joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b7e3
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0x40
push 0x1000
lea ebx, [edi + 0x14]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x100b839
push ebx
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
and dword [esi + 8], 0
mov dword [esi], 0x76746d31
mov dword [esi + 4], edi
mov dword [esi + 0xc], 0xbaadf00d
lea eax, [esi + 0x10]
mov dword [esi + edi + 0x10], 0xbaadbeef
jmp 0x100b83c
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100b866
Capabilities:
Query environment variable

Disassembly:
push 0xc
push 0x101f7a0
call fcn.0101ed10
or dword [ebp - 0x1c], 0xffffffff
push 0x104
mov eax, dword [ebp + 8]
push dword [eax + 0x44]
push 0x1004c08
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor esi, esi
mov dword [ebp - 4], esi
push 2
push esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
or dword [ebp - 4], 0xffffffff
jmp 0x100b8ad
push esi
call fcn.0100a84c
test eax, eax
je 0x100b8d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1004be0
call dword [sym.imp.msvcrt.dll_printf]
pop ecx
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], esi
jmp 0x100b8e0
push 0x1004bc0
call dword [sym.imp.msvcrt.dll_printf]
mov dword [ebp - 0x1c], esi
pop ecx
mov eax, dword [ebp - 0x1c]
call fcn.0101ed4b
ret
Function at 0x100f1ff
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, word [ebp + 0x10]
push ebx
push esi
push edi
push dword [ebp + 0xc]
xor edi, edi
push eax
push dword [ebp + 8]
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], edi
or ebx, 0xffffffff
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, edi
je 0x100f290
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x100f290
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x100f290
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x100f290
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
push esi
push eax
call fcn.0100b45d
add esp, 0x10
test eax, eax
je 0x100f290
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push 0xfde9
call fcn.0100f0ee
add esp, 0x14
mov ebx, eax
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x100f29c
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x100f2a8
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
cmp dword [ebp - 4], 0
je 0x100f2b8
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x100f8f3
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
or dword [ebp - 0xc], 0xffffffff
push esi
xor esi, esi
push edi
mov dword [ebp - 4], esi
xor edi, edi
push dword [esi + 0x1021574]
push dword [ebp + 0xc]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x100f92e
add esi, 0xc
inc edi
cmp esi, 0x378
jb 0x100f908
jmp 0x100fa03
mov eax, edi
imul eax, eax, 0xc
push ebx
mov ebx, dword [eax + 0x1021570]
mov eax, dword [eax + 0x1021578]
mov dword [ebp - 8], eax
test ebx, ebx
je 0x100fa02
mov esi, 0x208
push esi
call dword [sym.imp.msvcrt.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x100fa02
push esi
push 0
push edi
call sub.msvcrt.dll_memset
mov esi, dword [ebp + 8]
add esp, 0xc
push dword [ebp - 8]
push dword [esi + 0x44]
push edi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
cmp dword [esi + 0x28], 0
je 0x100f9c3
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100f9c3
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push edi
push 0xfde9
call fcn.0100b112
add esp, 0x10
test eax, eax
jne 0x100f9fa
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x100f9b9
mov dword [eax], edi
mov dword [ebp - 4], 1
jmp 0x100f9f4
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x100f9f4
push edi
call dword [sym.imp.msvcrt.dll_free]
push dword [ebp + 0x18]
and dword [ebp - 4], 0
push dword [ebp + 0x14]
push ebx
push 0x1005384
push dword [esi]
call fcn.0100f1ff
add esp, 0x18
test eax, eax
jne 0x100fa02
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x100f9f4
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
and dword [ebp - 0xc], 0
jmp 0x100fa02
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop ebx
mov eax, dword [ebp + 0x1c]
pop edi
pop esi
test eax, eax
je 0x100fa11
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x100ffbb
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov ebx, eax
test ebx, ebx
je 0x1010024
cmp word [ebx], 0
push esi
mov esi, ebx
je 0x101001c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
test edi, edi
je 0x101001b
push 0x3d
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x101001b
sub eax, esi
sar eax, 1
je 0x1010011
mov ecx, edi
sub ecx, eax
dec ecx
push ecx
lea ecx, [esi + eax*2 + 2]
push ecx
push eax
push esi
push dword [ebp + 0xc]
call fcn.0100ee3f
add esp, 0x14
lea esi, [esi + edi*2 + 2]
cmp word [esi], 0
jne 0x100ffd7
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x101da82
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x13c
or dword [ebp - 0xc], 0xffffffff
push ebx
push esi
push edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x20], ebx
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x118
stosd dword es:[edi], eax
lea eax, [ebp - 0x138]
push ebx
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 0x13c], ebx
call sub.msvcrt.dll_memset
push 0x44
pop esi
push esi
call dword [sym.imp.msvcrt.dll_malloc]
mov edi, eax
add esp, 0x10
cmp edi, ebx
je 0x101dbe6
push esi
push ebx
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
push edi
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [edi + 0x2c], 1
je 0x101daff
movzx eax, word [edi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x10], eax
call fcn.0100b4d1
test eax, eax
je 0x101db2b
push 0x1005ee0
call dword [sym.imp.msvcrt.dll_printf]
jmp 0x101dbe5
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0100b99a
mov esi, dword [sym.imp.msvcrt.dll_printf]
add esp, 0xc
cmp dword [ebp - 0x20], ebx
je 0x101db73
lea eax, [ebp - 0x13c]
push eax
mov dword [ebp - 0x13c], 0x11c
call dword [0x1021e38]
cmp dword [ebp - 0x138], 0xa
je 0x101db73
push 0x1005eb0
call esi
pop ecx
mov dword [ebp - 0x20], ebx
push dword [ebp - 0x20]
push ebx
push dword [ebp - 4]
call fcn.0100e4b1
add esp, 0xc
cmp eax, ebx
jne 0x101db9b
cmp dword [ebp - 0x20], ebx
je 0x101db94
push 0x1005e88
call esi
jmp 0x101dbe5
push 0x1005e6c
jmp 0x101db90
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x20]
push ecx
push eax
push dword [ebp - 4]
call fcn.0101002e
add esp, 0x10
test eax, eax
je 0x101dbba
push 0x1005e50
jmp 0x101db90
push dword [ebp - 8]
call fcn.0101cb9b
pop ecx
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x101dbd6
push 0x1005e38
call esi
mov eax, dword [ebp - 4]
jmp 0x101dbe2
push dword [ebp - 0x10]
push dword [ebp - 8]
call fcn.0101ca8f
pop ecx
mov dword [ebp - 0xc], eax
pop ecx
push dword [ebp - 8]
call fcn.0100b8ef
pop ecx
cmp edi, ebx
je 0x101dbfb
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x101ece0
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x101fa70
call fcn.0101f3f4
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x10221d0
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x101eaf5
cmp eax, esi
jne 0x101eae8
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x101eaf8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x101eacf
xor esi, esi
inc esi
mov eax, dword [0x10221cc]
cmp eax, esi
jne 0x101eb0b
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x101eb46
mov eax, dword [0x10221cc]
test eax, eax
jne 0x101eb40
mov dword [0x10221cc], esi
push 0x1001208
push 0x10011fc
call fcn.0101ea4c
pop ecx
pop ecx
test eax, eax
je 0x101eb46
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x101ec10
mov dword [0x1021e94], esi
mov eax, dword [0x10221cc]
cmp eax, esi
jne 0x101eb6a
push 0x10011f8
push 0x10011f0
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10221cc], 2
cmp dword [ebp - 0x1c], ebx
jne 0x101eb77
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10221d8], ebx
je 0x101eb98
push 0x10221d8
call fcn.0101f369
pop ecx
test eax, eax
je 0x101eb98
push ebx
push 2
push ebx
call dword [0x10221d8]
push dword [0x1021e7c]
push dword [0x1021e80]
push dword [0x1021e78]
call fcn.0101da82
add esp, 0xc
mov dword [0x1021e90], eax
cmp dword [0x1021e84], ebx
jne 0x101ebf6
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1021e94], ebx
jne 0x101ec04
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1021e90]
call fcn.0101f439
ret
call fcn.0101f541
jmp 0x101eaad
Function at 0x401e24
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 0x10]
push ebx
push esi
mov esi, eax
sub ecx, dword [esi + 0x18]
mov eax, dword [ebp + 0xc]
sub eax, dword [esi + 0x14]
mov edx, dword [esi]
push edi
push 1
push ecx
xor ebx, ebx
mov dword [ebp + 0x10], ecx
push eax
mov ecx, esi
mov dword [ebp + 0xc], eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call dword [edx + 0x6c]
mov edi, dword [esi + 0xe8]
cmp edi, ebx
mov dword [ebp - 0x10], eax
je 0x401f68
push edi
call fcn.004231a4
mov ebx, eax
test ebx, ebx
pop ecx
je 0x401f38
mov eax, dword [ebx + 0x10]
push 2
mov dword [ebp - 0xc], eax
mov eax, dword [ebx]
push 0
mov ecx, ebx
call dword [eax + 0x28]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x34]
test eax, eax
je 0x401e9e
lea eax, [ebx + 0x14]
push eax
call fcn.0041b15c
movzx eax, word [ebp + 0x10]
movzx ecx, word [ebp + 0xc]
shl eax, 0x10
or eax, ecx
push eax
push dword [ebp + 8]
mov ecx, ebx
push 0x202
call fcn.004233e7
mov eax, dword [ebp - 0x10]
cmp dword [esi + 0xe8], eax
jne 0x401ef5
mov eax, dword [ebx + 0x40]
xor ecx, ecx
cmp eax, ecx
je 0x401ee7
cmp word [eax], cx
je 0x401ee7
push 1
push ecx
push ecx
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x401f38
cmp dword [ebx + 0x10], ecx
je 0x401f38
mov dword [ebp - 4], 1
jmp 0x401f38
mov eax, dword [ebx]
push 1
push 0
mov ecx, ebx
call dword [eax + 0x28]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x34]
test eax, eax
je 0x401f14
lea eax, [ebx + 0x14]
push eax
call fcn.0041b15c
movzx eax, word [ebp + 0x10]
movzx ecx, word [ebp + 0xc]
shl eax, 0x10
or eax, ecx
push eax
push dword [ebp + 8]
mov ecx, ebx
push 0x2a3
call fcn.004233e7
mov dword [ebp - 8], 1
xor ecx, ecx
cmp dword [ebp - 4], ecx
mov dword [esi + 0xe8], ecx
je 0x401f49
push 0x67
jmp 0x401f61
cmp dword [ebp - 8], ecx
je 0x401f68
cmp dword [ebp - 0xc], ecx
je 0x401f68
lea eax, [esi + 0xe4]
cmp edi, dword [eax]
jne 0x401f5f
mov dword [eax], ecx
push 0x6a
mov edi, ebx
call fcn.00401a73
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x403556
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push dword [ebp + 8]
lea eax, [ebp + 8]
call fcn.0042241f
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
movzx eax, word [ebp - 2]
push eax
movzx eax, word [ebp - 4]
push eax
movzx eax, word [ebp - 6]
push eax
movzx eax, word [ebp - 8]
push eax
push str.__02d__02d__02d__03d__n
lea ecx, [ebp + 8]
call fcn.004099f7
mov esi, dword [ebp + 8]
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringW]
lea eax, [esi - 0x10]
call fcn.00401023
pop esi
leave
ret 4
Function at 0x40491d
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x11c
push esi
push edi
mov esi, 0x11c
push esi
xor edi, edi
lea eax, [ebp - 0xa4]
push edi
push eax
call fcn.00489500
add esp, 0xc
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetVersionExW]
push eax
call esi
cmp eax, edi
jne 0x404976
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], 0x114
call esi
cmp eax, edi
je 0x404a24
mov eax, dword [ebp - 0x94]
dec eax
je 0x404a10
dec eax
jne 0x404a24
cmp dword [ebp - 0xa0], 6
jne 0x4049c1
inc eax
cmp dword [ebp - 0x9c], eax
jne 0x4049a9
xor ecx, ecx
cmp byte [ebp + 0x76], al
setne cl
add ecx, 8
jmp 0x4049bd
cmp dword [ebp - 0x9c], edi
jne 0x4049fd
xor ecx, ecx
cmp byte [ebp + 0x76], al
setne cl
lea ecx, [ecx + ecx + 7]
mov edi, ecx
jmp 0x404a24
cmp dword [ebp - 0xa0], 5
jne 0x4049f0
cmp dword [ebp - 0x9c], 2
jne 0x4049d7
push 5
jmp 0x404a0d
cmp dword [ebp - 0x9c], 1
jne 0x4049e4
push 6
jmp 0x404a0d
cmp dword [ebp - 0x9c], edi
jne 0x404a24
push 3
jmp 0x404a0d
cmp dword [ebp - 0xa0], 4
ja 0x404a24
push 4
jmp 0x404a0d
cmp dword [ebp - 0x9c], 2
jne 0x404a24
cmp byte [ebp + 0x76], al
jne 0x404a24
push 0xa
pop edi
jmp 0x404a24
mov eax, dword [ebp - 0x98]
and eax, 0xffff0000
cmp eax, 0x45a0000
sbb edi, edi
inc edi
inc edi
mov eax, edi
pop edi
pop esi
add ebp, 0x78
leave
ret

Function at 0x404eef
Capabilities:
Query or enumerate registry value

Disassembly:
cmp dword [esp + 8], 0
jne 0x404efa
xor eax, eax
jmp 0x404f1f
lea ecx, [eax + 0x1004]
push ecx
push eax
add eax, 0x1000
push eax
mov eax, dword [esp + 0x10]
push 0
push dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
neg eax
sbb eax, eax
inc eax
ret 8

Function at 0x4051ca
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
mov dword [ebp - 8], ebx
jne 0x4051f1
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 8], 1
call fcn.00405077
mov eax, dword [eax]
pop ecx
push eax
lea eax, [ebp - 4]
call fcn.0042241f
test byte [ebp - 8], 1
je 0x40520b
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.00401023
mov esi, dword [ebp - 4]
cmp dword [esi - 0xc], ebx
jne 0x40521a
push 0x4e97a8
jmp 0x405279
push str.oem.ini
lea eax, [ebp - 4]
push eax
call fcn.00401000
push 0x206
lea eax, [ebp - 0x216]
push ebx
push eax
mov word [ebp - 0x218], bx
call fcn.00489500
mov esi, dword [ebp - 4]
add esp, 0xc
push esi
push 0x208
lea eax, [ebp - 0x218]
push eax
push ebx
push 0x4e97c0
push 0x4e97cc
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
test eax, eax
jne 0x405272
push edi
call fcn.00405144
pop ecx
jmp 0x405280
lea eax, [ebp - 0x218]
push eax
mov eax, edi
call fcn.0042241f
lea eax, [esi - 0x10]
call fcn.00401023
pop esi
mov eax, edi
pop ebx
leave
ret
Function at 0x405362
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp eax, edi
mov dword [ebp - 0xc], edi
jne 0x40538c
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0xc], 1
call fcn.00405077
mov eax, dword [eax]
pop ecx
push eax
lea eax, [ebp - 8]
call fcn.0042241f
test byte [ebp - 0xc], 1
je 0x4053a6
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401023
mov esi, dword [ebp - 8]
cmp dword [esi - 0xc], edi
jne 0x4053b5
push str.v1.0
jmp 0x40542c
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 8]
call fcn.0040528e
mov eax, dword [eax]
pop ecx
push dword [eax - 0xc]
push eax
lea eax, [ebp - 8]
call fcn.0040103b
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00401023
push 0x206
lea eax, [ebp - 0x21a]
push edi
push eax
mov word [ebp - 0x21c], di
call fcn.00489500
mov esi, dword [ebp - 8]
add esp, 0xc
push esi
push 0x208
lea eax, [ebp - 0x21c]
push eax
push edi
push str.Version
push 0x4e9838
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
test eax, eax
jne 0x405425
push ebx
call fcn.004052d9
pop ecx
jmp 0x405433
lea eax, [ebp - 0x21c]
push eax
mov eax, ebx
call fcn.0042241f
lea eax, [esi - 0x10]
call fcn.00401023
pop edi
mov eax, ebx
pop esi
leave
ret

Function at 0x40579f
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
push str.ProgramPath
lea eax, [ebp - 0xc]
call fcn.0042241f
push str.SOFTWAREcmcmkdesk
lea eax, [ebp - 8]
call fcn.0042241f
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
lea ebx, [ebp - 4]
call fcn.004055f4
mov eax, dword [ebp - 8]
pop ecx
add eax, 0xfffffff0
call fcn.00401023
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.00401023
mov eax, dword [ebp - 4]
xor edi, edi
cmp dword [eax - 0xc], edi
jne 0x4057ff
add eax, 0xfffffff0
call fcn.00401023
xor eax, eax
pop edi
pop ebx
leave
ret
lea eax, [ebp - 4]
push eax
call fcn.00475cfc
push dword [ebp + 0xc]
lea eax, [ebp - 4]
lea ecx, [ebp - 0xc]
call fcn.00413b36
mov ebx, dword [ebp - 0xc]
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40583e
lea eax, [ebx - 0x10]
call fcn.00401023
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00401023
mov eax, edi
jmp 0x4057fb
mov eax, dword [0x512bd4]
push esi
mov ecx, 0x512bd4
call dword [eax + 0xc]
push dword [ebp + 8]
add eax, 0x10
mov dword [ebp - 0xc], eax
push 0x4e96c0
lea eax, [ebp - 0xc]
call fcn.00421c33
mov esi, dword [ebp - 0xc]
pop ecx
pop ecx
push 1
push edi
push esi
push ebx
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
lea eax, [esi - 0x10]
mov edi, ecx
call fcn.00401023
pop esi
jmp 0x405827
Function at 0x406155
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
push eax
lea eax, [ebp - 4]
call fcn.0042241f
mov ebx, dword [ebp - 4]
push ebx
lea edi, [ebp - 0x1c]
call fcn.0043d9b3
push 0x4f0978
mov eax, edi
call fcn.0043dd8f
xor edi, edi
inc edi
test al, al
je 0x406192
mov dword [0x514840], edi
push str.fast_inst
lea eax, [ebp - 0x1c]
call fcn.0043dd8f
test al, al
je 0x4061a9
mov dword [0x514864], edi
mov esi, str.installpath
push esi
lea eax, [ebp - 0x1c]
call fcn.0043dd8f
test al, al
je 0x4061cf
push esi
lea eax, [ebp - 0x1c]
call fcn.0043ddca
push eax
push 0x514850
call fcn.00413ba8
push str.can_cover
lea eax, [ebp - 0x1c]
call fcn.0043dd8f
test al, al
je 0x4061e6
mov dword [0x51483c], edi
push str.yuanqi_inst
lea eax, [ebp - 0x1c]
call fcn.0043dd8f
test al, al
je 0x4061fd
mov dword [0x514860], edi
push 0x4f09e0
lea eax, [ebp - 0x1c]
call fcn.0043dd8f
test al, al
je 0x406215
and dword [0x514840], 0
push str.showlaucherrordlg
lea eax, [ebp - 0x1c]
call fcn.0043dd8f
test al, al
je 0x40622c
mov dword [0x514854], edi
push 0x4f0a10
lea eax, [ebp - 0x1c]
call fcn.0043ddca
test eax, eax
je 0x406252
push eax
call fcn.00489e9b
cmp dword [0x513f20], 0
pop ecx
jne 0x406252
mov dword [0x513f20], eax
push str.showfuncpop
lea eax, [ebp - 0x1c]
call fcn.0043dd8f
test al, al
mov esi, str.action
je 0x406295
push esi
lea eax, [ebp - 0x1c]
mov dword [0x514858], edi
call fcn.0043ddca
push eax
lea eax, [ebp - 4]
call fcn.0042241f
mov edi, 0x51485c
call fcn.004234ea
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00401023
lea edi, [ebp - 0x1c]
call fcn.00406717
mov eax, edi
push eax
call fcn.004067fb
push esi
mov eax, edi
call fcn.0043ddca
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
mov ecx, edi
mov dword [0x513f28], eax
call fcn.0043da08
lea eax, [ebx - 0x10]
call fcn.00401023
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4071fc
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x18
mov eax, dword [0x513b1c]
push ebp
push esi
push edi
xor edi, edi
cmp eax, edi
mov dword [esp + 0x1c], edi
je 0x407216
mov esi, dword [eax + 4]
jmp 0x407218
xor esi, esi
cmp esi, edi
jne 0x407228
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
cmp esi, edi
je 0x40724d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp esi, eax
je 0x40724d
push esi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x40724d
push edi
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x1c], 1
push esi
mov eax, ebx
mov dword [ebx + 0x330], edi
call fcn.00407e37
cmp eax, edi
mov dword [esp + 0x14], eax
jne 0x407273
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
jmp 0x40737c
mov edx, eax
call fcn.0040d96c
mov dword [esp + 0x20], eax
lea ebp, [ebx + 4]
push ebp
mov eax, esi
call fcn.0040d81f
cmp dword [ebx + 0x320], edi
je 0x407326
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push edi
push edi
push edi
push 0x2001
mov dword [esp + 0x20], eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x43
push edi
push edi
push edi
push edi
push edi
push dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x10]
je 0x4072e7
push 1
push eax
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x10]
je 0x407307
push edi
push eax
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 0xffffffffffffffec
push dword [ebp]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x80000
je 0x407326
push edi
push edi
push 0xf
push dword [ebp]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, ebx
call fcn.0044c87a
push 0x97
push edi
push ebp
mov dword [ebx + 0x330], edi
call fcn.0040d802
cmp dword [esp + 0x1c], edi
je 0x407364
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
cmp esi, edi
je 0x407364
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [ebp]
jne 0x407364
push esi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov edx, dword [esp + 0x20]
call fcn.0040d96c
push dword [ebp]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebx + 0x334]
pop edi
pop esi
pop ebp
add esp, 0x18
ret