joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f190
Capabilities:
Delete file
Move file

Disassembly:
sub esp, 0x22c
mov eax, dword [ecx]
push ebx
push ebp
push esi
push edi
push 0x3fe
push eax
mov dword [esp + 0x18], ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
mov edi, eax
push 0x1004
push edi
call ebx
mov ebp, eax
xor esi, esi
test ebp, ebp
jle 0x40f1dc
push 2
push esi
push 0x102c
push edi
call ebx
test eax, eax
jne 0x40f208
inc esi
cmp esi, ebp
jl 0x40f1c8
mov ebx, dword [esp + 0x10]
cmp esi, ebp
jne 0x40f231
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
push 0x40
push 0x452290
push str.Select_a_User_First_
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x22c
ret
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x1005
push edi
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], 4
mov dword [esp + 0x2c], 0
call ebx
mov ebx, dword [esp + 0x34]
jmp 0x40f1e0
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
push 0x24
push 0x4522bc
push str.Delete_User_
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
je 0x40f303
push 0x4522e0
push 0x4522e4
call fcn.0043a547
push 0x4522ec
push 0x4522f0
mov esi, eax
call fcn.0043a547
push esi
mov ebp, eax
call fcn.0043a4aa
push esi
push 0x1fe
mov edi, eax
lea eax, [esp + 0x58]
push 1
push eax
call fcn.0043a2fc
add esp, 0x24
test eax, eax
je 0x40f2d0
cmp edi, ebx
je 0x40f2af
push ebp
push 0x1fe
lea ecx, [esp + 0x44]
push 1
push ecx
call fcn.0043a661
add esp, 0x10
push esi
call fcn.0043a4aa
push esi
push 0x1fe
lea edx, [esp + 0x48]
push 1
push edx
mov edi, eax
call fcn.0043a2fc
add esp, 0x14
test eax, eax
jne 0x40f296
push esi
call fcn.0043a1c2
push ebp
call fcn.0043a1c2
add esp, 8
push 0x4522fc
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x452304
push str.users.tmp
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ecx, dword [esp + 0x10]
call fcn.0040ef60
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x22c
ret
Function at 0x40f480
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
mov ebx, dword [esp + 0x48]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0x4668f8
push 0
push 0x452154
mov esi, ecx
push 0x452158
mov dword [esi], ebx
call edi
test eax, eax
je 0x40f4b7
mov eax, dword [esi]
push 1
push 0x3e8
push eax
jmp 0x40f4c1
mov ecx, dword [esi]
push 0
push 0x3e8
push ecx
call dword [sym.imp.USER32.dll_CheckDlgButton]
push 0x4668f8
push 2
push 0x45216c
push 0x45217c
call edi
sub eax, 0
je 0x40f50d
dec eax
je 0x40f4f9
dec eax
push 0x469
push 0x469
push 0x467
jne 0x40f51c
mov eax, dword [esi]
push eax
jmp 0x40f51f
mov ecx, dword [esi]
push 0x468
push 0x469
push 0x467
push ecx
jmp 0x40f51f
push 0x467
push 0x469
push 0x467
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_CheckRadioButton]
push 0x3fe
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0x60
push 0
mov edi, eax
push 0x1036
push edi
call ebx
mov eax, 0x78
mov dword [esp + 0x14], eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0xc]
push eax
push 0
mov ecx, 7
push 0x101b
push edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0x452190
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], 0
mov dword [esp + 0x48], 0x452198
call ebx
lea ecx, [esp + 0x2c]
push ecx
push 1
push 0x101b
push edi
call ebx
mov ecx, esi
call fcn.0040ef60
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x40
ret 4

Function at 0x40f9e0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x445142
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
push edi
je 0x40fb05
mov edi, dword [esp + 0x18]
push edi
push 0x4b0
push 0x4524c4
push 0x4524d4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 0x960
jg 0x40fac2
je 0x40fa98
cmp eax, 0x12c
je 0x40fa6e
cmp eax, 0x4b0
jne 0x40fafb
push 0x84
call fcn.004394a2
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
mov dword [esp + 0x10], 1
je 0x40faf3
push 1
push edi
push esi
mov ecx, eax
call fcn.0042a630
jmp 0x40faf5
push 0x84
call fcn.004394a2
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
mov dword [esp + 0x10], 0
je 0x40faf3
push 1
push edi
push esi
mov ecx, eax
call fcn.0042a9f0
jmp 0x40faf5
push 0x84
call fcn.004394a2
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
mov dword [esp + 0x10], 2
je 0x40faf3
push 1
push edi
push esi
mov ecx, eax
call fcn.0042a890
jmp 0x40faf5
cmp eax, 0x2580
jne 0x40fafb
push 0x84
call fcn.004394a2
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
mov dword [esp + 0x10], 3
je 0x40faf3
push 1
push edi
push esi
mov ecx, eax
call fcn.0042ab50
jmp 0x40faf5
xor eax, eax
mov dword [esi + 0x144], eax
mov dword [esi + 0x15b], 1
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4
Function at 0x4102a0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44518c
push eax
mov dword fs:[0], esp
sub esp, 0xa0
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push edi
mov ebp, ecx
lea edi, [ebp + 0x62de9]
push edi
push 0
push 0x4526b8
push 0x4526c8
call esi
test eax, eax
je 0x410440
push ebx
push edi
push 0x88b8
push str.LEFT_TX_MAIN_PREV
push 0x4526e4
call esi
push edi
push 0x88b8
push str.RIGHT_TX_MAIN_PREV
push 0x452700
mov ebx, eax
call esi
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x62ddd]
push eax
push 1
push 4
lea ecx, [esp + 0x88]
call fcn.00437130
mov ecx, dword [esp + 0x10]
push ecx
push ebx
lea ecx, [esp + 0x84]
mov dword [esp + 0xc0], 0
call fcn.00437170
push edi
push 0x88b8
push str.LEFT_TX_WAVE_PREV
push 0x45271c
call esi
push edi
push 0x88b8
push str.RIGHT_TX_WAVE_PREV
push 0x452738
mov ebx, eax
call esi
mov edx, dword [ebp + 0x62ddd]
push edx
push 1
push 0x1008
lea ecx, [esp + 0x54]
mov dword [esp + 0x1c], eax
call fcn.00437130
mov eax, dword [esp + 0x10]
push eax
push ebx
lea ecx, [esp + 0x50]
mov byte [esp + 0xc0], 1
call fcn.00437170
mov ecx, dword [esp + 0xc0]
push ecx
push 0x1002
push 0x452740
push 0x452748
call esi
push edi
push 0x88b8
push str.LEFT_RX_PREV
push 0x452760
mov ebx, eax
call esi
push edi
push 0x88b8
push str.RIGHT_RX_PREV
push 0x452778
mov dword [esp + 0x20], eax
call esi
mov edx, dword [ebp + 0x62ddd]
push edx
push 1
push ebx
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.00437130
mov eax, dword [esp + 0x10]
push esi
mov byte [esp + 0xbc], 2
push eax
lea ecx, [esp + 0x1c]
call fcn.00437bd0
lea ecx, [esp + 0x14]
mov byte [esp + 0xb8], 1
call fcn.00437120
lea ecx, [esp + 0x48]
mov byte [esp + 0xb8], 0
call fcn.00437120
lea ecx, [esp + 0x7c]
mov dword [esp + 0xb8], 0xffffffff
call fcn.00437120
pop ebx
mov ecx, dword [esp + 0xac]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0xac
ret 4
Function at 0x410d70
Capabilities:
Capture microphone audio

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 0x62dcd]
test eax, eax
mov dword [esp + 8], esi
jne 0x410edb
push ebx
push ebp
push edi
mov dword [esi + 0x62dcd], 1
mov dword [esi + 0x15f], 0x1000
mov dword [esi + 0x10], 0
lea ebx, [esi + 0x439]
lea edx, [esi + 0x179]
mov ebp, 0xa
xor eax, eax
mov edi, edx
mov ecx, 8
rep stosd dword es:[edi], eax
mov edi, ebx
mov ecx, 0x800
add edx, 0x20
add ebx, 0x20c8
dec ebp
rep stosd dword es:[edi], eax
jne 0x410db7
mov eax, dword [0x466c98]
test eax, eax
lea ebp, [esi + 0xc]
jne 0x410dfe
mov ecx, dword [esi + 0x62ddd]
push 0x30000
push esi
push 0x410d30
lea eax, [esi + 0x167]
push eax
push ecx
jmp 0x410e17
mov eax, dword [esi + 0x62ddd]
push 0x30008
push esi
push 0x410d30
lea edx, [esi + 0x167]
push edx
push eax
push ebp
call dword [sym.imp.WINMM.dll_waveInOpen]
test eax, eax
je 0x410e4b
mov ecx, dword [ebp]
push ecx
call dword [sym.imp.WINMM.dll_waveInReset]
mov edx, dword [ebp]
push edx
call dword [sym.imp.WINMM.dll_waveInClose]
push str.Error_open_Wavein_device
call fcn.00436550
add esp, 4
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret
mov eax, dword [esp + 0x14]
xor ebx, ebx
add esi, 0x189
add eax, 0x439
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
lea edi, [esi - 0x10]
push 0x20
mov dword [edi], eax
mov dword [esi - 0xc], 0x2000
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi - 4], ebx
mov ecx, dword [ebp]
push edi
push ecx
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
mov edx, dword [ebp]
push 0x20
push edi
push edx
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
mov edx, dword [esp + 0x10]
inc ebx
add edx, 0x20c8
add esi, 0x20
cmp ebx, 9
mov dword [esp + 0x10], edx
jl 0x410e60
mov eax, dword [ebp]
push eax
call dword [sym.imp.WINMM.dll_waveInStart]
test eax, eax
je 0x410ecd
push eax
push str.SOUND:ERROR_Waveinstart_d
call fcn.00436550
add esp, 8
mov ecx, dword [esp + 0x14]
pop edi
pop ebp
mov dword [ecx + 0x10], 9
pop ebx
pop esi
add esp, 8
ret
Function at 0x410d73
Capabilities:
Capture microphone audio

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 0x62dcd]
test eax, eax
mov dword [esp + 8], esi
jne 0x410edb
push ebx
push ebp
push edi
mov dword [esi + 0x62dcd], 1
mov dword [esi + 0x15f], 0x1000
mov dword [esi + 0x10], 0
lea ebx, [esi + 0x439]
lea edx, [esi + 0x179]
mov ebp, 0xa
xor eax, eax
mov edi, edx
mov ecx, 8
rep stosd dword es:[edi], eax
mov edi, ebx
mov ecx, 0x800
add edx, 0x20
add ebx, 0x20c8
dec ebp
rep stosd dword es:[edi], eax
jne 0x410db7
mov eax, dword [0x466c98]
test eax, eax
lea ebp, [esi + 0xc]
jne 0x410dfe
mov ecx, dword [esi + 0x62ddd]
push 0x30000
push esi
push 0x410d30
lea eax, [esi + 0x167]
push eax
push ecx
jmp 0x410e17
mov eax, dword [esi + 0x62ddd]
push 0x30008
push esi
push 0x410d30
lea edx, [esi + 0x167]
push edx
push eax
push ebp
call dword [sym.imp.WINMM.dll_waveInOpen]
test eax, eax
je 0x410e4b
mov ecx, dword [ebp]
push ecx
call dword [sym.imp.WINMM.dll_waveInReset]
mov edx, dword [ebp]
push edx
call dword [sym.imp.WINMM.dll_waveInClose]
push str.Error_open_Wavein_device
call fcn.00436550
add esp, 4
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret
mov eax, dword [esp + 0x14]
xor ebx, ebx
add esi, 0x189
add eax, 0x439
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
lea edi, [esi - 0x10]
push 0x20
mov dword [edi], eax
mov dword [esi - 0xc], 0x2000
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi - 4], ebx
mov ecx, dword [ebp]
push edi
push ecx
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
mov edx, dword [ebp]
push 0x20
push edi
push edx
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
mov edx, dword [esp + 0x10]
inc ebx
add edx, 0x20c8
add esi, 0x20
cmp ebx, 9
mov dword [esp + 0x10], edx
jl 0x410e60
mov eax, dword [ebp]
push eax
call dword [sym.imp.WINMM.dll_waveInStart]
test eax, eax
je 0x410ecd
push eax
push str.SOUND:ERROR_Waveinstart_d
call fcn.00436550
add esp, 8
mov ecx, dword [esp + 0x14]
pop edi
pop ebp
mov dword [ecx + 0x10], 9
pop ebx
pop esi
add esp, 8
ret
Function at 0x4110f0
Capabilities:
Access peb ldr_data
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x445241
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xc]
mov ecx, edi
mov dword [esp + 0x10], esi
mov dword [esi], fcn.004113f0
call fcn.00424950
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push ebp
push 4
push 0x452780
push 0x452790
mov dword [esp + 0x2c], 0
mov dword [esi + 4], eax
mov dword [esi + 0x30], ecx
call ebx
push ebp
push 0x4b0
push 0x4527a0
push 0x4527b0
mov dword [esi + 0x80], eax
call ebx
push 0x802b
mov dword [esi + 0x3c], eax
call fcn.004394a2
add esp, 4
mov dword [esp + 0x24], eax
test eax, eax
mov byte [esp + 0x1c], 1
je 0x411191
mov edx, dword [esi + 0x3c]
push edx
mov ecx, eax
call fcn.0041b580
jmp 0x411193
xor eax, eax
push 0xdbe
mov byte [esp + 0x20], 0
mov dword [esi + 0x34], eax
call fcn.004394a2
add esp, 4
mov dword [esp + 0x24], eax
test eax, eax
mov byte [esp + 0x1c], 2
je 0x4111bf
push edi
mov ecx, eax
call fcn.0041ba60
jmp 0x4111c1
xor eax, eax
mov dword [esi + 0x38], eax
xor eax, eax
mov ecx, 9
lea edi, [esi + 0x40]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
lea ecx, [esi + 0x66]
mov dword [ecx], eax
mov dword [ecx + 4], eax
push ebp
xor edi, edi
mov dword [ecx + 8], eax
push edi
mov dword [ecx + 0xc], eax
push 0x4527c0
mov word [ecx + 0x10], ax
push 0x4527c8
mov dword [esi + 0x4e], edi
call ebx
mov edx, dword [esi + 0x30]
mov ecx, dword [esp + 0x2c]
mov dword [esi + 0x7c], eax
mov eax, dword [esi + 0x3c]
mov dword [edx + ecx*4 + 0x34], eax
mov ecx, dword [esp + 0x14]
mov dword [esi + 8], edi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x412500
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x28
push esi
push 0x69
mov esi, ecx
push eax
mov dword [esi + 4], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
cmp eax, edx
mov dword [esi], eax
jne 0x412530
push str.SOCK:ERROR_LISTA
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop esi
add esp, 0x28
ret 4
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push ebp
push edi
lea ecx, [esi + 8]
push ecx
push edx
push 0x101b
lea edi, [esi + 0x28]
lea ebp, [esi + 0x48]
push eax
mov dword [ecx], 7
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], 0x78
mov dword [esi + 0x14], str.Application_Num
mov dword [edi], 7
mov dword [esi + 0x2c], edx
mov dword [esi + 0x30], 0x96
mov dword [esi + 0x34], str.Ip_Addr
mov dword [ebp], 7
mov dword [esi + 0x4c], edx
mov dword [esi + 0x50], 0x50
mov dword [esi + 0x54], 0x452e10
call ebx
mov eax, dword [esi]
push edi
push 1
push 0x101b
push eax
call ebx
mov ecx, dword [esi]
push ebp
push 2
push 0x101b
push ecx
call ebx
mov edx, dword [0x467ab0]
mov ecx, dword [edx + 0x24]
xor ebp, ebp
call fcn.00430a00
mov edi, eax
test edi, edi
je 0x41260b
inc ebp
push ebp
push 0x452e18
push 0x4667b8
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [esi]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0
push 0x1007
push ecx
mov dword [esp + 0x20], 5
mov dword [esp + 0x34], 0x4667b8
mov dword [esp + 0x40], edi
mov dword [esp + 0x28], 0
call ebx
mov edi, dword [edi + 0x11]
test edi, edi
jne 0x4125c2
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x28
ret 4

Function at 0x412b10
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0xc]
push eax
push 4
push esi
push 0x412af0
push 0
push 0
mov dword [esi], 0x4464c0
mov dword [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
mov eax, esi
pop esi
ret
Function at 0x413670
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0x4668f8
push 0x64
mov esi, ecx
push str.TIMER
push 0x4533ac
mov dword [esi + 0x20], eax
mov dword [esi + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 1
push esi
push 0x413640
push 0xa
push eax
call dword [sym.imp.WINMM.dll_timeSetEvent]
push str.No_Available_Timers__nApplication_Terminates__
push str.TIMERFAIL
push str.KISSMSG
mov dword [esi + 0x1c], eax
call fcn.0040d190
mov eax, dword [esi + 0x1c]
add esp, 0xc
test eax, eax
jne 0x4136f8
mov ecx, dword [esi + 0x20]
push 0x40
call fcn.00401490
mov ecx, dword [esi + 0x20]
push eax
push 0x466a30
call fcn.00401480
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
mov dword [esp + 4], 0
jmp dword [sym.imp.USER32.dll_PostQuitMessage]
pop esi
ret 4

Function at 0x413890
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x234
push ebx
push esi
push edi
lea eax, [esp + 0x138]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xor ebx, ebx
test eax, eax
jne 0x4138bf
mov byte [esp + 0x138], bl
mov eax, dword [ebp + 0x10]
mov ecx, 0x26
mov esi, str.Script_Files__.hdr_
lea edi, [esp + 0xa0]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0xa0]
mov dword [esp + 0x30], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], edx
mov edx, dword [ebp + 8]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x138]
push eax
mov byte [0x467ab8], bl
mov dword [esp + 0x1c], 0x4c
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x38], 0x467ab8
mov dword [esp + 0x3c], 0x104
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], edx
mov dword [esp + 0x50], 0x8180c
mov word [esp + 0x54], bx
mov word [esp + 0x56], bx
mov dword [esp + 0x58], 0x4534b0
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
call dword [sym.imp.comdlg32.dll_GetOpenFileNameA]
cmp eax, 1
je 0x4139df
mov ecx, 8
mov esi, 0x4534b4
lea edi, [esp + 0x6c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov dword [esp + 0x8d], ecx
mov dword [esp + 0x91], ecx
mov dword [esp + 0x95], ecx
mov dword [esp + 0x99], ecx
mov byte [esp + 0x9d], cl
call dword [sym.imp.comdlg32.dll_CommDlgExtendedError]
cmp eax, ebx
je 0x4139df
push eax
lea edx, [esp + 0x14]
push 0x4534d8
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x70]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [ebp + 0xc]
push 0x10
push 0x4534dc
lea edx, [esp + 0x74]
push edx
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov eax, 0x467ab8
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4173ad
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x26c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
dec eax
push edi
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
je 0x4174b4
dec eax
jne 0x417532
mov eax, dword [esi + 0x10]
push ebp
push eax
push 0x12c
push 0x455130
push 0x45513c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [esp + 0x178]
push ecx
push 0x104
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp ebp, 0x12c
jne 0x417417
mov edx, dword [esi + 0x14]
push edx
push 0
push 0x455148
push 0x455150
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebp, eax
push ebp
lea eax, [esp + 0x17c]
push eax
lea ecx, [esp + 0x7c]
push 0x455158
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esi + 0x1c]
add esp, 0x10
lea edx, [esp + 0x10]
push edx
push 0
push 0
push 0x147
push 0x421
push eax
call edi
mov ecx, dword [esi + 0x1c]
push eax
push 0x148
push 0x421
push ecx
call edi
lea edx, [esp + 0x74]
push edx
lea eax, [esp + 0x14]
push eax
push 0x455168
push 0x455178
call ebx
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0x147
push 0x424
push edx
call edi
push eax
mov eax, dword [esi + 0x1c]
push 0x148
push 0x424
push eax
call edi
lea ecx, [esp + 0x74]
push ecx
lea edx, [esp + 0x14]
push edx
push 0x455188
push 0x455198
call ebx
pop ebp
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x147
push 0x422
push ecx
call edi
mov edx, dword [esi + 0x1c]
push eax
push 0x148
push 0x422
push edx
call edi
mov eax, dword [esi + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push str.CHANNELSPEED
push 0x4551b8
call ebx
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push 0
push 0
push 0x147
push 0x423
push eax
call edi
mov ecx, dword [esi + 0x1c]
push eax
push 0x148
push 0x423
push ecx
call edi
mov edx, dword [esi + 0x10]
push edx
lea eax, [esp + 0x10]
push eax
push str.SENS_THRESHOLD
push 0x4551d8
call ebx
mov ecx, dword [esi + 0x1c]
push 0
push 0
push 0x147
push 0x405
push ecx
call edi
push eax
lea edx, [esp + 0x10]
push 0x4551e8
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esi + 0x10]
add esp, 0xc
push eax
lea ecx, [esp + 0x10]
push ecx
push 0x4551ec
push 0x4551f8
call ebx
mov edx, dword [esi + 0x1c]
push 0x3e8
push edx
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
test eax, eax
je 0x4175a1
mov eax, dword [esi + 0x10]
push eax
push 0x455208
push 0x45520c
push 0x455220
call ebx
pop edi
pop esi
pop ebx
add esp, 0x26c
ret
mov ecx, dword [esi + 0x10]
push ecx
push 0x455230
push str.FULLDUPLEX_DRIVER
push 0x455248
call ebx
pop edi
pop esi
pop ebx
add esp, 0x26c
ret
Function at 0x4183c0
Capabilities:
Contain obfuscated stackstrings
Read .ini file

Disassembly:
sub esp, 0x40
push ebp
push esi
mov ebp, ecx
lea eax, [ebp + 0x148]
push edi
push eax
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov al, 7
mov cl, 0x3a
mov byte [esp + 0x26], al
mov byte [esp + 0x29], al
mov al, 0x30
mov byte [esp + 0x2c], cl
mov byte [esp + 0x3e], cl
mov edi, 0xffffde97
xor ecx, ecx
mov byte [esp + 0x24], 0x86
mov byte [esp + 0x25], 0x7b
mov byte [esp + 0x27], 0xea
mov byte [esp + 0x28], 4
mov byte [esp + 0x2a], 0x91
mov byte [esp + 0x2b], 0xef
mov byte [esp + 0x2d], al
mov byte [esp + 0x2e], 0xd3
mov byte [esp + 0x2f], 0xd4
mov byte [esp + 0x30], 0xd5
mov byte [esp + 0x31], 0xe4
mov byte [esp + 0x32], 0x23
mov byte [esp + 0x33], al
mov byte [esp + 0x34], 0xc6
mov byte [esp + 0x35], 0x57
mov byte [esp + 0x36], 0x9f
mov byte [esp + 0x37], 0x9c
mov byte [esp + 0x38], 0xb1
mov byte [esp + 0x39], 0x61
mov byte [esp + 0x3a], 0x3f
mov byte [esp + 0x3b], 0x4d
mov byte [esp + 0x3c], 5
mov byte [esp + 0x3d], al
mov byte [esp + 0x3f], 0x19
mov byte [esp + 0x40], 0x4b
mov byte [esp + 0x41], 0x7d
mov byte [esp + 0x42], 0x55
lea esi, [ebp + 0x2169]
sub edi, ebp
push ebx
mov al, byte [esi]
cmp al, 0x2d
je 0x4184b8
cmp al, 0x20
je 0x4184b8
test al, al
je 0x4184b8
xor edx, edx
movzx eax, al
mov ebx, 5
div ebx
inc ecx
inc ecx
inc esi
mov dl, byte [esp + edx + 0x28]
mov al, byte [esp + eax + 0x28]
mov byte [esp + ecx + 0x12], dl
mov byte [esp + ecx + 0x13], al
lea edx, [edi + esi]
cmp edx, 6
jb 0x418483
xor esi, esi
xor eax, eax
test ecx, ecx
pop ebx
jbe 0x4184cd
movzx edx, byte [esp + eax + 0x10]
add esi, edx
inc eax
cmp eax, ecx
jb 0x4184c1
lea eax, [ebp + 0x10]
push eax
push 0
push 0x455520
push 0x45552c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp esi, eax
jne 0x4184fb
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov al, 1
pop ebp
add esp, 0x40
ret
mov edx, dword [esp + 0xc]
push edx
mov byte [ebp + 0x215d], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x40
ret