joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409730
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61b5cb
mov eax, dword fs:[0]
push eax
sub esp, 0x81c
mov eax, dword [0x68d9ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x828], edi
cmp word [0x699de8], 0
jne 0x40986a
push 0x20219
push str.SOFTWAREJianDesk
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x824]
mov dword [ebp - 0x824], 0
mov dword [ebp - 0x820], 0
mov dword [ebp - 0x81c], 0
call fcn.0040a550
mov ebx, dword [ebp - 0x824]
test eax, eax
jne 0x40985f
lea eax, [ebp - 0x814]
mov dword [ebp - 0x814], 0x800
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x818]
push eax
push 0
push str.FROM
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40985f
mov eax, dword [ebp - 0x818]
cmp eax, 1
je 0x4097fc
cmp eax, 2
jne 0x40985f
mov eax, dword [ebp - 0x814]
test eax, eax
je 0x409819
test al, 1
jne 0x40985f
shr eax, 1
cmp word [ebp + eax*2 - 0x812], 0
je 0x409822
jmp 0x40985f
xor eax, eax
mov word [ebp - 0x810], ax
mov ecx, 0x699de8
lea esi, [ebp - 0x810]
mov edx, 0x3ff
sub esi, ecx
lea eax, [edx + 0x7ffffbff]
test eax, eax
je 0x409852
movzx eax, word [esi + ecx]
test ax, ax
je 0x409852
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x409834
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
test ebx, ebx
je 0x40986a
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00407320
mov ecx, eax
test ecx, ecx
je 0x4098da
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
push 0x699de8
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.00408fd0
test al, al
jne 0x4098bc
mov ecx, 0x699de8
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4098a0
sub ecx, edx
sar ecx, 1
push ecx
push 0x699de8
mov ecx, edi
call fcn.0040b130
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f9a43
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00407030
int3
Function at 0x4098f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61b5cb
mov eax, dword fs:[0]
push eax
sub esp, 0x81c
mov eax, dword [0x68d9ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x828], edi
cmp word [0x69b5e8], 0
jne 0x409a2a
push 0x20219
push str.SOFTWAREJianDesk
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x824]
mov dword [ebp - 0x824], 0
mov dword [ebp - 0x820], 0
mov dword [ebp - 0x81c], 0
call fcn.0040a550
mov ebx, dword [ebp - 0x824]
test eax, eax
jne 0x409a1f
lea eax, [ebp - 0x814]
mov dword [ebp - 0x814], 0x800
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x818]
push eax
push 0
push str.Setup_Path
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x409a1f
mov eax, dword [ebp - 0x818]
cmp eax, 1
je 0x4099bc
cmp eax, 2
jne 0x409a1f
mov eax, dword [ebp - 0x814]
test eax, eax
je 0x4099d9
test al, 1
jne 0x409a1f
shr eax, 1
cmp word [ebp + eax*2 - 0x812], 0
je 0x4099e2
jmp 0x409a1f
xor eax, eax
mov word [ebp - 0x810], ax
mov ecx, 0x69b5e8
lea esi, [ebp - 0x810]
mov edx, 0x3ff
sub esi, ecx
lea eax, [edx + 0x7ffffbff]
test eax, eax
je 0x409a12
movzx eax, word [esi + ecx]
test ax, ax
je 0x409a12
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x4099f4
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
test ebx, ebx
je 0x409a2a
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00407320
mov ecx, eax
test ecx, ecx
je 0x409a9a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
push 0x69b5e8
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.00408fd0
test al, al
jne 0x409a7c
mov ecx, 0x69b5e8
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409a60
sub ecx, edx
sar ecx, 1
push ecx
push 0x69b5e8
mov ecx, edi
call fcn.0040b130
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f9a43
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00407030
int3
Function at 0x40a1d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61b5cb
mov eax, dword fs:[0]
push eax
sub esp, 0x81c
mov eax, dword [0x68d9ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x828], ebx
cmp word [0x6995e8], 0
jne 0x40a30a
push 0x20219
push str.SOFTWAREJianDesk
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x824]
mov dword [ebp - 0x824], 0
mov dword [ebp - 0x820], 0
mov dword [ebp - 0x81c], 0
call fcn.0040a550
mov edi, dword [ebp - 0x824]
test eax, eax
jne 0x40a2ff
lea eax, [ebp - 0x814]
mov dword [ebp - 0x814], 0x800
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x818]
push eax
push 0
push 0x62eedc
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40a2ff
mov eax, dword [ebp - 0x818]
cmp eax, 1
je 0x40a29c
cmp eax, 2
jne 0x40a2ff
mov eax, dword [ebp - 0x814]
test eax, eax
je 0x40a2b9
test al, 1
jne 0x40a2ff
shr eax, 1
cmp word [ebp + eax*2 - 0x812], 0
je 0x40a2c2
jmp 0x40a2ff
xor eax, eax
mov word [ebp - 0x810], ax
mov ecx, 0x6995e8
lea esi, [ebp - 0x810]
mov edx, 0x3ff
sub esi, ecx
lea eax, [edx + 0x7ffffbff]
test eax, eax
je 0x40a2f2
movzx eax, word [esi + ecx]
test ax, ax
je 0x40a2f2
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x40a2d4
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
test edi, edi
je 0x40a30a
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x6995e8
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jg 0x40a35b
mov ecx, 0x6995e8
mov esi, str.noset
mov edx, 0x3ff
sub esi, ecx
nop word [eax + eax]
lea eax, [edx + 0x7ffffbff]
test eax, eax
je 0x40a34e
movzx eax, word [esi + ecx]
test ax, ax
je 0x40a34e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x40a330
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
call fcn.00407320
mov ecx, eax
test ecx, ecx
je 0x40a3ca
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
push 0x6995e8
mov ecx, ebx
mov dword [ebp - 4], 0
call fcn.00408fd0
test al, al
jne 0x40a3ac
mov ecx, 0x6995e8
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a390
sub ecx, edx
sar ecx, 1
push ecx
push 0x6995e8
mov ecx, ebx
call fcn.0040b130
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f9a43
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00407030
int3
Function at 0x40bd30
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x68d9ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x69bef4]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x210], esi
test al, 1
jne 0x40bd87
or eax, 1
mov dword [0x69bef4], eax
call fcn.00407320
mov ecx, eax
test ecx, ecx
je 0x40be6c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
push 0x62c6a0
mov dword [0x69bef0], eax
call fcn.004f9d2c
add esp, 4
mov eax, dword [0x69bef0]
cmp dword [eax - 0xc], 0
jne 0x40be4f
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.005e3240
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.JianDeskData
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40bdf3
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push str.Config.ini
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40be3e
push eax
push 0x80
push 2
push eax
push eax
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x40be3e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
mov ecx, 0x69bef0
push eax
call fcn.0040b930
push 0x69bef0
mov ecx, esi
call fcn.00408560
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004f9a43
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00407030
int3
Function at 0x40ccf0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61bab3
mov eax, dword fs:[0]
push eax
sub esp, 0x150
mov eax, dword [0x68d9ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
push 0x80
mov dword [ebp - 0xb4], eax
lea eax, [ebp - 0x90]
push 0
push eax
mov dword [ebp - 0xb0], 0
mov byte [ebp - 0xa9], 0
call fcn.005e3240
add esp, 0xc
lea eax, [ebp - 0x90]
push dword [esi + 4]
push 0x3f
push eax
push edi
push ebx
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x90], 0
je 0x40ce7b
xor eax, eax
mov dword [ebp - 0x98], 0
mov word [ebp - 0xa8], ax
lea eax, [ebp - 0x90]
mov dword [ebp - 0x94], 7
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40cda3
sub eax, edx
lea ecx, [ebp - 0xa8]
sar eax, 1
push eax
lea eax, [ebp - 0x90]
push eax
call fcn.00417880
mov dword [ebp - 4], 0
mov dword [ebp - 0x15c], 0x62fd00
mov dword [ebp - 0xfc], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
push 0
push 0
lea eax, [ebp - 0x14c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x15c]
mov dword [ebp - 0xb0], 1
call fcn.0040de50
mov eax, dword [ebp - 0x15c]
push 1
mov dword [ebp - 4], 2
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_istringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [ebp - 0x15c]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ebp + ecx - 0x160], eax
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0x14c]
call fcn.0040e480
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 4
call fcn.0040eec0
push dword [ebp - 0xb4]
lea eax, [ebp - 0x15c]
push eax
call fcn.0040c7a0
add esp, 8
lea ecx, [ebp - 0x15c]
mov bl, 1
call fcn.0040f6c0
mov al, bl
jmp 0x40ce81
mov al, byte [ebp - 0xa9]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f9a43
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40e5e0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61bdb9
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x68d9ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x220], esi
call fcn.00407320
mov ecx, eax
test ecx, ecx
je 0x40e756
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0
call fcn.00407320
mov ecx, eax
test ecx, ecx
je 0x40e760
mov eax, dword [ecx]
call dword [eax + 0xc]
lea ecx, [eax + 0x10]
mov dword [esi + 4], ecx
mov eax, dword [esi]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov byte [ebp - 4], 1
cmp dword [eax - 0xc], 0
jne 0x40e6be
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.005e3240
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.config.ini
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00412e50
mov ecx, dword [esi + 4]
cmp dword [ecx - 0xc], 0
jne 0x40e738
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.005e3240
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.jiandeskData
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40e71b
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push str.config.ini
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
lea ecx, [esi + 4]
call fcn.00412e50
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f9a43
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00407030
push 0x80004005
call fcn.00407030
int3
Function at 0x40fd60
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61c008
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x68d9ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push dword [esi + 4]
mov edi, dword [ebp + 8]
push 0
push dword [edi]
push str.CoreFuncCount
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebx, eax
call fcn.00407320
mov ecx, eax
test ecx, ecx
je 0x40fe15
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
inc ebx
mov dword [ebp - 4], 0
push ebx
lea eax, [ebp + 8]
push 0x62f094
push eax
call fcn.00407230
add esp, 0xc
push dword [esi + 4]
mov esi, dword [ebp + 8]
push esi
push dword [edi]
push str.CoreFuncCount
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40fe01
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00407030
int3

Function at 0x40fe20
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61c03b
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x68d9ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x21c], esi
call fcn.005e3240
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.PluginCfg
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40feb2
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push str.lockscreenfix.ini
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.00407320
mov ecx, eax
test ecx, ecx
je 0x40ff1e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
mov ecx, esi
test eax, 0xffff0000
jne 0x40fefa
movzx eax, ax
push eax
call fcn.00407760
jmp 0x40ff00
push eax
call fcn.00412e50
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f9a43
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00407030
int3
Function at 0x40ffb0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61c07b
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x68d9ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x21c], edi
call fcn.005e3240
add esp, 0xc
lea eax, [ebp - 0x218]
push dword [esi + 4]
push 0x104
push eax
push 0x62f1a8
push 0x62f480
push 0x62f470
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.00407320
mov ecx, eax
test ecx, ecx
je 0x41007d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
mov ecx, edi
test eax, 0xffff0000
jne 0x410058
movzx eax, ax
push eax
call fcn.00407760
jmp 0x41005e
push eax
call fcn.00412e50
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f9a43
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00407030
int3

Function at 0x410190
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61c0b8
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x68d9ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x4c]
push 0x3c
push 0
push eax
mov dword [ebp - 0x50], edi
call fcn.005e3240
add esp, 0xc
lea eax, [ebp - 0x4c]
push dword [esi + 4]
push 0xb
push eax
push 0
push str.check_time_linkacc
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.00407320
mov ecx, eax
test ecx, ecx
je 0x410245
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 4], 0
mov ecx, edi
test eax, 0xffff0000
jne 0x410220
movzx eax, ax
push eax
call fcn.00407760
jmp 0x410226
push eax
call fcn.00412e50
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f9a43
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00407030
int3
Function at 0x410250
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61c0b8
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x68d9ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x4c]
push 0x3c
push 0
push eax
mov dword [ebp - 0x50], edi
call fcn.005e3240
add esp, 0xc
lea eax, [ebp - 0x4c]
push dword [esi + 4]
push 0xb
push eax
push 0
push str.check_time_mbtry
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.00407320
mov ecx, eax
test ecx, ecx
je 0x410305
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 4], 0
mov ecx, edi
test eax, 0xffff0000
jne 0x4102e0
movzx eax, ax
push eax
call fcn.00407760
jmp 0x4102e6
push eax
call fcn.00412e50
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f9a43
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00407030
int3

Function at 0x410310
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61c0b8
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x68d9ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x4c]
push 0x3c
push 0
push eax
mov dword [ebp - 0x50], edi
call fcn.005e3240
add esp, 0xc
lea eax, [ebp - 0x4c]
push dword [esi + 4]
push 0xb
push eax
push 0
push str.check_time_outdate
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.00407320
mov ecx, eax
test ecx, ecx
je 0x4103c5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 4], 0
mov ecx, edi
test eax, 0xffff0000
jne 0x4103a0
movzx eax, ax
push eax
call fcn.00407760
jmp 0x4103a6
push eax
call fcn.00412e50
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f9a43
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00407030
int3
Function at 0x4103d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61c07b
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x68d9ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x21c], edi
call fcn.005e3240
add esp, 0xc
lea eax, [ebp - 0x218]
push dword [esi + 4]
push 0x104
push eax
push 0x62f1a8
push str.LastNewVersion
push str.UpdateOnline
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.00407320
mov ecx, eax
test ecx, ecx
je 0x41049d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
mov ecx, edi
test eax, 0xffff0000
jne 0x410478
movzx eax, ax
push eax
call fcn.00407760
jmp 0x41047e
push eax
call fcn.00412e50
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f9a43
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00407030
int3

Function at 0x4104d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp - 4]
push eax
call fcn.0040fe20
push dword [ebp - 4]
push 1
push str.lock_screen_state
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
mov eax, dword [ebp - 4]
setne bl
add eax, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x410513
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4105c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61c07b
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x68d9ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x21c], edi
call fcn.005e3240
add esp, 0xc
lea eax, [ebp - 0x218]
push dword [esi + 4]
push 0x104
push eax
push 0x62f1a8
push 0x62f45c
push 0x62f470
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.00407320
mov ecx, eax
test ecx, ecx
je 0x41068d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
mov ecx, edi
test eax, 0xffff0000
jne 0x410668
movzx eax, ax
push eax
call fcn.00407760
jmp 0x41066e
push eax
call fcn.00412e50
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f9a43
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00407030
int3