joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4246f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53e270
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x78
push ebx
push esi
push edi
mov eax, dword [0x5a6900]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x18], 1
lea ecx, [ebp - 0x28]
call fcn.0049b3e8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.0049028c
mov byte [ebp - 4], 1
mov byte [ebp - 4], 2
push 0
push 0x9001
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
call fcn.0049b85c
mov dword [ebp - 0x84], eax
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
je 0x4247d7
cmp dword [ebp + 0xc], 0
jle 0x4247d7
mov eax, dword [ebp + 0xc]
cdq
push edx
push eax
lea ecx, [ebp - 0x28]
call fcn.0049b29d
mov dword [ebp - 0x34], 4
push 2
mov eax, dword [ebp - 0x34]
neg eax
cdq
push edx
push eax
lea ecx, [ebp - 0x28]
call fcn.0049b16b
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], edx
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0x34]
cmp dword [ebp - 0x38], eax
jne 0x4247d7
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x7c
push ecx
lea ecx, [ebp - 0x28]
call fcn.0049b11e
jmp 0x4247fb
mov dword [ebp - 4], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00427690
cmp dword [ebp - 0x24], 0
je 0x424822
cmp dword [ebp - 0x24], 0xffffffff
je 0x424822
lea ecx, [ebp - 0x28]
call fcn.0049b382
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x80], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0049b4f0
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x427880
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 8
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x4278b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427950
Capabilities:
Create process on windows
Create process suspended
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53e3ab
mov eax, dword fs:[0]
push eax
sub esp, 0x4b8
mov eax, dword [0x5a6900]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.004af7d0
add esp, 0xc
call fcn.0040b910
mov ecx, eax
call fcn.00401390
push eax
push 0x54ba84
lea eax, [ebp - 0x21c]
push eax
call fcn.0040fa70
add esp, 0xc
xor eax, eax
mov word [ebp - 0x424], ax
push 0x206
push 0
lea eax, [ebp - 0x422]
push eax
call fcn.004af7d0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x104
lea ecx, [ebp - 0x424]
push ecx
push 0x54c078
push str.UserID
push str.UserData
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x424]
push eax
call fcn.004b258f
add esp, 4
mov dword [ebp - 0x428], eax
lea ecx, [ebp - 0x42c]
call fcn.0040da00
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x428]
push eax
push str.Mutual.exe
call fcn.0040b910
mov ecx, eax
call fcn.00401330
push eax
push str.__s_s__UpUserCfg__d
lea ecx, [ebp - 0x42c]
push ecx
call fcn.0040d1d0
add esp, 0x14
push 0x44
push 0
lea eax, [ebp - 0x470]
push eax
call fcn.004af7d0
add esp, 0xc
mov dword [ebp - 0x470], 0x44
push 0x10
push 0
lea eax, [ebp - 0x480]
push eax
call fcn.004af7d0
add esp, 0xc
lea eax, [ebp - 0x480]
push eax
lea ecx, [ebp - 0x470]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x42c]
call fcn.00404880
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
mov eax, dword [ebp - 0x480]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x480]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x47c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x4c4], 2
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x42c]
call fcn.004047e0
mov eax, dword [ebp - 0x4c4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004af76a
mov esp, ebp
pop ebp
ret
Function at 0x42de10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53e64b
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [0x5a6900]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x42dea5
push 0x48
call fcn.0048b8bd
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x54], 0
je 0x42de7d
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x54]
call fcn.004f9670
mov dword [ebp - 0x5c], eax
jmp 0x42de84
mov dword [ebp - 0x5c], 0
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x58], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x58]
mov dword [edx], eax
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call fcn.004fab30
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x432b40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push 8
push 0
push 0
push str.taskmgr.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x432e40
Capabilities:
Check for time delay via gettickcount
Print debug messages
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x874
mov eax, dword [0x5a6900]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
push 0x104
lea eax, [ebp - 0x214]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
lea eax, [ebp - 0x214]
push eax
call fcn.00404220
add esp, 8
xor ecx, ecx
mov word [eax + 2], cx
xor eax, eax
mov word [ebp - 0x41c], ax
push 0x206
push 0
lea eax, [ebp - 0x41a]
push eax
call fcn.004af7d0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x624], ax
push 0x206
push 0
lea eax, [ebp - 0x622]
push eax
call fcn.004af7d0
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
push str._sSoftApp.ini
lea ecx, [ebp - 0x41c]
push ecx
call fcn.0040fa70
add esp, 0xc
lea eax, [ebp - 0x41c]
push eax
push 0x104
lea ecx, [ebp - 0x624]
push ecx
push 0x54bf04
push str.Spreader
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
mov word [ebp - 0x82c], ax
push 0x206
push 0
lea eax, [ebp - 0x82a]
push eax
call fcn.004af7d0
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
push str._sdataengine_.dll
lea ecx, [ebp - 0x82c]
push ecx
call fcn.0040fa70
add esp, 0xc
lea eax, [ebp - 0x82c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x3a8], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x3a8], 0
je 0x432fab
push str.setadvertisement
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x3a8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x830], eax
cmp dword [ebp - 0x830], 0
je 0x432fab
push str.rilibiao
call dword [ebp - 0x830]
push str.start_dateengine
push 0x54ba84
call fcn.004108b0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x834], eax
push str._ndataengine_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004af76a
mov esp, ebp
pop ebp
ret
Function at 0x4330d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53ec7b
mov eax, dword fs:[0]
push eax
sub esp, 0x6f4
mov eax, dword [0x5a6900]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
push 0x104
lea eax, [ebp - 0x21c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
lea eax, [ebp - 0x21c]
push eax
call fcn.00404220
add esp, 8
xor ecx, ecx
mov word [eax + 2], cx
xor eax, eax
mov word [ebp - 0x424], ax
push 0x206
push 0
lea eax, [ebp - 0x422]
push eax
call fcn.004af7d0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x62c], ax
push 0x206
push 0
lea eax, [ebp - 0x62a]
push eax
call fcn.004af7d0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push str._sConfig.ini
lea ecx, [ebp - 0x424]
push ecx
call fcn.0040fa70
add esp, 0xc
lea eax, [ebp - 0x424]
push eax
push 0x104
lea ecx, [ebp - 0x62c]
push ecx
push 0x54c078
push str.isRegLockPage
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x62c]
push eax
call fcn.004b258f
add esp, 4
test eax, eax
jne 0x43328f
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x274], 0
je 0x433273
mov dword [ebp - 0x630], 0
push str.EnableLock
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x274]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x630], eax
push 1
call dword [ebp - 0x630]
mov dword [ebp - 0x634], 0
push str.SaveStartupPage
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x274]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x634], eax
push str.http:__www.hao123.com__tn92297945_hao_pg
lea ecx, [ebp - 0x6f8]
call fcn.00413810
mov dword [ebp - 0x6fc], eax
mov eax, dword [ebp - 0x6fc]
mov dword [ebp - 0x700], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x700]
call fcn.004138e0
push eax
call dword [ebp - 0x634]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6f8]
call fcn.00413870
lea eax, [ebp - 0x424]
push eax
push 0x54c4b0
push str.isRegLockPage
push str.Setting
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004af76a
mov esp, ebp
pop ebp
ret
Function at 0x433580
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53ed0b
mov eax, dword fs:[0]
push eax
sub esp, 0x8e4
mov eax, dword [0x5a6900]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
push 0x104
lea eax, [ebp - 0x21c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
lea eax, [ebp - 0x21c]
push eax
call fcn.00404220
add esp, 8
xor ecx, ecx
mov word [eax + 2], cx
xor eax, eax
mov word [ebp - 0x424], ax
push 0x206
push 0
lea eax, [ebp - 0x422]
push eax
call fcn.004af7d0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x62c], ax
push 0x206
push 0
lea eax, [ebp - 0x62a]
push eax
call fcn.004af7d0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push str._sConfig.ini
lea ecx, [ebp - 0x424]
push ecx
call fcn.0040fa70
add esp, 0xc
lea eax, [ebp - 0x424]
push eax
push 0x104
lea ecx, [ebp - 0x62c]
push ecx
push 0x54c4b0
push str.IsNextPrompt
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x62c]
push eax
call fcn.004b258f
add esp, 4
test eax, eax
jne 0x433677
mov al, 1
jmp 0x43375a
lea ecx, [ebp - 0x8ac]
call fcn.00452fe0
mov dword [ebp - 4], 0
push 0
push 0x96
push 0x12c
push 0
push 0
push 0x60000
push 0x10cf0000
push str.ConfirmExit
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
push ecx
lea ecx, [ebp - 0x8ac]
call dword [0x572318]
lea ecx, [ebp - 0x8ac]
call dword [0x572314]
lea ecx, [ebp - 0x8ac]
call dword [0x5723a0]
movzx eax, byte [ebp - 0x638]
test eax, eax
je 0x433727
movzx eax, byte [ebp - 0x637]
push eax
lea ecx, [ebp - 0x8ac]
call fcn.004536e0
movzx eax, byte [ebp - 0x636]
push eax
lea ecx, [ebp - 0x8ac]
call fcn.004535e0
mov byte [ebp - 0x8ee], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8ac]
call fcn.00453070
mov al, byte [ebp - 0x8ee]
jmp 0x43375a
mov byte [ebp - 0x8ed], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8ac]
call fcn.00453070
mov al, byte [ebp - 0x8ed]
jmp 0x43375a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004af76a
mov esp, ebp
pop ebp
ret
Function at 0x433830
Capabilities:
Change the wallpaper
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53ed4e
mov eax, dword fs:[0]
push eax
sub esp, 0x68c
mov eax, dword [0x5a6900]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
push 0x104
lea eax, [ebp - 0x21c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
lea eax, [ebp - 0x21c]
push eax
call fcn.00404220
add esp, 8
xor ecx, ecx
mov word [eax + 2], cx
xor eax, eax
mov word [ebp - 0x424], ax
push 0x206
push 0
lea eax, [ebp - 0x422]
push eax
call fcn.004af7d0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push str._sSoftApp.ini
lea ecx, [ebp - 0x424]
push ecx
call fcn.0040fa70
add esp, 0xc
xor eax, eax
mov word [ebp - 0x62c], ax
push 0x206
push 0
lea eax, [ebp - 0x62a]
push eax
call fcn.004af7d0
add esp, 0xc
lea eax, [ebp - 0x424]
push eax
push 0x104
lea ecx, [ebp - 0x62c]
push ecx
push 0
push str.AdverOfBottomUrl
push str.InfoConf
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x424]
push eax
push 0x12c
push str.AdverOfBottomWidth
push str.InfoConf
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x630], eax
lea eax, [ebp - 0x424]
push eax
push 0x96
push str.AdverOfBottomHeight
push str.InfoConf
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x634], eax
lea eax, [ebp - 0x62c]
push eax
call fcn.004af750
add esp, 4
test eax, eax
jbe 0x433a9a
cmp dword [ebp - 0x630], 0
jle 0x433a9a
cmp dword [ebp - 0x634], 0
jle 0x433a9a
push 0x27c
call fcn.0048b8bd
add esp, 4
mov dword [ebp - 0x690], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x690], 0
je 0x4339b5
mov ecx, dword [ebp - 0x690]
call fcn.004538f0
mov dword [ebp - 0x698], eax
jmp 0x4339bf
mov dword [ebp - 0x698], 0
mov eax, dword [ebp - 0x698]
mov dword [ebp - 0x694], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x694]
mov dword [ebp - 0x638], ecx
mov dword [ebp - 0x63c], 0x180
push 0
mov eax, dword [ebp - 0x634]
add eax, 0x14
push eax
mov ecx, dword [ebp - 0x630]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x63c]
push edx
push 0x90cf0000
push str.CUIAdvertising
push 0
mov ecx, dword [ebp - 0x638]
call dword [0x572318]
lea ecx, [ebp - 0x64c]
call fcn.004356d0
push 0
lea eax, [ebp - 0x64c]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [ebp - 0x634]
add eax, 0xf
push eax
mov ecx, dword [ebp - 0x630]
push ecx
mov edx, dword [ebp - 0x640]
sub edx, dword [ebp - 0x634]
sub edx, 0x11
push edx
mov eax, dword [ebp - 0x644]
sub eax, dword [ebp - 0x630]
sub eax, 3
push eax
mov ecx, dword [ebp - 0x638]
call fcn.00453c60
lea eax, [ebp - 0x62c]
push eax
mov ecx, dword [ebp - 0x638]
call fcn.00453ca0
push 1
push 1
mov ecx, dword [ebp - 0x638]
call dword [0x572344]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004af76a
mov esp, ebp
pop ebp
ret
Function at 0x43b480
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
push ecx
push str.__d_
mov edx, dword [ebp - 4]
push edx
call fcn.0043b820
add esp, 0x18
cmp dword [ebp + 0xc], 0
jne 0x43b4c0
mov eax, 1
jmp 0x43b556
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x88], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
call fcn.0043abe0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x84], 0
jle 0x43b509
mov ecx, dword [ebp - 4]
call fcn.0043ac30
mov ecx, dword [ebp - 4]
cmp eax, dword [ecx + 0x84]
jle 0x43b509
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x84]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0043abe0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
call fcn.0043ac80
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x43b640
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1c], 0
je 0x43b54d
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1c], 0xffffffff
jne 0x43b551
xor eax, eax
jmp 0x43b556
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x43b560
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
jne 0x43b57c
mov eax, 1
jmp 0x43b632
mov eax, dword [ebp - 4]
mov dword [eax + 0x88], 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.0043abe0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x84], 0
jle 0x43b5c6
mov ecx, dword [ebp - 4]
call fcn.0043ac30
mov ecx, dword [ebp - 4]
cmp eax, dword [ecx + 0x84]
jle 0x43b5c6
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x84]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0043abe0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
call fcn.0043ac80
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x43b660
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1c], 0
je 0x43b60a
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1c], 0xffffffff
jne 0x43b60e
xor eax, eax
jmp 0x43b632
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1c], 0xffffffff
jne 0x43b61b
xor eax, eax
jmp 0x43b632
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0xc], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43c1b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 4
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x43c4d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x43c1e9
jmp 0x43c206
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0xffffffff
jne 0x43c1f4
jmp 0x43c206
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 8], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x442880
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x4428d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 0x644], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x644]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x446400
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x446450
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 0x340], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x340]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4495f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x449640
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 0x434], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x434]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44d490
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5404fc
mov eax, dword fs:[0]
push eax
sub esp, 0x4f4
mov eax, dword [0x5a6900]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.004af7d0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x424], ax
push 0x206
push 0
lea eax, [ebp - 0x422]
push eax
call fcn.004af7d0
add esp, 0xc
lea eax, [ebp - 0x4f8]
push eax
call dword [0x572328]
add esp, 4
mov dword [ebp - 0x4fc], eax
mov ecx, dword [ebp - 0x4fc]
mov dword [ebp - 0x500], ecx
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x500]
sub esp, 0x84
mov ecx, 0x21
mov edi, esp
rep movsd dword es:[edi], dword [esi]
push str._sConfig.ini
lea edx, [ebp - 0x21c]
push edx
call fcn.0040fa70
add esp, 0x8c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4f8]
call dword [0x57231c]
lea eax, [ebp - 0x21c]
push eax
push 0x104
lea ecx, [ebp - 0x424]
push ecx
push 0x54c078
push str.IsStart
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [str.CheckBox_N]
push eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x270
call dword [0x572364]
mov dword [ebp - 0x428], eax
mov eax, dword [str.CheckBox_C]
push eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x270
call dword [0x572364]
mov dword [ebp - 0x42c], eax
lea eax, [ebp - 0x424]
push eax
call fcn.004b258f
add esp, 4
test eax, eax
jne 0x44d617
push 1
mov eax, dword [ebp - 0x428]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x428]
mov eax, dword [edx + 0xcc]
call eax
push 0
mov eax, dword [ebp - 0x42c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x42c]
mov eax, dword [edx + 0xcc]
call eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 0xa08], 0
jmp 0x44d654
push 0
mov eax, dword [ebp - 0x428]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x428]
mov eax, dword [edx + 0xcc]
call eax
push 1
mov eax, dword [ebp - 0x42c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x42c]
mov eax, dword [edx + 0xcc]
call eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 0xa08], 1
lea eax, [ebp - 0x434]
push eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x270
call dword [0x5723a4]
push 0
mov eax, dword [ebp - 0x430]
push eax
mov ecx, dword [ebp - 0x434]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x9f4]
sub eax, 0x15
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x9f0]
sub edx, dword [ebp - 0x434]
sub edx, 0x46
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax - 0x298]
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
push 1
mov ecx, dword [ebp - 0x14]
sub ecx, 0x29c
call dword [0x572344]
mov ecx, dword [ebp - 0x14]
add ecx, 0x968
call dword [0x572324]
push eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x29c
call fcn.0044cc20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004af76a
mov esp, ebp
pop ebp
ret