joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c2ed5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
mov dword [ebp - 0x31c], ecx
mov dword [ebp - 0x318], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x210], 0
push 0x104
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0054bfb0
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x314]
push ecx
call fcn.0054bfb0
add esp, 0xc
push 0x104
push 0
lea edx, [ebp - 0x108]
push edx
call fcn.0054bfb0
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call fcn.0053534c
add esp, 4
lea ecx, [ebp - 0x108]
push ecx
call fcn.0054c3e0
add esp, 4
movsx edx, byte [ebp + eax - 0x109]
cmp edx, 0x5c
je 0x4c2f82
push 0x5adccc
lea eax, [ebp - 0x108]
push eax
call fcn.0054bed0
add esp, 8
jmp 0x4c2f96
push 0x5adcdc
lea ecx, [ebp - 0x108]
push ecx
call fcn.0054bed0
add esp, 8
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4c2faf
xor eax, eax
jmp 0x4c313d
push 0x5adcec
lea eax, [ebp - 0x108]
push eax
call fcn.0054d3be
add esp, 8
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0
jne 0x4c2fd9
xor eax, eax
jmp 0x4c313d
push 2
push 0
mov ecx, dword [ebp - 0x318]
push ecx
call fcn.0054e492
add esp, 0xc
mov edx, dword [ebp - 0x318]
push edx
call fcn.0054e30f
add esp, 4
mov dword [ebp - 0x210], eax
push 0
push 0
mov eax, dword [ebp - 0x318]
push eax
call fcn.0054e492
add esp, 0xc
mov dword [ebp - 4], 0
jmp 0x4c3026
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x210]
xor edx, edx
mov ecx, 0x104
div ecx
cmp dword [ebp - 4], eax
jae 0x4c30c8
push 0
mov edx, dword [ebp - 4]
imul edx, edx, 0x104
push edx
mov eax, dword [ebp - 0x318]
push eax
call fcn.0054e492
add esp, 0xc
mov ecx, dword [ebp - 0x318]
push ecx
push 0x104
push 1
lea edx, [ebp - 0x20c]
push edx
call fcn.0054d276
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call fcn.0054c3e0
add esp, 4
test eax, eax
je 0x4c30c3
push 0
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x104
push ecx
mov edx, dword [ebp - 0x318]
push edx
call fcn.0054e492
add esp, 0xc
mov eax, dword [ebp - 0x318]
push eax
push 0x104
push 1
lea ecx, [ebp - 0x314]
push ecx
call fcn.0054d3d1
add esp, 0x10
jmp 0x4c30c8
jmp 0x4c301d
mov eax, dword [ebp - 0x210]
xor edx, edx
mov ecx, 0x104
div ecx
cmp dword [ebp - 4], eax
jne 0x4c310c
push 0x104
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.0054bfb0
add esp, 0xc
mov eax, dword [ebp - 0x318]
push eax
call fcn.0054d1f9
add esp, 4
mov dword [ebp - 0x318], 0
xor eax, eax
jmp 0x4c313d
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0054bec0
add esp, 8
mov eax, dword [ebp - 0x318]
push eax
call fcn.0054d1f9
add esp, 4
mov dword [ebp - 0x318], 0
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x4c6138
Capabilities:
Enumerate files on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x35c
mov dword [ebp - 0x35c], ecx
mov dword [ebp - 0x250], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push 0x5d96dc
mov ecx, dword [ebp - 4]
push ecx
call fcn.0054bec0
add esp, 8
lea edx, [ebp - 0x10c]
push edx
call fcn.0053534c
add esp, 4
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea ecx, [ebp - 0x24c]
push ecx
push str.ForceFlash.set
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x4c61ac
xor eax, eax
jmp 0x4c62a9
mov dword [ebp - 8], 0
mov dword [ebp - 0x250], 0
cmp dword [ebp - 8], 0
jne 0x4c6280
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x358]
push eax
call fcn.0054bec0
add esp, 8
lea ecx, [ebp - 0x358]
push ecx
call dword [sym.imp.USER32.dll_CharUpperA]
push str.FORCEFLASH
lea edx, [ebp - 0x358]
push edx
call fcn.0054ccc0
add esp, 8
test eax, eax
je 0x4c6251
push str..SET
lea eax, [ebp - 0x358]
push eax
call fcn.0054ccc0
add esp, 8
test eax, eax
je 0x4c6251
lea ecx, [ebp - 0x10c]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0054bec0
add esp, 8
push 0x5ae048
mov eax, dword [ebp - 4]
push eax
call fcn.0054bed0
add esp, 8
lea ecx, [ebp - 0x220]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0054bed0
add esp, 8
lea eax, [ebp - 0x24c]
push eax
mov ecx, dword [ebp - 0x254]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4c627b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4c627b
mov dword [ebp - 8], 1
jmp 0x4c61bd
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0054bec0
add esp, 8
mov edx, dword [ebp - 4]
push edx
call fcn.0054c3e0
add esp, 4
mov esp, ebp
pop ebp
ret 4
Function at 0x4ca07b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0054c3e0
add esp, 4
test eax, eax
je 0x4ca0b6
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4ca0b6
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
add eax, 0x2f90
push eax
call fcn.0054bec0
add esp, 8
mov esp, ebp
pop ebp
ret 4
Function at 0x4d09e5
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e8
mov dword [ebp - 0x1e8], ecx
movsx eax, byte [ebp + 8]
push eax
push 0x5aeb90
lea ecx, [ebp - 0xdc]
push ecx
call fcn.0054c45b
add esp, 0xc
mov dword [ebp - 0x5c], 0
movsx edx, byte [ebp + 8]
push edx
push 0x5aeb98
lea eax, [ebp - 0x9c]
push eax
call fcn.0054c45b
add esp, 0xc
push 0xff
push 0
lea ecx, [ebp - 0x1dc]
push ecx
call fcn.0054bfb0
add esp, 0xc
push 0x50
push 0
lea edx, [ebp - 0x54]
push edx
call fcn.0054bfb0
add esp, 0xc
push 0x50
lea eax, [ebp - 0x54]
push eax
push 0
push 0
lea ecx, [ebp - 0x58]
push ecx
push 0xff
lea edx, [ebp - 0x1dc]
push edx
lea eax, [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4d0aae
movsx ecx, byte [ebp - 0x54]
cmp ecx, 0x4e
jne 0x4d0aae
movsx edx, byte [ebp - 0x53]
cmp edx, 0x54
jne 0x4d0aae
movsx eax, byte [ebp - 0x52]
cmp eax, 0x46
jne 0x4d0aae
movsx ecx, byte [ebp - 0x51]
cmp ecx, 0x53
jne 0x4d0aae
mov dword [ebp - 0x5c], 1
mov edx, dword [ebp - 0x1e8]
mov eax, dword [ebp - 0x5c]
mov dword [edx + 0x2f8c], eax
push 0
push 0x20000000
push 3
push 0
push 3
push 0xc0000000
lea ecx, [ebp - 0xdc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0xffffffff
je 0x4d0b57
mov ecx, dword [ebp - 0x1e8]
call fcn.004bb428
test eax, eax
je 0x4d0b22
push 0
lea ecx, [ebp - 0x1e0]
push ecx
push 0
push 0
push 0
push 0
push 0x90018
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x1e4], eax
jmp 0x4d0b50
cmp dword [ebp - 0x5c], 0
je 0x4d0b50
push 0
lea ecx, [ebp - 0x1e0]
push ecx
push 0
push 0
push 0
push 0
push 0x90018
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x1e4], eax
mov eax, 1
jmp 0x4d0b59
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x4d1250
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x488
mov dword [ebp - 0x488], ecx
mov dword [ebp - 0x404], 1
push 0x5aec08
lea eax, [ebp - 0x484]
push eax
call fcn.0054bec0
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
push 0x5aec14
lea edx, [ebp - 0x400]
push edx
call fcn.0054c45b
add esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x488]
mov edx, dword [ecx + eax*4 + 0x2344]
add edx, 0x48
push edx
push 0x200
lea eax, [ebp - 0x200]
push eax
push 0
lea ecx, [ebp - 0x400]
push ecx
lea edx, [ebp - 0x484]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x200]
push eax
call fcn.0054c3e0
add esp, 4
test eax, eax
je 0x4d12f1
lea ecx, [ebp - 0x200]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.0054bec0
add esp, 8
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4d96cf
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
mov dword [ebp - 0x188], ecx
lea eax, [ebp - 0x184]
push eax
call fcn.0053534c
add esp, 4
push str.UFD_MPLocalSetting.INI
lea ecx, [ebp - 0x184]
push ecx
call fcn.0054bed0
add esp, 8
mov edx, dword [ebp + 8]
xor eax, eax
mov al, byte [edx + 0x5dd]
push eax
mov ecx, dword [ebp + 8]
xor edx, edx
mov dl, byte [ecx + 0x5dc]
push edx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax + 0x5db]
push ecx
mov edx, dword [ebp + 8]
xor eax, eax
mov al, byte [edx + 0x5da]
push eax
mov ecx, dword [ebp + 8]
xor edx, edx
mov dl, byte [ecx + 0x5d9]
push edx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax + 0x5d8]
push ecx
push str.Flash__.2X_.2X_.2X_.2X_.2X_.2X
lea edx, [ebp - 0x80]
push edx
call fcn.0054c45b
add esp, 0x20
lea eax, [ebp - 0x184]
push eax
push 0
lea ecx, [ebp - 0x80]
push ecx
push str.PretestCLK
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edx, dword [ebp + 8]
mov dword [edx + 0x4fd4], eax
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x4d9786
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
mov dword [ebp - 0xb4], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xc], 0
movsx eax, byte [ebp + 0x14]
push eax
push 0x5af83c
lea ecx, [ebp - 0xa0]
push ecx
call fcn.0054c45b
add esp, 0xc
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0xa8]
push ecx
lea edx, [ebp - 0xa0]
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jne 0x4d98ab
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xb4]
mov edx, dword [ecx + eax*4 + 0x2344]
xor eax, eax
mov al, byte [edx + 0x5c4]
test eax, eax
jne 0x4d986c
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xb4]
mov eax, dword [edx + ecx*4 + 0x2344]
xor ecx, ecx
mov cl, byte [eax + 0x5c5]
test ecx, ecx
jne 0x4d986c
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax + edx*4 + 0x2344]
xor edx, edx
mov dl, byte [ecx + 0x5c6]
test edx, edx
jne 0x4d986c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xb4]
mov edx, dword [ecx + eax*4 + 0x2344]
xor eax, eax
mov al, byte [edx + 0x5c7]
test eax, eax
je 0x4d987f
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x124
mov dword [ecx + 0x5db9c8], 1
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax + edx*4 + 0x204]
and ch, 0xfe
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xb4]
mov dword [eax + edx*4 + 0x204], ecx
mov dword [ebp - 0xc], 0
jmp 0x4d98d0
push 0
push 0x400
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.0054e710
push 0
push 0x400
push edx
push eax
call fcn.0054e710
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0xac]
push eax
lea ecx, [ebp - 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
cmp dword [ebp - 0x10], 0
jbe 0x4d9912
mov edx, dword [ebp - 8]
add edx, 1
cmp edx, dword [ebp - 0x10]
jne 0x4d9912
push 0x5af844
mov eax, dword [ebp + 0x10]
push eax
call fcn.0054bec0
add esp, 8
mov ecx, dword [ebp - 8]
add ecx, 1
cmp ecx, dword [ebp - 0x10]
jae 0x4d992e
push 0x5af848
mov edx, dword [ebp + 0x10]
push edx
call fcn.0054bec0
add esp, 8
mov eax, dword [ebp - 0xc]
push eax
push str._r_n_ld_MBytes
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0054c45b
add esp, 0xc
mov eax, dword [ebp - 0xb0]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4fe3b9
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x484
mov dword [ebp - 0x404], 1
push 0x5b1cb0
lea eax, [ebp - 0x484]
push eax
call fcn.0054bec0
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
push 0x5b1cbc
lea edx, [ebp - 0x400]
push edx
call fcn.0054c45b
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, 0x48
push eax
push 0x200
lea ecx, [ebp - 0x200]
push ecx
push 0
lea edx, [ebp - 0x400]
push edx
lea eax, [ebp - 0x484]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x200]
push ecx
call fcn.0054c3e0
add esp, 4
test eax, eax
je 0x4fe447
lea edx, [ebp - 0x200]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.0054bec0
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x4fe8d1
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
push 0x5db77c
mov eax, dword [ebp + 0xc]
push eax
call fcn.0054bec0
add esp, 8
lea ecx, [ebp - 0x108]
push ecx
call fcn.0053534c
add esp, 4
push 0x20
push 0
lea edx, [ebp - 0x168]
push edx
call fcn.0054bfb0
add esp, 0xc
push 0x40
push 0
lea eax, [ebp - 0x148]
push eax
call fcn.0054bfb0
add esp, 0xc
push str.CardModeCardMode.FCM
lea ecx, [ebp - 0x108]
push ecx
call fcn.0054bed0
add esp, 8
mov dword [ebp - 4], 0
jmp 0x4fe946
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0x17
jge 0x4fe983
mov eax, dword [ebp - 4]
imul eax, eax, 0x14
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x4764]
cmp edx, dword [eax + 0x5b8460]
jne 0x4fe981
mov eax, dword [ebp - 4]
imul eax, eax, 0x14
mov ecx, dword [eax + 0x5b845c]
push ecx
lea edx, [ebp - 0x168]
push edx
call fcn.0054bec0
add esp, 8
jmp 0x4fe983
jmp 0x4fe93d
mov eax, dword [ebp + 0xc]
push eax
call fcn.0053534c
add esp, 4
lea ecx, [ebp - 0x108]
push ecx
push 0
push str.EnableCardModeFolder
push str.CardModeFolder
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x4fea1f
lea edx, [ebp - 0x108]
push edx
push 0x40
lea eax, [ebp - 0x148]
push eax
push 0x5db780
lea ecx, [ebp - 0x168]
push ecx
push str.CARDMODEFOLDER
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x148]
push edx
call fcn.0054c3e0
add esp, 4
test eax, eax
je 0x4fea0c
push str.CardMode_
mov eax, dword [ebp + 0xc]
push eax
call fcn.0054bed0
add esp, 8
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0054bed0
add esp, 8
jmp 0x4fea1d
push str.CardModeDefault
mov eax, dword [ebp + 0xc]
push eax
call fcn.0054bed0
add esp, 8
jmp 0x4fea30
push str.CardMode
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0054bed0
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x5031b7
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
mov eax, dword [ebp + 0xc]
push eax
call fcn.0054c3e0
add esp, 4
cmp eax, 0x100
jae 0x5031f3
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x194]
shl eax, 8
add eax, 0x5da764
push eax
call fcn.0054bec0
add esp, 8
jmp 0x503229
push 0xff
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x194]
shl eax, 8
add eax, 0x5da764
push eax
call fcn.0054c980
add esp, 0xc
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x194]
shl edx, 8
mov byte [edx + 0x5da863], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x194]
shl ecx, 8
add ecx, 0x5da764
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x194]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x36f44]
push edx
push str.MsgHwnd__.4X__t_Port__.2d__t_Status__s__r_n
lea eax, [ebp - 0x100]
push eax
call fcn.0054c45b
add esp, 0x14
lea ecx, [ebp - 0x100]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp + 8]
cmp dword [edx + 0x36f44], 0
je 0x5032af
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x194]
shl ecx, 8
add ecx, 0x5da764
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x194]
push eax
push 0x903
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x36f44]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x511530
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0xa0], 0
cmp dword [ebp - 0x90], 4
jne 0x51159c
cmp dword [ebp - 0x8c], 0x5a
je 0x51159a
mov dword [ebp - 0xa8], 1
jmp 0x5115e0
cmp dword [ebp - 0x90], 5
jne 0x5115cd
cmp dword [ebp - 0x8c], 0
jne 0x5115b8
mov dword [ebp - 0x9c], 1
cmp dword [ebp - 0x8c], 1
jne 0x5115cb
mov dword [ebp - 0x98], 1
jmp 0x5115e0
cmp dword [ebp - 0x90], 6
jne 0x5115e0
mov dword [ebp - 0xa0], 1
mov eax, dword [ebp - 0xa0]
mov esp, ebp
pop ebp
ret
Function at 0x51e18a
Capabilities:
Check if file exists
Copy file
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov dword [ebp - 0x290], ecx
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x290]
add eax, 0x3b0
push eax
call fcn.0053534c
add esp, 4
push 0x5b45fc
mov ecx, dword [ebp - 0x290]
add ecx, 0x3b0
push ecx
call fcn.0054bed0
add esp, 8
lea edx, [ebp - 0x108]
push edx
call fcn.0053534c
add esp, 4
push 0x5b460c
lea eax, [ebp - 0x108]
push eax
call fcn.0054bed0
add esp, 8
lea ecx, [ebp - 0x108]
push ecx
push 0
push str.ENABLESEPERATEBYCMPNAME
push 0x5b4638
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x5be048], eax
cmp dword [0x5be048], 0
je 0x51e305
lea edx, [ebp - 0x20c]
push edx
call fcn.0053534c
add esp, 4
push 0x5b4640
lea eax, [ebp - 0x20c]
push eax
call fcn.0054bed0
add esp, 8
push 0
lea ecx, [ebp - 0x28c]
push ecx
call fcn.00536f18
add esp, 8
test eax, eax
je 0x51e294
push str.Default_
lea edx, [ebp - 0x20c]
push edx
call fcn.0054bed0
add esp, 8
lea eax, [ebp - 0x28c]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0054bed0
add esp, 8
push 0x5b4650
lea edx, [ebp - 0x20c]
push edx
call fcn.0054bed0
add esp, 8
jmp 0x51e2bc
push 0
push 0
push str.The_ComputerName_Not_Exist_Index_Change_to_default.
mov ecx, dword [ebp - 0x290]
call fcn.00563067
push str.Default.ini
lea eax, [ebp - 0x20c]
push eax
call fcn.0054bed0
add esp, 8
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x51e2e9
push 0
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [ebp - 0x290]
add eax, 0x3b0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp - 0x290]
add edx, 0x3b0
push edx
call fcn.0054bec0
add esp, 8
push 0
mov eax, dword [ebp - 0x290]
add eax, 0x3b0
push eax
push 1
call fcn.00426ee0
add esp, 0xc
push 1
mov ecx, dword [ebp - 0x290]
call fcn.0051e0ca
call fcn.00428514
push 0x10
push 0
mov ecx, dword [ebp - 0x290]
add ecx, 0x19550
push ecx
call fcn.0054bfb0
add esp, 0xc
push 0x28
push 0x5c5ce8
mov edx, dword [ebp - 0x290]
add edx, 0x134
push edx
call fcn.0054c980
add esp, 0xc
mov eax, dword [ebp - 0x290]
add eax, 0x3b0
push eax
mov ecx, dword [ebp - 0x290]
call fcn.00521f5d
mov ecx, dword [ebp - 0x290]
call fcn.0052519c
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x521cad
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov dword [ebp - 0x218], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call fcn.0054c3e0
add esp, 4
mov dword [ebp - 0x110], eax
jmp 0x521ced
mov ecx, dword [ebp - 0x110]
sub ecx, 1
mov dword [ebp - 0x110], ecx
cmp dword [ebp - 0x110], 0
jl 0x521d12
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x110]
movsx eax, byte [edx]
cmp eax, 0x5c
jne 0x521d10
mov dword [ebp - 4], 1
jmp 0x521d12
jmp 0x521cde
cmp dword [ebp - 4], 0
jne 0x521d6b
push 0x104
push 0
lea ecx, [ebp - 0x10c]
push ecx
call fcn.0054bfb0
add esp, 0xc
push 0x5be06c
lea edx, [ebp - 0x10c]
push edx
call fcn.0054bec0
add esp, 8
push 0x5b5320
lea eax, [ebp - 0x10c]
push eax
call fcn.0054bed0
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x10c]
push edx
call fcn.0054bed0
add esp, 8
jmp 0x521d7e
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.0054bec0
add esp, 8
lea edx, [ebp - 0x214]
push edx
call fcn.0053534c
add esp, 4
push 0x5b5324
lea eax, [ebp - 0x214]
push eax
call fcn.0054bed0
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
call fcn.0054c3e0
add esp, 4
mov dword [ebp - 8], eax
jmp 0x521dbb
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
jl 0x521dd3
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
movsx ecx, byte [eax]
cmp ecx, 0x5c
jne 0x521dd1
jmp 0x521dd3
jmp 0x521db2
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 1]
push ecx
lea edx, [ebp - 0x214]
push edx
call fcn.0054bed0
add esp, 8
push 0
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [ebp - 0x10c]
push edx
mov eax, dword [ebp - 0x218]
add eax, 0x14ff0
push eax
call fcn.0054bec0
add esp, 8
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x521f3c
lea edx, [ebp - 0x214]
push edx
mov eax, dword [ebp - 0x218]
add eax, 0x3b0
push eax
call fcn.0054bec0
add esp, 8
lea ecx, [ebp - 0x214]
push ecx
mov edx, dword [ebp - 0x218]
add edx, 0x151f8
push edx
call fcn.0054bec0
add esp, 8
push 0
mov eax, dword [ebp - 0x218]
add eax, 0x14ff0
push eax
push 1
call fcn.00426ee0
add esp, 0xc
push 1
mov ecx, dword [ebp - 0x218]
call fcn.0051e0ca
call fcn.00428514
mov ecx, dword [ebp - 0x218]
add ecx, 0x14ff0
push ecx
mov ecx, dword [ebp - 0x218]
call fcn.00521f5d
mov ecx, dword [ebp - 0x218]
call fcn.0051e5b8
cmp dword [0x5c7720], 1
jne 0x521f24
cmp dword [0x5c7724], 1
jne 0x521f24
push 0x5c7728
push 0x5c6018
call fcn.0054bec0
add esp, 8
push 0x5c7828
push 0x5c6218
call fcn.0054bec0
add esp, 8
push 0x5c7928
push 0x5c6418
call fcn.0054bec0
add esp, 8
push 0x5c7a28
push 0x5c6618
call fcn.0054bec0
add esp, 8
push 0x5c7728
push 0x5c5e18
call fcn.0054bec0
add esp, 8
push str.DOWNLOADINIOK
mov ecx, dword [ebp - 0x218]
add ecx, 0x80
call fcn.00422e70
jmp 0x521f52
push str.DOWNLOADINIFAIL
mov ecx, dword [ebp - 0x218]
add ecx, 0x80
call fcn.00422e70
mov eax, 1
mov esp, ebp
pop ebp
ret 4