joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44dd40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52f171
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x5695e0]
xor eax, ebp
mov dword [ebp - 0x44], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x14], 0x100
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x144]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x538ea0
lea ecx, [ebp - 0x148]
call fcn.0040afa0
mov dword [ebp - 4], 0
movzx edx, byte [ebp - 0x144]
push edx
push 0
lea ecx, [ebp - 0x148]
call fcn.0040b220
lea ecx, [ebp - 0x148]
call fcn.0040b090
push 0x538ea4
lea ecx, [ebp - 0x148]
call fcn.00419120
lea ecx, [ebp - 0x3c]
call fcn.00403780
mov byte [ebp - 4], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x14c], esp
push str.211223093231243231
call fcn.0040afa0
mov dword [ebp - 0x15c], eax
lea eax, [ebp - 0x150]
push eax
call fcn.00450980
add esp, 8
mov dword [ebp - 0x160], eax
mov ecx, dword [ebp - 0x160]
mov dword [ebp - 0x164], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x164]
push edx
lea ecx, [ebp - 0x3c]
call fcn.004016a0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x150]
call fcn.00401680
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x148]
call fcn.0040b050
lea ecx, [ebp - 0x2c]
call fcn.004f9949
mov byte [ebp - 4], 3
push 0
lea ecx, [ebp - 0x148]
call fcn.004016e0
push eax
lea ecx, [ebp - 0x2c]
call fcn.004f99de
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x44deb2
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x154], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.004f996f
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.00401680
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x148]
call fcn.00401680
mov eax, dword [ebp - 0x154]
jmp 0x44df4d
lea ecx, [ebp - 0x2c]
call fcn.004f9618
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x34]
call fcn.00434650
lea ecx, [ebp - 0x2c]
call fcn.004f9654
mov dword [ebp - 0x40], eax
lea edx, [ebp - 0x34]
push edx
lea ecx, [ebp - 0x2c]
call fcn.004f9866
lea ecx, [ebp - 0x34]
call fcn.004510c0
mov esi, eax
sub esi, 0x7bc
imul esi, esi, 0x22d
lea ecx, [ebp - 0x34]
call fcn.00451100
imul eax, eax, 0x25
add esi, eax
lea ecx, [ebp - 0x34]
call fcn.00451140
add esi, eax
mov dword [ebp - 0x38], esi
lea ecx, [ebp - 0x2c]
call fcn.004f9532
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x158], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.004f996f
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.00401680
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x148]
call fcn.00401680
mov eax, dword [ebp - 0x158]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x44]
xor ecx, ebp
call fcn.0050e02e
mov esp, ebp
pop ebp
ret
Function at 0x4514d0
Capabilities:
Parse credit card information
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp + 8], 0x3d
jne 0x4514e8
mov dword [ebp - 4], 2
cmp dword [ebp + 8], 0x3e
jne 0x4514f5
mov dword [ebp - 4], 3
cmp dword [ebp + 8], 0x3f
jne 0x451502
mov dword [ebp - 4], 4
cmp dword [ebp + 8], 0x40
jne 0x45150f
mov dword [ebp - 4], 2
cmp dword [ebp + 8], 0x41
jne 0x45151c
mov dword [ebp - 4], 3
cmp dword [ebp + 8], 0x42
jne 0x451529
mov dword [ebp - 4], 4
cmp dword [ebp + 8], 0x43
jne 0x451536
mov dword [ebp - 4], 6
cmp dword [ebp + 8], 0x44
jne 0x451543
mov dword [ebp - 4], 7
cmp dword [ebp + 8], 0x45
jne 0x451550
mov dword [ebp - 4], 8
cmp dword [ebp + 8], 0x46
jne 0x45155d
mov dword [ebp - 4], 9
cmp dword [ebp + 8], 0x47
jne 0x45156a
mov dword [ebp - 4], 0xa
cmp dword [ebp + 8], 0x48
jne 0x451577
mov dword [ebp - 4], 0xb
cmp dword [ebp + 8], 0x49
jne 0x451584
mov dword [ebp - 4], 0xc
cmp dword [ebp + 8], 0x4a
jne 0x451591
mov dword [ebp - 4], 0xd
cmp dword [ebp + 8], 0x4b
jne 0x45159e
mov dword [ebp - 4], 0xe
cmp dword [ebp + 8], 0x4c
jne 0x4515ab
mov dword [ebp - 4], 0xf
cmp dword [ebp + 8], 0x4d
jne 0x4515b8
mov dword [ebp - 4], 0x22
cmp dword [ebp + 8], 0x4e
jne 0x4515c5
mov dword [ebp - 4], 0x23
cmp dword [ebp + 8], 0x4f
jne 0x4515d2
mov dword [ebp - 4], 0x24
cmp dword [ebp + 8], 0x50
jne 0x4515df
mov dword [ebp - 4], 0x25
cmp dword [ebp + 8], 0x51
jne 0x4515ec
mov dword [ebp - 4], 0x2a
cmp dword [ebp + 8], 0x52
jne 0x4515f9
mov dword [ebp - 4], 0x2b
cmp dword [ebp + 8], 0x53
jne 0x451606
mov dword [ebp - 4], 0x2c
cmp dword [ebp + 8], 0x54
jne 0x451613
mov dword [ebp - 4], 0x2d
cmp dword [ebp + 8], 0x55
jne 0x451620
mov dword [ebp - 4], 0x2e
cmp dword [ebp + 8], 0x56
jne 0x45162d
mov dword [ebp - 4], 0x2f
cmp dword [ebp + 8], 0x57
jne 0x45163a
mov dword [ebp - 4], 0x30
cmp dword [ebp + 8], 0x58
jne 0x451647
mov dword [ebp - 4], 0x31
cmp dword [ebp + 8], 0x59
jne 0x451654
mov dword [ebp - 4], 0x32
cmp dword [ebp + 8], 0x5a
jne 0x451661
mov dword [ebp - 4], 0x33
cmp dword [ebp + 8], 0x5b
jne 0x45166e
mov dword [ebp - 4], 0x34
cmp dword [ebp + 8], 0x5c
jne 0x45167b
mov dword [ebp - 4], 0x35
cmp dword [ebp + 8], 0x5d
jne 0x451688
mov dword [ebp - 4], 0x36
cmp dword [ebp + 8], 0x5e
jne 0x451695
mov dword [ebp - 4], 0x37
cmp dword [ebp + 8], 0x5f
jne 0x4516a2
mov dword [ebp - 4], 0x3a
cmp dword [ebp + 8], 0x60
jne 0x4516af
mov dword [ebp - 4], 0x3b
cmp dword [ebp + 8], 0x61
jne 0x4516bc
mov dword [ebp - 4], 0x3c
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4516d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp + 8], 2
jne 0x4516e8
mov dword [ebp - 4], 0x3d
cmp dword [ebp + 8], 3
jne 0x4516f5
mov dword [ebp - 4], 0x3e
cmp dword [ebp + 8], 4
jne 0x451702
mov dword [ebp - 4], 0x3f
cmp dword [ebp + 8], 6
jne 0x45170f
mov dword [ebp - 4], 0x43
cmp dword [ebp + 8], 7
jne 0x45171c
mov dword [ebp - 4], 0x44
cmp dword [ebp + 8], 8
jne 0x451729
mov dword [ebp - 4], 0x45
cmp dword [ebp + 8], 9
jne 0x451736
mov dword [ebp - 4], 0x46
cmp dword [ebp + 8], 0xa
jne 0x451743
mov dword [ebp - 4], 0x47
cmp dword [ebp + 8], 0xb
jne 0x451750
mov dword [ebp - 4], 0x48
cmp dword [ebp + 8], 0xc
jne 0x45175d
mov dword [ebp - 4], 0x49
cmp dword [ebp + 8], 0xd
jne 0x45176a
mov dword [ebp - 4], 0x4a
cmp dword [ebp + 8], 0xe
jne 0x451777
mov dword [ebp - 4], 0x4b
cmp dword [ebp + 8], 0xf
jne 0x451784
mov dword [ebp - 4], 0x4c
cmp dword [ebp + 8], 0x22
jne 0x451791
mov dword [ebp - 4], 0x4d
cmp dword [ebp + 8], 0x23
jne 0x45179e
mov dword [ebp - 4], 0x4e
cmp dword [ebp + 8], 0x24
jne 0x4517ab
mov dword [ebp - 4], 0x4f
cmp dword [ebp + 8], 0x25
jne 0x4517b8
mov dword [ebp - 4], 0x50
cmp dword [ebp + 8], 0x2a
jne 0x4517c5
mov dword [ebp - 4], 0x51
cmp dword [ebp + 8], 0x2b
jne 0x4517d2
mov dword [ebp - 4], 0x52
cmp dword [ebp + 8], 0x2c
jne 0x4517df
mov dword [ebp - 4], 0x53
cmp dword [ebp + 8], 0x2d
jne 0x4517ec
mov dword [ebp - 4], 0x54
cmp dword [ebp + 8], 0x2e
jne 0x4517f9
mov dword [ebp - 4], 0x55
cmp dword [ebp + 8], 0x2f
jne 0x451806
mov dword [ebp - 4], 0x56
cmp dword [ebp + 8], 0x30
jne 0x451813
mov dword [ebp - 4], 0x57
cmp dword [ebp + 8], 0x31
jne 0x451820
mov dword [ebp - 4], 0x58
cmp dword [ebp + 8], 0x32
jne 0x45182d
mov dword [ebp - 4], 0x59
cmp dword [ebp + 8], 0x33
jne 0x45183a
mov dword [ebp - 4], 0x5a
cmp dword [ebp + 8], 0x34
jne 0x451847
mov dword [ebp - 4], 0x5b
cmp dword [ebp + 8], 0x35
jne 0x451854
mov dword [ebp - 4], 0x5c
cmp dword [ebp + 8], 0x36
jne 0x451861
mov dword [ebp - 4], 0x5d
cmp dword [ebp + 8], 0x37
jne 0x45186e
mov dword [ebp - 4], 0x5e
cmp dword [ebp + 8], 0x3a
jne 0x45187b
mov dword [ebp - 4], 0x5f
cmp dword [ebp + 8], 0x3b
jne 0x451888
mov dword [ebp - 4], 0x60
cmp dword [ebp + 8], 0x3c
jne 0x451895
mov dword [ebp - 4], 0x61
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x485400
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52fe92
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x5695e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0x60], 0
je 0x48547f
mov eax, dword [ebp - 0x14]
mov dword [eax], 0x53b404
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x98], 0x53db74
mov ecx, dword [ebp - 0x14]
add ecx, 0x60
call fcn.004be7f0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
or edx, 1
mov dword [ebp - 0x10], edx
push 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x90
call fcn.00462e70
mov eax, dword [ebp - 0x10]
or eax, 2
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + eax], vtable.._AURF__FJ___Anfangsberechnung_eckrad__QAEXXZ_.1.0
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x14]
mov dword [edx + ecx], vtable.._AURF__FJ___Anfangsberechnung_eckrad__QAEXXZ_.0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
sub edx, 0x90
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ecx + 8]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + eax - 4], edx
mov edx, dword [ebp - 0x14]
fld qword [ebp + 8]
fstp qword [edx + 8]
mov eax, dword [ebp - 0x14]
fld qword [ebp + 0x10]
fstp qword [eax + 0x10]
mov ecx, dword [ebp - 0x14]
fld qword [ebp + 0x18]
fstp qword [ecx + 0x18]
mov edx, dword [ebp - 0x14]
fld qword [ebp + 0x20]
fstp qword [edx + 0x20]
mov eax, dword [ebp - 0x14]
fld qword [ebp + 0x28]
fstp qword [eax + 0x28]
mov ecx, dword [ebp - 0x14]
add ecx, 0x30
mov edx, dword [ebp + 0x30]
mov dword [ecx], edx
mov eax, dword [ebp + 0x34]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 0x38]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 0x3c]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp + 0x40]
mov dword [ecx + 0x10], edx
mov eax, dword [ebp + 0x44]
mov dword [ecx + 0x14], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x48
mov edx, dword [ebp + 0x48]
mov dword [ecx], edx
mov eax, dword [ebp + 0x4c]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 0x50]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 0x54]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp + 0x58]
mov dword [ecx + 0x10], edx
mov eax, dword [ebp + 0x5c]
mov dword [ecx + 0x14], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x5c
Function at 0x4c01b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53098f
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x5695e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0x58], 0
je 0x4c020d
mov eax, dword [ebp - 0x14]
mov dword [eax + 8], 0x53cc10
mov ecx, dword [ebp - 0x14]
add ecx, 0x80
call fcn.004be7f0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
or ecx, 1
mov dword [ebp - 0x10], ecx
push 0
mov ecx, dword [ebp - 0x14]
call fcn.00462e70
mov edx, dword [ebp - 0x14]
mov dword [edx], vtable.RFKoll.1.0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 8]
mov edx, dword [ecx + 4]
mov eax, dword [ebp - 0x14]
mov dword [eax + edx + 8], vtable.RFKoll.0
mov ecx, dword [ebp - 0x14]
fld qword [ebp + 8]
fstp qword [ecx + 0x30]
mov edx, dword [ebp - 0x14]
fld qword [ebp + 0x10]
fstp qword [edx + 0x38]
mov eax, dword [ebp - 0x14]
add eax, 0x40
mov ecx, dword [ebp + 0x18]
mov dword [eax], ecx
mov edx, dword [ebp + 0x1c]
mov dword [eax + 4], edx
mov ecx, dword [ebp + 0x20]
mov dword [eax + 8], ecx
mov edx, dword [ebp + 0x24]
mov dword [eax + 0xc], edx
mov ecx, dword [ebp + 0x28]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp + 0x2c]
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 0x14]
fld qword [ebp + 0x30]
fstp qword [eax + 0x58]
mov ecx, dword [ebp - 0x14]
fld qword [ebp + 0x38]
fstp qword [ecx + 0x60]
mov edx, dword [ebp - 0x14]
add edx, 0x68
mov eax, dword [ebp + 0x40]
mov dword [edx], eax
mov ecx, dword [ebp + 0x44]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 0x48]
mov dword [edx + 8], eax
mov ecx, dword [ebp + 0x4c]
mov dword [edx + 0xc], ecx
mov eax, dword [ebp + 0x50]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp + 0x54]
mov dword [edx + 0x14], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x54
Function at 0x4d0b80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x530c67
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x5695e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0x38], 0
je 0x4d0bda
mov eax, dword [ebp - 0x14]
mov dword [eax + 8], 0x53e3a8
mov ecx, dword [ebp - 0x14]
add ecx, 0x78
call fcn.004be7f0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
or ecx, 1
mov dword [ebp - 0x10], ecx
push 0
mov ecx, dword [ebp - 0x14]
call fcn.00462e70
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x14]
mov dword [edx], vtable.RF.1.0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 8]
mov edx, dword [ecx + 4]
mov eax, dword [ebp - 0x14]
mov dword [eax + edx + 8], vtable.RF.0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x30], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x34], ecx
mov edx, dword [ebp - 0x14]
fld qword [ebp + 0x10]
fstp qword [edx + 0x38]
mov eax, dword [ebp - 0x14]
fld qword [ebp + 0x18]
fstp qword [eax + 0x40]
mov ecx, dword [ebp - 0x14]
add ecx, 0x48
mov edx, dword [ebp + 0x20]
mov dword [ecx], edx
mov eax, dword [ebp + 0x24]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 0x28]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 0x2c]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x58
call fcn.00428940
mov ecx, dword [ebp - 0x14]
fld qword [ebp + 0x30]
fstp qword [ecx + 0x70]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x34

Function at 0x4e4960
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
push esi
mov esi, dword [esp + 0x50]
mov bx, word [esp + 0x4c]
cmp bx, 4
mov word [esi], 0
jbe 0x4e4983
sub al, al
pop esi
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x38]
push 0x10
push eax
call fcn.004e45c0
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.004e4620
lea eax, [esp + 0x18]
push 0x10
push eax
call fcn.004e46e0
lea eax, [esp + 0x18]
push eax
call fcn.004e3fc0
add bl, 0x31
and eax, 0xffff
mov byte [esp + eax + 0x18], bl
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0xc]
push 0x10
push eax
lea eax, [esp + 0x24]
push 0x4e4950
push eax
lea eax, [esp + 0x3c]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
or eax, eax
je 0x4e4a34
lea eax, [esp + 8]
push 0x2c
push eax
call fcn.004e4930
or ax, ax
je 0x4e49fc
and eax, 0xffff
mov byte [esp + eax + 8], 0
cmp byte [esp + 8], 0x30
jne 0x4e4a20
mov al, byte [esp + 9]
and al, 0xdf
cmp al, 0x58
jne 0x4e4a20
lea eax, [esp + 0xa]
push esi
push eax
call fcn.004e40d0
or al, al
jne 0x4e4a34
jmp 0x4e4a2f
lea eax, [esp + 8]
push esi
push eax
call fcn.004e4020
or al, al
jne 0x4e4a34
mov word [esi], 0
mov ax, word [esi]
or ax, ax
je 0x4e4a4c
cmp ax, 0xffff
je 0x4e4a4c
mov al, 1
pop esi
pop ebx
add esp, 0x40
ret 8
sub al, al
pop esi
pop ebx
add esp, 0x40
ret 8
Function at 0x4e4a70
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
push esi
mov esi, dword [esp + 0x50]
mov bx, word [esp + 0x4c]
cmp bx, 4
mov word [esi], 0
jbe 0x4e4a93
sub al, al
pop esi
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x38]
push 0x10
push eax
call fcn.004e45c0
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.004e4620
lea eax, [esp + 0x18]
push 0x10
push eax
call fcn.004e46e0
lea eax, [esp + 0x18]
push eax
call fcn.004e3fc0
add bl, 0x31
and eax, 0xffff
mov byte [esp + eax + 0x18], bl
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0xc]
push 0x10
push eax
lea eax, [esp + 0x24]
push 0x4e4a60
push eax
lea eax, [esp + 0x3c]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
or eax, eax
je 0x4e4b44
lea eax, [esp + 8]
push 0x2c
push eax
call fcn.004e4930
or ax, ax
je 0x4e4b44
and eax, 0xffff
mov cl, byte [esp + eax + 9]
and cl, 0xdf
cmp cl, 0x54
jne 0x4e4b44
cmp byte [esp + eax + 0xa], 0x3a
jne 0x4e4b44
push esi
lea eax, [esp + eax + 0xf]
push eax
call fcn.004e4020
or al, al
jne 0x4e4b30
jmp 0x4e4b3f
mov ax, word [esi]
cmp ax, 1
jl 0x4e4b3f
cmp ax, 6
jle 0x4e4b44
mov word [esi], 0
cmp word [esi], 1
sbb al, al
inc al
pop esi
pop ebx
add esp, 0x40
ret 8

Function at 0x4e4b70
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x50
push esi
lea eax, [esp + 0x44]
push 0x10
push eax
call fcn.004e45c0
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.004e4620
lea eax, [esp + 0x34]
push 0x10
push eax
call fcn.004e47d0
lea eax, [esp + 4]
push 0x10
push eax
call fcn.004e4780
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x18]
push 0x10
push eax
lea eax, [esp + 0x40]
push 0x4e4b60
push eax
lea eax, [esp + 0x38]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
mov esi, eax
or esi, esi
je 0x4e4bdf
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 8]
push eax
call fcn.004e3e40
mov ecx, dword [esp + 0x5c]
mov byte [ecx], al
cmp esi, 1
sbb al, al
inc al
pop esi
add esp, 0x50
ret 8

Function at 0x4e4bf0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x30
lea eax, [esp + 0x20]
push 0x10
push eax
call fcn.004e45c0
lea eax, [esp]
push 0x10
push eax
call fcn.004e4620
lea eax, [esp + 0x10]
push 0x10
push eax
call fcn.004e4730
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x14]
push 0
push eax
lea eax, [esp + 0xc]
push eax
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov ecx, dword [esp + 0x34]
cmp eax, 1
mov word [ecx], ax
sbb cl, cl
inc cl
mov al, cl
add esp, 0x30
ret 4
Function at 0x4e4c60
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x70
push esi
mov esi, dword [esp + 0x78]
push 0x10
mov word [esi], 0
lea eax, [esp + 8]
push 0
push eax
call fcn.004e3fe0
lea eax, [esp + 0x64]
push 0x10
push eax
call fcn.004e45c0
lea eax, [esp + 0x44]
push 0x10
push eax
call fcn.004e4620
lea eax, [esp + 0x54]
push 0x10
push eax
call fcn.004e4680
lea eax, [esp + 0x34]
push 0x10
push eax
call fcn.004e4830
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.004e48e0
lea eax, [esp + 0x14]
push 0x10
push eax
call fcn.004e4890
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 8]
push 0x10
push eax
lea eax, [esp + 0x60]
push 0x4e4c50
push eax
lea eax, [esp + 0x58]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
or eax, eax
je 0x4e4d33
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 8]
push eax
call fcn.004e3e40
or al, al
je 0x4e4d01
mov word [esi], 2
jmp 0x4e4d33
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 8]
push eax
call fcn.004e3e40
or al, al
je 0x4e4d1b
mov word [esi], 3
jmp 0x4e4d33
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 8]
push eax
call fcn.004e3e40
or al, al
je 0x4e4d33
mov word [esi], 1
cmp word [esi], 1
sbb al, al
inc al
pop esi
add esp, 0x70
ret 4
Function at 0x4e4f20
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 4
push ebx
push esi
push edi
push ebp
mov esi, dword [esp + 0x18]
mov byte [esp + 0x13], 0
lea eax, [esi + 4]
mov edi, dword [esp + 0x1c]
mov dword [esi], eax
mov ax, word [edi + 4]
mov word [esi + 4], ax
mov ax, word [edi + 0xa]
mov word [esi + 6], ax
mov ax, word [edi + 0x14]
mov word [esi + 0x16], ax
mov ax, word [edi + 8]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
lea eax, [esi + 0x24]
mov dword [esi + 0x10], eax
lea eax, [esi + 4]
push eax
call fcn.004e4e20
or al, al
jne 0x4e50aa
test byte [edi + 0x1c], 4
je 0x4e4f83
mov byte [esp + 0x13], 1
sub cx, cx
sub dx, dx
lea esp, [esp]
mov ebp, ecx
and ebp, 0xffff
lea eax, [ebp*8]
sub eax, ebp
shl eax, 2
lea eax, [eax + eax*4]
lea ebx, [esi + eax]
lea eax, [ebp*4]
mov word [ebx + 0x36], cx
lea eax, [eax + eax*8]
lea ebp, [edi + eax]
mov ax, word [ebp + 0xe]
mov word [ebx + 0x9c], ax
mov ax, word [ebp + 0x12]
mov word [ebx + 0x8e], ax
mov ax, word [ebp + 0x16]
mov word [ebx + 0x34], ax
mov ax, word [ebp + 0x18]
mov word [ebx + 0x32], ax
mov eax, dword [ebp + 0x1c]
mov dword [ebx + 0x2c], eax
cmp cx, 3
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0x24]
mov dword [ebx + 0x28], eax
lea eax, [esi + 4]
mov dword [ebx + 0xa4], eax
jne 0x4e5010
mov dword [ebx + 0xa8], 0
jmp 0x4e501c
lea eax, [ebx + 0xb0]
mov dword [ebx + 0xa8], eax
or cx, cx
jne 0x4e5030
mov dword [ebx + 0xac], 0
jmp 0x4e5039
lea eax, [ebx - 0x68]
mov dword [ebx + 0xac], eax
cmp byte [esp + 0x13], 0
je 0x4e5050
cmp word [ebp + 0xe], 0xffff
jne 0x4e5050
or dword [ebx + 0x2c], 8
jmp 0x4e5056
mov word [ebx + 0x36], dx
inc dx
inc cx
cmp cx, 4
jb 0x4e4f90
push esi
call fcn.004e4e90
push esi
call fcn.004e4dd0
push esi
call fcn.004e4d90
mov eax, dword [esi + 0x10]
push eax
call fcn.004e6250
mov word [esi + 0xc], ax
or ax, ax
je 0x4e50a0
lea eax, [esi + 4]
push eax
call fcn.004e60a0
sub ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 8
push esi
call fcn.004e4d60
mov ax, 9
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 8

Function at 0x4e71a0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push esi
push edi
lea eax, [esp + 0xa]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
push eax
push esi
call fcn.004e50c0
mov eax, dword [esp + 0xc]
push 0xd
mov ax, word [eax + 4]
push eax
call fcn.004e6cd0
or al, al
jne 0x4e722a
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.004e7ac0
or al, al
jne 0x4e722a
mov eax, dword [esp + 0xc]
mov ax, word [eax + 0xa]
push eax
mov eax, dword [esp + 0x10]
mov al, byte [eax + 8]
push eax
mov eax, dword [esp + 0x14]
mov ax, word [eax + 6]
push eax
mov eax, dword [esp + 0x18]
mov ax, word [eax + 4]
push eax
mov eax, dword [esp + 0x20]
push eax
push esi
call fcn.004e7980
mov di, ax
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.004e7b10
or di, di
je 0x4e722a
mov ax, di
pop edi
pop esi
add esp, 0xc
ret 8