joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002388a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10207390]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x102134e0]
test al, al
jne 0x10023923
and word [ebp - 0x20c], 0
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
call fcn.10085bc0
add esp, 0xc
push 1
push 0x1a
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1002391e
lea eax, [ebp - 0x20c]
push eax
call fcn.100867a3
lea eax, [ebp - 0x20c]
mov dword [esp], str.config_systemprofile
push eax
call fcn.100885cc
test eax, eax
pop ecx
pop ecx
jne 0x10023917
lea eax, [ebp - 0x20c]
push str.cocuments_and_settingslocalService
push eax
call fcn.100885cc
test eax, eax
pop ecx
pop ecx
je 0x1002391e
mov byte [0x102134e0], 1
mov al, byte [0x102134e0]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008545e
leave
ret

Function at 0x100239d5
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x1017d069
call fcn.1008546d
xor esi, esi
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], 0x104
call fcn.1003cec0
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.1003ce97
test eax, eax
lea eax, [ebp - 0x10]
push eax
je 0x10023a4b
mov edi, 0xf013f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x10023a77
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
je 0x10023a52
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10023a77
mov edi, 0xf003f
jmp 0x10023a10
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.1003cdba
call fcn.10085545
ret 0xc
Function at 0x10024813
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
sub esp, 0x83c
lea ebp, [esp - 4]
mov eax, dword [0x10207390]
xor eax, ebp
mov dword [ebp + 0x83c], eax
push 4
mov eax, 0x1017d1cc
call fcn.1008546d
mov dword [ebp - 0x10], ecx
mov ebx, dword [ebp + 0x848]
mov esi, 0x206
xor edi, edi
push esi
lea eax, [ebp + 0x1e]
push edi
push eax
mov word [ebp + 0x1c], di
call fcn.10085bc0
add esp, 0xc
push edi
push 0x1a
lea eax, [ebp + 0x1c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp]
call fcn.100015f0
push str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar_
lea ecx, [ebp]
mov dword [ebp - 4], edi
call fcn.10003640
push ebx
lea ecx, [ebp]
call fcn.10003640
push str..lnk
lea ecx, [ebp]
call fcn.10003640
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x100248a5
lea eax, [ebp + 4]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call ebx
test eax, eax
jne 0x100248e4
push edi
push 1
lea ecx, [ebp]
call fcn.100017c0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x83c]
xor ecx, ebp
call fcn.1008545e
add ebp, 0x840
leave
ret 4
push esi
lea eax, [ebp + 0x226]
push edi
push eax
mov word [ebp + 0x224], di
call fcn.10085bc0
push esi
lea eax, [ebp + 0x42e]
push edi
push eax
mov word [ebp + 0x42c], di
call fcn.10085bc0
mov eax, dword [ebp + 4]
add esp, 0x18
cmp dword [ebp + 0x18], 8
jae 0x1002491d
lea eax, [ebp + 4]
push eax
lea eax, [ebp + 0x224]
push eax
call fcn.100860cd
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
lea eax, [ebp + 0x42c]
push eax
lea eax, [ebp + 0x224]
push eax
call fcn.1002376a
push esi
lea eax, [ebp + 0x636]
push edi
push eax
mov word [ebp + 0x634], di
call fcn.10085bc0
add esp, 0xc
push 0x104
lea eax, [ebp + 0x634]
push eax
lea eax, [ebp + 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [ebp + 0x634]
push eax
call fcn.10085b54
test eax, eax
pop ecx
jne 0x10024999
lea eax, [ebp + 0x42c]
push eax
lea eax, [ebp + 0x634]
push eax
call fcn.100860cd
pop ecx
pop ecx
lea eax, [ebp + 0x634]
push eax
call ebx
xor esi, esi
test eax, eax
jne 0x100249ba
push edi
push 1
lea ecx, [ebp]
call fcn.100017c0
mov eax, esi
jmp 0x100248bf
inc esi
jmp 0x100249a8
Function at 0x10024ead
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x240
lea ebp, [esp - 4]
mov eax, dword [0x10207390]
xor eax, ebp
mov dword [ebp + 0x240], eax
push 8
mov eax, 0x1017d2c0
call fcn.1008546d
mov dword [ebp - 0x10], ecx
mov ebx, dword [ebp + 0x24c]
xor esi, esi
push 0x206
lea eax, [ebp + 0x3a]
push esi
push eax
mov word [ebp + 0x38], si
call fcn.10085bc0
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add esp, 0xc
push esi
push 0x19
lea eax, [ebp + 0x38]
push eax
push esi
call edi
test eax, eax
je 0x10024f58
lea eax, [ebp + 0x38]
push eax
lea ecx, [ebp + 0x1c]
call fcn.100015f0
push 0x101ebeec
lea ecx, [ebp + 0x1c]
mov dword [ebp - 4], esi
call fcn.10003640
cmp dword [ebp + 0x34], 8
mov eax, dword [ebp + 0x20]
jae 0x10024f2e
lea eax, [ebp + 0x20]
mov ecx, dword [ebp - 0x10]
push ebx
push eax
call fcn.10024458
cmp eax, esi
push esi
mov dword [ebp - 0x14], eax
lea ecx, [ebp + 0x1c]
push 1
je 0x10024f4f
call fcn.100017c0
mov eax, dword [ebp - 0x14]
jmp 0x10024fb1
or dword [ebp - 4], 0xffffffff
call fcn.100017c0
push esi
push 0x10
lea eax, [ebp + 0x38]
push eax
push esi
call edi
test eax, eax
je 0x10024faf
lea eax, [ebp + 0x38]
push eax
lea ecx, [ebp]
call fcn.100015f0
xor edi, edi
inc edi
push 0x101ebeec
lea ecx, [ebp]
mov dword [ebp - 4], edi
call fcn.10003640
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x10024f91
lea eax, [ebp + 4]
mov ecx, dword [ebp - 0x10]
push ebx
push eax
call fcn.10024458
push esi
lea ecx, [ebp]
push edi
mov ebx, eax
call fcn.100017c0
cmp ebx, esi
je 0x10024faf
mov eax, ebx
jmp 0x10024fb1
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x240]
xor ecx, ebp
call fcn.1008545e
add ebp, 0x244
leave
ret 4
Function at 0x10026437
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x10207390]
xor eax, ebp
mov dword [ebp + 0x18c], eax
push esi
push edi
mov edi, dword [ebp + 0x198]
xor esi, esi
push 0x206
lea eax, [ebp - 0x7a]
push esi
push eax
mov dword [ebp - 0x80], ecx
mov word [ebp - 0x7c], si
call fcn.10085bc0
add esp, 0xc
push esi
push 0x17
lea eax, [ebp - 0x7c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x100264a6
lea eax, [ebp - 0x7c]
push 0x101ebeec
push eax
call fcn.100860a3
pop ecx
pop ecx
mov ecx, dword [ebp - 0x80]
push edi
lea eax, [ebp - 0x7c]
push eax
call fcn.10025bac
mov esi, eax
mov ecx, dword [ebp + 0x18c]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1008545e
add ebp, 0x190
leave
ret 4

Function at 0x10027ddc
Capabilities:
Check if file exists

Disassembly:
push ebp
sub esp, 0x410
lea ebp, [esp - 4]
mov eax, dword [0x10207390]
xor eax, ebp
mov dword [ebp + 0x410], eax
push 0x40
mov eax, 0x1017d7d9
call fcn.1008546d
mov esi, dword [ebp + 0x41c]
mov eax, dword [ebp + 0x420]
xor ebx, ebx
cmp esi, ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], eax
je 0x10027f3e
push 0x206
lea eax, [ebp + 2]
push ebx
push eax
mov word [ebp], bx
call fcn.10085bc0
lea eax, [ebp - 0x30]
push eax
call fcn.10027c75
add esp, 0x10
cmp dword [eax + 0x18], 8
jb 0x10027e46
mov eax, dword [eax + 4]
jmp 0x10027e49
add eax, 4
push str..znpf
push esi
push eax
mov edi, 0x1018bc78
lea eax, [ebp]
push edi
push eax
call fcn.10004df5
add esp, 0x14
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.100017c0
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp]
push eax
call esi
test eax, eax
je 0x10027ead
lea eax, [ebp]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.10022f83
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
push 0xffffffffffffffff
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.10001d30
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.100017c0
mov al, 1
jmp 0x10027f40
push 0x206
lea eax, [ebp + 0x20a]
push ebx
push eax
mov word [ebp + 0x208], bx
call fcn.10085bc0
lea eax, [ebp - 0x30]
push eax
call fcn.10027c75
add esp, 0x10
cmp dword [eax + 0x18], 8
jb 0x10027edd
mov eax, dword [eax + 4]
jmp 0x10027ee0
add eax, 4
push str..sznpf
push dword [ebp - 0x14]
push eax
lea eax, [ebp + 0x208]
push edi
push eax
call fcn.10004df5
add esp, 0x14
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0x30]
call fcn.100017c0
lea eax, [ebp + 0x208]
push eax
call esi
test eax, eax
je 0x10027f3e
lea eax, [ebp + 0x208]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.10022f83
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
push 0xffffffffffffffff
push ebx
push eax
mov dword [ebp - 4], edi
call fcn.10001d30
push ebx
push edi
lea ecx, [ebp - 0x4c]
jmp 0x10027ea1
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.1008545e
add ebp, 0x414
leave
ret
Function at 0x10029156
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
xor edi, edi
push edi
push 0x1002908a
push edi
push edi
mov dword [0x1021368c], edi
call dword [sym.imp.USER32.dll_EnumDisplayMonitors]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push edi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov ebx, eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x20]
push ecx
push eax
call esi
lea eax, [ebp - 0x30]
push eax
push ebx
call esi
mov eax, dword [ebp - 8]
mov ecx, dword [0x1021368c]
sub eax, dword [ebp - 0x10]
cmp ecx, 1
jle 0x100291db
cmp ecx, edi
jle 0x100291db
mov esi, 0x102135c0
mov edx, dword [esi]
cmp edx, eax
jle 0x100291d5
mov eax, edx
add esi, 0x10
dec ecx
jne 0x100291cd
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10029305
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
xor esi, esi
push esi
lea eax, [ebp - 0x20]
push eax
push esi
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push esi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x10]
push ecx
push eax
call esi
lea eax, [ebp - 0x30]
push eax
push edi
call esi
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
pop edi
pop esi
leave
ret

Function at 0x1002934f
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
xor esi, esi
push esi
lea eax, [ebp - 0x10]
push eax
push esi
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push esi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x20]
push ecx
push eax
call esi
lea eax, [ebp - 0x30]
push eax
push edi
call esi
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
pop edi
pop esi
leave
ret
Function at 0x100293b4
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0xb94]
sub esp, 0xc14
mov eax, dword [0x10207390]
xor eax, ebp
mov dword [ebp + 0xb90], eax
push esi
push edi
mov esi, 0x206
xor edi, edi
push esi
lea eax, [ebp + 0x782]
push edi
push eax
mov word [ebp + 0x780], di
call fcn.10085bc0
lea eax, [ebp + 0x780]
push str.C:log_
push eax
call fcn.100860cd
push esi
lea eax, [ebp + 0x372]
push edi
push eax
mov word [ebp + 0x370], di
call fcn.10085bc0
push esi
lea eax, [ebp + 0x98a]
push edi
push eax
mov word [ebp + 0x988], di
call fcn.10085bc0
add esp, 0x2c
push 0x104
lea eax, [ebp + 0x988]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp + 0x988]
push 0x5c
push eax
call fcn.10088966
pop ecx
mov word [eax], di
cmp dword [0x10213690], edi
pop ecx
je 0x10029474
lea eax, [ebp + 0x988]
push eax
lea eax, [ebp + 0x780]
push str._slog_
push eax
call fcn.10004df5
add esp, 0xc
push 0x3e6
lea eax, [ebp - 0x76]
push edi
push eax
mov word [ebp - 0x78], di
call fcn.10085bc0
lea eax, [ebp + 0x780]
push eax
lea eax, [ebp + 0x578]
push str._sgswb.log
push eax
call fcn.10004df5
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x18
lea eax, [ebp + 0x578]
push eax
call esi
test eax, eax
je 0x100295b2
lea eax, [ebp + 0x988]
push ebx
push eax
call fcn.10085b54
lea eax, [ebp + eax*2 + 0x98a]
push eax
lea eax, [ebp + 0x370]
push eax
call fcn.100860cd
lea eax, [ebp + 0x370]
push eax
lea eax, [ebp + 0x780]
push eax
lea eax, [ebp + 0x578]
push str._s_s.txt
push eax
call fcn.10004df5
lea eax, [ebp + 0xba0]
push eax
push dword [ebp + 0xb9c]
lea eax, [ebp - 0x78]
push 0x1f3
push eax
call fcn.100885b1
add esp, 0x2c
lea eax, [ebp + 0x578]
push eax
mov word [ebp + 0x36e], di
mov dword [ebp - 0x7c], edi
call esi
xor ebx, ebx
inc ebx
test eax, eax
je 0x10029534
mov dword [ebp - 0x7c], ebx
lea eax, [ebp + 0x578]
push 0x1018aa60
push eax
call fcn.10086090
mov esi, eax
cmp esi, edi
pop ecx
pop ecx
je 0x100295b1
cmp dword [ebp - 0x7c], edi
jne 0x10029569
push esi
push 2
lea eax, [ebp - 0x80]
push ebx
push eax
mov dword [ebp - 0x80], 0xfeff
call fcn.10085f48
add esp, 0x10
lea eax, [ebp - 0x78]
push eax
call fcn.10085b54
push esi
add eax, eax
push eax
lea eax, [ebp - 0x78]
push ebx
push eax
call fcn.10085f48
push esi
push 2
lea eax, [ebp - 0x7c]
push ebx
push eax
mov dword [ebp - 0x7c], 0xd
call fcn.10085f48
push esi
push 2
lea eax, [ebp - 0x7c]
push ebx
push eax
mov dword [ebp - 0x7c], 0xa
call fcn.10085f48
push esi
call fcn.10085d6d
add esp, 0x38
pop ebx
mov ecx, dword [ebp + 0xb90]
pop edi
xor ecx, ebp
pop esi
call fcn.1008545e
add ebp, 0xb94
leave
ret
Function at 0x100295c9
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1fb4]
mov eax, 0x2034
call fcn.100860f0
mov eax, dword [0x10207390]
xor eax, ebp
mov dword [ebp + 0x1fb0], eax
push esi
push edi
mov edi, 0x206
xor esi, esi
push edi
lea eax, [ebp + 0x1ba2]
push esi
push eax
mov word [ebp + 0x1ba0], si
call fcn.10085bc0
lea eax, [ebp + 0x1ba0]
push str.C:log_
push eax
call fcn.100860cd
push edi
lea eax, [ebp + 0x1792]
push esi
push eax
mov word [ebp + 0x1790], si
call fcn.10085bc0
push edi
lea eax, [ebp + 0x1daa]
push esi
push eax
mov word [ebp + 0x1da8], si
call fcn.10085bc0
add esp, 0x2c
push 0x104
lea eax, [ebp + 0x1da8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp + 0x1da8]
push 0x5c
push eax
call fcn.10088966
pop ecx
mov word [eax], si
cmp dword [0x10213690], esi
pop ecx
je 0x1002968d
lea eax, [ebp + 0x1da8]
push eax
lea eax, [ebp + 0x1ba0]
push str._slog_
push eax
call fcn.10004df5
add esp, 0xc
push 0x7fe
lea eax, [ebp + 0xf92]
push esi
push eax
mov word [ebp + 0xf90], si
call fcn.10085bc0
lea eax, [ebp + 0x1ba0]
push eax
lea eax, [ebp + 0x1998]
push str._sgswb.log
push eax
call fcn.10004df5
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x18
lea eax, [ebp + 0x1998]
push eax
call edi
test eax, eax
je 0x10029817
lea eax, [ebp + 0x1da8]
push ebx
push eax
call fcn.10085b54
lea eax, [ebp + eax*2 + 0x1daa]
push eax
lea eax, [ebp + 0x1790]
push eax
call fcn.100860cd
lea eax, [ebp + 0x1790]
push eax
lea eax, [ebp + 0x1ba0]
push eax
lea eax, [ebp + 0x1998]
push str._s_s.txt
push eax
call fcn.10004df5
lea eax, [ebp + 0x1fc0]
push eax
push dword [ebp + 0x1fbc]
lea eax, [ebp + 0xf90]
push 0x3ff
push eax
call fcn.100885b1
push esi
call fcn.10088fe8
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x7c], edx
call fcn.10088d04
lea ecx, [ebp + 0xf90]
push ecx
push dword [eax]
mov ecx, dword [eax + 0x10]
push dword [eax + 4]
inc ecx
push dword [eax + 8]
push dword [eax + 0xc]
mov eax, dword [eax + 0x14]
push ecx
add eax, 0x76c
push eax
lea eax, [ebp - 0x70]
push str.__d__d__d__d__d__d_:_s
push eax
call fcn.10004df5
add esp, 0x58
lea eax, [ebp + 0x1998]
push eax
mov word [ebp + 0x178e], si
mov dword [ebp - 0x74], esi
call edi
xor ebx, ebx
inc ebx
test eax, eax
je 0x10029799
mov dword [ebp - 0x74], ebx
lea eax, [ebp + 0x1998]
push 0x1018aa60
push eax
call fcn.10086090
mov edi, eax
cmp edi, esi
pop ecx
pop ecx
je 0x10029816
cmp dword [ebp - 0x74], esi
jne 0x100297ce
push edi
push 2
lea eax, [ebp - 0x78]
push ebx
push eax
mov dword [ebp - 0x78], 0xfeff
call fcn.10085f48
add esp, 0x10
lea eax, [ebp - 0x70]
push eax
call fcn.10085b54
push edi
add eax, eax
push eax
lea eax, [ebp - 0x70]
push ebx
push eax
call fcn.10085f48
push edi
push 2
lea eax, [ebp - 0x74]
push ebx
push eax
mov dword [ebp - 0x74], 0xd
call fcn.10085f48
push edi
push 2
lea eax, [ebp - 0x74]
push ebx
push eax
mov dword [ebp - 0x74], 0xa
call fcn.10085f48
push edi
call fcn.10085d6d
add esp, 0x38
pop ebx
mov ecx, dword [ebp + 0x1fb0]
pop edi
xor ecx, ebp
pop esi
call fcn.1008545e
add ebp, 0x1fb4
leave
ret
Function at 0x10029a4f
Capabilities:
Check if file exists
Create directory
Get common file path
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0xbb8]
sub esp, 0xc38
mov eax, dword [0x10207390]
xor eax, ebp
mov dword [ebp + 0xbb4], eax
push ebx
push esi
push edi
mov esi, 0x206
xor edi, edi
push esi
lea eax, [ebp + 0x59e]
push edi
push eax
mov dword [ebp - 0x80], ecx
mov word [ebp + 0x59c], di
call fcn.10085bc0
push esi
lea eax, [ebp + 0x396]
push edi
push eax
mov word [ebp + 0x394], di
call fcn.10085bc0
push esi
lea eax, [ebp + 0x18e]
push edi
push eax
mov word [ebp + 0x18c], di
call fcn.10085bc0
push esi
lea eax, [ebp - 0x7a]
push edi
push eax
mov word [ebp - 0x7c], di
call fcn.10085bc0
push esi
lea eax, [ebp + 0x7a6]
push edi
push eax
mov word [ebp + 0x7a4], di
call fcn.10085bc0
push esi
lea eax, [ebp + 0x9ae]
push edi
push eax
mov word [ebp + 0x9ac], di
call fcn.10085bc0
add esp, 0x48
push edi
push 0x2b
lea eax, [ebp + 0x7a4]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp + 0x7a4]
push str._shiqiang_
push eax
call fcn.100860a3
pop ecx
pop ecx
lea eax, [ebp + 0x7a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10029b35
push edi
lea eax, [ebp + 0x7a4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp + 0x7a4]
push eax
lea eax, [ebp + 0x9ac]
push eax
call fcn.100860cd
lea eax, [ebp + 0x9ac]
push str.wnsoft.ini
push eax
call fcn.100860a3
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 0x10
lea eax, [ebp + 0x9ac]
push eax
push 0x104
lea eax, [ebp + 0x59c]
push eax
mov ebx, 0x101ebf0c
push ebx
push str.OnlyIdentifier1
mov edi, str.Globals
push edi
call esi
lea eax, [ebp + 0x9ac]
push eax
push 0x104
lea eax, [ebp + 0x394]
push eax
push ebx
push str.OnlyIdentifier2
push edi
call esi
lea eax, [ebp + 0x9ac]
push eax
push 0x104
lea eax, [ebp + 0x18c]
push eax
push ebx
push str.OnlyIdentifier3
push edi
call esi
lea eax, [ebp + 0x9ac]
push eax
push 0x104
lea eax, [ebp - 0x7c]
push eax
push ebx
push str.OnlyIdentifier4
push edi
call esi
lea eax, [ebp + 0x59c]
push eax
call fcn.10085b54
mov esi, eax
lea eax, [ebp + 0x394]
push eax
call fcn.10085b54
mov edi, eax
lea eax, [ebp + 0x18c]
push eax
call fcn.10085b54
mov ebx, eax
lea eax, [ebp - 0x7c]
push eax
call fcn.10085b54
add esp, 0x10
test esi, esi
je 0x10029c71
test edi, edi
je 0x10029c71
test ebx, ebx
je 0x10029c71
test eax, eax
je 0x10029c71
mov esi, dword [ebp - 0x80]
lea eax, [ebp + 0x59c]
push eax
push dword [esi]
call fcn.100860cd
lea eax, [ebp + 0x394]
push eax
mov eax, dword [esi]
add eax, 0x208
push eax
call fcn.100860cd
lea eax, [ebp + 0x18c]
push eax
mov eax, dword [esi]
add eax, 0x410
push eax
call fcn.100860cd
lea eax, [ebp - 0x7c]
push eax
mov eax, dword [esi]
add eax, 0x618
push eax
call fcn.100860cd
xor eax, eax
add esp, 0x20
inc eax
jmp 0x10029c73
xor eax, eax
mov ecx, dword [ebp + 0xbb4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008545e
add ebp, 0xbb8
leave
ret
Function at 0x10029c8b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9b8]
sub esp, 0xa38
mov eax, dword [0x10207390]
xor eax, ebp
mov dword [ebp + 0x9b4], eax
push ebx
push esi
push edi
mov esi, 0x206
xor edi, edi
push esi
lea eax, [ebp + 0x5a6]
push edi
push eax
mov dword [ebp - 0x80], ecx
mov word [ebp + 0x5a4], di
call fcn.10085bc0
push esi
lea eax, [ebp + 0x39e]
push edi
push eax
mov word [ebp + 0x39c], di
call fcn.10085bc0
push esi
lea eax, [ebp - 0x72]
push edi
push eax
mov word [ebp - 0x74], di
call fcn.10085bc0
push esi
lea eax, [ebp + 0x196]
push edi
push eax
mov word [ebp + 0x194], di
call fcn.10085bc0
push esi
lea eax, [ebp + 0x7ae]
push edi
push eax
mov word [ebp + 0x7ac], di
call fcn.10085bc0
lea eax, [ebp + 0x7ac]
push 0x1018a1c8
push eax
call fcn.100860cd
add esp, 0x44
lea eax, [ebp + 0x7ac]
push str.MySoft
push eax
call fcn.100860a3
lea eax, [ebp + 0x7ac]
push 0x101ebeec
push eax
call fcn.100860a3
add esp, 0x10
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push edi
lea eax, [ebp + 0x7ac]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10029dd5
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x5a4]
push eax
push edi
push edi
push str.OnlyIdentifier1
push dword [ebp - 0x7c]
mov dword [ebp - 0x78], 0x104
call esi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x39c]
push eax
push edi
push edi
push str.OnlyIdentifier2
push dword [ebp - 0x7c]
call esi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
push edi
push edi
push str.OnlyIdentifier3
push dword [ebp - 0x7c]
call esi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x194]
push eax
push edi
push edi
push str.OnlyIdentifier4
push dword [ebp - 0x7c]
call esi
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0x5a4]
push eax
call fcn.10085b54
mov esi, eax
lea eax, [ebp + 0x39c]
push eax
call fcn.10085b54
mov ebx, eax
lea eax, [ebp - 0x74]
push eax
call fcn.10085b54
mov dword [ebp - 0x78], eax
lea eax, [ebp + 0x194]
push eax
call fcn.10085b54
add esp, 0x10
cmp esi, edi
je 0x10029e78
cmp ebx, edi
je 0x10029e78
cmp dword [ebp - 0x78], edi
je 0x10029e78
cmp eax, edi
je 0x10029e78
mov esi, dword [ebp - 0x80]
lea eax, [ebp + 0x5a4]
push eax
push dword [esi]
call fcn.100860cd
lea eax, [ebp + 0x39c]
push eax
mov eax, dword [esi]
add eax, 0x208
push eax
call fcn.100860cd
lea eax, [ebp - 0x74]
push eax
mov eax, dword [esi]
add eax, 0x410
push eax
call fcn.100860cd
lea eax, [ebp + 0x194]
push eax
mov eax, dword [esi]
add eax, 0x618
push eax
call fcn.100860cd
xor eax, eax
add esp, 0x20
inc eax
jmp 0x10029e7a
xor eax, eax
mov ecx, dword [ebp + 0x9b4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008545e
add ebp, 0x9b8
leave
ret