joyce8/EMBER2024-capa huggingface dataset:
Function at 0x474440
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x30
push esi
push edi
push 0
push 0x4743e0
push 0
push 0
mov dword [0x6551e4], 0
call dword [sym.imp.USER32.dll_EnumDisplayMonitors]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea eax, [esp + 0xc]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [esp + 0x18]
push ecx
push eax
call edi
lea edx, [esp + 0x28]
push edx
push esi
call edi
mov eax, dword [esp + 0x10]
mov ecx, dword [0x6551e4]
sub eax, dword [esp + 8]
cmp ecx, 1
jle 0x4744d2
test ecx, ecx
jle 0x4744d2
mov edx, 0x655118
mov esi, ecx
mov ecx, dword [edx]
cmp ecx, eax
jle 0x4744ca
mov eax, ecx
add edx, 0x10
sub esi, 1
jne 0x4744c2
pop edi
pop esi
add esp, 0x30
ret

Function at 0x474550
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x30
push esi
push edi
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [esp + 8]
push ecx
push eax
call edi
lea edx, [esp + 0x28]
push edx
push esi
call edi
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 8]
pop edi
pop esi
add esp, 0x30
ret

Function at 0x4745a0
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x30
push esi
push edi
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [esp + 8]
push ecx
push eax
call edi
lea edx, [esp + 0x28]
push edx
push esi
call edi
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0xc]
pop edi
pop esi
add esp, 0x30
ret

Function at 0x4745f0
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x30
push esi
push edi
push 0
lea eax, [esp + 0xc]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [esp + 0x18]
push ecx
push eax
call edi
lea edx, [esp + 0x28]
push edx
push esi
call edi
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0xc]
pop edi
pop esi
add esp, 0x30
ret
Function at 0x474f80
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
sub esp, 0x414
mov eax, dword [0x651788]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
push edi
xor esi, esi
push 0x206
lea eax, [esp + 0xe]
push esi
push eax
mov edi, ecx
mov word [esp + 0x14], si
call fcn.004afb50
push 0x206
lea ecx, [esp + 0x222]
push esi
push ecx
mov word [esp + 0x228], si
call fcn.004afb50
add esp, 0x18
push esi
push 0x2b
lea edx, [esp + 0x10]
push edx
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 8]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, si
jne 0x474fe3
mov ecx, dword [str._shiqiang_]
mov edx, dword [0x582824]
mov dword [eax], ecx
mov ecx, dword [0x582828]
mov dword [eax + 4], edx
mov edx, dword [0x58282c]
mov dword [eax + 8], ecx
mov ecx, dword [0x582830]
mov dword [eax + 0xc], edx
mov dx, word [0x582834]
mov dword [eax + 0x10], ecx
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov word [eax + 0x14], dx
lea eax, [esp + 0xc]
push eax
call ebx
test eax, eax
jne 0x475044
push esi
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
jmp 0x475050
movzx ecx, word [esp + eax + 0xc]
mov word [esp + eax + 0x214], cx
add eax, 2
cmp cx, si
jne 0x475050
lea eax, [esp + 0x214]
add eax, 0xfffffffe
nop
mov cx, word [eax + 2]
add eax, 2
cmp cx, si
jne 0x475070
mov edx, dword [str.wnsoft.ini]
mov ecx, dword [0x58280c]
mov dword [eax], edx
mov edx, dword [0x582810]
mov dword [eax + 4], ecx
mov ecx, dword [0x582814]
mov dword [eax + 8], edx
mov edx, dword [0x582818]
mov dword [eax + 0xc], ecx
mov cx, word [0x58281c]
mov dword [eax + 0x10], edx
lea edx, [esp + 0xc]
push edx
mov word [eax + 0x14], cx
call ebx
test eax, eax
pop ebx
je 0x475132
mov ecx, dword [edi]
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [esp + 0x210]
push eax
push ecx
push str.OnlyIdentifier1
push str.Globals
call esi
mov eax, dword [edi]
lea edx, [esp + 0x210]
push edx
add eax, 0x208
push eax
push str.OnlyIdentifier2
push str.Globals
call esi
mov edx, dword [edi]
lea ecx, [esp + 0x210]
push ecx
add edx, 0x410
push edx
push str.OnlyIdentifier3
push str.Globals
call esi
mov ecx, dword [edi]
lea eax, [esp + 0x210]
push eax
add ecx, 0x618
push ecx
push 0x582788
push str.Globals
call esi
mov ecx, dword [esp + 0x418]
pop edi
pop esi
xor ecx, esp
call fcn.004aeca3
add esp, 0x414
ret
Function at 0x475150
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str.software
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x47522e
mov edx, dword [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
push eax
push 0xf003f
push eax
push eax
push eax
push str.ShiQiang
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x47522e
mov eax, dword [esi]
mov ecx, dword [esp + 4]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x104
push eax
push 1
push 0
push str.OnlyIdentifier1
push ecx
call edi
mov edx, dword [esi]
mov eax, dword [esp + 8]
push 0x104
add edx, 0x208
push edx
push 1
push 0
push str.OnlyIdentifier2
push eax
call edi
mov ecx, dword [esi]
mov edx, dword [esp + 8]
push 0x104
add ecx, 0x410
push ecx
push 1
push 0
push str.OnlyIdentifier3
push edx
call edi
mov eax, dword [esi]
mov ecx, dword [esp + 8]
push 0x104
add eax, 0x618
push eax
push 1
push 0
push 0x582788
push ecx
call edi
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
mov eax, dword [esp + 0xc]
push eax
call esi
pop edi
pop esi
add esp, 8
ret

Function at 0x475a50
Capabilities:
Get common file path
Get disk information

Disassembly:
sub esp, 0x63c
mov eax, dword [0x651788]
xor eax, esp
mov dword [esp + 0x638], eax
push esi
xor eax, eax
push edi
mov edi, dword [esp + 0x648]
xor esi, esi
push 0x206
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov word [esp + 0x2a], ax
lea eax, [esp + 0x2e]
push esi
push eax
mov word [esp + 0x20], si
mov word [esp + 0x34], si
call fcn.004afb50
add esp, 0xc
push 0x104
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 3
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.004b4674
push 0x206
lea ecx, [esp + 0x44a]
push esi
push ecx
mov word [esp + 0x450], si
call fcn.004afb50
push 0x206
lea edx, [esp + 0x24e]
push esi
push edx
mov word [esp + 0x254], si
call fcn.004afb50
add esp, 0x24
push 0x104
lea eax, [esp + 0x234]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
push 0x104
lea ecx, [esp + 0x450]
push ecx
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x28], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x475b56
mov eax, dword [esp + 8]
push eax
push str._08X
push edi
call fcn.00405340
add esp, 0xc
jmp 0x475b6f
mov eax, 0x5a6624
mov edx, edi
sub edx, eax
nop
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, si
jne 0x475b60
mov ecx, dword [esp + 0x640]
pop edi
pop esi
xor ecx, esp
call fcn.004aeca3
add esp, 0x63c
ret 4
Function at 0x4773f0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x55ddab
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x651788]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
push 0x54
call fcn.00492548
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
mov dword [esp + 0x1c], 0
je 0x477439
mov ecx, eax
call fcn.00476e90
jmp 0x47743b
xor eax, eax
mov edi, dword [esp + 0x24]
mov ecx, edi
mov dword [esp + 0x1c], 0xffffffff
mov dword [esi + 0x78], eax
lea ebp, [ecx + 1]
nop
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x477450
sub ecx, ebp
push ecx
push edi
lea ecx, [eax + 8]
call fcn.00401f00
mov eax, dword [esi + 0x78]
mov dword [eax + 4], 0
mov ecx, dword [esi + 0x78]
push 9
push str.GET_test1
add ecx, 0x34
call fcn.00401f00
lea ecx, [esi + 0x14]
push ecx
push 0
push esi
push 0x477240
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x18], eax
je 0x4774ac
cmp eax, 0xffffffff
je 0x4774ac
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret 4
Function at 0x47e1c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov ecx, dword [esp + 0x14]
push ebp
mov ebp, dword [ecx]
mov ecx, dword [esp + 0x10]
xor eax, eax
and ebp, 7
cmp ecx, 5
jae 0x47e1d9
pop ebp
pop ecx
ret
mov edx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x1c]
add esi, 5
lea edx, [edx + ecx - 4]
push edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x10], edx
jmp 0x47e200
mov ecx, dword [esp + 0x18]
lea edi, [eax + ecx]
cmp edi, edx
jae 0x47e21f
jmp 0x47e210
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x47e21f
add edi, 1
cmp edi, edx
jb 0x47e210
mov eax, edi
sub eax, ecx
mov ecx, eax
sub ecx, dword [esp + 0x1c]
cmp edi, edx
jae 0x47e335
cmp ecx, 3
jbe 0x47e255
xor ebp, ebp
mov cl, byte [edi + 4]
test cl, cl
mov dword [esp + 0x1c], eax
je 0x47e293
cmp cl, 0xff
je 0x47e293
and ebp, 3
add ebp, ebp
or ebp, 1
add eax, 1
jmp 0x47e200
add ecx, 0xffffffff
shl ebp, cl
and ebp, 7
je 0x47e238
movzx ecx, byte [ebp + 0x582ec4]
mov ebx, edi
sub ebx, ecx
cmp byte [ebp + 0x582ebc], 0
mov cl, byte [ebx + 4]
je 0x47e27f
test cl, cl
je 0x47e27f
cmp cl, 0xff
jne 0x47e238
and ebp, 3
add ebp, ebp
mov dword [esp + 0x1c], eax
or ebp, 1
add eax, 1
jmp 0x47e200
xor edx, edx
mov dh, cl
movzx ecx, byte [edi + 2]
mov dl, byte [edi + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, ecx
lea esp, [esp]
cmp dword [esp + 0x28], 0
je 0x47e2be
lea ebx, [edx + eax]
add ebx, esi
jmp 0x47e2c4
sub edx, eax
sub edx, esi
mov ebx, edx
test ebp, ebp
je 0x47e306
movzx esi, byte [ebp + 0x582ec4]
add esi, esi
add esi, esi
add esi, esi
mov ecx, 0x18
sub ecx, esi
mov edx, ebx
shr edx, cl
test dl, dl
je 0x47e2e9
cmp dl, 0xff
jne 0x47e302
mov ecx, 0x20
sub ecx, esi
mov esi, dword [esp + 0x20]
mov edx, 1
shl edx, cl
sub edx, 1
xor edx, ebx
jmp 0x47e2b0
mov esi, dword [esp + 0x20]
mov edx, ebx
shr edx, 0x18
and dl, 1
sub dl, 1
not dl
mov byte [edi + 4], dl
mov edx, ebx
shr edx, 8
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 2], dl
mov edx, dword [esp + 0x10]
mov byte [edi + 3], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x47e200
cmp ecx, 3
pop edi
pop esi
pop ebx
jbe 0x47e348
mov ecx, dword [esp + 0x18]
xor ebp, ebp
mov dword [ecx], ebp
pop ebp
pop ecx
ret
add ecx, 0xffffffff
shl ebp, cl
mov ecx, dword [esp + 0x18]
and ebp, 7
mov dword [ecx], ebp
pop ebp
pop ecx
ret
Function at 0x482450
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
sub eax, 1
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x655550], ecx
add edx, 1
cmp edx, 0x100
jb 0x482452
cmp edx, 0x800
jae 0x48253b
mov edi, edi
mov eax, dword [edx*4 + 0x655150]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x655550]
add edx, 1
cmp edx, 0x800
mov dword [edx*4 + 0x65554c], eax
jb 0x482510
mov dword [0x657550], 0x47e540
call fcn.0047e480
test eax, eax
jne 0x482558
mov dword [0x657550], 0x47e5f0
ret
Function at 0x483c30
Capabilities:
Check if file exists
Copy file
Read .ini file

Disassembly:
call fcn.00483b90
mov ecx, eax
jmp fcn.00484db0

Function at 0x483c80
Capabilities:
Copy file

Disassembly:
call fcn.00483b90
mov ecx, eax
jmp fcn.00484020
Function at 0x484380
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x420
mov eax, dword [0x651788]
xor eax, esp
mov dword [esp + 0x41c], eax
push ebx
push ebp
push esi
push edi
xor esi, esi
push 0x206
lea eax, [esp + 0x22a]
push esi
push eax
mov ebp, ecx
mov word [esp + 0x230], si
call fcn.004afb50
push 0x206
lea ecx, [esp + 0x2e]
push esi
push ecx
mov word [esp + 0x34], si
call fcn.004afb50
mov esi, dword [ebp + 0x24]
mov edx, dword [esi + 4]
mov ebx, dword [edx]
add esp, 0x18
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], esi
nop
test esi, esi
mov eax, dword [ebp + 0x24]
mov edi, dword [eax + 4]
je 0x4843ee
cmp esi, eax
je 0x4843f3
call fcn.004afdfe
cmp ebx, edi
je 0x484597
test esi, esi
jne 0x484404
call fcn.004afdfe
cmp ebx, dword [esi + 4]
jne 0x48440e
call fcn.004afdfe
mov esi, dword [ebx + 0x10]
mov dword [esp + 0x10], esi
add esi, 0xc
mov eax, esi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x484420
sub eax, edx
sar eax, 1
test eax, eax
jle 0x484581
push esi
lea eax, [esp + 0x228]
push str.Is_s
push eax
call fcn.00405340
mov ebx, 8
add esp, 0xc
cmp dword [ebp + 0xb0], ebx
jb 0x484462
mov eax, dword [ebp + 0x9c]
jmp 0x484468
lea eax, [ebp + 0x9c]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push eax
push 0x104
lea ecx, [esp + 0x24]
push ecx
push 0x57413c
lea edx, [esp + 0x234]
push edx
push str.HotKey
call edi
mov ecx, 0x57413c
lea eax, [esp + 0x1c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4844bc
test dx, dx
je 0x4844b8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4844bc
add eax, 4
add ecx, 4
test dx, dx
jne 0x484496
xor eax, eax
jmp 0x4844c1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4844db
lea eax, [esp + 0x1c]
push eax
call fcn.004b0f27
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 4]
add esp, 4
mov byte [edx], al
push esi
lea eax, [esp + 0x228]
push str.Use_s
push eax
call fcn.00405340
add esp, 0xc
cmp dword [ebp + 0xb0], ebx
jb 0x484501
mov eax, dword [ebp + 0x9c]
jmp 0x484507
lea eax, [ebp + 0x9c]
push eax
push 0x104
lea ecx, [esp + 0x24]
push ecx
push str.nothing
lea edx, [esp + 0x234]
push edx
push str.HotKey
call edi
mov ecx, str.nothing
lea eax, [esp + 0x1c]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x484556
test dx, dx
je 0x484552
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x484556
add eax, 4
add ecx, 4
test dx, dx
jne 0x484530
xor eax, eax
jmp 0x48455b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x484581
mov eax, dword [esp + 0x10]
mov edx, dword [eax + 8]
lea ecx, [esp + 0x1c]
lea ebx, [ebx]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x484570
lea ecx, [esp + 0x14]
call fcn.00419a70
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
jmp 0x4843e0
mov ecx, dword [esp + 0x42c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004aeca3
add esp, 0x420
ret
Function at 0x4845b0
Capabilities:
Copy file

Disassembly:
sub esp, 0x41c
mov eax, dword [0x651788]
xor eax, esp
mov dword [esp + 0x418], eax
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x24]
mov eax, dword [edi + 4]
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edi
push ebx
test edi, edi
mov eax, dword [esi + 0x24]
mov ebx, dword [eax + 4]
je 0x4845ee
cmp edi, eax
je 0x4845f3
call fcn.004afdfe
cmp dword [esp + 0x14], ebx
je 0x4846f7
test edi, edi
jne 0x484606
call fcn.004afdfe
mov edx, dword [esp + 0x14]
cmp edx, dword [edi + 4]
jne 0x484614
call fcn.004afdfe
mov eax, dword [esp + 0x14]
mov edi, dword [eax + 0x10]
mov ecx, dword [edi + 4]
cmp byte [ecx], 0
mov ebx, dword [edi + 8]
je 0x484637
push 0x573190
push 0x574fd8
lea edx, [esp + 0x20]
push edx
jmp 0x484646
push 0x5731a4
push 0x574fd8
lea eax, [esp + 0x20]
push eax
call fcn.00405340
add esp, 0xc
add edi, 0xc
push edi
lea ecx, [esp + 0x224]
push str.Is_s
push ecx
call fcn.00405340
add esp, 0xc
cmp dword [esi + 0xb0], 8
jb 0x484678
mov eax, dword [esi + 0x9c]
jmp 0x48467e
lea eax, [esi + 0x9c]
push eax
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x228]
push eax
push str.HotKey
call ebp
push edi
lea ecx, [esp + 0x224]
push str.Use_s
push ecx
call fcn.00405340
push ebx
lea edx, [esp + 0x28]
push 0x574fd8
push edx
call fcn.00405340
add esp, 0x18
cmp dword [esi + 0xb0], 8
jb 0x4846ca
mov eax, dword [esi + 0x9c]
jmp 0x4846d0
lea eax, [esi + 0x9c]
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x228]
push ecx
push str.HotKey
call ebp
lea ecx, [esp + 0x10]
call fcn.00419a70
mov edi, dword [esp + 0x10]
jmp 0x4845e0
mov edi, 8
cmp dword [esi + 0xe8], edi
pop ebx
jb 0x48470d
mov eax, dword [esi + 0xd4]
jmp 0x484713
lea eax, [esi + 0xd4]
push eax
push 0x573190
push str.ModifyHotKey
push str.SetModify
call ebp
cmp dword [esi + 0xe8], edi
jb 0x484735
mov eax, dword [esi + 0xd4]
jmp 0x48473b
lea eax, [esi + 0xd4]
push eax
push 0x573190
push str.ModifyHotKey64
push str.SetModify
call ebp
cmp dword [esi + 0xe8], edi
jb 0x48475d
mov eax, dword [esi + 0xd4]
jmp 0x484763
lea eax, [esi + 0xd4]
push eax
push 0x573190
push str.TempModifyHotKey
push str.SetModify
call ebp
cmp dword [esi + 0xe8], edi
jb 0x484785
mov eax, dword [esi + 0xd4]
jmp 0x48478b
lea eax, [esi + 0xd4]
push eax
push 0x573190
push str.TempModifyHotKey64
push str.SetModify
call ebp
cmp dword [esi + 0xcc], edi
jb 0x4847ad
mov eax, dword [esi + 0xb8]
jmp 0x4847b3
lea eax, [esi + 0xb8]
cmp dword [esi + 0xb0], edi
jb 0x4847c3
mov esi, dword [esi + 0x9c]
jmp 0x4847c9
add esi, 0x9c
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.004aeca3
add esp, 0x41c
ret
Function at 0x4845cb
Capabilities:
Copy file

Disassembly:
sub esp, 0x41c
mov eax, dword [0x651788]
xor eax, esp
mov dword [esp + 0x418], eax
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x24]
mov eax, dword [edi + 4]
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edi
push ebx
test edi, edi
mov eax, dword [esi + 0x24]
mov ebx, dword [eax + 4]
je 0x4845ee
cmp edi, eax
je 0x4845f3
call fcn.004afdfe
cmp dword [esp + 0x14], ebx
je 0x4846f7
test edi, edi
jne 0x484606
call fcn.004afdfe
mov edx, dword [esp + 0x14]
cmp edx, dword [edi + 4]
jne 0x484614
call fcn.004afdfe
mov eax, dword [esp + 0x14]
mov edi, dword [eax + 0x10]
mov ecx, dword [edi + 4]
cmp byte [ecx], 0
mov ebx, dword [edi + 8]
je 0x484637
push 0x573190
push 0x574fd8
lea edx, [esp + 0x20]
push edx
jmp 0x484646
push 0x5731a4
push 0x574fd8
lea eax, [esp + 0x20]
push eax
call fcn.00405340
add esp, 0xc
add edi, 0xc
push edi
lea ecx, [esp + 0x224]
push str.Is_s
push ecx
call fcn.00405340
add esp, 0xc
cmp dword [esi + 0xb0], 8
jb 0x484678
mov eax, dword [esi + 0x9c]
jmp 0x48467e
lea eax, [esi + 0x9c]
push eax
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x228]
push eax
push str.HotKey
call ebp
push edi
lea ecx, [esp + 0x224]
push str.Use_s
push ecx
call fcn.00405340
push ebx
lea edx, [esp + 0x28]
push 0x574fd8
push edx
call fcn.00405340
add esp, 0x18
cmp dword [esi + 0xb0], 8
jb 0x4846ca
mov eax, dword [esi + 0x9c]
jmp 0x4846d0
lea eax, [esi + 0x9c]
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x228]
push ecx
push str.HotKey
call ebp
lea ecx, [esp + 0x10]
call fcn.00419a70
mov edi, dword [esp + 0x10]
jmp 0x4845e0
mov edi, 8
cmp dword [esi + 0xe8], edi
pop ebx
jb 0x48470d
mov eax, dword [esi + 0xd4]
jmp 0x484713
lea eax, [esi + 0xd4]
push eax
push 0x573190
push str.ModifyHotKey
push str.SetModify
call ebp
cmp dword [esi + 0xe8], edi
jb 0x484735
mov eax, dword [esi + 0xd4]
jmp 0x48473b
lea eax, [esi + 0xd4]
push eax
push 0x573190
push str.ModifyHotKey64
push str.SetModify
call ebp
cmp dword [esi + 0xe8], edi
jb 0x48475d
mov eax, dword [esi + 0xd4]
jmp 0x484763
lea eax, [esi + 0xd4]
push eax
push 0x573190
push str.TempModifyHotKey
push str.SetModify
call ebp
cmp dword [esi + 0xe8], edi
jb 0x484785
mov eax, dword [esi + 0xd4]
jmp 0x48478b
lea eax, [esi + 0xd4]
push eax
push 0x573190
push str.TempModifyHotKey64
push str.SetModify
call ebp
cmp dword [esi + 0xcc], edi
jb 0x4847ad
mov eax, dword [esi + 0xb8]
jmp 0x4847b3
lea eax, [esi + 0xb8]
cmp dword [esi + 0xb0], edi
jb 0x4847c3
mov esi, dword [esi + 0x9c]
jmp 0x4847c9
add esi, 0x9c
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.004aeca3
add esp, 0x41c
ret
Function at 0x4852d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x56318e
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x651788]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 0x60]
mov dword [esi], vtable.CShareVariableManager.0
xor edi, edi
mov eax, 7
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], edi
mov word [ecx + 4], di
lea ebx, [esi + 0x7c]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x14], edi
mov dword [esp + 0x20], edi
mov word [ebx + 4], di
lea ebp, [esi + 0x98]
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x14], edi
mov word [ebp + 4], di
mov dword [esi + 0xcc], eax
mov dword [esi + 0xc8], edi
mov word [esi + 0xb8], di
mov dword [esi + 0xe8], eax
mov dword [esi + 0xe4], edi
mov word [esi + 0xd4], di
mov dword [esi + 0x104], eax
mov dword [esi + 0x100], edi
mov word [esi + 0xf0], di
push edi
push 0x5a6624
mov byte [esp + 0x28], 5
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
call fcn.00402120
push edi
push 0x5a6624
mov ecx, ebx
call fcn.00402120
push edi
push 0x5a6624
mov ecx, ebp
call fcn.00402120
push edi
push 0x5a6624
lea ecx, [esi + 0xb4]
call fcn.00402120
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x486500
Capabilities:
Get common file path
Get program files directory

Disassembly:
sub esp, 0x20c
mov eax, dword [0x651788]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
push 0x206
lea eax, [esp + 0xa]
push 0
push eax
mov esi, ecx
mov word [esp + 0x10], 0
call fcn.004afb50
add esp, 0xc
push 0
push 0x26
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 4]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x486550
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 8]
add esi, 0x3c
push edx
mov ecx, esi
call fcn.00402120
push 1
push 0x5a6604
mov ecx, esi
call fcn.00403e10
push 0xd
push 0x583378
mov ecx, esi
call fcn.00403e10
push 1
push 0x5a6604
mov ecx, esi
call fcn.00403e10
mov ecx, dword [esp + 0x20c]
pop esi
xor ecx, esp
call fcn.004aeca3
add esp, 0x20c
ret