joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411460
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465a56
mov eax, dword fs:[0]
push eax
sub esp, 0x150
mov eax, dword [0x489d38]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 0x154], edi
xor eax, eax
mov dword [ebp - 0x118], 7
mov dword [ebp - 0x11c], edi
mov word [ebp - 0x12c], ax
cmp dword [ebx + 0x14], 8
mov dword [ebp - 4], edi
jb 0x4114c2
mov eax, dword [ebx]
jmp 0x4114c4
mov eax, ebx
push edi
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
xor ecx, ecx
mov dword [ebp - 0x14c], eax
cmp eax, edi
ja 0x41150b
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
lea edx, [ebp - 0x12c]
mov word [esi], cx
push edx
mov ecx, esi
call fcn.00410d30
cmp dword [ebp - 0x118], 8
jb 0x4116ab
mov eax, dword [ebp - 0x12c]
push eax
jmp 0x4116a3
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044f9de
mov edi, eax
mov eax, dword [ebp - 0x14c]
lea ecx, [eax + eax + 2]
push ecx
push 0
push edi
call fcn.00450d40
add esp, 0x10
cmp dword [ebx + 0x14], 8
jb 0x411542
mov eax, dword [ebx]
jmp 0x411544
mov eax, ebx
mov edx, dword [ebp - 0x14c]
push edi
push edx
xor ebx, ebx
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoW
cmp eax, 1
jne 0x41166d
lea eax, [ebp - 0x15c]
push eax
lea ecx, [ebp - 0x158]
push ecx
push str.VarFileInfoTranslation
push edi
mov dword [ebp - 0x15c], ebx
call sub.VERSION.dll_VerQueryValueW
cmp eax, 1
jne 0x41166d
mov eax, dword [ebp - 0x158]
cmp eax, ebx
je 0x41166d
movzx edx, word [eax + 2]
movzx eax, word [eax]
push edx
push eax
lea ecx, [ebp - 0x110]
push str.StringFileInfo_04x_04xFileVersion
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0x110]
push edx
lea ecx, [ebp - 0x148]
call fcn.00401a10
cmp dword [ebp - 0x134], 8
mov eax, dword [ebp - 0x148]
mov byte [ebp - 4], 1
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x154], ebx
jae 0x4115e9
lea eax, [ebp - 0x148]
lea ecx, [ebp - 0x154]
push ecx
lea edx, [ebp - 0x150]
push edx
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
cmp eax, 1
je 0x411632
push edi
call fcn.004515e9
add esp, 4
lea eax, [ebp - 0x12c]
push eax
mov ecx, esi
call fcn.00410db0
lea ecx, [ebp - 0x148]
call fcn.00417860
lea ecx, [ebp - 0x12c]
call fcn.00417860
jmp 0x4116ab
mov eax, dword [ebp - 0x150]
cmp eax, ebx
je 0x41165b
push eax
lea ecx, [ebp - 0x12c]
call fcn.00402f40
push 0x2e
lea ecx, [ebp - 0x12c]
push 0x2c
push ecx
call fcn.00410880
add esp, 0xc
push edi
call fcn.004515e9
add esp, 4
lea edx, [ebp - 0x12c]
push edx
jmp 0x411613
push edi
call fcn.004515e9
add esp, 4
lea ecx, [ebp - 0x12c]
xor eax, eax
push ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
mov ecx, esi
mov word [esi], ax
call fcn.00410d30
cmp dword [ebp - 0x118], 8
jb 0x4116ab
mov edx, dword [ebp - 0x12c]
push edx
call fcn.0044faa7
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004501e2
mov esp, ebp
pop ebp
ret
Function at 0x4116d0
Capabilities:
Create directory
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465a8b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x489d38]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
push edi
xor eax, eax
push 0x469a24
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], edi
mov word [ebp - 0x234], ax
call fcn.00401920
push 1
push 0x1a
lea ecx, [ebp - 0x218]
push ecx
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
js 0x4117e4
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
jmp 0x411760
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x411760
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x234]
call fcn.00401920
push 0xe
push str._videocalendar
lea ecx, [ebp - 0x234]
call fcn.00410a80
cmp dword [eax + 0x14], 8
jb 0x41179c
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4117b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4117e4
lea ecx, [ebp - 0x234]
xor eax, eax
push ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
mov ecx, esi
mov word [esi], ax
call fcn.00410d30
cmp dword [ebp - 0x220], 8
jb 0x411818
mov edx, dword [ebp - 0x234]
push edx
jmp 0x411810
push edi
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
push 0x469a24
mov ecx, esi
mov word [esi], ax
call fcn.00401920
cmp dword [ebp - 0x220], 8
jb 0x411818
mov ecx, dword [ebp - 0x234]
push ecx
call fcn.0044faa7
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004501e2
mov esp, ebp
pop ebp
ret
Function at 0x411900
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465afb
mov eax, dword fs:[0]
push eax
sub esp, 0x824
mov eax, dword [0x489d38]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x82c]
xor ebx, ebx
push eax
mov dword [ebp - 0x830], ebx
call fcn.00411840
add esp, 4
mov edi, dword [ebp - 0x81c]
mov dword [ebp - 4], ebx
cmp edi, ebx
jne 0x41197e
xor ecx, ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
push 1
mov word [esi], cx
push 0x46aa84
mov ecx, esi
call fcn.00401920
cmp dword [ebp - 0x818], 8
jmp 0x411a3c
push 0x7fe
lea ecx, [ebp - 0x80e]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x810], ax
call fcn.00450d40
add esp, 0xc
cmp edi, ebx
mov edi, 8
jbe 0x411a19
mov eax, dword [ebp - 0x82c]
cmp dword [ebp - 0x818], edi
jae 0x4119b9
lea eax, [ebp - 0x82c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x411a19
mov eax, dword [ebp - 0x82c]
cmp dword [ebp - 0x818], edi
jae 0x4119d8
lea eax, [ebp - 0x82c]
push eax
push 0x400
lea edx, [ebp - 0x810]
push edx
push 0x469a24
push str.ChannelMajor
push str.conf
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jle 0x411a19
lea eax, [ebp - 0x810]
push eax
mov ecx, esi
call fcn.00401a10
lea ecx, [ebp - 0x82c]
call fcn.00417860
jmp 0x411a4d
xor ecx, ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
push 1
mov word [esi], cx
push 0x46aa84
mov ecx, esi
call fcn.00401920
cmp dword [ebp - 0x818], edi
jb 0x411a4d
mov edx, dword [ebp - 0x82c]
push edx
call fcn.0044faa7
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004501e2
mov esp, ebp
pop ebp
ret
Function at 0x411a70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465b3b
mov eax, dword fs:[0]
push eax
sub esp, 0x850
mov eax, dword [0x489d38]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor edi, edi
push edi
push 0x80
push 4
push edi
push edi
push 0xc0000000
push str.C:logLog.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x411c18
lea eax, [ebp - 0x858]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x7fe
lea edx, [ebp - 0x80e]
xor ecx, ecx
push edi
push edx
mov word [ebp - 0x810], cx
call fcn.00450d40
movzx eax, word [ebp - 0x84a]
movzx ecx, word [ebp - 0x84c]
movzx edx, word [ebp - 0x84e]
push eax
movzx eax, word [ebp - 0x850]
push ecx
push edx
push eax
lea ecx, [ebp - 0x810]
push 0x46aa88
push ecx
call fcn.00410400
add esp, 0x24
xor edx, edx
lea eax, [ebp - 0x810]
mov word [ebp - 0x848], dx
mov dword [ebp - 0x834], 7
mov dword [ebp - 0x838], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x411b46
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x848]
call fcn.00401920
lea ecx, [ebp - 0x848]
push ecx
lea edx, [ebp - 0x82c]
push ebx
push edx
mov dword [ebp - 4], edi
call fcn.00410f80
add esp, 0xc
push 2
push edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 0x82c]
mov ebx, 8
mov dword [ebp - 0x85c], edi
cmp dword [ebp - 0x818], ebx
jae 0x411bac
lea eax, [ebp - 0x82c]
mov edx, dword [ebp - 0x81c]
push edi
lea ecx, [ebp - 0x85c]
push ecx
lea ecx, [edx + edx]
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x411bd1
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
cmp dword [ebp - 0x818], ebx
jb 0x411be8
mov edx, dword [ebp - 0x82c]
push edx
call fcn.0044faa7
add esp, 4
xor eax, eax
mov word [ebp - 0x82c], ax
mov dword [ebp - 0x81c], edi
mov dword [ebp - 0x818], 7
cmp dword [ebp - 0x834], ebx
jb 0x411c18
mov ecx, dword [ebp - 0x848]
push ecx
call fcn.0044faa7
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004501e2
mov esp, ebp
pop ebp
ret
Function at 0x413dd0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ecx + 0x29f], 0
jne 0x413e11
push esi
lea eax, [ebp - 4]
push eax
push 4
mov byte [ecx + 0x29f], 1
mov ecx, dword [ecx + 4]
push ecx
push 0x413cb0
push 0
push 0
call fcn.004522f1
add esp, 0x18
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x413f40
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ecx + 0x2a0], 0
jne 0x413f81
push esi
lea eax, [ebp - 4]
push eax
push 4
mov byte [ecx + 0x2a0], 1
mov ecx, dword [ecx + 4]
push ecx
push 0x413e20
push 0
push 0
call fcn.004522f1
add esp, 0x18
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x413f90
Capabilities:
Create directory
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465a8b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x489d38]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
push edi
xor eax, eax
push 0x469a24
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], edi
mov word [ebp - 0x234], ax
call fcn.00401920
lea ecx, [ebp - 0x218]
push ecx
push edi
push edi
push 0x1a
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4140a4
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
jmp 0x414020
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x414020
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x234]
call fcn.00401920
push 0xe
push str._videocalendar
lea ecx, [ebp - 0x234]
call fcn.00410a80
cmp dword [eax + 0x14], 8
jb 0x41405c
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x414075
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4140a4
lea ecx, [ebp - 0x234]
xor eax, eax
push ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
mov ecx, esi
mov word [esi], ax
call fcn.00410d30
cmp dword [ebp - 0x220], 8
jb 0x4140d8
mov edx, dword [ebp - 0x234]
push edx
jmp 0x4140d0
push edi
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
push 0x469a24
mov ecx, esi
mov word [esi], ax
call fcn.00401920
cmp dword [ebp - 0x220], 8
jb 0x4140d8
mov ecx, dword [ebp - 0x234]
push ecx
call fcn.0044faa7
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004501e2
mov esp, ebp
pop ebp
ret 4
Function at 0x414100
Capabilities:
Create directory
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465a8b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x489d38]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
push edi
xor eax, eax
push 0x469a24
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], edi
mov word [ebp - 0x234], ax
call fcn.00401920
lea ecx, [ebp - 0x218]
push ecx
push edi
push edi
push 0x1a
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x414214
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
jmp 0x414190
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x414190
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x234]
call fcn.00401920
push 0xb
push str.FEKeyValue
lea ecx, [ebp - 0x234]
call fcn.00410a80
cmp dword [eax + 0x14], 8
jb 0x4141cc
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4141e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x414214
lea ecx, [ebp - 0x234]
xor eax, eax
push ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
mov ecx, esi
mov word [esi], ax
call fcn.00410d30
cmp dword [ebp - 0x220], 8
jb 0x414248
mov edx, dword [ebp - 0x234]
push edx
jmp 0x414240
push edi
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
push 0x469a24
mov ecx, esi
mov word [esi], ax
call fcn.00401920
cmp dword [ebp - 0x220], 8
jb 0x414248
mov ecx, dword [ebp - 0x234]
push ecx
call fcn.0044faa7
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004501e2
mov esp, ebp
pop ebp
ret 4

Function at 0x414330
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465f38
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x489d38]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x38]
push eax
mov esi, ecx
call fcn.00413f90
push 0x12
push str._videocalendar.ini
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0
call fcn.00410a80
xor eax, eax
xor ecx, ecx
cmp dword [ebp - 0x24], 8
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], 0
mov word [ebp - 0x1c], cx
jae 0x41439b
lea eax, [ebp - 0x38]
push eax
push 5
lea edx, [ebp - 0x1c]
push edx
push 0x46aa84
push str.showleft
push str.root
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x1c]
push 0x469cb8
push ecx
call fcn.00452423
add esp, 0xc
cmp dword [ebp - 0x3c], 1
sete dl
cmp dword [ebp - 0x24], 8
mov byte [esi + 0x29d], dl
jb 0x4143eb
mov eax, dword [ebp - 0x38]
push eax
call fcn.0044faa7
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004501e2
mov esp, ebp
pop ebp
ret
Function at 0x414710
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465fd0
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x489d38]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
call fcn.00413f90
push str.Log.txt
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x48]
push edx
mov dword [ebp - 4], 0
call fcn.00410e40
add esp, 0xc
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00410d30
mov esi, 8
cmp dword [ebp - 0x34], esi
jb 0x414785
mov eax, dword [ebp - 0x48]
push eax
call fcn.0044faa7
add esp, 4
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], esi
jae 0x414790
lea eax, [ebp - 0x2c]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4147db
mov eax, dword [edi + 0x10]
push 0
lea ecx, [ebp - 0x4c]
push ecx
push eax
mov ecx, edi
mov dword [ebp - 0x4c], 0
call fcn.00408a80
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4147db
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x18], 8
jb 0x4147f4
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0044faa7
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004501e2
mov esp, ebp
pop ebp
ret 4

Function at 0x414820
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x466010
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x489d38]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 0xfde9
lea eax, [ebp - 0x48]
push esi
push eax
call fcn.00411040
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x64]
push edx
mov dword [ebp - 4], 0
call fcn.004112c0
add esp, 0x14
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.004094e0
cmp dword [ebp - 0x50], 0x10
mov byte [ebp - 4], 0
jb 0x414895
mov eax, dword [ebp - 0x64]
push eax
call fcn.0044faa7
add esp, 4
push 0xfde9
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x2c]
push edx
call fcn.00411170
add esp, 0xc
cmp dword [esi + 0x10], 0
je 0x4148cd
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x4148bc
lea eax, [ebp - 0x2c]
push 5
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [ebp - 0x18], 8
jb 0x4148df
mov eax, dword [ebp - 0x2c]
push eax
call fcn.0044faa7
add esp, 4
xor ecx, ecx
cmp dword [ebp - 0x34], 0x10
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], cx
jb 0x414905
mov edx, dword [ebp - 0x48]
push edx
call fcn.0044faa7
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004501e2
mov esp, ebp
pop ebp
ret 4
Function at 0x414a40
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4660b5
mov eax, dword fs:[0]
push eax
mov eax, 0x202c
call fcn.00452450
mov eax, dword [0x489d38]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x2038], edi
mov dword [ebp - 0x2034], eax
xor ecx, ecx
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], eax
push eax
mov word [edi], cx
mov ebx, 1
push 0x469a24
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.00401920
cmp dword [ebp + 0x1c], 0
mov dword [ebp - 0x2034], ebx
je 0x414bf5
lea edx, [ebp - 0x202c]
push edx
mov ecx, esi
call fcn.00414100
push 0xf
push str.FEKeyValue.ini
lea ecx, [ebp - 0x202c]
mov byte [ebp - 4], 2
call fcn.00410a80
xor eax, eax
push 0x1ffe
push eax
lea ecx, [ebp - 0x200e]
push ecx
mov word [ebp - 0x2010], ax
call fcn.00450d40
mov ecx, dword [ebp - 0x202c]
mov eax, 8
add esp, 0xc
lea esi, [ebp - 0x2010]
mov byte [ebp - 0x202d], 0
cmp dword [ebp - 0x2018], eax
jae 0x414b21
lea ecx, [ebp - 0x202c]
cmp dword [ebp + 0x20], eax
mov eax, dword [ebp + 0xc]
jae 0x414b2c
lea eax, [ebp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push ecx
push 0x1000
lea edx, [ebp - 0x2010]
push edx
push 0x469a24
push eax
push str.root
call ebx
cmp eax, 0xfff
jne 0x414bae
push 0x6000
mov byte [ebp - 0x202d], 1
call fcn.0044f9de
push 0x6000
mov esi, eax
push 0
push esi
call fcn.00450d40
mov ecx, dword [ebp - 0x202c]
mov eax, 8
add esp, 0x10
cmp dword [ebp - 0x2018], eax
jae 0x414b8f
lea ecx, [ebp - 0x202c]
cmp dword [ebp + 0x20], eax
mov eax, dword [ebp + 0xc]
jae 0x414b9a
lea eax, [ebp + 0xc]
push ecx
push 0x3000
push esi
push 0x469a24
push eax
push str.root
call ebx
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x414bb3
sub eax, edx
sar eax, 1
push eax
push esi
mov ecx, edi
call fcn.00401920
cmp byte [ebp - 0x202d], 0
je 0x414bdd
push esi
call fcn.004515e9
add esp, 4
cmp dword [ebp - 0x2018], 8
jb 0x414bf5
mov eax, dword [ebp - 0x202c]
push eax
call fcn.0044faa7
add esp, 4
cmp dword [ebp + 0x20], 8
jb 0x414c07
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0044faa7
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004501e2
mov esp, ebp
pop ebp
ret 0x20
Function at 0x4159e0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x14], 8
push esi
push edi
jb 0x4159f3
mov eax, dword [ebx]
jmp 0x4159f5
mov eax, ebx
xor esi, esi
push esi
push 0x80
push 3
push esi
push esi
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x415a84
push 0x38
call fcn.004503dc
add esp, 4
cmp eax, esi
je 0x415a40
mov ecx, 7
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], esi
xor edx, edx
mov word [eax], dx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x2c], esi
xor ecx, ecx
mov word [eax + 0x1c], cx
mov esi, eax
push 0xffffffffffffffff
push 0
push ebx
mov ecx, esi
call fcn.00401820
mov edx, dword [ebp + 0xc]
push 0xffffffffffffffff
push 0
push edx
lea ecx, [esi + 0x1c]
call fcn.00401820
lea eax, [ebp + 8]
push eax
push 4
push esi
push 0x4156c0
push 0
push 0
call fcn.004522f1
add esp, 0x18
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x415b70
Capabilities:
Create directory
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465a8b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x489d38]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
push edi
xor eax, eax
push 0x469a24
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], edi
mov word [ebp - 0x234], ax
call fcn.00401920
lea ecx, [ebp - 0x218]
push ecx
push edi
push edi
push 0x1a
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x415c84
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
jmp 0x415c00
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x415c00
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x234]
call fcn.00401920
push 0x14
push str._videocalendarlogo_
lea ecx, [ebp - 0x234]
call fcn.00410a80
cmp dword [eax + 0x14], 8
jb 0x415c3c
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x415c55
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x415c84
lea ecx, [ebp - 0x234]
xor eax, eax
push ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
mov ecx, esi
mov word [esi], ax
call fcn.00410d30
cmp dword [ebp - 0x220], 8
jb 0x415cb8
mov edx, dword [ebp - 0x234]
push edx
jmp 0x415cb0
push edi
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
push 0x469a24
mov ecx, esi
mov word [esi], ax
call fcn.00401920
cmp dword [ebp - 0x220], 8
jb 0x415cb8
mov ecx, dword [ebp - 0x234]
push ecx
call fcn.0044faa7
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004501e2
mov esp, ebp
pop ebp
ret 4