joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12174f40
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 4], 0
push 0x3c
push 0
lea eax, [ebp - 0x40]
push eax
call sub.MSVCR71.dll_memset
add esp, 0xc
mov dword [ebp - 0x40], 0x3c
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp + 8]
cmp dword [edx + 0xc], 0
je 0x12174f9e
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
call fcn.121758f0
add esp, 4
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x12174f9e
jmp 0x1217508d
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
push eax
call fcn.121758f0
add esp, 4
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x12174fbb
jmp 0x1217508d
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x14], 0
je 0x12174fe1
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x14]
push eax
call fcn.121758f0
add esp, 4
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x12174fe1
jmp 0x1217508d
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x18], 0
je 0x12175007
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x18]
push eax
call fcn.121758f0
add esp, 4
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x12175007
jmp 0x1217508d
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp + 8]
cmp dword [edx + 0x28], 0
je 0x12175044
mov eax, dword [ebp - 0x3c]
and eax, 1
je 0x12175044
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x28]
push edx
call fcn.121758f0
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x12175044
jmp 0x1217508d
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x34]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [ebp - 8], ecx
lea edx, [ebp - 0x40]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1217508d
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 0x20], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov dword [edx + 0x38], eax
cmp dword [ebp - 0x34], 0
je 0x1217509d
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 0x2c], 0
je 0x121750ad
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 0x28], 0
je 0x121750bd
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 0x18], 0
je 0x121750cd
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x121751b0
Capabilities:
Get file system object information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [0x1219be08]
mov dword [ebp - 8], eax
mov dword [ebp - 0x16c], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call fcn.121758f0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x121751ee
jmp 0x121752b0
push 0x160
push 0
lea ecx, [ebp - 0x168]
push ecx
call sub.MSVCR71.dll_memset
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov dword [ebp - 0x168], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x164], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x160], ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x168]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
je 0x1217528d
push 0x104
mov ecx, dword [ebp + 0x10]
add ecx, 0xc
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x15c]
push edx
push 0
push 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
push 0x50
mov eax, dword [ebp + 0x10]
add eax, 0x214
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x58]
push ecx
push 0
push 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x168]
mov dword [edx], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x164]
mov dword [ecx + 4], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x160]
mov dword [eax + 8], ecx
cmp dword [ebp - 4], 0
je 0x121752c0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 0x16c]
mov ecx, dword [ebp - 8]
call fcn.1218af21
mov esp, ebp
pop ebp
ret 0x14
Function at 0x121758f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x121758ff
pop dword [ebp - 0xc]
mov eax, 0xafca4d17
add eax, 0x624d0be8
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xd2b06560
sub dword [ebp - 0x1c], 0x845e2015
mov dword [ebp - 0x18], 0xab6cdd8
sub dword [ebp - 0x18], 0xd8838193
mov dword [ebp - 0x14], 0x781580d3
add dword [ebp - 0x14], 0xd436c35b
mov dword [ebp - 0x10], 0x23b1d999
sub dword [ebp - 0x10], 0x23b1d999
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x16c12e57
sub eax, 0x4a86b5b
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xd03b3ca1
add dword [ebp - 0x1c], 0xa4372cb5
mov dword [ebp - 0x18], 0x72c42169
sub dword [ebp - 0x18], 0x3157bff4
mov dword [ebp - 0x14], 0x23f4aedb
sub dword [ebp - 0x14], 0xc085426f
mov dword [ebp - 0x10], 0x6d9466e6
sub dword [ebp - 0x10], 0x6d9466e6
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x29ab95e
add eax, 0xf7e0a96
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x39ffb
push 0
call eax
mov ecx, 0xa7ee1ce3
sub ecx, 0xa7edd4ab
mov ebx, eax
mov edi, 0x2ef1c555
add edi, 0xe3283aab
add edi, dword [ebp - 0xc]
mov edx, 0xadc8990e
sub edx, 0x7a727ea0
add dword [ebp - 8], eax
mov esi, dword [edi]
xor dword [ebp - 4], edi
add esi, edx
xor dword [ebp - 8], edi
mov dword [ebx], esi
add dword [ebp - 8], 0xdbb08824
add ebx, 0x781a2919
add ebx, 0x87e5d6eb
add edi, 0xf6120079
sub edi, 0xf6120075
loop 0x12175a21
add eax, 0xd217f101
sub eax, 0xd216dd4e
xor ebx, ebx
add ebx, eax
add eax, 0x2b5b0210
add eax, 0xd4a4fdf5
mov ecx, 0x12170000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x12177f70
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x1219be5c], 0
je 0x12177f91
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x12177fec
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
shl ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
push 0x40
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
push ecx
push 0
push 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x12179de0
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [0x1219be5c], 0
je 0x12179e04
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.kernel32.dll_MoveFileW]
jmp 0x12179f18
cmp dword [ebp + 8], 0
je 0x12179e1c
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.kernel32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x24], eax
jmp 0x12179e23
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
shl ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
push 0x40
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp + 0xc], 0
je 0x12179e58
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x28], eax
jmp 0x12179e5f
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
shl edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
push 0x40
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
push 0
push 0
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [ebp - 0xc], eax
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 0xffffffffffffffff
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.kernel32.dll_MoveFileA]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp - 8]
push edx
push 0
push 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0xffffffffffffffff
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 8
Function at 0x12179f30
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [0x1219be5c], 0
je 0x12179f4d
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x12179fc2
cmp dword [ebp + 8], 0
je 0x12179f65
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.kernel32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x18], eax
jmp 0x12179f6c
mov dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
shl eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0x40
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
push 0
push 0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1217a470
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x1219be5c], 0
je 0x1217a491
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.kernel32.dll_GetComputerNameW]
jmp 0x1217a4e9
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
shl ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
push 0x40
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.kernel32.dll_GetComputerNameA]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
push ecx
push 0
push 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8

Function at 0x1217ac70
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.kernel32.dll_GetEnvironmentStrings]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call sub.MSVCR71.dll_strlen
add esp, 4
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
push 0
push 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x1217b100
Capabilities:
Create mailslot

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217b13b
mov eax, dword [ebp + 8]
push eax
call fcn.121758f0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217b13b
jmp 0x1217b154
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.kernel32.dll_CreateMailslotA]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x1217b164
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1217b830
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 8
mov dword [ebp - 8], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 0xc], 0
je 0x1217b86d
mov eax, dword [ebp + 8]
push eax
push 0
call fcn.121758f0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1217b86d
jmp 0x1217b89e
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.kernel32.dll_GetLogicalDriveStringsA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1217b89e
cmp dword [ebp + 0xc], 0
je 0x1217b89e
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.121758f0
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x1217b8ae
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x1217bbe0
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1217bc51
mov eax, dword [ebp - 0xc]
push eax
call sub.MSVCR71.dll_strlen
add esp, 4
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shl ecx, 1
push ecx
push 0x40
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xc]
push ecx
push 0
push 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x1217bc60
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 8
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
mov eax, dword [ebp + 8]
push eax
call fcn.121758f0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217bc9c
jmp 0x1217bcee
cmp dword [ebp + 0x10], 0
je 0x1217bcbb
mov ecx, dword [ebp + 0x10]
push ecx
push 0
call fcn.121758f0
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1217bcbb
jmp 0x1217bcee
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1217bcee
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xc]
push ecx
push 0
push 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
cmp dword [ebp - 4], 0
je 0x1217bcfe
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 0xc], 0
je 0x1217bd0e
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1217bd20
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217bd62
mov eax, dword [ebp + 8]
push eax
call fcn.121758f0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1217bd62
jmp 0x1217bd90
cmp dword [ebp + 0xc], 0
je 0x1217bd7f
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.121758f0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217bd7f
jmp 0x1217bd90
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 8], 0
je 0x1217bda0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 4], 0
je 0x1217bdb0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8

Function at 0x1217bdc0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217be02
mov eax, dword [ebp + 8]
push eax
call fcn.121758f0
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1217be02
jmp 0x1217be54
cmp dword [ebp + 0xc], 0
je 0x1217be21
mov ecx, dword [ebp + 0x10]
push ecx
push 0
call fcn.121758f0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217be21
jmp 0x1217be54
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1217be54
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
push ecx
push 0
push 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
cmp dword [ebp - 0xc], 0
je 0x1217be64
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 4], 0
je 0x1217be74
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1217be90
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217bec2
mov eax, dword [ebp + 8]
push eax
call fcn.121758f0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217bec2
jmp 0x1217becc
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp dword [ebp - 4], 0
je 0x1217bedc
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov esp, ebp
pop ebp
ret 4
Function at 0x1217c960
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 8
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217c9a9
mov eax, dword [ebp + 8]
push eax
call fcn.121758f0
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1217c9a9
jmp 0x1217c9fc
cmp dword [ebp + 0xc], 0
je 0x1217c9c6
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.121758f0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217c9c6
jmp 0x1217c9fc
cmp dword [ebp + 0x14], 0
je 0x1217c9e3
mov edx, dword [ebp + 0x14]
push edx
call fcn.121758f0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1217c9e3
jmp 0x1217c9fc
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x10], 0
je 0x1217ca0c
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 4], 0
je 0x1217ca1c
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 8], 0
je 0x1217ca2c
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1217ca40
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217ca9a
mov eax, dword [ebp + 8]
push eax
call fcn.121758f0
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x1217ca9a
jmp 0x1217cb4e
cmp dword [ebp + 0xc], 0
je 0x1217caba
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.121758f0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217caba
jmp 0x1217cb4e
cmp dword [ebp + 0x10], 0
je 0x1217cad7
mov edx, dword [ebp + 0x10]
push edx
call fcn.121758f0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1217cad7
jmp 0x1217cb4e
cmp dword [ebp + 0x14], 0
je 0x1217caf6
mov eax, dword [ebp + 0x18]
push eax
push 0
call fcn.121758f0
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1217caf6
jmp 0x1217cb4e
cmp dword [ebp + 0x1c], 0
je 0x1217cb13
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.121758f0
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1217cb13
jmp 0x1217cb4e
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1217cb4e
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.121758f0
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x1217cb5e
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 4], 0
je 0x1217cb6e
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 8], 0
je 0x1217cb7e
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 0x10], 0
je 0x1217cb8e
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 0xc], 0
je 0x1217cb9e
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 0x18