joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d9360
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push esi
push edi
mov edi, dword [esp + 0x20]
cmp dword [edi + 0x4c], 1
mov esi, dword [edi + 0x1c0]
mov dword [esp + 0x18], esi
jne 0x4d9387
mov dword [esp + 8], 0x1fe
mov byte [esi + 0x1c], 1
jmp 0x4d9393
mov dword [esp + 8], 0
mov byte [esi + 0x1c], 0
mov ecx, dword [edi + 0x64]
mov edx, dword [esp + 8]
mov eax, dword [edi + 4]
mov eax, dword [eax + 8]
push ecx
add edx, 0x100
push edx
push 1
push edi
call eax
xor ecx, ecx
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
add esp, 0x10
mov dword [esp + 0xc], ecx
cmp dword [edi + 0x64], ecx
jle 0x4d94a5
push ebx
push ebp
jmp 0x4d93dc
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x20]
mov edi, dword [esi + ecx*4 + 0x20]
cdq
idiv edi
cmp dword [esp + 0x10], 0
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], eax
je 0x4d93ff
mov edx, dword [esi + 0x18]
add dword [edx + ecx*4], 0xff
lea eax, [edx + ecx*4]
mov eax, dword [esi + 0x18]
mov ebp, dword [eax + ecx*4]
lea eax, [edi + 0xfe]
lea ecx, [edi + edi - 2]
cdq
idiv ecx
xor ebx, ebx
xor ecx, ecx
mov esi, eax
cmp ecx, esi
jle 0x4d944e
mov edx, ebx
imul edx, edx, 0x1fe
lea edi, [edx + edi + 0xfe]
jmp 0x4d9430
mov esi, dword [esp + 0x18]
add edi, 0x1fe
mov eax, edi
cdq
lea esi, [esi + esi - 2]
idiv esi
inc ebx
mov esi, eax
cmp ecx, esi
jg 0x4d9430
mov edi, dword [esp + 0x18]
mov al, byte [esp + 0x1c]
imul bl
mov byte [ecx + ebp], al
inc ecx
cmp ecx, 0xff
jle 0x4d9418
cmp dword [esp + 0x10], 0
je 0x4d948d
mov eax, 1
lea ecx, [ebp - 1]
nop
movzx edx, byte [ebp]
mov byte [ecx], dl
movzx edx, byte [ebp + 0xff]
mov byte [eax + ebp + 0xff], dl
inc eax
dec ecx
cmp eax, 0xff
jle 0x4d9470
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
inc eax
mov dword [esp + 0x14], eax
cmp eax, dword [ecx + 0x64]
jl 0x4d93d0
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x14
ret

Function at 0x4f95b0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
je 0x4f962a
cmp byte [eax], bl
je 0x4f962a
push ebx
push 0x80
push 3
push ebx
push 3
push closesocket
push eax
mov dword [edi], ebx
mov dword [edi + 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4f962a
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x4f960f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jne 0x4f9617
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [edi], eax
mov dword [edi + 4], ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
neg eax
sbb eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f9640
Capabilities:
Move file

Disassembly:
test esi, esi
je 0x4f964a
mov dword [esi], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x4f9659
xor eax, eax
ret
test esi, esi
je 0x4f9670
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4f9670
mov dword [esi], 1
or eax, 0xffffffff
ret

Function at 0x4fa5e0
Capabilities:
Create directory

Disassembly:
test esi, esi
jne 0x4fa5ea
call dword [sym.imp.MSVCR100.dll_abort]
mov eax, 0x60df7c
mov edx, esi
sub edx, eax
mov cl, byte [edx + eax]
test cl, cl
je 0x4fa604
mov byte [eax], cl
inc eax
cmp eax, 0x60e37b
jb 0x4fa5f3
push ebx
push edi
mov edi, 0x5cc7f4
mov ebx, 0x60df7c
mov byte [eax], 0
call fcn.004015d0
test eax, eax
jne 0x4fa630
push 0x400
mov ebx, edi
mov eax, 0x60df7c
call fcn.00401570
add esp, 4
push 0
push 0x60df7c
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop ebx
ret

Function at 0x4fa640
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x601018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
test ebx, ebx
je 0x4fa6b7
cmp byte [ebx], 0
je 0x4fa6b7
push str.default
push ebx
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
je 0x4fa6b7
lea eax, [ebp - 0x404]
mov edx, 0x60df7c
mov ecx, eax
sub edx, ecx
mov cl, byte [edx + eax]
test cl, cl
je 0x4fa692
mov byte [eax], cl
inc eax
lea ecx, [ebp - 5]
cmp eax, ecx
jb 0x4fa681
mov byte [eax], 0
push 0x400
lea eax, [ebp - 0x404]
call fcn.00401570
add esp, 4
push 0
lea edx, [ebp - 0x404]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00596083
mov esp, ebp
pop ebp
ret
Function at 0x4fe4d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4814
call fcn.005965e0
mov eax, dword [0x601018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
push 0x4000
lea eax, [ebp - 0x4804]
push eax
push 0x5bc564
push 0
push 0
mov word [ebp - 0x4804], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x4804], 0
lea esi, [ebp - 0x4804]
je 0x4fe61c
push edi
mov eax, dword [ebx + 4]
test eax, eax
je 0x4fe535
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov eax, ebx
call fcn.004faf40
mov dword [ebp - 0x4814], eax
test esi, esi
je 0x4fe5ff
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4fe550
sub eax, edx
mov edx, dword [ebx + 0x5010]
push edx
lea edi, [esi + eax]
call dword [sym.imp.icuuc51.dll_ucnv_reset_51]
lea ecx, [ebp - 0x480c]
push ecx
push 1
push 0
push edi
lea eax, [ebp - 0x804]
lea edx, [ebp - 0x4810]
push edx
mov edx, dword [ebx + 0x5010]
mov dword [ebp - 0x4808], eax
lea eax, [ebp - 6]
push eax
lea ecx, [ebp - 0x4808]
push ecx
push edx
mov dword [ebp - 0x480c], 0
mov dword [ebp - 0x4810], esi
call dword [sym.imp.icuuc51.dll_ucnv_toUnicode_51]
mov eax, dword [ebp - 0x480c]
add esp, 0x24
test eax, eax
jle 0x4fe5cd
cmp eax, 0xf
je 0x4fe5cd
xor eax, eax
mov word [ebp - 0x804], ax
jmp 0x4fe5e8
mov edx, dword [ebp - 0x4808]
xor ecx, ecx
mov word [edx], cx
mov eax, dword [ebp - 0x4808]
lea ecx, [ebp - 0x804]
sub eax, ecx
sar eax, 1
push eax
mov eax, dword [ebp - 0x4814]
lea edx, [ebp - 0x804]
push edx
push 0
push eax
push ebx
call fcn.004fac50
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4fe604
sub eax, edx
cmp byte [esi + eax + 1], cl
lea esi, [esi + eax + 1]
jne 0x4fe524
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00596083
mov esp, ebp
pop ebp
ret 4
Function at 0x4fe630
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa00c
call fcn.005965e0
mov eax, dword [0x601018]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
mov dword [ebp - 0xa008], eax
mov dword [ebp - 0xa00c], esi
jl 0x4fe83b
test eax, eax
je 0x4fe83b
test esi, esi
je 0x4fe83b
push ebx
push eax
push 0x400
lea eax, [ebp - 0x804]
push eax
push 0x5bc564
push str.inherit
push esi
mov byte [ebp - 0x804], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x804], 0
lea ebx, [ebp - 0x804]
je 0x4fe70e
lea esp, [esp]
test ebx, ebx
jne 0x4fe6ba
call dword [sym.imp.MSVCR100.dll_abort]
lea eax, [ebp - 0x404]
mov cl, byte [ebx]
test cl, cl
je 0x4fe6d6
inc ebx
cmp cl, 0x2c
je 0x4fe6d6
mov byte [eax], cl
inc eax
lea ecx, [ebp - 5]
cmp eax, ecx
jb 0x4fe6c0
lea esi, [ebp - 0x404]
mov byte [eax], 0
call fcn.00401830
cmp byte [ebp - 0x404], 0
je 0x4fe703
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp - 0xa008]
dec edx
push edx
mov eax, esi
push eax
push ecx
mov ecx, edi
call fcn.004fe630
cmp byte [ebx], 0
jne 0x4fe6b0
mov esi, dword [ebp - 0xa00c]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4fe713
sub eax, edx
push eax
mov eax, esi
lea ebx, [edi + 0x5010]
push 0x400
lea esi, [ebp - 0x2004]
call fcn.00516d70
mov ecx, dword [ebp - 0xa008]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4fe740
sub eax, esi
push eax
push 0x400
mov eax, ecx
lea esi, [ebp - 0x1804]
call fcn.00516d70
xor edx, edx
mov ecx, esi
push ecx
push 0x4000
mov dword [ebp - 0xa004], edx
lea edx, [ebp - 0xa004]
push edx
push 0x5e5130
push 0
lea eax, [ebp - 0x2004]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0xa004], 0
lea esi, [ebp - 0xa004]
je 0x4fe83a
jmp 0x4fe7a0
lea edx, [ebp - 0x1804]
push edx
push 0x400
lea eax, [ebp - 0x1004]
push eax
xor ecx, ecx
push 0x5e5130
mov word [ebp - 0x1004], cx
push esi
lea ecx, [ebp - 0x2004]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
mov ecx, edi
call fcn.004fc850
test eax, eax
jns 0x4fe810
mov eax, dword [edi + 4]
test eax, eax
je 0x4fe7ec
mov edx, dword [eax + 8]
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov eax, edi
call fcn.004faf40
push 0xffffffffffffffff
push esi
push 0
mov ebx, eax
push ebx
push edi
call fcn.004fac50
push 0xffffffffffffffff
lea eax, [ebp - 0x1004]
push eax
push 1
push ebx
jmp 0x4fe81c
push 0xffffffffffffffff
lea ecx, [ebp - 0x1004]
push ecx
push 1
push eax
push edi
call fcn.004fac50
push esi
call dword [sym.imp.icuuc51.dll_u_strlen_51]
lea esi, [esi + eax*2 + 2]
add esp, 4
cmp word [esi], 0
jne 0x4fe7a0
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00596083
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4fe850
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4c0c
call fcn.005965e0
mov eax, dword [0x601018]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x4c08], ecx
mov dword [ebp - 0x4c0c], esi
jl 0x4fe9b3
test ebx, ebx
je 0x4fe9b3
test esi, esi
je 0x4fe9b3
push edi
push ebx
push 0x400
lea eax, [ebp - 0x804]
push eax
push 0x5bc564
push str.inherit
push esi
mov byte [ebp - 0x804], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x804], 0
lea edi, [ebp - 0x804]
je 0x4fe92c
lea ebx, [ebx]
test edi, edi
jne 0x4fe8da
call dword [sym.imp.MSVCR100.dll_abort]
lea eax, [ebp - 0x404]
mov cl, byte [edi]
test cl, cl
je 0x4fe8f6
inc edi
cmp cl, 0x2c
je 0x4fe8f6
mov byte [eax], cl
inc eax
lea ecx, [ebp - 5]
cmp eax, ecx
jb 0x4fe8e0
lea esi, [ebp - 0x404]
mov byte [eax], 0
call fcn.00401830
cmp byte [ebp - 0x404], 0
je 0x4fe921
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x4c08]
dec edx
push edx
mov eax, esi
push eax
push ebx
call fcn.004fe850
cmp byte [edi], 0
jne 0x4fe8d0
mov esi, dword [ebp - 0x4c0c]
push ebx
push 0x4000
lea ecx, [ebp - 0x4c04]
push ecx
push 0x5bc564
push 0
push esi
mov word [ebp - 0x4c04], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x4c04], 0
lea esi, [ebp - 0x4c04]
pop edi
je 0x4fe9b3
mov eax, dword [ebp - 0x4c0c]
push ebx
push 0x400
lea edx, [ebp - 0xc04]
push edx
push 0x5bc564
push esi
push eax
mov byte [ebp - 0xc04], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [ebp - 0x4c08]
push ecx
lea ecx, [ebp - 0xc04]
mov edx, esi
call fcn.004fd230
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4fe9a0
sub eax, edx
cmp byte [esi + eax + 1], cl
lea esi, [esi + eax + 1]
jne 0x4fe960
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00596083
mov esp, ebp
pop ebp
ret 0xc

Function at 0x500670
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, edx
push edi
cmp esi, 2
jl 0x5006a2
mov edi, esi
shr edi, 1
mov edx, edi
neg edx
lea esi, [esi + edx*2]
push ebx
mov edx, ecx
movzx ebx, byte [edx + 1]
movzx edx, byte [edx]
shl ebx, 8
or ebx, edx
xor eax, ebx
add ecx, 2
imul eax, eax, 0x1000193
dec edi
jne 0x500685
pop ebx
test esi, esi
je 0x5006bc
xor edx, edx
movzx edi, byte [ecx]
shl edx, 8
or edx, edi
inc ecx
dec esi
jne 0x5006a8
xor eax, edx
imul eax, eax, 0x1000193
pop edi
pop esi
ret
Function at 0x503990
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push esi
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 8]
push eax
call esi
test eax, eax
jne 0x5039b3
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x10]
push ecx
call esi
test eax, eax
jne 0x5039c2
xor ecx, ecx
jmp 0x5039ca
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
sub ecx, dword [edi]
mov edx, dword [0x61023c]
sbb eax, dword [edi + 4]
push edx
mov edx, dword [0x610238]
push edx
push eax
push ecx
call fcn.00596bf0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x505660
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x601018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x400
lea eax, [ebp - 0x804]
mov esi, ecx
call fcn.00508eb0
mov eax, esi
add esp, 4
mov edx, eax
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x505690
lea edi, [ebp - 0x804]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x5056a0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x804]
push eax
push 0x400
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x404]
push ecx
push 0x5bc564
push str.EBCDICtoASCII
push str.Tables
call esi
lea edx, [ebp - 0x404]
push 0x601b38
push edx
mov ecx, 0x60d628
call fcn.00505550
add esp, 8
lea eax, [ebp - 0x804]
push eax
push 0x400
lea ecx, [ebp - 0x404]
push ecx
push 0x5bc564
push str.ASCIItoEBCDIC
push str.Tables
call esi
lea edx, [ebp - 0x404]
push 0x601c38
push edx
mov ecx, 0x60d528
call fcn.00505550
add esp, 8
lea eax, [ebp - 0x804]
push eax
push 0x400
lea ecx, [ebp - 0x404]
push ecx
push 0x5bc564
push str.BackupOEMtoWASCtable
push str.Tables
call esi
lea edx, [ebp - 0x404]
push 0x601d38
push edx
mov ecx, 0x60d328
call fcn.00505550
add esp, 8
lea eax, [ebp - 0x804]
push eax
push 0x400
lea ecx, [ebp - 0x404]
push ecx
push 0x5bc564
push str.OEMtoWASCtable
push str.Tables
call esi
lea edx, [ebp - 0x404]
push 0x601e38
push edx
mov ecx, 0x60d028
call fcn.00505550
add esp, 8
lea eax, [ebp - 0x804]
push eax
push 0x400
lea ecx, [ebp - 0x404]
push ecx
push 0x5bc564
push str.SortTable
push str.Tables
call esi
lea edx, [ebp - 0x404]
push 0x601f38
push edx
mov ecx, 0x60d428
call fcn.00505550
add esp, 8
lea eax, [ebp - 0x804]
push eax
push 0x400
lea ecx, [ebp - 0x404]
push ecx
push 0x5bc564
push str.SortTableDefault
push str.Tables
call esi
lea edx, [ebp - 0x404]
push 0x602038
push edx
mov ecx, 0x60d128
call fcn.00505550
add esp, 8
lea eax, [ebp - 0x804]
push eax
push 0x400
lea ecx, [ebp - 0x404]
push ecx
push 0x5bc564
push str.KeyActivateAnnotation
push str.Tables
call esi
lea edx, [ebp - 0x404]
push 0x602338
push edx
mov ecx, 0x60cf28
call fcn.00505550
add esp, 8
lea eax, [ebp - 0x804]
push eax
push 0x400
lea ecx, [ebp - 0x404]
push ecx
push 0x5bc564
push str.KeyActivateIndex
push str.Tables
call esi
lea edx, [ebp - 0x404]
push 0x602438
push edx
mov ecx, 0x60d228
call fcn.00505550
mov ecx, dword [ebp - 4]
add esp, 8
pop edi
xor ecx, ebp
pop esi
call fcn.00596083
mov esp, ebp
pop ebp
ret
Function at 0x506050
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x601018]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x6122d8
push 0x400
lea eax, [ebp - 0x808]
push eax
push 0x5bc564
push str.Widths
push str.Resources
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, str.7.2.0.19
lea eax, [ebp - 0x808]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x5060b4
test dl, dl
je 0x5060b0
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x5060b4
add eax, 2
add ecx, 2
test dl, dl
jne 0x506094
xor eax, eax
jmp 0x5060b9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x506161
push 0x400
lea eax, [ebp - 0x408]
call fcn.00508eb0
lea eax, [ebp - 0x408]
add esp, 4
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5060e0
sub eax, edx
test eax, eax
jle 0x506100
cmp byte [ebp + eax - 0x409], 0x5c
lea eax, [ebp + eax - 0x409]
jne 0x506100
mov byte [eax], cl
lea ecx, [ebp - 0x408]
push str..wid
push ecx
call fcn.00505bd0
lea edx, [ebp - 0x408]
push str..pu
push edx
call fcn.00505bd0
lea eax, [ebp - 0x408]
push str..gid
push eax
call fcn.00505bd0
lea ecx, [ebp - 0x408]
push str..enc
push ecx
call fcn.00505bd0
add esp, 0x20
push 0x6122d8
push str.7.2.0.19
push str.Widths
push str.Resources
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00596083
mov esp, ebp
pop ebp
ret
Function at 0x506170
Capabilities:
Read .ini file

Disassembly:
push ecx
push ebx
push esi
push 0x1830
push 0
push 0x6116d8
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x400
mov eax, 0x611ad8
call fcn.00508eb0
add esp, 4
push 0x400
mov eax, 0x6122d8
call fcn.00508eb0
add esp, 4
push 0x400
mov eax, 0x611ed8
call fcn.00508eb0
add esp, 4
push 0x400
mov eax, 0x6126d8
call fcn.00508eb0
add esp, 4
push 0x400
mov ebx, str.client.ini
mov eax, 0x611ad8
call fcn.00401570
add esp, 4
push 0x400
mov ebx, str.profiles.ini
mov eax, 0x611ed8
call fcn.00401570
add esp, 4
push 0x400
mov ebx, str.station.ini
mov eax, 0x6122d8
call fcn.00401570
add esp, 4
push 0x400
mov ebx, str.database.ini
mov eax, 0x6126d8
call fcn.00401570
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
add esp, 4
push 0x611ad8
push 0
push str.ShowFontLoad
push str.Debug
call esi
push 0x611ad8
push 0
push str.MetaLine
push str.Debug
mov dword [0x612ad8], eax
call esi
push 0x611ad8
push 0
push str.MetaImage
push str.Debug
mov dword [0x612adc], eax
call esi
push 0x611ad8
push 0
push str.MetaPerf
push str.Debug
mov dword [0x612ae0], eax
call esi
push 0x611ad8
push 0
push str.Greek
push str.Debug
mov dword [0x612ae4], eax
call esi
push 0x611ad8
push 0
push str.AFPCommand
push str.Debug
mov dword [0x612ae8], eax
call esi
mov dword [0x612aec], eax
push 0x611ad8
push 0
push str.AFPLine
push str.Debug
call esi
push 0x611ad8
push 0
push str.GOCACommand
push str.Debug
mov dword [0x612af0], eax
call esi
push 0x611ad8
push 0
push str.SubstituteFonts
push str.Debug
mov dword [0x612af4], eax
call esi
push 0x611ad8
push 0
push str.PrintTiles
push str.Debug
mov dword [0x612af8], eax
call esi
push 0x611ad8
push 0
push str.Ghostscript
push str.Debug
mov dword [0x612afc], eax
call esi
push 0x611ad8
push 0
push str.Connections
push str.Debug
mov dword [0x612b00], eax
call esi
push 0x611ad8
push 0x400
push 0x612b08
push 0x5bc564
push str.CodePage
push str.Encoding
mov dword [0x612b04], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
call fcn.00506050
pop esi
pop ebx
pop ecx
ret
Function at 0x509d80
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov esi, ecx
mov ecx, dword [esi + 8]
lea eax, [ebp - 4]
push eax
xor edi, edi
push ecx
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x509db8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
cmp eax, edi
jne 0x509dc4
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [esi + 0x10], edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
xor edx, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x50a2a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp dword [esi + 0x10], 0
push ebx
push edi
mov edi, eax
jne 0x50a476
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x50a476
mov eax, dword [ecx]
mov edx, dword [eax + 0x30]
call edx
mov ecx, dword [esi + 8]
mov ebx, eax
mov eax, dword [ecx]
mov dword [esp + 0x14], edx
mov edx, dword [eax + 0x14]
mov dword [esp + 0x10], ebx
call edx
test eax, eax
jne 0x50a476
test edi, edi
jle 0x50a304
mov eax, edi
cdq
mov edi, eax
mov eax, dword [esi + 0xc]
mov ecx, edx
add edi, ebx
adc ecx, dword [esp + 0x14]
cdq
cmp ecx, edx
jg 0x50a33a
jl 0x50a304
cmp edi, eax
ja 0x50a33a
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
mov edx, dword [eax + 0x34]
call edx
mov ecx, dword [esi + 8]
mov ebx, eax
mov eax, dword [ecx]
mov edi, edx
mov edx, dword [eax + 0x14]
call edx
test eax, eax
jne 0x50a476
mov eax, dword [esi + 0xc]
cdq
cmp edi, edx
jl 0x50a476
jg 0x50a33a
cmp ebx, eax
jbe 0x50a476
push 0x434
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
test eax, eax
je 0x50a357
call fcn.00508f50
mov ebx, eax
test ebx, ebx
jne 0x50a373
mov ecx, dword [esi + 8]
mov dword [esi + 4], 0x1255d
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push 0x1255d
call edx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x14]
push eax
mov dword [esp + 0x10], eax
lea eax, [esi + 0x414]
push eax
mov edi, ebx
call fcn.00508fc0
mov edx, dword [ebx]
mov eax, dword [edx + 0x14]
add esp, 8
mov ecx, ebx
call eax
test eax, eax
je 0x50a39f
mov edx, dword [ebx]
mov ecx, ebx
jmp 0x50a3c2
mov ecx, dword [esi + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x38]
push 0
push 0
push 0
call eax
mov ecx, dword [esi + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
test eax, eax
je 0x50a3da
mov ecx, dword [esi + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
mov dword [esi + 4], eax
mov edx, dword [ebx]
mov eax, dword [edx]
push 1
mov ecx, ebx
call eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [esi + 8]
call fcn.00506c00
mov edx, dword [ebx]
mov eax, dword [edx + 0x14]
mov ecx, ebx
call eax
mov edx, dword [ebx]
test eax, eax
je 0x50a416
mov eax, dword [edx + 0x14]
mov ecx, ebx
call eax
mov dword [esi + 4], eax
mov edx, dword [ebx]
mov eax, dword [edx]
push 1
mov ecx, ebx
call eax
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [edx + 0x38]
push 0
push eax
push ecx
mov ecx, ebx
call edx
mov eax, dword [ebx]
mov edx, dword [eax + 0x14]
mov ecx, ebx
call edx
test eax, eax
je 0x50a45d
mov eax, dword [ebx]
mov edx, dword [eax + 0x14]
mov ecx, ebx
call edx
mov dword [esi + 4], eax
mov eax, dword [ebx]
mov edx, dword [eax]
push 1
mov ecx, ebx
call edx
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x50a46c
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [esi + 8], ebx
mov dword [esi + 0x10], 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x514b50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59f8ff
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x601018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov dword [esi], vtable.Index.0
xor edi, edi
mov dword [esi + 0x244], edi
mov dword [esi + method.VirtualFile.virtual_0], vtable.VirtualFile.0
mov dword [esi + 0x24c], edi
mov dword [ebp - 4], edi
xor eax, eax
mov dword [esi + 0x250], edi
mov dword [esi + 0x254], edi
mov dword [esi + 0x264], eax
mov dword [esi + 0x268], eax
push 0x418
mov dword [esi + 0x26c], eax
lea eax, [esi + 0x270]
push edi
push eax
call sub.MSVCR100.dll_memset
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
add esp, 0xc
mov dword [esi + 0x30], eax
mov dword [esi + 8], ebx
cmp ebx, edi
je 0x514bfe
mov ecx, ebx
call fcn.0051c5d0
push 0x208
lea ecx, [esi + 0x38]
push edi
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
lea edi, [esi + 0x40]
mov ebx, 0x10
jmp 0x514c20
push 0x1400
call fcn.00596073
mov dword [edi], eax
add esp, 4
add edi, 0x20
dec ebx
jne 0x514c20
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push edx
push eax
mov ecx, esi
call fcn.00514d70
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc