joyce8/EMBER2024-capa huggingface dataset:
Function at 0x994cdc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x994d03
call fcn.00937288
mov dword [eax], esi
call fcn.00937275
push 0x16
pop esi
mov dword [eax], esi
call fcn.00937eca
mov eax, esi
jmp 0x994d58
test dword [ebp + 0xc], 0xfffffff9
jne 0x994ce9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x994d30
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0093729b
pop ecx
call fcn.00937275
mov eax, dword [eax]
jmp 0x994d58
test al, 0x10
jne 0x994d56
test al, 1
je 0x994d56
test byte [ebp + 0xc], 2
je 0x994d56
call fcn.00937288
mov dword [eax], 5
call fcn.00937275
mov dword [eax], 0xd
jmp 0x994d27
xor eax, eax
pop esi
pop ebp
ret

Function at 0x43b647
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x43b3c1
and ebx, ebx
inc ebx
call fcn.0043b682
add ecx, ecx
add ebx, ebx
xor dword [edx], esi
push 0x74716d0
pop ecx
inc edx
mov ecx, 0x63a582be
mov ecx, ecx
add ebx, 0x5e9f9cc1
cmp edx, eax
jne fcn.0043b647
inc ecx
add ebx, 0x4a2eb7c0
and ebx, ebx
ret
Function at 0x4015ec
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0xcc]
sub esp, 0x14c
mov eax, dword [0x415050]
xor eax, ebp
mov dword [ebp + 0xc8], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x3b]
mov esi, ecx
push ebx
push eax
mov dword [ebp - 0x40], esi
mov byte [ebp - 0x3c], bl
call fcn.00407070
add esp, 0xc
push 0x104
lea eax, [ebp - 0x3c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x3c
pop edi
push edi
lea eax, [ebp - 0x7c]
push ebx
push eax
call fcn.00407070
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x6c], eax
add esp, 0xc
mov dword [ebp - 0x7c], edi
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x68], esi
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov edi, str.runas
push eax
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x60], 9
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x78], 0x440
call esi
cmp dword [ebp - 0x5c], 0x20
mov dword [ebp - 0x80], ebx
jge 0x4016c3
push 0x3c
lea eax, [ebp - 0x7c]
push ebx
push eax
call fcn.00407070
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x68], eax
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
mov dword [ebp - 0x7c], 0x3c
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x60], 9
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x78], 0x440
call esi
cmp dword [ebp - 0x5c], 0x20
jl 0x4016c7
push 0x64
jmp 0x4016c9
push 0x65
mov ecx, dword [ebp + 0xc8]
pop eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404175
add ebp, 0xcc
leave
ret

Function at 0x4016e2
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
xor esi, esi
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x401742
push esi
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x401755
push 0x30
push str.Uninstaller
push str.Uninstaller_cannot_reboot_system.Please_reboot_your_system_manualy_
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop esi
leave
ret
Function at 0x40175a
Capabilities:
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x415050]
xor eax, ebp
mov dword [ebp + 0x18c], eax
push ebx
push esi
push edi
mov esi, 0x103
xor ebx, ebx
push esi
lea eax, [ebp + 0x89]
push ebx
push eax
mov byte [ebp + 0x88], bl
call fcn.00407070
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov byte [ebp - 0x7c], bl
call fcn.00407070
lea eax, [ebp - 0x7c]
push eax
call fcn.00402300
push str.arcadeweb32.dll
lea eax, [ebp - 0x7c]
push eax
push 0x4131ec
lea eax, [ebp + 0x88]
push 0x104
push eax
call fcn.00404291
add esp, 0x30
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [ebp + 0x88]
push eax
mov dword [ebp - 0x80], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x40181c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DllUnregisterServer
push edi
call esi
cmp eax, ebx
je 0x4017fe
call eax
jmp 0x401805
mov dword [ebp - 0x80], 2
push str.UnregisterTrayIcon
push edi
call esi
cmp eax, ebx
je 0x401813
call eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x401823
mov dword [ebp - 0x80], 1
lea eax, [ebp + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp + 0x88]
push eax
call fcn.004022f1
mov eax, dword [ebp - 0x80]
pop ecx
mov ecx, dword [ebp + 0x18c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404175
add ebp, 0x190
leave
ret
Function at 0x401c71
Capabilities:
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x415050]
xor eax, ebp
mov dword [ebp + 0x188], eax
push esi
mov esi, 0x103
push esi
lea eax, [ebp + 0x85]
push 0
push eax
mov byte [ebp + 0x84], 0
call fcn.00407070
push esi
lea eax, [ebp - 0x7f]
push 0
push eax
mov byte [ebp - 0x80], 0
call fcn.00407070
lea eax, [ebp - 0x80]
push eax
call fcn.00402300
push str.awun.exe
lea eax, [ebp - 0x80]
push eax
push 0x4131ec
lea eax, [ebp + 0x84]
push 0x104
push eax
call fcn.00404291
add esp, 0x30
lea eax, [ebp + 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp + 0x84]
push eax
call fcn.004022f1
pop ecx
mov ecx, dword [ebp + 0x188]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00404175
add ebp, 0x18c
leave
ret

Function at 0x401d15
Capabilities:
Delete file
Delete registry value
Persist via run registry key

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x415050]
xor eax, ebp
mov dword [ebp + 0x190], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
mov esi, str.TRICON_AW
push esi
push esi
call edi
push 0
push 0x9c43
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
and dword [ebp - 0x7c], 0
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push esi
call edi
test eax, eax
je 0x401d74
push 0x64
call ebx
inc dword [ebp - 0x7c]
cmp dword [ebp - 0x7c], 0x32
jl 0x401d5f
push 0x3e8
call ebx
lea eax, [ebp - 0x80]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x401e11
push str.TrayIcRun
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, 0x103
push esi
lea eax, [ebp + 0x8d]
push 0
push eax
mov byte [ebp + 0x8c], 0
call fcn.00407070
push esi
lea eax, [ebp - 0x77]
push 0
push eax
mov byte [ebp - 0x78], 0
call fcn.00407070
lea eax, [ebp - 0x78]
push eax
call fcn.00402300
push str.tray.exe
lea eax, [ebp - 0x78]
push eax
push 0x4131ec
lea eax, [ebp + 0x8c]
push 0x104
push eax
call fcn.00404291
add esp, 0x30
lea eax, [ebp + 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp + 0x8c]
push eax
call fcn.004022f1
pop ecx
mov ecx, dword [ebp + 0x190]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00404175
add ebp, 0x194
leave
ret
Function at 0x401e2b
Capabilities:
Delete directory

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x415050]
xor eax, ebp
mov dword [ebp + 0x188], eax
push esi
push edi
mov edi, 0x103
push edi
lea eax, [ebp - 0x7f]
push 0
push eax
mov byte [ebp - 0x80], 0
call fcn.00407070
lea eax, [ebp - 0x80]
push eax
call fcn.00402300
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
add esp, 0x10
lea eax, [ebp - 0x80]
push eax
call esi
lea eax, [ebp - 0x80]
push eax
call fcn.004022f1
push edi
lea eax, [ebp + 0x85]
push 0
push eax
mov byte [ebp + 0x84], 0
call fcn.00407070
xor ecx, ecx
lea edi, [ebp + 0x84]
call fcn.00402779
push str.text_links_arcadeweb.com
mov eax, edi
push 0x104
push eax
call fcn.0040421d
add esp, 0x1c
mov eax, edi
push eax
call esi
mov eax, edi
push eax
call fcn.004022f1
pop ecx
mov ecx, dword [ebp + 0x188]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00404175
add ebp, 0x18c
leave
ret

Function at 0x401f28
Capabilities:
Delete registry key

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x415050]
xor eax, ebp
mov dword [ebp + 0x88], eax
test ebx, ebx
je 0x40204b
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401f50
sub eax, edx
je 0x40204b
push esi
push edi
push 0x103
lea eax, [ebp - 0x7b]
push 0
push eax
mov byte [ebp - 0x7c], cl
call fcn.00407070
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push ebx
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.SHLWAPI.dll_wnsprintfA]
push ebx
push str.AppID_s
mov edi, 0x104
lea eax, [ebp - 0x7c]
push edi
push eax
call esi
lea eax, [ebp - 0x7c]
push eax
call fcn.00401edd
push ebx
push str.TypeLib_s
lea eax, [ebp - 0x7c]
push edi
push eax
call esi
lea eax, [ebp - 0x7c]
push eax
call fcn.00401edd
push ebx
push str.SOFTWAREClassesCLSID_sInprocServer32
lea eax, [ebp - 0x7c]
push edi
push eax
call esi
lea eax, [ebp - 0x7c]
push eax
call fcn.00401edd
push ebx
push str.SOFTWAREClassesCLSID_s
lea eax, [ebp - 0x7c]
push edi
push eax
call esi
lea eax, [ebp - 0x7c]
add esp, 0x4c
push eax
call fcn.00401edd
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects_s
lea eax, [ebp - 0x7c]
push edi
push eax
call esi
lea eax, [ebp - 0x7c]
push eax
call fcn.00401edd
push ebx
push str.CLSID_sInprocServer32
lea eax, [ebp - 0x7c]
push edi
push eax
call esi
lea eax, [ebp - 0x7c]
push eax
call fcn.00401edd
push ebx
push str.CLSID_s
push edi
lea eax, [ebp - 0x7c]
push eax
call esi
lea eax, [ebp - 0x7c]
push eax
call fcn.00401edd
add esp, 0x40
pop edi
pop esi
mov ecx, dword [ebp + 0x88]
xor ecx, ebp
call fcn.00404175
add ebp, 0x8c
leave
ret
Function at 0x402060
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [esp + 8]
push eax
push 2
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
mov edi, 0x80000002
push edi
call esi
test eax, eax
jne 0x4020d6
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push ebp
push str.AW_TrayIcon
push dword [esp + 0x14]
call ebx
push dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebp
call fcn.00403031
test al, al
je 0x4020d4
lea eax, [esp + 0x10]
push eax
push 0x102
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push edi
call esi
test eax, eax
jne 0x4020d4
push str.TrayIcRun
push dword [esp + 0x14]
call ebx
push dword [esp + 0x10]
call ebp
pop ebp
pop ebx
pop edi
pop esi
pop ecx
ret
Function at 0x4020da
Capabilities:
Delete registry key
Get installed programs
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x398]
sub esp, 0x418
mov eax, dword [0x415050]
xor eax, ebp
mov dword [ebp + 0x394], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallAWSoftware
mov esi, 0x80000002
push esi
call edi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallArcadeweb
push esi
call edi
mov esi, dword [sym.imp.SHLWAPI.dll_wnsprintfA]
mov ebx, str.SoftwareAppDataLowAWGAMECONFIG
push ebx
push str.cmd.exe__c_reg_delete_HKCU_s__f
lea eax, [ebp + 0x190]
push 0xff
push eax
call esi
lea eax, [ebp + 0x190]
push eax
push str.AW_Registry_removal
call fcn.0040236f
add esp, 0x18
call fcn.00402060
call fcn.00403452
mov dword [ebp - 0x7c], eax
test eax, eax
je 0x402189
lea ecx, [ebp - 0x80]
push ecx
push str.SoftwareAppDataLow
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push str.ArcadeWeb
push dword [ebp - 0x80]
call edi
push ebx
push dword [ebp - 0x7c]
call edi
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
mov ebx, 0x80000001
push ebx
call edi
push str.cmd.exe__c_reg_delete_HKCUSoftwareAppDataLowArcadeWeb__f
lea eax, [ebp + 0x190]
push 0xff
push eax
call esi
lea eax, [ebp + 0x190]
push eax
push str.AW_Registry_removal_2
call fcn.0040236f
add esp, 0x14
lea eax, [ebp - 0x80]
push eax
push str.SoftwareAppDataLow
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push str.ArcadeWeb
push dword [ebp - 0x80]
call edi
push str.AWGAMECONFIG
push dword [ebp - 0x80]
call edi
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, str.A670E878_A272_443D_BD19_ED0A9BFD3FD8
call fcn.00401f28
mov ebx, str.78919608_B066_4B5A_B248_38E12A783E05
call fcn.00401f28
push 0x103
lea eax, [ebp + 0x291]
push 0
push eax
mov byte [ebp + 0x290], 0
call fcn.00407070
push str.SOFTWAREClassesExplorerPlugin.Extension
mov ebx, 0x104
lea eax, [ebp + 0x290]
push ebx
push eax
call esi
lea eax, [ebp + 0x290]
push eax
call fcn.00401edd
push str.SOFTWAREClassesExplorerPlugin.Extension.1
lea eax, [ebp + 0x290]
push ebx
push eax
call esi
lea eax, [ebp + 0x290]
push eax
call fcn.00401edd
push str.ExplorerPlugin.Extension
lea eax, [ebp + 0x290]
push ebx
push eax
call esi
lea eax, [ebp + 0x290]
push eax
call fcn.00401edd
push str.ExplorerPlugin.Extension.1
lea eax, [ebp + 0x290]
push ebx
push eax
call esi
lea eax, [ebp + 0x290]
add esp, 0x48
push eax
call fcn.00401edd
and dword [ebp - 0x7c], 0
pop ecx
push ebx
lea eax, [ebp + 0x8c]
push eax
push 0
jmp 0x4022c8
lea eax, [ebp + 0x8c]
push eax
push str._sSoftwareAppDataLowAWGAMECONFIG
lea eax, [ebp - 0x78]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x78]
push eax
push 0x80000003
call edi
inc dword [ebp - 0x7c]
push ebx
lea eax, [ebp + 0x8c]
push eax
push dword [ebp - 0x7c]
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x402299
mov ecx, dword [ebp + 0x394]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00404175
add ebp, 0x398
leave
ret
Function at 0x4022f1
Capabilities:
Move file

Disassembly:
push 5
push 0
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
ret

Function at 0x402300
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersion
mov esi, 0x104
push 0x80000002
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 0
push str.ProgramFilesDir
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.SHLWAPI.dll_StrNCatA]
push esi
push 0x413704
push dword [ebp + 8]
call edi
push esi
push str.ArcadeWeb
push dword [ebp + 8]
call edi
pop edi
pop esi
leave
ret

Function at 0x40236f
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov byte [ebp - 1], 0
call fcn.00403452
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov ebx, eax
mov dword [ebp - 0xc], ebx
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
test ebx, ebx
je 0x4023c3
lea eax, [ebp - 8]
push eax
push edi
push ebx
call esi
test eax, eax
je 0x4023c3
lea eax, [ebp - 8]
push eax
push edi
push 0x80000001
call esi
test eax, eax
je 0x4023c3
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push ebx
call esi
xor al, al
jmp 0x402431
push dword [ebp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
call ebx
push eax
push dword [ebp + 0xc]
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4023ea
mov byte [ebp - 1], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
push edi
push 0x80000002
call esi
test eax, eax
jne 0x402425
push dword [ebp + 0xc]
call ebx
push eax
push dword [ebp + 0xc]
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402561
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88c
mov eax, dword [0x415050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, 0x1ff
push ebx
xor edi, edi
lea eax, [ebp - 0x887]
push edi
push eax
mov byte [ebp - 0x888], 0
call fcn.00407070
add esp, 0xc
push ebx
lea eax, [ebp - 0x287]
push edi
push eax
mov byte [ebp - 0x288], 0
call fcn.00407070
add esp, 0xc
push 0x7f
lea eax, [ebp - 0x87]
push edi
push eax
mov byte [ebp - 0x88], 0
call fcn.00407070
add esp, 0xc
lea esi, [ebp - 0x88]
call fcn.00403362
push dword [0x4162f4]
call fcn.004042f9
pop ecx
cmp eax, edi
jne 0x4025e7
mov eax, 0x30d48
lea ecx, [ebp - 0x88]
push ecx
push dword [0x4162f8]
mov edi, 0x200
push eax
push str._d_s_s
lea eax, [ebp - 0x288]
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
and dword [ebp - 0x88c], 0
add esp, 0x18
lea eax, [ebp - 0x288]
push eax
call esi
test eax, eax
jle 0x402651
mov eax, dword [ebp - 0x88c]
lea eax, [ebp + eax - 0x288]
xor byte [eax], 0x83
inc dword [ebp - 0x88c]
lea eax, [ebp - 0x288]
push eax
call esi
cmp dword [ebp - 0x88c], eax
jl 0x40262a
push ebx
lea eax, [ebp - 0x487]
push 0
push eax
mov byte [ebp - 0x488], 0
call fcn.00407070
add esp, 0xc
lea eax, [ebp - 0x88c]
push eax
lea eax, [ebp - 0x288]
push eax
mov dword [ebp - 0x88c], edi
call esi
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x488]
call fcn.0040106b
add esp, 0xc
push ebx
xor esi, esi
lea eax, [ebp - 0x687]
push esi
push eax
mov byte [ebp - 0x688], 0
call fcn.00407070
add esp, 0xc
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x688]
push eax
call fcn.004040c6
lea eax, [ebp - 0x688]
push eax
push str._aj_deactivate.ph
push str.http:__www.arcadeweb.com
push str._s_s_p_s
lea eax, [ebp - 0x888]
push edi
push eax
mov byte [0x416329], 0x70
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x20
push 9
push esi
push esi
lea eax, [ebp - 0x888]
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x1f
pop ecx
cmp ecx, eax
mov ecx, dword [ebp - 4]
pop edi
sbb eax, eax
pop esi
xor ecx, ebp
neg eax
pop ebx
call fcn.00404175
leave
ret
Function at 0x402779
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x415050]
xor eax, ebp
mov dword [ebp + 0x84], eax
push ebx
push esi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x7f]
push ebx
push eax
mov esi, ecx
mov byte [ebp - 0x80], bl
call fcn.00407070
add esp, 0xc
lea eax, [ebp - 0x80]
cmp esi, ebx
jne 0x4027c7
push eax
push ebx
push ebx
push 0x801a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
jmp 0x4027cf
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.MozillaExtensionsec8030f7_c20a_464f_9b0e_13a3a9e97384_
mov esi, 0x104
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.0040421d
lea eax, [ebp - 0x80]
push eax
push esi
push edi
call fcn.004041b5
add esp, 0x18
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov ecx, dword [ebp + 0x84]
dec eax
neg eax
sbb eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.00404175
add ebp, 0x88
leave
ret
Function at 0x402818
Capabilities:
Check if file exists
Get common file path
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x4a4]
sub esp, 0x524
mov eax, dword [0x415050]
xor eax, ebp
mov dword [ebp + 0x4a0], eax
mov eax, dword [ebp + 0x4ac]
push ebx
push esi
push edi
mov esi, 0x103
push esi
mov dword [ebp - 0x80], eax
xor edi, edi
lea eax, [ebp + 0x39d]
push edi
push eax
mov ebx, ecx
mov byte [ebp + 0x39c], 0
call fcn.00407070
push esi
lea eax, [ebp + 0x299]
push edi
push eax
mov byte [ebp + 0x298], 0
call fcn.00407070
push esi
lea eax, [ebp + 0x195]
push edi
push eax
mov byte [ebp + 0x194], 0
call fcn.00407070
push esi
lea eax, [ebp + 0x91]
push edi
push eax
mov byte [ebp + 0x90], 0
call fcn.00407070
push esi
lea eax, [ebp - 0x73]
push edi
push eax
mov byte [ebp - 0x74], 0
call fcn.00407070
add esp, 0x3c
lea eax, [ebp + 0x39c]
cmp ebx, edi
jne 0x4028d3
push eax
push edi
push edi
push 0x801a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp eax, 1
jne 0x4028db
xor al, al
jmp 0x402a16
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.MozillaFirefox_
mov ebx, 0x104
lea eax, [ebp + 0x39c]
push ebx
push eax
call fcn.0040421d
lea eax, [ebp + 0x39c]
push eax
lea eax, [ebp + 0x298]
push ebx
push eax
call fcn.004041b5
push str.profiles.ini
lea eax, [ebp + 0x298]
push ebx
push eax
call fcn.0040421d
add esp, 0x24
lea eax, [ebp + 0x298]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4028cc
mov dword [ebp - 0x7c], edi
mov byte [ebp - 0x75], 0
push edi
jmp 0x402970
lea eax, [ebp + 0x298]
push eax
push ebx
lea eax, [ebp - 0x74]
push eax
push 0x413052
push str.Name
lea eax, [ebp + 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 8
mov edi, str.default
lea esi, [ebp - 0x74]
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x4029b2
inc dword [ebp - 0x7c]
push dword [ebp - 0x7c]
push str.Profile_d
lea eax, [ebp + 0x194]
push 0x14
push eax
call fcn.00404291
add esp, 0x10
lea eax, [ebp + 0x298]
push eax
push ebx
lea eax, [ebp + 0x90]
push eax
push 0x413052
push str.Path
lea eax, [ebp + 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x402936
jmp 0x402a13
lea eax, [ebp + 0x90]
push eax
lea eax, [ebp + 0x39c]
push ebx
push eax
mov byte [ebp - 0x75], 1
call fcn.0040421d
push str.extensions_
lea eax, [ebp + 0x39c]
push ebx
push eax
call fcn.0040421d
push str.text_links_arcadeweb.com
lea eax, [ebp + 0x39c]
push ebx
push eax
call fcn.0040421d
push 0x413704
lea eax, [ebp + 0x39c]
push ebx
push eax
call fcn.0040421d
lea eax, [ebp + 0x39c]
push eax
push ebx
push dword [ebp - 0x80]
call fcn.004041b5
add esp, 0x3c
mov al, byte [ebp - 0x75]
mov ecx, dword [ebp + 0x4a0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404175
add ebp, 0x4a4
leave
ret