Function at 0x422537
Capabilities:
Read .ini file

Disassembly:
push 0x11c
mov eax, 0x5ca5a0
call fcn.00595e89
xor esi, esi
inc esi
mov dword [ebp - 4], esi
call fcn.00471470
cmp eax, 6
push ecx
mov ecx, esp
mov dword [ebp - 0x114], esp
jge 0x4225bc
push str.__Not_running_vista__skipping_low_cookie_handler.
call fcn.004015a6
mov byte [ebp - 4], 2
push 4
mov byte [ebp - 4], 1
call fcn.0040b216
push ecx
mov ecx, esp
mov dword [ebp - 0x114], esp
push str.NotVista
call fcn.004015a6
mov byte [ebp - 4], 3
mov byte [ebp - 4], 1
mov ecx, ebx
call fcn.00421b43
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00401752
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00401752
mov eax, esi
call fcn.00595f0c
ret 8
push str.__handling_low_cookies...
call fcn.004015a6
mov byte [ebp - 4], 4
push 4
mov byte [ebp - 4], 1
call fcn.0040b216
push ecx
mov ecx, esp
mov dword [ebp - 0x114], esp
push str.cookie.dat
call fcn.004015a6
mov byte [ebp - 4], 5
push ecx
mov eax, esp
mov dword [ebp - 0x118], esp
push eax
call fcn.00474e72
pop ecx
mov byte [ebp - 4], 6
mov byte [ebp - 4], 1
lea esi, [ebp - 0x120]
call fcn.0040d17c
mov byte [ebp - 4], 7
add esp, 4
mov ecx, esp
mov dword [ebp - 0x114], esp
push str..ini
call fcn.004015a6
mov byte [ebp - 4], 8
push ecx
mov eax, esi
mov ecx, esp
mov dword [ebp - 0x118], esp
push eax
call fcn.004049a2
mov byte [ebp - 4], 9
mov byte [ebp - 4], 7
lea esi, [ebp - 0x128]
call fcn.0040d0ba
mov byte [ebp - 4], 0xa
add esp, 4
lea eax, [ebp - 0x120]
mov ecx, esp
mov dword [ebp - 0x114], esp
push eax
call fcn.004049a2
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 0xa
call fcn.0040cd4f
mov eax, esi
mov ecx, esp
mov dword [ebp - 0x114], esp
push eax
call fcn.004049a2
mov byte [ebp - 4], 0xc
mov byte [ebp - 4], 0xa
call fcn.0040cd4f
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 0xc]
test eax, eax
pop ecx
mov edi, 0x61b3bc
jne 0x42270e
lea esi, [ebp - 0x118]
call fcn.0040d1ea
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x124]
push edi
push ecx
mov ecx, eax
call fcn.004046a1
mov byte [ebp - 4], 0xe
push edi
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.0040463d
add esp, 0x14
mov byte [ebp - 4], 0xf
push eax
lea ecx, [ebp + 0xc]
call fcn.004048fa
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x11c]
call fcn.00401752
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x124]
call fcn.00401752
mov byte [ebp - 4], 0xa
mov ecx, esi
call fcn.00401752
lea eax, [ebp - 0x114]
push str.__domain
push eax
lea ecx, [ebp + 8]
call fcn.004046a1
mov byte [ebp - 4], 0x10
push str.__lowcookie_
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.0040463d
add esp, 0x14
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x120]
push ecx
push eax
lea eax, [ebp - 0x124]
push eax
call fcn.004045e6
add esp, 0xc
mov byte [ebp - 4], 0x12
push edi
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.0040463d
add esp, 0xc
mov byte [ebp - 4], 0x13
push eax
lea ecx, [ebp + 0xc]
call fcn.004047d6
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x118]
call fcn.00401752
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x124]
call fcn.00401752
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x11c]
call fcn.00401752
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x114]
call fcn.00401752
push ecx
mov eax, esp
mov dword [ebp - 0x114], esp
push str.__running_low_process:
push eax
lea ecx, [ebp + 0xc]
call fcn.004046a1
pop ecx
pop ecx
mov byte [ebp - 4], 0x14
push 4
mov byte [ebp - 4], 0xa
call fcn.0040b216
push 0xffffffffffffffff
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x114], esp
push eax
call fcn.004049a2
mov byte [ebp - 4], 0x15
mov byte [ebp - 4], 0xa
call fcn.00421af9
test eax, eax
pop ecx
pop ecx
jne 0x42288a
push 1
push 0xf4
push ecx
mov ecx, esp
mov dword [ebp - 0x114], esp
push str.CCookieManager::HandleVistaLowCookies
call fcn.004015a6
mov byte [ebp - 4], 0x16
push ecx
mov ecx, esp
mov dword [ebp - 0x118], esp
push str.CreateLowIntegrityProcess_failed_
call fcn.004015a6
mov byte [ebp - 4], 0x17
push ecx
mov ecx, esp
mov dword [ebp - 0x124], esp
push str.createlow
call fcn.004015a6
mov byte [ebp - 4], 0x18
lea ecx, [ebx + 4]
mov eax, dword [ecx]
mov byte [ebp - 4], 0xa
call dword [eax + 0x10]
push dword [ebx + 0xc]
push ecx
mov ecx, esp
mov dword [ebp - 0x114], esp
push str.Vista.CreateLowError
call fcn.004015a6
mov byte [ebp - 4], 0x19
push ebx
mov byte [ebp - 4], 0xa
call fcn.00421b8b
xor esi, esi
jmp 0x4229d4
push dword [ebp - 0x128]
lea eax, [ebp - 0x110]
push 0x100
push eax
push str.Vista.NoResult
push str.Result
push str.Cookie
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ecx
lea eax, [ebp - 0x110]
mov ecx, esp
mov dword [ebp - 0x114], esp
push eax
call fcn.004015a6
mov byte [ebp - 4], 0x1a
mov byte [ebp - 4], 0xa
mov ecx, ebx
call fcn.00421b43
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x114]
call fcn.004015a6
mov byte [ebp - 4], 0x1b
push ecx
mov ecx, esp
mov dword [ebp - 0x118], esp
push str.__vista_result
push ecx
mov ecx, eax
call fcn.004046a1
pop ecx
pop ecx
mov byte [ebp - 4], 0x1c
push 4
mov byte [ebp - 4], 0x1b
call fcn.0040b216
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x114]
call fcn.00401752
lea ecx, [ebp - 0x11c]
call fcn.004048be
mov byte [ebp - 4], 0x1d
push ecx
lea eax, [ebp - 0x120]
mov ecx, esp
mov dword [ebp - 0x114], esp
push eax
call fcn.004049a2
mov byte [ebp - 4], 0x1e
lea eax, [ebp - 0x11c]
push eax
mov byte [ebp - 4], 0x1d
mov ecx, ebx
call fcn.00422e12
test eax, eax
je 0x42299c
push ecx
lea eax, [ebp - 0x11c]
mov ecx, esp
mov dword [ebp - 0x114], esp
push eax
call fcn.004049a2
mov byte [ebp - 4], 0x1f
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x118], esp
push eax
call fcn.004049a2
mov byte [ebp - 4], 0x20
push ebx
mov byte [ebp - 4], 0x1d
call fcn.0042228b
test eax, eax
jne 0x4229a0
xor esi, esi
jmp 0x4229c5
push ecx
mov ecx, esp
mov dword [ebp - 0x114], esp
push str.Vista.CopiedLow
call fcn.004015a6
mov byte [ebp - 4], 0x21
mov byte [ebp - 4], 0x1d
mov ecx, ebx
call fcn.00421b43
xor esi, esi
inc esi
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x11c]
call fcn.00401752
push ecx
lea eax, [ebp - 0x120]
mov ecx, esp
mov dword [ebp - 0x114], esp
push eax
call fcn.004049a2
mov byte [ebp - 4], 0x22
mov byte [ebp - 4], 0xa
call fcn.0040cd4f
lea eax, [ebp - 0x128]
mov ecx, esp
mov dword [ebp - 0x114], esp
push eax
call fcn.004049a2
mov byte [ebp - 4], 0x23
mov byte [ebp - 4], 0xa
call fcn.0040cd4f
pop ecx
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x128]
call fcn.00401752
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x120]
call fcn.00401752
jmp 0x42259a