joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5012bf
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
lea eax, [ebp - 0x210]
push eax
call fcn.00529440
add esp, 4
push str.UFD_MP_
lea ecx, [ebp - 0x210]
push ecx
call fcn.0054bea0
add esp, 8
push str.usbhub.cfg
lea edx, [ebp - 0x210]
push edx
call fcn.0054bea0
add esp, 8
mov eax, dword [ebp + 8]
push eax
push 0x5c947c
lea ecx, [ebp - 0x10]
push ecx
call fcn.0054c6e3
add esp, 0xc
mov byte [ebp - 0x310], 0
lea edx, [ebp - 0x210]
push edx
push 0xff
mov eax, dword [ebp + 0xc]
push eax
push 0
lea ecx, [ebp - 0x10]
push ecx
push 0x5c9488
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x314], eax
mov edx, dword [ebp + 8]
push edx
push 0x5c9490
lea eax, [ebp - 0x10]
push eax
call fcn.0054c6e3
add esp, 0xc
lea ecx, [ebp - 0x210]
push ecx
push 0
lea edx, [ebp - 0x10]
push edx
push 0x5c949c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
movsx edx, byte [ebp - 0x310]
test edx, edx
je 0x501386
mov eax, 1
jmp 0x501388
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x5206a5
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x204], 0
mov dword [ebp - 0x208], 0
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
mov dword [ebp - 0x204], 0
jmp 0x5206fd
mov edx, dword [ebp - 0x204]
add edx, 1
mov dword [ebp - 0x204], edx
cmp dword [ebp - 0x204], 0x20
jge 0x5208a5
push 0x200
push 0
lea eax, [ebp - 0x428]
push eax
call fcn.0054bf90
add esp, 0xc
push 6
push 0
lea ecx, [ebp - 0x214]
push ecx
call fcn.0054bf90
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x228], eax
mov edx, 1
mov ecx, dword [ebp - 0x204]
shl edx, cl
mov eax, dword [ebp - 0x228]
and eax, edx
test eax, eax
jne 0x52075a
jmp 0x5206ee
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x428]
push edx
mov eax, dword [ebp - 0x204]
add eax, 0x41
push eax
call fcn.004be7ee
add esp, 0xc
push 0x5ca57c
lea ecx, [ebp - 0x428]
push ecx
call fcn.0054cb20
add esp, 8
test eax, eax
jne 0x520797
jmp 0x5206ee
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [ebp - 0x204]
add eax, 0x41
push eax
call fcn.004be965
add esp, 8
test eax, eax
jne 0x5207b9
jmp 0x5206ee
push 0x10
push 0
lea ecx, [ebp - 0x224]
push ecx
call fcn.0054bf90
add esp, 0xc
push 0x200
push 0
lea edx, [ebp - 0x200]
push edx
call fcn.0054bf90
add esp, 0xc
mov byte [ebp - 0x224], 0xf0
mov byte [ebp - 0x223], 2
mov byte [ebp - 0x219], 1
push 0
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp - 0x219]
and ecx, 0xff
shl ecx, 9
push ecx
lea edx, [ebp - 0x200]
push edx
mov eax, dword [ebp - 0x20c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
call fcn.004c0e6e
add esp, 0x2c
test eax, eax
jne 0x52084a
mov ecx, dword [ebp - 0x20c]
push ecx
call fcn.004beacb
add esp, 4
jmp 0x5206ee
cmp dword [ebp - 0x208], 0
jne 0x520881
mov edx, dword [ebp - 0x204]
add edx, 0x41
mov eax, dword [ebp + 8]
mov byte [eax], dl
mov ecx, dword [ebp - 0x208]
add ecx, 1
mov dword [ebp - 0x208], ecx
mov edx, dword [ebp - 0x20c]
push edx
call fcn.004beacb
add esp, 4
jmp 0x5208a0
mov eax, dword [ebp - 0x204]
add eax, 0x41
mov ecx, dword [ebp + 0xc]
mov byte [ecx], al
mov edx, dword [ebp - 0x20c]
push edx
call fcn.004beacb
add esp, 4
jmp 0x5208a5
jmp 0x5206ee
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x5208b6
mov eax, 1
jmp 0x5208b8
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x521d52
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
cmp dword [eax + 0x4f2c], 0
je 0x521d8e
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x6cd4], 0
je 0x521d8e
jmp 0x521d98
mov eax, 1
jmp 0x521eaf
push 0x6785ac
push 0
push str.DGLEVELNO
push 0x5cac2c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x30], eax
push 0x6785ac
push 0
push str.DGLEVELMASK
push 0x5cac40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0xc], eax
push 0x28
push 0
lea edx, [ebp - 0x58]
push edx
call fcn.0054bf90
add esp, 0xc
mov dword [ebp - 4], 0
jmp 0x521dee
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x30]
jge 0x521e3a
push 0x20
push 0
lea edx, [ebp - 0x2c]
push edx
call fcn.0054bf90
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
push str.DGLEVEL_.2d
lea ecx, [ebp - 0x2c]
push ecx
call fcn.0054c6e3
add esp, 0xc
push 0x6785ac
push 0
lea edx, [ebp - 0x2c]
push edx
push 0x5cac54
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x58], eax
jmp 0x521de5
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x6cd0]
shr eax, 0xb
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x521e5b
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x30]
jge 0x521eaa
mov eax, 1
mov ecx, dword [ebp - 4]
shl eax, cl
mov ecx, dword [ebp - 0xc]
and ecx, eax
test ecx, ecx
jne 0x521e78
jmp 0x521e52
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + edx*4 - 0x58]
jl 0x521ea8
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x68c8], 0xb0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x68c8]
or eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x68c8], eax
jmp 0x521eaa
jmp 0x521e52
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x525fb8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov dword [ebp - 0x108], ecx
push 0x104
push 0
lea eax, [ebp - 0x104]
push eax
call fcn.0054bf90
add esp, 0xc
lea ecx, [ebp - 0x104]
push ecx
call fcn.00529440
add esp, 4
push 0x5caf98
lea edx, [ebp - 0x104]
push edx
call fcn.0054bea0
add esp, 8
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x526024
lea ecx, [ebp - 0x104]
push ecx
mov ecx, dword [ebp - 0x108]
call fcn.00525aff
mov esp, ebp
pop ebp
ret

Function at 0x526ee2
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push edi
mov dword [ebp - 0x110], 0xffffffff
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [ebp + 8], 0
jne 0x526f32
push 0x104
lea eax, [ebp - 0x104]
push eax
call fcn.00526fad
add esp, 8
lea ecx, [ebp - 0x104]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x108], edx
mov eax, dword [ebp - 0x108]
push eax
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0xffffffff
jne 0x526f9c
push str.255.255.255.255
mov ecx, dword [ebp - 0x108]
push ecx
call fcn.0054cf00
add esp, 8
test eax, eax
je 0x526f9c
mov edx, dword [ebp - 0x108]
push edx
call sub.WSOCK32.dll_gethostbyname
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x526f9c
mov eax, dword [ebp - 0x10c]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
push ecx
call sub.WSOCK32.dll_ntohl
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x526fad
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push edi
cmp dword [ebp + 8], 0
je 0x527066
cmp dword [ebp + 0xc], 0
jbe 0x527066
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.WSOCK32.dll_gethostname
cmp eax, 0xffffffff
je 0x527064
lea ecx, [ebp - 0x104]
push ecx
call sub.WSOCK32.dll_gethostbyname
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
je 0x52702d
mov edx, dword [ebp - 0x108]
mov eax, dword [edx]
push eax
lea ecx, [ebp - 0x104]
push ecx
call fcn.0054be90
add esp, 8
lea edx, [ebp - 0x104]
push edx
call fcn.0054ce70
add esp, 4
cmp eax, dword [ebp + 0xc]
jbe 0x52704d
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x527070
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0054be90
add esp, 8
mov al, 1
jmp 0x527070
jmp 0x52706e
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x527075
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push edi
cmp dword [ebp + 8], 0
je 0x5271a4
cmp dword [ebp + 0xc], 0
jbe 0x5271a4
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.WSOCK32.dll_gethostname
cmp eax, 0xffffffff
je 0x5271a2
lea ecx, [ebp - 0x104]
push ecx
call sub.WSOCK32.dll_gethostbyname
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
je 0x5271a2
mov edx, dword [ebp - 0x108]
mov eax, dword [edx + 0xc]
cmp dword [eax], 0
je 0x5271a2
mov ecx, dword [ebp - 0x108]
movsx edx, word [ecx + 0xa]
cmp edx, 4
jge 0x52710d
xor al, al
jmp 0x5271ae
mov byte [ebp - 0x104], 0
mov eax, dword [ebp - 0x108]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
xor eax, eax
mov al, byte [edx + 3]
push eax
mov ecx, dword [ebp - 0x108]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
xor ecx, ecx
mov cl, byte [eax + 2]
push ecx
mov edx, dword [ebp - 0x108]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax]
xor edx, edx
mov dl, byte [ecx + 1]
push edx
mov eax, dword [ebp - 0x108]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
xor eax, eax
mov al, byte [edx]
push eax
push str._u._u._u._u
lea ecx, [ebp - 0x104]
push ecx
call fcn.0054c6e3
add esp, 0x18
lea edx, [ebp - 0x104]
push edx
call fcn.0054ce70
add esp, 4
cmp eax, dword [ebp + 0xc]
jbe 0x52718b
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x5271ae
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0054be90
add esp, 8
mov al, 1
jmp 0x5271ae
jmp 0x5271ac
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x52747e
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x575a52
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x30]
call fcn.00526cec
and eax, 0xff
test eax, eax
je 0x5274b4
xor al, al
jmp 0x5275d4
push 0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call sub.WSOCK32.dll_socket
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x5275cb
lea ecx, [ebp - 0x20]
call fcn.005281b0
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0x10]
push edx
push 0x5cb000
push 0
lea ecx, [ebp - 0x20]
call fcn.00526bdb
and eax, 0xff
test eax, eax
jne 0x52751f
mov eax, dword [ebp - 0x10]
push eax
call sub.WSOCK32.dll_closesocket
mov byte [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.005281d0
mov al, byte [ebp - 0x24]
jmp 0x5275d4
lea ecx, [ebp - 0x20]
call fcn.00528100
push eax
lea ecx, [ebp - 0x20]
call fcn.005281a0
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.WSOCK32.dll_bind
cmp eax, 0xffffffff
jne 0x527560
mov edx, dword [ebp - 0x10]
push edx
call sub.WSOCK32.dll_closesocket
mov byte [ebp - 0x28], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.005281d0
mov al, byte [ebp - 0x28]
jmp 0x5275d4
push 2
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x20]
call fcn.00526bdb
lea ecx, [ebp - 0x20]
call fcn.00528100
push eax
lea ecx, [ebp - 0x20]
call fcn.005281a0
push eax
mov edx, dword [ebp - 0x10]
push edx
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x5275b3
mov eax, dword [ebp - 0x10]
push eax
call sub.WSOCK32.dll_closesocket
mov byte [ebp - 0x2c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.005281d0
mov al, byte [ebp - 0x2c]
jmp 0x5275d4
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x10]
mov dword [ecx + 4], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.005281d0
xor eax, eax
cmp dword [ebp - 0x10], 0xffffffff
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x527620
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
call fcn.00526d05
and eax, 0xff
test eax, eax
jne 0x52768d
mov ecx, dword [ebp - 0xc]
call fcn.00526cec
and eax, 0xff
test eax, eax
je 0x52768d
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 4
mov ecx, dword [ebp - 0xc]
push ecx
push 0x5280db
push 0
push 0
call fcn.0054f4e8
add esp, 0x18
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x52768d
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax + 8], ecx
mov al, 1
jmp 0x52768f
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x527693
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.00526cec
and eax, 0xff
test eax, eax
je 0x5276bb
mov ecx, dword [ebp - 4]
call fcn.005275e4
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
call fcn.00526d05
and eax, 0xff
test eax, eax
je 0x52770b
push 0x1388
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x5276f4
push 1
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 4]
add ecx, 0x10
call fcn.00528340
and eax, 0xff
test eax, eax
jne 0x52772a
mov ecx, dword [ebp - 4]
add ecx, 0x10
call fcn.005284d0
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x1c], 0
je 0x52774a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x1c], 0
mov esp, ebp
pop ebp
ret
Function at 0x52aa38
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x128], 0
lea eax, [ebp - 0x124]
push eax
call fcn.00529440
add esp, 4
push str.Capacity.ini
lea ecx, [ebp - 0x124]
push ecx
call fcn.0054bea0
add esp, 8
mov edx, dword [ebp + 8]
push edx
push str.CAPA__dM
lea eax, [ebp - 0x20]
push eax
call fcn.0054c6e3
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x130], ecx
cmp dword [ebp - 0x130], 0x1000
jg 0x52ab29
cmp dword [ebp - 0x130], 0x1000
je 0x52abed
cmp dword [ebp - 0x130], 0x200
jg 0x52ab04
cmp dword [ebp - 0x130], 0x200
je 0x52abc9
cmp dword [ebp - 0x130], 0x40
je 0x52ab9f
cmp dword [ebp - 0x130], 0x80
je 0x52abae
cmp dword [ebp - 0x130], 0x100
je 0x52abbd
jmp 0x52ac3f
cmp dword [ebp - 0x130], 0x400
je 0x52abd5
cmp dword [ebp - 0x130], 0x800
je 0x52abe1
jmp 0x52ac3f
cmp dword [ebp - 0x130], 0x10000
jg 0x52ab7a
cmp dword [ebp - 0x130], 0x10000
je 0x52ac1d
cmp dword [ebp - 0x130], 0x2000
je 0x52abf9
cmp dword [ebp - 0x130], 0x4000
je 0x52ac05
cmp dword [ebp - 0x130], 0x8000
je 0x52ac11
jmp 0x52ac3f
cmp dword [ebp - 0x130], 0x20000
je 0x52ac29
cmp dword [ebp - 0x130], 0x40000
je 0x52ac35
jmp 0x52ac3f
mov dword [ebp - 0x128], 0x33
jmp 0x52ac3f
mov dword [ebp - 0x128], 0x70
jmp 0x52ac3f
mov dword [ebp - 0x128], 0xea
jmp 0x52ac3f
mov dword [ebp - 0x128], 0x1d8
jmp 0x52ac3f
mov dword [ebp - 0x128], 0x3ba
jmp 0x52ac3f
mov dword [ebp - 0x128], 0x774
jmp 0x52ac3f
mov dword [ebp - 0x128], 0xee7
jmp 0x52ac3f
mov dword [ebp - 0x128], 0x1dce
jmp 0x52ac3f
mov dword [ebp - 0x128], 0x3b9b
jmp 0x52ac3f
mov dword [ebp - 0x128], 0x7736
jmp 0x52ac3f
mov dword [ebp - 0x128], 0xef10
jmp 0x52ac3f
mov dword [ebp - 0x128], 0x1de20
jmp 0x52ac3f
mov dword [ebp - 0x128], 0x3bc40
lea edx, [ebp - 0x124]
push edx
mov eax, dword [ebp - 0x128]
push eax
lea ecx, [ebp - 0x20]
push ecx
push str.CAPACITY
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
mov esp, ebp
pop ebp
ret

Function at 0x52ac6c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
push esi
push edi
cmp dword [ebp + 0x18], 0
jne 0x52aca2
lea eax, [ebp - 0x104]
push eax
call fcn.00529440
add esp, 4
push str.FlashID.INI
lea ecx, [ebp - 0x104]
push ecx
call fcn.0054bea0
add esp, 8
jmp 0x52acc8
mov edi, dword [ebp + 0x18]
lea edx, [ebp - 0x104]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str._d_d_d
lea ecx, [ebp - 0x184]
push ecx
call fcn.0054c6e3
add esp, 0x14
lea edx, [ebp - 0x104]
push edx
push 0x40
mov eax, dword [ebp + 0x14]
push eax
push 0x6858bc
lea ecx, [ebp - 0x184]
push ecx
push 0x5cb590
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x52b368
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
push esi
push edi
mov dword [ebp - 4], 0x80
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x8c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
cmp dword [ebp + 0xc], 0
je 0x52b3b7
lea edi, [ebp - 0x8c]
mov edx, dword [ebp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x94], ecx
mov dword [ebp - 8], 2
mov edx, dword [ebp - 4]
add edx, 1
push edx
call fcn.0054cfd4
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x52b3e7
or eax, 0xffffffff
jmp 0x52b566
mov ecx, dword [ebp - 4]
add ecx, 1
xor eax, eax
mov edi, dword [ebp - 0xc]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], 0
lea edi, [ebp - 0x8c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
mov dword [ebp - 0x90], ecx
jmp 0x52b432
mov ecx, dword [ebp - 0x90]
sub ecx, 1
mov dword [ebp - 0x90], ecx
cmp dword [ebp - 0x90], 0
jl 0x52b4f3
mov edx, dword [ebp - 0x90]
movsx eax, byte [ebp + edx - 0x8c]
cmp eax, 0x30
jl 0x52b4e1
mov ecx, dword [ebp - 0x90]
movsx edx, byte [ebp + ecx - 0x8c]
cmp edx, 0x39
jg 0x52b4e1
cmp dword [ebp - 0x94], 0
jle 0x52b4e1
cmp dword [ebp - 8], 0
jle 0x52b4e1
mov edi, dword [ebp - 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
mov dword [ebp - 0x98], ecx
jmp 0x52b49e
mov eax, dword [ebp - 0x98]
sub eax, 1
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jl 0x52b4c0
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x98]
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x98]
mov al, byte [edx]
mov byte [ecx + 1], al
jmp 0x52b48f
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x90]
mov al, byte [ebp + edx - 0x8c]
mov byte [ecx], al
cmp dword [ebp - 8], 2
jne 0x52b4df
mov dword [ebp - 8], 1
jmp 0x52b4ee
cmp dword [ebp - 8], 1
jne 0x52b4ee
mov dword [ebp - 8], 0
jmp 0x52b423
cmp dword [ebp - 8], 2
je 0x52b50a
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0054c571
add esp, 4
mov dword [ebp - 8], eax
jmp 0x52b511
mov dword [ebp - 8], 0xffffffff
mov edx, dword [ebp - 0xc]
push edx
call fcn.0054ccb2
add esp, 4
cmp dword [ebp - 8], 0
jl 0x52b53f
mov eax, dword [ebp - 8]
push eax
push 0x5cb59c
mov ecx, dword [ebp + 8]
push ecx
call fcn.0054c6e3
add esp, 0xc
mov eax, 1
jmp 0x52b566
mov edi, 0x6858c0
mov edx, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x534978
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], 0
jmp 0x534990
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jae 0x5349f0
cmp dword [ebp - 0x24], 0x20
jae 0x5349ee
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
mov eax, dword [edx*4 + 0x673a94]
mov dword [ecx*4 + 0x673a84], eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx*4 + 0x673a84]
sub edx, 1
push edx
push 0x5cc47c
lea eax, [ebp - 0x20]
push eax
call fcn.0054c6e3
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 0
lea edx, [ebp - 0x20]
push edx
push 0x5cc484
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 0x24]
mov dword [ecx*4 + 0x673a74], eax
jmp 0x534987
mov esp, ebp
pop ebp
ret
Function at 0x5364d8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
push esi
push edi
mov edi, 0x6858fc
mov edx, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x108]
push ecx
call fcn.00529440
add esp, 4
mov ecx, 8
xor eax, eax
lea edi, [ebp - 0x168]
rep stosd dword es:[edi], eax
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x148]
rep stosd dword es:[edi], eax
push str.CardModeCardMode.FCM
lea edx, [ebp - 0x108]
push edx
call fcn.0054bea0
add esp, 8
mov dword [ebp - 4], 0
jmp 0x53655b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x11
jge 0x5365a8
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0xc
mov edx, dword [0x673ea0]
cmp edx, dword [ecx + 0x5cb0e0]
jne 0x5365a6
mov eax, dword [ebp - 4]
imul eax, eax, 0xc
mov edi, dword [eax + 0x5cb0dc]
lea edx, [ebp - 0x168]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5365a8
jmp 0x536552
mov ecx, dword [ebp + 8]
push ecx
call fcn.00529440
add esp, 4
lea edx, [ebp - 0x108]
push edx
push 0
push str.EnableCardModeFolder
push str.CardModeFolder
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x536647
lea eax, [ebp - 0x108]
push eax
push 0x40
lea ecx, [ebp - 0x148]
push ecx
push 0x685900
lea edx, [ebp - 0x168]
push edx
push str.CARDMODEFOLDER
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edi, [ebp - 0x148]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
test ecx, ecx
je 0x536634
push str.CardMode_
mov eax, dword [ebp + 8]
push eax
call fcn.0054bea0
add esp, 8
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0054bea0
add esp, 8
jmp 0x536645
push str.CardModeDefault
mov eax, dword [ebp + 8]
push eax
call fcn.0054bea0
add esp, 8
jmp 0x536658
push 0x5cc7cc
mov ecx, dword [ebp + 8]
push ecx
call fcn.0054bea0
add esp, 8
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret