joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407f60
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0xffffffffffffffff
push 0x4a979a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
mov ebp, ecx
xor ebx, ebx
push esi
push edi
lea ecx, [ebp + 0x40]
mov dword [esp + 0x14], ebp
cmp ecx, ebx
je 0x407f90
lea eax, [ecx - 0x40]
jmp 0x407f92
xor eax, eax
push ecx
add eax, 0x2c
push 0x40
push 0xd
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, ebp
mov dword [esp + 0x20], ebx
call fcn.0043ed70
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x3c], ebx
or eax, 0xffffffff
mov dword [ebp + 0x44], ebx
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x4c], ebx
mov byte [ebp + 0x60], bl
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x58], eax
mov dword [ebp + 0x5c], eax
mov ecx, dword [esp + 0x28]
mov byte [esp + 0x20], 3
lea esi, [ebp + 0x68]
mov eax, dword [ecx]
cmp dword [eax - 0xc], ebx
jl 0x407fee
mov dword [esi], eax
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x408044
mov eax, dword [0x4c2080]
mov dword [esi], eax
mov ecx, dword [ecx]
cmp ecx, ebx
mov dword [esp + 0x28], ecx
jne 0x408003
xor edi, edi
jmp 0x40800c
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
push edi
mov ecx, esi
call fcn.004059f0
test eax, eax
je 0x408044
mov ecx, dword [esp + 0x28]
lea eax, [edi + edi]
mov dword [esp + 0x10], eax
push eax
mov eax, dword [esi]
lea edx, [edi + edi + 2]
push ecx
push edx
push eax
call fcn.00404a40
mov ecx, dword [esi]
mov eax, dword [esp + 0x20]
add esp, 0x10
mov dword [ecx - 8], edi
mov edx, dword [esi]
mov word [eax + edx], bx
mov ecx, dword [0x4c2080]
mov dword [ebp + 0x6c], ecx
mov edx, dword [0x4c2080]
mov dword [ebp + 0x70], edx
mov ecx, dword [esp + 0x2c]
mov byte [esp + 0x20], 6
lea edi, [ebp + 0x74]
mov eax, dword [ecx]
cmp dword [eax - 0xc], ebx
jl 0x408077
mov dword [edi], eax
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x4080f5
mov eax, dword [0x4c2080]
mov dword [edi], eax
mov edx, dword [ecx]
cmp edx, ebx
mov dword [esp + 0x2c], edx
jne 0x408090
xor esi, esi
mov dword [esp + 0x28], esi
jmp 0x4080a1
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x28], eax
mov esi, eax
mov eax, dword [edi]
cmp dword [eax - 0xc], 1
jg 0x4080ae
cmp esi, dword [eax - 4]
jle 0x4080c5
mov ecx, edi
call fcn.00405a90
push esi
mov ecx, edi
call fcn.004056f0
cmp eax, ebx
je 0x4080f5
mov edx, dword [esp + 0x2c]
lea eax, [esi + esi]
lea ecx, [esi + esi + 2]
cmp ecx, eax
jb 0x4080e8
mov edi, dword [edi]
mov ecx, eax
mov esi, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x28]
mov ecx, dword [ebp + 0x74]
mov dword [ecx - 8], esi
mov edx, dword [ebp + 0x74]
mov word [eax + edx], bx
mov ecx, dword [esp + 0x18]
pop edi
mov dword [ebp], vtable.CCancelMsgBox.1.0
mov dword [ebp + 0x24], vtable.CCancelMsgBox.0
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x4082d0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
test eax, eax
push edi
mov esi, ecx
jne 0x4084f6
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
cmp eax, 0x111
jne 0x408348
cmp di, 2
jne 0x408310
call fcn.00418470
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
cmp di, 0x3ec
jne 0x40832a
mov ecx, esi
call fcn.00418480
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
cmp di, 0x3ed
jne 0x40842a
mov ecx, esi
call fcn.00418470
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
cmp eax, 0x110
jne 0x408371
push 1
mov ecx, esi
call fcn.00408280
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push edi
call fcn.00409040
mov ecx, esi
call fcn.00408500
mov dword [ebx], eax
jmp 0x4083de
cmp eax, 0x14
jne 0x408393
push 1
mov ecx, esi
call fcn.00408280
push ecx
mov ecx, esi
mov eax, esp
mov dword [esp + 0x24], esp
mov dword [eax], edi
call fcn.00408910
mov dword [ebx], eax
jmp 0x4083de
cmp eax, 0xf
jne 0x4083b3
push 1
mov ecx, esi
call fcn.00408280
push ecx
mov ecx, esi
mov eax, esp
mov dword [esp + 0x24], esp
mov dword [eax], edi
call fcn.00408db0
jmp 0x4083d8
cmp eax, 0x201
jne 0x4083f5
push 1
mov ecx, esi
call fcn.00408280
mov ecx, ebp
shr ecx, 0x10
movsx ecx, cx
movsx eax, bp
push ecx
push eax
push edi
mov ecx, esi
call fcn.00418ab0
mov dword [ebx], 0
mov ecx, esi
call fcn.00408270
test eax, eax
je 0x408426
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
cmp eax, 0x7ed
jne 0x40842a
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push 1
push edx
push eax
push 0x7ed
mov ecx, esi
call fcn.004087f0
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push 0
push ebx
push ebp
push edi
push eax
push edx
mov ecx, esi
call fcn.0043f100
test eax, eax
je 0x40844c
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
mov ecx, dword [esp + 0x18]
lea eax, [esi + 0x44]
cmp ecx, 5
jne 0x4084c4
test eax, eax
je 0x408461
lea esi, [eax - 0x44]
jmp 0x408463
xor esi, esi
mov cl, byte [eax + 0x1c]
test cl, cl
je 0x408498
mov eax, dword [esi + 0x28]
push 0xe801
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp edi, 2
jne 0x408489
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40849d
test edi, edi
jne 0x408498
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40849d
cmp edi, 1
je 0x4084e4
mov ecx, ebp
shr ecx, 0x10
movsx edx, cx
movsx eax, bp
push edx
push eax
lea ecx, [esi + 0x44]
call fcn.0041baa0
mov dword [ebx], 0
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
cmp ecx, 0x24
jne 0x4084f6
mov edx, dword [eax + 0x14]
or ecx, 0xffffffff
cmp edx, ecx
je 0x4084e4
cmp dword [eax + 0x18], ecx
je 0x4084e4
mov ecx, dword [eax + 0x14]
mov dword [ebp + 0x18], ecx
mov edx, dword [eax + 0x18]
mov dword [ebp + 0x1c], edx
mov dword [ebx], 0
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x18
Function at 0x40a560
Capabilities:
Check os version

Disassembly:
sub esp, 0x140
push esi
push edi
mov ecx, 9
xor eax, eax
lea edi, [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
rep stosd dword es:[edi], eax
mov ecx, 0x47
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0x11c
push eax
call esi
test eax, eax
jne 0x40a5ac
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2c], 0x114
push ecx
call esi
test eax, eax
je 0x40a5ed
push str.GetNativeSystemInfo
push 0x4c28e0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40a5ed
lea edx, [esp + 8]
push edx
call eax
mov ax, word [esp + 8]
cmp ax, 9
je 0x40a5df
cmp ax, 6
jne 0x40a5ed
pop edi
mov eax, 1
pop esi
add esp, 0x140
ret
pop edi
xor eax, eax
pop esi
add esp, 0x140
ret

Function at 0x40a600
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
lea eax, [esp]
mov dword [esp], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [esp + 4]
xor eax, eax
cmp ecx, 5
sete al
add esp, 0x114
ret

Function at 0x40a660
Capabilities:
Get disk size

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x224
push esi
xor esi, esi
cmp edx, esi
je 0x40a6ee
push edi
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x22]
mov word [esp + 0x20], si
push esi
rep stosd dword es:[edi], eax
push esi
lea eax, [esp + 0x28]
push esi
push eax
push edx
call dword [sym.imp.MSVCRT.dll__wsplitpath]
add esp, 0x14
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
lea eax, [esp + 8]
push ecx
push edx
lea ecx, [esp + 0x28]
push eax
push ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
pop edi
je 0x40a6ee
mov eax, dword [esp + 0x230]
mov edx, dword [esp + 4]
mov ecx, dword [esp + 8]
pop esi
mov dword [eax], edx
mov dword [eax + 4], ecx
mov eax, 1
add esp, 0x224
ret
xor eax, eax
pop esi
add esp, 0x224
ret
Function at 0x40ae80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a9927
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov ecx, dword [esp + 0x34]
lea eax, [esp + 8]
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x2c], 1
call fcn.0040b0d0
mov edi, dword [esp + 0x30]
mov ecx, esi
push edi
call fcn.0040adb0
cmp eax, dword [esi + 0xc]
jne 0x40af21
mov eax, dword [esp + 8]
mov dword [esp + 0x10], edi
test eax, eax
mov dword [esp + 0x14], eax
je 0x40aeec
mov edx, dword [eax]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x38]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0xc]
lea ecx, [esi + 4]
lea edx, [esp + 0x10]
mov byte [esp + 0x24], 2
push edx
push 1
push eax
call fcn.0040b1d0
mov eax, dword [esp + 0x14]
mov byte [esp + 0x24], 1
test eax, eax
je 0x40af4b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x40af4b
mov esi, dword [eax + 4]
mov ecx, dword [esp + 8]
cmp esi, ecx
je 0x40af4f
mov dword [eax + 4], ecx
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x40af41
mov edx, dword [ecx]
push ecx
call dword [edx + 4]
mov ecx, dword [esp + 8]
test esi, esi
je 0x40af4f
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov ecx, dword [esp + 8]
mov esi, dword [esp + 0x2c]
test ecx, ecx
mov dword [esi], ecx
je 0x40af63
mov edx, dword [ecx]
push ecx
call dword [edx + 4]
mov ecx, dword [esp + 8]
mov dword [esp + 0xc], 1
test ecx, ecx
mov byte [esp + 0x24], 0
je 0x40af7a
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0x10

Function at 0x40b0d0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
xor ebx, ebx
push edi
mov dword [esp + 0xc], ecx
mov eax, dword [ebp]
cmp eax, ebx
je 0x40b0f0
mov dword [ebp], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x1c]
cmp eax, ebx
jne 0x40b103
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 8
push ebx
push ebx
push 3
push ebx
push ebx
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, ebx
jne 0x40b126
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 8
lea edx, [esp + 0x10]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp dword [esp + 0x14], ebx
jle 0x40b14a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 8
mov eax, dword [esp + 0x10]
push esi
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x40b192
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push ebx
push ecx
push edx
push esi
push edi
mov dword [esp + 0x38], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push ebp
push eax
push esi
call fcn.0040afa0
push esi
mov ebx, eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
mov eax, ebx
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x40c7f0
Capabilities:
Read .ini file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
push eax
mov eax, dword [esi + 8]
push ecx
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [esi + 4]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, dword [esi + 0xc]
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
ret 4

Function at 0x40c880
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40c892
pop esi
ret
mov ecx, esi
call fcn.0040bf40
call fcn.0040a560
test eax, eax
je 0x40c8a9
push str.Product64
jmp 0x40c8ae
push str.Product32
mov ecx, esi
call fcn.0040f550
mov ecx, dword [esi + 0x1c]
call fcn.0043d480
test eax, eax
jg 0x40c8cd
push 0x4c35f8
mov ecx, esi
call fcn.0040f550
mov ecx, esi
call fcn.0040f720
mov eax, dword [esi + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x40c8e6
push eax
mov ecx, esi
call fcn.0040cbb0
mov eax, dword [esi + 0xc]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x40c8f8
push eax
mov ecx, esi
call fcn.0040ce90
mov eax, dword [esi + 0x10]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x40c90a
push eax
mov ecx, esi
call fcn.0040cf90
mov eax, dword [esi + 0x14]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x40c91c
push eax
mov ecx, esi
call fcn.0040d090
mov eax, dword [esi + 0x18]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x40c92e
push eax
mov ecx, esi
call fcn.0040d1b0
mov eax, 1
pop esi
ret
Function at 0x40ce90
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x2000
call fcn.004a2ae0
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x800
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov edi, dword [esi]
test edi, edi
je 0x40cec5
mov ebp, dword [esp + 0x2010]
test ebp, ebp
je 0x40cec5
lea eax, [esp + 0xc]
test eax, eax
jne 0x40ced3
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x2000
ret 4
push ebx
push edi
lea ecx, [esp + 0x14]
push 0x1000
push ecx
push 0
push str.PageState
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x10], 0
jne 0x40cef9
xor eax, eax
jmp 0x40cf51
mov ebx, dword [sym.imp.MSVCRT.dll__wcsnicmp]
push 0x20
lea edx, [esp + 0x14]
push str.Hide
push edx
call ebx
add esp, 0xc
test eax, eax
jne 0x40cf1b
mov eax, 1
jmp 0x40cf51
push 0x20
lea eax, [esp + 0x14]
push str.Minimized
push eax
call ebx
add esp, 0xc
test eax, eax
jne 0x40cf37
mov eax, 2
jmp 0x40cf51
push 0x20
lea ecx, [esp + 0x14]
push str.Smart
push ecx
call ebx
add esp, 0xc
neg eax
sbb eax, eax
and al, 0xfd
add eax, 3
mov edx, dword [esi + 0x1c]
push edi
push 0
push str.ShowCancelButton
push ebp
mov dword [edx + 0x18c], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [esi + 0x1c]
xor ecx, ecx
cmp eax, 1
pop ebx
sete cl
pop edi
pop esi
mov dword [edx + 0x190], ecx
mov eax, 1
pop ebp
add esp, 0x2000
ret 4

Function at 0x40cf90
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x2000
call fcn.004a2ae0
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x800
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov edi, dword [esi]
test edi, edi
je 0x40cfc5
mov ebp, dword [esp + 0x2010]
test ebp, ebp
je 0x40cfc5
lea eax, [esp + 0xc]
test eax, eax
jne 0x40cfd3
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x2000
ret 4
push ebx
push edi
lea ecx, [esp + 0x14]
push 0x1000
push ecx
push 0
push str.PageState
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x10], 0
jne 0x40cff9
xor eax, eax
jmp 0x40d051
mov ebx, dword [sym.imp.MSVCRT.dll__wcsnicmp]
push 0x20
lea edx, [esp + 0x14]
push str.Hide
push edx
call ebx
add esp, 0xc
test eax, eax
jne 0x40d01b
mov eax, 1
jmp 0x40d051
push 0x20
lea eax, [esp + 0x14]
push str.Minimized
push eax
call ebx
add esp, 0xc
test eax, eax
jne 0x40d037
mov eax, 2
jmp 0x40d051
push 0x20
lea ecx, [esp + 0x14]
push str.Smart
push ecx
call ebx
add esp, 0xc
neg eax
sbb eax, eax
and al, 0xfd
add eax, 3
mov edx, dword [esi + 0x1c]
push edi
push 0
push str.ShowCancelButton
push ebp
mov dword [edx + 0x194], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [esi + 0x1c]
xor ecx, ecx
cmp eax, 1
pop ebx
sete cl
pop edi
pop esi
mov dword [edx + 0x198], ecx
mov eax, 1
pop ebp
add esp, 0x2000
ret 4
Function at 0x40d090
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x2000
call fcn.004a2ae0
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0x800
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov edi, dword [esi]
test edi, edi
je 0x40d0c5
mov ebx, dword [esp + 0x2010]
test ebx, ebx
je 0x40d0c5
lea eax, [esp + 0xc]
test eax, eax
jne 0x40d0d3
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x2000
ret 4
push ebp
push edi
lea ecx, [esp + 0x14]
push 0x1000
push ecx
push 0
push str.PageState
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x10], 0
jne 0x40d0f9
xor eax, eax
jmp 0x40d151
mov ebp, dword [sym.imp.MSVCRT.dll__wcsnicmp]
push 0x20
lea edx, [esp + 0x14]
push str.Hide
push edx
call ebp
add esp, 0xc
test eax, eax
jne 0x40d11b
mov eax, 1
jmp 0x40d151
push 0x20
lea eax, [esp + 0x14]
push str.Minimized
push eax
call ebp
add esp, 0xc
test eax, eax
jne 0x40d137
mov eax, 2
jmp 0x40d151
push 0x20
lea ecx, [esp + 0x14]
push str.Smart
push ecx
call ebp
add esp, 0xc
neg eax
sbb eax, eax
and al, 0xfd
add eax, 3
mov edx, dword [esi + 0x1c]
push edi
push 1
push str.ShowCancelButton
push ebx
mov dword [edx + 0x19c], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [esi + 0x1c]
xor ecx, ecx
cmp eax, 1
pop ebp
sete cl
mov dword [edx + 0x1a0], ecx
mov esi, dword [esi + 0x1c]
cmp dword [esi + 0x19c], 1
jne 0x40d191
mov dword [esi + 0x19c], 2
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x2000
ret 4

Function at 0x40d1b0
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x2000
call fcn.004a2ae0
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x800
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov edi, dword [esi]
test edi, edi
je 0x40d1e5
mov ebp, dword [esp + 0x2010]
test ebp, ebp
je 0x40d1e5
lea eax, [esp + 0xc]
test eax, eax
jne 0x40d1f3
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x2000
ret 4
push ebx
push edi
lea ecx, [esp + 0x14]
push 0x1000
push ecx
push 0
push str.PageState
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x10], 0
jne 0x40d219
xor eax, eax
jmp 0x40d271
mov ebx, dword [sym.imp.MSVCRT.dll__wcsnicmp]
push 0x20
lea edx, [esp + 0x14]
push str.Hide
push edx
call ebx
add esp, 0xc
test eax, eax
jne 0x40d23b
mov eax, 1
jmp 0x40d271
push 0x20
lea eax, [esp + 0x14]
push str.Minimized
push eax
call ebx
add esp, 0xc
test eax, eax
jne 0x40d257
mov eax, 2
jmp 0x40d271
push 0x20
lea ecx, [esp + 0x14]
push str.Smart
push ecx
call ebx
add esp, 0xc
neg eax
sbb eax, eax
and al, 0xfd
add eax, 3
mov edx, dword [esi + 0x1c]
push edi
push 0
push str.ShowCancelButton
push ebp
mov dword [edx + 0x1a4], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [esi + 0x1c]
xor ecx, ecx
cmp eax, 1
pop ebx
sete cl
pop edi
pop esi
mov dword [edx + 0x1a8], ecx
mov eax, 1
pop ebp
add esp, 0x2000
ret 4
Function at 0x40e840
Capabilities:
Get file version info

Disassembly:
mov eax, 0x200c
call fcn.004a2ae0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x201c]
test esi, esi
push edi
je 0x40e934
mov ebx, dword [esp + 0x2024]
test ebx, ebx
je 0x40e934
mov ebp, dword [esp + 0x2028]
cmp ebp, 0x80
jl 0x40e934
mov ecx, 0x800
xor eax, eax
lea edi, [esp + 0x1c]
mov dword [esp + 0x14], 0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x40e934
cmp eax, 0x1fff
ja 0x40e934
lea ecx, [esp + 0x1c]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40e934
lea edx, [esp + 0x18]
lea eax, [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x24]
push 0x4c2b54
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40e934
mov ecx, ebp
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov edx, dword [eax + 0xc]
mov cx, word [eax + 0xc]
shr edx, 0x10
push ecx
push edx
mov edx, dword [eax + 8]
xor ecx, ecx
mov cx, word [eax + 8]
shr edx, 0x10
push ecx
push edx
push 0x4c2b3c
push ebx
call dword [sym.imp.MSVCRT.dll_swprintf]
add esp, 0x18
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x200c
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x200c
ret
Function at 0x40f550
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x2004
call fcn.004a2ae0
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x800
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov edi, dword [esi]
test edi, edi
je 0x40f585
mov ebp, dword [esp + 0x2014]
test ebp, ebp
je 0x40f585
lea eax, [esp + 0x10]
test eax, eax
jne 0x40f593
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x2004
ret 4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push edi
lea ecx, [esp + 0x18]
push 0x1000
push ecx
push 0
push str.BDProduct
push ebp
call ebx
cmp word [esp + 0x14], 0
je 0x40f5ed
mov ebx, dword [sym.imp.MSVCRT.dll_wcslen]
lea edx, [esp + 0x14]
push edx
call ebx
mov dword [esp + 0x14], eax
mov ax, word [0x4d1c0c]
push eax
lea ecx, [esp + 0x1c]
push 0x2c
push ecx
call fcn.00438050
mov edx, dword [esp + 0x20]
add esp, 0x10
push 1
push 0
push 1
jmp 0x40f694
push edi
lea ecx, [esp + 0x18]
push 0x1000
push ecx
push 0
push str.FixedProduct
push ebp
call ebx
cmp word [esp + 0x14], 0
mov ebx, dword [sym.imp.MSVCRT.dll_wcslen]
je 0x40f648
lea edx, [esp + 0x14]
push edx
call ebx
mov dword [esp + 0x14], eax
mov ax, word [0x4d1c0c]
push eax
lea ecx, [esp + 0x1c]
push 0x2c
push ecx
call fcn.00438050
mov edx, dword [esp + 0x20]
add esp, 0x10
lea eax, [esp + 0x14]
mov ecx, esi
push 0
push 1
push 1
push edx
push eax
call fcn.0040dcb0
push edi
lea ecx, [esp + 0x18]
push 0x1000
push ecx
push 0
push 0x4c3838
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x14], 0
je 0x40f6a1
lea edx, [esp + 0x14]
push edx
call ebx
mov dword [esp + 0x14], eax
mov ax, word [0x4d1c0c]
push eax
lea ecx, [esp + 0x1c]
push 0x2c
push ecx
call fcn.00438050
mov edx, dword [esp + 0x20]
add esp, 0x10
push 0
push 1
push 0
lea eax, [esp + 0x20]
push edx
push eax
mov ecx, esi
call fcn.0040dcb0
push edi
lea ecx, [esp + 0x18]
push 0x1000
push ecx
push 0
push str.OptionalProductEx
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0x14], 0
je 0x40f6f4
lea edx, [esp + 0x14]
push edx
call ebx
mov edi, eax
mov ax, word [0x4d1c0c]
push eax
lea ecx, [esp + 0x1c]
push 0x2c
push ecx
call fcn.00438050
add esp, 0x10
lea edx, [esp + 0x14]
mov ecx, esi
push 0
push 1
push 2
push edi
push edx
call fcn.0040dcb0
mov ecx, dword [esi + 0x1c]
push 2
call fcn.0043cbb0
cmp eax, 1
pop ebx
je 0x40f70e
mov ecx, dword [esi + 0x1c]
push 0
call fcn.0043d620
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x2004
ret 4