joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41afce
Capabilities:
Create directory

Disassembly:
push ebp
lea ebp, [esp - 0x80]
sub esp, 0x80
push 0xffffffffffffffff
push 0x44c737
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x46c068]
xor eax, ebp
mov dword [ebp + 0x7c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [ecx + 0x30], 0
je 0x41b153
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
mov dword [ebp - 4], eax
call fcn.0041aa87
mov edi, dword [ebp - 0x14]
mov eax, edi
mov ebx, dword [ebp - 0x18]
sub eax, ebx
push 0x18
cdq
pop ecx
idiv ecx
imul esi, eax, 0x18
add esi, ebx
jmp 0x41b044
push esi
lea ecx, [esi - 0x18]
call fcn.00402f10
add esi, 0x18
cmp esi, edi
jne 0x41b038
add edi, 0xffffffe8
mov ecx, edi
call fcn.00403a8e
mov dword [ebp - 0x14], edi
cmp ebx, edi
je 0x41b12e
and dword [ebp + 0x74], 0
lea ecx, [ebp + 0x64]
and dword [ebp + 0x78], 0
lea esi, [ebx + 0x18]
push ebx
call fcn.00403c2a
mov byte [ebp - 4], 1
jmp 0x41b11e
push esi
mov edx, 0x46068c
lea ecx, [ebp + 0x18]
call fcn.004040f2
pop ecx
mov byte [ebp - 4], 2
mov ecx, eax
cmp dword [eax + 0x14], 0x10
jb 0x41b097
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp + 0x64]
call fcn.00403bd1
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 1
call fcn.00403a8e
lea eax, [ebp + 0x64]
push eax
lea ecx, [ebp + 0x30]
call fcn.0041a977
mov byte [ebp - 4], 3
lea ecx, [ebp]
cmp dword [ebp + 0x5c], 8
lea eax, [ebp + 0x48]
push ecx
cmovae eax, dword [ebp + 0x48]
push eax
call fcn.004343f0
pop ecx
pop ecx
cmp eax, 0xffffffff
jne 0x41b107
cmp dword [ebp + 0x5c], 8
lea eax, [ebp + 0x48]
cmovae eax, dword [ebp + 0x48]
push eax
call fcn.00433a7a
pop ecx
cmp eax, 0xffffffff
jne 0x41b107
call fcn.0042cba6
push 0x137
push 0x11
pop ecx
mov edx, dword [eax]
call fcn.0041989d
pop ecx
lea ecx, [ebp + 0x48]
mov byte [ebp - 4], 1
call fcn.00408804
lea ecx, [ebp + 0x30]
call fcn.00403a8e
add esi, 0x18
cmp esi, edi
jne 0x41b07a
lea ecx, [ebp + 0x64]
call fcn.00403a8e
lea ecx, [ebp - 0x18]
call fcn.00403a58
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x7c]
xor ecx, ebp
call fcn.00425c6e
sub ebp, 0xffffff80
leave
ret
push str.canonicalized_file_name_expected
lea ecx, [ebp - 0x18]
call fcn.0040660b
push 0x46a234
lea eax, [ebp - 0x18]
push eax
call fcn.0042906d
int3
Function at 0x41d522
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x23c]
sub esp, 0x23c
push 0xffffffffffffffff
push 0x44cc1d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x46c068]
xor eax, ebp
mov dword [ebp + 0x238], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea eax, [ebp + 0x30]
mov dword [ebp - 0x10], edi
push eax
xor ebx, ebx
push ebx
push ebx
push 0x2c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x41d5fc
lea eax, [ebp + 0x30]
push eax
lea ecx, [ebp]
call fcn.004087d5
mov esi, eax
mov dword [ebp - 4], ebx
mov ebx, str.OracleJavajava.settings.cfg
push ebx
call fcn.0042cecb
pop ecx
push eax
push ebx
mov ecx, esi
call fcn.00408b4d
xor ecx, ecx
mov byte [ebp - 0x10], cl
push dword [ebp - 0x10]
mov dword [ebp + 0x28], ecx
mov dword [ebp + 0x2c], ecx
lea ecx, [ebp + 0x18]
push eax
call fcn.004088dd
lea edx, [ebp + 0x18]
mov byte [ebp - 4], 1
mov ecx, edi
call fcn.0041cc62
lea ecx, [ebp + 0x18]
call fcn.00408804
lea ecx, [ebp]
call fcn.00408804
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x238]
xor ecx, ebp
call fcn.00425c6e
add ebp, 0x23c
leave
ret
push 0xc8
lea ecx, [ebp - 0x20]
call fcn.00415f92
push 0x46a42c
lea eax, [ebp - 0x20]
push eax
call fcn.0042906d
int3

Function at 0x41fffd
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ebx, ecx
push edi
mov edi, dword [esp + 0x24]
mov ebp, 0x7fffffff
test edi, edi
jl 0x420080
jg 0x420029
test esi, esi
je 0x420080
test edi, edi
jg 0x420029
jl 0x420025
cmp esi, ebp
jae 0x420029
mov eax, esi
jmp 0x42002b
mov eax, ebp
and dword [esp + 0x20], 0
cmp dword [esp + 0x18], 0xffffffff
je 0x420071
push 0
lea ecx, [esp + 0x24]
push ecx
push eax
push ebx
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42005b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x42007b
jmp 0x420071
mov eax, dword [esp + 0x20]
test eax, eax
jle 0x42006c
add ebx, eax
cdq
sub esi, eax
sbb edi, edx
jmp 0x420011
cmp eax, 0xffffffff
jne 0x42007b
call fcn.0042cba6
cmp dword [eax], 4
je 0x420011
or eax, 0xffffffff
jmp 0x420082
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10001000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x10001071
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
jne 0x10001071
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
jne 0x1000105a
jmp 0x10001071
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x10001520
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x100b7728], 0
je 0x10001539
mov eax, dword [0x100b7728]
jmp 0x100016d6
mov dword [0x100b7728], 0x100b7700
push 0x28
push 0
push 0x100b7700
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x100b7700], eax
push str.imagehlp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x100b7704], eax
cmp dword [0x100b7704], 0
jne 0x1000157f
xor eax, eax
jmp 0x100016d6
push str.ImagehlpApiVersionEx
mov eax, dword [0x100b7704]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100b7708], eax
push str.SymInitialize
mov ecx, dword [0x100b7704]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100b770c], eax
push str.SymSetOptions
mov edx, dword [0x100b7704]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100b7710], eax
push str.SymGetOptions
mov eax, dword [0x100b7704]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100b7714], eax
push str.SymLoadModule
mov ecx, dword [0x100b7704]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100b7718], eax
push str.SymGetModuleInfo
mov edx, dword [0x100b7704]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100b771c], eax
push str.SymGetSymFromName
mov eax, dword [0x100b7704]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100b7720], eax
push str.BindImage
mov ecx, dword [0x100b7704]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100b7724], eax
push 8
push 0
lea edx, [ebp - 8]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov word [ebp - 8], 9
cmp dword [0x100b7708], 0
je 0x1000165d
lea eax, [ebp - 8]
push eax
call dword [0x100b7708]
cmp dword [0x100b7708], 0
je 0x1000166f
movzx ecx, word [ebp - 8]
cmp ecx, 9
jge 0x1000168a
mov edx, dword [0x100b7704]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x100b7704], 0
xor eax, eax
jmp 0x100016d6
cmp dword [0x100b770c], 0
je 0x100016a3
push 0
push 0
mov eax, dword [0x100b7700]
push eax
call dword [0x100b770c]
cmp dword [0x100b7714], 0
je 0x100016d1
cmp dword [0x100b7710], 0
je 0x100016d1
call dword [0x100b7714]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
and ecx, 7
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [0x100b7710]
mov eax, dword [0x100b7728]
mov esp, ebp
pop ebp
ret
Function at 0x10003d90
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6c
mov eax, dword [0x100b1010]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
push esi
push edi
mov edi, dword [ebp + 8]
call fcn.10096f00
test eax, eax
je 0x10003eca
cmp eax, 7
je 0x10003eca
cmp eax, 8
je 0x10003eca
test byte [edi + 0x24], 1
je 0x10003eca
mov ecx, ebx
call fcn.100971d0
test al, al
je 0x10003eca
mov dword [edi + 0x34], 0x8d
nop
mov esi, dword [edi + 4]
lea eax, [esp + 0x28]
push 0x48
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, 0x20
mov dword [esp + 0x1c], 0x67452301
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x3c]
shr eax, 3
mov edx, 0x3f
and eax, 0x3f
mov dword [esp + 0x20], 0xefcdab89
add ecx, eax
mov dword [esp + 0x24], 0x98badcfe
mov dword [esp + 0x28], 0x10325476
sub edx, eax
mov dword [esp + 0x30], 0
add esp, 0xc
mov dword [esp + 0x30], esi
mov byte [ecx], 0x80
inc ecx
cmp edx, 8
jae 0x10003e7e
push edx
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
lea edx, [esp + 0x3c]
lea ecx, [esp + 0x1c]
call fcn.1000abe0
push 0x38
lea eax, [esp + 0x40]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
jmp 0x10003e8d
lea eax, [edx - 8]
push eax
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x30]
mov dword [esp + 0x68], eax
lea ecx, [esp + 0x10]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x6c], eax
call fcn.1000abe0
movzx eax, byte [esp + 0x16]
mov ecx, dword [edi + 0x34]
cmp eax, ecx
je 0x10003ebe
inc dword [edi + 4]
jmp 0x10003df0
lea eax, [edi + 0xc]
push eax
push eax
push ecx
push ebx
call fcn.10003800
mov ecx, dword [esp + 0x74]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1009823a
mov esp, ebp
pop ebp
ret 8
Function at 0x1000bc10
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x100b1010]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100b1308], 0x10
mov al, 0x66
push ebx
push esi
mov esi, 0x100b12f4
mov byte [ebp - 0x112], 0
cmovae esi, dword [0x100b12f4]
mov bl, 0x56
xor al, bl
mov byte [ebp - 0x114], bl
cmp dword [edx + 0x14], 0x10
mov byte [ebp - 0x113], al
mov byte [ebp - 0x112], 0
jb 0x1000bc60
mov edx, dword [edx]
cmp dword [ecx + 0x14], 0x10
jb 0x1000bc68
mov ecx, dword [ecx]
push esi
push 0x104
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x113]
push eax
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dl, 0x4c
mov byte [ebp - 0x115], 0
mov al, 0x23
mov byte [ebp - 0x118], dl
mov cl, 0x22
mov byte [ebp - 0x115], 0
xor al, dl
xor cl, dl
mov byte [ebp - 0x117], al
lea eax, [ebp - 0x108]
mov byte [ebp - 0x116], cl
lea ecx, [ebp - 0x117]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1000bce0
test dl, dl
je 0x1000bcdc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1000bce0
add eax, 2
add ecx, 2
test dl, dl
jne 0x1000bcc0
xor eax, eax
jmp 0x1000bce5
sbb eax, eax
or eax, 1
test eax, eax
je 0x1000bd86
mov ah, 0x23
mov byte [ebp - 0x10b], 0
mov dl, bl
mov byte [ebp - 0x110], ah
mov al, 0x57
mov byte [ebp - 0x10b], 0
mov cl, 0x51
xor al, ah
xor cl, ah
mov byte [ebp - 0x10f], al
xor dl, ah
mov byte [ebp - 0x10e], cl
mov bl, 0x46
mov byte [ebp - 0x10d], dl
xor bl, ah
lea ecx, [ebp - 0x10f]
mov byte [ebp - 0x10c], bl
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1000bd57
test dl, dl
je 0x1000bd53
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1000bd57
add eax, 2
add ecx, 2
test dl, dl
jne 0x1000bd37
xor eax, eax
jmp 0x1000bd5c
sbb eax, eax
or eax, 1
test eax, eax
je 0x1000bd86
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 4
cmp eax, 1
sete al
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009823a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop esi
xor ecx, ebp
pop ebx
call fcn.1009823a
mov esp, ebp
pop ebp
ret

Function at 0x1000bda0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x100b1010]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100b1308], 0x10
mov eax, 0x100b12f4
mov word [ebp - 0x10c], 0x3b
cmovae eax, dword [0x100b12f4]
cmp dword [edx + 0x14], 0x10
mov byte [ebp - 0x10b], 0
jb 0x1000bdde
mov edx, dword [edx]
cmp dword [ecx + 0x14], 0x10
jb 0x1000bde6
mov ecx, dword [ecx]
push eax
push 0x104
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x10b]
push eax
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x108]
xor ecx, ebp
call fcn.1009823a
mov esp, ebp
pop ebp
ret
Function at 0x1000be20
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x100b1010]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100b1308], 0x10
mov al, 0x47
push ebx
push esi
mov esi, 0x100b12f4
mov byte [ebp - 0x10a], 0
cmovae esi, dword [0x100b12f4]
mov bl, 0x77
xor al, bl
mov byte [ebp - 0x10c], bl
cmp dword [edx + 0x14], 0x10
mov byte [ebp - 0x10b], al
mov byte [ebp - 0x10a], 0
jb 0x1000be70
mov edx, dword [edx]
cmp dword [ecx + 0x14], 0x10
jb 0x1000be78
mov ecx, dword [ecx]
push esi
push 0x104
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x10b]
push eax
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop esi
pop ebx
call fcn.1009823a
mov esp, ebp
pop ebp
ret

Function at 0x1000bec0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x100b1010]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100b1308], 0x10
mov al, 0x7f
push ebx
push esi
mov esi, 0x100b12f4
mov byte [ebp - 0x10a], 0
cmovae esi, dword [0x100b12f4]
mov bl, 0x4f
xor al, bl
mov byte [ebp - 0x10c], bl
cmp dword [edx + 0x14], 0x10
mov byte [ebp - 0x10b], al
mov byte [ebp - 0x10a], 0
jb 0x1000bf10
mov edx, dword [edx]
cmp dword [ecx + 0x14], 0x10
jb 0x1000bf18
mov ecx, dword [ecx]
push esi
push 0x104
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x10b]
push eax
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
lea eax, [ebp - 0x108]
push eax
call esi
add esp, 4
test eax, eax
jne 0x1000bf5d
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009823a
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x108]
push eax
call esi
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop esi
pop ebx
call fcn.1009823a
mov esp, ebp
pop ebp
ret
Function at 0x1000bf80
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x100b1010]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100b1308], 0x10
mov al, 0x34
push ebx
push esi
mov esi, 0x100b12f4
mov byte [ebp - 0x10a], 0
cmovae esi, dword [0x100b12f4]
mov bl, 4
xor al, bl
mov byte [ebp - 0x10c], bl
cmp dword [edx + 0x14], 0x10
mov byte [ebp - 0x10b], al
mov byte [ebp - 0x10a], 0
jb 0x1000bfd0
mov edx, dword [edx]
cmp dword [ecx + 0x14], 0x10
jb 0x1000bfd8
mov ecx, dword [ecx]
push esi
push 0x104
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x10b]
push eax
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
lea eax, [ebp - 0x108]
push eax
call esi
add esp, 4
test eax, eax
je 0x1000c05e
lea eax, [ebp - 0x108]
push eax
call esi
add esp, 4
cmp eax, 1
jne 0x1000c030
pop esi
mov eax, str.Toggle
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009823a
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x108]
push eax
call esi
add esp, 4
mov ecx, str.Always
cmp eax, 2
mov edx, str.Hold
cmovne ecx, edx
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009823a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, str.Hold
pop esi
xor ecx, ebp
pop ebx
call fcn.1009823a
mov esp, ebp
pop ebp
ret

Function at 0x1000c080
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x100b1010]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100b1308], 0x10
mov al, 0x5b
push ebx
push esi
mov esi, 0x100b12f4
mov byte [ebp - 0x10a], 0
cmovae esi, dword [0x100b12f4]
mov bl, 0x6b
xor al, bl
mov byte [ebp - 0x10c], bl
cmp dword [edx + 0x14], 0x10
mov byte [ebp - 0x10b], al
mov byte [ebp - 0x10a], 0
jb 0x1000c0d0
mov edx, dword [edx]
cmp dword [ecx + 0x14], 0x10
jb 0x1000c0d8
mov ecx, dword [ecx]
push esi
push 0x104
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x10b]
push eax
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
mov ecx, dword [ebp - 4]
add esp, 4
fstp dword [ebp - 0x10c]
movss xmm0, dword [ebp - 0x10c]
xor ecx, ebp
pop esi
pop ebx
call fcn.1009823a
mov esp, ebp
pop ebp
ret
Function at 0x1000cd10
Capabilities:
Read .ini file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10099a50
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x130
mov eax, dword [0x100b1010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x13c], esi
mov ecx, dword [ebx + 8]
mov edi, 0x100b12f4
mov dword [ebp - 0x13c], esi
mov ah, 0x40
cmp dword [0x100b1308], 0x10
mov al, 0x70
mov byte [ebp - 0x13a], 0
cmovae edi, dword [0x100b12f4]
xor al, ah
cmp dword [ecx + 0x14], 0x10
mov byte [ebp - 0x13c], ah
mov byte [ebp - 0x13b], al
mov byte [ebp - 0x13a], 0
jb 0x1000cd9d
mov ecx, dword [ecx]
cmp dword [edx + 0x14], 0x10
jb 0x1000cda5
mov edx, dword [edx]
push edi
push 0x104
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x13b]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xorps xmm0, xmm0
mov dword [ebp - 0x128], 0
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x124], 0
movups xmmword [ebp - 0x138], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000cde8
sub ecx, edx
lea eax, [ebp - 0x120]
push ecx
push eax
lea ecx, [ebp - 0x138]
call fcn.1003d4b0
push ecx
lea edx, [ebp - 0x138]
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.1000ba60
mov ecx, dword [ebp - 0x124]
add esp, 4
cmp ecx, 0x10
jb 0x1000ce58
mov edx, dword [ebp - 0x138]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000ce4e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1000ce4e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1009827d
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1009823a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1003aee0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009aecd
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x100b1010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
lea ecx, [ebp - 0x30]
call fcn.1003c670
mov ah, 0x22
mov dword [ebp - 4], 0
mov dl, 0x44
mov byte [ebp - 0x13], 0
xor dl, ah
mov byte [ebp - 0x18], ah
mov cl, 0x41
mov byte [ebp - 0x15], dl
mov al, 0xc
mov byte [ebp - 0x13], 0
xor cl, ah
lea edx, [ebp - 0x17]
mov bl, 0x45
mov byte [ebp - 0x16], cl
xor al, ah
lea ecx, [edx + 1]
xor bl, ah
mov byte [ebp - 0x17], al
mov byte [ebp - 0x14], bl
mov al, byte [edx]
inc edx
test al, al
jne 0x1003af48
sub edx, ecx
lea eax, [ebp - 0x17]
cmp dword [ebp - 0x1c], 0x10
lea ecx, [ebp - 0x30]
push edx
cmovae ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x20]
push eax
push ecx
call fcn.1003d3a0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x1003afb7
mov ah, 0x36
mov byte [ebp - 0x13], 0
mov cl, 0x55
mov byte [ebp - 0x18], ah
xor cl, ah
mov byte [ebp - 0x13], 0
mov dl, 0x50
mov byte [ebp - 0x16], cl
mov al, 0x18
lea ecx, [ebp - 0x17]
xor dl, ah
mov bl, 0x51
xor al, ah
mov byte [ebp - 0x15], dl
xor bl, ah
mov byte [ebp - 0x17], al
mov byte [ebp - 0x14], bl
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1003afa1
sub ecx, edx
lea eax, [ebp - 0x17]
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.1003cbd0
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.1003d100
add esp, 4
mov ecx, 0x100b12f4
push eax
call fcn.1003c5b0
mov ecx, dword [ebp - 0x34]
cmp ecx, 0x10
jb 0x1003b007
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003affd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1003affd
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1009827d
add esp, 8
cmp dword [0x100b1308], 0x10
mov eax, 0x100b12f4
cmovae eax, dword [0x100b12f4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0x10
jb 0x1003b057
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003b04d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1003b04d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1009827d
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1009823a
mov esp, ebp
pop ebp
ret
Function at 0x1003b3c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1003b3ec
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x1003b414
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x1003b41a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x1003b482
jg 0x1003b431
test esi, esi
je 0x1003b482
test ecx, ecx
jl 0x1003b47d
jg 0x1003b43b
test eax, eax
je 0x1003b47d
cmp edi, ecx
jg 0x1003b44f
jl 0x1003b445
cmp esi, eax
jae 0x1003b44f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x1003b485
mov ecx, dword [ebp + 8]
jmp 0x1003b48f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x1003b4a9
jg 0x1003b48f
test esi, esi
je 0x1003b4a9
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x1003b4a9
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc