joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420732
Capabilities:
Delete file

Disassembly:
mov eax, 0x42cf6a
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x18
push ebx
push esi
push edi
mov esi, ecx
and dword [ebp - 4], 0
push 0xf
call sub.MFC42.DLL_operatornew
pop ecx
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 0x112
call sub.MFC42.DLL_operatornew
mov edi, eax
pop ecx
test edi, edi
je 0x4207bb
push dword [ebp - 0x10]
mov eax, dword [esi]
lea ecx, [ebp - 0x24]
push ecx
push edi
mov ecx, esi
call dword [eax + 0xe0]
mov bl, al
test bl, bl
je 0x4207b2
mov eax, dword [esi]
lea ecx, [ebp - 0x24]
push edi
push ecx
mov ecx, esi
call dword [eax + 0xec]
mov bl, al
test bl, bl
je 0x4207b2
push dword [ebp - 0x10]
mov eax, dword [esi]
lea ecx, [ebp - 0x24]
push ecx
mov ecx, esi
call dword [eax + 0xe4]
mov bl, al
push edi
call sub.MFC42.DLL_operatordelete
pop ecx
jmp 0x4207bd
xor bl, bl
mov eax, dword [esi + 0x12c]
add esi, 0x12c
test eax, eax
je 0x4207ff
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
and dword [esi], 0
pop ecx
lea eax, [ebp - 0x14]
mov ecx, 0x441ef8
push eax
call fcn.00413cc6
push dword [eax]
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCRT.dll_remove]
and byte [ebp - 4], 0
pop ecx
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
push dword [ebp - 0x10]
call sub.MFC42.DLL_operatordelete
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
pop edi
mov al, bl
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4

Function at 0x421e01
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0xf
call sub.MFC42.DLL_operatornew
pop ecx
mov edi, eax
push 7
push edi
push dword [esi + 0x17c]
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
mov dword [esi + 0x178], eax
test eax, eax
jle 0x421e9b
and byte [edi + 7], 0
push dword [esi + 0x178]
mov ecx, dword [esi + 0x1a0]
push edi
push 1
call fcn.0040c4ee
mov bl, al
test bl, bl
je 0x421e7b
push str.D000000
push edi
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x421e5f
mov bl, 1
jmp 0x421eba
lea eax, [edi + 3]
push eax
push str.MAINFRAME_JOB_ABENDED__RCODE___s__CONTACT_DDC
push dword [esi + 0x18c]
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
xor bl, bl
jmp 0x421eba
push str.download_rcode
push 0x43fdf0
push str._s_FILE_CONVERSION_ERROR__FIELD___s
push dword [esi + 0x18c]
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
jmp 0x421eba
push str.MAINFRAME_JOB_ABENDED__NO_RETURN_CODE__CONTACT_DDC
push dword [esi + 0x18c]
call dword [sym.imp.MSVCRT.dll_sprintf]
pop ecx
xor bl, bl
pop ecx
mov dword [esi + 0x178], 0x270f
push edi
call sub.MFC42.DLL_operatordelete
pop ecx
pop edi
mov al, bl
pop esi
pop ebx
ret
Function at 0x4223d6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov esi, ecx
push 0xf
mov byte [ebp - 1], 1
call sub.MFC42.DLL_operatornew
pop ecx
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
mov ecx, dword [esi + 0x194]
mov dword [ebp - 8], eax
add ecx, 6
push ecx
push str.6n4m_s.cal
push eax
call edi
mov ebx, dword [sym.imp.MSVCRT.dll__ftime]
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
call ebx
movzx eax, word [ebp - 0x18]
mov dword [ebp - 0xc], eax
pop ecx
fild dword [ebp - 0xc]
push dword [esi + 0x170]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fmul qword [0x431958]
fild dword [ebp - 0x1c]
push dword [esi + 0xc0]
fstp qword [ebp - 0x10]
fadd qword [ebp - 0x10]
push dword [esi + 0x17c]
fstp qword [esi + 0x160]
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
mov dword [esi + 0x178], eax
test eax, eax
jle 0x4224b2
fld qword [esi + 0x160]
lea eax, [ebp - 0x28]
fstp qword [ebp - 0x18]
push eax
call ebx
movzx eax, word [ebp - 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x170]
fild dword [ebp - 0xc]
pop ecx
mov ecx, dword [esi + 0xc0]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fmul qword [0x431958]
fild dword [ebp - 0x28]
fstp qword [ebp - 0x10]
fadd qword [ebp - 0x10]
fsub qword [ebp - 0x18]
fadd qword [esi + 0xd0]
fstp qword [esi + 0xd0]
and byte [eax + ecx], 0
jmp 0x4224d0
push 0x43fe20
push 0x43fe30
push str._s:_ERROR_READING__s
push dword [esi + 0x18c]
call edi
add esp, 0x10
and byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x4224e7
push 0
push 0x42
push dword [ebp - 8]
mov ecx, esi
call fcn.00421ec7
mov byte [ebp - 1], al
push dword [ebp - 8]
call sub.MFC42.DLL_operatordelete
mov al, byte [ebp - 1]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4224f8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov esi, ecx
push 0xf
mov byte [ebp - 1], 1
call sub.MFC42.DLL_operatornew
mov edi, dword [sym.imp.MSVCRT.dll_strncpy]
pop ecx
push 8
mov ebx, eax
push dword [esi + 0x194]
push ebx
call edi
mov byte [ebx + 8], 0x2e
mov eax, dword [esi + 0x194]
add esp, 0xc
add eax, 8
push 2
push eax
lea eax, [ebx + 9]
push eax
call edi
and byte [ebx + 0xb], 0
add esp, 0xc
push 0x25
push dword [esi + 0x188]
push dword [esi + 0xc0]
call edi
mov edi, dword [sym.imp.MSVCRT.dll__ftime]
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
call edi
movzx eax, word [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0xc0]
fild dword [ebp - 8]
pop ecx
add eax, 0x25
push dword [esi + 0x170]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fmul qword [0x431958]
fild dword [ebp - 0x18]
push eax
push dword [esi + 0x17c]
fstp qword [ebp - 0xc]
fadd qword [ebp - 0xc]
fstp qword [esi + 0x160]
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
mov dword [esi + 0x178], eax
test eax, eax
jle 0x422601
fld qword [esi + 0x160]
lea eax, [ebp - 0x24]
fstp qword [ebp - 0x14]
push eax
call edi
movzx eax, word [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x170]
fild dword [ebp - 8]
pop ecx
mov ecx, dword [esi + 0xc0]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fmul qword [0x431958]
fild dword [ebp - 0x24]
fstp qword [ebp - 0xc]
fadd qword [ebp - 0xc]
fsub qword [ebp - 0x14]
fadd qword [esi + 0xd0]
fstp qword [esi + 0xd0]
and byte [eax + ecx + 0x25], 0
jmp 0x422623
push 0x43fe3c
push 0x43fe4c
push str._s:_ERROR_READING__s
push dword [esi + 0x18c]
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
and byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x422638
push 1
push 0x43
push ebx
mov ecx, esi
call fcn.00421ec7
mov byte [ebp - 1], al
push ebx
call sub.MFC42.DLL_operatordelete
mov al, byte [ebp - 1]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4237d1
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x42d1e6
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x10c
push ebx
push esi
mov esi, ecx
push dword [esi + 0x170]
push dword [esi + 0xc0]
push dword [esi + 0x17c]
call dword [sym.imp.MSVCRT.dll__read]
lea ecx, [esi + 0x178]
add esp, 0xc
test eax, eax
mov dword [ecx], eax
jle 0x423857
mov eax, dword [esi + 0x170]
mov edx, dword [esi + 0xc0]
and byte [eax + edx], 0
push dword [ecx]
mov ecx, dword [esi + 0x1a0]
push dword [esi + 0xc0]
push 1
call fcn.0040c4ee
mov bl, al
test bl, bl
jne 0x42387b
push str.data_buffer
push 0x44008c
push str._s_FILE_CONVERSION_ERROR__FIELD___s
push dword [esi + 0x18c]
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
jmp 0x423877
push 0x440098
push 0x4400a8
push str._s:_ERROR_READING__s
push dword [esi + 0x18c]
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
xor bl, bl
test bl, bl
je 0x4238d0
lea eax, [ebp - 0x10]
mov ecx, 0x441ef8
push eax
call fcn.00403db2
and dword [ebp - 4], 0
push str.SCREEN._
push eax
lea eax, [ebp - 0x14]
push eax
call sub.MFC42.DLL_operator_2
push dword [eax]
lea eax, [ebp - 0x118]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 0x118]
mov ecx, esi
push eax
call fcn.00423ccf
mov bl, al
mov ecx, dword [ebp - 0xc]
mov al, bl
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x4238e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll__ftime]
push esi
lea eax, [ebp - 0x18]
push edi
mov esi, ecx
push eax
call ebx
movzx eax, word [ebp - 0x14]
mov dword [ebp - 8], eax
pop ecx
fild dword [ebp - 8]
push 0x25
push dword [esi + 0x188]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fmul qword [0x431958]
fild dword [ebp - 0x18]
push dword [esi + 0x17c]
fstp qword [ebp - 0xc]
fadd qword [ebp - 0xc]
fstp qword [esi + 0x160]
call dword [sym.imp.MSVCRT.dll__read]
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
test eax, eax
mov dword [esi + 0x178], eax
jle 0x423a05
fld qword [esi + 0x160]
lea eax, [ebp - 0x24]
fstp qword [ebp - 0x14]
push eax
call ebx
movzx eax, word [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x188]
fild dword [ebp - 8]
pop ecx
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fmul qword [0x431958]
fild dword [ebp - 0x24]
fstp qword [ebp - 0xc]
fadd qword [ebp - 0xc]
fsub qword [ebp - 0x14]
fadd qword [esi + 0xc8]
fstp qword [esi + 0xc8]
and byte [eax + 0x25], 0
push dword [esi + 0x178]
mov ecx, dword [esi + 0x1a0]
push dword [esi + 0x188]
push 1
call fcn.0040c4ee
test al, al
mov byte [ebp - 1], al
je 0x4239f4
push 3
lea ebx, [esi + 0x190]
push dword [esi + 0x188]
push dword [ebx]
call dword [sym.imp.MSVCRT.dll_strncpy]
mov eax, dword [ebx]
add esp, 0xc
lea ebx, [esi + 0x194]
and byte [eax + 3], 0
mov eax, dword [esi + 0x188]
add eax, 3
push 0xa
push eax
push dword [ebx]
call dword [sym.imp.MSVCRT.dll_strncpy]
mov eax, dword [ebx]
add esp, 0xc
and byte [eax + 0xa], 0
jmp 0x423a23
push str.header_data
push 0x4400cc
push str._s_FILE_CONVERSION_ERROR__FIELD___s
jmp 0x423a14
push 0x4400d8
push 0x4400e8
push str._s:_ERROR_READING__s
push dword [esi + 0x18c]
call edi
add esp, 0x10
and byte [ebp - 1], 0
cmp byte [ebp - 1], 0
mov ebx, str._s_INVALID_DOWNLOAD_RECORD_TYPE___s
je 0x423a92
mov eax, dword [esi + 0x190]
cmp byte [eax], 0x44
je 0x423a4f
push eax
push 0x4400f4
push ebx
push dword [esi + 0x18c]
call edi
add esp, 0x10
and byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x423a92
lea eax, [esi + 0x174]
push eax
mov eax, dword [esi + 0x190]
inc eax
push 0x440100
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0xc
cmp eax, 1
je 0x423a92
push dword [esi + 0x190]
push 0x440104
push ebx
push dword [esi + 0x18c]
call edi
add esp, 0x10
and byte [ebp - 1], 0
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x425c5c
Capabilities:
Delete file

Disassembly:
mov eax, 0x42d350
call sub.MSVCRT.dll__EH_prolog
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x14]
mov byte [ebp - 0xe], 1
call sub.MFC42.DLL_CString::CString_3
xor ebx, ebx
push 0x9c
mov dword [ebp - 4], ebx
call sub.MFC42.DLL_operatornew
pop ecx
mov ecx, eax
mov dword [ebp - 0x18], ecx
cmp ecx, ebx
mov byte [ebp - 4], 1
je 0x425ca0
call fcn.00403f2d
mov esi, eax
jmp 0x425ca2
xor esi, esi
mov ecx, esi
mov byte [ebp - 4], bl
call fcn.00404330
cmp esi, ebx
je 0x425db7
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
call fcn.00405fd1
push str.UnitTemp.txt
mov byte [ebp - 4], 2
push dword [eax]
lea eax, [ebp - 0x14]
push 0x44061c
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x10
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
mov eax, dword [edi + 0x18]
lea esi, [edi + 0x18]
push ebx
push 0x1002
push dword [ebp - 0x14]
mov ecx, esi
call dword [eax + 0x28]
test eax, eax
je 0x425d7d
mov al, byte [edi + 4]
lea ecx, [ebp - 0xd]
not al
inc al
push 1
and eax, 0xff
push ecx
mov byte [ebp - 0xd], al
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x40]
movsx ecx, word [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [esi]
push ecx
push edi
mov ecx, esi
call dword [eax + 0x40]
mov eax, dword [esi]
push ebx
push ebx
mov ecx, esi
call dword [eax + 0x30]
mov eax, dword [esi]
lea ecx, [ebp - 0xd]
push 1
push ecx
mov ecx, esi
call dword [eax + 0x3c]
mov dword [ebp + 0xc], ebx
cmp eax, ebx
jle 0x425d6b
movsx eax, word [ebp + 0xc]
mov cl, byte [ebp - 0xd]
push 1
mov byte [eax + edi], cl
mov eax, dword [esi]
lea ecx, [ebp - 0xd]
push ecx
mov ecx, esi
call dword [eax + 0x3c]
inc dword [ebp + 0xc]
jmp 0x425d4b
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x54]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x425dba
lea ecx, [ebp + 0xc]
call sub.MFC42.DLL_CString::CString_3
push dword [ebp - 0x14]
lea eax, [ebp + 0xc]
mov byte [ebp - 4], 3
push str.File__s_failed_to_open
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push ebx
push ebx
push dword [ebp + 0xc]
call sub.MFC42.DLL_AfxMessageBox_1
lea ecx, [ebp + 0xc]
mov byte [ebp - 0xe], bl
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
jmp 0x425dba
mov byte [ebp - 0xe], bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xe]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
Function at 0x426ab7
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x42d541
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x1c
and dword [ebp - 0x20], 0
push ebx
push edi
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString_3
push 1
lea ecx, [ebp - 0x18]
pop ebx
mov dword [ebp - 4], ebx
call sub.MFC42.DLL_CString::CString_3
mov al, byte [0x44247c]
lea edi, [ebp - 0x27]
mov byte [ebp - 0x28], al
xor eax, eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
mov al, byte [0x442480]
push 0x4408e4
mov byte [ebp - 0xd], al
lea eax, [ebp - 0x28]
push 6
push eax
lea eax, [ebp - 0xd]
mov byte [ebp - 4], 2
push eax
push str.Branch
push 0x4408f4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push 0x440908
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x14]
push 0x44090c
push eax
call sub.MFC42.DLL_CString::SpanExcluding
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call sub.MFC42.DLL_CString::operator_2
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x14]
cmp dword [eax - 8], 5
jg 0x426b6b
mov eax, dword [ebp - 0x18]
cmp dword [eax - 8], 0
je 0x426b78
push 0x440918
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::operator_1
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x426baf
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x42d57a
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x1c
and dword [ebp - 0x20], 0
push ebx
push edi
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString_3
push 1
lea ecx, [ebp - 0x18]
pop ebx
mov dword [ebp - 4], ebx
call sub.MFC42.DLL_CString::CString_3
mov al, byte [0x442484]
lea edi, [ebp - 0x27]
mov byte [ebp - 0x28], al
xor eax, eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
mov al, byte [0x442488]
push 0x440920
mov byte [ebp - 0xd], al
lea eax, [ebp - 0x28]
push 6
push eax
lea eax, [ebp - 0xd]
mov byte [ebp - 4], 2
push eax
push str.Dealer
push 0x440930
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push 0x440944
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x14]
push str.1234567890
push eax
call sub.MFC42.DLL_CString::SpanExcluding
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call sub.MFC42.DLL_CString::operator_2
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x14]
cmp dword [eax - 8], 5
jg 0x426c63
mov eax, dword [ebp - 0x18]
cmp dword [eax - 8], 0
je 0x426c70
push str.99999
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::operator_1
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x426fc1
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ax, word [0x44095c]
push 0x440964
mov word [ebp - 2], ax
mov ax, word [0x440960]
mov word [ebp - 4], ax
lea eax, [ebp - 2]
push 2
push eax
lea eax, [ebp - 4]
push eax
push str.DialUp_Check
push 0x44097c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 2]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
leave
ret
Function at 0x4299f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4320d0
push 0x429bac
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x4424d8], 0xffffffff
mov dword [0x4424dc], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x4424b8]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x4424b4]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x4424d4], ecx
call fcn.00429c00
mov eax, dword [0x441728]
test eax, eax
jne 0x429a81
push 0x429bf0
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.00429bd0
push 0x439048
push 0x439044
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x4424b0]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x4424ac]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x439040
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [sym.imp.MSVCRT.dll__acmdln]
mov esi, dword [edx]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x429b8f
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x429af5
cmp al, 0x22
jne 0x429ae7
cmp byte [esi], 0x22
jne 0x429afe
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x429b0e
cmp al, 0x20
ja 0x429b0e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x429afe
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x429b2f
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x429b34
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x429b74
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x429afe
inc esi
mov dword [ebp - 0x74], esi
jmp 0x429b8f
Function at 0x10004072
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100139b0]
jne 0x1000407c
repz ret
jmp fcn.10006d3c

Function at 0x10005459
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x100139f8]
je 0x10005474
inc edi
cmp edi, 0x17
jb 0x10005465
cmp edi, 0x17
jae 0x100055f4
push ebp
push 3
call fcn.1000aafd
cmp eax, 1
pop ecx
je 0x100055c0
push 3
call fcn.1000aafd
test eax, eax
pop ecx
jne 0x100054a8
cmp dword [0x10015408], 1
je 0x100055c0
cmp ebx, 0xfc
je 0x100055f3
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x10015418
push ebp
call fcn.1000a22b
add esp, 0xc
test eax, eax
je 0x100054de
push esi
push esi
push esi
push esi
push esi
call fcn.100082f7
add esp, 0x14
push 0x104
mov esi, 0x10015431
push esi
push 0
mov byte [0x10015535], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10005522
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.1000a22b
add esp, 0xc
test eax, eax
je 0x10005522
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.100082f7
add esp, 0x14
push esi
call fcn.1000a1a0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x10005567
push esi
call fcn.1000a1a0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x1001572c
push 0x1000facc
sub ecx, eax
push ecx
push eax
call fcn.1000aa4a
add esp, 0x14
test eax, eax
je 0x10005567
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.100082f7
add esp, 0x14
jmp 0x10005569
xor esi, esi
push 0x1000fac8
push ebx
push ebp
call fcn.1000a9d9
add esp, 0xc
test eax, eax
je 0x10005589
push esi
push esi
push esi
push esi
push esi
call fcn.100082f7
add esp, 0x14
push dword [edi*8 + 0x100139fc]
push ebx
push ebp
call fcn.1000a9d9
add esp, 0xc
test eax, eax
je 0x100055ab
push esi
push esi
push esi
push esi
push esi
call fcn.100082f7
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.1000a81c
add esp, 0xc
jmp 0x100055f3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x100055f3
cmp ebp, 0xffffffff
je 0x100055f3
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x100139fc]
push dword [esi]
call fcn.1000a1a0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret