joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408eb9
Capabilities:
Create directory

Disassembly:
mov eax, 0x4a981e
call fcn.004a7794
sub esp, 0x38
push ebx
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x28]
call fcn.00409002
lea eax, [ebp + 8]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x28]
mov dword [ebp + 8], 0x5c
call fcn.00409090
cmp eax, 0xffffffff
je 0x408fb0
push eax
lea eax, [ebp - 0x28]
push eax
lea esi, [ebp - 0x44]
call fcn.0040902e
cmp dword [eax + 0x18], 8
jb 0x408f0d
mov eax, dword [eax + 4]
jmp 0x408f10
add eax, 4
push ebx
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push ebx
push 1
lea esi, [ebp - 0x44]
mov edi, eax
call fcn.0040681f
cmp edi, ebx
je 0x408f65
cmp edi, 0x50
je 0x408f65
cmp edi, 0xb7
je 0x408f65
cmp edi, ebx
jle 0x408f47
and edi, 0xffff
or edi, 0x80070000
push ebx
push 1
lea esi, [ebp - 0x28]
call fcn.0040681f
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x408f71
lea eax, [ebp - 0x24]
push ebx
push 0x80
push 1
push ebx
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x408fa5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x408fa1
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x408f47
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
jmp 0x408f47
mov edi, 0x80070057
jmp 0x408f47

Function at 0x4093a0
Capabilities:
Set registry value

Disassembly:
push edi
xor edi, edi
cmp dword [esi], edi
je 0x4093ce
push dword [esp + 0xc]
call fcn.0047a9ca
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0x10]
push 1
push edi
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4093ce
inc edi
mov eax, edi
pop edi
ret 8

Function at 0x4093e8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
mov dword [esi], eax
push ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
mov dword [edi], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x409471
push ebx
call fcn.00476e91
pop ecx
push eax
push ebx
push dword [ebp - 8]
mov dword [ebp - 4], eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x409462
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4b95b8
push dword [ebp - 4]
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x409462
cmp dword [ebp - 0xc], ebx
je 0x409462
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
mov dword [edi], ecx
mov eax, dword [eax + 0xc]
mov dword [esi], eax
mov dword [ebp - 0x14], 1
cmp dword [ebp - 4], 0
je 0x409471
push dword [ebp - 4]
call fcn.00479a04
pop ecx
mov eax, dword [ebp - 0x14]
pop ebx
leave
ret
Function at 0x4094ad
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4aa31d
call fcn.004a7794
sub esp, 0x20c
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov ecx, 0x4da2a0
mov dword [ebp - 0x10], edi
call fcn.00405e98
push 0x206
lea eax, [ebp - 0x216]
mov dword [ebp - 4], edi
push edi
push eax
mov dword [ebp - 0x10], 1
mov word [ebp - 0x218], di
call fcn.00477840
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.00406070
push esi
call fcn.004064f4
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x409608
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x11c
push esi
push edi
mov esi, 0x11c
push esi
xor edi, edi
lea eax, [ebp - 0xa4]
push edi
push eax
call fcn.00477840
add esp, 0xc
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
cmp eax, edi
jne 0x409661
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], 0x114
call esi
cmp eax, edi
je 0x409724
mov eax, dword [ebp - 0x94]
dec eax
je 0x409710
dec eax
jne 0x409724
mov eax, dword [ebp - 0xa0]
mov esi, dword [ebp - 0x9c]
xor edx, edx
push 6
pop ecx
inc edx
cmp eax, ecx
jne 0x4096ae
cmp esi, edx
jne 0x40969c
xor eax, eax
cmp byte [ebp + 0x76], dl
setne al
add eax, 8
jmp 0x40970c
cmp esi, edi
jne 0x4096e6
xor eax, eax
cmp byte [ebp + 0x76], dl
setne al
lea eax, [eax + eax + 7]
jmp 0x40970c
cmp eax, 5
jne 0x4096d8
cmp dword [ebp - 0x9c], 2
jne 0x4096bf
push eax
jmp 0x4096df
cmp dword [ebp - 0x9c], 1
jne 0x4096cc
mov edi, ecx
jmp 0x409724
cmp dword [ebp - 0x9c], edi
jne 0x409724
push 3
jmp 0x4096df
cmp eax, 4
ja 0x4096e2
push 4
pop edi
jmp 0x409724
cmp eax, ecx
jb 0x409724
cmp esi, 2
jae 0x4096ef
cmp eax, ecx
jbe 0x4096f6
cmp byte [ebp + 0x76], dl
je 0x409707
cmp eax, ecx
jb 0x4096fd
cmp esi, 2
jae 0x409701
cmp eax, ecx
jbe 0x409724
cmp byte [ebp + 0x76], 3
jne 0x409724
call fcn.00409530
mov edi, eax
jmp 0x409724
mov eax, dword [ebp - 0x98]
and eax, 0xffff0000
cmp eax, 0x45a0000
sbb edi, edi
inc edi
inc edi
mov eax, edi
pop edi
pop esi
add ebp, 0x78
leave
ret
Function at 0x409f25
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
call fcn.00408a7f
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x409fd2
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0x200000
ja 0x409fd1
lea eax, [edi + 1]
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp + 8], edi
call fcn.00408abe
mov esi, eax
mov dword [ebp - 4], esi
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x409fd1
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x409fd1
sub dword [ebp + 8], eax
add dword [ebp - 4], eax
cmp dword [ebp + 8], ebx
jne 0x409f82
mov byte [esi + edi], bl
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
cmp eax, ebx
jne 0x409fbc
xor eax, eax
jmp 0x409fc3
push eax
call fcn.00479e10
pop ecx
mov edx, esi
call fcn.00408ae4
mov dword [ebp - 0x10], 1
pop edi
cmp dword [ebp - 8], ebx
pop esi
pop ebx
je 0x409fe2
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 8

Function at 0x40a70d
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x40a732
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40a7f3
push edi
push 0x228
xor edi, edi
lea eax, [ebp - 0x22c]
push edi
push eax
mov dword [ebp - 4], 0x490
call fcn.00477840
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
push esi
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40a7a2
lea eax, [ebp - 0x20c]
push 0x4b9790
push eax
call fcn.0047c0d4
test eax, eax
pop ecx
pop ecx
je 0x40a796
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40a76c
jmp 0x40a7ab
mov edi, dword [ebp - 0x228]
and dword [ebp - 4], 0
jmp 0x40a7ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x40a7d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40a7f2
push dword [ebp + 8]
push 0xf01ff
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40a7ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push edi
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret
Function at 0x40a8d8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
test esi, esi
jne 0x40a8ea
or eax, 0xffffffff
leave
ret
push 0x110
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.00477840
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40a92d
cmp dword [ebp - 0x110], 5
jne 0x40a92d
cmp dword [ebp - 0x10c], 0
je 0x40a93a
push esi
call fcn.0040a7f6
test eax, eax
pop ecx
jne 0x40a93a
leave
ret
push esi
call fcn.0040a70d
pop ecx
leave
ret

Function at 0x40a943
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 1], bl
mov dword [ebp - 8], ebx
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], bl
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40aa03
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push 2
push dword [ebp + 8]
call esi
test eax, eax
jne 0x40a9a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40aa02
push edi
push dword [ebp - 0xc]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push edi
push 2
push dword [ebp + 8]
call esi
test eax, eax
je 0x40a9f6
cmp dword [edi], ebx
mov dword [ebp - 0x10], ebx
jbe 0x40a9f6
lea esi, [edi + 4]
push dword [esi]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x40a9f2
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add esi, 8
cmp eax, dword [edi]
jb 0x40a9d4
jmp 0x40a9f6
mov byte [ebp - 1], 1
cmp edi, ebx
je 0x40aa01
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
cmp dword [ebp - 8], ebx
pop ebx
je 0x40aa12
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov al, byte [ebp - 1]
leave
ret
Function at 0x40aa17
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
xor edi, edi
push 1
push edi
push edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
jne 0x40aa85
push 0x110
lea eax, [ebp - 0x118]
push edi
push eax
call fcn.00477840
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 0x11c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40aa7f
cmp dword [ebp - 0x118], 6
jne 0x40aa7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40aaba
mov dword [esi], edi
xor eax, eax
jmp 0x40aaba
mov ecx, dword [ebp - 8]
xor eax, eax
cmp dword [ebp - 4], edi
push ebx
mov ebx, 0x490
jbe 0x40aab1
lea edx, [ecx + 8]
cmp dword [edx], edi
je 0x40aaa7
inc eax
add edx, 0xc
cmp eax, dword [ebp - 4]
jb 0x40aa98
jmp 0x40aab1
imul eax, eax, 0xc
mov eax, dword [eax + ecx]
mov dword [esi], eax
xor ebx, ebx
push ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, ebx
pop ebx
pop edi
leave
ret

Function at 0x40b44f
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
xor eax, eax
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x6c], 0x67452301
mov dword [ebp - 0x68], 0xefcdab89
mov dword [ebp - 0x64], 0x98badcfe
mov dword [ebp - 0x60], 0x10325476
call fcn.0040b276
lea eax, [ebp - 0x14]
push eax
lea esi, [ebp - 0x6c]
call fcn.0040b339
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.0040b3d5
mov eax, dword [ebp + 8]
add esp, 0x10
pop esi
leave
ret

Function at 0x40b60d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x230
push esi
mov esi, eax
cmp dword [esi + 0x14], 0x104
push edi
jb 0x40b62d
xor al, al
jmp 0x40b6ba
and word [esp + 0x28], 0
push 0x208
lea eax, [esp + 0x2e]
push 0
push eax
call fcn.00477840
add esp, 0xc
cmp dword [esi + 0x18], 8
jb 0x40b652
mov esi, dword [esi + 4]
jmp 0x40b655
add esi, 4
push esi
lea eax, [esp + 0x2c]
push 0x105
push eax
call fcn.0047c97c
and dword [esp + 0x14], 0
add esp, 0xc
push 6
xor eax, eax
pop ecx
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x28]
mov dword [esp + 0x10], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0x10], 3
mov word [esp + 0x1c], 0x414
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp dword [esp + 0x1a], 0
jne 0x40b626
test eax, eax
je 0x40b6b7
cmp eax, 2
je 0x40b6b7
cmp eax, 0x402
je 0x40b6b7
xor eax, eax
jmp 0x40b6ba
xor eax, eax
inc eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40e1a6
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
cmp dword [esi + 0xc], 0xffffffff
jne 0x40e20a
push ebx
push edi
lea ebx, [ebp - 4]
call fcn.0040e939
push dword [eax]
xor ebx, ebx
push ebx
push 0x4b9c88
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00405cd1
cmp edi, ebx
je 0x40e1f9
lea eax, [ebp - 4]
push eax
push esi
mov dword [ebp - 4], ebx
call fcn.0040e2f7
test eax, eax
je 0x40e1f9
cmp dword [ebp - 4], ebx
jne 0x40e202
call fcn.0040ea3c
test eax, eax
je 0x40e205
xor eax, eax
inc eax
pop edi
mov dword [esi + 0xc], eax
pop ebx
mov eax, dword [esi + 0xc]
pop esi
leave
ret

Function at 0x40e39a
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x4aa2d6
call fcn.004a7794
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x20]
add edi, 0x1c
test eax, eax
je 0x40e3c4
mov ecx, dword [edi + 8]
sub ecx, eax
sar ecx, 3
jne 0x40e4ef
mov eax, dword [0x4da2a0]
mov ecx, 0x4da2a0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
lea ebx, [ebp - 0x1c]
call fcn.0040e939
mov byte [ebp - 4], 1
push dword [eax]
mov eax, 0x104
push eax
push eax
lea esi, [ebp - 0x14]
call fcn.00405bfc
push eax
push str.1.01.21.5
push str.supportrate
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ebx, ebx
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00405cd1
cmp dword [ebp - 0x14], ebx
jne 0x40e427
xor eax, eax
jmp 0x40e430
push dword [ebp - 0x14]
call fcn.0047a9ca
pop ecx
lea edx, [ebp - 0x14]
call fcn.00405bdb
mov esi, 0x4b999c
push esi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
push eax
lea ecx, [ebp - 0x1c]
lea ebx, [ebp - 0x14]
call fcn.0042ec90
jmp 0x40e4cb
push eax
call fcn.0047d727
fstp qword [ebp - 0x24]
mov edx, dword [edi + 4]
test edx, edx
pop ecx
jne 0x40e467
xor ecx, ecx
jmp 0x40e46f
mov ecx, dword [edi + 8]
sub ecx, edx
sar ecx, 3
test edx, edx
je 0x40e48f
mov eax, dword [edi + 0xc]
sub eax, edx
sar eax, 3
cmp ecx, eax
jae 0x40e48f
mov eax, dword [edi + 8]
fld qword [ebp - 0x24]
fstp qword [eax]
add eax, 8
mov dword [edi + 8], eax
jmp 0x40e4ac
mov ebx, dword [edi + 8]
cmp edx, ebx
jbe 0x40e49b
call fcn.0047940b
push ebx
push edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, edi
call fcn.0042ff19
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00405cd1
push esi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
lea ebx, [ebp - 0x14]
call fcn.0042ec90
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], 0
jne 0x40e452
add eax, 0xfffffff0
call fcn.00405cd1
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00405cd1
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x40e735
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi + 0x18], 0
jne 0x40e76b
push ebx
lea ebx, [ebp - 4]
call fcn.0040e939
push dword [eax]
push 2
push 0x4b9c98
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00405cd1
pop ebx
mov eax, dword [esi + 0x18]
leave
ret

Function at 0x40e939
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4aa281
call fcn.004a7794
push ecx
push ecx
and dword [ebp - 0x14], 0
push edi
lea edi, [ebp - 0x14]
call fcn.0046393f
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
jne 0x40e977
push 0x4bea5c
push ebx
call fcn.00405e55
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00405cd1
jmp 0x40e9e2
add eax, 0xfffffff0
call fcn.00405b50
add eax, 0x10
mov dword [ebp - 0x10], eax
push str.datadpiconfig.ini
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 1
call fcn.00406d14
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40e9bc
lea eax, [ebp - 0x14]
lea edi, [ebp - 0x10]
call fcn.00405da7
push str._ressrcchsdpisetting.ini
mov eax, edi
push eax
call fcn.00406d14
push esi
mov esi, dword [ebp - 0x10]
add esi, 0xfffffff0
mov eax, esi
call fcn.00405b50
add eax, 0x10
mov dword [ebx], eax
mov eax, esi
call fcn.00405cd1
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00405cd1
pop esi
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
mov dword fs:[0], ecx
leave
ret

Function at 0x40e9f1
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, esi
call fcn.0040e6bc
test eax, eax
jne 0x40ea05
push 0x60
pop eax
leave
ret
cmp dword [esi + 8], 0xffffffff
jne 0x40ea37
push ebx
lea ebx, [ebp - 4]
call fcn.0040e939
push dword [eax]
push 0x60
push str.debugdpi
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esi + 8], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00405cd1
pop ebx
mov eax, dword [esi + 8]
leave
ret

Function at 0x40ea3c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi + 4], 0xffffffff
jne 0x40ea72
push ebx
lea ebx, [ebp - 4]
call fcn.0040e939
push dword [eax]
push 0
push str.debug
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00405cd1
pop ebx
mov eax, dword [esi + 4]
leave
ret
Function at 0x40ea77
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x4a94f0
call fcn.004a7794
push ecx
and dword [ebp - 0x10], 0
push esi
mov esi, ecx
add esi, 0x14
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jne 0x40eae9
push ebx
lea ebx, [ebp - 0x10]
call fcn.0040e939
and dword [ebp - 4], 0
push dword [eax]
mov eax, 0x104
push eax
push eax
call fcn.00405bfc
push eax
push str.kxetray
push str.supportprocess
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405cd1
mov eax, dword [esi]
test eax, eax
pop ebx
je 0x40eae2
push eax
call fcn.0047a9ca
pop ecx
mov edx, esi
call fcn.00405bdb
mov eax, dword [esi]
sub eax, 0x10
call fcn.00405b50
mov ecx, dword [ebp - 0xc]
add eax, 0x10
mov dword [edi], eax
mov eax, edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40ec73
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, word [ebp + 0xc]
push esi
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x40ecf6
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x40ecbf
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x40ecbf
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [ebp + 0xc], eax
jne 0x40ecc3
xor eax, eax
jmp 0x40ecf5
mov esi, dword [ebp + 0x10]
push edi
lea edi, [ebx + 1]
push edi
call fcn.00408abe
test eax, eax
je 0x40ece1
push ebx
push dword [ebp + 0xc]
push eax
call fcn.0047bc60
add esp, 0xc
mov eax, edi
call fcn.0040a06b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
inc eax
pop edi
pop ebx
pop esi
leave
ret
Function at 0x40ee26
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, 0x4a9788
call fcn.004a7794
push ecx
push ecx
mov eax, dword [0x4da2a0]
push ebx
push esi
push edi
mov edi, ecx
mov esi, 0x4da2a0
xor ebx, ebx
mov ecx, esi
mov dword [ebp - 0x14], ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x14], ebx
lea eax, [edi + 0xc]
jne 0x40ee5e
mov eax, edi
lea edi, [ebp - 0x10]
call fcn.00405da7
mov edi, dword [ebp - 0x10]
cmp dword [edi - 0xc], ebx
je 0x40ef54
mov eax, dword [0x4da2a0]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0x14], eax
push dword [ebp + 0x10]
mov byte [ebp - 4], 1
push dword [ebp + 8]
lea eax, [ebp + 0x14]
push edi
push str._s_d._s
call fcn.00407054
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp + 0x10], eax
je 0x40ef49
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, ebx
je 0x40ef40
mov esi, dword [ebp + 0xc]
push ebx
lea eax, [ebp + 8]
push eax
push edi
lea eax, [edi + 0xa]
push eax
mov dword [ebp + 8], ebx
call fcn.00408abe
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x40ef37
cmp dword [ebp + 8], edi
jne 0x40ef37
mov eax, edi
call fcn.0040a06b
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
call fcn.00405cd1
xor esi, esi
inc esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405cd1
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
xor eax, eax
mov edx, esi
call fcn.00408ae4
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
call fcn.00405cd1
mov esi, dword [ebp - 0x14]
jmp 0x40ef19