joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7f2e18d7
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x7f307acc], edi
je 0x7f2e18fc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x7f2e19fa
mov eax, dword [0x7f307088]
imul eax, dword [ebp + 0x10]
push eax
call fcn.7f2d53a1
test eax, eax
mov esi, dword [0x7f307088]
je 0x7f2e192f
mov eax, esi
imul eax, dword [ebp + 0x10]
cmp eax, edi
je 0x7f2e192f
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov dword [ebp - 4], esp
jmp 0x7f2e1932
mov dword [ebp - 4], edi
cmp dword [ebp + 0x10], edi
jbe 0x7f2e194e
cmp dword [ebp - 4], edi
jne 0x7f2e194e
push 0x3e9
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x7f2e19fa
mov ebx, dword [ebp + 8]
cmp ebx, 0xffff
jbe 0x7f2e19b9
push ebx
call fcn.7f2da99a
mov edi, eax
mov eax, dword [0x7f307088]
inc edi
imul eax, edi
pop ecx
push eax
call fcn.7f2d53a1
test eax, eax
mov esi, dword [0x7f307088]
je 0x7f2e1993
mov eax, esi
imul eax, edi
test eax, eax
je 0x7f2e1993
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov ebx, esp
jmp 0x7f2e1995
xor ebx, ebx
xor eax, eax
cmp ebx, eax
je 0x7f2e19bd
imul esi, edi
push eax
push eax
push esi
push ebx
push edi
push dword [ebp + 8]
push eax
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, dword [0x7f307088]
test ebx, ebx
jne 0x7f2e19c3
cmp dword [ebp + 8], 0
jne 0x7f2e1947
imul esi, dword [ebp + 0x10]
push esi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x7f2e19fa
cmp dword [ebp - 4], 0
je 0x7f2e19fa
push dword [ebp + 0x10]
inc eax
push dword [ebp + 0xc]
push eax
push dword [ebp - 4]
push 0
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x7f2e19fa
dec eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x7f2e1a04
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [0x7f307acc], ebx
push esi
push edi
je 0x7f2e1a23
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x7f2e1af3
mov edi, dword [ebp + 8]
cmp edi, 0xffff
jbe 0x7f2e1ad2
push edi
call fcn.7f2da99a
mov esi, eax
mov eax, dword [0x7f307088]
inc esi
imul eax, esi
pop ecx
push eax
call fcn.7f2d53a1
test eax, eax
je 0x7f2e1a69
mov eax, dword [0x7f307088]
imul eax, esi
cmp eax, ebx
je 0x7f2e1a69
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov edi, esp
jmp 0x7f2e1a6b
xor edi, edi
cmp edi, ebx
je 0x7f2e1ad8
cmp dword [0x7f307acc], ebx
mov dword [ebp - 4], ebx
jne 0x7f2e1a83
cmp byte [0x7f30708d], 0
je 0x7f2e1a88
mov ebx, 0x400
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
test eax, eax
mov eax, dword [0x7f307ac8]
jne 0x7f2e1a9c
mov eax, dword [0x7f307084]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [0x7f307088]
imul ecx, esi
push 0x7f2d2c28
push ecx
push edi
push esi
push dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp dword [ebp - 4], 0
jne 0x7f2e1aca
test eax, eax
je 0x7f2e1aca
push 0
jmp 0x7f2e1acc
push 0x7b
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
cmp edi, ebx
jne 0x7f2e1add
cmp dword [ebp + 8], ebx
jne 0x7f2e1ae7
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x7f2e1aec
or eax, 0xffffffff
jmp 0x7f2e1af3
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x7f2e1f74
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x7f307acc], edi
je 0x7f2e1f9b
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x7f2e20a5
mov ebx, dword [ebp + 0xc]
mov ecx, 0x20000000
mov eax, ebx
and eax, ecx
sub eax, ecx
neg eax
sbb eax, eax
mov edx, 0x40000000
mov ecx, ebx
and ecx, edx
sub ecx, edx
inc eax
neg ecx
sbb ecx, ecx
mov edx, ebx
inc ecx
and edx, 0x1fffffff
cmp dword [ebp + 8], 0x7f
jne 0x7f2e1fd3
mov dword [ebp + 8], 0x409
cmp eax, edi
je 0x7f2e1ff6
cmp byte [0x7f30708d], 0
jne 0x7f2e2095
push 0x3ec
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x7f2e20a5
cmp edx, 0x58
je 0x7f2e2095
cmp dword [ebp + 0x14], edi
je 0x7f2e2095
cmp dword [ebp + 0x10], edi
je 0x7f2e2095
cmp ecx, edi
je 0x7f2e2024
mov eax, dword [0x7f307ac8]
mov dword [ebp + 0xc], eax
mov eax, dword [0x7f307088]
jmp 0x7f2e2035
push dword [ebp + 8]
call fcn.7f2d4112
push eax
mov dword [ebp + 0xc], eax
call fcn.7f2d3f55
mov esi, eax
imul esi, dword [ebp + 0x14]
push esi
call fcn.7f2d53a1
test eax, eax
je 0x7f2e2058
cmp esi, edi
je 0x7f2e2058
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov edi, esp
cmp dword [ebp + 0x14], 0
jle 0x7f2e2062
test edi, edi
je 0x7f2e1fef
push esi
push edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xor ecx, ecx
cmp eax, ecx
je 0x7f2e2088
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
push ecx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x7f2e20a5
cmp dword [ebp + 0x14], ecx
jle 0x7f2e20a5
mov edx, dword [ebp + 0x10]
mov word [edx], cx
jmp 0x7f2e20a5
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x7f2e20af
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x7f307acc], edi
je 0x7f2e20d0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
jmp 0x7f2e2151
cmp dword [ebp + 0xc], edi
je 0x7f2e2149
mov ebx, dword [ebp + 8]
cmp ebx, edi
je 0x7f2e2149
mov eax, dword [0x7f307088]
imul eax, ebx
push eax
call fcn.7f2d53a1
test eax, eax
mov esi, dword [0x7f307088]
je 0x7f2e210a
mov eax, esi
imul eax, ebx
cmp eax, edi
je 0x7f2e210a
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov edi, esp
test ebx, ebx
jbe 0x7f2e2116
test edi, edi
jne 0x7f2e2116
xor eax, eax
jmp 0x7f2e2151
imul esi, ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x7f2e2151
cmp eax, ebx
ja 0x7f2e2151
test edi, edi
je 0x7f2e2151
push ebx
push dword [ebp + 0xc]
inc eax
push eax
push edi
push 0
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x7f2e2151
dec eax
jmp 0x7f2e2151
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x7f2e25a9
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [0x7f307acc], ebx
push esi
push edi
je 0x7f2e25d1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x7f2e278f
mov eax, dword [ebp + 8]
cmp eax, 0xffff
jbe 0x7f2e263a
push eax
call fcn.7f2da99a
mov edi, eax
mov eax, dword [0x7f307088]
inc edi
imul eax, edi
pop ecx
push eax
call fcn.7f2d53a1
test eax, eax
mov esi, dword [0x7f307088]
je 0x7f2e2616
mov eax, esi
imul eax, edi
cmp eax, ebx
je 0x7f2e2616
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov dword [ebp - 4], esp
jmp 0x7f2e2619
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], ebx
je 0x7f2e2642
imul esi, edi
push ebx
push ebx
push esi
push dword [ebp - 4]
push edi
push dword [ebp + 8]
push ebx
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x7f2e263d
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
jne 0x7f2e264e
cmp dword [ebp + 8], ebx
je 0x7f2e264e
xor eax, eax
jmp 0x7f2e278f
mov eax, dword [ebp + 0xc]
cmp eax, 0xffff
jbe 0x7f2e26b7
push eax
call fcn.7f2da99a
mov edi, eax
mov eax, dword [0x7f307088]
inc edi
imul eax, edi
pop ecx
push eax
call fcn.7f2d53a1
test eax, eax
mov esi, dword [0x7f307088]
je 0x7f2e2693
mov eax, esi
imul eax, edi
cmp eax, ebx
je 0x7f2e2693
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov dword [ebp + 8], esp
jmp 0x7f2e2696
mov dword [ebp + 8], ebx
cmp dword [ebp + 8], ebx
je 0x7f2e26bf
imul esi, edi
push ebx
push ebx
push esi
push dword [ebp + 8]
push edi
push dword [ebp + 0xc]
push ebx
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x7f2e26ba
mov dword [ebp + 8], eax
cmp dword [ebp + 8], ebx
jne 0x7f2e26c4
cmp dword [ebp + 0xc], ebx
jne 0x7f2e2647
cmp dword [ebp + 0x14], 0xffff
jbe 0x7f2e2760
push dword [ebp + 0x14]
call fcn.7f2da99a
mov edi, eax
mov eax, dword [0x7f307088]
inc edi
imul eax, edi
pop ecx
push eax
call fcn.7f2d53a1
test eax, eax
mov esi, dword [0x7f307088]
je 0x7f2e270b
mov eax, esi
imul eax, edi
cmp eax, ebx
je 0x7f2e270b
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov ebx, esp
xor eax, eax
cmp ebx, eax
je 0x7f2e2767
cmp dword [0x7f307acc], eax
mov dword [ebp + 0xc], eax
jne 0x7f2e2724
cmp byte [0x7f30708d], al
je 0x7f2e2729
mov eax, 0x400
imul esi, edi
lea ecx, [ebp + 0xc]
push ecx
push 0x7f2d2c28
push esi
push ebx
push edi
push dword [ebp + 0x14]
push eax
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp dword [ebp + 0xc], 0
jne 0x7f2e275c
test eax, eax
je 0x7f2e275c
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x7f2e2763
push 0x7b
jmp 0x7f2e2754
mov ebx, dword [ebp + 0x14]
test ebx, ebx
jne 0x7f2e2771
cmp dword [ebp + 0x14], 0
jne 0x7f2e2647
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x7f2e2647
push ebx
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x7f2e2799
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x7f307090]
push ebx
push esi
xor esi, esi
cmp dword [0x7f307acc], esi
mov dword [ebp - 4], eax
push edi
je 0x7f2e27ce
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
jmp 0x7f2e2911
mov eax, dword [0x7f307088]
imul eax, dword [ebp + 0x10]
push eax
call fcn.7f2d53a1
test eax, eax
je 0x7f2e2801
mov eax, dword [0x7f307088]
imul eax, dword [ebp + 0x10]
cmp eax, esi
je 0x7f2e2801
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov dword [ebp - 0x114], esp
jmp 0x7f2e2807
mov dword [ebp - 0x114], esi
mov eax, dword [ebp + 8]
cmp eax, 0xffff
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jbe 0x7f2e28a4
push eax
call fcn.7f2da99a
mov edi, eax
mov eax, dword [0x7f307088]
inc edi
imul eax, edi
pop ecx
push eax
call fcn.7f2d53a1
test eax, eax
mov esi, dword [0x7f307088]
je 0x7f2e2859
mov eax, esi
imul eax, edi
test eax, eax
je 0x7f2e2859
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov dword [ebp - 0x110], esp
jmp 0x7f2e2860
and dword [ebp - 0x110], 0
cmp dword [ebp - 0x110], 0
je 0x7f2e2884
imul esi, edi
xor eax, eax
push eax
push eax
push esi
push dword [ebp - 0x110]
push edi
push dword [ebp + 8]
push eax
push dword [0x7f307ac8]
call ebx
xor esi, esi
cmp dword [ebp + 0x10], esi
jbe 0x7f2e2893
cmp dword [ebp - 0x114], esi
je 0x7f2e28a0
cmp dword [ebp - 0x110], esi
jne 0x7f2e28ac
cmp dword [ebp + 8], esi
je 0x7f2e28ac
xor eax, eax
jmp 0x7f2e2911
mov dword [ebp - 0x110], eax
jmp 0x7f2e2886
push esi
push esi
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0xffffffffffffffff
push dword [ebp + 0x14]
push esi
push dword [0x7f307ac8]
call ebx
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [0x7f307088]
imul eax, dword [ebp + 0x10]
push eax
push dword [ebp - 0x114]
push dword [ebp - 0x110]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
cmp eax, esi
je 0x7f2e2907
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x114]
call fcn.7f2d5dd6
cmp eax, esi
je 0x7f2e2911
dec eax
jmp 0x7f2e2911
mov ecx, dword [ebp + 0xc]
cmp ecx, esi
je 0x7f2e2911
mov word [ecx], si
lea esp, [ebp - 0x120]
mov ecx, dword [ebp - 4]
call fcn.7f2fd123
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x7f2e2926
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x7f307090]
push ebx
xor ebx, ebx
cmp dword [0x7f307acc], ebx
push esi
mov dword [ebp - 4], eax
push edi
je 0x7f2e2958
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
jmp 0x7f2e2a07
mov eax, dword [0x7f307088]
mov edi, dword [ebp + 0xc]
imul eax, edi
push eax
call fcn.7f2d53a1
test eax, eax
mov esi, dword [0x7f307088]
je 0x7f2e2989
mov eax, esi
imul eax, edi
cmp eax, ebx
je 0x7f2e2989
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov ebx, esp
test edi, edi
jbe 0x7f2e2995
test ebx, ebx
jne 0x7f2e2995
xor eax, eax
jmp 0x7f2e2a07
mov ecx, esi
imul ecx, edi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
xor esi, esi
push esi
push esi
mov ecx, edx
push 0x104
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [ebp - 0x10c]
push eax
push 0xffffffffffffffff
push dword [ebp + 0x10]
push esi
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [0x7f307088]
imul eax, dword [ebp + 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
cmp eax, esi
je 0x7f2e29fd
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call fcn.7f2d5dd6
cmp eax, esi
je 0x7f2e2a07
dec eax
jmp 0x7f2e2a07
mov ecx, dword [ebp + 8]
cmp ecx, esi
je 0x7f2e2a07
mov word [ecx], si
lea esp, [ebp - 0x118]
mov ecx, dword [ebp - 4]
call fcn.7f2fd123
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x7f2e2cda
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [0x7f307acc], ebx
push esi
push edi
je 0x7f2e2d05
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructW]
jmp 0x7f2e2ec6
mov eax, dword [ebp + 8]
cmp eax, 0xffff
jbe 0x7f2e2d6e
push eax
call fcn.7f2da99a
mov edi, eax
mov eax, dword [0x7f307088]
inc edi
imul eax, edi
pop ecx
push eax
call fcn.7f2d53a1
test eax, eax
mov esi, dword [0x7f307088]
je 0x7f2e2d4a
mov eax, esi
imul eax, edi
cmp eax, ebx
je 0x7f2e2d4a
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov dword [ebp - 4], esp
jmp 0x7f2e2d4d
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], ebx
je 0x7f2e2d76
imul esi, edi
push ebx
push ebx
push esi
push dword [ebp - 4]
push edi
push dword [ebp + 8]
push ebx
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x7f2e2d71
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
jne 0x7f2e2d82
cmp dword [ebp + 8], ebx
je 0x7f2e2d82
xor eax, eax
jmp 0x7f2e2ec6
mov eax, dword [ebp + 0xc]
cmp eax, 0xffff
jbe 0x7f2e2deb
push eax
call fcn.7f2da99a
mov edi, eax
mov eax, dword [0x7f307088]
inc edi
imul eax, edi
pop ecx
push eax
call fcn.7f2d53a1
test eax, eax
mov esi, dword [0x7f307088]
je 0x7f2e2dc7
mov eax, esi
imul eax, edi
cmp eax, ebx
je 0x7f2e2dc7
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov dword [ebp + 8], esp
jmp 0x7f2e2dca
mov dword [ebp + 8], ebx
cmp dword [ebp + 8], ebx
je 0x7f2e2df3
imul esi, edi
push ebx
push ebx
push esi
push dword [ebp + 8]
push edi
push dword [ebp + 0xc]
push ebx
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x7f2e2dee
mov dword [ebp + 8], eax
cmp dword [ebp + 8], ebx
jne 0x7f2e2df8
cmp dword [ebp + 0xc], ebx
jne 0x7f2e2d7b
cmp dword [ebp + 0x18], 0xffff
jbe 0x7f2e2e94
push dword [ebp + 0x18]
call fcn.7f2da99a
mov edi, eax
mov eax, dword [0x7f307088]
inc edi
imul eax, edi
pop ecx
push eax
call fcn.7f2d53a1
test eax, eax
mov esi, dword [0x7f307088]
je 0x7f2e2e3f
mov eax, esi
imul eax, edi
cmp eax, ebx
je 0x7f2e2e3f
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov ebx, esp
xor eax, eax
cmp ebx, eax
je 0x7f2e2e9b
cmp dword [0x7f307acc], eax
mov dword [ebp + 0xc], eax
jne 0x7f2e2e58
cmp byte [0x7f30708d], al
je 0x7f2e2e5d
mov eax, 0x400
imul esi, edi
lea ecx, [ebp + 0xc]
push ecx
push 0x7f2d2c28
push esi
push ebx
push edi
push dword [ebp + 0x18]
push eax
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp dword [ebp + 0xc], 0
jne 0x7f2e2e90
test eax, eax
je 0x7f2e2e90
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x7f2e2e97
push 0x7b
jmp 0x7f2e2e88
mov ebx, dword [ebp + 0x18]
test ebx, ebx
jne 0x7f2e2ea5
cmp dword [ebp + 0x18], 0
jne 0x7f2e2d7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x7f2e2d7b
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x7f2e36ae
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x7f307acc], edi
je 0x7f2e36cc
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x7f2e3730
mov eax, dword [0x7f307088]
mov ebx, dword [ebp + 0xc]
imul eax, ebx
inc eax
push eax
call fcn.7f2d53a1
test eax, eax
mov esi, dword [0x7f307088]
je 0x7f2e36ff
mov eax, esi
imul eax, ebx
inc eax
cmp eax, edi
je 0x7f2e36ff
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov edi, esp
test edi, edi
jne 0x7f2e3707
xor eax, eax
jmp 0x7f2e3730
imul esi, ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x7f2e3730
push ebx
push dword [ebp + 8]
inc eax
push eax
push edi
push 0
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x7f2e3730
dec eax
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x7f2e399b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x7f307acc], 0
push ebx
push esi
push edi
je 0x7f2e39bb
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x7f2e3a61
mov eax, dword [0x7f307088]
imul eax, dword [ebp + 8]
push eax
call fcn.7f2d53a1
test eax, eax
je 0x7f2e39ea
mov eax, dword [0x7f307088]
imul eax, dword [ebp + 8]
test eax, eax
je 0x7f2e39ea
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov ebx, esp
jmp 0x7f2e39ec
xor ebx, ebx
test ebx, ebx
jne 0x7f2e39f9
cmp dword [ebp + 8], ebx
jbe 0x7f2e39f9
xor eax, eax
jmp 0x7f2e3a61
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push ebx
push 0x104
call esi
mov edi, eax
cmp edi, dword [ebp + 8]
jbe 0x7f2e3a18
push 0
push 0
call esi
mov esi, eax
jmp 0x7f2e3a5f
xor esi, esi
cmp edi, esi
jbe 0x7f2e3a5f
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
test eax, eax
mov eax, dword [0x7f307ac8]
jne 0x7f2e3a32
mov eax, dword [0x7f307084]
push dword [ebp + 8]
lea ecx, [edi + 1]
push dword [ebp + 0xc]
push ecx
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test esi, esi
je 0x7f2e3a4e
dec esi
jmp 0x7f2e3a5f
mov esi, dword [0x7f307088]
push 0x7a
imul esi, edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x7f2e3e69
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x7f307acc], edi
je 0x7f2e3e87
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x7f2e3ef5
mov eax, dword [0x7f307088]
mov ebx, dword [ebp + 0xc]
imul eax, ebx
inc eax
push eax
call fcn.7f2d53a1
test eax, eax
mov esi, dword [0x7f307088]
je 0x7f2e3eba
mov eax, esi
imul eax, ebx
inc eax
cmp eax, edi
je 0x7f2e3eba
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov edi, esp
test edi, edi
jne 0x7f2e3ec2
xor eax, eax
jmp 0x7f2e3ef5
imul esi, ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x7f2e3ef5
cmp dword [ebp + 8], 0
je 0x7f2e3ef5
test ebx, ebx
je 0x7f2e3ef5
push ebx
push dword [ebp + 8]
inc eax
push eax
push edi
push 0
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x7f2e3ef5
dec eax
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x7f2e455f
Capabilities:
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x7f307090]
push ebx
xor ebx, ebx
cmp dword [0x7f307acc], ebx
mov dword [ebp + 0x198], eax
je 0x7f2e459a
push dword [ebp + 0x1a8]
push dword [ebp + 0x1a4]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x7f2e464c
push esi
push dword [ebp + 0x1a4]
call fcn.7f2da99a
mov esi, 0x104
cmp eax, esi
pop ecx
ja 0x7f2e4641
push dword [ebp + 0x1a4]
call fcn.7f2da99a
cmp eax, esi
pop ecx
ja 0x7f2e4641
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
test eax, eax
mov eax, dword [0x7f307ac8]
jne 0x7f2e45d8
mov eax, dword [0x7f307084]
cmp dword [0x7f307acc], ebx
mov dword [ebp - 0x7c], eax
jne 0x7f2e45ee
cmp byte [0x7f30708d], bl
mov dword [ebp - 0x80], ebx
je 0x7f2e45f5
mov dword [ebp - 0x80], 0x400
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push esi
lea eax, [ebp + 0x90]
push eax
push 0xffffffffffffffff
push dword [ebp + 0x1a4]
push dword [ebp - 0x80]
push dword [ebp - 0x7c]
call edi
push ebx
push ebx
push esi
lea eax, [ebp - 0x78]
push eax
push 0xffffffffffffffff
push dword [ebp + 0x1a8]
push dword [ebp - 0x80]
push dword [ebp - 0x7c]
call edi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
pop edi
jmp 0x7f2e464b
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
mov ecx, dword [ebp + 0x198]
pop ebx
call fcn.7f2fd123
add ebp, 0x19c
leave
ret 8
Function at 0x7f2e4a97
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x7f307acc], 0
push ebx
push esi
push edi
je 0x7f2e4ab1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x7f2e4b27
mov ebx, dword [ebp + 8]
cmp ebx, 0xffff
jbe 0x7f2e4b16
push ebx
call fcn.7f2da99a
mov edi, eax
mov eax, dword [0x7f307088]
inc edi
imul eax, edi
pop ecx
push eax
call fcn.7f2d53a1
test eax, eax
mov esi, dword [0x7f307088]
je 0x7f2e4af6
mov eax, esi
imul eax, edi
test eax, eax
je 0x7f2e4af6
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov ebx, esp
jmp 0x7f2e4af8
xor ebx, ebx
xor eax, eax
cmp ebx, eax
je 0x7f2e4b1a
imul esi, edi
push eax
push eax
push esi
push ebx
push edi
push dword [ebp + 8]
push eax
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test ebx, ebx
jne 0x7f2e4b20
cmp dword [ebp + 8], 0
jne 0x7f2e4b27
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4