joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140079290
Capabilities:
Read .ini file

Disassembly:
push rdi
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x280], rbx
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x38], rdx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.140289490
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x40]
lea r8, [0x1402ec198]
lea rdx, str.SFTipsDate
lea rcx, str.config
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x14007938f
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rdi], rax
lea rax, [rsp + 0x40]
cmp rax, 0x10000
lea rax, [rsp + 0x40]
jae 0x140079343
movzx edx, ax
mov rcx, rdi
call fcn.14000b690
jmp 0x14007936b
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140079350
mov r8d, ecx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140010860
nop
mov rax, rdi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140172190
mov rbx, qword [rsp + 0x280]
add rsp, 0x260
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000adf0
int3

Function at 0x1400793c0
Capabilities:
Read .ini file

Disassembly:
push rdi
sub rsp, 0x270
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x290], rbx
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x40], rdx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call fcn.140289490
lea rcx, [rsp + 0x30]
call fcn.1400d2130
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x50]
mov r8, qword [rax]
lea rdx, str.SavePath
lea rcx, str.Theme
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140079465
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x1400794df
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rdi], rax
lea rax, [rsp + 0x50]
cmp rax, 0x10000
lea rax, [rsp + 0x50]
jae 0x1400794a0
movzx edx, ax
mov rcx, rdi
call fcn.14000b690
jmp 0x1400794bb
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400794a0
mov r8d, ebx
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.140010860
nop
mov rax, rdi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140172190
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000adf0
int3

Function at 0x1400794f0
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x28
mov r9, qword [rcx + 8]
lea rdx, str.timewidget
lea rcx, str.settings
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x140079520
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x28
mov r9, qword [rcx + 8]
lea rdx, str.hourSystem24
lea rcx, str.widget
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x140079550
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x28
mov r9, qword [rcx + 8]
lea rdx, [0x1402f9958]
lea rcx, str.widget
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x140079580
Capabilities:
Read .ini file

Disassembly:
push rdi
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x280], rbx
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x38], rdx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.140289490
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x40]
lea r8, [0x1402ec198]
lea rdx, str.towncode
lea rcx, [0x1402f9570]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x14007967f
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rdi], rax
lea rax, [rsp + 0x40]
cmp rax, 0x10000
lea rax, [rsp + 0x40]
jae 0x140079633
movzx edx, ax
mov rcx, rdi
call fcn.14000b690
jmp 0x14007965b
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140079640
mov r8d, ecx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140010860
nop
mov rax, rdi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140172190
mov rbx, qword [rsp + 0x280]
add rsp, 0x260
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000adf0
int3

Function at 0x1400796b0
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x28
mov r9, qword [rcx + 8]
lea rdx, str.VersionAreadyShowCheckUpdateDot
lea rcx, str.UpdateOnline
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x1400796e0
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x28
mov r9, qword [rcx + 8]
lea rdx, str.VersionAreadyShowTabDot
lea rcx, str.UpdateOnline
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x140079710
Capabilities:
Read .ini file

Disassembly:
push rdi
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x280], rbx
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x38], rdx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.140289490
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x40]
lea r8, [0x1402ec198]
lea rdx, str.imagePath
lea rcx, [0x1402f9570]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x14007980f
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rdi], rax
lea rax, [rsp + 0x40]
cmp rax, 0x10000
lea rax, [rsp + 0x40]
jae 0x1400797c3
movzx edx, ax
mov rcx, rdi
call fcn.14000b690
jmp 0x1400797eb
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x1400797d0
mov r8d, ecx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140010860
nop
mov rax, rdi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140172190
mov rbx, qword [rsp + 0x280]
add rsp, 0x260
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000adf0
int3

Function at 0x140079820
Capabilities:
Read .ini file

Disassembly:
push rdi
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x280], rbx
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x38], rdx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.140289490
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x40]
lea r8, [0x1402ec198]
lea rdx, str.imagePathAfter
lea rcx, [0x1402f9570]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x14007991f
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rdi], rax
lea rax, [rsp + 0x40]
cmp rax, 0x10000
lea rax, [rsp + 0x40]
jae 0x1400798d3
movzx edx, ax
mov rcx, rdi
call fcn.14000b690
jmp 0x1400798fb
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x1400798e0
mov r8d, ecx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140010860
nop
mov rax, rdi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140172190
mov rbx, qword [rsp + 0x280]
add rsp, 0x260
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000adf0
int3
Function at 0x140079930
Capabilities:
Read .ini file

Disassembly:
push rdi
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x280], rbx
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x38], rdx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.140289490
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x40]
lea r8, [0x1402ec198]
lea rdx, str.imagePathNow
lea rcx, [0x1402f9570]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x140079a2f
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rdi], rax
lea rax, [rsp + 0x40]
cmp rax, 0x10000
lea rax, [rsp + 0x40]
jae 0x1400799e3
movzx edx, ax
mov rcx, rdi
call fcn.14000b690
jmp 0x140079a0b
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x1400799f0
mov r8d, ecx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140010860
nop
mov rax, rdi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140172190
mov rbx, qword [rsp + 0x280]
add rsp, 0x260
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000adf0
int3

Function at 0x140079a40
Capabilities:
Read .ini file

Disassembly:
push rdi
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x280], rbx
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x38], rdx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.140289490
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x40]
lea r8, [0x1402ec198]
lea rdx, str.imagePathTomor
lea rcx, [0x1402f9570]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x140079b3f
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rdi], rax
lea rax, [rsp + 0x40]
cmp rax, 0x10000
lea rax, [rsp + 0x40]
jae 0x140079af3
movzx edx, ax
mov rcx, rdi
call fcn.14000b690
jmp 0x140079b1b
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140079b00
mov r8d, ecx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140010860
nop
mov rax, rdi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140172190
mov rbx, qword [rsp + 0x280]
add rsp, 0x260
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000adf0
int3
Function at 0x140079b50
Capabilities:
Read .ini file

Disassembly:
push rdi
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x280], rbx
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x38], rdx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.140289490
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x40]
lea r8, [0x1402ec198]
lea rdx, str.temperature
lea rcx, [0x1402f9570]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x140079c4f
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rdi], rax
lea rax, [rsp + 0x40]
cmp rax, 0x10000
lea rax, [rsp + 0x40]
jae 0x140079c03
movzx edx, ax
mov rcx, rdi
call fcn.14000b690
jmp 0x140079c2b
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140079c10
mov r8d, ecx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140010860
nop
mov rax, rdi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140172190
mov rbx, qword [rsp + 0x280]
add rsp, 0x260
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000adf0
int3

Function at 0x140079c60
Capabilities:
Read .ini file

Disassembly:
push rdi
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x280], rbx
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x38], rdx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.140289490
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x40]
lea r8, [0x1402ec198]
lea rdx, str.temperatureAfter
lea rcx, [0x1402f9570]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x140079d5f
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rdi], rax
lea rax, [rsp + 0x40]
cmp rax, 0x10000
lea rax, [rsp + 0x40]
jae 0x140079d13
movzx edx, ax
mov rcx, rdi
call fcn.14000b690
jmp 0x140079d3b
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140079d20
mov r8d, ecx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140010860
nop
mov rax, rdi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140172190
mov rbx, qword [rsp + 0x280]
add rsp, 0x260
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000adf0
int3
Function at 0x140079d70
Capabilities:
Read .ini file

Disassembly:
push rdi
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x280], rbx
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x38], rdx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.140289490
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x40]
lea r8, [0x1402ec198]
lea rdx, str.temperatureNow
lea rcx, [0x1402f9570]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x140079e6f
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rdi], rax
lea rax, [rsp + 0x40]
cmp rax, 0x10000
lea rax, [rsp + 0x40]
jae 0x140079e23
movzx edx, ax
mov rcx, rdi
call fcn.14000b690
jmp 0x140079e4b
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140079e30
mov r8d, ecx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140010860
nop
mov rax, rdi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140172190
mov rbx, qword [rsp + 0x280]
add rsp, 0x260
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000adf0
int3

Function at 0x140079e80
Capabilities:
Read .ini file

Disassembly:
push rdi
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x280], rbx
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x38], rdx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.140289490
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x40]
lea r8, [0x1402ec198]
lea rdx, str.temperatureTomor
lea rcx, [0x1402f9570]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x140079f7f
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rdi], rax
lea rax, [rsp + 0x40]
cmp rax, 0x10000
lea rax, [rsp + 0x40]
jae 0x140079f33
movzx edx, ax
mov rcx, rdi
call fcn.14000b690
jmp 0x140079f5b
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140079f40
mov r8d, ecx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140010860
nop
mov rax, rdi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140172190
mov rbx, qword [rsp + 0x280]
add rsp, 0x260
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000adf0
int3
Function at 0x140079f90
Capabilities:
Read .ini file

Disassembly:
push rdi
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x280], rbx
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x38], rdx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.140289490
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x40]
lea r8, [0x1402ec198]
lea rdx, [0x1402f95c0]
lea rcx, [0x1402f9570]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x14007a08f
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rdi], rax
lea rax, [rsp + 0x40]
cmp rax, 0x10000
lea rax, [rsp + 0x40]
jae 0x14007a043
movzx edx, ax
mov rcx, rdi
call fcn.14000b690
jmp 0x14007a06b
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x14007a050
mov r8d, ecx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140010860
nop
mov rax, rdi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140172190
mov rbx, qword [rsp + 0x280]
add rsp, 0x260
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000adf0
int3

Function at 0x14007a0a0
Capabilities:
Read .ini file

Disassembly:
push rdi
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x280], rbx
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x38], rdx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.140289490
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x40]
lea r8, [0x1402ec198]
lea rdx, str.textAfter
lea rcx, [0x1402f9570]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x14007a19f
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rdi], rax
lea rax, [rsp + 0x40]
cmp rax, 0x10000
lea rax, [rsp + 0x40]
jae 0x14007a153
movzx edx, ax
mov rcx, rdi
call fcn.14000b690
jmp 0x14007a17b
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x14007a160
mov r8d, ecx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140010860
nop
mov rax, rdi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140172190
mov rbx, qword [rsp + 0x280]
add rsp, 0x260
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000adf0
int3
Function at 0x14007a1b0
Capabilities:
Read .ini file

Disassembly:
push rdi
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x280], rbx
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x38], rdx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.140289490
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x40]
lea r8, [0x1402ec198]
lea rdx, str.textNow
lea rcx, [0x1402f9570]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x14007a2af
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rdi], rax
lea rax, [rsp + 0x40]
cmp rax, 0x10000
lea rax, [rsp + 0x40]
jae 0x14007a263
movzx edx, ax
mov rcx, rdi
call fcn.14000b690
jmp 0x14007a28b
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x14007a270
mov r8d, ecx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140010860
nop
mov rax, rdi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140172190
mov rbx, qword [rsp + 0x280]
add rsp, 0x260
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000adf0
int3

Function at 0x14007a2c0
Capabilities:
Read .ini file

Disassembly:
push rdi
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x280], rbx
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x38], rdx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.140289490
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x40]
lea r8, [0x1402ec198]
lea rdx, str.textTomor
lea rcx, [0x1402f9570]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x14007a3bf
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rdi], rax
lea rax, [rsp + 0x40]
cmp rax, 0x10000
lea rax, [rsp + 0x40]
jae 0x14007a373
movzx edx, ax
mov rcx, rdi
call fcn.14000b690
jmp 0x14007a39b
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x14007a380
mov r8d, ecx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140010860
nop
mov rax, rdi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140172190
mov rbx, qword [rsp + 0x280]
add rsp, 0x260
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000adf0
int3

Function at 0x14007a430
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r9, qword [rcx + 8]
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov r8d, 0xffffffff
lea rdx, str.left
lea rcx, str.config
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rbx], eax
mov r8d, 0xffffffff
mov r9, qword [rdi + 8]
lea rdx, [0x1402f9708]
lea rcx, str.config
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rbx, qword [rsp + 0x30]
mov dword [rsi], eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14007a4a0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, qword [rcx + 8]
lea rdx, str.ClearUserHold
mov rdi, rcx
xor r8d, r8d
lea rcx, str.config
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebx, eax
test eax, eax
je 0x14007a4eb
mov r9, qword [rdi + 8]
lea rdx, str.ClearUserHold
xor r8d, r8d
lea rcx, str.config
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14007a560
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x28
mov r9, qword [rcx + 8]
lea rdx, str.AlreadyShow
lea rcx, str.Theme
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
setne al
add rsp, 0x28
ret
Function at 0x14007d630
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, rdx
mov rbx, rcx
test rdi, rdi
je 0x14007d6e5
cmp qword [rdi], 0
mov rbx, qword [rcx]
je 0x14007d6b1
lea rcx, [0x1402f9ef0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14007d6d0
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14007d6d0
mov rdx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rcx, rbx
mov rdx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rdi + 8], 0
je 0x14007d6d0
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp byte [0x1403d4de0], 0
jne 0x14007d730
lea rcx, [0x1402f9ef0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14007d720
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403d4dd8], rax
mov byte [0x1403d4de0], 1
jmp 0x14007d737
mov rax, qword [0x1403d4dd8]
mov byte [0x1403d4de0], 1
jmp 0x14007d737
mov rax, qword [0x1403d4dd8]
mov rcx, qword [rbx]
mov rdx, rsi
test rax, rax
je 0x14007d6ba
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp rax

Function at 0x14007d860
Capabilities:
Get file version info

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x4060
call fcn.1401722d0
sub rsp, rax
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rsp + 0x4050], rax
movsxd rsi, r8d
mov rdi, rdx
mov rbx, rcx
xor edx, edx
mov r8d, 0x4000
lea rcx, [rsp + 0x50]
call fcn.140289490
mov dword [rsp + 0x40], 0
test rbx, rbx
je 0x14007d95d
test rdi, rdi
je 0x14007d95d
lea rdx, [rsp + 0x40]
mov rcx, rbx
call sub.VERSION.dll_GetFileVersionInfoSizeW
lea edx, [rax - 1]
cmp edx, 0x3ffe
ja 0x14007d95d
lea r9, [rsp + 0x50]
mov r8d, eax
xor edx, edx
mov rcx, rbx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x14007d95d
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x48]
lea rdx, [0x1402fa70c]
lea rcx, [rsp + 0x50]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14007d95d
mov r8, rsi
xor edx, edx
add r8, r8
mov rcx, rdi
call fcn.140289490
mov rax, qword [rsp + 0x48]
mov rcx, rdi
movzx r8d, word [rax + 0xc]
movzx r10d, word [rax + 0xe]
movzx r11d, word [rax + 8]
movzx r9d, word [rax + 0xa]
lea eax, [rsi - 1]
mov dword [rsp + 0x30], r8d
lea r8, [0x1402fa710]
mov dword [rsp + 0x28], r10d
movsxd rdx, eax
mov dword [rsp + 0x20], r11d
call fcn.14007fe30
mov eax, 1
jmp 0x14007d95f
xor eax, eax
mov rcx, qword [rsp + 0x4050]
xor rcx, rsp
call fcn.140172190
add rsp, 0x4060
pop rdi
pop rsi
pop rbx
ret