joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48c339
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, 0x4e34a0
mov edi, 0x4e3498
xor ebx, ebx
mov dword [0x4e349c], 2
jmp 0x48c4c9
mov edx, dword [0x4ab27c]
mov eax, dword [esi]
xor ecx, ecx
mov cl, byte [edx + eax + 2]
mov edx, dword [edi]
shl edx, 5
xor ecx, edx
and ecx, 0x7fff
mov dword [edi], ecx
mov ecx, dword [0x4e3488]
mov edx, dword [edi]
movzx ebp, word [ecx + edx*2]
and eax, 0x7fff
mov edx, dword [0x4ab280]
mov word [edx + eax*2], bp
mov eax, dword [0x4e3488]
mov ecx, dword [edi]
mov dx, word [esi]
mov word [eax + ecx*2], dx
test ebp, ebp
je 0x48c3c1
mov eax, dword [esi]
sub eax, ebp
cmp eax, 0x7efa
ja 0x48c3c1
mov eax, ebp
call fcn.0048c72c
mov ebx, eax
mov eax, dword [0x4e34ac]
cmp ebx, eax
jbe 0x48c3c1
mov ebx, eax
cmp ebx, 3
jb 0x48c46b
mov edx, ebx
sub edx, 3
mov eax, dword [esi]
sub eax, dword [0x4e34a4]
call fcn.0048e344
sub dword [0x4e34ac], ebx
cmp ebx, dword [0x4e34b4]
ja 0x48c43d
dec ebx
inc dword [esi]
mov ecx, dword [0x4ab27c]
mov edx, dword [esi]
movzx ecx, byte [ecx + edx + 2]
mov edx, dword [edi]
shl edx, 5
xor ecx, edx
and ecx, 0x7fff
mov dword [edi], ecx
mov ecx, dword [0x4e3488]
mov edx, dword [edi]
movzx ebp, word [ecx + edx*2]
mov edx, dword [esi]
and edx, 0x7fff
mov ecx, dword [0x4ab280]
mov word [ecx + edx*2], bp
mov edx, dword [0x4e3488]
mov ecx, dword [edi]
mov bp, word [esi]
mov word [edx + ecx*2], bp
dec ebx
jne 0x48c3eb
inc dword [esi]
jmp 0x48c485
add dword [esi], ebx
xor ebx, ebx
mov ecx, dword [esi]
mov edx, dword [0x4ab27c]
movzx edx, byte [edx + ecx]
mov dword [edi], edx
mov ebp, dword [esi]
mov ecx, dword [0x4ab27c]
shl edx, 5
movzx ecx, byte [ecx + ebp + 1]
xor ecx, edx
and ecx, 0x7fff
mov dword [edi], ecx
jmp 0x48c485
mov eax, dword [0x4ab27c]
mov edx, dword [esi]
movzx edx, byte [eax + edx]
xor eax, eax
call fcn.0048e344
dec dword [0x4e34ac]
inc dword [esi]
test eax, eax
je 0x48c4b8
mov edx, dword [esi]
sub edx, dword [0x4e3490]
cmp dword [0x4e3490], 0
jl 0x48c4a7
mov eax, dword [0x4ab27c]
add eax, dword [0x4e3490]
jmp 0x48c4a9
xor eax, eax
xor ecx, ecx
call fcn.0048e168
mov edx, dword [esi]
mov dword [0x4e3490], edx
cmp dword [0x4e34ac], 0x106
jae 0x48c4c9
call fcn.0048c208
cmp dword [0x4e34ac], 0
jne 0x48c358
mov edx, dword [esi]
sub edx, dword [0x4e3490]
cmp dword [0x4e3490], 0
jl 0x48c4f4
mov eax, dword [0x4ab27c]
add eax, dword [0x4e3490]
jmp 0x48c4f6
xor eax, eax
mov ecx, 1
call fcn.0048e168
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48c508
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov ebx, eax
mov esi, 0x4e3498
cmp ebx, 1
jl 0x48c51f
cmp ebx, 9
jle 0x48c529
mov eax, 0x4ab2d4
call fcn.00490114
xor edx, edx
mov dword [0x4e3494], edx
cmp dword [0x4e348c], 0
jne 0x48c54e
mov dword [0x4e3494], 1
mov dword [0x4e348c], 0x10000
cmp dword [0x4ab27c], 0
jne 0x48c58b
push 2
push 0x8000
call fcn.00493530
add esp, 8
mov edi, eax
mov dword [0x4ab27c], edi
test edi, edi
jne 0x48c58b
mov eax, 0x4af120
call fcn.0042ce18
mov edx, 0x4ab2d4
mov eax, 4
call fcn.0048ffb4
cmp dword [0x4ab280], 0
jne 0x48c5ee
push 2
push 0x8000
call fcn.00493530
add esp, 8
mov dword [0x4ab280], eax
push 2
push 0x8000
call fcn.00493530
add esp, 8
mov dword [0x4e3488], eax
cmp dword [0x4ab280], 0
je 0x48c5ce
cmp dword [0x4e3488], 0
jne 0x48c5ee
mov eax, 0x1ff
call fcn.0041202c
push eax
call fcn.0044e46c
pop ecx
mov edx, 0x4ab2d4
mov eax, 4
call fcn.0048ffb4
mov eax, dword [0x4e3488]
mov word [eax + 0xfffe], 0
push 0xfffe
push 0
push eax
call fcn.00494dd8
movzx edx, word [ebx*8 + 0x4ab286]
mov dword [0x4e34b4], edx
add esp, 0xc
movzx ecx, word [ebx*8 + 0x4ab284]
mov dword [0x4e34b8], ecx
cmp ebx, 2
movzx eax, word [ebx*8 + 0x4ab288]
mov dword [0x4e34bc], eax
movzx edx, word [ebx*8 + 0x4ab28a]
mov dword [0x4e34b0], edx
jg 0x48c64f
or word [ebp], 4
jmp 0x48c659
cmp ebx, 8
jl 0x48c659
or word [ebp], 2
xor ecx, ecx
xor eax, eax
mov dword [0x4e34a0], ecx
mov ebx, 0x8000
add ebx, ebx
mov dword [0x4e3490], eax
mov eax, dword [0x4ab27c]
mov edx, ebx
call dword [0x4ab6ac]
mov dword [0x4e34ac], eax
mov eax, dword [0x4e34ac]
test eax, eax
je 0x48c68f
cmp eax, 0xffffffff
jne 0x48c6a3
mov dword [0x4e34a8], 1
xor edx, edx
mov dword [0x4e34ac], edx
jmp 0x48c6e1
xor ecx, ecx
mov dword [0x4e34a8], ecx
cmp dword [0x4e34ac], 0x106
jae 0x48c6bc
call fcn.0048c208
xor eax, eax
xor ebx, ebx
mov dword [esi], eax
mov edx, dword [0x4ab27c]
mov eax, dword [esi]
shl eax, 5
xor ecx, ecx
mov cl, byte [edx + ebx]
inc ebx
xor eax, ecx
and eax, 0x7fff
cmp ebx, 2
mov dword [esi], eax
jb 0x48c6c2
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x494794
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x495fd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x495fec
call fcn.00497734
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x496008
test bl, 1
je 0x496008
call fcn.0049b818
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4961ec
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.004972f0
test byte [ebp + 0xd], 0xc0
jne 0x496210
mov eax, dword [0x4ac264]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x49621d
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x49624a
je 0x49625c
sub ecx, 0x100
je 0x49626a
sub ecx, 0x100
je 0x496271
sub ecx, 0x100
je 0x496263
jmp 0x496278
sub ecx, 0x600
je 0x496271
sub ecx, 0x100
je 0x49625c
jmp 0x496278
mov edi, 1
jmp 0x49627d
mov edi, 2
jmp 0x49627d
mov edi, 4
jmp 0x49627d
mov edi, 5
jmp 0x49627d
mov edi, 3
test byte [ebp + 0xd], 1
je 0x4962a4
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x4abcdc]
test al, 0x80
je 0x49629d
mov ebx, 0x80
jmp 0x4962b6
mov ebx, 1
jmp 0x4962b6
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4962b6
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x4962c8
je 0x4962d1
dec eax
je 0x4962da
jmp 0x4962e3
mov dword [ebp - 4], CreateStatusWindowA
jmp 0x4962f2
mov dword [ebp - 4], 0x40000000
jmp 0x4962f2
mov dword [ebp - 4], 0xc0000000
jmp 0x4962f2
push 1
call fcn.004976c8
pop ecx
mov ebx, eax
jmp 0x4963e2
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x49630e
sub eax, 0x10
je 0x496315
sub eax, 0x10
je 0x49631e
sub eax, 0x10
je 0x496327
jmp 0x496327
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x49632e
mov dword [ebp - 8], 1
jmp 0x49632e
mov dword [ebp - 8], 2
jmp 0x49632e
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x49639b
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x496390
test byte [ebp + 0xd], 1
je 0x49638b
mov ebx, 0x50
jmp 0x496390
mov ebx, 2
push ebx
call fcn.004976c8
pop ecx
mov ebx, eax
jmp 0x4963e2
mov edi, esi
push edi
call fcn.00496150
pop ecx
test eax, eax
je 0x4963af
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x4963bb
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.004973f0
add esp, 8
mov ebx, eax
inc eax
jne 0x4963e2
push 4
call fcn.004976c8
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.00497324
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4968ec
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryA
dec eax
je 0x496908
call fcn.00497734
jmp 0x496977
lea edx, [ebp - 0x108]
push edx
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test eax, eax
jne 0x496924
call fcn.00497734
jmp 0x496977
cmp dword [0x4e73c4], 1
je 0x496975
movsx ecx, byte [ebp - 0x108]
push ecx
call fcn.0049b6ec
pop ecx
cmp al, 0x41
jl 0x496975
cmp al, 0x5a
jg 0x496975
cmp byte [ebp - 0x107], 0x3a
jne 0x496975
mov byte [ebp - 4], 0x3d
mov byte [ebp - 3], al
lea eax, [ebp - 0x108]
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push eax
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.DLL_SetEnvironmentVariableA
dec eax
je 0x496975
call fcn.00497734
jmp 0x496977
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x49b7b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x49b812
call fcn.0049b760
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00494f88
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00494f88
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x49b890
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x4ad1bc], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x49b96a
cmp dword [0x4ad1b8], 0
jne 0x49b96a
cmp dword [0x4ad3e4], 0
je 0x49b924
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.0049b694
add esp, 8
mov ebx, eax
test eax, eax
jne 0x49b90a
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.0049b694
add esp, 8
mov ebx, eax
test eax, eax
jne 0x49b90a
lea ebx, [ebp - 0x84]
jmp 0x49b90b
inc ebx
call fcn.0049b84c
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x49b9a5
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4ad1c0
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00494f88
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4ad1c3
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x49b9a5
cmp dword [0x4ad1b8], 0
je 0x49b984
cmp dword [0x4ad1b8], 0xffffffff
je 0x49b9a5
push esi
call dword [0x4ad1b8]
pop ecx
mov eax, dword [0x4ad1bc]
test eax, eax
je 0x49b9a5
cmp dword [0x4ad1bc], 0xffffffff
je 0x49b9a5
cmp byte [eax], 0
je 0x49b9a5
push esi
push eax
call fcn.0049b7b0
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49d134
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
mov esi, dword [ebp + 0xc]
cmp esi, 0x10
jge 0x49d15a
test esi, esi
je 0x49d15a
call fcn.0049b818
mov dword [eax], 0x13
or eax, 0xffffffff
jmp 0x49d1cc
call fcn.0049ce4c
mov ebx, eax
test eax, eax
jne 0x49d175
call fcn.0049b818
mov dword [eax], 8
or eax, 0xffffffff
jmp 0x49d1cc
mov edx, dword [ebp + 0x10]
mov dword [ebx + 4], edx
lea edx, [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [ebx + 0x14], ecx
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0x54], eax
push edx
mov ecx, dword [ebp + 0x18]
push ecx
push ebx
push 0x49d090
push esi
mov eax, dword [ebp + 0x14]
push eax
call sub.KERNEL32.DLL_CreateThread
test eax, eax
jne 0x49d1c0
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x718
jne 0x49d1b9
push 0x59
call fcn.004976c8
pop ecx
jmp 0x49d1cc
call fcn.00497734
jmp 0x49d1cc
mov dword [ebx + 8], eax
test edi, edi
je 0x49d1cc
mov edx, dword [ebp - 4]
mov dword [edi], edx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x100eba3
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x10f52d8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10f52c1], 0
jne 0x103b37d
mov ecx, dword [ebp - 4]
mov al, byte [0x10f52c6]
xor ecx, ebp
call fcn.01002492
leave
ret
lea eax, [ebp - 0x118]
push eax
mov byte [0x10f52c1], 0
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x103b3bd
cmp dword [ebp - 0x114], 5
jbe 0x1066282
mov byte [0x10f52c6], 1
jmp 0x100ebc5
mov byte [0x10f52c6], 0
jmp 0x100ebc5
jne 0x103b3bd
cmp dword [ebp - 0x110], 1
jae 0x103b3b1
jmp 0x103b3bd

Function at 0x1015c07
Capabilities:
Capture webcam image

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
push 0x419
push dword [ecx + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
pop ebp
ret 4
Function at 0x101d952
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [0x10f5320], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
push esi
je 0x103f24b
mov eax, dword [0x10f981c]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x105d2bd
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x103f274
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0xc
call ebx
test eax, eax
js 0x105d29d
mov dword [0x10f5320], 1
jmp 0x101d971
mov dword [ebp - 4], eax
test eax, eax
je 0x101d984
jmp 0x101d99c
call ebx
test eax, eax
mov eax, dword [ebp + 8]
js 0x105d2c8
push dword [eax + 4]
call dword [eax]
test eax, eax
je 0x101d99b
mov dword [edi], eax
jmp 0x101d992
push 0x105d2e0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x105d2d4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x10f981c], eax
jmp 0x103f255
push dword [ebp + 0x10]
push eax
call esi
jmp 0x103f264
push dword [eax + 0xc]
call dword [eax + 8]
jmp 0x103f286
Function at 0x10209de
Capabilities:
Hide graphical window

Disassembly:
push 0x20
mov eax, 0x10d6690
call fcn.01001f95
mov dword [ebp - 0x14], ecx
and dword [ebp - 0x18], 0
push 0
lea ecx, [ebp - 0x2c]
call dword [sym.imp.mmcbase.DLL_public:_void___thiscall_mmcerror::SC::constructor_long_int_]
xor esi, esi
inc esi
push 0x1020ab8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], esi
call dword [sym.imp.mmcbase.DLL_public:_void___thiscall_mmcerror::SC::SetFunctionName_unsigned_short_int_const__]
mov eax, dword [0x10f52cc]
mov edi, 0x10f52cc
cmp eax, edi
je 0x1020a28
cmp byte [eax + 0x19], 5
jae 0x105ae24
mov ecx, dword [ebp - 0x14]
push esi
call fcn.0100dd70
mov ecx, dword [ebp - 0x14]
mov ebx, eax
call fcn.0101d08c
mov ecx, eax
mov dword [ebp - 0x1c], ecx
test ecx, ecx
je 0x105ae3b
call sub.MFC42u.dll_CFrameWnd::GetActiveView
cmp eax, ebx
sete byte [ebp - 0xd]
cmp dword [ebp + 0xc], ebx
je 0x1020a90
test ebx, ebx
jne 0x10478c8
xor edi, edi
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x10478d0
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
push dword [ebp + 0xc]
push esi
call fcn.01041a24
mov ecx, dword [ebp - 0x14]
call fcn.0100da2c
test ebx, ebx
jne 0x10478e7
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.mmcbase.DLL_public:_void___thiscall_mmcerror::SC::constructor_class_mmcerror::SC_const__]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 0
call dword [sym.imp.mmcbase.DLL_public:_void___thiscall_mmcerror::SC::destructor_void_]
mov eax, dword [ebp + 8]
call fcn.01001fcf
ret 0xc
mov edi, dword [ebx + 0x20]
jmp 0x1020a62
push 0
mov ecx, ebx
call sub.MFC42u.dll_CWnd::ShowWindow
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x1020a71
cmp byte [ebp - 0xd], 0
je 0x1020a90
jmp 0x105ae7c
push 0x100c4b0
push 0x1f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0106f7c2
jmp 0x1020a28
mov eax, dword [0x10f52cc]
cmp eax, edi
je 0x105ae5c
cmp byte [eax + 0x19], 2
jb 0x105ae5c
push 0x100c4b0
push 0x20
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0106f7c2
push 0x8000ffff
lea ecx, [ebp - 0x2c]
call dword [sym.imp.mmcbase.DLL_public:_class_mmcerror::SC____thiscall_mmcerror::SC::operator_long_int_]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.mmcbase.DLL_public:_void___thiscall_mmcerror::SC::constructor_class_mmcerror::SC_const__]
jmp 0x1020a9d
mov ecx, dword [ebp + 0xc]
push 5
call sub.MFC42u.dll_CWnd::ShowWindow
mov ecx, dword [ebp - 0x1c]
push esi
push dword [ebp + 0xc]
call sub.MFC42u.dll_CFrameWnd::SetActiveView
jmp 0x1020a90
Function at 0x102add6
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x114
mov eax, 0x10d1360
call fcn.0100c4d0
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x10c]
mov dword [ebp - 0x110], edi
mov dword [ebp - 0xec], ebx
call dword [sym.imp.mmcbase.DLL_public:_void___thiscall_mmcerror::SC::constructor_long_int_]
xor esi, esi
inc esi
push 0x102afc0
lea ecx, [ebp - 0x10c]
mov dword [ebp - 4], esi
call dword [sym.imp.mmcbase.DLL_public:_void___thiscall_mmcerror::SC::SetFunctionName_unsigned_short_int_const__]
lea eax, [ebp - 0xe4]
push eax
push 0x20019
push ebx
push 0x102af70
push 0x80000002
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 0xf8], ebx
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1057ac8
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0xf0]
push eax
push ebx
push 0x102af60
push dword [ebp - 0xe4]
mov dword [ebp - 0xfc], 0xc8
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x102af01
lea eax, [ebp - 0xd8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x102af01
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0xd8]
push 0x102af48
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x18
cmp eax, 2
jl 0x102af01
cmp dword [ebp - 0xe0], 6
jb 0x102aef4
mov dword [ebp - 0xdc], esi
cmp dword [ebp - 0xe0], 5
je 0x1057ab0
push dword [ebp - 0xe4]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
cmp dword [ebp - 0xdc], ebx
je 0x1057ac8
lea eax, [ebp - 0x10c]
push eax
mov ecx, edi
call dword [sym.imp.mmcbase.DLL_public:_void___thiscall_mmcerror::SC::constructor_class_mmcerror::SC_const__]
lea ecx, [ebp - 0x10c]
mov dword [ebp - 0xec], esi
mov byte [ebp - 4], bl
call dword [sym.imp.mmcbase.DLL_public:_void___thiscall_mmcerror::SC::destructor_void_]
mov eax, edi
call fcn.0100c50d
ret 4
cmp dword [ebp - 0xe8], 0x32
jb 0x102af01
mov dword [ebp - 0xdc], esi
jmp 0x102af01
push 0x3466
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.mmcbase.DLL_class_mmcerror::SC___stdcall_ScFromMMC_long_int_]
push eax
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 2
call dword [sym.imp.mmcbase.DLL_public:_class_mmcerror::SC____thiscall_mmcerror::SC::operator_class_mmcerror::SC_const__]
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 1
call dword [sym.imp.mmcbase.DLL_public:_void___thiscall_mmcerror::SC::destructor_void_]
lea eax, [ebp - 0x10c]
push eax
mov ecx, edi
call dword [sym.imp.mmcbase.DLL_public:_void___thiscall_mmcerror::SC::constructor_class_mmcerror::SC_const__]
jmp 0x102af28
Function at 0x102eb09
Capabilities:
Get common file path

Disassembly:
push 0x228
mov eax, 0x10e5a2c
call fcn.0100c4d0
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], eax
mov eax, dword [sym.imp.mmcbase.DLL_unsigned_int_mmcerror::SC::s_CallDepth]
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], ebx
inc dword [eax]
mov dword [ebp - 0x234], 3
mov dword [ebp - 0x230], ebx
xor esi, esi
inc esi
push 0x102ec28
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], esi
call dword [sym.imp.mmcbase.DLL_public:_void___thiscall_mmcerror::SC::SetFunctionName_unsigned_short_int_const__]
push 0xffffffffffffffff
push ebx
mov ecx, edi
call fcn.01011bbd
mov eax, dword [sym.imp.mmcbase.DLL_struct_HWND____mmcerror::SC::s_hWnd]
push dword [eax]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x104b325
mov dword [ebp - 0x224], ebx
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
push 0x1a
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x224]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, ebx
je 0x106742a
lea eax, [ebp - 0x218]
push eax
mov ecx, edi
call fcn.0102b350
push 0x5c
mov ecx, edi
call fcn.0102c7a0
push dword [0x102ec24]
mov ecx, edi
call fcn.0102e1c7
mov ecx, dword [ebp - 0x21c]
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.mmcbase.DLL_public:_void___thiscall_mmcerror::SC::constructor_class_mmcerror::SC_const__]
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x220], esi
mov byte [ebp - 4], bl
call dword [sym.imp.mmcbase.DLL_public:_void___thiscall_mmcerror::SC::destructor_void_]
mov eax, dword [ebp - 0x21c]
call fcn.0100c50d
ret 8
mov eax, dword [sym.imp.mmcbase.DLL_struct_HWND____mmcerror::SC::s_hWnd]
mov eax, dword [eax]
mov dword [ebp - 0x224], eax
jmp 0x102eb8b
mov ecx, dword [ebp - 0x21c]
lea eax, [ebp - 0x234]
push eax
mov dword [ebp - 0x234], 3
mov dword [ebp - 0x230], 0x80004005
call dword [sym.imp.mmcbase.DLL_public:_void___thiscall_mmcerror::SC::constructor_class_mmcerror::SC_const__]
jmp 0x102ebfe
Function at 0x102f91c
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp byte [0x10f985e], 0
jne 0x102f9ca
push ebx
push esi
push edi
xor eax, eax
mov esi, 0x10f62b0
push esi
push eax
push eax
push 0x25
push eax
mov word [0x10f66b0], ax
mov word [0x10f62b0], ax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov eax, dword [0x10f52cc]
mov edi, 0x10f52cc
mov ebx, 0x102f7d0
cmp eax, edi
je 0x102f96e
cmp byte [eax + 0x19], 4
jae 0x10578d5
push 0x102f9e8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10578e9
push 0x102f9cc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x105791c
mov esi, 0x200
push esi
push 0x10f66b0
call eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1057962
mov eax, dword [0x10f52cc]
cmp eax, edi
je 0x102f9c7
cmp byte [eax + 0x19], 2
jae 0x105795d
pop edi
pop esi
pop ebx
leave
ret
push esi
push ebx
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0106f7e8
jmp 0x102f96e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10578fd
and eax, 0xffff
or eax, 0x80070000
mov ecx, eax
mov eax, dword [0x10f52cc]
cmp eax, edi
je 0x102f9c7
cmp byte [eax + 0x19], 2
jb 0x102f9c7
push ecx
push ebx
push 0xb
jmp 0x105794d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1057930
and eax, 0xffff
or eax, 0x80070000
mov ecx, eax
mov eax, dword [0x10f52cc]
cmp eax, edi
je 0x102f9c7
cmp byte [eax + 0x19], 2
jb 0x102f9c7
push ecx
push ebx
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010a4e26
jmp 0x102f9c7
push ebx
push 0xd
jmp 0x1057992
mov byte [0x10f985f], 1
cmp dword [ebp - 4], esi
ja 0x1057978
cmp dword [ebp - 4], 0
jne 0x102f9c7
mov eax, dword [0x10f52cc]
cmp eax, edi
je 0x102f9c7
cmp byte [eax + 0x19], 2
jb 0x102f9c7
push ebx
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0106f7c2
jmp 0x102f9c7