joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4232d0
Capabilities:
Get common file path
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a864b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
push ebx
push ebp
mov ebx, ecx
push esi
lea edx, [esp + 0x1c]
push edi
mov al, byte [ebx + 0x34]
mov cl, byte [ebx + 0x157]
mov di, word [ebx + 0x160]
push edx
push 0x104
mov byte [esp + 0x1c], al
mov byte [esp + 0x20], cl
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
mov esi, dword [esp + 0x18]
and edi, 0xffff
and esi, 0xff
mov eax, dword [esp + 0x14]
imul esi, edi
and eax, 0xff
mov ebp, dword [esp + 0x134]
imul esi, eax
mov ecx, esi
xor eax, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
lea edx, [esp + 0x10]
and ecx, 3
mov dword [esp + 0x12c], 0
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
lea ecx, [esp + 0x20]
push eax
push ecx
push str._sIBBT__02X.BIN
push edx
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x20]
add esp, 0x10
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x1c]
push 0
push ecx
mov edi, eax
push esi
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x10]
mov dword [esp + 0x12c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x120
ret 4
Function at 0x425aa0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, ecx
xor bl, bl
mov cl, byte [esp + 0x1c]
push edi
mov eax, dword [esi + 0x1026c]
mov dl, byte [esi + 0x166]
and cl, 0xf
mov byte [esp + 0x13], dl
test eax, eax
mov byte [esp + 0x20], cl
mov byte [esp + 0x14], bl
jne 0x425ae2
mov ecx, 0x20
or eax, 0xffffffff
mov edi, ebp
rep stosd dword es:[edi], eax
mov cl, byte [esp + 0x20]
mov eax, dword [esi + 0x1026c]
test eax, eax
je 0x425b29
xor cx, cx
xor bl, bl
mov cl, dl
xor eax, eax
test cx, cx
jbe 0x425c45
mov edx, 0xffff
mov edi, eax
and edi, edx
cmp word [esi + edi*2 + 0x10272], dx
je 0x425c45
inc bl
inc eax
cmp ax, cx
jb 0x425b03
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
add esp, 8
ret 0xc
mov al, byte [esp + 0x1c]
cmp al, 2
jne 0x425b92
mov al, byte [esi + 0x157]
xor cl, cl
test dl, dl
mov byte [esp + 0x1c], al
jbe 0x425c45
mov edi, dword [esp + 0x1c]
and edi, 0xff
xor esi, esi
mov eax, esi
cdq
idiv edi
mov al, byte [esp + 0x20]
test byte [edx + 0x4b75a4], al
je 0x425b7b
mov eax, dword [esp + 0x14]
xor dx, dx
and eax, 0xff
mov dl, cl
inc bl
mov word [ebp + eax*2], dx
mov byte [esp + 0x14], bl
mov al, byte [esp + 0x13]
inc cl
inc esi
cmp cl, al
jb 0x425b51
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp al, 4
jne 0x425c1f
xor al, al
test dl, dl
jbe 0x425c45
cmp cl, 1
jne 0x425baf
test cl, al
jne 0x425c0d
jmp 0x425bb8
cmp cl, 2
jne 0x425bd3
test al, 1
je 0x425c0d
mov edi, dword [esp + 0x14]
movzx si, al
and edi, 0xff
inc bl
mov byte [esp + 0x14], bl
mov word [ebp + edi*2], si
jmp 0x425c0d
cmp cl, 4
jne 0x425be2
mov cl, dl
shr cl, 1
cmp al, cl
jae 0x425c09
jmp 0x425bef
cmp cl, 8
jne 0x425c0d
mov cl, dl
shr cl, 1
cmp al, cl
jb 0x425c09
mov esi, dword [esp + 0x14]
xor cx, cx
and esi, 0xff
mov cl, al
inc bl
mov word [ebp + esi*2], cx
mov byte [esp + 0x14], bl
mov cl, byte [esp + 0x20]
inc al
cmp al, dl
jb 0x425ba4
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
add esp, 8
ret 0xc
xor al, al
test dl, dl
jbe 0x425c45
mov esi, dword [esp + 0x14]
xor cx, cx
and esi, 0xff
mov cl, al
inc bl
inc al
cmp al, dl
mov word [ebp + esi*2], cx
mov byte [esp + 0x14], bl
jb 0x425c25
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x428f10
Capabilities:
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a86c8
push eax
mov dword fs:[0], esp
push esi
push edi
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
push 0
push 0x80
push 3
push 0
push 1
and esi, 0xff
push 0x80000000
push eax
shl esi, 9
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x428f7a
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], eax
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0xc
ret 0xc
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
push 0
push ecx
push esi
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 8]
pop edi
mov eax, 1
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 0xc
Function at 0x42dfd0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4a8836
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
push edi
mov edi, dword [esp + 0x24]
mov esi, ecx
push edi
push eax
mov dword [esp + 0x14], esi
call fcn.00414cb0
xor ebx, ebx
lea ecx, [esi + 0x120]
mov dword [esp + 0x18], ebx
call fcn.00457db0
mov eax, 1
mov dword [esi], 0x4bb8d8
mov dword [esi + 0x854], eax
mov dword [esi + 0x858], eax
mov dword [esi + 0x2de0], ebx
mov byte [esi + 0x2de4], 0xff
mov ecx, dword [0x4e5bb8]
mov byte [esp + 0x18], al
push ecx
push ebx
push str.UseOldId
push str.Scan
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov byte [esi + 0x85c], al
mov dword [esi + 0x3490], ebx
mov dword [esi + 0x3498], ebx
mov byte [esi + 0x2a99], bl
mov byte [esi + 0x85e], 0xff
mov dl, byte [edi + 0x3f7]
neg dl
sbb dl, dl
mov ecx, esi
and edx, 0xff
mov byte [esi + 0x3484], dl
call fcn.0042e270
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x42f010
Capabilities:
Read .ini file

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x98]
cmp eax, 0xfffffffd
jne 0x42f028
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret
mov ecx, dword [0x4e6100]
mov dl, byte [esi + 0x24]
push ecx
push eax
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x4e60d8
call fcn.004a57ee
lea ecx, [esi + 0x120]
call fcn.00457e30
push str.FlashList.ini
lea eax, [esp + 0x10]
push 0x4e60d8
push eax
call sub.MFC42.DLL_operator_1
mov eax, dword [eax]
mov ecx, dword [esi + 0x124]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea edi, [esi + 0x124]
push eax
push 0
push str.DrivingLevel_6990
push ecx
call ebx
lea ecx, [esp + 0xc]
mov byte [esi + 0x178], al
call sub.MFC42.DLL_CString::CString
push str.FlashList.ini
lea ecx, [esp + 0x10]
push 0x4e60d8
push ecx
call sub.MFC42.DLL_operator_1
mov eax, dword [eax]
mov ecx, dword [edi]
push eax
push 0
push str.DrivingLevel_6998
push ecx
call ebx
lea ecx, [esp + 0xc]
mov byte [esi + 0x17a], al
call sub.MFC42.DLL_CString::CString
push str.FlashList.ini
lea edx, [esp + 0x10]
push 0x4e60d8
push edx
call sub.MFC42.DLL_operator_1
mov eax, dword [eax]
mov ecx, dword [edi]
push eax
push 0
push str.DrivingLevel_6913
push ecx
call ebx
lea ecx, [esp + 0xc]
mov byte [esi + 0x179], al
call sub.MFC42.DLL_CString::CString
push str.FlashList.ini
lea eax, [esp + 0x10]
push 0x4e60d8
push eax
call sub.MFC42.DLL_operator_1
mov eax, dword [eax]
mov ecx, dword [edi]
push eax
push 0
push str.DrivingLevel_6921
push ecx
call ebx
lea ecx, [esp + 0xc]
mov byte [esi + 0x17b], al
call sub.MFC42.DLL_CString::CString
cmp byte [esi + 0x34], 8
jb 0x42f14a
mov al, byte [esi + 0x134]
cmp al, 3
jbe 0x42f13f
and eax, 0xff
jmp 0x42f144
mov eax, 3
mov byte [esi + 0x134], al
mov edx, dword [esi + 8]
mov cl, byte [edx + 0x58]
test cl, cl
je 0x42f15f
mov al, byte [esi + 0x140]
imul cl
mov byte [esi + 0x34], al
mov al, byte [esi + 0x140]
mov cl, byte [esi + 0x34]
cmp al, cl
ja 0x42f16e
mov al, cl
mov byte [esi + 0x34], al
mov al, byte [edx + 0x59]
cmp al, 2
jne 0x42f181
mov byte [esi + 0xa0], 1
jmp 0x42f18c
cmp al, 1
jne 0x42f18c
mov byte [esi + 0xa0], 0
push edi
lea ecx, [esi + 0x9c]
call fcn.004a5776
mov ecx, dword [esi + 8]
mov al, byte [ecx + 0x95]
cmp al, 0xff
jne 0x42f1bb
mov dl, byte [esi + 0x157]
mov eax, 1
mov byte [esi + 0x2a99], dl
pop edi
pop esi
pop ebx
pop ecx
ret
mov byte [esi + 0x2a99], al
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x432c70
Capabilities:
Read .ini file

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push 2
push 0
mov esi, ecx
push edi
call fcn.00431a80
mov eax, dword [0x4e5bb8]
push eax
push 0x14
push str.AA55
push str.Scan
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov byte [esp + 0xc], al
push 0
mov ecx, dword [esp + 0x10]
push 1
push edi
push ecx
mov ecx, esi
call fcn.004341c0
pop edi
mov eax, 1
pop esi
ret 4
Function at 0x436be0
Capabilities:
Get common file path
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a8c8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
push ebx
mov ebx, ecx
push ebp
push esi
mov al, byte [ebx + 0x34]
lea ecx, [esp + 0x1c]
push edi
mov edi, dword [ebx + 0x16c]
push ecx
push 0x104
mov byte [esp + 0x1c], al
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x134]
and esi, 0xff
xor eax, eax
imul esi, edi
mov ecx, esi
mov edi, ebp
mov edx, ecx
mov dword [esp + 0x12c], 0
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
lea edx, [esp + 0x10]
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
lea ecx, [esp + 0x20]
push eax
push ecx
push str._sIBBT__02X.BIN
push edx
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x20]
add esp, 0x10
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x436cb0
lea ecx, [esp + 0x14]
push 0x4d8340
push ecx
mov dword [esp + 0x1c], 0xc0000
call sub.MSVCRT.dll__CxxThrowException
lea edx, [esp + 0x1c]
push 0
push edx
push esi
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x436cdb
lea eax, [esp + 0x18]
push 0x4d8340
push eax
mov dword [esp + 0x20], 0xc0000
call sub.MSVCRT.dll__CxxThrowException
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x10]
mov dword [esp + 0x12c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x120
ret 4
Function at 0x440170
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb920
push 0x4a5d66
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 0xffffffff
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
mov dword [ebp - 0x20], ebx
cmp ebx, 0xffffffff
jne 0x4401d5
mov dword [ebp - 0x24], esi
jmp 0x4402a6
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x34], eax
lea edi, [eax + 0x200]
mov dword [ebp - 0x2c], edi
push edi
call sub.MFC42.DLL_operatornew
add esp, 4
mov esi, eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x1c], esi
mov ecx, edi
xor eax, eax
mov edi, esi
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
push 0
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x440229
mov dword [ebp - 0x24], eax
jmp 0x4402a6
mov dword [ebp - 0x3c], esi
mov esi, dword [ebp + 0xc]
and esi, 0xff
shl esi, 9
mov dword [ebp - 0x28], esi
mov ecx, esi
xor eax, eax
mov edi, dword [ebp + 0x10]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor edi, edi
mov dword [ebp - 0x38], edi
xor ebx, ebx
mov dword [ebp - 0x30], ebx
cmp ebx, esi
jae 0x4402a3
mov eax, dword [ebp + 0x10]
lea ecx, [ebx + eax]
push ecx
push str._2hx
mov edx, dword [ebp - 0x3c]
push edx
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0xc
inc ebx
mov dword [ebp - 0x30], ebx
mov eax, 2
mov ecx, dword [ebp - 0x3c]
add ecx, eax
mov dword [ebp - 0x3c], ecx
add edi, eax
mov dword [ebp - 0x38], edi
test bl, 0xf
jne 0x44029e
mov edx, ecx
add edx, eax
mov dword [ebp - 0x3c], edx
add edi, eax
mov dword [ebp - 0x38], edi
cmp edi, dword [ebp - 0x2c]
jb 0x44025a
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
call fcn.004402cb
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4402f0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb930
push 0x4a5d66
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
xor ebx, ebx
mov byte [ebp - 0x20], bl
or edi, 0xffffffff
mov dword [ebp - 0x24], edi
mov dword [ebp - 4], ebx
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x24], esi
cmp esi, edi
je 0x440383
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x34], eax
lea ecx, [eax + 0x200]
mov dword [ebp - 0x2c], ecx
xor edx, edx
mov dword [ebp - 0x28], edx
xor ecx, ecx
mov dword [ebp - 0x30], ecx
cmp ecx, eax
jae 0x44037a
add ecx, 2
mov dword [ebp - 0x30], ecx
inc edx
mov dword [ebp - 0x28], edx
test dl, 0xf
jne 0x440362
add ecx, 2
jmp 0x44035f
lea ebx, [edx + 0x1ff]
shr ebx, 9
mov byte [ebp - 0x20], bl
mov dword [ebp - 4], edi
call fcn.004403a9
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x449dc0
Capabilities:
Contain obfuscated stackstrings
Read .ini file

Disassembly:
sub esp, 0x18
push esi
mov esi, ecx
mov al, 5
mov byte [esp + 0x14], 0x50
mov ecx, dword [esi + 8]
mov byte [esp + 0x15], 0x40
mov byte [esp + 0x16], 0x20
mov byte [esp + 0x17], 0x10
mov dl, byte [ecx + 0x5a]
mov byte [esp + 0x18], 0
cmp dl, al
mov byte [esp + 0x19], 0
mov byte [esp + 0x1a], 0x60
mov byte [esp + 0x1b], 0x30
mov byte [esp + 0xc], 0x19
mov byte [esp + 0xd], 0x21
mov byte [esp + 0xe], 0x32
mov byte [esp + 0xf], 0x42
mov byte [esp + 0x10], 0x85
mov byte [esp + 0x11], 0
mov byte [esp + 0x12], 0x14
mov byte [esp + 0x13], 0x29
mov byte [esp + 8], al
jne 0x449e32
mov cl, byte [esi + 0x134]
mov byte [esp + 4], cl
jmp 0x449e36
mov byte [esp + 4], dl
mov ecx, dword [esi + 0x3a0]
test ecx, ecx
je 0x449e5f
mov al, byte [ecx + 0x10]
cmp al, 5
jne 0x449e4d
mov al, byte [esi + 0x134]
cmp al, 8
mov byte [esp + 8], al
jb 0x449e5f
mov al, byte [esi + 0x134]
mov byte [esp + 8], al
cmp dl, 5
jne 0x449e86
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
and edx, 0xff
and ecx, 0xff
mov dl, byte [esp + edx + 0xc]
cmp dl, byte [esp + ecx + 0xc]
jbe 0x449e86
mov byte [esp + 4], al
mov eax, dword [0x4e5bb8]
push eax
push 0
push str.NoForce66NS
push 0x4df17c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp byte [esi + 0x156], 1
jne 0x449ef4
mov ecx, dword [esi + 0x110]
test ch, 4
je 0x449ef4
test al, al
jne 0x449ef4
mov ax, word [esi + 0x26]
cmp ax, 0xcd03
je 0x449ede
cmp ax, 0xcf02
je 0x449ede
cmp ax, 0xe001
je 0x449ede
cmp ax, 0xe101
je 0x449ede
cmp ax, 0xe102
je 0x449ede
cmp ax, 0xe103
jne 0x449ef4
mov ecx, dword [esp + 4]
and ecx, 0xff
cmp byte [esp + ecx + 0xc], 0x29
ja 0x449ef4
mov byte [esp + 4], 7
mov ecx, dword [esp + 4]
and ecx, 0xff
mov dl, byte [esp + ecx + 0xc]
mov al, byte [esp + ecx + 0x14]
cmp dl, 0x14
jne 0x449f24
test byte [esi + 0x110], 8
jne 0x449f2d
mov edx, dword [esp + 0x20]
pop esi
mov word [edx], 0x133
add esp, 0x18
ret 4
mov ecx, dword [esp + 0x20]
mov word [ecx], 0
pop esi
add esp, 0x18
ret 4
Function at 0x44dac0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x2a08
call fcn.004a5b80
push ebx
push ebp
push esi
mov esi, ecx
lea ecx, [esp + 0x214]
push edi
mov bl, byte [esi + 0x24]
push ecx
cmp bl, 0x86
setne al
dec eax
and eax, 0x10
add eax, 4
mov byte [esp + 0x14], al
mov eax, dword [esp + 0x14]
mov edx, eax
and edx, 0xff
push edx
push 0
push 0
push 0
push 0
push eax
mov eax, dword [esi + 0x1c]
push 0
push 0x11
push 0xfa
push eax
call fcn.00482460
add esp, 0x2c
test eax, eax
je 0x44dc76
mov al, byte [esi + 0x24]
mov cl, al
sub cl, 0x86
neg cl
sbb ecx, ecx
and ecx, 0xffffe07a
add ecx, 0x2680
cmp al, 0x92
jne 0x44dbd8
xor bl, bl
mov word [esp + 0x14], 0x7f0
mov word [esp + 0x16], 0x7fa
mov dl, 1
mov byte [esp + 0x10], bl
mov ecx, dword [esp + 0x10]
xor eax, eax
and ecx, 0xff
mov ax, word [esp + ecx*2 + 0x14]
movzx cx, byte [esp + eax + 0x21a]
movzx si, byte [esp + eax + 0x21b]
shl ecx, 8
add ecx, esi
mov esi, ecx
and esi, 0xffff
and esi, 0x8000001f
jns 0x44db92
dec esi
or esi, 0xffffffe0
inc esi
jne 0x44dbba
movzx si, byte [esp + eax + 0x218]
movzx ax, byte [esp + eax + 0x219]
shl esi, 8
add esi, eax
lea eax, [ecx - 1]
not eax
cmp si, ax
jne 0x44dbba
test cx, cx
ja 0x44dbc7
inc bl
cmp bl, 2
mov byte [esp + 0x10], bl
jb 0x44db55
jmp 0x44dbc9
mov dl, bl
neg dl
sbb edx, edx
and edx, 0xa
add edx, 0x6f0
mov ecx, edx
lea esi, [esp + ecx + 0x218]
mov ecx, 0x60
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov al, byte [esp + 0x10f]
mov cl, byte [esp + 0xe0]
mov dl, byte [esp + 0x9a]
add al, cl
mov cl, byte [esp + 0xb5]
mov bl, al
add bl, cl
add cl, dl
add bl, dl
cmp cl, al
mov byte [esp + 0x10], bl
mov dl, cl
ja 0x44dc1c
mov dl, al
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x2a20]
and ecx, 0xff
lea edi, [esp + 0x18]
xor ebp, ebp
lea esi, [esp + ecx + 0x218]
mov ecx, 0x80
test eax, eax
rep movsd dword es:[edi], dword [esi]
jbe 0x44dc76
mov ecx, dword [esp + 0x2a1c]
lea esi, [esp + 0x18]
lea eax, [ecx + ebp]
mov edi, 0x200
mov bl, byte [eax]
xor bl, dl
xor bl, byte [esi]
inc esi
mov byte [eax], bl
inc eax
dec edi
jne 0x44dc58
mov eax, dword [esp + 0x2a20]
add ebp, 0x200
cmp ebp, eax
jb 0x44dc4c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a08
ret 8
Function at 0x44e8c0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [0x4e5bb8]
push eax
push 0
push str.L63BCycleTime
push str.Scan
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
and eax, 0xff
lea eax, [eax + eax*2]
lea ecx, [eax + eax*4]
mov eax, 0x10624dd3
shl ecx, 0xc
imul ecx
mov eax, edx
sar eax, 8
mov ecx, eax
shr ecx, 0x1f
add eax, ecx
ret

Function at 0x44e9a0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [0x4e5bb8]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push eax
push 0xff
push str.LlfDeletePage
mov esi, ecx
push str.Debug
call edi
cmp al, 0xff
je 0x44e9d3
xor ecx, ecx
pop edi
test al, al
setne cl
mov eax, ecx
pop esi
ret 4
mov edx, dword [0x4e5bb8]
push edx
push 0
push str.SetSortClass
push str.Debug
call edi
test eax, eax
je 0x44e9f3
pop edi
xor eax, eax
pop esi
ret 4
mov al, byte [esi + 0x12e]
test al, al
je 0x44ea04
pop edi
xor eax, eax
pop esi
ret 4
test byte [esi + 0x839], 0x8a
jne 0x44ea14
pop edi
xor eax, eax
pop esi
ret 4
test byte [esp + 0xc], 0xf
je 0x44ea22
pop edi
xor eax, eax
pop esi
ret 4
mov al, byte [esi + 0xf2]
cmp al, 8
je 0x44ea39
test byte [esi + 0xf1], 4
je 0x44ea44
cmp al, 8
jne 0x44ea4b
mov ecx, esi
call fcn.00447230
test eax, eax
jne 0x44ea4b
pop edi
xor eax, eax
pop esi
ret 4
mov al, byte [esi + 0x152]
cmp al, 0xa
jne 0x44ea5f
mov cl, byte [esi + 0x156]
test cl, cl
je 0x44ea70
cmp al, 8
jne 0x44ea77
mov eax, dword [esi + 8]
mov cl, byte [eax + 0x9f]
test cl, cl
jne 0x44ea77
pop edi
xor eax, eax
pop esi
ret 4
push str.GVX7
lea ecx, [esi + 0x124]
call sub.MFC42.DLL_CString::Find_1
cmp eax, 0xffffffff
je 0x44ea9d
mov eax, dword [esi + 0x5630]
test eax, eax
je 0x44ea9d
pop edi
xor eax, eax
pop esi
ret 4
mov ecx, dword [esi + 0x5834]
xor eax, eax
test ecx, ecx
pop edi
pop esi
sete al
ret 4
Function at 0x457470
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x10008
call fcn.004a5b80
mov eax, dword [0x4e5d88]
push ebx
push ebp
push esi
test eax, eax
push edi
mov ebx, ecx
jbe 0x45764b
mov edx, dword [0x4e5c94]
mov eax, dword [edx - 8]
test eax, eax
je 0x45764b
mov ecx, 0x4000
xor eax, eax
lea edi, [esp + 0x18]
push 0x4e25bc
rep stosd dword es:[edi], eax
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 0x10], edi
jne 0x457508
lea eax, [ebx + 0xbc]
push str.image_file_open_fail
push eax
call sub.MFC42.DLL_CString::Format
mov ecx, dword [ebx + 4]
mov edx, dword [0x4e60fc]
add esp, 8
push 8
push ecx
push 0x40c
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10008
ret
mov esi, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push 0
push edi
call esi
push edi
call dword [sym.imp.MSVCRT.dll_ftell]
cdq
and edx, 0x1ff
push 0
add eax, edx
push 0
mov ebp, eax
push edi
sar ebp, 9
call esi
mov eax, dword [0x4e5d88]
add esp, 0x1c
shl eax, 0xb
cmp eax, ebp
je 0x45758d
lea ecx, [ebx + 0xbc]
push str.Image_file_beyond_reserve_size
push ecx
call sub.MFC42.DLL_CString::Format
mov edx, dword [ebx + 4]
mov eax, dword [0x4e60fc]
add esp, 8
push 8
push edx
push 0x40c
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10008
ret
lea eax, [ebx + 0xbc]
push str.Writing_image_to_UFD...
push eax
xor esi, esi
call sub.MFC42.DLL_CString::Format
mov ecx, dword [ebx + 4]
mov edx, dword [0x4e60fc]
add esp, 8
push esi
push ecx
push 0x40c
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
test ebp, ebp
mov dword [esp + 0x14], esi
jbe 0x457641
push edi
push 0x80
lea eax, [esp + 0x20]
push 0x200
push eax
call dword [sym.imp.MSVCRT.dll_fread]
mov edx, dword [ebx + 0x1c]
add esp, 0x10
lea ecx, [esp + 0x18]
mov edi, eax
push ecx
push edi
push esi
push edx
mov ecx, ebx
call fcn.00457410
test eax, eax
je 0x45765b
add esi, edi
xor edx, edx
lea eax, [esi + esi*4]
lea eax, [eax + eax*4]
shl eax, 2
div ebp
push eax
lea eax, [ebx + 0xbc]
push str.Writing_image_to_UFD_d__
push eax
call sub.MFC42.DLL_CString::Format
mov eax, dword [ebx + 4]
mov ecx, dword [0x4e60fc]
add esp, 0xc
push 0
push eax
push 0x40c
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esp + 0x14]
add eax, edi
mov edi, dword [esp + 0x10]
cmp eax, ebp
mov dword [esp + 0x14], eax
jb 0x4575c2
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10008
ret
lea eax, [ebx + 0xbc]
push str.Write_file_to_UFD_failed
push eax
call sub.MFC42.DLL_CString::Format
mov edx, dword [ebx + 4]
mov eax, dword [0x4e60fc]
add esp, 8
push 8
push edx
push 0x40c
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10008
ret