joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10063f00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b2ca8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x100f101c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
push ecx
lea ecx, [ebp - 0x28]
call fcn.10006740
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.10009010
add esp, 4
lea ecx, [ebp - 0x28]
call fcn.10004040
lea ecx, [ebp - 0x28]
cmp eax, 2
jbe 0x1006402d
call fcn.100039b0
mov esi, eax
mov ecx, esi
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x10063f70
mov ecx, dword [esi]
cmp word [ecx], 0x5c
jne 0x10063f8a
mov ecx, esi
cmp eax, 8
jb 0x10063f7f
mov ecx, dword [esi]
cmp word [ecx + 2], 0x5c
je 0x100640a8
mov ecx, esi
cmp eax, 8
jb 0x10063f93
mov ecx, dword [esi]
cmp word [ecx], 0x2f
jne 0x10063fa9
mov ecx, esi
cmp eax, 8
jb 0x10063fa2
mov ecx, dword [esi]
cmp word [ecx + 2], 0x2f
je 0x10063ffe
push 0x5c
mov edx, 0x2f
lea ecx, [ebp - 0x28]
call fcn.10008e90
mov eax, dword [esi + 0x14]
add esp, 4
mov ecx, esi
cmp eax, 8
jb 0x10063fc7
mov ecx, dword [esi]
cmp word [ecx + 2], 0x3a
jne 0x10063ffe
mov ecx, esi
cmp eax, 8
jb 0x10063fd7
mov ecx, dword [esi]
cmp word [ecx + 4], 0x5c
jne 0x10063ffe
mov ecx, esi
cmp eax, 8
jb 0x10063fe7
mov ecx, dword [esi]
cmp word [ecx], 0x61
jb 0x10063ffe
cmp eax, 8
jb 0x10063ff4
mov esi, dword [esi]
cmp word [esi], 0x7a
jbe 0x10064089
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.100038a0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007f947
mov esp, ebp
pop ebp
ret
call fcn.10004040
cmp eax, 2
jne 0x10063ffe
lea ecx, [ebp - 0x28]
call fcn.100039b0
mov edx, eax
mov ecx, dword [eax + 0x14]
cmp ecx, 8
jb 0x1006404b
mov edx, dword [eax]
cmp word [edx + 2], 0x3a
jne 0x10063ffe
mov edx, eax
cmp ecx, 8
jb 0x1006405b
mov edx, dword [eax]
cmp word [edx], 0x61
jb 0x10063ffe
cmp ecx, 8
jb 0x10064068
mov eax, dword [eax]
cmp word [eax], 0x7a
ja 0x10063ffe
push 0x100d588c
call fcn.10003bb0
add esp, 4
lea ecx, [ebp - 0x28]
push eax
push 0x100d588c
call fcn.100040e0
lea ecx, [ebp - 0x28]
call fcn.10003830
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10063ffe
shr eax, 4
and al, 1
mov byte [edi], al
mov bl, 1
jmp 0x10064000
Function at 0x1006b680
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x1006b68b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.1006b6a0
Function at 0x1006bc00
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x63c]
sub esp, 0x63c
push 0xffffffffffffffff
push 0x100bdb90
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x100f101c]
xor eax, ebp
mov dword [ebp + 0x638], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0x644]
lea ecx, [ebp]
mov ebx, dword [ebp + 0x648]
call fcn.10003990
mov dword [ebp - 4], 0
mov eax, dword [0x100f3bf0]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x10], 0x100f3bf0
test eax, eax
je 0x1006bc72
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 1
mov ecx, 0x100f3bd8
call fcn.10004040
test eax, eax
je 0x1006bcb9
push 0x100f3bd8
call fcn.10003ec0
lea ecx, [ebp]
add esp, 4
cmp ecx, eax
je 0x1006bd6e
mov ecx, 0x100f3bd8
call fcn.100039b0
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x1006bcb0
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
jmp 0x1006bd66
push 0x20c
lea eax, [ebp + 0x42c]
push 0
push eax
call fcn.10081e90
add esp, 0xc
lea eax, [ebp + 0x42c]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x1006be0a
xor eax, eax
push 0x412
push eax
mov word [ebp + 0x636], ax
lea eax, [ebp + 0x18]
push eax
call fcn.10081e90
add esp, 0xc
lea eax, [ebp + 0x18]
push 0x208
push eax
lea eax, [ebp + 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x1006bd4f
test eax, eax
je 0x1006bd4f
add eax, eax
cmp eax, 0x412
jae 0x1006be5d
xor ecx, ecx
mov word [ebp + eax + 0x18], cx
lea eax, [ebp + 0x18]
push eax
call fcn.10003bb0
add esp, 4
push eax
lea eax, [ebp + 0x18]
jmp 0x1006bd65
lea eax, [ebp + 0x42c]
push eax
call fcn.10003bb0
add esp, 4
push eax
lea eax, [ebp + 0x42c]
push eax
lea ecx, [ebp]
call fcn.100039c0
mov byte [ebp - 4], 0
mov eax, dword [0x100f3bf0]
test eax, eax
je 0x1006bd82
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebx
push edi
lea eax, [ebp]
mov dword [ebp - 0x10], 0
push eax
mov ecx, esi
call fcn.1006bb90
test al, al
je 0x1006bda1
mov bl, 1
jmp 0x1006be27
push 0x20c
lea eax, [ebp + 0x42c]
push 0
push eax
call fcn.10081e90
add esp, 0xc
lea eax, [ebp + 0x42c]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x103
ja 0x1006be25
xor eax, eax
mov word [ebp + 0x636], ax
lea eax, [ebp + 0x42c]
push eax
call fcn.10003bb0
add esp, 4
lea ecx, [ebp]
push eax
lea eax, [ebp + 0x42c]
push eax
call fcn.100039c0
push ebx
push edi
lea eax, [ebp]
mov ecx, esi
push eax
call fcn.1006bb90
mov bl, al
jmp 0x1006be27
mov byte [ebp - 4], 0
mov eax, dword [0x100f3bf0]
test eax, eax
je 0x1006be1e
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x10], 0
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.100038a0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x638]
xor ecx, ebp
call fcn.1007f947
lea esp, [ebp + 0x63c]
pop ebp
ret 8
call fcn.10080162
int3
Function at 0x1006cb50
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bdd1f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100f101c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [edi + 4]
push eax
lea ecx, [eax + 0x94]
call fcn.1006d2f0
mov esi, dword [edi + 4]
add esp, 4
sub esi, 0x94
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.100038a0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.100038a0
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.100038a0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.100038a0
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.100038a0
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.100038a0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add dword [edi + 4], 0xffffff6c
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x1006d8a0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bdf0f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100f101c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.100038a0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.100038a0
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.100038a0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.100038a0
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.100038a0
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.100038a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1006ef60
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100be10f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100f101c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.100040a0
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.100040a0
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.100040a0
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.100040a0
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.100040a0
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.100040a0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10070100
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push ebx
push ebp
mov ebx, ecx
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
lea ecx, [eax - 1]
push esi
mov ebp, ecx
mov dword [esp + 0x14], ecx
push edi
mov edi, edx
sar ebp, 1
mov dword [esp + 0x14], edi
mov esi, edi
cmp edi, ebp
jge 0x10070173
add esi, esi
lea eax, [esi + 2]
lea eax, [eax + eax*2]
lea ecx, [ebx + eax*8]
lea eax, [ecx - 0x18]
push eax
push ecx
call fcn.10020e70
movzx eax, al
xor eax, 1
inc eax
add esi, eax
lea eax, [esi + esi*2]
lea eax, [ebx + eax*8]
push eax
call fcn.10003ec0
add esp, 0xc
push eax
lea eax, [edi + edi*2]
lea ecx, [ebx + eax*8]
call fcn.10003900
mov edi, esi
cmp esi, ebp
jl 0x10070130
mov eax, dword [esp + 0x10]
cmp esi, ebp
jne 0x1007019d
test al, 1
jne 0x1007019d
lea eax, [eax + eax*2]
lea eax, [eax - 3]
lea eax, [ebx + eax*8]
push eax
call fcn.10003ec0
add esp, 4
push eax
lea eax, [edi + edi*2]
lea ecx, [ebx + eax*8]
call fcn.10003900
mov edi, dword [esp + 0x18]
push dword [esp + 0x1c]
call fcn.10003ec0
add esp, 4
mov ecx, eax
mov dword [esp + 0x10], ecx
cmp dword [esp + 0x14], edi
jge 0x100701f3
lea esi, [edi - 1]
sar esi, 1
push ecx
lea eax, [esi + esi*2]
lea ebp, [ebx + eax*8]
push ebp
call fcn.10020e70
add esp, 8
test al, al
je 0x100701ef
push ebp
call fcn.10003ec0
add esp, 4
push eax
lea eax, [edi + edi*2]
lea ecx, [ebx + eax*8]
call fcn.10003900
mov edi, esi
mov ecx, dword [esp + 0x10]
cmp dword [esp + 0x14], esi
jl 0x100701b5
mov ecx, dword [esp + 0x10]
push ecx
call fcn.10003ec0
add esp, 4
push eax
lea eax, [edi + edi*2]
lea ecx, [ebx + eax*8]
call fcn.10003900
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x100721e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x100f101c]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x10072262
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x10072262
test ecx, ecx
je 0x1007225e
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x10072220
xor eax, eax
jmp 0x10072267
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x10072271
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1007f947
add esp, 0xc
ret 0xc

Function at 0x10072d00
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x100f101c]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, dword [esp + 0x10]
push edi
mov dword [esi], 0
mov dword [esi + 4], 0
mov eax, dword [ecx + 0x10]
cmp eax, 0xffffffff
je 0x10072d73
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10072d4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10072d73
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, edi
pop edi
adc eax, 0
mov dword [esi], ecx
mov dword [esi + 4], eax
xor eax, eax
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.1007f947
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.1007f947
add esp, 8
ret 4

Function at 0x10073100
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x100f101c]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, dword [esp + 0x10]
push edi
mov dword [esi], 0
mov dword [esi + 4], 0
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x10073173
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1007314e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10073173
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, edi
pop edi
adc eax, 0
mov dword [esi], ecx
mov dword [esi + 4], eax
xor eax, eax
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.1007f947
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.1007f947
add esp, 8
ret 4
Function at 0x10076700
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bdd1f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100f101c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push edx
push 0x94
call fcn.10002170
mov esi, dword [ebp + 8]
add esp, 8
mov edi, eax
mov ecx, eax
mov dword [ebp - 0x10], edi
push esi
call fcn.10006740
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
push ecx
lea ecx, [edi + 0x18]
call fcn.10006740
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.10006740
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.10006740
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.10006740
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.10006740
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10079520
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x100f101c]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x10079585
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10079560
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10079585
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.1007f947
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.1007f947
add esp, 8
ret 4
Function at 0x100796c0
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bf738
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x100f101c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
test ecx, ecx
je 0x10079709
mov dword [ecx], 0
mov dword [eax], 0
cmp dword [edi], 0xffffffff
je 0x1007985b
mov eax, dword [ebp + 0xc]
mov ecx, 0x100000
push 0
mov ebx, eax
mov dword [ebp - 0x1c], 0
cmp eax, 0x100000
lea eax, [ebp - 0x1c]
push eax
cmova ebx, ecx
push ebx
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x1c], 0
je 0x10079826
test eax, eax
je 0x10079826
mov edx, dword [ebp - 0x1c]
cmp edx, ebx
jae 0x10079829
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi]
mov dword [ebp - 0x24], eax
cmp ecx, 0xffffffff
je 0x100797ab
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1007979f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100797ab
mov eax, dword [ebp - 0x14]
xor ecx, ecx
add ecx, esi
adc eax, 0
jmp 0x100797b9
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
push 0
push dword [ebp - 0x24]
push eax
push ecx
sub esp, 0x18
lea eax, [edi + 4]
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.10006740
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x18]
mov esi, dword [ebp - 0x20]
test eax, eax
jne 0x10079826
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push ebx
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
xor edx, edx
test ecx, ecx
mov eax, 0x80004005
cmovne eax, edx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
test ecx, ecx
je 0x10079764
jmp 0x10079829
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
add dword [ecx], edx
test eax, eax
jne 0x10079852
test edx, edx
je 0x1007984e
mov eax, dword [ebp + 0xc]
add esi, edx
sub eax, edx
mov dword [ebp - 0x20], esi
mov dword [ebp + 0xc], eax
mov ecx, 0x100000
jne 0x10079720
mov al, 1
jmp 0x1007985d
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x1007985b
mov dword [ecx], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007f947
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1007b290
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bf921
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x100f101c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x234]
call fcn.10003990
mov dword [ebp - 4], 0
push 4
lea ecx, [ebp - 0x21c]
call fcn.10004900
lea ecx, [ebp - 0x21c]
call fcn.1000ae20
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x21c]
call fcn.1000b720
lea eax, [ebp - 0x234]
push eax
call fcn.1002a4f0
add esp, 4
mov byte [ebp - 0x235], al
lea ecx, [ebp - 0x21c]
call fcn.1000ba20
movzx ecx, byte [ebp - 0x235]
test ecx, ecx
jne 0x1007b352
mov byte [ebp - 0x236], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call fcn.1000aea0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.100038a0
mov al, byte [ebp - 0x236]
jmp 0x1007b4cd
push 0x100c241c
lea ecx, [ebp - 0x258]
call fcn.10003940
mov byte [ebp - 4], 2
lea edx, [ebp - 0x258]
push edx
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x270]
push ecx
call fcn.10008000
add esp, 0xc
mov dword [ebp - 0x23c], eax
mov edx, dword [ebp - 0x23c]
push edx
lea ecx, [ebp - 0x234]
call fcn.10003900
lea ecx, [ebp - 0x270]
call fcn.100038a0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x258]
call fcn.100038a0
lea eax, [ebp - 0x234]
push eax
call fcn.10006900
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x1007b3da
lea edx, [ebp - 0x234]
push edx
call fcn.1000dc60
add esp, 4
push 0x100f27d0
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x288]
push ecx
call fcn.10008000
add esp, 0xc
mov dword [ebp - 0x240], eax
mov edx, dword [ebp - 0x240]
push edx
lea ecx, [ebp - 0x234]
call fcn.10003900
lea ecx, [ebp - 0x288]
call fcn.100038a0
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.10081e90
add esp, 0xc
lea ecx, [ebp - 0x234]
call fcn.10003830
push eax
push 0x104
lea ecx, [ebp - 0x218]
push ecx
mov ecx, 0x100f27e8
call fcn.10003830
push eax
mov ecx, 0x100f2800
call fcn.10003830
push eax
mov ecx, 0x100f2818
call fcn.10003830
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edx, 2
imul eax, edx, 0
movzx ecx, word [ebp + eax - 0x218]
test ecx, ecx
jne 0x1007b490
push 0x100f27e8
mov ecx, dword [ebp + 8]
call fcn.10003870
jmp 0x1007b49f
lea edx, [ebp - 0x218]
push edx
mov ecx, dword [ebp + 8]
call fcn.10003840
mov byte [ebp - 0x237], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call fcn.1000aea0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.100038a0
mov al, byte [ebp - 0x237]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007f947
mov esp, ebp
pop ebp
ret
Function at 0x1007b4f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bf987
mov eax, dword fs:[0]
push eax
sub esp, 0x2ac
mov eax, dword [0x100f101c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x234]
call fcn.10003990
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24c]
call fcn.10003990
mov byte [ebp - 4], 1
push 4
lea ecx, [ebp - 0x21c]
call fcn.10004900
lea ecx, [ebp - 0x21c]
call fcn.1000ae20
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x21c]
call fcn.1000b720
lea eax, [ebp - 0x234]
push eax
call fcn.1002a4f0
add esp, 4
mov byte [ebp - 0x24d], al
lea ecx, [ebp - 0x21c]
call fcn.1000ba20
movzx ecx, byte [ebp - 0x24d]
test ecx, ecx
jne 0x1007b5d0
mov byte [ebp - 0x24e], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x21c]
call fcn.1000aea0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24c]
call fcn.100038a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.100038a0
mov al, byte [ebp - 0x24e]
jmp 0x1007b79d
push str.hotspotesswPrefs
lea ecx, [ebp - 0x270]
call fcn.10003940
mov byte [ebp - 4], 3
lea edx, [ebp - 0x270]
push edx
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x2a0]
push ecx
call fcn.10008000
add esp, 0xc
mov dword [ebp - 0x254], eax
mov edx, dword [ebp - 0x254]
push edx
lea ecx, [ebp - 0x234]
call fcn.10003900
lea ecx, [ebp - 0x2a0]
call fcn.100038a0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x270]
call fcn.100038a0
lea eax, [ebp - 0x234]
push eax
call fcn.10006900
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x1007b658
lea edx, [ebp - 0x234]
push edx
call fcn.1000dc60
add esp, 4
push 0x100f27d0
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x2b8]
push ecx
call fcn.10008000
add esp, 0xc
mov dword [ebp - 0x258], eax
mov edx, dword [ebp - 0x258]
push edx
lea ecx, [ebp - 0x234]
call fcn.10003900
lea ecx, [ebp - 0x2b8]
call fcn.100038a0
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.10081e90
add esp, 0xc
lea ecx, [ebp - 0x234]
call fcn.10003830
push eax
push 0x104
lea ecx, [ebp - 0x218]
push ecx
mov ecx, 0x100f27e8
call fcn.10003830
push eax
mov ecx, 0x100f2800
call fcn.10003830
push eax
mov ecx, 0x100f2818
call fcn.10003830
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edx, 2
imul eax, edx, 0
movzx ecx, word [ebp + eax - 0x218]
test ecx, ecx
jne 0x1007b711
push 0x100f27e8
lea ecx, [ebp - 0x24c]
call fcn.10003870
jmp 0x1007b723
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x24c]
call fcn.10003840
push 0x100c246c
lea ecx, [ebp - 0x288]
call fcn.10003940
mov byte [ebp - 4], 4
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x288]
push ecx
lea edx, [ebp - 0x24c]
push edx
call fcn.1007b190
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x288]
call fcn.100038a0
mov byte [ebp - 0x24f], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x21c]
call fcn.1000aea0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24c]
call fcn.100038a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.100038a0
mov al, byte [ebp - 0x24f]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007f947
mov esp, ebp
pop ebp
ret