joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000bfb0
Capabilities:
Check if file exists

Disassembly:
push 0x5c
mov eax, 0x100e7b47
call fcn.10077460
mov edi, ecx
call fcn.100058ef
mov ecx, eax
call fcn.10017c13
push eax
lea ecx, [ebp - 0x2c]
call fcn.10001df0
xor ebx, ebx
push str.LatelyCharFace.xml
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.10003cf0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.1001b179
pop ecx
pop ecx
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x48]
lea esi, [edi + 0x588]
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.10001e60
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x1000c018
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000c057
cmp dword [ebp - 0x30], 0x10
mov eax, dword [ebp - 0x44]
jae 0x1000c02f
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x68]
call fcn.10001d80
lea eax, [ebp - 0x68]
push eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.1000b5a7
push ebx
push 1
lea ecx, [ebp - 0x68]
call fcn.10001f70
jmp 0x1000c114
push 0x48
call fcn.10054d4d
pop ecx
mov ecx, eax
mov dword [ebp - 0x4c], ecx
cmp ecx, ebx
mov byte [ebp - 4], 3
je 0x1000c084
cmp dword [esi + 0x18], 0x10
jb 0x1000c077
mov eax, dword [esi + 4]
jmp 0x1000c07a
lea eax, [esi + 4]
push eax
call fcn.100b4b00
mov edi, eax
jmp 0x1000c086
xor edi, edi
push 0x38
mov byte [ebp - 4], 1
call fcn.10054d4d
pop ecx
mov ecx, eax
mov dword [ebp - 0x4c], ecx
cmp ecx, ebx
mov byte [ebp - 4], 4
je 0x1000c0b5
push 0x1011e018
push 0x100f2398
push 0x100f23a0
call fcn.100b5160
jmp 0x1000c0b7
xor eax, eax
push eax
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.100b3ee0
push 0x50
call fcn.10054d4d
pop ecx
mov ecx, eax
mov dword [ebp - 0x4c], ecx
cmp ecx, ebx
mov byte [ebp - 4], 5
je 0x1000c0e4
push 0x100f2390
call fcn.100b5640
jmp 0x1000c0e6
xor eax, eax
push eax
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.100b3ee0
cmp dword [esi + 0x18], 0x10
jb 0x1000c0fd
mov esi, dword [esi + 4]
jmp 0x1000c100
add esi, 4
push esi
mov ecx, edi
call fcn.100b4de0
cmp edi, ebx
je 0x1000c114
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.10001f70
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.10001fc0
xor eax, eax
inc eax
call fcn.100774e3
ret
Function at 0x1000ca86
Capabilities:
Read .ini file

Disassembly:
push 0x28
mov eax, 0x100e7c0b
call fcn.10077460
mov ebx, dword [ebp + 8]
mov esi, ecx
call fcn.10019402
push 8
call fcn.10054d4d
pop ecx
mov ecx, eax
mov dword [ebp - 0x30], ecx
xor edi, edi
cmp ecx, edi
mov dword [ebp - 4], edi
je 0x1000cab9
call fcn.10007ca2
jmp 0x1000cabb
xor eax, eax
or dword [ebp - 4], 0xffffffff
cmp eax, edi
mov dword [esi + 0x200], eax
jne 0x1000cad0
xor eax, eax
jmp 0x1000cb83
push 0x10
call fcn.10054d4d
pop ecx
cmp eax, edi
je 0x1000cae7
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
jmp 0x1000cae9
xor eax, eax
or dword [ebp - 4], 0xffffffff
cmp eax, edi
mov dword [esi + 0x314], eax
je 0x1000cac9
push 8
call fcn.10054d4d
pop ecx
mov ecx, eax
mov dword [ebp - 0x30], ecx
cmp ecx, edi
mov dword [ebp - 4], 2
je 0x1000cb16
call fcn.10007ca2
jmp 0x1000cb18
xor eax, eax
or dword [ebp - 4], 0xffffffff
cmp eax, edi
mov dword [esi + 0x318], eax
je 0x1000cac9
lea eax, [esi + 0xb0]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10003c90
push str.WanNengWBInfo.ini
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 3
call fcn.10003cf0
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x1000cb55
lea eax, [ebp - 0x28]
push eax
push edi
push str.ActivityMode
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push ebx
mov ecx, esi
mov dword [esi + 0x20c], eax
call fcn.1000c679
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.10001fc0
xor eax, eax
inc eax
call fcn.100774e3
ret 4
Function at 0x10012ae7
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3b0]
sub esp, 0x430
mov eax, dword [0x10139d20]
xor eax, ebp
mov dword [ebp + 0x3ac], eax
mov eax, dword [ebp + 0x3b8]
push ebx
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x68]
push eax
xor ebx, ebx
push 9
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x70], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10012b39
xor eax, eax
jmp 0x10012c10
push esi
push edi
mov edi, 0x206
push edi
lea eax, [ebp + 0x1a6]
push ebx
push eax
mov word [ebp + 0x1a4], bx
call fcn.10077be0
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp + 0x1a4]
push eax
mov dword [ebp - 0x6c], ebx
push ebx
jmp 0x10012bf1
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp + 0x1a4]
push eax
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x10012be3
push edi
lea eax, [ebp - 0x62]
push ebx
push eax
mov dword [ebp - 0x78], esi
mov word [ebp - 0x64], bx
call fcn.10077be0
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push str.DisplayName
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10012bda
push dword [ebp - 0x80]
lea eax, [ebp - 0x64]
push eax
call fcn.10079fe3
test eax, eax
pop ecx
pop ecx
je 0x10012bda
mov dword [ebp - 0x74], 1
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x6c]
push esi
lea eax, [ebp + 0x1a4]
push eax
push dword [ebp - 0x6c]
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x10012b6e
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x74]
pop edi
pop esi
mov ecx, dword [ebp + 0x3ac]
xor ecx, ebp
pop ebx
call fcn.100773e8
add ebp, 0x3b0
leave
ret 4
Function at 0x10015206
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x360]
lea ecx, [eax + 0x4a0]
mov eax, dword [ecx]
push 0
call dword [eax]
lea ecx, [eax + 0x4a0]
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, esi
call fcn.1001512c
mov ecx, esi
pop esi
jmp fcn.10014cef
Function at 0x100178b9
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.1001c409
mov dword [esi], eax
call fcn.1001c542
mov dword [esi + 8], eax
call fcn.1001c37f
mov dword [esi + 0xc], eax
call fcn.1001c4f8
mov dword [esi + 0x10], eax
call fcn.1001c464
mov dword [esi + 0x18], eax
call fcn.1001c4ae
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [esi + 0x1c], eax
mov eax, dword [esi]
mov dword [esi + 4], eax
lea eax, [esi + 0x1a0]
push eax
call edi
lea eax, [esi + 0x1b8]
push eax
call edi
lea eax, [esi + 0x1a8]
push eax
call edi
lea eax, [esi + 0x1e8]
push eax
call edi
lea eax, [esi + 0x1c8]
push eax
call edi
lea eax, [esi + 0x1d8]
push eax
call edi
mov eax, dword [0x1013cb74]
pop edi
mov dword [esi + 0x190], eax
pop esi
ret

Function at 0x1001793b
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x10139d20]
xor eax, ebp
mov dword [ebp + 0x9c], eax
push 0x11c
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.10077be0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x7c], 6
jne 0x10017996
xor eax, eax
inc eax
cmp dword [ebp - 0x78], 0
je 0x1001798e
cmp dword [ebp - 0x78], eax
jne 0x10017996
cmp byte [ebp + 0x9a], al
je 0x10017998
xor eax, eax
mov ecx, dword [ebp + 0x9c]
xor ecx, ebp
call fcn.100773e8
add ebp, 0xa0
leave
ret

Function at 0x10017aa3
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10139d20]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push esi
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
mov esi, ecx
call fcn.10077be0
add esp, 0xc
cmp dword [esi + 0x58], 8
jb 0x10017ae2
mov esi, dword [esi + 0x44]
jmp 0x10017ae5
add esi, 0x44
push str.AllSkin
push esi
lea eax, [ebp - 0x20c]
push 0x100f5bf8
push eax
call fcn.100054f5
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
pop esi
jne 0x10017b1e
lea eax, [ebp - 0x20c]
push eax
call fcn.10019493
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100773e8
leave
ret
Function at 0x10017b2a
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x10139d20]
xor eax, ebp
mov dword [ebp + 0x188], eax
and word [ebp - 0x80], 0
push ebx
push esi
push edi
push 0x206
lea eax, [ebp - 0x7e]
push 0
push eax
mov esi, ecx
call fcn.10077be0
add esp, 0xc
cmp dword [esi + 0x3c], 8
jb 0x10017b6d
mov eax, dword [esi + 0x28]
jmp 0x10017b70
lea eax, [esi + 0x28]
push 0x100f5c20
push eax
mov ebx, 0x100f5bf8
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.100054f5
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x10
lea eax, [ebp - 0x80]
push eax
call edi
test eax, eax
jne 0x10017ba3
push eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp dword [esi + 0x3c], 8
jb 0x10017bae
mov esi, dword [esi + 0x28]
jmp 0x10017bb1
add esi, 0x28
push str.Dict
push esi
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.100054f5
add esp, 0x10
lea eax, [ebp - 0x80]
push eax
call edi
test eax, eax
pop edi
pop esi
pop ebx
jne 0x10017bdc
push eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp + 0x188]
xor ecx, ebp
call fcn.100773e8
add ebp, 0x18c
leave
ret

Function at 0x10017c6b
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x5a0]
sub esp, 0x620
mov eax, dword [0x10139d20]
xor eax, ebp
mov dword [ebp + 0x59c], eax
push ebx
push esi
xor ebx, ebx
push 0x206
lea eax, [ebp + 0x396]
push ebx
push eax
mov esi, ecx
mov word [ebp + 0x394], bx
call fcn.10077be0
lea eax, [ebp + 0x394]
push str.SOFTWARE_
push eax
call fcn.100780db
lea eax, [ebp + 0x394]
push str.WanNengWBInput
push eax
call fcn.100780b1
add esp, 0x1c
cmp dword [esi + 0x58], 8
jb 0x10017cd5
mov eax, dword [esi + 0x44]
jmp 0x10017cd8
lea eax, [esi + 0x44]
push eax
lea eax, [ebp + 0x18c]
push eax
call fcn.100780db
cmp dword [esi + 0x3c], 8
pop ecx
pop ecx
jb 0x10017cf2
mov esi, dword [esi + 0x28]
jmp 0x10017cf5
add esi, 0x28
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.100780db
pop ecx
pop ecx
lea eax, [ebp - 0x80]
push eax
push 2
push ebx
lea eax, [ebp + 0x394]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10017d52
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov edi, 0x104
push edi
lea eax, [ebp + 0x18c]
push eax
push 1
push ebx
push str.CfgRootPath
push dword [ebp - 0x80]
call esi
push edi
lea eax, [ebp - 0x7c]
push eax
push 1
push ebx
push str.CfgUserPath
push dword [ebp - 0x80]
call esi
pop edi
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x59c]
pop esi
xor ecx, ebp
pop ebx
call fcn.100773e8
add ebp, 0x5a0
leave
ret
Function at 0x100185b5
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10139d20]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x58], 8
jb 0x100185d6
mov eax, dword [esi + 0x44]
jmp 0x100185d9
lea eax, [esi + 0x44]
push str.Config
push eax
lea eax, [ebp - 0x20c]
push 0x100f5bf8
push eax
call fcn.100054f5
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10018611
lea eax, [ebp - 0x20c]
push eax
call fcn.10019493
pop ecx
lea eax, [ebp - 0x20c]
push str.Config.ini
push eax
call fcn.100780b1
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x5c]
call fcn.10003cc0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100773e8
leave
ret

Function at 0x10018640
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10139d20]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x58], 8
jb 0x10018661
mov eax, dword [esi + 0x44]
jmp 0x10018664
lea eax, [esi + 0x44]
push str.Config
push eax
lea eax, [ebp - 0x20c]
push 0x100f5bf8
push eax
call fcn.100054f5
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1001869c
lea eax, [ebp - 0x20c]
push eax
call fcn.10019493
pop ecx
lea eax, [ebp - 0x20c]
push str.Related.ini
push eax
call fcn.100780b1
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0xe8]
call fcn.10003cc0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100773e8
leave
ret

Function at 0x10018792
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10139d20]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x58], 8
jb 0x100187b3
mov eax, dword [esi + 0x44]
jmp 0x100187b6
lea eax, [esi + 0x44]
push str.UseData
push eax
lea eax, [ebp - 0x20c]
push 0x100f5bf8
push eax
call fcn.100054f5
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100187ee
lea eax, [ebp - 0x20c]
push eax
call fcn.10019493
pop ecx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x158]
call fcn.10003cc0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100773e8
leave
ret
Function at 0x10018ced
Capabilities:
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0x3b8]
sub esp, 0x438
mov eax, dword [0x10139d20]
xor eax, ebp
mov dword [ebp + 0x3b4], eax
push ebx
push esi
push edi
xor esi, esi
push 0x206
lea eax, [ebp + 0x1ae]
push esi
push eax
mov edi, ecx
mov word [ebp + 0x1ac], si
call fcn.10077be0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x228
mov ebx, eax
lea eax, [ebp - 0x7c]
push esi
push eax
mov dword [ebp - 0x80], esi
call fcn.10077be0
add esp, 0xc
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x10018db1
lea eax, [ebp - 0x80]
push eax
push esi
mov dword [ebp - 0x80], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x10018d79
cmp dword [ebp - 0x78], ebx
je 0x10018d7f
lea eax, [ebp - 0x80]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10018d6a
jmp 0x10018d91
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp + 0x1ac]
push eax
call fcn.100780db
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp + 0x1ac]
push eax
call fcn.1007863d
pop ecx
push eax
lea ecx, [edi + 0x174]
call fcn.10003cc0
mov ecx, dword [ebp + 0x3b4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100773e8
add ebp, 0x3b8
leave
ret

Function at 0x10018dc9
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x10139d20]
xor eax, ebp
mov dword [ebp + 0x188], eax
push esi
push edi
xor esi, esi
push 0x206
lea eax, [ebp - 0x7e]
push esi
push eax
mov edi, ecx
mov word [ebp - 0x80], si
call fcn.10077be0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x80]
push eax
mov ecx, edi
call fcn.10017a73
test al, al
jne 0x10018e30
push esi
push 0x1a
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x80]
push eax
call fcn.10077b72
test eax, eax
pop ecx
je 0x10018e7e
mov esi, 0x1011e01c
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.100780b1
lea eax, [ebp - 0x80]
push str.WanNengWBIME
push eax
call fcn.100780b1
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.100780b1
add esp, 0x18
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10018e72
lea eax, [ebp - 0x80]
push eax
call fcn.10019493
pop ecx
lea eax, [ebp - 0x80]
push eax
lea ecx, [edi + 0x40]
call fcn.10003cc0
mov ecx, dword [ebp + 0x188]
pop edi
xor ecx, ebp
pop esi
call fcn.100773e8
add ebp, 0x18c
leave
ret
Function at 0x10018e95
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x10139d20]
xor eax, ebp
mov dword [ebp + 0x188], eax
push esi
push edi
xor esi, esi
push 0x206
lea eax, [ebp - 0x7e]
push esi
push eax
mov edi, ecx
mov word [ebp - 0x80], si
call fcn.10077be0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x80]
push eax
mov ecx, edi
call fcn.10017a73
test al, al
jne 0x10018efc
push esi
push 0x1a
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x80]
push eax
call fcn.10077b72
test eax, eax
pop ecx
je 0x10018f4a
mov esi, 0x1011e01c
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.100780b1
lea eax, [ebp - 0x80]
push str.WanNengWBIME.users
push eax
call fcn.100780b1
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.100780b1
add esp, 0x18
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10018f3e
lea eax, [ebp - 0x80]
push eax
call fcn.10019493
pop ecx
lea eax, [ebp - 0x80]
push eax
lea ecx, [edi + 0x24]
call fcn.10003cc0
mov ecx, dword [ebp + 0x188]
pop edi
xor ecx, ebp
pop esi
call fcn.100773e8
add ebp, 0x18c
leave
ret
Function at 0x10018f61
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0xbc0]
sub esp, 0xc40
mov eax, dword [0x10139d20]
xor eax, ebp
mov dword [ebp + 0xbbc], eax
push ebx
push esi
push edi
xor edi, edi
mov esi, 0x206
push esi
lea eax, [ebp - 0x72]
push edi
push eax
mov dword [ebp - 0x78], ecx
xor ebx, ebx
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x7c], edi
mov word [ebp - 0x74], di
call fcn.10077be0
push esi
lea eax, [ebp + 0x39e]
push edi
push eax
mov word [ebp + 0x39c], di
call fcn.10077be0
push esi
lea eax, [ebp + 0x7ae]
push edi
push eax
mov word [ebp + 0x7ac], di
call fcn.10077be0
push esi
lea eax, [ebp + 0x196]
push edi
push eax
mov word [ebp + 0x194], di
call fcn.10077be0
push esi
lea eax, [ebp + 0x9b6]
push edi
push eax
mov word [ebp + 0x9b4], di
call fcn.10077be0
push esi
lea eax, [ebp + 0x5a6]
push edi
push eax
mov word [ebp + 0x5a4], di
call fcn.10077be0
add esp, 0x48
push edi
push 0x1a
lea eax, [ebp - 0x74]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x9b4]
push eax
call fcn.100780db
lea eax, [ebp + 0x9b4]
push eax
call fcn.10077b72
lea eax, [ebp + 0x9b4]
push 0x5c
push eax
call fcn.1007a69a
add esp, 0x14
cmp eax, edi
je 0x1001916a
mov word [eax], di
lea eax, [ebp + 0x9b4]
push eax
lea eax, [ebp + 0x39c]
push eax
call fcn.100780db
lea eax, [ebp + 0x39c]
push str.Local
push eax
call fcn.100780b1
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x10
lea eax, [ebp + 0x39c]
push eax
call esi
test eax, eax
je 0x1001908d
inc ebx
lea eax, [ebp + 0x9b4]
push eax
lea eax, [ebp + 0x7ac]
push eax
call fcn.100780db
lea eax, [ebp + 0x7ac]
push str.LocalLow
push eax
call fcn.100780b1
add esp, 0x10
lea eax, [ebp + 0x7ac]
push eax
call esi
test eax, eax
je 0x100190c8
mov dword [ebp - 0x80], 1
lea eax, [ebp + 0x9b4]
push eax
lea eax, [ebp + 0x194]
push eax
call fcn.100780db
lea eax, [ebp + 0x194]
push str.Roaming
push eax
call fcn.100780b1
add esp, 0x10
lea eax, [ebp + 0x194]
push eax
call esi
test eax, eax
je 0x10019103
mov dword [ebp - 0x7c], 1
cmp ebx, edi
je 0x1001916a
cmp dword [ebp - 0x80], edi
je 0x1001916a
cmp dword [ebp - 0x7c], edi
je 0x1001916a
mov edi, dword [ebp - 0x78]
mov ecx, edi
call fcn.1001793b
test eax, eax
je 0x1001916a
push str.WanNengWBIME
lea eax, [ebp + 0x7ac]
push eax
lea eax, [ebp + 0x5a4]
push str._s_s_
push eax
call fcn.100054f5
add esp, 0x10
lea eax, [ebp + 0x5a4]
push eax
call esi
test eax, eax
jne 0x10019159
lea eax, [ebp + 0x5a4]
push eax
call fcn.10019493
pop ecx
lea eax, [ebp + 0x5a4]
push eax
lea ecx, [edi + 0x40]
call fcn.10003cc0
jmp 0x10019172
mov ecx, dword [ebp - 0x78]
call fcn.10018dc9
mov ecx, dword [ebp + 0xbbc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100773e8
add ebp, 0xbc0
leave
ret
Function at 0x1001918a
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0xbc0]
sub esp, 0xc40
mov eax, dword [0x10139d20]
xor eax, ebp
mov dword [ebp + 0xbbc], eax
push ebx
push esi
push edi
xor edi, edi
mov esi, 0x206
push esi
lea eax, [ebp - 0x72]
push edi
push eax
mov dword [ebp - 0x78], ecx
xor ebx, ebx
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x7c], edi
mov word [ebp - 0x74], di
call fcn.10077be0
push esi
lea eax, [ebp + 0x39e]
push edi
push eax
mov word [ebp + 0x39c], di
call fcn.10077be0
push esi
lea eax, [ebp + 0x7ae]
push edi
push eax
mov word [ebp + 0x7ac], di
call fcn.10077be0
push esi
lea eax, [ebp + 0x196]
push edi
push eax
mov word [ebp + 0x194], di
call fcn.10077be0
push esi
lea eax, [ebp + 0x9b6]
push edi
push eax
mov word [ebp + 0x9b4], di
call fcn.10077be0
push esi
lea eax, [ebp + 0x5a6]
push edi
push eax
mov word [ebp + 0x5a4], di
call fcn.10077be0
add esp, 0x48
push edi
push 0x1a
lea eax, [ebp - 0x74]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x9b4]
push eax
call fcn.100780db
lea eax, [ebp + 0x9b4]
push eax
call fcn.10077b72
lea eax, [ebp + 0x9b4]
push 0x5c
push eax
call fcn.1007a69a
add esp, 0x14
cmp eax, edi
je 0x10019393
mov word [eax], di
lea eax, [ebp + 0x9b4]
push eax
lea eax, [ebp + 0x39c]
push eax
call fcn.100780db
lea eax, [ebp + 0x39c]
push str.Local
push eax
call fcn.100780b1
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x10
lea eax, [ebp + 0x39c]
push eax
call esi
test eax, eax
je 0x100192b6
inc ebx
lea eax, [ebp + 0x9b4]
push eax
lea eax, [ebp + 0x7ac]
push eax
call fcn.100780db
lea eax, [ebp + 0x7ac]
push str.LocalLow
push eax
call fcn.100780b1
add esp, 0x10
lea eax, [ebp + 0x7ac]
push eax
call esi
test eax, eax
je 0x100192f1
mov dword [ebp - 0x80], 1
lea eax, [ebp + 0x9b4]
push eax
lea eax, [ebp + 0x194]
push eax
call fcn.100780db
lea eax, [ebp + 0x194]
push str.Roaming
push eax
call fcn.100780b1
add esp, 0x10
lea eax, [ebp + 0x194]
push eax
call esi
test eax, eax
je 0x1001932c
mov dword [ebp - 0x7c], 1
cmp ebx, edi
je 0x10019393
cmp dword [ebp - 0x80], edi
je 0x10019393
cmp dword [ebp - 0x7c], edi
je 0x10019393
mov edi, dword [ebp - 0x78]
mov ecx, edi
call fcn.1001793b
test eax, eax
je 0x10019393
push str.WanNengWBIME.users
lea eax, [ebp + 0x7ac]
push eax
lea eax, [ebp + 0x5a4]
push str._s_s_
push eax
call fcn.100054f5
add esp, 0x10
lea eax, [ebp + 0x5a4]
push eax
call esi
test eax, eax
jne 0x10019382
lea eax, [ebp + 0x5a4]
push eax
call fcn.10019493
pop ecx
lea eax, [ebp + 0x5a4]
push eax
lea ecx, [edi + 0x24]
call fcn.10003cc0
jmp 0x1001939b
mov ecx, dword [ebp - 0x78]
call fcn.10018e95
mov ecx, dword [ebp + 0xbbc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100773e8
add ebp, 0xbc0
leave
ret
Function at 0x100193b3
Capabilities:
Check if file exists

Disassembly:
push esi
push 0xffffffffffffffff
lea esi, [ecx + 0x78]
add ecx, 0x40
push 0
push ecx
mov ecx, esi
call fcn.10002540
push str.Skin_
mov ecx, esi
call fcn.10003cf0
cmp dword [esi + 0x18], 8
jb 0x100193dd
mov eax, dword [esi + 4]
jmp 0x100193e0
lea eax, [esi + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10019400
cmp dword [esi + 0x18], 8
jb 0x100193f6
mov esi, dword [esi + 4]
jmp 0x100193f9
add esi, 4
push esi
call fcn.10019493
pop ecx
pop esi
ret

Function at 0x10019493
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [esp + 0x14]
call fcn.10077b72
mov edi, eax
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10054d7d
push dword [esp + 0x1c]
mov esi, eax
push esi
call fcn.100780db
add esp, 0x10
xor ebp, ebp
test edi, edi
mov bl, 1
jl 0x10019502
cmp word [esi + ebp*2], 0x5c
jne 0x100194f9
and word [esi + ebp*2], 0
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100194f3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x10019500
mov word [esi + ebp*2], 0x5c
inc ebp
cmp ebp, edi
jle 0x100194d0
jmp 0x10019502
xor bl, bl
push esi
call fcn.10054d78
pop ecx
pop edi
pop esi
pop ebp
movzx eax, bl
pop ebx
ret