joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100463d2
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100464d2
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10046439
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x10046434
push 0x200
push 1
push 0
call fcn.10045a40
add esp, 0xc
jmp 0x100464d0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 2
jmp 0x10046473
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jl 0x100464d0
mov dword [ebp - 0xc], 1
mov dword [ebp - 0xc], 0
jmp 0x10046492
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jg 0x100464ba
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.1001f9f7
mov esi, eax
mov eax, dword [ebp - 0x3c]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.1001f9f7
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1004648b
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.1001f9f7
cmp dword [eax], 0
je 0x100464ce
jmp 0x10046468
jmp 0x10046468
jmp 0x10046547
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x1004653b
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1004651c
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jge 0x10046539
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x54]
call fcn.1001f9f7
mov dword [eax], 0x10c93b4e
jmp 0x10046511
jmp 0x10046547
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10047ded
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10047e23
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 1
push 0x61f1
push dword [ebp - 8]
push 0x49ce
call fcn.10047e78
add esp, 0x14
jmp 0x10047e74
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10047e47
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
jmp 0x10047e74
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10047e74
push 0x10c3
push 0x2050
push 0xb8a
push 0
call dword [sym.imp.USER32.dll_GetMessageA]
mov esp, ebp
pop ebp
ret
Function at 0x100486a2
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1004872c
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10048719
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x100486fa
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 4
jge 0x10048717
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.1001f9f7
mov dword [eax], 0x4eea2a3b
jmp 0x100486ef
jmp 0x1004872a
push 0x1978
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x100487a4
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1004878b
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x10048789
push 0x1b3
push 1
push 1
push 0x460
push 0xdd1
push 0x5be2
push 1
push 0x215f
push 0x48d7
push 0x2032
call fcn.10042dd6
add esp, 0x28
jmp 0x100487a4
mov byte [ebp - 1], 0
push 1
lea eax, [ebp - 1]
push eax
push 1
push 0x7578
call fcn.1003ff28
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10063fd5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1006e740]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10054328
mov dword [ebp - 0x14], eax
cmp dword [0x10611920], esi
jne 0x100640c8
push 0x800
push esi
push 0x10007680
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10064055
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x100641a8
push esi
push esi
push 0x10007680
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x100641a8
push 0x10007698
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100641a8
push eax
call ebx
push 0x100076a4
push edi
mov dword [0x10611920], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100076b4
push edi
mov dword [0x10611924], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100076c8
push edi
mov dword [0x10611928], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10611930], eax
test eax, eax
je 0x100640c5
push 0x100076e4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1061192c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x100640ed
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x100640e0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10064102
push 4
pop eax
jmp 0x100641aa
cmp dword [ebp - 0x14], esi
je 0x10064102
push dword [0x10611920]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x100640e7
mov eax, dword [0x1061192c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10064160
cmp dword [0x10611930], edi
je 0x10064160
push eax
call ebx
push dword [0x10611930]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10064160
test eax, eax
je 0x10064160
call ecx
test eax, eax
je 0x10064155
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10064155
test byte [ebp - 8], 1
jne 0x10064160
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10064190
mov eax, dword [0x10611924]
cmp eax, edi
je 0x1006418d
push eax
call ebx
test eax, eax
je 0x1006418d
call eax
mov esi, eax
test esi, esi
je 0x1006418d
mov eax, dword [0x10611928]
cmp eax, edi
je 0x1006418d
push eax
call ebx
test eax, eax
je 0x1006418d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10611920]
call ebx
test eax, eax
je 0x100641a8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x100641aa
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10051802
mov esp, ebp
pop ebp
ret
Function at 0x4f8776
Capabilities:
Encode data using xor

Disassembly:
add ecx, dword [edx + edx - 0x1bd895f3]
ret 0xa00c

Function at 0x51d99d
Capabilities:
Encode data using xor

Disassembly:
xor byte [edx], ah
xchg bl, bl
mov al, 5
sbb al, 0x35
invalid

Function at 0x5cb753
Capabilities:
Encode data using xor

Disassembly:
outsd dx, dword [esi]
cmc
sbb al, 0x22
cmpsd dword cs:[esi], dword es:[edi]
add ch, byte [ebp + ebx*2 - 0x30]
or eax, 0xf592d282
cdq
insb byte es:[edi], dx
movsd dword es:[edi], dword [esi]
add ebx, dword [esi]
mov edx, ss
invalid

Function at 0x5d1e7e
Capabilities:
Encode data using xor

Disassembly:
into
push edx
xor dword [ebx], ebx
and eax, dword [esi]
int3
mov ah, 0x27
add byte [edx], cl
mov eax, 0xb01d4706
out dx, eax
je 0x5d1e73
outsd dx, dword [esi]
jl 0x5d1e5a
inc ecx
jno 0x5d1d8e
in al, 0x5c
clc
mov edx, 0x6e3f7c4e
and al, 0x3f
loop 0x5d1e32
xchg byte [ebp + 0x18], ch
cmovp ebp, dword [esi + 0x1e]
insd dword es:[edi], dx
sbb byte [edi], cl
dec edx
outsb dx, byte [esi]
push ds
sub dl, byte [esi]
and esi, esi
frstor dword [esi - 0x671c96c5]
clc
out dx, eax
lea esp, [ebx + edx*2 - 0x7fd9f661]
lodsd eax, dword ss:[esi]
imul esp, ebx, 0x8deff898
movsb byte es:[edi], byte [esi]
push ebx
lahf
or dword [esi], esp
xor byte [esi], 0xad
cmp byte [ebx - 0x2e], dl
invalid
popfd
push cs
out dx, al
in al, 0x1f
add dword [ebx + 0x7e], esi
bound esi, qword [ebp + 0x5b]
or dword [edx], ebp
movsb byte es:[edi], byte [esi]
mov byte [esi + 0x38fdd709], dh
stosb byte es:[edi], al
pmulhuw mm6, qword [ecx + 0x4cf3443c]
or edi, edx
std
cmp byte [edx + 0x3cb1e40f], ch
inc esp
dec esp
loopne 0x5d1e1c
retf
xchg edi, eax
loope 0x5d1e43
fdivr qword [ebp + 0x64888eb8]
mov byte [eax - 4], ah
loopne 0x5d1e58
in al, 0x93
cld
popfd
imul ecx, dword [edi], 0x581c5618
jbe 0x5d1e0f
out 0xfc, al
js 0x5d1e9a
je 0x5d1dee
js 0x5d1ec0
mov dh, dh
cmpsd dword [esi], dword es:[edi]
cmp eax, 0x9341cd06
in al, 0x35
invalid
inc esi
mov ebp, 0xa4e3e73c
je 0x5d1e6c
add al, 0x27
push cs
xchg esp, eax
jne 0x5d1eed
xor ah, 0x7f
xor al, 0xad
leave
in al, 0x96
pop ss
mov esi, esp
mov byte [0x6745ed19], al
jl 0x5d1e50
in eax, dx
inc ebp
jl 0x5d1e50
inc ecx
aam 0xd
mov cl, 0xb4
xor byte [edx + 0x10d5ab90], cl
retf 0x7cf0
invalid
invalid
stosb byte es:[edi], al
mov ss, word [edx + 0x21]
mov esi, dword [eax]
int 0x26
stosd dword es:[edi], eax
jb 0x5d1ec6
adc al, 0xa0
imul ecx, edx, 0xffffff9b
mov al, byte [0x7ce56178]
dec esp
mov dh, 0xf8
ror dword [edx], 1
jb 0x5d1f43
invalid
cwde
xchg esi, eax
outsd dx, dword [esi]
iretd
Function at 0x6503ae
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6582f0
cmp edx, dword [eax]
je 0x6503d0
add eax, 8
inc ecx
cmp eax, 0x658380
jl 0x6503c1
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6582f0]
jne 0x6504fe
mov eax, dword [0xa5b934]
cmp eax, 1
je 0x6504d8
test eax, eax
jne 0x650401
cmp dword [0x658234], 1
je 0x6504d8
cmp edx, 0xfc
je 0x6504fe
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x650438
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00650ac0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00650cf0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x65047b
lea eax, [ebp - 0x1a4]
push eax
call fcn.00650cf0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x654b38
push edi
call fcn.006524c0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00650ac0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00650ad0
lea eax, [ebp - 0xa0]
push 0x654b18
push eax
call fcn.00650ad0
push dword [esi + 0x6582f4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00650ad0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00652434
add esp, 0x2c
pop edi
jmp 0x6504fe
lea eax, [ebp + 8]
lea esi, [esi + 0x6582f4]
push 0
push eax
push dword [esi]
call fcn.00650cf0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x7c6e011a
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x551e178a
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x566a1f65
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x9896ffe
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x10021720
Capabilities:
Delete file

Disassembly:
jmp 0x10025780
sub esp, 0x218
mov eax, dword [0x10037d20]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x10039504], 0
mov eax, dword [esp + 0x21c]
je 0x100257c2
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.10026ae6
add esp, 0x218
ret 4
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.10025330
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
lea ecx, [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x10025810
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x10025810
cmp dword [esp + 4], 0xffffffff
je 0x10025810
push eax
call fcn.1002943b
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.10026ae6
add esp, 0x218
ret 4

Function at 0x10025780
Capabilities:
Delete file

Disassembly:
jmp 0x10025780
sub esp, 0x218
mov eax, dword [0x10037d20]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x10039504], 0
mov eax, dword [esp + 0x21c]
je 0x100257c2
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.10026ae6
add esp, 0x218
ret 4
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.10025330
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
lea ecx, [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x10025810
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x10025810
cmp dword [esp + 4], 0xffffffff
je 0x10025810
push eax
call fcn.1002943b
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.10026ae6
add esp, 0x218
ret 4

Function at 0x100259f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x21c
mov eax, dword [0x10037d20]
xor eax, esp
mov dword [esp + 0x218], eax
cmp dword [0x10039504], 0
mov eax, dword [esp + 0x220]
mov ecx, dword [esp + 0x224]
je 0x10025a3a
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.10026ae6
add esp, 0x21c
ret 8
push esi
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.10025120
mov eax, dword [esp + 0x218]
push dword [esp + 8]
add eax, eax
shr eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 4]
mov esi, eax
call fcn.100252c0
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
cmp edx, eax
je 0x10025a8c
mov ecx, edx
shr ecx, 0x10
test ecx, ecx
je 0x10025a8c
cmp dword [esp + 4], 0xffffffff
je 0x10025a8c
push edx
call fcn.1002943b
add esp, 4
mov ecx, dword [esp + 0x21c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.10026ae6
add esp, 0x21c
ret 8
Function at 0x10025ab0
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x218
mov eax, dword [0x10037d20]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x10039504], 0
mov eax, dword [esp + 0x21c]
je 0x10025af2
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.10026ae6
add esp, 0x218
ret 4
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.10025330
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
lea ecx, [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x10025b40
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x10025b40
cmp dword [esp + 4], 0xffffffff
je 0x10025b40
push eax
call fcn.1002943b
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.10026ae6
add esp, 0x218
ret 4
Function at 0x10025d70
Capabilities:
Read .ini file

Disassembly:
sub esp, 0xa70
mov eax, dword [0x10037d20]
xor eax, esp
mov dword [esp + 0xa6c], eax
cmp dword [0x10039504], 0
mov ecx, dword [esp + 0xa88]
mov eax, dword [esp + 0xa74]
push ebx
mov ebx, dword [esp + 0xa84]
push ebp
mov ebp, dword [esp + 0xa8c]
push esi
mov esi, dword [esp + 0xa84]
push edi
mov edi, dword [esp + 0xa8c]
mov dword [esp + 0x10], ecx
je 0x10025dd0
push ecx
push ebp
push ebx
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x10025fb4
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x870]
mov dword [esp + 0x870], 0
mov dword [esp + 0x874], 0
call fcn.10025330
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0x230]
mov dword [esp + 0x230], 0
mov dword [esp + 0x234], 0
call fcn.10025330
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.10025330
push 0xffffffffffffffff
push dword [esp + 0x14]
lea ecx, [esp + 0x444]
mov dword [esp + 0x444], 0
mov dword [esp + 0x448], 0
call fcn.10025330
push ebp
push ebx
lea ecx, [esp + 0x658]
call fcn.10025120
push dword [esp + 0x440]
mov eax, dword [esp + 0x868]
add eax, eax
shr eax, 1
push eax
push dword [esp + 0x65c]
push dword [esp + 0x24]
push dword [esp + 0x23c]
push dword [esp + 0x880]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x650]
mov esi, eax
call fcn.100252c0
mov edx, dword [esp + 0x654]
lea eax, [esp + 0x658]
cmp edx, eax
je 0x10025eda
mov ecx, edx
shr ecx, 0x10
test ecx, ecx
je 0x10025eda
cmp dword [esp + 0x650], 0xffffffff
je 0x10025eda
push edx
call fcn.1002943b
add esp, 4
mov ecx, dword [esp + 0x440]
lea eax, [esp + 0x444]
mov dword [esp + 0x654], 0
cmp ecx, eax
je 0x10025f13
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x10025f13
cmp dword [esp + 0x43c], 0xffffffff
je 0x10025f13
push ecx
call fcn.1002943b
add esp, 4
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
mov dword [esp + 0x440], 0
cmp ecx, eax
je 0x10025f43
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x10025f43
cmp dword [esp + 0x14], 0xffffffff
je 0x10025f43
push ecx
call fcn.1002943b
add esp, 4
mov ecx, dword [esp + 0x22c]
lea eax, [esp + 0x230]
mov dword [esp + 0x18], 0
cmp ecx, eax
je 0x10025f79
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x10025f79
cmp dword [esp + 0x228], 0xffffffff
je 0x10025f79
push ecx
call fcn.1002943b
add esp, 4
mov ecx, dword [esp + 0x86c]
lea eax, [esp + 0x870]
mov dword [esp + 0x22c], 0
cmp ecx, eax
je 0x10025fb2
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x10025fb2
cmp dword [esp + 0x868], 0xffffffff
je 0x10025fb2
push ecx
call fcn.1002943b
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0xa7c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10026ae6
add esp, 0xa70
ret 0x18
Function at 0x10026250
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x440
mov eax, dword [0x10037d20]
xor eax, esp
mov dword [esp + 0x43c], eax
cmp dword [0x10039504], 0
mov eax, dword [esp + 0x450]
mov ecx, dword [esp + 0x454]
mov edx, dword [esp + 0x448]
push ebx
mov ebx, dword [esp + 0x448]
push ebp
mov ebp, dword [esp + 0x454]
push esi
mov esi, dword [esp + 0x464]
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
je 0x100262b6
push esi
push ecx
push eax
push ebp
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
jmp 0x1002644f
push 0xffffffffffffffff
push edx
lea ecx, [esp + 0x240]
mov dword [esp + 0x240], 0
mov dword [esp + 0x244], 0
call fcn.10025330
lea eax, [esp + 0x10]
push eax
push 0
lea eax, [esp + 0x24]
push eax
push ebp
push dword [esp + 0x24c]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
jne 0x10026421
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10026406
cmp eax, 2
jbe 0x10026388
cmp eax, 7
jne 0x10026406
mov eax, dword [esi]
lea ecx, [esp + 0x20]
shr eax, 1
push eax
push dword [esp + 0x1c]
call fcn.10025120
mov eax, dword [esp + 0x234]
add eax, eax
shr eax, 1
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x28]
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0x1c]
push ebp
push dword [esp + 0x24c]
push ebx
call eax
mov ecx, dword [esp + 0x10]
mov edi, eax
lea eax, [ecx + ecx]
mov dword [esi], eax
test edi, edi
je 0x10026375
lea ecx, [esp + 0x20]
call fcn.100251a0
jmp 0x10026421
cmp dword [esp + 0x24], 0
je 0x100263f6
push ecx
lea ecx, [esp + 0x24]
call fcn.10025260
jmp 0x100263f0
mov eax, dword [esi]
lea ecx, [esp + 0x20]
shr eax, 1
push eax
push dword [esp + 0x1c]
call fcn.10025120
mov eax, dword [esp + 0x234]
add eax, eax
shr eax, 1
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x28]
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0x1c]
push ebp
push dword [esp + 0x24c]
push ebx
call eax
mov ecx, dword [esp + 0x10]
mov edi, eax
lea eax, [ecx + ecx]
mov dword [esi], eax
test edi, edi
je 0x100263e0
lea ecx, [esp + 0x20]
call fcn.100251a0
jmp 0x10026421
cmp dword [esp + 0x24], 0
je 0x100263f6
lea ecx, [esp + 0x20]
call fcn.100252c0
mov ecx, eax
mov dword [esp + 0x10], ecx
lea eax, [ecx + ecx]
lea ecx, [esp + 0x20]
mov dword [esi], eax
call fcn.100251a0
jmp 0x10026421
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push ebp
push dword [esp + 0x24c]
push ebx
call eax
mov edi, eax
mov ecx, dword [esp + 0x23c]
lea eax, [esp + 0x240]
cmp ecx, eax
je 0x1002644f
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x1002644f
cmp dword [esp + 0x238], 0xffffffff
je 0x1002644f
push ecx
call fcn.1002943b
add esp, 4
mov ecx, dword [esp + 0x44c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10026ae6
add esp, 0x440
ret 0x18