joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428ac5
Capabilities:
Check os version
Create process on windows

Disassembly:
mov eax, 0x50d16a
call fcn.0050b978
sub esp, 0x184
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
jne 0x428ae6
xor eax, eax
jmp 0x428c99
mov eax, dword [0x55ba6c]
mov ecx, 0x55ba6c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push 0x53ca70
call fcn.004064fc
push 0x110
lea eax, [ebp - 0x18c]
push ebx
push eax
call fcn.004ee380
add esp, 0x18
lea eax, [ebp - 0x190]
push eax
mov dword [ebp - 0x190], 0x114
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x428b4b
cmp dword [ebp - 0x18c], 6
jne 0x428b4b
inc esi
cmp esi, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
lea esi, [ebp - 0x10]
jne 0x428b5f
call fcn.00409057
jmp 0x428b64
call fcn.00409007
cmp eax, ebx
jne 0x428c7d
push 0x40
lea eax, [ebp - 0x74]
push ebx
push eax
mov dword [ebp - 0x78], 0x44
call fcn.004ee380
push dword [ebp - 0x10]
xor eax, eax
mov dword [ebp - 0x2c], ebx
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 5
mov dword [ebp - 0x4c], 1
mov word [ebp - 0x48], ax
call fcn.004090c2
add esp, 0x10
test al, al
jne 0x428bc9
cmp dword [ebp - 0x10], ebx
je 0x428bbf
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x10]
push eax
call fcn.0040923c
pop ecx
push str.userenv.dll
mov dword [ebp - 0x70], 0x53ca98
mov dword [ebp - 0x14], 0x30
mov dword [ebp + 8], ebx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [ebp - 0x1c], eax
je 0x428c28
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateEnvironmentBlock
push eax
call edi
push str.DestroyEnvironmentBlock
push dword [ebp - 0x1c]
mov esi, eax
call edi
cmp esi, ebx
mov edi, eax
je 0x428c28
push ebx
push dword [ebp - 0x10]
lea eax, [ebp + 8]
push eax
call esi
test eax, eax
je 0x428c25
mov dword [ebp - 0x14], 0x430
jmp 0x428c28
mov dword [ebp + 8], ebx
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x78]
push eax
push ebx
push dword [ebp + 8]
push dword [ebp - 0x14]
push ebx
push ebx
push ebx
push dword [ebp - 0x18]
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
cmp dword [ebp - 0x2c], ebx
mov dword [ebp - 0x14], eax
je 0x428c58
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x28], ebx
je 0x428c66
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x428c6f
push dword [ebp + 8]
call edi
cmp dword [ebp - 0x1c], ebx
je 0x428c7d
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x10], ebx
je 0x428c8b
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00405892
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x428dc7
Capabilities:
Query environment variable

Disassembly:
push 0x14
push 0x549c30
call fcn.0050b998
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 8], eax
je 0x428e75
cmp dword [ebp + 0xc], eax
je 0x428e75
push eax
push eax
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call edi
mov esi, eax
cmp esi, 1
jb 0x428e75
mov ebx, 0x103
cmp esi, ebx
ja 0x428e75
and dword [ebp - 4], 0
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004eaffb
pop ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x428e71
lea ecx, [esi + esi]
push ecx
push 0
push eax
call fcn.004ee380
add esp, 0xc
push esi
push dword [ebp - 0x24]
push dword [ebp + 8]
call edi
test eax, eax
je 0x428e71
cmp eax, ebx
ja 0x428e71
push eax
push dword [ebp - 0x24]
push ebx
push dword [ebp + 0xc]
call fcn.004f1b9e
add esp, 0x10
mov dword [ebp - 0x20], 1
jmp 0x428e71
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], 0
je 0x428e84
push dword [ebp - 0x1c]
call fcn.004ee375
pop ecx
mov eax, dword [ebp - 0x20]
call fcn.0050b9d3
ret

Function at 0x428e8d
Capabilities:
Create directory
Delete directory

Disassembly:
mov eax, 0x50cfd6
call fcn.0050b978
push ebx
push esi
push edi
and dword [ebp - 4], 0
push str._access
lea eax, [ebp + 8]
push eax
call fcn.00406033
mov ebx, dword [ebp + 8]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call esi
test edi, edi
je 0x428ecf
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x428ed6
call esi
cmp eax, 5
je 0x428ed9
xor edi, edi
inc edi
lea eax, [ebx - 0x10]
call fcn.00405892
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4298c4
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x50f272
call fcn.0050b978
push esi
xor esi, esi
cmp dword [ebx], esi
push edi
je 0x4298e9
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret 4
cmp dword [ebp + 8], esi
jne 0x429944
push 0x400000
lea ecx, [ebp + 8]
call fcn.00405f59
pop ecx
mov dword [ebp - 4], esi
lea esi, [ebx + 4]
mov edi, esi
call fcn.00404ec2
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00405892
push str.data_fileinfo.dat
push 0x104
call fcn.004059c3
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, dword [esi]
test eax, eax
je 0x42993b
push eax
call fcn.004eecf4
pop ecx
mov edx, esi
call fcn.0040598a
jmp 0x429950
push dword [ebp + 8]
lea esi, [ebx + 4]
push esi
call fcn.00405d27
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x429963
xor eax, eax
jmp 0x4298d9
mov eax, dword [0x55ba6c]
mov ecx, 0x55ba6c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 1
mov ecx, dword [esi]
push eax
call fcn.00429850
test eax, eax
jne 0x429999
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00405892
jmp 0x42995c
lea edi, [ebx + 0x24]
lea eax, [ebp + 8]
call fcn.00429d8b
lea eax, [ebp + 8]
push eax
push ebx
call fcn.004299e4
test eax, eax
jne 0x4299c6
xor esi, esi
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00405892
mov eax, esi
jmp 0x4298d9
mov ecx, ebx
call fcn.00429a7e
mov eax, ebx
call fcn.00429c0e
mov ecx, ebx
call fcn.00429c54
xor eax, eax
inc eax
mov dword [ebx], eax
mov esi, eax
jmp 0x4299b4
Function at 0x429c54
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x50e7e4
call fcn.0050b978
sub esp, 0x28
push ebx
push esi
push edi
push 0
lea eax, [ebp - 0x30]
push eax
mov esi, ecx
call fcn.0040495a
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x30]
push ecx
mov ecx, eax
call fcn.00404a21
test al, al
je 0x429d70
mov edi, str.eid1
push edi
lea eax, [ebp - 0x30]
call fcn.00404e2e
test al, al
je 0x429d01
push edi
lea eax, [ebp - 0x30]
call fcn.00404e69
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00405b0c
lea ebx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004295b2
test eax, eax
je 0x429cf2
push edi
lea eax, [ebp - 0x18]
push eax
call fcn.00405b0c
lea eax, [ebp - 0x18]
push eax
lea eax, [esi + 8]
push eax
mov byte [ebp - 4], 2
call fcn.00429dcc
mov edi, eax
mov eax, ebx
call fcn.00404ec2
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00405892
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00405892
mov edi, str.eid2
push edi
lea eax, [ebp - 0x30]
call fcn.00404e2e
test al, al
je 0x429d70
push edi
lea eax, [ebp - 0x30]
call fcn.00404e69
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00405b0c
lea ebx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.004295b2
test eax, eax
je 0x429d65
push edi
lea eax, [ebp - 0x18]
push eax
call fcn.00405b0c
lea eax, [ebp - 0x18]
push eax
add esi, 8
push esi
mov byte [ebp - 4], 4
call fcn.00429dcc
mov edi, eax
mov eax, ebx
call fcn.00404ec2
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00405892
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00405892
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.004049d6
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x42aff4
Capabilities:
Check if file exists
Read .ini file

Disassembly:
mov eax, 0x50e03c
call fcn.0050b978
push ecx
push esi
xor esi, esi
push esi
lea ecx, [ebp - 0x10]
call fcn.00405f59
mov dword [ebp - 4], esi
lea eax, [ebp - 0x10]
mov dword [esp], str.dataproduct.dat
push eax
call fcn.00406033
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42b045
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405892
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
push dword [ebp - 0x10]
push 0xc8
push 0x53cb48
push str.common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp + 8]
xor esi, esi
mov dword [ecx], eax
inc esi
jmp 0x42b02b
Function at 0x42ba84
Capabilities:
Create thread

Disassembly:
mov eax, 0x50ffb0
call fcn.0050b978
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [edi], ebx
push esi
jne 0x42ba9f
xor al, al
jmp 0x42bb24
lea eax, [edi + 0x1c]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp + 8]
push eax
lea esi, [edi + 0xc]
mov dword [ebp - 4], ebx
call fcn.0042bce7
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea esi, [edi + 8]
mov eax, esi
call fcn.0042a773
test eax, eax
jne 0x42bb1a
push 0xc
call fcn.004150af
cmp eax, ebx
pop ecx
jne 0x42bae7
mov dword [ebp + 8], ebx
jmp 0x42bb08
push ebx
push ebx
push eax
push 0x42c051
push ebx
push ebx
mov dword [eax], edi
mov dword [eax + 8], ebx
mov dword [eax + 4], 0x42bb34
call fcn.004f18b7
add esp, 0x18
mov dword [ebp + 8], eax
mov eax, dword [esi]
cmp eax, ebx
je 0x42bb15
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
mov dword [esi], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov al, 1
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x42e70f
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov eax, 0x50ece8
call fcn.0050b978
sub esp, 0x278
push ebx
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x20]
xor edi, edi
push eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
call fcn.00405b0c
push edi
push 2
mov dword [ebp - 4], edi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 0x1c], esi
jne 0x42e76c
push 0xfffffffffffffffe
pop esi
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
call fcn.00405892
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
push 0x228
lea eax, [ebp - 0x280]
push edi
push eax
call fcn.004ee380
add esp, 0xc
lea eax, [ebp - 0x284]
push eax
push esi
mov dword [ebp - 0x284], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x42e7a7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfffffffffffffffd
jmp 0x42e74d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x54]
push eax
call fcn.004070f6
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42e7c7
xor edi, edi
mov eax, dword [ebp - 0x27c]
cmp eax, dword [ebp - 0x24]
je 0x42e851
cmp eax, edi
je 0x42e851
cmp eax, 4
je 0x42e851
push eax
push edi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x42e851
push edi
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.00407160
mov esi, dword [ebp + 8]
mov eax, dword [esi - 0xc]
test eax, eax
je 0x42e843
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx - 0xc]
cmp eax, ecx
jl 0x42e843
push ecx
push esi
push edx
call fcn.004ef683
add esp, 0xc
test eax, eax
jne 0x42e843
push eax
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp eax, 1
je 0x42e83d
push dword [ebp - 0x27c]
call fcn.004073e1
cmp eax, 1
pop ecx
jne 0x42e840
inc dword [ebp - 0x14]
inc dword [ebp - 0x18]
push edi
call ebx
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00405892
lea eax, [ebp - 0x284]
push eax
push dword [ebp - 0x1c]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x42e7c5
push dword [ebp - 0x1c]
call ebx
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x42e879
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
lea esi, [ebp - 0x34]
call fcn.004076ff
lea esi, [ebp - 0x54]
call fcn.0040701c
mov esi, dword [ebp - 0x14]
jmp 0x42e74e
Function at 0x42e9e0
Capabilities:
Check if file exists

Disassembly:
push ecx
mov eax, dword [esi + 8]
cmp dword [eax - 0xc], 0
jne 0x42e9f1
mov eax, 0x13a
pop ecx
ret
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42ea03
mov eax, 0x13b
pop ecx
ret
call fcn.00407dc4
cmp eax, 0xd
jge 0x42ea3e
push dword [esi + 0x1c]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
push eax
push ecx
call fcn.00428ac5
add esp, 0xc
test eax, eax
je 0x42ea28
xor eax, eax
pop ecx
ret
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
push eax
push ecx
mov ecx, dword [esi + 0x1c]
call fcn.0042894e
test eax, eax
pop ecx
pop ecx
jne 0x42ea24
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
push 0
push eax
push ecx
mov ecx, dword [esi + 0x1c]
call fcn.00428842
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0xfffffec7
add eax, 0x139
pop ecx
ret

Function at 0x42f308
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
cmp dword [esi + 0xc], 0xffffffff
jne 0x42f36c
push ebx
push edi
lea ebx, [ebp - 4]
call fcn.0042fa97
push dword [eax]
xor ebx, ebx
push ebx
push 0x53d278
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00405892
cmp edi, ebx
je 0x42f35b
lea eax, [ebp - 4]
push eax
push esi
mov dword [ebp - 4], ebx
call fcn.0042f459
test eax, eax
je 0x42f35b
cmp dword [ebp - 4], ebx
jne 0x42f364
call fcn.0042fb9a
test eax, eax
je 0x42f367
xor eax, eax
inc eax
pop edi
mov dword [esi + 0xc], eax
pop ebx
mov eax, dword [esi + 0xc]
pop esi
leave
ret
Function at 0x42f4fc
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x50e078
call fcn.0050b978
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x20]
add edi, 0x1c
test eax, eax
je 0x42f526
mov ecx, dword [edi + 8]
sub ecx, eax
sar ecx, 3
jne 0x42f651
mov eax, dword [0x55ba6c]
mov ecx, 0x55ba6c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
lea ebx, [ebp - 0x1c]
call fcn.0042fa97
mov byte [ebp - 4], 1
push dword [eax]
mov eax, 0x104
push eax
push eax
lea esi, [ebp - 0x14]
call fcn.004059c3
push eax
push str.1.01.21.5
push str.supportrate
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ebx, ebx
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00405892
cmp dword [ebp - 0x14], ebx
jne 0x42f589
xor eax, eax
jmp 0x42f592
push dword [ebp - 0x14]
call fcn.004eecf4
pop ecx
lea edx, [ebp - 0x14]
call fcn.0040598a
mov esi, 0x53d274
push esi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
push eax
lea ecx, [ebp - 0x1c]
lea ebx, [ebp - 0x14]
call fcn.0042949e
jmp 0x42f62d
push eax
call fcn.004f1cf1
fstp qword [ebp - 0x24]
mov edx, dword [edi + 4]
test edx, edx
pop ecx
jne 0x42f5c9
xor ecx, ecx
jmp 0x42f5d1
mov ecx, dword [edi + 8]
sub ecx, edx
sar ecx, 3
test edx, edx
je 0x42f5f1
mov eax, dword [edi + 0xc]
sub eax, edx
sar eax, 3
cmp ecx, eax
jae 0x42f5f1
mov eax, dword [edi + 8]
fld qword [ebp - 0x24]
fstp qword [eax]
add eax, 8
mov dword [edi + 8], eax
jmp 0x42f60e
mov ebx, dword [edi + 8]
cmp edx, ebx
jbe 0x42f5fd
call fcn.004edd0e
push ebx
push edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, edi
call fcn.00450c1a
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00405892
push esi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
lea ebx, [ebp - 0x14]
call fcn.0042949e
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], 0
jne 0x42f5b4
add eax, 0xfffffff0
call fcn.00405892
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00405892
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x42f897
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi + 0x18], 0
jne 0x42f8cd
push ebx
lea ebx, [ebp - 4]
call fcn.0042fa97
push dword [eax]
push 2
push 0x53d288
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00405892
pop ebx
mov eax, dword [esi + 0x18]
leave
ret
Function at 0x42fa97
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x50dbe1
call fcn.0050b978
push ecx
push ecx
and dword [ebp - 0x14], 0
push edi
lea edi, [ebp - 0x14]
call fcn.0045f378
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
jne 0x42fad5
push 0x53b74c
push ebx
call fcn.00405b0c
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00405892
jmp 0x42fb40
add eax, 0xfffffff0
call fcn.004058aa
add eax, 0x10
mov dword [ebp - 0x10], eax
push str.datadpiconfig.ini
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 1
call fcn.00406033
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42fb1a
lea eax, [ebp - 0x14]
lea edi, [ebp - 0x10]
call fcn.00404ec2
push str._ressrcchsdpisetting.ini
mov eax, edi
push eax
call fcn.00406033
push esi
mov esi, dword [ebp - 0x10]
add esi, 0xfffffff0
mov eax, esi
call fcn.004058aa
add eax, 0x10
mov dword [ebx], eax
mov eax, esi
call fcn.00405892
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00405892
pop esi
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
mov dword fs:[0], ecx
leave
ret

Function at 0x42fb4f
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, esi
call fcn.0042f81e
test eax, eax
jne 0x42fb63
push 0x60
pop eax
leave
ret
cmp dword [esi + 8], 0xffffffff
jne 0x42fb95
push ebx
lea ebx, [ebp - 4]
call fcn.0042fa97
push dword [eax]
push 0x60
push str.debugdpi
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esi + 8], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00405892
pop ebx
mov eax, dword [esi + 8]
leave
ret

Function at 0x42fb9a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi + 4], 0xffffffff
jne 0x42fbd0
push ebx
lea ebx, [ebp - 4]
call fcn.0042fa97
push dword [eax]
push 0
push str.debug
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00405892
pop ebx
mov eax, dword [esi + 4]
leave
ret

Function at 0x42fbd5
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x50e03c
call fcn.0050b978
push ecx
and dword [ebp - 0x10], 0
push esi
mov esi, ecx
add esi, 0x14
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jne 0x42fc47
push ebx
lea ebx, [ebp - 0x10]
call fcn.0042fa97
and dword [ebp - 4], 0
push dword [eax]
mov eax, 0x104
push eax
push eax
call fcn.004059c3
push eax
push str.kxetray
push str.supportprocess
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405892
mov eax, dword [esi]
test eax, eax
pop ebx
je 0x42fc40
push eax
call fcn.004eecf4
pop ecx
mov edx, esi
call fcn.0040598a
mov eax, dword [esi]
sub eax, 0x10
call fcn.004058aa
mov ecx, dword [ebp - 0xc]
add eax, 0x10
mov dword [edi], eax
mov eax, edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x42fdd1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, word [ebp + 0xc]
push esi
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x42fe54
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x42fe1d
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x42fe1d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [ebp + 0xc], eax
jne 0x42fe21
xor eax, eax
jmp 0x42fe53
mov esi, dword [ebp + 0x10]
push edi
lea edi, [ebx + 1]
push edi
call fcn.00406cd0
test eax, eax
je 0x42fe3f
push ebx
push dword [ebp + 0xc]
push eax
call fcn.004f0240
add esp, 0xc
mov eax, edi
call fcn.00408724
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
inc eax
pop edi
pop ebx
pop esi
leave
ret

Function at 0x42ff84
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, 0x50d037
call fcn.0050b978
push ecx
push ecx
mov eax, dword [0x55ba6c]
push ebx
push esi
push edi
mov edi, ecx
mov esi, 0x55ba6c
xor ebx, ebx
mov ecx, esi
mov dword [ebp - 0x14], ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x14], ebx
lea eax, [edi + 0xc]
jne 0x42ffbc
mov eax, edi
lea edi, [ebp - 0x10]
call fcn.00404ec2
mov edi, dword [ebp - 0x10]
cmp dword [edi - 0xc], ebx
je 0x4300b2
mov eax, dword [0x55ba6c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0x14], eax
push dword [ebp + 0x10]
mov byte [ebp - 4], 1
push dword [ebp + 8]
lea eax, [ebp + 0x14]
push edi
push str._s_d._s
call fcn.004064fc
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp + 0x10], eax
je 0x4300a7
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, ebx
je 0x43009e
mov esi, dword [ebp + 0xc]
push ebx
lea eax, [ebp + 8]
push eax
push edi
lea eax, [edi + 0xa]
push eax
mov dword [ebp + 8], ebx
call fcn.00406cd0
call dword [eax - 1]
jne 0x430057
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x430095
cmp dword [ebp + 8], edi
jne 0x430095
mov eax, edi
call fcn.00408724
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
call fcn.00405892
xor esi, esi
inc esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00405892
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
xor eax, eax
mov edx, esi
call fcn.00406cf6
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
call fcn.00405892
mov esi, dword [ebp - 0x14]
jmp 0x430077