joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007c90
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x8a0]
add eax, 1
mov dword [ebp - 0x8a0], eax
mov ecx, dword [ebp - 0x89c]
mov edx, dword [ebp - 0x8a0]
cmp edx, dword [ecx + 0x18]
jae 0x10007d9a
mov eax, dword [ebp - 0x8a0]
mov ecx, dword [ebp - 0x26fc]
mov edx, dword [ebp - 0x3d4]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x8a4], edx
mov eax, dword [ebp - 0x8a0]
mov ecx, dword [ebp - 0x271c]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x2720]
loopne 0x10007baa
invalid
dec dword [ebx - 0x3d373]
inc dword [ebx]
or al, 0x90
mov dword [ebp - 0x2724], ecx
mov dword [ebp - 0x1e8], 0
jmp 0x10007bfe
mov edx, dword [ebp - 0x1e8]
add edx, 1
mov dword [ebp - 0x1e8], edx
mov eax, dword [ebp - 0x8a4]
add eax, dword [ebp - 0x1e8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x10007cb0
mov edx, dword [ebp - 0x1e8]
movsx eax, byte [ebp + edx - 0x9d8]
test eax, eax
je 0x10007cb0
push esi
or esi, 0xb22f
add byte [eax], al
or esi, 0x14db7
xor esi, 0xda40
pop esi
push edx
push esi
add esp, 4
jmp 0x10007c4a
sub edx, 0x563
xor edx, 0x1384a
or edx, 0xfcf
pop edx
mov ecx, dword [ebp - 0x8a4]
add ecx, dword [ebp - 0x1e8]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1e8]
movsx ecx, byte [ebp + eax - 0x9d8]
cmp edx, ecx
je 0x10007ca2
mov edx, dword [ebp - 0x8a4]
add edx, dword [ebp - 0x1e8]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1e8]
movsx edx, byte [ebp + ecx - 0x9d8]
cmp eax, edx
jne 0x10007ca9
jmp 0x10007bef
jmp 0x10007cb0
push edx
push ecx
add esp, 4
add edx, 0x7deb
or edx, 0x5409
sub edx, 0xe53b
pop edx
push edi
call 0x10007cd6
add byte [ecx + 0x46], al
dec esi
inc eax
inc edi
inc ecx
add esp, 4
pop edi
push edi
or edi, 0xb278
pop edi
mov eax, dword [ebp - 0x8a4]
add eax, dword [ebp - 0x1e8]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1e8]
movsx eax, byte [ebp + edx - 0x9d8]
cmp ecx, eax
jne 0x10007d0f
mov dword [ebp - 0xed0], 0
jmp 0x10007d7e
push ecx
call 0x10007d1f
add byte [edx], dh
cmp al, 0x46
cmp al, byte [edi + 0x3e]
xor eax, 0xc483473f
add al, 0x81
jmp 0x10011c87
cmp dword [ebp - 0xed0], 0
jne 0x10007d95
mov edx, dword [ebp - 0x2724]
mov dword [ebp - 0x5dc], edx
jmp 0x10007da6
jmp 0x10007b7f
mov eax, dword [ebp - 0x8a8]
mov dword [ebp - 0x5dc], eax
Function at 0x10007cd6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x8a0]
add eax, 1
mov dword [ebp - 0x8a0], eax
mov ecx, dword [ebp - 0x89c]
mov edx, dword [ebp - 0x8a0]
cmp edx, dword [ecx + 0x18]
jae 0x10007d9a
mov eax, dword [ebp - 0x8a0]
mov ecx, dword [ebp - 0x26fc]
mov edx, dword [ebp - 0x3d4]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x8a4], edx
mov eax, dword [ebp - 0x8a0]
mov ecx, dword [ebp - 0x271c]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x2720]
loopne 0x10007baa
invalid
dec dword [ebx - 0x3d373]
inc dword [ebx]
or al, 0x90
mov dword [ebp - 0x2724], ecx
mov dword [ebp - 0x1e8], 0
jmp 0x10007bfe
mov edx, dword [ebp - 0x1e8]
add edx, 1
mov dword [ebp - 0x1e8], edx
mov eax, dword [ebp - 0x8a4]
add eax, dword [ebp - 0x1e8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x10007cb0
mov edx, dword [ebp - 0x1e8]
movsx eax, byte [ebp + edx - 0x9d8]
test eax, eax
je 0x10007cb0
push esi
or esi, 0xb22f
add byte [eax], al
or esi, 0x14db7
xor esi, 0xda40
pop esi
push edx
push esi
add esp, 4
jmp 0x10007c4a
sub edx, 0x563
xor edx, 0x1384a
or edx, 0xfcf
pop edx
mov ecx, dword [ebp - 0x8a4]
add ecx, dword [ebp - 0x1e8]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1e8]
movsx ecx, byte [ebp + eax - 0x9d8]
cmp edx, ecx
je 0x10007ca2
mov edx, dword [ebp - 0x8a4]
add edx, dword [ebp - 0x1e8]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1e8]
movsx edx, byte [ebp + ecx - 0x9d8]
cmp eax, edx
jne 0x10007ca9
jmp 0x10007bef
jmp 0x10007cb0
push edx
push ecx
add esp, 4
add edx, 0x7deb
or edx, 0x5409
sub edx, 0xe53b
pop edx
push edi
call 0x10007cd6
add byte [ecx + 0x46], al
dec esi
inc eax
inc edi
inc ecx
add esp, 4
pop edi
push edi
or edi, 0xb278
pop edi
mov eax, dword [ebp - 0x8a4]
add eax, dword [ebp - 0x1e8]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1e8]
movsx eax, byte [ebp + edx - 0x9d8]
cmp ecx, eax
jne 0x10007d0f
mov dword [ebp - 0xed0], 0
jmp 0x10007d7e
push ecx
call 0x10007d1f
add byte [edx], dh
cmp al, 0x46
cmp al, byte [edi + 0x3e]
xor eax, 0xc483473f
add al, 0x81
jmp 0x10011c87
cmp dword [ebp - 0xed0], 0
jne 0x10007d95
mov edx, dword [ebp - 0x2724]
mov dword [ebp - 0x5dc], edx
jmp 0x10007da6
jmp 0x10007b7f
mov eax, dword [ebp - 0x8a8]
mov dword [ebp - 0x5dc], eax
Function at 0x10007d1f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x8a0]
add eax, 1
mov dword [ebp - 0x8a0], eax
mov ecx, dword [ebp - 0x89c]
mov edx, dword [ebp - 0x8a0]
cmp edx, dword [ecx + 0x18]
jae 0x10007d9a
mov eax, dword [ebp - 0x8a0]
mov ecx, dword [ebp - 0x26fc]
mov edx, dword [ebp - 0x3d4]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x8a4], edx
mov eax, dword [ebp - 0x8a0]
mov ecx, dword [ebp - 0x271c]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x2720]
loopne 0x10007baa
invalid
dec dword [ebx - 0x3d373]
inc dword [ebx]
or al, 0x90
mov dword [ebp - 0x2724], ecx
mov dword [ebp - 0x1e8], 0
jmp 0x10007bfe
mov edx, dword [ebp - 0x1e8]
add edx, 1
mov dword [ebp - 0x1e8], edx
mov eax, dword [ebp - 0x8a4]
add eax, dword [ebp - 0x1e8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x10007cb0
mov edx, dword [ebp - 0x1e8]
movsx eax, byte [ebp + edx - 0x9d8]
test eax, eax
je 0x10007cb0
push esi
or esi, 0xb22f
add byte [eax], al
or esi, 0x14db7
xor esi, 0xda40
pop esi
push edx
push esi
add esp, 4
jmp 0x10007c4a
sub edx, 0x563
xor edx, 0x1384a
or edx, 0xfcf
pop edx
mov ecx, dword [ebp - 0x8a4]
add ecx, dword [ebp - 0x1e8]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1e8]
movsx ecx, byte [ebp + eax - 0x9d8]
cmp edx, ecx
je 0x10007ca2
mov edx, dword [ebp - 0x8a4]
add edx, dword [ebp - 0x1e8]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1e8]
movsx edx, byte [ebp + ecx - 0x9d8]
cmp eax, edx
jne 0x10007ca9
jmp 0x10007bef
jmp 0x10007cb0
push edx
push ecx
add esp, 4
add edx, 0x7deb
or edx, 0x5409
sub edx, 0xe53b
pop edx
push edi
call 0x10007cd6
add byte [ecx + 0x46], al
dec esi
inc eax
inc edi
inc ecx
add esp, 4
pop edi
push edi
or edi, 0xb278
pop edi
mov eax, dword [ebp - 0x8a4]
add eax, dword [ebp - 0x1e8]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1e8]
movsx eax, byte [ebp + edx - 0x9d8]
cmp ecx, eax
jne 0x10007d0f
mov dword [ebp - 0xed0], 0
jmp 0x10007d7e
push ecx
call 0x10007d1f
add byte [edx], dh
cmp al, 0x46
cmp al, byte [edi + 0x3e]
xor eax, 0xc483473f
add al, 0x81
jmp 0x10011c87
cmp dword [ebp - 0xed0], 0
jne 0x10007d95
mov edx, dword [ebp - 0x2724]
mov dword [ebp - 0x5dc], edx
jmp 0x10007da6
jmp 0x10007b7f
mov eax, dword [ebp - 0x8a8]
mov dword [ebp - 0x5dc], eax

Function at 0x10007d3d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
mov ecx, dword [ebp - 0x8a4]
add ecx, dword [ebp - 0x1e8]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x1e8]
movsx ecx, byte [ebp + eax - 0x9d8]
or ecx, 0x20
cmp edx, ecx
jge 0x10007d74
mov dword [ebp - 0xed0], 0xffffffff
jmp 0x10007d7e
mov dword [ebp - 0xed0], 1
Function at 0x1002b080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x100c230c]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.10079c60
add esp, 0xc
push 0x104
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, dword [esp + 8]
push eax
lea ebx, [esp + 8]
call fcn.1002b100
pop ebx
test eax, eax
je 0x1002b0e3
test esi, esi
je 0x1002b0e3
mov ecx, dword [esp]
mov dword [esi], ecx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.100755ed
add esp, 0x210
ret

Function at 0x1002b100
Capabilities:
Access peb ldr_data
Get disk information via ioctl

Disassembly:
push 0xffffffffffffffff
push 0x1009c748
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x100c230c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
mov ecx, 0x100aabfc
call fcn.10002500
mov dword [esp + 0x28], 0
mov ecx, dword [esp + 0x30]
push ecx
lea edi, [esp + 0x10]
call fcn.1002b360
push 0x3a
call fcn.1002b360
mov edx, dword [esp + 0xc]
push 0
push 0
push 3
push 0
push 3
push SysReAllocStringLen
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
or edi, 0xffffffff
cmp esi, edi
je 0x1002b19d
push 0
lea eax, [esp + 0x14]
push eax
push 0xc
lea ecx, [esp + 0x20]
push ecx
push 0
push 0
push 0x2d1080
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
test eax, eax
jne 0x1002b1c0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x28], edi
lea ecx, [esp + 0xc]
call fcn.100025b0
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1002b1d0
mov edx, dword [esp + 0x18]
mov dword [ebx], edx
mov dword [esp + 0x28], edi
lea ecx, [esp + 0xc]
call fcn.100025b0
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 4

Function at 0x1002b720
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x48
cmp dword [esi], 0
push edi
jne 0x1002b7a1
mov edi, dword [esi + 0x30]
test edi, edi
je 0x1002b737
call fcn.100316e0
jmp 0x1002b739
xor eax, eax
mov dword [esi + 0x20], eax
call fcn.1002b9f0
shrd eax, edx, 0x14
push 0x40
mov dword [esi + 0x10], eax
lea eax, [esp + 0xc]
shr edx, 0x14
push 0
push eax
mov dword [esi + 0x14], edx
call fcn.10079c60
add esp, 0xc
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
shrd edx, eax, 0x14
shr eax, 0x14
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], 0
call fcn.1002b990
mov dword [esi + 0x28], eax
call fcn.1002b7b0
mov dword [esi + 0x24], eax
mov dword [esi], 1
pop edi
add esp, 0x48
ret
Function at 0x1002b990
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [esp]
mov eax, 3
test ecx, ecx
je 0x1002b9e9
cmp ecx, 6
je 0x1002b9e0
cmp ecx, 9
jne 0x1002b9eb
lea eax, [ecx - 8]
add esp, 0x24
ret
mov eax, 2
add esp, 0x24
ret
xor eax, eax
add esp, 0x24
ret
Function at 0x10031530
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push edi
xor edi, edi
cmp dword [eax + 0x10], edi
je 0x1003154f
cmp esi, edi
je 0x10031545
mov dword [esi], 1
mov eax, 1
pop edi
add esp, 0xc
ret
cmp esi, edi
je 0x100315a6
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 8]
push edx
mov edx, dword [eax + 0x1c]
lea ecx, [esp + 0x14]
push ecx
push edi
push str.solid
push edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x100315a6
cmp dword [esp + 0xc], 4
jne 0x100315a6
mov eax, dword [esp + 4]
cmp eax, 0xa
je 0x10031597
cmp eax, 0xb
jne 0x100315a6
xor ecx, ecx
cmp eax, 0xb
sete cl
mov edi, 1
mov dword [esi], ecx
mov eax, edi
pop edi
add esp, 0xc
ret

Function at 0x100315b0
Capabilities:
Delete registry value
Set registry value

Disassembly:
sub esp, 0x50
mov eax, dword [0x100c230c]
xor eax, esp
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x54]
push esi
push edi
mov dword [ebx + 0x10], eax
test eax, eax
je 0x1003162d
mov eax, dword [str.sotm]
mov dx, word [0x100aca94]
mov ecx, 0xe
mov esi, str.SOFTWARE360Safe_softmgrdg
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x100aca90]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], ecx
push eax
lea ecx, [esp + 0x20]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov word [esp + 0x24], dx
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov eax, dword [ebx + 0x1c]
push 4
lea edx, [esp + 0x10]
push edx
push 4
push 0
push str.solid
mov dword [esp + 0x20], 0xb
push eax
jmp 0x10031649
mov edx, dword [ebx + 0x1c]
push 4
lea ecx, [esp + 0x10]
push ecx
push 4
push 0
push str.solid
mov dword [esp + 0x20], 0xa
push edx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call esi
mov ecx, dword [ebx + 0x1c]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x100a6654
push ecx
mov dword [esp + 0x24], 0x2717
call esi
mov edx, dword [ebx + 0x44]
cmp dword [edx - 0xc], 0
lea edi, [ebx + 0x44]
jne 0x1003168f
call fcn.10031a40
push edx
push eax
push 0x100aca98
call fcn.10012130
add esp, 0xc
mov eax, dword [edi]
sub eax, 0x10
cmp dword [eax + 0xc], 1
jle 0x100316a4
mov eax, dword [eax + 4]
push eax
push edi
call fcn.10002bc0
mov edi, dword [edi]
test edi, edi
je 0x100316c6
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebx + 0x1c]
lea ecx, [eax + eax + 2]
push ecx
push edi
push 1
push 0
push str.Ghost
push edx
call esi
mov ecx, dword [esp + 0x54]
pop edi
pop esi
xor ecx, esp
call fcn.100755ed
add esp, 0x50
ret 4
Function at 0x10033170
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x1009c3db
mov eax, dword fs:[0]
push eax
sub esp, 0x43c
mov eax, dword [0x100c230c]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
push esi
push edi
mov eax, dword [0x100c230c]
xor eax, esp
push eax
lea eax, [esp + 0x44c]
mov dword fs:[0], eax
push 0x206
mov esi, ecx
xor edi, edi
lea ecx, [esp + 0x246]
xor eax, eax
push edi
push ecx
xor ebx, ebx
mov word [esp + 0x24c], ax
call fcn.10079c60
push 0x206
lea eax, [esp + 0x4a]
xor edx, edx
push edi
push eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov word [esp + 0x50], dx
call fcn.10079c60
xor ecx, ecx
add esp, 0x18
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], cx
mov dword [esp + 0x454], edi
push 0x104
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push edx
push 0x104
lea eax, [esp + 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x10033281
lea eax, [esp + 0x38]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x10033245
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x3c]
lea esi, [esp + 0x20]
call fcn.10007450
push 0x100ace3c
mov ebx, 4
xor eax, eax
mov edx, esi
call fcn.10007c90
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
lea ebx, [ebx + ebx + 3]
mov dword [esp + 0x454], 0xffffffff
cmp dword [esp + 0x34], 8
jb 0x100332a0
mov ecx, dword [esp + 0x20]
push ecx
call fcn.100755e2
add esp, 4
xor edx, edx
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], dx
mov eax, ebx
mov ecx, dword [esp + 0x44c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x438]
xor ecx, esp
call fcn.100755ed
add esp, 0x448
ret
Function at 0x1003d8e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1009c18c
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x100c230c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp + 0x14], 2
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x20]
push ecx
push esi
call fcn.1003dd60
mov eax, 1
mov dword [esp + 4], eax
mov byte [esp + 0x14], al
cmp dword [esp + 0x34], 8
jb 0x1003d948
mov edx, dword [esp + 0x20]
push edx
call fcn.100755e2
add esp, 4
xor eax, eax
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
mov byte [esp + 0x14], al
lea ecx, [esp + 0x38]
push ecx
call fcn.10034030
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
add esp, 0x14
ret
Function at 0x10041cc0
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x2008
call fcn.10088280
mov eax, dword [0x100c230c]
xor eax, esp
mov dword [esp + 0x2004], eax
push ebx
push ebp
mov ebp, dword [esp + 0x2014]
push esi
push edi
xor eax, eax
push 0x1ffe
mov esi, ecx
push eax
lea ecx, [esp + 0x1a]
push ecx
mov edi, edx
mov word [esp + 0x1c], ax
call fcn.10079c60
mov esi, dword [esi]
add esp, 0xc
push esi
push ecx
call fcn.1006c580
add esp, 4
push eax
call fcn.1006c900
test eax, eax
je 0x10041d81
mov ecx, dword [eax + 0xc]
mov edi, dword [edi]
test ecx, ecx
je 0x10041d3f
mov edx, dword [ecx]
push 0x1000
lea eax, [esp + 0x14]
push eax
push 0x100a6f30
push 0x100a651c
push edi
push ecx
mov ecx, dword [edx + 0x18]
call ecx
jmp 0x10041d5d
mov edx, dword [eax]
push edx
push 0x1000
lea eax, [esp + 0x18]
push eax
push 0x100a6f30
push 0x100a651c
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x10]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10041d64
sub eax, edx
sar eax, 1
lea ecx, [esp + 0x10]
mov ebx, eax
push ecx
mov eax, ebp
call fcn.10002d60
mov ecx, dword [esp + 0x2014]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100755ed
add esp, 0x2008
ret 4

Function at 0x10043450
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x808
mov eax, dword [0x100c230c]
xor eax, esp
mov dword [esp + 0x804], eax
push ebx
push ebp
mov ebp, dword [esp + 0x814]
push esi
push edi
xor eax, eax
push 0x7fe
mov esi, ecx
push eax
lea ecx, [esp + 0x1a]
push ecx
mov edi, edx
mov word [esp + 0x1c], ax
call fcn.10079c60
mov esi, dword [esi]
add esp, 0xc
push esi
push ecx
call fcn.1006c580
add esp, 4
push eax
call fcn.1006c900
test eax, eax
je 0x1004350d
mov ecx, dword [eax + 0xc]
mov edi, dword [edi]
test ecx, ecx
je 0x100434cb
mov edx, dword [ecx]
push 0x400
lea eax, [esp + 0x14]
push eax
push 0x100a6f30
push 0x100a6588
push edi
push ecx
mov ecx, dword [edx + 0x18]
call ecx
jmp 0x100434e9
mov edx, dword [eax]
push edx
push 0x400
lea eax, [esp + 0x18]
push eax
push 0x100a6f30
push 0x100a6588
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x10]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100434f0
sub eax, edx
sar eax, 1
lea ecx, [esp + 0x10]
mov ebx, eax
push ecx
mov eax, ebp
call fcn.10002d60
mov ecx, dword [esp + 0x814]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100755ed
add esp, 0x808
ret 4
Function at 0x10046af0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x1009a570
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100c230c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x20], 0
lea edi, [ebp + ebp + 2]
cmp edi, dword [esp + 0x30]
mov dword [esp + 0x14], ebp
jge 0x10046bfd
mov ebx, dword [esp + 0x28]
mov ecx, dword [ebx + edi*4 - 4]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
je 0x10046bf3
mov eax, dword [ebx + edi*4]
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10046b76
test dx, dx
je 0x10046b72
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10046b76
add eax, 4
add ecx, 4
test dx, dx
jne 0x10046b50
xor eax, eax
jmp 0x10046b7b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setl al
test al, al
je 0x10046b85
dec edi
mov ecx, dword [ebx + edi*4]
mov esi, dword [ebx + ebp*4]
lea ebp, [ebx + ebp*4]
lea eax, [ecx - 0x10]
sub esi, 0x10
cmp eax, esi
je 0x10046be1
cmp dword [esi + 0xc], 0
lea ebx, [esi + 0xc]
jl 0x10046bd2
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x10046bd2
call fcn.10002cf0
mov dword [esp + 0x2c], eax
or eax, 0xffffffff
lock xadd dword [ebx], eax
dec eax
test eax, eax
jg 0x10046bc6
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ecx, dword [esp + 0x2c]
add ecx, 0x10
mov dword [ebp], ecx
jmp 0x10046bdd
mov ebx, dword [ecx - 0xc]
push ecx
mov eax, ebp
call fcn.10002d60
mov ebx, dword [esp + 0x28]
mov ebp, edi
lea edi, [edi + edi + 2]
cmp edi, dword [esp + 0x30]
jl 0x10046b33
jmp 0x10046c01
push 0x80004005
call fcn.10002030
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
cmp edi, eax
jne 0x10046c6b
mov ecx, dword [ebx + eax*4 - 4]
mov esi, dword [ebx + ebp*4]
lea edi, [ebx + ebp*4]
lea eax, [ecx - 0x10]
sub esi, 0x10
cmp eax, esi
je 0x10046c66
cmp dword [esi + 0xc], 0
lea ebp, [esi + 0xc]
jl 0x10046c57
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x10046c57
call fcn.10002cf0
mov dword [esp + 0x2c], eax
or eax, 0xffffffff
lock xadd dword [ebp], eax
dec eax
test eax, eax
jg 0x10046c4c
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ecx, dword [esp + 0x2c]
add ecx, 0x10
mov dword [edi], ecx
jmp 0x10046c66
mov ebx, dword [ecx - 0xc]
push ecx
mov eax, edi
call fcn.10002d60
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x30]
dec ebp
mov eax, dword [esp + 0x34]
push ecx
mov esi, esp
add eax, 0xfffffff0
mov dword [esp + 0x34], esp
mov dword [esp + 0x30], esi
call fcn.10002cf0
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x24], 2
mov edx, dword [esp + 0x18]
push edx
push ebx
mov byte [esp + 0x2c], 0
mov ecx, ebp
call fcn.10046ea0
add esp, 0xc
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10046cc9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret