joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10237af
Capabilities:
Get common file path

Disassembly:
push 0xa60
mov eax, 0x104c601
call fcn.0102eb23
mov eax, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0xa28], esi
mov dword [ebp - 0xa20], eax
mov dword [esi], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 4], ebx
lea edi, [esi + 8]
mov dword [edi], ebx
push 0x208
lea eax, [esi + 0xc]
push ebx
push eax
mov byte [ebp - 4], 2
call sub.msvcrt.dll_memset
add esp, 0xc
xchg dword [ebp - 0xa1c], eax
cmp dword [ebp - 0xa20], ebx
jne 0x1023839
push 0x1005b94
lea ecx, [ebp - 0xa44]
call fcn.0100efcb
lea eax, [ebp - 0xa44]
push eax
lea ecx, [ebp - 0xa6c]
mov byte [ebp - 4], 3
call fcn.01011b81
push 0x104ebf0
lea eax, [ebp - 0xa6c]
push eax
call sub.msvcrt.dll__CxxThrowException
lea eax, [ebp - 0xa18]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jbe 0x10238a6
push ebx
push dword [ebp - 0xa20]
lea eax, [ebp - 0xa18]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.0100e11f
test eax, eax
jl 0x10238a6
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xa1c]
push eax
call fcn.01027f43
push eax
mov ecx, edi
call fcn.010232ae
mov ecx, dword [ebp - 0xa1c]
cmp ecx, ebx
je 0x102389e
push 1
call fcn.0102324f
cmp dword [edi], ebx
jne 0x1023943
push ebx
lea eax, [ebp - 0xa18]
push eax
push 0x400
push ebx
push dword [ebp - 0xa20]
push ebx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
cmp eax, ebx
jne 0x10238fd
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x1005b7c
lea ecx, [ebp - 0xa44]
call fcn.0100efcb
mov byte [ebp - 4], 4
lea eax, [ebp - 0xa44]
push eax
lea ecx, [ebp - 0xa6c]
call fcn.01011bf1
push 0x104e680
jmp 0x102382d
lea eax, [ebp - 0xa18]
push eax
lea eax, [ebp - 0xa1c]
push eax
call fcn.01027f43
push eax
mov ecx, edi
call fcn.010232ae
mov ecx, dword [ebp - 0xa1c]
cmp ecx, ebx
je 0x1023929
push 1
call fcn.0102324f
cmp dword [edi], ebx
jne 0x1023943
push 0x1005b64
lea ecx, [ebp - 0xa44]
call fcn.0100efcb
mov byte [ebp - 4], 5
jmp 0x10238e1
mov dword [0x1058504], esi
mov eax, esi
call fcn.0102ebb5
ret 4
Function at 0x1024125
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x1054254]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push esi
xor esi, esi
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xd0], ecx
mov dword [ebp - 0xcc], esi
mov dword [ebp - 0xb4], esi
cmp eax, esi
je 0x10242b5
cmp ecx, esi
je 0x10242b5
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea ecx, [ebp - 0xb8]
push ecx
push esi
lea ecx, [ebp - 0xc4]
push ecx
push esi
lea ecx, [ebp - 0xbc]
push ecx
lea ecx, [ebp - 0xb0]
push ecx
push esi
push eax
mov dword [ebp - 0xc0], esi
mov dword [ebp - 0xbc], 0x56
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
jmp 0x102426d
cmp dword [ebp - 0xb4], esi
je 0x10241c8
push dword [ebp - 0xb4]
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0xb8]
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xb4], eax
cmp eax, esi
je 0x1024285
lea ecx, [ebp - 0xb8]
push ecx
push eax
push esi
push esi
lea eax, [ebp - 0xb0]
push eax
push dword [ebp - 0xc8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x1024275
push dword [ebp - 0xb8]
lea eax, [ebp - 0xb0]
push dword [ebp - 0xb4]
push dword [ebp - 0xc4]
push esi
push eax
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, esi
jne 0x1024275
inc dword [ebp - 0xc0]
lea eax, [ebp - 0xb8]
push eax
push esi
lea eax, [ebp - 0xc4]
push eax
push esi
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0xb0]
push eax
push dword [ebp - 0xc0]
mov dword [ebp - 0xbc], 0x56
push dword [ebp - 0xc8]
call edi
cmp eax, esi
je 0x10241b0
cmp eax, 0x103
je 0x1024289
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1024293
push 8
jmp 0x102427d
mov dword [ebp - 0xcc], 1
cmp dword [ebp - 0xb4], esi
je 0x10242ab
push dword [ebp - 0xb4]
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xcc]
pop edi
pop ebx
jmp 0x10242bf
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0102ea9b
leave
ret 8

Function at 0x1025c4e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x10], 0
je 0x1025c91
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1025c91
and dword [ebp + 0x14], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x14]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1025c94
cmp dword [ebp + 0x14], 1
je 0x1025c94
push 0xd
jmp 0x1025c93
push 0x57
pop eax
leave
ret 0x10
Function at 0x1025c9d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
je 0x1025cdb
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1025cdb
add eax, eax
mov dword [ebp + 0x14], eax
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1025cde
cmp dword [ebp + 0x10], 7
je 0x1025cde
push 0xd
jmp 0x1025cdd
push 0x57
pop eax
pop ebp
ret 0x10

Function at 0x1025dab
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [ebp + 8], edi
jne 0x1025dc8
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1025e42
push esi
mov esi, 0x1006538
cmp dword [ebp + 0x10], edi
je 0x1025de8
mov ecx, 0x80000001
cmp dword [ebp + 0xc], edi
je 0x1025de4
mov eax, 0x10064e0
jmp 0x1025dfc
mov eax, esi
jmp 0x1025dfc
mov ecx, 0x80000002
mov eax, 0x1006478
cmp dword [ebp + 0xc], edi
jne 0x1025dfc
mov eax, 0x1006410
lea edx, [ebp - 4]
push edx
push 0xf003f
push edi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1025e3e
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, edi
je 0x1025e34
push eax
push dword [ebp + 8]
push esi
push 0x10063b0
call fcn.0101c26a
add esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
call fcn.01012df6
xor eax, eax
inc eax
pop esi
pop edi
leave
ret 0xc

Function at 0x1025ebc
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
push esi
xor esi, esi
inc ebx
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 8], esi
jne 0x1025ee6
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1025f64
mov eax, 0x10064e0
cmp dword [ebp + 0xc], esi
jne 0x1025ef5
mov eax, 0x1006538
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push esi
lea ecx, [ebp - 4]
push ecx
push esi
push 4
push esi
push esi
push esi
push eax
push 0x80000001
call edi
cmp eax, esi
je 0x1025f18
mov dword [ebp - 4], esi
jmp 0x1025f57
push esi
lea eax, [ebp - 8]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call edi
cmp eax, esi
je 0x1025f37
mov dword [ebp - 8], esi
jmp 0x1025f57
cmp dword [ebp + 0x10], esi
je 0x1025f60
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push esi
push 0x1003b28
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, esi
je 0x1025f60
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1025f63
mov dword [ebp - 0xc], ebx
pop edi
push esi
lea eax, [ebp - 4]
push eax
call fcn.01012df6
push esi
lea eax, [ebp - 8]
push eax
call fcn.01012df6
mov eax, dword [ebp - 0xc]
pop esi
pop ebx
leave
ret 0xc
Function at 0x1026182
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
xor esi, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
call fcn.01025ce7
test eax, eax
je 0x10261a5
xor eax, eax
xor edx, edx
jmp 0x1026213
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push 0x100319c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x10261c6
push eax
jmp 0x10261fd
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0x1006664
push dword [ebp - 4]
mov dword [ebp - 8], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
je 0x10261ef
push eax
jmp 0x10261f7
cmp dword [ebp - 0xc], 0xb
je 0x1026203
push 0xb
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
lea eax, [ebp - 4]
push eax
call fcn.01012df6
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
pop esi
leave
ret

Function at 0x102621b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
xor esi, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
call fcn.01025ce7
test eax, eax
je 0x102623e
xor eax, eax
xor edx, edx
jmp 0x10262ac
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push 0x100319c
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x102625f
push eax
jmp 0x1026296
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0x1006664
push dword [ebp - 4]
mov dword [ebp - 8], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
je 0x1026288
push eax
jmp 0x1026290
cmp dword [ebp - 0xc], 0xb
je 0x102629c
push 0xb
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
lea eax, [ebp - 4]
push eax
call fcn.01012df6
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
pop esi
leave
ret

Function at 0x10262b4
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push 0x100319c
push 0x80000001
xor edi, edi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x1026318
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
push 8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0xb
push esi
push 0x1006664
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, esi
je 0x1026321
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1026324
xor edi, edi
inc edi
push esi
lea eax, [ebp - 4]
push eax
call fcn.01012df6
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x1026339
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push 0x100319c
push 0x80000002
xor edi, edi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x102639d
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
push 8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0xb
push esi
push 0x1006664
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, esi
je 0x10263a6
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10263a9
xor edi, edi
inc edi
push esi
lea eax, [ebp - 4]
push eax
call fcn.01012df6
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x10263be
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push edi
xor edi, edi
mov dword [ebp - 4], esi
cmp dword [ebp + 8], esi
je 0x1026421
cmp dword [ebp + 0xc], esi
je 0x1026421
lea eax, [ebp - 4]
push eax
push 0xf003f
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x10263f4
push eax
jmp 0x1026423
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
cmp eax, esi
jne 0x10263f1
push esi
lea eax, [ebp - 4]
push eax
call fcn.01012df6
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, esi
jne 0x10263f1
xor edi, edi
inc edi
jmp 0x1026429
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
lea eax, [ebp - 4]
push eax
call fcn.01012df6
mov eax, edi
pop edi
pop esi
leave
ret 8

Function at 0x1027571
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x1054254]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x808], eax
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x802]
push eax
mov esi, ecx
call sub.msvcrt.dll_memset
mov eax, dword [esi]
add esp, 0xc
mov ecx, esi
call dword [eax + 8]
test eax, eax
je 0x1027624
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push edi
lea eax, [ebp - 0x804]
push eax
mov edi, 0x400
push edi
push 0xd
push dword [esi + 4]
call ebx
test eax, eax
jl 0x102760e
cmp dword [ebp + 0xc], 0
je 0x10275f7
push 0x1002d18
push edi
lea eax, [ebp - 0x804]
push eax
call fcn.0101331c
test eax, eax
jl 0x102760e
push dword [ebp - 0x808]
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.0101331c
test eax, eax
jge 0x1027612
xor eax, eax
jmp 0x1027622
lea eax, [ebp - 0x804]
push eax
push 0
push 0xc
push dword [esi + 4]
call ebx
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0102ea9b
leave
ret 8
Function at 0x10277e6
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1054254]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x218], edi
mov dword [ebp - 0x214], edi
call sub.msvcrt.dll_memset
add esp, 0xc
cmp esi, edi
jne 0x102784b
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1027a10
lea eax, [ebp - 0x21c]
push eax
push 0x7fffffff
push esi
call fcn.010133d5
cmp eax, edi
jge 0x102787f
mov ecx, 0xffff
mov esi, eax
and esi, ecx
mov edx, esi
jle 0x1027876
and edx, ecx
or edx, 0x80070000
cmp edx, eax
jne 0x102787c
mov eax, esi
push eax
jmp 0x102783e
mov eax, 0x104
cmp dword [ebp - 0x21c], eax
jbe 0x1027890
push 0x32
jmp 0x102783e
push edi
push esi
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0100dcb2
cmp eax, edi
jl 0x1027861
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
lea eax, [ebp - 0x20c]
push eax
je 0x10278c3
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
jmp 0x10278c9
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push ebx
push edi
mov esi, 0xa28
push esi
push 2
call fcn.01026440
mov ebx, eax
cmp ebx, edi
jne 0x10278e5
xor eax, eax
jmp 0x1027a0f
push esi
push ebx
call fcn.0102705c
cmp eax, edi
je 0x10278f9
cmp eax, 2
jne 0x10279ed
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x10279e3
lea eax, [ebp - 0x20c]
push eax
push esi
push ebx
call fcn.010220ce
test eax, eax
jl 0x10279ed
lea eax, [ebp - 0x210]
push eax
push ebx
call fcn.01021e41
jmp 0x1027942
push ebx
call fcn.01021e75
dec dword [ebp - 0x210]
cmp dword [ebp - 0x210], 9
ja 0x1027936
lea eax, [ebp - 0x20c]
push eax
push esi
push ebx
call fcn.01021f6d
cmp eax, edi
jl 0x102796e
lea eax, [ebp - 0x210]
push eax
push ebx
call fcn.01021f05
cmp eax, edi
jge 0x102798b
mov ecx, 0xffff
mov esi, eax
and esi, ecx
mov edx, esi
jle 0x1027983
and edx, ecx
or edx, 0x80070000
cmp edx, eax
jne 0x10279da
mov eax, esi
jmp 0x10279da
push edi
lea eax, [ebp - 0x214]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push 0x100319c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
je 0x10279b8
mov dword [ebp - 0x214], edi
jmp 0x10279da
mov eax, dword [ebp - 0x210]
add eax, eax
push eax
push ebx
push 7
push edi
push 0x1006a9c
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, edi
je 0x10279e3
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10279ed
mov dword [ebp - 0x218], 1
push edi
lea eax, [ebp - 0x214]
push eax
call fcn.01012df6
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x218]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0102ea9b
leave
ret 4
Function at 0x1027a25
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1054254]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
cmp eax, esi
je 0x1027aa6
push esi
push 0x1007010
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.0100e11f
test eax, eax
jl 0x1027aa6
push 0x1006fd0
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push eax
mov dword [ebp - 0x210], eax
call fcn.0100d382
test al, al
je 0x1027aa6
push 0xfa
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, esi
je 0x1027ab8
cmp eax, 0x80
je 0x1027ab8
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.0100d39e
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0102ea9b
leave
ret 4
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, eax
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.0102526f
mov eax, edi
pop edi
jmp 0x1027aa9

Function at 0x1027b35
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x1054254]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x41c], ecx
mov dword [ebp - 0x420], edx
test ecx, ecx
je 0x1027c9d
test edx, edx
je 0x1027c9d
mov esi, 0x104
test eax, eax
jne 0x1027c65
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1027ca5
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
and dword [ebp - 0x418], 0
push dword [ebp - 0x420]
movzx eax, word [ebp - 0x424]
push dword [ebp - 0x418]
push eax
movzx eax, word [ebp - 0x426]
push eax
movzx eax, word [ebp - 0x428]
push eax
movzx eax, word [ebp - 0x42a]
push eax
movzx eax, word [ebp - 0x42e]
push eax
movzx eax, word [ebp - 0x430]
push eax
push dword [ebp - 0x41c]
lea eax, [ebp - 0x414]
push 0x1007030
push esi
push eax
call fcn.01013376
add esp, 0x30
test eax, eax
jl 0x1027c7b
push 0
lea eax, [ebp - 0x414]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100e36e
test eax, eax
jl 0x1027c7b
push 0
push dword [ebp + 0x1c]
lea eax, [ebp - 0x20c]
push 1
push 0
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
push edi
call fcn.0100d382
test al, al
jne 0x1027c99
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x1027ca5
inc dword [ebp - 0x418]
cmp dword [ebp - 0x418], 0xffffffff
jb 0x1027ba8
jmp 0x1027ca5
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d5f0
test eax, eax
jge 0x1027b94
mov ecx, 0xffff
mov esi, eax
and esi, ecx
mov edx, esi
jle 0x1027c90
and edx, ecx
or edx, 0x80070000
cmp edx, eax
jne 0x1027c96
mov eax, esi
push eax
jmp 0x1027c9f
mov eax, edi
jmp 0x1027ca8
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0102ea9b
leave
ret 0x18
Function at 0x102833e
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1054254]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x20c]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x1028380
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1007160
call fcn.0101c26a
pop ecx
pop ecx
jmp 0x10283cb
cmp eax, esi
jae 0x10283cb
push 0
push 0x100241c
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100e36e
test eax, eax
jge 0x10283a4
push eax
push 0x10070e8
jmp 0x1028377
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.01027cbd
test eax, eax
je 0x10283cb
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x1007080
call fcn.0101c26a
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0102ea9b
leave
ret 4

Function at 0x10283e1
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x1054254]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.01027adf
mov eax, dword [ebp + 8]
xor esi, esi
sub eax, esi
je 0x10284e1
dec eax
jne 0x10284f2
push 0x1007310
call fcn.0101c26a
pop ecx
mov edi, 0x109
push edi
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x102844e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10072a8
call fcn.0101c26a
pop ecx
pop ecx
xor al, al
jmp 0x10284f4
push 0x10072a0
push edi
lea eax, [ebp - 0x218]
push eax
call fcn.0101331c
test eax, eax
jl 0x1028447
push 0x40
lea eax, [ebp - 0x268]
push esi
push eax
mov dword [ebp - 0x26c], esi
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0x228], esi
lea edi, [ebp - 0x224]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x26c]
push eax
push esi
push esi
push 0x40
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x10284c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1007240
jmp 0x1028440
push esi
lea eax, [ebp - 0x224]
push eax
call fcn.0100d39e
push esi
lea eax, [ebp - 0x228]
push eax
call fcn.0100d39e
jmp 0x10284f2
push 0x10071d8
call fcn.0101c26a
pop ecx
push esi
call fcn.0102833e
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0102ea9b
leave
ret 4

Function at 0x1028f67
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
push 7
pop ecx
xor esi, esi
push esi
xor eax, eax
push esi
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
push 0x1028bef
push esi
push esi
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x1c], 0x1007484
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [ebp - 4], eax
call fcn.0100d382
test al, al
je 0x1028fc0
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
lea eax, [ebp - 4]
push eax
call fcn.0100d39e
pop edi
pop esi
leave
ret