joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003c2fc
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp dword [0x36208e4], 0
je 0x1003c41c
push ebx
mov ebx, 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x1019a27c], ebx
jne 0x1003c236
call edi
sub eax, dword [0x1011cd7c]
cmp eax, 0x7530
jbe 0x1003c236
call fcn.1003c010
cmp dword [0x10199550], ebx
jne 0x1003c274
cmp dword [0x1012d3e4], ebx
jne 0x1003c274
mov eax, dword [0x36208e4]
cmp dword [eax + 0x2634], 0
jne 0x1003c261
cmp dword [0x1011cd68], 2
jne 0x1003c274
push 3
jmp 0x1003c26c
cmp dword [0x1011cd68], 2
je 0x1003c274
push 4
call fcn.1003ba30
add esp, 4
cmp dword [0x10192e88], ebx
jne case.default.0x1003c2ec
call edi
sub eax, dword [0x1012d210]
cmp eax, 0xbb8
jb case.default.0x1003c2ec
call edi
sub eax, dword [0x1012d238]
cmp eax, 0x7d0
jb case.default.0x1003c2ec
mov eax, dword [0x10191a04]
cmp eax, ebx
jne 0x1003c2c9
cmp dword [0x1011cd68], 2
jne case.default.0x1003c2ec
mov ecx, dword [0x36208e4]
cmp dword [ecx + 0x2984], 0
je 0x1003c2db
jmp case.default.0x1003c2ec
test eax, eax
jne case.default.0x1003c2ec
mov edx, dword [0x36208e4]
cmp dword [edx + 0x2984], eax
jne case.default.0x1003c2ec
call edi
mov dword [0x1012d210], eax
mov eax, dword [0x10192fcc]
cmp eax, 4
ja case.default.0x1003c2ec
jmp dword [eax*4 + 0x1003c420]
push 0
push 0x92c0d
jmp 0x1003c31e
push 0
push 0x92c0e
jmp 0x1003c31e
push 0
push 0x92c0f
jmp 0x1003c31e
push 0
push 0xf468d
jmp 0x1003c31e
push 0
push 0xf468e
call fcn.1003a1d0
add esp, 8
mov eax, dword [0x36208e4]
cmp dword [eax + 0x2984], 0
jle 0x1003c3fd
push 0x1009e638
call fcn.10006d00
add esp, 4
test eax, eax
jne 0x1003c3fd
push 0x1009e630
call fcn.10006d00
add esp, 4
test eax, eax
jne 0x1003c3fd
push 0x1009e650
call fcn.10006d00
add esp, 4
test eax, eax
jne 0x1003c3fd
push 0x1009e640
call fcn.10006d00
add esp, 4
test eax, eax
jne 0x1003c3fd
push 0x1009e620
call fcn.10006d00
add esp, 4
test eax, eax
jne 0x1003c3fd
cmp dword [0x1012d3e4], ebx
jne 0x1003c3fd
cmp dword [0x33ccfd8], eax
jle 0x1003c3fd
call edi
sub eax, dword [0x101b8990]
cmp eax, 0x4e20
jb 0x1003c404
mov ecx, dword [0x36208e4]
mov eax, dword [ecx + 0x2984]
push 0
cmp eax, 6
jne 0x1003c3da
push 0xf468e
call fcn.1003a1d0
add esp, 8
jmp 0x1003c404
cmp eax, 7
jne 0x1003c3ee
push 0xf468d
call fcn.1003a1d0
add esp, 8
jmp 0x1003c404
push 0x92c0d
call fcn.1003a1d0
add esp, 8
jmp 0x1003c404
call edi
mov dword [0x101b8990], eax
cmp dword [0x10199428], ebx
pop edi
pop ebx
jne 0x1003c41c
cmp dword [0x33d4ad0], 0
jne 0x1003c41c
jmp fcn.1003a3c0
ret
Function at 0x1003c305
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp dword [0x36208e4], 0
je 0x1003c41c
push ebx
mov ebx, 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x1019a27c], ebx
jne 0x1003c236
call edi
sub eax, dword [0x1011cd7c]
cmp eax, 0x7530
jbe 0x1003c236
call fcn.1003c010
cmp dword [0x10199550], ebx
jne 0x1003c274
cmp dword [0x1012d3e4], ebx
jne 0x1003c274
mov eax, dword [0x36208e4]
cmp dword [eax + 0x2634], 0
jne 0x1003c261
cmp dword [0x1011cd68], 2
jne 0x1003c274
push 3
jmp 0x1003c26c
cmp dword [0x1011cd68], 2
je 0x1003c274
push 4
call fcn.1003ba30
add esp, 4
cmp dword [0x10192e88], ebx
jne case.default.0x1003c2ec
call edi
sub eax, dword [0x1012d210]
cmp eax, 0xbb8
jb case.default.0x1003c2ec
call edi
sub eax, dword [0x1012d238]
cmp eax, 0x7d0
jb case.default.0x1003c2ec
mov eax, dword [0x10191a04]
cmp eax, ebx
jne 0x1003c2c9
cmp dword [0x1011cd68], 2
jne case.default.0x1003c2ec
mov ecx, dword [0x36208e4]
cmp dword [ecx + 0x2984], 0
je 0x1003c2db
jmp case.default.0x1003c2ec
test eax, eax
jne case.default.0x1003c2ec
mov edx, dword [0x36208e4]
cmp dword [edx + 0x2984], eax
jne case.default.0x1003c2ec
call edi
mov dword [0x1012d210], eax
mov eax, dword [0x10192fcc]
cmp eax, 4
ja case.default.0x1003c2ec
jmp dword [eax*4 + 0x1003c420]
push 0
push 0x92c0d
jmp 0x1003c31e
push 0
push 0x92c0e
jmp 0x1003c31e
push 0
push 0x92c0f
jmp 0x1003c31e
push 0
push 0xf468d
jmp 0x1003c31e
push 0
push 0xf468e
call fcn.1003a1d0
add esp, 8
mov eax, dword [0x36208e4]
cmp dword [eax + 0x2984], 0
jle 0x1003c3fd
push 0x1009e638
call fcn.10006d00
add esp, 4
test eax, eax
jne 0x1003c3fd
push 0x1009e630
call fcn.10006d00
add esp, 4
test eax, eax
jne 0x1003c3fd
push 0x1009e650
call fcn.10006d00
add esp, 4
test eax, eax
jne 0x1003c3fd
push 0x1009e640
call fcn.10006d00
add esp, 4
test eax, eax
jne 0x1003c3fd
push 0x1009e620
call fcn.10006d00
add esp, 4
test eax, eax
jne 0x1003c3fd
cmp dword [0x1012d3e4], ebx
jne 0x1003c3fd
cmp dword [0x33ccfd8], eax
jle 0x1003c3fd
call edi
sub eax, dword [0x101b8990]
cmp eax, 0x4e20
jb 0x1003c404
mov ecx, dword [0x36208e4]
mov eax, dword [ecx + 0x2984]
push 0
cmp eax, 6
jne 0x1003c3da
push 0xf468e
call fcn.1003a1d0
add esp, 8
jmp 0x1003c404
cmp eax, 7
jne 0x1003c3ee
push 0xf468d
call fcn.1003a1d0
add esp, 8
jmp 0x1003c404
push 0x92c0d
call fcn.1003a1d0
add esp, 8
jmp 0x1003c404
call edi
mov dword [0x101b8990], eax
cmp dword [0x10199428], ebx
pop edi
pop ebx
jne 0x1003c41c
cmp dword [0x33d4ad0], 0
jne 0x1003c41c
jmp fcn.1003a3c0
ret
Function at 0x1003c30e
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp dword [0x36208e4], 0
je 0x1003c41c
push ebx
mov ebx, 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x1019a27c], ebx
jne 0x1003c236
call edi
sub eax, dword [0x1011cd7c]
cmp eax, 0x7530
jbe 0x1003c236
call fcn.1003c010
cmp dword [0x10199550], ebx
jne 0x1003c274
cmp dword [0x1012d3e4], ebx
jne 0x1003c274
mov eax, dword [0x36208e4]
cmp dword [eax + 0x2634], 0
jne 0x1003c261
cmp dword [0x1011cd68], 2
jne 0x1003c274
push 3
jmp 0x1003c26c
cmp dword [0x1011cd68], 2
je 0x1003c274
push 4
call fcn.1003ba30
add esp, 4
cmp dword [0x10192e88], ebx
jne case.default.0x1003c2ec
call edi
sub eax, dword [0x1012d210]
cmp eax, 0xbb8
jb case.default.0x1003c2ec
call edi
sub eax, dword [0x1012d238]
cmp eax, 0x7d0
jb case.default.0x1003c2ec
mov eax, dword [0x10191a04]
cmp eax, ebx
jne 0x1003c2c9
cmp dword [0x1011cd68], 2
jne case.default.0x1003c2ec
mov ecx, dword [0x36208e4]
cmp dword [ecx + 0x2984], 0
je 0x1003c2db
jmp case.default.0x1003c2ec
test eax, eax
jne case.default.0x1003c2ec
mov edx, dword [0x36208e4]
cmp dword [edx + 0x2984], eax
jne case.default.0x1003c2ec
call edi
mov dword [0x1012d210], eax
mov eax, dword [0x10192fcc]
cmp eax, 4
ja case.default.0x1003c2ec
jmp dword [eax*4 + 0x1003c420]
push 0
push 0x92c0d
jmp 0x1003c31e
push 0
push 0x92c0e
jmp 0x1003c31e
push 0
push 0x92c0f
jmp 0x1003c31e
push 0
push 0xf468d
jmp 0x1003c31e
push 0
push 0xf468e
call fcn.1003a1d0
add esp, 8
mov eax, dword [0x36208e4]
cmp dword [eax + 0x2984], 0
jle 0x1003c3fd
push 0x1009e638
call fcn.10006d00
add esp, 4
test eax, eax
jne 0x1003c3fd
push 0x1009e630
call fcn.10006d00
add esp, 4
test eax, eax
jne 0x1003c3fd
push 0x1009e650
call fcn.10006d00
add esp, 4
test eax, eax
jne 0x1003c3fd
push 0x1009e640
call fcn.10006d00
add esp, 4
test eax, eax
jne 0x1003c3fd
push 0x1009e620
call fcn.10006d00
add esp, 4
test eax, eax
jne 0x1003c3fd
cmp dword [0x1012d3e4], ebx
jne 0x1003c3fd
cmp dword [0x33ccfd8], eax
jle 0x1003c3fd
call edi
sub eax, dword [0x101b8990]
cmp eax, 0x4e20
jb 0x1003c404
mov ecx, dword [0x36208e4]
mov eax, dword [ecx + 0x2984]
push 0
cmp eax, 6
jne 0x1003c3da
push 0xf468e
call fcn.1003a1d0
add esp, 8
jmp 0x1003c404
cmp eax, 7
jne 0x1003c3ee
push 0xf468d
call fcn.1003a1d0
add esp, 8
jmp 0x1003c404
push 0x92c0d
call fcn.1003a1d0
add esp, 8
jmp 0x1003c404
call edi
mov dword [0x101b8990], eax
cmp dword [0x10199428], ebx
pop edi
pop ebx
jne 0x1003c41c
cmp dword [0x33d4ad0], 0
jne 0x1003c41c
jmp fcn.1003a3c0
ret
Function at 0x1003c317
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp dword [0x36208e4], 0
je 0x1003c41c
push ebx
mov ebx, 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x1019a27c], ebx
jne 0x1003c236
call edi
sub eax, dword [0x1011cd7c]
cmp eax, 0x7530
jbe 0x1003c236
call fcn.1003c010
cmp dword [0x10199550], ebx
jne 0x1003c274
cmp dword [0x1012d3e4], ebx
jne 0x1003c274
mov eax, dword [0x36208e4]
cmp dword [eax + 0x2634], 0
jne 0x1003c261
cmp dword [0x1011cd68], 2
jne 0x1003c274
push 3
jmp 0x1003c26c
cmp dword [0x1011cd68], 2
je 0x1003c274
push 4
call fcn.1003ba30
add esp, 4
cmp dword [0x10192e88], ebx
jne case.default.0x1003c2ec
call edi
sub eax, dword [0x1012d210]
cmp eax, 0xbb8
jb case.default.0x1003c2ec
call edi
sub eax, dword [0x1012d238]
cmp eax, 0x7d0
jb case.default.0x1003c2ec
mov eax, dword [0x10191a04]
cmp eax, ebx
jne 0x1003c2c9
cmp dword [0x1011cd68], 2
jne case.default.0x1003c2ec
mov ecx, dword [0x36208e4]
cmp dword [ecx + 0x2984], 0
je 0x1003c2db
jmp case.default.0x1003c2ec
test eax, eax
jne case.default.0x1003c2ec
mov edx, dword [0x36208e4]
cmp dword [edx + 0x2984], eax
jne case.default.0x1003c2ec
call edi
mov dword [0x1012d210], eax
mov eax, dword [0x10192fcc]
cmp eax, 4
ja case.default.0x1003c2ec
jmp dword [eax*4 + 0x1003c420]
push 0
push 0x92c0d
jmp 0x1003c31e
push 0
push 0x92c0e
jmp 0x1003c31e
push 0
push 0x92c0f
jmp 0x1003c31e
push 0
push 0xf468d
jmp 0x1003c31e
push 0
push 0xf468e
call fcn.1003a1d0
add esp, 8
mov eax, dword [0x36208e4]
cmp dword [eax + 0x2984], 0
jle 0x1003c3fd
push 0x1009e638
call fcn.10006d00
add esp, 4
test eax, eax
jne 0x1003c3fd
push 0x1009e630
call fcn.10006d00
add esp, 4
test eax, eax
jne 0x1003c3fd
push 0x1009e650
call fcn.10006d00
add esp, 4
test eax, eax
jne 0x1003c3fd
push 0x1009e640
call fcn.10006d00
add esp, 4
test eax, eax
jne 0x1003c3fd
push 0x1009e620
call fcn.10006d00
add esp, 4
test eax, eax
jne 0x1003c3fd
cmp dword [0x1012d3e4], ebx
jne 0x1003c3fd
cmp dword [0x33ccfd8], eax
jle 0x1003c3fd
call edi
sub eax, dword [0x101b8990]
cmp eax, 0x4e20
jb 0x1003c404
mov ecx, dword [0x36208e4]
mov eax, dword [ecx + 0x2984]
push 0
cmp eax, 6
jne 0x1003c3da
push 0xf468e
call fcn.1003a1d0
add esp, 8
jmp 0x1003c404
cmp eax, 7
jne 0x1003c3ee
push 0xf468d
call fcn.1003a1d0
add esp, 8
jmp 0x1003c404
push 0x92c0d
call fcn.1003a1d0
add esp, 8
jmp 0x1003c404
call edi
mov dword [0x101b8990], eax
cmp dword [0x10199428], ebx
pop edi
pop ebx
jne 0x1003c41c
cmp dword [0x33d4ad0], 0
jne 0x1003c41c
jmp fcn.1003a3c0
ret
Function at 0x1003c630
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, 1
cmp dword [0x101961a8], ebx
jne 0x1003c66b
mov eax, dword [0x1012d384]
cmp eax, dword [0x101961b4]
jl 0x1003c66b
push 0x1009e72c
call fcn.100080a0
add esp, 4
mov dword [0x1011d17c], 0
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x101961ac], ebx
jne 0x1003c692
mov eax, dword [0x101961b8]
cdq
cmp dword [0x1012d2a4], edx
jl 0x1003c692
jg 0x1003c68b
cmp dword [0x1012d2a0], eax
jb 0x1003c692
push 0x1009e708
jmp 0x1003c654
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x101961a4], ebx
jne 0x1003c6f8
mov eax, dword [0x11f6b60]
cmp dword [eax + 0x30], 0xffffffff
je 0x1003c6bb
cmp byte [0x1012d410], bl
jne 0x1003c6d2
push 0x1009e6fc
call fcn.100080a0
mov ecx, dword [0x100fe7b4]
add esp, 4
push ebx
push ecx
call esi
call edi
sub eax, dword [0x1012d22c]
cmp eax, 0x1d4c0
jb 0x1003c6f8
push 0x1009e6fc
call fcn.100080a0
mov edx, dword [0x100fe7b4]
add esp, 4
push ebx
push edx
call esi
cmp dword [0x101961a0], ebx
jne 0x1003c771
cmp byte [0x1012d3ff], bl
jne 0x1003c71d
mov byte [0x1012d3ff], 0
call edi
pop edi
pop esi
mov dword [0x1011d204], eax
pop ebx
mov esp, ebp
pop ebp
ret
call edi
mov ecx, eax
sub ecx, dword [0x1011d204]
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov eax, 0x88888889
mul edx
shr edx, 5
mov dword [ebp - 4], edx
fild dword [ebp - 4]
test edx, edx
jns 0x1003c74b
fadd dword [0x1009e6f8]
fild dword [0x101961b0]
fcompp
fnstsw ax
test ah, 0x41
jp 0x1003c771
push 0x1009e6fc
call fcn.100080a0
mov edx, dword [0x100fe7b4]
add esp, 4
push ebx
push edx
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003f680
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x100ae8c8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1012d417], 0
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
jne 0x1003f856
push ebx
push eax
push 0xbb8
push esi
push 0x10092e4c
push str.qhlb
mov byte [0x1011b6a8], 0
push str.config
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebx, dword [sym.imp.MSVCR100.dll_strtok]
push 0x1009e920
push esi
call ebx
mov esi, eax
add esp, 8
mov dword [ebp - 0x198], esi
test esi, esi
je 0x1003f855
push edi
jmp 0x1003f6f8
mov esi, dword [ebp - 0x198]
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003f700
sub eax, edx
push 0x1009e980
push esi
mov dword [ebp - 0x19c], eax
xor edi, edi
call ebx
add esp, 8
test eax, eax
je 0x1003f831
lea esi, [ebp - 0x194]
lea ebx, [ebx]
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1003f734
push 0x1009e980
push 0
inc edi
add esi, 0x32
call ebx
add esp, 8
test eax, eax
jne 0x1003f730
cmp edi, 8
jne 0x1003f82b
movzx edx, byte [0x1011b6a8]
lea ecx, [ebp - 0x194]
lea edx, [edx*4 + 0x1011aed8]
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x1003f770
mov esi, dword [sym.imp.MSVCR100.dll_atoi]
lea eax, [ebp - 0x162]
push eax
call esi
movzx ecx, byte [0x1011b6a8]
lea edx, [ebp - 0x130]
push edx
mov byte [ecx + 0x1011b658], al
call esi
movzx ecx, byte [0x1011b6a8]
lea edx, [ebp - 0xfe]
push edx
mov byte [ecx + 0x1011afa0], al
call esi
movzx ecx, byte [0x1011b6a8]
lea edx, [ebp - 0xcc]
push edx
mov byte [ecx + 0x1011af78], al
call esi
movzx ecx, byte [0x1011b6a8]
lea edx, [ebp - 0x9a]
push edx
mov byte [ecx + 0x1011aff0], al
call esi
movzx ecx, byte [0x1011b6a8]
mov byte [ecx + 0x1011afc8], al
movzx eax, byte [0x1011b6a8]
lea edx, [eax + eax*4]
add esp, 0x14
lea ecx, [ebp - 0x68]
lea edx, [edx*4 + 0x1011b018]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x1003f805
lea edx, [ebp - 0x36]
push edx
call esi
movzx ecx, byte [0x1011b6a8]
add esp, 4
mov byte [ecx + 0x1011b680], al
inc byte [0x1011b6a8]
mov esi, dword [ebp - 0x198]
mov edx, dword [ebp - 0x19c]
lea eax, [edx + esi + 1]
push 0x1009e920
push eax
call ebx
add esp, 8
mov dword [ebp - 0x198], eax
test eax, eax
jne 0x1003f6f2
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10086746
mov esp, ebp
pop ebp
ret
Function at 0x1003f870
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x100ae8c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
mov ecx, 0x1019fdd4
call section..text
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push edi
push 0xbb8
push esi
push 0x10092e4c
push str.ZYWP
push str.config
mov byte [esi], 0
call ebx
push 0x1009e920
push esi
mov esi, dword [sym.imp.MSVCR100.dll_strtok]
call esi
add esp, 8
test eax, eax
je 0x1003f8fb
lea esp, [esp]
push eax
mov ecx, 0x1019fdd4
call fcn.10001110
push 0x1009e920
push 0
call esi
add esp, 8
test eax, eax
jne 0x1003f8e0
push edi
push 0x64
lea ecx, [ebp - 0x68]
push ecx
push 0x10094b60
push str.D38CHECK1
push str.config
call ebx
mov esi, dword [sym.imp.MSVCR100.dll_atoi]
lea edx, [ebp - 0x68]
push edx
call esi
add esp, 4
push edi
push 0x64
mov dword [0x1019cd08], eax
lea eax, [ebp - 0x68]
push eax
push 0x10094b60
push str.D38CHECK3
push str.config
call ebx
lea ecx, [ebp - 0x68]
push ecx
call esi
add esp, 4
push edi
push 0x64
lea edx, [ebp - 0x68]
push edx
push 0x10094b60
push str.D38EDIT2
push str.config
mov dword [0x1019cd0c], eax
call ebx
lea eax, [ebp - 0x68]
push eax
call esi
add esp, 4
push edi
push 0x64
lea ecx, [ebp - 0x68]
push ecx
push 0x10094b60
push str.D38EDIT3
push str.config
mov dword [0x1019cd04], eax
call ebx
lea edx, [ebp - 0x68]
push edx
call dword [sym.imp.MSVCR100.dll__atoi64]
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
xor ecx, ebp
mov dword [0x1019cd10], eax
mov dword [0x1019cd14], edx
pop ebx
call fcn.10086746
mov esp, ebp
pop ebp
ret
Function at 0x1003fc90
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x100ae8c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call sub.MSVCR100.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 0xc
push esi
push 0x64
lea ecx, [ebp - 0x68]
push ecx
push 0x10094b60
push str.D7CHECK1
push str.config
call edi
mov ebx, dword [sym.imp.MSVCR100.dll_atoi]
lea edx, [ebp - 0x68]
push edx
call ebx
add esp, 4
push esi
push 0x64
mov dword [0x101956bc], eax
lea eax, [ebp - 0x68]
push eax
push 0x10094b60
push str.D7CHECK2
push str.config
call edi
lea ecx, [ebp - 0x68]
push ecx
call ebx
add esp, 4
push esi
push 0x64
lea edx, [ebp - 0x68]
push edx
push 0x10094b60
push str.D7CHECK3
push str.config
mov dword [0x101956c0], eax
call edi
lea eax, [ebp - 0x68]
push eax
call ebx
add esp, 4
push esi
push 0x64
lea ecx, [ebp - 0x68]
push ecx
push 0x10094b60
push str.D7CHECK4
push str.config
mov dword [0x101956c4], eax
call edi
lea edx, [ebp - 0x68]
push edx
call ebx
add esp, 4
push esi
push 0x64
mov dword [0x101956d0], eax
lea eax, [ebp - 0x68]
push eax
push 0x10094b60
push str.D7CHECK5
push str.config
call edi
lea ecx, [ebp - 0x68]
push ecx
call ebx
add esp, 4
push esi
push 0x64
lea edx, [ebp - 0x68]
mov dword [0x101956dc], eax
push edx
push 0x10094b60
push str.D7CHECK6
push str.config
call edi
lea eax, [ebp - 0x68]
push eax
call ebx
add esp, 4
push esi
push 0x64
lea ecx, [ebp - 0x68]
push ecx
push 0x10094b60
push str.D7EDIT1
push str.config
mov dword [0x1019588c], eax
call edi
lea edx, [ebp - 0x68]
push edx
call ebx
add esp, 4
push esi
push 0x64
mov dword [0x101956c8], eax
lea eax, [ebp - 0x68]
push eax
push 0x10094b60
push str.D7EDIT2
push str.config
call edi
lea ecx, [ebp - 0x68]
push ecx
call ebx
add esp, 4
push esi
push 0x64
lea edx, [ebp - 0x68]
push edx
push 0x10094b60
push str.D7EDIT3
push str.config
mov dword [0x101956cc], eax
call edi
lea eax, [ebp - 0x68]
push eax
call ebx
add esp, 4
push esi
push 0x64
lea ecx, [ebp - 0x68]
push ecx
push 0x10094b60
push str.D7EDIT4
push str.config
mov dword [0x101956d4], eax
call edi
lea edx, [ebp - 0x68]
push edx
mov ecx, 0x101956e0
call sub.mfc100.dll_Ordinal_12868
push esi
push 0x64
lea eax, [ebp - 0x68]
push eax
push 0x10094b60
push str.D7COMBO1
push str.config
call edi
lea ecx, [ebp - 0x68]
push ecx
call ebx
add esp, 4
push esi
push 0x64
lea edx, [ebp - 0x68]
push edx
push 0x10094b60
push str.D7COMBO2
push str.config
mov dword [0x101956d8], eax
call edi
lea eax, [ebp - 0x68]
push eax
mov ecx, 0x10195890
call sub.mfc100.dll_Ordinal_12868
push 0
mov ecx, 0x10195628
call sub.mfc100.dll_Ordinal_13219
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10086746
mov esp, ebp
pop ebp
ret
Function at 0x1003feb0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x100ae8c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call sub.MSVCR100.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 0xc
push esi
push 0x64
lea ecx, [ebp - 0x68]
push ecx
push 0x10094b60
push str.D13CHECK1
push str.config
call edi
mov ebx, dword [sym.imp.MSVCR100.dll_atoi]
lea edx, [ebp - 0x68]
push edx
call ebx
add esp, 4
push esi
push 0x64
mov dword [0x10199550], eax
lea eax, [ebp - 0x68]
push eax
push 0x10094b60
push str.D13CHECK3
push str.config
call edi
lea ecx, [ebp - 0x68]
push ecx
call ebx
add esp, 4
push esi
push 0x64
lea edx, [ebp - 0x68]
push edx
push 0x10094b60
push str.D13CHECK4
push str.config
mov dword [0x10199424], eax
call edi
lea eax, [ebp - 0x68]
push eax
call ebx
add esp, 4
push esi
push 0x64
lea ecx, [ebp - 0x68]
push ecx
push 0x10094b60
push str.D13COMBO3
push str.config
mov dword [0x10199428], eax
call edi
lea edx, [ebp - 0x68]
push edx
call ebx
add esp, 4
push 0
mov ecx, 0x10199390
mov dword [0x1019954c], eax
call sub.mfc100.dll_Ordinal_13219
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10086746
mov esp, ebp
pop ebp
ret
Function at 0x10046150
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x100ae8c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.1006ef80
push 0x32
lea eax, [ebp - 0x38]
push eax
mov ecx, 0x10194088
call sub.mfc100.dll_Ordinal_6969
push 0x32
lea ecx, [ebp - 0x6c]
push ecx
mov ecx, 0x10194134
call sub.mfc100.dll_Ordinal_6969
lea edx, [ebp - 0x38]
push edx
push 0x1009ed88
push 0x1012d4d8
call dword [sym.imp.MSVCR100.dll_sprintf]
mov edi, 1
add esp, 0xc
cmp dword [0x101971b0], edi
jne 0x100461b7
lea eax, [ebp - 0x38]
push eax
jmp 0x100462b0
push 0x1012d4d8
call fcn.10006c80
add esp, 4
test eax, eax
je 0x100461d8
push edi
push 0x1012d4d8
call fcn.10006ad0
jmp 0x100462bb
mov ecx, 0x1009ed80
lea eax, [ebp - 0x6c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10046200
test dl, dl
je 0x100461fc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10046200
add eax, 2
add ecx, 2
test dl, dl
jne 0x100461e0
xor eax, eax
jmp 0x10046205
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1004629a
mov esi, dword [0x35f42ac]
push ebx
xor ebx, ebx
xor edi, edi
call fcn.10006aa0
test eax, eax
je 0x1004626f
add esi, 0x53c
mov eax, dword [esi]
test eax, eax
je 0x1004625e
lea ecx, [eax + 0x64]
mov eax, 0x1009d65c
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10046255
test dl, dl
je 0x10046251
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10046255
add eax, 2
add ecx, 2
test dl, dl
jne 0x10046235
xor eax, eax
jmp 0x1004625a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1004626d
inc edi
add esi, 4
call fcn.10006aa0
cmp edi, eax
jb 0x10046227
jmp 0x1004626f
mov ebx, edi
mov ecx, dword [0x10194154]
push ebx
push 0
push 0
push 0x147
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
add eax, 9
push eax
call fcn.10039b40
add esp, 8
mov edi, 1
pop ebx
jmp 0x100462be
push edi
push 0x100943ec
call fcn.10006ad0
add esp, 8
test al, al
jne 0x100462be
lea edx, [ebp - 0x38]
push edx
call fcn.10007910
push eax
call fcn.1003b0a0
add esp, 8
cmp dword [0x10190e2c], edi
jne 0x10046353
lea eax, [ebp - 0x110]
push eax
mov dword [ebp - 0x110], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov esi, 2
cmp dword [ebp - 0x100], esi
jne 0x10046349
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x114]
push ecx
push 0x20
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea edx, [ebp - 0x11c]
push edx
push str.SeShutdownPrivilege
push 0
mov dword [ebp - 0x7c], edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x118]
push 0
push 0
push 0
lea edx, [ebp - 0x7c]
push edx
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x114]
push 0
push eax
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], esi
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 8
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10086746
mov esp, ebp
pop ebp
ret