ecx
call fcn.0048bd8f
add esp, 4
push eax
mov ecx, dword [ebp - 0x4d0]
call fcn.0045c280
push str.alpha_controlor
mov ecx, dword [ebp - 0x4d0]
add ecx, 0x2c
call dword [0x5880ec]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
je 0x45c652
mov dword [ebp - 0x4b4], 0x45c230
mov dword [ebp - 0x4b0], 0
mov edx, dword [ebp - 0x4b0]
push edx
mov eax, dword [ebp - 0x4b4]
push eax
mov ecx, dword [ebp - 0x4d0]
push ecx
lea edx, [ebp - 0x4cc]
push edx
call fcn.0045dd00
add esp, 0x10
mov dword [ebp - 0x4dc], eax
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0x4e0], eax
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x4e0]
push ecx
mov ecx, dword [ebp - 0x428]
add ecx, 0x34
call dword [0x588130]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4cc]
call fcn.00451610
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00488ec3
mov esp, ebp
pop ebp
ret 4
Function at 0x45dea0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x5be094]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x420], ax
push 0x206
push 0
lea ecx, [ebp - 0x41e]
push ecx
call fcn.00488f20
add esp, 0xc
call fcn.00407040
mov ecx, eax
call fcn.00401390
push eax
push 0x5667f0
lea edx, [ebp - 0x420]
push edx
call fcn.00410850
add esp, 0xc
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00488f20
add esp, 0xc
mov dword [ebp - 0x214], 0
lea edx, [ebp - 0x420]
push edx
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0x5667f8
push 0x5667fc
push 0x566818
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x210]
push ecx
call fcn.0048bd8f
add esp, 4
mov dword [ebp - 0x214], eax
mov edx, dword [ebp - 0x214]
add edx, 1
mov dword [ebp - 0x214], edx
mov eax, dword [ebp - 0x214]
push eax
push 0x56682c
lea ecx, [ebp - 0x210]
push ecx
call fcn.00410850
add esp, 0xc
lea edx, [ebp - 0x420]
push edx
lea eax, [ebp - 0x210]
push eax
push str.RefreshButton
push 0x566850
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00488ec3
mov esp, ebp
pop ebp
ret

Function at 0x45dfb0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x5be094]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
mov word [ebp - 0x418], ax
push 0x206
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.00488f20
add esp, 0xc
call fcn.00407040
mov ecx, eax
call fcn.00401390
push eax
push 0x566864
lea edx, [ebp - 0x418]
push edx
call fcn.00410850
add esp, 0xc
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00488f20
add esp, 0xc
mov dword [ebp - 4], 0
lea edx, [ebp - 0x418]
push edx
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0x56686c
push 0x566870
push 0x56688c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x210]
push ecx
call fcn.0048bd8f
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
push 0x5668a0
lea ecx, [ebp - 0x210]
push ecx
call fcn.00410850
add esp, 0xc
lea edx, [ebp - 0x418]
push edx
lea eax, [ebp - 0x210]
push eax
push str.WeaPicButton
push 0x5668c4
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00488ec3
mov esp, ebp
pop ebp
ret
Function at 0x45e0b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x5be094]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
mov word [ebp - 0x418], ax
push 0x206
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.00488f20
add esp, 0xc
call fcn.00407040
mov ecx, eax
call fcn.00401390
push eax
push 0x5668d8
lea edx, [ebp - 0x418]
push edx
call fcn.00410850
add esp, 0xc
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00488f20
add esp, 0xc
mov dword [ebp - 4], 0
lea edx, [ebp - 0x418]
push edx
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0x5668e0
push 0x5668e4
push 0x566908
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x210]
push ecx
call fcn.0048bd8f
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
push 0x56691c
lea ecx, [ebp - 0x210]
push ecx
call fcn.00410850
add esp, 0xc
lea edx, [ebp - 0x418]
push edx
lea eax, [ebp - 0x210]
push eax
push str.ChooseYearButton
push 0x566948
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00488ec3
mov esp, ebp
pop ebp
ret

Function at 0x45e1b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x5be094]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
mov word [ebp - 0x418], ax
push 0x206
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.00488f20
add esp, 0xc
call fcn.00407040
mov ecx, eax
call fcn.00401390
push eax
push 0x56695c
lea edx, [ebp - 0x418]
push edx
call fcn.00410850
add esp, 0xc
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00488f20
add esp, 0xc
mov dword [ebp - 4], 0
lea edx, [ebp - 0x418]
push edx
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0x566964
push 0x566968
push 0x56698c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x210]
push ecx
call fcn.0048bd8f
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
push 0x5669a0
lea ecx, [ebp - 0x210]
push ecx
call fcn.00410850
add esp, 0xc
lea edx, [ebp - 0x418]
push edx
lea eax, [ebp - 0x210]
push eax
push str.ChooseMonthButton
push 0x5669cc
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00488ec3
mov esp, ebp
pop ebp
ret
Function at 0x45e2b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x5be094]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x420], ax
push 0x206
push 0
lea ecx, [ebp - 0x41e]
push ecx
call fcn.00488f20
add esp, 0xc
call fcn.00407040
mov ecx, eax
call fcn.00401390
push eax
push 0x5669e0
lea edx, [ebp - 0x420]
push edx
call fcn.00410850
add esp, 0xc
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00488f20
add esp, 0xc
mov dword [ebp - 0x214], 0
lea edx, [ebp - 0x420]
push edx
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0x5669e8
push 0x5669ec
push 0x566a0c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x210]
push ecx
call fcn.0048bd8f
add esp, 4
mov dword [ebp - 0x214], eax
mov edx, dword [ebp - 0x214]
add edx, 1
mov dword [ebp - 0x214], edx
mov eax, dword [ebp - 0x214]
push eax
push 0x566a20
lea ecx, [ebp - 0x210]
push ecx
call fcn.00410850
add esp, 0xc
lea edx, [ebp - 0x420]
push edx
lea eax, [ebp - 0x210]
push eax
push str.CalendarButton
push 0x566a48
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00488ec3
mov esp, ebp
pop ebp
ret

Function at 0x45e3c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x5be094]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x420], ax
push 0x206
push 0
lea ecx, [ebp - 0x41e]
push ecx
call fcn.00488f20
add esp, 0xc
call fcn.00407040
mov ecx, eax
call fcn.00401390
push eax
push 0x566a5c
lea edx, [ebp - 0x420]
push edx
call fcn.00410850
add esp, 0xc
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00488f20
add esp, 0xc
mov dword [ebp - 0x214], 0
lea edx, [ebp - 0x420]
push edx
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0x566a64
push 0x566a68
push 0x566a80
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x210]
push ecx
call fcn.0048bd8f
add esp, 4
mov dword [ebp - 0x214], eax
mov edx, dword [ebp - 0x214]
add edx, 1
mov dword [ebp - 0x214], edx
mov eax, dword [ebp - 0x214]
push eax
push 0x566a94
lea ecx, [ebp - 0x210]
push ecx
call fcn.00410850
add esp, 0xc
lea edx, [ebp - 0x420]
push edx
lea eax, [ebp - 0x210]
push eax
push str.NoteButton
push 0x566ab4
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00488ec3
mov esp, ebp
pop ebp
ret
Function at 0x45e4d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x5be094]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x420], ax
push 0x206
push 0
lea ecx, [ebp - 0x41e]
push ecx
call fcn.00488f20
add esp, 0xc
call fcn.00407040
mov ecx, eax
call fcn.00401390
push eax
push 0x566ac8
lea edx, [ebp - 0x420]
push edx
call fcn.00410850
add esp, 0xc
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00488f20
add esp, 0xc
mov dword [ebp - 0x214], 0
lea edx, [ebp - 0x420]
push edx
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0x566ad0
push 0x566ad4
push 0x566aec
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x210]
push ecx
call fcn.0048bd8f
add esp, 4
mov dword [ebp - 0x214], eax
mov edx, dword [ebp - 0x214]
add edx, 1
mov dword [ebp - 0x214], edx
mov eax, dword [ebp - 0x214]
push eax
push 0x566b00
lea ecx, [ebp - 0x210]
push ecx
call fcn.00410850
add esp, 0xc
lea edx, [ebp - 0x420]
push edx
lea eax, [ebp - 0x210]
push eax
push str.SkinButton
push 0x566b20
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00488ec3
mov esp, ebp
pop ebp
ret

Function at 0x45e5e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x5be094]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x420], ax
push 0x206
push 0
lea ecx, [ebp - 0x41e]
push ecx
call fcn.00488f20
add esp, 0xc
call fcn.00407040
mov ecx, eax
call fcn.00401390
push eax
push 0x566b34
lea edx, [ebp - 0x420]
push edx
call fcn.00410850
add esp, 0xc
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00488f20
add esp, 0xc
mov dword [ebp - 0x214], 0
lea edx, [ebp - 0x420]
push edx
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0x566b3c
push 0x566b40
push 0x566b64
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x210]
push ecx
call fcn.0048bd8f
add esp, 4
mov dword [ebp - 0x214], eax
mov edx, dword [ebp - 0x214]
add edx, 1
mov dword [ebp - 0x214], edx
mov eax, dword [ebp - 0x214]
push eax
push 0x566b78
lea ecx, [ebp - 0x210]
push ecx
call fcn.00410850
add esp, 0xc
lea edx, [ebp - 0x420]
push edx
lea eax, [ebp - 0x210]
push eax
push str.TransparentButton
push 0x566ba4
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00488ec3
mov esp, ebp
pop ebp
ret
Function at 0x45e6f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x5be094]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
mov word [ebp - 0x418], ax
push 0x206
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.00488f20
add esp, 0xc
call fcn.00407040
mov ecx, eax
call fcn.00401390
push eax
push 0x566bb8
lea edx, [ebp - 0x418]
push edx
call fcn.00410850
add esp, 0xc
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00488f20
add esp, 0xc
mov dword [ebp - 4], 0
lea edx, [ebp - 0x418]
push edx
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0x566bc0
push 0x566bc4
push 0x566be4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x210]
push ecx
call fcn.0048bd8f
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
push 0x566bf8
lea ecx, [ebp - 0x210]
push ecx
call fcn.00410850
add esp, 0xc
lea edx, [ebp - 0x418]
push edx
lea eax, [ebp - 0x210]
push eax
push str.ToadyPicButton
push 0x566c20
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00488ec3
mov esp, ebp
pop ebp
ret

Function at 0x45e7f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x5be094]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
mov word [ebp - 0x418], ax
push 0x206
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.00488f20
add esp, 0xc
call fcn.00407040
mov ecx, eax
call fcn.00401390
push eax
push 0x566c34
lea edx, [ebp - 0x418]
push edx
call fcn.00410850
add esp, 0xc
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00488f20
add esp, 0xc
mov dword [ebp - 4], 0
lea edx, [ebp - 0x418]
push edx
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0x566c3c
push 0x566c40
push 0x566c5c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x210]
push ecx
call fcn.0048bd8f
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
push 0x566c70
lea ecx, [ebp - 0x210]
push ecx
call fcn.00410850
add esp, 0xc
lea edx, [ebp - 0x418]
push edx
lea eax, [ebp - 0x210]
push eax
push str.AutoRunButton
push 0x566c94
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00488ec3
mov esp, ebp
pop ebp
ret
Function at 0x45e8f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x5be094]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
mov word [ebp - 0x418], ax
push 0x206
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.00488f20
add esp, 0xc
call fcn.00407040
mov ecx, eax
call fcn.00401390
push eax
push 0x566ca8
lea edx, [ebp - 0x418]
push edx
call fcn.00410850
add esp, 0xc
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00488f20
add esp, 0xc
mov dword [ebp - 4], 0
lea edx, [ebp - 0x418]
push edx
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0x566cb0
push 0x566cb4
push 0x566cd8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x210]
push ecx
call fcn.0048bd8f
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
push 0x566cec
lea ecx, [ebp - 0x210]
push ecx
call fcn.00410850
add esp, 0xc
lea edx, [ebp - 0x418]
push edx
lea eax, [ebp - 0x210]
push eax
push 0x566cf4
push 0x566d18
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00488ec3
mov esp, ebp
pop ebp
ret

Function at 0x45e9f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x5be094]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
mov word [ebp - 0x418], ax
push 0x206
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.00488f20
add esp, 0xc
call fcn.00407040
mov ecx, eax
call fcn.00401390
push eax
push 0x566d2c
lea edx, [ebp - 0x418]
push edx
call fcn.00410850
add esp, 0xc
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00488f20
add esp, 0xc
mov dword [ebp - 4], 0
lea edx, [ebp - 0x418]
push edx
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0x566d34
push 0x566d38
push 0x566d50
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x210]
push ecx
call fcn.0048bd8f
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
push 0x566d64
lea ecx, [ebp - 0x210]
push ecx
call fcn.00410850
add esp, 0xc
lea edx, [ebp - 0x418]
push edx
lea eax, [ebp - 0x210]
push eax
push str.UpDataTimeButton
push 0x566d90
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00488ec3
mov esp, ebp
pop ebp
ret
Function at 0x45eaf0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x5be094]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x628], ax
push 0x206
push 0
lea ecx, [ebp - 0x626]
push ecx
call fcn.00488f20
add esp, 0xc
call fcn.00407040
mov ecx, eax
call fcn.00401390
push eax
push 0x566da4
lea edx, [ebp - 0x628]
push edx
call fcn.00410850
add esp, 0xc
xor eax, eax
mov word [ebp - 0x420], ax
push 0x206
push 0
lea ecx, [ebp - 0x41e]
push ecx
call fcn.00488f20
add esp, 0xc
xor edx, edx
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00488f20
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push str.SkinStyle_s
lea edx, [ebp - 0x210]
push edx
call fcn.00410850
add esp, 0xc
mov dword [ebp - 0x214], 0
lea eax, [ebp - 0x628]
push eax
push 0x104
lea ecx, [ebp - 0x420]
push ecx
push 0x566dc4
lea edx, [ebp - 0x210]
push edx
push 0x566dc8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x420]
push eax
call fcn.0048bd8f
add esp, 4
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 0x214]
add ecx, 1
mov dword [ebp - 0x214], ecx
mov edx, dword [ebp - 0x214]
push edx
push 0x566ddc
lea eax, [ebp - 0x420]
push eax
call fcn.00410850
add esp, 0xc
lea ecx, [ebp - 0x628]
push ecx
lea edx, [ebp - 0x420]
push edx
lea eax, [ebp - 0x210]
push eax
push 0x566de4
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00488ec3
mov esp, ebp
pop ebp
ret

Function at 0x45f220
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5500b4
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x5be094]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x10]
call fcn.0040acc0
mov dword [ebp - 4], 0
push str.rundll32.exe_shell32.dll__Control_RunDLL_Timedate.cpl__0
lea eax, [ebp - 0x10]
push eax
call fcn.00439a20
add esp, 8
push 9
lea ecx, [ebp - 0x10]
call fcn.00407f80
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004075a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x45fee0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x5be094]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x41c], ecx
call fcn.00407040
mov ecx, eax
call fcn.00401330
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.00488f00
add esp, 8
push 0x5678a8
lea ecx, [ebp - 0x418]
push ecx
call fcn.00488ed2
add esp, 8
lea edx, [ebp - 0x418]
mov dword [ebp - 4], edx
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00488f20
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0x5678c0
push 0x5678c4
push 0x5678d8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp - 0x41c]
mov eax, dword [edx + 0x350]
mov ecx, dword [ebp - 0x41c]
mov ecx, dword [ecx + 0x350]
mov edx, dword [eax]
mov eax, dword [edx + 0x2c]
call eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00488ec3
mov esp, ebp
pop ebp
ret

Function at 0x4605d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x34c], 0
mov ecx, dword [ebp - 4]
add ecx, 0x33c
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
push 0x460610
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x338], eax
mov esp, ebp
pop ebp
ret
Function at 0x460630
Capabilities:
Create process on windows
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x550265
mov eax, dword fs:[0]
push eax
sub esp, 0x484
mov eax, dword [0x5be094]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x490], ecx
call fcn.00407040
mov ecx, eax
call fcn.00401330
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.00488f00
add esp, 8
push str.Config.ini
lea ecx, [ebp - 0x424]
push ecx
call fcn.00488ed2
add esp, 8
lea edx, [ebp - 0x424]
mov dword [ebp - 0x10], edx
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.00488f20
add esp, 0xc
mov edx, dword [ebp - 0x10]
push edx
push 0x104
lea eax, [ebp - 0x21c]
push eax
push 0x5679b8
push 0x5679bc
push str.UserData
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x21c]
push ecx
call fcn.0048bd8f
add esp, 4
mov dword [ebp - 0x438], eax
lea ecx, [ebp - 0x488]
call fcn.0040acc0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x438]
push edx
push str.Mutual.exe
call fcn.00407040
mov ecx, eax
call fcn.00401330
push eax
push str.__s_s__DownCfg__d
lea eax, [ebp - 0x488]
push eax
call fcn.0040a4a0
add esp, 0x14
lea ecx, [ebp - 0x488]
call fcn.0040ac80
push eax
call fcn.00410640
add esp, 4
push 0x567a1c
call fcn.00410640
add esp, 4
push 0x44
push 0
lea ecx, [ebp - 0x484]
push ecx
call fcn.00488f20
add esp, 0xc
mov dword [ebp - 0x484], 0x44
push 0x10
push 0
lea edx, [ebp - 0x434]
push edx
call fcn.00488f20
add esp, 0xc
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x484]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x488]
call fcn.00407f80
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
mov edx, dword [ebp - 0x434]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x430]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x490]
mov dword [edx + 0x34c], 1
mov dword [ebp - 0x48c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x488]
call fcn.004075a0
mov eax, dword [ebp - 0x48c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00488ec3
mov esp, ebp
pop ebp
ret