joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403c10
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4401c8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x462524]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x6c], 0
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edi, eax
push 0x20
lea eax, [ebp - 0x30]
push eax
push 0x59
push edi
call esi
push 0x20
lea eax, [ebp - 0x50]
push eax
push 0x5a
push edi
call esi
xor eax, eax
mov dword [ebp - 0x54], 7
mov dword [ebp - 0x58], 0
mov word [ebp - 0x68], ax
cmp word [ebp - 0x30], ax
jne 0x403c87
xor ecx, ecx
jmp 0x403c9f
lea ecx, [ebp - 0x30]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403c90
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x68]
call fcn.00405b60
mov esi, dword [ebp - 0x54]
lea eax, [ebp - 0x68]
mov edi, dword [ebp - 0x68]
cmp esi, 8
push 2
push 0x444898
push dword [ebp - 0x58]
cmovae eax, edi
mov dword [ebp - 4], 0
push eax
call fcn.004056c0
add esp, 0x10
test eax, eax
jne 0x403cf1
push 0x4449e0
mov ecx, ebx
call fcn.00402f80
mov ecx, dword [ebp - 0x54]
cmp ecx, 8
jb 0x403d2e
inc ecx
push ecx
jmp 0x403d23
push 2
push 0x444a00
push dword [ebp - 0x58]
cmp esi, 8
lea eax, [ebp - 0x68]
cmovae eax, edi
push eax
call fcn.004056c0
add esp, 0x10
mov ecx, ebx
push str.Chinese
call fcn.00402f80
mov eax, dword [ebp - 0x54]
cmp eax, 8
jb 0x403d2e
inc eax
push eax
push dword [ebp - 0x68]
lea ecx, [ebp - 0x68]
call fcn.00405cc0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e99a
mov esp, ebp
pop ebp
ret 4

Function at 0x406720
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], 0
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4067ce
push esi
push dword [ebp - 8]
call fcn.0042a5fe
push dword [ebp - 8]
mov esi, eax
push 0
push esi
call fcn.00429120
add esp, 0x10
mov dword [ebp - 0xc], 1
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test esi, esi
je 0x4067c3
mov edx, dword [ebp + 0x14]
mov bl, 1
mov eax, esi
sub edx, esi
nop word [eax + eax]
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x4067a0
push esi
call fcn.0042a5f9
add esp, 4
mov al, bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x406d50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x462524]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x40], 8
lea eax, [esi + 0x2c]
jb 0x406d71
mov eax, dword [eax]
push str.Config
push eax
lea eax, [ebp - 0x20c]
push 0x444bbc
push eax
call fcn.00406e60
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x406dab
lea eax, [ebp - 0x20c]
push eax
call fcn.00422287
add esp, 4
lea ecx, [ebp - 0x20c]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x406db4
mov eax, dword [str.Config.ini]
mov dword [ecx], eax
mov eax, dword [0x444bcc]
mov dword [ecx + 4], eax
mov eax, dword [0x444bd0]
mov dword [ecx + 8], eax
mov eax, dword [0x444bd4]
mov dword [ecx + 0xc], eax
mov eax, dword [0x444bd8]
mov dword [ecx + 0x10], eax
mov ax, word [0x444bdc]
mov word [ecx + 0x14], ax
cmp word [ebp - 0x20c], 0
jne 0x406dff
xor ecx, ecx
jmp 0x406e1f
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406e10
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x1b0]
call fcn.00405b60
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0041e99a
mov esp, ebp
pop ebp
ret
Function at 0x407fb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4405fc
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x462524]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00429120
add esp, 0xc
lea ecx, [ebp - 0x29c]
xorps xmm0, xmm0
movlpd qword [ebp - 0x2a4], xmm0
call dword [sym.imp.CoreUI.dll_public:_void___thiscall_UiLib::CDuiString::constructor_void_]
mov ecx, dword [edi + 0x888]
push 0x444844
mov dword [ebp - 4], 0
mov eax, dword [ecx]
call dword [eax + 0x2c]
lea eax, [ebp - 0x29c]
mov ecx, edi
push eax
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00407c20
test al, al
jne 0x408081
mov eax, dword [edi + 0x888]
lea ecx, [ebp - 0x29c]
mov esi, dword [eax]
call dword [sym.imp.CoreUI.dll_public:_wchar_t_const____thiscall_UiLib::CDuiString::operator_wchar_t_const__void_const]
mov ecx, dword [edi + 0x888]
push eax
call dword [esi + 0x2c]
push 0x16
push 0x1b1
push 0x228
push 0
push 0
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x40815f
push 0x16
push 0x163
push 0x228
push 0
push 0
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [edi + 0x890]
push 0
mov eax, dword [ecx]
call dword [eax + 0xd0]
mov ecx, dword [edi + 0x894]
push 1
mov eax, dword [ecx]
call dword [eax + 0xd0]
mov ecx, dword [edi + 0x898]
push 0
mov eax, dword [ecx]
call dword [eax + 0xd0]
push 0
push 0xa
push 0x464
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
push 0x218
mov dword [edi + 0x868], eax
call fcn.0041e94b
mov ecx, dword [edi + 4]
mov esi, eax
add esp, 4
mov dword [esi], ecx
lea edx, [esi + 4]
mov ecx, dword [ebp - 0x2a4]
mov dword [esi + 0x210], ecx
mov ecx, dword [ebp - 0x2a0]
mov dword [esi + 0x214], ecx
lea ecx, [ebp - 0x218]
mov eax, ecx
sub edx, eax
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x408120
mov ecx, dword [edi + 0x870]
push 0
mov eax, dword [ecx]
call dword [eax + 0xe0]
lea eax, [edi + 0x860]
push eax
push 0
push esi
push 0x408190
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x864], eax
lea ecx, [ebp - 0x29c]
call dword [sym.imp.CoreUI.dll_public:_void___thiscall_UiLib::CDuiString::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e99a
mov esp, ebp
pop ebp
ret
Function at 0x4115d0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4417f7
mov eax, dword fs:[0]
push eax
sub esp, 0x2a8
mov eax, dword [0x462524]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [edi + 0x768]
cmp dword [eax + 0x108], ecx
jne 0x41173b
mov eax, dword [ecx]
lea edx, [ebp - 0x2b4]
push edx
call dword [eax + 0x28]
mov ecx, eax
mov dword [ebp - 4], 0
call dword [sym.imp.CoreUI.dll_public:_wchar_t_const____thiscall_UiLib::CDuiString::operator_wchar_t_const__void_const]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402f80
lea ecx, [ebp - 0x2b4]
mov byte [ebp - 4], 2
call dword [sym.imp.CoreUI.dll_public:_void___thiscall_UiLib::CDuiString::destructor_void_]
cmp dword [ebp - 0x220], 0
jne 0x411675
push 0x208
lea eax, [ebp - 0x218]
mov dword [edi + 0x7d8], 4
push 0
push eax
call fcn.00429120
push 4
jmp 0x4116cf
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call fcn.0042e79f
mov esi, eax
add esp, 4
mov dword [edi + 0x7d8], esi
cmp esi, 4
jl 0x4116a6
cmp esi, 0x63
jle 0x411710
jmp 0x4116ab
mov esi, 4
mov eax, 0x63
cmp esi, eax
push 0x208
cmovg esi, eax
lea eax, [ebp - 0x218]
push 0
push eax
mov dword [edi + 0x7d8], esi
call fcn.00429120
push esi
lea eax, [ebp - 0x218]
push 0x449444
push eax
call fcn.00406e60
mov ecx, dword [edi + 0x768]
lea edx, [ebp - 0x218]
add esp, 0x18
mov eax, dword [ecx]
push edx
call dword [eax + 0x2c]
push dword [edi + 0x7d8]
push 0xa
call fcn.004074f0
mov ecx, eax
call fcn.0041a250
mov ecx, edi
call fcn.0040f880
push 2
push 0x4156f0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x41173b
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00405cc0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e99a
mov esp, ebp
pop ebp
ret 4
Function at 0x413ab0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x441ed1
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x462524]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 0xc4]
mov dword [ecx + 0x734], 1
push edx
mov ecx, dword [eax + 0x108]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, eax
mov dword [ebp - 4], 0
call dword [sym.imp.CoreUI.dll_public:_wchar_t_const____thiscall_UiLib::CDuiString::operator_wchar_t_const__void_const]
lea ecx, [ebp - 0xc4]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call dword [sym.imp.CoreUI.dll_public:_void___thiscall_UiLib::CDuiString::destructor_void_]
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp word [esi], ax
jne 0x413b3d
xor ecx, ecx
jmp 0x413b51
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413b42
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00405b60
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 1
push eax
call fcn.00413650
mov ecx, dword [ebp - 0x14]
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov bl, al
cmp ecx, 8
jb 0x413b8c
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00405cc0
test bl, bl
je 0x413c37
push esi
lea ecx, [ebp - 0x40]
call fcn.00402f80
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 2
push eax
call fcn.00413360
mov ecx, dword [ebp - 0x2c]
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov esi, eax
cmp ecx, 8
jb 0x413bce
inc ecx
push ecx
push dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
call fcn.00405cc0
xor eax, eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov eax, dword [0x463714]
mov dword [ebp - 0x30], 0
test eax, eax
jne 0x413c20
push 0xbc
call fcn.0041e94b
add esp, 4
mov dword [ebp - 0xc8], eax
mov dword [ebp - 4], 3
test eax, eax
je 0x413c12
mov ecx, eax
call fcn.004182c0
jmp 0x413c14
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x463714], eax
push esi
push 0x48
mov ecx, eax
call fcn.0041a250
push 9
push 0x4156f0
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e99a
mov esp, ebp
pop ebp
ret 4
Function at 0x413ec0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x441fc9
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x462524]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi + 0x24]
lea edx, [ebp - 0xac]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
mov ecx, eax
mov dword [ebp - 4], 0
call dword [sym.imp.CoreUI.dll_public:_wchar_t_const____thiscall_UiLib::CDuiString::operator_wchar_t_const__void_const]
mov edx, eax
mov dword [ebp - 0x14], 7
xor eax, eax
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp word [edx], ax
jne 0x413f2c
xor ecx, ecx
jmp 0x413f40
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413f31
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00405b60
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 2
call dword [sym.imp.CoreUI.dll_public:_void___thiscall_UiLib::CDuiString::destructor_void_]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0042e79f
mov esi, eax
add esp, 4
mov eax, dword [0x463714]
test eax, eax
jne 0x413fa8
push 0xbc
call fcn.0041e94b
add esp, 4
mov dword [ebp - 0xb0], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x413f9d
mov ecx, eax
call fcn.004182c0
jmp 0x413f9f
xor eax, eax
mov byte [ebp - 4], 2
mov dword [0x463714], eax
push esi
push 0x46
mov ecx, eax
call fcn.0041a250
push 0xb
push 0x4156f0
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, edi
call fcn.00416080
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x413fdb
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00405cc0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e99a
mov esp, ebp
pop ebp
ret

Function at 0x414000
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x462524]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, ecx
push 0
push eax
call fcn.00429120
push 3
lea eax, [ebp - 0x20c]
push 0x449444
push eax
call fcn.00406e60
mov ecx, dword [esi + 0x24]
lea edx, [ebp - 0x20c]
add esp, 0x18
mov eax, dword [ecx]
push edx
call dword [eax + 0x2c]
push 0xb
push 0x4156f0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x38]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x3c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0041e99a
mov esp, ebp
pop ebp
ret
Function at 0x4182c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4426a2
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x462524]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x5c]
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 8
jb 0x418306
mov eax, dword [ecx]
jmp 0x418308
mov eax, ecx
xor edx, edx
mov word [eax], dx
mov dword [esi + 0x88], 7
mov dword [esi + 0x84], edx
cmp dword [esi + 0x88], 8
mov dword [ebp - 4], edx
jb 0x41832e
mov eax, dword [esi + 0x74]
jmp 0x418331
lea eax, [esi + 0x74]
xor edx, edx
mov word [eax], dx
lea ebx, [esi + 0x8c]
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], edx
cmp dword [ebx + 0x14], 8
jb 0x418350
mov eax, dword [ebx]
jmp 0x418352
mov eax, ebx
xor edx, edx
mov word [eax], dx
lea eax, [esi + 0xa4]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], edx
cmp dword [eax + 0x14], 8
jb 0x41836f
mov eax, dword [eax]
xor edx, edx
mov word [eax], dx
push edx
push 0x444844
mov byte [ebp - 4], 3
mov dword [esi + 4], edx
mov dword [esi + 8], edx
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], edx
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], edx
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], edx
mov dword [esi + 0x28], edx
mov dword [esi + 0x2c], edx
mov dword [esi + 0x30], edx
mov dword [esi + 0x34], edx
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], edx
mov dword [esi + 0x40], edx
mov dword [esi + 0x44], edx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], edx
mov dword [esi + 0x50], edx
mov dword [esi + 0x54], edx
mov dword [esi + 0x58], edx
call fcn.00405b60
push 0
push 0x444844
lea ecx, [esi + 0x74]
call fcn.00405b60
push 0
push 0x444844
mov ecx, ebx
call fcn.00405b60
push 0
push 0x444844
lea ecx, [esi + 0xa4]
call fcn.00405b60
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41a600
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x442793
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x462524]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x465268
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ebp - 4], 0
mov dword [ecx], 0x465268
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x44b534
mov byte [ebp - 4], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.0041e430
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41b430
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4428a8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x462524]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x41b481
push ebx
push ebx
push ebx
push 2
call fcn.0041dfb0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [edi + 0x18]
test esi, esi
je 0x41b497
mov ecx, esi
mov esi, dword [esi + 0x28]
push 1
mov eax, dword [ecx]
call dword [eax]
test esi, esi
jne 0x41b488
push 2
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
push 0
push ebx
mov dword [edi + 8], 0xffffffff
mov dword [edi + 4], 0xffffffff
call fcn.0042f3fe
push ebx
call fcn.0042f970
push 0
mov esi, eax
push 0
push ebx
mov dword [ebp - 0x14], esi
call fcn.0042f3fe
add esp, 0x1c
test esi, esi
jne 0x41b4fb
push esi
push esi
push esi
push 0xd
mov ecx, edi
call fcn.0041dfb0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 0x10], 0x465268
push esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.0041e510
lea eax, [esi + 1]
push eax
call fcn.0041e98c
push ebx
push 1
mov ebx, eax
mov dword [ebp + 8], eax
push esi
push ebx
mov byte [eax], 0
call fcn.0042f094
add esp, 0x14
cmp eax, 1
je 0x41b54b
push 0
push 0
push 0
push 2
mov ecx, edi
call fcn.0041dfb0
xor bl, bl
jmp 0x41b5ee
mov eax, dword [ebp - 0x14]
mov ecx, ebx
mov esi, ebx
mov byte [ebx + eax], 0
cmp byte [ebx], 0
je 0x41b5b8
nop dword [eax + eax]
mov al, byte [esi]
cmp al, 0xa
jne 0x41b57a
mov eax, esi
sub eax, ecx
inc eax
push eax
push ecx
lea ecx, [ebp - 0x10]
call fcn.0041e3e0
inc esi
mov ecx, esi
jmp 0x41b5b3
cmp al, 0xd
jne 0x41b5b2
mov eax, esi
sub eax, ecx
test eax, eax
jle 0x41b590
push eax
push ecx
lea ecx, [ebp - 0x10]
call fcn.0041e3e0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0xa
push eax
lea ecx, [ebp - 0x10]
call fcn.0041e3e0
cmp byte [esi + 1], 0xa
lea ecx, [esi + 1]
jne 0x41b5ae
lea ecx, [esi + 2]
mov esi, ecx
jmp 0x41b5b3
inc esi
cmp byte [esi], 0
jne 0x41b560
sub esi, ecx
je 0x41b5c6
push esi
push ecx
lea ecx, [ebp - 0x10]
call fcn.0041e3e0
push ebx
call fcn.0041e995
mov eax, dword [ebp - 0x10]
add esp, 4
mov edx, dword [edi]
add eax, 8
mov ecx, edi
push dword [ebp + 0xc]
push 0
push eax
call dword [edx + 8]
cmp byte [edi + 0x2c], 0
je 0x41b5ec
xor bl, bl
jmp 0x41b5ee
mov bl, 1
mov ecx, dword [ebp - 0x10]
cmp ecx, 0x465268
je 0x41b602
push ecx
call fcn.0041e995
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4209b5
Capabilities:
Read .ini file

Disassembly:
push 0x82c
mov eax, 0x442cf8
call fcn.0043d71c
mov edi, ecx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x10]
push 0x800
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x810]
push ecx
push eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], ecx
call fcn.00429120
lea eax, [edi + 0x8c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x420a12
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.00402f80
and dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x834], 1
jb 0x420a58
mov eax, dword [esi]
jmp 0x420a5a
mov eax, esi
push ebx
push eax
call fcn.00431688
pop ecx
pop ecx
test eax, eax
jne 0x420aa6
cmp byte [edi + 5], 0
lea eax, [ebp - 0x828]
push ebx
push dword [ebp - 0x82c]
mov ecx, edi
push dword [ebp - 0x830]
push eax
je 0x420a8a
call fcn.004208d1
jmp 0x420a8f
call fcn.0042098b
push eax
mov ecx, esi
call fcn.0040f690
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.00405650
mov eax, esi
call fcn.0043d6d7
ret 0x10
Function at 0x42166a
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa44
mov eax, dword [0x462524]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
mov edi, ecx
call fcn.00429120
lea eax, [edi + 0x2c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x4216a3
mov eax, dword [eax]
push str.Config
push eax
lea eax, [ebp - 0x20c]
push 0x444bbc
push eax
call fcn.00406e60
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4216db
lea eax, [ebp - 0x20c]
push eax
call fcn.00422287
pop ecx
push 0x208
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.00429120
push str.UseVestige.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x448a00
push eax
call fcn.00406e60
add esp, 0x1c
cmp word [ebp - 0x414], si
jne 0x42171a
mov eax, esi
jmp 0x421727
lea eax, [ebp - 0x414]
push eax
call fcn.004316ea
pop ecx
push eax
lea eax, [ebp - 0x414]
push eax
lea ecx, [edi + 0x8c]
call fcn.00405b60
push 0x208
lea eax, [ebp - 0x61c]
push esi
push eax
call fcn.00429120
push str.UseCache.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push 0x448a00
push eax
call fcn.00406e60
add esp, 0x1c
cmp word [ebp - 0x61c], si
jne 0x421779
mov eax, esi
jmp 0x421786
lea eax, [ebp - 0x61c]
push eax
call fcn.004316ea
pop ecx
push eax
lea eax, [ebp - 0x61c]
push eax
lea ecx, [edi + 0xa4]
call fcn.00405b60
push 0x208
lea eax, [ebp - 0x824]
push esi
push eax
call fcn.00429120
lea eax, [ebp - 0xa44]
push str.DSKXRoad
push eax
call fcn.00422989
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x4217c7
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x824]
push 0x44b2f4
push eax
call fcn.00406e60
add esp, 0xc
lea ecx, [ebp - 0xa44]
push esi
push 1
call fcn.00405650
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x421808
lea eax, [ebp - 0x824]
push eax
call fcn.00422287
pop ecx
push 0x208
lea eax, [ebp - 0xa2c]
push esi
push eax
call fcn.00429120
push str.UseCache.ini
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0xa2c]
push 0x448a00
push eax
call fcn.00406e60
add esp, 0x1c
cmp word [ebp - 0xa2c], si
je 0x421852
lea eax, [ebp - 0xa2c]
push eax
call fcn.004316ea
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0xa2c]
push eax
lea ecx, [edi + 0xbc]
call fcn.00405b60
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041e99a
mov esp, ebp
pop ebp
ret