joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101b85d0
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x101e12b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebx
push ebp
push esi
mov esi, dword [esp + 0x240]
push edi
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.100d21b0
mov ebp, dword [esp + 0x248]
push 0xffffffffffffffff
push ebx
mov ecx, ebp
call fcn.100d21b0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x10], 1
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x10]
test ecx, edx
je 0x101b8709
mov edx, dword [0x102584ac]
mov cx, word [0x102584b0]
mov dword [esp + 0x18], edx
add word [esp + 0x18], ax
lea edx, [esp + 0x18]
mov word [esp + 0x1c], cx
push edx
lea ecx, [esp + 0x28]
mov word [esp + 0x22], bx
call fcn.100cc080
mov eax, dword [esi + 4]
lea ecx, [esp + 0x24]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x244], ebx
call fcn.100d2750
mov edx, dword [0x1020dc58]
mov dword [esp + 0x14], edx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2e]
mov word [esp + 0x2c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x2c]
push 0x104
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x248], 1
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
push edx
mov word [esp + 0x236], bx
call fcn.100ccaa0
mov eax, dword [ebp + 4]
lea ecx, [esp + 0x14]
push ecx
push eax
mov ecx, ebp
call fcn.100d2750
lea ecx, [esp + 0x14]
mov byte [esp + 0x23c], bl
call fcn.100cc820
lea ecx, [esp + 0x24]
mov dword [esp + 0x23c], 0xffffffff
call fcn.100cc820
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
inc eax
shl edx, 1
cmp eax, 0x1a
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], edx
jb 0x101b862b
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x230
ret
Function at 0x101c9112
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ebp, [esi + 0x42c]
lea edi, [esi + 0x2c]
mov ecx, 0x100
xor eax, eax
push ebx
mov dword [esi], ebx
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [ebp], ebx
push 0x80
push 3
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x20]
push ebx
lea edi, [esi + 0xc]
push 7
push SysReAllocStringLen
push eax
mov dword [esi + 8], ebx
mov dword [edi], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], 1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x101c91a2
cmp eax, ebx
je 0x101c91a2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esi + 4]
mov dword [esi + 8], eax
push ebx
push ebp
lea eax, [esi + 0x2c]
push 0x400
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x101c91aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x101c9355
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x101c94a7
xor edx, edx
cmp eax, edx
je 0x101c94a7
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], edx
lea eax, [ebx + ecx]
cmp eax, ebx
jb 0x101c938a
cmp eax, ecx
jb 0x101c938a
xor ecx, ecx
jmp 0x101c938f
mov ecx, 1
mov edi, dword [esi + 0xc]
mov dword [esp + 0x14], ecx
cmp ecx, edi
jl 0x101c93a9
jg 0x101c94a7
cmp eax, dword [esi + 8]
ja 0x101c94a7
cmp ecx, edx
jne 0x101c93c3
cmp eax, dword [esi + 0x42c]
ja 0x101c93c3
lea eax, [ebx + esi + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
mov ebp, dword [esi + 0x1c]
cmp ebp, edx
je 0x101c9408
mov ecx, dword [esi + 0x28]
mov dword [esp + 0x1c], edx
mov edx, dword [esi + 0x24]
lea edi, [edx + ecx]
cmp edi, ecx
jb 0x101c93e3
cmp edi, edx
jb 0x101c93e3
xor edx, edx
jmp 0x101c93e8
mov edx, 1
cmp ecx, ebx
ja 0x101c9408
cmp dword [esp + 0x14], edx
jg 0x101c9408
jl 0x101c93f8
cmp eax, edi
ja 0x101c9408
mov eax, ebp
pop edi
sub eax, ecx
pop esi
add eax, ebx
pop ebp
pop ebx
add esp, 0x10
ret 8
mov eax, dword [esp + 0x28]
mov ecx, esi
push eax
call fcn.101c94c0
test eax, eax
je 0x101c94a7
cmp ebx, 0x7fffffff
push 0
push 0
jbe 0x101c9456
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push SysReAllocString
push ecx
call edi
cmp eax, 0xffffffff
je 0x101c9497
mov eax, dword [esi + 4]
push 1
lea edx, [ebx - 0x7fffffff]
push 0
push edx
push eax
call edi
cmp eax, 0xffffffff
je 0x101c9497
jmp 0x101c9466
mov ecx, dword [esi + 4]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x101c9497
mov ebp, dword [esp + 0x28]
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 4]
lea edi, [esi + 0x24]
push 0
push edi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x101c9497
cmp dword [edi], ebp
jne 0x101c9497
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x28], ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
xor eax, eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 8
Function at 0x101c9770
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x101c9856
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x18]
cmp edi, 3
jl 0x101c97e3
xor edx, edx
xor eax, eax
mov dh, byte [esi]
mov al, byte [esi + 2]
mov dl, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 6
and eax, 0x3f
inc ecx
and edx, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x101c983a
xor edx, edx
mov dl, byte [esi]
shl edx, 0x10
cmp edi, 2
jne 0x101c97f6
xor eax, eax
mov ah, byte [esi + 1]
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
cmp edi, 1
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
jne 0x101c9826
mov ebx, 0x3d
jmp 0x101c9834
shr edx, 6
and edx, 0x3f
xor ebx, ebx
mov bl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], bl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x101c978a
pop esi
pop ebx
mov eax, ebp
pop edi
mov byte [ecx], 0
pop ebp
ret
mov ecx, dword [esp + 0xc]
mov eax, ebp
pop edi
pop ebp
mov byte [ecx], 0
ret
Function at 0x40105b
Capabilities:
Hide graphical window

Disassembly:
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x405022], eax
call sub.kernel32.dll_GetTickCount
push eax
push 0xf7dc
push 0x23bdcb
push eax
call fcn.004035e5
call fcn.00402198
call fcn.00401d82
call fcn.00401bc3
call fcn.0040353c
call sub.kernel32.dll_GetCommandLineA
mov dword [0x40501a], eax
push 0xa
push dword [0x40501a]
push 0
push dword [0x405022]
call 0x40105b
push eax
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xffffff64
push 0x1f4
push dword [ebp + 8]
call sub.user32.dll_LoadIconA
mov dword [0x405026], eax
jmp 0x401086
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], 0x2000
mov dword [ebp - 0x28], 0x4011d3
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
push dword [ebp + 8]
pop dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0x10
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0x401078
push dword [0x405026]
pop dword [ebp - 0x18]
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x14], eax
push dword [0x405026]
pop dword [ebp - 4]
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassExA
mov dword [ebp - 0x50], 0x20a
mov dword [ebp - 0x54], 0x2c6
push 0
call sub.user32.dll_GetSystemMetrics
push eax
push dword [ebp - 0x50]
call fcn.00401452
mov dword [ebp - 0x58], eax
push 1
call sub.user32.dll_GetSystemMetrics
push eax
push dword [ebp - 0x54]
call fcn.00401452
mov dword [ebp - 0x5c], eax
push 0
push dword [ebp + 8]
push 0
push 0
push dword [ebp - 0x54]
push dword [ebp - 0x50]
push dword [ebp - 0x5c]
push dword [ebp - 0x58]
push 0xcf0000
push str.Asm_Pacman___by_VirusFree
push 0x401078
push 0
call sub.user32.dll_CreateWindowExA
mov dword [0x40501e], eax
push 0x258
push dword [ebp + 8]
call sub.user32.dll_LoadMenuA
push eax
push dword [0x40501e]
call sub.user32.dll_SetMenu
push 1
push dword [0x40501e]
call sub.user32.dll_ShowWindow
push dword [0x40501e]
call sub.user32.dll_UpdateWindow
push 0
push dword [0x4050c6]
push 0
push dword [0x40501e]
call sub.user32.dll_SetTimer
push dword [0x40501e]
pop dword [0x405032]
push 0
push 0
push 0
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_GetMessageA
cmp eax, 0
je 0x4011cc
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x4011a4
mov eax, dword [ebp - 0x44]
leave
ret 0x10
Function at 0x401468
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
cmp dword [0x40528a], 0
jne 0x40147c
call fcn.0040353c
call fcn.004023f1
cmp dword [0x40515e], 0
je 0x4015aa
cmp dword [0x40515e], 2
je 0x4015aa
cmp dword [0x40515e], 3
jne 0x401550
call sub.kernel32.dll_GetTickCount
sub eax, dword [0x405142]
cmp dword [0x40513e], eax
jg 0x40154e
cmp dword [0x405146], 1
jae 0x4014e8
mov dword [0x405146], 0
mov dword [0x40515e], 0
call fcn.00402198
call fcn.00401bc3
jmp 0x40154e
push dword [0x40511e]
pop dword [0x405116]
push dword [0x405122]
pop dword [0x40511a]
push edi
push edx
mov dword [ebp - 4], 0xffffffff
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
mov edi, 4
mul edi
push eax
add eax, dword [0x405213]
mov edi, eax
mov eax, dword [0x405233]
mov dword [edi], eax
pop eax
add eax, dword [0x405217]
mov edi, eax
mov eax, dword [0x405237]
mov dword [edi], eax
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [0x40520f]
jl 0x401509
pop edx
pop edi
mov dword [0x40515e], 1
jmp 0x4015aa
cmp dword [0x40515e], 4
jne 0x40158c
call sub.kernel32.dll_GetTickCount
sub eax, dword [0x4051e6]
cmp dword [0x4051e2], eax
jg 0x40158a
mov dword [0x405146], 0
mov dword [0x40515e], 0
call fcn.00402198
call fcn.00401bc3
jmp 0x4015aa
call fcn.00402537
call fcn.004026f4
call fcn.0040294a
call fcn.00402ae8
call fcn.00403317
call fcn.00403498
mov eax, 0
leave
ret
Function at 0x401bc3
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push str.Level.txt
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 4], eax
push 0
push dword [ebp - 4]
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 0
call sub.oleaut32.dll_SysAllocStringByteLen
mov dword [ebp - 0x10], eax
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push dword [ebp - 0x10]
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
push dword [0x4050d6]
push 0
call sub.oleaut32.dll_SysAllocStringByteLen
mov dword [0x4050da], eax
push ecx
push ebx
push edx
mov ebx, dword [0x4050da]
mov ecx, dword [ebp - 0x10]
mov edx, 0xffffffff
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
dec ecx
inc ecx
inc edx
mov eax, 0
mov al, byte [ecx]
cmp al, 0xa
je 0x401d6f
cmp al, 0xd
je 0x401d6f
cmp al, 0x50
jne 0x401cc1
push dword [ebp - 0x18]
pop dword [0x405116]
push dword [ebp - 0x1c]
pop dword [0x40511a]
push eax
push edi
push edx
mov eax, dword [0x4050ca]
mov edi, dword [0x405116]
mul edi
mov dword [0x405116], eax
mov eax, dword [0x4050ca]
mov edi, dword [0x40511a]
mul edi
mov dword [0x40511a], eax
push dword [0x405116]
pop dword [0x40511e]
push dword [0x40511a]
pop dword [0x405122]
pop edx
pop edi
pop eax
cmp al, 0x46
jne 0x401d2b
push edx
push eax
push edi
mov eax, 0xffffffff
inc eax
push eax
mov edi, 4
mul edi
push eax
add eax, dword [0x405213]
mov edi, eax
push edi
mov eax, dword [0x4050ca]
mov edi, dword [ebp - 0x18]
mul edi
pop edi
mov dword [edi], eax
mov dword [0x405233], eax
pop eax
push eax
add eax, dword [0x405217]
mov edi, eax
push edi
mov eax, dword [0x4050ca]
mov edi, dword [ebp - 0x1c]
mul edi
pop edi
mov dword [edi], eax
mov dword [0x405237], eax
pop eax
add eax, dword [0x40521f]
mov edi, eax
mov eax, 1
mov dword [edi], eax
pop eax
cmp eax, dword [0x40520f]
jne 0x401ccd
pop edi
pop eax
pop edx
cmp eax, 0x4f
je 0x401d35
cmp eax, 0x2e
jne 0x401d3b
inc dword [0x4050e6]
cmp eax, 0x26
jne 0x401d52
push dword [ebp - 0x18]
pop dword [0x40525b]
push dword [ebp - 0x1c]
pop dword [0x40525f]
inc dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [0x4050de]
pop eax
jne 0x401d6c
inc dword [ebp - 0x1c]
mov dword [ebp - 0x18], 0
mov byte [ebx], al
inc ebx
cmp edx, dword [ebp - 8]
jl 0x401c50
pop edx
pop ebx
pop ecx
mov eax, 0
leave
ret
Function at 0x403498
Capabilities:
Check for time delay via gettickcount

Disassembly:
call sub.kernel32.dll_GetTickCount
inc dword [0x4052b9]
inc dword [0x4052bd]
inc dword [0x4052c1]
push eax
push dword [0x4052c1]
push dword [0x4052b9]
push dword [0x4052b9]
call fcn.004035e5
cmp dword [0x405132], 1
jne 0x403519
call sub.kernel32.dll_GetTickCount
sub eax, dword [0x40513a]
cmp dword [0x405136], eax
jg 0x403519
mov dword [0x405132], 0
mov dword [0x405207], 0
push 0
push dword [0x40525f]
push dword [0x40525b]
push dword [0x4050da]
call fcn.004028f9
mov edi, eax
mov eax, 0x26
mov byte [edi], al
cmp dword [0x4050e6], 0
jg 0x403536
mov dword [0x40515e], 4
call sub.kernel32.dll_GetTickCount
mov dword [0x4051e2], eax
mov eax, 0
ret

Function at 0x403740
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push 0x4052e0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.kernel32.dll_FindResourceA
or eax, eax
jne 0x403767
push 2
call sub.kernel32.dll_SetLastError
xor eax, eax
leave
ret 8
mov dword [ebp - 4], eax
push eax
push dword [ebp + 8]
call sub.kernel32.dll_LoadResource
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
push dword [ebp + 8]
call sub.kernel32.dll_SizeofResource
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40379d
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.004037d2
jmp 0x4037a6
push 2
call sub.kernel32.dll_SetLastError
xor eax, eax
leave
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1003c180
Capabilities:
Create directory

Disassembly:
sub esp, 0x218
mov eax, dword [0x1006f3c0]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x10074b2c], 0
mov eax, dword [esp + 0x21c]
push esi
mov esi, dword [esp + 0x224]
je 0x1003c1cc
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop esi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.100526fd
add esp, 0x218
ret 8
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.1003bef0
cmp dword [esp + 0x214], 0x104
jl 0x1003c204
push 0xa1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x1003c211
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
cmp edx, eax
je 0x1003c236
mov ecx, edx
shr ecx, 0x10
test ecx, ecx
je 0x1003c236
cmp dword [esp + 4], 0xffffffff
je 0x1003c236
push edx
call fcn.10055458
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.100526fd
add esp, 0x218
ret 8

Function at 0x1003c340
Capabilities:
Delete file

Disassembly:
jmp 0x1003c340
sub esp, 0x218
mov eax, dword [0x1006f3c0]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x10074b2c], 0
mov eax, dword [esp + 0x21c]
je 0x1003c382
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.100526fd
add esp, 0x218
ret 4
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.1003bef0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
lea ecx, [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x1003c3d0
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x1003c3d0
cmp dword [esp + 4], 0xffffffff
je 0x1003c3d0
push eax
call fcn.10055458
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.100526fd
add esp, 0x218
ret 4

Function at 0x1003c5b0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x21c
mov eax, dword [0x1006f3c0]
xor eax, esp
mov dword [esp + 0x218], eax
cmp dword [0x10074b2c], 0
mov eax, dword [esp + 0x220]
mov ecx, dword [esp + 0x224]
je 0x1003c5fa
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.100526fd
add esp, 0x21c
ret 8
push esi
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.1003bce0
mov eax, dword [esp + 0x218]
push dword [esp + 8]
add eax, eax
shr eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 4]
mov esi, eax
call fcn.1003be80
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
cmp edx, eax
je 0x1003c64c
mov ecx, edx
shr ecx, 0x10
test ecx, ecx
je 0x1003c64c
cmp dword [esp + 4], 0xffffffff
je 0x1003c64c
push edx
call fcn.10055458
add esp, 4
mov ecx, dword [esp + 0x21c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.100526fd
add esp, 0x21c
ret 8
Function at 0x1003c670
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x218
mov eax, dword [0x1006f3c0]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x10074b2c], 0
mov eax, dword [esp + 0x21c]
je 0x1003c6b2
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.100526fd
add esp, 0x218
ret 4
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.1003bef0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
lea ecx, [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x1003c700
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x1003c700
cmp dword [esp + 4], 0xffffffff
je 0x1003c700
push eax
call fcn.10055458
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.100526fd
add esp, 0x218
ret 4

Function at 0x1003c720
Capabilities:
Get common file path

Disassembly:
sub esp, 0x21c
mov eax, dword [0x1006f3c0]
xor eax, esp
mov dword [esp + 0x218], eax
cmp dword [0x10074b2c], 0
mov eax, dword [esp + 0x220]
mov ecx, dword [esp + 0x224]
je 0x1003c76a
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.100526fd
add esp, 0x21c
ret 8
push esi
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.1003bce0
mov eax, dword [esp + 0x218]
push dword [esp + 8]
add eax, eax
shr eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 4]
call fcn.1003be80
mov esi, eax
test esi, esi
jle 0x1003c79c
dec esi
lea ecx, [esp + 4]
call fcn.1003be80
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
cmp eax, ecx
je 0x1003c7ca
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x1003c7ca
cmp dword [esp + 4], 0xffffffff
je 0x1003c7ca
push eax
call fcn.10055458
add esp, 4
mov ecx, dword [esp + 0x21c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.100526fd
add esp, 0x21c
ret 8
Function at 0x1003c8d0
Capabilities:
Move file

Disassembly:
jmp 0x1003c8d0
sub esp, 0x42c
mov eax, dword [0x1006f3c0]
xor eax, esp
mov dword [esp + 0x428], eax
cmp dword [0x10074b2c], 0
mov eax, dword [esp + 0x430]
push esi
mov esi, dword [esp + 0x438]
je 0x1003c91c
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
pop esi
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.100526fd
add esp, 0x42c
ret 8
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x220]
mov dword [esp + 0x220], 0
mov dword [esp + 0x224], 0
call fcn.1003bef0
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.1003bef0
push dword [esp + 8]
push dword [esp + 0x220]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov esi, eax
lea ecx, [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x1003c995
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x1003c995
cmp dword [esp + 4], 0xffffffff
je 0x1003c995
push eax
call fcn.10055458
add esp, 4
mov ecx, dword [esp + 0x21c]
lea eax, [esp + 0x220]
mov dword [esp + 8], 0
cmp ecx, eax
je 0x1003c9cb
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x1003c9cb
cmp dword [esp + 0x218], 0xffffffff
je 0x1003c9cb
push ecx
call fcn.10055458
add esp, 4
mov ecx, dword [esp + 0x42c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.100526fd
add esp, 0x42c
ret 8

Function at 0x1003cac0
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x218
mov eax, dword [0x1006f3c0]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x10074b2c], 0
mov eax, dword [esp + 0x220]
push esi
mov esi, dword [esp + 0x220]
je 0x1003cb0c
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
pop esi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.100526fd
add esp, 0x218
ret 8
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.1003bef0
push dword [esp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 8]
mov esi, eax
lea eax, [esp + 0xc]
cmp edx, eax
je 0x1003cb5a
mov ecx, edx
shr ecx, 0x10
test ecx, ecx
je 0x1003cb5a
cmp dword [esp + 4], 0xffffffff
je 0x1003cb5a
push edx
call fcn.10055458
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.100526fd
add esp, 0x218
ret 8