joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e178
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call sub.WSOCK32.dll_gethostname
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40e1b1
xor ebx, ebx
call sub.WSOCK32.dll_WSAGetLastError
sub ebx, eax
mov eax, ebx
jmp 0x40e1d8
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
test eax, eax
jne 0x40e1ce
mov eax, 0xfffffff4
jmp 0x40e1d8
mov eax, 1
jmp 0x40e1d8
pop edi
pop esi
pop ebx
leave
ret

Function at 0x413988
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
push esi
push edi
cmp dword [ebp + 0x14], 0x40
jle 0x4139ea
lea eax, [ebp - 0x14c]
push eax
call fcn.00413b35
add esp, 4
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.00413b82
add esp, 0xc
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0xf4]
push eax
call fcn.00413c81
add esp, 8
lea eax, [ebp - 0xf4]
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x14], 0x10
push 0x41
push 0
lea eax, [ebp - 0x9c]
push eax
call fcn.00414aba
add esp, 0xc
push 0x41
push 0
lea eax, [ebp - 0xe0]
push eax
call fcn.00414aba
add esp, 0xc
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x9c]
push eax
call fcn.00414a75
add esp, 0xc
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0xe0]
push eax
call fcn.00414a75
add esp, 0xc
mov dword [ebp - 0xe4], 0
jmp 0x413a53
inc dword [ebp - 0xe4]
cmp dword [ebp - 0xe4], 0x40
jge 0x413aa3
mov eax, dword [ebp - 0xe4]
xor ecx, ecx
mov cl, byte [ebp + eax - 0x9c]
xor cl, 0x36
mov eax, dword [ebp - 0xe4]
mov byte [ebp + eax - 0x9c], cl
mov eax, dword [ebp - 0xe4]
xor ecx, ecx
mov cl, byte [ebp + eax - 0xe0]
xor cl, 0x5c
mov eax, dword [ebp - 0xe4]
mov byte [ebp + eax - 0xe0], cl
jmp 0x413a4d
lea eax, [ebp - 0x58]
push eax
call fcn.00413b35
add esp, 4
push 0x40
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00413b82
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00413b82
add esp, 0xc
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp + 0x18]
push eax
call fcn.00413c81
add esp, 8
lea eax, [ebp - 0x58]
push eax
call fcn.00413b35
add esp, 4
push 0x40
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00413b82
add esp, 0xc
push 0x10
mov eax, dword [ebp + 0x18]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00413b82
add esp, 0xc
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp + 0x18]
push eax
call fcn.00413c81
add esp, 8
jmp 0x413b30
pop edi
pop esi
pop ebx
leave
ret
Function at 0x413b35
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
jmp 0x413b7d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x419150
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x114], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
cmp dword [0x5f6630], 1
jne 0x4191a7
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004197f0
add esp, 8
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
je 0x4191a7
mov eax, dword [ebp - 0x114]
jmp 0x41938e
push str.class.inf
push 0x5c
push 0x5c44f8
push 0x556b44
lea edx, [ebp - 0x110]
push edx
call fcn.00532706
add esp, 0x14
push 1
lea eax, [ebp - 0x110]
push eax
call fcn.004869a0
add esp, 8
push eax
lea ecx, [ebp - 0x110]
push ecx
call fcn.00532580
add esp, 8
push 1
push 0x556b4c
lea edx, [ebp - 0x110]
push edx
call fcn.00459360
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [0x5fdb24], 1
jne 0x419212
or eax, 0xffffffff
jmp 0x41938e
cmp dword [ebp - 8], 0
jne 0x41923b
push 0
push 0x556b50
lea eax, [ebp - 0x110]
push eax
call fcn.00459360
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [0x5c44f0], 0
cmp dword [0x5fdb24], 1
je 0x41924a
cmp dword [ebp - 8], 0
jne 0x419261
push str.ERROR:_Get_Class_Info_1:_Couldnt_find_Class_Info
push 0
call fcn.00436500
add esp, 8
or eax, 0xffffffff
jmp 0x41938e
mov ecx, dword [ebp - 8]
push ecx
call fcn.00455900
add esp, 4
mov dword [0x5c44f0], eax
push 0x127c
call fcn.005324a9
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x419361
mov dword [ebp - 0xc], 1
jmp 0x41929e
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [0x5c44f0]
jg 0x419347
cmp dword [ebp - 0x114], 0xffffffff
jne 0x419347
push 0x127c
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.005323e0
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
push 1
push 0x2bc
mov eax, dword [ebp - 4]
push eax
call fcn.0053367b
add esp, 0x10
mov ecx, dword [ebp - 4]
add ecx, 0x52
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.005327a0
add esp, 8
test eax, eax
jne 0x419342
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.0041aee0
add esp, 8
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.00419f70
add esp, 8
push 0x127c
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00533040
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0045cea0
add esp, 4
mov dword [ebp - 0x114], 1
jmp 0x419295
mov edx, dword [ebp - 8]
push edx
call fcn.00431d50
add esp, 4
mov eax, dword [ebp - 4]
push eax
call fcn.00532828
add esp, 4
jmp 0x419370
push str.ERROR:_Out_of_Memory_in_Get_Class_Info
push 0
call fcn.00436500
add esp, 8
cmp dword [ebp - 0x114], 0xffffffff
jne 0x419388
push str.ERROR:_Get_Class_Info_2:_Couldnt_find_Class_Info
push 0
call fcn.00436500
add esp, 8
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x41bed0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
push 0x55b2dc
mov eax, dword [ebp + 0xc]
push eax
call fcn.0042eaa0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41bfec
mov ecx, dword [ebp - 8]
push ecx
call fcn.004557e0
add esp, 4
mov dword [ebp - 4], eax
push 0
push 4
mov edx, dword [ebp - 8]
push edx
call fcn.00532940
add esp, 0xc
mov dword [ebp - 0xc], 0
jmp 0x41bf40
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 4]
jge 0x41bfd9
push 0xc8
push 0
lea edx, [ebp - 0xe0]
push edx
call fcn.005323e0
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
push 1
push 0xc8
lea ecx, [ebp - 0xe0]
push ecx
call fcn.0053367b
add esp, 0x10
movsx edx, word [ebp - 0xe0]
cmp edx, 1
jne 0x41bfd4
movsx eax, word [ebp - 0xde]
cmp eax, 0xf
jne 0x41bfd4
movsx ecx, word [ebp - 0xdc]
and ecx, 0x7f
mov dword [ebp - 0x10], ecx
push 0xc8
lea edx, [ebp - 0xe0]
push edx
mov eax, dword [ebp - 0x10]
sub eax, 1
imul eax, eax, 0xc8
add eax, dword [ebp + 8]
push eax
call fcn.00533040
add esp, 0xc
cmp dword [ebp - 0x10], 4
jne 0x41bfd4
mov dword [ebp - 0x14], 1
jmp 0x41bfd9
jmp 0x41bf37
mov ecx, dword [ebp - 8]
push ecx
call fcn.00431d50
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret

Function at 0x41c0a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov eax, 3
mov ecx, dword [ebp + 8]
mov word [ecx + 0x3a], ax
mov edx, 0xf
mov eax, dword [ebp + 8]
mov word [eax + 0x30], dx
push 0x55b2e0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0042eaa0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41c163
mov edx, dword [ebp - 8]
push edx
call fcn.004557e0
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00455880
add esp, 8
mov eax, dword [ebp - 4]
sub eax, 1
imul eax, eax, 0xc8
add eax, 4
mov dword [ebp - 0xc], eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00532940
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
push 1
push 0xc8
mov ecx, dword [ebp + 8]
push ecx
call fcn.005337fa
add esp, 0x10
mov edx, dword [ebp - 8]
push edx
call fcn.00431d50
add esp, 4
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x41dea0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0x55b6d8
mov eax, dword [ebp + 8]
push eax
call fcn.0042eaa0
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41df96
push 2
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00532940
add esp, 0xc
test eax, eax
je 0x41def9
mov edx, dword [ebp - 0xc]
push edx
call fcn.00431d50
add esp, 4
xor eax, eax
jmp 0x41df99
mov eax, dword [ebp - 0xc]
push eax
call fcn.00532b62
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x41df1e
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00431d50
add esp, 4
xor eax, eax
jmp 0x41df99
mov edx, dword [ebp - 0xc]
push edx
call fcn.005352ea
add esp, 4
push 0x14
call fcn.005324a9
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
add eax, 5
push eax
call fcn.005324a9
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41df65
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 1
mov eax, dword [ebp - 8]
push eax
call fcn.0053367b
add esp, 0x10
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov dword [edx], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00431d50
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x421c80
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x55c63c
push 0x5c5ed8
push 0x55c648
lea eax, [ebp - 0x208]
push eax
call fcn.00532706
add esp, 0x10
lea ecx, [ebp - 0x208]
push ecx
push 0xff
lea edx, [ebp - 0x108]
push edx
push 0x5c5ece
push str.email_SMTP
push 0x55c65c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 4], eax
movsx eax, byte [ebp - 0x108]
test eax, eax
je 0x421cfa
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00532580
add esp, 8
lea eax, [ebp - 0x208]
push eax
push 0xff
lea ecx, [ebp - 0x108]
push ecx
push 0x5c5ecf
push str.email_address
push 0x55c674
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 4], eax
movsx edx, byte [ebp - 0x108]
test edx, edx
je 0x421d43
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00532580
add esp, 8
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x427490
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 0
push 0xc8
push 0
lea eax, [ebp - 0xd0]
push eax
call fcn.005323e0
add esp, 0xc
or ecx, 0xffffffff
mov edx, dword [ebp + 0x1c]
mov word [edx], cx
mov eax, dword [ebp + 0x18]
mov dword [eax], 0xffffffff
cmp dword [ebp + 0xc], 0
je 0x427520
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xd4], ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00532b62
add esp, 4
mov dword [ebp - 0xd8], eax
jmp 0x427543
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x427543
push 1
push 0x55d72c
mov edx, dword [ebp + 8]
push edx
call fcn.00459360
add esp, 0xc
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
jne 0x427559
cmp dword [0x5f6630], 1
jne 0x4276fe
cmp dword [ebp + 0x10], 0xffffffff
je 0x42756a
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xe4], eax
jmp 0x42757f
mov ecx, dword [ebp - 0xd4]
push ecx
call fcn.004557e0
add esp, 4
mov dword [ebp - 0xe4], eax
mov edx, dword [ebp - 0xe4]
mov dword [ebp - 0xdc], edx
jmp 0x42759c
mov eax, dword [ebp - 0xdc]
sub eax, 1
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
jle 0x4276c5
cmp dword [0x5f6630], 1
jne 0x4275e3
cmp dword [0x5f663c], 0
je 0x4275c4
cmp dword [ebp - 0xd4], 0
jne 0x4275e3
lea ecx, [ebp - 0xd0]
push ecx
mov edx, dword [ebp - 0xdc]
sub edx, 1
push edx
mov eax, dword [ebp + 0x14]
push eax
call fcn.0044ce30
add esp, 0xc
jmp 0x427643
mov ecx, dword [ebp - 0xdc]
sub ecx, 1
imul ecx, ecx, 0xc8
add ecx, 4
mov dword [ebp - 0xe0], ecx
push 0
mov edx, dword [ebp - 0xe0]
push edx
mov eax, dword [ebp - 0xd4]
push eax
call fcn.00532940
add esp, 0xc
mov ecx, dword [ebp - 0xd4]
push ecx
push 1
push 0xc8
lea edx, [ebp - 0xd0]
push edx
call fcn.0053367b
add esp, 0x10
push 0
push 3
lea eax, [ebp - 0xd0]
push eax
call fcn.0041aba0
add esp, 0xc
lea ecx, [ebp - 0xd0]
push ecx
call fcn.00441ea0
add esp, 4
cmp eax, 1
jne 0x4276c0
lea edx, [ebp - 0xd0]
push edx
call fcn.00452540
add esp, 4
test eax, eax
jne 0x4276c0
movsx eax, word [ebp - 0xd0]
cmp eax, 0x7bc
jle 0x4276c0
movsx ecx, word [ebp - 0xd0]
cmp ecx, 0x7e4
jge 0x4276c0
movsx edx, word [ebp - 0xa0]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
movsx ecx, word [ebp - 0xd0]
sub ecx, 0x7bc
shl ecx, 9
movsx edx, word [ebp - 0xce]
shl edx, 5
add ecx, edx
movsx eax, word [ebp - 0xcc]
add ecx, eax
mov edx, dword [ebp + 0x1c]
mov word [edx], cx
jmp 0x4276c5
jmp 0x42758d
cmp dword [ebp + 0xc], 0
je 0x4276e5
push 0
mov eax, dword [ebp - 0xd8]
push eax
mov ecx, dword [ebp - 0xd4]
push ecx
call fcn.00532940
add esp, 0xc
jmp 0x4276fe
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
test eax, eax
je 0x4276fe
mov ecx, dword [ebp - 0xd4]
push ecx
call fcn.00431d50
add esp, 4
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x429360
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10c], 0
mov al, byte [0x5c6cb6]
mov byte [ebp - 0x108], al
push 0xfe
push 0
lea ecx, [ebp - 0x107]
push ecx
call fcn.005323e0
add esp, 0xc
mov byte [ebp - 0x108], 0
mov edx, dword [ebp + 8]
push edx
call fcn.00423310
add esp, 4
test eax, eax
jne 0x4293c0
mov eax, dword [ebp - 0x10c]
jmp 0x429483
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, dword [ebp + 8]
push eax
call fcn.00535914
add esp, 4
mov dword [ebp - 0x10c], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp dword [ebp - 0x10c], 0xffffffff
jne 0x429444
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x429444
mov edx, dword [ebp + 8]
push edx
push 0x55df9c
lea eax, [ebp - 0x108]
push eax
call fcn.00532706
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
push 0
call fcn.00436500
add esp, 8
push 0x80
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp + 8]
push eax
call fcn.00535914
add esp, 4
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xffffffff
jne 0x42947d
mov ecx, dword [ebp - 0x10c]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.ERROR:_Could_not_delete_the_file:__s___d_
lea eax, [ebp - 0x108]
push eax
call fcn.00532706
add esp, 0x10
lea ecx, [ebp - 0x108]
push ecx
push 1
call fcn.00436500
add esp, 8
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x429a50
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x920
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov al, byte [0x5c6cbb]
mov byte [ebp - 0x120], al
push 0xfe
push 0
lea ecx, [ebp - 0x11f]
push ecx
call fcn.005323e0
add esp, 0xc
mov dl, byte [0x5c6cbc]
mov byte [ebp - 0x1c], dl
xor eax, eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov word [ebp - 0xf], ax
mov byte [ebp - 0xd], al
mov cl, byte [0x5c6cbe]
mov byte [ebp - 0x920], cl
push 0x7ff
push 0
lea edx, [ebp - 0x91f]
push edx
call fcn.005323e0
add esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [0x5f6630], 1
jne 0x429af9
push 0x55e114
push 0x5c6cbf
push 0x55e134
push str.MSG_Message_FeatureNotActive
call fcn.00422b80
add esp, 0x10
jmp 0x429c51
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004281d0
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
push 0x5c
mov eax, dword [ebp + 8]
add eax, 0x52
push eax
push 0x5c
lea ecx, [ebp - 0x1c]
push ecx
push 0x5c44f8
push 0x55e164
lea edx, [ebp - 0x120]
push edx
call fcn.00532706
add esp, 0x20
push 0x55e17c
lea eax, [ebp - 0x120]
push eax
call fcn.0042eaa0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x429b8f
mov ecx, dword [ebp - 4]
push ecx
push 1
push 1
lea edx, [ebp - 0x920]
push edx
call fcn.0053367b
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
push 1
push 0x7d0
lea ecx, [ebp - 0x920]
push ecx
call fcn.0053367b
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.00431d50
add esp, 4
push 0x55e180
push 0
push 2
lea eax, [ebp - 0x920]
push eax
push 0x5c6cc0
push 0x55e198
push 0x55e1ac
mov ecx, dword [ebp + 0xc]
add ecx, 9
push ecx
call fcn.004250a0
add esp, 0x20
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jne 0x429c51
lea edx, [ebp - 0x920]
push edx
call fcn.00532e80
add esp, 4
test eax, eax
jne 0x429bee
lea eax, [ebp - 0x120]
push eax
call fcn.00429360
add esp, 4
jmp 0x429c51
push 0x55e1bc
lea ecx, [ebp - 0x120]
push ecx
call fcn.0042eaa0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x429c51
mov edx, dword [ebp - 4]
push edx
push 1
push 1
push 0x55e1c0
call fcn.005337fa
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
push 1
lea ecx, [ebp - 0x920]
push ecx
call fcn.00532e80
add esp, 4
push eax
lea edx, [ebp - 0x920]
push edx
call fcn.005337fa
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call fcn.00431d50
add esp, 4
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x42bb20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x5c6ce0]
mov byte [ebp - 0x108], al
push 0xfe
push 0
lea ecx, [ebp - 0x107]
push ecx
call fcn.005323e0
add esp, 0xc
cmp dword [0x5fdb24], 0
je 0x42bb62
jmp 0x42bcc6
push 0x55e3c0
push 0x11024c0
call fcn.00532680
add esp, 8
test eax, eax
jne 0x42bba4
push 0x55e3c8
push 0x11024c0
call fcn.00532680
add esp, 8
test eax, eax
jne 0x42bba4
push 0x55e3d4
push 0x11024c0
call fcn.00532680
add esp, 8
test eax, eax
je 0x42bba9
jmp 0x42bcc6
cmp dword [0x55c718], 1
jne 0x42bcc6
push 0x55e3ec
mov edx, dword [ebp + 8]
push edx
call fcn.0042eaa0
add esp, 8
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x42bcc6
mov eax, dword [ebp - 0x10c]
push eax
push 1
push 0xc
lea ecx, [ebp - 0x108]
push ecx
call fcn.0053367b
add esp, 0x10
mov edx, dword [ebp - 0x10c]
push edx
call fcn.00431d50
add esp, 4
lea eax, [ebp - 0x108]
push eax
call fcn.0053aa0e
add esp, 4
push 0xc
push 0x55e3f0
lea ecx, [ebp - 0x108]
push ecx
call fcn.00532db5
add esp, 0xc
test eax, eax
je 0x42bc60
push 6
push 0x55e400
lea edx, [ebp - 0x108]
push edx
call fcn.00532db5
add esp, 0xc
test eax, eax
je 0x42bc60
push 5
push str.__xml
lea eax, [ebp - 0x108]
push eax
call fcn.00532db5
add esp, 0xc
test eax, eax
jne 0x42bcc6
push 0x55e410
push 0x11024c0
call fcn.00532680
add esp, 8
test eax, eax
je 0x42bc8c
push 0x11024c0
call fcn.004894f0
add esp, 4
mov byte [0x11024c0], 0
jmp 0x42bcc6
mov ecx, dword [ebp + 8]
push ecx
push str._s.HTML
lea edx, [ebp - 0x108]
push edx
call fcn.00532706
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00488210
add esp, 8
lea edx, [ebp - 0x108]
push edx
call fcn.004894f0
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x4306e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x5c6f47]
mov byte [ebp - 0x108], al
push 0xfe
push 0
lea ecx, [ebp - 0x107]
push ecx
call fcn.005323e0
add esp, 0xc
movsx edx, byte [0x5c61d8]
test edx, edx
je 0x430729
mov eax, 0x5c61d8
jmp 0x4308df
cmp dword [0x5c6c08], 0
jne 0x430808
mov al, byte [0x5c6f48]
mov byte [ebp - 0x310], al
push 0xfe
push 0
lea ecx, [ebp - 0x30f]
push ecx
call fcn.005323e0
add esp, 0xc
mov dl, byte [0x5c6f49]
mov byte [ebp - 0x210], dl
push 0xfe
push 0
lea eax, [ebp - 0x20f]
push eax
call fcn.005323e0
add esp, 0xc
mov dword [ebp - 0x10c], 0
push 0x55efe4
push 0x5fd3d0
push 0x55eff0
lea ecx, [ebp - 0x310]
push ecx
call fcn.00532706
add esp, 0x10
lea edx, [ebp - 0x310]
push edx
push 0xff
lea eax, [ebp - 0x210]
push eax
push 0x5c6f4a
push 0x55eff8
push 0x55f004
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x4307ec
lea ecx, [ebp - 0x210]
push ecx
call fcn.00535089
add esp, 4
mov dword [0x5c6c08], eax
cmp dword [0x5c6c08], 1
jl 0x4307fe
cmp dword [0x5c6c08], 0x64
jle 0x430808
mov dword [0x5c6c08], 1
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
test eax, eax
jne 0x430826
push 0x5fd3d0
push 0x5c61d8
call fcn.00532580
add esp, 8
jmp 0x430844
mov ecx, dword [ebp + 8]
push ecx
push 0x5c61d8
call fcn.00532580
add esp, 8
push 0x5c61d8
call fcn.00433f40
add esp, 4
push 0x5c61d8
call fcn.004299d0
add esp, 4
push str.data_i
push 0x5c61d8
call fcn.00532590
add esp, 8
mov edx, dword [0x5c6c08]
push edx
push 0x5c61d8
push str._s__03d
lea eax, [ebp - 0x108]
push eax
call fcn.00532706
add esp, 0x10
lea ecx, [ebp - 0x108]
push ecx
call fcn.00423110
add esp, 4
test eax, eax
jne 0x4308c6
push 0x5c61d8
call fcn.00423110
add esp, 4
test eax, eax
je 0x4308c6
lea edx, [ebp - 0x108]
push edx
push 0x5c61d8
call fcn.00488210
add esp, 8
test eax, eax
jne 0x4308c6
mov eax, 0x5c61d8
jmp 0x4308df
lea eax, [ebp - 0x108]
push eax
push 0x5c61d8
call fcn.00532580
add esp, 8
mov eax, 0x5c61d8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x438560
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0x10325476
pop ebp
ret