joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001f2b
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x400
call fcn.10001acd
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10001f63
push ebx
call fcn.1004f7cf
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
push 0x400
push dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
push dword [ebx]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ebx, dword [ebp + 0xc]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10001fac
push 0x4f
push 0x4042128
push 6
call fcn.1004f7db
add esp, 0xc
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x10001fcb
push eax
mov ebx, eax
call fcn.100011ed
inc eax
push eax
call fcn.1004f7d5
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x10001fd0
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10001fe1
push ebx
call fcn.1004f7cf
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x14

Function at 0x10001fe8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ebx, dword [ebp + 0xc]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
nop
nop
cmp dword [ebp - 4], esp
je 0x1000202c
push 0x12
push 0x4042127
push 6
call fcn.1004f7db
add esp, 0xc
jmp 0x10002031
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10018367
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push 0x40
push 0x1000
push 0x400
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x100183c2
push 0x54
push 0x4041fc5
push 6
call fcn.1004f7db
add esp, 0xc
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], esp
push 0x400
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_RtlZeroMemory]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x100183f6
push 0x8c
push 0x4041fc5
push 6
call fcn.1004f7db
add esp, 0xc
push 0x100185b8
call fcn.100033dc
mov dword [ebp - 0x10], eax
fild dword [ebp - 4]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [0x10077da8]
fstp qword [ebp - 0x20]
mov dword [ebp - 0x24], 0
push 0
push dword [ebp - 0x24]
mov dword [ebp - 0x28], 0
push 0
push dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
push 0
push dword [ebp - 0x2c]
push 1
push 5
fld qword [ebp - 0x20]
call fcn.100011c6
push eax
push dword [ebp - 0x10]
call fcn.10003532
mov dword [ebp - 8], eax
push 0x80000301
push 0
push dword [ebp - 8]
push 1
mov ebx, 0x198
call fcn.100508d0
add esp, 0x10
mov dword [ebp - 0x10], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x198
call fcn.100508d0
add esp, 0x10
mov dword [ebp - 0x14], eax
push 0x10077ca1
push dword [ebp - 0x14]
push 0x10077db0
push dword [ebp - 0x10]
push 0x10077dbc
mov ecx, 5
call fcn.100020c7
add esp, 0x14
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x100184c7
push ebx
call fcn.1004f7cf
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x100184d7
push ebx
call fcn.1004f7cf
add esp, 4
mov eax, dword [ebp - 0x18]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x100184eb
push ebx
call fcn.1004f7cf
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call fcn.10001e08
fild dword [ebp - 4]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fadd qword [0x10077291]
fstp qword [ebp - 0x1c]
push 1
mov eax, 0x1007731e
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
fld qword [ebp - 0x1c]
call fcn.100011c6
push eax
push 0x10fa93f
call fcn.10003409
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x1001853e
push ebx
call fcn.1004f7cf
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x1001854e
push ebx
call fcn.1004f7cf
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x100185d7
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push 0x40
push 0x1000
push 0x400
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x10018632
push 0x19
push 0x4040cc2
push 6
call fcn.1004f7db
add esp, 0xc
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], esp
push 0x400
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_RtlZeroMemory]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x10018666
push 0x51
push 0x4040cc2
push 6
call fcn.1004f7db
add esp, 0xc
push 0x10018836
call fcn.100033dc
mov dword [ebp - 0x10], eax
fild dword [ebp - 4]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [0x10077dd6]
fstp qword [ebp - 0x20]
mov dword [ebp - 0x24], 0
push 0
push dword [ebp - 0x24]
mov dword [ebp - 0x28], 0
push 0
push dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
push 0
push dword [ebp - 0x2c]
push 1
push 5
fld qword [ebp - 0x20]
call fcn.100011c6
push eax
push dword [ebp - 0x10]
call fcn.10003532
mov dword [ebp - 8], eax
push 0x80000301
push 0
push dword [ebp - 8]
push 1
mov ebx, 0x198
call fcn.100508d0
add esp, 0x10
mov dword [ebp - 0x10], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x198
call fcn.100508d0
add esp, 0x10
mov dword [ebp - 0x14], eax
push 0x10077ca1
push dword [ebp - 0x14]
push 0x10077db0
push dword [ebp - 0x10]
push 0x10077dde
mov ecx, 5
call fcn.100020c7
add esp, 0x14
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10018737
push ebx
call fcn.1004f7cf
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x10018747
push ebx
call fcn.1004f7cf
add esp, 4
mov eax, dword [ebp - 0x18]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x1001875b
push ebx
call fcn.1004f7cf
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call fcn.10001e08
fild dword [ebp - 4]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fadd qword [0x10077291]
fstp qword [ebp - 0x1c]
push 1
mov eax, 0x10077e01
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
fld qword [ebp - 0x1c]
call fcn.100011c6
push eax
push 0x7d2796
call fcn.10003409
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x100187ae
push ebx
call fcn.1004f7cf
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x100187be
push ebx
call fcn.1004f7cf
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x10018855
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push 0x40
push 0x1000
push 0x400
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x100188b0
push 0x19
push 0x40411a6
push 6
call fcn.1004f7db
add esp, 0xc
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], esp
push 0x400
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_RtlZeroMemory]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x100188e4
push 0x51
push 0x40411a6
push 6
call fcn.1004f7db
add esp, 0xc
push 0x10018a8d
call fcn.100033dc
mov dword [ebp - 0x10], eax
fild dword [ebp - 4]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [0x10077c99]
fstp qword [ebp - 0x20]
mov dword [ebp - 0x24], 0
push 0
push dword [ebp - 0x24]
mov dword [ebp - 0x28], 0
push 0
push dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
push 0
push dword [ebp - 0x2c]
push 1
push 5
fld qword [ebp - 0x20]
call fcn.100011c6
push eax
push dword [ebp - 0x10]
call fcn.10003532
mov dword [ebp - 8], eax
push 0x80000301
push 0
push dword [ebp - 8]
push 1
mov ebx, 0x198
call fcn.100508d0
add esp, 0x10
mov dword [ebp - 0x10], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x198
call fcn.100508d0
add esp, 0x10
mov dword [ebp - 0x14], eax
push 0x10077ca1
push dword [ebp - 0x14]
push 0x10077db0
push dword [ebp - 0x10]
push 0x10077e0c
mov ecx, 5
call fcn.100020c7
add esp, 0x14
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x100189b5
push ebx
call fcn.1004f7cf
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x100189c5
push ebx
call fcn.1004f7cf
add esp, 4
mov eax, dword [ebp - 0x18]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x100189d9
push ebx
call fcn.1004f7cf
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call fcn.10001e08
fild dword [ebp - 4]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fadd qword [0x10077291]
fstp qword [ebp - 0x1c]
push 1
mov eax, 0x1007731e
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
fld qword [ebp - 0x1c]
call fcn.100011c6
push eax
push 0x110b4fa
call fcn.10003409
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x10018a2c
push ebx
call fcn.1004f7cf
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x10018a3c
push ebx
call fcn.1004f7cf
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x10018aac
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push 0x40
push 0x1000
push 0x400
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x10018b07
push 0x19
push 0x404163c
push 6
call fcn.1004f7db
add esp, 0xc
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], esp
push 0x400
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_RtlZeroMemory]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x10018b3b
push 0x51
push 0x404163c
push 6
call fcn.1004f7db
add esp, 0xc
push 0x10019085
call fcn.100033dc
mov dword [ebp - 0x10], eax
fild dword [ebp - 4]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [0x10077e2b]
fstp qword [ebp - 0x20]
mov dword [ebp - 0x24], 0
push 0
push dword [ebp - 0x24]
mov dword [ebp - 0x28], 0
push 0
push dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
push 0
push dword [ebp - 0x2c]
push 1
push 5
fld qword [ebp - 0x20]
call fcn.100011c6
push eax
push dword [ebp - 0x10]
call fcn.10003532
mov dword [ebp - 8], eax
push 0x80000301
push 0
push dword [ebp - 8]
push 1
mov ebx, 0x198
call fcn.100508d0
add esp, 0x10
mov dword [ebp - 0x10], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x198
call fcn.100508d0
add esp, 0x10
mov dword [ebp - 0x14], eax
push 0x10077ca1
push dword [ebp - 0x14]
push 0x10077db0
push dword [ebp - 0x10]
push 0x10077e33
mov ecx, 5
call fcn.100020c7
add esp, 0x14
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10018c0c
push ebx
call fcn.1004f7cf
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x10018c1c
push ebx
call fcn.1004f7cf
add esp, 4
mov eax, dword [ebp - 0x18]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x10018c30
push ebx
call fcn.1004f7cf
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call fcn.10001e08
fild dword [ebp - 4]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fadd qword [0x10077291]
fstp qword [ebp - 0x1c]
push 1
mov eax, 0x1007731e
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
fld qword [ebp - 0x1c]
call fcn.100011c6
push eax
push 0x9536d1
call fcn.10003409
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x10018c83
push ebx
call fcn.1004f7cf
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x10018c93
push ebx
call fcn.1004f7cf
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x10019c76
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
fild dword [ebp + 0xc]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fild dword [ebp + 8]
fstp qword [ebp - 0x18]
fsub qword [ebp - 0x18]
fsub qword [0x100773e2]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
call fcn.100011c6
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push 0x40
push 6
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10019ced
push 0x56
push 0x4016032
push 6
call fcn.1004f7db
add esp, 0xc
test eax, eax
je 0x10019d97
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x198
call fcn.100508d0
add esp, 0x10
mov dword [ebp - 0xc], eax
push 0x1007731e
push dword [ebp - 0xc]
push 0x100773ac
mov ecx, 3
call fcn.100020c7
add esp, 0xc
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x10019d41
push ebx
call fcn.1004f7cf
add esp, 4
push 0x80000301
push 0
push 6
push 0x80000301
push 0
push dword [ebp + 8]
push 0x80000005
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x10019d6a
mov eax, 0x10077289
push eax
push 3
mov ebx, 0x914
call fcn.10051bf0
add esp, 0x28
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10019d8d
push ebx
call fcn.1004f7cf
add esp, 4
mov eax, 1
jmp 0x10019da1
mov eax, 0
jmp 0x10019da1
mov esp, ebp
pop ebp
ret 8

Function at 0x10019da7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push 0x102d2b76
call fcn.10019e59
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10019dd8
push ebx
call fcn.1004f7cf
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x80000005
push 0
lea eax, [ebp - 4]
push eax
push 1
mov ebx, 0xc
mov eax, 0x10054da0
call fcn.100503d0
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 8]
push dword [ebp + 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10019e3c
push 0x66
push 0x4016033
push 6
call fcn.1004f7db
add esp, 0xc
jmp 0x10019e41
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10019e52
push ebx
call fcn.1004f7cf
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x18
Function at 0x10050490
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x100504f9
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.10050210
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x10050a80
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x140
push ebx
mov ebx, dword [esp + 0x154]
push ebp
push esi
mov esi, dword [ebx]
push edi
mov edi, dword [esp + 0x154]
xor ebp, ebp
test edi, edi
je 0x10050b00
push edi
call dword [0x102d33e0]
add esp, 4
test eax, eax
jbe 0x10050b00
test esi, esi
je 0x10050abe
cmp esi, 0xffffffff
je 0x10050abe
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebx], esi
je 0x10050b42
mov eax, dword [esp + 0x15c]
test eax, eax
je 0x10050aec
mov ecx, dword [esp + 0x10]
and ecx, 0x10
cmp cl, 0x10
je 0x10050b00
jmp 0x10050afb
mov edx, dword [esp + 0x158]
mov eax, dword [esp + 0x10]
test edx, eax
je 0x10050b00
mov ebp, 1
test esi, esi
je 0x10050b42
cmp esi, 0xffffffff
je 0x10050b42
test ebp, ebp
jne 0x10050b79
mov eax, dword [esp + 0x15c]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
lea eax, [esp + 0x10]
push eax
push esi
je 0x10050b4f
call edi
test eax, eax
je 0x10050b42
mov ecx, dword [esp + 0x10]
and ecx, 0x10
cmp cl, 0x10
jne 0x10050b79
lea edx, [esp + 0x10]
push edx
push esi
call edi
test eax, eax
jne 0x10050b2a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x140
ret
call edi
test eax, eax
je 0x10050b42
mov ebx, dword [esp + 0x158]
test dword [esp + 0x10], ebx
jne 0x10050b79
lea ecx, [esp + 0x10]
push ecx
push esi
call edi
test eax, eax
jne 0x10050b5c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret
lea edx, [esp + 0x3c]
push edx
call dword [0x102d33e0]
inc eax
push eax
call fcn.10050210
mov edx, eax
lea edi, [esp + 0x44]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret
Function at 0x100517a0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esp + 0x84]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x44], 1
je case.0x100517e1.2
mov ecx, dword [esp + 0x7c]
lea eax, [ecx - 1]
cmp eax, 5
ja case.0x100517e1.2
jmp dword [eax*4 + 0x1005186c]
mov word [esp + 0x48], di
jmp 0x1005181a
mov word [esp + 0x48], 2
jmp 0x1005181a
mov word [esp + 0x48], 3
jmp 0x1005181a
mov word [esp + 0x48], 4
jmp 0x1005181a
mov word [esp + 0x48], 7
jmp 0x1005181a
mov word [esp + 0x48], 5
lea edx, [esp + 8]
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0x18]
push edx
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
cmp esi, edi
je 0x10051864
cmp dword [esp + 0x70], edi
je 0x10051850
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x54
ret

Function at 0x10051b30
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call fcn.100669fc
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x10051b9a
push esi
lea edi, [eax + 0x400]
call fcn.10066a25
push edi
call fcn.100669fc
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x10051b6a
push esi
xor edi, edi
call dword [0x102d33e0]
add esp, 4
test eax, eax
je 0x10051bb6
push eax
push esi
call fcn.10053de0
add esp, 8
mov edi, eax
push esi
call fcn.10066a25
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10051d20
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x18
push ebp
mov ebp, dword [esp + 0x24]
test ebp, ebp
jne 0x10051d33
xor eax, eax
pop ebp
add esp, 0x18
ret
push ebp
call fcn.10054920
add esp, 4
test eax, eax
jne 0x10051d45
pop ebp
add esp, 0x18
ret
mov eax, dword [ebp]
push ebx
mov ebx, 1
push esi
cmp eax, ebx
push edi
mov dword [esp + 0x10], 0
jne 0x10051dbf
mov eax, dword [esp + 0x2c]
mov ebp, dword [ebp + 4]
cmp eax, ebx
mov dword [esp + 0x10], ebx
mov edi, ebx
jle 0x10051f15
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x3c]
mov eax, dword [esi]
lea edx, [esp + 0x20]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push ebp
call ebx
test eax, eax
je 0x10051dab
mov eax, dword [esp + 0x2c]
inc edi
add esi, 0xc
cmp edi, eax
jl 0x10051d7b
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x18
ret
pop edi
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
pop esi
pop ebx
pop ebp
add esp, 0x18
ret
cmp eax, 2
jne 0x10051e02
mov eax, dword [esp + 0x2c]
mov ebp, dword [ebp + 4]
cmp eax, ebx
mov dword [esp + 0x10], ebx
jle 0x10051f15
lea esi, [esp + 0x3c]
lea edi, [eax - 1]
mov eax, dword [esi]
mov edx, dword [ebp]
mov ecx, dword [eax + 4]
add eax, 8
push ecx
push eax
mov ecx, ebp
call dword [edx + 0x24]
add esi, 0xc
dec edi
jne 0x10051dde
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x18
ret
cmp eax, 3
jne 0x10051f15
mov edi, dword [esp + 0x2c]
mov edx, dword [ebp + 4]
xor ecx, ecx
cmp edi, ebx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
jle 0x10051e52
lea edx, [esp + 0x3c]
lea esi, [edi - 1]
mov eax, dword [edx]
mov eax, dword [eax + 4]
test eax, eax
jle 0x10051e36
cmp ecx, eax
jg 0x10051e36
mov ecx, eax
add edx, 0xc
dec esi
jne 0x10051e27
test ecx, ecx
jle 0x10051e52
push ecx
call fcn.100669fc
add esp, 4
mov dword [esp + 0x14], eax
mov ebx, 1
cmp edi, ebx
mov dword [esp + 0x20], ebx
jle 0x10051f08
lea ecx, [esp + 0x3c]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x18]
mov eax, dword [edx]
mov ebx, dword [eax + 4]
test ebx, ebx
jle 0x10051ed5
mov edi, dword [esp + 0x14]
mov ecx, ebx
lea esi, [eax + 8]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 1
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x24]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp + 0x130]
mov esi, dword [esp + 0x14]
lea edx, [ebp + 0xc]
push edx
lea edx, [ebp + 0x2c]
push ecx
push edx
push ebx
push esi
push eax
call fcn.10053a30
mov ecx, dword [esp + 0x34]
add esp, 0x18
lea eax, [esp + 0x24]
push 0
push eax
push ebx
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10051ef3
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
inc eax
add edx, 0xc
cmp eax, edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], edx
jl 0x10051e66
jmp 0x10051f08
mov edx, dword [esp + 0x14]
push edx
call fcn.10066a25
add esp, 4
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
push eax
call fcn.10066a25
add esp, 4
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x18
ret