joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43dff0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50722e
mov eax, dword fs:[0]
push eax
mov eax, 0x1130
call fcn.00501db0
mov eax, dword [0x55f43c]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1138], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov dword [ebp - 4], 0
push 0
push 0x51d17c
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
jle 0x43e05b
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [0x55f9c0], eax
push 0
call fcn.00501b42
test eax, eax
jne 0x43e096
push 0xffffffffffffffff
push 0
push 0x67
call sub.mfc100.dll_Ordinal_1981
mov dword [ebp - 0x1120], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov eax, dword [ebp - 0x1120]
jmp 0x43e229
push 0
call sub.mfc100.dll_Ordinal_1890
add esp, 4
mov ecx, dword [ebp - 0x1138]
call fcn.0043dd10
test eax, eax
jne 0x43e0d4
mov dword [ebp - 0x1124], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov eax, dword [ebp - 0x1124]
jmp 0x43e229
mov ecx, dword [ebp - 0x1138]
call fcn.0043d530
call sub.mfc100.dll_Ordinal_1951
push 0x5002d7
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
push 0
push 0x51d180
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
jle 0x43e1ba
push 0x10fc
call fcn.004319d0
mov dword [ebp - 0x112c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x112c], 0
je 0x43e149
push 0
mov ecx, dword [ebp - 0x112c]
call fcn.0043eab0
mov dword [ebp - 0x113c], eax
jmp 0x43e153
mov dword [ebp - 0x113c], 0
mov eax, dword [ebp - 0x113c]
mov dword [ebp - 0x1128], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x1128]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x1138]
mov eax, dword [ebp - 0x14]
mov dword [edx + 0x20], eax
push 0
push 0x66
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
mov eax, dword [edx + 0x16c]
call eax
push 0
mov ecx, dword [ebp - 0x14]
call sub.mfc100.dll_Ordinal_12962
mov dword [ebp - 0x1130], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov eax, dword [ebp - 0x1130]
jmp 0x43e229
push 0
lea ecx, [ebp - 0x111c]
call fcn.0043eab0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1138]
lea edx, [ebp - 0x111c]
mov dword [ecx + 0x20], edx
lea ecx, [ebp - 0x111c]
call sub.mfc100.dll_Ordinal_3620
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1134], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x111c]
call fcn.0043e3e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov eax, dword [ebp - 0x1134]
jmp 0x43e229
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00501b98
mov esp, ebp
pop ebp
ret
Function at 0x43e250
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0
push 4
push 0
call dword [sym.imp.MSVCR100.dll___iob_func]
add eax, 0x20
push eax
call dword [sym.imp.MSVCR100.dll_setvbuf]
add esp, 0x10
push 0
push 4
push 0
call dword [sym.imp.MSVCR100.dll___iob_func]
push eax
call dword [sym.imp.MSVCR100.dll_setvbuf]
add esp, 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.00501b5c
pop ebp
ret
Function at 0x441c70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x507a55
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x55f43c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.MMPT_encounter_error_in_CMMPTDlg::ThreadInitMicl__.
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov dword [ebp - 4], 0
push 0x10
push 0x51dc38
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x3da
push 0x51dc44
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.mfc100.dll_Ordinal_300]
mov dword [ebp - 0x1c], eax
push 1
push 0x63
call sub.Micl.dll_MiclAddDebugLogString
add esp, 0x14
call sub.Micl.dll_MiclStopDebugLogger
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x442d30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push 0x442d90
call sub.mfc100.dll_Ordinal_1854
mov dword [ebp - 4], eax
push 0xbb8
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 8]
call fcn.004718e0
test eax, eax
jne 0x442d77
mov dword [ebp + 8], 0xffffffff
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esp, ebp
pop ebp
ret 4
Function at 0x44aaa0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x508761
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x55f43c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x634], 0
je 0x44aaeb
mov ecx, dword [ebp - 0x20]
call fcn.00452900
test eax, eax
jne 0x44aafd
push str.Script_running_thread_already_exit.
call sub.Micl.dll_MiclSendDlgMessage
add esp, 4
jmp 0x44abdb
push str.Wait_for_script_running_thread_finished...
call sub.Micl.dll_MiclSendDlgMessage
add esp, 4
push 0x2710
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x634]
mov eax, dword [edx + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 0
je 0x44abc4
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_316]
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
push ecx
push str.Wait_for_script_running_thread_finished_timout__Kill_it_GetLastError_d_...
lea edx, [ebp - 0x18]
push edx
call dword [sym.imp.mfc100.dll_Ordinal_4283]
add esp, 0xc
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call sub.Micl.dll_MiclSendDlgMessage
add esp, 4
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x634], 0
je 0x44abb4
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x634]
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
cmp eax, 1
jne 0x44abb4
push 0xffffffffffffffff
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x634]
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 0
mov ecx, dword [ebp - 0x20]
call fcn.00452920
push str.Script_running_thread_is_finished.
call sub.Micl.dll_MiclSendDlgMessage
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x451f40
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x100
jne 0x451fc4
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0xd
je 0x451f72
cmp dword [ebp - 8], 0x1b
je 0x451fb3
cmp dword [ebp - 8], 0x74
je 0x451fba
jmp 0x451fc4
push 0
push 0xffffffffffffffff
push 0
push 0x3f7
mov ecx, dword [ebp - 4]
call sub.mfc100.dll_Ordinal_4785
mov ecx, eax
call fcn.004592a0
push 0x3e7
mov ecx, dword [ebp - 4]
call sub.mfc100.dll_Ordinal_4785
mov ecx, eax
call sub.mfc100.dll_Ordinal_7474
test eax, eax
je 0x451fac
mov ecx, dword [ebp - 4]
call fcn.0044d440
mov eax, 1
jmp 0x452000
mov eax, 1
jmp 0x452000
push 1
mov ecx, dword [ebp - 4]
call fcn.00458dd0
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x100
jne 0x451ff4
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0x45
jne 0x451ff4
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x451ff4
mov ecx, dword [ebp - 4]
call fcn.004730b0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call sub.mfc100.dll_Ordinal_11107
mov esp, ebp
pop ebp
ret 4

Function at 0x452640
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push str.Please_wait_to_update_DB...
call sub.Micl.dll_MiclSendDlgMessage
add esp, 4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x55fbec], eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0x452520
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
mov edx, dword [ebp - 0xc]
push edx
push 0x452570
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x454710
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
cmp dword [ebp + 8], 0
jne 0x454726
xor eax, eax
jmp 0x454837
mov ecx, dword [ebp + 8]
call fcn.00460f00
mov eax, dword [ebp + 0x10]
push eax
movzx ecx, word [ebp + 0xc]
push ecx
call fcn.00458430
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x454753
xor eax, eax
jmp 0x454837
mov edx, dword [ebp - 0x28]
push edx
call fcn.00458430
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x45477d
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
jmp 0x454837
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x24], eax
mov dword [ebp - 8], 0
mov edx, dword [ebp - 0x28]
push edx
call fcn.00458430
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call sub.MSVCR100.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp - 8]
push eax
push 1
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x454803
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp + 8]
call fcn.004612f0
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ecx + 8]
call eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4556d0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x509391
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x55f43c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0x34
push str.unknown
mov ecx, dword [ebp + 0xc]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
push 0
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x455815
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 0x1c], 0
jne 0x455756
mov eax, dword [ebp - 0x10]
push eax
call sub.mfc100.dll_Ordinal_265
add esp, 4
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
jmp 0x455739
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x455803
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x18]
push edx
push 0x5234a4
mov eax, dword [ebp - 0x1c]
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x455803
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0xc]
and edx, 0xffff
movzx eax, dx
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0xc]
shr edx, 0x10
and edx, 0xffff
movzx eax, dx
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 8]
and edx, 0xffff
movzx eax, dx
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 8]
shr edx, 0x10
and edx, 0xffff
movzx eax, dx
push eax
push 0x5234a8
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.MSVCR100.dll_sprintf_s]
add esp, 0x1c
mov eax, dword [ebp - 0x1c]
push eax
push 0x5234b4
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.mfc100.dll_Ordinal_4283]
add esp, 0xc
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
push eax
call sub.mfc100.dll_Ordinal_1296
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x4573f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5097b8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x55f43c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov byte [ebp - 0x4d], 0x5c
mov byte [ebp - 0x4e], 0x2f
lea eax, [ebp - 0x4d]
push eax
lea ecx, [ebp - 0x4e]
push ecx
lea edx, [ebp - 0x54]
push edx
lea ecx, [ebp + 8]
call fcn.00458950
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp + 8]
call fcn.00458920
mov edx, dword [eax]
push edx
call fcn.0045cee0
add esp, 0x10
lea ecx, [ebp + 8]
call fcn.00462610
sub eax, 1
push eax
lea ecx, [ebp + 8]
call fcn.00458980
movzx eax, word [eax]
cmp eax, 0x5c
je 0x45747b
push 0x5c
lea ecx, [ebp + 8]
call fcn.00458900
mov dword [ebp - 0x4c], 0
jmp 0x45748d
mov ecx, dword [ebp - 0x4c]
add ecx, 1
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp + 8]
call fcn.00462610
cmp dword [ebp - 0x4c], eax
jge 0x457579
mov edx, dword [ebp - 0x4c]
push edx
lea ecx, [ebp + 8]
call fcn.004589b0
movzx eax, word [eax]
cmp eax, 0x5c
jne 0x457574
push 0
mov ecx, dword [ebp - 0x4c]
add ecx, 1
push ecx
push 0
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp + 8]
call fcn.00458a10
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x64]
call fcn.004589d0
push eax
call dword [sym.imp.MSVCR100.dll__waccess_s]
add esp, 8
xor ecx, ecx
cmp eax, 2
sete cl
mov byte [ebp - 0x59], cl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00458860
movzx edx, byte [ebp - 0x59]
test edx, edx
je 0x457574
mov eax, dword [ebp - 0x4c]
add eax, 1
push eax
push 0
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp + 8]
call fcn.00458a10
mov dword [ebp - 0x68], eax
mov edx, dword [ebp - 0x68]
mov dword [ebp - 0x6c], edx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x6c]
call fcn.004589d0
push eax
call dword [sym.imp.MSVCR100.dll__wmkdir]
add esp, 4
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x5a], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.00458860
movzx eax, byte [ebp - 0x5a]
test eax, eax
je 0x457574
mov byte [ebp - 0x5b], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00458860
mov al, byte [ebp - 0x5b]
jmp 0x45758f
jmp 0x457484
mov byte [ebp - 0x5c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00458860
mov al, byte [ebp - 0x5c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00501b98
mov esp, ebp
pop ebp
ret
Function at 0x47bea0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50c6a4
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x55f43c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x120], ecx
mov dword [ebp - 4], 2
mov byte [ebp - 0x11c], 0
push 0x103
push 0
lea eax, [ebp - 0x11b]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp + 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push 0x104
lea ecx, [ebp - 0x11c]
push ecx
push 0x52c65a
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x11c]
push edx
push 0x52c7a0
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.mfc100.dll_Ordinal_4283]
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00501b98
mov esp, ebp
pop ebp
ret 0x10
Function at 0x48ea10
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50e08f
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x55f43c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
push 0x52e957
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov dword [ebp - 4], 0
push 0x52e976
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], 1
call fcn.004b82c0
lea eax, [ebp - 0x1c]
push eax
call fcn.004b8540
add esp, 4
push 0x52e9a0
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.0042c5c0
add esp, 0xc
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_1313]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 0x52e9c0
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], 3
push 0x52e977
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], 4
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24], 0
jmp 0x48eae9
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0x24
jge 0x48eb79
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp - 0x34]
add ecx, 0x94
call fcn.0048f700
mov edx, dword [eax]
push edx
push 0x52e9d8
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.mfc100.dll_Ordinal_4283]
add esp, 0xc
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push 0
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x24]
imul edx, edx, 0x78
mov eax, dword [ebp - 0x34]
lea ecx, [eax + edx + 0xa4]
call fcn.0042af90
mov ecx, dword [ebp - 0x24]
imul ecx, ecx, 0x14
add ecx, 0x19
push ecx
mov ecx, dword [ebp - 0x34]
call fcn.0048ebd0
jmp 0x48eae0
mov byte [ebp - 0x2d], 1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov al, byte [ebp - 0x2d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x491110
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50e1df
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x55f43c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
push 0x52eebb
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov dword [ebp - 4], 0
push 0x52eeda
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], 1
call fcn.004b82c0
lea eax, [ebp - 0x1c]
push eax
call fcn.004b8540
add esp, 4
push 0x52ef04
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.0042c5c0
add esp, 0xc
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_1313]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call dword [sym.imp.mfc100.dll_Ordinal_901]
push str.LTE_GOLDENBOARD_SETTING
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], 3
push 0x52eedb
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], 4
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24], 0
jmp 0x4911e9
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0x24
jge 0x491279
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp - 0x34]
add ecx, 0x94
call fcn.00491f90
mov edx, dword [eax]
push edx
push str.B_d_Enable
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.mfc100.dll_Ordinal_4283]
add esp, 0xc
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push 0
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x24]
imul edx, edx, 0x78
mov eax, dword [ebp - 0x34]
lea ecx, [eax + edx + 0xa4]
call fcn.0042af90
mov ecx, dword [ebp - 0x24]
imul ecx, ecx, 0x14
add ecx, 0x19
push ecx
mov ecx, dword [ebp - 0x34]
call fcn.004912d0
jmp 0x4911e0
mov byte [ebp - 0x2d], 1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov al, byte [ebp - 0x2d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret