joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4096d0
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x20c
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
lea eax, [esi + 0x64]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_wcscpy]
lea edx, [esp + 0x18]
push edx
call fcn.004335e0
lea eax, [esp + 0x1c]
push eax
call fcn.0048b310
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
mov dword [esi + 0x10], eax
je 0x40983b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40983b
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 1
mov ecx, esi
call fcn.004095c0
test eax, eax
mov dword [0x5dcab0], eax
jne 0x409760
push 0x64
call ebx
mov edx, edi
inc edi
cmp edx, 0x14
jb 0x409737
mov eax, dword [0x5dcab0]
test eax, eax
je 0x40983b
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], 0
mov edx, dword [0x5dcab0]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov edi, dword [esp + 0x21c]
push edi
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
jne 0x4097d0
mov ecx, dword [esi + 0x2c]
mov edx, dword [0x5dcab0]
push eax
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x20c
ret 4
push 0x4e96a0
push edi
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x40980c
mov eax, dword [esi + 0x2c]
mov ecx, dword [0x5dcab0]
push 0x1e0000
push 0xffffffffffffffff
push eax
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x20c
ret 4
push edi
mov ecx, esi
call fcn.0040b290
test eax, eax
je 0x40982a
mov edx, dword [0x5dcab0]
push edi
push 0
push edx
call fcn.004421e0
add esp, 0xc
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x20c
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x20c
ret 4

Function at 0x409a90
Capabilities:
Get common file path
Move file

Disassembly:
sub esp, 0x410
push esi
push edi
xor esi, esi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x212]
mov word [esp + 0x210], si
push 0x103
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x420]
stosw word es:[edi], ax
lea eax, [esp + 0x214]
push eax
push 0x4e96d4
push ecx
call fcn.00441930
add esp, 0x10
test eax, eax
je 0x409b3e
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], si
rep stosd dword es:[edi], eax
lea edx, [esp + 8]
push edx
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x4e8790
push 0x50527c
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [esp + 8]
push 1
push eax
push 0x505074
call esi
push 2
lea ecx, [esp + 0x214]
push 0x505074
push ecx
call esi
lea edx, [esp + 8]
push 1
push edx
call fcn.0048c470
add esp, 8
pop edi
pop esi
add esp, 0x410
ret 4
Function at 0x409ca0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x208
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
lea eax, [esp + 8]
push 0x103
push eax
push 0x4e96d4
push esi
call fcn.00441930
add esp, 0x10
test eax, eax
je 0x409d29
cmp word [esp + 8], 0
je 0x409d29
push 0
push 0x4e96fc
push esi
call fcn.004418a0
add esp, 0xc
cmp eax, 1
jne 0x409d18
lea ecx, [esp + 8]
push eax
push ecx
call fcn.00433e90
add esp, 8
pop edi
pop esi
add esp, 0x208
ret 4
lea edx, [esp + 8]
push edx
call fcn.00423c70
mov ecx, eax
call fcn.004259a0
pop edi
pop esi
add esp, 0x208
ret 4

Function at 0x409e70
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x5dc184]
sub esp, 0x208
test eax, eax
push esi
mov esi, ecx
jne 0x409ef4
mov eax, dword [0x5dc188]
test eax, eax
jne 0x409ef4
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esi + 0x64]
lea ecx, [esp + 8]
push eax
push str._s_taihang_cookieevent
push 0x103
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea edx, [esp + 0x18]
push edx
call fcn.004335e0
add esp, 0x14
lea eax, [esp + 8]
push eax
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 8], eax
mov eax, dword [0x5dc184]
test eax, eax
pop edi
jne 0x409ef4
mov eax, dword [0x5dc188]
test eax, eax
jne 0x409ef4
call fcn.00434180
call fcn.004341e0
call fcn.004c27d0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea ecx, [esi + 0x50]
mov dword [esi + 0x4c], eax
call fcn.00418910
mov ecx, 0x5da6a8
call fcn.0046bee0
mov ecx, esi
call fcn.0040a790
push str.MFC42U.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 1
call fcn.0040b810
add esp, 4
mov eax, 1
pop esi
add esp, 0x208
ret
Function at 0x40a480
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov dword [esi + 0x60], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x5c], eax
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x40a320
push 0
push 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x40a4c2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xc]
push ecx
mov ecx, esi
call fcn.0040a590
pop esi
pop ecx
ret 4

Function at 0x40a540
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push 0
push 0
push 1
mov esi, ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
mov dword [esi + 4], eax
je 0x40a586
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push esi
push 0x40a4e0
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x40a586
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ecx
ret

Function at 0x40a790
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push esi
mov edx, ecx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
lea esi, [edx + 0x64]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
lea edx, [esp + 0xc]
push ecx
push edx
push esi
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push SysReAllocString
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0x103
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40a7f8
push esi
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push 1
call fcn.00462910
push 1
push 2
push 9
call fcn.004628e0
push 1
push 2
push 0xf
call fcn.004628e0
push 1
push 2
push 0xa
call fcn.004628e0
push 0
call fcn.00462910
add esp, 0x2c
mov dword [0x5e3560], 1
call fcn.004427d0
pop edi
pop esi
add esp, 0x210
ret
Function at 0x40a850
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x470
push ebx
push esi
xor ebx, ebx
mov esi, ecx
xor eax, eax
push ebx
mov dword [esp + 0x20], eax
push ebx
lea ecx, [esp + 0x20]
push 1
mov dword [esp + 0x2c], eax
push ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], 1
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, ebx
mov dword [esi + 0x20], eax
je 0x40a971
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x6e]
mov word [esp + 0x6c], bx
mov word [esp + 0x274], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x276]
lea edx, [esp + 0x6c]
rep stosd dword es:[edi], eax
push 0x103
push edx
push ebx
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov eax, dword [esi + 0x20]
push 0x4e96e8
push eax
push 0x4e96d4
push 0xc
lea ecx, [esp + 0x80]
push str._tp:
push ecx
push str._s__s_d__s_d__s_d
lea edx, [esp + 0x294]
push 0x103
push edx
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x54]
add esp, 0x28
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
lea edx, [esp + 0x28]
push ecx
mov dword [esp + 0x14], eax
push edx
push ebx
mov dword [esp + 0x20], eax
push ebx
push ebx
mov dword [esp + 0x2c], eax
push 1
push ebx
lea eax, [esp + 0x290]
push ebx
push eax
push ebx
mov dword [esp + 0x50], 0x44
mov dword [esp + 0x7c], 0x80
mov dword [esp + 0x34], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
pop edi
je 0x40a971
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 8]
push edx
call esi
pop esi
pop ebx
add esp, 0x470
ret
Function at 0x40a9b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [0x5dc170]
sub esp, 0x28
push esi
push edi
xor edi, edi
mov esi, ecx
cmp eax, edi
jne 0x40a9ca
pop edi
xor eax, eax
pop esi
add esp, 0x28
ret
lea eax, [esp + 8]
lea ecx, [esp + 0x10]
push eax
push ecx
push 3
lea edx, [esp + 0x2c]
push edi
push edx
mov dword [esp + 0x34], 0x4df0c730
mov word [esp + 0x38], 0xdf9d
mov word [esp + 0x3a], 0x4ae3
mov byte [esp + 0x3c], 0x91
mov byte [esp + 0x3d], 0x53
mov byte [esp + 0x3e], 0xaa
mov byte [esp + 0x3f], 0x6b
mov byte [esp + 0x40], 0x82
mov byte [esp + 0x41], 0xe9
mov byte [esp + 0x42], 0x79
mov byte [esp + 0x43], 0x5a
mov dword [esp + 0x24], 0x8be2d872
mov word [esp + 0x28], 0x86aa
mov word [esp + 0x2a], 0x4d47
mov byte [esp + 0x2c], 0xb7
mov byte [esp + 0x2d], 0x76
mov byte [esp + 0x2e], 0x32
mov byte [esp + 0x2f], 0xcc
mov byte [esp + 0x30], 0xa4
mov byte [esp + 0x31], 0xc
mov byte [esp + 0x32], 0x70
mov byte [esp + 0x33], 0x18
mov dword [esp + 0x1c], edi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x40aaa7
mov eax, dword [esp + 8]
cmp eax, edi
je 0x40aaa7
lea edx, [esp + 0xc]
add esi, 0x26c
push edx
mov dword [esp + 0x10], edi
mov ecx, dword [eax]
push 1
push esi
push eax
call dword [ecx + 0x28]
test eax, eax
jne 0x40aa9d
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x40aa9d
mov ecx, dword [eax]
push eax
mov edi, 1
call dword [ecx + 8]
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, edi
pop edi
pop esi
add esp, 0x28
ret

Function at 0x40abe0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x208
test eax, eax
push ebx
mov ebx, dword [esp + 0x214]
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll__snwprintf]
push esi
push edi
mov edx, ecx
jne 0x40ac70
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
push str.LoginEnrolLoginEnrol.dll
add edx, 0x26c
push str.Extensions
push edx
stosw word es:[edi], ax
push 0x4e9968
lea eax, [esp + 0x20]
push 0x103
push eax
call ebp
add esp, 0x18
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x40ac70
push str.GetProfilePath
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40ac69
mov edx, dword [esp + 0x224]
dec edx
push edx
push ebx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp word [ebx], 0
jne 0x40acbd
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, dword [esp + 0x224]
lea ecx, [esp + 0x10]
push str.360SE
push ecx
dec edx
push 0x4e993c
push edx
push ebx
call ebp
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 0xc
Function at 0x40b030
Capabilities:
Delete directory

Disassembly:
sub esp, 0x41c
push esi
mov esi, ecx
mov eax, dword [esi + 0x60]
test eax, eax
je 0x40b07f
mov ecx, dword [esi + 0x5c]
mov esi, dword [esi + 0x3c]
xor eax, eax
lea edx, [esp + 4]
mov dword [esp + 8], eax
push edx
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x29
mov dword [esp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov eax, dword [0x5dcab0]
push esi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
add esp, 0x41c
ret 8
mov eax, dword [esp + 0x428]
test eax, eax
je 0x40b095
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [esp + 0x42c]
push 0
lea ecx, [esp + 0x1c]
push 0x103
push ecx
push edi
mov ecx, esi
call fcn.0040af30
lea edx, [esp + 0x18]
push 1
push edx
call fcn.00433540
push 0
push 0
lea eax, [esp + 0x28]
push 0
push eax
call fcn.0048c8a0
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
add esp, 0x18
cmp edi, 0xffffffff
je 0x40b11a
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x18]
push eax
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1c]
push 0x103
push ecx
push 0xffffffffffffffff
mov ecx, esi
call fcn.0040af30
lea edx, [esp + 0x18]
push edx
call ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x222]
mov word [esp + 0x220], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
lea eax, [esp + 0x224]
push 0x103
push eax
mov ecx, esi
call fcn.0040aeb0
lea ecx, [esp + 0x220]
push ecx
call ebx
pop edi
pop ebx
pop esi
add esp, 0x41c
ret 8

Function at 0x40b170
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x603524]
sub esp, 0x208
test eax, eax
je 0x40b1b4
push 0
push 0x4e9a28
call fcn.0040acd0
mov ecx, dword [esp + 0x20c]
push eax
mov eax, dword [esp + 0x214]
push 0x4e925c
dec eax
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
add esp, 0x208
ret 8
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
push edx
push 0x103
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, dword [esp + 0x214]
mov edx, dword [esp + 0x210]
lea eax, [esp + 4]
push 0x4e9a28
push eax
dec ecx
push 0x4e9370
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
pop edi
add esp, 0x208
ret 8
Function at 0x40b2f3
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
push 1
call fcn.00483520
add esp, 4
mov ecx, esi
call fcn.00409e70
call fcn.0044fd10
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40b371
lea ecx, [esp + 0xc]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 4]
push 0
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x1f0fff
mov dword [esi + 0x48], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esi + 0x14], eax
call fcn.00452720
mov ecx, eax
call fcn.00452770
call fcn.00479b60
mov ecx, eax
call fcn.00479bb0
push str.Extensions
call fcn.00423c70
mov ecx, eax
call fcn.00425ce0
mov ecx, esi
call fcn.0040b240
mov ecx, 0x5dd258
call fcn.004a0300
mov ecx, esi
call fcn.0040b530
pop esi
add esp, 0x14
ret

Function at 0x40b420
Capabilities:
Terminate process

Disassembly:
sub esp, 0x208
add ecx, 0x64
push ecx
call fcn.00488360
add esp, 4
test eax, eax
jne 0x40b51f
push edi
mov ecx, 0x81
lea edi, [esp + 6]
mov word [esp + 4], ax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x214]
pop edi
test eax, eax
je 0x40b4c3
mov ecx, dword [0x5e03c8]
lea eax, [esp]
push 0x103
push eax
push 0xc389
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x44
push 0xc38b
call fcn.0047dc90
add esp, 4
lea edx, [esp + 4]
push eax
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x40b4a9
push str.http:__se.360.cn
call fcn.00442560
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
add esp, 0x208
ret 8
mov eax, dword [0x4e93f8]
test eax, eax
je 0x40b514
mov ecx, dword [0x5e03c8]
lea eax, [esp]
push 0x103
push eax
push 0xc38a
push ecx
mov dword [0x4e93f8], 0
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x40
push 0xc38b
call fcn.0047dc90
add esp, 4
lea edx, [esp + 4]
push eax
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
add esp, 0x208
ret 8
mov eax, 1
add esp, 0x208
ret 8
Function at 0x40b540
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x208
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
push 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 8]
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
pop edi
je 0x40b5c1
lea ecx, [esp]
push str.360SE
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [esp]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40b5c1
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40b5c1
test al, 0x10
jne 0x40b5c1
lea ecx, [esp]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x208
ret

Function at 0x40b6c0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x40b6ef
push 0
push esi
call fcn.00432f10
add esp, 8
test eax, eax
je 0x40b6ef
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x40b6ef
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
ret

Function at 0x40bb50
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
xor ebx, ebx
push esi
cmp ebp, ebx
push edi
jne 0x40bb63
mov ebp, str.Main
mov esi, dword [esp + 0x20]
lea eax, [esi + esi]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [0x5091cc]
mov edi, dword [esp + 0x1c]
add esp, 4
cmp ecx, ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], ebx
je 0x40bbc0
mov eax, dword [0x5091ec]
test eax, eax
jne 0x40bba7
push str.GetAppValue
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x5091ec], eax
je 0x40bbb8
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
push esi
push edx
push edi
push ebp
call eax
mov ebx, eax
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x40bbe6
mov ecx, 0x505010
call fcn.0040aab0
push eax
mov eax, dword [esp + 0x18]
push esi
push eax
push 0x505000
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ecx, ecx
cmp ecx, eax
sbb ebx, ebx
neg ebx
test ebx, ebx
je 0x40bc30
test esi, esi
je 0x40bc30
cmp esi, 0x7fffffff
ja 0x40bc30
mov eax, dword [esp + 0x1c]
mov edi, SysReAllocString
mov edx, esi
sub edi, esi
mov esi, dword [esp + 0x14]
sub esi, eax
lea ecx, [edi + edx]
test ecx, ecx
je 0x40bc24
mov cx, word [esi + eax]
test cx, cx
je 0x40bc24
mov word [eax], cx
add eax, 2
dec edx
jne 0x40bc09
jmp 0x40bc28
test edx, edx
jne 0x40bc2b
sub eax, 2
mov word [eax], 0
mov edx, dword [esp + 0x14]
push edx
call fcn.004d0379
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x40bcd0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x20c
test eax, eax
je 0x40bdb9
push ebx
mov ebx, dword [esp + 0x214]
push esi
push edi
test ebx, ebx
jne 0x40bcf5
mov ebx, str.Main
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
mov ecx, dword [0x5091cc]
xor esi, esi
stosw word es:[edi], ax
mov edi, dword [esp + 0x220]
mov dword [esp + 0xc], esi
test ecx, ecx
je 0x40bd5d
mov eax, dword [0x5091f4]
test eax, eax
jne 0x40bd40
push str.GetAppValue
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x5091f4], eax
je 0x40bd55
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push 0x103
push edx
push edi
push ebx
call eax
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x40bd87
mov ecx, 0x505010
call fcn.0040aab0
push eax
lea eax, [esp + 0x14]
push 0x103
push eax
push 0x505000
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ecx, ecx
cmp ecx, eax
sbb esi, esi
neg esi
pop edi
test esi, esi
pop esi
pop ebx
je 0x40bdb9
cmp word [esp + 4], 0
je 0x40bdb9
lea edx, [esp + 4]
push edx
call dword [sym.imp.MSVCRT.dll__wtoi]
mov ecx, dword [esp + 0x21c]
add esp, 4
mov dword [ecx], eax
mov eax, 1
add esp, 0x20c
ret
xor eax, eax
add esp, 0x20c
ret
Function at 0x40bf20
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x20004
call fcn.004d03a0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20014]
test esi, esi
push edi
jne 0x40bf3e
mov esi, str.Main
mov ebp, dword [esp + 0x2002c]
mov ebx, 1
test ebp, ebp
je 0x40c136
mov edi, dword [esp + 0x20030]
test edi, edi
je 0x40c136
cmp dword [edi], 0
jbe 0x40c136
mov eax, dword [esp + 0x20028]
mov dword [esp + 0x10], 0
mov dword [eax], ebx
mov ecx, dword [0x5091cc]
test ecx, ecx
je 0x40bfd8
mov eax, dword [0x509200]
test eax, eax
jne 0x40bfa3
push str.EnumAppValue
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x509200], eax
je 0x40bfcc
mov edx, dword [esp + 0x20024]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x20024]
push edi
push ebp
push edx
mov edx, dword [esp + 0x2002c]
push ecx
push edx
push esi
call eax
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x40c129
mov ecx, 0x7fff
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x505010
xor edi, edi
call fcn.0040aab0
push eax
lea eax, [esp + 0x18]
push 0x10000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
test eax, eax
jbe 0x40c129
cmp word [esp + 0x14], di
lea esi, [esp + 0x14]
je 0x40c129
mov ebp, dword [sym.imp.MSVCRT.dll_wcschr]
push 0x3d
push esi
call ebp
add esp, 8
test eax, eax
je 0x40c04a
mov ecx, dword [esp + 0x2001c]
mov word [eax], 0
cmp edi, ecx
je 0x40c075
mov word [eax], 0x3d
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc edi
lea esi, [esi + eax*2 + 2]
cmp edi, 0xbb8
jae 0x40c129
cmp word [esi], 0
jne 0x40c029
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x20004
ret
mov ecx, dword [esp + 0x20024]
mov edx, dword [ecx]
test edx, edx
je 0x40c0c3
cmp edx, 0x7fffffff
ja 0x40c0c3
mov ecx, dword [esp + 0x20020]
mov ebx, SysReAllocString
sub ebx, edx
mov edi, edx
sub esi, ecx
lea edx, [ebx + edi]
test edx, edx
je 0x40c0b7
mov dx, word [esi + ecx]
test dx, dx
je 0x40c0b7
mov word [ecx], dx
add ecx, 2
dec edi
jne 0x40c09c
jmp 0x40c0bb
test edi, edi
jne 0x40c0be
sub ecx, 2
mov word [ecx], 0
mov ecx, dword [esp + 0x20030]
mov edx, dword [ecx]
shr edx, 1
je 0x40c127
cmp edx, 0x7fffffff
ja 0x40c127
mov ecx, dword [esp + 0x2002c]
mov esi, SysReAllocString
sub esi, edx
sub eax, ecx
lea edi, [eax + 2]
lea eax, [esi + edx]
test eax, eax
je 0x40c11b
mov ax, word [edi + ecx]
test ax, ax
je 0x40c11b
mov word [ecx], ax
add ecx, 2
dec edx
jne 0x40c0eb
sub ecx, 2
xor ebx, ebx
pop edi
pop esi
mov eax, ebx
pop ebp
mov word [ecx], 0
pop ebx
add esp, 0x20004
ret
test edx, edx
jne 0x40c122
sub ecx, 2
mov word [ecx], 0
xor ebx, ebx
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x20004
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20004
ret