joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10053ed0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10144e03
mov eax, dword fs:[0]
push eax
sub esp, 0x260
push esi
push edi
lea edi, [ebp - 0x26c]
mov ecx, 0x98
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x101b32cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [str.DivXProductConfig]
push eax
lea ecx, [ebp - 0x3c]
call fcn.1000a5e0
mov dword [ebp - 4], 0
push 0x1f4
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.1005b9c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3c]
call fcn.1000b3d0
lea ecx, [ebp - 0x1c]
call fcn.1005bdc0
movzx edx, al
test edx, edx
jne 0x10053f74
mov dword [ebp - 0x268], 0x3f3
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.1005bd60
mov eax, dword [ebp - 0x268]
jmp 0x10054099
mov dword [ebp - 0x50], 0
cmp dword [ebp + 0xc], 0
je 0x10054074
mov esi, esp
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp esi, esp
call fcn.10097d90
test eax, eax
je 0x10054074
mov esi, esp
lea ecx, [ebp - 0x260]
push ecx
push 0x10008
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp esi, esp
call fcn.10097d90
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x10054072
cmp dword [ebp - 0x40], 0
jne 0x1005405c
mov dword [ebp - 0x48], 0x100
mov esi, esp
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x254]
push edx
push 0
mov eax, dword [ebp - 0x260]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp esi, esp
call fcn.10097d90
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x103
jne 0x10054038
mov esi, esp
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp esi, esp
call fcn.10097d90
mov dword [ebp - 0x40], eax
jmp 0x1005405c
cmp dword [ebp - 0x40], 0
jne 0x10054057
lea eax, [ebp - 0x254]
push eax
mov ecx, dword [ebp - 0x260]
push ecx
call fcn.10053ed0
add esp, 8
mov dword [ebp - 0x40], eax
jmp 0x10053fd2
mov esi, esp
mov edx, dword [ebp - 0x260]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.10097d90
jmp 0x1005407b
mov dword [ebp - 0x40], 0x3f2
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x26c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.1005bd60
mov eax, dword [ebp - 0x26c]
push edx
mov ecx, ebp
push eax
lea edx, [0x100540d4]
call fcn.10097d30
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10097dc0
add esp, 0x26c
cmp ebp, esp
call fcn.10097d90
mov esp, ebp
pop ebp
ret
Function at 0x100ae7d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.100ae3f0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100ae802
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x1014f4c4]
call dword [ebp - 8]
jmp 0x100ae80c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret

Function at 0x1010fc05
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1013f600

Function at 0x1010fc1b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1010f482

Function at 0x10125a40
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0x101259d0
push 0x101b9fa4
call fcn.1012eb60
add esp, 8
cmp dword [0x101b3d90], 0xffffffff
je 0x10125a89
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x101b3d90]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x10125a87
push 0x70
push 0x10196dd0
push str.TlsSetValue_current_thread_tls_key__new_data_
call fcn.100df0b0
add esp, 0xc
jmp 0x10125aa1
xor eax, eax
jne 0x10125aa1
push 0x74
push 0x10196e78
push str.false
call fcn.100df0b0
add esp, 0xc
pop ebp
ret

Function at 0x1012ac10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014bf21
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101b32cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.boost::detail::thread_data_base.0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.1012a940
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0xc], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.10129f50
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.1012a080
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.1012a130
mov byte [ebp - 4], 3
push 0
push 1
call fcn.1012f530
add esp, 8
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call fcn.1012a920
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x44], 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10135910
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014ce55
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x101b32cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0xc]
call fcn.10135390
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x1013596c
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1013aa40
add esp, 0xc
mov eax, dword [ebp + 8]
jmp 0x10135aad
mov eax, dword [ebp - 0x30]
and eax, 0x400
je 0x10135a44
mov ecx, dword [ebp + 0xc]
call fcn.10135390
push eax
lea ecx, [ebp - 0x2c]
call fcn.1004cd80
mov dword [ebp - 4], 0
push 0
push 0x2000000
push 3
push 0
push 7
push 0
lea ecx, [ebp - 0x2c]
push ecx
call fcn.1013a8b0
add esp, 0x1c
push eax
lea ecx, [ebp - 0x34]
call fcn.1013a870
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
call fcn.1004cdf0
cmp dword [ebp - 0x34], 0xffffffff
jne 0x101359f3
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1013aa40
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.1013a890
mov eax, dword [ebp + 8]
jmp 0x10135aad
mov edx, dword [ebp + 0xc]
push edx
call fcn.1013a8e0
add esp, 4
movzx eax, al
test eax, eax
jne 0x10135a35
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.1013a630
add esp, 8
push eax
push 9
mov ecx, dword [ebp + 8]
call fcn.1013bef0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.1013a890
mov eax, dword [ebp + 8]
jmp 0x10135aad
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.1013a890
cmp dword [ebp + 0x10], 0
je 0x10135a52
mov ecx, dword [ebp + 0x10]
call fcn.1013d560
mov eax, dword [ebp - 0x30]
and eax, 0x10
je 0x10135a7a
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.1013a630
add esp, 8
push eax
push 3
lea ecx, [ebp - 0x44]
call fcn.1013bef0
mov dword [ebp - 0x38], eax
jmp 0x10135a98
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1013a630
add esp, 8
push eax
push 2
lea ecx, [ebp - 0x4c]
call fcn.1013bef0
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp + 8]
call fcn.1013be60
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10097dc0
mov esp, ebp
pop ebp
ret
Function at 0x10135ad0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov ecx, dword [ebp + 0xc]
call fcn.10135390
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10135b0a
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1013aa40
add esp, 0xc
mov eax, dword [ebp + 8]
jmp 0x10135be5
cmp dword [ebp + 0x10], 0
je 0x10135b18
mov ecx, dword [ebp + 0x10]
call fcn.1013d560
mov eax, dword [ebp - 4]
and eax, 0x400
je 0x10135b8a
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1013a8e0
add esp, 4
movzx edx, al
test edx, edx
je 0x10135b55
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1013a630
add esp, 8
push eax
push 4
lea ecx, [ebp - 0x1c]
call fcn.1013bef0
mov dword [ebp - 8], eax
jmp 0x10135b73
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.1013a630
add esp, 8
push eax
push 9
lea ecx, [ebp - 0x24]
call fcn.1013bef0
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.1013be60
mov eax, dword [ebp + 8]
jmp 0x10135be5
mov eax, dword [ebp - 4]
and eax, 0x10
je 0x10135bb2
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.1013a630
add esp, 8
push eax
push 3
lea ecx, [ebp - 0x2c]
call fcn.1013bef0
mov dword [ebp - 0xc], eax
jmp 0x10135bd0
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1013a630
add esp, 8
push eax
push 2
lea ecx, [ebp - 0x34]
call fcn.1013bef0
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
call fcn.1013be60
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x10136720
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
mov ecx, dword [ebp + 0xc]
call fcn.10135390
push eax
mov ecx, dword [ebp + 8]
call fcn.10135390
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
test eax, eax
jne 0x1013674d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x10136754
mov dword [ebp - 4], 0
push str.boost::filesystem::copy_directory
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.10139ed0
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x10136780
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0x10], 0
jne 0x10136795
mov dword [ebp - 4], 1
jmp 0x1013679c
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.10135390
push eax
mov ecx, dword [ebp + 8]
call fcn.10135390
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x101367c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x101367ce
mov dword [ebp - 8], 0
push str.boost::filesystem::copy_file
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.10139ed0
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x10136b40
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014cfef
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x101b32cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
mov ecx, dword [ebp + 8]
call fcn.10135390
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x10136b92
cmp dword [ebp + 0xc], 0
je 0x10136b8b
mov ecx, dword [ebp + 0xc]
call fcn.1013d560
mov al, 1
jmp 0x10136c53
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x68], eax
lea ecx, [ebp - 0x74]
call fcn.1004cc20
lea eax, [ebp - 0x74]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1013daf0
add esp, 8
movzx edx, al
test edx, edx
je 0x10136bcf
cmp dword [ebp + 0xc], 0
je 0x10136bc8
mov ecx, dword [ebp + 0xc]
call fcn.1013d560
xor al, al
jmp 0x10136c53
cmp dword [ebp + 0xc], 0
jne 0x10136c3f
push str.boost::filesystem::create_directory
lea ecx, [ebp - 0x2c]
call fcn.1000a5e0
mov dword [ebp - 4], 0
call fcn.1004d950
push eax
mov eax, dword [ebp - 0x68]
push eax
lea ecx, [ebp - 0x80]
call fcn.1012a7e0
sub esp, 0xc
mov ecx, esp
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x64]
call fcn.1013c0d0
push 0x101b02dc
lea eax, [ebp - 0x64]
push eax
call fcn.1009cc30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.1000b3d0
jmp 0x10136c51
call fcn.1004d950
push eax
mov ecx, dword [ebp - 0x68]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.1013d360
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10097dc0
mov esp, ebp
pop ebp
ret
Function at 0x10136d50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014d023
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x101b32cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x10136d96
mov dword [ebp - 0x10], 1
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10099b90
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x14]
call fcn.101311f0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.101312b0
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x10136dea
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
jmp 0x10136df1
mov dword [ebp - 0x18], 0
push 0x1019ac34
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.10139ce0
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.101312b0
push eax
mov ecx, dword [ebp + 8]
call fcn.1004ed00
mov ecx, dword [ebp - 0x1c]
or ecx, 1
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10131280
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10139c30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, dword [ebp + 8]
call fcn.10135390
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10139c6b
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x14]
push edx
call fcn.1013aa40
add esp, 0xc
mov ecx, eax
call fcn.1004e8b0
jmp 0x10139cd5
cmp dword [ebp + 0xc], 0
je 0x10139c79
mov ecx, dword [ebp + 0xc]
call fcn.1013d560
mov eax, dword [ebp - 4]
and eax, 0x400
je 0x10139cba
mov ecx, dword [ebp + 8]
push ecx
call fcn.1013a8e0
add esp, 4
movzx edx, al
test edx, edx
je 0x10139cb3
mov eax, dword [ebp - 4]
and eax, 0x10
je 0x10139ca7
mov dword [ebp - 8], 0xb
jmp 0x10139cae
mov dword [ebp - 8], 4
mov eax, dword [ebp - 8]
jmp 0x10139cd5
mov eax, 9
jmp 0x10139cd5
mov ecx, dword [ebp - 4]
and ecx, 0x10
je 0x10139ccb
mov dword [ebp - 0xc], 3
jmp 0x10139cd2
mov dword [ebp - 0xc], 2
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x1013a110
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
call fcn.10135390
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1013a146
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1013a0c0
add esp, 4
movzx eax, al
test eax, eax
jne 0x1013a146
mov dword [ebp - 4], 0
jmp 0x1013a14d
mov dword [ebp - 4], 1
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x1013a160
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
call fcn.10135390
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1013a196
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1013a0c0
add esp, 4
movzx eax, al
test eax, eax
jne 0x1013a196
mov dword [ebp - 4], 0
jmp 0x1013a19d
mov dword [ebp - 4], 1
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x1013ab60
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0
push 0x80
push 3
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
lea ecx, [ebp - 4]
call fcn.1013a870
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
cmp dword [ebp - 4], 0xffffffff
je 0x1013abce
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1013abce
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x1013abce
mov dword [ebp - 8], 1
jmp 0x1013abd5
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 4]
call fcn.1013a890
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x1013abf0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014d730
mov eax, dword fs:[0]
push eax
sub esp, 0x294
mov eax, dword [0x101b32cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0x10]
call fcn.1013e5e0
push eax
lea ecx, [ebp - 0x2c]
call fcn.10004bb0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.1008df00
movzx eax, al
test eax, eax
jne 0x1013aca2
lea ecx, [ebp - 0x2c]
call fcn.10006af0
sub eax, 1
push eax
lea ecx, [ebp - 0x2c]
call fcn.1000bea0
movzx ecx, word [eax]
cmp ecx, 0x5c
je 0x1013ac96
lea ecx, [ebp - 0x2c]
call fcn.10006af0
sub eax, 1
push eax
lea ecx, [ebp - 0x2c]
call fcn.1000bea0
movzx edx, word [eax]
cmp edx, 0x2f
je 0x1013ac96
lea ecx, [ebp - 0x2c]
call fcn.10006af0
sub eax, 1
push eax
lea ecx, [ebp - 0x2c]
call fcn.1000bea0
movzx eax, word [eax]
cmp eax, 0x3a
jne 0x1013aca2
mov dword [ebp - 0x29c], 0x1019b374
jmp 0x1013acac
mov dword [ebp - 0x29c], 0x1019b36c
mov ecx, dword [ebp - 0x29c]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.10135050
lea edx, [ebp - 0x298]
push edx
lea ecx, [ebp - 0x2c]
call fcn.10006750
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0xffffffff
jne 0x1013ad41
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1013ad0b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x1013ad0b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2a0], eax
jmp 0x1013ad15
mov dword [ebp - 0x2a0], 0
call fcn.1004d950
push eax
mov ecx, dword [ebp - 0x2a0]
push ecx
mov ecx, dword [ebp + 8]
call fcn.1012a7e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.100055c0
mov eax, dword [ebp + 8]
jmp 0x1013ae11
lea edx, [ebp - 0x26c]
push edx
mov ecx, dword [ebp + 0x14]
call fcn.10005720
mov eax, dword [ebp - 0x298]
and eax, 0x400
je 0x1013ad76
push 0
mov ecx, dword [ebp + 0x18]
call fcn.1013e220
push 0
mov ecx, dword [ebp + 0x1c]
call fcn.1013e220
jmp 0x1013adf7
mov ecx, dword [ebp - 0x298]
and ecx, 0x10
je 0x1013ad97
push 3
mov ecx, dword [ebp + 0x18]
call fcn.1013e220
push 3
mov ecx, dword [ebp + 0x1c]
call fcn.1013e220
jmp 0x1013adab
push 2
mov ecx, dword [ebp + 0x18]
call fcn.1013e220
push 2
mov ecx, dword [ebp + 0x1c]
call fcn.1013e220
lea edx, [ebp - 0x26c]
push edx
lea ecx, [ebp - 0x48]
call fcn.1004ed00
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x298]
push eax
lea ecx, [ebp - 0x48]
push ecx
call fcn.1013a630
add esp, 8
push eax
mov ecx, dword [ebp + 0x18]
call fcn.1013dcb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.1004cdf0
mov ecx, dword [ebp + 0x18]
call fcn.1013dcd0
push eax
mov ecx, dword [ebp + 0x1c]
call fcn.1013dcb0
mov ecx, dword [ebp + 8]
call fcn.1004cc20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.100055c0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10097dc0
mov esp, ebp
pop ebp
ret
Function at 0x1013e270
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014dc6d
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x101b32cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4c], 0
lea ecx, [ebp - 0x4d]
call fcn.10004b00
push eax
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push eax
lea ecx, [ebp - 0x70]
call fcn.1013bbe0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x70]
call fcn.1013d750
movzx ecx, al
test ecx, ecx
jne 0x1013e31e
lea ecx, [ebp - 0x70]
call fcn.1013df70
push eax
push 0
lea ecx, [ebp - 0x70]
call fcn.1013c880
push eax
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1013e31e
push 0
lea ecx, [ebp - 0x70]
call fcn.1013c880
push eax
lea ecx, [ebp - 0x48]
call fcn.100437e0
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x4c]
or eax, 1
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x58]
mov dword [ebp - 0x54], ecx
jmp 0x1013e338
lea ecx, [ebp - 0x2c]
call fcn.10005280
mov dword [ebp - 0x5c], eax
mov edx, dword [ebp - 0x4c]
or edx, 2
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x60], ecx
mov edx, dword [ebp - 0x60]
push edx
mov ecx, dword [ebp + 8]
call fcn.10004b10
mov eax, dword [ebp - 0x4c]
or eax, 4
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
and ecx, 2
je 0x1013e367
and dword [ebp - 0x4c], 0xfffffffd
lea ecx, [ebp - 0x2c]
call fcn.100055c0
mov edx, dword [ebp - 0x4c]
and edx, 1
je 0x1013e37b
and dword [ebp - 0x4c], 0xfffffffe
lea ecx, [ebp - 0x48]
call fcn.100055c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.1013c580
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10097dc0
mov esp, ebp
pop ebp
ret
Function at 0x864370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x86438e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x88d074
push ecx
mov edi, eax
call fcn.00878198
mov esi, eax
add esp, 8
test esi, esi
jne 0x8643cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0087802e
push esi
call fcn.00877fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret