joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40015871
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x40071298
call fcn.4006f3a0
sub esp, 0x604
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
mov ecx, dword [ebp + 0xc]
push 0xa
call fcn.40004d93
movzx edi, ax
mov ebx, 0x1fe
xor eax, eax
push ebx
mov word [ebp - 0x410], ax
lea eax, [ebp - 0x40e]
push esi
push eax
call fcn.40054740
xor eax, eax
push ebx
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push esi
push eax
call fcn.40054740
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea eax, [ebp - 0x410]
add esp, 0x18
mov ebx, 0x100
push ebx
push eax
push 0x59
push edi
call esi
push ebx
lea eax, [ebp - 0x210]
push eax
push 0x5a
push edi
call esi
xor eax, eax
push 0x1fe
push eax
mov word [ebp - 0x610], ax
lea eax, [ebp - 0x60e]
push eax
call fcn.40054740
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x610]
push str._s__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x610]
add esp, 0x1c
push eax
call fcn.400069d1
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.40004636
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x40017e2a
Capabilities:
Get session user name

Disassembly:
mov eax, 0x40070178
call fcn.4006f3a0
sub esp, 0xc
and dword [ebp - 0x18], 0
push esi
push edi
mov edi, ecx
call fcn.40001ce1
push eax
lea ecx, [ebp - 0x10]
call fcn.40006f05
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
mov ecx, 0x101
push eax
mov dword [ebp - 0x14], ecx
push ecx
lea ecx, [ebp - 0x10]
call fcn.40006b63
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x40017eb9
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x7a
jne 0x40017ea4
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.40006b9b
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
call fcn.40006b63
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x40017eb9
call esi
call fcn.40001ce1
push eax
mov ecx, edi
call fcn.40006f05
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
jmp 0x40017ed6
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.40006b9b
mov esi, dword [ebp - 0x10]
lea ecx, [esi - 0x10]
call fcn.400073ec
add eax, 0x10
lea ecx, [esi - 0x10]
mov dword [edi], eax
call fcn.40004636
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40017fbc
Capabilities:
Check if file exists
Read file on windows
Set file attributes
Write file on windows

Disassembly:
mov eax, 0x40071596
call fcn.4006f3a0
sub esp, 0x220
cmp byte [0x400946ea], 0
push ebx
push esi
push edi
je 0x400181b5
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x22c]
push ebx
push eax
call fcn.40054740
add esp, 0xc
lea eax, [ebp - 0x22c]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str..local
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4001815d
push 0x80
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x20]
call fcn.40047350
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x1c]
push dword [eax]
call fcn.40006970
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.40004636
push 0x4007c450
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x14], ebx
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.40056c18
add esp, 0xc
cmp dword [ebp - 0x14], ebx
je 0x4001814e
mov eax, dword [ebp - 0x1c]
push dword [ebp - 0x14]
mov ecx, dword [eax - 0xc]
inc ecx
push ecx
push 1
push eax
call fcn.400573e7
push dword [ebp - 0x14]
call fcn.4005492d
add esp, 0x14
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x22c]
push 0x4007f818
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.40056c18
add esp, 0xc
cmp dword [ebp - 0x14], ebx
je 0x4001814e
call fcn.40001ce1
push eax
lea ecx, [ebp - 0x18]
call fcn.40006f05
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax - 0xc]
lea esi, [ebx + 2]
push esi
call fcn.400072ff
push esi
lea ecx, [ebp - 0x18]
mov edi, eax
call fcn.4000780c
push dword [ebp - 0x14]
lea ecx, [ebx + 2]
push ecx
push 1
push edi
call fcn.40057a34
mov esi, dword [ebp - 0x18]
push dword [esi - 8]
push esi
call fcn.40056b87
add esp, 0x18
lea ecx, [ebp - 0x18]
push eax
call fcn.4000780c
push dword [ebp - 0x14]
call fcn.4005492d
pop ecx
push esi
push dword [ebp - 0x1c]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
call fcn.40057b3c
test eax, eax
pop ecx
sete al
pop ecx
test al, al
lea ecx, [esi - 0x10]
sete byte [0x400946e8]
call fcn.40004636
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.40004636
mov ecx, str.PropertyService_fenrir.co.jp
call fcn.400047fe
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
call fcn.400081d4
mov dword [ebp - 4], 4
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x400181a1
cmp byte [0x400946e8], 0
mov eax, dword [esi]
je 0x40018193
push str.AppData
jmp 0x40018198
push str.local
push str.app.user.storage
push esi
call dword [eax + 0x38]
or dword [ebp - 4], 0xffffffff
mov byte [0x400946ea], bl
test esi, esi
je 0x400181b5
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov al, byte [0x400946e8]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4001821d
Capabilities:
Create directory

Disassembly:
mov eax, 0x400715b8
call fcn.4006f3a0
mov eax, dword [0x40097abc]
sub esp, 0x220
push ebx
mov ebx, edx
push esi
mov esi, ecx
push edi
mov edi, 0x40097ab8
test al, 1
jne 0x40018262
or eax, 1
mov dword [0x40097abc], eax
call fcn.40001ce1
push eax
mov ecx, edi
call fcn.40006f05
push 0x400748fc
call fcn.400542cc
pop ecx
mov ecx, dword [0x40097ab8]
cmp dword [ecx - 0xc], 0
je 0x4001827b
push edi
mov ecx, ebx
call fcn.400088ff
jmp 0x400183d8
call fcn.40001ce1
push eax
lea ecx, [ebp - 0x14]
call fcn.40006f05
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.400181cb
push str.users
lea ecx, [ebp - 0x14]
call fcn.4000d55a
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov ecx, eax
mov dword [ebp - 0x1c], eax
call fcn.400073ec
add eax, 0x10
mov dword [ebp - 0x10], eax
push 0
mov byte [ebp - 4], 1
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push eax
call edi
call fcn.40017f3a
test al, al
je 0x40018395
push esi
call fcn.40054188
pop ecx
test eax, eax
jne 0x40018376
mov esi, str.default
lea edi, [ebp - 0x228]
push 0x1f2
push eax
lea eax, [ebp - 0x218]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.40054740
add esp, 0xc
call fcn.40001ce1
push eax
lea ecx, [ebp - 0x18]
call fcn.40006f05
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.40017eed
test al, al
jne 0x4001833e
push str.default
lea eax, [ebp - 0x228]
push 0x101
push eax
call fcn.40057ae0
add esp, 0xc
push 0x4007ea24
lea ecx, [ebp - 0x10]
call fcn.4000d55a
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x10]
call fcn.4000d55a
push 0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.40004636
jmp 0x400183a2
push 0x4007ea24
lea ecx, [ebp - 0x10]
call fcn.4000d55a
push esi
lea ecx, [ebp - 0x10]
call fcn.4000d55a
push 0
push dword [ebp - 0x10]
call edi
jmp 0x400183a2
push str.All_Users
lea ecx, [ebp - 0x10]
call fcn.4000d55a
push 0x4007ea24
lea ecx, [ebp - 0x10]
call fcn.4000d55a
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
call fcn.400088ff
push ebx
mov ecx, 0x40097ab8
call fcn.400088ff
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.40004636
mov ecx, dword [ebp - 0x1c]
call fcn.40004636
mov ecx, dword [ebp - 0xc]
mov al, 1
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4001d9ae
Capabilities:
Check if file exists
Get common file path
Get file attributes
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
lea eax, [ebp - 0x410]
push esi
push 0x208
push 0
push eax
call fcn.40054740
add esp, 0xc
lea eax, [ebp - 0x410]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x400817d8
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4001da3a
push str.SetSearchPathMode
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4001da1c
push 0x8001
call eax
push str.SetDllDirectoryW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4001da33
push 0x4007c358
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x208
lea eax, [ebp - 0x208]
push 0
push eax
call fcn.40054740
add esp, 0xc
lea eax, [ebp - 0x208]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
pop esi
jmp 0x4001da7f
cmp word [ebp + eax*2 - 0x208], 0x5c
je 0x4001da84
dec eax
jns 0x4001da74
jmp 0x4001daad
xor ecx, ecx
mov word [ebp + eax*2 - 0x208], cx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4001daad
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov esp, ebp
pop ebp
ret

Function at 0x4001dc5b
Capabilities:
Check mutex on windows

Disassembly:
push esi
mov esi, ecx
call fcn.4001dc96
push dword [esi + 8]
mov byte [esi + 0xc], 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4001dc8c
mov byte [esi + 0xd], 1
xor al, al
pop esi
ret
xor eax, eax
cmp dword [esi + 4], eax
pop esi
setne al
ret
Function at 0x4002056b
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x208]
push esi
push edi
push 0x208
push 0
push eax
mov esi, edx
mov edi, ecx
call fcn.40054740
add esp, 0xc
lea eax, [ebp - 0x208]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str..debug
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x400205eb
push edi
push str.General
lea eax, [ebp - 0x208]
push eax
call fcn.400205f1
push esi
push str.Property
lea eax, [ebp - 0x208]
push eax
call fcn.400205f1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40020e29
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov eax, dword [eax]
mov edi, ecx
mov dword [ebp - 4], 0xa
xor esi, esi
mov ebx, 0x811c9dc5
mov ecx, dword [eax - 0xc]
mov eax, ecx
div dword [ebp - 4]
mov dword [ebp - 8], ecx
inc eax
mov dword [ebp - 4], eax
test ecx, ecx
je 0x40020e7b
test esi, esi
js 0x40020e99
mov ecx, dword [ebp + 8]
push esi
call fcn.4001698f
add esi, dword [ebp - 4]
imul ebx, ebx, 0x1000193
movzx ecx, ax
xor ebx, ecx
cmp esi, dword [ebp - 8]
jb 0x40020e5b
mov edx, dword [edi + 0x14]
mov eax, edx
and eax, ebx
cmp dword [edi + 0x18], eax
pop edi
pop esi
pop ebx
ja 0x40020e93
shr edx, 1
or ecx, 0xffffffff
sub ecx, edx
add eax, ecx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.40001ad1
int3
Function at 0x4002281b
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x400721ea
call fcn.4006f3a0
sub esp, 0xdc
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x1c], edi
call fcn.40001ce1
push eax
lea ecx, [ebp - 0x14]
call fcn.40006f05
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [esi + 4], ebx
je 0x40022991
push ecx
push ecx
lea ecx, [ebp - 0xe8]
call fcn.40024680
mov byte [ebp - 4], 1
mov eax, dword [esi]
mov esi, dword [eax]
cmp esi, eax
je 0x40022901
mov eax, dword [ebp - 0x10]
cmp dword [esi + 0x24], ebx
je 0x400228f7
mov edx, 0x4007f4b0
lea ecx, [ebp - 0xd8]
call fcn.400278ff
lea edx, [esi + 8]
mov ecx, eax
call fcn.40027acb
mov edx, 0x4007f4a8
mov ecx, eax
call fcn.400278ff
mov edi, dword [esi + 0x20]
mov edi, dword [edi]
cmp edi, dword [esi + 0x20]
je 0x400228e4
lea edx, [edi + 8]
lea ecx, [ebp - 0xd8]
lea ebx, [edx + 0x18]
call fcn.40027acb
mov edx, 0x40082a54
mov ecx, eax
call fcn.400278ff
mov edx, ebx
mov ecx, eax
call fcn.40027acb
mov edx, 0x4007d27c
mov ecx, eax
call fcn.400278ff
mov edi, dword [edi]
cmp edi, dword [esi + 0x20]
jne 0x400228a9
xor ebx, ebx
mov edx, 0x4007d27c
lea ecx, [ebp - 0xd8]
call fcn.400278ff
mov eax, dword [ebp - 0x10]
mov esi, dword [esi]
cmp esi, dword [eax]
jne 0x40022874
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0xe8]
call fcn.400247b1
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
jb 0x4002291c
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x10]
call fcn.40006970
mov byte [ebp - 4], 3
mov edx, dword [eax]
mov esi, dword [ebp - 0x14]
lea ecx, [edx - 0x10]
lea edi, [esi - 0x10]
cmp ecx, edi
je 0x40022968
cmp dword [edi + 0xc], ebx
jl 0x40022959
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x40022959
call fcn.40009f30
mov ecx, edi
mov esi, eax
call fcn.40004636
add esi, 0x10
mov dword [ebp - 0x14], esi
jmp 0x40022968
push dword [edx - 0xc]
lea ecx, [ebp - 0x14]
push edx
call fcn.4000a015
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.40004636
push ebx
push 1
lea ecx, [ebp - 0x34]
call fcn.40007169
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], bl
call fcn.40022752
mov edi, dword [ebp - 0x1c]
jmp 0x40022994
mov esi, dword [ebp - 0x14]
mov eax, dword [esi - 0xc]
mov ecx, edi
mov dword [ebp - 0x10], eax
call fcn.40023678
push 0x4007e114
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push edi
push eax
call fcn.40056c18
add esp, 0xc
mov edi, eax
cmp dword [ebp - 0x18], 0
jne 0x400229fa
call fcn.40001ce1
push eax
lea ecx, [ebp - 0x10]
call fcn.40006f05
push dword [ebp - 0x1c]
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.4002371f
push eax
push edi
lea eax, [ebp - 0x10]
push str.error_code:__d___s__n_s
push eax
call fcn.40007b5a
mov ecx, dword [ebp - 0x10]
add esp, 0x14
lea ecx, [ecx - 0x10]
call fcn.40004636
jmp 0x40022a15
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push 1
push esi
call fcn.400573e7
push dword [ebp - 0x18]
call fcn.4005492d
add esp, 0x14
mov bl, 1
lea ecx, [esi - 0x10]
call fcn.40004636
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40023678
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, ecx
push ebx
call esi
test eax, eax
je 0x400236af
push ebx
call esi
test eax, eax
je 0x40023705
xor esi, esi
push esi
push esi
push esi
push esi
push 4
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
neg eax
sbb al, al
inc al
jmp 0x40023719
push edi
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
push 1
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 1
xor esi, esi
lea eax, [ebp - 0x20]
push esi
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push esi
push 0x20
lea eax, [ebp - 0x20]
mov dword [ebp - 0xc], 0xc
push 2
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 3
push 0x50000000
push ebx
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
pop edi
test esi, esi
jne 0x40023709
xor al, al
jmp 0x40023719
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4002a579
Capabilities:
Check if file exists
Delete file
Read .ini file

Disassembly:
mov eax, 0x400729c2
call fcn.4006f3a0
sub esp, 0x28
push ebx
push esi
push edi
mov edi, ecx
mov ecx, str.DirectoryService_fenrir.co.jp
mov dword [ebp - 0x10], edi
call fcn.400047fe
push eax
lea ecx, [ebp - 0x1c]
call fcn.40016d85
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, dword [ebp - 0x1c]
test esi, esi
jne 0x4002a5b7
mov ebx, 0x80004005
jmp 0x4002a708
push str.user.temp
push esi
lea ecx, [ebp - 0x34]
call fcn.4004cbf0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
push dword [edi + 8]
call fcn.40009edd
push 0x104
lea ecx, [ebp - 0x30]
call fcn.40006b63
push str..log
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddExtensionW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x30]
call fcn.40006b9b
push dword [ebp - 0x30]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4002a6f2
call fcn.40001ce1
push eax
lea ecx, [ebp - 0x18]
call fcn.40006f05
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x2c]
push dword [eax]
push ebx
push str.count
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push eax
lea eax, [ebp - 0x18]
push 0x4007c8bc
push eax
call fcn.40007b5a
add esp, 0xc
mov ecx, str.PropertyService_fenrir.co.jp
call fcn.400047fe
push eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
call fcn.400081d4
mov byte [ebp - 4], 3
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
test edi, edi
je 0x4002a6c5
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0x20]
push str..failed_lasttime
lea edx, [edx + 8]
call fcn.40009e4c
mov byte [ebp - 4], 4
mov ecx, dword [edi]
mov dword [esp], 0x4007ca10
push dword [eax]
push edi
call dword [ecx + 0x38]
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.40004636
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0x20]
push str..failed_lasttime_count
lea edx, [edx + 8]
call fcn.40009e4c
pop ecx
push ebx
mov byte [ebp - 4], 5
push dword [eax]
mov ecx, dword [edi]
push edi
call dword [ecx + 0x38]
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.40004636
cmp byte [ebp + 8], 0
je 0x4002a6d6
mov eax, dword [ebp - 0x2c]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 2
test edi, edi
je 0x4002a6e4
mov eax, dword [edi]
push edi
call dword [eax + 8]
lea ecx, [ebx - 0x10]
mov byte [ebp - 4], 1
call fcn.40004636
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
push dword [ebp - 0x2c]
lea ecx, [ecx + 4]
call fcn.400088ff
lea ecx, [ebp - 0x34]
call fcn.4004cca0
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x4002a716
mov ecx, dword [esi]
push esi
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4002a72b
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x400729dc
call fcn.4006f3a0
sub esp, 0x20
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov ecx, dword [ebx + 4]
call fcn.40023678
test al, al
jne 0x4002a754
mov eax, 0x80004005
jmp 0x4002a85e
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call fcn.40001ce1
push eax
lea ecx, [ebp - 0x14]
call fcn.40006f05
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], eax
movzx eax, word [ebp - 0x1e]
push eax
movzx eax, word [ebp - 0x20]
push eax
movzx eax, word [ebp - 0x22]
push eax
movzx eax, word [ebp - 0x24]
push eax
movzx eax, word [ebp - 0x26]
push eax
movzx eax, word [ebp - 0x2a]
push eax
movzx eax, word [ebp - 0x2c]
push eax
lea eax, [ebp - 0x14]
push str._04d__02d__02d__02d:_02d:_02d._03d
push eax
call fcn.40007b5a
mov esi, dword [ebp - 0x14]
add esp, 0x24
push dword [ebx + 4]
push esi
push str.start
push dword [ebx + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
call ebx
call fcn.40001ce1
push eax
lea ecx, [ebp - 0x18]
call fcn.40006f05
mov edi, dword [ebp - 0x10]
xor eax, eax
mov byte [ebp - 4], 1
push dword [edi + 4]
push eax
push str.count
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
inc eax
push eax
lea eax, [ebp - 0x18]
push 0x4007c8bc
push eax
call fcn.40007b5a
mov eax, dword [ebp - 0x10]
add esp, 0xc
push dword [edi + 4]
mov edi, dword [ebp - 0x18]
push edi
push str.count
push dword [eax + 8]
call ebx
mov ebx, dword [ebp - 0x10]
xor eax, eax
push eax
push 2
push 3
push eax
push 3
push 0xc0000000
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x4002a842
cmp eax, 0xffffffff
je 0x4002a842
mov dword [ebx], eax
jmp 0x4002a849
mov dword [ebp - 0x1c], 0x80004005
lea ecx, [edi - 0x10]
call fcn.40004636
lea ecx, [esi - 0x10]
call fcn.40004636
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4002bab0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40072ae8
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x4009464c]
push ebx
push ebp
push esi
cmp eax, 0xffffffff
jne 0x4002badd
xor ebp, ebp
mov dword [esp + 0xc], ebp
jmp 0x4002baea
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], ebp
mov dword [esp + 0x24], 0
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test ebp, ebp
je 0x4002bb46
push edi
jmp 0x4002bb20
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
lea esp, [esp]
cmp dword [ebp + 0x18], 0
mov edi, dword [ebp + 0xc]
jne 0x4002bb81
test edi, edi
jne 0x4002bb85
call fcn.4002b450
mov eax, dword [0x4009464c]
pop edi
cmp eax, 0xffffffff
je 0x4002bb46
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x24], 0xffffffff
test ebp, ebp
je 0x4002bb6f
lea eax, [ebp + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x4002bb6f
mov eax, dword [ebp]
mov ecx, ebp
push 0
call dword [eax]
push ebp
push 0
call esi
push eax
call ebx
mov ecx, dword [esp + 0x1c]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
test edi, edi
je 0x4002bbbd
mov eax, dword [edi + 4]
mov dword [ebp + 0xc], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x4002bbae
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [edi]
mov ecx, esi
push 0
mov eax, dword [esi]
call dword [eax]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call esi
push eax
call ebx
push edi
push 0
call esi
push eax
call ebx
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x4002bb85
mov ebx, dword [ebp + 0x14]
lea eax, [ebp + 0x14]
mov dword [esp + 0x14], eax
mov esi, dword [ebx]
cmp esi, ebx
je 0x4002bb10
mov ebp, eax
cmp byte [esi + 0xd], 0
mov edi, esi
jne 0x4002bc17
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x4002bbfc
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x4002bc17
mov edi, edi
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x4002bbf0
jmp 0x4002bc17
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x4002bc15
cmp esi, dword [eax + 8]
jne 0x4002bc15
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x4002bc05
mov esi, eax
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x4002bc2b
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x4002bc2b
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push edi
lea eax, [esp + 0x20]
mov ecx, ebp
push eax
call fcn.40008b4e
cmp esi, ebx
jne 0x4002bbd3
mov ebp, dword [esp + 0x10]
jmp 0x4002bb10