joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41067b
Capabilities:
Get file version info

Disassembly:
lea ebp, [esp + 0xc]
sub esp, 0x20
push 0x409a95
push ebp
push dword [ebp - 0xc]
lea eax, [ebp - 0x10]
push eax
jmp 0x4086bc
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x30], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], edx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ebx
lea esp, [ebp - 0x10]
jmp 0x410868
lea ebp, [esp + 8]
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push dword [ebp - 4]
call fcn.004567f8
test eax, eax
jne 0x410864
call fcn.00456732
mov dword [ebp - 0xc], eax
push 0x410264
push ebp
push 0x451c0c
push str.none__
push eax
jmp 0x40a07c
mov esp, ebp
pop ebp
ret
lea ebp, [esp + 0x10]
sub esp, 0xc
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
test ecx, ecx
je 0x4108ad
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 0x18], ecx
push 0x410293
push ebp
push ecx
lea edx, [ebp - 0x14]
push edx
jmp 0x410820
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 0x1c], ecx
push 0
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push dword [ebp - 8]
push ecx
call fcn.00456810
test eax, eax
jne 0x4108f9
call fcn.00456732
mov dword [ebp - 0x14], eax
cmp eax, 0xea
je 0x4108f9
push 0x4102f9
push ebp
push 0x451c14
push 0x44a758
push eax
push 0x451c1c
jmp 0x4080c0
mov esp, ebp
pop ebp
ret

Function at 0x432340
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x4449b0
push 3
push 0x18
push 0x3c
call fcn.0045699c
mov dword [ebp - 0x44], eax
mov dword [eax], 2
mov dword [eax + 4], 1
mov ecx, dword [ebp - 0x18]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0xc], edx
mov ebx, dword [ebp - 0x20]
mov dword [eax + 0x10], ebx
mov esi, dword [ebp - 0x24]
mov dword [eax + 0x14], esi
push 0x4449b0
push 3
push 0x18
push 0x3c
call fcn.0045699c
mov dword [ebp - 0x50], eax
mov dword [eax], 2
mov dword [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x10]
mov dword [eax + 0xc], edx
mov edi, dword [ebp - 0x14]
mov dword [eax + 0x10], edi
mov edi, dword [ebp - 0x44]
mov dword [eax + 0x14], edi
mov edi, dword [ebp - 0x28]
mov dword [edi], eax
ret

Function at 0x4331e0
Capabilities:
Terminate process

Disassembly:
daa
inc ebp
add byte [ebx + 0x2083f845], cl
add byte [ebx + 0x2183f44d], cl
add byte [ebx + 0x2283f055], cl
add cl, ch
pop ebp
add eax, dword [eax]
add byte [ebx + 0x488bfc45], cl
add al, 0x89
dec ebp
in al, dx
push 0x43ca3c
push 3
push 4
call fcn.00456990
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov ebx, dword [ebp - 8]
mov dword [ebx], 4
mov esi, dword [ebp - 0x10]
mov dword [esi], 4
jmp 0x433557
mov esp, ebp
pop ebp
ret
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
adc byte [eax], al
sbb al, byte [esi + 0x40]
sbb al, 0x5c
adc al, byte [eax]
rcl dword [ecx], cl
xchg esp, eax
dec edx
loope 0x401704
lock add byte [ecx + 0xd004014], cl
adc al, 0x40
xor bh, bl
adc al, 0x40
add bl, dh
sub eax, dword [eax + 0x45]
push ss
adc eax, 0x1b000040
mov eax, 0x1b1b531b
add bl, byte [ebx]
ficomp word [ebx]
sbb ebx, dword [ebx]
ficomp dword [ebx]
add ebx, dword [ebx]
sbb ebp, dword [ecx + 5]
sbb eax, dword [esi]
adc eax, 0x1b1b1b07
sbb ebx, dword [ebx]
sbb ebx, dword [ebx]
sbb ebx, dword [ebx]
or byte [eax], ch
or cl, byte [ebx]
or al, 0x29
ficomp word [ebx]
bndstx [ebx], bnd3
pushfd
sbb edx, dword [ecx]
adc dl, byte [ebx]
sbb edx, dword [edx + 0x19181716]
sbb dl, byte [eax - 0x6fad6f70]
nop
nop
nop
nop
nop
nop
mov esp, 0x8b559090
push ebp
mov ebp, esp
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
ror byte [0x40c008], 1
jb 0x4016e1
mov word [eax + 0x45], es
je 0x401735
xor eax, 0x15ff5100
and byte [esi - 0x535effc0], 0x79
inc ecx
add byte [ebx - 0x3f7af33c], al
je 0x4017a6
push eax
push str.Total_of__d_requests_completed_n
call dword [0xbf404869]
add esp, 8
push 1
call dword [sym.imp.MSVCRT.dll_exit]
nop
push ebp
mov ebp, esp
cmp ecx, 0xb8
mov eax, dword [0x410278]
mov edi, 0x404c34c0
inc ecx
add byte [esp + edx + 0x68], dh
adc al, 0x68
push es
cmp al, 0x41
add byte [eax - 0x18], dl
sahf
js 0x4017b1
add byte [esi + 1], ah
or eax, 0x70274
jmp 0x4017cf
jns 0x4017db
xchg ebp, eax
inc ecx
in eax, dx
mov eax, dword [0x410288]
push ebx
push esi
std
ja 0x401842
ror dword [eax + eax], 0x26
invalid
cmpsd dword [esi], dword es:[edi]
inc ebx
rol dword [eax], 0x83
les ecx, [ebx + ecx*4]
adc eax, 0xa7d018
mov ebp, dword [eax + ebx*2 + 0x680040c1]
pushal
or byte [eax], al
add byte [edx - 1], dl
salc
mov dword [0x410bb0], eax
mov eax, dword [0x40d010]
push 0x20
ret 0x8728

Function at 0x40ad0c
Capabilities:
Encode data using xor

Disassembly:
dec esp
xor al, byte [ecx]
mov eax, 0x380
mov dword [eax + edx], edi
je 0x40ad49
mov edx, eax
sar edx, 1
or eax, edx
dec ecx
mov dword [ebp - 0x57], eax
mov al, bl
and al, 0x3f
mov ebp, 0xeb0cf84d
scasd eax, dword es:[edi]
lea ecx, [eax - 0x463c7402]
push es
rol byte [eax], 0xf2
call 0xb1b810
mov ecx, dword [ebp - 8]
mov ebx, eax
mov esp, edi
xor ecx, dword [esi - 0x2c]
cli
jne 0x40ad19
mov edx, dword [ebp + 0xc]
or bl, al
lahf
pop ecx
dec dword [ebx - 0x76e37afe]
inc ebp
cld
bswap ebx
test dh, bh
mov esi, 0x5b5e4dff
mov esp, ebp
lahf
ret 0x8e10
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x74e50a8d
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x1a6d184f
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x10002205
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov byte [ebp - 8], 0
mov al, byte [ebp + 0xc]
mov byte [ebp - 4], al
mov dword [ebp - 0xc], 1
jmp 0x1000222a
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 4
jge 0x10002267
mov edx, dword [ebp - 0xc]
xor eax, eax
mov al, byte [ebp + edx - 5]
shl eax, 1
mov ecx, dword [ebp - 0xc]
mov byte [ebp + ecx - 4], al
mov edx, dword [ebp - 0xc]
xor eax, eax
mov al, byte [ebp + edx - 5]
and eax, 0x80
test eax, eax
je 0x10002265
mov ecx, dword [ebp - 0xc]
mov dl, byte [ebp + ecx - 4]
xor dl, 0x1b
mov eax, dword [ebp - 0xc]
mov byte [ebp + eax - 4], dl
jmp 0x10002221
mov dword [ebp - 0xc], 0
jmp 0x10002279
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 4
jge 0x100022a3
mov edx, dword [ebp + 8]
and edx, 0xff
mov ecx, dword [ebp - 0xc]
sar edx, cl
and edx, 1
test edx, edx
je 0x100022a1
mov eax, dword [ebp - 0xc]
mov cl, byte [ebp - 8]
xor cl, byte [ebp + eax - 4]
mov byte [ebp - 8], cl
jmp 0x10002270
mov al, byte [ebp - 8]
mov esp, ebp
pop ebp
ret 8

Function at 0x10003169
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
push str.IsCreack7
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBeginUltra]
call fcn.100028df
test eax, eax
je 0x100031b7
mov eax, 1
test eax, eax
je 0x100031a2
mov dword [ebp - 0xc], 0
jmp 0x100031b2
push 0x1000e1a4
call fcn.10004560
add esp, 4
mov dword [ebp - 0xc], eax
add esp, 0x14
jmp eax
call dword [sym.imp.VMProtectSDK32.dll_VMProtectEnd]
push str.ConnetServer_
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBeginUltra]
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xec], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 0xec], 0xffffffff
jne 0x10003211
mov eax, 1
test eax, eax
je 0x100031fa
mov dword [ebp - 0x10], 0
jmp 0x1000320a
push 0x1000e1c0
call fcn.10004560
add esp, 4
mov dword [ebp - 0x10], eax
xor eax, eax
jmp 0x100032c1
mov ecx, dword [ebp - 8]
mov word [ecx + 0xf0], 2
push 0x441
call sub.WSOCK32.dll_htons
mov edx, dword [ebp - 8]
mov word [edx + 0xf2], ax
push str.113.10.165.39
call sub.WSOCK32.dll_inet_addr
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xf4], eax
push 0x10
mov edx, dword [ebp - 8]
add edx, 0xf0
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xec]
push ecx
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x1000328f
mov edx, 1
test edx, edx
je 0x10003276
mov dword [ebp - 0x14], 0
jmp 0x10003286
push 0x1000e1e4
call fcn.10004560
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
jmp 0x100032b8
mov eax, 1
test eax, eax
je 0x100032a1
mov dword [ebp - 0x18], 0
jmp 0x100032b1
push 0x1000e1f4
call fcn.10004560
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 1
call dword [sym.imp.VMProtectSDK32.dll_VMProtectEnd]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003e40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000b27d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 0
push str.MyRecvLoginResult
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBeginUltra]
mov eax, dword [ebp + 8]
cmp dword [eax + 0xfc], 0
je 0x10003f90
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x100], 0
jbe 0x10003f90
lea edx, [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x24]
call fcn.10004570
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x2c]
call fcn.10004a60
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
neg eax
sbb eax, eax
inc eax
mov byte [ebp - 0x10], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1000aac6
mov edx, dword [ebp - 0x10]
and edx, 0xff
test edx, edx
je 0x10003f90
mov eax, dword [ebp - 0x24]
add eax, 0x100
push eax
mov ecx, dword [ebp + 8]
add ecx, 0xc8
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x10003f90
mov edx, dword [ebp + 8]
add edx, 0x104
push edx
mov ecx, dword [ebp - 0x24]
add ecx, 0xc4
call fcn.10004b40
mov eax, dword [ebp - 0x24]
mov dword [eax + 0xe4], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x114], eax
mov edx, 1
test edx, edx
je 0x10003f4e
mov dword [ebp - 0x30], 0
jmp 0x10003f62
mov eax, dword [ebp + 8]
push eax
push 0x1000e458
call fcn.10004560
add esp, 8
mov dword [ebp - 0x30], eax
cmp dword [0x1000f540], 0
jne 0x10003f8b
push 0
push 0
mov ecx, dword [ebp - 0x24]
push ecx
push 0x10003bbe
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x24]
mov dword [edx + 0xe0], eax
jmp 0x1000403e
mov eax, 1
test eax, eax
je 0x10003fa2
mov dword [ebp - 0x34], 0
jmp 0x10003fdd
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x24]
call fcn.10004570
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x20]
or edx, 1
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx]
push edx
push 0x1000e46c
call fcn.10004560
add esp, 8
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20]
and eax, 1
test eax, eax
je 0x10003ffa
and dword [ebp - 0x20], 0xfffffffe
lea ecx, [ebp - 0x18]
call fcn.1000aac6
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push ecx
mov ecx, dword [ebp - 0x24]
call fcn.10004570
mov dword [ebp - 0x40], eax
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x44], edx
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.100041f1
push 0
push 0
push 0x1000e480
call sub.MFC42.DLL_AfxMessageBox
mov ecx, dword [ebp - 0x24]
call fcn.10004520
call dword [sym.imp.VMProtectSDK32.dll_VMProtectEnd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x100041f1
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000b290
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov byte [ebp - 4], 1
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x100042b0
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ecx, [ebp + 8]
call fcn.10004a20
add eax, 1
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x14], eax
lea ecx, [ebp + 8]
call fcn.10004a20
add eax, 1
push eax
push 0
mov ecx, dword [ebp - 0x14]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp + 8]
call fcn.10004a60
push eax
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 0x1c]
push ecx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [ebp - 0x18], 1
jmp 0x100042d2
mov edx, 1
test edx, edx
je 0x100042c2
mov dword [ebp - 0x28], 0
jmp 0x100042d2
push 0x1000e508
call fcn.10004560
add esp, 4
mov dword [ebp - 0x28], eax
jmp 0x100042fc
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.1000aac6
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1000432e
Capabilities:
Suspend thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x1000436c
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
mov dword [ecx], 0
mov esp, ebp
pop ebp
ret 4
Function at 0x1000440b
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0x100
jne 0x10004436
cmp dword [ebp + 0x10], 0
je 0x10004430
mov byte [ebp - 0xc], 0x40
jmp 0x10004434
mov byte [ebp - 0xc], 0
jmp 0x1000443a
mov byte [ebp - 0xc], 0xc0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0x5a
jae 0x10004455
cmp dword [ebp + 8], 0x2d
ja 0x1000445e
mov cl, byte [ebp - 0xc]
add cl, 1
mov byte [ebp - 0xc], cl
mov edx, dword [ebp - 0xc]
and edx, 0xff
shl edx, 0x18
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
shl eax, 0x10
mov ecx, dword [ebp - 4]
or ecx, eax
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
or edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10005a8d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
cmp dword [ebp + 0xc], 0
je 0x10005aa2
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
cmp dword [ebp + 8], 0
jne 0x10005aaf
xor eax, eax
jmp 0x10005b85
cmp dword [ebp + 0xc], 0
jne 0x10005b6c
mov dword [ebp - 4], 0x200
mov ecx, dword [ebp - 4]
add ecx, 1
push ecx
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
add edx, 2
cmp edx, dword [ebp - 4]
jb 0x10005b52
mov eax, dword [ebp - 4]
add eax, 0x200
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
push edx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, dword [ebp - 4]
add eax, 1
push eax
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
mov dword [ebp - 0xc], eax
jmp 0x10005af4
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
push edx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, dword [ebp - 0xc]
add eax, 2
jmp 0x10005b85
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10005c48
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
cmp dword [ebp + 8], 0
jne 0x10005d07
mov dword [ebp - 4], 0x200
mov eax, dword [ebp - 4]
add eax, 1
push eax
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, 2
cmp eax, dword [ebp - 4]
jb 0x10005ced
mov ecx, dword [ebp - 4]
add ecx, 0x200
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [ebp - 4]
add ecx, 1
push ecx
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
mov dword [ebp - 0xc], eax
jmp 0x10005c92
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
push edx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, dword [ebp - 0xc]
add eax, 2
jmp 0x10005d1c
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
mov esp, ebp
pop ebp
ret 8
Function at 0x10006241
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x24], ecx
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
je 0x1000625d
cmp dword [ebp + 0xc], 0
jne 0x100062b7
cmp dword [ebp + 0x10], 0
jne 0x1000627e
push 1
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov byte [ecx], 0
jmp 0x100062af
mov edx, dword [ebp + 0x10]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
add eax, 1
push eax
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 8]
jmp 0x1000638e
mov dword [ebp - 4], 0x200
mov eax, dword [ebp - 4]
add eax, 1
push eax
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0
jne 0x100062e5
mov dword [ebp - 0x28], 0x1000f584
jmp 0x100062eb
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
add ecx, 1
cmp ecx, dword [ebp - 4]
jb 0x1000638b
mov edx, dword [ebp - 4]
add edx, 0x200
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov edx, dword [ebp - 4]
add edx, 1
push edx
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
cmp dword [ebp + 0x10], 0
jne 0x1000635f
mov dword [ebp - 0x2c], 0x1000f588
jmp 0x10006365
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0xc], eax
jmp 0x1000630f
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc