joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12174f40
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 4], 0
push 0x3c
push 0
lea eax, [ebp - 0x40]
push eax
call sub.MSVCR71.dll_memset
add esp, 0xc
mov dword [ebp - 0x40], 0x3c
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp + 8]
cmp dword [edx + 0xc], 0
je 0x12174f9e
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
call fcn.12171010
add esp, 4
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x12174f9e
jmp 0x1217508d
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x12174fbb
jmp 0x1217508d
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x14], 0
je 0x12174fe1
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x14]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x12174fe1
jmp 0x1217508d
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x18], 0
je 0x12175007
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x18]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x12175007
jmp 0x1217508d
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp + 8]
cmp dword [edx + 0x28], 0
je 0x12175044
mov eax, dword [ebp - 0x3c]
and eax, 1
je 0x12175044
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x28]
push edx
call fcn.12171010
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x12175044
jmp 0x1217508d
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x34]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [ebp - 8], ecx
lea edx, [ebp - 0x40]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1217508d
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 0x20], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov dword [edx + 0x38], eax
cmp dword [ebp - 0x34], 0
je 0x1217509d
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 0x2c], 0
je 0x121750ad
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 0x28], 0
je 0x121750bd
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 0x18], 0
je 0x121750cd
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x121751b0
Capabilities:
Get file system object information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [0x1219be08]
mov dword [ebp - 8], eax
mov dword [ebp - 0x16c], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x121751ee
jmp 0x121752b0
push 0x160
push 0
lea ecx, [ebp - 0x168]
push ecx
call sub.MSVCR71.dll_memset
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov dword [ebp - 0x168], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x164], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x160], ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x168]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
je 0x1217528d
push 0x104
mov ecx, dword [ebp + 0x10]
add ecx, 0xc
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x15c]
push edx
push 0
push 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
push 0x50
mov eax, dword [ebp + 0x10]
add eax, 0x214
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x58]
push ecx
push 0
push 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x168]
mov dword [edx], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x164]
mov dword [ecx + 4], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x160]
mov dword [eax + 8], ecx
cmp dword [ebp - 4], 0
je 0x121752c0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 0x16c]
mov ecx, dword [ebp - 8]
call fcn.1218af21
mov esp, ebp
pop ebp
ret 0x14

Function at 0x12177f70
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x1219be5c], 0
je 0x12177f91
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x12177fec
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
shl ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
push 0x40
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
push ecx
push 0
push 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x1217b100
Capabilities:
Create mailslot

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217b13b
mov eax, dword [ebp + 8]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217b13b
jmp 0x1217b154
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.kernel32.dll_CreateMailslotA]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x1217b164
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1217b830
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 8
mov dword [ebp - 8], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 0xc], 0
je 0x1217b86d
mov eax, dword [ebp + 8]
push eax
push 0
call fcn.12171010
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1217b86d
jmp 0x1217b89e
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.kernel32.dll_GetLogicalDriveStringsA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1217b89e
cmp dword [ebp + 0xc], 0
je 0x1217b89e
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.12171010
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x1217b8ae
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x1217bbe0
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1217bc51
mov eax, dword [ebp - 0xc]
push eax
call sub.MSVCR71.dll_strlen
add esp, 4
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shl ecx, 1
push ecx
push 0x40
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xc]
push ecx
push 0
push 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x1217bc60
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 8
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
mov eax, dword [ebp + 8]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217bc9c
jmp 0x1217bcee
cmp dword [ebp + 0x10], 0
je 0x1217bcbb
mov ecx, dword [ebp + 0x10]
push ecx
push 0
call fcn.12171010
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1217bcbb
jmp 0x1217bcee
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1217bcee
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xc]
push ecx
push 0
push 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
cmp dword [ebp - 4], 0
je 0x1217bcfe
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 0xc], 0
je 0x1217bd0e
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1217bd20
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217bd62
mov eax, dword [ebp + 8]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1217bd62
jmp 0x1217bd90
cmp dword [ebp + 0xc], 0
je 0x1217bd7f
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.12171010
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217bd7f
jmp 0x1217bd90
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 8], 0
je 0x1217bda0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 4], 0
je 0x1217bdb0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8

Function at 0x1217bdc0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217be02
mov eax, dword [ebp + 8]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1217be02
jmp 0x1217be54
cmp dword [ebp + 0xc], 0
je 0x1217be21
mov ecx, dword [ebp + 0x10]
push ecx
push 0
call fcn.12171010
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217be21
jmp 0x1217be54
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1217be54
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
push ecx
push 0
push 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
cmp dword [ebp - 0xc], 0
je 0x1217be64
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 4], 0
je 0x1217be74
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1217be90
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217bec2
mov eax, dword [ebp + 8]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217bec2
jmp 0x1217becc
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp dword [ebp - 4], 0
je 0x1217bedc
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov esp, ebp
pop ebp
ret 4
Function at 0x1217c960
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 8
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217c9a9
mov eax, dword [ebp + 8]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1217c9a9
jmp 0x1217c9fc
cmp dword [ebp + 0xc], 0
je 0x1217c9c6
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.12171010
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217c9c6
jmp 0x1217c9fc
cmp dword [ebp + 0x14], 0
je 0x1217c9e3
mov edx, dword [ebp + 0x14]
push edx
call fcn.12171010
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1217c9e3
jmp 0x1217c9fc
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x10], 0
je 0x1217ca0c
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 4], 0
je 0x1217ca1c
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 8], 0
je 0x1217ca2c
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1217ca40
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217ca9a
mov eax, dword [ebp + 8]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x1217ca9a
jmp 0x1217cb4e
cmp dword [ebp + 0xc], 0
je 0x1217caba
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.12171010
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217caba
jmp 0x1217cb4e
cmp dword [ebp + 0x10], 0
je 0x1217cad7
mov edx, dword [ebp + 0x10]
push edx
call fcn.12171010
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1217cad7
jmp 0x1217cb4e
cmp dword [ebp + 0x14], 0
je 0x1217caf6
mov eax, dword [ebp + 0x18]
push eax
push 0
call fcn.12171010
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1217caf6
jmp 0x1217cb4e
cmp dword [ebp + 0x1c], 0
je 0x1217cb13
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.12171010
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1217cb13
jmp 0x1217cb4e
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1217cb4e
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.12171010
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x1217cb5e
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 4], 0
je 0x1217cb6e
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 8], 0
je 0x1217cb7e
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 0x10], 0
je 0x1217cb8e
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 0xc], 0
je 0x1217cb9e
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1217ccc0
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 8
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217cd09
mov eax, dword [ebp + 8]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1217cd09
jmp 0x1217cd7c
cmp dword [ebp + 0xc], 0
je 0x1217cd28
mov ecx, dword [ebp + 0x10]
push ecx
push 0
call fcn.12171010
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1217cd28
jmp 0x1217cd7c
cmp dword [ebp + 0x14], 0
je 0x1217cd45
mov edx, dword [ebp + 0x14]
push edx
call fcn.12171010
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217cd45
jmp 0x1217cd7c
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetPrivateProfileSectionA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1217cd7c
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
push 0
push 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
cmp dword [ebp - 0x10], 0
je 0x1217cd8c
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 8], 0
je 0x1217cd9c
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 4], 0
je 0x1217cdac
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1217cea0
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217cee4
mov eax, dword [ebp + 0xc]
push eax
push 0
call fcn.12171010
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217cee4
jmp 0x1217cf30
cmp dword [ebp + 0x10], 0
je 0x1217cf01
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.12171010
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1217cf01
jmp 0x1217cf30
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.kernel32.dll_GetPrivateProfileSectionNamesA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1217cf30
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.12171010
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x1217cf40
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 8], 0
je 0x1217cf50
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1217cf60
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217cfa9
mov eax, dword [ebp + 8]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1217cfa9
jmp 0x1217d000
cmp dword [ebp + 0xc], 0
je 0x1217cfc6
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.12171010
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217cfc6
jmp 0x1217d000
cmp dword [ebp + 0x18], 0
je 0x1217cfe3
mov edx, dword [ebp + 0x18]
push edx
call fcn.12171010
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1217cfe3
jmp 0x1217d000
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.kernel32.dll_GetPrivateProfileStructA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 8], 0
je 0x1217d010
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 4], 0
je 0x1217d020
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 0xc], 0
je 0x1217d030
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0x14

Function at 0x1217d120
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 8
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x1217d153
mov eax, dword [ebp + 8]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217d153
jmp 0x1217d160
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.kernel32.dll_GetDriveTypeA]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x1217d170
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x1217d180
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217d1bd
mov eax, dword [ebp + 0xc]
push eax
push 0
call fcn.12171010
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1217d1bd
jmp 0x1217d1ec
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1217d1ec
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp - 8]
push edx
push 0
push 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
cmp dword [ebp - 8], 0
je 0x1217d1fc
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8