joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415ec9
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov dword [ebp - 0x210], ecx
push 0x208
push 0
lea eax, [ebp - 0x208]
push eax
call fcn.004e9480
add esp, 0xc
mov ecx, dword [ebp - 0x210]
add ecx, 0x2dd
push ecx
lea edx, [ebp - 0x208]
push edx
call fcn.004e96e0
add esp, 8
push 0x54aabc
lea eax, [ebp - 0x208]
push eax
call fcn.004e96f0
add esp, 8
mov ecx, dword [ebp - 0x210]
add ecx, 0xf34
push ecx
lea edx, [ebp - 0x208]
push edx
call fcn.004e96f0
add esp, 8
push 0x54aac8
lea eax, [ebp - 0x208]
push eax
call fcn.004e96f0
add esp, 8
mov ecx, dword [ebp - 0x210]
add ecx, 0xd2c
push ecx
lea edx, [ebp - 0x208]
push edx
call fcn.004ea370
add esp, 8
test eax, eax
jne 0x415f75
mov eax, 1
jmp 0x415fd9
push 0
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp - 0x210]
add ecx, 0xd2c
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x415fd4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20c], eax
mov edx, 1
test edx, edx
je 0x415fb6
mov dword [ebp - 0x214], 0
jmp 0x415fd0
mov eax, dword [ebp - 0x20c]
push eax
push str._CopyLoadConfigAsFileToDefaultDir_:_errorcode___d_n
call fcn.0040c0c0
add esp, 8
mov dword [ebp - 0x214], eax
xor eax, eax
jmp 0x415fd9
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x417c8d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0x8f5
push eax
push 0
push 0x54b3dc
push 0x54b3e4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx], al
mov edx, dword [ebp - 4]
add edx, 0x8f5
push edx
push 0
push 0x54b3f0
push 0x54b3fc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx + 1], al
mov edx, dword [ebp - 4]
add edx, 0x8f5
push edx
push 0
push 0x54b408
push 0x54b410
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx + 2], al
mov edx, dword [ebp - 4]
add edx, 0x8f5
push edx
push 0
push 0x54b41c
push 0x54b424
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov byte [ecx + 3], al
mov esp, ebp
pop ebp
ret 4
Function at 0x418375
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov dword [ebp - 0x104], ecx
mov eax, dword [ebp - 0x104]
add eax, 0x8f5
push eax
push 0
push 0x54b69c
push 0x54b6a4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp - 0x104]
add edx, 0x8f5
push edx
push 0
push 0x54b6ac
push 0x54b6bc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x104]
add edx, 0x8f5
push edx
push 0
push 0x54b6c4
push 0x54b6d4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x104]
add edx, 0x8f5
push edx
push 0
push 0x54b6dc
push 0x54b6e8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x104]
add edx, 0x8f5
push edx
push 0
push 0x54b6f0
push 0x54b6fc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 0x104]
add edx, 0x8f5
push edx
push 0
push 0x54b704
push 0x54b710
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], eax
push 0x100
push 0
lea edx, [ebp - 0x100]
push edx
call fcn.004e9480
add esp, 0xc
mov eax, dword [ebp - 0x104]
add eax, 0x8f5
push eax
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push 0
push 0x54b718
push 0x54b728
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x100]
push edx
mov ecx, dword [ebp + 8]
add ecx, 0x58
call fcn.0050e02a
mov esp, ebp
pop ebp
ret 4

Function at 0x41b465
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0x50
push 0
mov eax, dword [ebp - 0xc]
add eax, 0x1080
push eax
call fcn.004e9480
add esp, 0xc
mov ecx, dword [ebp - 0xc]
add ecx, 0x8f5
push ecx
push 0x50
mov edx, dword [ebp - 0xc]
add edx, 0x1080
push edx
push 0x56d3ec
push 0x54c3a8
push 0x54c3b4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [ebp - 0xc]
call fcn.0041b525
push 1
push 0
mov ecx, dword [ebp - 0xc]
call fcn.0041b6ab
mov ecx, dword [ebp - 0xc]
call fcn.0041c0db
mov ecx, dword [ebp - 0xc]
call fcn.0041c15c
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x1038], 0
je 0x41b500
push 0x82d
mov ecx, dword [ebp - 0xc]
call fcn.0050d114
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x103c]
push edx
mov ecx, dword [ebp - 8]
call fcn.00406220
push 0x818
mov ecx, dword [ebp - 0xc]
call fcn.0050d114
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
add eax, 0x1080
push eax
mov ecx, dword [ebp - 4]
call fcn.0050d3ab
mov esp, ebp
pop ebp
ret
Function at 0x41b525
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x524acf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x78
mov dword [ebp - 0x84], ecx
lea ecx, [ebp - 0x10]
call fcn.004046f0
mov dword [ebp - 4], 0
mov dword [ebp - 0x80], 0
mov eax, dword [ebp - 0x84]
add eax, 0x8f5
push eax
push 0
push 0x54c3bc
push 0x54c3d0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 0x84]
mov dword [ecx + 0x10d8], eax
push 6
push 0
mov edx, dword [ebp - 0x84]
add edx, 0x10dc
push edx
call fcn.004e9480
add esp, 0xc
push 0x64
push 0
lea eax, [ebp - 0x7c]
push eax
call fcn.004e9480
add esp, 0xc
mov ecx, dword [ebp - 0x84]
add ecx, 0x8f5
push ecx
push 0x64
lea edx, [ebp - 0x7c]
push edx
push 0x56d3f0
push 0x54c3d8
push 0x54c3e8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
movsx eax, byte [ebp - 0x7c]
test eax, eax
jne 0x41b5f3
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0050dea1
jmp 0x41b69d
push 0x54c3f0
lea ecx, [ebp - 0x7c]
push ecx
call fcn.004ea076
add esp, 8
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
push 0x54c3f4
lea eax, [ebp - 0x10]
push eax
call fcn.00503a72
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.00406ac0
test eax, eax
jne 0x41b68e
lea ecx, [ebp - 0x18]
push ecx
push 0x54c3f8
lea ecx, [ebp - 0x10]
call fcn.00404710
push eax
call fcn.004ea524
add esp, 0xc
mov edx, dword [ebp - 0x84]
add edx, dword [ebp - 0x80]
mov al, byte [ebp - 0x18]
mov byte [edx + 0x10dc], al
mov ecx, dword [ebp - 0x80]
add ecx, 1
mov dword [ebp - 0x80], ecx
cmp dword [ebp - 0x80], 6
jne 0x41b665
jmp 0x41b68e
push 0x54c3fc
push 0
call fcn.004ea076
add esp, 8
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
push 0x54c400
lea eax, [ebp - 0x10]
push eax
call fcn.00503a72
add esp, 0xc
jmp 0x41b61c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0050dea1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x41fffd
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x15
push 0
mov eax, dword [ebp - 8]
add eax, 0x5c
push eax
call fcn.004e9480
add esp, 0xc
cmp dword [0x56e308], 0
je 0x420047
mov ecx, dword [ebp - 8]
add ecx, 0x8f5
push ecx
push 0x15
mov edx, dword [ebp - 8]
add edx, 0x5c
push edx
push 0
push 0x54cdb8
push 0x54cdc0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [ebp - 8]
movsx ecx, byte [eax + 0x5c]
test ecx, ecx
jne 0x420077
mov edx, dword [ebp - 8]
add edx, 0x8f5
push edx
push 0x15
mov eax, dword [ebp - 8]
add eax, 0x5c
push eax
push 0
push 0x54cdc8
push 0x54cdd0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x569
mov ecx, dword [ebp - 8]
call fcn.0050d114
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, 0x5c
push ecx
mov ecx, dword [ebp - 4]
call fcn.0050d3ab
mov esp, ebp
pop ebp
ret
Function at 0x4262f8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 0x44], ecx
mov word [ebp - 0x20], 0x64
mov word [ebp - 0x1e], 0xc8
mov word [ebp - 0x1c], 0x32
mov word [ebp - 0x1a], 0x7d
mov word [ebp - 0x18], 0x89
mov word [ebp - 0x16], 0x96
mov word [ebp - 0x14], 0xa2
mov word [ebp - 0x12], 0xaf
mov word [ebp - 0x10], 0xbb
mov word [ebp - 0xe], 0x19
mov word [ebp - 0xc], 0x25
mov word [ebp - 0xa], 0x3e
mov word [ebp - 8], 0x4b
mov word [ebp - 6], 0x51
mov word [ebp - 4], 0x57
mov word [ebp - 2], 0xc1
mov word [ebp - 0x40], 0xa0
mov word [ebp - 0x3e], 0x20
mov word [ebp - 0x3c], 0x120
mov word [ebp - 0x3a], 0xa8
mov word [ebp - 0x38], 0xac
mov word [ebp - 0x36], 0x18
mov word [ebp - 0x34], 0x1a
mov word [ebp - 0x32], 0x1c
mov word [ebp - 0x30], 0x1e
mov word [ebp - 0x2e], 0x1a0
mov word [ebp - 0x2c], 0x118
mov word [ebp - 0x2a], 0x128
mov word [ebp - 0x28], 0x98
mov word [ebp - 0x26], 0x9a
mov word [ebp - 0x24], 0x9c
mov word [ebp - 0x22], 0x1f
cmp dword [0x56d5b8], 0
je 0x4263ed
cmp dword [0x56d5a4], 0
je 0x4263ed
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0xeba4]
mov edx, dword [ebp - 0x44]
mov ax, word [ebp + ecx*2 - 0x40]
mov word [edx + 0xebac], ax
jmp 0x426405
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx + 0xeba4]
mov eax, dword [ebp - 0x44]
mov cx, word [ebp + edx*2 - 0x20]
mov word [eax + 0xebac], cx
mov esp, ebp
pop ebp
ret
Function at 0x4268c4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x524c12
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x10]
call fcn.004046f0
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
push 0x10
push 0
mov eax, dword [ebp - 0x2c]
add eax, 0xe851
push eax
call fcn.004e9480
add esp, 0xc
mov ecx, dword [ebp - 0x2c]
add ecx, 0xe965
push ecx
push 0x104
mov edx, dword [ebp - 0x2c]
add edx, 0xe861
push edx
push 0
push str.WWN16
push 0x54dc20
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [ebp - 0x2c]
movsx ecx, byte [eax + 0xe861]
test ecx, ecx
jne 0x426978
push 0
push 0x54dc24
push str.Please_Check_the_WWN.ini_file_
mov ecx, dword [ebp - 0x2c]
call fcn.0050b84e
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0050dea1
mov eax, dword [ebp - 0x20]
jmp 0x426a6e
push 0x54dc4c
mov edx, dword [ebp - 0x2c]
add edx, 0xe861
push edx
call fcn.004ea076
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
push 0x54dc50
lea ecx, [ebp - 0x10]
push ecx
call fcn.00503a72
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.00406ac0
test eax, eax
jne 0x426a20
cmp dword [ebp - 0x1c], 0x10
jae 0x4269e4
lea edx, [ebp - 0x18]
push edx
push 0x54dc54
lea ecx, [ebp - 0x10]
call fcn.00404710
push eax
call fcn.004ea524
add esp, 0xc
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x1c]
mov cl, byte [ebp - 0x18]
mov byte [eax + 0xe851], cl
jmp 0x4269e6
jmp 0x426a20
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
push 0x54dc58
push 0
call fcn.004ea076
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x426a09
jmp 0x426a20
mov eax, dword [ebp - 0x14]
push eax
push 0x54dc5c
lea ecx, [ebp - 0x10]
push ecx
call fcn.00503a72
add esp, 0xc
jmp 0x4269a7
cmp dword [ebp - 0x1c], 0x10
jae 0x426a55
push 0
push 0x54dc60
push str.Cant_find_enough_16_bytes_WWN__please_check_WWN.ini_content.
mov ecx, dword [ebp - 0x2c]
call fcn.0050b84e
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0050dea1
mov eax, dword [ebp - 0x24]
jmp 0x426a6e
mov dword [ebp - 0x28], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0050dea1
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4271af
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], 0
jmp 0x4271d1
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x20
jge 0x427221
push 0x14
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004e9480
add esp, 0xc
mov edx, dword [ebp - 0x1c]
push edx
push 0x54dca8
lea eax, [ebp - 0x18]
push eax
call fcn.004e998d
add esp, 0xc
mov ecx, dword [ebp - 0x24]
add ecx, 0x8f5
push ecx
push 0
lea edx, [ebp - 0x18]
push edx
push 0x54dcb0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x1c]
mov byte [ecx], al
jmp 0x4271c8
mov dword [ebp - 0x1c], 0
jmp 0x427233
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0x20
jge 0x427288
mov dword [ebp - 0x20], 0
jmp 0x42724b
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x20
jge 0x42727e
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x20]
jne 0x42725b
jmp 0x427242
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x1c]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x20]
xor edx, edx
mov dl, byte [ecx]
cmp eax, edx
jne 0x42727c
mov dword [ebp - 4], 0
jmp 0x42727e
jmp 0x427242
cmp dword [ebp - 4], 0
jne 0x427286
jmp 0x427288
jmp 0x42722a
cmp dword [ebp - 4], 0
jne 0x4272b3
mov dword [ebp - 0x1c], 0
jmp 0x4272a0
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x20
jge 0x4272b3
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x1c]
mov dl, byte [ebp - 0x1c]
mov byte [ecx], dl
jmp 0x427297
mov esp, ebp
pop ebp
ret 4
Function at 0x434c38
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push str._SMIReadCIDTable
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x56d570], eax
cmp dword [0x56d570], 0
jne 0x434c87
mov ecx, 1
test ecx, ecx
je 0x434c6d
mov dword [ebp - 4], 0
jmp 0x434c7d
push str.Null_dll_SMIReadCIDTable_n
call fcn.0040c0c0
add esp, 4
mov dword [ebp - 4], eax
mov eax, 0x28
jmp 0x434e39
push str._SMIReadFlashID
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x56d56c], eax
cmp dword [0x56d56c], 0
jne 0x434cd0
mov eax, 1
test eax, eax
je 0x434cb6
mov dword [ebp - 8], 0
jmp 0x434cc6
push str.Null_dll_SMIScanSMIDrive_n
call fcn.0040c0c0
add esp, 4
mov dword [ebp - 8], eax
mov eax, 4
jmp 0x434e39
push str._SMIReadVndrCmd
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x56d568], eax
cmp dword [0x56d568], 0
jne 0x434d19
mov edx, 1
test edx, edx
je 0x434cff
mov dword [ebp - 0xc], 0
jmp 0x434d0f
push str.Null_dll_SMIReadVndrCmd_n
call fcn.0040c0c0
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, 5
jmp 0x434e39
push str._SMIWriteVndrCmd
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x56d564], eax
cmp dword [0x56d564], 0
jne 0x434d62
mov ecx, 1
test ecx, ecx
je 0x434d48
mov dword [ebp - 0x10], 0
jmp 0x434d58
push str.Null_dll_SMIWriteVndrCmd_n
call fcn.0040c0c0
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, 6
jmp 0x434e39
push str._SMI_Read_Phy_Page
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x56d560], eax
cmp dword [0x56d560], 0
jne 0x434dab
mov eax, 1
test eax, eax
je 0x434d91
mov dword [ebp - 0x14], 0
jmp 0x434da1
push str.Null_dll_SMI_Read_Phy_Page_n
call fcn.0040c0c0
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, 7
jmp 0x434e39
push str._SMI_Program_Phy_Page
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x56d55c], eax
cmp dword [0x56d55c], 0
jne 0x434df1
mov edx, 1
test edx, edx
je 0x434dda
mov dword [ebp - 0x18], 0
jmp 0x434dea
push str.Null_dll_SMI_Program_Phy_Page_n
call fcn.0040c0c0
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, 8
jmp 0x434e39
push str._SMI_Erase_Phy_block
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x56d558], eax
cmp dword [0x56d558], 0
jne 0x434e37
mov ecx, 1
test ecx, ecx
je 0x434e20
mov dword [ebp - 0x1c], 0
jmp 0x434e30
push str.Null_dll_SMI_Erase_Phy_block_n
call fcn.0040c0c0
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, 9
jmp 0x434e39
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x43daa8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525203
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x228
mov dword [ebp - 0x22c], 0
lea ecx, [ebp - 0x14]
call fcn.004046f0
mov dword [ebp - 4], 0
mov dword [ebp - 0x224], 0
jmp 0x43dafa
mov eax, dword [ebp - 0x224]
add eax, 1
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0x18
jge 0x43db2c
mov ecx, dword [ebp - 0x224]
mov dword [ecx*8 + 0x6741d8], 0
mov edx, dword [ebp - 0x224]
add edx, 0x43
mov eax, dword [ebp - 0x224]
mov byte [eax*8 + 0x6741dc], dl
jmp 0x43daeb
push 0x104
push 0
lea ecx, [ebp - 0x118]
push ecx
call fcn.004e9480
add esp, 0xc
push 0x5543d4
lea edx, [ebp - 0x118]
push edx
call fcn.004e96e0
add esp, 8
push 0x104
push 0
lea eax, [ebp - 0x220]
push eax
call fcn.004e9480
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
push 0x104
lea edx, [ebp - 0x220]
push edx
push 0x56d5e8
push 0x5543f4
push 0x5543f8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
movsx eax, byte [ebp - 0x220]
test eax, eax
jne 0x43dbc3
mov dword [ebp - 0x230], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0050dea1
mov eax, dword [ebp - 0x230]
jmp 0x43dcec
push 0x5543fc
lea ecx, [ebp - 0x220]
push ecx
call fcn.004ea076
add esp, 8
mov dword [ebp - 0x11c], eax
mov edx, dword [ebp - 0x11c]
push edx
push 0x554400
lea eax, [ebp - 0x14]
push eax
call fcn.00503a72
add esp, 0xc
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x14]
call fcn.00406ac0
test eax, eax
jne 0x43dcce
lea ecx, [ebp - 0x228]
push ecx
push 0x554404
lea ecx, [ebp - 0x14]
call fcn.00404710
push eax
call fcn.004ea524
add esp, 0xc
mov dword [ebp - 0x224], 0
jmp 0x43dc44
mov edx, dword [ebp - 0x224]
add edx, 1
mov dword [ebp - 0x224], edx
cmp dword [ebp - 0x224], 0x18
jge 0x43dc82
movsx eax, byte [ebp - 0x228]
mov ecx, dword [ebp - 0x224]
movsx edx, byte [ecx*8 + 0x6741dc]
cmp eax, edx
jne 0x43dc80
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x224]
mov dword [eax*8 + 0x6741d8], 1
jmp 0x43dc82
jmp 0x43dc35
mov ecx, dword [ebp - 0x22c]
add ecx, 1
mov dword [ebp - 0x22c], ecx
push 0x554408
push 0
call fcn.004ea076
add esp, 8
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jne 0x43dcb1
jmp 0x43dcce
mov edx, dword [ebp - 0x11c]
push edx
push 0x55440c
lea eax, [ebp - 0x14]
push eax
call fcn.00503a72
add esp, 0xc
jmp 0x43dbfc
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x234], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0050dea1
mov eax, dword [ebp - 0x234]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x447136
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov dword [0x56d6b8], 0
mov eax, dword [ebp - 4]
add eax, 0xf8
push eax
push 0
push str.ENABLECLEARSMARTFEATURE
push 0x555e78
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x56d6b8], eax
mov ecx, dword [ebp - 4]
add ecx, 0xf8
push ecx
push 0
push str.ENABLEASSEMBLYVERIFICATIONPAGE
push 0x555ea4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x56e310], eax
mov edx, dword [ebp - 4]
add edx, 0xf8
push edx
push 0
push str.ENABLEQCTOOLPAGE
push 0x555ec0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x56e30c], eax
mov eax, dword [ebp - 4]
add eax, 0xf8
push eax
push 0
push str.NetcomQCTool
push 0x555ed8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x56dee4], eax
mov ecx, dword [ebp - 4]
add ecx, 0xf8
push ecx
push 0
push str.MainPageOnlyUpdateCID_Identify
push 0x555f00
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x56d6b0], eax
mov esp, ebp
pop ebp
ret

Function at 0x4471ee
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0xf8
push eax
push 0
push str.ENTRANSCENDFEATURE
push 0x555f1c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x56e308], eax
mov ecx, dword [ebp - 4]
add ecx, 0xf8
push ecx
push 0
push str.ENABLEPNYMODE
push 0x555f34
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x56e314], eax
mov esp, ebp
pop ebp
ret
Function at 0x44dbcf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 0x44], ecx
mov byte [ebp - 4], 0
mov dword [ebp - 0x24], 0
mov byte [ebp - 0x20], 0x23
mov byte [ebp - 0x1f], 0x32
mov byte [ebp - 0x1e], 0x3c
mov byte [ebp - 0x1d], 0x46
mov byte [ebp - 0x1c], 0x50
mov byte [ebp - 0x1b], 0x64
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0x19], 0x6e
mov byte [ebp - 0x18], 0x73
mov byte [ebp - 0x17], 0x78
mov byte [ebp - 0x16], 0x7d
mov byte [ebp - 0x15], 0x82
mov byte [ebp - 0x14], 0x87
mov byte [ebp - 0x13], 0x8c
mov byte [ebp - 0x12], 0x91
mov byte [ebp - 0x11], 0x96
mov byte [ebp - 0x10], 0x9b
mov byte [ebp - 0xf], 0xa0
mov byte [ebp - 0xe], 0xa5
mov byte [ebp - 0xd], 0xaa
mov byte [ebp - 0xc], 0xaf
mov byte [ebp - 0xb], 0xb4
mov byte [ebp - 0xa], 0xb9
mov byte [ebp - 9], 0xbe
mov byte [ebp - 8], 0xc3
mov byte [ebp - 7], 0xc8
mov byte [ebp - 0x40], 0x9a
mov byte [ebp - 0x3f], 8
mov byte [ebp - 0x3e], 0xa
mov byte [ebp - 0x3d], 0xc
mov byte [ebp - 0x3c], 0xe
mov byte [ebp - 0x3b], 0x12
mov byte [ebp - 0x3a], 0x13
mov byte [ebp - 0x39], 0x14
mov byte [ebp - 0x38], 0x15
mov byte [ebp - 0x37], 0x16
mov byte [ebp - 0x36], 0x17
mov byte [ebp - 0x35], 0x18
mov byte [ebp - 0x34], 0x19
mov byte [ebp - 0x33], 0x1a
mov byte [ebp - 0x32], 0x1b
mov byte [ebp - 0x31], 0x1c
mov byte [ebp - 0x30], 0x1d
mov byte [ebp - 0x2f], 0x1e
mov byte [ebp - 0x2e], 0x1f
mov byte [ebp - 0x2d], 0x20
mov byte [ebp - 0x2c], 0x21
mov byte [ebp - 0x2b], 0x22
mov byte [ebp - 0x2a], 0x23
mov byte [ebp - 0x29], 0x24
mov byte [ebp - 0x28], 0x25
mov byte [ebp - 0x27], 0x26
mov dword [ebp - 0x24], 0
jmp 0x44dcc5
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x1a
jge 0x44dcec
mov ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp - 0x24]
xor eax, eax
mov al, byte [ebp + edx - 0x20]
cmp ecx, eax
jne 0x44dcea
mov ecx, dword [ebp - 0x24]
mov al, byte [ebp + ecx - 0x40]
jmp 0x44dcee
jmp 0x44dcbc
xor al, al
mov esp, ebp
pop ebp
ret 4
Function at 0x44dcf4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 0x44], ecx
mov byte [ebp - 4], 0
mov dword [ebp - 0x24], 0
mov byte [ebp - 0x20], 0x23
mov byte [ebp - 0x1f], 0x32
mov byte [ebp - 0x1e], 0x3c
mov byte [ebp - 0x1d], 0x46
mov byte [ebp - 0x1c], 0x50
mov byte [ebp - 0x1b], 0x64
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0x19], 0x6e
mov byte [ebp - 0x18], 0x73
mov byte [ebp - 0x17], 0x78
mov byte [ebp - 0x16], 0x7d
mov byte [ebp - 0x15], 0x82
mov byte [ebp - 0x14], 0x87
mov byte [ebp - 0x13], 0x8c
mov byte [ebp - 0x12], 0x91
mov byte [ebp - 0x11], 0x96
mov byte [ebp - 0x10], 0x9b
mov byte [ebp - 0xf], 0xa0
mov byte [ebp - 0xe], 0xa5
mov byte [ebp - 0xd], 0xaa
mov byte [ebp - 0xc], 0xaf
mov byte [ebp - 0xb], 0xb4
mov byte [ebp - 0xa], 0xb9
mov byte [ebp - 9], 0xbe
mov byte [ebp - 8], 0xc3
mov byte [ebp - 7], 0xc8
mov byte [ebp - 0x40], 0x9a
mov byte [ebp - 0x3f], 8
mov byte [ebp - 0x3e], 0xa
mov byte [ebp - 0x3d], 0xc
mov byte [ebp - 0x3c], 0xe
mov byte [ebp - 0x3b], 0x12
mov byte [ebp - 0x3a], 0x13
mov byte [ebp - 0x39], 0x14
mov byte [ebp - 0x38], 0x15
mov byte [ebp - 0x37], 0x16
mov byte [ebp - 0x36], 0x17
mov byte [ebp - 0x35], 0x18
mov byte [ebp - 0x34], 0x19
mov byte [ebp - 0x33], 0x1a
mov byte [ebp - 0x32], 0x1b
mov byte [ebp - 0x31], 0x1c
mov byte [ebp - 0x30], 0x1d
mov byte [ebp - 0x2f], 0x1e
mov byte [ebp - 0x2e], 0x1f
mov byte [ebp - 0x2d], 0x20
mov byte [ebp - 0x2c], 0x21
mov byte [ebp - 0x2b], 0x22
mov byte [ebp - 0x2a], 0x23
mov byte [ebp - 0x29], 0x24
mov byte [ebp - 0x28], 0x25
mov byte [ebp - 0x27], 0x26
mov dword [ebp - 0x24], 0
jmp 0x44ddea
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x1a
jge 0x44de11
mov ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp - 0x24]
xor eax, eax
mov al, byte [ebp + edx - 0x40]
cmp ecx, eax
jne 0x44de0f
mov ecx, dword [ebp - 0x24]
mov al, byte [ebp + ecx - 0x20]
jmp 0x44de13
jmp 0x44dde1
xor al, al
mov esp, ebp
pop ebp
ret 4