joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41dbbd
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x11c], 6
mov dword [ebp - 0x118], 6
mov dword [ebp - 0x114], 0x15
mov dword [ebp - 0x110], 0x44
mov dword [ebp - 0x10c], 0x44
mov dword [ebp - 0x108], 0x60
mov dword [ebp - 0x120], 0
jmp 0x41dc23
mov eax, dword [ebp - 0x120]
add eax, 1
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 3
jge 0x41dd11
push 0x104
push 0
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b9030
add esp, 0xc
mov edx, dword [ebp - 0x120]
add edx, 1
push edx
push 0x51b1bc
lea eax, [ebp - 0x104]
push eax
call fcn.004b953d
add esp, 0xc
mov ecx, dword [ebp - 0x124]
add ecx, 0x8f5
push ecx
mov edx, dword [ebp - 0x120]
mov eax, dword [ebp + edx*4 - 0x11c]
push eax
lea ecx, [ebp - 0x104]
push ecx
push 0x51b1cc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edx, dword [ebp - 0x120]
mov ecx, dword [ebp + 8]
mov dword [ecx + edx*4 + 0x5f], eax
push 0x104
push 0
lea edx, [ebp - 0x104]
push edx
call fcn.004b9030
add esp, 0xc
mov eax, dword [ebp - 0x120]
add eax, 1
push eax
push 0x51b1d0
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b953d
add esp, 0xc
mov edx, dword [ebp - 0x124]
add edx, 0x8f5
push edx
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp + eax*4 - 0x110]
push ecx
lea edx, [ebp - 0x104]
push edx
push 0x51b1e0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 0x120]
mov edx, dword [ebp + 8]
mov dword [edx + ecx*4 + 0x6b], eax
jmp 0x41dc14
mov esp, ebp
pop ebp
ret 4
Function at 0x41dd17
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov dword [ebp - 0x104], ecx
mov eax, dword [ebp - 0x104]
add eax, 0x8f5
push eax
push 0
push 0x51b1e4
push 0x51b1ec
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp - 0x104]
add edx, 0x8f5
push edx
push 0
push 0x51b1f4
push 0x51b204
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x104]
add edx, 0x8f5
push edx
push 0
push 0x51b20c
push 0x51b21c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x104]
add edx, 0x8f5
push edx
push 0
push 0x51b224
push 0x51b230
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x104]
add edx, 0x8f5
push edx
push 0
push 0x51b238
push 0x51b244
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 0x104]
add edx, 0x8f5
push edx
push 0
push 0x51b24c
push 0x51b258
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], eax
push 0x100
push 0
lea edx, [ebp - 0x100]
push edx
call fcn.004b9030
add esp, 0xc
mov eax, dword [ebp - 0x104]
add eax, 0x8f5
push eax
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push 0
push 0x51b260
push 0x51b270
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x100]
push edx
mov ecx, dword [ebp + 8]
add ecx, 0x58
call fcn.004dd84a
mov esp, ebp
pop ebp
ret 4

Function at 0x422384
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0x50
push 0
mov eax, dword [ebp - 0xc]
add eax, 0x1080
push eax
call fcn.004b9030
add esp, 0xc
mov ecx, dword [ebp - 0xc]
add ecx, 0x8f5
push ecx
push 0x50
mov edx, dword [ebp - 0xc]
add edx, 0x1080
push edx
push 0x53b284
push 0x51c3e0
push 0x51c3ec
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [ebp - 0xc]
call fcn.00422444
push 1
push 0
mov ecx, dword [ebp - 0xc]
call fcn.004225ca
mov ecx, dword [ebp - 0xc]
call fcn.004232c2
mov ecx, dword [ebp - 0xc]
call fcn.00423343
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x1038], 0
je 0x42241f
push 0x82d
mov ecx, dword [ebp - 0xc]
call fcn.004dc934
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x103c]
push edx
mov ecx, dword [ebp - 8]
call fcn.00405760
push 0x818
mov ecx, dword [ebp - 0xc]
call fcn.004dc934
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
add eax, 0x1080
push eax
mov ecx, dword [ebp - 4]
call fcn.004dcbcb
mov esp, ebp
pop ebp
ret
Function at 0x422444
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f482e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x78
mov dword [ebp - 0x84], ecx
lea ecx, [ebp - 0x10]
call fcn.004048c0
mov dword [ebp - 4], 0
mov dword [ebp - 0x80], 0
mov eax, dword [ebp - 0x84]
add eax, 0x8f5
push eax
push 0
push 0x51c3f4
push 0x51c408
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 0x84]
mov dword [ecx + 0x10d8], eax
push 6
push 0
mov edx, dword [ebp - 0x84]
add edx, 0x10dc
push edx
call fcn.004b9030
add esp, 0xc
push 0x64
push 0
lea eax, [ebp - 0x7c]
push eax
call fcn.004b9030
add esp, 0xc
mov ecx, dword [ebp - 0x84]
add ecx, 0x8f5
push ecx
push 0x64
lea edx, [ebp - 0x7c]
push edx
push 0x53b288
push 0x51c410
push 0x51c420
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
movsx eax, byte [ebp - 0x7c]
test eax, eax
jne 0x422512
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004dd6c1
jmp 0x4225bc
push 0x51c428
lea ecx, [ebp - 0x7c]
push ecx
call fcn.004b9d16
add esp, 8
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
push 0x51c42c
lea eax, [ebp - 0x10]
push eax
call fcn.004d3292
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.0040b850
test eax, eax
jne 0x4225ad
lea ecx, [ebp - 0x18]
push ecx
push 0x51c430
lea ecx, [ebp - 0x10]
call fcn.004048e0
push eax
call fcn.004b9fab
add esp, 0xc
mov edx, dword [ebp - 0x84]
add edx, dword [ebp - 0x80]
mov al, byte [ebp - 0x18]
mov byte [edx + 0x10dc], al
mov ecx, dword [ebp - 0x80]
add ecx, 1
mov dword [ebp - 0x80], ecx
cmp dword [ebp - 0x80], 6
jne 0x422584
jmp 0x4225ad
push 0x51c434
push 0
call fcn.004b9d16
add esp, 8
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
push 0x51c438
lea eax, [ebp - 0x10]
push eax
call fcn.004d3292
add esp, 0xc
jmp 0x42253b
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004dd6c1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x42775f
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x15
push 0
mov eax, dword [ebp - 8]
add eax, 0x5c
push eax
call fcn.004b9030
add esp, 0xc
cmp dword [0x53bfa0], 0
je 0x4277a9
mov ecx, dword [ebp - 8]
add ecx, 0x8f5
push ecx
push 0x15
mov edx, dword [ebp - 8]
add edx, 0x5c
push edx
push 0
push 0x51cf6c
push 0x51cf74
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [ebp - 8]
movsx ecx, byte [eax + 0x5c]
test ecx, ecx
jne 0x4277d9
mov edx, dword [ebp - 8]
add edx, 0x8f5
push edx
push 0x15
mov eax, dword [ebp - 8]
add eax, 0x5c
push eax
push 0
push 0x51cf7c
push 0x51cf84
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x569
mov ecx, dword [ebp - 8]
call fcn.004dc934
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, 0x5c
push ecx
mov ecx, dword [ebp - 4]
call fcn.004dcbcb
mov esp, ebp
pop ebp
ret
Function at 0x42fa1d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov dword [ebp - 0x54], ecx
mov word [ebp - 0x28], 0x64
mov word [ebp - 0x26], 0xc8
mov word [ebp - 0x24], 0x32
mov word [ebp - 0x22], 0x7d
mov word [ebp - 0x20], 0x89
mov word [ebp - 0x1e], 0x96
mov word [ebp - 0x1c], 0xa2
mov word [ebp - 0x1a], 0xaf
mov word [ebp - 0x18], 0xbb
mov word [ebp - 0x16], 0x19
mov word [ebp - 0x14], 0x25
mov word [ebp - 0x12], 0x3e
mov word [ebp - 0x10], 0x4b
mov word [ebp - 0xe], 0x51
mov word [ebp - 0xc], 0x57
mov word [ebp - 0xa], 0xc1
mov word [ebp - 8], 0x38
mov word [ebp - 6], 0x44
mov word [ebp - 4], 0x5d
mov word [ebp - 0x50], 0xa0
mov word [ebp - 0x4e], 0x20
mov word [ebp - 0x4c], 0x120
mov word [ebp - 0x4a], 0xa8
mov word [ebp - 0x48], 0xac
mov word [ebp - 0x46], 0x18
mov word [ebp - 0x44], 0x1a
mov word [ebp - 0x42], 0x1c
mov word [ebp - 0x40], 0x1e
mov word [ebp - 0x3e], 0x1a0
mov word [ebp - 0x3c], 0x118
mov word [ebp - 0x3a], 0x128
mov word [ebp - 0x38], 0x98
mov word [ebp - 0x36], 0x9a
mov word [ebp - 0x34], 0x9c
mov word [ebp - 0x32], 0x1f
mov word [ebp - 0x30], 0x124
mov word [ebp - 0x2e], 0x12c
mov word [ebp - 0x2c], 0x9e
cmp dword [0x53b484], 0
je 0x42fb36
cmp dword [0x53b44c], 0
je 0x42fb36
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax + 0x11e80]
mov edx, dword [ebp - 0x54]
mov ax, word [ebp + ecx*2 - 0x50]
mov word [edx + 0x11e88], ax
jmp 0x42fb4e
mov ecx, dword [ebp - 0x54]
mov edx, dword [ecx + 0x11e80]
mov eax, dword [ebp - 0x54]
mov cx, word [ebp + edx*2 - 0x28]
mov word [eax + 0x11e88], cx
mov esp, ebp
pop ebp
ret
Function at 0x43005e
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f499a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x124
mov dword [ebp - 0x130], ecx
lea ecx, [ebp - 0x10]
call fcn.004048c0
mov dword [ebp - 4], 0
mov dword [ebp - 0x120], 0
push 0x10
push 0
mov eax, dword [ebp - 0x130]
add eax, 0x11b2d
push eax
call fcn.004b9030
add esp, 0xc
mov ecx, dword [ebp - 0x130]
add ecx, 0x11c41
push ecx
push 0x104
mov edx, dword [ebp - 0x130]
add edx, 0x11b3d
push edx
push 0
push 0x51e170
push 0x51e178
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [ebp - 0x130]
movsx ecx, byte [eax + 0x11b3d]
test ecx, ecx
jne 0x430130
push 0
push 0x51e17c
push str.Please_Check_the_WWN.ini_file_
mov ecx, dword [ebp - 0x130]
call fcn.004db06e
mov dword [ebp - 0x124], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004dd6c1
mov eax, dword [ebp - 0x124]
jmp 0x430278
push 0x104
push 0
lea edx, [ebp - 0x11c]
push edx
call fcn.004b9030
add esp, 0xc
mov eax, dword [ebp - 0x130]
add eax, 0x11b3d
push eax
lea ecx, [ebp - 0x11c]
push ecx
call fcn.004b9290
add esp, 8
push 0x51e1a4
lea edx, [ebp - 0x11c]
push edx
call fcn.004b9d16
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
push 0x51e1a8
lea ecx, [ebp - 0x10]
push ecx
call fcn.004d3292
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.0040b850
test eax, eax
jne 0x430218
cmp dword [ebp - 0x120], 0x10
jae 0x4301d3
lea edx, [ebp - 0x18]
push edx
push 0x51e1ac
lea ecx, [ebp - 0x10]
call fcn.004048e0
push eax
call fcn.004b9fab
add esp, 0xc
mov eax, dword [ebp - 0x130]
add eax, dword [ebp - 0x120]
mov cl, byte [ebp - 0x18]
mov byte [eax + 0x11b2d], cl
jmp 0x4301d5
jmp 0x430218
mov edx, dword [ebp - 0x120]
add edx, 1
mov dword [ebp - 0x120], edx
push 0x51e1b0
push 0
call fcn.004b9d16
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4301fe
jmp 0x430218
mov eax, dword [ebp - 0x14]
push eax
push 0x51e1b4
lea ecx, [ebp - 0x10]
push ecx
call fcn.004d3292
add esp, 0xc
jmp 0x43018d
cmp dword [ebp - 0x120], 0x10
jae 0x430259
push 0
push 0x51e1b8
push str.Cant_find_enough_16_bytes_WWN__please_check_WWN.ini_content.
mov ecx, dword [ebp - 0x130]
call fcn.004db06e
mov dword [ebp - 0x128], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004dd6c1
mov eax, dword [ebp - 0x128]
jmp 0x430278
mov dword [ebp - 0x12c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004dd6c1
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4308c5
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], 0
jmp 0x4308e7
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x20
jge 0x430937
push 0x14
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.004b9030
add esp, 0xc
mov edx, dword [ebp - 0x1c]
push edx
push 0x51e200
lea eax, [ebp - 0x18]
push eax
call fcn.004b953d
add esp, 0xc
mov ecx, dword [ebp - 0x24]
add ecx, 0x8f5
push ecx
push 0
lea edx, [ebp - 0x18]
push edx
push 0x51e208
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x1c]
mov byte [ecx], al
jmp 0x4308de
mov dword [ebp - 0x1c], 0
jmp 0x430949
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0x20
jge 0x43099e
mov dword [ebp - 0x20], 0
jmp 0x430961
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x20
jge 0x430994
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x20]
jne 0x430971
jmp 0x430958
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x1c]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x20]
xor edx, edx
mov dl, byte [ecx]
cmp eax, edx
jne 0x430992
mov dword [ebp - 4], 0
jmp 0x430994
jmp 0x430958
cmp dword [ebp - 4], 0
jne 0x43099c
jmp 0x43099e
jmp 0x430940
cmp dword [ebp - 4], 0
jne 0x4309c9
mov dword [ebp - 0x1c], 0
jmp 0x4309b6
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x20
jge 0x4309c9
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x1c]
mov dl, byte [ebp - 0x1c]
mov byte [ecx], dl
jmp 0x4309ad
mov esp, ebp
pop ebp
ret 4
Function at 0x43f038
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push str._SMIReadCIDTable
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x53b404], eax
cmp dword [0x53b404], 0
jne 0x43f087
mov ecx, 1
test ecx, ecx
je 0x43f06d
mov dword [ebp - 4], 0
jmp 0x43f07d
push str.Null_dll_SMIReadCIDTable_n
call fcn.00411ec0
add esp, 4
mov dword [ebp - 4], eax
mov eax, 0x28
jmp 0x43f239
push str._SMIReadFlashID
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x53b400], eax
cmp dword [0x53b400], 0
jne 0x43f0d0
mov eax, 1
test eax, eax
je 0x43f0b6
mov dword [ebp - 8], 0
jmp 0x43f0c6
push str.Null_dll_SMIScanSMIDrive_n
call fcn.00411ec0
add esp, 4
mov dword [ebp - 8], eax
mov eax, 4
jmp 0x43f239
push str._SMIReadVndrCmd
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x53b3fc], eax
cmp dword [0x53b3fc], 0
jne 0x43f119
mov edx, 1
test edx, edx
je 0x43f0ff
mov dword [ebp - 0xc], 0
jmp 0x43f10f
push str.Null_dll_SMIReadVndrCmd_n
call fcn.00411ec0
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, 5
jmp 0x43f239
push str._SMIWriteVndrCmd
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x53b3f8], eax
cmp dword [0x53b3f8], 0
jne 0x43f162
mov ecx, 1
test ecx, ecx
je 0x43f148
mov dword [ebp - 0x10], 0
jmp 0x43f158
push str.Null_dll_SMIWriteVndrCmd_n
call fcn.00411ec0
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, 6
jmp 0x43f239
push str._SMI_Read_Phy_Page
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x53b3f4], eax
cmp dword [0x53b3f4], 0
jne 0x43f1ab
mov eax, 1
test eax, eax
je 0x43f191
mov dword [ebp - 0x14], 0
jmp 0x43f1a1
push str.Null_dll_SMI_Read_Phy_Page_n
call fcn.00411ec0
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, 7
jmp 0x43f239
push str._SMI_Program_Phy_Page
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x53b3f0], eax
cmp dword [0x53b3f0], 0
jne 0x43f1f1
mov edx, 1
test edx, edx
je 0x43f1da
mov dword [ebp - 0x18], 0
jmp 0x43f1ea
push str.Null_dll_SMI_Program_Phy_Page_n
call fcn.00411ec0
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, 8
jmp 0x43f239
push str._SMI_Erase_Phy_block
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x53b3ec], eax
cmp dword [0x53b3ec], 0
jne 0x43f237
mov ecx, 1
test ecx, ecx
je 0x43f220
mov dword [ebp - 0x1c], 0
jmp 0x43f230
push str.Null_dll_SMI_Erase_Phy_block_n
call fcn.00411ec0
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, 9
jmp 0x43f239
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x445cdf
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f4d43
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x228
mov dword [ebp - 0x22c], 0
lea ecx, [ebp - 0x14]
call fcn.004048c0
mov dword [ebp - 4], 0
mov dword [ebp - 0x224], 0
jmp 0x445d31
mov eax, dword [ebp - 0x224]
add eax, 1
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0x18
jge 0x445d63
mov ecx, dword [ebp - 0x224]
mov dword [ecx*8 + 0x53c768], 0
mov edx, dword [ebp - 0x224]
add edx, 0x43
mov eax, dword [ebp - 0x224]
mov byte [eax*8 + 0x53c76c], dl
jmp 0x445d22
push 0x104
push 0
lea ecx, [ebp - 0x118]
push ecx
call fcn.004b9030
add esp, 0xc
push 0x5253a8
lea edx, [ebp - 0x118]
push edx
call fcn.004b9290
add esp, 8
push 0x104
push 0
lea eax, [ebp - 0x220]
push eax
call fcn.004b9030
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
push 0x104
lea edx, [ebp - 0x220]
push edx
push 0x53b4d0
push 0x5253c8
push 0x5253cc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
movsx eax, byte [ebp - 0x220]
test eax, eax
jne 0x445dfa
mov dword [ebp - 0x230], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004dd6c1
mov eax, dword [ebp - 0x230]
jmp 0x445f23
push 0x5253d0
lea ecx, [ebp - 0x220]
push ecx
call fcn.004b9d16
add esp, 8
mov dword [ebp - 0x11c], eax
mov edx, dword [ebp - 0x11c]
push edx
push 0x5253d4
lea eax, [ebp - 0x14]
push eax
call fcn.004d3292
add esp, 0xc
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x14]
call fcn.0040b850
test eax, eax
jne 0x445f05
lea ecx, [ebp - 0x228]
push ecx
push 0x5253d8
lea ecx, [ebp - 0x14]
call fcn.004048e0
push eax
call fcn.004b9fab
add esp, 0xc
mov dword [ebp - 0x224], 0
jmp 0x445e7b
mov edx, dword [ebp - 0x224]
add edx, 1
mov dword [ebp - 0x224], edx
cmp dword [ebp - 0x224], 0x18
jge 0x445eb9
movsx eax, byte [ebp - 0x228]
mov ecx, dword [ebp - 0x224]
movsx edx, byte [ecx*8 + 0x53c76c]
cmp eax, edx
jne 0x445eb7
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x224]
mov dword [eax*8 + 0x53c768], 1
jmp 0x445eb9
jmp 0x445e6c
mov ecx, dword [ebp - 0x22c]
add ecx, 1
mov dword [ebp - 0x22c], ecx
push 0x5253dc
push 0
call fcn.004b9d16
add esp, 8
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jne 0x445ee8
jmp 0x445f05
mov edx, dword [ebp - 0x11c]
push edx
push 0x5253e0
lea eax, [ebp - 0x14]
push eax
call fcn.004d3292
add esp, 0xc
jmp 0x445e33
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x234], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004dd6c1
mov eax, dword [ebp - 0x234]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x450896
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov dword [0x53b5a4], 0
mov eax, dword [ebp - 4]
add eax, 0xf8
push eax
push 0
push str.ENABLECLEARSMARTFEATURE
push 0x5273fc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x53b5a4], eax
mov dword [0x53b5a0], 0
mov ecx, dword [ebp - 4]
add ecx, 0xf8
push ecx
push 0
push str.ResetSmartTool
push 0x527418
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x53b5a0], eax
mov edx, dword [ebp - 4]
add edx, 0xf8
push edx
push 0
push str.ENABLEQCTOOLPAGE
push 0x527438
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x53b424], eax
mov esp, ebp
pop ebp
ret

Function at 0x450917
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0xf8
push eax
push 0
push str.ENTRANSCENDFEATURE
push 0x527454
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x53bfa0], eax
mov ecx, dword [ebp - 4]
add ecx, 0xf8
push ecx
push 0
push str.ENABLEPNYMODE
push 0x52746c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x53c1b8], eax
mov edx, dword [ebp - 4]
add edx, 0xf8
push edx
push 0
push str.EnBarunMode
push 0x527480
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x53b59c], eax
mov eax, dword [ebp - 4]
add eax, 0xf8
push eax
push 0
push str.EnKingstonMode
push 0x527498
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x53b420], eax
mov ecx, dword [ebp - 4]
add ecx, 0xf8
push ecx
push 0
push str.EnBadBlkTab
push 0x5274ac
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x53b598], eax
mov esp, ebp
pop ebp
ret
Function at 0x455d27
Capabilities:
Create directory
Enumerate files on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f51f6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x260
mov dword [ebp - 0x26c], ecx
lea ecx, [ebp - 0x14]
call fcn.004048c0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004048c0
mov byte [ebp - 4], 1
push 0x725
mov ecx, dword [ebp - 0x26c]
call fcn.004dc934
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
call fcn.004057c0
push 0x104
push 0
lea eax, [ebp - 0x268]
push eax
call fcn.004b9030
add esp, 0xc
mov ecx, dword [ebp - 0x26c]
add ecx, 0x5c
push ecx
lea edx, [ebp - 0x268]
push edx
call fcn.004b9290
add esp, 8
push 0x5280c8
lea eax, [ebp - 0x268]
push eax
call fcn.004b92a0
add esp, 8
lea ecx, [ebp - 0x268]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x455e53
push 0
lea edx, [ebp - 0x268]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x455e33
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xb7
je 0x455e33
lea eax, [ebp - 0x268]
push eax
push 0x5280cc
lea ecx, [ebp - 0x10]
push ecx
call fcn.004d3292
add esp, 0xc
push 0
push 0x528110
lea ecx, [ebp - 0x10]
call fcn.004048e0
push eax
mov ecx, dword [ebp - 0x26c]
call fcn.004db06e
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004dd6c1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004dd6c1
jmp 0x455f7c
push 0x140
push 0
lea edx, [ebp - 0x158]
push edx
call fcn.004b9030
add esp, 0xc
lea eax, [ebp - 0x158]
push eax
push str...ini
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0xffffffff
jne 0x455eaa
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004dd6c1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004dd6c1
jmp 0x455f7c
cmp dword [ebp - 0x15c], 0xffffffff
je 0x455f18
lea ecx, [ebp - 0x14]
call fcn.004dd64c
lea ecx, [ebp - 0x12c]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004dd84a
push 0x2e
lea ecx, [ebp - 0x14]
call fcn.004d2f2f
mov dword [ebp - 0x164], eax
push 0
mov edx, dword [ebp - 0x164]
push edx
lea ecx, [ebp - 0x14]
call fcn.004d2a02
lea ecx, [ebp - 0x14]
call fcn.004048e0
push eax
mov ecx, dword [ebp - 0x18]
call fcn.00405790
lea eax, [ebp - 0x158]
push eax
mov ecx, dword [ebp - 0x15c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x455f16
jmp 0x455f18
jmp 0x455eaa
mov edx, dword [ebp - 0x15c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x104
push 0
mov eax, dword [ebp - 0x26c]
add eax, 0x674
push eax
call fcn.004b9030
add esp, 0xc
mov ecx, dword [ebp - 0x26c]
add ecx, 0x674
push ecx
push 0
mov ecx, dword [ebp - 0x18]
call fcn.00414970
push 0
mov ecx, dword [ebp - 0x18]
call fcn.00405760
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004dd6c1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004dd6c1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret