joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c18f
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x11c], 6
mov dword [ebp - 0x118], 6
mov dword [ebp - 0x114], 0x15
mov dword [ebp - 0x110], 0x44
mov dword [ebp - 0x10c], 0x44
mov dword [ebp - 0x108], 0x60
mov dword [ebp - 0x120], 0
jmp 0x41c1f5
mov eax, dword [ebp - 0x120]
add eax, 1
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 3
jge 0x41c2e3
push 0x104
push 0
lea ecx, [ebp - 0x104]
push ecx
call fcn.004adbd0
add esp, 0xc
mov edx, dword [ebp - 0x120]
add edx, 1
push edx
push 0x50e9bc
lea eax, [ebp - 0x104]
push eax
call fcn.004ae0dd
add esp, 0xc
mov ecx, dword [ebp - 0x124]
add ecx, 0x8f5
push ecx
mov edx, dword [ebp - 0x120]
mov eax, dword [ebp + edx*4 - 0x11c]
push eax
lea ecx, [ebp - 0x104]
push ecx
push 0x50e9cc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edx, dword [ebp - 0x120]
mov ecx, dword [ebp + 8]
mov dword [ecx + edx*4 + 0x5b], eax
push 0x104
push 0
lea edx, [ebp - 0x104]
push edx
call fcn.004adbd0
add esp, 0xc
mov eax, dword [ebp - 0x120]
add eax, 1
push eax
push 0x50e9d0
lea ecx, [ebp - 0x104]
push ecx
call fcn.004ae0dd
add esp, 0xc
mov edx, dword [ebp - 0x124]
add edx, 0x8f5
push edx
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp + eax*4 - 0x110]
push ecx
lea edx, [ebp - 0x104]
push edx
push 0x50e9e0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 0x120]
mov edx, dword [ebp + 8]
mov dword [edx + ecx*4 + 0x67], eax
jmp 0x41c1e6
mov esp, ebp
pop ebp
ret 4
Function at 0x41c2e9
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov dword [ebp - 0x104], ecx
mov eax, dword [ebp - 0x104]
add eax, 0x8f5
push eax
push 0
push 0x50e9e4
push 0x50e9ec
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp - 0x104]
add edx, 0x8f5
push edx
push 0
push 0x50e9f4
push 0x50ea04
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x104]
add edx, 0x8f5
push edx
push 0
push 0x50ea0c
push 0x50ea1c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x104]
add edx, 0x8f5
push edx
push 0
push 0x50ea24
push 0x50ea30
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x104]
add edx, 0x8f5
push edx
push 0
push 0x50ea38
push 0x50ea44
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 0x104]
add edx, 0x8f5
push edx
push 0
push 0x50ea4c
push 0x50ea58
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], eax
push 0x100
push 0
lea edx, [ebp - 0x100]
push edx
call fcn.004adbd0
add esp, 0xc
mov eax, dword [ebp - 0x104]
add eax, 0x8f5
push eax
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push 0
push 0x50ea60
push 0x50ea70
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x100]
push edx
mov ecx, dword [ebp + 8]
add ecx, 0x58
call fcn.004d23ea
mov esp, ebp
pop ebp
ret 4

Function at 0x4201e7
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0x50
push 0
mov eax, dword [ebp - 0xc]
add eax, 0x1080
push eax
call fcn.004adbd0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
add ecx, 0x8f5
push ecx
push 0x50
mov edx, dword [ebp - 0xc]
add edx, 0x1080
push edx
push 0x52d014
push 0x50fa44
push 0x50fa50
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [ebp - 0xc]
call fcn.004202a7
push 1
push 0
mov ecx, dword [ebp - 0xc]
call fcn.0042042d
mov ecx, dword [ebp - 0xc]
call fcn.004210ab
mov ecx, dword [ebp - 0xc]
call fcn.0042112c
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x1038], 0
je 0x420282
push 0x82d
mov ecx, dword [ebp - 0xc]
call fcn.004d14d4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x103c]
push edx
mov ecx, dword [ebp - 8]
call fcn.0040a310
push 0x818
mov ecx, dword [ebp - 0xc]
call fcn.004d14d4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
add eax, 0x1080
push eax
mov ecx, dword [ebp - 4]
call fcn.004d176b
mov esp, ebp
pop ebp
ret
Function at 0x4202a7
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e91ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x78
mov dword [ebp - 0x84], ecx
lea ecx, [ebp - 0x10]
call fcn.004048b0
mov dword [ebp - 4], 0
mov dword [ebp - 0x80], 0
mov eax, dword [ebp - 0x84]
add eax, 0x8f5
push eax
push 0
push 0x50fa58
push 0x50fa6c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 0x84]
mov dword [ecx + 0x10d8], eax
push 6
push 0
mov edx, dword [ebp - 0x84]
add edx, 0x10dc
push edx
call fcn.004adbd0
add esp, 0xc
push 0x64
push 0
lea eax, [ebp - 0x7c]
push eax
call fcn.004adbd0
add esp, 0xc
mov ecx, dword [ebp - 0x84]
add ecx, 0x8f5
push ecx
push 0x64
lea edx, [ebp - 0x7c]
push edx
push 0x52d018
push 0x50fa74
push 0x50fa84
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
movsx eax, byte [ebp - 0x7c]
test eax, eax
jne 0x420375
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004d2261
jmp 0x42041f
push 0x50fa8c
lea ecx, [ebp - 0x7c]
push ecx
call fcn.004ae8b6
add esp, 8
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
push 0x50fa90
lea eax, [ebp - 0x10]
push eax
call fcn.004c7e32
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.0040ad70
test eax, eax
jne 0x420410
lea ecx, [ebp - 0x18]
push ecx
push 0x50fa94
lea ecx, [ebp - 0x10]
call fcn.004048d0
push eax
call fcn.004aeb4b
add esp, 0xc
mov edx, dword [ebp - 0x84]
add edx, dword [ebp - 0x80]
mov al, byte [ebp - 0x18]
mov byte [edx + 0x10dc], al
mov ecx, dword [ebp - 0x80]
add ecx, 1
mov dword [ebp - 0x80], ecx
cmp dword [ebp - 0x80], 6
jne 0x4203e7
jmp 0x420410
push 0x50fa98
push 0
call fcn.004ae8b6
add esp, 8
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
push 0x50fa9c
lea eax, [ebp - 0x10]
push eax
call fcn.004c7e32
add esp, 0xc
jmp 0x42039e
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004d2261
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4252b4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x15
push 0
mov eax, dword [ebp - 8]
add eax, 0x5c
push eax
call fcn.004adbd0
add esp, 0xc
cmp dword [0x52dcc4], 0
je 0x4252fe
mov ecx, dword [ebp - 8]
add ecx, 0x8f5
push ecx
push 0x15
mov edx, dword [ebp - 8]
add edx, 0x5c
push edx
push 0
push 0x510564
push 0x51056c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [ebp - 8]
movsx ecx, byte [eax + 0x5c]
test ecx, ecx
jne 0x42532e
mov edx, dword [ebp - 8]
add edx, 0x8f5
push edx
push 0x15
mov eax, dword [ebp - 8]
add eax, 0x5c
push eax
push 0
push 0x510574
push 0x51057c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x569
mov ecx, dword [ebp - 8]
call fcn.004d14d4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, 0x5c
push ecx
mov ecx, dword [ebp - 4]
call fcn.004d176b
mov esp, ebp
pop ebp
ret
Function at 0x42c749
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov dword [ebp - 0x54], ecx
mov word [ebp - 0x28], 0x64
mov word [ebp - 0x26], 0xc8
mov word [ebp - 0x24], 0x32
mov word [ebp - 0x22], 0x7d
mov word [ebp - 0x20], 0x89
mov word [ebp - 0x1e], 0x96
mov word [ebp - 0x1c], 0xa2
mov word [ebp - 0x1a], 0xaf
mov word [ebp - 0x18], 0xbb
mov word [ebp - 0x16], 0x19
mov word [ebp - 0x14], 0x25
mov word [ebp - 0x12], 0x3e
mov word [ebp - 0x10], 0x4b
mov word [ebp - 0xe], 0x51
mov word [ebp - 0xc], 0x57
mov word [ebp - 0xa], 0xc1
mov word [ebp - 8], 0x38
mov word [ebp - 6], 0x44
mov word [ebp - 4], 0x5d
mov word [ebp - 0x50], 0xa0
mov word [ebp - 0x4e], 0x20
mov word [ebp - 0x4c], 0x120
mov word [ebp - 0x4a], 0xa8
mov word [ebp - 0x48], 0xac
mov word [ebp - 0x46], 0x18
mov word [ebp - 0x44], 0x1a
mov word [ebp - 0x42], 0x1c
mov word [ebp - 0x40], 0x1e
mov word [ebp - 0x3e], 0x1a0
mov word [ebp - 0x3c], 0x118
mov word [ebp - 0x3a], 0x128
mov word [ebp - 0x38], 0x98
mov word [ebp - 0x36], 0x9a
mov word [ebp - 0x34], 0x9c
mov word [ebp - 0x32], 0x1f
mov word [ebp - 0x30], 0x124
mov word [ebp - 0x2e], 0x12c
mov word [ebp - 0x2c], 0x9e
cmp dword [0x52d208], 0
je 0x42c862
cmp dword [0x52d1d0], 0
je 0x42c862
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax + 0x11d08]
mov edx, dword [ebp - 0x54]
mov ax, word [ebp + ecx*2 - 0x50]
mov word [edx + 0x11d10], ax
jmp 0x42c87a
mov ecx, dword [ebp - 0x54]
mov edx, dword [ecx + 0x11d08]
mov eax, dword [ebp - 0x54]
mov cx, word [ebp + edx*2 - 0x28]
mov word [eax + 0x11d10], cx
mov esp, ebp
pop ebp
ret
Function at 0x42ccfb
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e9324
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x10]
call fcn.004048b0
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
push 0x10
push 0
mov eax, dword [ebp - 0x2c]
add eax, 0x119b5
push eax
call fcn.004adbd0
add esp, 0xc
mov ecx, dword [ebp - 0x2c]
add ecx, 0x11ac9
push ecx
push 0x104
mov edx, dword [ebp - 0x2c]
add edx, 0x119c5
push edx
push 0
push str.WWN16
push 0x5114bc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [ebp - 0x2c]
movsx ecx, byte [eax + 0x119c5]
test ecx, ecx
jne 0x42cdaf
push 0
push 0x5114c0
push str.Please_Check_the_WWN.ini_file_
mov ecx, dword [ebp - 0x2c]
call fcn.004cfc0e
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004d2261
mov eax, dword [ebp - 0x20]
jmp 0x42cea5
push 0x5114e8
mov edx, dword [ebp - 0x2c]
add edx, 0x119c5
push edx
call fcn.004ae8b6
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
push 0x5114ec
lea ecx, [ebp - 0x10]
push ecx
call fcn.004c7e32
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.0040ad70
test eax, eax
jne 0x42ce57
cmp dword [ebp - 0x1c], 0x10
jae 0x42ce1b
lea edx, [ebp - 0x18]
push edx
push 0x5114f0
lea ecx, [ebp - 0x10]
call fcn.004048d0
push eax
call fcn.004aeb4b
add esp, 0xc
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x1c]
mov cl, byte [ebp - 0x18]
mov byte [eax + 0x119b5], cl
jmp 0x42ce1d
jmp 0x42ce57
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
push 0x5114f4
push 0
call fcn.004ae8b6
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x42ce40
jmp 0x42ce57
mov eax, dword [ebp - 0x14]
push eax
push 0x5114f8
lea ecx, [ebp - 0x10]
push ecx
call fcn.004c7e32
add esp, 0xc
jmp 0x42cdde
cmp dword [ebp - 0x1c], 0x10
jae 0x42ce8c
push 0
push 0x5114fc
push str.Cant_find_enough_16_bytes_WWN__please_check_WWN.ini_content.
mov ecx, dword [ebp - 0x2c]
call fcn.004cfc0e
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004d2261
mov eax, dword [ebp - 0x24]
jmp 0x42cea5
mov dword [ebp - 0x28], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004d2261
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x42d4f2
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], 0
jmp 0x42d514
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x20
jge 0x42d564
push 0x14
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004adbd0
add esp, 0xc
mov edx, dword [ebp - 0x1c]
push edx
push 0x511544
lea eax, [ebp - 0x18]
push eax
call fcn.004ae0dd
add esp, 0xc
mov ecx, dword [ebp - 0x24]
add ecx, 0x8f5
push ecx
push 0
lea edx, [ebp - 0x18]
push edx
push 0x51154c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x1c]
mov byte [ecx], al
jmp 0x42d50b
mov dword [ebp - 0x1c], 0
jmp 0x42d576
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0x20
jge 0x42d5cb
mov dword [ebp - 0x20], 0
jmp 0x42d58e
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x20
jge 0x42d5c1
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x20]
jne 0x42d59e
jmp 0x42d585
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x1c]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x20]
xor edx, edx
mov dl, byte [ecx]
cmp eax, edx
jne 0x42d5bf
mov dword [ebp - 4], 0
jmp 0x42d5c1
jmp 0x42d585
cmp dword [ebp - 4], 0
jne 0x42d5c9
jmp 0x42d5cb
jmp 0x42d56d
cmp dword [ebp - 4], 0
jne 0x42d5f6
mov dword [ebp - 0x1c], 0
jmp 0x42d5e3
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x20
jge 0x42d5f6
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x1c]
mov dl, byte [ebp - 0x1c]
mov byte [ecx], dl
jmp 0x42d5da
mov esp, ebp
pop ebp
ret 4
Function at 0x43b308
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push str._SMIReadCIDTable
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x52d188], eax
cmp dword [0x52d188], 0
jne 0x43b357
mov ecx, 1
test ecx, ecx
je 0x43b33d
mov dword [ebp - 4], 0
jmp 0x43b34d
push str.Null_dll_SMIReadCIDTable_n
call fcn.004110a0
add esp, 4
mov dword [ebp - 4], eax
mov eax, 0x28
jmp 0x43b509
push str._SMIReadFlashID
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x52d184], eax
cmp dword [0x52d184], 0
jne 0x43b3a0
mov eax, 1
test eax, eax
je 0x43b386
mov dword [ebp - 8], 0
jmp 0x43b396
push str.Null_dll_SMIScanSMIDrive_n
call fcn.004110a0
add esp, 4
mov dword [ebp - 8], eax
mov eax, 4
jmp 0x43b509
push str._SMIReadVndrCmd
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x52d180], eax
cmp dword [0x52d180], 0
jne 0x43b3e9
mov edx, 1
test edx, edx
je 0x43b3cf
mov dword [ebp - 0xc], 0
jmp 0x43b3df
push str.Null_dll_SMIReadVndrCmd_n
call fcn.004110a0
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, 5
jmp 0x43b509
push str._SMIWriteVndrCmd
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x52d17c], eax
cmp dword [0x52d17c], 0
jne 0x43b432
mov ecx, 1
test ecx, ecx
je 0x43b418
mov dword [ebp - 0x10], 0
jmp 0x43b428
push str.Null_dll_SMIWriteVndrCmd_n
call fcn.004110a0
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, 6
jmp 0x43b509
push str._SMI_Read_Phy_Page
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x52d178], eax
cmp dword [0x52d178], 0
jne 0x43b47b
mov eax, 1
test eax, eax
je 0x43b461
mov dword [ebp - 0x14], 0
jmp 0x43b471
push str.Null_dll_SMI_Read_Phy_Page_n
call fcn.004110a0
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, 7
jmp 0x43b509
push str._SMI_Program_Phy_Page
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x52d174], eax
cmp dword [0x52d174], 0
jne 0x43b4c1
mov edx, 1
test edx, edx
je 0x43b4aa
mov dword [ebp - 0x18], 0
jmp 0x43b4ba
push str.Null_dll_SMI_Program_Phy_Page_n
call fcn.004110a0
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, 8
jmp 0x43b509
push str._SMI_Erase_Phy_block
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x52d170], eax
cmp dword [0x52d170], 0
jne 0x43b507
mov ecx, 1
test ecx, ecx
je 0x43b4f0
mov dword [ebp - 0x1c], 0
jmp 0x43b500
push str.Null_dll_SMI_Erase_Phy_block_n
call fcn.004110a0
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, 9
jmp 0x43b509
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x441f0c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e9683
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x228
mov dword [ebp - 0x22c], 0
lea ecx, [ebp - 0x14]
call fcn.004048b0
mov dword [ebp - 4], 0
mov dword [ebp - 0x224], 0
jmp 0x441f5e
mov eax, dword [ebp - 0x224]
add eax, 1
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0x18
jge 0x441f90
mov ecx, dword [ebp - 0x224]
mov dword [ecx*8 + 0x52e460], 0
mov edx, dword [ebp - 0x224]
add edx, 0x43
mov eax, dword [ebp - 0x224]
mov byte [eax*8 + 0x52e464], dl
jmp 0x441f4f
push 0x104
push 0
lea ecx, [ebp - 0x118]
push ecx
call fcn.004adbd0
add esp, 0xc
push 0x518434
lea edx, [ebp - 0x118]
push edx
call fcn.004ade30
add esp, 8
push 0x104
push 0
lea eax, [ebp - 0x220]
push eax
call fcn.004adbd0
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
push 0x104
lea edx, [ebp - 0x220]
push edx
push 0x52d250
push 0x518454
push 0x518458
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
movsx eax, byte [ebp - 0x220]
test eax, eax
jne 0x442027
mov dword [ebp - 0x230], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004d2261
mov eax, dword [ebp - 0x230]
jmp 0x442150
push 0x51845c
lea ecx, [ebp - 0x220]
push ecx
call fcn.004ae8b6
add esp, 8
mov dword [ebp - 0x11c], eax
mov edx, dword [ebp - 0x11c]
push edx
push 0x518460
lea eax, [ebp - 0x14]
push eax
call fcn.004c7e32
add esp, 0xc
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x14]
call fcn.0040ad70
test eax, eax
jne 0x442132
lea ecx, [ebp - 0x228]
push ecx
push 0x518464
lea ecx, [ebp - 0x14]
call fcn.004048d0
push eax
call fcn.004aeb4b
add esp, 0xc
mov dword [ebp - 0x224], 0
jmp 0x4420a8
mov edx, dword [ebp - 0x224]
add edx, 1
mov dword [ebp - 0x224], edx
cmp dword [ebp - 0x224], 0x18
jge 0x4420e6
movsx eax, byte [ebp - 0x228]
mov ecx, dword [ebp - 0x224]
movsx edx, byte [ecx*8 + 0x52e464]
cmp eax, edx
jne 0x4420e4
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x224]
mov dword [eax*8 + 0x52e460], 1
jmp 0x4420e6
jmp 0x442099
mov ecx, dword [ebp - 0x22c]
add ecx, 1
mov dword [ebp - 0x22c], ecx
push 0x518468
push 0
call fcn.004ae8b6
add esp, 8
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jne 0x442115
jmp 0x442132
mov edx, dword [ebp - 0x11c]
push edx
push 0x51846c
lea eax, [ebp - 0x14]
push eax
call fcn.004c7e32
add esp, 0xc
jmp 0x442060
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x234], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004d2261
mov eax, dword [ebp - 0x234]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x44c4d6
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov dword [0x52d324], 0
mov eax, dword [ebp - 4]
add eax, 0xf8
push eax
push 0
push str.ENABLECLEARSMARTFEATURE
push 0x51a308
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x52d324], eax
mov dword [0x52d320], 0
mov ecx, dword [ebp - 4]
add ecx, 0xf8
push ecx
push 0
push str.ResetSmartTool
push 0x51a324
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x52d320], eax
mov edx, dword [ebp - 4]
add edx, 0xf8
push edx
push 0
push str.ENABLEQCTOOLPAGE
push 0x51a344
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x52d1a8], eax
mov esp, ebp
pop ebp
ret

Function at 0x44c557
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0xf8
push eax
push 0
push str.ENTRANSCENDFEATURE
push 0x51a360
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x52dcc4], eax
mov ecx, dword [ebp - 4]
add ecx, 0xf8
push ecx
push 0
push str.ENABLEPNYMODE
push 0x51a378
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x52ded4], eax
mov edx, dword [ebp - 4]
add edx, 0xf8
push edx
push 0
push str.EnBarunMode
push 0x51a38c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x52d31c], eax
mov eax, dword [ebp - 4]
add eax, 0xf8
push eax
push 0
push str.EnKingstonMode
push 0x51a3a4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x52d1a4], eax
mov ecx, dword [ebp - 4]
add ecx, 0xf8
push ecx
push 0
push str.EnBadBlkTab
push 0x51a3b8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x52d318], eax
mov esp, ebp
pop ebp
ret
Function at 0x451967
Capabilities:
Create directory
Enumerate files on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e9b36
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x260
mov dword [ebp - 0x26c], ecx
lea ecx, [ebp - 0x14]
call fcn.004048b0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004048b0
mov byte [ebp - 4], 1
push 0x725
mov ecx, dword [ebp - 0x26c]
call fcn.004d14d4
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
call fcn.0040a3d0
push 0x104
push 0
lea eax, [ebp - 0x268]
push eax
call fcn.004adbd0
add esp, 0xc
mov ecx, dword [ebp - 0x26c]
add ecx, 0x5c
push ecx
lea edx, [ebp - 0x268]
push edx
call fcn.004ade30
add esp, 8
push 0x51afd4
lea eax, [ebp - 0x268]
push eax
call fcn.004ade40
add esp, 8
lea ecx, [ebp - 0x268]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x451a93
push 0
lea edx, [ebp - 0x268]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x451a73
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xb7
je 0x451a73
lea eax, [ebp - 0x268]
push eax
push 0x51afd8
lea ecx, [ebp - 0x10]
push ecx
call fcn.004c7e32
add esp, 0xc
push 0
push 0x51b01c
lea ecx, [ebp - 0x10]
call fcn.004048d0
push eax
mov ecx, dword [ebp - 0x26c]
call fcn.004cfc0e
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004d2261
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004d2261
jmp 0x451bbc
push 0x140
push 0
lea edx, [ebp - 0x158]
push edx
call fcn.004adbd0
add esp, 0xc
lea eax, [ebp - 0x158]
push eax
push str...ini
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0xffffffff
jne 0x451aea
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004d2261
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004d2261
jmp 0x451bbc
cmp dword [ebp - 0x15c], 0xffffffff
je 0x451b58
lea ecx, [ebp - 0x14]
call fcn.004d21ec
lea ecx, [ebp - 0x12c]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004d23ea
push 0x2e
lea ecx, [ebp - 0x14]
call fcn.004c7acf
mov dword [ebp - 0x164], eax
push 0
mov edx, dword [ebp - 0x164]
push edx
lea ecx, [ebp - 0x14]
call fcn.004c75a2
lea ecx, [ebp - 0x14]
call fcn.004048d0
push eax
mov ecx, dword [ebp - 0x18]
call fcn.0040a3a0
lea eax, [ebp - 0x158]
push eax
mov ecx, dword [ebp - 0x15c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x451b56
jmp 0x451b58
jmp 0x451aea
mov edx, dword [ebp - 0x15c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x104
push 0
mov eax, dword [ebp - 0x26c]
add eax, 0x674
push eax
call fcn.004adbd0
add esp, 0xc
mov ecx, dword [ebp - 0x26c]
add ecx, 0x674
push ecx
push 0
mov ecx, dword [ebp - 0x18]
call fcn.00413b50
push 0
mov ecx, dword [ebp - 0x18]
call fcn.0040a310
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004d2261
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004d2261
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret