joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47ffd5
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57455f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1dc
mov dword [ebp - 0x1e8], ecx
mov dword [ebp - 0x1bc], 0
lea ecx, [ebp - 0x14]
call fcn.00401420
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov word [ebp - 0x1b8], 0x101
lea eax, [ebp - 0x1b4]
push eax
mov cx, word [ebp - 0x1b8]
push ecx
call sub.WSOCK32.dll_WSAStartup
push 6
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x48007f
push 0
push 0x5e89d8
push 0x5b274c
mov ecx, dword [ebp - 0x1e8]
call fcn.00564245
mov edx, dword [ebp + 8]
mov dword [edx + 0x28], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0056206c
jmp 0x48022e
mov dword [ebp - 0x1c0], 0
jmp 0x48009a
mov eax, dword [ebp - 0x1c0]
add eax, 1
mov dword [ebp - 0x1c0], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1c0]
cmp edx, dword [ecx + 0x24]
jge 0x480147
mov eax, dword [ebp - 0x1e8]
mov ecx, dword [ebp - 0x1c0]
mov dword [eax + 0x60], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x1c0]
mov edx, dword [eax + ecx*4]
push edx
push 0x5b2760
lea eax, [ebp - 0x1e0]
push eax
call fcn.0054c6e3
add esp, 0xc
mov word [ebp - 0x24], 2
lea ecx, [ebp - 0x1e0]
push ecx
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 0x20], eax
mov dx, word [0x5ea130]
push edx
call sub.WSOCK32.dll_htons
mov word [ebp - 0x22], ax
push 0x10
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.WSOCK32.dll_connect
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0xffffffff
jne 0x480127
jmp 0x48008b
lea edx, [ebp - 0x1e0]
push edx
mov eax, dword [ebp + 8]
add eax, 4
push eax
call fcn.0054be90
add esp, 8
mov dword [ebp - 0x1bc], 1
push 1
mov ecx, dword [ebp - 0x1e8]
call fcn.004116d0
push 2
mov ecx, dword [ebp - 0x1e8]
call fcn.004116d0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x28], 0
mov edx, dword [ebp - 0x10]
push edx
call sub.WSOCK32.dll_closesocket
call sub.WSOCK32.dll_WSACleanup
cmp dword [ebp - 0x1bc], 0
je 0x4801d1
lea eax, [ebp - 0x1e0]
push eax
mov ecx, dword [ebp - 0x1e8]
mov ecx, dword [ecx + 0x64]
call fcn.005621f5
lea edx, [ebp - 0x1e0]
push edx
push str.Find_Host_:__s
lea eax, [ebp - 0x14]
push eax
call fcn.0055f827
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.005287a0
push eax
push 0x5aa
mov ecx, dword [ebp - 0x1e8]
call fcn.005654d4
mov ecx, eax
call fcn.0056567d
jmp 0x480206
push 0xffffffffffffffff
push 0x457
mov ecx, dword [ebp - 0x1e8]
call fcn.005654d4
mov ecx, eax
call fcn.00457e30
push str.Can_not_find_any_SN_server_
push 0x5aa
mov ecx, dword [ebp - 0x1e8]
call fcn.005654d4
mov ecx, eax
call fcn.0056567d
push 5
push 0x5aa
mov ecx, dword [ebp - 0x1e8]
call fcn.005654d4
mov ecx, eax
call fcn.0056577e
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0056206c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4827c8
Capabilities:
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
cmp dword [0x5edfc0], 0
je 0x482920
push 0x5ebe74
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test eax, eax
jb 0x482920
push 0x5ebe74
push 0
push 0x5b2a48
push 0x5b2a54
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x673ba4], eax
push 0x5ebe74
push 0xd
push 0x5b2a5c
push 0x5b2a64
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x673ba8], eax
push 0x5ebe74
push 0
push 0x5b2a6c
push 0x5b2a7c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x673b90], eax
push 0x5ebe74
mov eax, dword [0x673ba8]
add eax, 1
push eax
push 0x679058
push 0
push 0x5b2a84
push 0x5b2a90
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 4], eax
push 0x5ebe74
push 3
push 0x5b2a98
push 0x5b2aa8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x673ba0], eax
push 0x5ebe74
push 0xa
push 0x5b2ab0
push 0x5b2abc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x673b9c], eax
push 0x5ebe74
mov ecx, dword [0x673ba8]
add ecx, 1
push ecx
push 0x678e58
push 0
push 0x5b2ac4
push 0x5b2ad0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 4], eax
push 0x5ebe74
mov edx, dword [0x673ba8]
add edx, 1
push edx
push 0x678f58
push 0x5b2ad8
push 0x5b2aec
push 0x5b2af8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 4], eax
push 0x5ebe74
push 0x10
push 0x6787b4
push 0x5e8b5c
push 0x5b2b00
push 0x5b2b0c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
jmp 0x482a4a
push 0x6785ac
push 0
push 0x5b2b14
push 0x5b2b20
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x673ba4], eax
push 0x6785ac
push 0xd
push 0x5b2b28
push 0x5b2b30
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x673ba8], eax
push 0x6785ac
push 0
push 0x5b2b38
push 0x5b2b48
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x673b90], eax
push 0x6785ac
push 3
push 0x5b2b50
push 0x5b2b60
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x673ba0], eax
push 0x6785ac
push 0xa
push 0x5b2b68
push 0x5b2b74
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x673b9c], eax
push 0x6785ac
mov eax, dword [0x673ba8]
add eax, 1
push eax
push 0x679058
push 0
push 0x5b2b7c
push 0x5b2b88
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 4], eax
push 0x6785ac
mov ecx, dword [0x673ba8]
add ecx, 1
push ecx
push 0x678e58
push 0
push 0x5b2b90
push 0x5b2b9c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 4], eax
push 0x6785ac
mov edx, dword [0x673ba8]
add edx, 1
push edx
push 0x678f58
push 0x5b2ba4
push 0x5b2bb8
push 0x5b2bc4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 4], eax
push 0x6785ac
push 0x10
push 0x6787b4
push 0x5e8b60
push 0x5b2bcc
push 0x5b2bd8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esp, ebp
pop ebp
ret
Function at 0x483625
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x574788
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.005287a0
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x10], eax
lea ecx, [ebp + 8]
call fcn.005287a0
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0x18]
call fcn.00456720
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov edx, dword [ebp - 0x14]
push edx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0056206c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x48df5f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
push 0x442
mov ecx, dword [ebp - 0x24]
call fcn.005654d4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
call fcn.00404920
mov dword [0x5ea054], eax
mov ecx, dword [ebp - 4]
call fcn.00404920
neg eax
sbb eax, eax
and eax, 5
push eax
push 0x605
mov ecx, dword [ebp - 0x24]
call fcn.005654d4
mov ecx, eax
call fcn.0056577e
mov eax, dword [str.SoftwareSMI]
mov dword [ebp - 0x1c], eax
mov ecx, dword [0x5bed18]
mov dword [ebp - 0x18], ecx
mov edx, dword [0x5bed1c]
mov dword [ebp - 0x14], edx
mov al, byte [0x5bed20]
mov byte [ebp - 0x10], al
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0
mov ecx, dword [0x5ea054]
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 0x20]
push edx
push 0xf003f
push 0
lea eax, [ebp - 0x1c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x48e025
push 4
lea ecx, [ebp - 0xc]
push ecx
push 4
push 0
push 0x5bed24
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x48e066
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x20]
push edx
push 0
push 0x20006
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x48e066
push 4
lea ecx, [ebp - 0xc]
push ecx
push 4
push 0
push str.EnableTimeout
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esp, ebp
pop ebp
ret
Function at 0x48ee22
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
cmp dword [0x5e91cc], 0
jne 0x48ee3e
mov eax, 1
jmp 0x48ef79
cmp dword [0x5e91cc], 2
jne 0x48eecd
push 0x5ec0b8
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x88]
and eax, 0x10
test eax, eax
jne 0x48ee8e
push 0x10
push 0x5ec0b8
push str.Log_File_Directory_not_exist__
call fcn.0047a0b0
mov ecx, dword [eax + 0x1c]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x48ef79
push 0x5ebfb8
call fcn.0054ce70
add esp, 4
test eax, eax
ja 0x48eecd
cmp dword [0x5edfa0], 0
jne 0x48eecd
push 0x10
push 0x67fac4
push str.Log_File_Name_is_empty__
call fcn.0047a0b0
mov eax, dword [eax + 0x1c]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x48ef79
mov dword [ebp - 4], 0
jmp 0x48eedf
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 8
jge 0x48ef74
mov eax, dword [ebp - 4]
imul eax, eax, 0x1fe
add eax, 0x5ec1b8
push eax
call fcn.0054ce70
add esp, 4
test eax, eax
je 0x48ef6f
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x1fe
add ecx, 0x5ec2b7
push ecx
call fcn.0054ce70
add esp, 4
test eax, eax
ja 0x48ef6f
mov edx, dword [ebp - 4]
imul edx, edx, 0x1fe
add edx, 0x5ec1b8
push edx
mov eax, dword [ebp - 4]
add eax, 1
push eax
push str.Custom_Field__.2d__s__is_empty
lea ecx, [ebp - 0x84]
push ecx
call fcn.0054c6e3
add esp, 0x10
push 0x10
push 0x67fac8
lea edx, [ebp - 0x84]
push edx
call fcn.0047a0b0
mov eax, dword [eax + 0x1c]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x48ef79
jmp 0x48eed6
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4a7090
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov dword [ebp - 0x10c], ecx
push 0x6784a8
push 0
push str.ExtCommandCount
push 0x5c2498
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jle 0x4a7139
mov eax, dword [ebp - 0x10c]
mov ecx, dword [eax + 0x14e0]
add ecx, 1
mov edx, dword [ebp - 0x10c]
mov dword [edx + 0x14e0], ecx
mov eax, dword [ebp - 0x10c]
mov ecx, dword [eax + 0x14e0]
cmp ecx, dword [ebp - 0x108]
jl 0x4a7139
mov edx, dword [ebp - 0x10c]
mov dword [edx + 0x14e0], 0
push 0x6784a8
push 0x104
lea eax, [ebp - 0x104]
push eax
push 0x67fbe0
push str.ExtCommandRun
push 0x5c24b4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x104]
push ecx
call fcn.0054ef2f
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4aa17e
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
push 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004be410
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
and edx, 8
test edx, edx
je 0x4aa24c
mov eax, dword [ebp + 0x10]
push eax
push 0x5c2908
mov ecx, dword [ebp + 0x1c]
push ecx
push 0x5c290c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov edx, dword [ebp + 0x14]
mov eax, dword [edx*4 + 0x5e9ff8]
push eax
mov ecx, dword [0x5eaa50]
call fcn.0041a620
mov ecx, dword [ebp + 0x20]
mov dword [ecx], eax
mov edx, dword [ebp + 0x20]
mov eax, dword [edx]
push eax
push 0x5c2914
lea ecx, [ebp - 0x14]
push ecx
call fcn.0054c6e3
add esp, 0xc
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
push 0x5c2918
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0xb
push 0x5e9ff8
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [0x5eaa50]
call fcn.00419244
push 0xb
push 0x5e9ff8
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [0x5eaa4c]
call fcn.00419244
push 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 4]
push edx
mov ecx, dword [ebp + 8]
call fcn.004be000
jmp 0x4aa318
mov eax, dword [ebp + 0x10]
push eax
push 0x5c2920
mov ecx, dword [ebp + 0x1c]
push ecx
push 0x5c2924
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0x10
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0054bf90
add esp, 0xc
mov eax, dword [ebp + 0x10]
push eax
push 0x3a
mov ecx, dword [ebp + 0x18]
push ecx
push 0x5c292c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edx, dword [ebp + 0x20]
mov dword [edx], eax
push 0xb
push 0x5e9ff8
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [0x5eaa50]
call fcn.0041932e
mov ecx, dword [ebp + 0x20]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax*4 + 0x5e9ff8]
push ecx
mov ecx, dword [0x5eaa50]
call fcn.004020e0
cmp dword [ebp + 0x14], 1
jne 0x4aa2ff
mov dword [ebp - 0x18], 0
jmp 0x4aa2d8
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
cmp eax, dword [0x673b98]
jge 0x4aa2f4
mov ecx, dword [ebp - 0x18]
push ecx
mov ecx, dword [0x5eaa50]
call fcn.00419409
jmp 0x4aa2cf
mov ecx, dword [0x5eaa50]
call fcn.004195ce
mov ecx, dword [ebp - 0x1c]
call fcn.004afc19
push 8
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp + 8]
call fcn.004be000
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4b6509
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov dword [ebp - 0x410], ecx
mov dword [ebp - 4], 0
mov dword [0x5edf54], 1
cmp dword [0x5edf54], 0
jne 0x4b65ac
push 0x5eb960
lea eax, [ebp - 0x108]
push eax
call fcn.0054be90
add esp, 8
push 0x5c50b0
lea ecx, [ebp - 0x108]
push ecx
call fcn.0054bea0
add esp, 8
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x108]
push eax
call fcn.0054bea0
add esp, 8
push 0x5c50b4
mov ecx, dword [ebp + 8]
push ecx
call fcn.0054cb20
add esp, 8
test eax, eax
jne 0x4b6597
push 0x5c50b8
mov edx, dword [ebp + 8]
push edx
call fcn.0054cb20
add esp, 8
test eax, eax
je 0x4b65aa
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.0054be90
add esp, 8
jmp 0x4b65bf
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x108]
push eax
call fcn.0054be90
add esp, 8
cmp dword [0x5edf54], 0
jne 0x4b6600
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00529440
add esp, 4
push 0x5c50bc
lea edx, [ebp - 0x20c]
push edx
call fcn.0054bea0
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0054bea0
add esp, 8
jmp 0x4b666f
lea edx, [ebp - 0x20c]
push edx
call fcn.00529440
add esp, 4
push 0x5c50c0
lea eax, [ebp - 0x20c]
push eax
call fcn.0054bea0
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
call fcn.0054ce70
add esp, 4
mov dword [ebp - 4], eax
jmp 0x4b663d
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
jl 0x4b6655
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0x5c
jne 0x4b6653
jmp 0x4b6655
jmp 0x4b6634
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 1]
push ecx
lea edx, [ebp - 0x20c]
push edx
call fcn.0054bea0
add esp, 8
push 0
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [ebp - 0x108]
push edx
push 0x5edc7c
call fcn.0054be90
add esp, 8
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4b673b
lea ecx, [ebp - 0x20c]
push ecx
push 0x6785ac
call fcn.0054be90
add esp, 8
lea edx, [ebp - 0x20c]
push edx
push 0x5eda74
call fcn.0054be90
add esp, 8
mov eax, dword [ebp - 0x410]
push eax
push 0x6785ac
call fcn.004ad773
add esp, 8
call fcn.004a5ec3
push 0x6785ac
mov ecx, dword [ebp - 0x410]
call fcn.004ad3e0
push 0
push 0x5c50c4
mov ecx, 0x5ea158
call fcn.0041a877
cmp dword [0x5edf54], 0
jne 0x4b6723
cmp dword [0x5edf44], 0
je 0x4b6739
lea ecx, [ebp - 0x30c]
push ecx
push 0xd
push str.DOWNLOADINIOK
call fcn.004b79fe
add esp, 0xc
jmp 0x4b6774
push 0
push 0x5c50e4
mov ecx, 0x5ea158
call fcn.0041a877
cmp dword [0x5edf54], 0
jne 0x4b675e
cmp dword [0x5edf44], 0
je 0x4b6774
lea edx, [ebp - 0x40c]
push edx
push 0xf
push str.DOWNLOADINIFAIL
call fcn.004b79fe
add esp, 0xc
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x4b9087
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov dword [ebp - 0x4c], ecx
cmp dword [0x5ee01c], 0
jne 0x4b909e
jmp 0x4b9213
push 0x6784a8
push 0
push str.ENABLECOLUMNBUTTON
push 0x5c5450
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x4c]
call fcn.00411570
mov ecx, dword [ebp - 0x3c]
sub ecx, dword [ebp - 0x44]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x38]
sub edx, dword [ebp - 0x40]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x30]
mov dword [eax + 0x1508], ecx
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x34]
mov dword [edx + 0x150c], eax
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x30]
cmp edx, dword [ecx + 0x14f8]
jge 0x4b910f
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [eax + 0x14fc]
jge 0x4b910f
jmp 0x4b9213
lea edx, [ebp - 0x2c]
push edx
mov ecx, 0x5eaa08
call fcn.00411570
mov ecx, 0x5eaa08
call fcn.00401600
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 4]
call fcn.00568f03
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x38]
sub ecx, eax
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x20], edx
push 1
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, 0x5eaa08
call fcn.005656ee
mov ecx, dword [ebp - 0x3c]
sub ecx, dword [ebp - 0x44]
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
cdq
mov ecx, 6
idiv ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x48]
cdq
mov ecx, 6
idiv ecx
shl eax, 1
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x48]
cdq
mov ecx, 6
idiv ecx
imul eax, eax, 3
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x48]
cdq
mov ecx, 6
idiv ecx
mov dword [ebp - 0x50], eax
fild dword [ebp - 0x50]
fmul qword [0x580960]
call fcn.0054d0a0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0xffffffff
lea edx, [ebp - 0x1c]
push edx
push 5
mov ecx, 0x5eaa08
call fcn.004be300
cmp dword [ebp - 8], 0
je 0x4b91f8
push 1
mov ecx, dword [ebp - 0x4c]
call fcn.004b7e61
jmp 0x4b9202
push 0
mov ecx, dword [ebp - 0x4c]
call fcn.004b7e61
push 0
push 0xa
push 0x1111
mov ecx, dword [ebp - 0x4c]
call fcn.004116a0
mov esp, ebp
pop ebp
ret
Function at 0x4bba7c
Capabilities:
Check if file exists
Create directory
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x108], 1
lea eax, [ebp - 0x10c]
push eax
call fcn.005600cb
mov ecx, dword [ebp + 8]
push ecx
push 0x40
push 0x5eded4
push 0x67fd74
push str.DBName
push 0x5c5df8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x104]
push edx
call fcn.00529440
add esp, 4
cmp dword [ebp + 0xc], 0
je 0x4bbaff
push 0x5c5e00
lea eax, [ebp - 0x104]
push eax
call fcn.0054bea0
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x104]
push edx
call fcn.0054bea0
add esp, 8
jmp 0x4bbb13
push str.DBFile
lea eax, [ebp - 0x104]
push eax
call fcn.0054bea0
add esp, 8
lea ecx, [ebp - 0x10c]
call fcn.004bde60
push eax
lea ecx, [ebp - 0x10c]
call fcn.004bde40
push eax
lea ecx, [ebp - 0x10c]
call fcn.004bde20
push eax
push 0x5c5e0c
push 0x5edec4
call fcn.0054c6e3
add esp, 0x14
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4bbb6a
push 0
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp dword [ebp + 0xc], 0
jne 0x4bbbb9
push 0x5c5e1c
lea eax, [ebp - 0x104]
push eax
call fcn.0054bea0
add esp, 8
push 0x5edec4
lea ecx, [ebp - 0x104]
push ecx
call fcn.0054bea0
add esp, 8
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4bbbb9
push 0
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [ebp - 0x108]
mov esp, ebp
pop ebp
ret 8
Function at 0x4be965
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e0
movsx eax, byte [ebp + 8]
push eax
push 0x5c6de0
lea ecx, [ebp - 0xd8]
push ecx
call fcn.0054c6e3
add esp, 0xc
mov dword [0x6812c4], 0
movsx edx, byte [ebp + 8]
push edx
push 0x5c6de8
lea eax, [ebp - 0x98]
push eax
call fcn.0054c6e3
add esp, 0xc
push 0xff
push 0
lea ecx, [ebp - 0x1d8]
push ecx
call fcn.0054bf90
add esp, 0xc
push 0x50
push 0
lea edx, [ebp - 0x54]
push edx
call fcn.0054bf90
add esp, 0xc
push 0x50
lea eax, [ebp - 0x54]
push eax
push 0
push 0
lea ecx, [ebp - 0x58]
push ecx
push 0xff
lea edx, [ebp - 0x1d8]
push edx
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4bea2e
movsx ecx, byte [ebp - 0x54]
cmp ecx, 0x4e
jne 0x4bea2e
movsx edx, byte [ebp - 0x53]
cmp edx, 0x54
jne 0x4bea2e
movsx eax, byte [ebp - 0x52]
cmp eax, 0x46
jne 0x4bea2e
movsx ecx, byte [ebp - 0x51]
cmp ecx, 0x53
jne 0x4bea2e
mov dword [0x6812c4], 1
push 0
push 0x20000000
push 3
push 0
push 3
push 0xc0000000
lea edx, [ebp - 0xd8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0xffffffff
je 0x4beac5
call fcn.0053cb19
test eax, eax
je 0x4bea8d
push 0
lea eax, [ebp - 0x1dc]
push eax
push 0
push 0
push 0
push 0
push 0x90018
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x1e0], eax
jmp 0x4beabe
cmp dword [0x6812c4], 0
je 0x4beabe
push 0
lea eax, [ebp - 0x1dc]
push eax
push 0
push 0
push 0
push 0
push 0x90018
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x1e0], eax
mov eax, 1
jmp 0x4beac7
xor eax, eax
mov esp, ebp
pop ebp
ret