joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4380e8
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x22c
mov eax, 0x5a4f5c
call fcn.0043a209
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x234]
push eax
push 0xf003f
xor ebx, ebx
mov dword [ebp - 0x238], 0x208
push ebx
push str.EUDC936
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x234], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x438136
xor eax, eax
jmp 0x4381e4
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.004381ec
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], ebx
push ebx
push eax
call fcn.00446360
add esp, 0xc
lea ecx, [ebp - 0x238]
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push ebx
push ebx
push eax
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x234]
test eax, eax
je 0x4381a1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, ebx
jmp 0x4381d4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebp - 0x218], 0
jne 0x4381b5
mov eax, ebx
jmp 0x4381c2
lea eax, [ebp - 0x218]
push eax
call fcn.004549d7
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.004020c0
xor esi, esi
inc esi
push ebx
push 1
lea ecx, [ebp - 0x230]
call fcn.004253f2
mov eax, esi
call fcn.0043a1c4
ret 4

Function at 0x438257
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x62c144]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
push 0xf003f
xor esi, esi
mov ebx, 0x208
push esi
push str.EUDC936
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x214], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4382a8
xor eax, eax
jmp 0x43831c
push ebx
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00446360
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push str.SystemDefaultEUDCFont
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
test eax, eax
je 0x4382ec
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4382a4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebp - 0x20c], si
je 0x43830a
lea eax, [ebp - 0x20c]
push eax
call fcn.004549d7
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.004020c0
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00439cb7
mov esp, ebp
pop ebp
ret 4
Function at 0x438456
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x62c144]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x210]
xor edi, edi
push eax
push 0xf003f
push edi
push str.EUDC936
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x210], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x438501
push 0x208
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00446360
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00454a23
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push str.SystemDefaultEUDCFont
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x210]
test eax, eax
je 0x438522
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, edi
push edi
push 1
lea ecx, [ebp + 8]
call fcn.004253f2
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00439cb7
mov esp, ebp
pop ebp
ret 0x18
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
inc esi
jmp 0x438503

Function at 0x438611
Capabilities:
Check if file exists

Disassembly:
push 0x40
mov eax, 0x5a500c
call fcn.0043a209
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
push edi
lea ecx, [ebp - 0x4c]
mov dword [ebp - 4], ebx
call fcn.004388bd
mov esi, dword [ebp - 0x4c]
jmp 0x4386c1
push esi
lea ecx, [ebp - 0x40]
call fcn.004037f0
push str.Dict
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00425bae
add esp, 0xc
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4386a5
push 0x5ab5ac
call fcn.004549d7
pop ecx
push eax
push ebx
push 0x5ab5ac
lea ecx, [ebp - 0x28]
call fcn.00405510
cmp eax, 0xffffffff
jne 0x4386a5
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
call fcn.00428d19
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.004253f2
push ebx
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.004253f2
add esi, 0x18
cmp esi, dword [ebp - 0x48]
jne 0x43863f
lea ecx, [ebp - 0x4c]
call fcn.00428c9b
call fcn.0043a1c4
ret 4
Function at 0x4386da
Capabilities:
Enumerate files on windows

Disassembly:
push 0x67c
mov eax, 0x5a503c
call fcn.0043a209
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x420]
mov ebx, dword [ebp + 0xc]
push 0x208
push 0
push eax
call fcn.00446360
push edi
lea eax, [ebp - 0x420]
push str._s.
push eax
call fcn.00408fc0
add esp, 0x18
lea eax, [ebp - 0x688]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x43881a
lea eax, [ebp - 0x688]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x43881a
push 0x2e
pop eax
cmp word [ebp - 0x65c], ax
je 0x438736
cmp word [ebp - 0x65a], 0
je 0x438736
cmp word [ebp - 0x65a], ax
jne 0x438775
cmp word [ebp - 0x658], 0
je 0x438736
test byte [ebp - 0x688], 0x10
je 0x438736
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00446360
lea eax, [ebp - 0x65c]
push eax
push edi
lea eax, [ebp - 0x218]
push 0x5a92fc
push eax
call fcn.00408fc0
and dword [ebp - 0x428], 0
xor eax, eax
add esp, 0x1c
mov dword [ebp - 0x424], 7
mov word [ebp - 0x438], ax
cmp word [ebp - 0x218], ax
je 0x4387dd
lea eax, [ebp - 0x218]
push eax
call fcn.004549d7
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x438]
call fcn.004020c0
and dword [ebp - 4], 0
lea eax, [ebp - 0x438]
push eax
mov ecx, ebx
call fcn.00414080
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x438]
push 0
push 1
call fcn.004253f2
jmp 0x438736
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
call fcn.0043a1c4
ret 8

Function at 0x438829
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x62c144]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov dword [ebp - 8], 7
mov esi, 0x5ababc
mov word [ebp - 0x1c], ax
xor edi, edi
push esi
mov dword [ebp - 0xc], edi
call fcn.004549d7
pop ecx
push eax
push esi
lea ecx, [ebp - 0x1c]
call fcn.004020c0
lea eax, [ebp - 0x20]
push eax
push 0xf003f
push edi
push str.SoftWareMicrosoftWindowsCurrentVersionUninstall
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43889f
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push 1
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], edi
call fcn.004253f2
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00439cb7
mov esp, ebp
pop ebp
ret
Function at 0x4388f1
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x62c144]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x418]
mov ebx, str.WnWBImeDictFile
push eax
push ebx
push accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x438a44
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push eax
push ebx
push 1
push 0x5a6864
push dword [ebp - 0x418]
call edi
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00446360
add esp, 0xc
mov ebx, str.WnDictInst.exe
push ebx
call fcn.004257a1
mov ecx, eax
call fcn.00434641
push eax
lea eax, [ebp - 0x414]
push 0x5a916c
push eax
call fcn.00408fc0
add esp, 0x10
lea eax, [ebp - 0x414]
push 0x104
push eax
push 1
push str.DefaultIcon
push dword [ebp - 0x418]
call edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00446360
add esp, 0xc
push ebx
call fcn.004257a1
mov ecx, eax
call fcn.00434641
push eax
lea eax, [ebp - 0x20c]
push str.__s_s___install
push eax
call fcn.00408fc0
lea eax, [ebp - 0x20c]
push 0x5abbd0
push eax
call fcn.004549f2
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 1
push str.shellopencommand_
push dword [ebp - 0x418]
call edi
push dword [ebp - 0x418]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
lea eax, [ebp - 0x41c]
push eax
push str..wncl
push accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x438a43
push 0x104
push str.WnWBImeDictFile
push 1
push 0x5a6864
push dword [ebp - 0x41c]
call edi
push dword [ebp - 0x41c]
call ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00439cb7
mov esp, ebp
pop ebp
ret

Function at 0x438a53
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
call fcn.00438a63
mov ecx, esi
pop esi
jmp fcn.004388f1
Function at 0x438a63
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x62c144]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
lea eax, [ebp - 0x41c]
push eax
mov ebx, str.WnWBImeSkinFile
push ebx
push accept
call esi
test eax, eax
jne 0x438bed
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push eax
push ebx
push 1
push 0x5a6864
push dword [ebp - 0x41c]
call edi
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00446360
add esp, 0xc
mov ebx, str.WnSkinInst.exe
push ebx
call fcn.004257a1
mov ecx, eax
call fcn.00434641
push eax
lea eax, [ebp - 0x414]
push 0x5a916c
push eax
call fcn.00408fc0
add esp, 0x10
lea eax, [ebp - 0x414]
push 0x104
push eax
push 1
push str.DefaultIcon
push dword [ebp - 0x41c]
call edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00446360
add esp, 0xc
push ebx
call fcn.004257a1
mov ecx, eax
call fcn.00434641
push eax
lea eax, [ebp - 0x20c]
push str.__s_s___install
push eax
call fcn.00408fc0
lea eax, [ebp - 0x20c]
push 0x5abbd0
push eax
call fcn.004549f2
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 1
push str.shellopencommand_
push dword [ebp - 0x41c]
call edi
push dword [ebp - 0x41c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
lea eax, [ebp - 0x418]
push eax
push str..wnpf
push accept
call esi
test eax, eax
jne 0x438bec
push 0x104
push str.WnWBImeSkinFile
push 1
push 0x5a6864
push dword [ebp - 0x418]
call edi
push dword [ebp - 0x418]
call ebx
lea eax, [ebp - 0x418]
push eax
push str..swnpf
push accept
call esi
test eax, eax
jne 0x438bec
push 0x104
push str.WnWBImeSkinFile
push 1
push 0x5a6864
push dword [ebp - 0x418]
call edi
push dword [ebp - 0x418]
call ebx
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00439cb7
mov esp, ebp
pop ebp
ret

Function at 0x438c49
Capabilities:
Delete registry key

Disassembly:
push esi
mov esi, ecx
call fcn.00438c59
mov ecx, esi
pop esi
jmp fcn.00438bfd

Function at 0x438c59
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x5a6864
push accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x438cab
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.WnWBImeSkinFile
push dword [ebp - 4]
call esi
push str..wnpf
push dword [ebp - 4]
call esi
push str..swnpf
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x438f16
Capabilities:
Check if file exists
Get common file path

Disassembly:
push 0x23c
mov eax, 0x5a47ec
call fcn.0043a209
mov esi, ecx
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00446360
add esp, 0xc
lea eax, [ebp - 0x218]
push ebx
push 0x10
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x438e33
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
je 0x438d1f
lea eax, [ebp - 0x218]
push eax
call fcn.004549d7
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.004020c0
mov edi, 0x5a6c98
mov dword [ebp - 4], ebx
push edi
call fcn.004549d7
pop ecx
push eax
push edi
lea ecx, [ebp - 0x230]
call fcn.004053e0
mov edi, 0x5abc4c
push edi
call fcn.004549d7
pop ecx
push eax
push edi
lea ecx, [ebp - 0x230]
call fcn.004053e0
mov edi, str..lnk
push edi
call fcn.004549d7
pop ecx
push eax
push edi
lea ecx, [ebp - 0x230]
call fcn.004053e0
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x438e25
call fcn.004257a1
mov ecx, eax
call fcn.00434641
push eax
lea ecx, [ebp - 0x248]
call fcn.00403820
mov edi, str.wnwb.exe
mov byte [ebp - 4], 1
push edi
call fcn.004549d7
pop ecx
push eax
push edi
lea ecx, [ebp - 0x248]
call fcn.004053e0
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x248]
push ebx
cmovae ecx, dword [ebp - 0x248]
lea eax, [ebp - 0x230]
cmp dword [ebp - 0x21c], 8
push ebx
cmovae eax, dword [ebp - 0x230]
push 0x657
push 1
push 0x5abc5c
push ecx
push eax
mov ecx, esi
call fcn.00438e39
push ebx
push 1
lea ecx, [ebp - 0x248]
call fcn.004253f2
push ebx
push 1
lea ecx, [ebp - 0x230]
call fcn.004253f2
call fcn.0043a1c4
ret
jmp 0x438caf
Function at 0x439060
Capabilities:
Set registry value

Disassembly:
push 0x244
mov eax, 0x5a506f
call fcn.0043a209
mov eax, dword [ebp + 0xc]
xor edi, edi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
push 0x208
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x218]
push edi
push eax
mov dword [ebp - 0x228], esi
call fcn.00446360
push esi
lea eax, [ebp - 0x218]
push str.SOFTWAREMicrosoftInternet_ExplorerLow_RightsElevationPolicy_s
push eax
call fcn.00408fc0
add esp, 0x18
mov dword [ebp - 0x220], edi
lea ecx, [ebp - 0x250]
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x22c], 3
call fcn.0042abc9
lea ecx, [ebp - 0x250]
mov dword [ebp - 4], edi
call fcn.0042ac8f
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4391c2
lea eax, [ebp - 0x220]
push eax
push 0xf013f
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerLow_RightsElevationPolicy
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x439283
xor ecx, ecx
lea eax, [ebp - 0x21c]
push ecx
push eax
push ecx
push 0xf013f
push ecx
push ecx
push ecx
push dword [ebp - 0x228]
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x43914c
push dword [ebp - 0x220]
call esi
jmp 0x439283
push ebx
call fcn.004549d7
pop ecx
lea eax, [eax*2 + 2]
push eax
push ebx
push 1
push 0
push str.AppName
push dword [ebp - 0x21c]
call edi
push dword [ebp - 0x224]
call fcn.004549d7
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x224]
push 1
push 0
push str.AppPath
push dword [ebp - 0x21c]
call edi
push 4
lea eax, [ebp - 0x22c]
push eax
push 4
push 0
push str.Policy
push dword [ebp - 0x21c]
call edi
push dword [ebp - 0x21c]
call esi
push dword [ebp - 0x220]
call esi
lea eax, [ebp - 0x220]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerLow_RightsElevationPolicy
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x439283
xor ecx, ecx
lea eax, [ebp - 0x21c]
push ecx
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push dword [ebp - 0x228]
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x43927b
push ebx
call fcn.004549d7
pop ecx
lea eax, [eax*2 + 2]
push eax
push ebx
push 1
push 0
push str.AppName
push dword [ebp - 0x21c]
call edi
mov ebx, dword [ebp - 0x224]
push ebx
call fcn.004549d7
pop ecx
lea eax, [eax*2 + 2]
push eax
push ebx
push 1
push 0
push str.AppPath
push dword [ebp - 0x21c]
call edi
push 4
lea eax, [ebp - 0x22c]
push eax
push 4
push 0
push str.Policy
push dword [ebp - 0x21c]
call edi
push dword [ebp - 0x21c]
call esi
push dword [ebp - 0x220]
call esi
lea ecx, [ebp - 0x250]
call fcn.0042abdc
call fcn.0043a1c4
ret 0xc
Function at 0x43b385
Capabilities:
Read .ini file

Disassembly:
push 0x864
mov eax, 0x5a51ae
call fcn.0043a209
mov ebx, ecx
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cdq
push edx
push eax
lea eax, [ebp - 0x828]
push eax
call int.00426d85
add esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 0x828]
push eax
lea ecx, [ebp - 0x858]
call fcn.004037f0
push 0x800
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 1
push 0
push eax
call fcn.00446360
lea ecx, [ebx + 0xd4]
add esp, 0xc
cmp dword [ecx + 0x14], 8
jb 0x43b3ef
mov ecx, dword [ecx]
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
push ecx
cmovae eax, dword [ebp - 0x828]
lea ecx, [ebp - 0x810]
push 0x400
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
and dword [ebp - 0x830], 0
xor eax, eax
mov dword [ebp - 0x82c], 7
mov word [ebp - 0x840], ax
cmp word [ebp - 0x810], ax
je 0x43b449
lea eax, [ebp - 0x810]
push eax
call fcn.004549d7
pop ecx
push eax
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x840]
call fcn.004020c0
lea eax, [ebp - 0x828]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x840]
call fcn.00426c97
test eax, eax
jne 0x43b4b9
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
mov ecx, ebx
cmovae eax, dword [ebp - 0x828]
push eax
push edi
push esi
lea eax, [ebp - 0x870]
push eax
call fcn.0043b5b1
push eax
lea ecx, [ebp - 0x858]
call fcn.00403a30
xor ebx, ebx
lea ecx, [ebp - 0x870]
push ebx
push 1
call fcn.004253f2
jmp 0x43b4d0
push 0xffffffffffffffff
xor ebx, ebx
lea eax, [ebp - 0x840]
push ebx
push eax
lea ecx, [ebp - 0x858]
call fcn.00401fa0
cmp dword [ebp - 0x844], 8
lea eax, [ebp - 0x858]
cmovae eax, dword [ebp - 0x858]
push eax
call fcn.00449bc4
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x840]
mov esi, eax
call fcn.004253f2
push ebx
push 1
lea ecx, [ebp - 0x858]
call fcn.004253f2
push ebx
push 1
lea ecx, [ebp - 0x828]
call fcn.004253f2
mov eax, esi
call fcn.0043a1c4
ret 0xc
Function at 0x43b605
Capabilities:
Read .ini file

Disassembly:
push 0x838
mov eax, 0x5a51e1
call fcn.0043a209
mov edi, ecx
mov ecx, dword [ebp + 0xc]
lea eax, [edi + 0x8c]
cmp dword [eax + 0x14], 8
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x844], ecx
jb 0x43b630
mov eax, dword [eax]
push eax
push dword [ebp + 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
cmp esi, dword [ebp + 0x10]
jne 0x43b70e
xor esi, esi
mov dword [ebp - 0x814], 7
push esi
xor eax, eax
mov dword [ebp - 0x818], esi
push 0x5a6864
lea ecx, [ebp - 0x828]
mov word [ebp - 0x828], ax
call fcn.004020c0
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 4], esi
push esi
push eax
call fcn.00446360
push dword [ebp + 0x10]
lea eax, [ebp - 0x810]
push 0x5a6ac0
push eax
call fcn.00408fc0
add esp, 0x18
lea eax, [ebp - 0x810]
cmp byte [edi + 5], 0
mov ecx, edi
push eax
push dword [ebp - 0x844]
lea eax, [ebp - 0x840]
push ebx
push eax
je 0x43b6c3
call fcn.0043b521
jmp 0x43b6c8
call fcn.0043b5db
push eax
lea ecx, [ebp - 0x828]
call fcn.00403a30
push esi
push 1
lea ecx, [ebp - 0x840]
call fcn.004253f2
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.00449bc4
pop ecx
push 0
push 1
lea ecx, [ebp - 0x828]
mov esi, eax
call fcn.004253f2
mov eax, esi
call fcn.0043a1c4
ret 0xc

Function at 0x43b718
Capabilities:
Read .ini file

Disassembly:
push 0x82c
mov eax, 0x5a522b
call fcn.0043a209
mov edi, ecx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x10]
push 0x800
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x810]
push ecx
push eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], ecx
call fcn.00446360
lea eax, [edi + 0x8c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x43b775
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.00403820
and dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x834], 1
jb 0x43b7bb
mov eax, dword [esi]
jmp 0x43b7bd
mov eax, esi
push ebx
push eax
call fcn.00454bdb
pop ecx
pop ecx
test eax, eax
jne 0x43b809
cmp byte [edi + 5], 0
lea eax, [ebp - 0x828]
push ebx
push dword [ebp - 0x82c]
mov ecx, edi
push dword [ebp - 0x830]
push eax
je 0x43b7ed
call fcn.0043b521
jmp 0x43b7f2
call fcn.0043b5db
push eax
mov ecx, esi
call fcn.00403a30
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.004253f2
mov eax, esi
call fcn.0043a1c4
ret 0x10
Function at 0x43c3bb
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa44
mov eax, dword [0x62c144]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
mov edi, ecx
call fcn.00446360
lea eax, [edi + 0x2c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x43c3f4
mov eax, dword [eax]
push str.Config
push eax
lea eax, [ebp - 0x20c]
push 0x5a92fc
push eax
call fcn.00408fc0
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43c42c
lea eax, [ebp - 0x20c]
push eax
call fcn.00429262
pop ecx
push 0x208
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.00446360
push str.UseVestige.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x5a916c
push eax
call fcn.00408fc0
add esp, 0x1c
cmp word [ebp - 0x414], si
jne 0x43c46b
mov eax, esi
jmp 0x43c478
lea eax, [ebp - 0x414]
push eax
call fcn.004549d7
pop ecx
push eax
lea eax, [ebp - 0x414]
push eax
lea ecx, [edi + 0x8c]
call fcn.004020c0
push 0x208
lea eax, [ebp - 0x61c]
push esi
push eax
call fcn.00446360
push str.Cache.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push 0x5a916c
push eax
call fcn.00408fc0
add esp, 0x1c
cmp word [ebp - 0x61c], si
jne 0x43c4ca
mov eax, esi
jmp 0x43c4d7
lea eax, [ebp - 0x61c]
push eax
call fcn.004549d7
pop ecx
push eax
lea eax, [ebp - 0x61c]
push eax
lea ecx, [edi + 0xa4]
call fcn.004020c0
push 0x208
lea eax, [ebp - 0x824]
push esi
push eax
call fcn.00446360
lea eax, [ebp - 0xa44]
push str.ShxlPath
push eax
call fcn.00429907
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x43c518
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x824]
push 0x5a8044
push eax
call fcn.00408fc0
add esp, 0xc
lea ecx, [ebp - 0xa44]
push esi
push 1
call fcn.004253f2
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43c559
lea eax, [ebp - 0x824]
push eax
call fcn.00429262
pop ecx
push 0x208
lea eax, [ebp - 0xa2c]
push esi
push eax
call fcn.00446360
push str.Cache.ini
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0xa2c]
push 0x5a916c
push eax
call fcn.00408fc0
add esp, 0x1c
cmp word [ebp - 0xa2c], si
je 0x43c5a3
lea eax, [ebp - 0xa2c]
push eax
call fcn.004549d7
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0xa2c]
push eax
lea ecx, [edi + 0xbc]
call fcn.004020c0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00439cb7
mov esp, ebp
pop ebp
ret