joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414428
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x5475b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x414]
push edi
push 0x208
push 0
push eax
mov edi, ecx
call fcn.004deff0
push esi
lea eax, [edi + 4]
push eax
lea eax, [ebp - 0x414]
push 0x511e14
push eax
call fcn.004db950
add esp, 0x1c
lea eax, [ebp - 0x418]
push eax
push 0x20006
push 0
lea eax, [ebp - 0x414]
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x4144b0
push 0x512700
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x418]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
pop edi
sete al
xor ecx, ebp
pop esi
call fcn.004d9731
mov esp, ebp
pop ebp
ret 4

Function at 0x4144c9
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x5475b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x41c], eax
mov edi, ecx
xor eax, eax
push 0x208
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.004deff0
push esi
lea eax, [edi + 4]
push eax
lea eax, [ebp - 0x414]
push 0x511e14
push eax
call fcn.004db950
add esp, 0x1c
lea eax, [ebp - 0x418]
xor ecx, ecx
push ecx
push eax
push ecx
push 0x20006
push ecx
push ecx
push ecx
lea eax, [ebp - 0x414]
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x414585
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x41454a
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push ebx
push 1
push esi
push dword [ebp - 0x41c]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.004d9731
mov esp, ebp
pop ebp
ret 0xc
Function at 0x416cf7
Capabilities:
Read .ini file

Disassembly:
push 0xc
mov eax, 0x4fdb23
call fcn.004e6cb7
mov edi, ecx
mov eax, dword [0x548750]
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push 0x54dbe8
push str._sUser.ini
push eax
call fcn.0040306c
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
add esp, 0xc
push dword [ebp - 0x10]
push 0
push str.nottips
push 0x513940
call esi
push dword [ebp - 0x10]
mov dword [edi + 0xf4], eax
push 1
push str.minitotray
push 0x513960
call esi
mov dword [edi + 0xf8], eax
mov ecx, edi
test eax, eax
je 0x416d68
call fcn.00416e98
jmp 0x416d6d
call fcn.00416f23
mov eax, dword [0x548750]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00433693
mov byte [ebp - 4], 2
push dword [eax]
lea eax, [ebp - 0x14]
push 0x513968
push eax
call fcn.0040306c
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00403080
mov eax, dword [edi + 0x28]
lea ecx, [edi + 0x28]
mov esi, 0x513974
push esi
call dword [eax + 0x20]
test eax, eax
je 0x416dd2
mov eax, dword [edi + 0x28]
lea ecx, [edi + 0x28]
push esi
call dword [eax + 0x20]
push 0
push dword [ebp - 0x14]
mov ecx, eax
mov edx, dword [eax]
push 0x51380c
call dword [edx + 0x34]
lea ecx, [ebp - 0x14]
call fcn.00403080
lea ecx, [ebp - 0x10]
call fcn.00403080
call fcn.004e6c85
ret

Function at 0x416fcf
Capabilities:
Read .ini file

Disassembly:
push 4
mov eax, 0x4fb5ab
call fcn.004e6cb7
mov eax, dword [0x548750]
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push 0x54dbe8
push str._sUser.ini
push eax
call fcn.0040306c
add esp, 0xc
push dword [ebp - 0x10]
push 1
push str.minitotray
push 0x513960
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.00403080
mov eax, esi
call fcn.004e6c85
ret
Function at 0x41d45e
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5475b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
push str.filename_edit
lea ecx, [esi + 0x28]
mov eax, dword [ecx]
call dword [eax + 0x20]
mov edi, eax
xor ebx, ebx
test edi, edi
je 0x41d4ea
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.004deff0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [edi + 0x6c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41d4c7
sub ecx, edx
sar ecx, 1
je 0x41d4ea
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0xf4]
call fcn.004028f2
push ebx
push 1
push 0x10
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d9731
mov esp, ebp
pop ebp
ret
Function at 0x41f9e0
Capabilities:
Create thread

Disassembly:
cmp dword [0x548a68], 0
push edi
mov edi, ecx
je 0x41fa34
push ebx
xor ebx, ebx
mov dword [0x548a68], ebx
call fcn.0046b844
test eax, eax
je 0x41fa33
push esi
call fcn.0046b5b2
mov esi, eax
cmp dword [esi + 4], ebx
jne 0x41fa1e
push ebx
push ebx
push esi
push 0x46d15d
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
push ebx
push 0x1388
push 0x17d
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
pop esi
pop ebx
pop edi
ret

Function at 0x41fc9c
Capabilities:
Create thread
Read .ini file

Disassembly:
push 0xc
mov eax, 0x4fe2d9
call fcn.004e6cb7
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x154], ebx
jne 0x41fe33
mov dword [esi + 0x154], 1
mov eax, dword [0x548750]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], eax
mov edi, 0x54dbe8
mov byte [ebp - 4], 1
push edi
lea eax, [ebp - 0x14]
push str._sdata.xml
push eax
call fcn.0040306c
add esp, 0xc
lea eax, [ebp - 0x18]
push edi
push str._sin_data.xml
push eax
call fcn.0040306c
pop ecx
pop ecx
push dword [ebp - 0x14]
call fcn.004b179f
push ebx
push ebx
push esi
push 0x4236b6
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0043340d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
push str.usergame_wnd
lea ecx, [esi + 0x8734]
call fcn.0044b69b
test eax, eax
je 0x41fd40
add eax, 0xffffffdc
jmp 0x41fd42
mov eax, ebx
mov dword [esi + 0x8770], eax
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 0x10]
push dword [esi + 4]
lea ecx, [esi + 0x524]
call fcn.004bb1df
mov ecx, esi
call fcn.0044a726
mov ecx, esi
call fcn.0041f9e0
mov eax, dword [esi + 0x8754]
cmp dword [eax - 8], 0
je 0x41fd92
and dword [esi + 0x8750], 0
mov ecx, esi
push eax
call fcn.00422517
mov bl, al
mov dword [esi + 0x8750], 1
push str.http:__stc3.teeqee.com_start_game.html
lea ecx, [ebp - 0x10]
call fcn.00404fa0
mov byte [ebp - 4], 2
call fcn.00433846
test al, al
jne 0x41fdb9
push str.http:__cusbox.6wan.com_Home_Ad_getTabNewPage
lea ecx, [ebp - 0x10]
call fcn.004028f2
test bl, bl
jne 0x41fe01
cmp byte [0x548a64], bl
je 0x41fe1b
push dword [0x549e80]
mov esi, str.show
mov byte [0x548a64], bl
push 1
push esi
mov edi, 0x514c24
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
jne 0x41fe01
push 0
push esi
push edi
call fcn.00433e43
push ecx
mov ecx, dword [ebp - 0x10]
xor edx, edx
call fcn.00403188
pop ecx
jmp 0x41fe1b
mov ecx, dword [0x54d9b4]
test ecx, ecx
je 0x41fe1b
push ecx
push ecx
push dword [ebp - 0x10]
add ecx, 0x524
call fcn.004bbb40
lea ecx, [ebp - 0x10]
call fcn.00403080
lea ecx, [ebp - 0x18]
call fcn.00403080
lea ecx, [ebp - 0x14]
call fcn.00403080
call fcn.004e6c85
ret
Function at 0x420464
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov ecx, 0x1e0
cmp eax, ecx
ja 0x420522
je 0x420516
lea esi, [ecx - 0x64]
sub eax, esi
je 0x4204ec
dec eax
je 0x4204e0
sub eax, 6
je 0x4204d4
sub eax, 0x59
je 0x4204c8
dec eax
je 0x4204ba
dec eax
je 0x4204ae
dec eax
jne 0x4205ac
mov ecx, edi
call fcn.0042420a
jmp 0x4205ac
mov ecx, edi
call fcn.0042448c
jmp 0x4205ac
mov ecx, edi
call fcn.004236f2
push 0x1dd
jmp 0x420508
mov ecx, edi
call fcn.00420683
jmp 0x4205ac
mov ecx, edi
call fcn.0041fc5a
jmp 0x4205ac
mov ecx, edi
call fcn.0041fb32
jmp 0x4205ac
mov ecx, 0x54e500
call fcn.0040503b
mov ecx, 0x54e4fc
call fcn.0040503b
and dword [0x54e4f8], 0
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x4205ac
mov ecx, edi
call fcn.00420608
jmp 0x4205ac
mov ecx, 0x1e1
sub eax, ecx
je 0x42059d
dec eax
je 0x420594
dec eax
je 0x420578
dec eax
je 0x420561
dec eax
je 0x420558
dec eax
jne 0x4205ac
cmp dword [edi + 0x180], eax
jne 0x420548
mov eax, dword [edi + 0x87e4]
push dword [edi + 0x87f0]
mov ecx, edi
push eax
call fcn.00423848
jmp 0x4205ac
mov ecx, edi
call fcn.004206c9
jmp 0x4205ac
mov esi, dword [edi]
lea ecx, [edi + 0x24]
mov eax, dword [ecx]
push str.searchgif
call dword [eax + 0x20]
push eax
mov ecx, edi
call dword [esi + 0x6c]
jmp 0x4205ac
xor eax, eax
push eax
push eax
push edi
push 0x421522
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1e3
jmp 0x420508
mov ecx, edi
call fcn.004205b4
jmp 0x4205ac
push ecx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.00423be8
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x4205b4
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x87ac]
call fcn.00404c46
test eax, eax
je 0x420606
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x87a8]
xor edx, edx
mov ecx, 0x3e8
div ecx
cmp eax, 0xa
jb 0x420606
push 0x1e2
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 1
xor eax, eax
push eax
push eax
push dword [esi + 0x87ac]
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
ret

Function at 0x420608
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov esi, ecx
push 0x1e0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esi + 4]
mov edi, 0x7530
push 0x14
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], 0x6c
mov dword [ebp - 4], 1
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x4c0
call fcn.004da35a
pop ecx
push 5
xor edx, edx
pop ecx
test eax, eax
je 0x420664
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0xc], edi
jmp 0x420666
mov eax, edx
push edx
push edx
push eax
push 0x431422
mov edi, eax
lea esi, [ebp - 0x14]
push edx
rep movsd dword es:[edi], dword [esi]
push edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x420683
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push 0x1dc
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov esi, dword [esi + 4]
push 8
call fcn.004da35a
pop ecx
xor ecx, ecx
test eax, eax
je 0x4206ac
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x4206ae
mov eax, ecx
push ecx
push ecx
push eax
push 0x43bd2d
push ecx
push ecx
mov dword [eax], esi
mov dword [eax + 4], 0x4c1
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
ret

Function at 0x4206c9
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push 0x1e5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov esi, dword [esi + 4]
push 8
call fcn.004da35a
pop ecx
xor ecx, ecx
test eax, eax
je 0x4206f2
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x4206f4
mov eax, ecx
push ecx
push ecx
push eax
push 0x46aa9a
push ecx
push ecx
mov dword [eax], esi
mov dword [eax + 4], 0x4ca
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
ret
Function at 0x42181b
Capabilities:
Get graphical window text

Disassembly:
push 0x230
mov eax, 0x4fe47b
call fcn.004e6cea
mov esi, ecx
mov dword [ebp - 0x230], esi
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
push 0x54b9d8
push 0x54acb4
push edi
push eax
call fcn.004fb014
mov ebx, eax
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
mov dword [ebp - 0x220], ebx
call fcn.004deff0
add esp, 0x20
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [ebx + 0x6c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x218]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4218b3
test dx, dx
je 0x4218af
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4218b3
add eax, 4
add ecx, 4
test dx, dx
jne 0x42188d
mov eax, edi
jmp 0x4218b8
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4219fd
lea eax, [esi + 0x87c4]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea edi, [esi + 0x87b8]
mov eax, dword [edi + 4]
sub eax, dword [edi]
sar eax, 2
test eax, eax
jle 0x4219e8
xor eax, eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], eax
lea ecx, [ebp - 0x22c]
mov dword [ebp - 4], eax
call fcn.00421b44
mov esi, dword [ebp - 0x228]
mov ebx, dword [ebp - 0x22c]
sub esi, ebx
sar esi, 2
test esi, esi
jle 0x4219c9
push 0x514e60
lea ecx, [ebp - 0x21c]
call fcn.00404fa0
xor eax, eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], eax
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x23c]
call fcn.00412be2
lea eax, [ebp - 0x21c]
mov ecx, edi
push eax
call fcn.00412be2
test esi, esi
jle 0x421978
push ebx
mov ecx, edi
call fcn.00412be2
add ebx, 4
dec esi
jne 0x42196a
mov ebx, dword [ebp - 0x220]
mov ecx, ebx
call fcn.0045b05d
push edi
mov ecx, ebx
call fcn.0045b008
lea esi, [ebx + 0x114]
mov ecx, esi
call fcn.004138fb
lea eax, [ebp - 0x23c]
mov ecx, esi
push eax
call fcn.004132e6
push 1
mov ecx, ebx
call fcn.0045ad44
lea ecx, [ebp - 0x23c]
call fcn.004114d2
lea ecx, [ebp - 0x21c]
call fcn.00403080
jmp 0x4219d5
mov ecx, dword [ebp - 0x220]
push edi
call fcn.0045ae70
lea ecx, [ebp - 0x22c]
call fcn.004114d2
mov esi, dword [ebp - 0x230]
jmp 0x4219f0
push edi
mov ecx, ebx
call fcn.0045ae70
lea eax, [esi + 0x87c4]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
call fcn.004e6c99
ret 8
Function at 0x421b44
Capabilities:
Read .ini file

Disassembly:
push 0x218
mov eax, 0x4fe4fa
call fcn.004e6cea
mov edi, ecx
xor ebx, ebx
mov esi, ebx
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.004deff0
mov eax, dword [0x548750]
mov dword [ebp - 0x21c], eax
inc esi
mov dword [ebp - 4], ebx
push esi
lea eax, [ebp - 0x21c]
push str.searchword_d
push eax
call fcn.0040306c
add esp, 0x18
lea eax, [ebp - 0x218]
push dword [0x549e80]
push 0x104
push eax
push 0x512700
push dword [ebp - 0x21c]
push str.searchword
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x421bc9
sub ecx, edx
sar ecx, 1
je 0x421c23
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x220]
call fcn.00404fa0
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 1
push eax
mov ecx, edi
call fcn.00412be2
lea ecx, [ebp - 0x220]
call fcn.00403080
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.00403080
cmp esi, 3
jl 0x421b59
jmp 0x421c2e
lea ecx, [ebp - 0x21c]
call fcn.00403080
call fcn.004e6c99
ret

Function at 0x421c34
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x5475b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
push str.searchedit
lea ecx, [ebx + 0x24]
mov eax, dword [ecx]
call dword [eax + 0x20]
mov edi, eax
test edi, edi
je 0x421cf3
xor esi, esi
mov edx, esi
movzx ecx, word [edx + 0x514c90]
mov word [ebp + edx - 0x418], cx
add edx, 2
test cx, cx
jne 0x421c67
push 0x104
lea eax, [ebp - 0x210]
push eax
push dword [edi + 0x6c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [ebp - 0x418]
cmp word [ebp - 0x210], si
je 0x421ce5
lea eax, [ebp - 0x210]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x421ccc
test dx, dx
je 0x421cd1
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x421ccc
add eax, 4
add ecx, 4
test dx, dx
jne 0x421ca8
jmp 0x421cd1
sbb esi, esi
or esi, 1
test esi, esi
je 0x421cf3
lea eax, [ebp - 0x210]
mov ecx, ebx
push eax
call fcn.00421dbd
jmp 0x421cf3
mov eax, dword [edi]
push esi
push ecx
push str.distext
mov ecx, edi
call dword [eax + 0x34]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d9731
mov esp, ebp
pop ebp
ret
Function at 0x422022
Capabilities:
Read .ini file

Disassembly:
push 0x10c
mov eax, 0x4fe550
call fcn.004e6cea
mov edi, ecx
mov eax, dword [0x548750]
mov dword [ebp - 0x114], eax
push 0x54dbe8
lea eax, [ebp - 0x114]
xor ebx, ebx
push str._sUser.ini
push eax
mov dword [ebp - 4], ebx
call fcn.0040306c
add esp, 0xc
push dword [ebp - 0x114]
push ebx
push str.nottips
push 0x513940
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x114]
mov esi, eax
call fcn.00403080
test esi, esi
jne 0x4220b9
push ecx
lea ecx, [ebp - 0x110]
call fcn.00416a5e
push ecx
push dword [edi + 4]
lea ecx, [ebp - 0x110]
call fcn.00424c7f
mov esi, eax
lea ecx, [ebp - 0x110]
neg esi
sbb esi, esi
call fcn.00416af8
and esi, 1
je 0x4220fb
call fcn.00416fcf
test eax, eax
je 0x4220e2
push ebx
push 0xf020
push 0x112
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4220fb
call fcn.004b07bc
push ebx
push ebx
push 0x10
mov dword [eax + 0x30], 1
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
call fcn.004e6c99
ret
Function at 0x4221b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x873c], ebx
jne 0x4221ec
push 0x14
call fcn.004da35a
pop ecx
test eax, eax
je 0x4221da
mov ecx, eax
call fcn.00454693
jmp 0x4221dc
mov eax, ebx
push ebx
push 0x6d
mov ecx, eax
mov dword [edi + 0x873c], eax
call fcn.00454e8c
mov ecx, dword [edi + 0x873c]
lea eax, [ebp - 0x10]
push ebx
push eax
add ecx, 4
call fcn.00424a81
push dword [0x549e80]
push 1
mov ebx, dword [eax]
push str.show
push 0x514f1c
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 1
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetSubMenu]
mov ebx, eax
mov esi, 0x100
test ebx, ebx
je 0x422273
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x30
push eax
push 0
push 0x815f
push ebx
mov dword [ebp - 0x3c], 0x20
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
test eax, eax
je 0x422273
push dword [ebp - 0x20]
cmp dword [ebp - 4], 0
lea eax, [esi + 8]
mov ecx, 0x815f
push ecx
cmovne eax, esi
push eax
push ecx
push ebx
call dword [sym.imp.USER32.dll_ModifyMenuW]
call fcn.0046930d
lea esi, [eax - 1]
neg esi
sbb esi, esi
inc esi
test ebx, ebx
je 0x4222c7
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x30
push eax
push 0
push 0x8168
push ebx
mov dword [ebp - 0x3c], 0x20
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
test eax, eax
je 0x4222c7
push dword [ebp - 0x20]
mov eax, 0x100
mov ecx, 0x8168
test esi, esi
push ecx
lea edx, [eax + 8]
cmovne eax, edx
push eax
push ecx
push ebx
call dword [sym.imp.USER32.dll_ModifyMenuW]
mov ebx, dword [ebp - 0xc]
lea edx, [ebp - 8]
mov ecx, ebx
call fcn.00454768
test eax, eax
je 0x4222f9
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, dword [ebp - 8]
mov edx, dword [ebp + 8]
lea ecx, [esi + edx]
cmp ecx, eax
jl 0x4222fc
mov edx, eax
sub edx, esi
sub edx, 2
mov dword [ebp + 8], edx
jmp 0x4222fc
mov edx, dword [ebp + 8]
xor esi, esi
push esi
push dword [edi + 4]
push esi
push dword [ebp + 0xc]
push edx
push esi
push ebx
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push esi
push esi
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x422847
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4fe663
mov eax, dword fs:[0]
push eax
sub esp, 0x348
mov eax, dword [0x5475b0]
xor eax, esp
mov dword [esp + 0x340], eax
push ebx
push esi
push edi
mov eax, dword [0x5475b0]
xor eax, esp
push eax
lea eax, [esp + 0x358]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 0xc]
test esi, esi
jle 0x4229b4
lea ecx, [esp + 0x1c]
call fcn.00411306
lea eax, [esp + 0x1c]
xor ebx, ebx
push eax
push esi
mov dword [esp + 0x368], ebx
call fcn.004b47d9
test eax, eax
je 0x42298c
mov eax, dword [esp + 0x78]
cmp dword [eax - 8], ebx
je 0x42298c
mov ecx, dword [0x54d9b4]
test ecx, ecx
je 0x4228df
push 1
push ebx
push eax
add ecx, 0x524
call fcn.004bb96e
mov ecx, dword [esp + 0x7c]
cmp dword [ecx - 8], ebx
je 0x4229a3
mov eax, dword [0x548750]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
mov byte [esp + 0x360], 2
push eax
lea edx, [esp + 0x18]
call fcn.0040dc7a
mov esi, dword [esp + 0x14]
pop ecx
cmp dword [esi - 8], ebx
je 0x422978
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, esi
mov dword [edi + 0x87a8], eax
lea ecx, [esp + 0x18]
call fcn.0040db4d
lea esi, [edi + 0x87ac]
mov byte [esp + 0x360], 3
push eax
mov ecx, esi
call fcn.00402aef
lea ecx, [esp + 0x18]
mov byte [esp + 0x360], 2
call fcn.00403080
mov ecx, dword [esi]
call fcn.00404c46
test eax, eax
jne 0x422978
push ebx
push dword [esi]
push dword [esp + 0x84]
call fcn.0040cfcf
mov ecx, eax
call fcn.0040d654
lea ecx, [esp + 0x10]
call fcn.00403080
lea ecx, [esp + 0x14]
call fcn.00403080
jmp 0x4229a3
push ebx
push ebx
push esi
push 0x422799
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esp + 0x360], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.00410abb
xor eax, eax
mov ecx, dword [esp + 0x358]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x340]
xor ecx, esp
call fcn.004d9731
mov esp, ebp
pop ebp
ret 0x10

Function at 0x422c2d
Capabilities:
Create thread

Disassembly:
push 0
mov eax, 0x4fe731
call fcn.004e6cb7
lea esi, [ecx + 0x87e0]
xor edi, edi
mov ecx, dword [esi]
cmp dword [ecx - 8], edi
je 0x422c5a
push ecx
xor edx, edx
call fcn.00403188
pop ecx
mov ecx, esi
call fcn.0040503b
jmp 0x422c99
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x422c99
cmp dword [ebp + 0x10], edi
jle 0x422c89
mov edx, eax
lea ecx, [ebp + 0xc]
call fcn.004691a9
mov dword [ebp - 4], edi
xor edx, edx
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00403188
pop ecx
lea ecx, [ebp + 0xc]
call fcn.00403080
jmp 0x422c99
push edi
push edi
push eax
push 0x422ab5
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
call fcn.004e6c85
ret 0x10