joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50c300
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62bdcb
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x6d5db8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.CReconnectDevProcess.0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 4], 0
je 0x50c388
mov edx, dword [ebp - 0x10]
mov dword [edx + 0xc], 0
push 0x3e8
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x50c371
push 0xffffffffffffffff
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 0x10]
call fcn.0050c9d0
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.0050cb60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x50c3c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62bdee
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x6d5db8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x20]
cmp dword [eax + 4], 0
jne 0x50c44d
lea ecx, [ebp - 0x1c]
call fcn.00514f40
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.005177c0
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 0xc], 1
lea eax, [ebp - 0x10]
push eax
push 1
mov ecx, dword [ebp - 0x20]
push ecx
push 0x50c4d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x20]
mov dword [edx + 4], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00515010
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp dword [eax + 4], 0
setne cl
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x50c470
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x50c4c9
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0
push 0x3e8
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x50c4b2
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov esp, ebp
pop ebp
ret
Function at 0x50e030
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x11c], ecx
push 0x6721f8
mov eax, dword [ebp - 0x11c]
add eax, 0x10
push eax
lea ecx, [ebp - 0x114]
push ecx
call fcn.00404260
add esp, 0xc
mov dword [ebp - 4], 0x18
mov dword [ebp - 8], str.CPersonality
mov byte [ebp - 0x110], 0
push 0xff
push 0
lea edx, [ebp - 0x10f]
push edx
call fcn.005e5330
add esp, 0xc
lea ecx, [ebp - 0x114]
call fcn.00587e90
push eax
push 0x100
lea eax, [ebp - 0x110]
push eax
push 0x6721ca
push str.btn_size
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x50e0d9
lea edx, [ebp - 0x110]
push edx
call fcn.005e62d7
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0x118], 1
lea ecx, [ebp - 0x114]
call fcn.00401620
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret

Function at 0x515070
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.00587e90
push eax
push 0x40
mov eax, dword [ebp + 8]
push eax
push 0x673bc1
push str.ProjectName
push 0x673bec
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 4], eax
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x515130
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], ecx
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.005e5330
add esp, 0xc
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.00587e90
push eax
push 0xa
lea ecx, [ebp - 0x10]
push ecx
push 0x673bc2
push str.VideoWndTotal
push 0x673c30
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x18], 0
jbe 0x515199
lea edx, [ebp - 0x10]
push edx
call fcn.005e62d7
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret
Function at 0x515270
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x515293
xor al, al
jmp 0x5152f8
push 0xa
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.005e5330
add esp, 0xc
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
push str.Wnd__d__d
lea ecx, [ebp - 0x10]
push ecx
call fcn.005e5a78
add esp, 0x10
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.00587e90
push eax
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0x673c78
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
test eax, eax
setne dl
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x14]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x5152f5
xor al, al
jmp 0x5152f8
mov al, byte [ebp - 0x15]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret 0x10

Function at 0x5154f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.00587e90
push eax
push 0
push str.RecoverLastState
push 0x673d44
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
setne al
mov esp, ebp
pop ebp
ret

Function at 0x515630
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x110], ecx
push 0x100
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.005e5330
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push str.Wnd__d_Sound
lea edx, [ebp - 0x108]
push edx
call fcn.005e5a78
add esp, 0xc
mov ecx, dword [ebp - 0x110]
add ecx, 4
call fcn.00587e90
push eax
push 0
lea eax, [ebp - 0x108]
push eax
push 0x673da8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
setne al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret 4

Function at 0x5158d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x110], ecx
push 0x100
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.005e5330
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push str.Wnd__d_Record
lea edx, [ebp - 0x108]
push edx
call fcn.005e5a78
add esp, 0xc
mov ecx, dword [ebp - 0x110]
add ecx, 4
call fcn.00587e90
push eax
push 0
lea eax, [ebp - 0x108]
push eax
push 0x673e28
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
setne al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret 4
Function at 0x515d30
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00587e90
push eax
push 0
push str.AlarmShow
push 0x673ef4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
xor ecx, ecx
cmp ecx, eax
sbb edx, edx
neg edx
mov eax, dword [ebp + 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00587e90
push eax
push 0xf
push str.AlarmKeepDays
push 0x673f10
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00587e90
push eax
push 7
push str.OperationKeepDays
push str.Log_note
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
mov al, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x515db0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62cd8c
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x128], ecx
mov byte [ebp - 0x11c], 0
push 0x103
push 0
lea eax, [ebp - 0x11b]
push eax
call fcn.005e5330
add esp, 0xc
push str.Picture
call fcn.0041b910
add eax, 4
push eax
lea ecx, [ebp - 0x120]
push ecx
call fcn.00404260
add esp, 0xc
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x128]
add ecx, 4
call fcn.00587e90
push eax
push 0x104
lea edx, [ebp - 0x11c]
push edx
push 0x673bdf
push 0x673f44
push 0x673f4c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
setne al
mov byte [ebp - 0x121], al
push 0x673bf9
lea ecx, [ebp - 0x11c]
push ecx
call fcn.0040ced0
add esp, 8
test eax, eax
jne 0x515e86
lea edx, [ebp - 0x120]
push edx
mov ecx, dword [ebp + 8]
call fcn.0040bb70
jmp 0x515e95
lea eax, [ebp - 0x11c]
push eax
mov ecx, dword [ebp + 8]
call fcn.00401640
mov cl, byte [ebp - 0x121]
mov byte [ebp - 0x122], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x120]
call fcn.00401620
mov al, byte [ebp - 0x122]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret 4
Function at 0x515f20
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62cdbf
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x128], ecx
mov byte [ebp - 0x11c], 0
push 0x103
push 0
lea eax, [ebp - 0x11b]
push eax
call fcn.005e5330
add esp, 0xc
push 0x673f7c
call fcn.0041b910
add eax, 4
push eax
lea ecx, [ebp - 0x120]
push ecx
call fcn.00404260
add esp, 0xc
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x128]
add ecx, 4
call fcn.00587e90
push eax
push 0x104
lea edx, [ebp - 0x11c]
push edx
lea ecx, [ebp - 0x120]
call fcn.00587e90
push eax
push 0x673f84
push 0x673f8c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
setne al
mov byte [ebp - 0x121], al
push 0x673bfa
lea ecx, [ebp - 0x11c]
push ecx
call fcn.0040ced0
add esp, 8
test eax, eax
jne 0x515ffd
lea edx, [ebp - 0x120]
push edx
mov ecx, dword [ebp + 8]
call fcn.0040bb70
jmp 0x51600c
lea eax, [ebp - 0x11c]
push eax
mov ecx, dword [ebp + 8]
call fcn.00401640
mov cl, byte [ebp - 0x121]
mov byte [ebp - 0x122], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x120]
call fcn.00401620
mov al, byte [ebp - 0x122]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret 4

Function at 0x5161c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], ecx
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.005e5330
add esp, 0xc
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.00587e90
push eax
push 0xa
lea ecx, [ebp - 0x10]
push ecx
push 0x673bff
push 0x673fec
push 0x673ff4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
setne dl
mov byte [ebp - 0x15], dl
movzx eax, byte [ebp - 0x15]
test eax, eax
je 0x516232
lea ecx, [ebp - 0x10]
push ecx
call fcn.005e62d7
add esp, 4
mov dword [ebp - 0x14], eax
jmp 0x516253
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.00587e90
push eax
push 0x674008
push 0x67400c
push 0x674014
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret
Function at 0x516410
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], ecx
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.005e5330
add esp, 0xc
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.00587e90
push eax
push 0xa
lea ecx, [ebp - 0x10]
push ecx
push 0x674084
push 0x674088
push 0x674094
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
setne dl
mov byte [ebp - 0x15], dl
movzx eax, byte [ebp - 0x15]
test eax, eax
je 0x516482
lea ecx, [ebp - 0x10]
push ecx
call fcn.005e62d7
add esp, 4
mov dword [ebp - 0x14], eax
jmp 0x5164a3
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.00587e90
push eax
push 0x6740a8
push str.ExpandTree
push 0x6740b8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [ebp - 0x14], 0
setne al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret

Function at 0x516570
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], ecx
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.005e5330
add esp, 0xc
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.00587e90
push eax
push 0xa
lea ecx, [ebp - 0x10]
push ecx
push 0x6740f0
push 0x6740f4
push 0x674100
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
setne dl
mov byte [ebp - 0x15], dl
movzx eax, byte [ebp - 0x15]
test eax, eax
je 0x5165e2
lea ecx, [ebp - 0x10]
push ecx
call fcn.005e62d7
add esp, 4
mov dword [ebp - 0x14], eax
jmp 0x516603
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.00587e90
push eax
push 0x674114
push str.AutoLogin
push 0x674124
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [ebp - 0x14], 0
setne al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret

Function at 0x5166d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], ecx
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.005e5330
add esp, 0xc
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.00587e90
push eax
push 0xa
lea ecx, [ebp - 0x10]
push ecx
push 0x674160
push 0x674164
push 0x674174
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
setne dl
mov byte [ebp - 0x15], dl
movzx eax, byte [ebp - 0x15]
test eax, eax
je 0x516742
lea ecx, [ebp - 0x10]
push ecx
call fcn.005e62d7
add esp, 4
mov dword [ebp - 0x14], eax
jmp 0x516763
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.00587e90
push eax
push 0x674188
push str.AutoLoginTemp
push 0x67419c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [ebp - 0x14], 0
setne al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret
Function at 0x516780
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], ecx
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.005e5330
add esp, 0xc
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.00587e90
push eax
push 0xa
lea ecx, [ebp - 0x10]
push ecx
push 0x673c1f
push 0x6741b0
push 0x6741bc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
setne dl
mov byte [ebp - 0x15], dl
movzx eax, byte [ebp - 0x15]
test eax, eax
je 0x5167f2
lea ecx, [ebp - 0x10]
push ecx
call fcn.005e62d7
add esp, 4
mov dword [ebp - 0x14], eax
jmp 0x516813
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.00587e90
push eax
push 0x6741d0
push 0x6741d4
push 0x6741e0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret

Function at 0x5168e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], ecx
push 0xa
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.005e5330
add esp, 0xc
mov dword [ebp - 0x14], 4
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.00587e90
push eax
push 0xa
lea ecx, [ebp - 0x10]
push ecx
push 0x674218
push 0x67421c
push 0x67422c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
setne dl
mov byte [ebp - 0x15], dl
movzx eax, byte [ebp - 0x15]
test eax, eax
je 0x516952
lea ecx, [ebp - 0x10]
push ecx
call fcn.005e62d7
add esp, 4
mov dword [ebp - 0x14], eax
jmp 0x516973
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.00587e90
push eax
push 0x67423c
push 0x674240
push 0x674250
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret
Function at 0x516a40
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
push 0x100
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.005e5330
add esp, 0xc
mov ecx, dword [ebp - 0x214]
add ecx, 4
call fcn.00587e90
push eax
push 0x100
lea ecx, [ebp - 0x108]
push ecx
push 0x673c3d
push 0x674284
push 0x67428c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
setne dl
mov byte [ebp - 0x109], dl
movzx eax, byte [ebp - 0x109]
test eax, eax
jne 0x516abf
mov eax, 0xfffffffd
jmp 0x516b4a
lea ecx, [ebp - 0x108]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00401640
push 0x100
push 0
lea edx, [ebp - 0x210]
push edx
call fcn.005e5330
add esp, 0xc
mov ecx, dword [ebp - 0x214]
add ecx, 4
call fcn.00587e90
push eax
push 0x100
lea eax, [ebp - 0x210]
push eax
push 0x673c3e
push 0x674294
push 0x67429c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
setne cl
mov byte [ebp - 0x109], cl
movzx edx, byte [ebp - 0x109]
test edx, edx
jne 0x516b31
mov eax, 0xfffffffc
jmp 0x516b4a
lea eax, [ebp - 0x210]
push eax
call fcn.005e62d7
add esp, 4
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret 8

Function at 0x516d50
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x268], ecx
push 0x10
push 0
lea eax, [ebp - 0x264]
push eax
call fcn.005e5330
add esp, 0xc
mov ecx, dword [ebp - 0x268]
add ecx, 4
call fcn.00587e90
push eax
push 0x10
lea ecx, [ebp - 0x264]
push ecx
push 0x673c3f
push 0x6742f0
push 0x6742fc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
setne dl
mov byte [ebp - 0x109], dl
movzx eax, byte [ebp - 0x109]
test eax, eax
jne 0x516dc7
or eax, 0xffffffff
jmp 0x516e93
lea ecx, [ebp - 0x264]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00401640
push 0x100
push 0
lea edx, [ebp - 0x108]
push edx
call fcn.005e5330
add esp, 0xc
mov ecx, dword [ebp - 0x268]
add ecx, 4
call fcn.00587e90
push eax
push 0x100
lea eax, [ebp - 0x108]
push eax
push 0x673c4a
push 0x674304
push 0x674310
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
setne cl
mov byte [ebp - 0x251], cl
movzx edx, byte [ebp - 0x251]
test edx, edx
jne 0x516e39
mov eax, 0xfffffffe
jmp 0x516e93
push 0x100
push 0
lea eax, [ebp - 0x250]
push eax
call fcn.005e5330
add esp, 0xc
push 0x100
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x250]
push edx
call fcn.005e5550
add esp, 0xc
push 1
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x250]
push ecx
call sub.Password.dll_DecryptStringEX
lea edx, [ebp - 0x150]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00401640
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret 8
Function at 0x516eb0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.00587e90
push eax
push 0xea60
push 0x674318
push 0x674328
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x4e20
jle 0x516eed
mov eax, dword [ebp - 4]
jmp 0x516ef2
mov eax, 0xea60
mov esp, ebp
pop ebp
ret

Function at 0x517000
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.00587e90
push eax
push 1
push 0x674368
push 0x674378
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [ebp - 4], 0
setg al
mov esp, ebp
pop ebp
ret

Function at 0x5170c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.00587e90
push eax
push 0
push 0x67439c
push str.DDNS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [ebp - 4], 0
setg al
mov esp, ebp
pop ebp
ret

Function at 0x517100
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x6d5db8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
push 0x100
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.005e5330
add esp, 0xc
mov ecx, dword [ebp - 0x214]
add ecx, 4
call fcn.00587e90
push eax
push 0x100
lea ecx, [ebp - 0x108]
push ecx
push 0x673c4b
push 0x6743b4
push 0x6743bc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
setne dl
mov byte [ebp - 0x109], dl
movzx eax, byte [ebp - 0x109]
test eax, eax
jne 0x51717d
or eax, 0xffffffff
jmp 0x517208
lea ecx, [ebp - 0x108]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00401640
push 0x100
push 0
lea edx, [ebp - 0x210]
push edx
call fcn.005e5330
add esp, 0xc
mov ecx, dword [ebp - 0x214]
add ecx, 4
call fcn.00587e90
push eax
push 0x100
lea eax, [ebp - 0x210]
push eax
push str.9000
push 0x6743d0
push 0x6743d8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
setne cl
mov byte [ebp - 0x109], cl
movzx edx, byte [ebp - 0x109]
test edx, edx
jne 0x5171ef
mov eax, 0xfffffffe
jmp 0x517208
lea eax, [ebp - 0x210]
push eax
call fcn.005e62d7
add esp, 4
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e5163
mov esp, ebp
pop ebp
ret 8