joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407670
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov dword [esi + 0x68], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x64], eax
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x407510
push 0
push 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x4076b2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00407780
pop esi
pop ecx
ret 4

Function at 0x407730
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push 0
push 0
push 1
mov esi, ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
mov dword [esi + 4], eax
je 0x407776
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push esi
push 0x4076d0
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x407776
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ecx
ret

Function at 0x407960
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x470
push ebx
push esi
xor ebx, ebx
mov esi, ecx
xor eax, eax
push ebx
mov dword [esp + 0x20], eax
push ebx
lea ecx, [esp + 0x20]
push 1
mov dword [esp + 0x2c], eax
push ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], 1
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, ebx
mov dword [esi + 0x28], eax
je 0x407a81
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x6e]
mov word [esp + 0x6c], bx
mov word [esp + 0x274], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x276]
lea edx, [esp + 0x6c]
rep stosd dword es:[edi], eax
push 0x103
push edx
push ebx
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov eax, dword [esi + 0x28]
push 0x4f7638
push eax
push 0x4f7624
push 0xc
lea ecx, [esp + 0x80]
push str._tp:
push ecx
push str._s__s_d__s_d__s_d
lea edx, [esp + 0x294]
push 0x103
push edx
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x54]
add esp, 0x28
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
lea edx, [esp + 0x28]
push ecx
mov dword [esp + 0x14], eax
push edx
push ebx
mov dword [esp + 0x20], eax
push ebx
push ebx
mov dword [esp + 0x2c], eax
push 1
push ebx
lea eax, [esp + 0x290]
push ebx
push eax
push ebx
mov dword [esp + 0x50], 0x44
mov dword [esp + 0x7c], 0x80
mov dword [esp + 0x34], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
pop edi
je 0x407a81
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 8]
push edx
call esi
pop esi
pop ebx
add esp, 0x470
ret
Function at 0x407ac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [0x5ed660]
sub esp, 0x28
push esi
push edi
xor edi, edi
mov esi, ecx
cmp eax, edi
jne 0x407ada
pop edi
xor eax, eax
pop esi
add esp, 0x28
ret
lea eax, [esp + 8]
lea ecx, [esp + 0x10]
push eax
push ecx
push 3
lea edx, [esp + 0x2c]
push edi
push edx
mov dword [esp + 0x34], 0x4df0c730
mov word [esp + 0x38], 0xdf9d
mov word [esp + 0x3a], 0x4ae3
mov byte [esp + 0x3c], 0x91
mov byte [esp + 0x3d], 0x53
mov byte [esp + 0x3e], 0xaa
mov byte [esp + 0x3f], 0x6b
mov byte [esp + 0x40], 0x82
mov byte [esp + 0x41], 0xe9
mov byte [esp + 0x42], 0x79
mov byte [esp + 0x43], 0x5a
mov dword [esp + 0x24], 0x8be2d872
mov word [esp + 0x28], 0x86aa
mov word [esp + 0x2a], 0x4d47
mov byte [esp + 0x2c], 0xb7
mov byte [esp + 0x2d], 0x76
mov byte [esp + 0x2e], 0x32
mov byte [esp + 0x2f], 0xcc
mov byte [esp + 0x30], 0xa4
mov byte [esp + 0x31], 0xc
mov byte [esp + 0x32], 0x70
mov byte [esp + 0x33], 0x18
mov dword [esp + 0x1c], edi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x407bb7
mov eax, dword [esp + 8]
cmp eax, edi
je 0x407bb7
lea edx, [esp + 0xc]
add esi, 0x274
push edx
mov dword [esp + 0x10], edi
mov ecx, dword [eax]
push 1
push esi
push eax
call dword [ecx + 0x28]
test eax, eax
jne 0x407bad
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x407bad
mov ecx, dword [eax]
push eax
mov edi, 1
call dword [ecx + 8]
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, edi
pop edi
pop esi
add esp, 0x28
ret

Function at 0x407c80
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x208
test eax, eax
push ebx
mov ebx, dword [esp + 0x214]
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll__snwprintf]
push esi
push edi
mov edx, ecx
jne 0x407d10
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
push str.LoginEnrolLoginEnrol.dll
add edx, 0x274
push str.Extensions
push edx
stosw word es:[edi], ax
push 0x4f77d8
lea eax, [esp + 0x20]
push 0x103
push eax
call ebp
add esp, 0x18
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x407d10
push str.GetProfilePath
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x407d09
mov edx, dword [esp + 0x224]
dec edx
push edx
push ebx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp word [ebx], 0
jne 0x407d5d
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, dword [esp + 0x224]
lea ecx, [esp + 0x10]
push str.360SE
push ecx
dec edx
push 0x4f77ac
push edx
push ebx
call ebp
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 0xc
Function at 0x4080d0
Capabilities:
Delete directory

Disassembly:
sub esp, 0x41c
push esi
mov esi, ecx
mov eax, dword [esi + 0x68]
test eax, eax
je 0x40811f
mov ecx, dword [esi + 0x64]
mov esi, dword [esi + 0x44]
xor eax, eax
lea edx, [esp + 4]
mov dword [esp + 8], eax
push edx
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x29
mov dword [esp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov eax, dword [0x5edfa0]
push esi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
add esp, 0x41c
ret 8
mov eax, dword [esp + 0x428]
test eax, eax
je 0x408135
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [esp + 0x42c]
push 0
lea ecx, [esp + 0x1c]
push 0x103
push ecx
push edi
mov ecx, esi
call fcn.00407fd0
lea edx, [esp + 0x18]
push 1
push edx
call fcn.00432fa0
push 0
push 0
lea eax, [esp + 0x28]
push 0
push eax
call fcn.004936c0
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
add esp, 0x18
cmp edi, 0xffffffff
je 0x4081ba
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x18]
push eax
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1c]
push 0x103
push ecx
push 0xffffffffffffffff
mov ecx, esi
call fcn.00407fd0
lea edx, [esp + 0x18]
push edx
call ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x222]
mov word [esp + 0x220], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
lea eax, [esp + 0x224]
push 0x103
push eax
mov ecx, esi
call fcn.00407f50
lea ecx, [esp + 0x220]
push ecx
call ebx
pop edi
pop ebx
pop esi
add esp, 0x41c
ret 8

Function at 0x408210
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x614524]
sub esp, 0x208
test eax, eax
je 0x408254
push 0
push 0x4f78a4
call fcn.00407d70
mov ecx, dword [esp + 0x20c]
push eax
mov eax, dword [esp + 0x214]
push 0x4f6170
dec eax
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
add esp, 0x208
ret 8
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
push edx
push 0x103
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, dword [esp + 0x214]
mov edx, dword [esp + 0x210]
lea eax, [esp + 4]
push 0x4f78a4
push eax
dec ecx
push 0x4f7884
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
pop edi
add esp, 0x208
ret 8
Function at 0x408410
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
push 1
call fcn.004898b0
add esp, 4
mov ecx, esi
call fcn.004070f0
call fcn.00453130
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x408491
lea ecx, [esp + 0xc]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 4]
push 0
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x1f0fff
mov dword [esi + 0x50], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esi + 0x14], eax
call fcn.004556a0
mov ecx, eax
call fcn.004556f0
push 0
call fcn.00480fb0
mov ecx, eax
call fcn.00481000
mov ecx, esi
call fcn.00409380
mov ecx, esi
call fcn.00408640
pop esi
add esp, 0x14
ret

Function at 0x408650
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x208
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
push 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 8]
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
pop edi
je 0x4086d1
lea ecx, [esp]
push str.360SE
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [esp]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4086d1
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4086d1
test al, 0x10
jne 0x4086d1
lea ecx, [esp]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x208
ret
Function at 0x408fa0
Capabilities:
Check if file exists
Read .ini file

Disassembly:
sub esp, 0x824
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebp, ebp
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x62e]
mov word [esp + 0x62c], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x21e]
mov word [esp + 0x21c], bp
rep stosd dword es:[edi], eax
push 0x515474
xor ebx, ebx
mov dword [esp + 0x14], ebp
stosw word es:[edi], ax
call dword [sym.imp.MSVCRT.dll_wcslen]
sub eax, 4
push eax
lea eax, [esp + 0x224]
push 0x515474
push eax
call dword [sym.imp.MSVCRT.dll_wcsncpy]
push 5
lea ecx, [esp + 0x230]
push str..ini
push ecx
call dword [sym.imp.MSVCRT.dll_wcsncat]
add esp, 0x1c
lea edx, [esp + 0x62c]
mov ecx, esi
push 0x103
push edx
push 1
call fcn.00407c80
mov edi, dword [sym.imp.MSVCRT.dll__snwprintf]
lea eax, [esp + 0x21c]
lea ecx, [esp + 0x62c]
push eax
push ecx
push 0x4f7884
lea edx, [esp + 0x20]
push 0x103
push edx
call edi
add esp, 0x14
mov ecx, esi
call fcn.00406650
cmp eax, ebp
je 0x409096
lea ecx, [esp + 0x10]
push ecx
push 0x4f7ae0
push eax
call fcn.00441d30
add esp, 0xc
mov ebx, eax
cmp dword [esp + 0x10], ebp
jne 0x409107
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x426]
mov word [esp + 0x424], bp
rep stosd dword es:[edi], eax
lea edx, [esp + 0x14]
stosw word es:[edi], ax
push edx
lea eax, [esp + 0x428]
push 0x103
push eax
push 0x514ff0
push 0x4f7984
push 0x4f7318
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x424], bp
je 0x409101
lea ecx, [esp + 0x424]
push ecx
call dword [sym.imp.MSVCRT.dll__wtoi]
add esp, 4
cmp eax, ebp
je 0x409101
mov ebx, 1
mov edi, dword [sym.imp.MSVCRT.dll__snwprintf]
mov eax, ebx
sub eax, ebp
je 0x40916a
dec eax
jne 0x40916a
mov eax, dword [esp + 0x83c]
mov ebp, dword [esp + 0x838]
lea edx, [esp + 0x62c]
push str.360seie6.ini
push edx
dec eax
push 0x4f7884
push eax
push ebp
call edi
add esp, 0x14
push ebp
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40918a
push 1
lea ecx, [esp + 0x18]
push ebp
push ecx
call fcn.00433ab0
add esp, 0xc
mov ecx, esi
push ebp
call fcn.00408ef0
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x824
ret 8
mov eax, dword [esp + 0x83c]
mov ecx, dword [esp + 0x838]
lea edx, [esp + 0x14]
dec eax
push edx
push 0x4f6170
push eax
push ecx
call edi
add esp, 0x10
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x824
ret 8
Function at 0x409380
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x410
push ebx
push edi
push 0x4f7318
call fcn.0045efa0
mov ecx, eax
call fcn.0045eff0
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 8]
push 0x103
push eax
push str.FHres
call fcn.0045efa0
mov ecx, eax
call fcn.0045f040
mov ebx, dword [sym.imp.MSVCRT.dll__wtoi]
test eax, eax
je 0x4093eb
cmp word [esp + 8], 0
je 0x4093eb
lea ecx, [esp + 8]
push ecx
call ebx
add esp, 4
mov dword [0x6200a0], eax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x212]
mov word [esp + 0x210], 0
rep stosd dword es:[edi], eax
lea edx, [esp + 0x210]
push 0x103
push edx
push str.FHExternal
stosw word es:[edi], ax
call fcn.0045efa0
mov ecx, eax
call fcn.0045f040
test eax, eax
je 0x409446
cmp word [esp + 0x210], 0
je 0x409446
lea eax, [esp + 0x210]
push eax
call ebx
add esp, 4
mov dword [0x6200a4], eax
mov eax, dword [0x6200a0]
pop edi
test eax, eax
pop ebx
je 0x40945c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x5e9b78], eax
add esp, 0x410
ret

Function at 0x409470
Capabilities:
Delete file

Disassembly:
sub esp, 0x400
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
mov ecx, 0x514ff8
stosw word es:[edi], ax
call fcn.00407c50
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
push eax
push str._sdataFavouriteBar.dat
lea eax, [esp + 0x10]
push 0x1ff
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x10
lea ecx, [esp + 8]
push ecx
call edi
mov ecx, 0x514ff8
call fcn.00407c50
push eax
push str._sdatapluginbar.dat
lea edx, [esp + 0x10]
push 0x1ff
push edx
call esi
add esp, 0x10
lea eax, [esp + 8]
push eax
call edi
mov ecx, 0x514ff8
call fcn.00407c50
push eax
push str._sdataStatusBar.dat
lea ecx, [esp + 0x10]
push 0x1ff
push ecx
call esi
add esp, 0x10
lea edx, [esp + 8]
push edx
call edi
pop edi
pop esi
add esp, 0x400
ret
Function at 0x409540
Capabilities:
Persist via app paths registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x418
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x14]
push 0x104
push eax
push ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x14]
push str.360seSS.exe
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x40970c
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [esp + 0xc]
push ebp
push edx
push 0xf003f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360se_3.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], ebx
call edi
cmp eax, ebx
jne 0x409658
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x222]
mov word [esp + 0x220], bx
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x220]
stosw word es:[edi], ax
lea eax, [esp + 0x10]
lea edx, [esp + 0x14]
push eax
push ecx
push edx
push ebx
push 0x514ff0
push esi
mov dword [esp + 0x28], 0x104
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40960f
cmp word [esp + 0x220], bx
jne 0x409700
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esp + 0x18]
push eax
call edi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [eax + eax + 2]
lea edx, [esp + 0x18]
push ecx
push edx
push 1
push ebx
push 0x514ff0
push esi
call ebp
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0x18]
push ecx
call edi
lea edx, [eax + eax + 2]
lea eax, [esp + 0x18]
push edx
push eax
jmp 0x4096f5
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], ebx
push ecx
push 0xf003f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x40967b
mov esi, dword [esp + 0x10]
lea edx, [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.360se_3.exe
push esi
mov dword [esp + 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x4096b1
cmp esi, ebx
je 0x4096ad
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [esp + 0x18]
push ecx
call edi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea edx, [eax + eax + 2]
lea eax, [esp + 0x18]
push edx
push eax
push 1
push ebx
push 0x514ff0
push esi
call ebp
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [esp + 0x18]
push edx
call edi
lea eax, [eax + eax + 2]
lea ecx, [esp + 0x18]
push eax
push ecx
push 1
push ebx
push str.Path
push esi
call ebp
cmp esi, ebx
pop ebp
je 0x40970c
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
add esp, 0x418
ret
Function at 0x409820
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x40984f
push 0
push esi
call fcn.00432970
add esp, 8
test eax, eax
je 0x40984f
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x40984f
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
ret

Function at 0x409cb0
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
xor ebx, ebx
push esi
cmp ebp, ebx
push edi
jne 0x409cc3
mov ebp, str.Main
mov esi, dword [esp + 0x20]
lea eax, [esi + esi]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [0x5191c4]
mov edi, dword [esp + 0x1c]
add esp, 4
cmp ecx, ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], ebx
je 0x409d20
mov eax, dword [0x5191e4]
test eax, eax
jne 0x409d07
push str.GetAppValue
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x5191e4], eax
je 0x409d18
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
push esi
push edx
push edi
push ebp
call eax
mov ebx, eax
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x409d46
mov ecx, 0x514ff8
call fcn.00407bc0
push eax
mov eax, dword [esp + 0x18]
push esi
push eax
push 0x514ff0
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ecx, ecx
cmp ecx, eax
sbb ebx, ebx
neg ebx
test ebx, ebx
je 0x409d90
test esi, esi
je 0x409d90
cmp esi, 0x7fffffff
ja 0x409d90
mov eax, dword [esp + 0x1c]
mov edi, SysReAllocString
mov edx, esi
sub edi, esi
mov esi, dword [esp + 0x14]
sub esi, eax
lea ecx, [edi + edx]
test ecx, ecx
je 0x409d84
mov cx, word [esi + eax]
test cx, cx
je 0x409d84
mov word [eax], cx
add eax, 2
dec edx
jne 0x409d69
jmp 0x409d88
test edx, edx
jne 0x409d8b
sub eax, 2
mov word [eax], 0
mov edx, dword [esp + 0x14]
push edx
call fcn.004d9644
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x409e30
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x20c
test eax, eax
je 0x409f19
push ebx
mov ebx, dword [esp + 0x214]
push esi
push edi
test ebx, ebx
jne 0x409e55
mov ebx, str.Main
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
mov ecx, dword [0x5191c4]
xor esi, esi
stosw word es:[edi], ax
mov edi, dword [esp + 0x220]
mov dword [esp + 0xc], esi
test ecx, ecx
je 0x409ebd
mov eax, dword [0x5191ec]
test eax, eax
jne 0x409ea0
push str.GetAppValue
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x5191ec], eax
je 0x409eb5
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push 0x103
push edx
push edi
push ebx
call eax
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x409ee7
mov ecx, 0x514ff8
call fcn.00407bc0
push eax
lea eax, [esp + 0x14]
push 0x103
push eax
push 0x514ff0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ecx, ecx
cmp ecx, eax
sbb esi, esi
neg esi
pop edi
test esi, esi
pop esi
pop ebx
je 0x409f19
cmp word [esp + 4], 0
je 0x409f19
lea edx, [esp + 4]
push edx
call dword [sym.imp.MSVCRT.dll__wtoi]
mov ecx, dword [esp + 0x21c]
add esp, 4
mov dword [ecx], eax
mov eax, 1
add esp, 0x20c
ret
xor eax, eax
add esp, 0x20c
ret
Function at 0x40a040
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x20004
call fcn.004d9670
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20014]
test esi, esi
push edi
jne 0x40a05e
mov esi, str.Main
mov ebp, dword [esp + 0x2002c]
mov ebx, 1
test ebp, ebp
je 0x40a256
mov edi, dword [esp + 0x20030]
test edi, edi
je 0x40a256
cmp dword [edi], 0
jbe 0x40a256
mov eax, dword [esp + 0x20028]
mov dword [esp + 0x10], 0
mov dword [eax], ebx
mov ecx, dword [0x5191c4]
test ecx, ecx
je 0x40a0f8
mov eax, dword [0x5191f8]
test eax, eax
jne 0x40a0c3
push str.EnumAppValue
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x5191f8], eax
je 0x40a0ec
mov edx, dword [esp + 0x20024]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x20024]
push edi
push ebp
push edx
mov edx, dword [esp + 0x2002c]
push ecx
push edx
push esi
call eax
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x40a249
mov ecx, 0x7fff
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x514ff8
xor edi, edi
call fcn.00407bc0
push eax
lea eax, [esp + 0x18]
push 0x10000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
test eax, eax
jbe 0x40a249
cmp word [esp + 0x14], di
lea esi, [esp + 0x14]
je 0x40a249
mov ebp, dword [sym.imp.MSVCRT.dll_wcschr]
push 0x3d
push esi
call ebp
add esp, 8
test eax, eax
je 0x40a16a
mov ecx, dword [esp + 0x2001c]
mov word [eax], 0
cmp edi, ecx
je 0x40a195
mov word [eax], 0x3d
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc edi
lea esi, [esi + eax*2 + 2]
cmp edi, 0xbb8
jae 0x40a249
cmp word [esi], 0
jne 0x40a149
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x20004
ret
mov ecx, dword [esp + 0x20024]
mov edx, dword [ecx]
test edx, edx
je 0x40a1e3
cmp edx, 0x7fffffff
ja 0x40a1e3
mov ecx, dword [esp + 0x20020]
mov ebx, SysReAllocString
sub ebx, edx
mov edi, edx
sub esi, ecx
lea edx, [ebx + edi]
test edx, edx
je 0x40a1d7
mov dx, word [esi + ecx]
test dx, dx
je 0x40a1d7
mov word [ecx], dx
add ecx, 2
dec edi
jne 0x40a1bc
jmp 0x40a1db
test edi, edi
jne 0x40a1de
sub ecx, 2
mov word [ecx], 0
mov ecx, dword [esp + 0x20030]
mov edx, dword [ecx]
shr edx, 1
je 0x40a247
cmp edx, 0x7fffffff
ja 0x40a247
mov ecx, dword [esp + 0x2002c]
mov esi, SysReAllocString
sub esi, edx
sub eax, ecx
lea edi, [eax + 2]
lea eax, [esi + edx]
test eax, eax
je 0x40a23b
mov ax, word [edi + ecx]
test ax, ax
je 0x40a23b
mov word [ecx], ax
add ecx, 2
dec edx
jne 0x40a20b
sub ecx, 2
xor ebx, ebx
pop edi
pop esi
mov eax, ebx
pop ebp
mov word [ecx], 0
pop ebx
add esp, 0x20004
ret
test edx, edx
jne 0x40a242
sub ecx, 2
mov word [ecx], 0
xor ebx, ebx
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x20004
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20004
ret