joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409ae0
Capabilities:
Copy file
Delete file

Disassembly:
sub esp, 0x28c
mov eax, dword [0x431034]
xor eax, esp
mov dword [esp + 0x288], eax
call fcn.0040b5b0
test eax, eax
je 0x409b06
push 6
push esi
call dword [sym.imp.UxTheme.dll_EnableThemeDialogTexture]
push ebx
push ebp
push edi
call fcn.00409060
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextW]
push eax
push esi
call ebx
push 0x7f01
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
push 0x170
push 0x7d4
push esi
call edi
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call ebp
push 0x432b78
push 0x7d5
push esi
call edi
push eax
call ebx
push 0x275
call fcn.0040ba80
add esp, 4
push eax
push 0x7d6
push esi
call edi
push eax
call ebx
push 0x276
call fcn.0040ba80
push eax
lea eax, [esp + 0x14]
push str._a__s__a_
push eax
call fcn.00409ac0
add esp, 0x10
lea ecx, [esp + 0xc]
push ecx
push 0x7d8
push esi
call edi
push eax
call ebx
push 0x277
call fcn.0040ba80
add esp, 4
push eax
push 0x7d9
push esi
call edi
push eax
call ebx
push 0x27a
call fcn.0040ba80
add esp, 4
push eax
push 0x7da
push esi
call edi
push eax
call ebx
push 0x280
call fcn.0040ba80
add esp, 4
push eax
push 0x7dc
push esi
call edi
push eax
call ebx
push 0
push 0x64
push 0xc5
push 0x7db
push esi
call edi
push eax
call ebp
push 0x281
call fcn.0040ba80
add esp, 4
push eax
push 0x7dd
push esi
call edi
push eax
call ebx
push 0x278
call fcn.0040ba80
add esp, 4
push eax
push 1
push esi
call edi
push eax
call ebx
push 0x279
call fcn.0040ba80
add esp, 4
push eax
push 2
push esi
call edi
push eax
call ebx
lea edx, [esp + 0x8c]
push edx
call fcn.0040fe40
add esp, 4
test eax, eax
je 0x409cac
mov ecx, dword [0x432a6c]
push 0
lea eax, [esp + 0x90]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x409c9e
lea edx, [esp + 0x8c]
push 0x432a5c
push edx
call fcn.00409740
add esp, 8
test eax, eax
je 0x409c9e
push 0x7d7
push esi
call edi
push eax
lea eax, [esp + 0x90]
call fcn.004099c0
add esp, 4
lea eax, [esp + 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call fcn.0040cc90
mov ecx, dword [esp + 0x298]
add esp, 4
pop edi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0040ff55
add esp, 0x28c
ret
Function at 0x409ce0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc28
mov eax, dword [0x431034]
xor eax, esp
mov dword [esp + 0xc24], eax
mov eax, dword [esp + 0xc2c]
push esi
push edi
push 0x3ff
mov edi, ecx
lea ecx, [esp + 0x431]
push 0
push ecx
mov dword [esp + 0x20], eax
mov byte [esp + 0x438], 0
call fcn.00411d90
push 0x3ff
lea edx, [esp + 0x3d]
push 0
push edx
mov byte [esp + 0x44], 0
call fcn.00411d90
lea eax, [esp + 0x30]
push 0
push eax
call fcn.0040dfb0
push 0x432b78
call fcn.0040fa50
mov esi, eax
add esp, 0x24
test esi, esi
je 0x409d7e
push 0x400
lea ecx, [esp + 0x430]
push ecx
push esi
call fcn.0040feb0
add esp, 0xc
test eax, eax
jne 0x409d75
mov byte [esp + 0x42c], al
push esi
call fcn.00410fa2
add esp, 4
mov eax, 0x432a78
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409d86
sub eax, edx
sar eax, 1
jne 0x409dae
push 0x429544
push 0x80
push 0x432a78
call fcn.004105bc
add esp, 0xc
push 0x432a78
call fcn.0040fa50
mov esi, eax
add esp, 4
test esi, esi
je 0x409de5
push 0x400
lea edx, [esp + 0x30]
push edx
push esi
call fcn.0040feb0
add esp, 0xc
test eax, eax
jne 0x409ddc
mov byte [esp + 0x2c], al
push esi
call fcn.00410fa2
add esp, 4
movzx edx, word [0x432a68]
lea eax, [esp + 0x2c]
push eax
movzx eax, word [0x432a66]
lea ecx, [esp + 0x430]
push ecx
movzx ecx, word [0x432a64]
push edx
movzx edx, word [0x432a62]
push eax
movzx eax, word [0x432a5e]
push ecx
movzx ecx, word [0x432a5c]
push edx
push eax
push ecx
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x850]
push str.1__S__04d_02d_02d__02d_02d_02d.dat__s__s
push eax
call fcn.004092b0
push 0x4293a0
lea ecx, [esp + 0x38]
xor esi, esi
push edi
push ecx
mov dword [esp + 0x48], esi
mov dword [esp + 0x40], esi
call fcn.004117a3
add esp, 0x38
test eax, eax
jne 0x409f57
mov edx, dword [esp + 8]
push edx
call fcn.0040a800
mov esi, eax
add esp, 4
test esi, esi
jbe 0x409f2f
push ebx
push ebp
push esi
call fcn.00411613
lea ebx, [esi + esi + 1]
push ebx
mov ebp, eax
call fcn.00411613
add esp, 8
mov edi, eax
test ebp, ebp
je 0x409f20
test edi, edi
je 0x409f17
mov eax, dword [esp + 0x10]
push eax
push 1
push esi
push ebp
call fcn.004115a7
add esp, 0x10
cmp eax, 1
jne 0x409f17
push ebx
push ebp
mov ebx, esi
call fcn.00409a50
add esp, 8
test eax, eax
je 0x409f17
mov ecx, dword [esp + 0x1c]
push 0x429444
push ecx
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], 0
call fcn.004117a3
add esp, 0xc
test eax, eax
jne 0x409f17
mov ecx, dword [esp + 0x14]
push edi
lea eax, [esp + 0x838]
push eax
push 0x429510
push ecx
call fcn.00411c66
add esp, 0x10
test eax, eax
jle 0x409f0a
mov dword [esp + 0x18], 1
mov edx, dword [esp + 0x14]
push edx
call fcn.004110a7
add esp, 4
push ebp
call fcn.00410fa2
add esp, 4
pop ebp
pop ebx
test edi, edi
je 0x409f2f
push edi
call fcn.00410fa2
add esp, 4
mov eax, dword [esp + 8]
push eax
call fcn.004110a7
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
mov ecx, dword [esp + 0xc24]
xor ecx, esp
call fcn.0040ff55
add esp, 0xc28
ret
mov ecx, dword [esp + 0xc2c]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040ff55
add esp, 0xc28
ret
Function at 0x409f70
Capabilities:
Copy file
Delete file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x431034]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
lea eax, [esp + 4]
push eax
xor esi, esi
call fcn.0040fe40
add esp, 4
test eax, eax
je 0x409fe4
mov edx, dword [0x432a6c]
push esi
lea ecx, [esp + 8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x409fd9
push 0x432b78
lea eax, [esp + 8]
push 0x432a5c
push eax
call fcn.00409830
add esp, 0xc
test eax, eax
je 0x409fd9
push edi
lea ecx, [esp + 8]
call fcn.00409ce0
add esp, 4
mov esi, eax
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x20c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040ff55
add esp, 0x20c
ret

Function at 0x40a000
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x46c
mov eax, dword [0x431034]
xor eax, esp
mov dword [esp + 0x468], eax
mov eax, dword [esp + 0x474]
mov eax, dword [eax + 8]
cmp eax, 0xfffffffe
je 0x40a02c
cmp eax, 0xfffffffc
jne 0x40a11f
cmp dword [esp + 0x470], 0x7d8
jne 0x40a11f
push edi
push 0x54
lea ecx, [esp + 0xc]
push 0
push ecx
mov dword [esp + 0x10], 0
call fcn.00411d90
push str.UsbError.dat
mov edi, 0x104
lea edx, [esp + 0x6c]
push edi
push edx
call fcn.004105bc
push 0x58
lea eax, [esp + 0x20]
push 0
push eax
call fcn.00411d90
add esp, 0x24
lea eax, [esp + 4]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x264]
push eax
mov dword [esp + 8], 0x58
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x429550
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x3c], 2
mov dword [esp + 0x44], 0x429548
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
test eax, eax
je 0x40a11e
push 0x80
push 0x432a78
push 0x7db
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea edi, [esp + 0x5c]
call fcn.00409f70
test eax, eax
je 0x40a101
push 0x40
call fcn.00409060
push eax
push 0x27b
jmp 0x40a10e
push 0x10
call fcn.00409060
push eax
push 0x27c
call fcn.0040ba80
add esp, 4
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
mov ecx, dword [esp + 0x468]
xor ecx, esp
xor eax, eax
call fcn.0040ff55
add esp, 0x46c
ret

Function at 0x40a1d0
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x7d2
push esi
mov dword [0x432a70], esi
call edi
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextW]
push 0x429358
push eax
call ebx
call fcn.00409060
push eax
push esi
call ebx
push 0x27f
call fcn.0040ba80
add esp, 4
push eax
push 0x7d3
push esi
call edi
push eax
call ebx
push esi
call fcn.0040cc90
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x40a140
push 0
push 0
call fcn.00411f0b
add esp, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x64
push 0
push 0x406
push 0x7d1
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x64
push 1
push esi
mov dword [0x432a58], 0
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x40a310
Capabilities:
Get graphical window text

Disassembly:
mov eax, ebx
sub eax, 1
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
je 0x40a325
sub eax, 1
je 0x40a378
pop edi
ret
push 0x80
push 0x432a78
push 0x7db
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0
push 0x40a280
push esi
push 0x65
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
test eax, eax
je 0x40a3a8
push 0x40
call fcn.00409060
push eax
push 0x27d
call fcn.0040ba80
add esp, 4
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
push 0
push 0xf0
push 0x7da
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jne 0x40a39e
push eax
call fcn.00409080
add esp, 4
push ebx
push esi
call dword [sym.imp.USER32.dll_EndDialog]
pop edi
ret
push 0x10
call fcn.00409060
push eax
push 0x27e
call fcn.0040ba80
add esp, 4
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
ret

Function at 0x40a480
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [esp + 0x10]
push 0x4293a0
push eax
lea ecx, [esp + 0x18]
xor esi, esi
push ecx
mov dword [edi], esi
mov dword [esp + 0x1c], esi
call fcn.004117a3
add esp, 0xc
test eax, eax
jne 0x40a4ff
mov edx, dword [esp + 0x10]
push edx
call fcn.0040a800
add esp, 4
mov dword [edi], eax
test eax, eax
jle 0x40a4f2
push eax
push 1
call fcn.00411c26
mov esi, eax
add esp, 8
test esi, esi
je 0x40a4f2
mov eax, dword [esp + 0x10]
mov ecx, dword [edi]
push eax
push 1
push ecx
push esi
call fcn.004115a7
add esp, 0x10
cmp eax, 1
je 0x40a4f2
xor esi, esi
push esi
call fcn.00410fa2
add esp, 4
mov dword [edi], esi
mov edx, dword [esp + 0x10]
push edx
call fcn.004110a7
add esp, 4
pop edi
mov eax, esi
pop esi
ret

Function at 0x40a510
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
push 0x429444
push eax
lea ecx, [esp + 0xc]
xor esi, esi
push ecx
mov dword [esp + 0x10], esi
call fcn.004117a3
add esp, 0xc
test eax, eax
jne 0x40a560
mov edx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push edx
push 1
push eax
push ecx
call fcn.00411285
add esp, 0x10
cmp eax, 1
jne 0x40a553
mov esi, eax
mov edx, dword [esp + 4]
push edx
call fcn.004110a7
add esp, 4
mov eax, esi
pop esi
pop ecx
ret
Function at 0x40a880
Capabilities:
Get file version info

Disassembly:
sub esp, 0x818
mov eax, dword [0x431034]
xor eax, esp
mov dword [esp + 0x814], eax
push ebx
mov ebx, dword [esp + 0x824]
push ebp
or eax, 0xffffffff
push esi
push edi
mov edi, dword [esp + 0x82c]
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], eax
mov dword [ebx + 4], eax
mov dword [ebx], eax
lea eax, [esp + 0x14]
push eax
xor ebp, ebp
push edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebp
je 0x40a9a0
push esi
call fcn.0041092f
mov ecx, dword [esp + 0x18]
add esp, 4
mov ebp, eax
push ebp
push esi
push ecx
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40a991
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x20]
push eax
push str.VarFileInfoTranslation
xor edi, edi
push ebp
mov dword [esp + 0x2c], edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
mov eax, dword [esp + 0x1c]
jne 0x40a91a
mov eax, dword [esp + 0x18]
movzx ecx, word [eax + 2]
movzx edx, word [eax]
push ecx
push edx
lea eax, [esp + 0x2c]
push str.StringFileInfo_04x_04xFileVersion
push eax
call fcn.0040a860
add esp, 0x10
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x2c]
push eax
push ebp
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40a991
mov esi, dword [esp + 0x18]
push esi
call fcn.004108ba
push 0x2c
push esi
mov dword [ebx + edi*4], eax
call fcn.004106fe
mov esi, eax
add esp, 0xc
test esi, esi
je 0x40a984
inc edi
add esi, 2
cmp edi, 4
jl 0x40a952
push ebp
call fcn.00410899
mov eax, dword [esp + 0x14]
add esp, 4
jmp 0x40a9a2
cmp edi, 3
jne 0x40a991
mov dword [esp + 0x10], 1
push ebp
call fcn.00410899
mov eax, dword [esp + 0x14]
add esp, 4
jmp 0x40a9a2
mov eax, ebp
mov ecx, dword [esp + 0x824]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040ff55
add esp, 0x818
ret

Function at 0x40aa20
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x48
mov eax, dword [0x431034]
xor eax, esp
mov dword [esp + 0x44], eax
movzx eax, di
push eax
lea ecx, [esp + 0x28]
push str._04x
push ecx
call fcn.0040a9c0
add esp, 0xc
push esi
push 0x10
lea edx, [esp + 0xc]
push edx
push 0x429358
lea eax, [esp + 0x34]
push eax
push str.LocaleID
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 4]
lea edx, [eax + 2]
jmp 0x40aa70
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40aa70
sub eax, edx
sar eax, 1
je 0x40aaa4
push 0x10
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0xc]
push edx
call fcn.004123b9
add esp, 0xc
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.0040ff55
add esp, 0x48
ret
mov ecx, dword [esp + 0x44]
xor ecx, esp
mov ax, di
call fcn.0040ff55
add esp, 0x48
ret
Function at 0x40aac0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x414
mov eax, dword [0x431034]
xor eax, esp
mov dword [esp + 0x410], eax
lea eax, [esp]
push eax
push 0x104
call fcn.0040afe0
add esp, 8
test eax, eax
je 0x40ab38
cmp eax, 0x104
ja 0x40ab38
lea ecx, [esp]
push ecx
lea edx, [esp + 0x20c]
push str._sUsbRemove.ini
push edx
call fcn.0040a9e0
add esp, 0xc
lea eax, [esp + 0x208]
push eax
push 0xffffffffffffffff
push str.UsbStart
push str.Language
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.0040ff55
add esp, 0x414
ret
mov ecx, dword [esp + 0x410]
xor ecx, esp
xor eax, eax
call fcn.0040ff55
add esp, 0x414
ret

Function at 0x40ab50
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x220
mov eax, dword [0x431034]
xor eax, esp
mov dword [esp + 0x21c], eax
push str.SoftwareContentGuard
lea eax, [esp + 0x18]
push 0x104
push eax
mov dword [esp + 0xc], 0
call fcn.004105bc
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 8]
push edx
push 0
push 0xf003f
push 0
push 0x429358
push 0
lea eax, [esp + 0x30]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40abe9
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 4]
push edx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push 0
push str.USBSTART_LANGUAGE
push ecx
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x21c]
mov eax, dword [esp]
xor ecx, esp
call fcn.0040ff55
add esp, 0x220
ret

Function at 0x40ac10
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x42844b
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x431034]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
push edi
mov eax, dword [0x431034]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
mov esi, dword [esp + 0x230]
call fcn.0040aac0
test eax, eax
jge 0x40ace8
lea ecx, [esp + 0xc]
call fcn.0040f5a0
movzx eax, word [esi]
push eax
lea ecx, [esp + 0x18]
push str.._c:
push ecx
mov dword [esp + 0x234], 0
call fcn.0040a9e0
add esp, 0xc
push SysReAllocString
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x14]
call fcn.0040f5b0
test eax, eax
je 0x40acbd
lea ecx, [esp + 0xc]
call fcn.0040f610
lea ecx, [esp + 0xc]
mov edi, eax
call fcn.0040f5e0
test edi, edi
je 0x40acbd
call fcn.0040ab50
jmp 0x40acd0
push esi
push 0
push str.UsbStart
push str.Language
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x228], 0xffffffff
call fcn.0040f630
mov eax, esi
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0040ff55
add esp, 0x220
ret
Function at 0x40ad10
Capabilities:
Identify system language via api
Read .ini file

Disassembly:
sub esp, 0x834
mov eax, dword [0x431034]
xor eax, esp
mov dword [esp + 0x830], eax
push ebx
mov ebx, dword [esp + 0x840]
push ebp
mov ebp, dword [esp + 0x840]
push esi
push edi
push ebp
push str._1.1s:.cfgLanguage.cfg
lea eax, [esp + 0x28]
push 0x104
push eax
call fcn.00410301
push ebp
push str._s.cfgLanguage.cfg
lea ecx, [esp + 0x240]
push 0x104
push ecx
call fcn.00410301
lea edx, [esp + 0x40]
push edx
call fcn.0040ac10
add esp, 0x24
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx edi, ax
lea eax, [esp + 0x228]
push 0
push eax
call fcn.00410a1d
add esp, 8
test eax, eax
jne 0x40aeb4
cmp dword [esp + 0x850], eax
jne 0x40aeb4
test esi, esi
jne 0x40ade4
lea esi, [esp + 0x228]
call fcn.0040aa20
movzx eax, ax
movzx ecx, ax
push ecx
push ebp
push str._s.cfg_04x.cfg
push 0x104
push ebx
call fcn.00410301
push 0
push ebx
call fcn.00410a1d
add esp, 0x1c
test eax, eax
je 0x40afbc
mov edx, esi
jmp 0x40afad
movzx eax, di
push eax
push str._04x.cfg
lea ecx, [esp + 0x640]
push 0x104
push ecx
call fcn.00410301
push esi
lea edx, [esp + 0x24]
push 0x4297f0
push edx
call fcn.0040aa00
add esp, 0x1c
lea eax, [esp + 0x228]
push eax
push 0x104
lea ecx, [esp + 0x438]
push ecx
push 0x429358
lea edx, [esp + 0x20]
push edx
push str.File
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x430]
push eax
push ebp
push str._s.cfg_s
push 0x104
push ebx
call fcn.00410301
push 0
push ebx
call fcn.00410a1d
add esp, 0x1c
test eax, eax
je 0x40ae7a
lea ecx, [esp + 0x228]
push ecx
push 0x104
push ebx
call fcn.004105bc
add esp, 0xc
lea edx, [esp + 0x638]
push edx
lea eax, [esp + 0x434]
push eax
call fcn.004124f5
add esp, 8
test eax, eax
je 0x40afbc
call fcn.0040aac0
test eax, eax
jge 0x40afbc
lea ecx, [esp + 0x228]
push ecx
jmp 0x40afae
test esi, esi
jne 0x40aef4
lea esi, [esp + 0x20]
call fcn.0040aa20
movzx eax, ax
movzx edx, ax
push edx
push ebp
push str._1.1s:.cfg_04x.cfg
push 0x104
push ebx
call fcn.00410301
push 0
push ebx
call fcn.00410a1d
add esp, 0x1c
test eax, eax
je 0x40afbc
mov eax, esi
push eax
jmp 0x40afae
movzx ecx, di
push ecx
push str._04x.cfg
lea edx, [esp + 0x640]
push 0x104
push edx
call fcn.00410301
push esi
lea eax, [esp + 0x24]
push 0x4297f0
push eax
call fcn.0040aa00
add esp, 0x1c
lea ecx, [esp + 0x20]
push ecx
push 0x104
lea edx, [esp + 0x438]
push edx
push 0x429358
lea eax, [esp + 0x20]
push eax
push str.File
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esp + 0x430]
push ecx
push ebp
push str._1.1s:.cfg_s
push 0x104
push ebx
call fcn.00410301
push 0
push ebx
call fcn.00410a1d
add esp, 0x1c
test eax, eax
je 0x40af84
lea edx, [esp + 0x20]
push edx
push 0x104
push ebx
call fcn.004105bc
add esp, 0xc
lea eax, [esp + 0x638]
push eax
lea ecx, [esp + 0x434]
push ecx
call fcn.004124f5
add esp, 8
test eax, eax
je 0x40afbc
call fcn.0040aac0
test eax, eax
jge 0x40afbc
lea edx, [esp + 0x20]
push edx
push 0x104
push ebx
call fcn.004105bc
add esp, 0xc
mov ecx, dword [esp + 0x840]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040ff55
add esp, 0x834
ret
Function at 0x40afe0
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
sub esp, 0x418
mov eax, dword [0x431034]
xor eax, esp
mov dword [esp + 0x414], eax
push ebx
mov ebx, dword [esp + 0x424]
push esi
push 0x206
xor esi, esi
lea ecx, [esp + 0x21a]
xor eax, eax
push esi
push ecx
mov word [esp + 0x220], ax
call fcn.00411d90
push 0x206
lea eax, [esp + 0x1e]
xor edx, edx
push esi
push eax
mov word [esp + 0x24], dx
call fcn.00411d90
add esp, 0x18
lea ecx, [esp + 8]
push ecx
push 0x1c
push esi
mov dword [esp + 0x14], esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x40b127
mov eax, dword [esp + 8]
push ebp
push edi
lea edx, [esp + 0x21c]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea edx, [esp + 0x21c]
push edx
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40b09d
push esi
lea eax, [esp + 0x220]
push eax
call edi
test eax, eax
je 0x40b123
push 0x42988c
lea ecx, [esp + 0x220]
push ecx
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x40b123
lea eax, [esp + 0x14]
push eax
call ebp
test eax, eax
jne 0x40b0d0
push eax
lea ecx, [esp + 0x18]
push ecx
call edi
test eax, eax
je 0x40b123
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x40b123
push 0x429888
lea eax, [esp + 0x18]
push 0x104
push eax
call fcn.0041053f
mov ecx, dword [esp + 0x438]
add esp, 0xc
push ecx
push ebx
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
pop edi
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.0040ff55
add esp, 0x418
ret
mov eax, esi
jmp 0x40b10a
mov ecx, dword [esp + 0x41c]
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.0040ff55
add esp, 0x418
ret
Function at 0x40b160
Capabilities:
Check http status code
Read data from internet
Receive data

Disassembly:
mov eax, 0x2018
call fcn.00412600
mov eax, dword [0x431034]
xor eax, esp
mov dword [esp + 0x2014], eax
push ebx
xor ebx, ebx
push ebx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0x20000013
push edi
mov dword [esp + 0x20], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x40b1b6
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2014]
xor ecx, esp
call fcn.0040ff55
add esp, 0x2018
ret
cmp dword [esp + 8], 0xc8
jne 0x40b19e
push ebp
push esi
push 0x1000
lea edx, [esp + 0x1021]
push ebx
push edx
mov byte [esp + 0x1028], bl
call fcn.00411d90
mov ebp, dword [sym.imp.WININET.dll_InternetReadFile]
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push 0x1000
lea ecx, [esp + 0x20]
push ecx
push edi
mov dword [esp + 0x1c], ebx
call ebp
test eax, eax
je 0x40b278
nop
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x40b292
mov byte [esp + eax + 0x18], bl
lea eax, [esp + 0x101c]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40b220
sub eax, edx
mov edx, eax
lea eax, [esp + 0x18]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40b232
sub eax, esi
add eax, edx
cmp eax, 0x1000
ja 0x40b278
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x1020]
push 0x1001
push eax
call fcn.00412588
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 0x1000
lea edx, [esp + 0x20]
push edx
push edi
mov dword [esp + 0x1c], ebx
call ebp
test eax, eax
jne 0x40b200
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2014]
xor ecx, esp
call fcn.0040ff55
add esp, 0x2018
ret
mov edx, str.SUCCESS
lea ecx, [esp + 0x101c]
mov edi, edi
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x40b2df
cmp al, bl
je 0x40b2bc
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x40b2df
add ecx, 2
add edx, 2
cmp al, bl
jne 0x40b2a0
xor eax, eax
xor ecx, ecx
cmp eax, ebx
sete cl
pop esi
pop ebp
pop ebx
mov eax, ecx
mov ecx, dword [esp + 0x2014]
xor ecx, esp
call fcn.0040ff55
add esp, 0x2018
ret
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
cmp eax, ebx
sete cl
pop esi
pop ebp
pop ebx
mov eax, ecx
mov ecx, dword [esp + 0x2014]
xor ecx, esp
call fcn.0040ff55
add esp, 0x2018
ret