joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406158
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
push str.0x00000000_
call fcn.004014c5
lea eax, [ebp - 8]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SoftwareKingsoftAntivirus
push reloc.WS2_32.dll_bind
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x406193
xor eax, eax
jmp 0x4061fc
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
mov edi, 0x4acfb8
push edi
push dword [ebp - 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
call esi
test eax, eax
jne 0x4061ee
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push edi
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x4061ee
and dword [ebp - 4], 0xffffff
push dword [ebp - 4]
push str.0x_08x_
push dword [ebp + 8]
call fcn.004063eb
add esp, 0xc
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop esi
pop ebx
leave
ret

Function at 0x406726
Capabilities:
Read .ini file

Disassembly:
push 0x18
mov eax, 0x4a2993
call fcn.00481d3a
push dword [ebp + 0xc]
xor ebx, ebx
mov esi, 0x4efe98
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ebx
call fcn.0042c1c3
call fcn.00428e38
push dword [ebp + 0xc]
lea ecx, [ebp - 0x1c]
call fcn.00401640
lea eax, [ebp - 0x1c]
push eax
lea esi, [ebp - 0x24]
lea edi, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.00407c55
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401325
cmp esi, ebx
je 0x406867
mov edi, dword [ebp - 0x10]
cmp word [edi], bx
je 0x406856
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xffffffffffffffff
push dword [0x4efe94]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
call fcn.00401640
cmp dword [0x4efe90], ebx
je 0x4067f5
push dword [ebp - 0x14]
push ebx
push 0x4aced4
push str.COMMENT
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push ebx
push 0x4efe88
push 0x453
push dword [0x4efe90]
mov dword [0x4efe8c], eax
mov dword [0x4efe88], 6
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401325
push dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00406885
push edi
call fcn.0047ba0d
cmp dword [0x4eef64], ebx
pop ecx
lea edi, [edi + eax*2 + 2]
je 0x406833
call fcn.004029cd
imul eax, eax, 5
jmp 0x406849
mov eax, dword [ebp - 0x18]
push 0xa
cdq
pop ecx
idiv ecx
inc dword [ebp - 0x18]
cmp edx, 9
jne 0x40684d
call fcn.004029cd
dec eax
push eax
call esi
cmp word [edi], bx
jne 0x40679a
mov edi, 0x4efea0
call fcn.0042cda8
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x10], ebx
je 0x406875
push dword [ebp - 0x10]
call fcn.0045d845
pop ecx
call fcn.00428e69
mov eax, dword [ebp - 0x20]
call fcn.00481e12
ret 0x14
Function at 0x407882
Capabilities:
Check if file exists

Disassembly:
push 0xc
mov eax, 0x4a0e4e
call fcn.00481d3a
mov esi, ecx
call fcn.0045db7e
push eax
lea ecx, [ebp - 0x10]
call fcn.0040161b
xor edi, edi
lea eax, [esi + 0x760]
mov dword [ebp - 4], edi
xor ebx, ebx
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], ebx
call fcn.004015ba
mov eax, dword [esi + 0x30c]
cmp eax, 3
jne 0x4078f6
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x407940
push dword [ebp - 0x10]
lea eax, [esi + 0x738]
push eax
call fcn.0047eb2f
pop ecx
push edx
push eax
call fcn.004020a7
add esp, 0xc
test eax, eax
jne 0x407985
jmp 0x407940
test eax, eax
jne 0x407940
push dword [ebp - 0x10]
call fcn.0042e9b9
test eax, eax
pop ecx
je 0x407934
push dword [esi + 0x30c]
lea eax, [ebp - 0x18]
push dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
call fcn.00401822
test eax, eax
pop ecx
pop ecx
jne 0x40793d
mov ecx, dword [ebp - 0x10]
lea eax, [esi + 0x2dc]
push eax
call fcn.00407469
test eax, eax
jge 0x407939
xor edi, edi
inc edi
jmp 0x407985
je 0x407964
jmp 0x407985
mov ebx, dword [ebp - 0x18]
mov eax, dword [esi + 0x304]
cmp eax, dword [ebp - 0x14]
ja 0x407934
jne 0x407955
cmp dword [esi + 0x308], ebx
ja 0x407934
xor edi, edi
cmp eax, dword [ebp - 0x14]
jne 0x407985
cmp dword [esi + 0x308], ebx
jne 0x407985
push dword [ebp - 0x10]
add esi, 0x738
push esi
call fcn.0047eb2f
pop ecx
push edx
push eax
call fcn.004020a7
add esp, 0xc
mov edi, eax
neg edi
sbb edi, edi
inc edi
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401325
xor eax, eax
test edi, edi
sete al
call fcn.00481e12
ret
Function at 0x407c55
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
mov dword [esi], 0x2800
add dword [esi], 0x2800
mov eax, dword [edi]
test eax, eax
je 0x407c76
push eax
call fcn.0045d845
pop ecx
mov eax, dword [esi]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0045d840
mov dword [edi], eax
mov ecx, dword [esi]
add ecx, ecx
push ecx
push 0
push eax
call fcn.0047e7d0
mov eax, dword [edi]
add esp, 0x10
test eax, eax
je 0x407cc9
mov ecx, dword [ebp + 8]
push dword [ecx]
push dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
test eax, eax
je 0x407cc9
mov ecx, dword [esi]
sub ecx, eax
cmp ecx, 0x104
jb 0x407c63
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x408c05
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1a4]
sub esp, 0x224
mov eax, dword [0x4d0620]
xor eax, ebp
mov dword [ebp + 0x1a0], eax
mov eax, dword [ebp + 0x1ac]
push ebx
push esi
push edi
push 4
pop edi
xor ebx, ebx
push 0x208
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x6a]
mov esi, ecx
push ebx
push eax
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x74], edi
mov word [ebp - 0x6c], bx
call fcn.0047e7d0
add esp, 0xc
cmp esi, ebx
je 0x408cbc
cmp dword [ebp - 0x78], ebx
je 0x408cbc
lea esi, [ebp - 0x6c]
call fcn.00408be5
push ebx
lea eax, [ebp - 0x70]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
mov eax, esi
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x408ca7
cmp dword [ebp - 0x70], ebx
je 0x408ca7
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x78]
lea eax, [ebp - 0x74]
push eax
push ebx
push dword [ebp - 0x7c]
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x408cab
mov esi, eax
jmp 0x408cbf
mov esi, dword [ebp - 0x74]
sub esi, edi
neg esi
sbb esi, esi
and esi, 0xee
jmp 0x408cbf
or esi, 0xffffffff
cmp dword [ebp - 0x70], ebx
je 0x408ccd
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x1a0]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047b9fe
add ebp, 0x1a4
leave
ret
Function at 0x408ce7
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x4d0620]
xor eax, ebp
mov dword [ebp + 0x194], eax
push esi
push edi
xor edi, edi
push 0x208
lea eax, [ebp - 0x76]
mov esi, ecx
push edi
push eax
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x7c], edi
mov word [ebp - 0x78], di
call fcn.0047e7d0
add esp, 0xc
cmp esi, edi
je 0x408d79
cmp ebx, edi
je 0x408d79
lea esi, [ebp - 0x78]
call fcn.00408be5
push edi
lea eax, [ebp - 0x7c]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
mov eax, esi
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
jne 0x408d75
cmp dword [ebp - 0x7c], edi
je 0x408d75
push ebx
call fcn.0047ba0d
pop ecx
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push edi
push dword [ebp - 0x80]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
jmp 0x408d7c
or esi, 0xffffffff
cmp dword [ebp - 0x7c], edi
je 0x408d8a
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x194]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0047b9fe
add ebp, 0x198
leave
ret
Function at 0x40bf06
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4d0620]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, eax
call fcn.0043af41
test eax, eax
je 0x40c04e
xor ebx, ebx
cmp esi, ebx
jne 0x40c04e
mov edi, 0x206
push edi
lea eax, [ebp - 0x20a]
push ebx
push eax
mov word [ebp - 0x20c], bx
call fcn.0047e7d0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.0047ebd0
cmp eax, ebx
pop ecx
pop ecx
je 0x40c03d
mov word [eax + 2], bx
lea eax, [ebp - 0x20c]
push 0x4ad698
push eax
call fcn.0040468c
pop ecx
pop ecx
lea ecx, [ebp - 0x20c]
call fcn.00428c7b
test eax, eax
je 0x40c03d
call fcn.00428da0
test eax, eax
jl 0x40c03d
cmp dword [0x4ee940], ebx
jne 0x40c04e
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
cmp esi, ebx
je 0x40c04e
push edi
lea eax, [ebp - 0x412]
push ebx
push eax
mov word [ebp - 0x414], bx
call fcn.0047e7d0
add esp, 0xc
cmp word [esi], 0x22
jne 0x40bff9
push 0x22
add esi, 2
jmp 0x40bffb
push 0x20
push esi
call fcn.0047d56b
cmp eax, ebx
pop ecx
pop ecx
je 0x40c01a
inc eax
inc eax
je 0x40c01a
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0040464f
pop ecx
pop ecx
cmp dword [0x4ee930], ebx
je 0x40c03d
mov eax, dword [0x4ee938]
cmp eax, ebx
je 0x40c03d
mov ecx, dword [eax]
lea edx, [ebp - 0x414]
push edx
push str.uplive.exe
push eax
call dword [ecx + 0x1c]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047b9fe
leave
ret
call fcn.0047f57a
jmp 0x40c03f

Function at 0x40c109
Capabilities:
Set registry value

Disassembly:
push 0xc
mov eax, 0x4a0d8f
call fcn.00481d3a
xor esi, esi
mov dword [ebp - 0x10], esi
push str.SoftwareKingsoftAntivirus
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], esi
call fcn.00401640
push 0x4ad6c8
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00401250
push dword [ebp - 0x14]
lea edi, [ebp - 0x10]
push reloc.WS2_32.dll_accept
call fcn.004048a0
test eax, eax
jne 0x40c1a3
fld dword [ebx + 0x11c]
fadd qword [0x4bf140]
call fcn.00483936
push 4
pop edi
push edi
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push edi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push str.Avgbandwidth
push dword [ebp - 0x10]
call esi
mov eax, dword [ebx + 0x120]
push edi
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push edi
push 0
push str.Watchaccount
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x10]
call fcn.004047d1
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401325
lea ecx, [ebp - 0x10]
call fcn.004047d1
mov eax, esi
call fcn.00481e12
ret
Function at 0x40ce6d
Capabilities:
Check if file exists
Initialize winsock library

Disassembly:
push 0x19c
mov eax, 0x4a3650
call fcn.00481da3
call fcn.0040da25
call fcn.0045db7e
push eax
lea ecx, [ebp - 0x1a4]
call fcn.0040161b
and dword [ebp - 4], 0
lea edi, [ebx + 0x110]
push edi
lea ecx, [ebp - 0x1a4]
call fcn.004015ba
push str.KAVPID.KID
lea ecx, [ebp - 0x1a4]
call fcn.00401250
push 0x80
push 0
push 0x4efaa4
mov dword [0x4efb24], 3
call fcn.0047e7d0
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
push dword [ebp - 0x1a4]
call esi
test eax, eax
je 0x40cef2
mov dword [0x4efaa4], 1
push edi
lea ecx, [ebp - 0x1a4]
call fcn.004015ba
push str.KFWPID.KID
lea ecx, [ebp - 0x1a4]
call fcn.00401250
push dword [ebp - 0x1a4]
call esi
test eax, eax
je 0x40cf24
mov dword [0x4efaa8], 1
push edi
lea ecx, [ebp - 0x1a4]
call fcn.004015ba
push str.KASPID.KID
lea ecx, [ebp - 0x1a4]
call fcn.00401250
mov edi, dword [ebp - 0x1a4]
push edi
call esi
test eax, eax
je 0x40cf57
mov dword [0x4efaac], 1
xor esi, esi
push 0x18e
lea eax, [ebp - 0x19e]
push esi
push eax
mov word [ebp - 0x1a0], si
call fcn.0047e7d0
add esp, 0xc
lea eax, [ebp - 0x1a0]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, esi
jne 0x40d015
push 0x42
pop esi
mov dword [ebx + 0xc4], 1
call fcn.00436a31
test eax, eax
je 0x40cfdd
push 0x14
call fcn.0045d815
mov esi, eax
pop ecx
mov dword [ebp - 0x1a8], esi
test esi, esi
mov byte [ebp - 4], 1
je 0x40cfc8
mov ecx, esi
call fcn.00460dea
mov eax, esi
jmp 0x40cfca
xor eax, eax
test eax, eax
mov byte [ebp - 4], 0
mov dword [ebx + 0x128], eax
je 0x40cfdd
call fcn.00408da3
push str.SOFTWAREKingsoftAntiVirus
push 0x4eef7c
call fcn.0040464f
pop ecx
pop ecx
call fcn.004037bd
cmp dword [0x4eef6c], 0
je 0x40d00e
call fcn.004041d3
lea ecx, [edi - 0x10]
call fcn.00401325
xor eax, eax
inc eax
jmp 0x40d032
call fcn.0040d038
jmp 0x40d001
push 0x40
push str.KingSoft_AntiVirus_Update
push str.Load_socket_error_
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [edi - 0x10]
call fcn.00401325
xor eax, eax
call fcn.00481e26
ret
Function at 0x40da25
Capabilities:
Get common file path

Disassembly:
push 0xc
mov eax, 0x4a2ca0
call fcn.00481d3a
mov edi, 0x104
push edi
mov esi, 0x4ecfd0
xor ebx, ebx
push esi
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x40da53
mov dword [ebp - 0x10], 1
call fcn.0042e70c
push edi
push esi
mov esi, 0x4ed9f8
push esi
call fcn.0047d58d
push 0x5c
push esi
call fcn.0047d56b
add esp, 0x14
cmp eax, ebx
je 0x40da78
mov word [eax + 2], bx
push edi
mov esi, 0x4ecdc8
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x40da90
mov dword [ebp - 0x10], 1
call fcn.0042e70c
push ebx
push 0x23
mov esi, 0x4edc00
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x40dab0
mov dword [ebp - 0x10], 1
call fcn.0042e70c
push str.kingsoft
push esi
call fcn.0040468c
pop ecx
pop ecx
call fcn.0042e70c
mov esi, 0x4ed3e0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x40dadf
mov dword [ebp - 0x10], 1
call fcn.0042e70c
mov esi, 0x4ed1d8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, ebx
jne 0x40db2b
push str.C:Temp
lea ecx, [ebp - 0x14]
call fcn.00401640
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.0042e810
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401325
push str.C:Temp_
push esi
call fcn.0040464f
pop ecx
pop ecx
jmp 0x40db30
call fcn.0042e70c
push dword [0x4efd98]
mov esi, 0x4ed5e8
push esi
call fcn.0040464f
push str.Update_
push esi
call fcn.0040468c
push dword [0x4efd98]
push 0x4ed7f0
call fcn.0040464f
lea eax, [ebp - 0x18]
push 0xd
push eax
call fcn.00402f7f
push dword [eax]
push esi
call fcn.0040464f
mov ecx, dword [ebp - 0x18]
add esp, 0x28
add ecx, 0xfffffff0
call fcn.00401325
xor eax, eax
cmp dword [ebp - 0x10], ebx
sete al
call fcn.00481e12
ret

Function at 0x40e397
Capabilities:
Read .ini file

Disassembly:
push 8
mov eax, 0x4a2c37
call fcn.00481d3a
lea eax, [ebp - 0x14]
push 0xd
push eax
call fcn.00402f7f
and dword [ebp - 4], 0
push 0x4ad1b4
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00402dca
mov ecx, dword [ebp - 0x14]
add esp, 0x14
add ecx, 0xfffffff0
call fcn.00401325
push dword [ebp - 0x10]
push 0
push 0x4add40
push 0x4acf30
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor edx, edx
push 0x64
pop ecx
div ecx
mov dword [esi], edx
xor edx, edx
div ecx
shl edx, 0x10
or dword [esi], edx
xor edx, edx
div ecx
mov ecx, dword [ebp + 8]
shl eax, 0x10
or eax, edx
mov dword [ecx], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401325
xor eax, eax
inc eax
call fcn.00481e12
ret 4
Function at 0x40f13d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push esi
push 0xa0
push 2
push esi
push 1
push 0x40000000
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40f193
push esi
lea eax, [ebp - 4]
push eax
mov esi, 0x16572
push esi
push 0x4d2398
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40f18c
cmp dword [ebp - 4], esi
jne 0x40f18c
inc ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x40f236
Capabilities:
Read .ini file

Disassembly:
push 0x1c
mov eax, 0x4a358c
call fcn.00481d3a
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push dword [ebp + 0xc]
xor esi, esi
push eax
mov dword [ebp - 0x28], esi
call fcn.0040a465
add esp, 0xc
mov dword [ebp - 4], esi
mov edi, dword [ebp + 0x14]
cmp edi, esi
jne 0x40f268
mov edi, 0x4ad1b4
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call fcn.0040a465
add esp, 0xc
push edi
push eax
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 1
call fcn.00402dca
add esp, 0xc
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00401325
cmp dword [ebp + 0x18], esi
je 0x40f2a9
mov ebx, dword [ebp - 0x10]
call fcn.004057fa
lea eax, [ebp - 0x10]
call fcn.0040602a
cmp eax, esi
mov dword [ebp - 0x24], eax
jle 0x40f3cc
mov eax, dword [ebp + 0x10]
lea edi, [ebp + 0x14]
mov dword [ebp + 0x14], 1
call fcn.0040603f
mov dword [ebp - 0x20], eax
call fcn.0045db7e
push eax
lea ecx, [ebp - 0x18]
call fcn.0040161b
cmp dword [ebp - 0x20], esi
mov byte [ebp - 4], 4
je 0x40f2f5
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 0x14]
call fcn.004061ff
pop ecx
cmp dword [ebp - 0x24], esi
mov dword [ebp + 0x18], esi
jle 0x40f3bf
mov edi, 0x104
call fcn.0045db7e
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040161b
push dword [ebp + 0x18]
lea eax, [ebp - 0x1c]
push 0x4ad28c
push eax
mov byte [ebp - 4], 5
call fcn.004063eb
add esp, 0xc
call fcn.0045db7e
push eax
lea ecx, [ebp + 0x14]
call fcn.0040161b
mov byte [ebp - 4], 6
mov ebx, dword [ebp - 0x10]
push edi
lea ecx, [ebp + 0x14]
call fcn.0040133f
push ebx
mov ebx, dword [ebp - 0x1c]
push edi
push eax
push 0x4ac888
push ebx
push 0x4acf30
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffffffffffffffff
lea ecx, [ebp + 0x14]
call fcn.00402fd4
cmp dword [ebp - 0x20], esi
je 0x40f381
push dword [ebp - 0x18]
push dword [ebp + 0x14]
call fcn.0047bbb4
test eax, eax
pop ecx
pop ecx
jne 0x40f399
push dword [ebp + 0x1c]
lea eax, [ebp + 0x14]
push esi
push esi
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.0040f236
add esp, 0x18
mov ecx, dword [ebp + 0x14]
add ecx, 0xfffffff0
call fcn.00401325
lea ecx, [ebx - 0x10]
mov byte [ebp - 4], 4
call fcn.00401325
inc dword [ebp + 0x18]
mov eax, dword [ebp + 0x18]
cmp eax, dword [ebp - 0x24]
jl 0x40f306
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00401325
jmp 0x40f3dc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
call fcn.0040f3fb
pop ecx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401325
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401325
mov eax, dword [ebp - 0x28]
call fcn.00481e12
ret
Function at 0x40f650
Capabilities:
Check if file exists
Copy file
Move file
Set file attributes

Disassembly:
push 0x840
mov eax, 0x4a2c07
call fcn.00481da3
mov eax, dword [ebp + 8]
and dword [ebp - 0x848], 0
mov ebx, ecx
mov dword [ebp - 0x84c], eax
call fcn.0045db7e
push eax
lea ecx, [ebp - 0x844]
call fcn.0040161b
and dword [ebp - 4], 0
lea esi, [ebp - 0x840]
call fcn.0040f19a
mov eax, dword [0x4ef874]
cmp eax, 0xffffffff
jne 0x40f6a5
call fcn.0040f5af
mov dword [0x4ef874], eax
xor esi, esi
add eax, 0xfffffffd
inc esi
cmp eax, esi
ja 0x40f798
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40f6d5
mov eax, dword [ebx]
push 0xa0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40f79e
push ebx
lea ecx, [ebp - 0x844]
call fcn.004015ba
lea edi, [ebp - 0x844]
call fcn.0040f51e
mov eax, dword [ebp - 0x84c]
xor edi, edi
push edi
push dword [ebp - 0x844]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [0x4efdd4], edi
je 0x40f780
push 0x830
lea eax, [ebp - 0x840]
push edi
push eax
call fcn.0047e7d0
mov eax, dword [ebp + 0x10]
add esp, 0xc
push dword [ebx]
mov dword [ebp - 0x838], eax
lea eax, [ebp - 0x834]
mov dword [ebp - 0x83c], esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push eax
call esi
push dword [ebp - 0x844]
lea eax, [ebp - 0x422]
push eax
call esi
cmp dword [ebp + 0xc], edi
je 0x40f774
cmp dword [0x4efdd4], edi
je 0x40f780
mov eax, dword [0x4efdd0]
cmp eax, edi
je 0x40f780
mov ecx, dword [eax]
lea edx, [ebp - 0x840]
push edx
push eax
call dword [ecx + 0x28]
jmp 0x40f780
lea eax, [ebp - 0x840]
push eax
call fcn.004355d8
mov ebx, dword [ebx]
push 5
push ebx
push dword [ebp - 0x844]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x40f79e
xor esi, esi
inc esi
mov dword [ebp - 0x848], esi
mov ecx, dword [ebp - 0x844]
add ecx, 0xfffffff0
call fcn.00401325
mov eax, dword [ebp - 0x848]
call fcn.00481e26
ret

Function at 0x40fe2c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4d0620]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
call fcn.0047e7d0
add esp, 0xc
mov ecx, esi
call fcn.00401557
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x40fe9c
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.004014c5
push esi
call fcn.0040fda7
mov ecx, esi
mov dword [esp], str.drivers_
call fcn.00401250
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047b9fe
leave
ret
Function at 0x410017
Capabilities:
Copy file
Set file attributes

Disassembly:
push 0x10
mov eax, 0x4a290f
call fcn.00481d3a
mov esi, ecx
call fcn.0045db7e
push eax
lea ecx, [ebp - 0x18]
call fcn.0040161b
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.0045db7e
push eax
lea ecx, [ebp - 0x14]
call fcn.0040161b
mov byte [ebp - 4], 1
call fcn.0045db7e
push eax
lea ecx, [ebp - 0x10]
call fcn.0040161b
mov byte [ebp - 4], 2
cmp dword [esi + 0x99c], 1
je 0x410086
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401325
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401325
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
jmp 0x41012e
mov eax, dword [esi + 0x760]
lea esi, [ebp - 0x14]
mov dword [ebp - 0x1c], eax
call fcn.0040fe2c
mov esi, dword [ebp - 0x14]
cmp dword [esi - 0xc], ebx
jne 0x4100af
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401325
lea ecx, [esi - 0x10]
jmp 0x410076
lea edi, [ebp - 0x10]
call fcn.0040ff2f
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], ebx
jne 0x4100c4
lea ecx, [eax - 0x10]
jmp 0x4100a5
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
call fcn.0040fea8
mov esi, dword [ebp - 0x18]
pop ecx
pop ecx
push dword [esi - 0xc]
lea ecx, [ebp - 0x14]
push esi
call fcn.00401275
push dword [esi - 0xc]
lea ecx, [ebp - 0x10]
push esi
call fcn.00401275
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push dword [ebp - 0x14]
call edi
push ebx
push dword [ebp - 0x10]
call edi
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call edi
push ebx
mov ebx, dword [ebp - 0x10]
push ebx
push dword [ebp - 0x1c]
call edi
lea ecx, [ebx - 0x10]
call fcn.00401325
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401325
lea ecx, [esi - 0x10]
call fcn.00401325
call fcn.00481e12
ret