joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10024055
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 4
pop esi
push esi
push 0x10160acc
push ebx
call fcn.1007e952
add esp, 0xc
test eax, eax
je 0x100240a0
push esi
push 0x10160a78
push ebx
call fcn.1007e952
add esp, 0xc
test eax, eax
je 0x100240a0
push esi
push 0x10160a84
push ebx
call fcn.1007e952
add esp, 0xc
test eax, eax
jne 0x100240a3
add ebx, 8
push ebx
call fcn.1007e283
cmp eax, esi
pop ecx
jb 0x10024157
cmp word [ebx + 2], 0x3a
jne 0x10024157
cmp word [ebx + 4], 0x5c
lea eax, [ebx + 4]
mov dword [ebp - 4], eax
jne 0x10024157
mov esi, 0x10160ac4
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
lea edi, [ebp - 0xa]
stosd dword es:[edi], eax
stosw word es:[edi], ax
movzx eax, word [ebx]
push eax
call fcn.1007e7d6
mov word [ebp - 0x10], ax
pop ecx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
jne 0x10024157
and word [ebp - 0x218], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x216]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x104
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x10]
push eax
call sub.MPR.dll_WNetGetConnectionW
test eax, eax
jne 0x10024157
push dword [ebp - 4]
lea eax, [ebp - 0x218]
push eax
mov eax, dword [ebp + 0x10]
dec eax
push 0x10160ab8
push eax
push dword [ebp + 0xc]
call fcn.1007e75e
add esp, 0x14
jmp 0x10024175
push ebx
call fcn.1007e283
pop ecx
mov ecx, dword [ebp + 0x10]
dec ecx
cmp eax, ecx
jbe 0x10024168
mov eax, ecx
push eax
push ebx
push dword [ebp + 0xc]
call fcn.1007e246
add esp, 0xc
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1002417d
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x10024307
cmp dword [ebp + 0xc], 0
je 0x10024307
push esi
push edi
mov esi, 0x10160ac4
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
lea edi, [ebp - 6]
stosd dword es:[edi], eax
stosw word es:[edi], ax
cmp word [ebp - 0xc], 0x5a
ja 0x10024236
and word [ebp - 0x214], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x212]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x214]
push 0x104
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea eax, [ebp - 0x214]
push eax
call fcn.1007e283
mov esi, eax
pop ecx
test esi, esi
jbe 0x1002420f
lea eax, [ebp - 0x214]
push esi
push eax
push ebx
call fcn.1007f884
add esp, 0xc
test eax, eax
je 0x10024215
inc word [ebp - 0xc]
jmp 0x100241b1
lea eax, [ebx + esi*2]
test eax, eax
je 0x10024236
push eax
lea eax, [ebp - 0xc]
push eax
push 0x10160ab8
push dword [ebp + 0xc]
call fcn.1007e637
add esp, 0x10
jmp 0x10024301
push 8
push 0x101764a4
push ebx
call fcn.1007f884
add esp, 0xc
test eax, eax
jne 0x10024258
add ebx, 0x10
push ebx
push 0x10176498
jmp 0x100242e6
push 0x19
push str.DeviceLanmanRedirector_
push ebx
call fcn.1007f884
add esp, 0xc
test eax, eax
jne 0x10024271
add ebx, 0x32
jmp 0x1002424d
push 0xc
push str.DeviceMup_
push ebx
call fcn.1007f884
add esp, 0xc
test eax, eax
jne 0x1002428a
add ebx, 0x18
jmp 0x1002424d
push ebx
call fcn.1007e283
cmp eax, 0x18
pop ecx
jbe 0x100242bd
push 0x17
push str.DeviceTSafeDiskVolume
push ebx
call fcn.1007f884
add esp, 0xc
test eax, eax
jne 0x100242bd
lea eax, [ebx + 0x30]
push eax
movzx eax, word [ebx + 0x2e]
push eax
push str._TSD_VOLUME__c:_s
jmp 0x10024226
push ebx
call fcn.1007e283
cmp eax, 0xf
pop ecx
jbe 0x100242f0
push 0xf
push str.__TSD_VOLUME_
push ebx
call fcn.1007f884
add esp, 0xc
test eax, eax
jne 0x100242f0
add ebx, 0x1e
push ebx
push str._TSD_VOLUME__s
push dword [ebp + 0xc]
call fcn.1007e637
jmp 0x100242fe
push 0x208
push dword [ebp + 0xc]
push ebx
call fcn.10024055
add esp, 0xc
pop edi
xor eax, eax
pop esi
jmp 0x1002430c
mov eax, 0xc000000d
pop ebx
leave
ret
Function at 0x1002bbc5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
or dword [esp], 0xffffffff
push ebp
push edi
mov edi, dword [esp + 0x10]
push edi
call fcn.1002bc51
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop ecx
test eax, eax
jne 0x1002bbf3
push edi
call ebp
cmp eax, 0xffffffff
je 0x1002bbf3
push edi
call fcn.1007e450
pop ecx
jmp 0x1002bc4d
push ebx
push esi
push edi
call fcn.1007e450
mov ebx, eax
pop ecx
add ebx, edi
mov eax, edi
cmp edi, ebx
jae 0x1002bc47
push 0x20
push eax
call fcn.1007eff0
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x1002bc19
and byte [esi], 0
push edi
call fcn.1002bc51
test eax, eax
pop ecx
jne 0x1002bc2c
push edi
call ebp
cmp eax, 0xffffffff
jne 0x1002bc3c
test esi, esi
je 0x1002bc47
lea eax, [esi + 1]
mov byte [esi], 0x20
cmp eax, ebx
jb 0x1002bc06
jmp 0x1002bc47
push edi
call fcn.1007e450
pop ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
pop esi
pop ebx
pop edi
pop ebp
pop ecx
ret
Function at 0x1002be08
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x1002beb6
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1002beb6
cmp dword [ebp + 0x10], 0
je 0x1002beb6
mov cl, byte [ebx]
test cl, cl
je 0x1002beb6
mov dl, byte [ebx + 1]
lea esi, [ebx + 1]
test dl, dl
mov byte [ebp - 1], dl
je 0x1002beb6
mov dl, byte [ebx + 2]
lea edi, [ebx + 2]
test dl, dl
mov dword [ebp - 8], edi
mov byte [ebp + 0xb], dl
je 0x1002beb6
mov dl, byte [ebx + 3]
test dl, dl
jne 0x1002be72
mov byte [eax], cl
mov cl, byte [esi]
mov byte [eax + 1], cl
mov cl, byte [edi]
and byte [eax + 3], dl
mov byte [eax + 2], cl
jmp 0x1002c016
cmp cl, 0x5c
jne 0x1002bf0f
cmp byte [ebp - 1], cl
jne 0x1002bf0f
cmp byte [ebp + 0xb], 0x2e
jne 0x1002be8e
cmp dl, cl
je 0x1002be99
cmp byte [ebp + 0xb], 0x3f
jne 0x1002bebd
cmp dl, 0x5c
jne 0x1002bebd
add ebx, 4
cmp byte [ebx], 0
je 0x1002beb6
cmp byte [ebx + 1], 0x3a
lea esi, [ebx + 1]
jne 0x1002beb6
cmp byte [ebx + 2], 0x5c
lea eax, [ebx + 2]
mov dword [ebp - 8], eax
je 0x1002bf0f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push 0x5c
push edi
call fcn.1007eff0
pop ecx
test eax, eax
pop ecx
je 0x1002beb6
push 6
push 0x10179a2c
push eax
call fcn.1008d570
add esp, 0xc
test eax, eax
je 0x1002beb6
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
lea eax, [esi - 1]
push eax
push ebx
push edi
call fcn.1007e350
and byte [edi + esi - 1], 0
push edi
call fcn.10127a82
push edi
call fcn.1007e450
add esp, 0x14
push 3
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
jmp 0x1002beb8
and byte [ebp - 0x10c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x10b]
cmp byte [esi], 0x3a
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, 0x104
je 0x1002bfb8
lea eax, [ebp - 0x10c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x1002beb6
cmp eax, edi
jae 0x1002beb6
lea eax, [ebp - 0x10c]
push eax
call fcn.1007e450
mov dword [ebp + 8], eax
mov al, byte [ebx]
cmp al, 0x2e
pop ecx
jne 0x1002bf85
cmp byte [esi], 0x5c
jne 0x1002bf72
mov ebx, dword [ebp - 8]
jmp 0x1002bf85
cmp al, 0x2e
jne 0x1002bf85
cmp byte [esi], al
jne 0x1002bf85
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x1002bf85
add ebx, 3
push ebx
call fcn.1007e450
pop ecx
mov ecx, dword [ebp + 8]
lea eax, [eax + ecx + 1]
cmp eax, edi
jae 0x1002beb6
lea eax, [ebp - 0x10c]
push ebx
push eax
mov byte [ebp + ecx - 0x10c], 0x5c
call fcn.1007e530
pop ecx
lea ebx, [ebp - 0x10c]
pop ecx
test ebx, ebx
mov eax, ebx
je 0x1002bfd2
inc eax
push 0x2f
push eax
call fcn.1007eff0
pop ecx
test eax, eax
pop ecx
je 0x1002bfd2
mov byte [eax], 0x5c
jmp 0x1002bfbe
push 0x7e
push ebx
call fcn.1007eff0
pop ecx
test eax, eax
pop ecx
je 0x1002bffd
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
test eax, eax
je 0x1002beb6
lea ebx, [ebp - 0x210]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
lea eax, [esi - 1]
push eax
push ebx
push edi
call fcn.1007e350
add esp, 0xc
and byte [edi + esi - 1], 0
push 1
pop eax
jmp 0x1002beb8
Function at 0x1002c01e
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x1002c0de
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1002c0de
cmp dword [ebp + 0x10], 0
je 0x1002c0de
mov di, word [ebx]
test di, di
je 0x1002c0de
cmp word [ebx + 2], 0
lea esi, [ebx + 2]
je 0x1002c0de
cmp word [ebx + 4], 0
lea ecx, [ebx + 4]
mov dword [ebp + 8], ecx
je 0x1002c0de
cmp word [ebx + 6], 0
jne 0x1002c08f
mov word [eax], di
mov dx, word [esi]
mov word [eax + 2], dx
mov cx, word [ecx]
and word [eax + 6], 0
mov word [eax + 4], cx
jmp 0x1002c25b
push 0x5c
pop edx
cmp di, dx
jne 0x1002c137
cmp word [esi], dx
jne 0x1002c137
mov ax, word [ecx]
cmp ax, 0x2e
jne 0x1002c0b3
cmp word [ebx + 6], dx
je 0x1002c0bf
cmp ax, 0x3f
jne 0x1002c0e5
cmp word [ebx + 6], dx
jne 0x1002c0e5
add ebx, 8
cmp word [ebx], 0
je 0x1002c0de
cmp word [ebx + 2], 0x3a
lea esi, [ebx + 2]
jne 0x1002c0de
cmp word [ebx + 4], dx
lea eax, [ebx + 4]
mov dword [ebp + 8], eax
je 0x1002c137
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push edx
push ecx
call fcn.1007e735
pop ecx
test eax, eax
pop ecx
je 0x1002c0de
push 6
push str.pipe_
push eax
call fcn.1007f884
add esp, 0xc
test eax, eax
je 0x1002c0de
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
lea eax, [esi - 1]
push eax
push ebx
push edi
call fcn.1007e246
and word [edi + esi*2 - 2], 0
push edi
call fcn.1007ec7d
push edi
call fcn.1007e283
add esp, 0x14
push 3
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
jmp 0x1002c0e0
and word [ebp - 0x20c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20a]
cmp word [esi], 0x3a
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
je 0x1002c1ed
lea eax, [ebp - 0x20c]
mov edi, 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1002c0de
cmp eax, edi
jae 0x1002c0de
lea eax, [ebp - 0x20c]
push eax
call fcn.1007e283
mov dword [ebp - 4], eax
mov ax, word [ebx]
cmp ax, 0x2e
pop ecx
jne 0x1002c1b8
cmp word [esi], 0x5c
jne 0x1002c1a1
mov ebx, dword [ebp + 8]
jmp 0x1002c1b8
cmp ax, 0x2e
jne 0x1002c1b8
cmp word [esi], ax
jne 0x1002c1b8
mov eax, dword [ebp + 8]
cmp word [eax], 0x5c
jne 0x1002c1b8
add ebx, 6
push ebx
call fcn.1007e283
pop ecx
mov ecx, dword [ebp - 4]
lea eax, [eax + ecx + 1]
cmp eax, edi
jae 0x1002c0de
lea eax, [ebp - 0x20c]
push ebx
push eax
mov word [ebp + ecx*2 - 0x20c], 0x5c
call fcn.1007e6a6
pop ecx
lea ebx, [ebp - 0x20c]
pop ecx
and word [ebp - 0x414], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x412]
rep stosd dword es:[edi], eax
push 0x7e
push ebx
stosw word es:[edi], ax
call fcn.1007e735
pop ecx
test eax, eax
pop ecx
je 0x1002c241
lea eax, [ebp - 0x414]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jne 0x1002c23b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1002c241
jmp 0x1002c0de
lea ebx, [ebp - 0x414]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
lea eax, [esi - 1]
push eax
push ebx
push edi
call fcn.1007e246
add esp, 0xc
and word [edi + esi*2 - 2], 0
push 1
pop eax
jmp 0x1002c0e0
Function at 0x1002f4c9
Capabilities:
Get common file path

Disassembly:
mov eax, 0x10135d4f
call fcn.1007db34
sub esp, 0x218
push ebx
push esi
push edi
xor edi, edi
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], edi
call fcn.10094520
mov eax, dword [ebp + 0x10]
push edi
mov ecx, 0x101ad1f8
mov dword [ebp - 4], 1
mov dword [eax], edi
call fcn.1004bccb
test eax, eax
mov ebx, 0x101ad158
mov esi, 0x1016324c
je 0x1002f638
push 4
lea ecx, [ebp - 0x1c]
call fcn.1005eb25
cmp dword [ebp + 0xc], edi
mov byte [ebp - 4], 2
jne 0x1002f548
mov edi, 0x104
lea ecx, [ebp - 0x10]
push edi
call fcn.10095990
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.10095a60
xor edi, edi
cmp dword [0x101b04b8], edi
je 0x1002f56d
push dword [ebp - 0x10]
mov ecx, ebx
call fcn.100aa1c0
push eax
push str.__s__CSafeInject::GetRealCurrentDir1_wstrCurDir__s_
push esi
push 4
call fcn.1007bb15
add esp, 0x14
push dword [ebp - 0x10]
call fcn.10073be5
cmp eax, 0xffffffff
pop ecx
jne 0x1002f62a
cmp dword [0x101b04b8], edi
je 0x1002f5a2
push dword [ebp - 0x10]
mov ecx, ebx
call fcn.100aa1c0
push eax
push str.__s__CSafeInject::GetRealCurrentDir2_wstrCurDir__s_
push esi
push 4
call fcn.1007bb15
add esp, 0x14
mov word [ebp - 0x224], di
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x222]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x224]
push 0x104
push eax
push dword [ebp - 0x10]
call fcn.1002679d
add esp, 0xc
test eax, eax
je 0x1002f62a
cmp dword [0x101b04b8], 0
je 0x1002f600
lea eax, [ebp - 0x224]
mov ecx, ebx
push eax
push dword [ebp - 0x10]
call fcn.100aa1c0
push eax
push str.__s__CSafeInject::GetRealCurrentDir3_wstrCurDir__s___wszRedirectedPath__s_
push esi
push 4
call fcn.1007bb15
add esp, 0x18
lea eax, [ebp - 0x224]
push eax
call fcn.10073be5
cmp eax, 0xffffffff
pop ecx
je 0x1002f62a
lea eax, [ebp - 0x224]
lea ecx, [ebp - 0x10]
push eax
call fcn.10094f40
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.1005eb48
xor edi, edi
cmp dword [0x101b04b8], edi
je 0x1002f663
mov eax, dword [ebp + 0x10]
mov ecx, ebx
push dword [eax]
push dword [ebp - 0x10]
push dword [ebp + 0xc]
call fcn.100aa1c0
push eax
push str.__s__CSafeInject::GetRealCurrentDir_lpwszCurrentDir__s___wstrCurDir__s___bChange__d_
push esi
push 4
call fcn.1007bb15
add esp, 0x1c
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.100942c0
mov dword [ebp - 0x14], 1
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.10094cc0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x1004ba2e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x1013802e
call fcn.1007db34
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x10140820
lea ecx, [esi + 0x3f8]
mov dword [ebp - 4], 0x28
call fcn.10094cc0
lea ecx, [esi + 0x3f4]
mov byte [ebp - 4], 0x27
call fcn.10094cc0
lea ecx, [esi + 0x3e0]
mov byte [ebp - 4], 0x26
call fcn.100a1330
lea ecx, [esi + 0x3d0]
mov byte [ebp - 4], 0x25
call fcn.100234b7
lea ecx, [esi + 0x3c0]
mov byte [ebp - 4], 0x24
call fcn.1009a5f0
lea ecx, [esi + 0x3b0]
mov byte [ebp - 4], 0x23
call fcn.1009a5f0
lea ecx, [esi + 0x3a0]
mov byte [ebp - 4], 0x22
call fcn.1009a5f0
lea ecx, [esi + 0x390]
mov byte [ebp - 4], 0x21
call fcn.1009a5f0
lea ecx, [esi + 0x380]
mov byte [ebp - 4], 0x20
call fcn.1009a5f0
lea ecx, [esi + 0x370]
mov byte [ebp - 4], 0x1f
call fcn.1009a5f0
lea ecx, [esi + 0x360]
mov byte [ebp - 4], 0x1e
call fcn.1009a5f0
lea ecx, [esi + 0x350]
mov byte [ebp - 4], 0x1d
call fcn.1009a5f0
lea ecx, [esi + 0x340]
mov byte [ebp - 4], 0x1c
call fcn.1009a5f0
lea ecx, [esi + 0x330]
mov byte [ebp - 4], 0x1b
call fcn.1009a5f0
lea ecx, [esi + 0x320]
mov byte [ebp - 4], 0x1a
call fcn.1009a5f0
lea ecx, [esi + 0x310]
mov byte [ebp - 4], 0x19
call fcn.1009a5f0
lea ecx, [esi + 0x300]
mov byte [ebp - 4], 0x18
call fcn.1009a5f0
lea ecx, [esi + 0x2f0]
mov byte [ebp - 4], 0x17
call fcn.1009a5f0
lea ecx, [esi + 0x2e0]
mov byte [ebp - 4], 0x16
call fcn.1009a5f0
lea ecx, [esi + 0x2d0]
mov byte [ebp - 4], 0x15
call fcn.1009a5f0
lea ecx, [esi + 0x2c0]
mov byte [ebp - 4], 0x14
call fcn.1009a5f0
lea ecx, [esi + 0x2bc]
mov byte [ebp - 4], 0x13
call fcn.10094cc0
lea ecx, [esi + 0x2b8]
mov byte [ebp - 4], 0x12
call fcn.10094cc0
lea ecx, [esi + 0x2b4]
mov byte [ebp - 4], 0x11
call fcn.10094cc0
lea ecx, [esi + 0x2b0]
mov byte [ebp - 4], 0x10
call fcn.10094cc0
lea ecx, [esi + 0x2a0]
mov byte [ebp - 4], 0xf
call fcn.1009a5f0
lea ecx, [esi + 0x290]
mov byte [ebp - 4], 0xe
call fcn.1009a5f0
lea ecx, [esi + 0x280]
mov byte [ebp - 4], 0xd
call fcn.1009a5f0
lea ecx, [esi + 0x270]
mov byte [ebp - 4], 0xc
call fcn.1009a5f0
lea ecx, [esi + 0x260]
mov byte [ebp - 4], 0xb
call fcn.1009a5f0
lea ecx, [esi + 0x250]
mov byte [ebp - 4], 0xa
call fcn.1009a5f0
lea ecx, [esi + 0x240]
mov byte [ebp - 4], 9
call fcn.1009a5f0
lea ecx, [esi + 0x230]
mov byte [ebp - 4], 8
call fcn.10099910
lea ecx, [esi + 0x220]
mov byte [ebp - 4], 7
call fcn.1009a5f0
lea ecx, [esi + 0x210]
mov byte [ebp - 4], 6
call fcn.10099910
lea ecx, [esi + 0x200]
mov byte [ebp - 4], 5
call fcn.1009a5f0
lea ecx, [esi + 0x1f0]
mov byte [ebp - 4], 4
call fcn.1009a5f0
lea ecx, [esi + 0x1e0]
mov byte [ebp - 4], 3
call fcn.10099910
lea ecx, [esi + 0x1d0]
mov byte [ebp - 4], 2
call fcn.1009a5f0
lea ecx, [esi + 0x1cc]
mov byte [ebp - 4], 1
call fcn.10094cc0
and byte [ebp - 4], 0
lea ecx, [esi + 0x1c0]
call fcn.10094cc0
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0xb0]
call fcn.100a6ba0
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x1004c36b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
test byte [0x101acf3c], 1
push esi
mov esi, 0x101acf38
jne 0x1004c3a1
or byte [0x101acf3c], 1
push 0x1019f4bc
mov ecx, esi
call fcn.10094520
push 0x1004c403
call fcn.1007d6fa
pop ecx
cmp dword [0x101acf40], 0
jne 0x1004c3fb
and word [ebp - 0x208], 0
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
pop edi
jbe 0x1004c3fb
movzx eax, word [ebp - 0x208]
push eax
push str._c:Program_FilesWindowsApps
push esi
mov dword [0x101acf40], 1
call fcn.10097c40
add esp, 0xc
mov eax, dword [0x101acf38]
pop esi
leave
ret

Function at 0x1004c40d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x1004c507
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1004c507
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x1004c507
cmp byte [ebx], 0
je 0x1004c507
cmp byte [esi], 0
je 0x1004c507
cmp byte [edx], 0
je 0x1004c507
and byte [ebp - 0x108], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x107]
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x108]
push 0x104
push eax
push 0
push edx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
call esi
test eax, eax
je 0x1004c507
cmp eax, 0x103
jae 0x1004c4a4
mov ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x108]
push eax
call fcn.1008fba0
push 1
pop eax
jmp 0x1004c509
and dword [ebp - 4], 0
mov ebx, 0x400
cmp ebx, 0xa00000
jae 0x1004c502
add ebx, ebx
push ebx
call fcn.1007e238
mov edi, eax
pop ecx
test edi, edi
je 0x1004c502
push dword [ebp + 8]
push ebx
push edi
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
test eax, eax
jbe 0x1004c4de
lea ecx, [ebx - 1]
cmp eax, ecx
jb 0x1004c4e7
push edi
call fcn.1007de95
pop ecx
jmp 0x1004c4ad
mov ecx, dword [ebp + 0x14]
and byte [edi + eax], 0
push edi
mov dword [ebp - 4], 1
call fcn.1008fba0
push edi
call fcn.1007de95
pop ecx
mov eax, dword [ebp - 4]
jmp 0x1004c509
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x10050745
Capabilities:
Print debug messages

Disassembly:
push esi
push edi
push 1
xor esi, esi
pop edi
cmp dword [0x101acf9c], 0
jbe 0x10050770
push str.WaitForOpenProcThreadExit_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x1e
jbe 0x1005074c
xor edi, edi
mov eax, edi
pop edi
pop esi
ret
Function at 0x100512b0
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1013859c
call fcn.1007db34
sub esp, 0x20c
mov eax, dword [0x101acfe0]
push ebx
xor ebx, ebx
push esi
cmp dword [eax - 8], ebx
mov esi, 0x101acfe0
jne 0x100512e0
call fcn.10054571
push eax
mov ecx, esi
call fcn.10094f40
mov ecx, 0x101ad1f8
call fcn.10050211
test eax, eax
je 0x1005139a
cmp dword [0x101ad200], ebx
je 0x1005139a
cmp dword [0x101ad660], ebx
jne 0x1005139a
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x216]
mov word [ebp - 0x218], bx
mov dword [0x101ad660], 1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x10]
push eax
call fcn.10094520
push 0x10184b60
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.100984d0
lea eax, [ebp - 0x218]
push 0x103
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.10094f40
push str.OCularOEA_
mov ecx, esi
call fcn.10095910
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10094cc0
pop edi
mov ecx, dword [ebp - 0xc]
mov eax, dword [0x101acfe0]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x100515b0
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x101385b0
call fcn.1007db34
push ecx
push edi
call fcn.10050745
mov edi, 0x101ad120
mov ecx, edi
call fcn.1005626f
push 0
mov ecx, 0x101ad1f8
call fcn.1004bccb
test eax, eax
je 0x10051658
mov ecx, 0x101ad158
call fcn.10058169
test eax, eax
jne 0x10051658
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
push str.TFloatTip.dll
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1005161a
call fcn.1000490e
call fcn.10004881
call fcn.100049b0
call fcn.1000478e
push 0x1019f4bc
lea ecx, [ebp - 0x10]
call fcn.10094520
and dword [ebp - 4], 0
call esi
sub eax, ebx
push eax
lea eax, [ebp - 0x10]
push str.CFloatTipMgr::Stop_Time:_d
push eax
call fcn.10097c40
add esp, 0xc
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10094cc0
pop esi
pop ebx
mov ecx, edi
call fcn.100a4e80
test eax, eax
je 0x1005166a
mov ecx, edi
call fcn.100a4d40
mov ecx, 0x101ad158
call fcn.100581b1
test eax, eax
pop edi
je 0x10051681
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x1005183e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x10138607
call fcn.1007db34
push ecx
push ecx
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.10051722
pop ecx
push 1
pop esi
push dword [ebp - 0x10]
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100518a1
push edi
lea ecx, [ebp - 0x10]
push dword [0x101ad648]
call fcn.10094f40
mov edi, 0x10160bc0
lea ecx, [ebp - 0x10]
push edi
call fcn.100984d0
push edi
lea ecx, [ebp - 0x10]
call fcn.10095910
push str.dtframe32.dll
lea ecx, [ebp - 0x10]
call fcn.10095910
pop edi
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.100942c0
mov dword [ebp - 0x14], esi
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.10094cc0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x10051987
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
cmp dword [0x101ad668], 0
push esi
mov esi, 0x101ad654
jne 0x100519e2
and word [ebp - 0x208], 0
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
push 0x103
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
pop edi
je 0x100519e2
lea eax, [ebp - 0x208]
push 2
push eax
push esi
call fcn.1007e246
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x10051bb1
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, dword [0x101b4004]
test eax, eax
je 0x10051bc8
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
and dword [0x101b4004], 0
mov eax, dword [0x101ad650]
push 0
push eax
push 0x10051b5d
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
xor ecx, ecx
mov dword [0x101b4004], eax
test eax, eax
setne cl
mov eax, ecx
ret