joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444620
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
mov eax, dword [esp + 0x14]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push bind
mov dword [esp + 0x2c], ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x444715
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 2
push 0
push 0
push ebp
call edi
mov esi, eax
mov dword [esp + 0x18], esi
lea ecx, [esi + 1]
push ecx
call dword [sym.imp.MSVCRT.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x44470e
push 0
push 0
push 0
push ebp
call edi
lea edx, [esp + 0x10]
push 0
push edx
push esi
push ebx
push ebp
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x444704
cmp dword [esp + 0x10], esi
jne 0x444704
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x20]
or ecx, 0xffffffff
push ebp
lea edx, [eax + 0x34]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ebx
mov byte [ebx + eax], 0
call fcn.00444550
push ebx
mov esi, eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
push ebx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 4
Function at 0x445570
Capabilities:
Get mac address on windows

Disassembly:
mov eax, 0x1288
call fcn.004557b0
push ebx
lea eax, [esp + 4]
push edi
lea ecx, [esp + 0x10]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edi
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
jne 0x445621
mov edx, dword [esp + 8]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x44562a
push ebp
lea eax, [esp + 0xc]
push esi
push eax
push ebx
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x445600
mov eax, ebx
mov ecx, dword [eax + 0x190]
lea edx, [ecx + edi]
cmp edx, 0x1000
jae 0x445609
mov ebp, ecx
lea esi, [eax + 0x194]
lea edi, [esp + edi + 0x298]
mov eax, dword [eax]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test eax, eax
mov edi, edx
jne 0x4455ca
jmp 0x445609
add eax, 0xf0000000
mov dword [esp + 0x14], eax
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x14]
pop esi
pop ebp
jmp 0x445626
add eax, 0xe0000000
test eax, eax
je 0x445635
pop edi
xor eax, eax
pop ebx
add esp, 0x1288
ret
mov ecx, dword [esp + 0x293]
mov edx, dword [esp + 0x294]
mov eax, dword [esp + 0x295]
and ecx, 0xff
add ecx, 0xff00
and edx, 0xff
shl ecx, 8
add ecx, edx
mov edx, dword [esp + 0x1294]
shl ecx, 8
and eax, 0xff
pop edi
add ecx, eax
mov eax, dword [esp + 0x28c]
and eax, 0xff
mov dword [edx], ecx
mov ecx, dword [esp + 0x28d]
mov edx, dword [esp + 0x28e]
add eax, 0xff00
and ecx, 0xff
shl eax, 8
add eax, ecx
mov ecx, dword [esp + 0x1294]
shl eax, 8
and edx, 0xff
pop ebx
add eax, edx
mov dword [ecx], eax
mov eax, 1
add esp, 0x1288
ret

Function at 0x4456e0
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x2c00
call fcn.004557b0
mov eax, dword [esp + 0x2c0c]
push ebx
push ebp
push esi
test eax, eax
push edi
mov ebx, ecx
jne 0x44570a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2c00
ret 0xc
mov ebp, dword [esp + 0x2c14]
mov ecx, 0xa00
xor eax, eax
lea edi, [esp + 0x410]
rep stosd dword es:[edi], eax
push ebx
lea eax, [esp + 0x414]
push 0x2800
push eax
push 0x4db968
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0x410]
lea esi, [esp + 0x410]
test al, al
je 0x4457b9
mov ecx, dword [esp + 0x2c18]
push esi
push ecx
call fcn.004457d0
add esp, 8
test eax, eax
je 0x4457a4
push ebx
lea edx, [esp + 0x14]
push 0x400
push edx
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x1c]
push 0x4db968
push esi
push ebp
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [esp + 0x2c1c]
lea edx, [esp + 0x10]
push edx
push esi
mov eax, dword [ecx]
push ebp
push ebx
call dword [eax]
test eax, eax
je 0x4456fb
cmp byte [esi], 0
je 0x4457b1
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x4457a9
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x44574f
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2c00
ret 0xc
Function at 0x445830
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea eax, [esp]
push esi
push eax
push 0x20019
push 0
push ecx
push edx
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, dword [esp + 4]
test eax, eax
jne 0x445899
test edx, edx
je 0x445899
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x18]
mov word [eax], 0
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
pop esi
pop ecx
ret
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4458bb
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ecx
push eax
push edx
call dword [sym.imp.MSVCRT.dll_memmove]
mov edx, dword [esp + 0x10]
add esp, 0xc
jmp 0x4458d5
mov ecx, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x1c]
mov esi, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
rep stosb byte es:[edi], al
pop edi
test edx, edx
je 0x4458e0
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
pop ecx
ret

Function at 0x4458f0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x14]
lea ecx, [esp + 4]
push eax
mov eax, dword [esp + 0x28]
push ecx
push 0
push 0x2001f
push 0
push edi
push 0
push edx
push eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x445939
xor al, al
pop edi
add esp, 8
ret
push esi
mov esi, str.null
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x445965
test cl, cl
je 0x445961
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x445965
add eax, 2
add esi, 2
test cl, cl
jne 0x445941
xor eax, eax
jmp 0x44596a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x445970
xor edi, edi
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0xc]
push ecx
push edx
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 8]
mov esi, eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
pop edi
sete al
add esp, 8
ret
Function at 0x446160
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4b6411
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.00445e50
xor edi, edi
lea ecx, [esi + 0x1c]
mov dword [esp + 0x14], edi
call sub.MFC42.DLL_CString::CString_5
lea ecx, [esi + 0x80]
mov byte [esp + 0x14], 1
call fcn.0045c060
lea ecx, [esi + 0x98]
mov byte [esp + 0x14], 2
call fcn.0045c060
lea ecx, [esi + 0xb0]
mov byte [esp + 0x14], 3
call fcn.0045c060
lea ecx, [esi + 0xc8]
mov byte [esp + 0x14], 4
call fcn.0045c060
lea ecx, [esi + 0xe0]
mov byte [esp + 0x14], 5
call fcn.0045c060
lea ecx, [esi + 0xf8]
mov byte [esp + 0x14], 6
call fcn.0045c060
lea ecx, [esi + 0x110]
mov byte [esp + 0x14], 7
call fcn.0045c060
lea ecx, [esi + 0x128]
mov byte [esp + 0x14], 8
call fcn.0045c060
lea ecx, [esi + 0x140]
mov byte [esp + 0x14], 9
call fcn.0045c060
lea ecx, [esi + 0x158]
mov byte [esp + 0x14], 0xa
call fcn.004a9560
mov dword [esi], 0x4c13f4
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x1b8], 0xa19d9d
mov dword [esi + 0x1bc], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0xb4], edi
mov dword [esi + 0xcc], edi
mov ecx, dword [esp + 0xc]
mov dword [esi + 0xe4], edi
mov dword [esi + 0xfc], edi
mov dword [esi + 0x114], edi
mov dword [esi + 0x144], edi
mov dword [esi + 0x12c], edi
mov dword [esi + 0x19c], edi
mov dword [esi + 0x1a0], edi
mov dword [esi + 0x1a4], edi
mov dword [esi + 0x1a8], edi
mov dword [esi + 0x1b4], edi
mov dword [esi + 0x1ac], edi
mov dword [esi + 0x1b0], edi
mov dword [esi + 0x1c0], edi
mov dword [esi + 0x1c4], 9
mov dword [esi + 0x1c8], 0x14
mov dword [esi + 0x1cc], 6
mov dword [esi + 0x18], 1
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x446450
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 4]
push esi
test eax, eax
mov esi, ecx
je 0x4464a7
push edi
lea edi, [esi + 0x1c]
push eax
mov ecx, edi
call sub.MFC42.DLL_CString::operator_1
mov ecx, esi
call fcn.004464b0
mov edi, dword [edi]
push edi
push 1
push str.ThemeVer
push str.Theme
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
mov dword [esi + 0x18], eax
pop edi
jne 0x446497
mov ecx, esi
call fcn.004467b0
pop esi
ret 4
cmp eax, 2
jne 0x4464a7
mov ecx, esi
call fcn.00446aa0
pop esi
ret 4
xor eax, eax
pop esi
ret 4
Function at 0x446530
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b64e6
push eax
mov dword fs:[0], esp
mov eax, dword [ecx + 0x1c]
sub esp, 0x10c
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x44656e
xor eax, eax
mov ecx, dword [esp + 0x10c]
mov dword fs:[0], ecx
add esp, 0x118
ret 0xc
mov ecx, dword [esp + 0x124]
mov edx, dword [esp + 0x120]
push eax
lea eax, [esp + 0xc]
push 0x104
push eax
push 0x4db968
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 8]
test al, al
jne 0x4465b5
xor eax, eax
mov ecx, dword [esp + 0x10c]
mov dword fs:[0], ecx
add esp, 0x118
ret 0xc
lea eax, [esp + 8]
push esi
push eax
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_4
push 0x4d6160
lea ecx, [esp + 0xc]
push 0x4dbf74
push ecx
mov dword [esp + 0x124], 0
call sub.MFC42.DLL_operator_1
mov esi, dword [esp + 0x120]
push eax
mov ecx, esi
mov byte [esp + 0x11c], 1
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 8]
mov byte [esp + 0x118], 0
call sub.MFC42.DLL_CString::CString
lea edx, [esp + 4]
mov ecx, esi
push edx
call sub.MFC42.DLL_CString::operator_2
lea ecx, [esp + 4]
mov dword [esp + 0x118], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x110]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x118
ret 0xc
Function at 0x44bb80
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
push esi
mov edx, ecx
push edi
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0xd]
mov dword [esp + 8], eax
mov byte [esp + 0xc], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [edx + 4]
mov edx, dword [esp + 0x118]
push eax
lea ecx, [esp + 0x10]
push 0x104
push ecx
push 0x4db968
push edx
push str.GameNodeURL
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, dword [esp + 0x114]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_4
mov eax, esi
pop edi
pop esi
add esp, 0x108
ret 8

Function at 0x44db10
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
mov esi, ecx
push edi
push eax
lea ecx, [esp + 0x18]
call fcn.00434d30
mov ebx, dword [esp + 0x18]
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x44dc01
mov edx, dword [ecx]
call dword [edx + 0x3c]
test eax, eax
je 0x44db6f
mov eax, dword [0x4dc5f0]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x44db6f
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0x14]
mov ecx, dword [0x4dc5f4]
push ecx
push 0
push eax
push str.InvisibleGameNode
call ebp
test eax, eax
jne 0x44dbf3
mov eax, dword [0x4dbb54]
mov ecx, dword [esp + 0x14]
push eax
mov eax, dword [0x4dbb2c]
mov edx, dword [ecx]
push eax
call dword [edx + 0x64]
mov edx, dword [esi + 0x130]
xor ecx, ecx
test edx, edx
je 0x44dbad
mov edi, dword [esi + 0x134]
sub edi, edx
sar edi, 2
cmp ecx, edi
jae 0x44dbad
mov edi, dword [esi + 0x130]
cmp dword [edi + ecx*4], eax
je 0x44dbad
inc ecx
jmp 0x44db8c
mov eax, dword [esi + 0x130]
test eax, eax
je 0x44dbc6
mov edx, dword [esi + 0x134]
sub edx, eax
sar edx, 2
cmp ecx, edx
jb 0x44dbc9
or ecx, 0xffffffff
mov eax, dword [esp + 0x14]
push ecx
push eax
push ebx
mov ecx, esi
call fcn.0044da60
mov ecx, dword [esp + 0x14]
mov edi, eax
push edi
mov edx, dword [ecx]
call dword [edx + 0x88]
mov eax, dword [esp + 0x14]
push edi
push eax
mov ecx, esi
call fcn.0044db10
lea ecx, [esp + 0x14]
call fcn.00434d60
jmp 0x44db2e
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x44e320
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
push esi
mov edx, ecx
push edi
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0xd]
mov dword [esp + 8], eax
mov byte [esp + 0xc], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [edx + 4]
lea ecx, [esp + 0xc]
push eax
push 0x104
push ecx
push 0x4db968
push str.Default
push str.GameNodeURL
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, dword [esp + 0x114]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_4
mov eax, esi
pop edi
pop esi
add esp, 0x108
ret 4
Function at 0x44e390
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x200
push ebp
mov ebp, dword [esp + 0x208]
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x1dc]
test eax, eax
je 0x44e430
mov ecx, dword [ebp + 0x28]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x44e3c1
mov eax, dword [ebp + 0x2c]
test eax, eax
je 0x44e3ca
mov eax, dword [0x4dc504]
test eax, eax
jne 0x44e3d6
mov dword [esi + 0x140], 1
jmp 0x44e430
mov eax, dword [esp + 0x214]
test eax, eax
je 0x44e3f9
push 1
push 0
push ebp
mov ecx, esi
call fcn.0044e7b0
pop edi
pop esi
pop ebp
add esp, 0x200
ret 8
mov eax, dword [ebp + 0x2c]
test eax, eax
je 0x44e417
push 1
push eax
mov ecx, esi
call fcn.0044f480
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x140], eax
jmp 0x44e430
mov eax, dword [esi + 0x114]
push ecx
mov ecx, dword [eax + 0x44]
call fcn.004210b0
mov dword [esi + 0x140], 0
mov eax, dword [esi + 0x140]
test eax, eax
je 0x44e518
mov ecx, dword [0x4dbcf0]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ecx
lea edx, [esp + 0x110]
push 0x100
push edx
push 0x4db968
push str.BeforeLoginURL
push 0x4d68a4
call edi
mov eax, dword [0x4dbcf0]
lea ecx, [esp + 0xc]
push eax
push 0x100
push ecx
push 0x4db968
push str.AfterLoginURL
push 0x4d68a4
call edi
mov eax, dword [0x4dc504]
lea edi, [esp + 0xc]
test eax, eax
jne 0x44e49e
lea edi, [esp + 0x10c]
mov ecx, dword [esi + 0x150]
test ecx, ecx
jne 0x44e502
cmp byte [edi], 0
je 0x44e502
test eax, eax
je 0x44e4d2
lea edx, [esp + 0xc]
lea eax, [esp + 0x10c]
push edx
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x44e4d2
mov eax, 1
jmp 0x44e4d4
xor eax, eax
xor ecx, ecx
test eax, eax
sete cl
push ecx
push edi
push ebp
mov ecx, esi
call fcn.0044e7b0
mov eax, 1
pop edi
mov dword [esi + 0x150], eax
mov dword [esi + 0x144], eax
pop esi
pop ebp
add esp, 0x200
ret 8
push 1
push 0
push ebp
mov ecx, esi
call fcn.0044e7b0
mov dword [esi + 0x144], 0
pop edi
pop esi
pop ebp
add esp, 0x200
ret 8
Function at 0x44e39e
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x200
push ebp
mov ebp, dword [esp + 0x208]
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x1dc]
test eax, eax
je 0x44e430
mov ecx, dword [ebp + 0x28]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x44e3c1
mov eax, dword [ebp + 0x2c]
test eax, eax
je 0x44e3ca
mov eax, dword [0x4dc504]
test eax, eax
jne 0x44e3d6
mov dword [esi + 0x140], 1
jmp 0x44e430
mov eax, dword [esp + 0x214]
test eax, eax
je 0x44e3f9
push 1
push 0
push ebp
mov ecx, esi
call fcn.0044e7b0
pop edi
pop esi
pop ebp
add esp, 0x200
ret 8
mov eax, dword [ebp + 0x2c]
test eax, eax
je 0x44e417
push 1
push eax
mov ecx, esi
call fcn.0044f480
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x140], eax
jmp 0x44e430
mov eax, dword [esi + 0x114]
push ecx
mov ecx, dword [eax + 0x44]
call fcn.004210b0
mov dword [esi + 0x140], 0
mov eax, dword [esi + 0x140]
test eax, eax
je 0x44e518
mov ecx, dword [0x4dbcf0]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ecx
lea edx, [esp + 0x110]
push 0x100
push edx
push 0x4db968
push str.BeforeLoginURL
push 0x4d68a4
call edi
mov eax, dword [0x4dbcf0]
lea ecx, [esp + 0xc]
push eax
push 0x100
push ecx
push 0x4db968
push str.AfterLoginURL
push 0x4d68a4
call edi
mov eax, dword [0x4dc504]
lea edi, [esp + 0xc]
test eax, eax
jne 0x44e49e
lea edi, [esp + 0x10c]
mov ecx, dword [esi + 0x150]
test ecx, ecx
jne 0x44e502
cmp byte [edi], 0
je 0x44e502
test eax, eax
je 0x44e4d2
lea edx, [esp + 0xc]
lea eax, [esp + 0x10c]
push edx
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x44e4d2
mov eax, 1
jmp 0x44e4d4
xor eax, eax
xor ecx, ecx
test eax, eax
sete cl
push ecx
push edi
push ebp
mov ecx, esi
call fcn.0044e7b0
mov eax, 1
pop edi
mov dword [esi + 0x150], eax
mov dword [esi + 0x144], eax
pop esi
pop ebp
add esp, 0x200
ret 8
push 1
push 0
push ebp
mov ecx, esi
call fcn.0044e7b0
mov dword [esi + 0x144], 0
pop edi
pop esi
pop ebp
add esp, 0x200
ret 8
Function at 0x44f480
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b6d96
push eax
mov eax, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 0x10c
push ebx
xor ebx, ebx
push ebp
push esi
cmp eax, ebx
push edi
mov esi, ecx
je 0x44f5dd
lea ecx, [esp + 0x14]
mov byte [esp + 0x18], bl
call sub.MFC42.DLL_CString::CString_5
lea ecx, [esp + 0x10]
mov dword [esp + 0x124], ebx
call sub.MFC42.DLL_CString::CString_5
mov edi, dword [esp + 0x12c]
mov eax, dword [0x4dbce8]
push edi
push eax
lea ecx, [esp + 0x1c]
push str._s_advert_0d_settings.ini
push ecx
mov byte [esp + 0x134], 1
call sub.MFC42.DLL_CString::Format_1
mov edx, dword [esp + 0x24]
add esp, 0x10
lea eax, [esp + 0x18]
push edx
push 0x104
push eax
push str.ad.html
push str.MainFile
push str.settings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator_1
push ebx
push str.http:__
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Find_1
lea edx, [esp + 0x18]
test eax, eax
push edx
jge 0x44f5a9
mov eax, dword [0x4dbce8]
push edi
push eax
lea ecx, [esp + 0x1c]
push str._s_advert_0d_s
push ecx
call sub.MFC42.DLL_CString::Format_1
mov edx, dword [esp + 0x24]
push edx
call fcn.00455b60
add esp, 0x18
test eax, eax
je 0x44f57e
mov ecx, dword [esi + 0x114]
push 1
lea eax, [esp + 0x1c]
push ebx
mov ecx, dword [ecx + 0x44]
push eax
push edi
call fcn.00420e50
jmp 0x44f5b7
lea ecx, [esp + 0x10]
mov byte [esp + 0x124], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov dword [esp + 0x124], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
jmp 0x44f637
mov eax, dword [esi + 0x114]
mov ecx, dword [eax + 0x44]
call fcn.004210b0
lea ecx, [esp + 0x10]
mov byte [esp + 0x124], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov dword [esp + 0x124], 0xffffffff
call sub.MFC42.DLL_CString::CString
jmp 0x44f632
mov edx, dword [esi + 0x1a0]
xor eax, eax
cmp edx, ebx
jle 0x44f632
mov edi, dword [esi + 0x19c]
mov ebp, dword [esp + 0x12c]
mov ecx, edi
cmp dword [ecx], ebp
je 0x44f606
inc eax
add ecx, 4
cmp eax, edx
jl 0x44f5f8
jmp 0x44f632
cmp eax, 0xffffffff
je 0x44f632
mov ecx, dword [esi + 0x188]
push ebx
mov edx, dword [ecx + eax*4]
mov ecx, dword [esi + 0x174]
push edx
mov edx, dword [ecx + eax*4]
mov ecx, dword [esi + 0x114]
mov eax, dword [edi + eax*4]
push edx
mov ecx, dword [ecx + 0x44]
push eax
call fcn.00420e50
mov eax, 1
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x118
ret 8
Function at 0x4510f0
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x2e0]
test eax, eax
jne 0x4511a4
mov ebp, dword [esp + 0x14]
or ecx, 0xffffffff
mov edi, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4511a4
mov edx, dword [esp + 0x1c]
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4511a4
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x4511a4
lea edi, [esi + 0x2e8]
push edx
mov ecx, edi
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [edi]
mov ecx, dword [eax - 8]
cmp byte [ecx + eax - 1], 0x5c
jne 0x45115b
dec ecx
push 0
push ecx
mov ecx, edi
call sub.MFC42.DLL_CString::SetAt
mov eax, dword [esp + 0x18]
mov dword [esi + 0x2dc], ebx
lea ebx, [esi + 0x298]
push eax
push ebp
mov ecx, ebx
call fcn.00450060
mov ecx, dword [edi]
push ecx
mov ecx, ebx
call fcn.00450080
push esi
push 0
push 0x451750
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
xor edx, edx
cmp edx, eax
mov dword [esi + 0x2e0], eax
pop edi
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
ret 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10

Function at 0x451260
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push esi
push 0
push 0x451860
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
mov dword [esi + 0x2e4], eax
pop esi
ret