joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e7be0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push dword [esp + 0x24]
call fcn.100b2650
mov edx, dword [ebp + 0xc]
mov ebx, eax
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x14], ebx
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [0x102448a8]
mov esi, eax
add esp, 8
test esi, esi
je 0x100e7d62
lea ecx, [esi + 0xc]
mov dword [esi], ebp
mov dword [esi + 4], ecx
mov eax, dword [ebp + 0xc]
add eax, ecx
mov dword [esi + 8], eax
push edi
lea edi, [ebp + 4]
cmp ebx, dword [ebp + 0x10]
jbe 0x100e7c62
mov eax, dword [ebp]
push ecx
call eax
mov eax, dword [esp + 0x28]
push ebx
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebp + 0xc]
push dword [esi + 4]
mov dword [esp + 0x38], eax
push eax
mov eax, dword [ebp + 8]
call eax
mov eax, dword [ebp + 0x14]
add esp, 0x18
mov dword [esp + 0x14], eax
push dword [esi + 4]
mov eax, dword [ebp]
call eax
push dword [esi + 8]
mov eax, dword [ebp]
call eax
mov eax, dword [esp + 0x1c]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x100e7cd3
mov ebp, dword [esp + 0x24]
mov ebx, eax
mov dword [esp + 0x18], eax
nop dword [eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x13], al
lea eax, [esp + 0x13]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x1f], al
lea eax, [esp + 0x1f]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub ebx, 1
jne 0x100e7c90
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
cmp ebx, dword [ebp + 0x10]
jae 0x100e7d05
nop dword [eax + eax]
mov eax, dword [edi]
push 1
push 0x1022adb0
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0x1022adb1
push dword [esi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [ebp + 0x10]
jb 0x100e7ce0
push dword [esp + 0x30]
call fcn.100b2650
mov ecx, dword [esi]
push eax
push dword [esp + 0x34]
push dword [esi + 4]
mov eax, dword [ecx + 4]
call eax
mov edi, dword [esp + 0x44]
add esp, 0x10
mov ebx, dword [esi]
test edi, edi
jne 0x100e7d30
mov edi, dword [ebx + 0xc]
add edi, dword [esi + 8]
push dword [esi + 4]
mov eax, dword [ebx + 8]
push edi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push edi
push dword [esi + 8]
call eax
push dword [esi + 8]
mov eax, dword [ebx + 8]
push edi
call eax
push esi
call dword [0x102448ac]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop esi
pop ebp
mov eax, 0x1b
pop ebx
add esp, 0xc
ret
Function at 0x100e9520
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x100e956c
push ebx
mov ebx, dword [esp + 0x10]
mov cl, byte [esi + ebx]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [esi + ebx], cl
inc esi
cmp esi, edi
jb 0x100e9531
pop ebx
pop edi
pop esi
ret
Function at 0x100ed1a0
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
lea edi, [ebp - 0x30]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x10244c40]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x100ed31c
mov dword [ebp - 0x28], 0x1c
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x100ed309
cmp dword [ebp - 0x28], 0x10
jb 0x100ed2ed
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, esp
call fcn.100f0594
cmp dword [ebp - 0x1c], eax
jne 0x100ed2ed
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, esp
call fcn.100f0594
cmp dword [ebp - 0x20], eax
je 0x100ed2ed
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x100ed274
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0x80
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
shl edx, 2
mov esi, esp
push edx
push 0
mov eax, dword [0x10249e24]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp esi, esp
call fcn.100f0594
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x100ed272
jmp 0x100ed309
jmp 0x100ed2cd
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 4]
jb 0x100ed2cd
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 1
shl ecx, 2
mov esi, esp
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [0x10249e24]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
cmp esi, esp
call fcn.100f0594
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x100ed2b7
jmp 0x100ed309
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
shl eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x30]
mov dword [edx], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x20]
mov dword [ecx + edx*4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + 8], edx
mov dword [ebp - 0x28], 0x1c
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x100ed1f3
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100f0594
push edx
mov ecx, ebp
push eax
lea edx, [0x100ed348]
call fcn.100f0540
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ef5dc
add esp, 0x30
cmp ebp, esp
call fcn.100f0594
mov esp, ebp
pop ebp
ret
Function at 0x100ed360
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.100ed1a0
add esp, 4
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x100ed42b
mov dword [ebp - 4], 0
jmp 0x100ed3bc
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 8]
jae 0x100ed42b
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov esi, esp
mov ecx, dword [ebp - 4]
mov edx, dword [eax + ecx*4]
push edx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.100f0594
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100ed429
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.100f0594
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.100ecfc0
add esp, 0xc
mov esi, esp
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100f0594
jmp 0x100ed3b3
pop esi
add esp, 8
cmp ebp, esp
call fcn.100f0594
mov esp, ebp
pop ebp
ret

Function at 0x100ed440
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x100ed4eb
mov dword [ebp - 4], 0
jmp 0x100ed473
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 8]
jae 0x100ed4ce
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov esi, esp
mov eax, dword [ebp - 4]
mov ecx, dword [edx + eax*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.100f0594
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100ed4cc
mov esi, esp
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.100f0594
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100f0594
jmp 0x100ed46a
mov esi, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x10249e24]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, esp
call fcn.100f0594
pop esi
add esp, 8
cmp ebp, esp
call fcn.100f0594
mov esp, ebp
pop ebp
ret
Function at 0x100ed500
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x1024a1b0]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x100ed563
mov eax, dword [ebp - 0x18]
sub eax, 5
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
add ecx, 2
mov dword [ebp - 0x14], ecx
mov esi, esp
lea edx, [ebp - 0xc]
push edx
push 0x40
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.100f0594
test eax, eax
jne 0x100ed58e
mov eax, 0xa
jmp 0x100ed690
cmp dword [ebp + 0xc], 0
je 0x100ed5da
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0xe9
mov ecx, dword [ebp - 0x18]
add ecx, 5
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 1], eax
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 1
movzx ecx, al
test ecx, ecx
je 0x100ed5d8
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov byte [ecx], 0xeb
mov edx, dword [ebp - 0x20]
mov byte [edx + 1], 0xf9
jmp 0x100ed616
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x100ed601
push 7
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x100ed616
push 5
mov edx, dword [ebp - 4]
add edx, 0xc
push edx
mov eax, dword [ebp - 0x18]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov esi, esp
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.100f0594
mov esi, esp
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.100f0594
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp esi, esp
call fcn.100f0594
mov cl, byte [ebp + 0xc]
and cl, 1
shl cl, 1
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 0xfd
or al, cl
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x14], al
mov dl, byte [ebp + 0xc]
and dl, 1
shl dl, 2
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 0xfb
or cl, dl
mov edx, dword [ebp - 4]
mov byte [edx + 0x14], cl
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x100ed6b4]
call fcn.100f0540
pop eax
pop edx
pop edi
pop esi
add esp, 0x20
cmp ebp, esp
call fcn.100f0594
mov esp, ebp
pop ebp
ret
Function at 0x100edd80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [0x1024a1a8]
mov dword [ebp - 4], eax
jmp 0x100edda7
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x100eddc0
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x100eddbe
mov eax, dword [ebp - 4]
jmp 0x100ede44
jmp 0x100edd9f
mov esi, esp
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.100f0594
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100ede41
mov ecx, dword [ebp - 4]
add ecx, 0x20
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
cmp ecx, 0xfe0
jbe 0x100ede03
mov edx, dword [ebp - 4]
mov eax, dword [0x1024a1a8]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x1024a1a8], ecx
mov eax, dword [ebp - 4]
pop esi
add esp, 8
cmp ebp, esp
call fcn.100f0594
mov esp, ebp
pop ebp
ret

Function at 0x100ee330
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xcccccccc
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x100ee380
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x100ee380
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x100ee380
xor eax, eax
jmp 0x100ee3c1
mov dword [ebp - 4], 1
jmp 0x100ee392
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x100ee3bc
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x100ee3ba
xor eax, eax
jmp 0x100ee3c1
jmp 0x100ee389
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10001dc0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
mov eax, dword [0x10077154]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x18], str..._ini_GameSetup.ini
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push str..._Settings.ini
push 0
push str.FullScreen
push str.Screen
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
jbe 0x10001ec6
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
lea edx, [ebp - 0x70]
push edx
call fcn.10002540
add esp, 8
mov dword [ebp - 0xbc], eax
mov ecx, dword [ebp - 0xbc]
call fcn.100023b0
push eax
push str.ScrWidth
push str.ScreenMode
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [ebp - 0x70]
call fcn.10001cf0
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
push ecx
lea edx, [ebp - 0x88]
push edx
call fcn.10002540
add esp, 8
mov dword [ebp - 0xbc], eax
mov ecx, dword [ebp - 0xbc]
call fcn.100023b0
push eax
push str.ScrHeight
push str.ScreenMode
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [ebp - 0x88]
call fcn.10001cf0
mov eax, dword [ebp - 0x18]
push eax
push 0x1005f430
push str.FullScrType
push str.ScreenMode
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [ebp - 0x18]
push eax
push 0x1005f440
push str.ScreenModeRecord
push str.ScreenMode
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x10001f82
mov eax, dword [ebp - 0x18]
push eax
push 0x400
lea ecx, [ebp - 0xa0]
push ecx
call fcn.10002540
add esp, 8
mov dword [ebp - 0xbc], eax
mov ecx, dword [ebp - 0xbc]
call fcn.100023b0
push eax
push str.ScrWidth
push str.ScreenMode
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [ebp - 0xa0]
call fcn.10001cf0
mov eax, dword [ebp - 0x18]
push eax
push 0x300
lea ecx, [ebp - 0xb8]
push ecx
call fcn.10002540
add esp, 8
mov dword [ebp - 0xbc], eax
mov ecx, dword [ebp - 0xbc]
call fcn.100023b0
push eax
push str.ScrHeight
push str.ScreenMode
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [ebp - 0xb8]
call fcn.10001cf0
mov eax, dword [ebp - 0x18]
push eax
push 0x1005f430
push str.FullScrType
push str.ScreenMode
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [ebp - 0x18]
push eax
push 0x1005f458
push str.ScreenModeRecord
push str.ScreenMode
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10027fbe
mov esp, ebp
pop ebp
ret
Function at 0x10005f20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x10077154]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x10005f4d
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 0x3d]
test ecx, ecx
jne 0x10005f54
mov al, 1
jmp 0x1000603d
call fcn.10002480
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov ecx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x7c], eax
call fcn.10002480
mov dword [ebp - 0x80], eax
lea ecx, [ebp - 0x7c]
push ecx
lea edx, [ebp - 0x80]
push edx
call fcn.100073d0
add esp, 8
movzx eax, al
test eax, eax
je 0x10005f90
xor al, al
jmp 0x1000603d
mov dword [ebp - 0xc], 0x20
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 8]
add eax, 0x40
push eax
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x38]
call fcn.10008980
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
je 0x10005fd8
cmp dword [ebp - 0x84], 1
je 0x10005fdf
cmp dword [ebp - 0x84], 3
je 0x10006037
jmp 0x1000603b
mov eax, dword [ebp - 8]
mov byte [eax + 0x3d], 0
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x30]
sub eax, ecx
mov dword [ebp - 0x38], eax
je 0x1000600e
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x30]
push eax
call fcn.100449a1
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x1000600e
xor al, al
jmp 0x1000603d
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 0x3d]
test ecx, ecx
jne 0x10006025
mov dword [ebp - 0x84], 1
jmp 0x1000602f
mov dword [ebp - 0x84], 0
mov al, byte [ebp - 0x84]
jmp 0x1000603d
mov al, 1
jmp 0x1000603d
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10027fbe
mov esp, ebp
pop ebp
ret
Function at 0x10007ba0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x10077154]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
call fcn.10002480
mov dword [ebp - 0x84], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x84]
push ecx
call fcn.100073d0
add esp, 8
movzx edx, al
test edx, edx
je 0x10007bef
lea eax, [ebp + 8]
push eax
call fcn.100079f0
add esp, 4
jmp 0x10007d91
mov ecx, dword [ebp - 8]
call fcn.10007f60
test eax, eax
je 0x10007c31
mov ecx, dword [ebp - 8]
call fcn.10007f60
mov esi, eax
mov ecx, dword [ebp - 8]
call fcn.100073a0
cmp esi, eax
jae 0x10007c31
lea eax, [ebp + 8]
push eax
call fcn.10008560
add esp, 4
mov bl, al
mov ecx, dword [ebp - 8]
call fcn.10006930
mov byte [eax], bl
mov eax, dword [ebp + 8]
jmp 0x10007d91
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
jne 0x10007c44
call fcn.10002480
jmp 0x10007d91
mov ecx, dword [ebp - 8]
call fcn.10006980
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
jne 0x10007c9c
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x4c]
push ecx
lea edx, [ebp + 8]
push edx
call fcn.10008560
add esp, 4
movzx eax, al
push eax
call fcn.10002840
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x10007c86
mov edx, dword [ebp + 8]
mov dword [ebp - 0x88], edx
jmp 0x10007c91
call fcn.10002480
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x88]
jmp 0x10007d91
mov dword [ebp - 0xc], 0x20
lea eax, [ebp + 8]
push eax
call fcn.10008560
add esp, 4
mov byte [ebp - 0x32], al
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x31]
push ecx
lea edx, [ebp - 0x32]
push edx
mov eax, dword [ebp - 8]
add eax, 0x40
push eax
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x38]
call fcn.10007b60
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jl 0x10007d8c
cmp dword [ebp - 0x88], 1
jle 0x10007d06
cmp dword [ebp - 0x88], 3
je 0x10007d53
jmp 0x10007d8c
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x30]
sub eax, ecx
mov dword [ebp - 0x40], eax
je 0x10007d38
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x40]
push edx
push 1
lea eax, [ebp - 0x30]
push eax
call fcn.100449a1
add esp, 0x10
cmp dword [ebp - 0x40], eax
je 0x10007d38
call fcn.10002480
jmp 0x10007d91
mov eax, dword [ebp - 8]
mov byte [eax + 0x3d], 1
lea eax, [ebp - 0x32]
cmp dword [ebp - 0x38], eax
je 0x10007d4c
mov eax, dword [ebp + 8]
jmp 0x10007d91
call fcn.10002480
jmp 0x10007d91
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x4c]
push ecx
movzx edx, byte [ebp - 0x32]
push edx
call fcn.10002840
add esp, 8
movzx eax, al
test eax, eax
je 0x10007d79
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x88], ecx
jmp 0x10007d84
call fcn.10002480
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x88]
jmp 0x10007d91
call fcn.10002480
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10027fbe
mov esp, ebp
pop ebp
ret 4
Function at 0x10008ac0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, 1
test eax, eax
je 0x10008be9
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x10008afb
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.10008c10
jmp 0x10008bfd
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 4]
call fcn.10006380
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
cmp dword [ebp + 0x10], 0
jl 0x10008b8f
jg 0x10008b23
cmp dword [ebp + 0xc], 0
jbe 0x10008b8f
cmp dword [ebp - 0x10], 0
jl 0x10008b8f
jg 0x10008b31
cmp dword [ebp - 0x14], 0
jbe 0x10008b8f
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x10]
jg 0x10008b4f
jl 0x10008b43
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0x14]
jae 0x10008b4f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
call fcn.10007730
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10002400
add esp, 0xc
mov eax, dword [ebp - 0x14]
add eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x10]
sbb ecx, dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], ecx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
call fcn.10007630
cmp dword [ebp + 0x10], 0
jl 0x10008bd9
jg 0x10008b9d
cmp dword [ebp + 0xc], 0
jbe 0x10008bd9
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4c], 0
je 0x10008bd9
mov ecx, dword [ebp - 4]
call fcn.10006980
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.10044339
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
sbb edx, dword [ebp + 0x10]
jmp 0x10008bfd
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.10008c10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc