joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f85f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x608554]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push ecx
push str.CBaseInfoResBasicIni::Read_InstInfo_FileVersion
lea ecx, [ebp - 0x3c]
call fcn.0040a480
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4f8655
test byte [ecx + 0x1c], 1
je 0x4f8655
cmp dword [0x608f68], 8
mov eax, 0x608f54
mov edx, 0x5db828
cmovae eax, dword [0x608f54]
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0xc
call fcn.00401840
add esp, 0xc
cmp dword [esi + 0x18], 8
lea eax, [esi + 4]
jb 0x4f8660
mov eax, dword [eax]
push eax
push 0x10000
push 0x5ceb18
push str.InstallInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [edi], eax
mov byte [ebp - 0x38], 1
mov ecx, dword [0x608f30]
pop edi
pop esi
cmp ecx, 0x608f30
je 0x4f86c0
test byte [ecx + 0x1c], 1
je 0x4f86c0
cmp dword [0x608f68], 8
mov eax, 0x608f54
push 0
cmovae eax, dword [0x608f54]
mov edx, 0x5db828
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0xd
call fcn.004018a0
add esp, 0x10
lea ecx, [ebp - 0x3c]
call fcn.0040a570
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0056d977
mov esp, ebp
pop ebp
ret 4

Function at 0x4f8b30
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x608554]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push ecx
push str.CBaseInfoResBasicIni::Read_InstInfo_PrinterNum
lea ecx, [ebp - 0x3c]
call fcn.0040a480
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4f8b95
test byte [ecx + 0x1c], 1
je 0x4f8b95
cmp dword [0x608f68], 8
mov eax, 0x608f54
mov edx, 0x5db828
cmovae eax, dword [0x608f54]
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x14
call fcn.00401840
add esp, 0xc
cmp dword [esi + 0x18], 8
lea eax, [esi + 4]
jb 0x4f8ba0
mov eax, dword [eax]
push eax
push 0
push str.PrinterNum
push str.InstallInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [edi], eax
mov byte [ebp - 0x38], 1
mov ecx, dword [0x608f30]
pop edi
pop esi
cmp ecx, 0x608f30
je 0x4f8bfd
test byte [ecx + 0x1c], 1
je 0x4f8bfd
cmp dword [0x608f68], 8
mov eax, 0x608f54
push 0
cmovae eax, dword [0x608f54]
mov edx, 0x5db828
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x15
call fcn.004018a0
add esp, 0x10
lea ecx, [ebp - 0x3c]
call fcn.0040a570
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0056d977
mov esp, ebp
pop ebp
ret 4
Function at 0x4f8d40
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x608554]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push ecx
push str.CBaseInfoResBasicIni::Read_InstInfo_Status
lea ecx, [ebp - 0x3c]
call fcn.0040a480
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4f8da6
test byte [ecx + 0x1c], 1
je 0x4f8da6
cmp dword [0x608f68], 8
mov eax, 0x608f54
mov edx, 0x5db828
cmovae eax, dword [0x608f54]
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x18
call fcn.00401840
add esp, 0xc
lea eax, [ebx + 4]
xor esi, esi
cmp dword [eax + 0x14], 8
jb 0x4f8db3
mov eax, dword [eax]
push eax
push 0
push str.Status
push str.InstallInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [edi], eax
test eax, eax
je 0x4f8e10
cmp eax, 0xa
je 0x4f8e10
cmp eax, 0x14
je 0x4f8e10
cmp eax, 0x1e
je 0x4f8e10
cmp eax, 0x28
je 0x4f8e10
cmp eax, 0x32
je 0x4f8e10
cmp eax, 0x3c
je 0x4f8e10
cmp eax, 0x46
je 0x4f8e10
cmp eax, 0x50
je 0x4f8e10
cmp eax, 0x3e8
je 0x4f8e10
mov dword [edi], 0x270f
mov esi, 0x80010001
mov dword [0x6183ec], 1
mov byte [ebp - 0x38], 1
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4f8e55
test byte [ecx + 0x1c], 1
je 0x4f8e55
cmp dword [0x608f68], 8
mov eax, 0x608f54
push esi
cmovae eax, dword [0x608f54]
mov edx, 0x5db828
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x19
call fcn.004018a0
add esp, 0x10
lea ecx, [ebp - 0x3c]
call fcn.0040a570
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056d977
mov esp, ebp
pop ebp
ret 4
Function at 0x4faa20
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a110b
mov eax, dword fs:[0]
push eax
sub esp, 0x44c
mov eax, dword [0x608554]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push ecx
push str.CBaseInfoResBasicIni::Read_PrnInfo_cVer
lea ecx, [ebp - 0x458]
call fcn.0040a480
mov dword [ebp - 4], 0
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4faaae
test byte [ecx + 0x1c], 1
je 0x4faaae
cmp dword [0x608f68], 8
mov eax, 0x608f54
mov edx, 0x5db828
cmovae eax, dword [0x608f54]
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x32
call fcn.00401840
add esp, 0xc
test esi, esi
je 0x4fab19
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00571c00
push esi
lea eax, [ebp - 0x420]
push 0x208
push eax
call fcn.005746e6
add esp, 0x18
lea eax, [ebp - 0x420]
mov ecx, ebx
push 1
push 0x208
push eax
call fcn.004fce40
mov esi, eax
test esi, esi
jne 0x4fab2e
cmp dword [ebx + 0x18], 8
lea ecx, [ebx + 4]
jb 0x4fab00
mov ecx, dword [ecx]
push ecx
push 0
push str.cVersion
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [edi], eax
jmp 0x4fab2e
mov esi, 0x80010001
mov dword [0x6183ec], 1
mov dword [edi], 0
mov byte [ebp - 0x454], 1
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4fab76
test byte [ecx + 0x1c], 1
je 0x4fab76
cmp dword [0x608f68], 8
mov eax, 0x608f54
push esi
cmovae eax, dword [0x608f54]
mov edx, 0x5db828
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x33
call fcn.004018a0
add esp, 0x10
lea ecx, [ebp - 0x458]
call fcn.0040a570
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056d977
mov esp, ebp
pop ebp
ret 8
Function at 0x4fad40
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a110b
mov eax, dword fs:[0]
push eax
sub esp, 0x44c
mov eax, dword [0x608554]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push ecx
push str.CBaseInfoResBasicIni::Read_PrnInfo_Additionals
lea ecx, [ebp - 0x458]
call fcn.0040a480
mov dword [ebp - 4], 0
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4fadce
test byte [ecx + 0x1c], 1
je 0x4fadce
cmp dword [0x608f68], 8
mov eax, 0x608f54
mov edx, 0x5db828
cmovae eax, dword [0x608f54]
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x36
call fcn.00401840
add esp, 0xc
test esi, esi
je 0x4fae39
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00571c00
push esi
lea eax, [ebp - 0x420]
push 0x208
push eax
call fcn.005746e6
add esp, 0x18
lea eax, [ebp - 0x420]
mov ecx, ebx
push 1
push 0x208
push eax
call fcn.004fce40
mov esi, eax
test esi, esi
jne 0x4fae4e
cmp dword [ebx + 0x18], 8
lea ecx, [ebx + 4]
jb 0x4fae20
mov ecx, dword [ecx]
push ecx
push 0
push str.Additionals
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [edi], eax
jmp 0x4fae4e
mov esi, 0x80010001
mov dword [0x6183ec], 1
mov dword [edi], 0
mov byte [ebp - 0x454], 1
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4fae96
test byte [ecx + 0x1c], 1
je 0x4fae96
cmp dword [0x608f68], 8
mov eax, 0x608f54
push esi
cmovae eax, dword [0x608f54]
mov edx, 0x5db828
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x37
call fcn.004018a0
add esp, 0x10
lea ecx, [ebp - 0x458]
call fcn.0040a570
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056d977
mov esp, ebp
pop ebp
ret 8
Function at 0x4fb070
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a110b
mov eax, dword fs:[0]
push eax
sub esp, 0x44c
mov eax, dword [0x608554]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push ecx
push str.CBaseInfoResBasicIni::Read_PrnInfo_Kind
lea ecx, [ebp - 0x458]
call fcn.0040a480
mov dword [ebp - 4], 0
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4fb0fe
test byte [ecx + 0x1c], 1
je 0x4fb0fe
cmp dword [0x608f68], 8
mov eax, 0x608f54
mov edx, 0x5db828
cmovae eax, dword [0x608f54]
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x3a
call fcn.00401840
add esp, 0xc
test esi, esi
je 0x4fb169
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00571c00
push esi
lea eax, [ebp - 0x420]
push 0x208
push eax
call fcn.005746e6
add esp, 0x18
lea eax, [ebp - 0x420]
mov ecx, ebx
push 1
push 0x208
push eax
call fcn.004fce40
mov esi, eax
test esi, esi
jne 0x4fb17e
cmp dword [ebx + 0x18], 8
lea ecx, [ebx + 4]
jb 0x4fb150
mov ecx, dword [ecx]
push ecx
push 0
push str.Kind
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [edi], eax
jmp 0x4fb17e
mov esi, 0x80010001
mov dword [0x6183ec], 1
mov dword [edi], 0
mov byte [ebp - 0x454], 1
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4fb1c6
test byte [ecx + 0x1c], 1
je 0x4fb1c6
cmp dword [0x608f68], 8
mov eax, 0x608f54
push esi
cmovae eax, dword [0x608f54]
mov edx, 0x5db828
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x3b
call fcn.004018a0
add esp, 0x10
lea ecx, [ebp - 0x458]
call fcn.0040a570
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056d977
mov esp, ebp
pop ebp
ret 8
Function at 0x4fb390
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a110b
mov eax, dword fs:[0]
push eax
sub esp, 0x44c
mov eax, dword [0x608554]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push ecx
push str.CBaseInfoResBasicIni::Read_PrnInfo_Proc
lea ecx, [ebp - 0x458]
call fcn.0040a480
mov dword [ebp - 4], 0
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4fb41e
test byte [ecx + 0x1c], 1
je 0x4fb41e
cmp dword [0x608f68], 8
mov eax, 0x608f54
mov edx, 0x5db828
cmovae eax, dword [0x608f54]
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x3e
call fcn.00401840
add esp, 0xc
test esi, esi
je 0x4fb489
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00571c00
push esi
lea eax, [ebp - 0x420]
push 0x208
push eax
call fcn.005746e6
add esp, 0x18
lea eax, [ebp - 0x420]
mov ecx, ebx
push 1
push 0x208
push eax
call fcn.004fce40
mov esi, eax
test esi, esi
jne 0x4fb49e
cmp dword [ebx + 0x18], 8
lea ecx, [ebx + 4]
jb 0x4fb470
mov ecx, dword [ecx]
push ecx
push 0
push str.Proc
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [edi], eax
jmp 0x4fb49e
mov esi, 0x80010001
mov dword [0x6183ec], 1
mov dword [edi], 0
mov byte [ebp - 0x454], 1
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4fb4e6
test byte [ecx + 0x1c], 1
je 0x4fb4e6
cmp dword [0x608f68], 8
mov eax, 0x608f54
push esi
cmovae eax, dword [0x608f54]
mov edx, 0x5db828
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x3f
call fcn.004018a0
add esp, 0x10
lea ecx, [ebp - 0x458]
call fcn.0040a570
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056d977
mov esp, ebp
pop ebp
ret 8
Function at 0x4fb6b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a110b
mov eax, dword fs:[0]
push eax
sub esp, 0x44c
mov eax, dword [0x608554]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push ecx
push str.CBaseInfoResBasicIni::Read_PrnInfo_NetShare
lea ecx, [ebp - 0x458]
call fcn.0040a480
mov dword [ebp - 4], 0
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4fb73e
test byte [ecx + 0x1c], 1
je 0x4fb73e
cmp dword [0x608f68], 8
mov eax, 0x608f54
mov edx, 0x5db828
cmovae eax, dword [0x608f54]
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x42
call fcn.00401840
add esp, 0xc
test esi, esi
je 0x4fb7a9
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00571c00
push esi
lea eax, [ebp - 0x420]
push 0x208
push eax
call fcn.005746e6
add esp, 0x18
lea eax, [ebp - 0x420]
mov ecx, ebx
push 1
push 0x208
push eax
call fcn.004fce40
mov esi, eax
test esi, esi
jne 0x4fb7be
cmp dword [ebx + 0x18], 8
lea ecx, [ebx + 4]
jb 0x4fb790
mov ecx, dword [ecx]
push ecx
push 0
push str.NetShare
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [edi], eax
jmp 0x4fb7be
mov esi, 0x80010001
mov dword [0x6183ec], 1
mov dword [edi], 0
mov byte [ebp - 0x454], 1
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4fb806
test byte [ecx + 0x1c], 1
je 0x4fb806
cmp dword [0x608f68], 8
mov eax, 0x608f54
push esi
cmovae eax, dword [0x608f54]
mov edx, 0x5db828
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x43
call fcn.004018a0
add esp, 0x10
lea ecx, [ebp - 0x458]
call fcn.0040a570
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056d977
mov esp, ebp
pop ebp
ret 8
Function at 0x4fbe50
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a110b
mov eax, dword fs:[0]
push eax
sub esp, 0x44c
mov eax, dword [0x608554]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push ecx
push str.CBaseInfoResBasicIni::Read_PrnInfo_CompleteDel
lea ecx, [ebp - 0x458]
call fcn.0040a480
mov dword [ebp - 4], 0
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4fbede
test byte [ecx + 0x1c], 1
je 0x4fbede
cmp dword [0x608f68], 8
mov eax, 0x608f54
mov edx, 0x5db828
cmovae eax, dword [0x608f54]
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x4a
call fcn.00401840
add esp, 0xc
test esi, esi
je 0x4fbf49
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00571c00
push esi
lea eax, [ebp - 0x420]
push 0x208
push eax
call fcn.005746e6
add esp, 0x18
lea eax, [ebp - 0x420]
mov ecx, ebx
push 1
push 0x208
push eax
call fcn.004fce40
mov esi, eax
test esi, esi
jne 0x4fbf5e
cmp dword [ebx + 0x18], 8
lea ecx, [ebx + 4]
jb 0x4fbf30
mov ecx, dword [ecx]
push ecx
push 0
push str.CompleteDel
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [edi], eax
jmp 0x4fbf5e
mov esi, 0x80010001
mov dword [0x6183ec], 1
mov dword [edi], 0
mov byte [ebp - 0x454], 1
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4fbfa6
test byte [ecx + 0x1c], 1
je 0x4fbfa6
cmp dword [0x608f68], 8
mov eax, 0x608f54
push esi
cmovae eax, dword [0x608f54]
mov edx, 0x5db828
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x4b
call fcn.004018a0
add esp, 0x10
lea ecx, [ebp - 0x458]
call fcn.0040a570
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056d977
mov esp, ebp
pop ebp
ret 8
Function at 0x4fc170
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a110b
mov eax, dword fs:[0]
push eax
sub esp, 0x44c
mov eax, dword [0x608554]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push ecx
push str.CBaseInfoResBasicIni::Read_PrnInfo_CompleteAdd
lea ecx, [ebp - 0x458]
call fcn.0040a480
mov dword [ebp - 4], 0
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4fc1fe
test byte [ecx + 0x1c], 1
je 0x4fc1fe
cmp dword [0x608f68], 8
mov eax, 0x608f54
mov edx, 0x5db828
cmovae eax, dword [0x608f54]
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x4e
call fcn.00401840
add esp, 0xc
test esi, esi
je 0x4fc269
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00571c00
push esi
lea eax, [ebp - 0x420]
push 0x208
push eax
call fcn.005746e6
add esp, 0x18
lea eax, [ebp - 0x420]
mov ecx, ebx
push 1
push 0x208
push eax
call fcn.004fce40
mov esi, eax
test esi, esi
jne 0x4fc27e
cmp dword [ebx + 0x18], 8
lea ecx, [ebx + 4]
jb 0x4fc250
mov ecx, dword [ecx]
push ecx
push 0
push str.CompleteAdd
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [edi], eax
jmp 0x4fc27e
mov esi, 0x80010001
mov dword [0x6183ec], 1
mov dword [edi], 0
mov byte [ebp - 0x454], 1
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4fc2c6
test byte [ecx + 0x1c], 1
je 0x4fc2c6
cmp dword [0x608f68], 8
mov eax, 0x608f54
push esi
cmovae eax, dword [0x608f54]
mov edx, 0x5db828
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x4f
call fcn.004018a0
add esp, 0x10
lea ecx, [ebp - 0x458]
call fcn.0040a570
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056d977
mov esp, ebp
pop ebp
ret 8
Function at 0x4fc440
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ab476
mov eax, dword fs:[0]
push eax
mov eax, 0x10058
call fcn.0056e430
mov eax, dword [0x608554]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10064], ecx
mov edi, dword [ebp + 8]
push ecx
push str.CBaseInfoResBasicIni::Read_DeletedDriverList
lea ecx, [ebp - 0x10060]
call fcn.0040a480
mov dword [ebp - 4], 0
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4fc4d3
test byte [ecx + 0x1c], 1
je 0x4fc4d3
cmp dword [0x608f68], 8
mov eax, 0x608f54
mov edx, 0x5db828
cmovae eax, dword [0x608f54]
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x52
call fcn.00401840
add esp, 0xc
push 0xfffe
lea eax, [ebp - 0x10010]
push 0
push eax
call fcn.00571c00
add esp, 0xc
mov dword [ebp - 0x10018], 0
xor eax, eax
mov dword [ebp - 0x10014], 7
lea ecx, [ebp - 0x10028]
mov word [ebp - 0x10028], ax
push eax
push 0x5c6930
call fcn.004035d0
mov byte [ebp - 4], 1
mov ebx, dword [edi + 4]
mov esi, dword [edi]
cmp esi, ebx
je 0x4fc534
mov ecx, esi
call fcn.00403570
add esi, 0x18
cmp esi, ebx
jne 0x4fc524
mov esi, dword [edi]
mov eax, dword [ebp - 0x10064]
add eax, 4
mov dword [edi + 4], esi
cmp dword [eax + 0x14], 8
jb 0x4fc548
mov eax, dword [eax]
push eax
push 0x7fff
lea eax, [ebp - 0x10010]
push eax
push str.DeletedDriverList
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
cmp word [ebp - 0x10010], 0
lea esi, [ebp - 0x10010]
je 0x4fc5cf
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4fc580
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x10028]
call fcn.004035d0
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x10028]
push ecx
cmp dword [edi + 8], eax
je 0x4fc5b8
mov ecx, eax
call fcn.00402f40
add dword [edi + 4], 0x18
jmp 0x4fc5c0
push eax
mov ecx, edi
call fcn.00478930
push esi
call ebx
lea esi, [esi + eax*2]
add esi, 2
cmp word [esi], 0
jne 0x4fc576
mov byte [ebp - 0x1005c], 1
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4fc618
test byte [ecx + 0x1c], 1
je 0x4fc618
cmp dword [0x608f68], 8
mov eax, 0x608f54
push 0
cmovae eax, dword [0x608f54]
mov edx, 0x5db828
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x53
call fcn.004018a0
add esp, 0x10
mov edx, dword [ebp - 0x10014]
cmp edx, 8
jb 0x4fc654
mov ecx, dword [ebp - 0x10028]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4fc64a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4fc67f
push edx
push ecx
call fcn.0056deb6
add esp, 8
lea ecx, [ebp - 0x10060]
call fcn.0040a570
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056d977
mov esp, ebp
pop ebp
ret 4
call fcn.00574908
int3
Function at 0x4fc690
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x608554]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push ecx
push str.CBaseInfoResBasicIni::Read_DeletedDriverData
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x40], eax
call fcn.0040a480
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4fc702
test byte [ecx + 0x1c], 1
je 0x4fc702
cmp dword [0x608f68], 8
mov eax, 0x608f54
mov edx, 0x5db828
cmovae eax, dword [0x608f54]
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x54
call fcn.00401840
mov ecx, dword [0x608f30]
add esp, 0xc
xor esi, esi
test edi, edi
je 0x4fc72f
cmp dword [ebx + 0x18], 8
lea eax, [ebx + 4]
jb 0x4fc713
mov eax, dword [eax]
push eax
push 0
push edi
push str.DeletedDriverList
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x40]
mov dword [ecx], eax
mov ecx, dword [0x608f30]
jmp 0x4fc73e
mov esi, 0x80010001
mov dword [0x6183ec], 1
mov byte [ebp - 0x38], 1
cmp ecx, 0x608f30
je 0x4fc77d
test byte [ecx + 0x1c], 1
je 0x4fc77d
cmp dword [0x608f68], 8
mov eax, 0x608f54
push esi
cmovae eax, dword [0x608f54]
mov edx, 0x5db828
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x55
call fcn.004018a0
add esp, 0x10
lea ecx, [ebp - 0x3c]
call fcn.0040a570
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056d977
mov esp, ebp
pop ebp
ret 8