joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d0c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x314], 0
mov dword [ebp - 0x318], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30c], 0
mov dword [ebp - 0x310], 0x5fd3d0
mov al, byte [0x5c8124]
mov byte [ebp - 0x418], al
push 0xfe
push 0
lea ecx, [ebp - 0x417]
push ecx
call fcn.005323e0
add esp, 0xc
mov dl, byte [0x5c8125]
mov byte [ebp - 0x208], dl
push 0xfe
push 0
lea eax, [ebp - 0x207]
push eax
call fcn.005323e0
add esp, 0xc
mov cl, byte [0x5c8126]
mov byte [ebp - 0x108], cl
push 0xfe
push 0
lea edx, [ebp - 0x107]
push edx
call fcn.005323e0
add esp, 0xc
mov al, byte [0x5c8127]
mov byte [ebp - 0x308], al
push 0xfe
push 0
lea ecx, [ebp - 0x307]
push ecx
call fcn.005323e0
add esp, 0xc
push str.is_SR_course_installed
push 5
call fcn.00436500
add esp, 8
call fcn.00485a30
mov dword [ebp - 0x310], eax
push 0x5613c4
mov edx, dword [ebp - 0x310]
push edx
push 0x5613cc
lea eax, [ebp - 0x418]
push eax
call fcn.00532706
add esp, 0x10
lea ecx, [ebp - 4]
push ecx
push 1
push 1
lea edx, [ebp - 0x30c]
push edx
lea eax, [ebp - 0x208]
push eax
push 0x5613d4
lea ecx, [ebp - 0x418]
push ecx
push 4
call fcn.00491e40
add esp, 0x20
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0
jne 0x43d2dc
movsx edx, byte [ebp - 0x208]
cmp edx, 0x2e
jne 0x43d212
jmp 0x43d29f
cmp dword [ebp - 4], 0
jne 0x43d21d
jmp 0x43d29f
push 0x5c
lea eax, [ebp - 0x208]
push eax
push 0x5c
lea ecx, [ebp - 0x418]
push ecx
push str._s_c_s_cdyned.ini
lea edx, [ebp - 0x108]
push edx
call fcn.00532706
add esp, 0x18
lea eax, [ebp - 0x108]
push eax
push 0xff
lea ecx, [ebp - 0x308]
push ecx
push 0x5c8128
push 0x5613ec
push 0x5613f0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x314], eax
lea edx, [ebp - 0x308]
push edx
call fcn.0053ac2a
add esp, 4
cmp dword [ebp - 0x314], 0
je 0x43d29f
movsx eax, byte [ebp - 0x308]
cmp eax, 0x79
jne 0x43d29f
mov dword [ebp - 0x318], 1
cmp dword [ebp - 0x318], 0
jne 0x43d2dc
lea ecx, [ebp - 4]
push ecx
push 1
push 0
lea edx, [ebp - 0x30c]
push edx
lea eax, [ebp - 0x208]
push eax
push 0x5613fc
lea ecx, [ebp - 0x418]
push ecx
push 4
call fcn.00491e40
add esp, 0x20
test eax, eax
je 0x43d201
mov eax, dword [ebp - 0x318]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x44b220
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ec
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0xd8], 0
push 1
push 0x562698
mov eax, dword [ebp + 8]
push eax
call fcn.00459360
add esp, 0xc
mov dword [ebp - 0xd8], eax
cmp dword [0x5fdb24], 1
jne 0x44b26e
jmp 0x44b462
cmp dword [ebp - 0xd8], 0
jne 0x44b304
mov ecx, dword [ebp + 8]
push ecx
call fcn.00423310
add esp, 4
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 0
jne 0x44b2c0
push 1
push 0x56269c
mov edx, dword [ebp + 8]
push edx
call fcn.00459360
add esp, 0xc
mov dword [ebp - 0xd8], eax
push 0
mov eax, dword [ebp - 0xd8]
push eax
call fcn.00455880
add esp, 8
cmp dword [ebp - 0xd8], 0
jne 0x44b304
mov ecx, dword [ebp + 8]
push ecx
push 0x5626a0
lea edx, [ebp - 0x1e0]
push edx
call fcn.00532706
add esp, 0xc
push 0x5f493f
push 0x5f4940
push 0x5626b4
lea eax, [ebp - 0x1e0]
push eax
call fcn.00422b80
add esp, 0x10
jmp 0x44b462
mov ecx, dword [ebp - 0xd8]
push ecx
call fcn.004557e0
add esp, 4
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0xdc], 1
jmp 0x44b334
mov edx, dword [ebp - 0xdc]
add edx, 1
mov dword [ebp - 0xdc], edx
mov eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0x1e8]
jg 0x44b38e
mov ecx, dword [ebp - 0xd8]
push ecx
push 1
push 0xc8
lea edx, [ebp - 0xd0]
push edx
call fcn.0053367b
add esp, 0x10
push 0
push 1
lea eax, [ebp - 0xd0]
push eax
call fcn.0041aba0
add esp, 0xc
movsx ecx, word [ebp - 0xd0]
cmp ecx, 3
jne 0x44b38c
mov edx, dword [ebp - 0xdc]
mov dword [ebp - 0xd4], edx
jmp 0x44b38e
jmp 0x44b325
cmp dword [ebp - 0xd4], 0
jne 0x44b3c8
mov eax, dword [ebp - 0x1e8]
add eax, 1
mov dword [ebp - 0x1e8], eax
mov ecx, dword [ebp - 0x1e8]
push ecx
mov edx, dword [ebp - 0xd8]
push edx
call fcn.00455880
add esp, 8
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0xd4], eax
push 0xc8
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0xd0]
push edx
call fcn.00533040
add esp, 0xc
mov eax, dword [ebp - 0xd4]
sub eax, 1
imul eax, eax, 0xc8
add eax, 4
mov dword [ebp - 0x1e4], eax
push 0
mov ecx, dword [ebp - 0x1e4]
push ecx
mov edx, dword [ebp - 0xd8]
push edx
call fcn.00532940
add esp, 0xc
push 0
push 3
lea eax, [ebp - 0xd0]
push eax
call fcn.0041aba0
add esp, 0xc
mov ecx, dword [ebp - 0xd8]
push ecx
push 1
push 0xc8
lea edx, [ebp - 0xd0]
push edx
call fcn.005337fa
add esp, 0x10
push 0
push 3
lea eax, [ebp - 0xd0]
push eax
call fcn.0041aba0
add esp, 0xc
mov ecx, dword [ebp - 0xd8]
push ecx
call fcn.00431d50
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x44b470
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a8
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x3a8], 1
push 1
push 0x5626c4
mov eax, dword [ebp + 8]
push eax
call fcn.00459360
add esp, 0xc
mov dword [ebp - 0x29c], eax
cmp dword [0x5fdb24], 1
jne 0x44b4b6
xor eax, eax
jmp 0x44b5fc
cmp dword [ebp - 0x29c], 0
jne 0x44b4fc
mov ecx, dword [ebp + 8]
push ecx
push 0x5626c8
lea edx, [ebp - 0x3a0]
push edx
call fcn.00532706
add esp, 0xc
push 0x5f4941
push 0x5f4942
push 0x5626dc
lea eax, [ebp - 0x3a0]
push eax
call fcn.00422b80
add esp, 0x10
xor eax, eax
jmp 0x44b5fc
mov ecx, dword [ebp + 0xc]
push ecx
push 0x5626ec
lea edx, [ebp - 0x1d0]
push edx
call fcn.00532706
add esp, 0xc
lea eax, [ebp - 0x1d0]
push eax
call fcn.0053aa0e
add esp, 4
mov ecx, dword [ebp - 0x29c]
push ecx
call fcn.004557e0
add esp, 4
mov dword [ebp - 0x3a4], eax
mov dword [ebp - 0x2a0], 1
jmp 0x44b553
mov edx, dword [ebp - 0x2a0]
add edx, 1
mov dword [ebp - 0x2a0], edx
mov eax, dword [ebp - 0x2a0]
cmp eax, dword [ebp - 0x3a4]
jg 0x44b5e7
mov ecx, dword [ebp - 0x29c]
push ecx
push 1
push 0xc8
lea edx, [ebp - 0xd0]
push edx
call fcn.0053367b
add esp, 0x10
push 0
push 1
lea eax, [ebp - 0xd0]
push eax
call fcn.0041aba0
add esp, 0xc
movsx ecx, word [ebp - 0xd0]
cmp ecx, 4
jne 0x44b5e2
push 0xc8
lea edx, [ebp - 0xd0]
push edx
lea eax, [ebp - 0x298]
push eax
call fcn.00533040
add esp, 0xc
lea ecx, [ebp - 0x1d0]
push ecx
lea edx, [ebp - 0x292]
push edx
call fcn.00532680
add esp, 8
test eax, eax
je 0x44b5e2
mov dword [ebp - 0x3a8], 0
jmp 0x44b5e7
jmp 0x44b544
mov eax, dword [ebp - 0x29c]
push eax
call fcn.00431d50
add esp, 4
mov eax, dword [ebp - 0x3a8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x44b610
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3b0
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0xd4], 0
cmp dword [0x5f6638], 2
jl 0x44b63c
jmp 0x44b8b3
push 1
push 0x5626f0
mov eax, dword [ebp + 8]
push eax
call fcn.00459360
add esp, 0xc
mov dword [ebp - 0x2a4], eax
cmp dword [0x5fdb24], 1
jne 0x44b663
jmp 0x44b8b3
cmp dword [ebp - 0x2a4], 0
jne 0x44b6a7
mov ecx, dword [ebp + 8]
push ecx
push 0x5626f4
lea edx, [ebp - 0x3a8]
push edx
call fcn.00532706
add esp, 0xc
push 0x5f4943
push 0x5f4944
push 0x562708
lea eax, [ebp - 0x3a8]
push eax
call fcn.00422b80
add esp, 0x10
jmp 0x44b8b3
mov ecx, dword [ebp + 0xc]
push ecx
push 0x562718
lea edx, [ebp - 0x1d8]
push edx
call fcn.00532706
add esp, 0xc
lea eax, [ebp - 0x1d8]
push eax
call fcn.0053aa0e
add esp, 4
mov ecx, dword [ebp - 0x2a4]
push ecx
call fcn.004557e0
add esp, 4
mov dword [ebp - 0x3b0], eax
mov dword [ebp - 0x2a8], 1
jmp 0x44b6fe
mov edx, dword [ebp - 0x2a8]
add edx, 1
mov dword [ebp - 0x2a8], edx
mov eax, dword [ebp - 0x2a8]
cmp eax, dword [ebp - 0x3b0]
jg 0x44b7a4
mov ecx, dword [ebp - 0x2a4]
push ecx
push 1
push 0xc8
lea edx, [ebp - 0xd0]
push edx
call fcn.0053367b
add esp, 0x10
push 0
push 1
lea eax, [ebp - 0xd0]
push eax
call fcn.0041aba0
add esp, 0xc
movsx ecx, word [ebp - 0xd0]
cmp ecx, 4
jne 0x44b79f
lea edx, [ebp - 0xca]
push edx
call fcn.00532e80
add esp, 4
mov esi, eax
lea eax, [ebp - 0x1d8]
push eax
call fcn.00532e80
add esp, 4
add esi, eax
cmp esi, 0xc2
jae 0x44b79f
push 0xc8
lea ecx, [ebp - 0xd0]
push ecx
lea edx, [ebp - 0x2a0]
push edx
call fcn.00533040
add esp, 0xc
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0xd4], eax
jmp 0x44b7a4
jmp 0x44b6ef
cmp dword [ebp - 0xd4], 0
jne 0x44b800
mov ecx, dword [ebp - 0x3b0]
add ecx, 1
mov dword [ebp - 0x3b0], ecx
mov edx, dword [ebp - 0x3b0]
push edx
mov eax, dword [ebp - 0x2a4]
push eax
call fcn.00455880
add esp, 8
mov ecx, dword [ebp - 0x3b0]
mov dword [ebp - 0xd4], ecx
push 0xc8
push 0
lea edx, [ebp - 0x2a0]
push edx
call fcn.005323e0
add esp, 0xc
mov eax, 4
mov word [ebp - 0x2a0], ax
lea ecx, [ebp - 0x1d8]
push ecx
lea edx, [ebp - 0x29a]
push edx
call fcn.00532590
add esp, 8
push 0xc8
lea eax, [ebp - 0x2a0]
push eax
lea ecx, [ebp - 0xd0]
push ecx
call fcn.00533040
add esp, 0xc
mov edx, dword [ebp - 0xd4]
sub edx, 1
imul edx, edx, 0xc8
add edx, 4
mov dword [ebp - 0x3ac], edx
push 0
mov eax, dword [ebp - 0x3ac]
push eax
mov ecx, dword [ebp - 0x2a4]
push ecx
call fcn.00532940
add esp, 0xc
push 0
push 1
lea edx, [ebp - 0xd0]
push edx
call fcn.0041aba0
add esp, 0xc
mov eax, dword [ebp - 0x2a4]
push eax
push 1
push 0xc8
lea ecx, [ebp - 0xd0]
push ecx
call fcn.005337fa
add esp, 0x10
push 0
push 1
lea edx, [ebp - 0xd0]
push edx
call fcn.0041aba0
add esp, 0xc
mov eax, dword [ebp - 0x2a4]
push eax
call fcn.00431d50
add esp, 4
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x454340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x3c]
mov word [ebp - 0x28], cx
mov byte [ebp - 0x24], 0x54
mov byte [ebp - 0x23], 0x48
mov byte [ebp - 0x22], 0x43
mov byte [ebp - 0x21], 0x3b
mov byte [ebp - 0x20], 0x37
mov byte [ebp - 0x1f], 0x2c
mov byte [ebp - 0x1e], 0x24
mov byte [ebp - 0x1d], 0x1c
mov byte [ebp - 0x1c], 0x17
mov byte [ebp - 0x1b], 0
mov byte [ebp - 0x34], 0x1b
mov byte [ebp - 0x33], 0x19
mov byte [ebp - 0x32], 0x16
mov byte [ebp - 0x31], 0x14
mov byte [ebp - 0x30], 0x11
mov byte [ebp - 0x2f], 0xf
mov byte [ebp - 0x2e], 0xc
mov byte [ebp - 0x2d], 0xa
mov byte [ebp - 0x2c], 7
mov byte [ebp - 0x2b], 0
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x17], 0x43
mov byte [ebp - 0x16], 0x33
mov byte [ebp - 0x15], 0x25
mov byte [ebp - 0x14], 0x1b
mov byte [ebp - 0x13], 0
mov byte [ebp - 0x10], 0xc
mov byte [ebp - 0xf], 0xa
mov byte [ebp - 0xe], 7
mov byte [ebp - 0xd], 5
mov byte [ebp - 0xc], 2
mov byte [ebp - 0xb], 0
movsx edx, word [ebp - 0x28]
cmp edx, 0x64
jl 0x4543ef
movsx eax, word [ebp - 0x28]
sub eax, 0x64
mov word [ebp - 0x28], ax
movsx ecx, word [ebp - 0x28]
test ecx, ecx
jne 0x4544d6
mov edx, dword [ebp + 8]
push edx
call fcn.004527d0
add esp, 4
cmp eax, 1
jne 0x4544d6
mov eax, dword [ebp + 8]
movsx ecx, word [eax + 0xc]
cmp ecx, 2
jne 0x454474
mov edx, dword [ebp + 8]
movsx eax, word [edx + 0xe]
cmp eax, 6
jne 0x454474
mov ecx, dword [ebp + 8]
movsx edx, word [ecx + 0x14]
sub edx, 0x3e8
mov word [ebp - 0x38], dx
mov dword [ebp - 4], 0
jmp 0x45444b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xa
jge 0x454472
movsx ecx, word [ebp - 0x38]
mov edx, dword [ebp - 4]
movsx eax, byte [ebp + edx - 0x24]
cmp ecx, eax
jle 0x454470
mov ecx, dword [ebp - 4]
movsx dx, byte [ebp + ecx - 0x34]
mov word [ebp - 0x28], dx
jmp 0x454472
jmp 0x454442
jmp 0x4544d6
mov eax, dword [ebp + 8]
movsx ecx, word [eax + 0xc]
cmp ecx, 1
jne 0x4544d6
mov edx, dword [ebp + 8]
movsx eax, word [edx + 0xe]
cmp eax, 0xe
jne 0x4544d6
mov ecx, dword [ebp + 8]
movsx edx, word [ecx + 0x14]
sub edx, 0x3e8
mov word [ebp - 0x3c], dx
mov dword [ebp - 4], 0
jmp 0x4544af
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 6
jge 0x4544d6
movsx ecx, word [ebp - 0x3c]
mov edx, dword [ebp - 4]
movsx eax, byte [ebp + edx - 0x18]
cmp ecx, eax
jle 0x4544d4
mov ecx, dword [ebp - 4]
movsx dx, byte [ebp + ecx - 0x10]
mov word [ebp - 0x28], dx
jmp 0x4544d6
jmp 0x4544a6
mov ax, word [ebp - 0x28]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x455880
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x5f4ba7]
mov byte [ebp - 0x10], al
xor ecx, ecx
mov dword [ebp - 0xf], ecx
mov dword [ebp - 0xb], ecx
mov byte [ebp - 7], cl
cmp dword [ebp + 8], 0
jne 0x4558ab
jmp 0x4558f1
mov edx, dword [ebp + 0xc]
push edx
push 0x5634d0
lea eax, [ebp - 0x10]
push eax
call fcn.00532706
add esp, 0xc
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00532940
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 1
push 4
lea eax, [ebp - 0x10]
push eax
call fcn.00532e80
add esp, 4
lea ecx, [ebp + eax - 0x14]
push ecx
call fcn.005337fa
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret

Function at 0x455990
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x45599b
jmp 0x4559d3
mov eax, dword [ebp + 0xc]
push eax
push 1
push 0x228
mov ecx, dword [ebp + 8]
push ecx
call fcn.0053367b
add esp, 0x10
mov edx, dword [ebp + 8]
movsx eax, word [edx + 0x21a]
cmp eax, 0xff
jle 0x4559d3
push 1
mov ecx, dword [ebp + 8]
push ecx
push 3
call fcn.0041a960
add esp, 0xc
pop ebp
ret

Function at 0x4559e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x4559eb
jmp 0x455a02
mov eax, dword [ebp + 0xc]
push eax
push 1
push 0x228
mov ecx, dword [ebp + 8]
push ecx
call fcn.005337fa
add esp, 0x10
pop ebp
ret
Function at 0x455e20
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov al, byte [0x5f5637]
mov byte [ebp - 0x210], al
push 0xfe
push 0
lea ecx, [ebp - 0x20f]
push ecx
call fcn.005323e0
add esp, 0xc
mov dl, byte [0x5f577f]
mov byte [ebp - 0x110], dl
push 0xfe
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.005323e0
add esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0x563630
push 0x5c5ed8
push 0x56363c
lea ecx, [ebp - 0x210]
push ecx
call fcn.00532706
add esp, 0x10
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov cl, byte [eax]
mov byte [edx], cl
lea edx, [ebp - 0x210]
push edx
push 0xff
lea eax, [ebp - 0x110]
push eax
push 0x5f587f
push 0x563644
push 0x563658
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
movsx ecx, byte [ebp - 0x110]
test ecx, ecx
je 0x455eed
cmp dword [ebp + 0xc], 1
jne 0x455eed
mov eax, dword [ebp - 4]
jmp 0x455ff7
lea edx, [ebp - 0x110]
push edx
call fcn.0053ac2a
add esp, 4
movsx eax, byte [ebp - 0x110]
test eax, eax
jne 0x455f10
mov dword [ebp - 8], 2
jmp 0x455f38
push 0x563660
lea ecx, [ebp - 0x110]
push ecx
call fcn.00532680
add esp, 8
test eax, eax
je 0x455f31
mov dword [ebp - 8], 1
jmp 0x455f38
mov dword [ebp - 8], 2
movsx edx, byte [ebp - 0x110]
test edx, edx
jne 0x455f4c
mov dword [ebp - 4], 2
jmp 0x455f8d
push 0x563664
push 0x563678
push 0x5f597f
push 0x5f5a7f
push 0x5f5b7f
push 0x5f5c7f
push 0x5f5d7f
push str.MSG_Button_AlwaysOn
push str.MSG_Button_DialUp
mov eax, dword [ebp - 8]
push eax
push str.MSG_Message_InternetIntranetConnection
call fcn.00425d60
add esp, 0x2c
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x455ff4
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 8]
jne 0x455fa6
movsx edx, byte [ebp - 0x110]
test edx, edx
jne 0x455ff4
cmp dword [ebp - 4], 1
jne 0x455fc2
push 0x5636d8
lea eax, [ebp - 0x110]
push eax
call fcn.00532580
add esp, 8
jmp 0x455fd6
push 0x5636dc
lea ecx, [ebp - 0x110]
push ecx
call fcn.00532580
add esp, 8
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x110]
push eax
push 0x5636e0
push 0x5636f4
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x45c5d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10c], 0
mov al, byte [0x5f60ed]
mov byte [ebp - 0x108], al
push 0xfe
push 0
lea ecx, [ebp - 0x107]
push ecx
call fcn.005323e0
add esp, 0xc
cmp dword [0x5f6630], 1
jne 0x45c765
cmp dword [ebp + 0xc], 0
jne 0x45c631
movsx edx, byte [0x15444c0]
test edx, edx
jne 0x45c631
jmp 0x45c765
push str.local.dat
push 0x5c
mov eax, dword [ebp + 8]
push eax
push 0x5c
push 0x5c44f8
call fcn.004306e0
add esp, 4
push eax
push 0x56484c
lea ecx, [ebp - 0x108]
push ecx
call fcn.00532706
add esp, 0x1c
push 1
push 0x564858
lea edx, [ebp - 0x108]
push edx
call fcn.00459360
add esp, 0xc
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x45c765
cmp dword [0x5f6638], 2
jle 0x45c702
push 0x15444c0
call fcn.00434e70
add esp, 4
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x180], eax
jne 0x45c702
mov edx, dword [ebp + 8]
mov dword [ebp - 0x114], edx
mov eax, dword [ebp + 8]
add eax, 0x180
mov dword [ebp - 0x110], eax
push 0
mov ecx, dword [ebp - 0x110]
add ecx, 0x2bc
sub ecx, dword [ebp - 0x114]
push ecx
mov edx, dword [ebp - 0x10c]
push edx
call fcn.00532940
add esp, 0xc
mov eax, dword [ebp - 0x10c]
push eax
push 1
push 4
mov ecx, dword [ebp + 8]
add ecx, 0x180
push ecx
call fcn.005337fa
add esp, 0x10
push 0
push 0x8e8
mov edx, dword [ebp - 0x10c]
push edx
call fcn.00532940
add esp, 0xc
cmp dword [ebp + 0xc], 0
jne 0x45c73f
mov byte [0x15444c0], 0
mov eax, dword [ebp - 0x10c]
push eax
push 1
push 0x16
push 0x15444c0
call fcn.005337fa
add esp, 0x10
jmp 0x45c756
mov ecx, dword [ebp - 0x10c]
push ecx
push 1
push 0x16
mov edx, dword [ebp + 0xc]
push edx
call fcn.005337fa
add esp, 0x10
mov eax, dword [ebp - 0x10c]
push eax
call fcn.00431d50
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x45eda0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov al, byte [0x5f611c]
mov byte [ebp - 0x210], al
push 0xfe
push 0
lea ecx, [ebp - 0x20f]
push ecx
call fcn.005323e0
add esp, 0xc
mov dl, byte [0x5f611d]
mov byte [ebp - 0x110], dl
push 0xfe
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.005323e0
add esp, 0xc
mov dword [ebp - 8], 0
push 0x1068ea0
push str._slocal.dat
lea ecx, [ebp - 0x210]
push ecx
call fcn.00532706
add esp, 0xc
push 0x564d78
lea edx, [ebp - 0x210]
push edx
call fcn.0042eaa0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x45ef97
push 0x127c
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.005323e0
add esp, 0xc
push 0x8e78
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.005323e0
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
push 1
push 0x2bc
mov eax, dword [ebp + 8]
push eax
call fcn.0053367b
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00455990
add esp, 8
mov eax, dword [ebp - 4]
push eax
push 1
push 0x404
push 0xd86460
call fcn.0053367b
add esp, 0x10
mov byte [0x5c4c2c], 0
mov ecx, dword [ebp - 4]
push ecx
push 1
push 0x16
push 0x5c4c2c
call fcn.0053367b
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.00431d50
add esp, 4
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.0041aee0
add esp, 8
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00419f70
add esp, 8
mov edx, dword [ebp + 0xc]
movsx eax, word [edx + 0x21a]
cmp eax, 1
je 0x45ef09
push 0x3e7
mov ecx, dword [ebp + 0xc]
push ecx
push 1
call fcn.0041a960
add esp, 0xc
mov edx, 1
mov eax, dword [ebp + 0xc]
mov word [eax + 0x21a], dx
mov dword [ebp - 8], 1
push 0x228
mov ecx, dword [ebp + 0xc]
push ecx
push 0x119e040
call fcn.00533040
add esp, 0xc
movsx edx, byte [0xd86493]
test edx, edx
je 0x45ef5e
push 0x3d1
push 0xd86493
push 0xd86494
call fcn.00533040
add esp, 0xc
mov byte [0xd86493], 0
push 0
push 0xd86460
call fcn.0041b080
add esp, 8
push 0xd86489
call fcn.00532e80
add esp, 4
cmp eax, 8
je 0x45ef95
mov dword [ebp - 8], 0
push str.Error:_LoadLocalClassStudent_GroupSerialNum
push 1
call fcn.00436500
add esp, 8
jmp 0x45efd9
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x110]
push ecx
push str.MSG_Message_UnableToReadFile
push 0
call fcn.0046ce90
add esp, 0x10
push str.Unable_to_read_local.dat_file.
push 0x5f611e
push 0x564de8
lea edx, [ebp - 0x110]
push edx
call fcn.00422b80
add esp, 0x10
mov dword [ebp - 8], 0
movsx eax, word [0xd86498]
cmp eax, 0xfffffc18
jl 0x45eff3
movsx ecx, word [0xd86498]
cmp ecx, 0xf
jle 0x45effc
xor edx, edx
mov word [0xd86498], dx
movsx eax, word [0xd86496]
cmp eax, 0xfffffe93
jl 0x45f016
movsx ecx, word [0xd86496]
cmp ecx, 0xf
jle 0x45f01f
xor edx, edx
mov word [0xd86496], dx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret
Function at 0x460770
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x110], 0
mov al, byte [0x5f6124]
mov byte [ebp - 0x108], al
push 0xfe
push 0
lea ecx, [ebp - 0x107]
push ecx
call fcn.005323e0
add esp, 0xc
mov dl, byte [0x5f6125]
mov byte [ebp - 0x210], dl
push 0xfe
push 0
lea eax, [ebp - 0x20f]
push eax
call fcn.005323e0
add esp, 0xc
cmp dword [0x5f6630], 1
jne 0x4607ff
mov ecx, dword [ebp + 8]
mov byte [ecx], 0
mov edx, dword [ebp + 0xc]
push edx
push str.ADDC
call fcn.0046fa30
add esp, 8
mov dword [ebp - 0x110], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
jmp 0x460876
push 0x564e40
push 0x5fd3d0
push 0x564e4c
lea ecx, [ebp - 0x210]
push ecx
call fcn.00532706
add esp, 0x10
lea edx, [ebp - 0x210]
push edx
push 0xff
lea eax, [ebp - 0x108]
push eax
push 0x5f6126
push str.audio1
push 0x564e5c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x110], eax
lea ecx, [ebp - 0x109]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x108]
push eax
call fcn.0041b340
add esp, 0xc
movsx ecx, byte [ebp - 0x109]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret

Function at 0x461eb0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 1
push 0x28
push 0x5652bc
mov eax, dword [ebp + 0xc]
add eax, 0x9e
push eax
call fcn.0053387c
add esp, 0xc
test eax, eax
jne 0x461ee9
mov dword [ebp - 8], 1
jmp 0x461f21
mov dword [ebp - 4], 0x28
jmp 0x461efb
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x50
jge 0x461f21
cmp dword [ebp - 8], 1
jne 0x461f21
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
movzx eax, byte [edx + 0x76]
cmp eax, 0xcc
je 0x461f1f
mov dword [ebp - 8], 0
jmp 0x461ef2
cmp dword [ebp - 8], 1
jne 0x461f3d
push 0x28
push 0
mov ecx, dword [ebp + 0xc]
add ecx, 0x9e
push ecx
call fcn.005323e0
add esp, 0xc
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx + 0x76]
test eax, eax
jne 0x461f7c
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx + 0x77]
cmp edx, 0xcc
jne 0x461f7c
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + 0x9e]
cmp ecx, 0xcc
jne 0x461f7c
push 0x50
push 0
mov edx, dword [ebp + 0xc]
add edx, 0x76
push edx
call fcn.005323e0
add esp, 0xc
push 0xa
mov eax, dword [ebp + 0xc]
add eax, 0x9e
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00533040
add esp, 0xc
mov eax, 1
mov esp, ebp
pop ebp
ret