joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x40de38
nop
nop
mov ecx, 0x65ff0329
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x3d1d258e
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x100010e3
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 8]
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov dword [ebp - 4], eax
or eax, eax
je 0x10001115
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x10001115
push dword [ebp - 4]
call fcn.100010c6
push 0
pop dword [ebp - 4]
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x10001134
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push 0x44
lea eax, [ebp - 0x44]
push eax
call fcn.1000111c
push 0x10
lea eax, [ebp - 0x54]
push eax
call fcn.1000111c
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
push 0
call sub.kernel32.dll_CreateProcessA
lea edi, [ebp - 0x54]
push dword [edi]
push dword [edi + 4]
call sub.kernel32.dll_CloseHandle
call sub.kernel32.dll_CloseHandle
leave
ret 4
Function at 0x10004f50
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101299e8
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
mov eax, dword [esp + 0x14]
lea ecx, [esi + 0x78]
push eax
push 0x12c
push 0x12c
mov dword [esp + 0x18], 0
call fcn.10120158
push eax
push str.MESSAGE_TITLE
push str.MESSAGE_TITLE
push 0x1016a81c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esi + 0x74]
call fcn.1011fe5a
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 0xffffffff
call fcn.1011fd13
mov ecx, dword [esp + 4]
pop esi
mov dword fs:[0], ecx
add esp, 0xc
ret 4

Function at 0x10004f65
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101299e8
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
mov eax, dword [esp + 0x14]
lea ecx, [esi + 0x78]
push eax
push 0x12c
push 0x12c
mov dword [esp + 0x18], 0
call fcn.10120158
push eax
push str.MESSAGE_TITLE
push str.MESSAGE_TITLE
push 0x1016a81c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esi + 0x74]
call fcn.1011fe5a
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 0xffffffff
call fcn.1011fd13
mov ecx, dword [esp + 4]
pop esi
mov dword fs:[0], ecx
add esp, 0xc
ret 4

Function at 0x10007be0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
test esi, esi
jbe 0x10007c0c
mov ecx, dword [esp + 8]
push ebx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
shr edx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x1016ad40]
xor eax, edx
inc ecx
dec esi
jne 0x10007bf0
pop ebx
pop esi
ret
Function at 0x1000a220
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
lea eax, [esp]
push esi
push eax
push ecx
mov dword [esp + 0xc], 0xc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.1011fd13
mov eax, esi
pop esi
add esp, 0xc
ret

Function at 0x1000a260
Capabilities:
Delete directory
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x1012a5c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x3c], 0
xor esi, esi
call fcn.1002cf57
lea eax, [esp + 0x44]
lea ecx, [esp + 0xc]
push eax
mov byte [esp + 0x40], 1
call fcn.1011fa80
push 0x1016a0d8
lea ecx, [esp + 0x14]
mov byte [esp + 0x40], 2
call fcn.1011fddc
lea ecx, [esp + 0x14]
push 1
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x44], 3
call fcn.1011dbe5
mov edx, dword [esp + 0x10]
mov eax, dword [eax]
push edx
push eax
call fcn.1002f1fa
add esp, 8
lea ecx, [esp + 0x14]
test eax, eax
setne bl
call fcn.1011fd13
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 2
call fcn.1011fd13
test bl, bl
je 0x1000a325
push 0x1016b6c4
lea ecx, [esp + 0x14]
call fcn.1011fddc
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 4
push ecx
lea ecx, [esp + 0x10]
call fcn.10120140
mov byte [esp + 0x3c], 2
lea ecx, [esp + 0x10]
jmp 0x1000a34f
push 0x1016a0d0
lea ecx, [esp + 0x14]
call fcn.1011fddc
lea edx, [esp + 0x10]
lea ecx, [esp + 0xc]
push edx
mov byte [esp + 0x40], 5
call fcn.10120140
mov byte [esp + 0x3c], 2
lea ecx, [esp + 0x10]
call fcn.1011fd13
mov eax, dword [esp + 0xc]
push 0
push eax
lea ecx, [esp + 0x20]
call fcn.1002d01c
test eax, eax
je 0x1000a3d6
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x18]
call fcn.1002d242
lea ecx, [esp + 0x18]
mov ebx, eax
call fcn.1002d205
test eax, eax
jne 0x1000a3d2
mov edx, dword [esp + 0x18]
push 0x10
lea ecx, [esp + 0x1c]
call dword [edx + 0x38]
test eax, eax
jne 0x1000a3b7
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
call fcn.1002d311
mov eax, dword [eax]
push eax
call edi
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.1011fd13
jmp 0x1000a3d2
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ecx
lea ecx, [esp + 0x20]
call fcn.1002d311
call fcn.1000a260
add esp, 4
mov esi, eax
test ebx, ebx
jne 0x1000a36e
lea ecx, [esp + 0x18]
call fcn.1002cfd2
mov edx, dword [esp + 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], 1
call fcn.1011fd13
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 0
call fcn.1002cf96
lea ecx, [esp + 0x44]
mov dword [esp + 0x3c], 0xffffffff
call fcn.1011fd13
mov ecx, dword [esp + 0x34]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x34
ret
Function at 0x1000a430
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x1012a600
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x3c], 0
call fcn.1002cf57
lea eax, [esp + 0x44]
lea ecx, [esp + 0xc]
push eax
mov byte [esp + 0x40], 1
call fcn.1011fa80
push 0x1016a0d8
lea ecx, [esp + 0x14]
mov byte [esp + 0x40], 2
call fcn.1011fddc
lea ecx, [esp + 0x14]
push 1
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x44], 3
call fcn.1011dbe5
mov edx, dword [esp + 0x10]
mov eax, dword [eax]
push edx
push eax
call fcn.1002f1fa
add esp, 8
lea ecx, [esp + 0x14]
test eax, eax
setne bl
call fcn.1011fd13
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 2
call fcn.1011fd13
test bl, bl
je 0x1000a4f3
push 0x1016b6c4
lea ecx, [esp + 0x14]
call fcn.1011fddc
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 4
push ecx
lea ecx, [esp + 0x10]
call fcn.10120140
mov byte [esp + 0x3c], 2
lea ecx, [esp + 0x10]
jmp 0x1000a51d
push 0x1016a0d0
lea ecx, [esp + 0x14]
call fcn.1011fddc
lea edx, [esp + 0x10]
lea ecx, [esp + 0xc]
push edx
mov byte [esp + 0x40], 5
call fcn.10120140
mov byte [esp + 0x3c], 2
lea ecx, [esp + 0x10]
call fcn.1011fd13
mov eax, dword [esp + 0xc]
push 0
push eax
lea ecx, [esp + 0x20]
call fcn.1002d01c
test eax, eax
je 0x1000a5a0
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x18]
call fcn.1002d242
lea ecx, [esp + 0x18]
mov esi, eax
call fcn.1002d205
test eax, eax
jne 0x1000a59c
mov edx, dword [esp + 0x18]
push 0x10
lea ecx, [esp + 0x1c]
call dword [edx + 0x38]
test eax, eax
jne 0x1000a583
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
call fcn.1002d311
mov eax, dword [eax]
push eax
call edi
lea ecx, [esp + 0x14]
call fcn.1011fd13
jmp 0x1000a59c
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ecx
lea ecx, [esp + 0x20]
call fcn.1002d311
call fcn.1000a260
add esp, 4
test esi, esi
jne 0x1000a53c
lea ecx, [esp + 0x18]
call fcn.1002cfd2
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], 1
call fcn.1011fd13
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 0
call fcn.1002cf96
lea ecx, [esp + 0x44]
mov dword [esp + 0x3c], 0xffffffff
call fcn.1011fd13
mov ecx, dword [esp + 0x34]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x34
ret
Function at 0x1000f500
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1012aae0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [0x1016e0e4]
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], ebp
mov dword [esp + 0x14], eax
add ecx, 0x64
mov byte [esp + 0x30], 1
mov dword [esp + 0x10], ebp
mov dword [esp + 0x1c], ecx
call fcn.1011f039
mov eax, dword [esp + 0x38]
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.1011fd87
call fcn.1000f3e0
mov ebx, eax
or ecx, 0xffffffff
mov edi, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.1002e5f3
mov esi, eax
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
test ebx, ebx
rep stosb byte es:[edi], al
jne 0x1000f5b8
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], bl
call fcn.1011fd13
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0xffffffff
call fcn.1011fd13
or eax, 0xffffffff
jmp 0x1000f702
mov ecx, ebx
mov al, byte [ecx]
test al, al
je 0x1000f658
cmp al, 0xa
je 0x1000f5cf
mov byte [esi + ebp], al
inc ecx
inc ebp
jmp 0x1000f5ba
inc ecx
inc ebp
mov dword [esp + 0x38], ecx
mov edi, esi
mov byte [esi + ebp], 0
or ecx, 0xffffffff
xor eax, eax
mov byte [esi + ebp + 1], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ecx
push esi
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.10024e80
mov edx, dword [esp + 0x1c]
add esp, 0xc
lea ecx, [esp + 0x14]
push edx
call fcn.1011feaa
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x14]
push eax
call fcn.1011f1a3
mov eax, dword [esp + 0x10]
xor ebp, ebp
cmp eax, ebp
je 0x1000f634
push eax
call fcn.1011fa75
add esp, 4
mov dword [esp + 0x10], ebp
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x38]
jmp 0x1000f5ba
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.10024e80
mov edx, dword [esp + 0x1c]
add esp, 0xc
lea ecx, [esp + 0x14]
push edx
call fcn.1011feaa
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x14]
push eax
call fcn.1011f1a3
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1000f6b0
push eax
call fcn.1011fa75
add esp, 4
mov dword [esp + 0x10], 0
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call fcn.1002e4db
add esp, 4
test esi, esi
je 0x1000f6e1
push esi
call fcn.1002e4db
add esp, 4
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 0
call fcn.1011fd13
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0xffffffff
call fcn.1011fd13
xor eax, eax
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret 4
Function at 0x10010720
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1012af80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
lea ecx, [esp + 4]
mov dword [esp + 0x28], 0
call fcn.1002cf57
mov eax, dword [esp + 0x30]
push 0
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 1
call fcn.1002d01c
lea ecx, [esp + 4]
mov esi, eax
mov byte [esp + 0x28], 0
call fcn.1002cf96
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call fcn.1011fd13
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x10012b90
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x1012b280
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
push str.Systemmedia_rkfactorydefault_wallpaper.jpg
lea ecx, [esp + 0xc]
mov dword [esi + 0x15c], 0
call fcn.1011fddc
lea eax, [esp + 8]
lea ecx, [esi + 0x6c]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x24], 0
call fcn.1011ff52
lea edi, [esi + 0xc8]
push eax
mov ecx, edi
mov byte [esp + 0x1c], 1
call fcn.1011fe5a
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], 0
call fcn.1011fd13
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.1011fd13
mov edi, dword [edi]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10012c28
mov dword [esi + 0x15c], 1
mov ecx, dword [esp + 0x10]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x10012c40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1012b2c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [0x1016e0e4]
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], eax
xor ebx, ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebx
push str.Systemmedia_bootanimation.zip
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 1
mov dword [esi + 0x158], ebx
mov dword [esi + 0x160], ebx
call fcn.1011fddc
lea eax, [esp + 0x10]
lea ecx, [esi + 0x6c]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
mov byte [esp + 0x38], 2
call fcn.1011ff52
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 3
call fcn.1011fe5a
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 2
call fcn.1011fd13
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 1
call fcn.1011fd13
push 0x5c
lea ecx, [esp + 0x10]
call fcn.1011dcd9
push str._bootanimation
lea ecx, [esp + 0x14]
mov edi, eax
call fcn.1011fddc
lea eax, [esp + 0x18]
push edi
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 4
call fcn.1011dc61
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push eax
push edx
mov byte [esp + 0x38], 5
call fcn.1011ff52
lea edi, [esi + 0xc0]
push eax
mov ecx, edi
mov byte [esp + 0x30], 6
call fcn.1011fe5a
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 5
call fcn.1011fd13
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 4
call fcn.1011fd13
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 1
call fcn.1011fd13
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push edi
call fcn.1011fa80
mov ecx, esi
call fcn.10013910
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], bl
call fcn.1011fd13
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.1011fd13
mov ecx, dword [esp + 0x24]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret
Function at 0x1001a860
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x1012c118
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x1016e0e4]
push ebx
push ebp
push esi
push edi
mov ebx, ecx
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x24]
push 0x1016cb20
push esi
mov dword [esp + 0x24], 0
call fcn.1001a780
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 0xffffffff
jle 0x1001a8f3
mov ecx, dword [esi + 4]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetMenuItemID]
mov edx, dword [0x1018e644]
lea ecx, [esp + 0x10]
push edx
push 0x12c
push 0x12c
mov edi, eax
call fcn.10120158
push eax
push str.ADD_APK
push str.ADD_APK
push str.APKList
call ebp
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 4]
push eax
push edi
push 0
push edi
push ecx
call dword [sym.imp.USER32.dll_ModifyMenuW]
push 0x1016cb04
push esi
mov ecx, ebx
call fcn.1001a780
cmp eax, 0xffffffff
jle 0x1001a950
mov edx, dword [esi + 4]
push eax
push edx
call dword [sym.imp.USER32.dll_GetMenuItemID]
mov edi, eax
mov eax, dword [0x1018e644]
push eax
push 0x12c
push 0x12c
lea ecx, [esp + 0x1c]
call fcn.10120158
push eax
push str.DEL_APK
push str.DEL_APK
push str.APKList
call ebp
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 4]
push ecx
push edi
push 0
push edi
push edx
call dword [sym.imp.USER32.dll_ModifyMenuW]
push 0x12c
lea ecx, [esp + 0x14]
call fcn.101201a8
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call fcn.1011fd13
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x1001b500
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x1012c5d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x1016e0e4]
push esi
push edi
mov esi, ecx
mov dword [esp + 8], eax
mov dword [esp + 0x14], 0
call fcn.1001b730
mov ecx, esi
call fcn.1001b990
mov ecx, esi
call fcn.1001bb10
mov ecx, esi
call fcn.1001be00
mov ecx, esi
call fcn.1001bf30
mov ecx, esi
call fcn.1001c2f0
push 0x4e6
mov ecx, esi
call fcn.1012371b
mov ecx, dword [eax + 0x1c]
push 0x105
push 0
push 0
push ecx
call dword [sym.imp.USER32.dll_RedrawWindow]
mov edx, dword [0x1018e644]
lea ecx, [esp + 8]
push edx
push 0x12c
push 0x12c
call fcn.10120158
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push eax
push str.CONFIRM_MODIFICTION
push str.CONFIRM_MODIFICTION
push str.SystemSeting
call edi
mov eax, dword [esp + 8]
mov ecx, esi
push eax
push 0x4c1
call fcn.1012371b
mov ecx, eax
call fcn.10123809
mov ecx, dword [0x1018e644]
push ecx
push 0x12c
push 0x12c
lea ecx, [esp + 0x14]
call fcn.10120158
push eax
push str.MODIFY_BUILD_PROP
push str.MODIFY_BUILD_PROP
push str.SystemSeting
call edi
mov edx, dword [esp + 8]
mov ecx, esi
push edx
push 0x4e1
call fcn.1012371b
mov ecx, eax
call fcn.10123809
mov eax, dword [0x1018e644]
lea ecx, [esp + 8]
push eax
push 0x12c
push 0x12c
call fcn.10120158
push eax
push str.MODIFY_KAY_MAPPED
push str.MODIFY_KAY_MAPPED
push str.SystemSeting
call edi
mov ecx, dword [esp + 8]
push ecx
push 0x4e2
mov ecx, esi
call fcn.1012371b
mov ecx, eax
call fcn.10123809
mov edx, dword [0x1018e644]
lea ecx, [esp + 8]
push edx
push 0x12c
push 0x12c
call fcn.10120158
push eax
push str.MODIFY_BATTERY_PARAMS
push str.MODIFY_BATTERY_PARAMS
push str.SystemSeting
call edi
mov eax, dword [esp + 8]
mov ecx, esi
push eax
push 0x4ec
call fcn.1012371b
mov ecx, eax
call fcn.10123809
mov ecx, dword [0x1018e644]
push ecx
push 0x12c
push 0x12c
lea ecx, [esp + 0x14]
call fcn.10120158
push eax
push str.MODIFY_KERNEL_PARAMETER
push str.MODIFY_KERNEL_PARAMETER
push str.SystemSeting
call edi
mov edx, dword [esp + 8]
mov ecx, esi
push edx
push 0x4ef
call fcn.1012371b
mov ecx, eax
call fcn.10123809
push 0x12c
lea ecx, [esp + 0xc]
call fcn.101201a8
mov eax, dword [esi + 0x1e8]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x640000
push 0
push 0x401
push eax
call edi
mov ecx, dword [esi + 0x1e8]
push 0
push 1
push 0x404
push ecx
call edi
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.1011fd13
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1001b730
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x1012c5f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x1016e0e4]
push esi
push edi
mov esi, ecx
mov dword [esp + 8], eax
mov ecx, dword [0x1018e644]
mov dword [esp + 0x14], 0
push ecx
push 0x12c
push 0x12c
lea ecx, [esp + 0x14]
call fcn.10120158
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push eax
push str.IDC_STATIC_SYS_INFO
push str.IDC_STATIC_SYS_INFO
push str.DIALOG_102
call edi
mov edx, dword [esp + 8]
mov ecx, esi
push edx
push 0x4e7
call fcn.1012371b
mov ecx, eax
call fcn.10123809
mov eax, dword [0x1018e644]
lea ecx, [esp + 8]
push eax
push 0x12c
push 0x12c
call fcn.10120158
push eax
push str.COMPANY
push str.COMPANY
push str.SystemSeting
call edi
mov ecx, dword [esp + 8]
push ecx
push 0x4d8
mov ecx, esi
call fcn.1012371b
mov ecx, eax
call fcn.10123809
push 0
push 0x4bf
mov ecx, esi
call fcn.1012371b
mov ecx, eax
call fcn.10123809
push 0
push 0x4bf
mov ecx, esi
call fcn.1012371b
mov ecx, eax
call fcn.101238dc
mov edx, dword [0x1018e644]
lea ecx, [esp + 8]
push edx
push 0x12c
push 0x12c
call fcn.10120158
push eax
push str.MODEL_NUMBER
push str.MODEL_NUMBER
push str.SystemSeting
call edi
mov eax, dword [esp + 8]
mov ecx, esi
push eax
push 0x4d0
call fcn.1012371b
mov ecx, eax
call fcn.10123809
push 0
push 0x4b6
mov ecx, esi
call fcn.1012371b
mov ecx, eax
call fcn.10123809
push 0
push 0x4b6
mov ecx, esi
call fcn.1012371b
mov ecx, eax
call fcn.101238dc
mov ecx, dword [0x1018e644]
push ecx
push 0x12c
push 0x12c
lea ecx, [esp + 0x14]
call fcn.10120158
push eax
push str.BUILD_NUMBER_SDK
push str.BUILD_NUMBER_SDK
push str.SystemSeting
call edi
mov edx, dword [esp + 8]
mov ecx, esi
push edx
push 0x4d7
call fcn.1012371b
mov ecx, eax
call fcn.10123809
push 0
push 0x4b8
mov ecx, esi
call fcn.1012371b
mov ecx, eax
call fcn.10123809
push 0
push 0x4b8
mov ecx, esi
call fcn.1012371b
mov ecx, eax
call fcn.101238dc
mov eax, dword [0x1018e644]
lea ecx, [esp + 8]
push eax
push 0x12c
push 0x12c
call fcn.10120158
push eax
push str.BUILD_NUMBER
push str.BUILD_NUMBER
push str.SystemSeting
call edi
mov ecx, dword [esp + 8]
push ecx
push 0x4d6
mov ecx, esi
call fcn.1012371b
mov ecx, eax
call fcn.10123809
push 0
push 0x4bc
mov ecx, esi
call fcn.1012371b
mov ecx, eax
call fcn.10123809
push 0
push 0x4bc
mov ecx, esi
call fcn.1012371b
mov ecx, eax
call fcn.101238dc
push 0x12c
lea ecx, [esp + 0xc]
call fcn.101201a8
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.1011fd13
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1001b990
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x1012c618
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x1016e0e4]
push esi
push edi
mov esi, ecx
mov dword [esp + 8], eax
mov ecx, dword [0x1018e644]
mov dword [esp + 0x14], 0
push ecx
push 0x12c
push 0x12c
lea ecx, [esp + 0x14]
call fcn.10120158
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push eax
push str.IDC_STATIC_USB_CONFIG
push str.IDC_STATIC_USB_CONFIG
push str.DIALOG_102
call edi
mov edx, dword [esp + 8]
mov ecx, esi
push edx
push 0x4e8
call fcn.1012371b
mov ecx, eax
call fcn.10123809
mov eax, dword [0x1018e644]
lea ecx, [esp + 8]
push eax
push 0x12c
push 0x12c
call fcn.10120158
push eax
push str.USB_FACTORY
push str.USB_FACTORY
push str.SystemSeting
call edi
mov ecx, dword [esp + 8]
push ecx
push 0x4d1
mov ecx, esi
call fcn.1012371b
mov ecx, eax
call fcn.10123809
push 0
push 0x4b7
mov ecx, esi
call fcn.1012371b
mov ecx, eax
call fcn.10123809
push 0
push 0x4b7
mov ecx, esi
call fcn.1012371b
mov ecx, eax
call fcn.101238dc
mov edx, dword [0x1018e644]
lea ecx, [esp + 8]
push edx
push 0x12c
push 0x12c
call fcn.10120158
push eax
push str.DISK_VOLUME
push str.DISK_VOLUME
push str.SystemSeting
call edi
mov eax, dword [esp + 8]
mov ecx, esi
push eax
push 0x4d2
call fcn.1012371b
mov ecx, eax
call fcn.10123809
push 0
push 0x4b9
mov ecx, esi
call fcn.1012371b
mov ecx, eax
call fcn.10123809
push 0
push 0x4b9
mov ecx, esi
call fcn.1012371b
mov ecx, eax
call fcn.101238dc
push 0x12c
lea ecx, [esp + 0xc]
call fcn.101201a8
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.1011fd13
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret