joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405f90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5515a6
mov eax, dword fs:[0]
push eax
sub esp, 0x644
mov eax, dword [0x5b70dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x1e8
lea eax, [ebp - 0x1f8]
push 0
push eax
call fcn.0041de80
movups xmm0, xmmword [0x554e68]
lea ecx, [ebp - 0x218]
add esp, 0xc
add ecx, 0xfffffffe
movups xmmword [ebp - 0x218], xmm0
movups xmm0, xmmword [0x554e78]
movups xmmword [ebp - 0x208], xmm0
nop word [eax + eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x406000
mov eax, dword [0x554f34]
mov dword [ecx], eax
mov eax, dword [0x554f38]
mov dword [ecx + 4], eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x650]
call fcn.0040c6b6
lea ecx, [ebp - 0x650]
mov dword [ebp - 4], 0
call fcn.0040c6fd
test eax, eax
jne 0x4061d2
push 0x208
push eax
lea eax, [ebp - 0x628]
push eax
call fcn.0041de80
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.0041de80
add esp, 0x18
lea eax, [ebp - 0x628]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x554f48
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x420]
push 0x554fa0
push eax
call fcn.00406f00
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x648]
add esp, 0x10
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x4061d2
lea eax, [ebp - 0x644]
push eax
push 0xf003f
push 0
push 0x555004
push dword [ebp - 0x648]
call esi
test eax, eax
je 0x406119
push 0
lea eax, [ebp - 0x644]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x55500c
push dword [ebp - 0x648]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4061cb
push 0xf
xor eax, eax
mov dword [ebp - 0x630], 0
push 0x554e68
lea ecx, [ebp - 0x640]
mov dword [ebp - 0x62c], 7
mov word [ebp - 0x640], ax
call fcn.004022b0
push 3
push 0x555010
lea ecx, [ebp - 0x640]
mov byte [ebp - 4], 1
call fcn.00402130
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406167
sub ecx, edx
sar ecx, 1
cmp dword [ebp - 0x62c], 8
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x420]
push eax
push 1
lea ecx, [ebp - 0x640]
cmovae ecx, dword [ebp - 0x640]
push 0
push ecx
push dword [ebp - 0x644]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x644]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x648]
call esi
lea ecx, [ebp - 0x640]
call fcn.00401380
mov esi, 1
jmp 0x4061d4
xor esi, esi
lea ecx, [ebp - 0x650]
call fcn.0040c6cb
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040721f
mov esp, ebp
pop ebp
ret
Function at 0x4094ca
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x4ac
mov eax, 0x5518ac
call fcn.00440364
mov esi, dword [ebp + 0x38]
xor eax, eax
lea ecx, [ebp - 0x260]
inc eax
push 0x5544dc
mov dword [ebp - 4], eax
call fcn.0040825e
push 0x208
xor ebx, ebx
mov byte [ebp - 4], 2
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.0041de80
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0042e09b
lea eax, [ebp - 0x218]
push 0x5558c4
push eax
call fcn.0042e09b
add esp, 0x1c
lea eax, [ebp - 0x4b0]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40972f
test byte [ebp - 0x4b0], 0x10
lea eax, [ebp - 0x484]
lea ecx, [ebp - 0x230]
push eax
je 0x40965c
call fcn.00401d30
push 0x5558cc
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 3
call fcn.004098b2
test al, al
jne 0x409703
push 0x5558d0
lea ecx, [ebp - 0x230]
call fcn.004098b2
test al, al
jne 0x409703
lea eax, [ebp + 8]
mov dword [ebp - 0x238], ebx
push eax
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x234], ebx
call fcn.004097db
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push dword [ebp - 0x220]
cmovae eax, dword [ebp - 0x230]
lea ecx, [ebp - 0x248]
push eax
mov byte [ebp - 4], 4
call fcn.00402130
push 0x55450c
call fcn.0042deed
pop ecx
push eax
push 0x55450c
lea ecx, [ebp - 0x248]
call fcn.00402130
cmp dword [ebp + 0x3c], 0
jne 0x4096f8
push ebx
push ebx
push esi
sub esp, 0x18
lea eax, [ebp + 0x20]
mov ecx, esp
mov dword [ebp - 0x4b4], esp
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.004097db
sub esp, 0x18
mov byte [ebp - 4], 5
mov ecx, esp
lea eax, [ebp - 0x248]
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.004097db
mov byte [ebp - 4], 4
call fcn.004094ca
add esp, 0x3c
jmp 0x4096f8
call fcn.00401d30
cmp dword [ebp + 0x34], 8
lea eax, [ebp + 0x20]
push ebx
cmovae eax, dword [ebp + 0x20]
lea ecx, [ebp - 0x230]
push eax
mov byte [ebp - 4], 6
call fcn.00409d98
cmp eax, 0xffffffff
mov ecx, ebx
push 1
pop eax
cmovne ecx, eax
test ecx, ecx
je 0x409703
lea eax, [ebp + 8]
mov dword [ebp - 0x238], ebx
push eax
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x234], ebx
call fcn.004097db
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push dword [ebp - 0x220]
cmovae eax, dword [ebp - 0x230]
lea ecx, [ebp - 0x248]
push eax
mov byte [ebp - 4], 8
call fcn.00402130
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
je 0x4096e9
lea eax, [ebp - 0x248]
mov ecx, esi
push eax
call fcn.00408992
jmp 0x4096f8
lea ecx, [ebp - 0x248]
push ecx
push eax
mov ecx, esi
call fcn.004089b4
lea ecx, [ebp - 0x248]
call fcn.004020c0
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.004020c0
lea eax, [ebp - 0x4b0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x409555
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x260]
call fcn.00401de0
lea ecx, [ebp + 8]
call fcn.004020c0
lea ecx, [ebp + 0x20]
call fcn.004020c0
call fcn.0044031f
ret
Function at 0x40bb5f
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2034
call fcn.00407260
mov eax, dword [0x5b70dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x208
lea eax, [ebp - 0x61c]
push edi
xor esi, esi
push esi
push eax
call fcn.0041de80
push str.C:log_
mov ebx, 0x104
lea eax, [ebp - 0x61c]
push ebx
push eax
call fcn.0042f02f
push 0x800
lea eax, [ebp - 0x1024]
push esi
push eax
call fcn.0041de80
push 0x554e68
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push str._s_s.log
push eax
call fcn.00408d24
push edi
lea eax, [ebp - 0x824]
push esi
push eax
call fcn.0041de80
add esp, 0x40
lea eax, [ebp - 0x20c]
push edi
push esi
push eax
call fcn.0041de80
add esp, 0xc
lea eax, [ebp - 0x20c]
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call fcn.0042deed
pop ecx
test eax, eax
je 0x40bdbe
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.0041e270
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x414]
push eax
call ebx
test eax, eax
je 0x40bdbe
lea eax, [ebp - 0x20c]
push eax
call fcn.0042deed
lea ecx, [ebp - 0x20a]
lea eax, [ecx + eax*2]
push eax
lea eax, [ebp - 0x824]
push 0x104
push eax
call fcn.0042f02f
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push str._s_s.txt
push eax
call fcn.00408d24
lea eax, [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x1024]
push 0x3ff
push 0x400
push eax
call fcn.00401cf0
push esi
call fcn.0042220f
mov dword [ebp - 0x2034], eax
lea eax, [ebp - 0x2034]
push eax
mov dword [ebp - 0x2030], edx
call fcn.0042f31d
add esp, 0x40
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test edi, edi
je 0x40bdbe
lea ecx, [ebp - 0x1024]
push ecx
push eax
push dword [edi]
mov eax, dword [edi + 0x10]
push dword [edi + 4]
inc eax
push dword [edi + 8]
push dword [edi + 0xc]
push eax
mov eax, dword [edi + 0x14]
add eax, 0x76c
push eax
lea eax, [ebp - 0x2024]
push str.__d__d__d__d__d__d___d_:_s
push eax
call fcn.0040ba7b
xor eax, eax
add esp, 0x28
mov word [ebp - 0x826], ax
lea eax, [ebp - 0x414]
push eax
call ebx
xor ebx, ebx
inc ebx
test eax, eax
lea eax, [ebp - 0x414]
push 0x556c3c
push eax
cmovne esi, ebx
call fcn.0042cd02
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x40bdbe
test esi, esi
jne 0x40bd64
push edi
push 2
lea eax, [ebp - 0x202c]
mov dword [ebp - 0x202c], 0xfeff
push ebx
push eax
call fcn.0042e906
add esp, 0x10
lea eax, [ebp - 0x2024]
push eax
call fcn.0042deed
push edi
add eax, eax
push eax
lea eax, [ebp - 0x2024]
push ebx
push eax
call fcn.0042e906
push edi
push 2
lea eax, [ebp - 0x2028]
mov dword [ebp - 0x2028], 0xd
push ebx
push eax
call fcn.0042e906
push edi
push 2
lea eax, [ebp - 0x2028]
mov dword [ebp - 0x2028], 0xa
push ebx
push eax
call fcn.0042e906
push edi
call fcn.0042cb00
add esp, 0x38
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040721f
leave
ret
Function at 0x40bdcd
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00407260
mov eax, dword [0x5b70dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
call fcn.0042220f
mov dword [ebp - 0x1014], eax
lea eax, [ebp - 0x1014]
push eax
mov dword [ebp - 0x1010], edx
call fcn.0042f31d
pop ecx
pop ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi + 0x10]
push edi
push eax
push dword [esi]
mov eax, dword [esi + 0x14]
inc ecx
push dword [esi + 4]
add eax, 0x76c
push dword [esi + 8]
push dword [esi + 0xc]
push ecx
push eax
lea eax, [ebp - 0x1004]
push str.__d__d__d__d__d__d___d_:_s
push eax
call fcn.0040ba7b
add esp, 0x28
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push 0
xor ecx, ecx
pop edi
inc ecx
test eax, eax
push 0x556c3c
push ebx
cmovne edi, ecx
call fcn.0042cd02
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x40bee9
test edi, edi
jne 0x40be8c
push esi
push 2
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0xfeff
push 1
push eax
call fcn.0042e906
add esp, 0x10
lea eax, [ebp - 0x1004]
push eax
call fcn.0042deed
push esi
add eax, eax
push eax
lea eax, [ebp - 0x1004]
push 1
push eax
call fcn.0042e906
push esi
push 2
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0xd
push 1
push eax
call fcn.0042e906
push esi
push 2
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0xa
push 1
push eax
call fcn.0042e906
push esi
call fcn.0042cb00
add esp, 0x38
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040721f
leave
ret

Function at 0x40c0e2
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.0042deed
mov dword [ebp - 4], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00407211
push dword [ebp + 8]
mov esi, eax
push esi
call fcn.0042e10c
mov eax, dword [ebp - 4]
xor edi, edi
add esp, 0x10
xor ebx, ebx
inc edi
test eax, eax
js 0x40c15c
push 0x5c
pop ecx
cmp word [esi + ebx*2], cx
jne 0x40c153
xor eax, eax
push esi
mov word [esi + ebx*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40c149
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40c15a
mov eax, dword [ebp - 4]
push 0x5c
pop ecx
mov word [esi + ebx*2], cx
inc ebx
cmp ebx, eax
jle 0x40c126
jmp 0x40c15c
xor edi, edi
push esi
call fcn.0040721a
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c16a
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5b70dc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x1a
push eax
push 0
call fcn.0040c645
lea eax, [ebp - 0x20c]
push eax
call fcn.0042deed
add esp, 0x14
test eax, eax
je 0x40c215
push ebx
mov ebx, 0x55450c
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0042e09b
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0042e09b
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0042e09b
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ebx
test eax, eax
jne 0x40c1f9
lea eax, [ebp - 0x20c]
push eax
call fcn.0040c0e2
pop ecx
lea eax, [ebp - 0x20c]
push eax
call fcn.0042deed
pop ecx
push eax
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.004022b0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040721f
leave
ret

Function at 0x40c346
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5b70dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov bl, byte [0x5c2724]
test bl, bl
jne 0x40c3dd
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0041de80
add esp, 0xc
lea eax, [ebp - 0x20c]
xor ebx, ebx
inc ebx
push ebx
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40c3d7
lea eax, [ebp - 0x20c]
push eax
call fcn.0042e2d7
lea eax, [ebp - 0x20c]
mov dword [esp], str.config_systemprofile
push eax
call fcn.0041f756
pop ecx
pop ecx
test eax, eax
jne 0x40c3cf
lea eax, [ebp - 0x20c]
push str.documents_and_settingslocalservice
push eax
call fcn.0041f756
pop ecx
pop ecx
test eax, eax
je 0x40c3d7
mov byte [0x5c2724], bl
jmp 0x40c3dd
mov bl, byte [0x5c2724]
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0040721f
leave
ret
Function at 0x40c3ec
Capabilities:
Check if file exists

Disassembly:
push 0xc50
mov eax, 0x551bbe
call fcn.00440364
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xc40]
mov ebx, dword [ebp + 0xc]
mov esi, 0x208
push esi
push 0
push eax
mov dword [ebp - 0xc5c], edi
call fcn.0041de80
push esi
lea eax, [ebp - 0x830]
push 0
push eax
call fcn.0041de80
push esi
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.0041de80
push esi
lea eax, [ebp - 0xa38]
push 0
push eax
call fcn.0041de80
push esi
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0041de80
push esi
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.0041de80
xor ecx, ecx
mov dword [ebp - 0xc44], 7
xor eax, eax
mov dword [ebp - 0xc48], ecx
add esp, 0x48
mov word [ebp - 0xc58], ax
push ecx
push 0x1a
lea eax, [ebp - 0xc40]
mov dword [ebp - 4], ecx
push eax
push ecx
call fcn.0040c645
lea eax, [ebp - 0xc40]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0042e10c
lea eax, [ebp - 0x218]
push eax
call fcn.0042deed
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.0041e270
add esp, 0x24
test eax, eax
je 0x40c601
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.0042e10c
lea eax, [ebp - 0x830]
push str.Local
push eax
call fcn.0042e09b
add esp, 0x10
lea eax, [ebp - 0x830]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
xor esi, esi
inc ecx
test eax, eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x628]
cmovne esi, ecx
push eax
call fcn.0042e10c
lea eax, [ebp - 0x628]
push str.LocalLow
push eax
call fcn.0042e09b
add esp, 0x10
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
test eax, eax
push 1
pop eax
cmovne ecx, eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xa38]
mov dword [ebp - 0xc5c], ecx
push eax
call fcn.0042e10c
lea eax, [ebp - 0xa38]
push str.Roaming
push eax
call fcn.0042e09b
add esp, 0x10
lea eax, [ebp - 0xa38]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
test eax, eax
push 1
pop eax
cmovne ecx, eax
test esi, esi
je 0x40c601
cmp dword [ebp - 0xc5c], 0
je 0x40c601
test ecx, ecx
je 0x40c601
push ebx
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x420]
push str._s_s_
push eax
call fcn.00406f00
add esp, 0x10
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40c5df
lea eax, [ebp - 0x420]
push eax
call fcn.0040c0e2
pop ecx
lea eax, [ebp - 0x420]
push eax
call fcn.0042deed
pop ecx
push eax
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0xc58]
call fcn.004022b0
jmp 0x40c610
lea eax, [ebp - 0xc58]
push ebx
push eax
call fcn.0040c16a
pop ecx
pop ecx
xor eax, eax
mov ecx, edi
mov byte [ebp - 0xc5c], al
push dword [ebp - 0xc5c]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
lea eax, [ebp - 0xc58]
push eax
call fcn.00409750
lea ecx, [ebp - 0xc58]
call fcn.004020c0
mov eax, edi
call fcn.0044031f
ret
Function at 0x40c6d0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0xb7
neg eax
sbb eax, eax
inc eax
mov dword [esi + 4], eax
pop esi
pop ebp
ret 4

Function at 0x40cac2
Capabilities:
Read .ini file

Disassembly:
push 0x838
mov eax, 0x551c97
call fcn.00440364
mov edi, ecx
mov ecx, dword [ebp + 0xc]
lea eax, [edi + 0x8c]
cmp dword [eax + 0x14], 8
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x844], ecx
jb 0x40caed
mov eax, dword [eax]
push eax
push dword [ebp + 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
cmp esi, dword [ebp + 0x10]
jne 0x40cbaa
push 0x554480
lea ecx, [ebp - 0x828]
call fcn.00401d30
and dword [ebp - 4], 0
lea eax, [ebp - 0x810]
push 0x800
push 0
push eax
call fcn.0041de80
push dword [ebp + 0x10]
lea eax, [ebp - 0x810]
push 0x555740
push eax
call fcn.00406f00
add esp, 0x18
lea eax, [ebp - 0x810]
cmp byte [edi + 5], 0
mov ecx, edi
push eax
push dword [ebp - 0x844]
lea eax, [ebp - 0x840]
push ebx
push eax
je 0x40cb66
call fcn.0040c9f3
jmp 0x40cb6b
call fcn.0040ca9f
push eax
lea ecx, [ebp - 0x828]
call fcn.00401910
lea ecx, [ebp - 0x840]
call fcn.004020c0
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.0042213c
pop ecx
lea ecx, [ebp - 0x828]
mov esi, eax
call fcn.004020c0
mov eax, esi
call fcn.0044031f
ret 0xc

Function at 0x40cbb4
Capabilities:
Read .ini file

Disassembly:
push 0x82c
mov eax, 0x551ce1
call fcn.00440364
mov edi, ecx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x10]
push 0x800
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x810]
push ecx
mov dword [ebp - 0x838], esi
push eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x834], ecx
call fcn.0041de80
lea eax, [edi + 0x8c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x40cc11
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.00401d30
and dword [ebp - 4], 0
mov eax, esi
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x834], 1
jb 0x40cc57
mov eax, dword [esi]
push ebx
push eax
call fcn.0042e0cc
pop ecx
pop ecx
test eax, eax
jne 0x40cc9f
cmp byte [edi + 5], 0
lea eax, [ebp - 0x828]
push ebx
push dword [ebp - 0x82c]
mov ecx, edi
push dword [ebp - 0x830]
push eax
je 0x40cc87
call fcn.0040c9f3
jmp 0x40cc8c
call fcn.0040ca9f
push eax
mov ecx, esi
call fcn.00401910
lea ecx, [ebp - 0x828]
call fcn.004020c0
mov eax, esi
call fcn.0044031f
ret 0x10
Function at 0x40d6f2
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa44
mov eax, dword [0x5b70dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, 0x208
lea eax, [ebp - 0x20c]
push ebx
push 0
push eax
mov esi, ecx
call fcn.0041de80
lea eax, [esi + 0x2c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x40d72b
mov eax, dword [eax]
push str.Config
push eax
lea eax, [ebp - 0x20c]
push 0x5558d8
push eax
call fcn.00406f00
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40d763
lea eax, [ebp - 0x20c]
push eax
call fcn.0040c0e2
pop ecx
push ebx
lea eax, [ebp - 0x61c]
push 0
push eax
call fcn.0041de80
push str.userconfig.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push 0x5558b8
push eax
call fcn.00406f00
lea eax, [ebp - 0x61c]
push eax
call fcn.0042deed
add esp, 0x20
lea ecx, [esi + 0x8c]
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.004022b0
push ebx
lea eax, [ebp - 0x824]
push 0
push eax
call fcn.0041de80
push str.Config.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push 0x5558b8
push eax
call fcn.00406f00
lea eax, [ebp - 0x824]
push eax
call fcn.0042deed
add esp, 0x20
lea ecx, [esi + 0xa4]
push eax
lea eax, [ebp - 0x824]
push eax
call fcn.004022b0
push ebx
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.0041de80
lea eax, [ebp - 0xa44]
push 0x5544e8
push eax
call fcn.0040c3ec
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x40d82a
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x414]
push 0x556b74
push eax
call fcn.00406f00
add esp, 0xc
lea ecx, [ebp - 0xa44]
call fcn.004020c0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40d868
lea eax, [ebp - 0x414]
push eax
call fcn.0040c0e2
pop ecx
push ebx
lea eax, [ebp - 0xa2c]
push 0
push eax
call fcn.0041de80
push str.Config.ini
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xa2c]
push 0x5558b8
push eax
call fcn.00406f00
lea eax, [ebp - 0xa2c]
push eax
call fcn.0042deed
add esp, 0x20
lea ecx, [esi + 0xbc]
push eax
lea eax, [ebp - 0xa2c]
push eax
call fcn.004022b0
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040721f
leave
ret
Function at 0x40d8c4
Capabilities:
Check if file exists

Disassembly:
push 0x90
mov eax, 0x551db9
call fcn.00440364
mov esi, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x40]
push eax
call fcn.00401d30
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [ebp - 0x30], edi
jne 0x40d905
mov ecx, esi
call fcn.0040c9c3
mov esi, eax
push esi
call fcn.0042deed
pop ecx
push eax
push esi
lea ecx, [ebp - 0x40]
call fcn.004022b0
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x40]
push eax
call esi
test eax, eax
je 0x40daac
push str.HaoKanWallPaper.exe
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.00408928
add esp, 0xc
cmp dword [ebp - 0x74], 8
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0x88]
push eax
call esi
test eax, eax
je 0x40d95d
xor edi, edi
inc edi
jmp 0x40daa1
lea eax, [ebp - 0x70]
push str.9755104754656314543663180836632607635531116508026850084024582929
push eax
call fcn.004088e8
pop ecx
pop ecx
mov dword [ebp - 0x94], edi
mov dword [ebp - 0x90], edi
mov dword [ebp - 0x8c], edi
push 0x5544e4
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.00401d30
cmp dword [ebp - 0x5c], 8
lea eax, [ebp - 0x70]
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 4
cmovae eax, dword [ebp - 0x70]
push eax
call fcn.00401d30
lea eax, [ebp - 0x94]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0040b1db
add esp, 0xc
lea ecx, [ebp - 0x58]
call fcn.004020c0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.004020c0
mov esi, dword [ebp - 0x94]
jmp 0x40da70
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x40d9ec
mov eax, dword [esi]
push eax
lea ecx, [ebp - 0x58]
call fcn.00401d30
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
push 1
push edi
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 7
push eax
sub esp, 0x18
lea eax, [ebp - 0x58]
mov ecx, esp
mov dword [ebp - 0x98], esp
push eax
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
call fcn.004097db
sub esp, 0x18
mov byte [ebp - 4], 8
mov ecx, esp
lea eax, [ebp - 0x40]
push eax
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
call fcn.004097db
mov byte [ebp - 4], 7
call fcn.004094ca
mov eax, dword [ebp - 0x18]
add esp, 0x3c
sub eax, dword [ebp - 0x1c]
cdq
push 0x18
pop ecx
idiv ecx
lea ecx, [ebp - 0x1c]
test eax, eax
jne 0x40da7e
call fcn.00409b47
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
call fcn.004020c0
push 0x18
pop eax
add esi, eax
cmp esi, dword [ebp - 0x90]
jne 0x40d9e2
jmp 0x40da8e
call fcn.00409b47
lea ecx, [ebp - 0x58]
call fcn.004020c0
xor edi, edi
inc edi
lea ecx, [ebp - 0x94]
call fcn.00409b47
lea ecx, [ebp - 0x70]
call fcn.004020c0
lea ecx, [ebp - 0x88]
call fcn.004020c0
lea ecx, [ebp - 0x40]
call fcn.004020c0
mov eax, edi
call fcn.0044031f
ret 4