joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46be60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
lea eax, [ebp - 0x41c]
push eax
mov ebx, str.ZNImeSkinFile
push ebx
push SysReAllocString
call esi
test eax, eax
jne 0x46bfea
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push eax
push ebx
push 1
push 0x5e87f0
push dword [ebp - 0x41c]
call edi
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.004830b0
add esp, 0xc
mov ebx, str.SkinInst.exe
push ebx
call fcn.004538e0
mov ecx, eax
call fcn.00467adc
push eax
lea eax, [ebp - 0x414]
push 0x5ebf3c
push eax
call fcn.00407e70
add esp, 0x10
lea eax, [ebp - 0x414]
push 0x104
push eax
push 1
push str.DefaultIcon
push dword [ebp - 0x41c]
call edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004830b0
add esp, 0xc
push ebx
call fcn.004538e0
mov ecx, eax
call fcn.00467adc
push eax
lea eax, [ebp - 0x20c]
push str.__s_s___install
push eax
call fcn.00407e70
lea eax, [ebp - 0x20c]
push 0x5f0e38
push eax
call fcn.00491772
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 1
push str.shellopencommand_
push dword [ebp - 0x41c]
call edi
push dword [ebp - 0x41c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
lea eax, [ebp - 0x418]
push eax
push str..znpf
push SysReAllocString
call esi
test eax, eax
jne 0x46bfe9
push 0x104
push str.ZNImeSkinFile
push 1
push 0x5e87f0
push dword [ebp - 0x418]
call edi
push dword [ebp - 0x418]
call ebx
lea eax, [ebp - 0x418]
push eax
push str..sznpf
push SysReAllocString
call esi
test eax, eax
jne 0x46bfe9
push 0x104
push str.ZNImeSkinFile
push 1
push 0x5e87f0
push dword [ebp - 0x418]
call edi
push dword [ebp - 0x418]
call ebx
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0046ce06
mov esp, ebp
pop ebp
ret

Function at 0x46bffa
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x5e87f0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46c042
push str.ZNImeDictFile
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str..zncel
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x46c046
Capabilities:
Delete registry key

Disassembly:
push esi
mov esi, ecx
call fcn.0046c056
mov ecx, esi
pop esi
jmp fcn.0046bffa

Function at 0x46c056
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x5e87f0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46c0a8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.ZNImeSkinFile
push dword [ebp - 4]
call esi
push str..znpf
push dword [ebp - 4]
call esi
push str..sznpf
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x46e400
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
mov esi, dword [edi + 8]
mov ecx, dword [esi + 8]
call fcn.0046f670
push dword [ebp + 0xc]
mov ecx, dword [esi + 8]
call fcn.0046f620
push dword [ebp + 0x10]
mov ecx, dword [esi + 8]
call fcn.0046f6c0
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x10]
test eax, eax
je 0x46e43c
mov ecx, dword [edi + 8]
mov dword [ecx + 0xc], eax
mov esi, dword [edi + 8]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x46e490
push 0
push 0
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x10], eax
test eax, eax
je 0x46e480
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x46e480
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], 0
mov eax, dword [edi + 8]
pop edi
pop esi
mov al, byte [eax + 4]
pop ebp
ret 0xc
Function at 0x46e5d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e5ac6
mov eax, dword fs:[0]
push eax
sub esp, 0x630
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x638], esi
lea eax, [esi + 8]
mov dword [esi], 0
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x63c], esi
jb 0x46e62a
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 0x34], 7
mov dword [esi + 0x30], ecx
cmp dword [esi + 0x34], 8
mov dword [ebp - 4], ecx
jb 0x46e647
mov eax, dword [esi + 0x20]
jmp 0x46e64a
lea eax, [esi + 0x20]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x38]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x46e664
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x50]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x46e67e
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x68]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x46e698
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
push ecx
mov byte [ebp - 4], 4
mov dword [esi + 0x80], ecx
mov dword [esi + 0x84], ecx
call fcn.004869db
push eax
call fcn.00491b89
push 0x20c
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.004830b0
add esp, 0x14
lea eax, [ebp - 0x220]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x46e757
xor eax, eax
push 0x412
push eax
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x634]
push eax
call fcn.004830b0
add esp, 0xc
lea eax, [ebp - 0x634]
push 0x208
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x46e748
test eax, eax
je 0x46e748
add eax, eax
cmp eax, 0x412
jae 0x46e743
xor ecx, ecx
mov word [ebp + eax - 0x634], cx
lea eax, [ebp - 0x634]
jmp 0x46e74e
call fcn.0046d9cc
lea eax, [ebp - 0x220]
push eax
lea ecx, [esi + 0x20]
call fcn.00403dc0
mov eax, dword [esi + 0x30]
test eax, eax
je 0x46e783
cmp dword [esi + 0x34], 8
jb 0x46e769
mov ecx, dword [esi + 0x20]
jmp 0x46e76c
lea ecx, [esi + 0x20]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x46e783
push 1
push 0x5e8aa0
lea ecx, [esi + 0x20]
call fcn.00405710
cmp dword [esi + 0x30], 0
jne 0x46e798
push 3
push 0x5f147c
lea ecx, [esi + 0x20]
call fcn.00402650
mov dword [esi + 4], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046ce06
mov esp, ebp
pop ebp
ret
Function at 0x46e7c0
Capabilities:
Delete file

Disassembly:
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x60], 0
je 0x46e7dc
cmp dword [edi + 0x64], 8
lea eax, [edi + 0x50]
jb 0x46e7d5
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [edi + 0x80]
test eax, eax
je 0x46e7f9
push eax
call fcn.0046ce20
add esp, 4
mov dword [edi + 0x80], 0
mov eax, dword [edi + 0x7c]
lea esi, [edi + 0x68]
cmp eax, 8
jb 0x46e80f
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00402750
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x46e825
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x50]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x46e840
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00402750
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x46e856
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x38]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x46e871
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00402750
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x46e887
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x20]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x46e8a2
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00402750
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x46e8b8
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
mov eax, dword [edi + 0x1c]
cmp eax, 8
jb 0x46e8d2
inc eax
lea ecx, [edi + 8]
push eax
push dword [edi + 8]
call fcn.00402750
mov dword [edi + 0x1c], 7
cmp dword [edi + 0x1c], 8
mov dword [edi + 0x18], 0
jb 0x46e8f1
mov eax, dword [edi + 8]
xor ecx, ecx
pop edi
pop esi
mov word [eax], cx
ret
xor eax, eax
mov word [edi + 8], ax
pop edi
pop esi
ret
Function at 0x46ff30
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
sub esp, 8
test eax, eax
je 0x46ff6e
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 4], 0
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 8], 4
push ecx
push 0x20000005
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x46ff6e
mov eax, dword [ebp - 4]
xor edx, edx
mov esp, ebp
pop ebp
ret
xor eax, eax
xor edx, edx
mov esp, ebp
pop ebp
ret
Function at 0x470b09
Capabilities:
Set registry value

Disassembly:
push 0x2c
mov eax, 0x5e5df1
call fcn.0046d286
xor esi, esi
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.00464ae4
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], esi
call fcn.00464bb1
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x470b42
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x470bb2
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push 0x5e8b28
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x470b7f
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x470bb2
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0xc]
push 1
push esi
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x38]
call fcn.00464af7
call fcn.0046d24f
ret 8
Function at 0x4710d5
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x5e688d
call fcn.0046d286
xor esi, esi
mov dword [ebp - 0x18], 0x104
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.00464ae4
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.00464bb1
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x471115
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x471177
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push 0x5e8b28
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x471152
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x471177
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x3c]
call fcn.00464af7
call fcn.0046d24f
ret 8

Function at 0x471193
Capabilities:
Read .ini file

Disassembly:
push 0x224
mov eax, 0x5e376b
call fcn.0046d2ba
mov esi, ecx
mov ebx, 0x5e8a4c
lea eax, [ebp - 0x230]
push ebx
push str.InstallTime
push str.AppInfo
push eax
call fcn.0047163c
and dword [ebp - 4], 0
lea ecx, [ebp - 0x230]
push ebx
call fcn.00429920
test eax, eax
jne 0x471243
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004830b0
lea eax, [esi + 0xd4]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x4711f7
mov eax, dword [eax]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push ebx
push str.InstallTime
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x471223
xor eax, eax
jmp 0x471230
lea eax, [ebp - 0x218]
push eax
call fcn.00491757
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402650
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call fcn.00486908
pop ecx
push 0
push 1
lea ecx, [ebp - 0x230]
mov esi, eax
call fcn.0041f8c0
mov eax, esi
call fcn.0046d264
ret
Function at 0x4712da
Capabilities:
Read .ini file

Disassembly:
push 0x864
mov eax, 0x5e5ece
call fcn.0046d2ba
mov ebx, ecx
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cdq
push edx
push eax
lea eax, [ebp - 0x828]
push eax
call int.0045572d
add esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 0x828]
push eax
lea ecx, [ebp - 0x858]
call fcn.00403b00
push 0x800
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 1
push 0
push eax
call fcn.004830b0
lea ecx, [ebx + 0xd4]
add esp, 0xc
cmp dword [ecx + 0x14], 8
jb 0x471344
mov ecx, dword [ecx]
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
push ecx
cmovae eax, dword [ebp - 0x828]
lea ecx, [ebp - 0x810]
push 0x400
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
and dword [ebp - 0x830], 0
xor eax, eax
mov dword [ebp - 0x82c], 7
mov word [ebp - 0x840], ax
cmp word [ebp - 0x810], ax
je 0x47139e
lea eax, [ebp - 0x810]
push eax
call fcn.00491757
pop ecx
push eax
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x840]
call fcn.00402650
lea eax, [ebp - 0x828]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x840]
call fcn.004556c4
test eax, eax
jne 0x47140e
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
mov ecx, ebx
cmovae eax, dword [ebp - 0x828]
push eax
push edi
push esi
lea eax, [ebp - 0x870]
push eax
call fcn.0047163c
push eax
lea ecx, [ebp - 0x858]
call fcn.00403d40
xor ebx, ebx
lea ecx, [ebp - 0x870]
push ebx
push 1
call fcn.0041f8c0
jmp 0x471425
push 0xffffffffffffffff
xor ebx, ebx
lea eax, [ebp - 0x840]
push ebx
push eax
lea ecx, [ebp - 0x858]
call fcn.00402530
cmp dword [ebp - 0x844], 8
lea eax, [ebp - 0x858]
cmovae eax, dword [ebp - 0x858]
push eax
call fcn.00486908
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x840]
mov esi, eax
call fcn.0041f8c0
push ebx
push 1
lea ecx, [ebp - 0x858]
call fcn.0041f8c0
push ebx
push 1
lea ecx, [ebp - 0x828]
call fcn.0041f8c0
mov eax, esi
call fcn.0046d264
ret 0xc
Function at 0x471476
Capabilities:
Read .ini file

Disassembly:
push 0x844
mov eax, 0x5e5f23
call fcn.0046d2ba
mov ebx, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x828]
and dword [ebp - 4], 0
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
and dword [ebp - 0x84c], 0
mov dword [ebp - 0x848], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x850], esi
mov dword [ebp - 0x844], eax
call fcn.00403b30
lea eax, [ebp - 0x828]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.00403b00
cmp byte [ebp + 0x18], 0
mov dword [ebp - 0x84c], 1
jne 0x47154f
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.004830b0
lea eax, [ebx + 0xd4]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x471505
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push edi
push dword [ebp - 0x844]
push dword [ebp - 0x848]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x810], 0
jne 0x471533
xor eax, eax
jmp 0x471540
lea eax, [ebp - 0x810]
push eax
call fcn.00491757
pop ecx
push eax
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.00402650
lea eax, [ebp - 0x828]
mov ecx, esi
push eax
call fcn.004556c4
test eax, eax
jne 0x471593
push edi
push dword [ebp - 0x844]
lea eax, [ebp - 0x840]
mov ecx, ebx
push dword [ebp - 0x848]
push eax
call fcn.0047163c
push eax
mov ecx, esi
call fcn.00403d40
push 0
push 1
lea ecx, [ebp - 0x840]
call fcn.0041f8c0
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.0041f8c0
mov eax, esi
call fcn.0046d264
ret 0x14

Function at 0x471690
Capabilities:
Read .ini file

Disassembly:
push 0x838
mov eax, 0x5e5f56
call fcn.0046d2ba
mov edi, ecx
mov ecx, dword [ebp + 0xc]
lea eax, [edi + 0x8c]
cmp dword [eax + 0x14], 8
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x844], ecx
jb 0x4716bb
mov eax, dword [eax]
push eax
push dword [ebp + 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
cmp esi, dword [ebp + 0x10]
jne 0x471799
xor esi, esi
mov dword [ebp - 0x814], 7
push esi
xor eax, eax
mov dword [ebp - 0x818], esi
push 0x5e87f0
lea ecx, [ebp - 0x828]
mov word [ebp - 0x828], ax
call fcn.00402650
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 4], esi
push esi
push eax
call fcn.004830b0
push dword [ebp + 0x10]
lea eax, [ebp - 0x810]
push 0x5e8a2c
push eax
call fcn.00407e70
add esp, 0x18
lea eax, [ebp - 0x810]
cmp byte [edi + 5], 0
mov ecx, edi
push eax
push dword [ebp - 0x844]
lea eax, [ebp - 0x840]
push ebx
push eax
je 0x47174e
call fcn.004715ac
jmp 0x471753
call fcn.00471666
push eax
lea ecx, [ebp - 0x828]
call fcn.00403d40
push esi
push 1
lea ecx, [ebp - 0x840]
call fcn.0041f8c0
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.00486908
pop ecx
push 0
push 1
lea ecx, [ebp - 0x828]
mov esi, eax
call fcn.0041f8c0
mov eax, esi
call fcn.0046d264
ret 0xc
Function at 0x4717a3
Capabilities:
Read .ini file

Disassembly:
push 0x82c
mov eax, 0x5e5fa0
call fcn.0046d2ba
mov edi, ecx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x10]
push 0x800
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x810]
push ecx
push eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], ecx
call fcn.004830b0
lea eax, [edi + 0x8c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x471800
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.00403b30
and dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x834], 1
jb 0x471846
mov eax, dword [esi]
jmp 0x471848
mov eax, esi
push ebx
push eax
call fcn.0049185b
pop ecx
pop ecx
test eax, eax
jne 0x471894
cmp byte [edi + 5], 0
lea eax, [ebp - 0x828]
push ebx
push dword [ebp - 0x82c]
mov ecx, edi
push dword [ebp - 0x830]
push eax
je 0x471878
call fcn.004715ac
jmp 0x47187d
call fcn.00471666
push eax
mov ecx, esi
call fcn.00403d40
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.0041f8c0
mov eax, esi
call fcn.0046d264
ret 0x10
Function at 0x472446
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa44
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
mov edi, ecx
call fcn.004830b0
lea eax, [edi + 0x2c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x47247f
mov eax, dword [eax]
push str.Config
push eax
lea eax, [ebp - 0x20c]
push 0x5ed890
push eax
call fcn.00407e70
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4724b7
lea eax, [ebp - 0x20c]
push eax
call fcn.00458ac6
pop ecx
push 0x208
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.004830b0
push str.UseVestige.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x5ebf3c
push eax
call fcn.00407e70
add esp, 0x1c
cmp word [ebp - 0x414], si
jne 0x4724f6
mov eax, esi
jmp 0x472503
lea eax, [ebp - 0x414]
push eax
call fcn.00491757
pop ecx
push eax
lea eax, [ebp - 0x414]
push eax
lea ecx, [edi + 0x8c]
call fcn.00402650
push 0x208
lea eax, [ebp - 0x61c]
push esi
push eax
call fcn.004830b0
push str.Cache.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push 0x5ebf3c
push eax
call fcn.00407e70
add esp, 0x1c
cmp word [ebp - 0x61c], si
jne 0x472555
mov eax, esi
jmp 0x472562
lea eax, [ebp - 0x61c]
push eax
call fcn.00491757
pop ecx
push eax
lea eax, [ebp - 0x61c]
push eax
lea ecx, [edi + 0xa4]
call fcn.00402650
push 0x208
lea eax, [ebp - 0x824]
push esi
push eax
call fcn.004830b0
lea eax, [ebp - 0xa44]
push 0x5e8a7c
push eax
call int.004593be
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x4725a3
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x824]
push 0x5ea998
push eax
call fcn.00407e70
add esp, 0xc
lea ecx, [ebp - 0xa44]
push esi
push 1
call fcn.0041f8c0
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4725e4
lea eax, [ebp - 0x824]
push eax
call fcn.00458ac6
pop ecx
push 0x208
lea eax, [ebp - 0xa2c]
push esi
push eax
call fcn.004830b0
push str.Cache.ini
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0xa2c]
push 0x5ebf3c
push eax
call fcn.00407e70
add esp, 0x1c
cmp word [ebp - 0xa2c], si
je 0x47262e
lea eax, [ebp - 0xa2c]
push eax
call fcn.00491757
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0xa2c]
push eax
lea ecx, [edi + 0xbc]
call fcn.00402650
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0046ce06
mov esp, ebp
pop ebp
ret
Function at 0x472c7e
Capabilities:
Read .ini file

Disassembly:
push 0x23c
mov eax, 0x5e6072
call fcn.0046d2ba
mov ebx, ecx
call fcn.004710c9
lea edi, [ebx + 0xd4]
push eax
mov ecx, edi
call fcn.00453a60
mov esi, str.ZhiNengPYInfo.ini
push esi
call fcn.00491757
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00405710
push str.guanf
push 0x5e9a00
push str.AppInfo
lea eax, [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.0047163c
and dword [ebp - 4], 0
lea esi, [ebx + 0xec]
lea eax, [ebp - 0x248]
cmp esi, eax
je 0x472cf4
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00402530
push str.guanf
mov ecx, esi
call fcn.00429920
test eax, eax
jne 0x472d70
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004830b0
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x472d21
mov edi, dword [edi]
push edi
push 0x104
lea eax, [ebp - 0x218]
mov edi, str.guanf
push eax
push edi
push 0x5e9a00
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x472d52
xor eax, eax
jmp 0x472d5f
lea eax, [ebp - 0x218]
push eax
call fcn.00491757
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00402650
jmp 0x472d75
mov edi, str.guanf
push edi
mov ecx, esi
call fcn.00429920
test eax, eax
jne 0x472e38
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004830b0
add esp, 0xc
lea eax, [ebx + 0x5c]
lea ecx, [ebp - 0x230]
push eax
call fcn.00403b00
push str.ZhiNengPYInfo.ini
mov byte [ebp - 4], 1
call fcn.00491757
pop ecx
push eax
push str.ZhiNengPYInfo.ini
lea ecx, [ebp - 0x230]
call fcn.00405710
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
push 0x5e9a00
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x472e09
xor eax, eax
jmp 0x472e16
lea eax, [ebp - 0x218]
push eax
call fcn.00491757
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00402650
push 0
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.0041f8c0
push edi
mov ecx, esi
call fcn.00429920
test eax, eax
jne 0x472e74
push edi
push 0x5e9a00
push str.AppInfo
lea eax, [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.004717a3
push eax
mov ecx, esi
call fcn.00403d40
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.0041f8c0
push 0
push 1
lea ecx, [ebp - 0x248]
call fcn.0041f8c0
call fcn.0046d264
ret