joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411710
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cb162
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x505070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004a1ef0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x411784
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cannot_install_service___d__n
call fcn.00411950
add esp, 8
jmp 0x4118d2
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.pdfServer.exe
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x411813
mov eax, dword [0x51c338]
test eax, eax
jne 0x4117e7
push 0x2c
call fcn.0049f1e8
add esp, 4
mov dword [ebp - 0x21c], eax
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.00410d80
mov dword [ebp - 4], 0xffffffff
mov dword [0x51c338], eax
push str.OpenSCManager_fail
push str.InstallService
push eax
call fcn.00411290
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_failed___d__n
call fcn.00411950
add esp, 8
jmp 0x4118d2
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x218]
push eax
push 1
push 2
push 0x10
push 0xf01ff
push str.masterPDF_Server
push str.masterPDF_Server
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
test esi, esi
jne 0x41188a
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push str.CreateService_failed___d__n
call fcn.00411950
add esp, 8
call esi
push eax
push str.CreateService_fail__error___d
push str.InstallService
call fcn.00411230
push eax
call fcn.00411290
add esp, 0x10
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x4e470c
push 0x4dff34
jmp 0x4118c5
push str.Service_installed_successfully_n
call fcn.00411950
add esp, 4
push str.Service_installed_successfully
push str.InstallService
call fcn.00411230
push eax
call fcn.00411290
add esp, 0xc
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
push 0x4e470c
push 0x4dff2c
push str.delay_enable_server
call fcn.00472b70
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049f1b4
mov esp, ebp
pop ebp
ret
Function at 0x411ef0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40
push esi
mov esi, dword [ebp + 0x10]
push edi
push 5
push str._oftp
push esi
call fcn.004b10c3
add esp, 0xc
test eax, eax
jne 0x411f24
lea ecx, [esi + 0xc]
call fcn.00411c30
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 4
push str._coe
push esi
call fcn.004b10c3
add esp, 0xc
test eax, eax
jne 0x411f47
call fcn.00411e80
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 0x13
push str._setPdfDefaulttrue
push esi
call fcn.004b10c3
add esp, 0xc
test eax, eax
jne 0x411f7a
push ecx
mov ecx, esp
push 0x4e470c
call fcn.00405360
call fcn.00471970
add esp, 4
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
sub esp, 0xc
call fcn.00412820
lea ecx, [esp + 0xc]
call fcn.0046d5c0
push ecx
push dword [eax]
call fcn.004119a0
mov ecx, eax
call fcn.0047a410
mov edx, dword [esp + 0xc]
or edi, 0xffffffff
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x411fc0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [esp + 0xc]
call fcn.0046d8c0
push dword [eax]
push ecx
call fcn.004119a0
add esp, 4
mov ecx, eax
call fcn.0047a290
mov edx, dword [esp + 0xc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x411ff4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
sub esp, 8
call fcn.004119a0
add esp, 4
mov ecx, eax
call fcn.0047a240
call fcn.004119a0
mov dword [eax + 0x1a40], 0x411ac0
call fcn.004119a0
cmp dword [0x51c33c], 0
mov dword [eax + 0x1a34], 0
jne 0x412042
push 4
call fcn.0049f1e8
add esp, 4
mov dword [0x51c33c], eax
mov dword [eax], vtable.CSkinMgr.0
push ecx
push esp
call fcn.0041d300
call fcn.0043b4e0
mov ecx, eax
call fcn.0043b540
lea eax, [esp + 0x10]
mov dword [esp + 0x10], vtable.WTL::CMessageLoop.0
xorps xmm0, xmm0
mov dword [esp + 0x24], 0
push eax
movups xmmword [esp + 0x18], xmm0
mov dword [esp + 0x2c], 0
call fcn.004126a0
push ecx
lea edx, [esp + 0x14]
mov ecx, esi
call fcn.0041c000
add esp, 4
mov edi, eax
call fcn.00412590
mov esi, dword [0x51bafc]
test esi, esi
je 0x4120b1
mov ecx, esi
call fcn.0047ab50
push 0x50
push esi
call fcn.0049f891
add esp, 8
mov dword [0x51bafc], 0
call fcn.00412400
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [esp + 0x10]
call fcn.004120f0
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x414000
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x228
mov eax, dword [0x505070]
xor eax, esp
mov dword [esp + 0x224], eax
mov eax, dword [ecx + 4]
mov edx, dword [ebp + 8]
or eax, 0x2001f
push esi
push edi
push eax
push edx
push dword [ecx]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.00413f80
mov esi, eax
test esi, esi
jne 0x4140f7
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x20]
push eax
push esi
push esi
push esi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x100
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x28]
call edi
test eax, eax
jne 0x4140c9
nop dword [eax]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
call fcn.00414000
mov esi, eax
test esi, esi
jne 0x4140f7
lea eax, [esp + 0x20]
mov dword [esp + 8], 0x100
push eax
push esi
push esi
push esi
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x28]
call edi
test eax, eax
je 0x414090
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4140e0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], 0
push dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], 0
call fcn.004141a0
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x414106
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x22c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.0049f1b4
mov esp, ebp
pop ebp
ret 4
Function at 0x414da0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cb436
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x505070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
push 0x60
push 0
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x414e4c
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x414e4c
call fcn.004133a0
mov esi, eax
jmp 0x414f3c
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x414e6f
call fcn.004133a0
jmp 0x414f2f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x414e8d
call fcn.004133a0
jmp 0x414f2f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x414eae
mov esi, 0x8007000e
jmp 0x414f31
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.00413350
jmp 0x414ed8
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
jne 0x414eef
mov esi, 0x8007000e
jmp 0x414f31
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x414f0f
call fcn.004133a0
jmp 0x414f2f
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.00414c40
mov esi, eax
test edi, edi
je 0x414f3c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x414f60
lea ecx, [ebp - 0x418]
call fcn.00413300
nop word [eax + eax]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0049f1b4
mov esp, ebp
pop ebp
ret 0x10
Function at 0x415b90
Capabilities:
Check if file exists
Delete file
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x415bb8
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x415bb8
push 0
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [esi + 0x13c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x415bdf
push dword [esi + 0x13c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esi + 0x138]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x415bfb
push dword [esi + 0x138]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x415c19
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_DestroyWindow]
pop esi
ret
Function at 0x4161b0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cb5d1
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x505070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.00405a90
mov ecx, eax
test ecx, ecx
jne 0x4161fe
push 0x80004005
call fcn.00405cb0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
mov edx, str.kzx
mov dword [ebp - 0x10], 1
call fcn.0046d5f0
push eax
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.00403c60
mov byte [ebp - 4], 0
or eax, 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x416251
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x416266
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x416ff0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x85c
mov eax, dword [0x505070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
jne 0x417023
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049f1b4
mov esp, ebp
pop ebp
ret 0x14
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.004a1ef0
add esp, 0xc
lea eax, [ebp - 0x804]
test edi, edi
je 0x417056
push edi
push esi
push 0x4e5e68
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x417066
push esi
push 0x4e4b3c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x40
lea eax, [ebp - 0x858]
push 0
push eax
call fcn.004a1ef0
mov ax, word [ebp + 0x18]
add esp, 0xc
mov word [ebp - 0x82c], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x818]
mov dword [ebp - 0x85c], 0x44
movups xmmword [ebp - 0x818], xmm0
push eax
lea eax, [ebp - 0x85c]
mov dword [ebp - 0x830], 1
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x41700f
cmp dword [ebp + 0x10], 0
je 0x417105
push dword [ebp + 0x14]
push dword [ebp - 0x818]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x808]
mov dword [ebp - 0x808], 0
push eax
push dword [ebp - 0x818]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x818]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x814]
call esi
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0049f1b4
mov esp, ebp
pop ebp
ret 0x14
Function at 0x417260
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x505070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push eax
push 1
push 0
push str.Software360QuickNewsCommon
push SysReAllocStringLen
mov esi, ecx
mov dword [ebp - 0x214], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41736a
push 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004a1ef0
add esp, 0xc
mov dword [ebp - 0x214], 1
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0x4e5eb0
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SoftMgrNewsLook.exe
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x20c]
lea ecx, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x417330
sub edx, ecx
lea eax, [ebp - 0x20c]
sar edx, 1
mov ecx, esi
push edx
push eax
call fcn.00405580
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049f1b4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0049f1b4
mov esp, ebp
pop ebp
ret
Function at 0x417380
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cb838
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x505070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.0046da20
mov dword [ebp - 4], 0
test esi, esi
jg 0x4173ee
push dword [ebp + 8]
push 0
push str.PopWndNextDays
push 0x4e5ee8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
xor ecx, ecx
cmp esi, dword [ecx*4 + 0x4dff84]
jl 0x4173e7
inc ecx
cmp ecx, 4
jl 0x4173d6
jmp 0x4173ee
mov esi, dword [ecx*4 + 0x4dff84]
call fcn.00405a90
mov ecx, eax
test ecx, ecx
jne 0x417403
push 0x80004005
call fcn.00405cb0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push esi
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push 0x4e4588
push eax
call fcn.00408f50
mov edi, dword [ebp - 0x10]
add esp, 0xc
push dword [ebp + 8]
push edi
push str.PopWndNextDays
push 0x4e5ee8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
call fcn.00405a90
mov ecx, eax
test ecx, ecx
jne 0x417450
push 0x80004005
call fcn.00405cb0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push 0
mov byte [ebp - 4], 2
call fcn.004b117c
add esp, 4
push edx
push eax
lea eax, [ebp - 0x14]
push 0x4e5fb8
push eax
call fcn.00408f50
mov esi, dword [ebp - 0x14]
add esp, 0x10
push dword [ebp + 8]
push esi
push str.PopWndLastTime
push 0x4e5ee8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea edx, [esi - 0x10]
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4174b1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
add edi, 0xfffffff0
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4174cc
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x4174eb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x417510
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cb86b
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x505070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00405a90
mov ecx, eax
test ecx, ecx
jne 0x417553
push 0x80004005
call fcn.00405cb0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x220], eax
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], 0
call fcn.00417260
or ebx, 0xffffffff
test eax, eax
je 0x417581
xor esi, esi
jmp 0x417655
lea ecx, [ebp - 0x21c]
call fcn.0046da20
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004a1ef0
add esp, 0xc
lea eax, [ebp - 0x218]
push dword [ebp - 0x21c]
push 0x104
push eax
push 0x4e470c
push str.PopWndLastTime
push 0x4e5ee8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push dword [ebp - 0x21c]
push 0
push str.PopWndNextDays
push 0x4e5ee8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x224], eax
test eax, eax
jne 0x4175f0
lea esi, [eax + 1]
jmp 0x417638
lea eax, [ebp - 0x218]
push eax
call fcn.004b1045
push 0
mov esi, eax
mov edi, edx
call fcn.004b117c
add esp, 8
mov ecx, edx
sub eax, esi
mov dword [ebp - 0x228], eax
sbb ecx, edi
imul eax, dword [ebp - 0x224], 0x15180
cdq
cmp ecx, edx
jb 0x417636
ja 0x41762f
cmp dword [ebp - 0x228], eax
jbe 0x417636
mov esi, 1
jmp 0x417638
xor esi, esi
mov edx, dword [ebp - 0x21c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x417655
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x417677
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049f1b4
mov esp, ebp
pop ebp
ret
Function at 0x418f10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cbb90
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x505070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov eax, 0x2aaaaaab
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
sub edx, esi
imul edx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ecx + 0x58], eax
je 0x419046
xor edi, edi
lea eax, [edi + esi]
push eax
lea ecx, [ebp - 0x50]
call fcn.00418cd0
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00419620
mov byte [ebp - 4], 2
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
lea eax, [ebp - 0x50]
push eax
push ecx
mov esi, esp
je 0x418fba
mov dword [ebp - 0x1c], esi
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00405420
mov ecx, dword [ebp - 0x18]
add eax, 0x10
mov dword [esi], eax
call fcn.004194a0
jmp 0x418ff6
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x20], esi
call fcn.00405420
add eax, 0x10
mov dword [esi], eax
push ecx
mov byte [ebp - 4], 3
mov esi, esp
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x20], esi
lea ecx, [ecx - 0x10]
call fcn.00405420
mov ecx, dword [ebp - 0x18]
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 2
call fcn.00419220
mov byte [ebp - 4], 1
or eax, 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x419015
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0
call fcn.0040cce0
mov ecx, dword [ebp + 0xc]
mov eax, 0x2aaaaaab
mov esi, dword [ebp + 8]
inc ebx
sub ecx, esi
add edi, 0x30
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x418f68
lea ecx, [ebp + 8]
call fcn.00419e70
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x419070
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x505070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, str.HKEY_LOCAL_MACHINE
mov ecx, dword [eax + 0x18]
push ebx
lea ebx, [eax + 0x18]
mov dword [ebp - 0x214], eax
push esi
push edi
mov edi, reloc.OLEAUT32.dll_SysReAllocString
mov eax, ecx
mov si, word [eax]
cmp si, word [edx]
jne 0x4190c7
test si, si
je 0x4190c3
mov si, word [eax + 2]
cmp si, word [edx + 2]
jne 0x4190c7
add eax, 4
add edx, 4
test si, si
jne 0x4190a1
xor eax, eax
jmp 0x4190cc
sbb eax, eax
or eax, 1
test eax, eax
je 0x419138
mov eax, str.HKEY_CURRENT_USER
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x4190fb
test dx, dx
je 0x4190f7
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x4190fb
add ecx, 4
add eax, 4
test dx, dx
jne 0x4190d5
xor eax, eax
jmp 0x419100
sbb eax, eax
or eax, 1
test eax, eax
jne 0x41910b
mov edi, SysReAllocStringLen
jmp 0x419138
mov edx, str.HKEY_USERS
mov ecx, ebx
call fcn.00403860
test al, al
je 0x419122
mov edi, SysReAllocStringLen
jmp 0x419138
mov edx, str.HKEY_CLASSES_ROOT
mov ecx, ebx
call fcn.00403860
test al, al
mov ecx, SysReAllocStringLen
cmovne edi, ecx
mov esi, dword [ebp - 0x214]
lea eax, [ebp - 0x210]
push eax
push 1
push 0
push dword [esi + 0x1c]
mov dword [ebp - 0x210], 0
push edi
mov dword [ebp - 0x218], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x419204
push 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004a1ef0
add esp, 0xc
mov dword [ebp - 0x218], 1
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push dword [esi + 0x20]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esi + 0x24]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049f1b4
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049f1b4
mov esp, ebp
pop ebp
ret 4