joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10071ed5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1007d740]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10062668
mov dword [ebp - 0x14], eax
cmp dword [0x106216f8], esi
jne 0x10071fc8
push 0x800
push esi
push 0x100075c0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10071f55
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x100720a8
push esi
push esi
push 0x100075c0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x100720a8
push 0x100075d8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100720a8
push eax
call ebx
push 0x100075e4
push edi
mov dword [0x106216f8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100075f4
push edi
mov dword [0x106216fc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007608
push edi
mov dword [0x10621700], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10621708], eax
test eax, eax
je 0x10071fc5
push 0x10007624
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10621704], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10071fed
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10071fe0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10072002
push 4
pop eax
jmp 0x100720aa
cmp dword [ebp - 0x14], esi
je 0x10072002
push dword [0x106216f8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10071fe7
mov eax, dword [0x10621704]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10072060
cmp dword [0x10621708], edi
je 0x10072060
push eax
call ebx
push dword [0x10621708]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10072060
test eax, eax
je 0x10072060
call ecx
test eax, eax
je 0x10072055
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10072055
test byte [ebp - 8], 1
jne 0x10072060
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10072090
mov eax, dword [0x106216fc]
cmp eax, edi
je 0x1007208d
push eax
call ebx
test eax, eax
je 0x1007208d
call eax
mov esi, eax
test esi, esi
je 0x1007208d
mov eax, dword [0x10621700]
cmp eax, edi
je 0x1007208d
push eax
call ebx
test eax, eax
je 0x1007208d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x106216f8]
call ebx
test eax, eax
je 0x100720a8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x100720aa
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005fb4e
mov esp, ebp
pop ebp
ret
Function at 0x100015a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004d89a
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x100701bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.10028b77
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x10001660
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.1002fc17
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x1006e82c
push eax
call fcn.10030eb4
push edi
push esi
call fcn.10028ebf
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002db4b
mov esp, ebp
pop ebp
ret 4

Function at 0x10010850
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004d9c6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100701bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1002dfcd
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.10028dbc
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100180e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3ec
mov eax, dword [0x100701bc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0x14]
lea eax, [ebp - 0x3ec]
push 0x3e8
push 0
push eax
mov esi, ecx
call fcn.10030f30
mov eax, dword [ebp + 8]
add esp, 0xc
dec eax
cmp eax, 2
ja 0x100181e3
lea eax, [ebp + 8]
push eax
push 0x1000
push 0x10018090
call fcn.100362a4
movzx eax, byte [esi + 4]
add esp, 0xc
push dword [esi + 0xc]
push dword [esi + 8]
push eax
lea eax, [ebp - 0x3ec]
push eax
push dword [ebp + 8]
call fcn.1001d7b0
push 0x10060c54
push 0
mov esi, eax
call dword [sym.imp.USER32.dll_FindWindowA]
push 0
push eax
call dword [sym.imp.USER32.dll_EndDialog]
test esi, esi
jne 0x100181cc
cmp byte [ebp - 0x3ec], 0
jne 0x10018197
xor ecx, ecx
lea eax, [ebp - 0x3ec]
push ecx
push eax
mov ecx, edi
call fcn.1000dd80
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002db4b
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [ebp - 0x3ec]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100181a0
sub ecx, edx
lea eax, [ebp - 0x3ec]
push ecx
push eax
mov ecx, edi
call fcn.1000dd80
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002db4b
mov esp, ebp
pop ebp
ret 0x10
pop edi
mov eax, 0xffffffe0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002db4b
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
mov eax, 0xffffffe9
pop edi
xor ecx, ebp
pop esi
call fcn.1002db4b
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10018a60
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x324
mov eax, dword [0x100701bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x100
lea eax, [ebp - 0x108]
mov ebx, ecx
push 0
push eax
call fcn.10030f30
add esp, 0xc
lea eax, [ebp - 0x208]
push 0x100
push 0
push eax
call fcn.10030f30
add esp, 0xc
lea eax, [ebp - 0x208]
mov edx, str.LogDir
mov ecx, 0x1005fab4
push eax
push 0x1005fa15
call fcn.10027100
add esp, 8
mov dword [ebp - 0x310], 0xf
cmp byte [ebp - 0x208], 0
mov dword [ebp - 0x314], 0
mov byte [ebp - 0x324], 0
jne 0x10018aea
xor ecx, ecx
jmp 0x10018afc
lea ecx, [ebp - 0x208]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10018af3
sub ecx, edx
push ecx
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x324]
call fcn.1000dd80
cmp dword [ebp - 0x314], 0
mov eax, dword [ebp - 0x310]
sete byte [ebp - 0x309]
cmp eax, 0x10
jb 0x10018b3b
inc eax
lea ecx, [ebp - 0x324]
push eax
push dword [ebp - 0x324]
call fcn.1000e380
push 0x100
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.10030f30
xor ecx, ecx
add esp, 0xc
cmp byte [ebp - 0x309], cl
je 0x10018ba5
nop dword [eax + eax]
mov al, byte [ecx + 0x100725d0]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x109], al
test al, al
jne 0x10018b60
lea ecx, [ebp - 0x108]
dec ecx
nop dword [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x10018b80
mov eax, dword [str.TSLOG]
mov dword [ecx], eax
mov ax, word [0x10060ed4]
mov word [ecx + 4], ax
mov al, byte [0x10060ed6]
mov byte [ecx + 6], al
jmp 0x10018bba
mov al, byte [ebp + ecx - 0x208]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x109], al
test al, al
jne 0x10018ba5
lea eax, [ebp - 0x108]
push eax
call fcn.1003774c
add esp, 4
cmp eax, 0xffffffff
jne 0x10018beb
call fcn.10036a0d
cmp dword [eax], 0x11
je 0x10018beb
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002db4b
mov esp, ebp
pop ebp
ret
push 0x100
lea eax, [ebp - 0x308]
push 0
push eax
call fcn.10030f30
add esp, 0xc
xor ecx, ecx
mov al, byte [ebp + ecx - 0x108]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x309], al
test al, al
jne 0x10018c03
lea edi, [ebp - 0x308]
dec edi
nop
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x10018c20
mov ax, word [0x10060a58]
mov esi, ebx
mov word [edi], ax
mov al, byte [ebx]
inc ebx
test al, al
jne 0x10018c35
lea edi, [ebp - 0x308]
sub ebx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10018c45
mov ecx, ebx
lea eax, [ebp - 0x308]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
push 0x10060ed8
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.10036552
mov ecx, dword [ebp - 4]
add esp, 8
test eax, eax
mov dword [0x10072538], eax
setne al
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1002db4b
mov esp, ebp
pop ebp
ret
Function at 0x1001b870
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
mov eax, dword [0x100701bc]
xor eax, esp
mov dword [esp + 0x128], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 8]
test eax, eax
je 0x1001b8a7
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [edi + 8], 0
push 0x104
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.10030f30
add esp, 0xc
lea ecx, [esp + 0x10]
call fcn.10025510
cmp dword [eax + 0x14], 0x10
jb 0x1001b8cc
mov eax, dword [eax]
push 0x10061254
push eax
lea eax, [esp + 0x30]
push 0x10060914
push eax
call fcn.10018850
mov eax, dword [esp + 0x34]
add esp, 0x10
cmp eax, 0x10
jb 0x1001b8fc
inc eax
lea ecx, [esp + 0x10]
push eax
push dword [esp + 0x14]
call fcn.1000e380
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [edi + 8], eax
test eax, eax
jne 0x1001b93e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x26
push 0x10061264
mov ecx, ebx
call fcn.1000dd80
mov eax, 0xffffff92
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.1002db4b
mov esp, ebp
pop ebp
ret 4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ICC_Reader_Open
push eax
call esi
push str.ICC_Reader_Close
push dword [edi + 8]
mov dword [edi + 0xc], eax
call esi
push str.ICC_Reader_PowerOn
push dword [edi + 8]
mov dword [edi + 0x10], eax
call esi
push str.ICC_Reader_PowerOff
push dword [edi + 8]
mov dword [edi + 0x14], eax
call esi
push str.ICC_Reader_GetStatus
push dword [edi + 8]
mov dword [edi + 0x18], eax
call esi
push str.ICC_Reader_Application
push dword [edi + 8]
mov dword [edi + 0x1c], eax
call esi
push str.ICC_Reader_Libinfo
push dword [edi + 8]
mov dword [edi + 0x20], eax
call esi
cmp dword [edi + 0xc], 0
mov dword [edi + 0x24], eax
je 0x1001b9de
cmp dword [edi + 0x10], 0
je 0x1001b9de
cmp dword [edi + 0x14], 0
je 0x1001b9de
cmp dword [edi + 0x18], 0
je 0x1001b9de
cmp dword [edi + 0x1c], 0
je 0x1001b9de
cmp dword [edi + 0x20], 0
je 0x1001b9de
test eax, eax
je 0x1001b9de
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.1002db4b
mov esp, ebp
pop ebp
ret 4
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x2e
push 0x1006128c
mov ecx, ebx
mov dword [edi + 8], 0
call fcn.1000dd80
mov ecx, dword [esp + 0x134]
mov eax, 0xffffff91
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1002db4b
mov esp, ebp
pop ebp
ret 4
Function at 0x1001baa0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
mov eax, dword [0x100701bc]
xor eax, esp
mov dword [esp + 0x128], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 8]
test eax, eax
je 0x1001bad7
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [edi + 8], 0
push 0x104
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.10030f30
add esp, 0xc
lea ecx, [esp + 0x10]
call fcn.10025510
cmp dword [eax + 0x14], 0x10
jb 0x1001bafc
mov eax, dword [eax]
push 0x100611b8
push eax
lea eax, [esp + 0x30]
push 0x10060914
push eax
call fcn.10018850
mov eax, dword [esp + 0x34]
add esp, 0x10
cmp eax, 0x10
jb 0x1001bb2c
inc eax
lea ecx, [esp + 0x10]
push eax
push dword [esp + 0x14]
call fcn.1000e380
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [edi + 8], eax
test eax, eax
jne 0x1001bb6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x26
push 0x100611c8
mov ecx, ebx
call fcn.1000dd80
mov eax, 0xffffff92
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.1002db4b
mov esp, ebp
pop ebp
ret 4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ICC_Reader_Open
push eax
call esi
push str.ICC_Reader_Close
push dword [edi + 8]
mov dword [edi + 0xc], eax
call esi
push str.ICC_Reader_PowerOn
push dword [edi + 8]
mov dword [edi + 0x10], eax
call esi
push str.ICC_Reader_PowerOff
push dword [edi + 8]
mov dword [edi + 0x14], eax
call esi
push str.ICC_Reader_GetStatus
push dword [edi + 8]
mov dword [edi + 0x18], eax
call esi
push str.ICC_Reader_Application
push dword [edi + 8]
mov dword [edi + 0x1c], eax
call esi
push str.ICC_Reader_Libinfo
push dword [edi + 8]
mov dword [edi + 0x20], eax
call esi
cmp dword [edi + 0xc], 0
mov dword [edi + 0x24], eax
je 0x1001bc0e
cmp dword [edi + 0x10], 0
je 0x1001bc0e
cmp dword [edi + 0x14], 0
je 0x1001bc0e
cmp dword [edi + 0x18], 0
je 0x1001bc0e
cmp dword [edi + 0x1c], 0
je 0x1001bc0e
cmp dword [edi + 0x20], 0
je 0x1001bc0e
test eax, eax
je 0x1001bc0e
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.1002db4b
mov esp, ebp
pop ebp
ret 4
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x2e
push 0x1006120c
mov ecx, ebx
mov dword [edi + 8], 0
call fcn.1000dd80
mov ecx, dword [esp + 0x134]
mov eax, 0xffffff91
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1002db4b
mov esp, ebp
pop ebp
ret 4
Function at 0x10027100
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10050fe1
mov eax, dword fs:[0]
push eax
sub esp, 0x154
mov eax, dword [0x100701bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
cmp dword [0x10072750], 0
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x12c], eax
je 0x100272f7
mov dword [ebp - 0x114], 0xf
mov dword [ebp - 0x118], 0
mov byte [ebp - 0x128], 0
mov dword [ebp - 4], 0
cmp byte [esi], 0
mov dword [ebp - 0x148], 0xf
mov dword [ebp - 0x14c], 0
mov byte [ebp - 0x15c], 0
jne 0x10027191
xor ecx, ecx
jmp 0x1002719f
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10027196
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x15c]
call fcn.1000dd80
mov byte [ebp - 4], 1
cmp byte [edi], 0
mov dword [ebp - 0x130], 0xf
mov dword [ebp - 0x134], 0
mov byte [ebp - 0x144], 0
jne 0x100271d4
xor ecx, ecx
jmp 0x100271e9
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100271e0
sub ecx, edx
push ecx
push edi
lea ecx, [ebp - 0x144]
call fcn.1000dd80
lea eax, [ebp - 0x15c]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x144]
push eax
call fcn.10027640
mov ecx, eax
call fcn.10021d80
lea ecx, [ebp - 0x128]
cmp ecx, eax
je 0x10027228
push 0xffffffffffffffff
push 0
push eax
call fcn.1000de40
mov eax, dword [ebp - 0x130]
cmp eax, 0x10
jb 0x10027246
inc eax
lea ecx, [ebp - 0x144]
push eax
push dword [ebp - 0x144]
call fcn.1000e380
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x130], 0xf
mov dword [ebp - 0x134], 0
mov byte [ebp - 0x144], 0
cmp eax, 0x10
jb 0x10027283
inc eax
lea ecx, [ebp - 0x15c]
push eax
push dword [ebp - 0x15c]
call fcn.1000e380
mov edx, 0x1005fa15
lea ecx, [ebp - 0x128]
call fcn.10012670
mov esi, dword [ebp - 0x114]
mov edi, dword [ebp - 0x128]
test al, al
je 0x100272c2
mov ecx, dword [ebp - 0x12c]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100272b0
sub ecx, edx
push ecx
push dword [ebp - 0x12c]
jmp 0x100272d5
push dword [ebp - 0x118]
cmp esi, 0x10
lea eax, [ebp - 0x128]
cmovae eax, edi
push eax
push ebx
call fcn.10030940
add esp, 0xc
cmp esi, 0x10
jb 0x100272f3
lea eax, [esi + 1]
push eax
push edi
lea ecx, [ebp - 0x128]
call fcn.1000e380
xor eax, eax
jmp 0x10027343
push 0x100
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.10030f30
add esp, 0xc
lea eax, [ebp - 0x110]
push str.config.ini
push 0x100725d0
push 0x10060914
push eax
call fcn.100188e0
add esp, 0x10
lea eax, [ebp - 0x110]
push eax
push 4
push ebx
push dword [ebp - 0x12c]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002db4b
mov esp, ebp
pop ebp
ret
Function at 0x10027360
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10051031
mov eax, dword fs:[0]
push eax
sub esp, 0x150
mov eax, dword [0x100701bc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10072750], 0
je 0x100274ff
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], 0
mov byte [ebp - 0x12c], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x15c]
push 7
push str.LogFile
mov dword [ebp - 0x148], 0xf
mov dword [ebp - 0x14c], 0
mov byte [ebp - 0x15c], 0
call fcn.1000dd80
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x144]
push 3
push 0x1005fab4
mov dword [ebp - 0x130], 0xf
mov dword [ebp - 0x134], 0
mov byte [ebp - 0x144], 0
call fcn.1000dd80
lea eax, [ebp - 0x15c]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x144]
push eax
call fcn.10027640
mov ecx, eax
call fcn.10021d80
lea ecx, [ebp - 0x12c]
cmp ecx, eax
je 0x1002744b
push 0xffffffffffffffff
push 0
push eax
call fcn.1000de40
mov eax, dword [ebp - 0x130]
cmp eax, 0x10
jb 0x10027469
inc eax
lea ecx, [ebp - 0x144]
push eax
push dword [ebp - 0x144]
call fcn.1000e380
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x130], 0xf
mov dword [ebp - 0x134], 0
mov byte [ebp - 0x144], 0
cmp eax, 0x10
jb 0x100274a6
inc eax
lea ecx, [ebp - 0x15c]
push eax
push dword [ebp - 0x15c]
call fcn.1000e380
mov edx, 0x1005fa15
lea ecx, [ebp - 0x12c]
call fcn.10012670
test al, al
je 0x100274be
xor esi, esi
jmp 0x100274dd
cmp dword [ebp - 0x118], 0x10
lea eax, [ebp - 0x12c]
cmovae eax, dword [ebp - 0x12c]
push eax
call fcn.10037722
add esp, 4
mov esi, eax
mov ecx, dword [ebp - 0x118]
cmp ecx, 0x10
jb 0x100274fb
inc ecx
push ecx
push dword [ebp - 0x12c]
lea ecx, [ebp - 0x12c]
call fcn.1000e380
mov eax, esi
jmp 0x1002754c
push 0x100
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.10030f30
add esp, 0xc
lea eax, [ebp - 0x114]
push str.config.ini
push 0x100725d0
push 0x10060914
push eax
call fcn.100188e0
add esp, 0x10
lea eax, [ebp - 0x114]
push eax
push 0
push str.LogFile
push 0x1005fab4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1002db4b
mov esp, ebp
pop ebp
ret

Function at 0x10041b9e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10041a1d

Function at 0x10043925
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100435e5
Function at 0x403350
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push edi
mov ecx, 8
push esi
mov esi, 0x405233
push ebx
sub esp, 0x250
mov eax, dword [0x407040]
mov dword [esp + 0x24c], eax
xor eax, eax
lea edi, [esp + 0x2c]
mov ebx, dword [esp + 0x260]
rep movsd dword es:[edi], dword [esi]
mov edx, eax
mov byte [esp + eax + 0x14c], al
and edx, 0x1f
mov dl, byte [esp + edx + 0x2c]
mov byte [esp + eax + 0x4c], dl
inc eax
cmp eax, 0x100
jne 0x40337e
xor esi, esi
xor edi, edi
movzx eax, byte [esp + esi + 0x14c]
add eax, edi
add al, byte [esp + esi + 0x4c]
movzx edi, al
lea eax, [esp + 0x14c]
add eax, esi
inc esi
mov dword [esp + 4], eax
lea eax, [esp + 0x14c]
add eax, edi
mov dword [esp], eax
call fcn.00402c98
cmp esi, 0x100
jne 0x40339e
mov edi, dword [esp + 0x264]
xor esi, esi
xor eax, eax
add edi, ebx
cmp edi, ebx
je 0x403435
lea edx, [esi + 1]
lea ecx, [esp + 0x14c]
movzx esi, dl
add al, byte [esp + esi + 0x14c]
movzx eax, al
lea edx, [ecx + eax]
mov dword [esp + 0x1c], eax
mov dword [esp + 4], edx
lea edx, [ecx + esi]
mov dword [esp], edx
call fcn.00402c98
mov eax, dword [esp + 0x1c]
mov dl, byte [esp + eax + 0x14c]
add dl, byte [esp + esi + 0x14c]
movzx edx, dl
mov dl, byte [esp + edx + 0x14c]
xor byte [ebx], dl
inc ebx
jmp 0x4033e3
mov eax, dword [esp + 0x24c]
sub eax, dword [0x407040]
je 0x403449
call fcn.00401770
mov eax, dword [esp + 0x264]
add esp, 0x250
pop ebx
pop esi
pop edi
ret