joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003c2b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp dword [0x2fb7ac4], 0
je 0x1003c4cc
push ebx
mov ebx, 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x1019a27c], ebx
jne 0x1003c2e6
call edi
sub eax, dword [0x1011cd7c]
cmp eax, 0x7530
jbe 0x1003c2e6
call fcn.1003c0c0
cmp dword [0x10199550], ebx
jne 0x1003c324
cmp dword [0x1012d3e4], ebx
jne 0x1003c324
mov eax, dword [0x2fb7ac4]
cmp dword [eax + 0x2630], 0
jne 0x1003c311
cmp dword [0x1011cd68], 2
jne 0x1003c324
push 3
jmp 0x1003c31c
cmp dword [0x1011cd68], 2
je 0x1003c324
push 4
call fcn.1003bae0
add esp, 4
cmp dword [0x10192e88], ebx
jne case.default.0x1003c39c
call edi
sub eax, dword [0x1012d210]
cmp eax, 0xbb8
jb case.default.0x1003c39c
call edi
sub eax, dword [0x1012d238]
cmp eax, 0x7d0
jb case.default.0x1003c39c
mov eax, dword [0x10191a04]
cmp eax, ebx
jne 0x1003c379
cmp dword [0x1011cd68], 2
jne case.default.0x1003c39c
mov ecx, dword [0x2fb7ac4]
cmp dword [ecx + 0x297c], 0
je 0x1003c38b
jmp case.default.0x1003c39c
test eax, eax
jne case.default.0x1003c39c
mov edx, dword [0x2fb7ac4]
cmp dword [edx + 0x297c], eax
jne case.default.0x1003c39c
call edi
mov dword [0x1012d210], eax
mov eax, dword [0x10192fcc]
cmp eax, 4
ja case.default.0x1003c39c
jmp dword [eax*4 + 0x1003c4d0]
push 0
push 0x92c0d
jmp 0x1003c3ce
push 0
push 0x92c0e
jmp 0x1003c3ce
push 0
push 0x92c0f
jmp 0x1003c3ce
push 0
push 0xf468d
jmp 0x1003c3ce
push 0
push 0xf468e
call fcn.1003a280
add esp, 8
mov eax, dword [0x2fb7ac4]
cmp dword [eax + 0x297c], 0
jle 0x1003c4ad
push 0x1009e680
call fcn.10006d90
add esp, 4
test eax, eax
jne 0x1003c4ad
push 0x1009e678
call fcn.10006d90
add esp, 4
test eax, eax
jne 0x1003c4ad
push 0x1009e698
call fcn.10006d90
add esp, 4
test eax, eax
jne 0x1003c4ad
push 0x1009e688
call fcn.10006d90
add esp, 4
test eax, eax
jne 0x1003c4ad
push 0x1009e668
call fcn.10006d90
add esp, 4
test eax, eax
jne 0x1003c4ad
cmp dword [0x1012d3e4], ebx
jne 0x1003c4ad
cmp dword [0x34d2968], eax
jle 0x1003c4ad
call edi
sub eax, dword [0x101b8990]
cmp eax, 0x4e20
jb 0x1003c4b4
mov ecx, dword [0x2fb7ac4]
mov eax, dword [ecx + 0x297c]
push 0
cmp eax, 6
jne 0x1003c48a
push 0xf468e
call fcn.1003a280
add esp, 8
jmp 0x1003c4b4
cmp eax, 7
jne 0x1003c49e
push 0xf468d
call fcn.1003a280
add esp, 8
jmp 0x1003c4b4
push 0x92c0d
call fcn.1003a280
add esp, 8
jmp 0x1003c4b4
call edi
mov dword [0x101b8990], eax
cmp dword [0x10199428], ebx
pop edi
pop ebx
jne 0x1003c4cc
cmp dword [0x34da460], 0
jne 0x1003c4cc
jmp fcn.1003a470
ret
Function at 0x1003c3b5
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp dword [0x2fb7ac4], 0
je 0x1003c4cc
push ebx
mov ebx, 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x1019a27c], ebx
jne 0x1003c2e6
call edi
sub eax, dword [0x1011cd7c]
cmp eax, 0x7530
jbe 0x1003c2e6
call fcn.1003c0c0
cmp dword [0x10199550], ebx
jne 0x1003c324
cmp dword [0x1012d3e4], ebx
jne 0x1003c324
mov eax, dword [0x2fb7ac4]
cmp dword [eax + 0x2630], 0
jne 0x1003c311
cmp dword [0x1011cd68], 2
jne 0x1003c324
push 3
jmp 0x1003c31c
cmp dword [0x1011cd68], 2
je 0x1003c324
push 4
call fcn.1003bae0
add esp, 4
cmp dword [0x10192e88], ebx
jne case.default.0x1003c39c
call edi
sub eax, dword [0x1012d210]
cmp eax, 0xbb8
jb case.default.0x1003c39c
call edi
sub eax, dword [0x1012d238]
cmp eax, 0x7d0
jb case.default.0x1003c39c
mov eax, dword [0x10191a04]
cmp eax, ebx
jne 0x1003c379
cmp dword [0x1011cd68], 2
jne case.default.0x1003c39c
mov ecx, dword [0x2fb7ac4]
cmp dword [ecx + 0x297c], 0
je 0x1003c38b
jmp case.default.0x1003c39c
test eax, eax
jne case.default.0x1003c39c
mov edx, dword [0x2fb7ac4]
cmp dword [edx + 0x297c], eax
jne case.default.0x1003c39c
call edi
mov dword [0x1012d210], eax
mov eax, dword [0x10192fcc]
cmp eax, 4
ja case.default.0x1003c39c
jmp dword [eax*4 + 0x1003c4d0]
push 0
push 0x92c0d
jmp 0x1003c3ce
push 0
push 0x92c0e
jmp 0x1003c3ce
push 0
push 0x92c0f
jmp 0x1003c3ce
push 0
push 0xf468d
jmp 0x1003c3ce
push 0
push 0xf468e
call fcn.1003a280
add esp, 8
mov eax, dword [0x2fb7ac4]
cmp dword [eax + 0x297c], 0
jle 0x1003c4ad
push 0x1009e680
call fcn.10006d90
add esp, 4
test eax, eax
jne 0x1003c4ad
push 0x1009e678
call fcn.10006d90
add esp, 4
test eax, eax
jne 0x1003c4ad
push 0x1009e698
call fcn.10006d90
add esp, 4
test eax, eax
jne 0x1003c4ad
push 0x1009e688
call fcn.10006d90
add esp, 4
test eax, eax
jne 0x1003c4ad
push 0x1009e668
call fcn.10006d90
add esp, 4
test eax, eax
jne 0x1003c4ad
cmp dword [0x1012d3e4], ebx
jne 0x1003c4ad
cmp dword [0x34d2968], eax
jle 0x1003c4ad
call edi
sub eax, dword [0x101b8990]
cmp eax, 0x4e20
jb 0x1003c4b4
mov ecx, dword [0x2fb7ac4]
mov eax, dword [ecx + 0x297c]
push 0
cmp eax, 6
jne 0x1003c48a
push 0xf468e
call fcn.1003a280
add esp, 8
jmp 0x1003c4b4
cmp eax, 7
jne 0x1003c49e
push 0xf468d
call fcn.1003a280
add esp, 8
jmp 0x1003c4b4
push 0x92c0d
call fcn.1003a280
add esp, 8
jmp 0x1003c4b4
call edi
mov dword [0x101b8990], eax
cmp dword [0x10199428], ebx
pop edi
pop ebx
jne 0x1003c4cc
cmp dword [0x34da460], 0
jne 0x1003c4cc
jmp fcn.1003a470
ret
Function at 0x1003c3be
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp dword [0x2fb7ac4], 0
je 0x1003c4cc
push ebx
mov ebx, 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x1019a27c], ebx
jne 0x1003c2e6
call edi
sub eax, dword [0x1011cd7c]
cmp eax, 0x7530
jbe 0x1003c2e6
call fcn.1003c0c0
cmp dword [0x10199550], ebx
jne 0x1003c324
cmp dword [0x1012d3e4], ebx
jne 0x1003c324
mov eax, dword [0x2fb7ac4]
cmp dword [eax + 0x2630], 0
jne 0x1003c311
cmp dword [0x1011cd68], 2
jne 0x1003c324
push 3
jmp 0x1003c31c
cmp dword [0x1011cd68], 2
je 0x1003c324
push 4
call fcn.1003bae0
add esp, 4
cmp dword [0x10192e88], ebx
jne case.default.0x1003c39c
call edi
sub eax, dword [0x1012d210]
cmp eax, 0xbb8
jb case.default.0x1003c39c
call edi
sub eax, dword [0x1012d238]
cmp eax, 0x7d0
jb case.default.0x1003c39c
mov eax, dword [0x10191a04]
cmp eax, ebx
jne 0x1003c379
cmp dword [0x1011cd68], 2
jne case.default.0x1003c39c
mov ecx, dword [0x2fb7ac4]
cmp dword [ecx + 0x297c], 0
je 0x1003c38b
jmp case.default.0x1003c39c
test eax, eax
jne case.default.0x1003c39c
mov edx, dword [0x2fb7ac4]
cmp dword [edx + 0x297c], eax
jne case.default.0x1003c39c
call edi
mov dword [0x1012d210], eax
mov eax, dword [0x10192fcc]
cmp eax, 4
ja case.default.0x1003c39c
jmp dword [eax*4 + 0x1003c4d0]
push 0
push 0x92c0d
jmp 0x1003c3ce
push 0
push 0x92c0e
jmp 0x1003c3ce
push 0
push 0x92c0f
jmp 0x1003c3ce
push 0
push 0xf468d
jmp 0x1003c3ce
push 0
push 0xf468e
call fcn.1003a280
add esp, 8
mov eax, dword [0x2fb7ac4]
cmp dword [eax + 0x297c], 0
jle 0x1003c4ad
push 0x1009e680
call fcn.10006d90
add esp, 4
test eax, eax
jne 0x1003c4ad
push 0x1009e678
call fcn.10006d90
add esp, 4
test eax, eax
jne 0x1003c4ad
push 0x1009e698
call fcn.10006d90
add esp, 4
test eax, eax
jne 0x1003c4ad
push 0x1009e688
call fcn.10006d90
add esp, 4
test eax, eax
jne 0x1003c4ad
push 0x1009e668
call fcn.10006d90
add esp, 4
test eax, eax
jne 0x1003c4ad
cmp dword [0x1012d3e4], ebx
jne 0x1003c4ad
cmp dword [0x34d2968], eax
jle 0x1003c4ad
call edi
sub eax, dword [0x101b8990]
cmp eax, 0x4e20
jb 0x1003c4b4
mov ecx, dword [0x2fb7ac4]
mov eax, dword [ecx + 0x297c]
push 0
cmp eax, 6
jne 0x1003c48a
push 0xf468e
call fcn.1003a280
add esp, 8
jmp 0x1003c4b4
cmp eax, 7
jne 0x1003c49e
push 0xf468d
call fcn.1003a280
add esp, 8
jmp 0x1003c4b4
push 0x92c0d
call fcn.1003a280
add esp, 8
jmp 0x1003c4b4
call edi
mov dword [0x101b8990], eax
cmp dword [0x10199428], ebx
pop edi
pop ebx
jne 0x1003c4cc
cmp dword [0x34da460], 0
jne 0x1003c4cc
jmp fcn.1003a470
ret
Function at 0x1003c3c7
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp dword [0x2fb7ac4], 0
je 0x1003c4cc
push ebx
mov ebx, 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x1019a27c], ebx
jne 0x1003c2e6
call edi
sub eax, dword [0x1011cd7c]
cmp eax, 0x7530
jbe 0x1003c2e6
call fcn.1003c0c0
cmp dword [0x10199550], ebx
jne 0x1003c324
cmp dword [0x1012d3e4], ebx
jne 0x1003c324
mov eax, dword [0x2fb7ac4]
cmp dword [eax + 0x2630], 0
jne 0x1003c311
cmp dword [0x1011cd68], 2
jne 0x1003c324
push 3
jmp 0x1003c31c
cmp dword [0x1011cd68], 2
je 0x1003c324
push 4
call fcn.1003bae0
add esp, 4
cmp dword [0x10192e88], ebx
jne case.default.0x1003c39c
call edi
sub eax, dword [0x1012d210]
cmp eax, 0xbb8
jb case.default.0x1003c39c
call edi
sub eax, dword [0x1012d238]
cmp eax, 0x7d0
jb case.default.0x1003c39c
mov eax, dword [0x10191a04]
cmp eax, ebx
jne 0x1003c379
cmp dword [0x1011cd68], 2
jne case.default.0x1003c39c
mov ecx, dword [0x2fb7ac4]
cmp dword [ecx + 0x297c], 0
je 0x1003c38b
jmp case.default.0x1003c39c
test eax, eax
jne case.default.0x1003c39c
mov edx, dword [0x2fb7ac4]
cmp dword [edx + 0x297c], eax
jne case.default.0x1003c39c
call edi
mov dword [0x1012d210], eax
mov eax, dword [0x10192fcc]
cmp eax, 4
ja case.default.0x1003c39c
jmp dword [eax*4 + 0x1003c4d0]
push 0
push 0x92c0d
jmp 0x1003c3ce
push 0
push 0x92c0e
jmp 0x1003c3ce
push 0
push 0x92c0f
jmp 0x1003c3ce
push 0
push 0xf468d
jmp 0x1003c3ce
push 0
push 0xf468e
call fcn.1003a280
add esp, 8
mov eax, dword [0x2fb7ac4]
cmp dword [eax + 0x297c], 0
jle 0x1003c4ad
push 0x1009e680
call fcn.10006d90
add esp, 4
test eax, eax
jne 0x1003c4ad
push 0x1009e678
call fcn.10006d90
add esp, 4
test eax, eax
jne 0x1003c4ad
push 0x1009e698
call fcn.10006d90
add esp, 4
test eax, eax
jne 0x1003c4ad
push 0x1009e688
call fcn.10006d90
add esp, 4
test eax, eax
jne 0x1003c4ad
push 0x1009e668
call fcn.10006d90
add esp, 4
test eax, eax
jne 0x1003c4ad
cmp dword [0x1012d3e4], ebx
jne 0x1003c4ad
cmp dword [0x34d2968], eax
jle 0x1003c4ad
call edi
sub eax, dword [0x101b8990]
cmp eax, 0x4e20
jb 0x1003c4b4
mov ecx, dword [0x2fb7ac4]
mov eax, dword [ecx + 0x297c]
push 0
cmp eax, 6
jne 0x1003c48a
push 0xf468e
call fcn.1003a280
add esp, 8
jmp 0x1003c4b4
cmp eax, 7
jne 0x1003c49e
push 0xf468d
call fcn.1003a280
add esp, 8
jmp 0x1003c4b4
push 0x92c0d
call fcn.1003a280
add esp, 8
jmp 0x1003c4b4
call edi
mov dword [0x101b8990], eax
cmp dword [0x10199428], ebx
pop edi
pop ebx
jne 0x1003c4cc
cmp dword [0x34da460], 0
jne 0x1003c4cc
jmp fcn.1003a470
ret
Function at 0x1003c6e0
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, 1
cmp dword [0x101961a8], ebx
jne 0x1003c71b
mov eax, dword [0x1012d384]
cmp eax, dword [0x101961b4]
jl 0x1003c71b
push 0x1009e774
call fcn.10008130
add esp, 4
mov dword [0x1011d17c], 0
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x101961ac], ebx
jne 0x1003c742
mov eax, dword [0x101961b8]
cdq
cmp dword [0x1012d2a4], edx
jl 0x1003c742
jg 0x1003c73b
cmp dword [0x1012d2a0], eax
jb 0x1003c742
push 0x1009e750
jmp 0x1003c704
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x101961a4], ebx
jne 0x1003c7a8
mov eax, dword [0xe77dfc]
cmp dword [eax + 0x30], 0xffffffff
je 0x1003c76b
cmp byte [0x1012d410], bl
jne 0x1003c782
push 0x1009e744
call fcn.10008130
mov ecx, dword [0x100fe7b4]
add esp, 4
push ebx
push ecx
call esi
call edi
sub eax, dword [0x1012d22c]
cmp eax, 0x1d4c0
jb 0x1003c7a8
push 0x1009e744
call fcn.10008130
mov edx, dword [0x100fe7b4]
add esp, 4
push ebx
push edx
call esi
cmp dword [0x101961a0], ebx
jne 0x1003c821
cmp byte [0x1012d3ff], bl
jne 0x1003c7cd
mov byte [0x1012d3ff], 0
call edi
pop edi
pop esi
mov dword [0x1011d204], eax
pop ebx
mov esp, ebp
pop ebp
ret
call edi
mov ecx, eax
sub ecx, dword [0x1011d204]
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov eax, 0x88888889
mul edx
shr edx, 5
mov dword [ebp - 4], edx
fild dword [ebp - 4]
test edx, edx
jns 0x1003c7fb
fadd dword [0x1009e740]
fild dword [0x101961b0]
fcompp
fnstsw ax
test ah, 0x41
jp 0x1003c821
push 0x1009e744
call fcn.10008130
mov edx, dword [0x100fe7b4]
add esp, 4
push ebx
push edx
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003f6f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x100ae8c8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1012d417], 0
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
jne 0x1003f8c6
push ebx
push eax
push 0xbb8
push esi
push 0x10092e4c
push str.qhlb
mov byte [0x1011b6a8], 0
push str.config
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebx, dword [sym.imp.MSVCR100.dll_strtok]
push 0x1009e968
push esi
call ebx
mov esi, eax
add esp, 8
mov dword [ebp - 0x198], esi
test esi, esi
je 0x1003f8c5
push edi
jmp 0x1003f768
mov esi, dword [ebp - 0x198]
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003f770
sub eax, edx
push 0x1009e9c8
push esi
mov dword [ebp - 0x19c], eax
xor edi, edi
call ebx
add esp, 8
test eax, eax
je 0x1003f8a1
lea esi, [ebp - 0x194]
lea ebx, [ebx]
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1003f7a4
push 0x1009e9c8
push 0
inc edi
add esi, 0x32
call ebx
add esp, 8
test eax, eax
jne 0x1003f7a0
cmp edi, 8
jne 0x1003f89b
movzx edx, byte [0x1011b6a8]
lea ecx, [ebp - 0x194]
lea edx, [edx*4 + 0x1011aed8]
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x1003f7e0
mov esi, dword [sym.imp.MSVCR100.dll_atoi]
lea eax, [ebp - 0x162]
push eax
call esi
movzx ecx, byte [0x1011b6a8]
lea edx, [ebp - 0x130]
push edx
mov byte [ecx + 0x1011b658], al
call esi
movzx ecx, byte [0x1011b6a8]
lea edx, [ebp - 0xfe]
push edx
mov byte [ecx + 0x1011afa0], al
call esi
movzx ecx, byte [0x1011b6a8]
lea edx, [ebp - 0xcc]
push edx
mov byte [ecx + 0x1011af78], al
call esi
movzx ecx, byte [0x1011b6a8]
lea edx, [ebp - 0x9a]
push edx
mov byte [ecx + 0x1011aff0], al
call esi
movzx ecx, byte [0x1011b6a8]
mov byte [ecx + 0x1011afc8], al
movzx eax, byte [0x1011b6a8]
lea edx, [eax + eax*4]
add esp, 0x14
lea ecx, [ebp - 0x68]
lea edx, [edx*4 + 0x1011b018]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x1003f875
lea edx, [ebp - 0x36]
push edx
call esi
movzx ecx, byte [0x1011b6a8]
add esp, 4
mov byte [ecx + 0x1011b680], al
inc byte [0x1011b6a8]
mov esi, dword [ebp - 0x198]
mov edx, dword [ebp - 0x19c]
lea eax, [edx + esi + 1]
push 0x1009e968
push eax
call ebx
add esp, 8
mov dword [ebp - 0x198], eax
test eax, eax
jne 0x1003f762
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100867e6
mov esp, ebp
pop ebp
ret
Function at 0x1003f8e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x100ae8c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
mov ecx, 0x1019fdd4
call section..text
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push edi
push 0xbb8
push esi
push 0x10092e4c
push str.ZYWP
push str.config
mov byte [esi], 0
call ebx
push 0x1009e968
push esi
mov esi, dword [sym.imp.MSVCR100.dll_strtok]
call esi
add esp, 8
test eax, eax
je 0x1003f96b
lea esp, [esp]
push eax
mov ecx, 0x1019fdd4
call fcn.10001100
push 0x1009e968
push 0
call esi
add esp, 8
test eax, eax
jne 0x1003f950
push edi
push 0x64
lea ecx, [ebp - 0x68]
push ecx
push 0x10094b88
push str.D38CHECK1
push str.config
call ebx
mov esi, dword [sym.imp.MSVCR100.dll_atoi]
lea edx, [ebp - 0x68]
push edx
call esi
add esp, 4
push edi
push 0x64
mov dword [0x1019cd08], eax
lea eax, [ebp - 0x68]
push eax
push 0x10094b88
push str.D38CHECK3
push str.config
call ebx
lea ecx, [ebp - 0x68]
push ecx
call esi
add esp, 4
push edi
push 0x64
lea edx, [ebp - 0x68]
push edx
push 0x10094b88
push str.D38EDIT2
push str.config
mov dword [0x1019cd0c], eax
call ebx
lea eax, [ebp - 0x68]
push eax
call esi
add esp, 4
push edi
push 0x64
lea ecx, [ebp - 0x68]
push ecx
push 0x10094b88
push str.D38EDIT3
push str.config
mov dword [0x1019cd04], eax
call ebx
lea edx, [ebp - 0x68]
push edx
call dword [sym.imp.MSVCR100.dll__atoi64]
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
xor ecx, ebp
mov dword [0x1019cd10], eax
mov dword [0x1019cd14], edx
pop ebx
call fcn.100867e6
mov esp, ebp
pop ebp
ret
Function at 0x1003fd00
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x100ae8c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call sub.MSVCR100.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 0xc
push esi
push 0x64
lea ecx, [ebp - 0x68]
push ecx
push 0x10094b88
push str.D7CHECK1
push str.config
call edi
mov ebx, dword [sym.imp.MSVCR100.dll_atoi]
lea edx, [ebp - 0x68]
push edx
call ebx
add esp, 4
push esi
push 0x64
mov dword [0x101956bc], eax
lea eax, [ebp - 0x68]
push eax
push 0x10094b88
push str.D7CHECK2
push str.config
call edi
lea ecx, [ebp - 0x68]
push ecx
call ebx
add esp, 4
push esi
push 0x64
lea edx, [ebp - 0x68]
push edx
push 0x10094b88
push str.D7CHECK3
push str.config
mov dword [0x101956c0], eax
call edi
lea eax, [ebp - 0x68]
push eax
call ebx
add esp, 4
push esi
push 0x64
lea ecx, [ebp - 0x68]
push ecx
push 0x10094b88
push str.D7CHECK4
push str.config
mov dword [0x101956c4], eax
call edi
lea edx, [ebp - 0x68]
push edx
call ebx
add esp, 4
push esi
push 0x64
mov dword [0x101956d0], eax
lea eax, [ebp - 0x68]
push eax
push 0x10094b88
push str.D7CHECK5
push str.config
call edi
lea ecx, [ebp - 0x68]
push ecx
call ebx
add esp, 4
push esi
push 0x64
lea edx, [ebp - 0x68]
mov dword [0x101956dc], eax
push edx
push 0x10094b88
push str.D7CHECK6
push str.config
call edi
lea eax, [ebp - 0x68]
push eax
call ebx
add esp, 4
push esi
push 0x64
lea ecx, [ebp - 0x68]
push ecx
push 0x10094b88
push str.D7EDIT1
push str.config
mov dword [0x1019588c], eax
call edi
lea edx, [ebp - 0x68]
push edx
call ebx
add esp, 4
push esi
push 0x64
mov dword [0x101956c8], eax
lea eax, [ebp - 0x68]
push eax
push 0x10094b88
push str.D7EDIT2
push str.config
call edi
lea ecx, [ebp - 0x68]
push ecx
call ebx
add esp, 4
push esi
push 0x64
lea edx, [ebp - 0x68]
push edx
push 0x10094b88
push str.D7EDIT3
push str.config
mov dword [0x101956cc], eax
call edi
lea eax, [ebp - 0x68]
push eax
call ebx
add esp, 4
push esi
push 0x64
lea ecx, [ebp - 0x68]
push ecx
push 0x10094b88
push str.D7EDIT4
push str.config
mov dword [0x101956d4], eax
call edi
lea edx, [ebp - 0x68]
push edx
mov ecx, 0x101956e0
call sub.mfc100.dll_Ordinal_12868
push esi
push 0x64
lea eax, [ebp - 0x68]
push eax
push 0x10094b88
push str.D7COMBO1
push str.config
call edi
lea ecx, [ebp - 0x68]
push ecx
call ebx
add esp, 4
push esi
push 0x64
lea edx, [ebp - 0x68]
push edx
push 0x10094b88
push str.D7COMBO2
push str.config
mov dword [0x101956d8], eax
call edi
lea eax, [ebp - 0x68]
push eax
mov ecx, 0x10195890
call sub.mfc100.dll_Ordinal_12868
push 0
mov ecx, 0x10195628
call sub.mfc100.dll_Ordinal_13219
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100867e6
mov esp, ebp
pop ebp
ret
Function at 0x1003ff20
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x100ae8c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call sub.MSVCR100.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 0xc
push esi
push 0x64
lea ecx, [ebp - 0x68]
push ecx
push 0x10094b88
push str.D13CHECK1
push str.config
call edi
mov ebx, dword [sym.imp.MSVCR100.dll_atoi]
lea edx, [ebp - 0x68]
push edx
call ebx
add esp, 4
push esi
push 0x64
mov dword [0x10199550], eax
lea eax, [ebp - 0x68]
push eax
push 0x10094b88
push str.D13CHECK3
push str.config
call edi
lea ecx, [ebp - 0x68]
push ecx
call ebx
add esp, 4
push esi
push 0x64
lea edx, [ebp - 0x68]
push edx
push 0x10094b88
push str.D13CHECK4
push str.config
mov dword [0x10199424], eax
call edi
lea eax, [ebp - 0x68]
push eax
call ebx
add esp, 4
push esi
push 0x64
lea ecx, [ebp - 0x68]
push ecx
push 0x10094b88
push str.D13COMBO3
push str.config
mov dword [0x10199428], eax
call edi
lea edx, [ebp - 0x68]
push edx
call ebx
add esp, 4
push 0
mov ecx, 0x10199390
mov dword [0x1019954c], eax
call sub.mfc100.dll_Ordinal_13219
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100867e6
mov esp, ebp
pop ebp
ret
Function at 0x100461d0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x100ae8c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.1006efb0
push 0x32
lea eax, [ebp - 0x38]
push eax
mov ecx, 0x10194088
call sub.mfc100.dll_Ordinal_6969
push 0x32
lea ecx, [ebp - 0x6c]
push ecx
mov ecx, 0x10194134
call sub.mfc100.dll_Ordinal_6969
lea edx, [ebp - 0x38]
push edx
push 0x1009edd0
push 0x1012d4d8
call dword [sym.imp.MSVCR100.dll_sprintf]
mov edi, 1
add esp, 0xc
cmp dword [0x101971b0], edi
jne 0x10046237
lea eax, [ebp - 0x38]
push eax
jmp 0x10046330
push 0x1012d4d8
call fcn.10006d10
add esp, 4
test eax, eax
je 0x10046258
push edi
push 0x1012d4d8
call fcn.10006a90
jmp 0x1004633b
mov ecx, 0x1009edc8
lea eax, [ebp - 0x6c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10046280
test dl, dl
je 0x1004627c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10046280
add eax, 2
add ecx, 2
test dl, dl
jne 0x10046260
xor eax, eax
jmp 0x10046285
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1004631a
mov esi, dword [0x2f99460]
push ebx
xor ebx, ebx
xor edi, edi
call fcn.10006a60
test eax, eax
je 0x100462ef
add esi, 0x53c
mov eax, dword [esi]
test eax, eax
je 0x100462de
lea ecx, [eax + 0x64]
mov eax, 0x1009d684
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100462d5
test dl, dl
je 0x100462d1
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100462d5
add eax, 2
add ecx, 2
test dl, dl
jne 0x100462b5
xor eax, eax
jmp 0x100462da
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100462ed
inc edi
add esi, 4
call fcn.10006a60
cmp edi, eax
jb 0x100462a7
jmp 0x100462ef
mov ebx, edi
mov ecx, dword [0x10194154]
push ebx
push 0
push 0
push 0x147
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
add eax, 9
push eax
call fcn.10039bf0
add esp, 8
mov edi, 1
pop ebx
jmp 0x1004633e
push edi
push 0x100943ec
call fcn.10006a90
add esp, 8
test al, al
jne 0x1004633e
lea edx, [ebp - 0x38]
push edx
call fcn.100079a0
push eax
call fcn.1003b150
add esp, 8
cmp dword [0x10190e2c], edi
jne 0x100463d3
lea eax, [ebp - 0x110]
push eax
mov dword [ebp - 0x110], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov esi, 2
cmp dword [ebp - 0x100], esi
jne 0x100463c9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x114]
push ecx
push 0x20
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea edx, [ebp - 0x11c]
push edx
push str.SeShutdownPrivilege
push 0
mov dword [ebp - 0x7c], edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x118]
push 0
push 0
push 0
lea edx, [ebp - 0x7c]
push edx
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x114]
push 0
push eax
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], esi
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 8
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100867e6
mov esp, ebp
pop ebp
ret