joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418ab6
Capabilities:
Get file size
Read file on windows

Disassembly:
push 8
mov eax, 0x494518
call fcn.0045d7a7
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x14], edi
call fcn.00401afb
push eax
lea ecx, [ebp - 0x10]
call fcn.004026a6
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], edi
cmp dword [ebp + 0x14], edi
je 0x418ae8
lea eax, [esi + 0xc]
push eax
jmp 0x418ae9
push esi
call fcn.004016b7
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
je 0x418bbd
call fcn.00401afb
push eax
lea ecx, [ebp + 0x14]
call fcn.004026a6
push dword [ebp + 0x10]
xor ebx, ebx
lea eax, [ebp + 0x14]
push dword [ebp + 8]
inc ebx
push esi
push str._s_d._s
push eax
mov byte [ebp - 4], bl
call fcn.00402941
add esp, 0x14
push edi
push 0x80
push 3
push edi
mov edi, dword [ebp + 0x14]
push ebx
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x418bb5
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp + 0x10], eax
test eax, eax
je 0x418bae
mov ecx, dword [ebp + 0xc]
add eax, 0xa
and dword [ebp + 8], 0
push eax
call fcn.00402c2d
push 0
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x418ba4
mov eax, dword [ebp + 0x10]
cmp dword [ebp + 8], eax
jne 0x418ba4
mov ecx, dword [ebp + 0xc]
push eax
call fcn.00403a69
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [edi - 0x10]
call fcn.00401dbc
xor edi, edi
inc edi
jmp 0x418bc0
mov ecx, dword [ebp + 0xc]
push 0
call fcn.00402d6c
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [edi - 0x10]
call fcn.00401dbc
mov edi, dword [ebp - 0x14]
lea ecx, [esi - 0x10]
call fcn.00401dbc
mov eax, edi
call fcn.0045d770
ret 0x10

Function at 0x41900a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x18], 0
jne 0x419042
lea eax, [ebp - 4]
push eax
call fcn.0041904a
push dword [eax]
push 2
push 0x49cec8
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 4]
mov dword [esi + 0x18], eax
lea ecx, [ecx - 0x10]
call fcn.00401dbc
mov eax, dword [esi + 0x18]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41904a
Capabilities:
Check if file exists

Disassembly:
push 0xc
mov eax, 0x49455e
call fcn.0045d7a7
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x14]
push eax
call fcn.00419318
mov eax, dword [ebp - 0x14]
and dword [ebp - 4], 0
cmp dword [eax - 0xc], 0
jne 0x41908d
mov ecx, dword [ebp + 8]
push 0x49a86c
call fcn.00401616
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401dbc
mov eax, dword [ebp + 8]
jmp 0x4190ff
add eax, 0xfffffff0
push eax
call fcn.00401911
add eax, 0x10
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
mov dword [esp], str.datadpiconfig.ini
call fcn.0040276d
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4190d9
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.004016b7
push str._ressrcchsdpisetting.ini
lea ecx, [ebp - 0x10]
call fcn.0040276d
mov esi, dword [ebp - 0x10]
add esi, 0xfffffff0
push esi
call fcn.00401911
mov edi, dword [ebp + 8]
add eax, 0x10
pop ecx
mov ecx, esi
mov dword [edi], eax
call fcn.00401dbc
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401dbc
mov eax, edi
call fcn.0045d770
ret 4

Function at 0x419107
Capabilities:
Read .ini file

Disassembly:
push 0x14
mov eax, 0x494591
call fcn.0045d7a7
mov edi, ecx
lea esi, [edi + 0x1c]
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jne 0x4191f8
call fcn.00401afb
push eax
lea ecx, [ebp - 0x10]
call fcn.004026a6
lea eax, [ebp - 0x18]
xor ebx, ebx
push eax
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.0041904a
push dword [eax]
mov eax, 0x104
mov byte [ebp - 4], 1
push eax
push eax
lea ecx, [ebp - 0x10]
call fcn.00401c94
push eax
push str.1.01.21.51.72.02.22.52.73.0
push str.supportrate
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], bl
lea ecx, [ecx - 0x10]
call fcn.00401dbc
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004036a2
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
mov edi, 0x49c204
lea eax, [ebp - 0x14]
push edi
push eax
lea ecx, [ebp - 0x10]
call fcn.004171f3
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
jmp 0x4191df
push eax
call fcn.00481e4d
pop ecx
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
fstp qword [ebp - 0x20]
call fcn.00419588
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], bl
lea ecx, [ecx - 0x10]
call fcn.00401dbc
lea eax, [ebp - 0x18]
push eax
push edi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.004171f3
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ebx
mov byte [ebp - 4], 2
jne 0x4191a5
lea ecx, [eax - 0x10]
call fcn.00401dbc
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401dbc
mov eax, esi
call fcn.0045d770
ret
Function at 0x420afb
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
test esi, esi
je 0x420b0b
mov dword [esi], edi
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x420b51
push edi
lea ecx, [ebp + 0x14]
push ecx
mov ecx, 0x8000
cmp eax, ecx
cmovae eax, ecx
push eax
push dword [ebp + 0xc]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
add dword [ecx + 0x10], edx
adc dword [ecx + 0x14], edi
test esi, esi
je 0x420b46
add dword [esi], edx
test eax, eax
jne 0x420b51
call fcn.0042058d
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x428f75
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x496be9
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x4c2498]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0042c83d
lea ecx, [esi + 0x30]
call fcn.00428f1b
push dword [esi + 0x24]
call fcn.0045d8af
pop ecx
lea ecx, [esi + 0xc]
call fcn.00424204
mov ecx, esi
call fcn.00428e32
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42ed31
Capabilities:
Create directory

Disassembly:
push 0x38
mov eax, 0x495f8e
call fcn.0045d7a7
xor ebx, ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x42ed51
mov al, 1
jmp 0x42ed99
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x42ed62
xor al, al
jmp 0x42ed99
lea ecx, [ebp - 0x44]
call fcn.0042efa4
lea ecx, [ebp - 0x1c]
call fcn.0042cd0a
push ebx
push dword [ebp + 8]
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], ebx
call fcn.0042f18d
test al, al
je 0x42ed8e
mov ebx, dword [ebp - 0x24]
shr ebx, 4
and bl, 1
push dword [ebp - 0x1c]
call fcn.0045d8af
pop ecx
mov al, bl
call fcn.0045d770
ret

Function at 0x42eeff
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x42f74f
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
pop ebp
ret

Function at 0x42f852
Capabilities:
Get disk information

Disassembly:
push 0x20
mov eax, 0x49602f
call fcn.0045d7a7
mov ecx, dword [ebp + 8]
call fcn.0042494e
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
jne 0x42f880
xor al, al
jmp 0x42f920
push edi
lea ecx, [ebp - 0x1c]
call fcn.0042ef39
mov esi, dword [ebp - 0x1c]
push esi
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
test edi, edi
je 0x42f917
cmp edi, dword [ebp - 0x18]
ja 0x42f917
lea ecx, [ebp - 0x2c]
call fcn.0042cd0a
mov byte [ebp - 4], 1
mov edx, ebx
mov dword [ebp - 0x18], edx
mov eax, ebx
mov dword [ebp - 0x10], eax
test edi, edi
je 0x42f909
push 2
pop ecx
mov dword [ebp - 0x14], ecx
cmp word [esi + ecx - 2], bx
jne 0x42f8f8
lea eax, [edx + esi]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0042ce09
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
inc eax
mov dword [ebp - 0x18], eax
call fcn.00428bbc
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
call fcn.004244f9
mov ecx, dword [ebp - 0x14]
mov edx, ecx
mov eax, dword [ebp - 0x10]
inc eax
add ecx, 2
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
cmp eax, edi
jb 0x42f8c2
mov edx, dword [ebp - 0x18]
push dword [ebp - 0x2c]
cmp edx, edi
sete bl
call fcn.0045d8af
pop ecx
push esi
call fcn.0045d8af
pop ecx
mov al, bl
call fcn.0045d770
ret
Function at 0x42faad
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42fad7
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x42fad7
xor al, al
jmp 0x42faeb
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x430486
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4c2498]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [edi]
and dword [edi + 4], 0
mov word [eax], cx
xor eax, eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
mov ecx, edi
lea eax, [ebp - 0x210]
push eax
call fcn.0042ce09
lea eax, [esi - 1]
mov ecx, 0x103
cmp ecx, eax
mov ecx, dword [ebp - 4]
pop edi
sbb eax, eax
xor ecx, ebp
inc eax
pop esi
call fcn.0045d75f
mov esp, ebp
pop ebp
ret

Function at 0x430fb2
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x4c2498]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push str.GlobalMemoryStatusEx
push str.kernel32.dll
mov dword [ebp - 0x64], 0x40
and dword [esi + 4], 0
mov dword [esi], SysReAllocString
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x431015
lea ecx, [ebp - 0x64]
push ecx
call eax
test eax, eax
je 0x431015
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call fcn.00430f35
add esp, 0x10
mov dword [esi + 4], edx
jmp 0x431034
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x20
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xc], eax
cmovb eax, dword [ebp - 0xc]
and dword [esi + 4], 0
mov ecx, dword [ebp - 4]
mov dword [esi], eax
xor ecx, ebp
mov al, 1
pop esi
call fcn.0045d75f
mov esp, ebp
pop ebp
ret
Function at 0x43191e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
mov edx, dword [edx]
and edx, 7
cmp eax, 5
jae 0x43193b
xor eax, eax
jmp 0x431a58
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [eax - 4]
add ecx, ebx
push esi
mov dword [ebp + 0xc], ecx
lea esi, [edi + ebx]
jmp 0x431956
mov al, byte [esi]
and al, 0xfe
cmp al, 0xe8
je 0x43195a
inc esi
cmp esi, ecx
jb 0x43194d
mov ecx, esi
sub ecx, edi
mov edi, esi
sub ecx, ebx
sub edi, ebx
cmp esi, dword [ebp + 0xc]
jae 0x431a45
cmp ecx, 2
jbe 0x4319b0
xor edx, edx
movzx ebx, byte [esi + 4]
lea eax, [ebx + 1]
test al, 0xfe
jne 0x431a36
movzx eax, byte [esi + 3]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 2]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
mov eax, dword [ebp + 0x10]
add eax, 5
add eax, edi
cmp dword [ebp + 0x18], 0
je 0x4319dc
add ebx, eax
jmp 0x4319de
shr edx, cl
test edx, edx
je 0x431974
cmp edx, 4
ja 0x4319ce
cmp edx, 3
je 0x4319ce
mov eax, edx
shr eax, 1
movzx eax, byte [eax + esi + 1]
inc eax
test al, 0xfe
jne 0x431974
or edx, 8
shr edx, 1
inc edi
mov ecx, dword [ebp + 0xc]
jmp 0x431948
sub ebx, eax
test edx, edx
je 0x431a13
and edx, 6
mov eax, ebx
shl edx, 2
mov ecx, edx
shr eax, cl
inc eax
test al, 0xfe
jne 0x431a11
mov eax, 0x100
shl eax, cl
dec eax
xor ebx, eax
mov eax, dword [ebp + 0x10]
add eax, 5
add eax, edi
cmp dword [ebp + 0x18], 0
je 0x431a0f
add ebx, eax
jmp 0x431a11
sub ebx, eax
xor edx, edx
mov eax, ebx
mov byte [esi + 1], bl
shr eax, 8
mov byte [esi + 2], al
mov eax, ebx
shr ebx, 0x18
shr eax, 0x10
and bl, 1
neg bl
mov byte [esi + 3], al
push 5
mov byte [esi + 4], bl
pop eax
jmp 0x431a3e
or edx, 8
xor eax, eax
shr edx, 1
inc eax
mov ebx, dword [ebp + 8]
add edi, eax
jmp 0x4319d4
xor eax, eax
shr edx, cl
cmp ecx, 2
pop esi
cmova edx, eax
mov eax, dword [ebp + 0x14]
pop ebx
mov dword [eax], edx
mov eax, edi
pop edi
pop ebp
ret
Function at 0x434fe4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
xor eax, eax
push ebx
push esi
mov esi, dword [ebp + 8]
inc eax
push edi
push 0x20
pop ecx
or dword [esi + 0x90], 0xffffffff
or dword [esi + 0x94], 0xffffffff
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
mov eax, dword [esi + 4]
cmp eax, ecx
mov dword [esi + 0x78], edx
cmova eax, ecx
mov dword [esi + 0x7c], edx
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov dword [esi + 0x34], edx
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], edx
mov dword [esi + 0x40], edx
mov dword [esi + 0x70], edx
mov dword [esi + 0x88], edx
mov dword [esi + 0x68], edx
mov dword [esi + 0x6c], edx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], edx
mov dword [esi + 0x50], edx
mov dword [esi + 0x60], edx
mov dword [esi + 0x64], edx
mov dword [esi + 0x80], edx
mov dword [esi + 0x84], edx
mov dword [esi + 0x58], edx
cmp eax, dword [esi + 0x20]
je 0x435091
lea edi, [esi + 0xc8]
mov ebx, ecx
cmp dword [edi + 8], edx
je 0x435070
push edi
call fcn.00434fb9
pop ecx
xor edx, edx
add edi, 0x28
sub ebx, 1
jne 0x435062
cmp dword [esi + 0x5c], ebx
je 0x43508c
mov eax, dword [esi + 0x14]
push dword [esi + 0x5c]
push eax
call dword [eax + 4]
and dword [esi + 0x5c], ebx
pop ecx
pop ecx
mov eax, dword [esi]
mov dword [esi + 0x20], eax
push dword [esi + 0x10]
lea eax, [esi + 0x98]
push eax
call fcn.004354a8
mov ecx, dword [esi + 0x58]
and dword [esi + 0x24], 0
and dword [esi + 0x28], 0
lea eax, [ecx + 5]
imul ebx, eax, 0x28
lea eax, [ecx + 1]
mov dword [esi + 0x58], eax
add ebx, esi
push ebx
call fcn.00434f7b
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x435113
lea eax, [ebx + 0x20]
push eax
call fcn.00435f78
mov edi, eax
pop ecx
test edi, edi
jne 0x435113
lea eax, [ebx + 0x1c]
push eax
call fcn.00435f78
mov edi, eax
pop ecx
test edi, edi
jne 0x435113
push ebx
call fcn.00435e68
mov edi, eax
test edi, edi
je 0x435113
and dword [esi + 0x44], 0
lea ebx, [esi + 0xc8]
push 0x20
pop esi
push ebx
call fcn.00434ef4
add ebx, 0x28
pop ecx
sub esi, 1
jne 0x435101
mov esi, dword [ebp + 8]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
test eax, eax
je 0x435127
mov dword [esi + 0x40], eax
xor edx, edx
cmp dword [esi + 0x38], edx
jne 0x43513b
cmp dword [esi + 0x40], edx
jne 0x43513b
cmp dword [esi + 0x3c], edx
jne 0x43513b
mov dword [esi + 0x44], edx
xor ecx, ecx
cmp dword [esi + 0x44], edx
pop edi
pop esi
cmovne eax, ecx
pop ebx
pop ebp
ret

Function at 0x436067
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push esi
call fcn.004826cd
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
jne 0x436093
call fcn.00435f94
mov esi, eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4360bc
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 4
mov eax, 0x49643d
call fcn.0045d7a7
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.00401616
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x436139
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x436139
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x436139
lea eax, [ebp - 0x10]
push eax
call fcn.00436230
mov eax, dword [ebp - 0x10]
pop ecx
cmp dword [eax - 0xc], esi
je 0x43613c
push eax
call fcn.004360bc
pop ecx
test eax, eax
je 0x43613c
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x436139
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x43613c
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401dbc
mov eax, esi
call fcn.0045d770
ret

Function at 0x436212
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43622c
test al, 0x10
je 0x43622c
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x43667f
Capabilities:
Check if file exists
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x4c2498]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x41c]
push edi
mov edi, 0x20a
xor ebx, ebx
push edi
push ebx
push eax
mov dword [ebp - 0x62c], ebx
call fcn.004752c0
push edi
lea eax, [ebp - 0x210]
push ebx
push eax
call fcn.004752c0
add esp, 0x18
lea eax, [ebp - 0x210]
mov edi, 0x104
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.data_setting.ini
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
push edi
lea eax, [ebp - 0x41c]
mov edi, 0x49a86c
push eax
push edi
push str.temp_path
push str.common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jle 0x436747
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x436747
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x41c]
push eax
jmp 0x43676e
xor eax, eax
mov word [ebp - 0x628], ax
lea eax, [ebp - 0x628]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
lea ecx, [ebp - 0x628]
cmovle ecx, edi
push ecx
mov ecx, esi
call fcn.004026cf
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045d75f
mov esp, ebp
pop ebp
ret
Function at 0x43b7b1
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4c2498]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.004752c0
add esp, 0xc
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x120]
push eax
call esi
test eax, eax
jne 0x43b812
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x114
push eax
call esi
test eax, eax
je 0x43b8b9
mov eax, dword [ebp - 0x110]
sub eax, 1
je 0x43b8a4
sub eax, 1
jne 0x43b8b9
cmp dword [ebp - 0x11c], 6
jne 0x43b86e
mov eax, dword [ebp - 0x118]
cmp eax, 1
jne 0x43b84b
xor ebx, ebx
cmp byte [ebp - 6], al
setne bl
add ebx, 8
jmp 0x43b8b9
test eax, eax
jne 0x43b85e
cmp byte [ebp - 6], 1
push 9
pop ebx
push 7
pop eax
cmove ebx, eax
jmp 0x43b8b9
cmp eax, 2
jne 0x43b8b9
cmp byte [ebp - 6], 1
jne 0x43b8b9
push 0xa
pop ebx
jmp 0x43b8b9
cmp dword [ebp - 0x11c], 5
jne 0x43b897
mov eax, dword [ebp - 0x118]
cmp eax, 2
jne 0x43b886
push 5
jmp 0x43b86b
cmp eax, 1
jne 0x43b88f
push 6
jmp 0x43b86b
test eax, eax
jne 0x43b8b9
push 3
jmp 0x43b86b
cmp dword [ebp - 0x11c], 4
ja 0x43b8b9
push 4
jmp 0x43b86b
mov eax, dword [ebp - 0x114]
and eax, 0xffff0000
cmp eax, 0x45a0000
sbb ebx, ebx
add ebx, 2
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.0045d75f
mov esp, ebp
pop ebp
ret

Function at 0x43c3d8
Capabilities:
Read .ini file

Disassembly:
push 0x214
mov eax, 0x496479
call fcn.0045d7db
mov edi, ecx
mov eax, dword [edi + 4]
test eax, eax
jne 0x43c4ff
push 3
push dword [edi + 0x60]
lea eax, [ebp - 0x110]
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], eax
call fcn.00402a4a
and dword [ebp - 4], 0
lea eax, [edi + 0x4c]
push 0x4a0028
push eax
push dword [ebp - 0x114]
push dword [edi + 8]
call fcn.0043b1e6
or dword [ebp - 4], 0xffffffff
add esp, 0x10
mov dword [edi + 4], eax
lea eax, [ebp - 0x110]
cmp dword [ebp - 0x114], eax
je 0x43c44f
push dword [ebp - 0x114]
call fcn.0047a44b
pop ecx
mov eax, dword [edi + 0x64]
cmp dword [eax - 0xc], 0
je 0x43c4fc
lea eax, [ebp - 0x220]
push 0x400000
push eax
call fcn.0043614f
push str.data_skin_skincfg.ini
push eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 1
push eax
call fcn.00403466
add esp, 0x14
mov esi, eax
push 3
push dword [edi + 0x64]
lea eax, [ebp - 0x214]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x218], eax
call fcn.00402a4a
push dword [esi]
push 0xff
push dword [ebp - 0x218]
push str.alpha
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [edi + 0x30], eax
lea eax, [ebp - 0x214]
cmp dword [ebp - 0x218], eax
je 0x43c4e0
push dword [ebp - 0x218]
call fcn.0047a44b
pop ecx
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.00401dbc
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.00401dbc
xor eax, eax
inc eax
call fcn.0045d785
ret