joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1050b20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x48], ecx
push 0x16d
push 0x110e4b8
mov eax, dword [ebp - 0x48]
push eax
call fcn.0100a1f0
cmp dword [ebp + 8], 0
jne 0x1050b56
push 0x16e
push 0x110e4f0
call fcn.0100a6d0
test eax, eax
je 0x1050b56
int3
call fcn.01014200
mov dword [ebp - 0xc], eax
push 0xf1
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x1050b81
xor eax, eax
jmp 0x1050cfd
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x1050b9f
xor eax, eax
jmp 0x1050cfd
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1050bb9
xor eax, eax
jmp 0x1050cfd
mov ecx, dword [ebp - 4]
movzx edx, word [ecx]
cmp edx, 1
je 0x1050bd8
push 0x17d
push 0x110e528
call fcn.0100a6d0
test eax, eax
je 0x1050bd8
int3
push 0x17f
push 0x110e560
mov ecx, dword [ebp - 4]
movzx eax, word [ecx + 6]
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.01005860
add esp, 0xc
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], 0
jmp 0x1050c1d
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 4]
movzx eax, word [edx + 6]
cmp dword [ebp - 0x1c], eax
jge 0x1050c43
mov ecx, dword [ebp - 4]
call fcn.01053c10
mov ecx, dword [ebp - 0x1c]
movzx edx, word [eax + ecx*2]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov dword [ecx + eax*4], edx
jmp 0x1050c14
mov edx, dword [ebp - 4]
movzx eax, word [edx + 6]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x48]
call fcn.01050f20
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
push eax
call fcn.01005d90
add esp, 4
cmp dword [ebp - 0x10], 0
je 0x1050ce7
mov ecx, dword [ebp - 4]
movzx edx, word [ecx + 4]
push edx
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 2]
push ecx
lea ecx, [ebp - 0x24]
call fcn.010cca90
mov edx, dword [ebp - 4]
movzx eax, word [edx + 4]
add eax, 7
push eax
mov ecx, dword [ebp - 4]
movzx edx, word [ecx + 2]
add edx, 7
push edx
lea ecx, [ebp - 0x2c]
call fcn.010cca90
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x44]
push ecx
mov ecx, dword [ebp - 0x48]
call fcn.01050830
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x48]
call fcn.01050d10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
push eax
call fcn.0102c490
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4
Function at 0x1057280
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x105737b
mov eax, dword [ebp - 4]
push eax
call fcn.0102d320
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1057367
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x20]
cmp edx, dword [ebp - 4]
je 0x1057367
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x20]
push edx
call fcn.01056ea0
test eax, eax
je 0x1057367
push 0xfffffffffffffff0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x1057325
mov ecx, dword [ebp - 0xc]
and ecx, 0x18000000
cmp ecx, 0x10000000
jne 0x1057325
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x3c]
or ecx, 2
mov edx, dword [ebp - 8]
mov dword [edx + 0x3c], ecx
jmp 0x1057367
cmp dword [ebp + 8], 0
je 0x1057367
mov eax, dword [ebp - 0xc]
and eax, 0x18000000
jne 0x1057367
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x3c]
and edx, 2
je 0x1057367
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0xb4], 0
jne 0x1057367
push 4
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x3c]
and eax, 0xfffffffd
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x3c], eax
push 2
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
jmp 0x105729b
mov esp, ebp
pop ebp
ret 4
Function at 0x106bbe0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0xa0], 0
mov dword [ebp - 0x10], 0x115e0e4
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
cmp dword [ecx], 0
je 0x106bd06
lea edx, [ebp - 0x14]
push edx
push 1
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
push reloc.oledlg.dll_OleUIAddVerbMenuA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x106bcf8
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0
je 0x106bce7
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x106bcc4
cmp dword [ebp - 8], 4
jne 0x106bcc4
cmp dword [ebp - 0x18], 0
je 0x106bcaa
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov ecx, dword [edx + 0xa0]
or ecx, dword [eax + 4]
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0xa0], ecx
jmp 0x106bcc4
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
not ecx
mov edx, dword [ebp - 0x1c]
and ecx, dword [edx + 0xa0]
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0xa0], ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
add ecx, 8
mov dword [ebp - 4], ecx
jmp 0x106bc56
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x10]
add eax, 8
mov dword [ebp - 0x10], eax
jmp 0x106bc20
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x1074260
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10da703
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x115e76c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], 0
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
shl eax, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0x10], 0
je 0x10742b0
mov ecx, dword [ebp - 0x14]
or ecx, 0x1000000
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x1c]
call fcn.0100f000
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x40
mov edx, dword [ebp - 0x18]
shl edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
call fcn.01011650
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x18]
add ecx, 1
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.01011680
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x18]
je 0x10742c6
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
call fcn.01011300
mov ecx, dword [ebp - 0x24]
or ecx, 1
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.01009720
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x108de80
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x115e76c]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0108dcb0
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jne 0x108debc
push 0x66
push 0x1131f58
call fcn.0100a6d0
test eax, eax
je 0x108debc
int3
mov dword [ebp - 0x4c], 0x40
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x108df1f
mov ecx, dword [ebp - 4]
add ecx, 4
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx - 4]
mov dword [ebp - 0x54], eax
push 0x40
lea ecx, [ebp - 0x48]
push ecx
mov edx, dword [ebp - 0x50]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [ebp - 0x54]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0x40
lea edx, [ebp - 0x48]
push edx
call fcn.010aa070
add esp, 0x10
cmp eax, 1
je 0x108df1d
push 0xffffffffffffffff
push 0
mov eax, dword [ebp + 0x14]
push eax
call fcn.0100f550
mov ecx, dword [ebp + 8]
call fcn.0108ddc0
jmp 0x108df83
call fcn.010a4cf0
mov ecx, dword [eax]
mov dword [ebp - 0x58], ecx
call fcn.010a4cf0
mov dword [eax], 0
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0x3f
push 0x40
lea ecx, [ebp - 0x48]
push ecx
call fcn.010a9f10
add esp, 0x14
call fcn.010a4cf0
cmp dword [eax], 0
je 0x108df68
call fcn.010a4cf0
mov edx, dword [eax]
push edx
call fcn.01009270
add esp, 4
jmp 0x108df72
call fcn.010a4cf0
mov ecx, dword [ebp - 0x58]
mov dword [eax], ecx
xor edx, edx
jne 0x108df1f
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.01068c40
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0109d5d0
mov esp, ebp
pop ebp
ret

Function at 0x108e790
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.0108dce0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
call fcn.010412f0
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x108e819
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x108e7f0
mov eax, dword [ebp - 8]
add eax, 1
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.01011650
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x108e80d
push 0x100
push 0xff
mov ecx, dword [ebp + 0x10]
call fcn.01011320
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x10]
call fcn.01011680
jmp 0x108e84a
mov ecx, dword [ebp + 0x10]
call fcn.0101b260
push eax
push 0xffffffffffffffff
push 0x14d
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x108e84a
mov ecx, dword [ebp + 0x10]
call fcn.0101b260
push eax
mov edx, dword [ebp - 4]
push edx
call fcn.01068c40
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1095c70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x100
push 0x1139404
mov eax, dword [ebp - 8]
push eax
call fcn.0100a1f0
mov ecx, dword [ebp - 8]
cmp dword [ecx + 4], 0xffffffff
jne 0x1095ca9
push 0x101
push 0x113943c
call fcn.0100a6d0
test eax, eax
je 0x1095ca9
int3
cmp dword [ebp + 0xc], 0
jne 0x1095cb3
xor eax, eax
jmp 0x1095d2e
cmp dword [ebp + 8], 0
jne 0x1095ccd
push 0x106
push 0x1139474
call fcn.0100a6d0
test eax, eax
je 0x1095ccd
int3
push 1
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.010116f0
test eax, eax
jne 0x1095cf4
push 0x107
push 0x11394ac
call fcn.0100a6d0
test eax, eax
je 0x1095cf4
int3
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1095d2b
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.0101b260
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0101cae0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x1095d40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x112
push 0x11394e4
mov eax, dword [ebp - 8]
push eax
call fcn.0100a1f0
mov ecx, dword [ebp - 8]
cmp dword [ecx + 4], 0xffffffff
jne 0x1095d79
push 0x113
push 0x113951c
call fcn.0100a6d0
test eax, eax
je 0x1095d79
int3
cmp dword [ebp + 0xc], 0
jne 0x1095d84
jmp 0x1095e19
cmp dword [ebp + 8], 0
jne 0x1095d9e
push 0x118
push 0x1139554
call fcn.0100a6d0
test eax, eax
je 0x1095d9e
int3
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.010116f0
test eax, eax
jne 0x1095dc5
push 0x119
push 0x113958c
call fcn.0100a6d0
test eax, eax
je 0x1095dc5
int3
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1095dfc
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.0101b260
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0101cae0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x1095e19
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.0101b260
push eax
push 0xffffffffffffffff
push 0xd
call fcn.0101cd00
mov esp, ebp
pop ebp
ret 8
Function at 0x1096200
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x191
push 0x113989c
mov eax, dword [ebp - 4]
push eax
call fcn.0100a1f0
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 0xffffffff
jne 0x1096237
push 0x192
push 0x11398d4
call fcn.0100a6d0
test eax, eax
je 0x1096237
int3
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0x30]
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1096277
mov ecx, dword [ebp - 4]
add ecx, 0xc
call fcn.0101b260
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0101cae0
mov esp, ebp
pop ebp
ret 8

Function at 0x1096280
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0x19c
push 0x113990c
mov eax, dword [ebp - 0xc]
push eax
call fcn.0100a1f0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x10962d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10962d8
mov ecx, dword [ebp - 0xc]
add ecx, 0xc
call fcn.0101b260
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0101cae0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x1096630
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
push 0x104
mov ecx, dword [ebp + 0xc]
call fcn.01011320
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0x104
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0xffffffff
lea eax, [ebp - 0xc]
push eax
push str.CLSID
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x109670a
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1096700
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x20]
push ecx
push str.InProcServer32
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10966f6
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
lea edx, [ebp - 4]
push edx
push 0
push 0x1139047
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x14], eax
xor ecx, ecx
cmp dword [ebp - 0x14], 0
sete cl
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
call fcn.01011680
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 8
Function at 0x1096720
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10db347
mov eax, dword fs:[0]
push eax
sub esp, 0x17c
mov eax, dword [0x115e76c]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
cmp dword [ebp + 8], 0
jne 0x1096765
xor eax, eax
jmp 0x10968d8
push 0x800
push 0x160
lea ecx, [ebp - 0x17c]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x1096793
mov eax, dword [ebp - 0x174]
and eax, 0x10000
jne 0x109679a
xor eax, eax
jmp 0x10968d8
lea ecx, [ebp - 0x14]
push ecx
push 0x113a294
push 0
push 0x113a284
lea ecx, [ebp - 0x17d]
call fcn.01096380
test eax, eax
jl 0x10967bf
cmp dword [ebp - 0x14], 0
jne 0x10967c6
xor eax, eax
jmp 0x10968d8
mov dword [ebp - 0x10], 0
lea edx, [ebp - 0x10]
push edx
push 0x11465a4
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ecx]
call eax
test eax, eax
jl 0x10968c8
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x184]
call fcn.010087e0
mov dword [ebp - 4], 0
cmp dword [ebp - 0x10], 0
je 0x10968a2
push 0
lea ecx, [ebp - 0x184]
call fcn.0101b260
push eax
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [eax + 0x14]
call edx
test eax, eax
jl 0x10968a2
push 2
mov ecx, dword [ebp + 8]
call fcn.0103a490
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ecx + 0x4c]
call eax
test eax, eax
jl 0x10968a2
push 0
push 0
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ecx + 0xc]
call eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [edx + 8]
call ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [eax + 8]
call edx
mov dword [ebp - 0x188], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x184]
call fcn.01009720
mov eax, dword [ebp - 0x188]
jmp 0x10968d8
cmp dword [ebp - 0x10], 0
je 0x10968b6
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ecx + 8]
call eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x184]
call fcn.01009720
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [edx + 8]
call ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0109d5d0
mov esp, ebp
pop ebp
ret 0x10
Function at 0x109ab70
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0x24
call fcn.0101b260
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 1
je 0x109abe1
push 1
push 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x18]
mov eax, dword [edx + 0xa0]
call eax
test eax, eax
jne 0x109abdf
push str.Warning:_File_save_with_new_name_failed._n
push 0
mov ecx, 0x11609f0
call fcn.01001320
push eax
push 0x10f
push 0x113bb3c
lea ecx, [ebp - 0xc]
call fcn.010012d0
push eax
call fcn.010012f0
add esp, 0x10
xor eax, eax
jmp 0x109ac39
jmp 0x109ac34
push 1
mov ecx, dword [ebp - 0x18]
add ecx, 0x24
call fcn.0101b260
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x18]
mov eax, dword [edx + 0xa0]
call eax
test eax, eax
jne 0x109ac34
push str.Warning:_File_save_failed._n
push 0
mov ecx, 0x11609f0
call fcn.01001320
push eax
push 0x117
push 0x113bba0
lea ecx, [ebp - 0x14]
call fcn.010012d0
push eax
call fcn.010012f0
add esp, 0x10
xor eax, eax
jmp 0x109ac39
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x109d5d0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x115e76c]
jne 0x109d5da
repz ret
jmp fcn.010abbd0
Function at 0x10001340
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
test eax, eax
je 0x100013a8
cmp byte [esi + eax - 1], 0xa
mov ebx, eax
je 0x100013a0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x10007084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
xor eax, eax
jmp 0x1000136a
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop ebp
ret
Function at 0x10001a20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov ebx, dword [ebp + 0xc]
mov dword [esp], ebx
call sym.___wine_dbg_get_channel_flags
movzx ecx, byte [ebp + 8]
movzx eax, al
sar eax, cl
test al, 1
je 0x10001c08
mov edx, dword [0x10007084]
mov eax, dword fs:[0x18]
cmp dword [eax + 0x24], edx
je 0x10001bf8
test byte [0x10002030], 8
jne 0x10001ba0
lea edi, [ebp - 0xd4]
mov esi, edi
test byte [0x10002040], 8
jne 0x10001b60
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov ecx, str._04x:
mov dword [esp + 4], ecx
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10001aaa
cmp dword [ebp + 8], 3
jbe 0x10001b18
mov dword [esp], 2
mov ebx, edi
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov esi, dword [ebx]
add ebx, 4
lea ecx, [esi - 0x1010101]
not esi
and ecx, esi
and ecx, 0x80808080
je 0x10001ab9
mov dword [esp + 0xc], eax
mov esi, ecx
mov eax, 1
mov dword [esp + 4], eax
shr esi, 0x10
test ecx, 0x8080
mov dword [esp], edi
cmove ecx, esi
lea esi, [ebx + 2]
mov dl, cl
cmove ebx, esi
add dl, cl
sbb ebx, 3
sub ebx, edi
mov dword [esp + 8], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp + 0x10]
add eax, esi
inc ebx
mov dword [esp + 0x10], ebx
mov dword [esp], eax
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 8]
mov ecx, dword [edx*4 + 0x100055e8]
mov edx, str._s:_s:_s
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov ecx, edi
sub ecx, eax
add ecx, 0xc8
mov dword [esp + 4], ecx
call sym._snprintf.constprop.0
jmp 0x10001aaa
mov dword [esp], 0x10002040
call sym.___wine_dbg_get_channel_flags
and al, 8
je 0x10001a7f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov ecx, str._04x:
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call sym._sprintf
add esi, eax
jmp 0x10001a7f
mov dword [esp], 0x10002030
call sym.___wine_dbg_get_channel_flags
and al, 8
je 0x10001a6a
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
mov esi, str._3u._03u:
mov dword [esp + 4], esi
lea edi, [ebp - 0xd4]
mov dword [esp], edi
mov ecx, eax
mul edx
shr edx, 6
mov dword [esp + 8], edx
imul eax, edx, 0x3e8
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea esi, [edi + eax]
jmp 0x10001a72
add esp, 0xe0
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0xffffffff
jmp 0x10001b07