joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10074640
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c6c6f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100fc03c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [edi + 4]
push eax
lea ecx, [eax + 0x94]
call fcn.10074de0
mov esi, dword [edi + 4]
add esp, 4
sub esi, 0x94
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.10002d10
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.10002d10
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.10002d10
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.10002d10
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.10002d10
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10002d10
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add dword [edi + 4], 0xffffff6c
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x10075390
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c6e5f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100fc03c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.10002d10
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.10002d10
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.10002d10
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.10002d10
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.10002d10
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10002d10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10076a50
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c705f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100fc03c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.10003520
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.10003520
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.10003520
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.10003520
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.10003520
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.10003520
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10077bf0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push ebx
push ebp
mov ebx, ecx
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
lea ecx, [eax - 1]
push esi
mov ebp, ecx
mov dword [esp + 0x14], ecx
push edi
mov edi, edx
sar ebp, 1
mov dword [esp + 0x14], edi
mov esi, edi
cmp edi, ebp
jge 0x10077c63
add esi, esi
lea eax, [esi + 2]
lea eax, [eax + eax*2]
lea ecx, [ebx + eax*8]
lea eax, [ecx - 0x18]
push eax
push ecx
call fcn.1002f4a0
movzx eax, al
xor eax, 1
inc eax
add esi, eax
lea eax, [esi + esi*2]
lea eax, [ebx + eax*8]
push eax
call fcn.10003210
add esp, 0xc
push eax
lea eax, [edi + edi*2]
lea ecx, [ebx + eax*8]
call fcn.10005ef0
mov edi, esi
cmp esi, ebp
jl 0x10077c20
mov eax, dword [esp + 0x10]
cmp esi, ebp
jne 0x10077c8d
test al, 1
jne 0x10077c8d
lea eax, [eax + eax*2]
lea eax, [eax - 3]
lea eax, [ebx + eax*8]
push eax
call fcn.10003210
add esp, 4
push eax
lea eax, [edi + edi*2]
lea ecx, [ebx + eax*8]
call fcn.10005ef0
mov edi, dword [esp + 0x18]
push dword [esp + 0x1c]
call fcn.10003210
add esp, 4
mov ecx, eax
mov dword [esp + 0x10], ecx
cmp dword [esp + 0x14], edi
jge 0x10077ce3
lea esi, [edi - 1]
sar esi, 1
push ecx
lea eax, [esi + esi*2]
lea ebp, [ebx + eax*8]
push ebp
call fcn.1002f4a0
add esp, 8
test al, al
je 0x10077cdf
push ebp
call fcn.10003210
add esp, 4
push eax
lea eax, [edi + edi*2]
lea ecx, [ebx + eax*8]
call fcn.10005ef0
mov edi, esi
mov ecx, dword [esp + 0x10]
cmp dword [esp + 0x14], esi
jl 0x10077ca5
mov ecx, dword [esp + 0x10]
push ecx
call fcn.10003210
add esp, 4
push eax
lea eax, [edi + edi*2]
lea ecx, [ebx + eax*8]
call fcn.10005ef0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x1007a0e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x100fc03c]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x1007a162
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x1007a162
test ecx, ecx
je 0x1007a15e
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x1007a120
xor eax, eax
jmp 0x1007a167
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x1007a171
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10088f98
add esp, 0xc
ret 0xc

Function at 0x1007ac00
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x100fc03c]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, dword [esp + 0x10]
push edi
mov dword [esi], 0
mov dword [esi + 4], 0
mov eax, dword [ecx + 0x10]
cmp eax, 0xffffffff
je 0x1007ac73
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1007ac4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1007ac73
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, edi
pop edi
adc eax, 0
mov dword [esi], ecx
mov dword [esi + 4], eax
xor eax, eax
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.10088f98
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.10088f98
add esp, 8
ret 4

Function at 0x1007b000
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x100fc03c]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, dword [esp + 0x10]
push edi
mov dword [esi], 0
mov dword [esi + 4], 0
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x1007b073
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1007b04e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1007b073
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, edi
pop edi
adc eax, 0
mov dword [esi], ecx
mov dword [esi + 4], eax
xor eax, eax
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.10088f98
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.10088f98
add esp, 8
ret 4
Function at 0x1007e640
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c6c6f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100fc03c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push edx
push 0x94
call fcn.10002190
mov esi, dword [ebp + 8]
add esp, 8
mov edi, eax
mov ecx, eax
mov dword [ebp - 0x10], edi
push esi
call fcn.10002dc0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
push ecx
lea ecx, [edi + 0x18]
call fcn.10002dc0
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.10002dc0
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.10002dc0
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.10002dc0
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.10002dc0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10081470
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x100fc03c]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x100814d5
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100814b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100814d5
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.10088f98
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.10088f98
add esp, 8
ret 4
Function at 0x10081610
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c8688
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x100fc03c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
test ecx, ecx
je 0x10081659
mov dword [ecx], 0
mov dword [eax], 0
cmp dword [edi], 0xffffffff
je 0x100817ab
mov eax, dword [ebp + 0xc]
mov ecx, 0x100000
push 0
mov ebx, eax
mov dword [ebp - 0x1c], 0
cmp eax, 0x100000
lea eax, [ebp - 0x1c]
push eax
cmova ebx, ecx
push ebx
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x1c], 0
je 0x10081776
test eax, eax
je 0x10081776
mov edx, dword [ebp - 0x1c]
cmp edx, ebx
jae 0x10081779
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi]
mov dword [ebp - 0x24], eax
cmp ecx, 0xffffffff
je 0x100816fb
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100816ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100816fb
mov eax, dword [ebp - 0x14]
xor ecx, ecx
add ecx, esi
adc eax, 0
jmp 0x10081709
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
push 0
push dword [ebp - 0x24]
push eax
push ecx
sub esp, 0x18
lea eax, [edi + 4]
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.10002dc0
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x18]
mov esi, dword [ebp - 0x20]
test eax, eax
jne 0x10081776
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push ebx
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
xor edx, edx
test ecx, ecx
mov eax, 0x80004005
cmovne eax, edx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
test ecx, ecx
je 0x100816b4
jmp 0x10081779
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
add dword [ecx], edx
test eax, eax
jne 0x100817a2
test edx, edx
je 0x1008179e
mov eax, dword [ebp + 0xc]
add esi, edx
sub eax, edx
mov dword [ebp - 0x20], esi
mov dword [ebp + 0xc], eax
mov ecx, 0x100000
jne 0x10081670
mov al, 1
jmp 0x100817ad
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x100817ab
mov dword [ecx], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10088f98
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100831f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c8871
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x100fc03c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x234]
call fcn.10003560
mov dword [ebp - 4], 0
push 4
lea ecx, [ebp - 0x21c]
call fcn.10006360
lea ecx, [ebp - 0x21c]
call fcn.100061a0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x21c]
call fcn.10006ac0
lea eax, [ebp - 0x234]
push eax
call fcn.1003b460
add esp, 4
mov byte [ebp - 0x235], al
lea ecx, [ebp - 0x21c]
call fcn.10006dc0
movzx ecx, byte [ebp - 0x235]
test ecx, ecx
jne 0x100832b2
mov byte [ebp - 0x236], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call fcn.10006220
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.10002d10
mov al, byte [ebp - 0x236]
jmp 0x1008342d
push 0x100cb45c
lea ecx, [ebp - 0x258]
call fcn.10002d70
mov byte [ebp - 4], 2
lea edx, [ebp - 0x258]
push edx
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x270]
push ecx
call fcn.1000d5d0
add esp, 0xc
mov dword [ebp - 0x23c], eax
mov edx, dword [ebp - 0x23c]
push edx
lea ecx, [ebp - 0x234]
call fcn.10005ef0
lea ecx, [ebp - 0x270]
call fcn.10002d10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x258]
call fcn.10002d10
lea eax, [ebp - 0x234]
push eax
call fcn.1000bf00
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x1008333a
lea edx, [ebp - 0x234]
push edx
call fcn.10017190
add esp, 4
push 0x100fd830
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x288]
push ecx
call fcn.1000d5d0
add esp, 0xc
mov dword [ebp - 0x240], eax
mov edx, dword [ebp - 0x240]
push edx
lea ecx, [ebp - 0x234]
call fcn.10005ef0
lea ecx, [ebp - 0x288]
call fcn.10002d10
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.1008bb90
add esp, 0xc
lea ecx, [ebp - 0x234]
call fcn.10002cb0
push eax
push 0x104
lea ecx, [ebp - 0x218]
push ecx
mov ecx, 0x100fd848
call fcn.10002cb0
push eax
mov ecx, 0x100fd860
call fcn.10002cb0
push eax
mov ecx, 0x100fd878
call fcn.10002cb0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edx, 2
imul eax, edx, 0
movzx ecx, word [ebp + eax - 0x218]
test ecx, ecx
jne 0x100833f0
push 0x100fd848
mov ecx, dword [ebp + 8]
call fcn.10005ec0
jmp 0x100833ff
lea edx, [ebp - 0x218]
push edx
mov ecx, dword [ebp + 8]
call fcn.10002ce0
mov byte [ebp - 0x237], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call fcn.10006220
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.10002d10
mov al, byte [ebp - 0x237]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10088f98
mov esp, ebp
pop ebp
ret
Function at 0x10083450
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c88d7
mov eax, dword fs:[0]
push eax
sub esp, 0x2ac
mov eax, dword [0x100fc03c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x234]
call fcn.10003560
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24c]
call fcn.10003560
mov byte [ebp - 4], 1
push 4
lea ecx, [ebp - 0x21c]
call fcn.10006360
lea ecx, [ebp - 0x21c]
call fcn.100061a0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x21c]
call fcn.10006ac0
lea eax, [ebp - 0x234]
push eax
call fcn.1003b460
add esp, 4
mov byte [ebp - 0x24d], al
lea ecx, [ebp - 0x21c]
call fcn.10006dc0
movzx ecx, byte [ebp - 0x24d]
test ecx, ecx
jne 0x10083530
mov byte [ebp - 0x24e], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x21c]
call fcn.10006220
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24c]
call fcn.10002d10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.10002d10
mov al, byte [ebp - 0x24e]
jmp 0x100836fd
push str.hotspotesswPrefs
lea ecx, [ebp - 0x270]
call fcn.10002d70
mov byte [ebp - 4], 3
lea edx, [ebp - 0x270]
push edx
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x2a0]
push ecx
call fcn.1000d5d0
add esp, 0xc
mov dword [ebp - 0x254], eax
mov edx, dword [ebp - 0x254]
push edx
lea ecx, [ebp - 0x234]
call fcn.10005ef0
lea ecx, [ebp - 0x2a0]
call fcn.10002d10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x270]
call fcn.10002d10
lea eax, [ebp - 0x234]
push eax
call fcn.1000bf00
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x100835b8
lea edx, [ebp - 0x234]
push edx
call fcn.10017190
add esp, 4
push 0x100fd830
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x2b8]
push ecx
call fcn.1000d5d0
add esp, 0xc
mov dword [ebp - 0x258], eax
mov edx, dword [ebp - 0x258]
push edx
lea ecx, [ebp - 0x234]
call fcn.10005ef0
lea ecx, [ebp - 0x2b8]
call fcn.10002d10
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.1008bb90
add esp, 0xc
lea ecx, [ebp - 0x234]
call fcn.10002cb0
push eax
push 0x104
lea ecx, [ebp - 0x218]
push ecx
mov ecx, 0x100fd848
call fcn.10002cb0
push eax
mov ecx, 0x100fd860
call fcn.10002cb0
push eax
mov ecx, 0x100fd878
call fcn.10002cb0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edx, 2
imul eax, edx, 0
movzx ecx, word [ebp + eax - 0x218]
test ecx, ecx
jne 0x10083671
push 0x100fd848
lea ecx, [ebp - 0x24c]
call fcn.10005ec0
jmp 0x10083683
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x24c]
call fcn.10002ce0
push 0x100cb4ac
lea ecx, [ebp - 0x288]
call fcn.10002d70
mov byte [ebp - 4], 4
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x288]
push ecx
lea edx, [ebp - 0x24c]
push edx
call fcn.100830f0
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x288]
call fcn.10002d10
mov byte [ebp - 0x24f], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x21c]
call fcn.10006220
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24c]
call fcn.10002d10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.10002d10
mov al, byte [ebp - 0x24f]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10088f98
mov esp, ebp
pop ebp
ret
Function at 0x10085310
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c8be8
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x100fc03c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x68]
call fcn.10003560
mov dword [ebp - 4], 0
lea eax, [ebp - 0x68]
push eax
call fcn.10085490
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x10085375
mov byte [ebp - 0x69], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.10002d10
mov al, byte [ebp - 0x69]
jmp 0x10085477
lea edx, [ebp - 0x68]
push edx
call fcn.1000c090
add esp, 4
movzx eax, al
test eax, eax
jne 0x100853a3
mov byte [ebp - 0x6a], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.10002d10
mov al, byte [ebp - 0x6a]
jmp 0x10085477
push 0x40
push 0
lea ecx, [ebp - 0x50]
push ecx
call fcn.1008bb90
add esp, 0xc
lea ecx, [ebp - 0x68]
call fcn.10002cb0
push eax
push 0x20
lea edx, [ebp - 0x50]
push edx
push 0x100cb890
push 0x100cb624
push 0x100cb60c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 0x74], 0x100cb894
lea eax, [ebp - 0x50]
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x70]
mov dx, word [ecx]
mov word [ebp - 0x76], dx
mov eax, dword [ebp - 0x74]
cmp dx, word [eax]
jne 0x10085429
cmp word [ebp - 0x76], 0
je 0x10085420
mov ecx, dword [ebp - 0x70]
mov dx, word [ecx + 2]
mov word [ebp - 0x78], dx
mov eax, dword [ebp - 0x74]
cmp dx, word [eax + 2]
jne 0x10085429
add dword [ebp - 0x70], 4
add dword [ebp - 0x74], 4
cmp word [ebp - 0x78], 0
jne 0x100853e4
mov dword [ebp - 0x7c], 0
jmp 0x10085431
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x7c], ecx
mov edx, dword [ebp - 0x7c]
mov dword [ebp - 0x80], edx
cmp dword [ebp - 0x80], 0
jne 0x10085455
mov byte [ebp - 0x6b], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.10002d10
mov al, byte [ebp - 0x6b]
jmp 0x10085477
lea eax, [ebp - 0x50]
push eax
mov ecx, dword [ebp + 8]
call fcn.10002ce0
mov byte [ebp - 0x6c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.10002d10
mov al, byte [ebp - 0x6c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10088f98
mov esp, ebp
pop ebp
ret
Function at 0x10085770
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c8cb6
mov eax, dword fs:[0]
push eax
mov eax, 0x1024
call fcn.100898c0
mov eax, dword [0x100fc03c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1030], 0
lea ecx, [ebp - 0x102c]
call fcn.10003560
mov dword [ebp - 4], 0
push 4
lea ecx, [ebp - 0x1014]
call fcn.10006360
lea ecx, [ebp - 0x1014]
call fcn.100061a0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1014]
call fcn.10006ac0
push 0x1000
push 0
lea eax, [ebp - 0x1010]
push eax
call fcn.1008bb90
add esp, 0xc
push 0
push 0x1c
lea ecx, [ebp - 0x1010]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x10085821
lea edx, [ebp - 0x1010]
push edx
lea ecx, [ebp - 0x102c]
call fcn.10002ce0
lea ecx, [ebp - 0x1014]
call fcn.10006dc0
lea eax, [ebp - 0x102c]
push eax
mov ecx, dword [ebp + 8]
call fcn.10003520
mov ecx, dword [ebp - 0x1030]
or ecx, 1
mov dword [ebp - 0x1030], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1014]
call fcn.10006220
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x102c]
call fcn.10002d10
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10088f98
mov esp, ebp
pop ebp
ret