joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40894f
Capabilities:
Create directory

Disassembly:
mov eax, 0x4a8589
call fcn.004a6844
sub esp, 0x38
push ebx
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x28]
call fcn.00408a98
lea eax, [ebp + 8]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x28]
mov dword [ebp + 8], 0x5c
call fcn.00408b26
cmp eax, 0xffffffff
je 0x408a46
push eax
lea eax, [ebp - 0x28]
push eax
lea esi, [ebp - 0x44]
call fcn.00408ac4
cmp dword [eax + 0x18], 8
jb 0x4089a3
mov eax, dword [eax + 4]
jmp 0x4089a6
add eax, 4
push ebx
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push ebx
push 1
lea esi, [ebp - 0x44]
mov edi, eax
call fcn.00406942
cmp edi, ebx
je 0x4089fb
cmp edi, 0x50
je 0x4089fb
cmp edi, 0xb7
je 0x4089fb
cmp edi, ebx
jle 0x4089dd
and edi, 0xffff
or edi, 0x80070000
push ebx
push 1
lea esi, [ebp - 0x28]
call fcn.00406942
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x408a07
lea eax, [ebp - 0x24]
push ebx
push 0x80
push 1
push ebx
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x408a3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x408a37
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x4089dd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
jmp 0x4089dd
mov edi, 0x80070057
jmp 0x4089dd

Function at 0x408e36
Capabilities:
Set registry value

Disassembly:
push edi
xor edi, edi
cmp dword [esi], edi
je 0x408e64
push dword [esp + 0xc]
call fcn.00476b5e
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0x10]
push 1
push edi
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x408e64
inc edi
mov eax, edi
pop edi
ret 8

Function at 0x408e7e
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
mov dword [esi], eax
push ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
mov dword [edi], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x408f07
push ebx
call fcn.00476555
pop ecx
push eax
push ebx
push dword [ebp - 8]
mov dword [ebp - 4], eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x408ef8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4b3724
push dword [ebp - 4]
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x408ef8
cmp dword [ebp - 0xc], ebx
je 0x408ef8
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
mov dword [edi], ecx
mov eax, dword [eax + 0xc]
mov dword [esi], eax
mov dword [ebp - 0x14], 1
cmp dword [ebp - 4], 0
je 0x408f07
push dword [ebp - 4]
call fcn.004768b7
pop ecx
mov eax, dword [ebp - 0x14]
pop ebx
leave
ret
Function at 0x408f43
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4a8304
call fcn.004a6844
sub esp, 0x20c
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov ecx, 0x4d906c
mov dword [ebp - 0x10], edi
call fcn.0040134f
push 0x206
lea eax, [ebp - 0x216]
mov dword [ebp - 4], edi
push edi
push eax
mov dword [ebp - 0x10], 1
mov word [ebp - 0x218], di
call fcn.00476790
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.0040107b
push esi
call fcn.00409fe9
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40909e
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x11c
push esi
push edi
mov esi, 0x11c
push esi
xor edi, edi
lea eax, [ebp - 0xa4]
push edi
push eax
call fcn.00476790
add esp, 0xc
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
cmp eax, edi
jne 0x4090f7
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], 0x114
call esi
cmp eax, edi
je 0x4091ad
mov eax, dword [ebp - 0x94]
dec eax
je 0x409199
dec eax
jne 0x4091ad
mov eax, dword [ebp - 0xa0]
xor edx, edx
push 6
pop ecx
inc edx
cmp eax, ecx
jne 0x409146
cmp dword [ebp - 0x9c], edx
jne 0x409130
xor eax, eax
cmp byte [ebp + 0x76], dl
setne al
add eax, 8
jmp 0x409195
cmp dword [ebp - 0x9c], edi
jne 0x40917e
xor eax, eax
cmp byte [ebp + 0x76], dl
setne al
lea eax, [eax + eax + 7]
jmp 0x409195
cmp eax, 5
jne 0x409170
cmp dword [ebp - 0x9c], 2
jne 0x409157
push eax
jmp 0x409177
cmp dword [ebp - 0x9c], 1
jne 0x409164
mov edi, ecx
jmp 0x4091ad
cmp dword [ebp - 0x9c], edi
jne 0x4091ad
push 3
jmp 0x409177
cmp eax, 4
ja 0x40917a
push 4
pop edi
jmp 0x4091ad
cmp eax, ecx
jb 0x4091ad
cmp dword [ebp - 0x9c], 2
jae 0x40918b
cmp eax, ecx
jbe 0x4091ad
cmp byte [ebp + 0x76], dl
jne 0x4091ad
call fcn.00408fc6
mov edi, eax
jmp 0x4091ad
mov eax, dword [ebp - 0x98]
and eax, 0xffff0000
cmp eax, 0x45a0000
sbb edi, edi
inc edi
inc edi
mov eax, edi
pop edi
pop esi
add ebp, 0x78
leave
ret
Function at 0x409917
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
call fcn.00408557
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x4099c4
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0x200000
ja 0x4099c3
lea eax, [edi + 1]
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp + 8], edi
call fcn.00408596
mov esi, eax
mov dword [ebp - 4], esi
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4099c3
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x4099c3
sub dword [ebp + 8], eax
add dword [ebp - 4], eax
cmp dword [ebp + 8], ebx
jne 0x409974
mov byte [esi + edi], bl
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
cmp eax, ebx
jne 0x4099ae
xor eax, eax
jmp 0x4099b5
push eax
call fcn.00477a30
pop ecx
mov edx, esi
call fcn.004085bc
mov dword [ebp - 0x10], 1
pop edi
cmp dword [ebp - 8], ebx
pop esi
pop ebx
je 0x4099d4
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 8

Function at 0x40a07d
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x40a0a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40a163
push edi
push 0x228
xor edi, edi
lea eax, [ebp - 0x22c]
push edi
push eax
mov dword [ebp - 4], 0x490
call fcn.00476790
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
push esi
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40a112
lea eax, [ebp - 0x20c]
push 0x4b882c
push eax
call fcn.0047b084
test eax, eax
pop ecx
pop ecx
je 0x40a106
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40a0dc
jmp 0x40a11b
mov edi, dword [ebp - 0x228]
and dword [ebp - 4], 0
jmp 0x40a11b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x40a140
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40a162
push dword [ebp + 8]
push 0xf01ff
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40a15c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push edi
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret
Function at 0x40a248
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
test esi, esi
jne 0x40a25a
or eax, 0xffffffff
leave
ret
push 0x110
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.00476790
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40a29d
cmp dword [ebp - 0x110], 5
jne 0x40a29d
cmp dword [ebp - 0x10c], 0
je 0x40a2aa
push esi
call fcn.0040a166
test eax, eax
pop ecx
jne 0x40a2aa
leave
ret
push esi
call fcn.0040a07d
pop ecx
leave
ret

Function at 0x40a2b3
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 1], bl
mov dword [ebp - 8], ebx
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], bl
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40a373
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push 2
push dword [ebp + 8]
call esi
test eax, eax
jne 0x40a319
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40a372
push edi
push dword [ebp - 0xc]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push edi
push 2
push dword [ebp + 8]
call esi
test eax, eax
je 0x40a366
cmp dword [edi], ebx
mov dword [ebp - 0x10], ebx
jbe 0x40a366
lea esi, [edi + 4]
push dword [esi]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x40a362
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add esi, 8
cmp eax, dword [edi]
jb 0x40a344
jmp 0x40a366
mov byte [ebp - 1], 1
cmp edi, ebx
je 0x40a371
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
cmp dword [ebp - 8], ebx
pop ebx
je 0x40a382
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov al, byte [ebp - 1]
leave
ret
Function at 0x40a387
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
xor edi, edi
push 1
push edi
push edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
jne 0x40a3f5
push 0x110
lea eax, [ebp - 0x118]
push edi
push eax
call fcn.00476790
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 0x11c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40a3ef
cmp dword [ebp - 0x118], 6
jne 0x40a3ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40a42a
mov dword [esi], edi
xor eax, eax
jmp 0x40a42a
mov ecx, dword [ebp - 8]
xor eax, eax
cmp dword [ebp - 4], edi
push ebx
mov ebx, 0x490
jbe 0x40a421
lea edx, [ecx + 8]
cmp dword [edx], edi
je 0x40a417
inc eax
add edx, 0xc
cmp eax, dword [ebp - 4]
jb 0x40a408
jmp 0x40a421
imul eax, eax, 0xc
mov eax, dword [eax + ecx]
mov dword [esi], eax
xor ebx, ebx
push ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, ebx
pop ebx
pop edi
leave
ret

Function at 0x40adbf
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
xor eax, eax
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x6c], 0x67452301
mov dword [ebp - 0x68], 0xefcdab89
mov dword [ebp - 0x64], 0x98badcfe
mov dword [ebp - 0x60], 0x10325476
call fcn.0040abe6
lea eax, [ebp - 0x14]
push eax
lea esi, [ebp - 0x6c]
call fcn.0040aca9
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.0040ad45
mov eax, dword [ebp + 8]
add esp, 0x10
pop esi
leave
ret

Function at 0x40af7d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x230
push esi
mov esi, eax
cmp dword [esi + 0x14], 0x104
push edi
jb 0x40af9d
xor al, al
jmp 0x40b02a
and word [esp + 0x28], 0
push 0x208
lea eax, [esp + 0x2e]
push 0
push eax
call fcn.00476790
add esp, 0xc
cmp dword [esi + 0x18], 8
jb 0x40afc2
mov esi, dword [esi + 4]
jmp 0x40afc5
add esi, 4
push esi
lea eax, [esp + 0x2c]
push 0x105
push eax
call fcn.0047bdf0
and dword [esp + 0x14], 0
add esp, 0xc
push 6
xor eax, eax
pop ecx
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x28]
mov dword [esp + 0x10], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0x10], 3
mov word [esp + 0x1c], 0x414
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp dword [esp + 0x1a], 0
jne 0x40af96
test eax, eax
je 0x40b027
cmp eax, 2
je 0x40b027
cmp eax, 0x402
je 0x40b027
xor eax, eax
jmp 0x40b02a
xor eax, eax
inc eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40da8c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
cmp dword [esi + 0xc], 0xffffffff
jne 0x40daf0
push ebx
push edi
lea ebx, [ebp - 4]
call fcn.0040e21f
push dword [eax]
xor ebx, ebx
push ebx
push 0x4b8be0
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00401018
cmp edi, ebx
je 0x40dadf
lea eax, [ebp - 4]
push eax
push esi
mov dword [ebp - 4], ebx
call fcn.0040dbdd
test eax, eax
je 0x40dadf
cmp dword [ebp - 4], ebx
jne 0x40dae8
call fcn.0040e322
test eax, eax
je 0x40daeb
xor eax, eax
inc eax
pop edi
mov dword [esi + 0xc], eax
pop ebx
mov eax, dword [esi + 0xc]
pop esi
leave
ret

Function at 0x40dc80
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x4a9990
call fcn.004a6844
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x20]
add edi, 0x1c
test eax, eax
je 0x40dcaa
mov ecx, dword [edi + 8]
sub ecx, eax
sar ecx, 3
jne 0x40ddd5
mov eax, dword [0x4d906c]
mov ecx, 0x4d906c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
lea ebx, [ebp - 0x1c]
call fcn.0040e21f
mov byte [ebp - 4], 1
push dword [eax]
mov eax, 0x104
push eax
push eax
lea esi, [ebp - 0x14]
call fcn.00401248
push eax
push str.1.01.21.5
push str.supportrate
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ebx, ebx
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00401018
cmp dword [ebp - 0x14], ebx
jne 0x40dd0d
xor eax, eax
jmp 0x40dd16
push dword [ebp - 0x14]
call fcn.00476b5e
pop ecx
lea edx, [ebp - 0x14]
call fcn.004013fd
mov esi, 0x4b88c8
push esi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
push eax
lea ecx, [ebp - 0x1c]
lea ebx, [ebp - 0x14]
call fcn.0042e6fd
jmp 0x40ddb1
push eax
call fcn.0047c73e
fstp qword [ebp - 0x24]
mov edx, dword [edi + 4]
test edx, edx
pop ecx
jne 0x40dd4d
xor ecx, ecx
jmp 0x40dd55
mov ecx, dword [edi + 8]
sub ecx, edx
sar ecx, 3
test edx, edx
je 0x40dd75
mov eax, dword [edi + 0xc]
sub eax, edx
sar eax, 3
cmp ecx, eax
jae 0x40dd75
mov eax, dword [edi + 8]
fld qword [ebp - 0x24]
fstp qword [eax]
add eax, 8
mov dword [edi + 8], eax
jmp 0x40dd92
mov ebx, dword [edi + 8]
cmp edx, ebx
jbe 0x40dd81
call fcn.004771be
push ebx
push edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, edi
call fcn.0042f99f
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00401018
push esi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
lea ebx, [ebp - 0x14]
call fcn.0042e6fd
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], 0
jne 0x40dd38
add eax, 0xfffffff0
call fcn.00401018
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401018
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x40e01b
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi + 0x18], 0
jne 0x40e051
push ebx
lea ebx, [ebp - 4]
call fcn.0040e21f
push dword [eax]
push 2
push 0x4b8bf0
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00401018
pop ebx
mov eax, dword [esi + 0x18]
leave
ret

Function at 0x40e21f
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4a8f0e
call fcn.004a6844
push ecx
push ecx
and dword [ebp - 0x14], 0
push edi
lea edi, [ebp - 0x14]
call fcn.004631cf
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
jne 0x40e25d
push 0x4b878c
push ebx
call fcn.00406140
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401018
jmp 0x40e2c8
add eax, 0xfffffff0
call fcn.00401543
add eax, 0x10
mov dword [ebp - 0x10], eax
push str.datadpiconfig.ini
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 1
call fcn.004011e5
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40e2a2
lea eax, [ebp - 0x14]
lea edi, [ebp - 0x10]
call fcn.0040103a
push str._ressrcchsdpisetting.ini
mov eax, edi
push eax
call fcn.004011e5
push esi
mov esi, dword [ebp - 0x10]
add esi, 0xfffffff0
mov eax, esi
call fcn.00401543
add eax, 0x10
mov dword [ebx], eax
mov eax, esi
call fcn.00401018
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401018
pop esi
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
mov dword fs:[0], ecx
leave
ret

Function at 0x40e2d7
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, esi
call fcn.0040dfa2
test eax, eax
jne 0x40e2eb
push 0x60
pop eax
leave
ret
cmp dword [esi + 8], 0xffffffff
jne 0x40e31d
push ebx
lea ebx, [ebp - 4]
call fcn.0040e21f
push dword [eax]
push 0x60
push str.debugdpi
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esi + 8], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00401018
pop ebx
mov eax, dword [esi + 8]
leave
ret

Function at 0x40e322
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi + 4], 0xffffffff
jne 0x40e358
push ebx
lea ebx, [ebp - 4]
call fcn.0040e21f
push dword [eax]
push 0
push str.debug
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00401018
pop ebx
mov eax, dword [esi + 4]
leave
ret
Function at 0x40e35d
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x4a8f4a
call fcn.004a6844
push ecx
and dword [ebp - 0x10], 0
push esi
mov esi, ecx
add esi, 0x14
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jne 0x40e3cf
push ebx
lea ebx, [ebp - 0x10]
call fcn.0040e21f
and dword [ebp - 4], 0
push dword [eax]
mov eax, 0x104
push eax
push eax
call fcn.00401248
push eax
push str.kxetray
push str.supportprocess
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401018
mov eax, dword [esi]
test eax, eax
pop ebx
je 0x40e3c8
push eax
call fcn.00476b5e
pop ecx
mov edx, esi
call fcn.004013fd
mov eax, dword [esi]
sub eax, 0x10
call fcn.00401543
mov ecx, dword [ebp - 0xc]
add eax, 0x10
mov dword [edi], eax
mov eax, edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40e559
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, word [ebp + 0xc]
push esi
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x40e5dc
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x40e5a5
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x40e5a5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [ebp + 0xc], eax
jne 0x40e5a9
xor eax, eax
jmp 0x40e5db
mov esi, dword [ebp + 0x10]
push edi
lea edi, [ebx + 1]
push edi
call fcn.00408596
test eax, eax
je 0x40e5c7
push ebx
push dword [ebp + 0xc]
push eax
call fcn.0047ac10
add esp, 0xc
mov eax, edi
call fcn.00409a5d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
inc eax
pop edi
pop ebx
pop esi
leave
ret
Function at 0x40e70c
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, 0x4a8e69
call fcn.004a6844
push ecx
push ecx
mov eax, dword [0x4d906c]
push ebx
push esi
push edi
mov edi, ecx
mov esi, 0x4d906c
xor ebx, ebx
mov ecx, esi
mov dword [ebp - 0x14], ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x14], ebx
lea eax, [edi + 0xc]
jne 0x40e744
mov eax, edi
lea edi, [ebp - 0x10]
call fcn.0040103a
mov edi, dword [ebp - 0x10]
cmp dword [edi - 0xc], ebx
je 0x40e83a
mov eax, dword [0x4d906c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0x14], eax
push dword [ebp + 0x10]
mov byte [ebp - 4], 1
push dword [ebp + 8]
lea eax, [ebp + 0x14]
push edi
push str._s_d._s
call fcn.00406b30
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp + 0x10], eax
je 0x40e82f
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, ebx
je 0x40e826
mov esi, dword [ebp + 0xc]
push ebx
lea eax, [ebp + 8]
push eax
push edi
lea eax, [edi + 0xa]
push eax
mov dword [ebp + 8], ebx
call fcn.00408596
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x40e81d
cmp dword [ebp + 8], edi
jne 0x40e81d
mov eax, edi
call fcn.00409a5d
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
call fcn.00401018
xor esi, esi
inc esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401018
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
xor eax, eax
mov edx, esi
call fcn.004085bc
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
call fcn.00401018
mov esi, dword [ebp - 0x14]
jmp 0x40e7ff