joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100120a0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x32c
mov eax, dword [0x1007b4bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.update
mov edi, 0x1007d158
lea eax, [ebp - 0x20c]
push edi
push eax
mov esi, ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
xor ebx, ebx
lea eax, [ebp - 0x20c]
push ebx
push eax
push str.updatetemp
mov ecx, esi
call fcn.10011f16
push ebx
push edi
push str.productpath
mov ecx, esi
call fcn.10011f16
push ebx
push edi
push str.instdir
mov ecx, esi
call fcn.10011f16
push ebx
push edi
push str.datadir
mov ecx, esi
call fcn.10011f16
push ebx
push 3
push str.clientver
mov ecx, esi
call fcn.10011fca
push 0x118
lea eax, [ebp - 0x324]
push ebx
push eax
call fcn.10040d30
lea eax, [ebp - 0x32c]
mov dword [ebp - 0x328], 0x11c
push eax
lea eax, [ebp - 0x328]
mov dword [ebp - 0x32c], ebx
push eax
call fcn.1000f234
add esp, 0x14
mov edi, 0x104
test eax, eax
lea eax, [ebp - 0x20c]
je 0x1001218d
push dword [ebp - 0x31c]
push dword [ebp - 0x320]
push dword [ebp - 0x324]
push str._d._d._04d
push 0x208
push eax
call fcn.10012076
add esp, 0x18
jmp 0x10012199
push str.5.0.0000
push edi
push eax
call fcn.10005de3
push ebx
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
push str.sysver
call fcn.10011f16
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
push eax
push 0x100618ec
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.1000fed9
add esp, 0x10
lea eax, [ebp - 0x20c]
mov ecx, esi
push ebx
push eax
push str.syslang
call fcn.10011f16
push ebx
push 0x100619dc
push str.uilang
mov ecx, esi
call fcn.10011f16
push ebx
push str.H_HOME
push str.oemid
mov ecx, esi
call fcn.10011f16
push ebx
push 0x100616c0
push str.userid
mov ecx, esi
call fcn.10011f16
mov ecx, esi
call fcn.10011ecb
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003eec9
leave
ret

Function at 0x1001275b
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1007b4bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ecx + 0x40]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
test ecx, ecx
je 0x100127a2
push esi
push str.updatetemp
call fcn.10011d84
test eax, eax
je 0x100127a2
mov eax, dword [esi]
cmp dword [eax - 0xc], edi
je 0x100127a2
push eax
call fcn.1000f8f1
pop ecx
test eax, eax
je 0x100127a2
xor eax, eax
inc eax
jmp 0x10012801
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100127ff
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x100127ff
lea edx, [ebp - 0x20c]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x100127df
sub edx, ecx
lea eax, [ebp - 0x20c]
sar edx, 1
mov ecx, esi
push edx
push eax
call fcn.10009f28
jmp 0x1001279d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1003eec9
leave
ret 4
Function at 0x10012ae5
Capabilities:
Delete file

Disassembly:
push 4
mov eax, 0x1005d61b
call fcn.1003ef11
mov esi, dword [ebp + 0xc]
lea edi, [ecx + 4]
mov ebx, dword [ebp + 8]
xor eax, eax
xor edx, edx
mov dword [ebp - 0x10], eax
mov ecx, dword [esi + 0x10]
cmp dword [ecx - 0xc], eax
je 0x10012c73
mov eax, dword [esi + 0xc]
cmp dword [eax - 0xc], edx
je 0x10012c73
push ecx
call fcn.1000f400
pop ecx
test eax, eax
je 0x10012b6d
push dword [esi + 4]
push dword [esi + 0x10]
call fcn.1000f424
pop ecx
pop ecx
test eax, eax
je 0x10012b59
mov eax, dword [esi + 0x14]
cmp dword [eax - 0xc], 0x20
jne 0x10012c6e
push dword [esi + 0x18]
push eax
push dword [esi + 0x10]
call fcn.1000ee18
add esp, 0xc
test eax, eax
jne 0x10012c6e
push dword [esi + 0x10]
xor eax, eax
inc eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x10012c6e
mov eax, dword [esi + 0x14]
and dword [ebp + 8], 0
mov dword [ebp - 0x10], 1
cmp dword [eax - 0xc], 0x20
jne 0x10012b98
push dword [esi + 0x18]
push eax
push dword [esi + 4]
call fcn.1000ee18
add esp, 0xc
test eax, eax
je 0x10012c6e
call fcn.1000ada5
push eax
lea ecx, [ebp + 0xc]
call fcn.1000a8c4
and dword [ebp - 4], 0
lea eax, [ebp + 0xc]
push eax
push dword [esi + 4]
call fcn.1000eee4
pop ecx
pop ecx
test eax, eax
je 0x10012c01
push dword [esi + 0xc]
push dword [ebp + 0xc]
call fcn.1000efbd
pop ecx
pop ecx
test eax, eax
je 0x10012c01
lea eax, [ebp + 0xc]
mov ecx, esi
push eax
call fcn.1000dcf4
lea ecx, [esi + 8]
call fcn.10009b84
push dword [ebp + 0xc]
mov ecx, edi
push 0x10061628
push ebx
call fcn.10011676
push 0
push 0x10061a80
push ebx
mov ecx, edi
call fcn.10011676
jmp 0x10012c07
mov eax, dword [ebp - 0x10]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10009de4
cmp dword [ebp + 8], 0
je 0x10012c6e
push dword [esi + 0xc]
mov ecx, edi
push 0x10061628
push ebx
call fcn.10011676
push dword [esi + 4]
mov ecx, edi
push str.path
push ebx
call fcn.10011676
mov eax, dword [esi + 0x14]
mov ecx, edi
cmp dword [eax - 0xc], 0x20
jne 0x10012c4a
push eax
jmp 0x10012c4c
push 0
push 0x10061a80
push ebx
call fcn.10011676
lea eax, [esi + 0xc]
mov ecx, esi
push eax
call fcn.1000dcf4
lea eax, [esi + 0x14]
push eax
lea ecx, [esi + 8]
call fcn.1000dcf4
mov edx, dword [ebp - 0x10]
jmp 0x10012c7a
mov dword [ebp - 0x10], 1
test edx, edx
je 0x10012cba
push 0
push str.pver
push ebx
mov ecx, edi
call fcn.10011676
push 0
push str.ppath
push ebx
mov ecx, edi
call fcn.10011676
push 0
push str.pmd5
push ebx
mov ecx, edi
call fcn.10011676
push 0
push str.pextcb
push ebx
mov ecx, edi
call fcn.10011676
cmp dword [ebp - 0x10], 0
je 0x10012cd8
lea ecx, [esi + 0xc]
call fcn.10009b84
lea ecx, [esi + 0x10]
call fcn.10009b84
lea ecx, [esi + 0x14]
call fcn.10009b84
call fcn.1003eeda
ret 8
Function at 0x10015142
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x10015152
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
pop ebp
jmp dword [sym.imp.KERNEL32.dll_DeleteFileW]

Function at 0x100152e9
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1007b4bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push eax
push ecx
lea eax, [ebp - 0x24]
push eax
call fcn.1001605f
push 0x10061b64
lea eax, [ebp - 0x24]
push eax
push 0x10061b78
push esi
call fcn.10015bb9
mov ecx, dword [ebp - 4]
add esp, 0x1c
xor ecx, ebp
pop esi
call fcn.1003eec9
leave
ret 0xc

Function at 0x1001535f
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1007b4bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0xc]
push 0x10061b64
push eax
lea eax, [ebp - 0x24]
push esi
push eax
call fcn.10015bb9
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x10]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push ebx
call fcn.10016af9
mov ecx, dword [ebp - 4]
add esp, 0x28
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1003eec9
leave
ret 0x18

Function at 0x100155c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1007b4bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x11
pop ecx
mov esi, ebx
lea edi, [ebp - 0x48]
push 0x10061b88
rep movsd dword es:[edi], dword [esi]
push ebx
call fcn.100153df
pop ecx
pop ecx
mov ecx, dword [ebx + 0x40]
lea esi, [ebp - 0x48]
shr ecx, 7
push 0x11
neg ecx
sub esi, ebx
pop edx
mov eax, dword [esi + ebx]
xor eax, dword [ebx]
and eax, ecx
xor dword [ebx], eax
lea ebx, [ebx + 4]
sub edx, 1
jne 0x10015601
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003eec9
leave
ret
Function at 0x1001605f
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov eax, dword [0x1007b4bc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x24]
push 0x20
push dword [ebp + 0xc]
push eax
call fcn.10040740
mov al, byte [ebp - 5]
add esp, 0xc
and byte [ebp - 0x24], 0xf8
and al, 0x3f
mov ecx, dword [ebp + 0x10]
or al, 0x40
xor esi, esi
mov byte [ebp - 5], al
mov eax, esi
movd xmm1, dword [eax + ecx]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
movups xmmword [ebp + eax*4 - 0x1a4], xmm1
add eax, 4
cmp eax, 0x20
jb 0x1001609d
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1a4]
push eax
call fcn.1001618e
lea eax, [ebp - 0x124]
push eax
push eax
call fcn.1001651f
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.10016432
lea eax, [ebp - 0xa4]
push eax
call fcn.10016123
add esp, 0x20
mov al, byte [ebp + esi*4 - 0xa4]
mov byte [edi + esi], al
inc esi
cmp esi, 0x20
jb 0x10016103
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.1003eec9
leave
ret

Function at 0x10016123
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x1007b4bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x20
pop ecx
push 0x10061bd0
mov esi, ebx
lea edi, [ebp - 0x84]
push ebx
rep movsd dword es:[edi], dword [esi]
push ebx
call fcn.10016014
mov ecx, dword [ebx + 0x7c]
lea esi, [ebp - 0x84]
add esp, 0xc
shr ecx, 7
and ecx, 1
neg ecx
sub esi, ebx
push 0x20
pop edx
mov eax, dword [esi + ebx]
xor eax, dword [ebx]
and eax, ecx
xor dword [ebx], eax
lea ebx, [ebx + 4]
sub edx, 1
jne 0x1001616e
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003eec9
leave
ret

Function at 0x10016980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x14]
dec eax
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
sub ebx, edi
sub edi, esi
mov dword [ebp - 4], eax
sub dword [ebp + 0xc], esi
mov dword [ebp + 0x18], 0x40
mov edx, dword [esi]
lea ecx, [edi + esi]
mov eax, dword [ecx + ebx]
xor edx, eax
and edx, dword [ebp - 4]
xor eax, edx
mov dword [ecx], eax
mov eax, dword [esi]
mov ecx, dword [ebp + 0xc]
xor eax, edx
sub dword [ebp + 0x18], 1
mov dword [ecx + esi], eax
lea esi, [esi + 4]
jne 0x100169a5
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10016af9
Capabilities:
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x1007b4bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x6c], eax
mov eax, esi
push edi
mov edi, dword [ebp + 0x14]
or eax, edi
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x68], edi
je 0x10016c4d
mov ecx, dword [ebp + 0x18]
push ebx
push 8
xor ebx, ebx
mov eax, dword [ecx]
mov dword [ebp - 0x14], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x10], eax
pop eax
cmp eax, 0x10
jae 0x10016c5d
mov byte [ebp + eax - 0x14], bl
inc eax
cmp eax, 0x10
jl 0x10016b41
cmp edi, ebx
ja 0x10016b65
cmp esi, 0x40
jae 0x10016b65
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x58], eax
jmp 0x10016bee
lea ecx, [ebp - 0x54]
mov eax, edx
sub eax, ecx
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x58], eax
sub eax, ecx
mov dword [ebp - 0x64], eax
push str.expand_32_byte_k
push dword [ebp - 0x6c]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.100156fc
mov edi, dword [ebp - 0x64]
mov edx, ebx
mov ebx, dword [ebp - 0x60]
add esp, 0x10
lea ecx, [ebp - 0x54]
add ecx, edx
mov al, byte [edi + ecx]
xor al, byte [ecx]
inc edx
mov byte [ebx + ecx], al
cmp edx, 0x40
jl 0x10016b9a
mov edi, dword [ebp - 0x68]
xor ecx, ecx
push 8
xor ebx, ebx
inc ecx
pop edx
movzx eax, byte [ebp + edx - 0x14]
add ecx, eax
mov byte [ebp + edx - 0x14], cl
shr ecx, 8
inc edx
cmp edx, 0x10
jl 0x10016bb8
add esi, 0xffffffc0
push 0x40
adc edi, 0xffffffff
pop eax
add dword [ebp - 0x5c], eax
add dword [ebp - 0x60], eax
add dword [ebp - 0x58], eax
add dword [ebp - 0x64], eax
mov dword [ebp - 0x68], edi
cmp edi, ebx
ja 0x10016b7a
jb 0x10016bee
cmp esi, eax
jae 0x10016b7a
mov eax, esi
or eax, edi
je 0x10016c4c
push str.expand_32_byte_k
push dword [ebp - 0x6c]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.100156fc
add esp, 0x10
cmp edi, ebx
jb 0x10016c4c
ja 0x10016c16
cmp esi, ebx
jbe 0x10016c4c
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x54]
mov edx, dword [ebp - 0x5c]
sub eax, ecx
sub edx, ecx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], edx
lea ecx, [ebp - 0x54]
add ecx, ebx
mov al, byte [eax + ecx]
xor al, byte [ecx]
inc ebx
mov byte [edx + ecx], al
mov eax, ebx
cdq
mov ecx, eax
cmp edx, edi
mov eax, dword [ebp - 0x58]
mov edx, dword [ebp - 0x5c]
jb 0x10016c29
ja 0x10016c4c
cmp ecx, esi
jb 0x10016c29
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.1003eec9
leave
ret
call fcn.1003f10e
int3
Function at 0x10017e0c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
je 0x10017fd4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.PPInit
push eax
call esi
push str.PPInit2
push dword [edi]
mov dword [edi + 4], eax
call esi
push str.PPClose
push dword [edi]
mov dword [edi + 8], eax
call esi
push str.PPSetConfig
push dword [edi]
mov dword [edi + 0xc], eax
call esi
push str.PPGetConfig
push dword [edi]
mov dword [edi + 0x10], eax
call esi
push str.PPDownload
push dword [edi]
mov dword [edi + 0x14], eax
call esi
push str.PPStopTask
push dword [edi]
mov dword [edi + 0x18], eax
call esi
push str.PPRestart
push dword [edi]
mov dword [edi + 0x1c], eax
call esi
push str.PPRemoveTask
push dword [edi]
mov dword [edi + 0x20], eax
call esi
push str.PPStopSeed
push dword [edi]
mov dword [edi + 0x24], eax
call esi
push str.PPCloseHandle
push dword [edi]
mov dword [edi + 0x28], eax
call esi
push str.PPQueryTask
push dword [edi]
mov dword [edi + 0x2c], eax
call esi
push str.PPQueryTaskEx
push dword [edi]
mov dword [edi + 0x30], eax
call esi
push str.PPStartTask
push dword [edi]
mov dword [edi + 0x34], eax
call esi
push str.PPStartTaskEx
push dword [edi]
mov dword [edi + 0x38], eax
call esi
push str._GetTasks
push dword [edi]
mov dword [edi + 0x3c], eax
call esi
push str._StartRun
push dword [edi]
mov dword [edi + 0x44], eax
call esi
push str._StopRun
push dword [edi]
mov dword [edi + 0x48], eax
call esi
push str._Run
push dword [edi]
mov dword [edi + 0x4c], eax
call esi
push str._EnableP2P
push dword [edi]
mov dword [edi + 0x50], eax
call esi
mov dword [edi + 0x54], eax
push str._SetKeep
push dword [edi]
call esi
push str._SetKeepEx
push dword [edi]
mov dword [edi + 0x58], eax
call esi
push str._IsStopped
push dword [edi]
mov dword [edi + 0x5c], eax
call esi
push str._PPQueryTask2
push dword [edi]
mov dword [edi + 0x60], eax
call esi
push str.__PPSetModulePath2
push dword [edi]
mov dword [edi + 0x64], eax
call esi
push str.StartLan
push dword [edi]
mov dword [edi + 0x68], eax
call esi
push str.StopLan
push dword [edi]
mov dword [edi + 0x6c], eax
call esi
push str._PPQueryIPPort
push dword [edi]
mov dword [edi + 0x70], eax
call esi
push str._PPSetLocalLog
push dword [edi]
mov dword [edi + 0x74], eax
call esi
push str._P2SPUpdateRegInfo
push dword [edi]
mov dword [edi + 0x78], eax
call esi
push str._P2SPCheckProxy
push dword [edi]
mov dword [edi + 0x7c], eax
call esi
push str._P2SPCancelCheckProxy
push dword [edi]
mov dword [edi + 0x80], eax
call esi
push str._P2SPSetOption
push dword [edi]
mov dword [edi + 0x84], eax
call esi
push str.PPSetOption
push dword [edi]
mov dword [edi + 0x88], eax
call esi
mov dword [edi + 0x40], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
push 0x1007512c
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x10061c80
push eax
call fcn.10040cb4
int3
Function at 0x10018446
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1007b4bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x20c]
push eax
push 0x1006205c
push dword [esi + 0x34]
call fcn.1000f97f
add esp, 0xc
test eax, eax
jne 0x1001848d
push 6
pop eax
jmp 0x100184de
push dword [ebp + 0x1c]
lea ecx, [ebp - 0x20c]
push 1
push dword [ebp + 0x18]
push 1
push 0x3c
push ecx
push edi
mov ecx, esi
call fcn.1001864f
test eax, eax
jne 0x100184af
inc eax
jmp 0x100184de
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
mov ecx, esi
push dword [ebp + 0x14]
push ebx
push eax
call fcn.10019a94
cmp dword [esi + 8], 0
mov edi, eax
jne 0x100184dc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003eec9
leave
ret 0x18

Function at 0x100184ef
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1007b4bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0x14]
lea ecx, [ebp - 0x20c]
push ecx
mov dword [ebp - 0x218], eax
mov eax, dword [ebp + 0x10]
push 0x100620b8
push eax
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x214], 6
call fcn.1000f97f
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ecx, ebx
push dword [ebp + 0x24]
push 1
push dword [ebp + 0x20]
push 1
push 0x3c
push eax
push esi
call fcn.1001864f
test eax, eax
jne 0x10018569
inc eax
jmp 0x1001863e
xor ebx, ebx
cmp dword [ebp + 0x18], ebx
je 0x100185b0
lea eax, [ebp - 0x20c]
push eax
call fcn.1000f69c
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x100185b0
cmp dword [ebp + 0x1c], eax
je 0x100185b0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x20c]
push eax
push str.only_cab_szTempFileName__s_sign_fail
call fcn.1002137f
pop ecx
pop ecx
push 4
pop eax
jmp 0x1001863e
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
call fcn.10009969
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop ecx
pop ecx
test eax, eax
je 0x10018620
push dword [ebp - 0x218]
push dword [ebp - 0x210]
push edi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x10018620
push edi
call fcn.1000f400
pop ecx
test eax, eax
je 0x10018620
and dword [ebp - 0x214], 0
cmp dword [ebp + 0x18], 0
je 0x10018623
test ebx, ebx
jne 0x10018623
push edi
call fcn.10018ffe
pop ecx
cmp eax, 1
jne 0x10018623
push edi
call fcn.1000f69c
pop ecx
test eax, eax
jne 0x10018623
push edi
push str.lpszDestPath__s_sign_fail
jmp 0x100185a1
push edi
call esi
mov ecx, dword [ebp - 0x21c]
cmp dword [ecx + 8], 0
jne 0x10018638
lea ecx, [ebp - 0x20c]
push ecx
call esi
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003eec9
leave
ret 0x20
Function at 0x10018961
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x1007b4bc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0x620], ebx
jne 0x10018997
push ebx
push esi
call fcn.10018b6b
jmp 0x10018b5a
xor ecx, ecx
mov dword [ebp - 0x624], ecx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x24], ecx
cmp dword [edi + 0x30], ecx
je 0x10018b57
test ebx, ebx
je 0x10018b57
test dword [esi + 0x28], 0x100
je 0x10018a74
lea eax, [ebp - 0x61c]
push eax
push 0x10062144
push dword [edi + 0x34]
call fcn.1000f97f
add esp, 0xc
lea eax, [ebp - 0x61c]
mov ecx, edi
push 2
push 1
push 1
push 1
push 0x3c
push eax
push dword [esi + 0x14]
call fcn.1001864f
test eax, eax
je 0x10018b57
lea eax, [ebp - 0x414]
push eax
push 0x1006214c
push dword [edi + 0x34]
call fcn.1000f97f
add esp, 0xc
xor eax, eax
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x10018b57
lea edx, [ebp - 0x414]
lea ecx, [ebx + 8]
lea edi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, word [ebp - 0x624]
jne 0x10018a3f
sub edx, edi
lea eax, [ebp - 0x414]
sar edx, 1
push edx
push eax
call fcn.10009f28
lea eax, [esi + 4]
push eax
lea ecx, [ebx + 0xc]
call fcn.1000dcf4
xor ecx, ecx
mov eax, ecx
jmp 0x10018b5a
mov eax, dword [esi + 0x1c]
cmp dword [eax - 0xc], ecx
je 0x10018a98
mov eax, dword [ebx + 4]
cmp dword [eax - 0xc], ecx
je 0x10018a98
mov eax, dword [ebx]
cmp dword [eax - 0xc], ecx
je 0x10018a98
push ebx
push esi
mov ecx, edi
call fcn.10018f49
mov ebx, eax
jmp 0x10018a9b
push 5
pop ebx
cmp ebx, 3
je 0x10018aa9
cmp ebx, 5
jne 0x10018b53
push 2
push 1
push 1
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
push dword [esi + 0xc]
push dword [esi + 0x14]
call fcn.10018446
mov ebx, eax
test ebx, ebx
jne 0x10018b53
mov eax, dword [esi + 8]
cmp dword [eax - 0xc], 0x20
jne 0x10018aff
push dword [esi + 0x30]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.1000ee18
add esp, 0xc
test eax, eax
jne 0x10018aff
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 4
pop ebx
jmp 0x10018b53
mov edi, dword [ebp - 0x620]
lea edx, [ebp - 0x20c]
lea eax, [edx + 2]
mov dword [ebp - 0x620], eax
lea ecx, [edi + 8]
mov ax, word [edx]
add edx, 2
cmp ax, word [ebp - 0x624]
jne 0x10018b17
sub edx, dword [ebp - 0x620]
lea eax, [ebp - 0x20c]
sar edx, 1
push edx
push eax
call fcn.10009f28
lea eax, [esi + 4]
push eax
lea ecx, [edi + 0xc]
call fcn.1000dcf4
lea eax, [esi + 8]
push eax
lea ecx, [edi + 0x10]
call fcn.1000dcf4
mov eax, ebx
jmp 0x10018b5a
push 6
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003eec9
leave
ret 0xc