joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10072760
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x63c]
sub esp, 0x63c
push 0xffffffffffffffff
push 0x100c59d0
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x100fb03c]
xor eax, ebp
mov dword [ebp + 0x638], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0x644]
lea ecx, [ebp]
mov ebx, dword [ebp + 0x648]
call fcn.10004970
mov dword [ebp - 4], 0
mov eax, dword [0x100fdc28]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x10], 0x100fdc28
test eax, eax
je 0x100727d2
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 1
mov ecx, 0x100fdc2c
call fcn.100051f0
test eax, eax
je 0x10072819
push 0x100fdc2c
call fcn.10004ef0
lea ecx, [ebp]
add esp, 4
cmp ecx, eax
je 0x100728ce
mov ecx, 0x100fdc2c
call fcn.10004990
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x10072810
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
jmp 0x100728c6
push 0x20c
lea eax, [ebp + 0x42c]
push 0
push eax
call fcn.1008ac40
add esp, 0xc
lea eax, [ebp + 0x42c]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x1007296a
xor eax, eax
push 0x412
push eax
mov word [ebp + 0x636], ax
lea eax, [ebp + 0x18]
push eax
call fcn.1008ac40
add esp, 0xc
lea eax, [ebp + 0x18]
push 0x208
push eax
lea eax, [ebp + 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x100728af
test eax, eax
je 0x100728af
add eax, eax
cmp eax, 0x412
jae 0x100729bd
xor ecx, ecx
mov word [ebp + eax + 0x18], cx
lea eax, [ebp + 0x18]
push eax
call fcn.10004b70
add esp, 4
push eax
lea eax, [ebp + 0x18]
jmp 0x100728c5
lea eax, [ebp + 0x42c]
push eax
call fcn.10004b70
add esp, 4
push eax
lea eax, [ebp + 0x42c]
push eax
lea ecx, [ebp]
call fcn.100049a0
mov byte [ebp - 4], 0
mov eax, dword [0x100fdc28]
test eax, eax
je 0x100728e2
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebx
push edi
lea eax, [ebp]
mov dword [ebp - 0x10], 0
push eax
mov ecx, esi
call fcn.100726f0
test al, al
je 0x10072901
mov bl, 1
jmp 0x10072987
push 0x20c
lea eax, [ebp + 0x42c]
push 0
push eax
call fcn.1008ac40
add esp, 0xc
lea eax, [ebp + 0x42c]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x103
ja 0x10072985
xor eax, eax
mov word [ebp + 0x636], ax
lea eax, [ebp + 0x42c]
push eax
call fcn.10004b70
add esp, 4
lea ecx, [ebp]
push eax
lea eax, [ebp + 0x42c]
push eax
call fcn.100049a0
push ebx
push edi
lea eax, [ebp]
mov ecx, esi
push eax
call fcn.100726f0
mov bl, al
jmp 0x10072987
mov byte [ebp - 4], 0
mov eax, dword [0x100fdc28]
test eax, eax
je 0x1007297e
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x10], 0
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.10004840
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x638]
xor ecx, ebp
call fcn.100881a5
lea esp, [ebp + 0x63c]
pop ebp
ret 8
call fcn.100889c9
int3
Function at 0x100736d0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c5b5f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100fb03c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [edi + 4]
push eax
lea ecx, [eax + 0x94]
call fcn.10073e70
mov esi, dword [edi + 4]
add esp, 4
sub esi, 0x94
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.10004840
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.10004840
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.10004840
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.10004840
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.10004840
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10004840
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add dword [edi + 4], 0xffffff6c
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x10074420
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c5d4f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100fb03c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.10004840
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.10004840
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.10004840
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.10004840
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.10004840
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.10004840
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10075ae0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c5f4f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100fb03c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.100048e0
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.100048e0
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.100048e0
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.100048e0
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.100048e0
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.100048e0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10076c80
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push ebx
push ebp
mov ebx, ecx
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
lea ecx, [eax - 1]
push esi
mov ebp, ecx
mov dword [esp + 0x14], ecx
push edi
mov edi, edx
sar ebp, 1
mov dword [esp + 0x14], edi
mov esi, edi
cmp edi, ebp
jge 0x10076cf3
add esi, esi
lea eax, [esi + 2]
lea eax, [eax + eax*2]
lea ecx, [ebx + eax*8]
lea eax, [ecx - 0x18]
push eax
push ecx
call fcn.1002e910
movzx eax, al
xor eax, 1
inc eax
add esi, eax
lea eax, [esi + esi*2]
lea eax, [ebx + eax*8]
push eax
call fcn.10004ef0
add esp, 0xc
push eax
lea eax, [edi + edi*2]
lea ecx, [ebx + eax*8]
call fcn.100048a0
mov edi, esi
cmp esi, ebp
jl 0x10076cb0
mov eax, dword [esp + 0x10]
cmp esi, ebp
jne 0x10076d1d
test al, 1
jne 0x10076d1d
lea eax, [eax + eax*2]
lea eax, [eax - 3]
lea eax, [ebx + eax*8]
push eax
call fcn.10004ef0
add esp, 4
push eax
lea eax, [edi + edi*2]
lea ecx, [ebx + eax*8]
call fcn.100048a0
mov edi, dword [esp + 0x18]
push dword [esp + 0x1c]
call fcn.10004ef0
add esp, 4
mov ecx, eax
mov dword [esp + 0x10], ecx
cmp dword [esp + 0x14], edi
jge 0x10076d73
lea esi, [edi - 1]
sar esi, 1
push ecx
lea eax, [esi + esi*2]
lea ebp, [ebx + eax*8]
push ebp
call fcn.1002e910
add esp, 8
test al, al
je 0x10076d6f
push ebp
call fcn.10004ef0
add esp, 4
push eax
lea eax, [edi + edi*2]
lea ecx, [ebx + eax*8]
call fcn.100048a0
mov edi, esi
mov ecx, dword [esp + 0x10]
cmp dword [esp + 0x14], esi
jl 0x10076d35
mov ecx, dword [esp + 0x10]
push ecx
call fcn.10004ef0
add esp, 4
push eax
lea eax, [edi + edi*2]
lea ecx, [ebx + eax*8]
call fcn.100048a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x10079190
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x100fb03c]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x10079212
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x10079212
test ecx, ecx
je 0x1007920e
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x100791d0
xor eax, eax
jmp 0x10079217
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x10079221
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100881a5
add esp, 0xc
ret 0xc

Function at 0x10079cb0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x100fb03c]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, dword [esp + 0x10]
push edi
mov dword [esi], 0
mov dword [esi + 4], 0
mov eax, dword [ecx + 0x10]
cmp eax, 0xffffffff
je 0x10079d23
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10079cfe
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10079d23
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, edi
pop edi
adc eax, 0
mov dword [esi], ecx
mov dword [esi + 4], eax
xor eax, eax
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.100881a5
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.100881a5
add esp, 8
ret 4

Function at 0x1007a0b0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x100fb03c]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, dword [esp + 0x10]
push edi
mov dword [esi], 0
mov dword [esi + 4], 0
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x1007a123
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1007a0fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1007a123
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, edi
pop edi
adc eax, 0
mov dword [esi], ecx
mov dword [esi + 4], eax
xor eax, eax
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.100881a5
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.100881a5
add esp, 8
ret 4
Function at 0x1007d6f0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c5b5f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100fb03c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push edx
push 0x94
call fcn.10002180
mov esi, dword [ebp + 8]
add esp, 8
mov edi, eax
mov ecx, eax
mov dword [ebp - 0x10], edi
push esi
call fcn.10008cd0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
push ecx
lea ecx, [edi + 0x18]
call fcn.10008cd0
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.10008cd0
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.10008cd0
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.10008cd0
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.10008cd0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10080510
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x100fb03c]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x10080575
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10080550
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10080575
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.100881a5
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.100881a5
add esp, 8
ret 4
Function at 0x100806b0
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c7578
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x100fb03c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
test ecx, ecx
je 0x100806f9
mov dword [ecx], 0
mov dword [eax], 0
cmp dword [edi], 0xffffffff
je 0x1008084b
mov eax, dword [ebp + 0xc]
mov ecx, 0x100000
push 0
mov ebx, eax
mov dword [ebp - 0x1c], 0
cmp eax, 0x100000
lea eax, [ebp - 0x1c]
push eax
cmova ebx, ecx
push ebx
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x1c], 0
je 0x10080816
test eax, eax
je 0x10080816
mov edx, dword [ebp - 0x1c]
cmp edx, ebx
jae 0x10080819
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi]
mov dword [ebp - 0x24], eax
cmp ecx, 0xffffffff
je 0x1008079b
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1008078f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1008079b
mov eax, dword [ebp - 0x14]
xor ecx, ecx
add ecx, esi
adc eax, 0
jmp 0x100807a9
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
push 0
push dword [ebp - 0x24]
push eax
push ecx
sub esp, 0x18
lea eax, [edi + 4]
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.10008cd0
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x18]
mov esi, dword [ebp - 0x20]
test eax, eax
jne 0x10080816
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push ebx
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
xor edx, edx
test ecx, ecx
mov eax, 0x80004005
cmovne eax, edx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
test ecx, ecx
je 0x10080754
jmp 0x10080819
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
add dword [ecx], edx
test eax, eax
jne 0x10080842
test edx, edx
je 0x1008083e
mov eax, dword [ebp + 0xc]
add esi, edx
sub eax, edx
mov dword [ebp - 0x20], esi
mov dword [ebp + 0xc], eax
mov ecx, 0x100000
jne 0x10080710
mov al, 1
jmp 0x1008084d
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x1008084b
mov dword [ecx], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100881a5
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10082280
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c7761
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x100fb03c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x234]
call fcn.10004970
mov dword [ebp - 4], 0
push 4
lea ecx, [ebp - 0x21c]
call fcn.10005570
lea ecx, [ebp - 0x21c]
call fcn.100053b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x21c]
call fcn.10005cd0
lea eax, [ebp - 0x234]
push eax
call fcn.1003a900
add esp, 4
mov byte [ebp - 0x235], al
lea ecx, [ebp - 0x21c]
call fcn.10005fe0
movzx ecx, byte [ebp - 0x235]
test ecx, ecx
jne 0x10082342
mov byte [ebp - 0x236], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call fcn.10005430
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.10004840
mov al, byte [ebp - 0x236]
jmp 0x100824bd
push 0x100ca44c
lea ecx, [ebp - 0x258]
call fcn.10004920
mov byte [ebp - 4], 2
lea edx, [ebp - 0x258]
push edx
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x270]
push ecx
call fcn.1000c8f0
add esp, 0xc
mov dword [ebp - 0x23c], eax
mov edx, dword [ebp - 0x23c]
push edx
lea ecx, [ebp - 0x234]
call fcn.100048a0
lea ecx, [ebp - 0x270]
call fcn.10004840
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x258]
call fcn.10004840
lea eax, [ebp - 0x234]
push eax
call fcn.1000b1f0
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x100823ca
lea edx, [ebp - 0x234]
push edx
call fcn.100164d0
add esp, 4
push 0x100fc800
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x288]
push ecx
call fcn.1000c8f0
add esp, 0xc
mov dword [ebp - 0x240], eax
mov edx, dword [ebp - 0x240]
push edx
lea ecx, [ebp - 0x234]
call fcn.100048a0
lea ecx, [ebp - 0x288]
call fcn.10004840
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.1008ac40
add esp, 0xc
lea ecx, [ebp - 0x234]
call fcn.10004780
push eax
push 0x104
lea ecx, [ebp - 0x218]
push ecx
mov ecx, 0x100fc818
call fcn.10004780
push eax
mov ecx, 0x100fc830
call fcn.10004780
push eax
mov ecx, 0x100fc848
call fcn.10004780
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edx, 2
imul eax, edx, 0
movzx ecx, word [ebp + eax - 0x218]
test ecx, ecx
jne 0x10082480
push 0x100fc818
mov ecx, dword [ebp + 8]
call fcn.10004810
jmp 0x1008248f
lea edx, [ebp - 0x218]
push edx
mov ecx, dword [ebp + 8]
call fcn.100047e0
mov byte [ebp - 0x237], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call fcn.10005430
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.10004840
mov al, byte [ebp - 0x237]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100881a5
mov esp, ebp
pop ebp
ret
Function at 0x100824e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c77c7
mov eax, dword fs:[0]
push eax
sub esp, 0x2ac
mov eax, dword [0x100fb03c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x234]
call fcn.10004970
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24c]
call fcn.10004970
mov byte [ebp - 4], 1
push 4
lea ecx, [ebp - 0x21c]
call fcn.10005570
lea ecx, [ebp - 0x21c]
call fcn.100053b0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x21c]
call fcn.10005cd0
lea eax, [ebp - 0x234]
push eax
call fcn.1003a900
add esp, 4
mov byte [ebp - 0x24d], al
lea ecx, [ebp - 0x21c]
call fcn.10005fe0
movzx ecx, byte [ebp - 0x24d]
test ecx, ecx
jne 0x100825c0
mov byte [ebp - 0x24e], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x21c]
call fcn.10005430
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24c]
call fcn.10004840
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.10004840
mov al, byte [ebp - 0x24e]
jmp 0x1008278d
push str.hotspotesswPrefs
lea ecx, [ebp - 0x270]
call fcn.10004920
mov byte [ebp - 4], 3
lea edx, [ebp - 0x270]
push edx
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x2a0]
push ecx
call fcn.1000c8f0
add esp, 0xc
mov dword [ebp - 0x254], eax
mov edx, dword [ebp - 0x254]
push edx
lea ecx, [ebp - 0x234]
call fcn.100048a0
lea ecx, [ebp - 0x2a0]
call fcn.10004840
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x270]
call fcn.10004840
lea eax, [ebp - 0x234]
push eax
call fcn.1000b1f0
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x10082648
lea edx, [ebp - 0x234]
push edx
call fcn.100164d0
add esp, 4
push 0x100fc800
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x2b8]
push ecx
call fcn.1000c8f0
add esp, 0xc
mov dword [ebp - 0x258], eax
mov edx, dword [ebp - 0x258]
push edx
lea ecx, [ebp - 0x234]
call fcn.100048a0
lea ecx, [ebp - 0x2b8]
call fcn.10004840
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.1008ac40
add esp, 0xc
lea ecx, [ebp - 0x234]
call fcn.10004780
push eax
push 0x104
lea ecx, [ebp - 0x218]
push ecx
mov ecx, 0x100fc818
call fcn.10004780
push eax
mov ecx, 0x100fc830
call fcn.10004780
push eax
mov ecx, 0x100fc848
call fcn.10004780
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edx, 2
imul eax, edx, 0
movzx ecx, word [ebp + eax - 0x218]
test ecx, ecx
jne 0x10082701
push 0x100fc818
lea ecx, [ebp - 0x24c]
call fcn.10004810
jmp 0x10082713
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x24c]
call fcn.100047e0
push 0x100ca49c
lea ecx, [ebp - 0x288]
call fcn.10004920
mov byte [ebp - 4], 4
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x288]
push ecx
lea edx, [ebp - 0x24c]
push edx
call fcn.10082180
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x288]
call fcn.10004840
mov byte [ebp - 0x24f], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x21c]
call fcn.10005430
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24c]
call fcn.10004840
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.10004840
mov al, byte [ebp - 0x24f]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100881a5
mov esp, ebp
pop ebp
ret
Function at 0x100843a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c7ad8
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x100fb03c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x68]
call fcn.10004970
mov dword [ebp - 4], 0
lea eax, [ebp - 0x68]
push eax
call fcn.10084520
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x10084405
mov byte [ebp - 0x69], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.10004840
mov al, byte [ebp - 0x69]
jmp 0x10084507
lea edx, [ebp - 0x68]
push edx
call fcn.1000b380
add esp, 4
movzx eax, al
test eax, eax
jne 0x10084433
mov byte [ebp - 0x6a], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.10004840
mov al, byte [ebp - 0x6a]
jmp 0x10084507
push 0x40
push 0
lea ecx, [ebp - 0x50]
push ecx
call fcn.1008ac40
add esp, 0xc
lea ecx, [ebp - 0x68]
call fcn.10004780
push eax
push 0x20
lea edx, [ebp - 0x50]
push edx
push 0x100ca880
push 0x100ca614
push 0x100ca5fc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 0x74], 0x100ca884
lea eax, [ebp - 0x50]
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x70]
mov dx, word [ecx]
mov word [ebp - 0x76], dx
mov eax, dword [ebp - 0x74]
cmp dx, word [eax]
jne 0x100844b9
cmp word [ebp - 0x76], 0
je 0x100844b0
mov ecx, dword [ebp - 0x70]
mov dx, word [ecx + 2]
mov word [ebp - 0x78], dx
mov eax, dword [ebp - 0x74]
cmp dx, word [eax + 2]
jne 0x100844b9
add dword [ebp - 0x70], 4
add dword [ebp - 0x74], 4
cmp word [ebp - 0x78], 0
jne 0x10084474
mov dword [ebp - 0x7c], 0
jmp 0x100844c1
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x7c], ecx
mov edx, dword [ebp - 0x7c]
mov dword [ebp - 0x80], edx
cmp dword [ebp - 0x80], 0
jne 0x100844e5
mov byte [ebp - 0x6b], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.10004840
mov al, byte [ebp - 0x6b]
jmp 0x10084507
lea eax, [ebp - 0x50]
push eax
mov ecx, dword [ebp + 8]
call fcn.100047e0
mov byte [ebp - 0x6c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.10004840
mov al, byte [ebp - 0x6c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100881a5
mov esp, ebp
pop ebp
ret