joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406f50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bb8fa
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
lea eax, [ebp - 0x428]
push eax
push str.SWImeSkinFile
push SysReAllocString
call ebx
test eax, eax
jne 0x407186
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push eax
push str.SWImeSkinFile
push 1
push 0x625f30
push dword [ebp - 0x428]
call esi
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00486960
mov eax, dword [0x63fa20]
add esp, 0xc
test eax, eax
jne 0x40700e
push 0x158
call fcn.00455626
add esp, 4
mov dword [ebp - 0x42c], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x407000
mov ecx, eax
call fcn.00450f00
jmp 0x407002
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x63fa20], eax
push str.SWSkinInst.exe
mov ecx, eax
call fcn.004617b1
push eax
lea eax, [ebp - 0x420]
push 0x5c58d8
push eax
call fcn.0040ad20
add esp, 0x10
lea eax, [ebp - 0x420]
push 0x104
push eax
push 1
push str.DefaultIcon
push dword [ebp - 0x428]
call esi
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00486960
mov eax, dword [0x63fa20]
add esp, 0xc
test eax, eax
jne 0x40709e
push 0x158
call fcn.00455626
add esp, 4
mov dword [ebp - 0x42c], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x407090
mov ecx, eax
call fcn.00450f00
jmp 0x407092
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x63fa20], eax
push str.SWSkinInst.exe
mov ecx, eax
call fcn.004617b1
push eax
lea eax, [ebp - 0x218]
push str.__s_s___install
push eax
call fcn.0040ad20
lea ecx, [ebp - 0x218]
add esp, 0x10
add ecx, 0xfffffffe
nop dword [eax + eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x4070d0
mov eax, dword [0x5c5c40]
mov dword [ecx], eax
mov ax, word [0x5c5c44]
push 0x104
mov word [ecx + 4], ax
lea eax, [ebp - 0x218]
push eax
push 1
push str.shellopencommand_
push dword [ebp - 0x428]
call esi
push dword [ebp - 0x428]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
lea eax, [ebp - 0x424]
push eax
push str..znpf
push SysReAllocString
call ebx
test eax, eax
jne 0x407186
push 0x104
push str.SWImeSkinFile
push 1
push 0x625f30
push dword [ebp - 0x424]
call esi
push dword [ebp - 0x424]
call edi
lea eax, [ebp - 0x424]
push eax
push str..sznpf
push SysReAllocString
call ebx
test eax, eax
jne 0x407186
push 0x104
push str.SWImeSkinFile
push 1
push 0x625f30
push dword [ebp - 0x424]
call esi
push dword [ebp - 0x424]
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00455afe
mov esp, ebp
pop ebp
ret
Function at 0x407760
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bba25
mov eax, dword fs:[0]
push eax
sub esp, 0x418
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00486960
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00486960
mov eax, dword [0x63fa20]
add esp, 0x18
test eax, eax
jne 0x4077f4
push 0x158
call fcn.00455626
add esp, 4
mov dword [ebp - 0x424], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x4077e6
mov ecx, eax
call fcn.00450f00
jmp 0x4077e8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x63fa20], eax
mov ecx, eax
call fcn.004617b1
lea edx, [ebp - 0x420]
sub edx, eax
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x407803
lea edi, [ebp - 0x420]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x407820
mov ecx, 8
mov dword [ebp - 0x218], 0x22
mov esi, str.SWMBManager.exe
lea edx, [ebp - 0x420]
rep movsd dword es:[edi], dword [esi]
mov esi, edx
nop word [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x407850
lea edi, [ebp - 0x218]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x407866
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x218]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x407890
mov eax, dword [0x5c61e0]
lea ecx, [ebp - 0x218]
mov dword [edi], eax
add ecx, 0xfffffffe
nop dword [eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x4078b0
mov eax, dword [0x5c61e4]
mov dword [ecx], eax
mov eax, dword [str.heckSysMb]
mov dword [ecx + 4], eax
mov eax, dword [0x5c61ec]
mov dword [ecx + 8], eax
mov eax, dword [0x5c61f0]
mov dword [ecx + 0xc], eax
mov eax, dword [0x5c61f4]
mov dword [ecx + 0x10], eax
mov eax, dword [0x5c61f8]
mov dword [ecx + 0x14], eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x407913
push 0
push 0
push 0
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004679f1
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00455afe
mov esp, ebp
pop ebp
ret
Function at 0x407ef0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x625f30
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x407f41
push str.SWImeSkinFile
push dword [ebp - 4]
call esi
push str..znpf
push dword [ebp - 4]
call esi
push str..sznpf
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x625f30
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x407f7d
push str.SWImeDictFile
push dword [ebp - 4]
call esi
push str..zncel
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407f90
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bbb9b
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x63fa20]
test eax, eax
jne 0x407ffb
push 0x158
call fcn.00455626
add esp, 4
mov dword [ebp - 0x24c], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x407fed
mov ecx, eax
call fcn.00450f00
jmp 0x407fef
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x63fa20], eax
mov ecx, eax
call fcn.004617b1
mov edx, eax
mov dword [ebp - 0x21c], 7
xor eax, eax
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
cmp word [edx], ax
jne 0x40802a
xor ecx, ecx
jmp 0x40803f
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408030
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x230]
call fcn.00402510
push 0x14
push str.SmartCloudWBInfo.ini
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], 1
call fcn.00404190
push 1
push 0
push 0x625fd4
lea ecx, [ebp - 0x230]
call fcn.0040aaf0
cmp eax, 0xffffffff
je 0x4081a0
push 0xffffffffffffffff
inc eax
lea ecx, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.00403e60
push 0x208
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 2
push 0
push eax
call fcn.00486960
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x1c
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edi, [ebp - 0x218]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4080d0
cmp dword [ebp - 0x234], 8
lea edx, [ebp - 0x248]
mov ecx, 7
mov esi, str.VirtualStore_
cmovae edx, dword [ebp - 0x248]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x408100
lea edi, [ebp - 0x218]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x408116
mov ecx, edx
lea eax, [ebp - 0x218]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x408165
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x218]
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push ecx
push eax
call fcn.0046396c
add esp, 8
mov eax, dword [ebp - 0x234]
cmp eax, 8
jb 0x408183
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.00402610
xor eax, eax
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x4081be
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00402610
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00455afe
mov esp, ebp
pop ebp
ret
Function at 0x4081e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bbbe8
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ecx, ecx
xor ebx, ebx
mov dword [ebp - 0x44], ecx
xor eax, eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x50]
cmp ecx, edi
je 0x40824e
mov ebx, dword [edi]
mov dword [edi], eax
mov eax, dword [edi + 4]
mov dword [edi + 4], 0
mov ecx, dword [edi + 8]
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], ecx
mov dword [edi + 8], 0
mov esi, ebx
cmp ebx, eax
je 0x40837c
nop dword [eax + eax]
xor eax, eax
mov dword [ebp - 0x14], 7
push 0xffffffffffffffff
push eax
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00402760
push str.Dict
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00405ec0
add esp, 0xc
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4082d4
push 0xb
push 0
push 0x5c5b94
lea ecx, [ebp - 0x40]
call fcn.00404f70
cmp eax, 0xffffffff
jne 0x4082d4
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.0040ac30
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 1
cmp eax, 8
jb 0x40832b
mov ecx, dword [ebp - 0x40]
inc eax
cmp eax, 0x7fffffff
ja 0x4083ae
add eax, eax
cmp eax, 0x1000
jb 0x408322
test cl, 0x1f
jne 0x4083ae
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x4083ae
sub ecx, eax
cmp ecx, 4
jb 0x4083ae
cmp ecx, 0x23
ja 0x4083ae
mov ecx, eax
push ecx
call fcn.00455659
add esp, 4
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x40836e
mov ecx, dword [ebp - 0x28]
inc eax
cmp eax, 0x7fffffff
ja 0x4083ae
add eax, eax
cmp eax, 0x1000
jb 0x408365
test cl, 0x1f
jne 0x4083ae
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x4083ae
sub ecx, eax
cmp ecx, 4
jb 0x4083ae
cmp ecx, 0x23
ja 0x4083ae
mov ecx, eax
push ecx
call fcn.00455659
add esp, 4
mov eax, dword [ebp - 0x4c]
add esi, 0x18
cmp esi, eax
jne 0x408260
test ebx, ebx
je 0x4083f7
push dword [ebp - 0x44]
lea ecx, [ebp - 0x50]
push ecx
push eax
push ebx
call fcn.00405fd0
mov ecx, dword [ebp - 0x44]
mov eax, 0x2aaaaaab
sub ecx, ebx
add esp, 0x10
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0xaaaaaaa
jbe 0x4083b3
call fcn.0048a351
lea eax, [eax + eax*2]
shl eax, 3
cmp eax, 0x1000
jb 0x4083ee
test bl, 0x1f
je 0x4083ca
call fcn.0048a351
mov eax, dword [ebx - 4]
cmp eax, ebx
jb 0x4083d6
call fcn.0048a351
sub ebx, eax
cmp ebx, 4
jae 0x4083e2
call fcn.0048a351
cmp ebx, 0x23
jbe 0x4083ec
call fcn.0048a351
mov ebx, eax
push ebx
call fcn.00455659
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00455afe
mov esp, ebp
pop ebp
ret 4
Function at 0x408420
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bbc1b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x234]
push eax
push 0xf003f
push 0
push str.EUDC936
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x238], 0x208
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40848f
xor eax, eax
jmp 0x408563
lea eax, [ebp - 0x230]
mov ecx, esi
push eax
call fcn.00408580
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00486960
add esp, 0xc
lea ecx, [ebp - 0x238]
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push 0
push 0
push eax
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x234]
test eax, eax
je 0x408501
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
jmp 0x408543
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebp - 0x218], 0
jne 0x408515
xor ecx, ecx
jmp 0x40852f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408520
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
call fcn.00402510
mov esi, 1
mov ecx, dword [ebp - 0x21c]
cmp ecx, 8
jb 0x408561
inc ecx
push ecx
push dword [ebp - 0x230]
lea ecx, [ebp - 0x230]
call fcn.00402610
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00455afe
mov esp, ebp
pop ebp
ret 4
Function at 0x408740
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bbc7c
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test esi, esi
jne 0x408781
xor al, al
jmp 0x408997
lea eax, [ebp - 0x278]
push eax
call fcn.00409130
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00486960
add esp, 0xc
lea eax, [ebp - 0x230]
mov ecx, edi
push esi
push eax
call fcn.0040a190
cmp dword [ebp - 0x264], 8
lea eax, [ebp - 0x278]
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0x278]
cmp dword [ebp - 0x21c], 8
push eax
cmovae ecx, dword [ebp - 0x230]
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0x625f30
push ecx
push 0x5c5834
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, 0x625f30
lea eax, [ebp - 0x218]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x408836
test dx, dx
je 0x408832
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x408836
add eax, 4
add ecx, 4
test dx, dx
jne 0x408810
xor eax, eax
jmp 0x40883b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4088d0
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], eax
mov word [ebp - 0x248], ax
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x248]
push ecx
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 2
cmovae eax, dword [ebp - 0x230]
mov ecx, edi
push eax
push 0x5c5834
call fcn.00408c50
lea ecx, [ebp - 0x248]
test al, al
jne 0x40889c
call fcn.00402370
xor bl, bl
jmp 0x40893c
cmp dword [ebp - 0x234], 8
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x248]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x4088b0
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 1
call fcn.00402370
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.00409fe0
lea eax, [ebp - 0x260]
mov byte [ebp - 4], 3
cmp ebx, eax
je 0x4088ff
push 0xffffffffffffffff
push 0
push eax
mov ecx, ebx
call fcn.00402760
mov eax, dword [ebp - 0x24c]
mov bl, 1
cmp eax, 8
jb 0x40891f
inc eax
lea ecx, [ebp - 0x260]
push eax
push dword [ebp - 0x260]
call fcn.00402610
xor eax, eax
mov dword [ebp - 0x24c], 7
mov dword [ebp - 0x250], 0
mov word [ebp - 0x260], ax
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x40895a
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00402610
mov ecx, dword [ebp - 0x264]
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
cmp ecx, 8
jb 0x408995
inc ecx
push ecx
push dword [ebp - 0x278]
lea ecx, [ebp - 0x278]
call fcn.00402610
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00455afe
mov esp, ebp
pop ebp
ret 8
Function at 0x408de0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
push 0xf003f
push 0
push str.EUDC936
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x214], 0x208
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408e75
push 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00486960
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push str.SystemDefaultEUDCFont
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
test eax, eax
je 0x408e88
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00455afe
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebp - 0x20c], 0
jne 0x408e9c
xor ecx, ecx
jmp 0x408eb4
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408ea5
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00402510
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.00455afe
mov esp, ebp
pop ebp
ret 4
Function at 0x408f70
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bbdab
mov eax, dword fs:[0]
push eax
sub esp, 0x680
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0x208
mov dword [ebp - 0x68c], eax
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00486960
push ebx
lea eax, [ebp - 0x420]
push str._s.
push eax
call fcn.0040ad20
add esp, 0x18
lea eax, [ebp - 0x688]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4090ff
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea eax, [ebp - 0x688]
push eax
push esi
call edi
test eax, eax
je 0x4090ff
cmp word [ebp - 0x65c], 0x2e
je 0x408ff7
mov ax, word [ebp - 0x65a]
test ax, ax
je 0x408ff7
cmp ax, 0x2e
jne 0x40902f
cmp word [ebp - 0x658], 0
je 0x408ff7
test byte [ebp - 0x688], 0x10
je 0x408ff7
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00486960
lea eax, [ebp - 0x65c]
push eax
push ebx
lea eax, [ebp - 0x218]
push 0x5c5b7c
push eax
call fcn.0040ad20
xor eax, eax
mov dword [ebp - 0x424], 7
add esp, 0x1c
mov dword [ebp - 0x428], 0
mov word [ebp - 0x438], ax
cmp word [ebp - 0x218], ax
je 0x4090a5
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409096
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x438]
call fcn.00402510
mov ecx, dword [ebp - 0x68c]
lea eax, [ebp - 0x438]
push eax
mov dword [ebp - 4], 0
call fcn.0040ab80
mov eax, dword [ebp - 0x424]
mov dword [ebp - 4], 0xffffffff
cmp eax, 8
jb 0x408ff7
inc eax
lea ecx, [ebp - 0x438]
push eax
push dword [ebp - 0x438]
call fcn.00402610
jmp 0x408ff7
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00455afe
mov esp, ebp
pop ebp
ret 8
Function at 0x4092d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bbe58
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x40]
push eax
call fcn.00408630
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
push 0
push 0x5c5814
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
mov eax, dword [ebp - 0x2c]
setg bl
cmp eax, 8
jb 0x40933d
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00402610
test bl, bl
je 0x4093b0
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
mov ecx, esi
lea eax, [ebp - 0x28]
push eax
push 0x5c5800
call fcn.00408740
mov esi, dword [ebp - 0x14]
test al, al
je 0x40939c
push 1
push 0x5c5810
push dword [ebp - 0x18]
cmp esi, 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0040a970
add esp, 0x10
test eax, eax
jne 0x40939c
lea ecx, [ebp - 0x28]
call fcn.00402370
mov al, 1
jmp 0x4093b2
cmp esi, 8
jb 0x4093b0
lea eax, [esi + 1]
push eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00402610
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00455afe
mov esp, ebp
pop ebp
ret
Function at 0x409e70
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.00486960
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jne 0x409ede
mov eax, dword [ebp - 0x118]
test eax, eax
je 0x409ec8
cmp eax, 1
jne 0x409ede
cmp byte [ebp - 6], 1
jne 0x409ede
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00455afe
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.00455afe
mov esp, ebp
pop ebp
ret

Function at 0x409ef0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push eax
push 0xf003f
push 0
push str.EUDC936
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409fa8
push 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00486960
add esp, 0xc
lea ecx, [ebp + 8]
cmp dword [ebp + 0x1c], 8
lea edx, [ebp - 0x20c]
cmovae ecx, dword [ebp + 8]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x409f56
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
push str.SystemDefaultEUDCFont
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x210]
test eax, eax
je 0x409fd2
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov ecx, dword [ebp + 0x1c]
cmp ecx, 8
jb 0x409fbf
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00402610
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00455afe
mov esp, ebp
pop ebp
ret 0x18
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 1
jmp 0x409faa