joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428b9a
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x50f5d1
call fcn.0050df3c
sub esp, 0x70
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
mov ebx, ecx
jne 0x428bba
xor eax, eax
jmp 0x428d02
mov eax, dword [0x55fb0c]
mov ecx, 0x55fb0c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x20], eax
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
lea eax, [ebp - 0x20]
push 0x53fd1c
call fcn.00406455
add esp, 0xc
lea esi, [ebp - 0x14]
mov dword [ebp - 0x14], edi
call fcn.00409270
test eax, eax
jne 0x428ce6
push 0x40
push eax
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x7c], 0x44
call fcn.004f0540
and dword [ebp - 0x34], 0
xor eax, eax
add esp, 0xc
neg ebx
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
sbb ebx, ebx
and ebx, 5
stosd dword es:[edi], eax
mov word [ebp - 0x4c], bx
xor ebx, ebx
push str.userenv.dll
stosd dword es:[edi], eax
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x74], 0x53fd44
mov dword [ebp - 0x24], 0x30
mov dword [ebp + 8], ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [ebp - 0x1c], eax
je 0x428c90
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateEnvironmentBlock
push eax
call edi
push str.DestroyEnvironmentBlock
push dword [ebp - 0x1c]
mov esi, eax
call edi
cmp esi, ebx
mov dword [ebp - 0x18], eax
je 0x428c90
push ebx
push dword [ebp - 0x14]
lea eax, [ebp + 8]
push eax
call esi
test eax, eax
je 0x428c8d
mov dword [ebp - 0x24], 0x430
jmp 0x428c90
mov dword [ebp + 8], ebx
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push dword [ebp + 8]
push dword [ebp - 0x24]
push ebx
push ebx
push ebx
push dword [ebp - 0x20]
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
cmp dword [ebp - 0x34], ebx
mov edi, eax
je 0x428cbf
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x30], ebx
je 0x428ccd
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x18], ebx
je 0x428cd8
push dword [ebp + 8]
call dword [ebp - 0x18]
cmp dword [ebp - 0x1c], ebx
je 0x428ce6
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x14], 0
je 0x428cf5
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
call fcn.00405980
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x428d11
Capabilities:
Check os version
Create process on windows

Disassembly:
mov eax, 0x50f49c
call fcn.0050df3c
sub esp, 0x184
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
jne 0x428d32
xor eax, eax
jmp 0x428ee5
mov eax, dword [0x55fb0c]
mov ecx, 0x55fb0c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push 0x53fd1c
call fcn.00406455
push 0x110
lea eax, [ebp - 0x18c]
push ebx
push eax
call fcn.004f0540
add esp, 0x18
lea eax, [ebp - 0x190]
push eax
mov dword [ebp - 0x190], 0x114
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x428d97
cmp dword [ebp - 0x18c], 6
jne 0x428d97
inc esi
cmp esi, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
lea esi, [ebp - 0x10]
jne 0x428dab
call fcn.00409270
jmp 0x428db0
call fcn.00409220
cmp eax, ebx
jne 0x428ec9
push 0x40
lea eax, [ebp - 0x74]
push ebx
push eax
mov dword [ebp - 0x78], 0x44
call fcn.004f0540
push dword [ebp - 0x10]
xor eax, eax
mov dword [ebp - 0x2c], ebx
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 5
mov dword [ebp - 0x4c], 1
mov word [ebp - 0x48], ax
call fcn.004092db
add esp, 0x10
test al, al
jne 0x428e15
cmp dword [ebp - 0x10], ebx
je 0x428e0b
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x10]
push eax
call fcn.00409455
pop ecx
push str.userenv.dll
mov dword [ebp - 0x70], 0x53fd44
mov dword [ebp - 0x14], 0x30
mov dword [ebp + 8], ebx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [ebp - 0x1c], eax
je 0x428e74
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateEnvironmentBlock
push eax
call edi
push str.DestroyEnvironmentBlock
push dword [ebp - 0x1c]
mov esi, eax
call edi
cmp esi, ebx
mov edi, eax
je 0x428e74
push ebx
push dword [ebp - 0x10]
lea eax, [ebp + 8]
push eax
call esi
test eax, eax
je 0x428e71
mov dword [ebp - 0x14], 0x430
jmp 0x428e74
mov dword [ebp + 8], ebx
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x78]
push eax
push ebx
push dword [ebp + 8]
push dword [ebp - 0x14]
push ebx
push ebx
push ebx
push dword [ebp - 0x18]
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
cmp dword [ebp - 0x2c], ebx
mov dword [ebp - 0x14], eax
je 0x428ea4
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x28], ebx
je 0x428eb2
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x428ebb
push dword [ebp + 8]
call edi
cmp dword [ebp - 0x1c], ebx
je 0x428ec9
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x10], ebx
je 0x428ed7
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00405980
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x42901f
Capabilities:
Query environment variable

Disassembly:
push 0x14
push 0x54d530
call fcn.0050ddcc
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 8], eax
je 0x4290cd
cmp dword [ebp + 0xc], eax
je 0x4290cd
push eax
push eax
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call edi
mov esi, eax
cmp esi, 1
jb 0x4290cd
mov ebx, 0x103
cmp esi, ebx
ja 0x4290cd
and dword [ebp - 4], 0
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004ed1bb
pop ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x4290c9
lea ecx, [esi + esi]
push ecx
push 0
push eax
call fcn.004f0540
add esp, 0xc
push esi
push dword [ebp - 0x24]
push dword [ebp + 8]
call edi
test eax, eax
je 0x4290c9
cmp eax, ebx
ja 0x4290c9
push eax
push dword [ebp - 0x24]
push ebx
push dword [ebp + 0xc]
call fcn.004f3e92
add esp, 0x10
mov dword [ebp - 0x20], 1
jmp 0x4290c9
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], 0
je 0x4290dc
push dword [ebp - 0x1c]
call fcn.004f0535
pop ecx
mov eax, dword [ebp - 0x20]
call fcn.0050de07
ret

Function at 0x4290e5
Capabilities:
Create directory
Delete directory

Disassembly:
mov eax, 0x510f0e
call fcn.0050df3c
push ebx
push esi
push edi
and dword [ebp - 4], 0
push str._access
lea eax, [ebp + 8]
push eax
call fcn.004061c6
mov ebx, dword [ebp + 8]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call esi
test edi, edi
je 0x429127
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x42912e
call esi
cmp eax, 5
je 0x429131
xor edi, edi
inc edi
lea eax, [ebx - 0x10]
call fcn.00405980
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x429d0a
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x51168e
call fcn.0050df3c
push esi
xor esi, esi
cmp dword [ebx], esi
push edi
je 0x429d2f
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret 4
cmp dword [ebp + 8], esi
jne 0x429d8a
push 0x400000
lea ecx, [ebp + 8]
call fcn.00408f62
pop ecx
mov dword [ebp - 4], esi
lea esi, [ebx + 4]
mov edi, esi
call fcn.00404ec2
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00405980
push str.data_fileinfo.dat
push 0x104
call fcn.00405ab1
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, dword [esi]
test eax, eax
je 0x429d81
push eax
call fcn.004f0eb4
pop ecx
mov edx, esi
call fcn.00405a78
jmp 0x429d96
push dword [ebp + 8]
lea esi, [ebx + 4]
push esi
call fcn.00405e0b
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x429da9
xor eax, eax
jmp 0x429d1f
mov eax, dword [0x55fb0c]
mov ecx, 0x55fb0c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 1
mov ecx, dword [esi]
push eax
call fcn.00429c96
test eax, eax
jne 0x429ddf
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00405980
jmp 0x429da2
lea edi, [ebx + 0x24]
lea eax, [ebp + 8]
call fcn.0042a1d1
lea eax, [ebp + 8]
push eax
push ebx
call fcn.00429e2a
test eax, eax
jne 0x429e0c
xor esi, esi
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00405980
mov eax, esi
jmp 0x429d1f
mov ecx, ebx
call fcn.00429ec4
mov eax, ebx
call fcn.0042a054
mov ecx, ebx
call fcn.0042a09a
xor eax, eax
inc eax
mov dword [ebx], eax
mov esi, eax
jmp 0x429dfa
Function at 0x42a09a
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x510c0f
call fcn.0050df3c
sub esp, 0x28
push ebx
push esi
push edi
push 0
lea eax, [ebp - 0x30]
push eax
mov esi, ecx
call fcn.0040495a
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x30]
push ecx
mov ecx, eax
call fcn.00404a21
test al, al
je 0x42a1b6
mov edi, str.eid1
push edi
lea eax, [ebp - 0x30]
call fcn.00404e2e
test al, al
je 0x42a147
push edi
lea eax, [ebp - 0x30]
call fcn.00404e69
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00405bf0
lea ebx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004299f8
test eax, eax
je 0x42a138
push edi
lea eax, [ebp - 0x18]
push eax
call fcn.00405bf0
lea eax, [ebp - 0x18]
push eax
lea eax, [esi + 8]
push eax
mov byte [ebp - 4], 2
call fcn.0042a212
mov edi, eax
mov eax, ebx
call fcn.00404ec2
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00405980
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00405980
mov edi, str.eid2
push edi
lea eax, [ebp - 0x30]
call fcn.00404e2e
test al, al
je 0x42a1b6
push edi
lea eax, [ebp - 0x30]
call fcn.00404e69
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00405bf0
lea ebx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.004299f8
test eax, eax
je 0x42a1ab
push edi
lea eax, [ebp - 0x18]
push eax
call fcn.00405bf0
lea eax, [ebp - 0x18]
push eax
add esi, 8
push esi
mov byte [ebp - 4], 4
call fcn.0042a212
mov edi, eax
mov eax, ebx
call fcn.00404ec2
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00405980
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00405980
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.004049d6
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x42b463
Capabilities:
Check if file exists
Read .ini file

Disassembly:
mov eax, 0x51009b
call fcn.0050df3c
push ecx
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.0040610f
xor esi, esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x10]
mov dword [esp], str.dataproduct.dat
push eax
call fcn.004061c6
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42b4b4
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405980
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
push dword [ebp - 0x10]
push 0x1f4
push 0x53fe68
push str.common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp + 8]
xor esi, esi
mov dword [ecx], eax
inc esi
jmp 0x42b49a
Function at 0x42beb3
Capabilities:
Create thread

Disassembly:
mov eax, 0x512407
call fcn.0050df3c
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [edi], ebx
push esi
jne 0x42bece
xor al, al
jmp 0x42bf53
lea eax, [edi + 0x1c]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp + 8]
push eax
lea esi, [edi + 0xc]
mov dword [ebp - 4], ebx
call fcn.00463fc7
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea esi, [edi + 8]
mov eax, esi
call fcn.0042abe2
test eax, eax
jne 0x42bf49
push 0xc
call fcn.004152d5
cmp eax, ebx
pop ecx
jne 0x42bf16
mov dword [ebp + 8], ebx
jmp 0x42bf37
push ebx
push ebx
push eax
push 0x42c2d4
push ebx
push ebx
mov dword [eax], edi
mov dword [eax + 8], ebx
mov dword [eax + 4], 0x42bf63
call fcn.004f3b37
add esp, 0x18
mov dword [ebp + 8], eax
mov eax, dword [esi]
cmp eax, ebx
je 0x42bf44
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
mov dword [esi], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov al, 1
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x42e78e
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov eax, 0x511049
call fcn.0050df3c
sub esp, 0x278
push ebx
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x20]
xor edi, edi
push eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
call fcn.00405bf0
push edi
push 2
mov dword [ebp - 4], edi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 0x1c], esi
jne 0x42e7eb
push 0xfffffffffffffffe
pop esi
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
call fcn.00405980
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
push 0x228
lea eax, [ebp - 0x280]
push edi
push eax
call fcn.004f0540
add esp, 0xc
lea eax, [ebp - 0x284]
push eax
push esi
mov dword [ebp - 0x284], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x42e826
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfffffffffffffffd
jmp 0x42e7cc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x54]
push eax
call fcn.00406f18
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42e846
xor edi, edi
mov eax, dword [ebp - 0x27c]
cmp eax, dword [ebp - 0x24]
je 0x42e8d0
cmp eax, edi
je 0x42e8d0
cmp eax, 4
je 0x42e8d0
push eax
push edi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x42e8d0
push edi
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.00406f82
mov esi, dword [ebp + 8]
mov eax, dword [esi - 0xc]
test eax, eax
je 0x42e8c2
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx - 0xc]
cmp eax, ecx
jl 0x42e8c2
push ecx
push esi
push edx
call fcn.004f1903
add esp, 0xc
test eax, eax
jne 0x42e8c2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp eax, 1
je 0x42e8bc
push dword [ebp - 0x27c]
call fcn.00407203
cmp eax, 1
pop ecx
jne 0x42e8bf
inc dword [ebp - 0x14]
inc dword [ebp - 0x18]
push edi
call ebx
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00405980
lea eax, [ebp - 0x284]
push eax
push dword [ebp - 0x1c]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x42e844
push dword [ebp - 0x1c]
call ebx
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x42e8f8
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
lea esi, [ebp - 0x34]
call fcn.0040752b
lea esi, [ebp - 0x54]
call fcn.00406e3e
mov esi, dword [ebp - 0x14]
jmp 0x42e7cd
Function at 0x42ea5f
Capabilities:
Check if file exists

Disassembly:
push ecx
mov eax, dword [esi + 8]
cmp dword [eax - 0xc], 0
jne 0x42ea70
mov eax, 0x13a
pop ecx
ret
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42ea82
mov eax, 0x13b
pop ecx
ret
call fcn.00407e80
cmp eax, 0xd
jge 0x42eabd
push dword [esi + 0x1c]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
push eax
push ecx
call fcn.00428d11
add esp, 0xc
test eax, eax
je 0x42eaa7
xor eax, eax
pop ecx
ret
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
push eax
push ecx
mov ecx, dword [esi + 0x1c]
call fcn.00428b9a
test eax, eax
pop ecx
pop ecx
jne 0x42eaa3
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
push 0
push eax
push ecx
mov ecx, dword [esi + 0x1c]
call fcn.00428a8e
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0xfffffec7
add eax, 0x139
pop ecx
ret

Function at 0x42f387
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
cmp dword [esi + 0xc], 0xffffffff
jne 0x42f3eb
push ebx
push edi
lea ebx, [ebp - 4]
call fcn.0042fb16
push dword [eax]
xor ebx, ebx
push ebx
push 0x540598
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00405980
cmp edi, ebx
je 0x42f3da
lea eax, [ebp - 4]
push eax
push esi
mov dword [ebp - 4], ebx
call fcn.0042f4d8
test eax, eax
je 0x42f3da
cmp dword [ebp - 4], ebx
jne 0x42f3e3
call fcn.0042fc19
test eax, eax
je 0x42f3e6
xor eax, eax
inc eax
pop edi
mov dword [esi + 0xc], eax
pop ebx
mov eax, dword [esi + 0xc]
pop esi
leave
ret
Function at 0x42f57b
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x5104e3
call fcn.0050df3c
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x20]
add edi, 0x1c
test eax, eax
je 0x42f5a5
mov ecx, dword [edi + 8]
sub ecx, eax
sar ecx, 3
jne 0x42f6d0
mov eax, dword [0x55fb0c]
mov ecx, 0x55fb0c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
lea ebx, [ebp - 0x1c]
call fcn.0042fb16
mov byte [ebp - 4], 1
push dword [eax]
mov eax, 0x104
push eax
push eax
lea esi, [ebp - 0x14]
call fcn.00405ab1
push eax
push str.1.01.21.5
push str.supportrate
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ebx, ebx
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00405980
cmp dword [ebp - 0x14], ebx
jne 0x42f608
xor eax, eax
jmp 0x42f611
push dword [ebp - 0x14]
call fcn.004f0eb4
pop ecx
lea edx, [ebp - 0x14]
call fcn.00405a78
mov esi, 0x540594
push esi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
push eax
lea ecx, [ebp - 0x1c]
lea ebx, [ebp - 0x14]
call fcn.004298ff
jmp 0x42f6ac
push eax
call fcn.004f401a
fstp qword [ebp - 0x24]
mov edx, dword [edi + 4]
test edx, edx
pop ecx
jne 0x42f648
xor ecx, ecx
jmp 0x42f650
mov ecx, dword [edi + 8]
sub ecx, edx
sar ecx, 3
test edx, edx
je 0x42f670
mov eax, dword [edi + 0xc]
sub eax, edx
sar eax, 3
cmp ecx, eax
jae 0x42f670
mov eax, dword [edi + 8]
fld qword [ebp - 0x24]
fstp qword [eax]
add eax, 8
mov dword [edi + 8], eax
jmp 0x42f68d
mov ebx, dword [edi + 8]
cmp edx, ebx
jbe 0x42f67c
call fcn.004efece
push ebx
push edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, edi
call fcn.00450bbd
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00405980
push esi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
lea ebx, [ebp - 0x14]
call fcn.004298ff
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], 0
jne 0x42f633
add eax, 0xfffffff0
call fcn.00405980
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00405980
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x42f916
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi + 0x18], 0
jne 0x42f94c
push ebx
lea ebx, [ebp - 4]
call fcn.0042fb16
push dword [eax]
push 2
push 0x5405a8
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00405980
pop ebx
mov eax, dword [esi + 0x18]
leave
ret
Function at 0x42fb16
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x50fd0f
call fcn.0050df3c
push ecx
push ecx
and dword [ebp - 0x14], 0
push edi
lea edi, [ebp - 0x14]
call fcn.0045fd36
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
jne 0x42fb54
push 0x53e9ec
push ebx
call fcn.00405bf0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00405980
jmp 0x42fbbf
add eax, 0xfffffff0
call fcn.00405998
add eax, 0x10
mov dword [ebp - 0x10], eax
push str.datadpiconfig.ini
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 1
call fcn.004061c6
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42fb99
lea eax, [ebp - 0x14]
lea edi, [ebp - 0x10]
call fcn.00404ec2
push str._ressrcchsdpisetting.ini
mov eax, edi
push eax
call fcn.004061c6
push esi
mov esi, dword [ebp - 0x10]
add esi, 0xfffffff0
mov eax, esi
call fcn.00405998
add eax, 0x10
mov dword [ebx], eax
mov eax, esi
call fcn.00405980
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00405980
pop esi
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
mov dword fs:[0], ecx
leave
ret

Function at 0x42fbce
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, esi
call fcn.0042f89d
test eax, eax
jne 0x42fbe2
push 0x60
pop eax
leave
ret
cmp dword [esi + 8], 0xffffffff
jne 0x42fc14
push ebx
lea ebx, [ebp - 4]
call fcn.0042fb16
push dword [eax]
push 0x60
push str.debugdpi
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esi + 8], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00405980
pop ebx
mov eax, dword [esi + 8]
leave
ret

Function at 0x42fc19
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi + 4], 0xffffffff
jne 0x42fc4f
push ebx
lea ebx, [ebp - 4]
call fcn.0042fb16
push dword [eax]
push 0
push str.debug
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00405980
pop ebx
mov eax, dword [esi + 4]
leave
ret

Function at 0x42fc54
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x51009b
call fcn.0050df3c
push ecx
and dword [ebp - 0x10], 0
push esi
mov esi, ecx
add esi, 0x14
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jne 0x42fcc6
push ebx
lea ebx, [ebp - 0x10]
call fcn.0042fb16
and dword [ebp - 4], 0
push dword [eax]
mov eax, 0x104
push eax
push eax
call fcn.00405ab1
push eax
push str.kxetray
push str.supportprocess
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405980
mov eax, dword [esi]
test eax, eax
pop ebx
je 0x42fcbf
push eax
call fcn.004f0eb4
pop ecx
mov edx, esi
call fcn.00405a78
mov eax, dword [esi]
sub eax, 0x10
call fcn.00405998
mov ecx, dword [ebp - 0xc]
add eax, 0x10
mov dword [edi], eax
mov eax, edi
pop esi
mov dword fs:[0], ecx
leave
ret