joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49aa50
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53cdb8
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x58c758]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x224], ecx
mov ecx, dword [ebp - 0x224]
call fcn.00402010
movzx eax, al
test eax, eax
jne 0x49aaaa
mov ecx, dword [ebp - 0x224]
call fcn.0043e290
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49aab1
xor eax, eax
jmp 0x49ac34
xor ecx, ecx
mov word [ebp - 0x21c], cx
push 0x206
push 0
lea edx, [ebp - 0x21a]
push edx
call fcn.004b0ac0
add esp, 0xc
push str.360safe
lea ecx, [ebp - 0x10]
call fcn.00401e30
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x224]
call fcn.0043e290
push eax
push 0x208
lea eax, [ebp - 0x21c]
push eax
push 0x540868
push str.comfullname
lea ecx, [ebp - 0x10]
call fcn.0043e290
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x49ab28
lea ecx, [ebp - 0x21c]
push ecx
call fcn.004b0eb7
add esp, 4
mov ecx, dword [ebp - 0x224]
call fcn.0043e290
push eax
push 0x208
lea edx, [ebp - 0x21c]
push edx
push 0x540868
push str.comshortname
lea ecx, [ebp - 0x10]
call fcn.0043e290
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x21c]
push eax
call fcn.004b0eb7
add esp, 4
test eax, eax
jbe 0x49abaa
lea ecx, [ebp - 0x21c]
push ecx
call fcn.004b0eb7
add esp, 4
mov esi, eax
push 0x54adf4
call fcn.004b0eb7
add esp, 4
add esi, eax
cmp esi, 0x208
jae 0x49aba8
push 0x54adf4
lea edx, [ebp - 0x21c]
push edx
call fcn.004b1f08
add esp, 8
jmp 0x49abbe
push 0x54adec
lea eax, [ebp - 0x21c]
push eax
call fcn.004b1f36
add esp, 8
lea ecx, [ebp - 0x21c]
push ecx
push str.SafeTitle
mov ecx, dword [ebp - 0x224]
call fcn.0049a860
lea edx, [ebp - 0x21c]
push edx
push str.SDTitle
mov ecx, dword [ebp - 0x224]
call fcn.0049a860
lea eax, [ebp - 0x21c]
push eax
push str.SDTooltip
mov ecx, dword [ebp - 0x224]
call fcn.0049a860
lea ecx, [ebp - 0x21c]
push ecx
mov ecx, dword [ebp - 0x224]
call fcn.0049a950
mov dword [ebp - 0x220], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401eb0
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004b0a79
mov esp, ebp
pop ebp
ret
Function at 0x49ac50
Capabilities:
Check if file exists
Copy file
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53cde8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x58c758]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp + 8]
call fcn.00402010
movzx eax, al
test eax, eax
jne 0x49ac9a
mov ecx, dword [ebp + 8]
call fcn.0043e290
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49aca1
xor eax, eax
jmp 0x49ad83
push str.360oem
lea ecx, [ebp - 0x10]
push ecx
call fcn.00401270
add esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00402010
movzx edx, al
test edx, edx
je 0x49ace6
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401eb0
mov eax, dword [ebp - 0x14]
jmp 0x49ad83
push 0
lea ecx, [ebp - 0x10]
call fcn.0043e290
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x10]
call fcn.0043e290
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49ad25
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401eb0
mov eax, dword [ebp - 0x18]
jmp 0x49ad83
push str.360EntLogo.png
lea ecx, [ebp - 0x10]
call fcn.00401990
lea ecx, [ebp - 0x10]
call fcn.0043e290
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x49ad54
lea ecx, [ebp - 0x10]
call fcn.0043e290
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea ecx, [ebp - 0x10]
call fcn.0043e290
push eax
mov ecx, dword [ebp + 8]
call fcn.0043e290
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401eb0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x49aea0
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53ce3b
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x58c758]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
je 0x49aeef
cmp dword [ebp + 0xc], 0
je 0x49aeef
mov eax, dword [ebp + 8]
push eax
call fcn.004b0eb7
add esp, 4
test eax, eax
jbe 0x49aeef
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004b0eb7
add esp, 4
test eax, eax
ja 0x49aef6
xor al, al
jmp 0x49af7d
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49af0e
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x49af26
xor al, al
jmp 0x49af7d
lea ecx, [ebp - 0xd]
call fcn.0041e6f0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0xd]
call fcn.0041e9c0
test eax, eax
jne 0x49af67
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 0xe], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd]
call fcn.0041e710
mov al, byte [ebp - 0xe]
jmp 0x49af7d
mov byte [ebp - 0xf], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd]
call fcn.0041e710
mov al, byte [ebp - 0xf]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x49b7c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53cec8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x58c758]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x18]
push edx
call fcn.00409f40
add esp, 0xc
mov dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
push ecx
mov ecx, 0x58fc7c
call fcn.00459810
lea edx, [ebp - 0x24]
push edx
mov ecx, 0x58fc7c
call fcn.00486210
push eax
lea ecx, [ebp - 0x14]
call fcn.00475200
movzx eax, al
test eax, eax
je 0x49b854
mov dword [ebp - 0x1c], 1
lea ecx, [ebp - 0x18]
push ecx
mov ecx, 0x58fc7c
call fcn.00458e70
mov dword [eax], 1
jmp 0x49b884
lea ecx, [ebp - 0x14]
call fcn.0045a620
cmp dword [eax + 4], 0xa
jg 0x49b884
lea ecx, [ebp - 0x14]
call fcn.0045a620
add eax, 4
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx]
add eax, 1
mov ecx, dword [ebp - 0x2c]
mov dword [ecx], eax
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], 0
je 0x49b8ba
mov ecx, dword [ebp + 0xc]
call fcn.0043e290
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp + 8]
call fcn.0043e290
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x54b050
push 0x58f750
call fcn.004045b0
add esp, 8
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00401eb0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x49b8f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53cf0b
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x58c758]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
call fcn.00401f80
lea ecx, [ebp - 0x10]
call fcn.00403840
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00403840
mov byte [ebp - 4], 1
lea eax, [ebp - 0x10]
push eax
call fcn.00401800
add esp, 4
test eax, eax
jne 0x49b972
mov dword [ebp - 0x18], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401eb0
mov eax, dword [ebp - 0x18]
jmp 0x49bae0
push str.SDVersion.dll
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x1c]
push edx
call fcn.00403700
add esp, 0xc
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00401970
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00401eb0
lea ecx, [ebp - 0x14]
call fcn.0043e290
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49b9f9
push str.360sd.exe
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.00403700
add esp, 0xc
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x44]
push edx
lea ecx, [ebp - 0x14]
call fcn.00401970
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.00401eb0
lea ecx, [ebp - 0x14]
call fcn.0043e290
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49ba36
mov dword [ebp - 0x24], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401eb0
mov eax, dword [ebp - 0x24]
jmp 0x49bae0
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
lea eax, [ebp - 0x14]
push eax
call fcn.00401e10
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.00401620
add esp, 8
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 0x50], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x50]
push eax
lea ecx, [ebp - 0x10]
call fcn.00401970
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00401eb0
lea ecx, [ebp - 0x10]
call fcn.00402010
movzx ecx, al
test ecx, ecx
je 0x49baaf
mov dword [ebp - 0x30], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401eb0
mov eax, dword [ebp - 0x30]
jmp 0x49bae0
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.00401970
mov dword [ebp - 0x34], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401eb0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4a01c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d60f
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x58c758]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x234], ecx
lea ecx, [ebp - 0x1c]
call fcn.00403840
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00403840
mov byte [ebp - 4], 1
push str.ext_heart
lea ecx, [ebp - 0x10]
call fcn.00401e30
mov byte [ebp - 4], 2
push str.EntClientExamCmd.dat
lea eax, [ebp - 0x14]
push eax
call fcn.0041acc0
add esp, 8
mov byte [ebp - 4], 3
xor ecx, ecx
mov word [ebp - 0x22c], cx
push 0x206
push 0
lea edx, [ebp - 0x22a]
push edx
call fcn.004b0ac0
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.0043e290
push eax
push 0x103
lea eax, [ebp - 0x22c]
push eax
push 0x540868
push str.LastDone
push str.Exam
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x22c]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00401ed0
lea ecx, [ebp - 0x14]
call fcn.0043e290
push eax
push 0x103
lea edx, [ebp - 0x22c]
push edx
push 0x540868
push str.LastDone
push 0x542d44
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x22c]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x234]
mov eax, dword [edx + 0x80]
push eax
push str.libver_slastcmd_slstsd_s
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00409170
add esp, 0x14
cmp dword [0x58fb50], 0
je 0x4a02fc
mov edx, dword [ebp - 0x1c]
push edx
push 0x54bc90
push 0x58f750
call fcn.004045b0
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x234]
call fcn.004a0020
mov dword [ebp - 0x230], 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.00401eb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.00401eb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00401eb0
mov eax, dword [ebp - 0x230]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.004b0a79
mov esp, ebp
pop ebp
ret
Function at 0x4a0880
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d70e
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x58c758]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
cmp dword [0x58fc78], 0
je 0x4a0a06
push 0x540868
lea ecx, [ebp - 0x14]
call fcn.00401e30
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call fcn.0041ad90
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.0043e290
push eax
call fcn.00401c70
add esp, 4
test eax, eax
je 0x4a0981
mov dword [ebp - 0x1c], 0
push 0x540868
lea ecx, [ebp - 0x20]
push ecx
call fcn.0041acc0
add esp, 8
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], 0
push 1
lea ecx, [ebp - 0x20]
call fcn.0043e290
push eax
push str._restart1
lea ecx, [ebp - 0x10]
call fcn.0043e290
push eax
push str.open
push 0
call fcn.00428ad0
add esp, 0x18
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x18], 0x20
ja 0x4a0955
cmp dword [ebp - 0x1c], 5
jl 0x4a0915
cmp dword [ebp - 0x18], 0x20
ja 0x4a0973
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x542c4c
lea eax, [ebp - 0x14]
push eax
call fcn.00409170
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.00401eb0
jmp 0x4a098e
push 0x542cb8
lea ecx, [ebp - 0x14]
call fcn.00401ed0
mov ecx, dword [ebp - 0x14]
push ecx
push 0x54bee4
push 0x58f750
call fcn.004045b0
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.00402010
movzx edx, al
test edx, edx
je 0x4a09eb
mov dword [0x58fc78], 0
mov ecx, 0x58f750
call fcn.00404340
mov ecx, 0x58f750
call fcn.00404510
mov ecx, 0x58fb60
call fcn.00404510
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401eb0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4a13b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d798
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x58c758]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], ecx
mov byte [ebp - 0x12], 0
mov byte [ebp - 0x1d], 0
lea eax, [ebp - 0x1d]
push eax
lea ecx, [ebp - 0x12]
push ecx
push 0x540e68
lea edx, [ebp - 0x38]
push edx
call fcn.0041acc0
add esp, 8
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x44]
call fcn.0043e290
push eax
call fcn.004a6180
add esp, 0xc
mov byte [ebp - 0x11], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00401eb0
movzx ecx, byte [ebp - 0x1d]
test ecx, ecx
je 0x4a1499
movzx edx, byte [ebp - 0x12]
test edx, edx
je 0x4a1450
push str.b__rYGS
push 0x58f750
call fcn.004045b0
add esp, 8
jmp 0x4a1499
push 0x54c0fc
push 0x58f750
call fcn.004045b0
add esp, 8
push str.360EntClient_update.ini
lea eax, [ebp - 0x24]
push eax
call fcn.0041acc0
add esp, 8
lea ecx, [ebp - 0x24]
call fcn.0043e290
push eax
push 0x540ba4
push str.Connected
push str.360EntClient
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x24]
call fcn.00401eb0
lea ecx, [ebp - 0x18]
call fcn.00403840
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x18]
push ecx
call fcn.00401800
add esp, 4
test eax, eax
jne 0x4a14cc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00401eb0
jmp 0x4a1595
push str.setting.ini
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x1c]
push eax
call fcn.00403700
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.0043e290
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4a1510
lea ecx, [ebp - 0x1c]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00401eb0
jmp 0x4a1595
lea ecx, [ebp - 0x1c]
call fcn.0043e290
push eax
push 0x540ba4
push 0x5452c8
push 0x5409f0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
push str.Q360SDClass
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4a157e
mov dword [ebp - 0x34], 0
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x34], 0x363363
mov dword [ebp - 0x28], 0
lea edx, [ebp - 0x28]
push edx
push 0x2710
push 1
lea eax, [ebp - 0x34]
push eax
push 0
push 0x4a
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
lea ecx, [ebp - 0x1c]
call fcn.00401eb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00401eb0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4a2820
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x4a284c
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x28], 0
je 0x4a2845
mov eax, 1
jmp 0x4a29e4
xor eax, eax
jmp 0x4a29e4
mov edx, dword [ebp - 4]
mov dword [edx + 4], 1
mov eax, dword [ebp + 8]
push eax
call section..text
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x28], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x28], 0
je 0x4a29e2
push str.XDOpen
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
push str.XDClose
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
push str.XDAddRecordsEx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
push str.XDDeleteRecords
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
push str.XDGetFirst
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
push str.XDGetNext
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
push str.XDGetCounts
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], eax
push str.XDGetLastFlag
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x24], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
je 0x4a297d
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0xc], 0
je 0x4a297d
mov edx, dword [ebp - 4]
cmp dword [edx + 0x10], 0
je 0x4a297d
mov eax, dword [ebp - 4]
cmp dword [eax + 0x14], 0
je 0x4a297d
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x18], 0
je 0x4a297d
mov edx, dword [ebp - 4]
cmp dword [edx + 0x1c], 0
je 0x4a297d
mov eax, dword [ebp - 4]
cmp dword [eax + 0x20], 0
je 0x4a297d
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x24], 0
jne 0x4a29db
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x1c], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x24], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x28], 0
xor eax, eax
jmp 0x4a29e4
mov eax, 1
jmp 0x4a29e4
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4a3730
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 1
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0x10], 0
je 0x4a376e
mov eax, dword [ebp - 0x10]
push eax
call fcn.004b2096
add esp, 4
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 8]
shl ecx, 0xc
mov dword [ebp - 4], ecx
push 2
mov edx, dword [ebp - 4]
push edx
call fcn.004b2124
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0x540868
push str.content
push str.ignore
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
sub ecx, 1
cmp dword [ebp - 0xc], ecx
je 0x4a3755
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4a37d8
mov edx, dword [ebp - 0x10]
push edx
call fcn.004b2096
add esp, 4
jmp 0x4a37f0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.004a3b90
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004b2096
add esp, 4
mov al, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x4a6cc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x401c
call fcn.004b0a90
mov eax, dword [0x58c758]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x401c], ecx
mov dword [ebp - 0x4018], 0
mov dword [ebp - 0x400c], 1
xor eax, eax
mov word [ebp - 0x4008], ax
push 0x3ffe
push 0
lea ecx, [ebp - 0x4006]
push ecx
call fcn.004b0ac0
add esp, 0xc
mov dword [ebp - 0x4010], 0x3ffe
lea edx, [ebp - 0x4010]
push edx
lea eax, [ebp - 0x4008]
push eax
lea ecx, [ebp - 0x400c]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x401c]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x4014], eax
lea edx, [ebp - 0x4008]
push edx
mov ecx, dword [ebp + 8]
call fcn.00401e30
mov eax, dword [ebp - 0x4018]
or eax, 1
mov dword [ebp - 0x4018], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b0a79
mov esp, ebp
pop ebp
ret 8

Function at 0x4a6d80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 8], 0
jne 0x4a6d96
xor al, al
jmp 0x4a6dc3
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
add eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4a6dd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax + 8], 0
je 0x4a6e1a
mov dword [ebp - 4], 0
mov dword [ebp - 8], 4
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
neg eax
sbb eax, eax
add eax, 1
jmp 0x4a6e1c
xor al, al
mov esp, ebp
pop ebp
ret 8

Function at 0x4a6e30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax + 8], 0
jne 0x4a6e48
xor al, al
jmp 0x4a6e7c
mov dword [ebp - 4], 4
mov dword [ebp - 8], 4
mov ecx, dword [ebp - 8]
push ecx
lea edx, [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
add eax, 1
mov esp, ebp
pop ebp
ret 8