joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448740
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x758
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x754], 0
mov al, byte [0x526bcb]
mov byte [ebp - 0x404], al
push 0x1ff
push 0
lea ecx, [ebp - 0x403]
push ecx
call fcn.004b6780
add esp, 0xc
mov dl, byte [0x526bcc]
mov byte [ebp - 0x604], dl
push 0x1ff
push 0
lea eax, [ebp - 0x603]
push eax
call fcn.004b6780
add esp, 0xc
mov cl, byte [0x526bcd]
mov byte [ebp - 0x204], cl
push 0x1ff
push 0
lea edx, [ebp - 0x203]
push edx
call fcn.004b6780
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x204]
push ecx
call fcn.004b5e60
add esp, 8
lea edx, [ebp - 0x204]
push edx
call fcn.004b5f60
add esp, 4
test eax, eax
jbe 0x44883d
lea eax, [ebp - 0x204]
push eax
call fcn.004b5f60
add esp, 4
movsx ecx, byte [ebp + eax - 0x205]
cmp ecx, 0x5c
jne 0x44883d
lea edx, [ebp - 0x204]
push edx
call fcn.004b5f60
add esp, 4
sub eax, 1
mov dword [ebp - 0x758], eax
cmp dword [ebp - 0x758], 0x200
jae 0x44882a
jmp 0x44882f
call fcn.004b64ae
mov eax, dword [ebp - 0x758]
mov byte [ebp + eax - 0x204], 0
lea ecx, [ebp - 0x204]
push ecx
push 0x4e4204
lea edx, [ebp - 0x604]
push edx
call fcn.004b6e08
add esp, 0xc
lea eax, [ebp - 0x744]
push eax
lea ecx, [ebp - 0x604]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x750], eax
cmp dword [ebp - 0x750], 0xffffffff
je 0x4489c1
mov edx, dword [ebp + 0xc]
lea eax, [ebp + edx - 0x205]
mov dword [ebp - 0x74c], eax
mov dword [ebp - 0x748], 0
mov ecx, dword [ebp - 0x74c]
movsx edx, byte [ecx]
test edx, edx
je 0x4488c5
mov eax, dword [ebp - 0x74c]
movsx ecx, byte [eax]
cmp ecx, 0x5c
je 0x4488c5
mov edx, dword [ebp - 0x74c]
sub edx, 1
mov dword [ebp - 0x74c], edx
jmp 0x448899
mov eax, dword [ebp - 0x74c]
add eax, 1
mov dword [ebp - 0x74c], eax
mov ecx, 1
imul ecx, ecx, 0
movsx edx, byte [ebp + ecx - 0x718]
cmp edx, 0x2e
jne 0x4488ee
jmp 0x44897b
mov eax, dword [ebp - 0x744]
and eax, 0x10
je 0x44896c
push str.profiles
lea ecx, [ebp - 0x718]
push ecx
call fcn.004b68e0
add esp, 8
test eax, eax
jne 0x448922
mov edx, dword [ebp - 0x748]
add edx, 1
mov dword [ebp - 0x748], edx
jmp 0x44897b
lea eax, [ebp - 0x718]
push eax
lea ecx, [ebp - 0x204]
push ecx
push 0x4e4218
lea edx, [ebp - 0x404]
push edx
call fcn.004b6e08
add esp, 0x10
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x404]
push ecx
call fcn.00448740
add esp, 8
test eax, eax
jne 0x44896a
mov edx, dword [ebp - 0x748]
add edx, 1
mov dword [ebp - 0x748], edx
jmp 0x44897b
mov eax, dword [ebp - 0x748]
add eax, 1
mov dword [ebp - 0x748], eax
lea ecx, [ebp - 0x744]
push ecx
mov edx, dword [ebp - 0x750]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4488d4
mov eax, dword [ebp - 0x750]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x748], 0
jne 0x4489c1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov dword [ebp - 0x754], 1
mov eax, dword [ebp - 0x754]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret
Function at 0x449660
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20c], 0
mov al, byte [0x526d02]
mov byte [ebp - 0x204], al
push 0xfe
push 0
lea ecx, [ebp - 0x203]
push ecx
call fcn.004b6780
add esp, 0xc
mov dl, byte [0x526d03]
mov byte [ebp - 0x104], dl
push 0xfe
push 0
lea eax, [ebp - 0x103]
push eax
call fcn.004b6780
add esp, 0xc
mov byte [ebp - 0x205], 0
cmp dword [0x54e958], 1
jne 0x4496ff
mov ecx, 1
imul ecx, ecx, 0
mov edx, dword [ebp + 8]
mov byte [edx + ecx], 0
mov eax, dword [ebp + 0xc]
push eax
push str.ADDC
call fcn.004498c0
add esp, 8
mov dword [ebp - 0x20c], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
jmp 0x449776
push 0x4e4548
push 0x4fcad8
push 0x4e4554
lea edx, [ebp - 0x104]
push edx
call fcn.004b6e08
add esp, 0x10
lea eax, [ebp - 0x104]
push eax
push 0xff
lea ecx, [ebp - 0x204]
push ecx
push 0x526d04
push 0x4e455c
push 0x4e4564
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x20c], eax
lea edx, [ebp - 0x205]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x204]
push ecx
call fcn.00449b50
add esp, 0xc
movsx edx, byte [ebp - 0x205]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret
Function at 0x44f1c0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e4
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1d4], 0
mov dword [ebp - 0x1dc], 0
mov dword [ebp - 0x1d8], 0
mov dword [ebp - 0x1e0], 0
mov dword [ebp - 0x1e4], 0
mov al, byte [0x526d44]
mov byte [ebp - 0x104], al
push 0xfe
push 0
lea ecx, [ebp - 0x103]
push ecx
call fcn.004b6780
add esp, 0xc
mov dword [ebp - 0x1d0], 0
push 0xc8
push 0
lea edx, [ebp - 0x1cc]
push edx
call fcn.004b6780
add esp, 0xc
push 1
push 0x4e4b34
mov eax, dword [ebp + 8]
push eax
call fcn.00419d20
add esp, 0xc
mov dword [ebp - 0x1d0], eax
cmp dword [0x54e900], 1
jne 0x44f26d
jmp 0x44f46b
cmp dword [ebp - 0x1d0], 0
jne 0x44f303
mov ecx, dword [ebp + 8]
push ecx
call fcn.004196c0
add esp, 4
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0
jne 0x44f2bf
push 1
push 0x4e4b38
mov edx, dword [ebp + 8]
push edx
call fcn.00419d20
add esp, 0xc
mov dword [ebp - 0x1d0], eax
push 0
mov eax, dword [ebp - 0x1d0]
push eax
call fcn.00462010
add esp, 8
cmp dword [ebp - 0x1d0], 0
jne 0x44f303
mov ecx, dword [ebp + 8]
push ecx
push str.Cant_read_file:__s
lea edx, [ebp - 0x104]
push edx
call fcn.004b6e08
add esp, 0xc
push 0x526d45
push 0x526d46
push 0x4e4b50
lea eax, [ebp - 0x104]
push eax
call fcn.00458fb0
add esp, 0x10
jmp 0x44f46b
mov ecx, dword [ebp - 0x1d0]
push ecx
call fcn.0045c650
add esp, 4
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 0x1d8], 1
jmp 0x44f333
mov edx, dword [ebp - 0x1d8]
add edx, 1
mov dword [ebp - 0x1d8], edx
mov eax, dword [ebp - 0x1d8]
cmp eax, dword [ebp - 0x1d4]
jg 0x44f38d
mov ecx, dword [ebp - 0x1d0]
push ecx
push 1
push 0xc8
lea edx, [ebp - 0x1cc]
push edx
call fcn.004b8e47
add esp, 0x10
push 0
push 1
lea eax, [ebp - 0x1cc]
push eax
call fcn.00411510
add esp, 0xc
movsx ecx, word [ebp - 0x1cc]
cmp ecx, 3
jne 0x44f38b
mov edx, dword [ebp - 0x1d8]
mov dword [ebp - 0x1dc], edx
jmp 0x44f38d
jmp 0x44f324
cmp dword [ebp - 0x1dc], 0
jne 0x44f3c7
mov eax, dword [ebp - 0x1d4]
add eax, 1
mov dword [ebp - 0x1d4], eax
mov ecx, dword [ebp - 0x1d4]
push ecx
mov edx, dword [ebp - 0x1d0]
push edx
call fcn.00462010
add esp, 8
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x1dc], eax
push 0xc8
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x1cc]
push edx
call fcn.004b8640
add esp, 0xc
mov eax, dword [ebp - 0x1dc]
sub eax, 1
imul eax, eax, 0xc8
add eax, 4
mov dword [ebp - 0x1e4], eax
push 0
mov ecx, dword [ebp - 0x1e4]
push ecx
mov edx, dword [ebp - 0x1d0]
push edx
call fcn.004b8f82
add esp, 0xc
push 0
push 3
lea eax, [ebp - 0x1cc]
push eax
call fcn.00411510
add esp, 0xc
mov ecx, dword [ebp - 0x1d0]
push ecx
push 1
push 0xc8
lea edx, [ebp - 0x1cc]
push edx
call fcn.004b9519
add esp, 0x10
push 0
push 3
lea eax, [ebp - 0x1cc]
push eax
call fcn.00411510
add esp, 0xc
mov ecx, dword [ebp - 0x1d0]
push ecx
call fcn.00419ca0
add esp, 4
mov dword [ebp - 0x1d0], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret
Function at 0x453710
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x54be3d]
mov byte [ebp - 0x210], al
push 0xfe
push 0
lea ecx, [ebp - 0x20f]
push ecx
call fcn.004b6780
add esp, 0xc
mov dl, byte [0x54be3e]
mov byte [ebp - 0x110], dl
push 0xfe
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.004b6780
add esp, 0xc
mov cl, byte [0x54be3f]
mov byte [ebp - 0x10], cl
xor edx, edx
mov dword [ebp - 0xf], edx
mov dword [ebp - 0xb], edx
mov byte [ebp - 7], dl
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 0
mov eax, 1
imul eax, eax, 0
mov ecx, dword [ebp + 0x10]
mov byte [ecx + eax], 0
mov edx, dword [ebp + 8]
push edx
push 0x4e5650
lea eax, [ebp - 0x10]
push eax
call fcn.004b6e08
add esp, 0xc
lea ecx, [ebp - 0x214]
push ecx
push 1
push 1
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x110]
push eax
push 0x4e5658
mov ecx, dword [ebp + 0xc]
push ecx
push 4
call fcn.00497900
add esp, 0x20
cmp dword [ebp - 0x214], 0
jne 0x4537e9
jmp 0x453866
push 3
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x110]
push eax
call fcn.004b6970
add esp, 0xc
test eax, eax
je 0x453804
jmp 0x453866
push str.DYNED.INI
push 0x5c
lea ecx, [ebp - 0x110]
push ecx
push 0x5c
mov edx, dword [ebp + 0xc]
push edx
push 0x4e56cc
lea eax, [ebp - 0x210]
push eax
call fcn.004b6e08
add esp, 0x1c
lea ecx, [ebp - 0x210]
push ecx
push 0xff
mov edx, dword [ebp + 0x10]
push edx
push 0x54be40
push str.course_name
push 0x4e56e4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, 1
imul eax, eax, 0
mov ecx, dword [ebp + 0x10]
movsx edx, byte [ecx + eax]
test edx, edx
je 0x453866
jmp 0x45389a
lea eax, [ebp - 0x214]
push eax
push 1
push 0
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x110]
push edx
push 0x4e56f0
mov eax, dword [ebp + 0xc]
push eax
push 4
call fcn.00497900
add esp, 0x20
test eax, eax
je 0x4537de
mov ecx, 1
imul ecx, ecx, 0
mov edx, dword [ebp + 0x10]
movsx eax, byte [edx + ecx]
test eax, eax
jne 0x4538bd
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.004538d0
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret
Function at 0x4571b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x408], 0
mov dword [ebp - 0x410], 0
mov dword [ebp - 0x40c], 0
mov dword [ebp - 0x414], 0
mov dword [ebp - 0x418], 0x4fcad8
mov al, byte [0x54be41]
mov byte [ebp - 0x204], al
push 0xfe
push 0
lea ecx, [ebp - 0x203]
push ecx
call fcn.004b6780
add esp, 0xc
mov dl, byte [0x54be42]
mov byte [ebp - 0x104], dl
push 0xfe
push 0
lea eax, [ebp - 0x103]
push eax
call fcn.004b6780
add esp, 0xc
mov cl, byte [0x54be43]
mov byte [ebp - 0x404], cl
push 0xfe
push 0
lea edx, [ebp - 0x403]
push edx
call fcn.004b6780
add esp, 0xc
mov al, byte [0x54be44]
mov byte [ebp - 0x304], al
push 0xfe
push 0
lea ecx, [ebp - 0x303]
push ecx
call fcn.004b6780
add esp, 0xc
push str.is_SR_course_installed
push 5
call fcn.004417b0
add esp, 8
call fcn.0049cfc0
mov dword [ebp - 0x418], eax
push 0x4e5724
mov edx, dword [ebp - 0x418]
push edx
push 0x4e572c
lea eax, [ebp - 0x204]
push eax
call fcn.004b6e08
add esp, 0x10
lea ecx, [ebp - 0x40c]
push ecx
push 1
push 1
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x104]
push eax
push 0x4e5734
lea ecx, [ebp - 0x204]
push ecx
push 4
call fcn.00497900
add esp, 0x20
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0
jne 0x4573ea
mov edx, 1
imul edx, edx, 0
movsx eax, byte [ebp + edx - 0x104]
cmp eax, 0x2e
jne 0x457311
jmp 0x4573aa
cmp dword [ebp - 0x40c], 0
jne 0x45731f
jmp 0x4573aa
push 0x5c
lea ecx, [ebp - 0x104]
push ecx
push 0x5c
lea edx, [ebp - 0x204]
push edx
push str._s_c_s_cdyned.ini
lea eax, [ebp - 0x404]
push eax
call fcn.004b6e08
add esp, 0x18
lea ecx, [ebp - 0x404]
push ecx
push 0xff
lea edx, [ebp - 0x304]
push edx
push 0x54be45
push 0x4e577c
push str.dyned.ini
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x408], eax
lea eax, [ebp - 0x304]
push eax
call fcn.004ca5db
add esp, 4
cmp dword [ebp - 0x408], 0
je 0x4573aa
mov ecx, 1
imul ecx, ecx, 0
movsx edx, byte [ebp + ecx - 0x304]
cmp edx, 0x79
jne 0x4573aa
mov dword [ebp - 0x410], 1
cmp dword [ebp - 0x410], 0
jne 0x4573ea
lea eax, [ebp - 0x40c]
push eax
push 1
push 0
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x104]
push edx
push 0x4e57ac
lea eax, [ebp - 0x204]
push eax
push 4
call fcn.00497900
add esp, 0x20
test eax, eax
je 0x4572f7
mov eax, dword [ebp - 0x410]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret
Function at 0x462010
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x54bf64]
mov byte [ebp - 0x10], al
xor ecx, ecx
mov dword [ebp - 0xf], ecx
mov dword [ebp - 0xb], ecx
mov byte [ebp - 7], cl
cmp dword [ebp + 8], 0
je 0x46207f
mov edx, dword [ebp + 0xc]
push edx
push 0x4e84d0
lea eax, [ebp - 0x10]
push eax
call fcn.004b6e08
add esp, 0xc
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.004b8f82
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 1
push 4
lea eax, [ebp - 0x10]
push eax
call fcn.004b5f60
add esp, 4
lea ecx, [ebp + eax - 0x14]
push ecx
call fcn.004b9519
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret

Function at 0x4620c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
je 0x462101
mov eax, dword [ebp + 0xc]
push eax
push 1
push 0x228
mov ecx, dword [ebp + 8]
push ecx
call fcn.004b8e47
add esp, 0x10
mov edx, dword [ebp + 8]
movsx eax, word [edx + 0x21a]
cmp eax, 0xff
jle 0x462101
push 1
mov ecx, dword [ebp + 8]
push ecx
push 3
call fcn.00411a80
add esp, 0xc
pop ebp
ret

Function at 0x462240
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
je 0x462260
mov eax, dword [ebp + 0xc]
push eax
push 1
push 0x228
mov ecx, dword [ebp + 8]
push ecx
call fcn.004b9519
add esp, 0x10
pop ebp
ret
Function at 0x4656b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x54e2ac]
mov byte [ebp - 0x204], al
push 0xfe
push 0
lea ecx, [ebp - 0x203]
push ecx
call fcn.004b6780
add esp, 0xc
mov dl, byte [0x54e2ad]
mov byte [ebp - 0x104], dl
push 0xfe
push 0
lea eax, [ebp - 0x103]
push eax
call fcn.004b6780
add esp, 0xc
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x208], 0
push 0x4e95cc
mov ecx, dword [ebp + 8]
push ecx
push 0x4e9620
lea edx, [ebp - 0x204]
push edx
call fcn.004b6e08
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
push 0xff
lea ecx, [ebp - 0x104]
push ecx
push 0x54e2ae
push 0x4e9628
push 0x4e963c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edx, 1
imul edx, edx, 0
movsx eax, byte [ebp + edx - 0x104]
test eax, eax
je 0x465784
cmp dword [ebp + 0xc], 1
jne 0x465784
mov eax, dword [ebp - 0x208]
jmp 0x4658ca
lea ecx, [ebp - 0x104]
push ecx
call fcn.004ca5db
add esp, 4
mov edx, 1
imul edx, edx, 0
movsx eax, byte [ebp + edx - 0x104]
test eax, eax
jne 0x4657b3
mov dword [ebp - 0x20c], 2
jmp 0x4657e1
push 0x4e9644
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5ff0
add esp, 8
test eax, eax
je 0x4657d7
mov dword [ebp - 0x20c], 1
jmp 0x4657e1
mov dword [ebp - 0x20c], 2
mov edx, 1
imul edx, edx, 0
movsx eax, byte [ebp + edx - 0x104]
test eax, eax
jne 0x465801
mov dword [ebp - 0x208], 2
jmp 0x465848
push 0x4e9648
push 0x4e965c
push 0x54e2af
push 0x54e2b0
push 0x54e2b1
push 0x54e2b2
push 0x54e2b3
push str.MSG_Button_AlwaysOn
push str.MSG_Button_DialUp
mov ecx, dword [ebp - 0x20c]
push ecx
push str.MSG_Message_InternetIntranetConnection
call fcn.0045a870
add esp, 0x2c
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
je 0x4658c4
mov edx, dword [ebp - 0x208]
cmp edx, dword [ebp - 0x20c]
jne 0x465873
mov eax, 1
imul eax, eax, 0
movsx ecx, byte [ebp + eax - 0x104]
test ecx, ecx
jne 0x4658c4
cmp dword [ebp - 0x208], 1
jne 0x465892
push 0x4e96bc
lea edx, [ebp - 0x104]
push edx
call fcn.004b5e60
add esp, 8
jmp 0x4658a6
push 0x4e96c0
lea eax, [ebp - 0x104]
push eax
call fcn.004b5e60
add esp, 8
lea ecx, [ebp - 0x204]
push ecx
lea edx, [ebp - 0x104]
push edx
push str.dial_up_connection
push 0x4e96d8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [ebp - 0x208]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret
Function at 0x467890
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x4e9be8
push 0x4fcad8
push 0x4e9bf4
lea eax, [ebp - 0x104]
push eax
call fcn.004b6e08
add esp, 0x10
lea ecx, [ebp - 0x104]
push ecx
push 0xff
mov edx, dword [ebp + 8]
push edx
push 0x54e2e7
push 0x4e9bfc
push 0x4e9c14
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x108], eax
lea eax, [ebp - 0x104]
push eax
push 0xff
mov ecx, dword [ebp + 0xc]
push ecx
push 0x54e2e8
push 0x4e9c1c
push 0x4e9c34
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x108], eax
lea edx, [ebp - 0x104]
push edx
push 0xff
mov eax, dword [ebp + 0x10]
push eax
push 0x54e2e9
push 0x4e9c3c
push 0x4e9c5c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x108], eax
lea ecx, [ebp - 0x104]
push ecx
push 0xff
mov edx, dword [ebp + 0x14]
push edx
push 0x54e2ea
push 0x4e9c64
push 0x4e9c7c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x108], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret

Function at 0x4683d0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
imul eax, eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0
mov edx, 4
shl edx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx], 0
cmp dword [ebp + 0xc], 0
jne 0x46849d
mov ecx, 4
imul ecx, ecx, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 8], 0x6a09e667
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 8], 0xbb67ae85
mov edx, 4
shl edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + edx + 8], 0x3c6ef372
mov ecx, 4
imul ecx, ecx, 3
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 8], 0xa54ff53a
mov eax, 4
shl eax, 2
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 8], 0x510e527f
mov edx, 4
imul edx, edx, 5
mov eax, dword [ebp + 8]
mov dword [eax + edx + 8], 0x9b05688c
mov ecx, 4
imul ecx, ecx, 6
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 8], 0x1f83d9ab
mov eax, 4
imul eax, eax, 7
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 8], 0x5be0cd19
jmp 0x468534
mov edx, 4
imul edx, edx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx + 8], 0xc1059ed8
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 8], 0x367cd507
mov eax, 4
shl eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 8], 0x3070dd17
mov edx, 4
imul edx, edx, 3
mov eax, dword [ebp + 8]
mov dword [eax + edx + 8], 0xf70e5939
mov ecx, 4
shl ecx, 2
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 8], 0xffc00b31
mov eax, 4
imul eax, eax, 5
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 8], 0x68581511
mov edx, 4
imul edx, edx, 6
mov eax, dword [ebp + 8]
mov dword [eax + edx + 8], 0x64f98fa7
mov ecx, 4
imul ecx, ecx, 7
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 8], 0xbefa4fa4
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0xe8], ecx
pop ebp
ret
Function at 0x468c60
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0x40
jbe 0x468cb0
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00468be0
add esp, 0x10
cmp dword [ebp + 0x14], 0
je 0x468c9d
mov dword [ebp - 0x2c], 0x1c
jmp 0x468ca4
mov dword [ebp - 0x2c], 0x20
mov ecx, dword [ebp - 0x2c]
mov dword [ebp + 0x10], ecx
lea edx, [ebp - 0x24]
mov dword [ebp + 0xc], edx
push 0x40
push 0x36
mov eax, dword [ebp + 8]
add eax, 0x68
push eax
call fcn.004b6780
add esp, 0xc
push 0x40
push 0x5c
mov ecx, dword [ebp + 8]
add ecx, 0xa8
push ecx
call fcn.004b6780
add esp, 0xc
mov dword [ebp - 0x28], 0
jmp 0x468ceb
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp + 0x10]
jae 0x468d37
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x28]
movzx edx, byte [ecx + 0x68]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x28]
movzx ecx, byte [eax]
xor edx, ecx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x28]
mov byte [eax + 0x68], dl
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x28]
movzx edx, byte [ecx + 0xa8]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x28]
movzx ecx, byte [eax]
xor edx, ecx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x28]
mov byte [eax + 0xa8], dl
jmp 0x468ce2
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004683d0
add esp, 8
push 0x40
mov eax, dword [ebp + 8]
add eax, 0x68
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00468550
add esp, 0xc
push 0x20
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.004b6780
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret
Function at 0x4751e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x108], 0
mov al, byte [0x54e66b]
mov byte [ebp - 0x104], al
push 0xfe
push 0
lea ecx, [ebp - 0x103]
push ecx
call fcn.004b6780
add esp, 0xc
cmp dword [0x54e958], 1
jne 0x4753ab
cmp dword [ebp + 0xc], 0
jne 0x475249
mov edx, 1
imul edx, edx, 0
movsx eax, byte [edx + 0x4f9910]
test eax, eax
jne 0x475249
jmp 0x4753ab
push str.local.dat
push 0x5c
mov ecx, dword [ebp + 8]
push ecx
push 0x5c
push 0x4f93d8
call fcn.0042b620
add esp, 4
push eax
push 0x4eb12c
lea edx, [ebp - 0x104]
push edx
call fcn.004b6e08
add esp, 0x1c
push 1
push 0x4eb138
lea eax, [ebp - 0x104]
push eax
call fcn.00419d20
add esp, 0xc
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
je 0x4753ab
cmp dword [0x54e960], 2
jle 0x47531a
push 0x4f9910
call fcn.00482010
add esp, 4
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x180], eax
jne 0x47531a
mov edx, dword [ebp + 8]
mov dword [ebp - 0x114], edx
mov eax, dword [ebp + 8]
add eax, 0x180
mov dword [ebp - 0x110], eax
push 0
mov ecx, dword [ebp - 0x110]
add ecx, 0x2bc
sub ecx, dword [ebp - 0x114]
push ecx
mov edx, dword [ebp - 0x108]
push edx
call fcn.004b8f82
add esp, 0xc
mov eax, dword [ebp - 0x108]
push eax
push 1
push 4
mov ecx, dword [ebp + 8]
add ecx, 0x180
push ecx
call fcn.004b9519
add esp, 0x10
push 0
push 0x8e8
mov edx, dword [ebp - 0x108]
push edx
call fcn.004b8f82
add esp, 0xc
cmp dword [ebp + 0xc], 0
jne 0x47537b
mov eax, 1
imul eax, eax, 0
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x16
jae 0x47534f
jmp 0x475354
call fcn.004b64ae
mov ecx, dword [ebp - 0x10c]
mov byte [ecx + 0x4f9910], 0
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0x16
push 0x4f9910
call fcn.004b9519
add esp, 0x10
jmp 0x475392
mov eax, dword [ebp - 0x108]
push eax
push 1
push 0x16
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004b9519
add esp, 0x10
mov edx, dword [ebp - 0x108]
push edx
call fcn.00419ca0
add esp, 4
mov dword [ebp - 0x108], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret