joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405e40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x7a1304], 0
push esi
jne 0x405e77
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405e51
mov dword [ecx*4 + 0x7a1300], eax
inc ecx
cmp ecx, 0x100
jl 0x405e4c
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405ea8
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x7a1300]
xor eax, esi
inc ecx
dec edx
jne 0x405e8a
pop edi
not eax
pop esi
ret 0xc

Function at 0x10451058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.104511a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1045107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1045106a
add dl, dl
jne 0x10451089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104510dc
xor eax, eax
add dl, dl
jne 0x10451096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1045117d
add dl, dl
jne 0x104510a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104510b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104510bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104510c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104510d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10451075
mov eax, 1
add dl, dl
jne 0x104510ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104510f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104510e1
sub eax, ebx
mov ebx, 1
jne 0x10451128
mov ecx, 1
add dl, dl
jne 0x1045110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10451119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10451105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10451075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1045113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1045114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10451136
cmp eax, 0x7d00
jae 0x1045116d
cmp eax, 0x500
jb 0x10451168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10451075
cmp eax, 0x7f
ja 0x10451170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10451075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1045119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10451075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x407fa0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x407ff9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x407ff9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x407fea
cmp esi, edx
jae 0x407ff9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x407fd8
cmp esi, edx
jae 0x407ff9
cmp word [esi], 0
je 0x407ff9
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x409820
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61f78b
mov eax, dword fs:[0]
push eax
sub esp, 0x81c
mov eax, dword [0x690a1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x828], edi
cmp word [0x69cf68], 0
jne 0x40995a
push 0x20219
push str.SOFTWAREJianDesk
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x824]
mov dword [ebp - 0x824], 0
mov dword [ebp - 0x820], 0
mov dword [ebp - 0x81c], 0
call fcn.0040a640
mov ebx, dword [ebp - 0x824]
test eax, eax
jne 0x40994f
lea eax, [ebp - 0x814]
mov dword [ebp - 0x814], 0x800
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x818]
push eax
push 0
push str.FROM
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40994f
mov eax, dword [ebp - 0x818]
cmp eax, 1
je 0x4098ec
cmp eax, 2
jne 0x40994f
mov eax, dword [ebp - 0x814]
test eax, eax
je 0x409909
test al, 1
jne 0x40994f
shr eax, 1
cmp word [ebp + eax*2 - 0x812], 0
je 0x409912
jmp 0x40994f
xor eax, eax
mov word [ebp - 0x810], ax
mov ecx, 0x69cf68
lea esi, [ebp - 0x810]
mov edx, 0x3ff
sub esi, ecx
lea eax, [edx + 0x7ffffbff]
test eax, eax
je 0x409942
movzx eax, word [esi + ecx]
test ax, ax
je 0x409942
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x409924
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
test ebx, ebx
je 0x40995a
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x4099ca
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
push 0x69cf68
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.004090c0
test al, al
jne 0x4099ac
mov ecx, 0x69cf68
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409990
sub ecx, edx
sar ecx, 1
push ecx
push 0x69cf68
mov ecx, edi
call fcn.0040b220
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa103
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00407120
int3
Function at 0x4099e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61f78b
mov eax, dword fs:[0]
push eax
sub esp, 0x81c
mov eax, dword [0x690a1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x828], edi
cmp word [0x69e768], 0
jne 0x409b1a
push 0x20219
push str.SOFTWAREJianDesk
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x824]
mov dword [ebp - 0x824], 0
mov dword [ebp - 0x820], 0
mov dword [ebp - 0x81c], 0
call fcn.0040a640
mov ebx, dword [ebp - 0x824]
test eax, eax
jne 0x409b0f
lea eax, [ebp - 0x814]
mov dword [ebp - 0x814], 0x800
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x818]
push eax
push 0
push str.Setup_Path
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x409b0f
mov eax, dword [ebp - 0x818]
cmp eax, 1
je 0x409aac
cmp eax, 2
jne 0x409b0f
mov eax, dword [ebp - 0x814]
test eax, eax
je 0x409ac9
test al, 1
jne 0x409b0f
shr eax, 1
cmp word [ebp + eax*2 - 0x812], 0
je 0x409ad2
jmp 0x409b0f
xor eax, eax
mov word [ebp - 0x810], ax
mov ecx, 0x69e768
lea esi, [ebp - 0x810]
mov edx, 0x3ff
sub esi, ecx
lea eax, [edx + 0x7ffffbff]
test eax, eax
je 0x409b02
movzx eax, word [esi + ecx]
test ax, ax
je 0x409b02
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x409ae4
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
test ebx, ebx
je 0x409b1a
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x409b8a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
push 0x69e768
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.004090c0
test al, al
jne 0x409b6c
mov ecx, 0x69e768
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409b50
sub ecx, edx
sar ecx, 1
push ecx
push 0x69e768
mov ecx, edi
call fcn.0040b220
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa103
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00407120
int3
Function at 0x40a2c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61f78b
mov eax, dword fs:[0]
push eax
sub esp, 0x81c
mov eax, dword [0x690a1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x828], ebx
cmp word [0x69c768], 0
jne 0x40a3fa
push 0x20219
push str.SOFTWAREJianDesk
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x824]
mov dword [ebp - 0x824], 0
mov dword [ebp - 0x820], 0
mov dword [ebp - 0x81c], 0
call fcn.0040a640
mov edi, dword [ebp - 0x824]
test eax, eax
jne 0x40a3ef
lea eax, [ebp - 0x814]
mov dword [ebp - 0x814], 0x800
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x818]
push eax
push 0
push 0x632edc
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40a3ef
mov eax, dword [ebp - 0x818]
cmp eax, 1
je 0x40a38c
cmp eax, 2
jne 0x40a3ef
mov eax, dword [ebp - 0x814]
test eax, eax
je 0x40a3a9
test al, 1
jne 0x40a3ef
shr eax, 1
cmp word [ebp + eax*2 - 0x812], 0
je 0x40a3b2
jmp 0x40a3ef
xor eax, eax
mov word [ebp - 0x810], ax
mov ecx, 0x69c768
lea esi, [ebp - 0x810]
mov edx, 0x3ff
sub esi, ecx
lea eax, [edx + 0x7ffffbff]
test eax, eax
je 0x40a3e2
movzx eax, word [esi + ecx]
test ax, ax
je 0x40a3e2
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x40a3c4
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
test edi, edi
je 0x40a3fa
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x69c768
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jg 0x40a44b
mov ecx, 0x69c768
mov esi, str.noset
mov edx, 0x3ff
sub esi, ecx
nop word [eax + eax]
lea eax, [edx + 0x7ffffbff]
test eax, eax
je 0x40a43e
movzx eax, word [esi + ecx]
test ax, ax
je 0x40a43e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x40a420
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x40a4ba
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
push 0x69c768
mov ecx, ebx
mov dword [ebp - 4], 0
call fcn.004090c0
test al, al
jne 0x40a49c
mov ecx, 0x69c768
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a480
sub ecx, edx
sar ecx, 1
push ecx
push 0x69c768
mov ecx, ebx
call fcn.0040b220
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa103
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00407120
int3
Function at 0x40be20
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x690a1c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x69f074]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x210], esi
test al, 1
jne 0x40be77
or eax, 1
mov dword [0x69f074], eax
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x40bf5c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
push 0x6309e0
mov dword [0x69f070], eax
call fcn.004fa3ec
add esp, 4
mov eax, dword [0x69f070]
cmp dword [eax - 0xc], 0
jne 0x40bf3f
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.005e3920
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.JianDeskData
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40bee3
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push str.Config.ini
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40bf2e
push eax
push 0x80
push 2
push eax
push eax
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x40bf2e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
mov ecx, 0x69f070
push eax
call fcn.0040ba20
push 0x69f070
mov ecx, esi
call fcn.00408650
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004fa103
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00407120
int3
Function at 0x40cde0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61fc73
mov eax, dword fs:[0]
push eax
sub esp, 0x150
mov eax, dword [0x690a1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
push 0x80
mov dword [ebp - 0xb4], eax
lea eax, [ebp - 0x90]
push 0
push eax
mov dword [ebp - 0xb0], 0
mov byte [ebp - 0xa9], 0
call fcn.005e3920
add esp, 0xc
lea eax, [ebp - 0x90]
push dword [esi + 4]
push 0x3f
push eax
push edi
push ebx
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x90], 0
je 0x40cf6b
xor eax, eax
mov dword [ebp - 0x98], 0
mov word [ebp - 0xa8], ax
lea eax, [ebp - 0x90]
mov dword [ebp - 0x94], 7
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40ce93
sub eax, edx
lea ecx, [ebp - 0xa8]
sar eax, 1
push eax
lea eax, [ebp - 0x90]
push eax
call fcn.00417940
mov dword [ebp - 4], 0
mov dword [ebp - 0x15c], 0x633d00
mov dword [ebp - 0xfc], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
push 0
push 0
lea eax, [ebp - 0x14c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x15c]
mov dword [ebp - 0xb0], 1
call fcn.0040df40
mov eax, dword [ebp - 0x15c]
push 1
mov dword [ebp - 4], 2
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_istringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [ebp - 0x15c]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ebp + ecx - 0x160], eax
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0x14c]
call fcn.0040e570
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 4
call fcn.0040efb0
push dword [ebp - 0xb4]
lea eax, [ebp - 0x15c]
push eax
call fcn.0040c890
add esp, 8
lea ecx, [ebp - 0x15c]
mov bl, 1
call fcn.0040f7b0
mov al, bl
jmp 0x40cf71
mov al, byte [ebp - 0xa9]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa103
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40e6d0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61ff79
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x690a1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x220], esi
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x40e846
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x40e850
mov eax, dword [ecx]
call dword [eax + 0xc]
lea ecx, [eax + 0x10]
mov dword [esi + 4], ecx
mov eax, dword [esi]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov byte [ebp - 4], 1
cmp dword [eax - 0xc], 0
jne 0x40e7ae
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.005e3920
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.config.ini
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00412f20
mov ecx, dword [esi + 4]
cmp dword [ecx - 0xc], 0
jne 0x40e828
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.005e3920
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.jiandeskData
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40e80b
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push str.config.ini
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
lea ecx, [esi + 4]
call fcn.00412f20
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa103
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00407120
push 0x80004005
call fcn.00407120
int3
Function at 0x40fe50
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6201c8
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x690a1c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push dword [esi + 4]
mov edi, dword [ebp + 8]
push 0
push dword [edi]
push str.CoreFuncCount
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebx, eax
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x40ff05
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
inc ebx
mov dword [ebp - 4], 0
push ebx
lea eax, [ebp + 8]
push 0x633094
push eax
call fcn.00407320
add esp, 0xc
push dword [esi + 4]
mov esi, dword [ebp + 8]
push esi
push dword [edi]
push str.CoreFuncCount
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40fef1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00407120
int3

Function at 0x40ff10
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6201fb
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x690a1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x21c], esi
call fcn.005e3920
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.PluginCfg
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40ffa2
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push str.lockscreenfix.ini
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x41000e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
mov ecx, esi
test eax, 0xffff0000
jne 0x40ffea
movzx eax, ax
push eax
call fcn.00407850
jmp 0x40fff0
push eax
call fcn.00412f20
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa103
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00407120
int3
Function at 0x410080
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62023b
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x690a1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x21c], edi
call fcn.005e3920
add esp, 0xc
lea eax, [ebp - 0x218]
push dword [esi + 4]
push 0x104
push eax
push 0x6331a8
push 0x633480
push 0x633470
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x41014d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
mov ecx, edi
test eax, 0xffff0000
jne 0x410128
movzx eax, ax
push eax
call fcn.00407850
jmp 0x41012e
push eax
call fcn.00412f20
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa103
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00407120
int3

Function at 0x410260
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x620278
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x690a1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x4c]
push 0x3c
push 0
push eax
mov dword [ebp - 0x50], edi
call fcn.005e3920
add esp, 0xc
lea eax, [ebp - 0x4c]
push dword [esi + 4]
push 0xb
push eax
push 0
push str.check_time_linkacc
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x410315
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 4], 0
mov ecx, edi
test eax, 0xffff0000
jne 0x4102f0
movzx eax, ax
push eax
call fcn.00407850
jmp 0x4102f6
push eax
call fcn.00412f20
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa103
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00407120
int3
Function at 0x410320
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x620278
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x690a1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x4c]
push 0x3c
push 0
push eax
mov dword [ebp - 0x50], edi
call fcn.005e3920
add esp, 0xc
lea eax, [ebp - 0x4c]
push dword [esi + 4]
push 0xb
push eax
push 0
push str.check_time_mbtry
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x4103d5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 4], 0
mov ecx, edi
test eax, 0xffff0000
jne 0x4103b0
movzx eax, ax
push eax
call fcn.00407850
jmp 0x4103b6
push eax
call fcn.00412f20
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa103
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00407120
int3

Function at 0x4103e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x620278
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x690a1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x4c]
push 0x3c
push 0
push eax
mov dword [ebp - 0x50], edi
call fcn.005e3920
add esp, 0xc
lea eax, [ebp - 0x4c]
push dword [esi + 4]
push 0xb
push eax
push 0
push str.check_time_outdate
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x410495
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 4], 0
mov ecx, edi
test eax, 0xffff0000
jne 0x410470
movzx eax, ax
push eax
call fcn.00407850
jmp 0x410476
push eax
call fcn.00412f20
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa103
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00407120
int3