joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403cb0
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4274c0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x439018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
test ebx, ebx
jne 0x403d0d
mov dword [edi], edx
mov dword [edi + 0x10], edx
mov dword [edi + 0x14], 7
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ef0a
mov esp, ebp
pop ebp
ret
push 0x10021
call fcn.0040f1a2
add esp, 4
test eax, eax
je 0x403e50
lea ecx, [eax + 0x23]
and ecx, 0xffffffe0
push 0xfffe
push 0
push ecx
mov dword [ecx - 4], eax
lea esi, [ecx + 0xfffe]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], esi
call fcn.00410cb0
add esp, 0xc
mov dword [ebp - 0x18], esi
push ebx
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x403d6f
mov dword [edi], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 7
jmp 0x403e14
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
sub ecx, eax
sar ecx, 1
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x403df4
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 0x38]
call fcn.00403960
cmp byte [ebp - 0x20], 0
je 0x403df4
lea eax, [ebp - 0x38]
mov ecx, edi
push eax
call fcn.00404170
cmp byte [ebp - 0x20], 0
je 0x403e08
mov edx, dword [ebp - 0x24]
cmp edx, 8
jb 0x403dde
mov ecx, dword [ebp - 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x403dd4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403e50
push edx
push ecx
call fcn.0040f194
add esp, 8
xor eax, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
jmp 0x403e08
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov dword [edi], 0
cmp esi, 0xffffffff
je 0x403e14
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x1c]
test edx, edx
je 0x403cef
mov ecx, dword [ebp - 0x14]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x403e41
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403e50
push ecx
push edx
call fcn.0040f194
add esp, 8
jmp 0x403cef
call fcn.004134aa
int3
Function at 0x40b5c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427c48
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x439018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ecx]
push 0
push 0
mov eax, dword [eax + 4]
mov dword [ecx + eax], vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ecx]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + ecx - 4], eax
mov eax, dword [ecx]
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov ebx, dword [eax + 4]
add ebx, ecx
mov ecx, ebx
mov dword [ebx + 0x30], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0x201
mov dword [ebx + 0x18], 6
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
call fcn.00406bc0
push 8
call fcn.0040f1a2
mov edi, eax
xorps xmm0, xmm0
add esp, 4
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 2
call fcn.0040e6d4
mov dword [edi + 4], eax
add esp, 4
mov eax, dword [ebp + 8]
mov dword [ebx + 0x30], edi
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], 0
mov edi, dword [edi + 4]
mov dword [ebp - 0x1c], edi
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x429174]
mov ecx, edi
call esi
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 3
push eax
call fcn.00405210
mov edi, eax
add esp, 4
mov ecx, dword [edi]
push 0x20
mov esi, dword [ecx + 0x30]
mov ecx, esi
call dword [0x429174]
mov ecx, edi
call esi
movzx edi, ax
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 1
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x40b719
mov eax, dword [edi]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x429174]
mov ecx, edi
call esi
mov edi, eax
test edi, edi
je 0x40b719
mov ecx, dword [edi]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x429174]
mov ecx, edi
call esi
cmp dword [ebx + 0x38], 0
mov eax, dword [ebp - 0x10]
mov word [ebx + 0x40], ax
jne fcn.0040b736
mov eax, dword [ebx + 0xc]
mov ecx, ebx
push 0
or eax, 4
push eax
call fcn.00406bc0
Function at 0x10001780
Capabilities:
Read .ini file

Disassembly:
cmp dword [eax + 0x18], 8
jb 0x1000179a
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 8]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
ret 4
add eax, 4
push eax
mov eax, dword [esp + 8]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
ret 4

Function at 0x10001940
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x234
mov eax, dword [0x10170024]
xor eax, esp
mov dword [esp + 0x230], eax
mov eax, dword [esp + 0x238]
xor ecx, ecx
test eax, eax
setne cl
push ebx
push esi
push edi
mov dword [esp + 0xc], eax
mov edi, ecx
test edi, edi
jne 0x10001991
push 0x64
call fcn.10001520
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.Comn.dll_GetObjectLog
push esi
push ebx
push str.pExeFile_NULL
jmp 0x100019cf
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10001994
sub eax, edx
sar eax, 1
xor ecx, ecx
mov esi, eax
cmp ecx, esi
sbb edi, edi
neg edi
jne 0x100019e8
push 0x66
call fcn.10001520
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.Comn.dll_GetObjectLog
push esi
push ebx
push str.szlExe_0
mov edx, dword [eax]
push str._s_return_code:_0x_08X___s.
push eax
mov eax, dword [edx + 0xc]
call eax
mov ebx, dword [esp + 0x20]
add esp, 0x14
jmp 0x10001aa2
push ebp
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
xor ecx, ecx
mov ebx, eax
cmp ebx, 0xffffffff
setne cl
mov edi, ecx
test edi, edi
jne 0x10001a34
push 0x69
call fcn.10001520
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
call sub.Comn.dll_GetObjectLog
mov edx, dword [eax]
push esi
push ebp
push str.hProcessSnap_INVALID_HANDLE_VALUE
push str._s_return_code:_0x_08X___s.
push eax
mov eax, dword [edx + 0xc]
call eax
add esp, 0x14
jmp 0x10001aa1
lea ecx, [esp + 0x14]
push ecx
push ebx
mov dword [esp + 0x1c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
mov edi, eax
test edi, edi
jne 0x10001a6f
push 0x6d
call fcn.10001520
add esp, 4
push eax
push str.Process32First__hProcessSnap__pe32_
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.100016d0
add esp, 8
jmp 0x10001aa1
mov ebp, dword [sym.imp.MSVCR80.dll__wcsnicmp]
xor edi, edi
mov edx, dword [esp + 0x10]
push esi
push edx
lea eax, [esp + 0x40]
push eax
call ebp
add esp, 0xc
test eax, eax
je 0x10001a9c
lea ecx, [esp + 0x14]
push ecx
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10001a77
jmp 0x10001aa1
mov edi, 1
pop ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x23c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1012d370
add esp, 0x234
ret
Function at 0x10002ad0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x10170024]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push esi
push edi
push 0x206
lea eax, [esp + 0x12]
push 0
push eax
mov ebx, ecx
mov word [esp + 0x18], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
call sub.Comn.dll_GetObjectSys
xor ecx, ecx
test ebx, ebx
setne cl
mov esi, ecx
test esi, esi
jne 0x10002b3b
push 0x250
call fcn.10001520
add esp, 4
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.Comn.dll_GetObjectLog
push edi
push ebx
push str.pDir_NULL
jmp 0x10002b6b
xor ecx, ecx
test eax, eax
setne cl
mov esi, ecx
test esi, esi
jne 0x10002b95
push 0x251
call fcn.10001520
add esp, 4
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.Comn.dll_GetObjectLog
push edi
push ebx
push str.pSys_NULL
mov edx, dword [eax]
push str._s_return_code:_0x_08X___s.
push eax
mov eax, dword [edx + 0xc]
call eax
add esp, 0x14
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.1012d370
add esp, 0x20c
ret
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x1c]
call eax
test eax, eax
je 0x10002c18
xor eax, eax
jmp 0x10002bb0
movzx ecx, word [eax + str.C:ProgramData]
mov word [esp + eax + 0xc], cx
add eax, 2
test cx, cx
jne 0x10002bb0
lea eax, [esp + 0xc]
lea edx, [eax + 2]
jmp 0x10002bd0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10002bd0
sub eax, edx
xor ecx, ecx
sar eax, 1
cmp eax, 0x104
setl cl
mov edi, ecx
test edi, edi
jne 0x10002c76
push 0x257
call fcn.10001520
add esp, 4
push eax
push str.l_Length
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.100016d0
add esp, 8
jmp 0x10002c8f
lea edx, [esp + 0xc]
push edx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10002c32
sub eax, edx
xor ecx, ecx
sar eax, 1
cmp eax, 0x104
setl cl
mov edi, ecx
test edi, edi
jne 0x10002c76
push 0x25d
call fcn.10001520
add esp, 4
push eax
push str.l_Length
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.100016d0
add esp, 8
jmp 0x10002c8f
lea eax, [esp + 0xc]
mov edx, ebx
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x10002c80
mov ecx, dword [esp + 0x214]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1012d370
add esp, 0x20c
ret
Function at 0x10003040
Capabilities:
Get common file path

Disassembly:
sub esp, 0x42c
mov eax, dword [0x10170024]
xor eax, esp
mov dword [esp + 0x428], eax
push ebx
push ebp
mov ebp, dword [esp + 0x438]
mov bl, 1
call sub.Comn.dll_GetObjectSys
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x1c]
call eax
test eax, eax
je 0x10003073
xor bl, bl
push 0x3fe
lea ecx, [esp + 0x36]
push 0
push ecx
mov word [esp + 0x3c], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
test bl, bl
je 0x10003158
mov eax, dword [0x1014c860]
mov ecx, dword [0x1014c864]
mov edx, dword [0x1014c85c]
mov dword [esp + 0xc], eax
mov ax, word [0x1014c86c]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x30]
push ecx
mov word [esp + 0x1c], ax
xor eax, eax
push eax
push eax
mov dword [esp + 0x14], edx
mov edx, dword [0x1014c868]
push 0x23
push eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov dword [esp + 0x3a], eax
mov dword [esp + 0x3e], eax
mov word [esp + 0x42], ax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 8]
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10003100
push esi
push edi
lea edi, [esp + 0x38]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10003116
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea edx, [esp + 0x38]
rep movsb byte es:[edi], byte [esi]
push edx
mov ecx, ebp
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.1012d370
add esp, 0x42c
ret
push 0x400
lea eax, [esp + 0x34]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x30]
push 0x5c
push ecx
call dword [sym.imp.MSVCR80.dll_wcsrchr]
add esp, 8
lea edx, [esp + 0x30]
push edx
mov ecx, ebp
mov word [eax], 0
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
mov ecx, dword [esp + 0x430]
pop ebp
pop ebx
xor ecx, esp
call fcn.1012d370
add esp, 0x42c
ret
Function at 0x100031b0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x1013c30b
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x10170024]
xor eax, esp
mov dword [esp + 0x224], eax
push esi
push edi
mov eax, dword [0x10170024]
xor eax, esp
push eax
lea eax, [esp + 0x234]
mov dword fs:[0], eax
push 0x206
lea eax, [esp + 0x2e]
push 0
push eax
mov word [esp + 0x34], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea ecx, [esp + 0x2c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x28]
push 0x5c
push edx
call dword [sym.imp.MSVCR80.dll_wcsrchr]
lea edi, [esp + 0x30]
add esp, 8
mov word [eax], 0
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10003232
mov ecx, 6
mov esi, str.Version.ini
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0xc]
movsw word es:[edi], word [esi]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x240], 0
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
cmp dword [esp + 0x24], 8
mov eax, dword [esp + 0x10]
jae 0x1000327f
lea eax, [esp + 0x10]
push eax
push 0x11
push str.versionCode
push str.VersionInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x23c], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x234]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.1012d370
add esp, 0x234
ret
Function at 0x100032e0
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x1013d27c
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x10170024]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10170024]
xor eax, esp
push eax
lea eax, [esp + 0x240]
mov dword fs:[0], eax
xor ebp, ebp
push 0x206
lea eax, [esp + 0x3a]
push ebp
push eax
mov esi, ecx
mov word [esp + 0x40], bp
call sub.MSVCR80.dll_memset
add esp, 0xc
lea ecx, [esp + 0x34]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
lea ebx, [esp + 0x34]
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x10003350
sub eax, edx
sar eax, 1
cmp eax, 3
jne 0x100033be
push ebx
lea ecx, [esp + 0x1c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x24c], 0
call fcn.10003480
add ebx, 8
mov eax, ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10003390
sub eax, edx
sar eax, 1
lea ecx, [esp + 0x18]
mov edi, eax
mov dword [esp + 0x248], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
add ebp, 1
cmp edi, 3
je 0x10003364
mov eax, ebp
mov ecx, dword [esp + 0x240]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.1012d370
add esp, 0x238
ret
Function at 0x100041c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x10170024]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push esi
push edi
push 0x206
lea eax, [esp + 0x12]
push 0
push eax
mov ebx, ecx
mov word [esp + 0x18], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
call sub.Comn.dll_GetObjectSys
xor ecx, ecx
test ebx, ebx
setne cl
mov esi, ecx
test esi, esi
jne 0x10004228
push 0x1a
call fcn.10003fe0
add esp, 4
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.Comn.dll_GetObjectLog
push edi
push ebx
push str.pDir_NULL
jmp 0x10004255
xor ecx, ecx
test eax, eax
setne cl
mov esi, ecx
test esi, esi
jne 0x1000427f
push 0x1b
call fcn.10003fe0
add esp, 4
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.Comn.dll_GetObjectLog
push edi
push ebx
push str.pSys_NULL
mov edx, dword [eax]
push str._s_return_code:_0x_08X___s.
push eax
mov eax, dword [edx + 0xc]
call eax
add esp, 0x14
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.1012d370
add esp, 0x20c
ret
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x1c]
call eax
test eax, eax
je 0x100042f5
xor eax, eax
mov edi, edi
movzx ecx, word [eax + str.C:ProgramData]
mov word [esp + eax + 0xc], cx
add eax, 2
test cx, cx
jne 0x10004290
lea eax, [esp + 0xc]
lea edx, [eax + 2]
jmp 0x100042b0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100042b0
sub eax, edx
xor ecx, ecx
sar eax, 1
cmp eax, 0x104
setl cl
mov edi, ecx
test edi, edi
jne 0x10004351
push 0x21
call fcn.10003fe0
add esp, 4
push eax
push str.l_lenth
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.100016d0
add esp, 8
jmp 0x1000436f
lea edx, [esp + 0xc]
push edx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0xc]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10004310
sub eax, edx
xor ecx, ecx
sar eax, 1
cmp eax, 0x104
setl cl
mov edi, ecx
test edi, edi
jne 0x10004351
push 0x27
call fcn.10003fe0
add esp, 4
push eax
push str.l_lenth
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.100016d0
add esp, 8
jmp 0x1000436f
lea eax, [esp + 0xc]
mov edx, ebx
mov ecx, eax
sub edx, ecx
jmp 0x10004360
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x10004360
mov ecx, dword [esp + 0x214]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1012d370
add esp, 0x20c
ret
Function at 0x10004cf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [eax + 4]
lea edx, [esp + 8]
push edx
push 0
push str.ProductName
push ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10004d26
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
pop ecx
ret 4
cmp dword [esp], 1
sete al
pop ecx
ret 4
Function at 0x1000d9d0
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x1013b9ee
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x10170024]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x24]
mov eax, 1
test byte [0x10188c48], al
jne 0x1000da33
or dword [0x10188c48], eax
mov ecx, 0x10188c2c
mov dword [esp + 0x1c], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
push 0x10145cf0
call fcn.1012d48d
add esp, 4
mov dword [esp + 0x1c], 0xffffffff
push 0
push ebp
mov dword [esp + 0x2c], 0x34
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x1000dacf
lea ecx, [ecx]
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.MSVCR80.dll_void____cdecl_operator_new___unsigned_int_
mov esi, eax
add esp, 4
test esi, esi
je 0x1000da50
push esi
push edi
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1000daba
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0x1014bdb4
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1000daba
mov eax, dword [esp + 0x10]
movzx edx, word [eax + 0x16]
movzx ecx, word [eax + 0x10]
push edx
movzx edx, word [eax + 0x12]
push ecx
push edx
push str._d._d._d
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push esi
mov ecx, 0x10188c2c
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp dword [0x10188c44], 8
mov eax, dword [0x10188c30]
jae 0x1000dae2
mov eax, 0x10188c30
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret 4
Function at 0x1000dc90
Capabilities:
Access peb ldr_data
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x1013d06b
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x10170024]
xor eax, esp
mov dword [esp + 0x42c], eax
push edi
mov eax, dword [0x10170024]
xor eax, esp
push eax
lea eax, [esp + 0x438]
mov dword fs:[0], eax
call fcn.100031b0
lea ecx, [esp + 8]
mov edi, eax
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
push 0x206
lea eax, [esp + 0x2a]
push 0
mov dword [esp + 0x448], 0
push eax
mov word [esp + 0x30], 0
call sub.MSVCR80.dll_memset
push 0x206
lea ecx, [esp + 0x23e]
push 0
push ecx
mov word [esp + 0x244], 0
call sub.MSVCR80.dll_memset
add esp, 0x18
lea edx, [esp + 0x24]
push edx
call fcn.10016760
lea eax, [esp + 0x24]
push eax
push str._sVersion.ini
lea edx, [esp + 0x234]
call fcn.10003fc0
add esp, 8
lea ecx, [esp + 0x22c]
push ecx
lea ecx, [esp + 0xc]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
cmp dword [esp + 0x20], 8
mov eax, dword [esp + 0xc]
jae 0x1000dd61
lea eax, [esp + 0xc]
push eax
push 0
push 0x1014cefc
push 0x1014cf00
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea ecx, [edi - 1]
cmp ecx, 0xf
ja case.default.0x1000dd80
jmp dword [ecx*4 + 0x1000dec4]
push str.beta
jmp 0x1000de81
push 0x1014cf44
jmp 0x1000de81
push 0x1014cf48
jmp 0x1000de81
push 0x1014dc60
jmp 0x1000de81
push 0x1014cf50
jmp 0x1000de81
push str.tech
jmp 0x1000de81
push str.techp
jmp 0x1000de81
add eax, 0xfffffffe
cmp eax, 0xf
ja case.0x1000ddd9.6
jmp dword [eax*4 + 0x1000df04]
push str.pro_trial
jmp 0x1000de81
push str.srv_trial
jmp 0x1000de81
push str.tech_trial
jmp 0x1000de81
push str.techp_trial
jmp 0x1000de81
push str.ws_trial
jmp 0x1000de81
push str.agent_Trial
jmp 0x1000de81
push str.stand_cn
jmp 0x1000de81
push str.pro_trial_cn
jmp 0x1000de81
push str.enterprise_trial_cn
jmp 0x1000de81
push str.agent_Trial_cn
jmp 0x1000de81
push str.home_Trial
jmp 0x1000de81
cmp eax, 0xa
mov ecx, esi
jne 0x1000de44
push str.agent_unreg
jmp 0x1000de83
push str.formal
jmp 0x1000de83
push str.agent_pro
jmp 0x1000de81
push str.agent_srv
jmp 0x1000de81
push str.std_cn
jmp 0x1000de81
push str.pro_cn
jmp 0x1000de81
push str.srv_cn
jmp 0x1000de81
push str.enterprise_cn
jmp 0x1000de81
push str.home
jmp 0x1000de81
push str.unknown
mov ecx, esi
call dword [0x10146514]
lea ecx, [esp + 8]
mov dword [esp + 0x440], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [esp + 0x438]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x42c]
xor ecx, esp
call fcn.1012d370
add esp, 0x43c
ret