joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421263
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x3b0]
sub esp, 0x430
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x3ac], eax
call fcn.00406689
mov edx, dword [eax]
push 0x32
mov ecx, eax
call dword [edx]
test eax, eax
je 0x4213b1
call fcn.00404dc4
mov ecx, eax
call fcn.0042a71e
push eax
mov dword [ebp - 0x80], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4213b1
push ebx
call fcn.0042d724
push dword [ebp - 0x80]
mov ebx, str.Setting
push 0xffffffffffffffff
push str.CompetitiveAnalysisData
push ebx
mov dword [ebp - 0x7c], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, dword [ebp - 0x7c]
je 0x4213b0
push esi
push edi
mov esi, 0x206
xor edi, edi
push esi
lea eax, [ebp + 0x192]
push edi
push eax
mov word [ebp + 0x190], di
call fcn.0045fa70
push esi
lea eax, [ebp - 0x76]
push edi
push eax
mov word [ebp - 0x78], di
call fcn.0045fa70
add esp, 0x18
call fcn.00404dc4
mov ecx, eax
call fcn.0042a6b8
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.0045fd44
lea eax, [ebp - 0x78]
push str.SCMutual.exe
push eax
call fcn.0045fd1a
lea eax, [ebp + 0x190]
push 0x4c6d40
push eax
call fcn.0045fd44
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x190]
push eax
call fcn.0045fd1a
lea eax, [ebp + 0x190]
push str.__QueryAppInfo
push eax
call fcn.0045fd1a
push dword [ebp - 0x7c]
mov word [ebp + 0x398], di
xor eax, eax
lea edi, [ebp + 0x39a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp + 0x398]
push 0x4c4cf4
push eax
call fcn.00460936
add esp, 0x34
push dword [ebp - 0x80]
lea eax, [ebp + 0x398]
push eax
push str.CompetitiveAnalysisData
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp + 0x190]
push eax
call fcn.0042d648
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x3ac]
xor ecx, ebp
call fcn.0045fa14
add ebp, 0x3b0
leave
ret
Function at 0x4213c6
Capabilities:
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x3b4]
sub esp, 0x434
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x3b0], eax
call fcn.00406689
mov edx, dword [eax]
push 0x48
mov ecx, eax
call dword [edx]
test eax, eax
jne 0x421407
call fcn.00406689
mov edx, dword [eax]
push 0x47
mov ecx, eax
call dword [edx]
test eax, eax
je 0x42154f
push ebx
push esi
push edi
call fcn.00404dc4
mov ecx, eax
call fcn.0042a71e
mov dword [ebp - 0x78], eax
call fcn.0042d724
push dword [ebp - 0x78]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push str.SyncMBTime
mov esi, str.UserLogin
push esi
mov dword [ebp - 0x80], eax
call edi
push dword [ebp - 0x78]
mov ebx, str.SyncCfgTime
push 0
push ebx
push esi
mov dword [ebp - 0x7c], eax
call edi
mov ecx, dword [ebp - 0x80]
cmp ecx, dword [ebp - 0x7c]
jne 0x42145a
cmp ecx, eax
je 0x42154c
and word [ebp + 0x39c], 0
xor eax, eax
lea edi, [ebp + 0x39e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ecx
stosw word es:[edi], ax
lea eax, [ebp + 0x39c]
push 0x4c4cf4
push eax
call fcn.00460936
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
add esp, 0xc
push dword [ebp - 0x78]
lea eax, [ebp + 0x39c]
push eax
push str.SyncMBTime
push esi
call edi
push dword [ebp - 0x78]
lea eax, [ebp + 0x39c]
push eax
push ebx
push esi
call edi
mov esi, 0x206
xor edi, edi
push esi
lea eax, [ebp + 0x196]
push edi
push eax
mov word [ebp + 0x194], di
call fcn.0045fa70
push esi
lea eax, [ebp - 0x72]
push edi
push eax
mov word [ebp - 0x74], di
call fcn.0045fa70
add esp, 0x18
call fcn.00404dc4
mov ecx, eax
call fcn.0042a6b8
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.0045fd44
lea eax, [ebp - 0x74]
push str.SCConfig.exe
push eax
call fcn.0045fd1a
lea eax, [ebp + 0x194]
push 0x4c6d40
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x194]
push eax
call fcn.0045fd1a
lea eax, [ebp + 0x194]
push str.__QuickSync
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x74]
push eax
call fcn.0042cf83
add esp, 0x2c
test eax, eax
je 0x42154c
lea eax, [ebp + 0x194]
push eax
call fcn.0042c6af
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x3b0]
xor ecx, ebp
call fcn.0045fa14
add ebp, 0x3b4
leave
ret
Function at 0x421564
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00404dc4
mov ecx, eax
call fcn.0042a71e
push eax
mov dword [ebp - 0x42c], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4216ab
push ebx
push esi
push edi
push dword [ebp - 0x42c]
mov ebx, str.UpdateDllLocalDate
push 0xffffffffffffffff
push ebx
mov esi, str.Setting
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
call fcn.0042d724
mov ecx, eax
cmp ecx, edi
jne 0x4215d2
push 0x4c9318
call fcn.00430859
pop ecx
jmp 0x4216a8
and word [ebp - 0x18], 0
xor eax, eax
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ecx
stosw word es:[edi], ax
lea eax, [ebp - 0x18]
push 0x4c4cf4
push eax
call fcn.00460936
add esp, 0xc
push dword [ebp - 0x42c]
lea eax, [ebp - 0x18]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov esi, 0x206
xor edi, edi
push esi
lea eax, [ebp - 0x21e]
push edi
push eax
mov word [ebp - 0x220], di
call fcn.0045fa70
push esi
lea eax, [ebp - 0x426]
push edi
push eax
mov word [ebp - 0x428], di
call fcn.0045fa70
add esp, 0x18
call fcn.00404dc4
mov ecx, eax
call fcn.0042a6b8
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.0045fd44
lea eax, [ebp - 0x428]
push str.SCTool.exe
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x220]
push 0x4c6d40
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x220]
push str.__RunServerCmd
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x220]
push eax
call fcn.0042c6af
add esp, 0x2c
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045fa14
leave
ret
Function at 0x4216b7
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x206
xor edi, edi
push esi
lea eax, [ebp - 0x822]
push edi
push eax
mov word [ebp - 0x824], di
call fcn.0045fa70
add esp, 0xc
call fcn.00406689
mov edx, dword [eax]
push 0x99
mov ecx, eax
call dword [edx]
push esi
mov ebx, eax
lea eax, [ebp - 0x20a]
push edi
push eax
mov word [ebp - 0x20c], di
call fcn.0045fa70
add esp, 0xc
call fcn.00404dc4
mov ecx, eax
call fcn.0042a746
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0045fd44
cmp ebx, edi
pop ecx
pop ecx
jne 0x42174a
lea eax, [ebp - 0x20c]
push str.UseData.ini
push eax
call fcn.0045fd1a
pop ecx
pop ecx
jmp 0x421794
push ebx
lea eax, [ebp - 0x824]
push 0x4c4cf4
push eax
call fcn.00460936
lea eax, [ebp - 0x20c]
push str.UseData
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x20c]
push str..ini
push eax
call fcn.0045fd1a
add esp, 0x24
lea eax, [ebp - 0x20c]
push eax
push str.Run_Activity__s
call fcn.00430859
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x421863
push esi
lea eax, [ebp - 0x412]
push edi
push eax
mov word [ebp - 0x414], di
call fcn.0045fa70
push esi
lea eax, [ebp - 0x61a]
push edi
push eax
mov word [ebp - 0x61c], di
call fcn.0045fa70
add esp, 0x18
call fcn.00404dc4
mov ecx, eax
call fcn.0042a6b8
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.0045fd44
lea eax, [ebp - 0x61c]
push str.SCMutual.exe
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x414]
push 0x4c6d40
push eax
call fcn.0045fd44
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x414]
push str.__UpActivityData
push eax
call fcn.0045fd1a
add esp, 0x28
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x414]
push eax
call fcn.0042c6af
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045fa14
leave
ret
Function at 0x4229f4
Capabilities:
Terminate thread

Disassembly:
push 8
mov eax, 0x4bbc4a
call fcn.004603b7
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.CUpDmpInfoDlg.0
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0x78]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp - 0x10]
push dword [esi + 0x78]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea edi, [esi + 0x288]
mov ebx, dword [edi]
test ebx, ebx
je 0x422a49
mov ecx, ebx
call fcn.004187d9
push ebx
call fcn.00402ac9
and dword [edi], 0
pop ecx
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00420eb3
call fcn.0046048f
ret

Function at 0x422a7c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push esi
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
mov esi, ecx
call fcn.0045fa70
mov eax, dword [esi + 0x288]
add esp, 0xc
cmp dword [eax + 0x34], 8
jb 0x422ac1
mov ecx, dword [eax + 0x20]
jmp 0x422ac4
lea ecx, [eax + 0x20]
cmp dword [eax + 0x18], 8
jb 0x422acf
mov eax, dword [eax + 4]
jmp 0x422ad2
add eax, 4
push ecx
push eax
lea eax, [ebp - 0x20c]
push str._sDmp_s
push eax
call fcn.00460936
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov ecx, esi
jne 0x422b02
push 0x4c9b80
jmp 0x422b12
call fcn.004229e2
test eax, eax
mov ecx, esi
je 0x422afb
push 0x4c9b68
mov eax, dword [esi]
call dword [eax + 0x170]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x154]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
pop esi
call fcn.0045fa14
leave
ret

Function at 0x422b4e
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x7c]
push eax
xor eax, eax
push eax
push esi
push 0x422b3f
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x78], eax
pop esi
ret
Function at 0x423917
Capabilities:
Read .ini file

Disassembly:
push ebp
sub esp, 0x240
lea ebp, [esp - 4]
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x240], eax
push 4
mov eax, 0x4be6ad
call fcn.004603b7
mov edi, dword [ebp + 0x24c]
xor esi, esi
mov dword [ebp - 0x10], esi
call fcn.00404dc4
mov ecx, eax
call fcn.0042a71e
push eax
lea ecx, [ebp + 0x1c]
call fcn.00401130
push 0x206
lea eax, [ebp + 0x3a]
push esi
push eax
mov dword [ebp - 4], esi
mov word [ebp + 0x38], si
call fcn.0045fa70
mov eax, dword [ebp + 0x20]
add esp, 0xc
cmp dword [ebp + 0x34], 8
jae 0x423980
lea eax, [ebp + 0x20]
push eax
push 0x104
lea eax, [ebp + 0x38]
push eax
push 0x4c74e4
push str.SoftMD5
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp + 0x38]
push eax
lea ecx, [ebp]
call fcn.00401130
push 0x4df45c
lea ecx, [ebp]
mov byte [ebp - 4], 1
call fcn.0040fa3a
test eax, eax
je 0x4239ce
lea eax, [ebp]
push eax
push edi
call fcn.0042de9c
pop ecx
pop ecx
jmp 0x4239da
push str.Null
mov ecx, edi
call fcn.004010c0
push esi
push 1
lea ecx, [ebp]
call fcn.00401330
push esi
push 1
lea ecx, [ebp + 0x1c]
call fcn.00401330
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x240]
xor ecx, ebp
call fcn.0045fa14
add ebp, 0x244
leave
ret 4

Function at 0x424c82
Capabilities:
Terminate thread

Disassembly:
push 8
mov eax, 0x4be912
call fcn.004603b7
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.CUpUserCfgDlg.0
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0x7c]
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp - 0x10]
push dword [esi + 0x7c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea edi, [esi + 0x290]
mov ebx, dword [edi]
test ebx, ebx
je 0x424cda
mov ecx, ebx
call fcn.00420718
push ebx
call fcn.00402ac9
and dword [edi], 0
pop ecx
lea ecx, [esi + 0x294]
mov byte [ebp - 4], 0
call fcn.00429f4c
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00420eb3
call fcn.0046048f
ret
Function at 0x424d16
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 4
mov eax, 0x4bbbf5
call fcn.004603b7
mov edi, ecx
call fcn.00424c16
xor esi, esi
push 0x204
mov ebx, eax
lea eax, [ebp + 4]
push esi
push eax
mov dword [ebp], esi
call fcn.0045fa70
add esp, 0xc
lea eax, [ebp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.00405839
push 0x4c4488
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.004056fb
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x424d9b
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp ebx, esi
push dword [ebp - 0x10]
je 0x424da9
push 0x4c4484
jmp 0x424dae
push 0x4c4480
push 0x4c60e8
push str.MutualTempFile
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push esi
push esi
push 0x464
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00404ff6
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0045fa14
add ebp, 0x20c
leave
ret

Function at 0x424e0e
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x84]
push eax
xor eax, eax
push eax
push esi
push 0x424dff
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x7c], eax
pop esi
ret

Function at 0x424f0a
Capabilities:
Terminate thread

Disassembly:
push 8
mov eax, 0x4bbc4a
call fcn.004603b7
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.CUpUserMBDlg.0
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0x78]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp - 0x10]
push dword [esi + 0x78]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea edi, [esi + 0x288]
mov ebx, dword [edi]
test ebx, ebx
je 0x424f5f
mov ecx, ebx
call fcn.0041cc67
push ebx
call fcn.00402ac9
and dword [edi], 0
pop ecx
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00420eb3
call fcn.0046048f
ret
Function at 0x424f70
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push ebx
push esi
mov esi, 0x206
push esi
lea eax, [ebp - 0x20a]
push 0
push eax
mov ebx, ecx
call fcn.0045fa70
add esp, 0xc
call fcn.00404dc4
mov ecx, eax
call fcn.0042a6b8
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x20c]
push str.SCMBManager.exe
push eax
call fcn.0045fd1a
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42503f
and word [ebp - 0x414], 0
push esi
lea eax, [ebp - 0x412]
push 0
push eax
call fcn.0045fa70
lea eax, [ebp - 0x414]
push 0x4c6d40
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x414]
push str.__ExportUserMb
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x414]
push eax
call fcn.0042c74a
add esp, 0x28
mov ecx, dword [ebx + 0x288]
call fcn.0041e7ab
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0045fa14
leave
ret

Function at 0x42507a
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 4
mov eax, 0x4bbbf5
call fcn.004603b7
xor esi, esi
push 0x204
lea eax, [ebp + 4]
push esi
push eax
mov edi, ecx
mov dword [ebp], esi
call fcn.0045fa70
add esp, 0xc
lea eax, [ebp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.00405839
push 0x4c4488
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.004056fb
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4250f8
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, edi
call fcn.00424f70
test eax, eax
push dword [ebp - 0x10]
je 0x42510d
push 0x4c4484
jmp 0x425112
push 0x4c4480
push 0x4c6154
push str.MutualTempFile
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push esi
push esi
push 0x464
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00404ff6
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0045fa14
add ebp, 0x20c
leave
ret

Function at 0x425172
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x7c]
push eax
xor eax, eax
push eax
push esi
push 0x425163
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x78], eax
pop esi
ret
Function at 0x4261a1
Capabilities:
Read .ini file

Disassembly:
push ebp
sub esp, 0x360
lea ebp, [esp - 4]
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x360], eax
push 8
mov eax, 0x4bea3b
call fcn.004603b7
mov dword [ebp - 0x10], ecx
lea ecx, [ebp + 0x1c]
call fcn.004057d9
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.0042d724
mov esi, eax
call fcn.00404dc4
mov ecx, eax
call fcn.0042a71e
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push eax
push ebx
push str.InstallDate
push str.Setting
mov dword [ebp - 0x14], eax
call edi
dec esi
cmp eax, esi
jne 0x42627b
push str.Install_
lea ecx, [ebp]
call fcn.004010c0
push 0x4c67f4
lea ecx, [ebp]
mov byte [ebp - 4], 1
call fcn.004057bc
push 0xffffffffffffffff
push ebx
lea eax, [ebp]
push eax
lea ecx, [ebp + 0x1c]
call fcn.004011a0
mov esi, 0x4c8128
push esi
lea ecx, [ebp + 0x38]
call fcn.00401280
mov ecx, dword [ebp - 0x10]
lea eax, [ebp + 0x1c]
push eax
call fcn.0042614c
push str.InstallNum
lea ecx, [ebp + 0x1c]
call fcn.00401280
push esi
lea ecx, [ebp + 0x38]
call fcn.00401280
mov ecx, dword [ebp - 0x10]
lea eax, [ebp + 0x1c]
push eax
call fcn.0042614c
push ebx
push 1
lea ecx, [ebp]
mov byte [ebp - 4], bl
call fcn.004012b0
push dword [ebp - 0x14]
mov esi, str.InstallInfo
push ebx
push str.UIDError
push esi
call edi
cmp eax, 1
jne 0x4262b7
push 0x4ca2fc
lea ecx, [ebp + 0x1c]
call fcn.00401280
push 0x4c8128
lea ecx, [ebp + 0x38]
call fcn.00401280
mov ecx, dword [ebp - 0x10]
lea eax, [ebp + 0x1c]
push eax
call fcn.0042614c
push dword [ebp - 0x14]
push 0x4c4480
push str.UIDError
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x206
lea eax, [ebp + 0x56]
push ebx
push eax
mov word [ebp + 0x54], bx
call fcn.0045fa70
add esp, 0xc
push dword [ebp - 0x14]
lea eax, [ebp + 0x54]
push 0x104
push eax
mov edi, str.null
push edi
push str.Other
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp + 0x54]
push edi
push eax
call fcn.004615f0
test eax, eax
pop ecx
pop ecx
je 0x426362
push 0x103
lea eax, [ebp + 0x25d]
push ebx
push eax
mov byte [ebp + 0x25c], bl
call fcn.0045fa70
lea eax, [ebp + 0x25c]
push eax
lea eax, [ebp + 0x54]
push eax
call fcn.0042c364
add esp, 0x14
lea eax, [ebp + 0x25c]
push eax
lea ecx, [ebp + 0x1c]
call fcn.00401280
push 0x4c8128
lea ecx, [ebp + 0x38]
call fcn.00401280
mov ecx, dword [ebp - 0x10]
lea eax, [ebp + 0x1c]
push eax
call fcn.0042614c
push dword [ebp - 0x14]
push edi
push str.Other
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp + 0x1c]
call fcn.00405555
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x360]
xor ecx, ebp
call fcn.0045fa14
add ebp, 0x364
leave
ret
Function at 0x427530
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4beb30
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4f2720]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f2720]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x18]
call fcn.004057d9
and dword [esp + 0x5c], 0
call fcn.00404dc4
mov ecx, eax
call fcn.0042a732
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
push edi
push 0
push str.MiNiAdvInShow
mov esi, str.MiNiNews
push esi
call ebx
cmp eax, 1
mov ebp, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jne 0x4275db
push 0x4cad98
lea ecx, [esp + 0x1c]
call fcn.00401280
push 0x4c8128
lea ecx, [esp + 0x38]
call fcn.00401280
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
call fcn.0042614c
push edi
push 0x4c4480
push str.MiNiAdvInShow
push esi
call ebp
push edi
push 0
push str.MiNiCloseBySafeSoft
push esi
call ebx
cmp eax, 1
jne 0x427615
push 0x4cad5c
lea ecx, [esp + 0x1c]
call fcn.00401280
push 0x4c8128
lea ecx, [esp + 0x38]
call fcn.00401280
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
call fcn.0042614c
push edi
push 0x4c4480
push str.MiNiCloseBySafeSoft
push esi
call ebp
push edi
push 0
push str.MiNiAdvInErr
push esi
call ebx
test eax, eax
je 0x42768e
cmp eax, 1
jne 0x42763e
push str.MiNiAdvInDownImgErr
jmp 0x42765b
cmp eax, 2
jne 0x42764a
push str.MiNiAdvInImgTypeNotSupportErr
jmp 0x42765b
cmp eax, 3
jne 0x427656
push str.MiNiAdvInImgSizeErr
jmp 0x42765b
push str.MiNiAdvInUnKnowErr
lea ecx, [esp + 0x1c]
call fcn.00401280
push 0x4c8128
lea ecx, [esp + 0x38]
call fcn.00401280
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
call fcn.0042614c
push edi
push 0x4c4480
push str.MiNiAdvInErr
push esi
call ebp
push edi
push 0
push str.MiNiAdvOutShow
push esi
call ebx
cmp eax, 1
jne 0x4276d6
push 0x4cacb4
lea ecx, [esp + 0x1c]
call fcn.00401280
push 0x4c8128
lea ecx, [esp + 0x38]
call fcn.00401280
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
call fcn.0042614c
push edi
push 0x4c4480
push str.MiNiAdvOutShow
push esi
call ebp
push edi
push 0
push str.MiNiAdvOutClickClose
push esi
call ebx
cmp eax, 1
jne 0x42771e
push 0x4cac70
lea ecx, [esp + 0x1c]
call fcn.00401280
push 0x4c8128
lea ecx, [esp + 0x38]
call fcn.00401280
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
call fcn.0042614c
push edi
push 0x4c4480
push str.MiNiAdvOutClickClose
push esi
call ebp
lea ecx, [esp + 0x18]
call fcn.00405555
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.0045fa14
add esp, 0x4c
ret