joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005ba90
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159245
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
mov eax, dword [0x101ba0ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x101c82ac]
mov edi, dword [ebp + 8]
test esi, esi
jne 0x1005bafa
push 0x1c8
call fcn.1010a803
mov esi, eax
add esp, 4
mov dword [ebp - 0xdc], esi
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.1003f040
mov dword [ebp - 4], 0xffffffff
mov dword [0x101c82ac], esi
add esi, 0x54
cmp dword [esi + 0x14], 8
jb 0x1005bb05
mov esi, dword [esi]
push esi
push 0x64
lea eax, [ebp - 0xd8]
push eax
push 0x1018444c
push str.UserID
push 0x1018f350
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0xd8], 0
jne 0x1005bb32
xor ecx, ecx
jmp 0x1005bb4f
lea ecx, [ebp - 0xd8]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005bb40
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0xd8]
mov ecx, edi
push eax
call fcn.10041f80
cmp dword [edi + 0x10], 0
seta al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1010a7f2
mov esp, ebp
pop ebp
ret 4

Function at 0x1005bc90
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x101ba0ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.1005bb90
push 0x208
mov esi, eax
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.1012bcf0
add esp, 0xc
lea eax, [ebp - 0x414]
push esi
push 0x104
push eax
push str.null
push str.FirstInstallDate
push 0x1018f868
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.1012bcf0
call fcn.1011220a
push eax
lea eax, [ebp - 0x20c]
push 0x1018f870
push eax
call fcn.10041b40
add esp, 0x18
lea eax, [ebp - 0x20c]
lea ecx, [ebp - 0x414]
pop esi
nop dword [eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x1005bd57
test dx, dx
je 0x1005bd42
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x1005bd57
add ecx, 4
add eax, 4
test dx, dx
jne 0x1005bd20
xor eax, eax
test eax, eax
sete al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010a7f2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
sbb eax, eax
or eax, 1
test eax, eax
sete al
xor ecx, ebp
call fcn.1010a7f2
mov esp, ebp
pop ebp
ret
Function at 0x1005bd70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.1005bc30
test al, al
je 0x1005be15
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
call fcn.1005b190
test al, al
je 0x1005be15
cmp dword [ebp - 4], 1
jg 0x1005be15
call fcn.1005bb90
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
push edi
push 0
push str.ShowDay1
push str.VipExpire
call esi
push edi
push 0
push str.ShowDay2
push str.VipExpire
mov ebx, eax
call esi
push edi
push 0
push str.ShowDay3
push str.VipExpire
mov dword [ebp - 4], eax
call esi
test ebx, ebx
je 0x1005bdf3
cmp dword [ebp - 4], 0
jne 0x1005bdfc
call fcn.1011220a
sub eax, ebx
cmp eax, 3
jl 0x1005be15
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x1005be15
call fcn.1011220a
sub eax, ebx
cmp eax, 7
jl 0x1005be15
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1005d7e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159436
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x101ba0ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
lea edi, [ebx + 8]
mov dword [ebx], vtable.Config.0
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
cmp dword [edi + 0x14], 0x10
jb 0x1005d82e
mov eax, dword [edi]
jmp 0x1005d830
mov eax, edi
mov byte [eax], 0
mov dword [ebp - 4], 0
lea esi, [ebx + 0x30]
xor eax, eax
mov dword [ebp - 0x14], esi
mov word [ebx + 0x20], ax
xorps xmm0, xmm0
movq qword [ebx + 0x22], xmm0
mov dword [ebx + 0x2a], eax
mov word [ebx + 0x2e], ax
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.10044090
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 1
cmp edi, eax
je 0x1005d878
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
call fcn.100461b0
cmp dword [edi + 0x14], 0x10
jb 0x1005d882
mov eax, dword [edi]
jmp 0x1005d884
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1005d8a4
cmp dword [edi + 0x14], 0x10
jb 0x1005d897
mov edi, dword [edi]
lea eax, [ebx + 0x38]
push eax
push edi
call fcn.101403be
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1005dd50
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3ec
mov eax, dword [0x101ba0ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add ecx, 8
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
cmp dword [ecx + 0x14], 0x10
jb 0x1005dd78
mov ecx, dword [ecx]
cmp dword [edx + 0x14], 0x10
jb 0x1005dd80
mov edx, dword [edx]
cmp dword [eax + 0x14], 0x10
jb 0x1005dd88
mov eax, dword [eax]
push ecx
push 0x190
lea ecx, [ebp - 0x3ec]
push ecx
push 0x10184650
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x1005de0b
cmp byte [ebp - 0x3ec], 0
jne 0x1005ddd3
xor ecx, ecx
lea eax, [ebp - 0x3ec]
push ecx
push eax
mov ecx, esi
call fcn.10046530
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010a7f2
mov esp, ebp
pop ebp
ret 0xc
lea ecx, [ebp - 0x3ec]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005dde0
sub ecx, edx
lea eax, [ebp - 0x3ec]
push ecx
push eax
mov ecx, esi
call fcn.10046530
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010a7f2
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.1010a7f2
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1005de20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101594b8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x101ba0ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
cmp dword [ecx + 0x1c], 0x10
lea ebx, [ecx + 8]
mov dword [ebp - 0x24], ebx
jb 0x1005de5b
mov eax, dword [ebx]
jmp 0x1005de5d
mov eax, ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x1005de7c
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
call fcn.10044090
mov esi, eax
mov dword [ebp - 0x2c], esi
mov edx, dword [ebp - 0x10]
mov dword [ebp - 4], 0
mov edi, dword [edx + 0x30]
mov dword [ebp - 0x20], edi
mov ecx, dword [edi]
mov dword [ebp - 0x18], ecx
cmp ecx, edi
je 0x1005df3d
mov esi, dword [ecx + 0x28]
lea eax, [ecx + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
cmp eax, esi
je 0x1005df21
mov edi, dword [ebp - 0x1c]
add eax, 0x10
mov ecx, edx
mov dword [ebp - 0x1c], eax
lea ebx, [eax + 0x18]
push ebx
push eax
push edi
call fcn.1005dd50
push edi
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x2c]
call fcn.1005e560
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x3c]
push dword [ebp - 0x1c]
push eax
lea ecx, [ecx + 0x28]
call fcn.1005c510
mov ecx, dword [ebp - 0x3c]
add ecx, 0x28
cmp ecx, ebx
je 0x1005df0c
push 0xffffffffffffffff
push 0
push ebx
call fcn.100461b0
lea ecx, [ebp - 0x14]
call fcn.10043dd0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
cmp eax, esi
jne 0x1005dec6
mov edi, dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
call fcn.10043dd0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
cmp ecx, edi
jne 0x1005deb1
mov esi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x2c]
lea edi, [edx + 0x30]
cmp edi, eax
je 0x1005df5a
mov eax, dword [edi]
mov dword [edi], esi
mov ecx, dword [edi + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [edi + 4], eax
mov dword [ebp - 0x28], ecx
cmp dword [ebx + 0x14], 0x10
jb 0x1005df62
mov ebx, dword [ebx]
lea eax, [edx + 0x38]
push eax
push ebx
call fcn.101403be
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
add esp, 8
push eax
push dword [eax]
lea eax, [ebp - 0x24]
push eax
call fcn.1005e070
push dword [ebp - 0x2c]
call fcn.100e3fa0
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1005fd70
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0x10
jb 0x1005fd7d
mov eax, dword [esi]
jmp 0x1005fd7f
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
je 0x1005fd8f
xor al, al
pop esi
ret
cmp dword [esi + 0x14], 0x10
jb 0x1005fd99
mov eax, dword [esi]
jmp 0x1005fd9b
mov eax, esi
push 0
push 0x80
push 4
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x1c], eax
cmp eax, 0xffffffff
je 0x1005fd8b
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push eax
push 0
push 2
push 0
push dword [esi + 0x1c]
mov dword [esi + 0x18], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 0x24], eax
test eax, eax
je 0x1005fe07
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x20], eax
test eax, eax
jne 0x1005fe07
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x24], 0
cmp dword [esi + 0x20], 0
pop esi
setne al
ret
Function at 0x10060c10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159608
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x101ba0ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10060d3e
cmp byte [ebx + 0x3d], 0
je 0x10060d3e
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x10060c69
xor al, al
jmp 0x10060d40
push 0
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.100611d0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x10060ccf
sub eax, 1
je 0x10060cd3
mov ecx, dword [ebp - 0x14]
sub eax, 2
je 0x10060d26
xor bl, bl
jmp 0x10060d28
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x10060d08
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.1013f8b0
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x10060ccb
cmp byte [ebx + 0x3d], 0
je 0x10060d26
test esi, esi
jne 0x10060c91
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.1004b2d0
jmp 0x10060c8e
mov bl, 1
cmp ecx, 0x10
jb 0x10060d3a
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.10046700
mov al, bl
jmp 0x10060d40
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1010a7f2
mov esp, ebp
pop ebp
ret
Function at 0x10060e60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10158aa6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x101ba0ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1010a803
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.10104f2f
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100612a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159698
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101ba0ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x100612ef
mov eax, dword [esi]
jmp 0x100612f1
mov eax, esi
push 0xffffffffffffffff
push 0
push dword [ebp + 8]
mov byte [eax], 0
call fcn.100461b0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
push 0x10
mov dword [ebp - 4], 0
call fcn.1010a803
xorps xmm0, xmm0
mov dword [ebp + 8], eax
add esp, 4
mov dword [eax], vtable.Darts::DoubleArrayImpl_void__void__int__void_.0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [esi + 0x28], eax
mov eax, esi
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
movsd qword [esi + 0x38], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10064190
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159a90
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x101ba0ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x48], edi
call fcn.10064f20
mov dword [ebp - 4], 0
mov dword [edi], vtable.EngineImpl.0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov al, byte [ebp - 0x40]
mov byte [ebp - 0x30], al
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], vtable.._AV___Func_impl_V___Binder_U_Unforced_std__P8EngineImpl__AEXPAVContext___ZQAV3_ABU___Ph__00_2__std__V__allocator_H_2_XPAVContext___std__.0
mov dword [ebp - 0x34], 0x10064a40
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 5
mov ecx, dword [edi + 4]
mov eax, dword [ecx + 0x88]
lea esi, [ecx + 0x8c]
mov dword [ebp - 0x3c], eax
inc eax
mov dword [ecx + 0x88], eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
mov ecx, esi
push eax
call fcn.10066680
push eax
add eax, 0x10
push eax
push ecx
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.10066710
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1006429e
mov edx, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov al, byte [ebp - 0x40]
mov byte [ebp - 0x30], al
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], vtable.._AV___Func_impl_V___Binder_U_Unforced_std__P8EngineImpl__AEXPAVContext___ZQAV3_ABU___Ph__00_2__std__V__allocator_H_2_XPAVContext___std__.0
mov dword [ebp - 0x34], 0x10064a10
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 7
mov ecx, dword [edi + 4]
mov eax, dword [ecx + 0x94]
lea esi, [ecx + 0x98]
mov dword [ebp - 0x3c], eax
inc eax
mov dword [ecx + 0x94], eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
mov ecx, esi
push eax
call fcn.10066680
push eax
add eax, 0x10
push eax
push ecx
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.10066710
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x10064314
mov esi, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne al
movzx edx, al
push edx
call dword [esi + 0x10]
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.100644a0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1010a7f2
mov esp, ebp
pop ebp
ret
Function at 0x100670c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015a105
mov eax, dword fs:[0]
push eax
sub esp, 0x418
mov eax, dword [0x101ba0ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ecx + 8]
lea eax, [edx + 1]
mov dword [ecx + 8], eax
cmp edx, 4
jge 0x100671e4
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.1012bcf0
mov esi, dword [0x101c82ac]
add esp, 0xc
test esi, esi
jne 0x1006714f
push 0x1c8
call fcn.1010a803
mov esi, eax
add esp, 4
mov dword [ebp - 0x424], esi
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.1003f040
mov dword [ebp - 4], 0xffffffff
mov dword [0x101c82ac], esi
cmp dword [esi + 0xb0], 8
lea ecx, [esi + 0x9c]
jb 0x10067160
mov ecx, dword [ecx]
lea edx, [ebp - 0x218]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x10067166
lea edi, [ebp - 0x218]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10067180
mov ecx, 6
lea eax, [ebp - 0x218]
mov esi, str.WnPlugin.exe
rep movsd dword es:[edi], dword [esi]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100671e4
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.1012bcf0
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push str.__s___daemon
push eax
call fcn.10041b40
add esp, 0x18
lea ecx, [ebp - 0x420]
call fcn.100d5580
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1010a7f2
mov esp, ebp
pop ebp
ret

Function at 0x10068210
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x101ba0ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, 0x4a
call fcn.1005aec0
mov ebx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, 0x5f4
nop dword [eax + eax]
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.1012bcf0
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x100682a7
cmp dword [ebp - 0x11c], 6
jb 0x100682a7
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
push str.ChangeWindowMessageFilter
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100682a4
push 1
push edi
call eax
push esi
call ebx
inc edi
cmp edi, 0x5fc
jl 0x10068240
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1010a7f2
mov esp, ebp
pop ebp
ret
Function at 0x10068530
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015a2e5
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x101ba0ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x101c82ac]
test esi, esi
jne 0x1006858f
push 0x1c8
call fcn.1010a803
mov esi, eax
add esp, 4
mov dword [ebp - 0x21c], esi
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.1003f040
mov dword [0x101c82ac], esi
add esi, 0x3c
cmp dword [esi + 0x14], 8
jb 0x1006859a
mov esi, dword [esi]
push str.Event.conf
push 0x10184350
push esi
lea eax, [ebp - 0x218]
push 0x101843b0
push eax
call fcn.10041b40
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [ebp - 0x218]
add esp, 0x14
push eax
push 1
push str.FirstShow
push str.GTPTip
call esi
cmp eax, 1
jne 0x100685db
jmp 0x100685f6
lea eax, [ebp - 0x218]
push eax
push 1
push str.Show
push str.GTPTip
call esi
dec eax
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1010a7f2
mov esp, ebp
pop ebp
ret

Function at 0x10068980
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015a2e5
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x101ba0ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x101c82ac]
test esi, esi
jne 0x100689df
push 0x1c8
call fcn.1010a803
mov esi, eax
add esp, 4
mov dword [ebp - 0x21c], esi
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.1003f040
mov dword [0x101c82ac], esi
add esi, 0x3c
cmp dword [esi + 0x14], 8
jb 0x100689ea
mov esi, dword [esi]
push str.Event.conf
push 0x10184350
push esi
lea eax, [ebp - 0x218]
push 0x101843b0
push eax
call fcn.10041b40
add esp, 0x14
lea eax, [ebp - 0x218]
push eax
push 1
push str.Show
push str.RMenuTip
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
dec eax
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1010a7f2
mov esp, ebp
pop ebp
ret

Function at 0x10068a80
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
xor dl, dl
push edi
mov dword [esi], vtable.Event::CSendThread.0
lea eax, [esi + 0xc]
xchg byte [eax], dl
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
nop word [eax + eax]
push 0x32
call ebx
mov al, byte [esi + 0xd]
test al, al
jne 0x10068ab1
inc edi
cmp edi, 0xa
jl 0x10068aa0
mov al, byte [esi + 0xd]
test al, al
jne 0x10068ac3
push 0
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi + 0x1c]
mov dword [esi + 8], 0
push eax
call fcn.101059e8
mov ecx, dword [esi + 0x10]
add esp, 4
test ecx, ecx
je 0x10068b0a
mov eax, dword [esi + 0x18]
sub eax, ecx
sar eax, 2
push eax
push ecx
call fcn.1003ee80
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
pop edi
pop esi
pop ebx
ret
Function at 0x10068bf0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x2c]
mov ecx, dword [0x101c589c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x101c87d4]
cmp eax, dword [ecx + 4]
jle 0x10068c47
push 0x101c87d4
call fcn.1010aa90
add esp, 4
cmp dword [0x101c87d4], 0xffffffff
jne 0x10068c47
push 0x10166cf0
mov dword [0x101c87d8], 0
call fcn.1010aeaf
push 0x101c87d4
call fcn.1010aa51
add esp, 8
mov eax, dword [0x101c87d8]
test eax, eax
jne 0x10068ce7
push esi
push 0x4c
call fcn.1010a803
mov esi, eax
push 2
mov dword [ebp - 4], esi
mov dword [esi], vtable.Event::CSendThread.0
lea eax, [esi + 0x1c]
push eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
call fcn.10105a11
mov dword [esi + 4], 0
add esp, 0xc
mov dword [esi + 8], 0
mov ecx, dword [0x101c87d8]
mov dword [0x101c87d8], esi
test ecx, ecx
je 0x10068cb4
mov eax, dword [ecx]
push 1
call dword [eax]
mov esi, dword [0x101c87d8]
cmp dword [esi + 8], 0
jne 0x10068ce4
mov cl, 1
lea eax, [esi + 0xc]
xchg byte [eax], cl
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x10068b10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
mov eax, dword [0x101c87d8]
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret