joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000737b
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x1001b1bc
call fcn.1001a990
sub esp, 0x468
push ebx
push esi
push edi
mov esi, ecx
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, dword [ebp + 8]
mov byte [esi + 0x1c], 1
and dword [ebp - 0x20], 0
lea edi, [ebp - 0x1c]
mov eax, dword [ebx]
and byte [ebp - 0x474], 0
mov dword [esi + 0x28], eax
mov eax, dword [ebx + 4]
mov dword [esi + 0x24], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x473]
and byte [ebp - 0x74], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x73]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x10]
call fcn.1000acbc
and dword [ebp - 4], 0
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x10]
call fcn.1000ad0b
and byte [ebp - 0x30], 0
xor eax, eax
lea edi, [ebp - 0x2f]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x30]
push eax
call fcn.1000ac65
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x74]
push dword [ebx + 8]
push dword [ebx + 4]
push dword [ebx]
add ebx, 0xc
push ebx
push eax
lea eax, [ebp - 0x474]
push str.http:__www.58wb.com_adm_attchss_relation.aspx_mac_su_sw_dh_dkwindex_dBID_s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x24
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
xor edi, edi
cmp eax, edi
jne 0x10007480
mov ecx, dword [0x100229bc]
mov eax, dword [esi + 4]
push edi
push ecx
push edi
push eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0x474]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 0x50000000
push eax
push str.AtlAxWin
push edi
call fcn.1000135d
mov dword [esi + 0x20], eax
push 0xffffffffffffffff
mov ecx, esi
call fcn.10007187
push edi
push 0xc8
push 2
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.1000ad00
mov ecx, dword [ebp - 0xc]
push 1
pop eax
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x100087ce
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esi + 4]
cmp eax, ecx
je 0x100087f7
cmp eax, dword [esi + 0x280]
je 0x100087f7
cmp eax, dword [esi + 0x344]
je 0x100087f7
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 0x10

Function at 0x10008929
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
mov esi, ecx
push ebx
push 0x18b
push dword [esi + 0x344]
call edi
cmp eax, ebx
jle 0x10008969
mov dword [ebp - 4], eax
push ebx
push ebx
push 0x182
push dword [esi + 0x344]
call edi
dec dword [ebp - 4]
jne 0x10008955
push dword [ebp + 8]
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x14]
push 0x10021ad0
push eax
call edi
add esp, 0xc
lea eax, [esi + 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push eax
lea eax, [ebp - 0xa4]
push 0x80
push eax
push 0x10021acc
lea eax, [ebp - 0x14]
push 0x10021ac8
push eax
call ebx
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
mov dword [ebp - 4], eax
push 1
pop ecx
cmp eax, ecx
mov dword [ebp + 8], ecx
jl 0x10008a16
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push 0x10021ad0
push eax
call edi
add esp, 0xc
lea eax, [esi + 0x1c]
push eax
lea eax, [ebp - 0xa4]
push 0x80
push eax
lea eax, [ebp - 0x24]
push 0x10021ac0
push eax
lea eax, [ebp - 0x14]
push eax
call ebx
lea eax, [ebp - 0xa4]
push eax
push 0
push 0x180
push dword [esi + 0x344]
call dword [sym.imp.USER32.dll_SendMessageA]
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
jle 0x100089c1
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10008a1d
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x9c
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
mov esi, ecx
push ebx
push 0x18b
push dword [esi + 0x280]
call edi
cmp eax, ebx
jle 0x10008a58
mov ebp, eax
push ebx
push ebx
push 0x182
push dword [esi + 0x280]
call edi
dec ebp
jne 0x10008a46
lea eax, [esi + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push eax
mov ebp, 0x80
lea eax, [esp + 0x30]
push ebp
push eax
push 0x10021acc
mov ebx, str.hotindex
push 0x10021ac8
push ebx
call edi
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
mov dword [esp + 0x18], eax
push 0
push 0
push 0x19
push 0x12
push 0x16
call fcn.10008fe8
push 0
push 0
push 0x19
push 0x12
push 0x16
mov dword [esi + 0x2a4], eax
call fcn.10008fe8
push 1
mov dword [esi + 0x2a8], eax
pop eax
cmp dword [esp + 0x18], eax
mov dword [esp + 0x10], eax
jl 0x10008b82
push dword [esp + 0x10]
lea eax, [esp + 0x20]
push 0x10021ad0
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [esi + 0x1c]
push eax
lea eax, [esp + 0x30]
push ebp
push eax
lea eax, [esp + 0x28]
push 0x10021ac0
push eax
push ebx
call edi
lea eax, [esp + 0x2c]
push eax
push 0
push 0x180
push dword [esi + 0x280]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x13d
push dword [0x100229bc]
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0xffffff
push eax
push dword [esi + 0x2a4]
mov dword [esp + 0x20], eax
call fcn.100090bc
push dword [esp + 0x14]
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0x13c
push dword [0x100229bc]
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0xffffff
push eax
push dword [esi + 0x2a8]
mov dword [esp + 0x20], eax
call fcn.100090bc
push dword [esp + 0x14]
call dword [sym.imp.GDI32.dll_DeleteObject]
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x18]
jle 0x10008aca
lea eax, [esi + 0x1c]
push eax
lea eax, [esp + 0x30]
push ebp
push eax
push 0x10021acc
push str.current
push ebx
call edi
mov edi, dword [sym.imp.MSVCRT.dll_atoi]
lea eax, [esp + 0x2c]
push eax
call edi
pop ecx
push eax
mov ecx, esi
call fcn.10008929
push dword [esi + 0x280]
call dword [sym.imp.USER32.dll_SetFocus]
lea eax, [esp + 0x2c]
push eax
call edi
pop ecx
dec eax
push 0
push eax
push 0x186
push dword [esi + 0x280]
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x9c
ret 4
Function at 0x10008d55
Capabilities:
Initialize iwebbrowser2

Disassembly:
mov eax, 0x1001b228
call fcn.1001a990
sub esp, 0x38
or word [ebp - 0x3c], 0xffff
mov word [ebp - 0x44], 0xb
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push 0x1001d31c
push 0x15
push 0
push 0x1001d2fc
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
mov eax, dword [ebp - 0x10]
jl 0x10008e41
test eax, eax
je 0x10008e4b
push esi
mov esi, dword [eax]
lea ecx, [ebp - 0x44]
call fcn.10008f47
push eax
push dword [ebp - 0x10]
call dword [esi + 0xa4]
and word [ebp - 0x24], 0
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push str.http:__www.58wb.com_hot_more.aspx
lea ecx, [ebp - 0x14]
mov word [ebp - 0x34], 8
call fcn.10008e73
mov eax, dword [eax]
test eax, eax
je 0x10008ddd
mov eax, dword [eax]
jmp 0x10008ddf
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
test ecx, ecx
je 0x10008df2
call fcn.10008efa
and dword [ebp - 0x14], 0
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
push edx
lea edx, [ebp - 0x24]
push edx
mov ecx, dword [eax]
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x34]
push edx
push eax
call dword [ecx + 0xd0]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x34]
push eax
call esi
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x44]
push eax
call esi
test eax, eax
pop esi
jge 0x10008e3c
push eax
call fcn.1001a794
push 1
pop eax
jmp 0x10008e65
test eax, eax
je 0x10008e4b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
jge 0x10008e63
push eax
call fcn.1001a794
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x10009740
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 4], esp
push ebx
mov byte [esi + 0x13c], bl
mov dword [esi + 0x20], ebx
mov dword [esi + 0x144], ebx
mov dword [esi + 0x148], ebx
mov dword [esi + 0x14c], 0xffffff
mov dword [esi + 0x150], 0xff
mov dword [esi + 0x140], ebx
lea edi, [esi + 0x24]
call fcn.10009459
push ebx
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 4], esp
push ebx
call fcn.10009459
push dword [esi + 4]
mov ecx, edi
call fcn.1000918d
push dword [edi]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100097fd
push ebx
push 1
push 0x401
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [esi + 0x28]
push eax
call sub.MSVCRT.dll_strlen
cmp eax, 2
pop ecx
ja 0x100097e2
lea eax, [esi + 0x28]
push 0x80
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push ebx
push ebx
push ecx
lea eax, [esi + 0x28]
mov ecx, esp
mov dword [ebp - 4], esp
push eax
call fcn.10009459
push dword [esi + 4]
mov ecx, edi
call fcn.100091de
lea eax, [esi + 0xa9]
push 0x80
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push ebx
push ebx
push 0x31
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, ebx
mov dword [esi + 0x144], eax
jne 0x1000983e
push 0xd
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [esi + 0x144], eax
push 0xe
xor eax, eax
pop ecx
lea edi, [ebp - 0x3c]
mov dword [ebp - 0x40], ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x40]
push eax
push 0x3c
push dword [esi + 0x144]
call dword [sym.imp.GDI32.dll_GetObjectA]
mov al, byte [esi + 0x140]
mov byte [ebp - 0x2b], al
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push 1
push ebx
push dword [esi + 4]
mov dword [esi + 0x148], eax
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000a110
Capabilities:
Delete file
Hide graphical window
Read .ini file

Disassembly:
sub esp, 0x98
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
mov esi, ecx
push ebx
push 0x188
push dword [esi + 0x228]
call edi
push ebx
push ebx
push 0x18b
mov ebp, eax
push dword [esi + 0x228]
call edi
cmp ebp, ebx
jl 0x1000a2af
cmp ebp, eax
jge 0x1000a2af
sub eax, ebp
cmp eax, 1
jne 0x1000a1f4
lea eax, [esi + 0x1c]
mov ebx, str.search
mov dword [esp + 0x10], eax
push eax
lea eax, [esp + 0x18]
push 0x10
push eax
push str.true
push str.localie
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x14]
push eax
push str.true
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
pop ecx
push 0
push ebp
push 0x182
push dword [esi + 0x228]
test eax, eax
jne 0x1000a1c8
call edi
push 0x10021bac
push ebp
push 0x181
push dword [esi + 0x228]
call edi
push dword [esp + 0x10]
push str.false
jmp 0x1000a1e6
call edi
push 0x10021b94
push ebp
push 0x181
push dword [esi + 0x228]
call edi
push dword [esp + 0x10]
push str.true
push str.localie
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x1000a215
cmp eax, 2
jne 0x1000a21d
lea eax, [esi + 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
push ebx
push 0x184
push dword [esi + 0x228]
call edi
push 1
pop eax
jmp 0x1000a2b1
lea eax, [esp + 0x24]
push eax
push ebp
push 0x189
push dword [esi + 0x228]
call edi
mov eax, dword [esi + 0x2e8]
and byte [eax + 0xb65], 0
lea eax, [esp + 0x24]
push eax
mov eax, dword [esi + 0x2e8]
push dword [eax + 0x3f4]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [esi + 0x2e8]
push ebx
mov byte [eax + 0xb65], 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x2e8]
push dword [eax + 0x3f4]
call dword [sym.imp.USER32.dll_SetFocus]
mov ebp, dword [esi + 0x2e8]
push 0xffffffffffffffff
add ebp, 0x3f4
push ebx
push 0xb1
push dword [ebp]
call edi
push ebx
push ebx
push 0xb7
push dword [ebp]
call edi
mov ecx, dword [esi + 0x2e8]
push 0xffffffffffffffff
call fcn.10012e0d
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x98
ret 0x10
Function at 0x1000a751
Capabilities:
Hide graphical window

Disassembly:
cmp dword [esp + 8], 1
push esi
mov esi, ecx
jne 0x1000a787
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esi + 0x2e8]
cmp eax, dword [ecx + 0x3f4]
je 0x1000a787
mov ecx, dword [esi + 4]
cmp eax, ecx
je 0x1000a787
cmp eax, dword [esi + 0x228]
je 0x1000a787
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 0x10

Function at 0x1000a78d
Capabilities:
Hide graphical window

Disassembly:
cmp byte [ecx + 0x2ec], 0
je 0x1000a7a1
push 0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
ret 0x10

Function at 0x1000ac65
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
mov dword [ebp - 8], 0xd
push eax
push 0xf003f
push 0
push str.SOFTWARESXWLSAFE
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push dword [ebp + 8]
push eax
push 0
push 0x10021bf4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
leave
ret

Function at 0x1000acbc
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push esi
mov esi, ecx
push eax
push 0x202
mov dword [esi], 0x1001d184
call sub.WS2_32.dll_WSAStartup
mov eax, esi
pop esi
add esp, 0x190
ret

Function at 0x1000ad99
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and byte [ebp - 0x18], 0
push edi
xor eax, eax
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
pop edi
je 0x1000ae00
lea eax, [ebp - 0x18]
push eax
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x1000ae00
mov eax, dword [eax + 0xc]
push 4
push dword [eax]
lea eax, [ebp - 8]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push dword [ebp - 8]
call sub.WS2_32.dll_inet_ntoa
push eax
push dword [ebp + 8]
call sub.MSVCRT.dll_strcpy
pop ecx
mov al, 1
pop ecx
jmp 0x1000ae02
xor al, al
leave
ret 4
Function at 0x1000b5b5
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x1001b33c
call fcn.1001a990
sub esp, 0x14
push esi
add ecx, 0x14
push edi
push ecx
lea ecx, [ebp - 0x10]
call fcn.100018e6
and dword [ebp - 4], 0
mov esi, str.winskydata.ini
mov eax, esi
test eax, eax
je 0x1000b5e6
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.1000197b
and byte [ebp - 0x20], 0
xor eax, eax
lea edi, [ebp - 0x1f]
push dword [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x20]
push 0x10
push eax
push 0x100213cc
push str.innertype
push str.popup
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.100018ba
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x1000d6eb
Capabilities:
Read file via mapping

Disassembly:
push esi
push edi
xor edi, edi
push str.sxwliesharememry
push edi
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov esi, eax
cmp esi, edi
jne 0x1000d708
or eax, 0xffffffff
jmp 0x1000d735
push 0xc
push edi
push edi
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, edi
jne 0x1000d71e
or edi, 0xffffffff
jmp 0x1000d72c
mov ecx, dword [eax + 4]
mov edx, dword [esp + 0xc]
mov eax, dword [eax + 8]
mov edi, ecx
mov dword [edx], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret 4

Function at 0x1000d73a
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0xffffffff
push ebx
push edi
jle 0x1000d76c
xor edi, edi
cmp dword [ebp + 8], edi
jne 0x1000d753
or dword [ebp + 8], 0xffffffff
push str.sxwliesharememry
mov ebx, 0xf001f
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
cmp eax, edi
mov dword [ebp - 4], eax
jne 0x1000d770
xor al, al
jmp 0x1000d7d3
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0xc
push edi
push edi
push 4
push eax
call esi
mov ecx, eax
cmp ecx, edi
jne 0x1000d78a
xor bl, bl
jmp 0x1000d7c7
mov dword [ebp - 0x10], edi
xor eax, eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ecx]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
cmp eax, 0x64
jge 0x1000d7a4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
push 0xc
push 0
push 0
push ebx
mov dword [ebp - 8], eax
push dword [ebp - 4]
call esi
lea ecx, [ebp - 0x10]
push 0xc
push ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov bl, 1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop esi
pop edi
pop ebx
leave
ret 8
Function at 0x1000e5ce
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
add ecx, 0x14
push edi
lea eax, [ebp - 0x20c]
push ecx
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x20c]
push str.winskydata.ini
push eax
call sub.MSVCRT.dll_strcat
and byte [ebp - 8], 0
xor eax, eax
lea edi, [ebp - 7]
add esp, 0x10
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x20c]
mov esi, 0x100213cc
push eax
lea eax, [ebp - 8]
push 5
push eax
push esi
push str.Relatepop
push str.popup
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 8]
push esi
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
pop ecx
pop edi
test eax, eax
setne al
pop esi
leave
ret

Function at 0x1000eb13
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x1001b5cc
call fcn.1001a990
sub esp, 0xc
push ebx
add ecx, 0x14
push esi
push ecx
lea ecx, [ebp - 0x10]
call fcn.100018e6
mov esi, str.winskydata.ini
xor ebx, ebx
mov eax, esi
mov dword [ebp - 4], ebx
test eax, eax
je 0x1000eb45
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.1000197b
push dword [ebp - 0x10]
xor eax, eax
lea edi, [ebp - 0x17]
mov byte [ebp - 0x18], bl
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x18]
push 5
mov esi, 0x100213cc
push eax
push esi
push str.image
push str.ietop
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x18]
push esi
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
pop ecx
pop edi
test eax, eax
je 0x1000eb8c
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.100018ba
mov ecx, dword [ebp - 0xc]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x1000eba8
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x1001b5e0
call fcn.1001a990
sub esp, 0xc
push ebx
add ecx, 0x14
push esi
push ecx
lea ecx, [ebp - 0x10]
call fcn.100018e6
mov esi, str.winskydata.ini
xor ebx, ebx
mov eax, esi
mov dword [ebp - 4], ebx
test eax, eax
je 0x1000ebda
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.1000197b
push dword [ebp - 0x10]
xor eax, eax
lea edi, [ebp - 0x17]
mov byte [ebp - 0x18], bl
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x18]
push 5
mov esi, 0x100213cc
push eax
push esi
push str.Navigate
push str.popup
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x18]
push esi
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
pop ecx
pop edi
test eax, eax
je 0x1000ec21
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.100018ba
mov ecx, dword [ebp - 0xc]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x1000ec3d
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x1001b5f4
call fcn.1001a990
sub esp, 0xc
push ebx
add ecx, 0x14
push esi
push ecx
lea ecx, [ebp - 0x10]
call fcn.100018e6
mov esi, str.winskydata.ini
xor ebx, ebx
mov eax, esi
mov dword [ebp - 4], ebx
test eax, eax
je 0x1000ec6f
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.1000197b
push dword [ebp - 0x10]
xor eax, eax
lea edi, [ebp - 0x17]
mov byte [ebp - 0x18], bl
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x18]
push 5
mov esi, 0x100213cc
push eax
push esi
push str.Navigate2
push str.popup
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x18]
push esi
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
pop ecx
pop edi
test eax, eax
je 0x1000ecb6
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.100018ba
mov ecx, dword [ebp - 0xc]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x1000ecd2
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x1001b608
call fcn.1001a990
sub esp, 0x14
push ebx
add ecx, 0x14
push esi
push ecx
lea ecx, [ebp - 0x10]
call fcn.100018e6
mov esi, str.winskydata.ini
xor ebx, ebx
mov eax, esi
mov dword [ebp - 4], ebx
test eax, eax
je 0x1000ed04
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.1000197b
xor eax, eax
lea edi, [ebp - 0x1f]
mov byte [ebp - 0x20], bl
push dword [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x20]
push 0x10
push eax
push 0x100213cc
push str.inner
push str.popup
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x20]
push eax
push 0x10021acc
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
pop ecx
pop edi
test eax, eax
jne 0x1000ed53
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.100018ba
mov ecx, dword [ebp - 0xc]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x1000f382
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
and byte [ebp - 0x20c], 0
push ebx
push esi
mov ebx, ecx
push edi
mov ecx, 0x80
xor eax, eax
lea edi, [ebp - 0x20b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
add ebx, 0x14
lea eax, [ebp - 0x20c]
push ebx
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x20c]
push str.winskydata.ini
push eax
call sub.MSVCRT.dll_strcat
and byte [ebp - 8], 0
xor eax, eax
lea edi, [ebp - 7]
add esp, 0x10
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x20c]
mov esi, 0x100213cc
push eax
lea eax, [ebp - 8]
push 5
push eax
push esi
push str.Ietop
push str.ietop
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 8]
push esi
push eax
call sub.MSVCRT.dll_strcmp
test eax, eax
push 0x204
lea eax, [ebp - 0x20c]
push 0
push eax
setne byte [ebp - 1]
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x20c]
push ebx
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x20c]
push str.winskyieset.ini
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x24
lea eax, [ebp - 0x20c]
push eax
push 0
push str.Count
push 0x10021390
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop esi
cmp eax, 1
pop ebx
jae 0x1000f464
and byte [ebp - 1], 0
mov al, byte [ebp - 1]
leave
ret