joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100553c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa3c
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x414]
push edi
push str.InProcServer32
push esi
push str.CLSID
push str._s_s_s
push 0xffffffffffffffff
push 0x104
xor edi, edi
mov ebx, ecx
push eax
mov dword [ebp - 0xa3c], edi
call fcn.1000f290
add esp, 0x1c
lea eax, [ebp - 0xa3c]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x414]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100554d7
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x624]
push eax
push edi
push 0x10067498
push dword [ebp - 0xa3c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100554d7
push ecx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.10054510
xor eax, eax
cmp ax, word [ebp - 0x20c]
je 0x100554d2
push 0xffffffffffffffff
push esi
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea eax, [ebp - 0xa34]
push 0x104
push eax
mov dword [ebp - 0xa38], 3
call esi
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x82c]
push 0x104
push eax
call esi
mov eax, dword [ebx + 4]
lea edx, [ebp - 0xa38]
add esp, 0x20
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 4]
test eax, eax
jne 0x100554d2
mov dword [ebx + 8], 1
jmp 0x100554d7
mov edi, 1
push dword [ebp - 0xa3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005b6db
mov esp, ebp
pop ebp
ret 4

Function at 0x10055500
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x424]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, ecx
mov dword [ebp - 0x424], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100555c7
cmp dword [edi + 8], esi
jne 0x100555c2
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor eax, eax
mov dword [ebp - 0x420], 0x104
mov word [ebp - 0x20c], ax
mov word [ebp - 0x414], ax
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], 0x104
push eax
lea eax, [ebp - 0x41c]
push eax
push 0
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x424]
call ebx
test eax, eax
jne 0x100555c1
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.100553c0
inc esi
cmp dword [edi + 8], 0
je 0x10055550
pop ebx
mov esi, 1
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
Function at 0x100555f0
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push 0x104
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10055610
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 2]
push eax
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr_s]
push str.explorer.exe
push esi
call dword [sym.imp.VCRUNTIME140.dll_wcsstr]
add esp, 0x10
test eax, eax
jne 0x10055647
xor ecx, ecx
mov word [esi], cx
pop esi
pop ebp
ret 0xc
lea ecx, [eax + 0x18]
test ecx, ecx
jne 0x10055658
xor eax, eax
mov word [esi], ax
pop esi
pop ebp
ret 0xc
mov eax, 0x20
cmp ax, word [ecx]
jne 0x1005566a
add ecx, 2
cmp ax, word [ecx]
je 0x10055662
mov edx, ecx
push edi
lea edi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10055670
sub edx, edi
sar edx, 1
push edx
push ecx
push 0x104
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
xor eax, eax
add esp, 0x10
cmp ax, word [esi]
je 0x100556d5
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push esi
call edi
test eax, eax
jne 0x100556ca
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveArgsW]
push esi
call edi
test eax, eax
jne 0x100556ca
push 0x104
push esi
call fcn.10054790
push esi
call edi
test eax, eax
jne 0x100556ca
push esi
call fcn.100549d0
pop edi
mov eax, 1
pop esi
pop ebp
ret 0xc
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x100556e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x83c
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1006c4e4]
mov edx, dword [ebp + 8]
movq xmm0, qword [str.Shell]
push edi
mov dword [ebp - 8], eax
mov edi, ecx
lea eax, [ebp - 0x424]
movq qword [ebp - 0x10], xmm0
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x428]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100557c8
push ecx
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.100555f0
xor eax, eax
cmp ax, word [ebp - 0x218]
je 0x100557b2
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
mov dword [ebp - 0x83c], 2
push eax
lea eax, [ebp - 0x838]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
push 0xffffffffffffffff
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x630]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov eax, dword [edi + 4]
lea edx, [ebp - 0x83c]
add esp, 0x20
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 4]
test eax, eax
jne 0x100557b2
mov dword [edi + 8], 1
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.1005b6db
mov esp, ebp
pop ebp
ret 4
Function at 0x100557e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
push 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x2c
push esi
call dword [sym.imp.VCRUNTIME140.dll_wcschr]
mov edx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
add esp, 8
cmp dword [ebx + 8], 0
mov edi, eax
jne 0x1005587e
test edi, edi
je 0x10055882
mov eax, edi
sub eax, esi
sar eax, 1
push eax
push esi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call edx
xor eax, eax
add esp, 0x10
cmp ax, word [ebp - 0x20c]
je 0x1005585b
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.10053f10
cmp dword [ebx + 8], 0
jne 0x100558c2
lea esi, [edi + 2]
push 0x2c
push esi
call dword [sym.imp.VCRUNTIME140.dll_wcschr]
mov edx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
add esp, 8
cmp dword [ebx + 8], 0
mov edi, eax
je 0x10055825
test edi, edi
jne 0x100558c2
mov ecx, esi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10055887
sub ecx, edi
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push esi
push 0x104
push eax
call edx
xor eax, eax
add esp, 0x10
cmp ax, word [ebp - 0x20c]
je 0x100558c2
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.10053f10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005b6db
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10055980
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4c
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0xc4c], 0
xor ebx, ebx
mov dword [ebp - 0xc48], 0
cmp dword [esi + 8], ebx
jne 0x10055b23
push edi
cmp ebx, 0xb
jae 0x10055b22
push ebx
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0xc4c]
push eax
call fcn.100543f0
test eax, eax
je 0x10055b17
lea eax, [ebp - 0xc48]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x824]
push eax
push dword [ebp - 0xc4c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10055b17
xor edi, edi
cmp dword [esi + 8], edi
jne 0x10055b17
xor eax, eax
mov dword [ebp - 0x830], 0x104
mov word [ebp - 0x61c], ax
mov word [ebp - 0x414], ax
mov word [ebp - 0x20c], ax
mov dword [ebp - 0x828], eax
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x82c], 0x104
push eax
lea eax, [ebp - 0x828]
push eax
push 0
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x61c]
push eax
push edi
push dword [ebp - 0xc48]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x10055b17
mov eax, dword [ebp - 0x828]
cmp eax, 1
je 0x10055a8f
cmp eax, 2
jne 0x10055b0c
push ecx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.10054510
xor eax, eax
cmp ax, word [ebp - 0x20c]
je 0x10055b0c
push 0xffffffffffffffff
lea eax, [ebp - 0x61c]
mov dword [ebp - 0xc44], 1
push eax
lea eax, [ebp - 0xc40]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa38]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov eax, dword [esi + 4]
lea edx, [ebp - 0xc44]
add esp, 0x20
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 4]
test eax, eax
jne 0x10055b0c
mov dword [esi + 8], 1
inc edi
cmp dword [esi + 8], 0
je 0x10055a10
inc ebx
cmp dword [esi + 8], 0
je 0x100559b7
pop edi
push dword [ebp - 0xc48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
Function at 0x10056cc0
Capabilities:
Check if file exists
Create process on windows
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005ff46
mov eax, dword fs:[0]
push eax
sub esp, 0x624
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x410
lea eax, [ebp - 0x628]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
test esi, esi
je 0x10056e9f
cmp word [esi], 0
je 0x10056e9f
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10056e9f
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
lea eax, [ebp - 0x628]
push 0xffffffffffffffff
je 0x10056d56
push str._root__
jmp 0x10056d5b
push str._select__
push 0x208
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov ecx, esi
add esp, 0x10
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10056d70
sub ecx, edx
lea eax, [ebp - 0x628]
sar ecx, 1
push ecx
push esi
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
push 0x208
push eax
call esi
push 3
push 0x1006a988
lea eax, [ebp - 0x628]
push 0x208
push eax
call esi
add esp, 0x20
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push 0xc
push str.explorer.exe
lea eax, [ebp - 0x218]
push 0x104
push eax
call esi
add esp, 0x10
test ebx, ebx
je 0x10056e30
xorps xmm0, xmm0
lea ecx, [ebp - 0x630]
movq qword [ebp - 0x630], xmm0
call fcn.100527e0
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x62c]
test esi, esi
je 0x10056e1c
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x28]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10056e30
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 0x54]
push 1
push 0
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x218]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, eax
test ebx, ebx
je 0x10056e92
xorps xmm0, xmm0
lea ecx, [ebp - 0x630]
movq qword [ebp - 0x630], xmm0
call fcn.100527e0
mov dword [ebp - 4], 1
mov esi, dword [ebp - 0x62c]
test esi, esi
je 0x10056e92
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x28]
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 0x54]
mov eax, 0x20
cmp eax, edi
sbb eax, eax
neg eax
jmp 0x10056ea1
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
Function at 0x10056ec0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push 0xc
push str.explorer.exe
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
add esp, 0x10
lea eax, [ebp - 0x20c]
push 1
push 0
push str.::645FF040_5081_101B_9F08_00AA002F954E
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x20
cmp ecx, eax
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
Function at 0x10057e60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [edi + 0x28]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [edi + 0x58], 0
xorps xmm0, xmm0
movq qword [ebp - 0xc], xmm0
mov ebx, 0x80004005
mov dword [ebp - 0x10], 0xc
mov byte [ebp - 0x24], 0
movups xmmword [ebp - 0x23], xmm0
mov word [ebp - 0x13], 0
mov byte [ebp - 0x11], 0
jne 0x10057f78
lea ecx, [edi + 0x24]
mov eax, 1
lock xadd dword [ecx], eax
inc eax
cmp eax, 1
jle 0x10057ecc
mov ebx, 1
jmp 0x10057f78
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x14], eax
test eax, eax
je 0x10057f31
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x10]
call fcn.100433f0
test eax, eax
lea ecx, [ebp - 0x10]
push str.Global59B0D764_B5C3_4c4a_958F_B7652451D8D9
mov eax, 0
push eax
cmove ecx, eax
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x18], eax
test eax, eax
je 0x10057f31
push 0
push 0
push edi
push 0x100584b0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [edi + 0x1c], eax
test eax, eax
je 0x10057f31
xor ebx, ebx
jmp 0x10057f78
mov ecx, dword [edi + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
test ecx, ecx
je 0x10057f4c
push ecx
call eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x14], 0
mov ecx, dword [edi + 0x18]
test ecx, ecx
je 0x10057f5d
push ecx
call eax
mov dword [edi + 0x18], 0
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x10057f72
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x1c], 0
lea eax, [edi + 0x24]
lock dec dword [eax]
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005b6db
mov esp, ebp
pop ebp
ret 4
Function at 0x10058b50
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006000b
mov eax, dword fs:[0]
push eax
sub esp, 0x328
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x31c]
push 0x20a
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x100
lea eax, [ebp - 0x110]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [ebp - 0x320], 7
add esp, 0x18
mov dword [ebp - 0x324], 0
mov word [ebp - 0x334], ax
lea ecx, [ebp - 0x334]
mov dword [ebp - 4], eax
call fcn.1003f100
test eax, eax
je 0x10058c92
mov eax, dword [ebp - 0x324]
inc eax
cmp eax, 0x104
ja 0x10058c92
cmp dword [ebp - 0x320], 8
lea eax, [ebp - 0x334]
cmovae eax, dword [ebp - 0x334]
push eax
lea eax, [ebp - 0x31c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov eax, dword [ebp - 0x320]
add esp, 0xc
cmp eax, 8
jb 0x10058c35
inc eax
push eax
push dword [ebp - 0x334]
call fcn.10003020
push str.nodisturb.ini
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x10058cac
push ecx
lea edx, [ebp - 0x110]
mov ecx, ebx
call fcn.10058830
add esp, 4
test eax, eax
je 0x10058cac
cmp dword [esi], 0
jne 0x10058c89
lea eax, [ebp - 0x31c]
push eax
push 0
lea eax, [ebp - 0x110]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jne 0x10058c89
mov dword [esi], eax
mov eax, 1
jmp 0x10058cac
mov eax, 1
mov dword [esi], eax
jmp 0x10058cac
mov ecx, dword [ebp - 0x320]
cmp ecx, 8
jb 0x10058caa
inc ecx
push ecx
push dword [ebp - 0x334]
call fcn.10003020
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
Function at 0x10058cd0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push 0x20a
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x210]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [ebp + 0x18], 0
jne 0x10058e49
mov edx, 0x104
lea ecx, [ebp - 0x210]
call fcn.1003f2c0
test eax, eax
je 0x10058e49
push str.nodisturb.ini
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x10058d6b
xor ecx, ecx
mov eax, 0x280
mov edx, 2
mul edx
push edi
push 0x1007da74
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1005be25
mov edi, eax
add esp, 8
mov dword [ebp - 0x218], edi
test edi, edi
jne 0x10058d7b
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret 0x14
push esi
push 0x280
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x27f
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
test eax, eax
jne 0x10058dc2
push edi
xor esi, esi
call fcn.1005be17
add esp, 4
mov eax, esi
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret 0x14
push ebx
lea ebx, [edi + 0x500]
mov esi, edi
cmp edi, ebx
jae 0x10058e26
mov edi, dword [ebp - 0x214]
mov eax, esi
lea edx, [eax + 2]
nop word [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10058de0
sub eax, edx
sar eax, 1
je 0x10058e20
mov edx, dword [ebp + 8]
sub esp, 8
mov ecx, esi
push edi
call fcn.10058b50
mov ecx, esi
add esp, 0xc
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10058e07
sub ecx, edx
sar ecx, 1
lea esi, [esi + ecx*2]
add esi, 2
cmp esi, ebx
jb 0x10058dd5
mov edi, dword [ebp - 0x218]
mov esi, 1
pop ebx
push edi
call fcn.1005be17
add esp, 4
mov eax, esi
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10059400
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push edi
mov edi, ecx
push str.C:Program_Files
push edi
call esi
push str.C:Program_Files__x86_
push edi
mov ebx, eax
call esi
mov esi, eax
test ebx, ebx
je 0x10059553
test esi, esi
je 0x10059553
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x214], 0
call fcn.100591f0
test eax, eax
je 0x10059553
cmp dword [ebp - 0x214], 0
je 0x10059553
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [ebx + 0x20]
add esi, 0x2c
cmp eax, esi
push 0x10
push str.C:Program_Files
cmova esi, eax
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov ecx, esi
add esp, 0x1c
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100594b0
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
lea eax, [ebp - 0x210]
sub ecx, edx
sar ecx, 1
push ecx
push esi
push 0x104
push eax
call ebx
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100594ff
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
push 0x16
push str.C:Program_Files__x86_
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov ecx, esi
add esp, 0x10
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10059520
sub ecx, edx
lea eax, [ebp - 0x210]
sar ecx, 1
push ecx
push esi
push 0x104
push eax
call ebx
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100594e9
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005b6db
mov esp, ebp
pop ebp
ret

Function at 0x10059570
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
test ecx, ecx
je 0x100595e3
cmp word [ecx], 0
je 0x100595e3
push esi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x100595ce
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
xor edx, edx
call fcn.1005b6db
mov esp, ebp
pop ebp
ret