joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42eaa0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x45cda0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
lea eax, [esp + 8]
lea ecx, [esp + 4]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
push str.singleline
push str.Software360Safe
push SysReAllocString
mov dword [esp + 0x1c], 1
mov dword [esp + 0x24], 4
mov dword [esp + 0x20], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x42eb05
mov eax, dword [esp + 4]
mov dword [esi + 0xa38], eax
mov ecx, dword [esi + 0x1b0]
test ecx, ecx
je 0x42eb23
mov eax, dword [esi + 0xa38]
xor edx, edx
test eax, eax
setne dl
inc edx
push edx
call fcn.0042a110
mov eax, dword [esi + 0xa38]
test eax, eax
je 0x42eb7f
lea eax, [esp + 0x14]
push eax
call fcn.0041d770
add esp, 4
push str.MainFrame_framemod_sim.png
lea ecx, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x34], 0
call sub.MFC42u.DLL_operator
push eax
lea ecx, [esi + 0xa50]
mov byte [esp + 0x2c], 1
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call sub.MFC42u.DLL_CString::CString
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x14]
jmp 0x42ebcf
lea edx, [esp + 0x10]
push edx
call fcn.0041d770
add esp, 4
push str.MainFrame_framemod.png
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x30], 2
push eax
call sub.MFC42u.DLL_operator
push eax
lea ecx, [esi + 0xa50]
mov byte [esp + 0x2c], 3
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 2
call sub.MFC42u.DLL_CString::CString
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x1c]
push ecx
call fcn.0041d770
add esp, 4
push str.MainFrame_frame.png
lea edx, [esp + 0x1c]
push eax
push edx
mov dword [esp + 0x34], 4
call sub.MFC42u.DLL_operator
push eax
lea ecx, [esi + 0xa4c]
mov byte [esp + 0x2c], 5
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 4
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x20]
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x4317a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push esi
lea ecx, [esp + 4]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
push str.NewVersion
push str.Software360Safe
push SysReAllocString
mov esi, 1
mov dword [esp + 0x24], 4
mov dword [esp + 0x20], 4
mov dword [esp + 0x1c], 0
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4317f1
cmp dword [esp + 4], esi
jne 0x4317f1
xor esi, esi
lea eax, [esp + 4]
push 4
push eax
push 4
push str.NewVersion
push str.Software360Safe
push SysReAllocString
mov dword [esp + 0x1c], 1
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov eax, esi
pop esi
add esp, 0xc
ret
Function at 0x433b60
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x2418
call fcn.00456620
mov ax, word [0x473258]
push ebx
push ebp
push esi
mov dword [esp + 0xc], ecx
push edi
mov word [esp + 0x18], ax
mov ecx, 0x103
xor eax, eax
lea edi, [esp + 0x1a]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
xor edx, edx
test ecx, ecx
mov dword [esp + 0x14], edx
stosw word es:[edi], ax
je 0x433cf1
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebp, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov esi, dword [sym.imp.MSVCRT.dll_wcsncpy]
mov word [esp + 0x18], dx
mov edx, str.360OEMlogo.png
test edx, edx
je 0x433c37
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x428]
push edx
rep stosd dword es:[edi], eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x433c23
lea eax, [esp + 0x428]
push 0x800
push eax
push 0
call ebx
lea ecx, [esp + 0x428]
push ecx
call ebp
lea edx, [esp + 0x428]
push str.360OEMlogo.png
lea eax, [esp + 0x42c]
push edx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [esp + 0x428]
push 0x208
lea edx, [esp + 0x1c]
push ecx
push edx
jmp 0x433c32
push 0x208
lea eax, [esp + 0x1c]
push str.360OEMlogo.png
push eax
call esi
add esp, 0xc
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x428]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x428]
test ecx, ecx
je 0x433cf1
mov ecx, 0x400
lea edi, [esp + 0x1428]
lea edx, [esp + 0x18]
mov word [esp + 0x428], ax
rep stosd dword es:[edi], eax
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x433cc8
lea eax, [esp + 0x1428]
push 0x800
push eax
push 0
call ebx
lea ecx, [esp + 0x1428]
push ecx
call ebp
lea edx, [esp + 0x18]
lea eax, [esp + 0x1428]
push edx
lea ecx, [esp + 0x142c]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [esp + 0x1428]
push 0x400
lea eax, [esp + 0x42c]
push edx
push eax
jmp 0x433cda
lea ecx, [esp + 0x18]
push 0x400
lea edx, [esp + 0x42c]
push ecx
push edx
call esi
add esp, 0xc
lea eax, [esp + 0x428]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x433d0b
mov ecx, dword [esp + 0x10]
mov dword [ecx + 0xb1c], 1
call fcn.00433f20
push 0x473258
jmp 0x433d10
lea ecx, [esp + 0x18]
push ecx
mov esi, dword [esp + 0x2430]
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_1
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2418
ret 4

Function at 0x433f20
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0
push ecx
push 0x41ec00
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x433f50
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x45d79b
push eax
mov eax, 0x180c
mov dword fs:[0], esp
call fcn.00456620
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
mov ebp, ecx
push eax
call fcn.00433b60
mov edx, dword [esp + 0x10]
xor ebx, ebx
cmp edx, ebx
mov dword [esp + 0x1824], ebx
mov esi, edx
je 0x434091
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1c]
test ecx, ecx
je 0x434091
mov ecx, 0x400
lea edi, [esp + 0x81c]
rep stosd dword es:[edi], eax
push edx
mov word [esp + 0x20], bx
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x43401a
lea edx, [esp + 0x81c]
push 0x800
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x81c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0x81c]
push esi
lea edx, [esp + 0x820]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x81c]
push 0x400
lea ecx, [esp + 0x20]
push eax
push ecx
jmp 0x434025
push 0x400
lea edx, [esp + 0x20]
push esi
push edx
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, ebx
je 0x434091
lea ecx, [esp + 0x14]
push 4
push ecx
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::Right
mov edx, dword [eax]
push str..png
push edx
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
cmp eax, ebx
lea ecx, [esp + 0x14]
sete bl
call sub.MFC42u.DLL_CString::CString
test bl, bl
je 0x434091
push 0x1f40
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.004562c0
lea ecx, [ebp + 0x934]
call fcn.0040fd80
lea ecx, [esp + 0x10]
mov dword [esp + 0x1824], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x181c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x1818
ret
Function at 0x434190
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x45d7db
push eax
mov eax, 0x180c
mov dword fs:[0], esp
call fcn.00456620
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push 1
mov ebp, ecx
push eax
call fcn.00434160
mov edx, dword [esp + 0x10]
xor ebx, ebx
cmp edx, ebx
mov dword [esp + 0x1824], ebx
mov esi, edx
je 0x4342fa
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1c]
test ecx, ecx
je 0x4342fa
mov ecx, 0x400
lea edi, [esp + 0x81c]
rep stosd dword es:[edi], eax
push edx
mov word [esp + 0x20], bx
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x43425c
lea edx, [esp + 0x81c]
push 0x800
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x81c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0x81c]
push esi
lea edx, [esp + 0x820]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x81c]
push 0x400
lea ecx, [esp + 0x20]
push eax
push ecx
jmp 0x434267
push 0x400
lea edx, [esp + 0x20]
push esi
push edx
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, ebx
je 0x4342fa
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
cmp eax, 4
jle 0x4342fa
lea edx, [esp + 0x14]
push 4
push edx
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::Right
mov eax, dword [eax]
push str..png
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
cmp eax, ebx
lea ecx, [esp + 0x14]
sete bl
call sub.MFC42u.DLL_CString::CString
test bl, bl
je 0x4342fa
push 0x1f40
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.004562c0
lea ecx, [ebp + 0x934]
call fcn.0040fd80
lea ecx, [esp + 0x10]
mov dword [esp + 0x1824], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov eax, 1
jmp 0x434310
lea ecx, [esp + 0x10]
mov dword [esp + 0x1824], 0xffffffff
call sub.MFC42u.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0x181c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x1818
ret
Function at 0x435770
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0xee0]
push eax
push 0
push esi
push 0x435760
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xb20], eax
xor eax, eax
pop esi
ret

Function at 0x4357c0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x45d9c4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebp
push esi
push edi
mov esi, ecx
push 1
push str.WorkerThread
lea ecx, [esp + 0x18]
xor ebp, ebp
call fcn.00455e90
push 0x220
mov dword [esp + 0x23c], ebp
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
mov byte [esp + 0x238], 1
je 0x435827
push ebp
push str.AfxSocketInit
mov ecx, eax
call fcn.00455e90
mov edi, eax
jmp 0x435829
xor edi, edi
push 0
mov byte [esp + 0x23c], 0
call sub.MFC42u.DLL_AfxSocketInit
test eax, eax
jne 0x435846
push 0xffffffffffffffff
push eax
push 0x68
call sub.MFC42u.DLL_AfxMessageBox
mov ecx, 0x473130
call fcn.00402ae0
test edi, edi
je 0x435864
mov ecx, edi
call fcn.00455fc0
push edi
call sub.MFC42u.DLL_operatordelete
add esp, 4
lea eax, [esp + 0xc]
mov ecx, 0x473130
push eax
call fcn.00404910
mov edi, dword [eax]
mov byte [esp + 0x238], 2
test edi, edi
je 0x4358c7
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4358aa
push edi
call fcn.00456ce0
add esp, 4
test eax, eax
jne 0x4358aa
call fcn.00456be0
push eax
push edi
call fcn.00456bf0
add esp, 8
jmp 0x4358c7
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x4358c7
push str.Initialize
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4358c7
call eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x238], 0
call sub.MFC42u.DLL_CString::CString
mov ecx, esi
call fcn.00432090
mov ecx, 0x473130
call fcn.00403660
mov ecx, esi
call fcn.00434960
lea ecx, [esi + 0xe1c]
push ecx
mov ecx, esi
call fcn.00431120
lea edi, [esi + 0xf60]
mov ecx, edi
call fcn.00451120
mov ecx, edi
call fcn.00451350
push 0
lea ecx, [esi + 0xb24]
call fcn.0043b750
test eax, eax
je 0x435928
mov ebp, 1
mov edx, dword [esi + 0x20]
push 0
push ebp
push 0x531
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, esi
call fcn.0042f3a0
lea eax, [esi + 0xdd4]
mov ecx, esi
push eax
call fcn.00431120
lea ecx, [esp + 0x10]
mov dword [esp + 0x238], 0xffffffff
call fcn.00455fc0
mov ecx, dword [esp + 0x230]
pop edi
pop esi
xor eax, eax
pop ebp
mov dword fs:[0], ecx
add esp, 0x230
ret
Function at 0x437240
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [0x4732b8]
sub esp, 0x800
test eax, eax
je 0x43725d
mov ecx, dword [0x4730e4]
test ecx, ecx
jne 0x437327
push esi
push edi
lea eax, [esp + 8]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 8]
push ecx
call edi
mov eax, dword [0x4730e8]
xor esi, esi
test eax, eax
jle 0x43729a
lea edx, [esp + 8]
push edx
call edi
mov eax, dword [0x4730e8]
inc esi
cmp esi, eax
jl 0x437289
lea eax, [esp + 8]
push str.MiniUI.dll
lea ecx, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [esp + 8]
pop edi
test edx, edx
pop esi
je 0x4372ec
lea eax, [esp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4372f0
lea ecx, [esp]
push ecx
call fcn.00456ce0
add esp, 4
test eax, eax
jne 0x4372f0
call fcn.00456be0
lea edx, [esp]
push eax
push edx
call fcn.00456bf0
add esp, 8
xor eax, eax
jmp 0x4372fb
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [0x4730e4], eax
jne 0x43730b
add esp, 0x800
ret
push str.GetMiniUI3
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x4732b8], eax
jne 0x437327
add esp, 0x800
ret
call eax
add esp, 0x800
ret
Function at 0x437550
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45dbc7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 8], ebx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], 2
call sub.MFC42u.DLL_CString::MakeLower
lea ecx, [esp + 0x30]
call sub.MFC42u.DLL_CString::MakeLower
lea eax, [esp + 0x2c]
lea ecx, [esp + 0xc]
push eax
push ecx
lea ecx, [esi + 0x14]
call fcn.0041c530
mov eax, dword [esi + 0x18]
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jne 0x4375c7
mov esi, dword [esp + 0x28]
push 0x473258
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_1
mov eax, 1
mov dword [esp + 8], eax
jmp 0x43766d
mov ecx, dword [ecx + 0x10]
cmp ecx, ebx
jl 0x437654
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x437654
mov edx, dword [esi + 0xc]
sub edx, eax
mov eax, 0x66666667
imul edx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp ecx, edx
jae 0x437654
mov esi, dword [esi + 8]
lea ecx, [ecx + ecx*4]
lea edx, [esp + 0x30]
lea esi, [esi + ecx*4]
push edx
mov ecx, esi
call fcn.0041cd60
mov ecx, dword [esi + 4]
mov dword [esp + 0x10], eax
cmp eax, ecx
je 0x43762f
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [esp + 0x34]
push eax
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
cmp eax, ebx
jl 0x43762f
lea eax, [esp + 0x10]
jmp 0x43763a
mov eax, dword [esi + 4]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
mov eax, dword [eax]
mov ecx, dword [esi + 4]
cmp eax, ecx
je 0x437654
mov esi, dword [esp + 0x28]
add eax, 0x10
push eax
mov ecx, esi
call fcn.004562c0
jmp 0x437664
mov esi, dword [esp + 0x28]
push 0x473258
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_1
mov eax, 1
mov dword [esp + 8], eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], al
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x30]
mov byte [esp + 0x20], bl
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
Function at 0x43a500
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x814
push esi
mov esi, dword [esp + 0x81c]
push edi
mov edi, ecx
test esi, esi
jne 0x43a522
pop edi
xor eax, eax
pop esi
add esp, 0x814
ret 4
mov ecx, dword [edi + 0x64]
mov edx, dword [edi + 0x20]
mov eax, dword [esi]
push 0
push ecx
push edx
mov ecx, esi
call dword [eax + 0x14]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
mov esi, eax
test esi, esi
je 0x43a68b
lea ecx, [esp + 0xc]
push ecx
mov ecx, edi
call fcn.0043a6b0
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
sub edx, eax
push 1
push edx
mov edx, dword [esp + 0x1c]
sub edx, ecx
push edx
push eax
push ecx
push esi
call dword [sym.imp.USER32.dll_MoveWindow]
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0x20]
mov dword [esp + 8], eax
mov eax, dword [0x4730e0]
test eax, eax
je 0x43a598
mov ecx, dword [0x4730e4]
test ecx, ecx
jne 0x43a66d
push ebx
push ebp
lea ecx, [esp + 0x24]
push 0x400
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebp, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [esp + 0x24]
push edx
call ebp
mov eax, dword [0x4730e8]
xor ebx, ebx
test eax, eax
jle 0x43a5d5
lea eax, [esp + 0x24]
push eax
call ebp
mov eax, dword [0x4730e8]
inc ebx
cmp ebx, eax
jl 0x43a5c4
lea ecx, [esp + 0x24]
push str.MiniUI.dll
lea edx, [esp + 0x28]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x24]
pop ebp
test eax, eax
pop ebx
je 0x43a627
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43a62b
lea edx, [esp + 0x1c]
push edx
call fcn.00456ce0
add esp, 4
test eax, eax
jne 0x43a62b
call fcn.00456be0
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00456bf0
add esp, 8
xor eax, eax
jmp 0x43a636
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [0x4730e4], eax
je 0x43a68b
push str.GetMiniUI
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x4730e0], eax
jne 0x43a66d
mov edx, dword [0x4730e4]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4730e4], 0
jmp 0x43a68b
call eax
test eax, eax
je 0x43a68b
mov edx, dword [esp + 8]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x1c]
test eax, eax
je 0x43a68b
mov ecx, dword [eax]
push 3
push esi
push eax
call dword [ecx + 0xc]
mov edx, dword [edi + 0x6c]
mov ecx, edi
push edx
call sub.MFC42u.DLL_CWnd::SetWindowTextW
pop edi
mov eax, 1
pop esi
add esp, 0x814
ret 4
Function at 0x43ab20
Capabilities:
Check if file exists
Create directory

Disassembly:
sub esp, 0x208
push esi
mov esi, ecx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
push eax
call fcn.0043a8f0
add esp, 8
test eax, eax
jne 0x43ab5f
pop edi
pop esi
add esp, 0x208
ret
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43ab7a
lea edx, [esp + 8]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [esp + 8]
push str.RightMenuSetting.ini
lea ecx, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [esp + 8]
lea ecx, [esi + 0x60]
push edx
call fcn.0043a7e0
xor ecx, ecx
pop edi
test eax, eax
setne cl
mov eax, ecx
pop esi
add esp, 0x208
ret

Function at 0x43ab26
Capabilities:
Check if file exists
Create directory

Disassembly:
sub esp, 0x208
push esi
mov esi, ecx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
push eax
call fcn.0043a8f0
add esp, 8
test eax, eax
jne 0x43ab5f
pop edi
pop esi
add esp, 0x208
ret
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43ab7a
lea edx, [esp + 8]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [esp + 8]
push str.RightMenuSetting.ini
lea ecx, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [esp + 8]
lea ecx, [esi + 0x60]
push edx
call fcn.0043a7e0
xor ecx, ecx
pop edi
test eax, eax
setne cl
mov eax, ecx
pop esi
add esp, 0x208
ret
Function at 0x43b5d0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x800
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x43b5f1
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x800
ret
mov eax, dword [esi + 4]
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
je 0x43b608
push eax
call ebp
mov dword [esi + 4], 0
mov eax, str.modulesSDPublicity.dll
test eax, eax
je 0x43b6ca
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x43b63f
push str.modulesSDPublicity.dll
call fcn.00401560
add esp, 4
test eax, eax
je 0x43b6c7
push str.modulesSDPublicity.dll
jmp 0x43b6c1
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0xc]
push 0x400
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [esp + 0xc]
push str.modulesSDPublicity.dll
lea ecx, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [esp + 0xc]
test edx, edx
je 0x43b6b8
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43b6bc
lea ecx, [esp + 0xc]
push ecx
call fcn.00456ce0
add esp, 4
test eax, eax
jne 0x43b6bc
call fcn.00456be0
lea edx, [esp + 0xc]
push eax
push edx
call fcn.00456bf0
add esp, 8
xor eax, eax
jmp 0x43b6c7
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x43b71b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.IsSDNeedPublicity
push eax
call edi
mov dword [esi + 0x10], eax
mov ecx, dword [esi + 4]
push str.DoSDNeedPublicity
push ecx
call edi
test eax, eax
mov dword [esi + 0x14], eax
je 0x43b70a
mov eax, dword [esi + 0x10]
test eax, eax
je 0x43b70a
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x800
ret
mov eax, dword [esi + 4]
test eax, eax
je 0x43b71b
push eax
call ebp
mov dword [esi + 4], 0
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x800
ret