joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409230
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
mov ebx, dword [esp + 0x11c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
lea eax, [esp + 0x18]
push 0x104
push eax
push 0
push str.Path
push str.Redirect
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x14]
lea ecx, [esp + 0x14]
test edx, edx
je 0x40929d
mov al, byte [esp + 0x14]
test al, al
je 0x40929d
cmp al, 0x20
je 0x409295
cmp al, 9
jne 0x4092e0
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40928d
mov esi, dword [esp + 0x120]
test esi, esi
je 0x4092d3
mov edx, dword [esp + 0x124]
test edx, edx
jle 0x4092d3
test ebx, ebx
je 0x4092d3
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jae 0x4092d3
push ebx
push edx
push esi
call dword [0x420070]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
lea eax, [esp + 0x14]
push 0x3a
push eax
call fcn.00410b95
add esp, 8
test eax, eax
jne 0x4093a3
cmp byte [esp + 0x14], 0x5c
je 0x4093a3
test ebx, ebx
je 0x4092d3
mov edi, dword [esp + 0x120]
test edi, edi
je 0x4092d3
mov ebp, dword [esp + 0x124]
test ebp, ebp
jle 0x4092d3
push 0x5c
push ebx
call fcn.00410c2c
add esp, 8
test eax, eax
jne 0x409336
push 0x2f
push ebx
call fcn.00410c2c
add esp, 8
test eax, eax
mov byte [edi], 0
je 0x40937a
sub eax, ebx
inc eax
mov esi, eax
test esi, esi
jle 0x40935b
cmp ebp, esi
jle 0x40935b
push esi
push ebx
push ebp
push edi
call dword [0x42006c]
add esp, 0x10
mov byte [esi + edi], 0
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push ebp
push edi
mov ecx, esi
call fcn.0040a7a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
push ebp
push ebx
mov ecx, esi
call fcn.0040a370
test eax, eax
je 0x409393
push ebx
push ebp
push edi
call dword [0x420070]
add esp, 0xc
push 0x42034c
push ebp
push edi
mov ecx, esi
call fcn.0040a7a0
jmp 0x40935f
mov edx, dword [esp + 0x124]
mov eax, dword [esp + 0x120]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
call fcn.00409230
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
Function at 0x409810
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x400
push ebx
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
mov edx, dword [esp + 0x41c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x410]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0x41c]
push 0x400
push ecx
mov ecx, dword [esp + 0x420]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0xc]
xor edi, edi
xor esi, esi
lea edx, [esp + 0xc]
test al, al
lea ecx, [esp + 0xc]
je 0x409896
cmp al, 0x20
je 0x409887
cmp al, 9
je 0x409887
test edi, edi
jne 0x40988e
mov edi, 1
mov edx, ecx
jmp 0x40988e
cmp edi, 1
jne 0x40988e
mov esi, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x409872
mov ebx, dword [esp + 0x420]
test edx, edx
mov byte [ebx], 0
je 0x409905
test esi, esi
jne 0x4098df
test ebx, ebx
je 0x409905
mov esi, dword [esp + 0x424]
test esi, esi
jle 0x409905
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, esi
jae 0x409905
push edx
push esi
push ebx
call dword [0x420070]
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x400
ret 0x18
sub esi, edx
test ebx, ebx
je 0x409905
test esi, esi
jle 0x409905
mov eax, dword [esp + 0x424]
cmp eax, esi
jle 0x409905
push esi
push edx
push eax
push ebx
call dword [0x42006c]
add esp, 0x10
mov byte [esi + ebx], 0
pop edi
pop esi
pop ebx
add esp, 0x400
ret 0x18
Function at 0x409920
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
mov ebx, dword [esp + 0x11c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
lea eax, [esp + 0x18]
push 0x104
push eax
push 0
push str.Path
push str.Redirect
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x14]
lea ecx, [esp + 0x14]
test edx, edx
je 0x40998d
mov al, byte [esp + 0x14]
test al, al
je 0x40998d
cmp al, 0x20
je 0x409985
cmp al, 9
jne 0x4099d0
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40997d
mov esi, dword [esp + 0x120]
test esi, esi
je 0x4099c3
mov edx, dword [esp + 0x124]
test edx, edx
jle 0x4099c3
test ebx, ebx
je 0x4099c3
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jae 0x4099c3
push ebx
push edx
push esi
call dword [0x420070]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
lea eax, [esp + 0x14]
push 0x3a
push eax
call fcn.00410b95
add esp, 8
test eax, eax
jne 0x409a93
cmp byte [esp + 0x14], 0x5c
je 0x409a93
test ebx, ebx
je 0x4099c3
mov edi, dword [esp + 0x120]
test edi, edi
je 0x4099c3
mov ebp, dword [esp + 0x124]
test ebp, ebp
jle 0x4099c3
push 0x5c
push ebx
call fcn.00410c2c
add esp, 8
test eax, eax
jne 0x409a26
push 0x2f
push ebx
call fcn.00410c2c
add esp, 8
test eax, eax
mov byte [edi], 0
je 0x409a6a
sub eax, ebx
inc eax
mov esi, eax
test esi, esi
jle 0x409a4b
cmp ebp, esi
jle 0x409a4b
push esi
push ebx
push ebp
push edi
call dword [0x42006c]
add esp, 0x10
mov byte [esi + edi], 0
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push ebp
push edi
mov ecx, esi
call fcn.0040a870
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
push ebp
push ebx
mov ecx, esi
call fcn.0040a480
test eax, eax
je 0x409a83
push ebx
push ebp
push edi
call dword [0x420070]
add esp, 0xc
push 0x42034c
push ebp
push edi
mov ecx, esi
call fcn.0040a870
jmp 0x409a4f
mov edx, dword [esp + 0x124]
mov eax, dword [esp + 0x120]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
call fcn.00409920
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc

Function at 0x40aa50
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x400
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x40c]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x410]
push eax
push ecx
push 0x3ff
push 0x400
push edx
call dword [0x420064]
add esp, 0x14
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
add esp, 0x400
ret
Function at 0x40b110
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
mov ebx, dword [esp + 0x11c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
lea eax, [esp + 0x18]
push 0x104
push eax
push 0
push str.Path
push str.Redirect
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x14]
lea ecx, [esp + 0x14]
test edx, edx
je 0x40b17d
mov al, byte [esp + 0x14]
test al, al
je 0x40b17d
cmp al, 0x20
je 0x40b175
cmp al, 9
jne 0x40b1c0
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40b16d
mov esi, dword [esp + 0x120]
test esi, esi
je 0x40b1b3
mov edx, dword [esp + 0x124]
test edx, edx
jle 0x40b1b3
test ebx, ebx
je 0x40b1b3
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jae 0x40b1b3
push ebx
push edx
push esi
call dword [0x420070]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
lea eax, [esp + 0x14]
push 0x3a
push eax
call fcn.00410b95
add esp, 8
test eax, eax
jne 0x40b283
cmp byte [esp + 0x14], 0x5c
je 0x40b283
test ebx, ebx
je 0x40b1b3
mov edi, dword [esp + 0x120]
test edi, edi
je 0x40b1b3
mov ebp, dword [esp + 0x124]
test ebp, ebp
jle 0x40b1b3
push 0x5c
push ebx
call fcn.00410c2c
add esp, 8
test eax, eax
jne 0x40b216
push 0x2f
push ebx
call fcn.00410c2c
add esp, 8
test eax, eax
mov byte [edi], 0
je 0x40b25a
sub eax, ebx
inc eax
mov esi, eax
test esi, esi
jle 0x40b23b
cmp ebp, esi
jle 0x40b23b
push esi
push ebx
push ebp
push edi
call dword [0x42006c]
add esp, 0x10
mov byte [esi + edi], 0
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push ebp
push edi
mov ecx, esi
call fcn.0040b660
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
push ebp
push ebx
mov ecx, esi
call fcn.0040b5b0
test eax, eax
je 0x40b273
push ebx
push ebp
push edi
call dword [0x420070]
add esp, 0xc
push 0x42034c
push ebp
push edi
mov ecx, esi
call fcn.0040b660
jmp 0x40b23f
mov edx, dword [esp + 0x124]
mov eax, dword [esp + 0x120]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
call fcn.0040b110
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
Function at 0x40e410
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x1ee4
call fcn.00410680
push ebx
push ebp
push esi
xor ebx, ebx
push str.Configinfo.ini
push ebx
push str.HXLogLevel
push str.Public
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esi, dword [0x4206b8]
mov ebp, 0x41d25c
push ebx
lea ecx, [esp + 0x10]
mov dword [0x420060], eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
call fcn.0040e610
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
je 0x40e47a
mov eax, dword [ecx]
push ebx
push esi
call dword [eax + 0x20]
mov ecx, eax
cmp ecx, ebx
mov dword [esp + 0x10], ecx
je 0x40e4b9
mov edx, dword [ecx]
push ebx
call dword [edx + 0x10]
mov ecx, dword [esp + 0x10]
cmp ecx, ebx
je 0x40e4b9
mov eax, dword [ecx]
push str.R2QQLuncher
call dword [eax + 0x20]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
call dword [edx + 0x28]
test eax, eax
jne 0x40e4b9
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
cmp ecx, ebx
je 0x40e4ab
mov eax, dword [ecx]
push ebx
call dword [eax + 8]
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1ee4
ret 0x10
lea ecx, [esp + 0x34]
push ebx
lea edx, [esp + 0x48]
push ecx
push edx
mov dword [esp + 0x40], 1
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
call sub.gdiplus.dll_GdiplusStartup
lea ecx, [esp + 0x48]
call fcn.00401390
mov eax, dword [esp + 0x1efc]
push 0x3ff
lea ecx, [esp + 0x74]
push eax
push ecx
call fcn.00410420
add esp, 0xc
lea ecx, [esp + 0x48]
mov byte [esp + 0x46f], bl
call fcn.00401800
lea ecx, [esp + 0x48]
call fcn.004019d0
mov ecx, dword [esp + 0x10]
cmp ecx, ebx
je 0x40e527
mov edx, dword [ecx]
push eax
call dword [edx + 0x24]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push edi
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x20]
mov dword [esp + 0x1c], ebx
rep stosd dword es:[edi], eax
push ebx
push ebx
lea eax, [esp + 0x24]
push ebx
push eax
call esi
test eax, eax
je 0x40e58f
mov edi, dword [sym.imp.USER32.dll_TranslateAcceleratorA]
mov ebp, dword [sym.imp.USER32.dll_TranslateMessage]
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x1c]
push ecx
push ebx
push edx
call edi
test eax, eax
jne 0x40e57c
lea eax, [esp + 0x1c]
push eax
call ebp
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
lea edx, [esp + 0x24]
push ebx
push edx
call esi
test eax, eax
jne 0x40e559
mov ebp, 0x41d25c
mov ecx, dword [esp + 0x14]
pop edi
cmp ecx, ebx
je 0x40e59d
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov esi, dword [esp + 0x20]
lea ecx, [esp + 0x50]
call fcn.00401660
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
cmp ecx, ebx
je 0x40e5bc
mov edx, dword [ecx]
push ebx
call dword [edx + 8]
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1ee4
ret 0x10
Function at 0x40e860
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x400
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x40c]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x410]
push eax
push ecx
push 0x3ff
push 0x400
push edx
call dword [0x420064]
add esp, 0x14
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
add esp, 0x400
ret
Function at 0x40ebe0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x400
push ebx
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
mov edx, dword [esp + 0x41c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x410]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0x41c]
push 0x400
push ecx
mov ecx, dword [esp + 0x420]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0xc]
xor edi, edi
xor esi, esi
lea edx, [esp + 0xc]
test al, al
lea ecx, [esp + 0xc]
je 0x40ec66
cmp al, 0x20
je 0x40ec57
cmp al, 9
je 0x40ec57
test edi, edi
jne 0x40ec5e
mov edi, 1
mov edx, ecx
jmp 0x40ec5e
cmp edi, 1
jne 0x40ec5e
mov esi, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40ec42
mov ebx, dword [esp + 0x420]
test edx, edx
mov byte [ebx], 0
je 0x40ecd5
test esi, esi
jne 0x40ecaf
test ebx, ebx
je 0x40ecd5
mov esi, dword [esp + 0x424]
test esi, esi
jle 0x40ecd5
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, esi
jae 0x40ecd5
push edx
push esi
push ebx
call dword [0x420070]
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x400
ret 0x18
sub esi, edx
test ebx, ebx
je 0x40ecd5
test esi, esi
jle 0x40ecd5
mov eax, dword [esp + 0x424]
cmp eax, esi
jle 0x40ecd5
push esi
push edx
push eax
push ebx
call dword [0x42006c]
add esp, 0x10
mov byte [esi + ebx], 0
pop edi
pop esi
pop ebx
add esp, 0x400
ret 0x18
Function at 0x40ecf0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
mov ebx, dword [esp + 0x11c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
lea eax, [esp + 0x18]
push 0x104
push eax
push 0
push str.Path
push str.Redirect
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x14]
lea ecx, [esp + 0x14]
test edx, edx
je 0x40ed5d
mov al, byte [esp + 0x14]
test al, al
je 0x40ed5d
cmp al, 0x20
je 0x40ed55
cmp al, 9
jne 0x40eda0
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x40ed4d
mov esi, dword [esp + 0x120]
test esi, esi
je 0x40ed93
mov edx, dword [esp + 0x124]
test edx, edx
jle 0x40ed93
test ebx, ebx
je 0x40ed93
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jae 0x40ed93
push ebx
push edx
push esi
call dword [0x420070]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
lea eax, [esp + 0x14]
push 0x3a
push eax
call fcn.00410b95
add esp, 8
test eax, eax
jne 0x40ee63
cmp byte [esp + 0x14], 0x5c
je 0x40ee63
test ebx, ebx
je 0x40ed93
mov edi, dword [esp + 0x120]
test edi, edi
je 0x40ed93
mov ebp, dword [esp + 0x124]
test ebp, ebp
jle 0x40ed93
push 0x5c
push ebx
call fcn.00410c2c
add esp, 8
test eax, eax
jne 0x40edf6
push 0x2f
push ebx
call fcn.00410c2c
add esp, 8
test eax, eax
mov byte [edi], 0
je 0x40ee3a
sub eax, ebx
inc eax
mov esi, eax
test esi, esi
jle 0x40ee1b
cmp ebp, esi
jle 0x40ee1b
push esi
push ebx
push ebp
push edi
call dword [0x42006c]
add esp, 0x10
mov byte [esi + edi], 0
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push ebp
push edi
mov ecx, esi
call fcn.0040f100
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
push ebp
push ebx
mov ecx, esi
call fcn.0040f050
test eax, eax
je 0x40ee53
push ebx
push ebp
push edi
call dword [0x420070]
add esp, 0xc
push 0x42034c
push ebp
push edi
mov ecx, esi
call fcn.0040f100
jmp 0x40ee1f
mov edx, dword [esp + 0x124]
mov eax, dword [esp + 0x120]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
call fcn.0040ecf0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
Function at 0x415d59
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x421100
cmp edx, dword [eax]
je 0x415d7b
add eax, 8
inc ecx
cmp eax, 0x421190
jl 0x415d6c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x421100]
jne 0x415ea9
mov eax, dword [0x4223a0]
cmp eax, 1
je 0x415e83
test eax, eax
jne 0x415dac
cmp dword [0x420774], 1
je 0x415e83
cmp edx, 0xfc
je 0x415ea9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x415de3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00416e40
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004110a0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x415e26
lea eax, [ebp - 0x1a4]
push eax
call fcn.004110a0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x41d734
push edi
call fcn.00410420
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00416e40
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00416e50
lea eax, [ebp - 0xa0]
push 0x41d714
push eax
call fcn.00416e50
push dword [esi + 0x421104]
lea eax, [ebp - 0xa0]
push eax
call fcn.00416e50
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004185e2
add esp, 0x2c
pop edi
jmp 0x415ea9
lea eax, [ebp + 8]
lea esi, [esi + 0x421104]
push 0
push eax
push dword [esi]
call fcn.004110a0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4048d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x4b1784]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push 0x11c
lea eax, [esp + 8]
push 0
push eax
call fcn.0046ea20
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x11c
call esi
test eax, eax
jne 0x404925
lea edx, [esp + 4]
push edx
mov dword [esp + 8], 0x114
call esi
test eax, eax
je 0x40494e
cmp dword [esp + 8], 6
jne 0x40494e
cmp dword [esp + 0xc], 0
jne 0x40494e
mov eax, 1
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.00469efd
add esp, 0x120
ret
mov ecx, dword [esp + 0x120]
pop esi
xor ecx, esp
xor eax, eax
call fcn.00469efd
add esp, 0x120
ret

Function at 0x404970
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x4b1784]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push 0x11c
lea eax, [esp + 8]
push 0
push eax
call fcn.0046ea20
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x11c
call esi
test eax, eax
jne 0x4049c5
lea edx, [esp + 4]
push edx
mov dword [esp + 8], 0x114
call esi
test eax, eax
je 0x4049d7
cmp dword [esp + 8], 6
jne 0x4049d7
mov eax, 1
cmp dword [esp + 0xc], eax
jae 0x4049d9
xor eax, eax
mov ecx, dword [esp + 0x120]
pop esi
xor ecx, esp
call fcn.00469efd
add esp, 0x120
ret
Function at 0x405180
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x218
mov eax, dword [0x4b1784]
xor eax, esp
mov dword [esp + 0x214], eax
test esi, esi
mov eax, dword [esp + 0x21c]
jne 0x4051b6
xor eax, eax
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.00469efd
add esp, 0x218
ret
push ebx
lea ecx, [esp + 4]
push ecx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405265
mov ebx, dword [esp + 4]
test ebx, ebx
je 0x405265
push 0x20a
push eax
lea edx, [esp + 0x16]
push edx
mov word [esp + 0x18], ax
call fcn.0046ea20
add esp, 0xc
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push edi
push ebx
mov dword [esp + 0x20], 0x20b
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40525a
push 0x103
lea edx, [esp + 0x10]
push edx
push esi
call fcn.00469d89
mov eax, dword [esp + 0x10]
add esp, 0xc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.00469efd
add esp, 0x218
ret
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x218]
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00469efd
add esp, 0x218
ret
Function at 0x405500
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x48b8f8
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4b1784]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b1784]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, edx
xor ebp, ebp
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x68], ebp
call fcn.004048d0
test eax, eax
jne 0x4055bb
call fcn.00404970
test eax, eax
jne 0x4055bb
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebp
push str.SOFTWARETencentQQPinyin
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405704
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push ecx
push ebx
lea edx, [esp + 0x20]
push edx
push ebp
push esi
mov edi, 4
push eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 0x14]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp esi, ebp
sete al
jmp 0x405706
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], ebp
mov word [esp + 0x44], bp
lea ebx, [esp + 0x24]
mov byte [esp + 0x68], 1
call fcn.004049f0
push 0xffffffffffffffff
push ebp
lea ecx, [esp + 0x48]
mov byte [esp + 0x70], 2
call fcn.0040c2f0
mov esi, 8
mov byte [esp + 0x68], 1
cmp dword [esp + 0x3c], esi
jb 0x405608
mov edx, dword [esp + 0x28]
push edx
call fcn.00469050
add esp, 4
push 1
push 0x492c00
lea ecx, [esp + 0x48]
call fcn.0040dd80
mov eax, str.SOFTWARETencentQQPinyin
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x405620
sub eax, edx
sar eax, 1
push eax
push str.SOFTWARETencentQQPinyin
lea ecx, [esp + 0x48]
call fcn.0040dd80
cmp dword [esp + 0x58], esi
mov eax, dword [esp + 0x44]
jae 0x40564c
lea eax, [esp + 0x44]
lea ecx, [esp + 0x14]
push ecx
push 0x2001f
push ebp
push eax
push reloc.WS2_32.dll_closesocket
mov dword [esp + 0x28], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x4056f1
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x24]
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
push edx
mov edi, 4
push esi
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [esp + 0x14], edi
mov edi, 0xd
jne 0x4056a9
mov edi, eax
cmp esi, ebp
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x4056b8
push esi
call ebx
xor esi, esi
xor eax, eax
cmp edi, ebp
sete al
cmp dword [esp + 0x58], 8
mov edi, eax
jb 0x4056d5
mov ecx, dword [esp + 0x44]
push ecx
call fcn.00469050
add esp, 4
cmp esi, ebp
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], ebp
mov word [esp + 0x44], bp
je 0x4056ed
push esi
call ebx
mov eax, edi
jmp 0x405706
cmp dword [esp + 0x58], esi
jb 0x405704
mov edx, dword [esp + 0x44]
push edx
call fcn.00469050
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00469efd
add esp, 0x58
ret
Function at 0x405730
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0xc]
push edx
xor esi, esi
push esi
push eax
push ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [esp + 4], 4
jne 0x40576c
cmp eax, esi
lea eax, [esi + 1]
je 0x40576e
mov eax, esi
pop esi
add esp, 8
ret