joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005a670
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x101ba0ec]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x101c82b4], 0
push ebx
push esi
push edi
je 0x1005a6f8
call fcn.100ebaf0
test al, al
je 0x1005a6ac
push ebp
push eax
pop ecx
push edx
pop ecx
pop ebx
pop ecx
pop ebp
push esp
push edi
pop ebx
pop esi
pop ebp
pop edx
push esp
push ebp
push edx
pop edi
pop eax
push esi
call fcn.100ebe70
test al, al
je 0x1005a6d1
pop edi
push edi
pop esp
pop edi
push ebp
push edi
push ebx
pop esi
pop esi
pop edi
pop ebp
push ecx
push edx
pop ebx
pop ebx
pop eax
push ebp
pop esi
push edx
pop esi
pop edi
push esi
push ebp
pop ebp
push eax
pop edi
pop edx
push edi
call fcn.100eb770
test al, al
je 0x1005a7ef
push esp
pop edx
push edi
pop ebp
pop eax
push ebp
push ecx
pop esi
push esp
pop edi
pop ecx
pop edx
push edx
pop ecx
push esp
push ebx
pop edx
pop edi
push edx
push edi
push ebp
jmp 0x1005a7ef
call fcn.100eb770
test al, al
je 0x1005a71c
pop edx
push ecx
pop edi
push esi
pop ebp
push ebp
push esp
pop ebp
push ebx
push ecx
push ecx
pop esi
push ebp
push ebp
pop esp
push eax
pop edi
push esp
push ebx
push ebp
push eax
pop ecx
pop ebx
pop edi
pop esp
pop esi
pop ebx
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.1012bd00
add esp, 0xc
lea eax, [ebp - 0x210]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1005a78c
lea eax, [ebp - 0x210]
push eax
call fcn.1013c88a
lea eax, [ebp - 0x210]
push str.config_systemprofile
push eax
call fcn.1012af47
add esp, 0xc
test eax, eax
jne 0x1005a785
lea eax, [ebp - 0x210]
push str.documents_and_settingslocalservice
push eax
call fcn.1012af47
add esp, 8
test eax, eax
je 0x1005a78c
mov byte [0x101c82b4], 1
call fcn.100ebee0
test al, al
je 0x1005a7a7
pop ecx
push ecx
push esi
push edx
push eax
pop esi
push eax
push ebx
pop ebx
push esi
push eax
push eax
push edi
push ebp
pop esi
push esp
pop eax
push esp
call fcn.100ebaf0
test al, al
je 0x1005a7cb
push edx
push esi
push esi
push edi
push esi
push edi
pop edi
push esi
push ecx
push esp
push esp
push edx
push ecx
pop esp
push esp
push ebx
pop edi
pop edx
pop ebp
pop ebx
pop esi
push esp
pop ebx
pop edx
pop eax
pop esi
push ebx
call fcn.100ebaf0
test al, al
je 0x1005a7ef
push ebx
pop ebp
pop edi
push esi
pop esp
pop ecx
pop ebx
pop edi
pop eax
pop edi
pop edi
push edx
pop eax
pop ecx
push eax
push edi
push ecx
pop edi
pop esi
push ebp
push esp
push esi
push edx
push edi
push esi
push edx
push ebp
mov ecx, dword [ebp - 4]
mov al, byte [0x101c82b4]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1010a832
mov esp, ebp
pop ebp
ret
Function at 0x1005aac0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x101ba0ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x21c], ecx
sub esp, 8
mov dword [ebp - 0x214], ebx
lea edx, [ebp - 0x210]
call fcn.1005a810
lea ecx, [ebp - 0x210]
add esp, 8
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005ab00
sub ecx, edx
sar ecx, 1
mov dword [ebp - 0x218], ecx
call fcn.100eb9a0
test al, al
je 0x1005ab3d
pop esp
push ecx
pop ebx
push ecx
pop ecx
pop edi
pop ecx
pop esi
push ebx
pop esp
pop ecx
push esi
push edx
push edx
push ebx
push edi
push ebx
push esi
pop esp
pop edx
push ebp
pop eax
push ebx
push edx
push ebp
mov ebx, dword [ebp - 0x214]
cmp dword [ebp - 0x218], 0
je 0x1005aca2
lea edi, [ebp - 0x210]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x1005ab53
mov eax, dword [0x1018443c]
mov esi, ebx
mov dword [edi], eax
nop dword [eax + eax]
mov cx, word [ebx]
add ebx, 2
test cx, cx
jne 0x1005ab70
lea edi, [ebp - 0x210]
sub ebx, esi
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x1005ab86
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x210]
add edi, 0xfffffffe
nop dword [eax]
mov cx, word [edi + 2]
lea edi, [edi + 2]
test cx, cx
jne 0x1005abb0
mov dword [edi], eax
call fcn.100eb770
test al, al
je 0x1005abe2
pop ebx
pop ecx
push ecx
push edx
pop ebp
push edx
pop esp
push ecx
pop ecx
push esp
push ecx
push esp
pop esi
pop eax
push esp
push ebp
push edi
pop ecx
pop ebx
push ebp
pop edi
push ebx
push esi
push ebx
push ebx
pop ebp
push edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1005ac02
lea eax, [ebp - 0x210]
push eax
call fcn.10110097
add esp, 4
call fcn.100ebaf0
test al, al
je 0x1005ac1f
push ebp
push eax
pop ecx
push edx
pop ecx
pop ebx
pop ecx
pop ebp
push esp
push edi
pop ebx
pop esi
pop ebp
pop edx
push esp
push ebp
push edx
pop edi
pop eax
push esi
call fcn.100ebe70
test al, al
je 0x1005ac44
pop edi
push edi
pop esp
pop edi
push ebp
push edi
push ebx
pop esi
pop esi
pop edi
pop ebp
push ecx
push edx
pop ebx
pop ebx
pop eax
push ebp
pop esi
push edx
pop esi
pop edi
push esi
push ebp
pop ebp
push eax
pop edi
pop edx
push edi
call fcn.100eb770
test al, al
je 0x1005ac62
push esp
pop edx
push edi
pop ebp
pop eax
push ebp
push ecx
pop esi
push esp
pop edi
pop ecx
pop edx
push edx
pop ecx
push esp
push ebx
pop edx
pop edi
push edx
push edi
push ebp
cmp word [ebp - 0x210], 0
jne 0x1005ac70
xor ecx, ecx
jmp 0x1005ac8f
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005ac80
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x21c]
lea eax, [ebp - 0x210]
push eax
call fcn.10041f80
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1010a832
mov esp, ebp
pop ebp
ret
Function at 0x1005ad90
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [0x101ba0ec]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
je 0x1005ae05
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.1012bd00
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 5
jg 0x1005adf5
cmp dword [ebp - 0x118], 2
jle 0x1005ae05
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010a832
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
push esi
mov esi, dword [edx + 0x14]
cmp esi, 8
jb 0x1005ae15
mov ecx, dword [edx]
jmp 0x1005ae17
mov ecx, edx
push ebx
push edi
mov edi, dword [edx + 0x10]
mov ebx, 0x3400
add edi, edi
mov dword [ebp - 0x124], 0x4db5
mov dword [ebp - 0x128], 0xe815
mov dword [ebp - 0x12c], 0xe86f
mov dword [ebp - 0x130], 0x19b5
nop dword [eax + eax]
cmp esi, 8
jb 0x1005ae59
mov eax, dword [edx]
jmp 0x1005ae5b
mov eax, edx
add eax, edi
cmp ecx, eax
je 0x1005aead
movzx eax, word [ecx]
cmp ax, bx
jb 0x1005ae72
cmp ax, word [ebp - 0x124]
jbe 0x1005ae97
cmp ax, word [ebp - 0x128]
jb 0x1005ae84
cmp ax, word [ebp - 0x12c]
jbe 0x1005ae97
add eax, 0xffffcc00
cmp ax, word [ebp - 0x130]
jbe 0x1005ae97
add ecx, 2
jmp 0x1005ae50
pop edi
pop ebx
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010a832
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.1010a832
mov esp, ebp
pop ebp
ret

Function at 0x1005aec0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x101ba0ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x11c
xor edi, edi
lea eax, [ebp - 0x120]
push edi
push eax
mov ebx, ecx
call fcn.1012bd00
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x1005af46
cmp dword [ebp - 0x11c], 6
jb 0x1005af46
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
push str.ChangeWindowMessageFilter
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1005af3f
push 1
push ebx
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
test edi, edi
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.1010a832
mov esp, ebp
pop ebp
ret
Function at 0x1005b0c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101590f5
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
mov eax, dword [0x101ba0ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x101c82ac]
test esi, esi
jne 0x1005b11f
push 0x1c8
call fcn.1010a843
mov esi, eax
add esp, 4
mov dword [ebp - 0xdc], esi
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.1003f040
mov dword [0x101c82ac], esi
add esi, 0x54
cmp dword [esi + 0x14], 8
jb 0x1005b12a
mov esi, dword [esi]
push esi
push 0x64
lea eax, [ebp - 0xd8]
push eax
push 0x1018444c
push str.UserID
push 0x1018f350
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0xd8]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005b152
sub ecx, edx
sar ecx, 1
cmp ecx, 1
setg al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1010a832
mov esp, ebp
pop ebp
ret
Function at 0x1005b280
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159171
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x101ba0ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test edi, edi
jne 0x1005b2bf
xor al, al
jmp 0x1005b479
call fcn.1005b9f0
push 0x208
mov esi, eax
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.1012bd00
add esp, 0xc
lea eax, [ebp - 0x230]
push edi
push eax
call fcn.1005b630
push esi
push 0x104
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x218]
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push ecx
cmovae eax, dword [ebp - 0x230]
push 0x1018444c
push eax
push str.user
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, 0x1018444c
lea eax, [ebp - 0x218]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1005b356
test dx, dx
je 0x1005b352
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1005b356
add eax, 4
add ecx, 4
test dx, dx
jne 0x1005b330
xor eax, eax
jmp 0x1005b35b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1005b3ef
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], eax
mov word [ebp - 0x248], ax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x248]
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push ecx
cmovae eax, dword [ebp - 0x230]
push eax
push ecx
call fcn.1005b4a0
lea ecx, [ebp - 0x248]
test al, al
jne 0x1005b3b6
call fcn.100420d0
xor bl, bl
jmp 0x1005b459
cmp dword [ebp - 0x234], 8
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x248]
nop word [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x1005b3d0
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], al
call fcn.100420d0
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.1005b840
lea eax, [ebp - 0x260]
mov byte [ebp - 4], 2
cmp ebx, eax
je 0x1005b41c
push 0xffffffffffffffff
push 0
push eax
mov ecx, ebx
call fcn.10041c10
mov eax, dword [ebp - 0x24c]
mov bl, 1
cmp eax, 8
jb 0x1005b43c
inc eax
lea ecx, [ebp - 0x260]
push eax
push dword [ebp - 0x260]
call fcn.10042120
xor eax, eax
mov dword [ebp - 0x24c], 7
mov dword [ebp - 0x250], 0
mov word [ebp - 0x260], ax
mov ecx, dword [ebp - 0x21c]
cmp ecx, 8
jb 0x1005b477
inc ecx
push ecx
push dword [ebp - 0x230]
lea ecx, [ebp - 0x230]
call fcn.10042120
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1010a832
mov esp, ebp
pop ebp
ret 8
Function at 0x1005ba90
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159225
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
mov eax, dword [0x101ba0ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x101c82ac]
mov edi, dword [ebp + 8]
test esi, esi
jne 0x1005bafa
push 0x1c8
call fcn.1010a843
mov esi, eax
add esp, 4
mov dword [ebp - 0xdc], esi
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.1003f040
mov dword [ebp - 4], 0xffffffff
mov dword [0x101c82ac], esi
add esi, 0x54
cmp dword [esi + 0x14], 8
jb 0x1005bb05
mov esi, dword [esi]
push esi
push 0x64
lea eax, [ebp - 0xd8]
push eax
push 0x1018444c
push str.UserID
push 0x1018f350
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0xd8], 0
jne 0x1005bb32
xor ecx, ecx
jmp 0x1005bb4f
lea ecx, [ebp - 0xd8]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005bb40
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0xd8]
mov ecx, edi
push eax
call fcn.10041f80
cmp dword [edi + 0x10], 0
seta al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1010a832
mov esp, ebp
pop ebp
ret 4

Function at 0x1005bc90
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x101ba0ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.1005bb90
push 0x208
mov esi, eax
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.1012bd00
add esp, 0xc
lea eax, [ebp - 0x414]
push esi
push 0x104
push eax
push str.null
push str.FirstInstallDate
push 0x1018f868
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.1012bd00
call fcn.1011219b
push eax
lea eax, [ebp - 0x20c]
push 0x1018f870
push eax
call fcn.10041b40
add esp, 0x18
lea eax, [ebp - 0x20c]
lea ecx, [ebp - 0x414]
pop esi
nop dword [eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x1005bd57
test dx, dx
je 0x1005bd42
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x1005bd57
add ecx, 4
add eax, 4
test dx, dx
jne 0x1005bd20
xor eax, eax
test eax, eax
sete al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010a832
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
sbb eax, eax
or eax, 1
test eax, eax
sete al
xor ecx, ebp
call fcn.1010a832
mov esp, ebp
pop ebp
ret
Function at 0x1005bd70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.1005bc30
test al, al
je 0x1005be15
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
call fcn.1005b190
test al, al
je 0x1005be15
cmp dword [ebp - 4], 1
jg 0x1005be15
call fcn.1005bb90
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
push edi
push 0
push str.ShowDay1
push str.VipExpire
call esi
push edi
push 0
push str.ShowDay2
push str.VipExpire
mov ebx, eax
call esi
push edi
push 0
push str.ShowDay3
push str.VipExpire
mov dword [ebp - 4], eax
call esi
test ebx, ebx
je 0x1005bdf3
cmp dword [ebp - 4], 0
jne 0x1005bdfc
call fcn.1011219b
sub eax, ebx
cmp eax, 3
jl 0x1005be15
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x1005be15
call fcn.1011219b
sub eax, ebx
cmp eax, 7
jl 0x1005be15
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1005d7e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159416
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x101ba0ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
lea edi, [ebx + 8]
mov dword [ebx], vtable.Config.0
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
cmp dword [edi + 0x14], 0x10
jb 0x1005d82e
mov eax, dword [edi]
jmp 0x1005d830
mov eax, edi
mov byte [eax], 0
mov dword [ebp - 4], 0
lea esi, [ebx + 0x30]
xor eax, eax
mov dword [ebp - 0x14], esi
mov word [ebx + 0x20], ax
xorps xmm0, xmm0
movq qword [ebx + 0x22], xmm0
mov dword [ebx + 0x2a], eax
mov word [ebx + 0x2e], ax
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.10044090
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 1
cmp edi, eax
je 0x1005d878
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
call fcn.100461b0
cmp dword [edi + 0x14], 0x10
jb 0x1005d882
mov eax, dword [edi]
jmp 0x1005d884
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1005d8a4
cmp dword [edi + 0x14], 0x10
jb 0x1005d897
mov edi, dword [edi]
lea eax, [ebx + 0x38]
push eax
push edi
call fcn.101403ae
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1005dd50
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3ec
mov eax, dword [0x101ba0ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add ecx, 8
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
cmp dword [ecx + 0x14], 0x10
jb 0x1005dd78
mov ecx, dword [ecx]
cmp dword [edx + 0x14], 0x10
jb 0x1005dd80
mov edx, dword [edx]
cmp dword [eax + 0x14], 0x10
jb 0x1005dd88
mov eax, dword [eax]
push ecx
push 0x190
lea ecx, [ebp - 0x3ec]
push ecx
push 0x10184650
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x1005de0b
cmp byte [ebp - 0x3ec], 0
jne 0x1005ddd3
xor ecx, ecx
lea eax, [ebp - 0x3ec]
push ecx
push eax
mov ecx, esi
call fcn.10046530
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010a832
mov esp, ebp
pop ebp
ret 0xc
lea ecx, [ebp - 0x3ec]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005dde0
sub ecx, edx
lea eax, [ebp - 0x3ec]
push ecx
push eax
mov ecx, esi
call fcn.10046530
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010a832
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.1010a832
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1005de20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159498
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x101ba0ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
cmp dword [ecx + 0x1c], 0x10
lea ebx, [ecx + 8]
mov dword [ebp - 0x24], ebx
jb 0x1005de5b
mov eax, dword [ebx]
jmp 0x1005de5d
mov eax, ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x1005de7c
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
call fcn.10044090
mov esi, eax
mov dword [ebp - 0x2c], esi
mov edx, dword [ebp - 0x10]
mov dword [ebp - 4], 0
mov edi, dword [edx + 0x30]
mov dword [ebp - 0x20], edi
mov ecx, dword [edi]
mov dword [ebp - 0x18], ecx
cmp ecx, edi
je 0x1005df3d
mov esi, dword [ecx + 0x28]
lea eax, [ecx + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
cmp eax, esi
je 0x1005df21
mov edi, dword [ebp - 0x1c]
add eax, 0x10
mov ecx, edx
mov dword [ebp - 0x1c], eax
lea ebx, [eax + 0x18]
push ebx
push eax
push edi
call fcn.1005dd50
push edi
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x2c]
call fcn.1005e560
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x3c]
push dword [ebp - 0x1c]
push eax
lea ecx, [ecx + 0x28]
call fcn.1005c510
mov ecx, dword [ebp - 0x3c]
add ecx, 0x28
cmp ecx, ebx
je 0x1005df0c
push 0xffffffffffffffff
push 0
push ebx
call fcn.100461b0
lea ecx, [ebp - 0x14]
call fcn.10043dd0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
cmp eax, esi
jne 0x1005dec6
mov edi, dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
call fcn.10043dd0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
cmp ecx, edi
jne 0x1005deb1
mov esi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x2c]
lea edi, [edx + 0x30]
cmp edi, eax
je 0x1005df5a
mov eax, dword [edi]
mov dword [edi], esi
mov ecx, dword [edi + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [edi + 4], eax
mov dword [ebp - 0x28], ecx
cmp dword [ebx + 0x14], 0x10
jb 0x1005df62
mov ebx, dword [ebx]
lea eax, [edx + 0x38]
push eax
push ebx
call fcn.101403ae
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
add esp, 8
push eax
push dword [eax]
lea eax, [ebp - 0x24]
push eax
call fcn.1005e070
push dword [ebp - 0x2c]
call fcn.100e3fa0
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10060c10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101595e8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x101ba0ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10060d3e
cmp byte [ebx + 0x3d], 0
je 0x10060d3e
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x10060c69
xor al, al
jmp 0x10060d40
push 0
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.100611d0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x10060ccf
sub eax, 1
je 0x10060cd3
mov ecx, dword [ebp - 0x14]
sub eax, 2
je 0x10060d26
xor bl, bl
jmp 0x10060d28
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x10060d08
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.1013f8a0
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x10060ccb
cmp byte [ebx + 0x3d], 0
je 0x10060d26
test esi, esi
jne 0x10060c91
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.1004b2d0
jmp 0x10060c8e
mov bl, 1
cmp ecx, 0x10
jb 0x10060d3a
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.10046700
mov al, bl
jmp 0x10060d40
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1010a832
mov esp, ebp
pop ebp
ret