joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420ed0
Capabilities:
Get mac address on windows

Disassembly:
sub esp, 8
push ebp
push edi
lea eax, [esp + 8]
xor edi, edi
push eax
push edi
mov ebp, ecx
mov dword [esp + 0x10], edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
je 0x420f12
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x14]
push eax
push str.GetMAC_Failed__ErrorCode:__d
push 0x12
push ecx
call fcn.00421180
add esp, 0x10
pop edi
xor eax, eax
pop ebp
add esp, 8
ret 4
mov edx, dword [esp + 8]
push esi
push edx
call fcn.0058b3a6
mov esi, eax
add esp, 4
mov dword [esp + 0x10], esi
cmp esi, edi
jne 0x420f45
mov eax, dword [esp + 0x18]
push str.GetMAC_Failed__Because_malloc_failed_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop esi
pop edi
xor eax, eax
pop ebp
add esp, 8
ret 4
lea ecx, [esp + 0xc]
push ecx
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
je 0x420f80
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x18]
push eax
push str.GetMAC_Failed__ErrorCode:__d
push 0x12
push edx
call fcn.00421180
push esi
call fcn.0058b32d
add esp, 0x14
pop esi
pop edi
xor eax, eax
pop ebp
add esp, 8
ret 4
push ebx
mov ebx, dword [esp + 0x1c]
mov eax, dword [esi + 0x190]
cmp eax, 6
jb 0x420fbb
cmp eax, 8
ja 0x420fbb
push eax
lea eax, [esi + 0x194]
push eax
push ebx
call fcn.0058ac90
mov edi, dword [esi + 0x190]
add esp, 0xc
lea ecx, [esi + 8]
push ecx
mov ecx, ebp
call fcn.00420d00
test al, 4
jne 0x420fc1
mov esi, dword [esi]
test esi, esi
jne 0x420f85
mov edx, dword [esp + 0x14]
push edx
call fcn.0058b32d
add esp, 4
pop ebx
pop esi
mov eax, edi
pop edi
pop ebp
add esp, 8
ret 4

Function at 0x4250e5
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x6dddc8]
push esi
mov esi, ecx
mov ecx, dword [eax + 8]
mov dword [ecx + 0xc], 1
cmp dword [esi + 0x10], 0
push 0
mov ecx, 0x6dddc0
push 0
je 0x42511b
push 3
mov dword [0x6ddff0], 1
call fcn.0040c880
mov dword [esi + 0x10], 0
jmp 0x425122
push 2
call fcn.0040c880
cmp dword [0x6ee148], 0
pop esi
jne 0x425140
mov dword [0x6ee148], 1
mov ecx, 0x6ee0b0
jmp fcn.004d4e60
ret
Function at 0x444ce0
Capabilities:
Delete file

Disassembly:
push esi
push edi
push 0x5b9978
push str.._image_InterfaceScript_AdvancedSetDlg.bin
mov edi, ecx
call fcn.004447a0
mov ecx, dword [edi + 0x18]
mov esi, eax
push esi
call fcn.00582b00
mov ecx, esi
call fcn.00514d50
pop edi
mov dword [0x6de634], esi
mov ecx, esi
pop esi
jmp 0x515540
sub esp, 0x2cc
mov eax, dword [0x6dc0d0]
xor eax, esp
mov dword [esp + 0x2c8], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebp
push esi
push edi
push 0xff
lea eax, [esp + 0x1dc]
push eax
push 0
mov ebp, ecx
call ebx
lea ecx, [esp + 0x1d8]
push 0x5c
push ecx
call fcn.0058c090
lea edi, [esp + 0x1e0]
add esp, 8
mov byte [eax + 1], 0
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x515590
mov ecx, 6
mov esi, str.._Ini_AdvancedSet_Cfg.ini
rep movsd dword es:[edi], dword [esi]
push 0xff
lea edx, [esp + 0xdc]
push edx
push 0
movsw word es:[edi], word [esi]
call ebx
lea eax, [esp + 0xd8]
push 0x5c
push eax
call fcn.0058c090
lea edi, [esp + 0xe0]
add esp, 8
mov byte [eax + 1], 0
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x5155d5
mov ecx, 7
mov esi, str.._Ini_AdvancedSet_Config.ini
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0xd8]
push ecx
lea edx, [esp + 0x1dc]
push str.admin
push edx
movsb byte es:[edi], byte [esi]
call fcn.00515940
push 0xc8
lea eax, [esp + 0x20]
push 0
push eax
call fcn.00588e70
push str.._Ini_AdvancedSet_Config.ini
lea ecx, [esp + 0x2c]
push ecx
push str.Power
push str.AddPoint
call fcn.0051b770
lea edx, [esp + 0x38]
push edx
call fcn.00589b46
push 0xc8
mov dword [ebp + 0x24c], eax
lea eax, [esp + 0x40]
push 0
push eax
call fcn.00588e70
push str.._Ini_AdvancedSet_Config.ini
lea ecx, [esp + 0x4c]
push ecx
push 0x5c9d88
push str.AddPoint
call fcn.0051b770
lea edx, [esp + 0x58]
add esp, 0x48
push edx
call fcn.00589b46
push 0xc8
mov dword [ebp + 0x250], eax
lea eax, [esp + 0x18]
push 0
push eax
call fcn.00588e70
push str.._Ini_AdvancedSet_Config.ini
lea ecx, [esp + 0x24]
push ecx
push 0x5c9d84
push str.AddPoint
call fcn.0051b770
lea edx, [esp + 0x30]
push edx
call fcn.00589b46
push 0xc8
mov dword [ebp + 0x254], eax
lea eax, [esp + 0x38]
push 0
push eax
call fcn.00588e70
push str.._Ini_AdvancedSet_Config.ini
lea ecx, [esp + 0x44]
push ecx
push 0x5c9d80
push str.AddPoint
call fcn.0051b770
lea edx, [esp + 0x50]
add esp, 0x40
push edx
call fcn.00589b46
mov dword [ebp + 0x258], eax
add esp, 4
lea eax, [esp + 0xd8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x2d8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00589034
add esp, 0x2cc
ret
Function at 0x476a60
Capabilities:
Print debug messages

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov eax, dword [ebx]
push edi
mov edi, ecx
test eax, eax
jne 0x476a80
push str.Item_DB_idx__0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop ebx
ret 4
push esi
push eax
mov ecx, 0x6ece28
call fcn.004ab760
mov esi, eax
test esi, esi
je 0x476a9f
mov ax, word [ebx + 6]
mov word [esi + 0x28e], ax
jmp 0x476acd
push str.CItemShopGridDialog::AddItem
push ebx
mov ecx, 0x6ece28
call fcn.004ae7b0
mov esi, eax
test esi, esi
jne 0x476abb
pop esi
pop edi
pop ebx
ret 4
push esi
mov ecx, 0x6ece28
mov dword [esi + 0x24], 1
call fcn.004b77b0
mov edx, dword [esi]
mov eax, dword [edx + 0x7c]
mov ecx, esi
call eax
movzx ecx, ax
push ecx
mov ecx, edi
call fcn.00476980
movzx eax, ax
push esi
push eax
mov ecx, edi
call fcn.0042fc30
pop esi
pop edi
pop ebx
ret 4

Function at 0x48da95
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
lea ecx, [esi + 0x284]
cmp ebx, 1
jne 0x48dad7
mov eax, dword [0x6ed144]
add eax, 0x1d4c0
push edi
mov dword [esi + 0x238], eax
call fcn.0044b7f0
push str.ANRaster.tga
lea ecx, [esi + 0x284]
call fcn.0044b820
pop edi
push ebx
mov ecx, esi
call fcn.0042aed0
pop esi
pop ebx
ret 4
call fcn.0044b7f0
push str.ANRaster.tga
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
mov ecx, esi
call fcn.0042aed0
pop esi
pop ebx
ret 4

Function at 0x48db00
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
lea ecx, [esi + 0x284]
cmp ebx, 1
jne 0x48db4d
mov eax, dword [esp + 0x10]
imul eax, eax, 0x3e8
add eax, dword [0x6ed144]
push edi
mov dword [esi + 0x238], eax
call fcn.0044b7f0
push str.ANRaster.tga
lea ecx, [esi + 0x284]
call fcn.0044b820
pop edi
push ebx
mov ecx, esi
call fcn.0042aed0
pop esi
pop ebx
ret 8
call fcn.0044b7f0
push str.ANRaster.tga
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
mov ecx, esi
call fcn.0042aed0
pop esi
pop ebx
ret 8
Function at 0x4b3010
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x1ac
mov eax, dword [0x6dc0d0]
xor eax, esp
mov dword [esp + 0x1a8], eax
push ebx
mov ebx, dword [sym.imp.WINMM.dll_timeGetTime]
push esi
mov esi, ecx
call ebx
cmp dword [esi + 0xf4], 0
jne 0x4b303f
mov dword [esi + 0xf4], eax
sub eax, dword [esi + 0xf4]
cmp eax, 0x1388
jbe 0x4b311b
mov ecx, dword [esi + 0xd0]
mov eax, dword [esi + 0xdc]
mov dword [esi + 0xe4], eax
test ecx, ecx
jle 0x4b3075
test eax, eax
je 0x4b3072
mov eax, dword [eax]
mov dword [esi + 0xe4], eax
dec ecx
jne 0x4b3066
push edi
push 0
push 2
mov dword [esp + 0x14], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x4b311a
lea ecx, [esp + 0xc]
push ecx
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4b310b
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x138]
push 0x5b9d14
push eax
call fcn.00589549
add esp, 0xc
lea ecx, [esp + 0x134]
push ecx
mov ecx, esi
call fcn.004ae5d0
test eax, eax
je 0x4b30fc
mov ecx, 0x6fc6a8
call fcn.0052aaa0
push 0x230
mov ecx, 0x6ee218
call fcn.004d69e0
push eax
push 1
push 0x179e
push 0x6eb910
call fcn.00447ec0
add esp, 0x10
lea edx, [esp + 0xc]
push edx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4b30a1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
mov dword [esi + 0xf4], eax
pop edi
mov ecx, dword [esp + 0x1b0]
pop esi
pop ebx
xor ecx, esp
call fcn.00589034
add esp, 0x1ac
ret
Function at 0x4c8180
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [0x6d7ba5], 0
push esi
mov esi, ecx
je 0x4c81a3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xc], eax
mov dword [0x6ed158], eax
mov byte [0x6d7ba5], 0
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0xc]
mov edx, eax
sub edx, ecx
mov dword [0x6ed158], eax
cmp eax, ecx
jae 0x4c81ba
dec edx
mov dword [0x6ed140], edx
mov dword [esi + 0xc], eax
mov eax, dword [0x6ed140]
add dword [0x6ed144], eax
add dword [esi + 8], eax
cmp dword [esi + 8], 0x5265c00
jb 0x4c81e4
inc dword [esi + 4]
add dword [esi + 8], 0xfad9a400
pop esi
ret
Function at 0x4d0f10
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4d0f3f
pop edi
xor eax, eax
pop esi
ret 4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x520
lea edx, [edi + 0x524]
push edx
push esi
call ebx
test eax, eax
jne 0x4d0f6f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
xor eax, eax
pop esi
ret 4
push 0
lea eax, [esp + 0x14]
push eax
push 0xc0
add edi, 0xb04
push edi
push esi
call ebx
push esi
test eax, eax
je 0x4d0f61
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov eax, 1
pop esi
ret 4
Function at 0x4d4db0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push esi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push str.._ini_GameOption.opt
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4d4de3
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0x10]
push eax
push 4
lea ecx, [esp + 0x1c]
push ecx
push esi
mov dword [esp + 0x20], 0
call edi
test eax, eax
je 0x4d4e28
cmp dword [esp + 0x10], 0x61208
jne 0x4d4e28
push 0
lea edx, [esp + 0x10]
push edx
push 0xac
add ebx, 4
push ebx
push esi
call edi
test eax, eax
jne 0x4d4e38
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
cmp dword [esp + 0xc], 0xac
push esi
ja 0x4d4e29
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 8
ret

Function at 0x4d4e60
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push str.._ini_GameOption.opt
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4d4ec6
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea ecx, [esp + 0x18]
push ecx
push esi
mov dword [esp + 0x20], 0x61208
call edi
push 0
lea edx, [esp + 0x14]
push edx
push 0xac
add ebx, 4
push ebx
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x4fef20
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
mov eax, dword [0x6dc0d0]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
push ebx
push esi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4feff8
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0x10]
push eax
push 4
lea ecx, [esp + 0x1c]
push ecx
push esi
call edi
test eax, eax
je 0x4fef80
cmp dword [esp + 0x10], 0x6060801
je 0x4fef9b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00589034
add esp, 0x18
ret 4
push 0
lea edx, [esp + 0x10]
push edx
push 0xc
lea eax, [esp + 0x20]
push eax
push esi
call edi
push esi
test eax, eax
je 0x4fef81
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebx + 0x1c], 0
je 0x4feff7
mov ecx, dword [0x6ec21c]
test ecx, ecx
je 0x4feff7
mov edx, dword [esp + 0x18]
push edx
call fcn.00499d90
mov eax, dword [esp + 0x14]
mov ecx, dword [0x6ec21c]
push eax
call fcn.004990c0
fld dword [esp + 0x1c]
push 0
push ecx
fstp dword [esp]
push 0
mov ecx, 0x719560
call fcn.0055f690
pop edi
mov ecx, dword [esp + 0x1c]
pop esi
pop ebx
xor ecx, esp
call fcn.00589034
add esp, 0x18
ret 4

Function at 0x4ff010
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x18
mov eax, dword [0x6dc0d0]
xor eax, esp
mov dword [esp + 0x14], eax
mov ecx, dword [0x6ec21c]
push esi
mov esi, dword [esp + 0x20]
test ecx, ecx
je 0x4ff0aa
call fcn.00499d80
fld dword [0x7195a0]
push 0
push 0x80
push 2
push 0
mov dword [esp + 0x20], eax
mov eax, dword [0x6ec21c]
mov cx, word [eax + 0x688]
fstp dword [esp + 0x24]
push 0
push 0x40000000
push esi
mov word [esp + 0x28], cx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4ff0aa
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [esp + 0xc]
push edx
push 4
lea eax, [esp + 0x18]
push eax
push esi
mov dword [esp + 0x20], 0x6060801
call edi
push 0
lea ecx, [esp + 0xc]
push ecx
push 0xc
lea edx, [esp + 0x1c]
push edx
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov ecx, dword [esp + 0x18]
pop esi
xor ecx, esp
call fcn.00589034
add esp, 0x18
ret 4
Function at 0x4fff80
Capabilities:
Create directory

Disassembly:
sub esp, 0x108
mov eax, dword [0x6dc0d0]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
mov ebx, dword [esp + 0x110]
push esi
mov esi, ecx
test ebx, ebx
je 0x500069
push ebp
push edi
push 0
mov ecx, 0x719e88
call fcn.0056de30
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea eax, [esp + 0x14]
push str._sData
push eax
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
push 0
lea ecx, [esp + 0x14]
push ecx
call ebp
mov edx, dword [esi + 0x18]
push edx
push 0
mov ecx, 0x719e88
call fcn.0056de30
push eax
lea eax, [esp + 0x18]
push str._sData_d
push eax
call edi
add esp, 0x10
push 0
lea ecx, [esp + 0x14]
push ecx
call ebp
test bl, 1
je 0x500035
mov eax, dword [esi + 0x18]
push eax
push eax
push 0
mov ecx, 0x719e88
call fcn.0056de30
push eax
lea edx, [esp + 0x1c]
push str._sData_d_d.UII
push edx
call edi
add esp, 0x14
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.004ff8d0
test bl, 2
je 0x500067
mov eax, dword [esi + 0x18]
push eax
push eax
push 0
mov ecx, 0x719e88
call fcn.0056de30
push eax
lea ecx, [esp + 0x1c]
push str._sData_d_d.UIS
push ecx
call edi
add esp, 0x14
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.004ff010
pop edi
pop ebp
mov ecx, dword [esp + 0x10c]
pop esi
pop ebx
xor ecx, esp
call fcn.00589034
add esp, 0x108
ret 4
Function at 0x515540
Capabilities:
Delete file

Disassembly:
push esi
push edi
push 0x5b9978
push str.._image_InterfaceScript_AdvancedSetDlg.bin
mov edi, ecx
call fcn.004447a0
mov ecx, dword [edi + 0x18]
mov esi, eax
push esi
call fcn.00582b00
mov ecx, esi
call fcn.00514d50
pop edi
mov dword [0x6de634], esi
mov ecx, esi
pop esi
jmp 0x515540
sub esp, 0x2cc
mov eax, dword [0x6dc0d0]
xor eax, esp
mov dword [esp + 0x2c8], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebp
push esi
push edi
push 0xff
lea eax, [esp + 0x1dc]
push eax
push 0
mov ebp, ecx
call ebx
lea ecx, [esp + 0x1d8]
push 0x5c
push ecx
call fcn.0058c090
lea edi, [esp + 0x1e0]
add esp, 8
mov byte [eax + 1], 0
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x515590
mov ecx, 6
mov esi, str.._Ini_AdvancedSet_Cfg.ini
rep movsd dword es:[edi], dword [esi]
push 0xff
lea edx, [esp + 0xdc]
push edx
push 0
movsw word es:[edi], word [esi]
call ebx
lea eax, [esp + 0xd8]
push 0x5c
push eax
call fcn.0058c090
lea edi, [esp + 0xe0]
add esp, 8
mov byte [eax + 1], 0
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x5155d5
mov ecx, 7
mov esi, str.._Ini_AdvancedSet_Config.ini
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0xd8]
push ecx
lea edx, [esp + 0x1dc]
push str.admin
push edx
movsb byte es:[edi], byte [esi]
call fcn.00515940
push 0xc8
lea eax, [esp + 0x20]
push 0
push eax
call fcn.00588e70
push str.._Ini_AdvancedSet_Config.ini
lea ecx, [esp + 0x2c]
push ecx
push str.Power
push str.AddPoint
call fcn.0051b770
lea edx, [esp + 0x38]
push edx
call fcn.00589b46
push 0xc8
mov dword [ebp + 0x24c], eax
lea eax, [esp + 0x40]
push 0
push eax
call fcn.00588e70
push str.._Ini_AdvancedSet_Config.ini
lea ecx, [esp + 0x4c]
push ecx
push 0x5c9d88
push str.AddPoint
call fcn.0051b770
lea edx, [esp + 0x58]
add esp, 0x48
push edx
call fcn.00589b46
push 0xc8
mov dword [ebp + 0x250], eax
lea eax, [esp + 0x18]
push 0
push eax
call fcn.00588e70
push str.._Ini_AdvancedSet_Config.ini
lea ecx, [esp + 0x24]
push ecx
push 0x5c9d84
push str.AddPoint
call fcn.0051b770
lea edx, [esp + 0x30]
push edx
call fcn.00589b46
push 0xc8
mov dword [ebp + 0x254], eax
lea eax, [esp + 0x38]
push 0
push eax
call fcn.00588e70
push str.._Ini_AdvancedSet_Config.ini
lea ecx, [esp + 0x44]
push ecx
push 0x5c9d80
push str.AddPoint
call fcn.0051b770
lea edx, [esp + 0x50]
add esp, 0x40
push edx
call fcn.00589b46
mov dword [ebp + 0x258], eax
add esp, 4
lea eax, [esp + 0xd8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x2d8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00589034
add esp, 0x2cc
ret
Function at 0x5169b0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x5c9fdc
push eax
mov esi, ecx
xor bl, bl
call fcn.005894eb
mov edi, eax
add esp, 8
test edi, edi
je 0x516a7d
push edi
push 0x118
lea ecx, [esi + 0x14]
push 1
push ecx
call fcn.00589969
add esp, 0x10
cmp eax, 0x118
jne 0x516a4b
mov edx, dword [esi + 0x118]
mov eax, dword [esi + 0x11c]
lea ecx, [eax + edx*2]
cmp dword [esi + 0x120], ecx
jne 0x516a4b
mov edx, dword [esi + 0x124]
push edx
call fcn.00587f5a
add esp, 4
mov dword [esi + 0x10], eax
test eax, eax
je 0x516a4b
push ebp
mov ebp, dword [esi + 0x124]
push edi
push ebp
push 1
push eax
call fcn.00589969
add esp, 0x10
cmp ebp, eax
jne 0x516a4a
mov edx, dword [esi + 0x118]
mov eax, dword [esi + 0x11c]
mov dword [esi + 4], edx
mov dword [esi + 8], eax
mov dword [esi + 0xc], ebp
mov bl, 1
pop ebp
push edi
call fcn.005891ea
add esp, 4
test bl, bl
jne 0x516a6f
mov eax, dword [esi + 0x10]
test eax, eax
je 0x516a6f
push eax
call fcn.00588ef5
add esp, 4
mov dword [esi + 0x10], 0
pop edi
mov byte [esi + 0x128], bl
pop esi
mov al, bl
pop ebx
ret 4
pop edi
pop esi
xor al, al
pop ebx
ret 4

Function at 0x517ee0
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x518c30
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x6dc0d0]
xor eax, esp
mov dword [esp + 0x2c], eax
push esi
mov esi, ecx
cmp dword [esi + 0x44], 0
je 0x518dc0
cmp byte [esi + 0x49], 0
je 0x518dc0
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
jne 0x518c75
xor al, al
pop esi
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00589034
add esp, 0x30
ret
push ebx
push 0
push 0
lea ecx, [esp + 0x20]
call fcn.0042c530
push 0
push 8
lea ecx, [esp + 0x20]
call fcn.00518de0
push ebp
lea ebx, [esi + 0x4c]
push edi
lea ecx, [esp + 0x20]
call fcn.0042c230
cmp dword [esp + 0x34], 0x10
mov ebp, dword [esp + 0x30]
mov edi, eax
mov eax, dword [esp + 0x20]
jae 0x518cb3
lea eax, [esp + 0x20]
lea ecx, [esp + 0x20]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.00519400
mov ecx, dword [esi + 0x44]
mov edx, dword [ecx]
mov edx, dword [edx + 0x18]
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x18]
add edi, ebp
push edi
push eax
push ebx
call edx
sub eax, 0
je 0x518d0d
dec eax
je 0x518d11
sub eax, 2
push 0
lea ecx, [esp + 0x24]
push 1
je 0x518da6
call fcn.0042c530
pop edi
pop ebp
pop ebx
xor al, al
pop esi
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00589034
add esp, 0x30
ret
mov byte [esi + 0x49], 0
mov eax, dword [esp + 0x20]
mov ebp, 0x10
cmp dword [esp + 0x34], ebp
jae 0x518d24
lea eax, [esp + 0x20]
lea ecx, [esp + 0x20]
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.00519400
mov edi, dword [esp + 0x1c]
sub edi, dword [esp + 0x10]
je 0x518d72
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x34], ebp
jae 0x518d4b
lea eax, [esp + 0x20]
lea edx, [esp + 0x20]
push edx
push eax
lea ecx, [esp + 0x20]
call fcn.00519400
mov eax, dword [esi + 0x54]
mov ecx, dword [esp + 0x18]
push eax
push edi
push 1
push ecx
call fcn.005893b5
add esp, 0x10
cmp edi, eax
jne 0x518d91
cmp byte [esi + 0x49], 0
je 0x518d9e
test edi, edi
jne 0x518c95
push edi
push 8
lea ecx, [esp + 0x28]
call fcn.00518980
jmp 0x518c95
push 0
push 1
lea ecx, [esp + 0x28]
jmp 0x518cf3
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.0042c530
pop edi
pop ebp
pop ebx
mov al, 1
pop esi
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00589034
add esp, 0x30
ret
mov ecx, dword [esp + 0x30]
pop esi
xor ecx, esp
mov al, 1
call fcn.00589034
add esp, 0x30
ret
Function at 0x51b770
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x6dc0d0]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x114]
push ebx
mov ebx, dword [esp + 0x110]
push ebp
mov ebp, dword [esp + 0x118]
push esi
mov esi, dword [esp + 0x124]
push edi
push 0xff
lea ecx, [esp + 0x18]
push ecx
push 0
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x14]
push 0x5c
push edx
call fcn.0058c090
mov byte [eax + 1], 0
mov eax, esi
add esp, 8
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x51b7d1
lea edi, [esp + 0x14]
sub eax, ecx
dec edi
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x51b7e0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x14]
push eax
push 0xff
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x18]
push ecx
push 0
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00589034
add esp, 0x108
ret

Function at 0x51c780
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 8]
mov dword [esi], vtable.PingManager.0
push edi
xor edi, edi
push 0x1e
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
call fcn.0051cb10
push edi
push edi
push edi
push 0x51ca40
push edi
push edi
mov dword [esi + 0x2c], 1
mov dword [esi + 0x30], edi
call fcn.0058c5d2
add esp, 0x18
mov dword [esi + 4], eax
pop edi
mov eax, esi
pop esi
ret

Function at 0x51cd10
Capabilities:
Create raw socket
Initialize winsock library
Set socket configuration

Disassembly:
sub esp, 0x198
mov eax, dword [0x6dc0d0]
xor eax, esp
mov dword [esp + 0x194], eax
push esi
xor eax, eax
push 0x18e
mov esi, ecx
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.00588e70
add esp, 0xc
lea edx, [esp + 8]
push edx
push 0x102
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x51cd6c
xor al, al
pop esi
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.00589034
add esp, 0x198
ret
push 1
push 3
push 2
call sub.WSOCK32.dll_socket
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x51cd54
push 4
lea ecx, [esp + 8]
push ecx
push 0x1006
push 0xffff
push eax
mov dword [esp + 0x18], 0x7d0
call sub.WSOCK32.dll_setsockopt
cmp eax, 0xffffffff
je 0x51cd54
mov eax, dword [esi + 4]
push 4
lea edx, [esp + 8]
push edx
push 0x1005
push 0xffff
push eax
mov dword [esp + 0x18], 0x7d0
call sub.WSOCK32.dll_setsockopt
mov ecx, dword [esp + 0x198]
cmp eax, 0xffffffff
setne al
pop esi
xor ecx, esp
call fcn.00589034
add esp, 0x198
ret