joyce8/EMBER2024-capa huggingface dataset:
Function at 0x539080
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60efb3
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x6b000c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x98]
push edx
mov ecx, dword [eax + 0x110]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x98]
mov esi, dword [sym.imp.ycomuiu.dll_public:_bool___thiscall_DuiLib::CStdString::operator_wchar_t_const__const]
push str.btnSearch
call esi
test al, al
je 0x53920f
cmp dword [edi + 0x900], 0
jne 0x53924f
cmp dword [edi + 0x908], 0
je 0x53924f
push 0
push str.FilterEdit
lea eax, [ebp - 0x120]
mov ecx, edi
push eax
call dword [sym.imp.ycomuiu.dll_public:_class_DuiLib::CStdString___thiscall_DuiLib::WindowImplBase::GetDlgItemTextW_wchar_t_const___bool_]
mov byte [ebp - 4], 1
mov ecx, eax
call dword [sym.imp.ycomuiu.dll_public:_wchar_t_const____thiscall_DuiLib::CStdString::operator_wchar_t_const__void_const]
mov esi, eax
test esi, esi
jne 0x53912d
xor ecx, ecx
jmp 0x539141
mov ecx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x539132
sub ecx, ebx
sar ecx, 1
push ecx
push esi
lea ecx, [edi + 0x904]
call fcn.0040c9d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x120]
call dword [sym.imp.ycomuiu.dll_public:_void___thiscall_DuiLib::CStdString::destructor_void_]
mov esi, dword [edi + 0x908]
push ecx
mov edx, dword [esi + 0xeac]
mov ecx, dword [esi + 0xea8]
call fcn.0048dc50
mov eax, dword [esi + 0xea8]
add esp, 4
mov dword [esi + 0xeac], eax
mov esi, dword [edi + 0x908]
mov ebx, dword [esi + 0xeac]
cmp dword [esi + 0xeb0], ebx
je 0x5391bf
mov ecx, dword [edi + 0x904]
sub ecx, 0x10
mov dword [ebp - 0x124], ebx
call fcn.0040c950
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 0
add dword [esi + 0xeac], 4
jmp 0x5391d2
lea eax, [edi + 0x904]
push eax
push ebx
lea ecx, [esi + 0xea8]
call fcn.004c90d0
mov eax, dword [edi + 0x908]
mov dword [0x6b8aac], 0
mov dword [eax + 0xb8c], 3
lea eax, [ebp - 0x128]
push eax
push 0
push edi
push 0x539430
push 0
push 0
call fcn.005b6ff3
add esp, 0x18
mov dword [edi + 0x900], eax
jmp 0x53924f
push str.btnClose
lea ecx, [ebp - 0x98]
call esi
test al, al
je 0x53922c
push 1
mov ecx, edi
call dword [sym.imp.ycomuiu.dll_public:_void___thiscall_DuiLib::CWindowWnd::Close_unsigned_int_]
jmp 0x53924f
push str.btnStop
lea ecx, [ebp - 0x98]
call esi
mov ecx, dword [0x6b8aac]
test al, al
mov edx, 1
cmovne ecx, edx
mov dword [0x6b8aac], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call dword [sym.imp.ycomuiu.dll_public:_void___thiscall_DuiLib::CStdString::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055f9be
mov esp, ebp
pop ebp
ret 4
Function at 0x542990
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6104d1
mov eax, dword fs:[0]
push eax
sub esp, 0x468
mov eax, dword [0x6b000c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x460], ecx
mov eax, dword [ecx + 4]
mov edi, 1
cmp dword [eax - 0xc], 0
je 0x542a77
mov ecx, dword [ecx]
test ecx, ecx
je 0x542a77
mov eax, dword [ecx]
lea edx, [ebp - 0x45c]
push 0
push edx
push ecx
call dword [eax + 0x30]
mov ebx, dword [ebp - 0x454]
lea eax, [ebp - 0x414]
push 0x402
push 0
push eax
call fcn.00588800
xor esi, esi
add esp, 0xc
mov dword [ebp - 0x46c], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x468], esi
mov dword [ebp - 4], edi
xorps xmm0, xmm0
mov eax, dword [ebp - 0x460]
push esi
push 0x80
push 4
push esi
push 3
push 0x40000000
push dword [eax + 4]
movq qword [ebp - 0x474], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x542a95
call fcn.005104b0
mov edi, eax
test edi, edi
je 0x542a9f
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x542a77
push esi
call ebx
mov dword [ebp - 0x46c], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055f9be
mov esp, ebp
pop ebp
ret
mov esi, eax
xor edi, edi
mov dword [ebp - 0x46c], esi
mov eax, dword [ebp - 0x460]
push 0
push 0
push dword [ebp - 0x470]
mov eax, dword [eax]
push dword [ebp - 0x474]
mov dword [ebp - 0x464], 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
test ebx, ebx
je 0x542b24
nop dword [eax + eax]
mov eax, dword [ebp - 0x460]
lea edx, [ebp - 0x464]
push edx
push 0x400
lea edx, [ebp - 0x414]
mov eax, dword [eax]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov edi, eax
test edi, edi
jne 0x542b24
push eax
lea eax, [ebp - 0x470]
push eax
push dword [ebp - 0x464]
lea eax, [ebp - 0x414]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x542b1c
call fcn.005104b0
sub ebx, dword [ebp - 0x464]
jne 0x542ad0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x542a5f
push esi
call ebx
xor esi, esi
mov dword [ebp - 0x46c], esi
jmp 0x542a5f
Function at 0x542b80
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x610530
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x6b000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea edi, [ecx + 4]
mov ecx, dword [edi]
sub ecx, 0x10
call fcn.0040c950
lea esi, [eax + 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 1
push 0x2e
push dword [edi]
call fcn.005884c3
mov ebx, eax
add esp, 8
or eax, 0xffffffff
test ebx, ebx
je 0x542cc1
mov ecx, dword [edi]
sub ebx, ecx
sar ebx, 1
mov dword [ebp - 0x10], ecx
cmp ebx, eax
je 0x542cc1
call fcn.0040bf10
push eax
lea eax, [ebx + 1]
push eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
call fcn.00435c40
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x10]
mov edx, dword [edi]
sub edx, 0x10
mov dword [ebp - 0x18], edx
lea ebx, [eax - 0x10]
cmp ebx, edx
je 0x542c62
cmp dword [edx + 0xc], 0
lea ecx, [edx + 0xc]
mov dword [ebp - 0x14], ecx
jl 0x542c57
mov ecx, dword [ebx]
cmp ecx, dword [edx]
jne 0x542c57
mov ecx, ebx
call fcn.0040c950
mov edx, dword [ebp - 0x14]
or ecx, 0xffffffff
mov dword [ebp - 0x1c], eax
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x542c50
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [eax]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x1c]
add eax, 0x10
mov dword [edi], eax
jmp 0x542c62
push dword [eax - 0xc]
mov ecx, edi
push eax
call fcn.0040c9d0
mov byte [ebp - 4], 1
or eax, 0xffffffff
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x542c7b
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp + 8]
test edx, edx
jne 0x542c86
xor ecx, ecx
jmp 0x542c9f
mov ecx, edx
lea ebx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x542c90
sub ecx, ebx
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.0040ceb0
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x542cbe
push 1
push dword [edi]
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x542cdd
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x550e60
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x613147
mov eax, dword fs:[0]
push eax
mov eax, 0x10010
call fcn.005ddc60
mov eax, dword [0x6b000c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ecx, eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10018], eax
call fcn.004c9940
push 0xfffe
lea eax, [ebp - 0x10010]
push 0
push eax
call fcn.00588800
add esp, 0xc
lea eax, [ebp - 0x10010]
push dword [0x6b9f30]
push 0x7ffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
test eax, eax
je 0x550fb9
cmp word [ebp - 0x10010], 0
lea esi, [ebp - 0x10010]
je 0x550faa
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x3d
push esi
call fcn.00588565
mov edi, eax
add esp, 8
test edi, edi
je 0x550f97
call fcn.0040bf10
mov ecx, edi
sub ecx, esi
push eax
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x1001c]
call fcn.00435c40
mov dword [ebp - 4], 1
add edi, 2
push edi
lea ecx, [ebp - 0x10014]
call fcn.0040c380
mov byte [ebp - 4], 2
lea eax, [ebp - 0x10014]
mov ecx, dword [ebp - 0x10018]
push eax
call fcn.004c5880
mov byte [ebp - 4], 1
or eax, 0xffffffff
mov edx, dword [ebp - 0x10014]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x550f72
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x1001c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x550f97
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push esi
call ebx
lea esi, [esi + eax*2]
add esi, 2
cmp word [esi], 0
jne 0x550ef6
mov eax, dword [ebp - 0x10018]
cmp dword [eax + 4], 0
setne al
jmp 0x550fbb
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055f9be
mov esp, ebp
pop ebp
ret 8
Function at 0x552f90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61387d
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x6b000c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x220], 0
mov ax, word [0x639ee0]
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push 0
push eax
call fcn.00588800
add esp, 0xc
mov dword [ebp - 0x21c], 0x208
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0x660214
push 0x650fc8
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
call fcn.0040bf10
mov ecx, eax
test ecx, ecx
je 0x5530ad
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 1
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.0040c5a0
test al, al
jne 0x55307e
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x553060
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040c9d0
mov dword [ebp - 4], 0
mov dword [ebp - 0x220], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055f9be
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.0040b250
int3

Function at 0x5530c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6138dd
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x6b000c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x220], 0
mov ax, word [0x639ee0]
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push 0
push eax
call fcn.00588800
add esp, 0xc
mov dword [ebp - 0x21c], 0x208
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push str.patch
push 0x650fc8
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
call fcn.0040bf10
mov ecx, eax
test ecx, ecx
je 0x5531dd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 1
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.0040c5a0
test al, al
jne 0x5531ae
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x553190
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040c9d0
mov dword [ebp - 4], 0
mov dword [ebp - 0x220], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055f9be
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.0040b250
int3
Function at 0x553260
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61397d
mov eax, dword fs:[0]
push eax
sub esp, 0x428
mov eax, dword [0x6b000c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x434], esi
xor ebx, ebx
mov dword [ebp - 0x428], ebx
mov ax, word [0x639ee0]
mov word [ebp - 0x21c], ax
push 0x206
push ebx
lea eax, [ebp - 0x21a]
push eax
call fcn.00588800
add esp, 0xc
mov dword [ebp - 0x430], 0x208
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x21c]
push eax
push ebx
push str.partner
push 0x650fc8
push SysReAllocString
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
call edi
test eax, eax
jne 0x55331d
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.0040c380
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], 1
jmp 0x553420
push 0x208
push 0
lea eax, [ebp - 0x424]
push eax
call fcn.00588800
add esp, 0xc
mov dword [ebp - 0x42c], 0x208
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x424]
push eax
push 0
push str.InstallerName
push 0x650fc8
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x5533fb
mov dword [ebp - 4], 1
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
je 0x5533d9
push 0x5f
push eax
call fcn.00588565
add esp, 8
mov edi, eax
test edi, edi
je 0x5533d9
add edi, 2
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x5533d9
add eax, eax
push eax
push edi
push 1
push str.partner
push 0x650fc8
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push edi
mov ecx, esi
call fcn.0040c380
mov dword [ebp - 0x428], 1
jmp 0x553420
mov dword [ebp - 4], 0
jmp 0x5533fb
call fcn.0040bf10
mov ecx, eax
test ecx, ecx
je 0x55343e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0
or ebx, 1
mov dword [ebp - 0x428], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0055f9be
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040b250
int3
Function at 0x554410
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x613c78
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x6b000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
lea eax, [ebp - 0x10]
mov ecx, 0x6b8f68
push eax
call fcn.0048ed00
mov dword [ebp - 4], 0
push dword [ebp - 0x10]
push 0
push str.HasNewInstaller
push str.main
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
mov dword [ebp - 4], 0xffffffff
or esi, 0xffffffff
mov edx, dword [ebp - 0x10]
mov ecx, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x554489
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x554502
mov edx, str.WnRecoverSetup6.exe
lea ecx, [ebp - 0x10]
call fcn.0048e550
mov dword [ebp - 4], 2
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5544e3
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x5544cd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x554502
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x554540
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x613cb8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
mov eax, dword [0x6b000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, str.WnRecoverSetup6.exe
lea ecx, [ebp - 0x10]
call fcn.0048e550
mov dword [ebp - 4], 0
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5545d5
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x6b0dd0
call fcn.00420d90
mov byte [ebp - 4], 1
push 0
mov byte [ebp - 4], 0
mov edx, 4
mov ecx, dword [0x6b1b98]
call fcn.004e0d20
add esp, 0x1c
cmp eax, 6
jne 0x5545d5
push 0xa
push 0
push 0
push dword [ebp - 0x10]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov bl, 1
jmp 0x5545d7
xor bl, bl
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x5545f9
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5548c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x613db1
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x6b000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
mov edx, dword [0x6b9640]
push str.cd.dat
call fcn.0048e450
add esp, 4
mov dword [ebp - 0x10], 1
push dword [eax]
push 1
push str.WxPay
push str.Config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, 1
mov esi, eax
mov dword [ebp - 0x10], ecx
and ecx, 0xfffffffe
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x554957
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x554a20
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x613e31
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x6b000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
mov edx, dword [0x6b9640]
push str.cd.dat
call fcn.0048e450
add esp, 4
mov dword [ebp - 0x10], 1
push dword [eax]
push 1
push str.TermDlg
push str.Config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, 1
mov esi, eax
mov dword [ebp - 0x10], ecx
and ecx, 0xfffffffe
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x554ab7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x554cf0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x613f31
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x6b000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
mov edx, dword [0x6b9640]
push str.cd.dat
call fcn.0048e450
add esp, 4
mov dword [ebp - 0x10], 1
push dword [eax]
push 1
push str.ScanInPath
push str.Scan
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, 1
mov esi, eax
mov dword [ebp - 0x10], ecx
and ecx, 0xfffffffe
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x554d87
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x554fb0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x614031
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x6b000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x10], ebx
cmp dword [0x6b0c60], 0x3a8
je 0x555023
cmp dword [0x6b9784], ebx
je 0x555023
mov edx, str.cd.dat
lea ecx, [ebp - 0x14]
call fcn.0048e550
mov dword [ebp - 4], ebx
mov ebx, 1
mov dword [ebp - 0x10], ebx
push dword [eax]
push ebx
push str.TrialSize
push str.Other
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x555023
mov esi, ebx
jmp 0x555025
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test bl, 1
je 0x555059
and ebx, 0xfffffffe
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x555059
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x555120
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6140b1
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x6b000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
mov edx, dword [0x6b9640]
push str.cd.dat
call fcn.0048e450
add esp, 4
mov dword [ebp - 0x10], 1
push dword [eax]
push 1
push str.DSCScan
push str.Scan
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, 1
mov esi, eax
mov dword [ebp - 0x10], ecx
and ecx, 0xfffffffe
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x5551b7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret