joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408f56
Capabilities:
Create thread
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
cmp dword [ebp + 8], 0
push ebx
push esi
je 0x4090fb
mov ebx, dword [sym.imp.zbgui.dll_GetPluginByName]
push dword [0x43c104]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x408fae
push str.hwnd_play
push dword [0x43c108]
call ebx
mov esi, eax
push esi
call dword [sym.imp.zbgui.dll_Plugin_IsValid]
test eax, eax
je 0x408fa3
mov ecx, esi
call fcn.00404f4f
jmp 0x408fa5
xor al, al
test al, al
jne 0x408f70
jmp 0x4090fb
push str.loading_play
push dword [0x43c108]
call ebx
push str.page_play_content
push dword [0x43c108]
mov esi, eax
call ebx
push esi
mov ebx, eax
call dword [sym.imp.zbgui.dll_Plugin_IsValid]
test eax, eax
je 0x40900d
mov ecx, dword [esi]
push 1
push esi
call dword [ecx + 0xb0]
mov eax, dword [ebx]
push 0
push ebx
call dword [eax + 0xb0]
push 5
push dword [0x43c104]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi]
push 1
push esi
call dword [eax + 0x84]
push eax
call dword [sym.imp.zbgui.dll_Plugin_Redraw]
mov ecx, dword [0x43c10c]
test ecx, ecx
je 0x4090fb
mov eax, dword [ecx]
push dword [0x43c104]
call dword [eax + 0x70]
mov ecx, eax
xor ebx, ebx
test ecx, ecx
je 0x409055
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x409031
sub ecx, edx
sar ecx, 1
je 0x409055
mov ecx, dword [0x43c10c]
push 5
push dword [0x43c104]
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov ecx, dword [0x43c10c]
push 0xffffffffffffffff
push dword [0x43c104]
mov eax, dword [ecx]
call dword [eax + 0x78]
push 0x1050
call fcn.004182d8
mov esi, eax
pop ecx
test esi, esi
je 0x4090b2
push dword [ebp + 8]
mov ecx, dword [0x43c104]
lea eax, [esi + 4]
mov dword [esi], ecx
mov ecx, dword [ebp + 0xc]
push 0x824
push eax
mov dword [esi + 0x104c], ecx
call fcn.0041814e
add esp, 0xc
push ebx
push ebx
push esi
push 0x401412
push ebx
push ebx
call fcn.00418820
add esp, 0x18
jmp 0x4090fb
mov ecx, dword [0x43c10c]
push 0x4045a4
push dword [0x43c104]
mov eax, dword [ecx]
call dword [eax + 0x98]
mov ecx, dword [0x43c10c]
push 0x4e20
push dword [0x43c104]
mov eax, dword [ecx]
call dword [eax + 0x94]
mov ecx, dword [0x43c10c]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [ecx]
push dword [0x43c104]
call dword [eax + 0x34]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4092ff
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 8]
xor esi, esi
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0xf023f
push esi
push esi
push esi
push dword [ebp + 0xc]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x409349
push dword [ebp + 0x1c]
push dword [ebp + 0x14]
push dword [ebp + 0x18]
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x409352
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
mov eax, dword [ebp + 0x1c]
or eax, 0x20019
push eax
push ebx
push str.SOFTWARE114zhibo
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4093a7
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x14]
lea eax, [ebp + 0x1c]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
cmove ebx, edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x18

Function at 0x4093b0
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 8]
xor ebx, ebx
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0xf023f
push ebx
push ebx
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4093fd
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
cmove ebx, edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x409d66
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, ecx
push esi
mov esi, eax
mov dword [ebp - 4], eax
push edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x409d77
sub esi, ecx
inc esi
push esi
call fcn.004182d8
push esi
xor ebx, ebx
mov edi, eax
push ebx
push edi
call fcn.0041ba00
push dword [ebp - 4]
push esi
push edi
call fcn.004198a4
add esp, 0x1c
cmp byte [edi], bl
je 0x409dae
xor byte [edi], 0x21
inc edi
inc ebx
cmp byte [edi], 0
jne 0x409da4
sub edi, ebx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40a301
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x439030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
xor eax, eax
push esi
mov word [ebp - 0xc], ax
mov ebx, esi
mov dword [ebp - 0xa], esi
mov word [ebp - 6], si
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x104
lea ecx, [ebp - 0x254]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40a42e
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0x258], eax
test eax, eax
jle 0x40a42e
push edi
push eax
call fcn.00417e2e
pop ecx
mov edi, eax
lea eax, [ebp - 0x254]
push edi
push dword [ebp - 0x258]
push dword [ebp - 0x260]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x40a3d8
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x25c]
push eax
push 0x4318c0
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x40a3d8
mov ecx, dword [ebp - 0x25c]
inc ebx
mov ax, word [ecx + 0xa]
mov word [ebp - 0xc], ax
mov ax, word [ecx + 8]
mov word [ebp - 0xa], ax
mov ax, word [ecx + 0xe]
mov word [ebp - 8], ax
mov ax, word [ecx + 0xc]
mov word [ebp - 6], ax
push edi
call fcn.004183e2
pop ecx
test ebx, ebx
je 0x40a42d
mov edi, 0x104
push 0xa
push 0x20
lea eax, [ebp - 0x4c]
push eax
movzx eax, word [ebp + esi*2 - 0xc]
push eax
call fcn.0041a51e
lea eax, [ebp - 0x4c]
push eax
push edi
push dword [0x441150]
call fcn.0041826c
add esp, 0x1c
cmp esi, 3
je 0x40a427
push 0x431cdc
push edi
push dword [0x441150]
call fcn.0041826c
add esp, 0xc
inc esi
cmp esi, 4
jb 0x40a3e8
pop edi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.0041813f
mov esp, ebp
pop ebp
ret
Function at 0x40a583
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x53c
mov eax, dword [0x439030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.0041ba00
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0x23
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, 0x4318c0
lea eax, [ebp - 0x20c]
push esi
mov edi, 0x104
push edi
push eax
call fcn.0041826c
push 0x4318c4
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0041826c
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0041826c
add esp, 0x24
lea eax, [ebp - 0x20c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.setconfig.ini
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0041826c
add esp, 0xc
lea eax, [ebp - 0x53c]
push eax
push dword [0x43c108]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [ebp - 0x53c]
xor edi, edi
mov eax, dword [ebp - 0x538]
mov ecx, dword [ebp - 0x534]
mov edx, dword [ebp - 0x530]
sub ecx, esi
sub edx, eax
test esi, esi
cmovs esi, edi
test eax, eax
mov dword [0x43aed8], esi
cmovs eax, edi
cmp ecx, 0x64
mov dword [0x43aedc], eax
mov edi, 0xc6
mov eax, 0x3d4
cmovl ecx, eax
mov eax, 0x28a
cmp edx, 0x64
mov dword [0x43aee0], ecx
push edi
cmovl edx, eax
xor eax, eax
mov word [ebp - 0x52c], ax
lea eax, [ebp - 0x52a]
push ebx
push eax
mov dword [0x43aee4], edx
call fcn.0041ba00
xor eax, eax
mov word [ebp - 0x2d4], ax
push edi
lea eax, [ebp - 0x2d2]
push ebx
push eax
call fcn.0041ba00
xor eax, eax
push edi
mov word [ebp - 0x39c], ax
lea eax, [ebp - 0x39a]
push ebx
push eax
call fcn.0041ba00
xor eax, eax
push edi
mov word [ebp - 0x464], ax
lea eax, [ebp - 0x462]
push ebx
push eax
call fcn.0041ba00
push esi
mov esi, 0x431ce0
lea eax, [ebp - 0x52c]
push esi
push eax
call fcn.00402d1a
push dword [0x43aedc]
lea eax, [ebp - 0x2d4]
push esi
push eax
call fcn.00402d1a
add esp, 0x48
lea eax, [ebp - 0x39c]
push dword [0x43aee0]
push esi
push eax
call fcn.00402d1a
push dword [0x43aee4]
lea eax, [ebp - 0x464]
push esi
push eax
call fcn.00402d1a
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0x20c]
add esp, 0x18
mov edi, str.config
push eax
lea eax, [ebp - 0x52c]
push eax
push str.StartX
push edi
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x2d4]
push eax
push str.StartY
push edi
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x39c]
push eax
push str.WindowWidth
push edi
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x464]
push eax
push str.WindowHeight
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041813f
mov esp, ebp
pop ebp
ret
Function at 0x40a7b8
Capabilities:
Check if file exists
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x439030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.0041ba00
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0x23
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, 0x4318c0
lea eax, [ebp - 0x20c]
push esi
mov edi, 0x104
push edi
push eax
call fcn.0041826c
push 0x4318c4
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0041826c
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0041826c
push str.setconfig.ini
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0041826c
add esp, 0x30
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40a964
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [ebp - 0x20c]
push eax
push ebx
push str.CloseProgramAndExit
mov edi, str.config
push edi
call esi
mov dword [0x43aebc], eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push str.TopMostWindow
push edi
call esi
mov dword [0x43aec0], eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push str.SaveWindowPlacement
push edi
call esi
mov dword [0x43aec4], eax
lea eax, [ebp - 0x20c]
push eax
push 1
push str.ShowMiniSite
push edi
call esi
mov dword [0x43aec8], eax
lea eax, [ebp - 0x20c]
push eax
push 1
push str.AutoRunPlayer
push edi
call esi
mov dword [0x43aecc], eax
call fcn.00401988
test al, al
lea eax, [ebp - 0x20c]
push eax
je 0x40a8ec
push 1
jmp 0x40a8ed
push ebx
push str.RunLockHomepage
push edi
call esi
mov dword [0x43aed0], eax
lea eax, [ebp - 0x20c]
push eax
push 1
push str.SilentUpdate
push edi
call esi
mov dword [0x43aed4], eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push str.StartX
push edi
call esi
mov dword [0x43aed8], eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push str.StartY
push edi
call esi
mov dword [0x43aedc], eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push str.WindowWidth
push edi
call esi
mov dword [0x43aee0], eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push str.WindowHeight
push edi
call esi
mov dword [0x43aee4], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041813f
mov esp, ebp
pop ebp
ret
Function at 0x40aa5f
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x439030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov dword [ebp - 0x210], ebx
call fcn.0041ba00
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, 0x4318c0
lea eax, [ebp - 0x20c]
push esi
mov edi, 0x104
push edi
push eax
call fcn.0041826c
push 0x4318c4
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0041826c
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0041826c
add esp, 0x24
lea eax, [ebp - 0x20c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.setconfig.ini
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0041826c
mov esi, dword [sym.imp.zbgui.dll_GetPluginByName]
add esp, 0xc
push str.chk_CloseProgramAndExit
push ebx
call esi
push str.chk_TopMostWnd
push ebx
mov edi, eax
call esi
push str.chk_SaveWndPlacement
push dword [ebp - 0x210]
mov ebx, eax
call esi
push str.chk_AutoRunPlayer
push dword [ebp - 0x210]
mov dword [ebp - 0x214], eax
call esi
mov ecx, dword [edi]
mov esi, eax
push edi
call dword [ecx + 0x190]
mov dword [0x43aebc], eax
mov ecx, dword [ebx]
push ebx
call dword [ecx + 0x190]
mov dword [0x43aec0], eax
mov eax, dword [ebp - 0x214]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x190]
mov dword [0x43aec4], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x190]
mov dword [0x43aecc], eax
cmp dword [0x43aebc], 0
lea eax, [ebp - 0x20c]
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov edi, 0x433838
push eax
mov ecx, 0x43383c
mov eax, edi
cmove eax, ecx
mov ebx, str.config
push eax
push str.CloseProgramAndExit
push ebx
call esi
cmp dword [0x43aec0], 0
lea eax, [ebp - 0x20c]
push eax
mov ecx, 0x43383c
mov eax, edi
cmove eax, ecx
push eax
push str.TopMostWindow
push ebx
call esi
cmp dword [0x43aec4], 0
lea eax, [ebp - 0x20c]
push eax
mov ecx, 0x43383c
mov eax, edi
cmove eax, ecx
push eax
push str.SaveWindowPlacement
push ebx
call esi
cmp dword [0x43aecc], 0
lea eax, [ebp - 0x20c]
push eax
mov eax, 0x43383c
cmove edi, eax
push edi
push str.AutoRunPlayer
push ebx
call esi
push dword [0x43aecc]
call fcn.0040a975
pop edi
pop esi
pop ebx
xor eax, eax
push 3
push eax
push eax
push eax
push eax
cmp dword [0x43aec0], eax
je 0x40ac3c
push 0xffffffffffffffff
jmp 0x40ac3d
push eax
push dword [0x43c108]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041813f
mov esp, ebp
pop ebp
ret 4
Function at 0x40b012
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
push ebx
push esi
push edi
mov esi, 0x208
xor ebx, ebx
push esi
mov dword [0x43e4b4], ebx
call fcn.004182d8
push esi
push ebx
push eax
mov dword [0x43e4b0], eax
call fcn.0041ba00
add esp, 0x10
push ebx
push 0x23
push dword [0x43e4b0]
push dword [0x43c108]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, 0x4318c0
mov edi, 0x104
push esi
push edi
push dword [0x43e4b0]
call fcn.0041826c
push 0x4318c4
push edi
push dword [0x43e4b0]
call fcn.0041826c
push esi
push edi
push dword [0x43e4b0]
call fcn.0041826c
add esp, 0x24
push ebx
push dword [0x43e4b0]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.text_ad.ini
push edi
push dword [0x43e4b0]
call fcn.0041826c
add esp, 0xc
push dword [0x43e4b0]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
mov eax, 0x43e4b0
pop ebx
ret

Function at 0x40b27e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 4], edx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp + 8]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x40b2b1
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
jmp 0x40b2d9
lea eax, [edi + 1]
push eax
call fcn.00417e2e
push edi
mov esi, eax
push ebx
push esi
call fcn.0041a850
add esp, 0x10
mov byte [esi + edi], 0
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b7c9
Capabilities:
Create directory
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x439030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor edi, edi
push 0x206
mov word [ebp - 0x248], ax
lea eax, [ebp - 0x246]
push edi
push eax
call fcn.0041ba00
pop ecx
pop ecx
lea eax, [ebp - 0x248]
push eax
call fcn.00401a1a
push edi
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x433a10
lea eax, [ebp - 0x248]
push 0x104
push eax
call fcn.0041826c
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [ebp - 0x248]
add esp, 0xc
mov ebx, str.config
push eax
push edi
push str.year
push ebx
call esi
mov dword [ebp - 0x25c], eax
lea eax, [ebp - 0x248]
push eax
push edi
push str.month
push ebx
call esi
mov ebx, eax
lea eax, [ebp - 0x248]
push eax
push edi
push 0x433a54
push str.config
call esi
mov esi, eax
lea edi, [ebp - 0x256]
xor eax, eax
mov word [ebp - 0x258], ax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [ebp - 0x258]
movzx eax, word [ebp - 0x256]
imul ecx, edx, 0x64
add ecx, eax
movzx eax, word [ebp - 0x252]
imul ecx, ecx, 0x64
add ecx, eax
imul eax, dword [ebp - 0x25c], 0x64
add eax, ebx
imul eax, eax, 0x64
add eax, esi
cmp eax, ecx
je 0x40b980
test esi, esi
jne 0x40b993
xor eax, eax
lea edi, [ebp - 0x16]
mov word [ebp - 0x18], ax
mov esi, 0x431ce0
stosd dword es:[edi], eax
push edx
push esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x2c], ax
lea edi, [ebp - 0x2a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x40], ax
lea edi, [ebp - 0x3e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x18]
push eax
call fcn.0040d212
movzx eax, word [ebp - 0x256]
push eax
lea eax, [ebp - 0x2c]
push esi
push eax
call fcn.0040d212
movzx eax, word [ebp - 0x252]
push eax
lea eax, [ebp - 0x40]
push esi
push eax
call fcn.0040d212
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0x248]
add esp, 0x24
mov ebx, str.config
push eax
lea eax, [ebp - 0x18]
push eax
push str.year
push ebx
call esi
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x2c]
push eax
push str.month
push ebx
call esi
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x40]
push eax
push 0x433a54
push ebx
call esi
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041813f
mov esp, ebp
pop ebp
ret
xor al, al
jmp 0x40b982
Function at 0x40b9b5
Capabilities:
Create directory
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x439030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor edi, edi
push 0x206
mov word [ebp - 0x248], ax
lea eax, [ebp - 0x246]
push edi
push eax
call fcn.0041ba00
pop ecx
pop ecx
lea eax, [ebp - 0x248]
push eax
call fcn.00401a1a
push edi
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.soft_download.ini
lea eax, [ebp - 0x248]
push 0x104
push eax
call fcn.0041826c
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [ebp - 0x248]
add esp, 0xc
mov ebx, str.config
push eax
push edi
push str.year
push ebx
call esi
mov dword [ebp - 0x25c], eax
lea eax, [ebp - 0x248]
push eax
push edi
push str.month
push ebx
call esi
mov ebx, eax
lea eax, [ebp - 0x248]
push eax
push edi
push 0x433a54
push str.config
call esi
mov esi, eax
lea edi, [ebp - 0x256]
xor eax, eax
mov word [ebp - 0x258], ax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [ebp - 0x258]
movzx eax, word [ebp - 0x256]
imul ecx, edx, 0x64
add ecx, eax
movzx eax, word [ebp - 0x252]
imul ecx, ecx, 0x64
add ecx, eax
imul eax, dword [ebp - 0x25c], 0x64
add eax, ebx
imul eax, eax, 0x64
add eax, esi
cmp eax, ecx
je 0x40bb68
xor eax, eax
lea edi, [ebp - 0x16]
mov word [ebp - 0x18], ax
mov esi, 0x431ce0
stosd dword es:[edi], eax
push edx
push esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x2c], ax
lea edi, [ebp - 0x2a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x40], ax
lea edi, [ebp - 0x3e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x18]
push eax
call fcn.0040d212
movzx eax, word [ebp - 0x256]
push eax
lea eax, [ebp - 0x2c]
push esi
push eax
call fcn.0040d212
movzx eax, word [ebp - 0x252]
push eax
lea eax, [ebp - 0x40]
push esi
push eax
call fcn.0040d212
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0x248]
add esp, 0x24
mov ebx, str.config
push eax
lea eax, [ebp - 0x18]
push eax
push str.year
push ebx
call esi
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x2c]
push eax
push str.month
push ebx
call esi
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x40]
push eax
push 0x433a54
push ebx
call esi
mov al, 1
jmp 0x40bb6a
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041813f
mov esp, ebp
pop ebp
ret