joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100845c0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1029a8f8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x103680b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.10050dd0
push eax
call fcn.10084580
add esp, 4
movzx eax, al
test eax, eax
je 0x1008461f
mov dword [ebp - 0x18], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.100513c0
mov eax, dword [ebp - 0x18]
jmp 0x1008466e
mov ecx, dword [ebp + 0x20]
push ecx
lea ecx, [ebp + 8]
call fcn.10050dd0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1008464f
cmp dword [ebp - 0x10], 0xb7
je 0x1008464f
mov dword [ebp - 0x14], 0
jmp 0x10084656
mov dword [ebp - 0x14], 1
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.100513c0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10084d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10298048
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x103680b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0xffffffff
lea eax, [ebp + 0xc]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0x10]
call fcn.10050dd0
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x10084d9b
push 0x1031aebb
mov ecx, dword [ebp + 8]
call fcn.10051590
mov edx, dword [ebp - 0x2c]
or edx, 1
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp + 8]
jmp 0x10084e63
lea ecx, [ebp - 0x28]
call fcn.10051670
mov dword [ebp - 4], 0
mov dword [ebp - 0x34], 0x400
mov dword [ebp - 0x38], 1
push 0
mov eax, dword [ebp - 0x34]
push eax
lea ecx, [ebp - 0x28]
call fcn.10050cf0
lea ecx, [ebp - 0x34]
push ecx
push 0
lea ecx, [ebp - 0x28]
call fcn.10050f10
push eax
lea edx, [ebp - 0x38]
push edx
push 0
mov ecx, dword [ebp + 0x14]
call fcn.10050dd0
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x30], 0
je 0x10084e2b
push 0x1031aec1
mov ecx, dword [ebp + 8]
call fcn.10051590
mov edx, dword [ebp - 0x2c]
or edx, 1
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.100513c0
mov eax, dword [ebp + 8]
jmp 0x10084e63
push 0
mov eax, dword [ebp - 0x34]
sub eax, 1
push eax
lea ecx, [ebp - 0x28]
call fcn.10050cf0
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp + 8]
call fcn.100514a0
mov edx, dword [ebp - 0x2c]
or edx, 1
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.100513c0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ff9df
mov esp, ebp
pop ebp
ret
Function at 0x10085260
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x103680b4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
jne 0x10085280
xor eax, eax
jmp 0x1008539a
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x238], 0
push 0x22c
push 0
lea eax, [ebp - 0x230]
push eax
call fcn.1026c0f0
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xffffffff
jne 0x100852ca
xor eax, eax
jmp 0x1008539a
mov dword [ebp - 0x230], 0x22c
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1008537d
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.1027046f
add esp, 8
test eax, eax
jne 0x1008535f
mov edx, dword [ebp - 0x228]
push edx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp + 8]
push eax
push 0xf01ff
mov ecx, dword [ebp - 0x23c]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 0x238], eax
mov edx, dword [ebp - 0x23c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x238]
jmp 0x1008539a
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x100852f0
jmp 0x10085387
mov dword [ebp - 0x238], 0
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ff9df
mov esp, ebp
pop ebp
ret
Function at 0x100853b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
test eax, eax
je 0x100853ec
cmp dword [ebp - 4], 0
jne 0x10085406
push 0x10321194
lea edx, [ebp - 4]
push edx
call fcn.10085260
add esp, 8
test eax, eax
jne 0x10085406
jmp 0x10085508
lea eax, [ebp - 8]
push eax
push 1
push 1
push 0
push 0xf01ff
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x100854f7
push 0x44
push 0
lea edx, [ebp - 0x6c]
push edx
call fcn.1026c0f0
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x6c], 0x44
mov dword [ebp - 0x64], str.WinSta0Default
mov ecx, 5
mov word [ebp - 0x3c], cx
mov dword [ebp - 0x40], 1
mov dword [ebp - 0xc], 0
push 0
mov edx, dword [ebp - 8]
push edx
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x10085498
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
jmp 0x10085508
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x430
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x6c]
push ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
jne 0x100854e5
mov dword [ebp - 0x10], 0
jmp 0x10085508
cmp dword [ebp - 0xc], 0
je 0x100854f5
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
jmp 0x10085500
mov dword [ebp - 0x10], 0
jmp 0x10085508
xor ecx, ecx
jne 0x100853cb
cmp dword [ebp - 8], 0
je 0x1008551e
cmp dword [ebp - 8], 0xffffffff
je 0x1008551e
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x10085534
cmp dword [ebp - 4], 0xffffffff
je 0x10085534
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x10085fa0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x103680b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [0x10374b50], eax
mov ecx, dword [ebp + 8]
mov dword [0x10374b48], ecx
mov edx, dword [ebp + 0xc]
mov dword [0x10374e34], edx
mov eax, dword [ebp + 0x14]
mov dword [0x10374e38], eax
mov ecx, dword [ebp + 0x10]
mov dword [0x10374e30], ecx
push 0x200
push 0
lea edx, [ebp - 0x204]
push edx
call fcn.1026c0f0
add esp, 0xc
lea eax, [ebp - 0x204]
push eax
call fcn.10084350
lea ecx, [ebp - 0x204]
push ecx
lea ecx, [ebp - 0x308]
call fcn.100899f0
mov ecx, eax
call fcn.10049320
push eax
mov ecx, dword [0x10374b44]
call sym.nsDui.dll_public:_class_DuiLib::CPaintManagerUI____thiscall_DuiLib::WindowImplBase::GetPaintManagerUI_void_
mov ecx, eax
call sym.nsDui.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const
mov dword [ebp - 0x30c], eax
lea ecx, [ebp - 0x308]
call fcn.10089990
cmp dword [ebp - 0x30c], 0
je 0x100860b2
mov ecx, dword [ebp - 0x30c]
call sym.nsDui.dll_public:_int___thiscall_DuiLib::CTabLayoutUI::GetCurSel_void_const
mov dword [ebp - 0x310], eax
push 1
mov edx, dword [ebp - 0x310]
add edx, 1
push edx
mov eax, dword [ebp - 0x30c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x30c]
mov eax, dword [edx + 0x1e8]
call eax
cmp dword [ebp - 0x310], 0
jne 0x100860b2
cmp dword [0x1037473c], 0
jne 0x100860b2
push 0
push 0
push 0
push 0x10085e80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1037473c], eax
mov ecx, dword [0x1037473c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ff9df
mov esp, ebp
pop ebp
ret
Function at 0x10086220
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x103680b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [0x10374b50], eax
mov ecx, dword [ebp + 8]
mov dword [0x10374b48], ecx
mov edx, dword [ebp + 0xc]
mov dword [0x10374e34], edx
mov eax, dword [ebp + 0x14]
mov dword [0x10374e38], eax
mov ecx, dword [ebp + 0x10]
mov dword [0x10374e30], ecx
push 0x200
push 0
lea edx, [ebp - 0x204]
push edx
call fcn.1026c0f0
add esp, 0xc
lea eax, [ebp - 0x204]
push eax
call fcn.10084350
lea ecx, [ebp - 0x204]
push ecx
lea ecx, [ebp - 0x308]
call fcn.100899f0
mov ecx, eax
call fcn.10049320
push eax
mov ecx, dword [0x10374b44]
call sym.nsDui.dll_public:_class_DuiLib::CPaintManagerUI____thiscall_DuiLib::WindowImplBase::GetPaintManagerUI_void_
mov ecx, eax
call sym.nsDui.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const
mov dword [ebp - 0x30c], eax
lea ecx, [ebp - 0x308]
call fcn.10089990
cmp dword [ebp - 0x30c], 0
je 0x10086332
mov ecx, dword [ebp - 0x30c]
call sym.nsDui.dll_public:_int___thiscall_DuiLib::CTabLayoutUI::GetCurSel_void_const
mov dword [ebp - 0x310], eax
push 1
mov edx, dword [ebp - 0x310]
add edx, 1
push edx
mov eax, dword [ebp - 0x30c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x30c]
mov eax, dword [edx + 0x1e8]
call eax
cmp dword [ebp - 0x310], 0
jne 0x10086332
cmp dword [0x1037473c], 0
jne 0x10086332
push 0
push 0
push 0
push 0x100860c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1037473c], eax
mov ecx, dword [0x1037473c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ff9df
mov esp, ebp
pop ebp
ret

Function at 0x10086510
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x53c
call fcn.100ffbf0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1008653e
push str._fT
mov ecx, dword [ebp - 8]
call fcn.1008c7d0
mov dword [ebp - 0xc], eax
jmp 0x10086545
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
push 0
push accept
push accept
push accept
push accept
push 0x60000
push 0x96c80000
push 0x10321314
mov ecx, dword [0x10374b44]
call sym.nsDui.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
push eax
mov ecx, dword [ebp - 4]
call sym.nsDui.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::Create_struct_HWND_____wchar_t_const___unsigned_long_int__unsigned_long_int__int__int__int__int__struct_HMENU____
mov ecx, dword [ebp - 4]
call sym.nsDui.dll_public:_void___thiscall_DuiLib::CWindowWnd::CenterWindow_void_
mov ecx, dword [ebp - 4]
call sym.nsDui.dll_public:_unsigned_int___thiscall_DuiLib::CWindowWnd::ShowModal_void_
cmp eax, 1
jne 0x100865a7
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x100867b0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x103680b4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x400
push 0
lea eax, [ebp - 0x804]
push eax
call fcn.1026c0f0
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x814], ecx
lea edx, [ebp - 0x804]
mov dword [ebp - 0x80c], edx
mov eax, dword [ebp - 0x80c]
mov dword [ebp - 0x81c], eax
mov ecx, dword [ebp - 0x814]
mov dl, byte [ecx]
mov byte [ebp - 0x805], dl
mov eax, dword [ebp - 0x80c]
mov cl, byte [ebp - 0x805]
mov byte [eax], cl
mov edx, dword [ebp - 0x814]
add edx, 1
mov dword [ebp - 0x814], edx
mov eax, dword [ebp - 0x80c]
add eax, 1
mov dword [ebp - 0x80c], eax
cmp byte [ebp - 0x805], 0
jne 0x100867fa
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x804]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0x400
push 0
lea eax, [ebp - 0x404]
push eax
call fcn.1026c0f0
add esp, 0xc
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x818], ecx
lea edx, [ebp - 0x404]
mov dword [ebp - 0x810], edx
mov eax, dword [ebp - 0x810]
mov dword [ebp - 0x820], eax
mov ecx, dword [ebp - 0x818]
mov dl, byte [ecx]
mov byte [ebp - 0x806], dl
mov eax, dword [ebp - 0x810]
mov cl, byte [ebp - 0x806]
mov byte [eax], cl
mov edx, dword [ebp - 0x818]
add edx, 1
mov dword [ebp - 0x818], edx
mov eax, dword [ebp - 0x810]
add eax, 1
mov dword [ebp - 0x810], eax
cmp byte [ebp - 0x806], 0
jne 0x10086885
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x404]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0
lea eax, [ebp - 0x404]
push eax
lea ecx, [ebp - 0x804]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x100868fc
mov byte [ebp - 0x807], 1
jmp 0x10086903
mov byte [ebp - 0x807], 0
mov al, byte [ebp - 0x807]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ff9df
mov esp, ebp
pop ebp
ret

Function at 0x100872f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
mov dword [0x10374b50], eax
mov ecx, dword [ebp + 8]
mov dword [0x10374b48], ecx
mov edx, dword [ebp + 0xc]
mov dword [0x10374e34], edx
mov eax, dword [ebp + 0x14]
mov dword [0x10374e38], eax
mov ecx, dword [ebp + 0x10]
mov dword [0x10374e30], ecx
push 5
push 0
push 0x10321398
push str.http:__pdf.shipinwuyou.com_protocol.html
push 0x103213b4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebp
ret
Function at 0x10087340
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x89c
mov eax, dword [0x103680b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x88c], 0
push 0
lea ecx, [ebp - 0x89c]
call fcn.10083700
push 0x2001f
push str.SOFTWAREClassesTencent_shellopencommand
push reloc.WS2_32.dll_bind
lea ecx, [ebp - 0x89c]
call fcn.100837a0
test eax, eax
jne 0x1008740d
push 0x800
push 0
lea eax, [ebp - 0x804]
push eax
call fcn.1026c0f0
add esp, 0xc
mov dword [ebp - 0x890], 0x400
lea ecx, [ebp - 0x890]
push ecx
lea edx, [ebp - 0x804]
push edx
push 0
lea ecx, [ebp - 0x89c]
call fcn.10083840
push 0xffffffffffffffff
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0x888]
call sym.nsDui.dll_public:_void___thiscall_DuiLib::CDuiString::constructor_wchar_t_const___int_
lea ecx, [ebp - 0x888]
call sym.nsDui.dll_public:_bool___thiscall_DuiLib::CDuiString::IsEmpty_void_const
movzx ecx, al
test ecx, ecx
jne 0x100873f7
mov dword [ebp - 0x88c], 1
lea ecx, [ebp - 0x89c]
call fcn.10083750
lea ecx, [ebp - 0x888]
call sym.nsDui.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_
cmp dword [ebp - 0x88c], 0
je 0x10087433
push 5
push 0
push str.explorer
push str.tencent:__message__uin2822372562SiteqqMenuyes
push 0x10321600
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x10087449
push 0
push 0x1032160c
push 0x10321618
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x89c]
call fcn.10083730
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ff9df
mov esp, ebp
pop ebp
ret
Function at 0x10087470
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x774
mov eax, dword [0x103680b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [0x10374b50], eax
mov ecx, dword [ebp + 8]
mov dword [0x10374b48], ecx
mov edx, dword [ebp + 0xc]
mov dword [0x10374e34], edx
mov eax, dword [ebp + 0x14]
mov dword [0x10374e38], eax
mov ecx, dword [ebp + 0x10]
mov dword [0x10374e30], ecx
push 0x200
push 0
lea edx, [ebp - 0x404]
push edx
call fcn.1026c0f0
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
call fcn.10084350
push 0x200
push 0
lea ecx, [ebp - 0x204]
push ecx
call fcn.1026c0f0
add esp, 0xc
lea edx, [ebp - 0x204]
push edx
call fcn.10084350
call fcn.10084410
mov dword [ebp - 0x74c], eax
lea ecx, [ebp - 0x758]
call fcn.1008d2b0
push 0
push 0
push 0
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x740]
call fcn.100899f0
mov ecx, eax
call fcn.10049320
push eax
push 0
lea ecx, [ebp - 0x404]
push ecx
lea ecx, [ebp - 0x63c]
call fcn.100899f0
mov ecx, eax
call fcn.10049320
push eax
push 0x1032166c
lea ecx, [ebp - 0x538]
call fcn.100899f0
mov ecx, eax
call fcn.10049320
push eax
lea ecx, [ebp - 0x758]
call fcn.1008dc80
lea ecx, [ebp - 0x538]
call fcn.10089990
lea ecx, [ebp - 0x63c]
call fcn.10089990
lea ecx, [ebp - 0x740]
call fcn.10089990
lea ecx, [ebp - 0x424]
call fcn.10087710
push str.desklink
lea ecx, [ebp - 0x424]
call fcn.10051330
push 0x10321684
lea ecx, [ebp - 0x40c]
call fcn.100897f0
push 0x10321690
lea ecx, [ebp - 0x408]
call fcn.10089870
push 0x103216b4
lea ecx, [ebp - 0x748]
call fcn.100898d0
lea edx, [ebp - 0x748]
push edx
lea eax, [ebp - 0x75c]
push eax
lea ecx, [ebp - 0x758]
call fcn.1008df00
push eax
lea ecx, [ebp - 0x744]
push ecx
call fcn.100896e0
add esp, 0xc
lea ecx, [ebp - 0x75c]
call fcn.100898b0
lea ecx, [ebp - 0x748]
call fcn.100898b0
push 0x103216c0
lea ecx, [ebp - 0x744]
call fcn.100897d0
lea ecx, [ebp - 0x744]
call fcn.10049320
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100876d8
lea ecx, [ebp - 0x758]
call fcn.1008df30
test eax, eax
je 0x10087662
lea ecx, [ebp - 0x744]
call fcn.10049320
push eax
lea ecx, [ebp - 0x758]
call fcn.1008dfc0
cmp dword [ebp - 0x74c], 0
jle 0x100876d8
lea edx, [ebp - 0x764]
push edx
call fcn.10084080
push 0
push 0
push 0
mov eax, dword [ebp - 0x74c]
push eax
lea ecx, [ebp - 0x774]
call fcn.10083fe0
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x76c]
push eax
lea ecx, [ebp - 0x764]
call fcn.100840c0
lea ecx, [ebp - 0x434]
push ecx
lea ecx, [ebp - 0x76c]
call fcn.10084190
lea ecx, [ebp - 0x744]
call fcn.10049320
push eax
lea edx, [ebp - 0x434]
push edx
lea ecx, [ebp - 0x758]
call fcn.1008e140
lea ecx, [ebp - 0x744]
call fcn.100898b0
lea ecx, [ebp - 0x424]
call fcn.10087740
lea ecx, [ebp - 0x758]
call fcn.1008d330
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ff9df
mov esp, ebp
pop ebp
ret
Function at 0x10087800
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1024
call fcn.10100550
mov eax, dword [0x103680b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [0x10374b50], eax
mov ecx, dword [ebp + 8]
mov dword [0x10374b48], ecx
mov edx, dword [ebp + 0xc]
mov dword [0x10374e34], edx
mov eax, dword [ebp + 0x14]
mov dword [0x10374e38], eax
mov ecx, dword [ebp + 0x10]
mov dword [0x10374e30], ecx
push 0x200
push 0
lea edx, [ebp - 0x204]
push edx
call fcn.1026c0f0
add esp, 0xc
lea eax, [ebp - 0x204]
push eax
call fcn.10084350
push 0x200
push 0
lea ecx, [ebp - 0x404]
push ecx
call fcn.1026c0f0
add esp, 0xc
lea edx, [ebp - 0x404]
push edx
call fcn.10084350
call fcn.10084410
mov dword [ebp - 0x1018], eax
lea ecx, [ebp - 0x1024]
call fcn.1008d2b0
cmp dword [ebp - 0x1018], 1
jne 0x10087907
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0xe0c]
call fcn.100899f0
mov ecx, eax
call fcn.10049320
push eax
push 0x103216d8
lea ecx, [ebp - 0xd08]
call fcn.100899f0
mov ecx, eax
call fcn.10049320
push eax
lea ecx, [ebp - 0x1024]
call fcn.1008d360
lea ecx, [ebp - 0xd08]
call fcn.10089990
lea ecx, [ebp - 0xe0c]
call fcn.10089990
jmp 0x1008799e
push 0x800
push 0
lea ecx, [ebp - 0xc04]
push ecx
call fcn.1026c0f0
add esp, 0xc
lea edx, [ebp - 0xc04]
push edx
push 0x3ff
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0xc04]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea ecx, [ebp - 0xc04]
push ecx
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x204]
push edx
lea ecx, [ebp - 0x1014]
call fcn.100899f0
mov ecx, eax
call fcn.10049320
push eax
push 0x103216e4
lea ecx, [ebp - 0xf10]
call fcn.100899f0
mov ecx, eax
call fcn.10049320
push eax
lea ecx, [ebp - 0x1024]
call fcn.1008d360
lea ecx, [ebp - 0xf10]
call fcn.10089990
lea ecx, [ebp - 0x1014]
call fcn.10089990
lea ecx, [ebp - 0x1024]
call fcn.1008d330
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ff9df
mov esp, ebp
pop ebp
ret
Function at 0x10088f30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6e8
mov eax, dword [0x103680b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [0x10374b50], eax
mov ecx, dword [ebp + 8]
mov dword [0x10374b48], ecx
mov edx, dword [ebp + 0xc]
mov dword [0x10374e34], edx
mov eax, dword [ebp + 0x14]
mov dword [0x10374e38], eax
mov ecx, dword [ebp + 0x10]
mov dword [0x10374e30], ecx
push 0x104
push 0
lea edx, [ebp - 0x310]
push edx
call fcn.1026c0f0
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
call fcn.10084350
push 0x104
push 0
lea ecx, [ebp - 0x414]
push ecx
call fcn.1026c0f0
add esp, 0xc
lea edx, [ebp - 0x414]
push edx
call fcn.10084350
push 0x208
push 0
lea eax, [ebp - 0x61c]
push eax
call fcn.1026c0f0
add esp, 0xc
lea ecx, [ebp - 0x61c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0x6e0], 3
mov edx, dword [ebp - 0x6e0]
mov dword [ebp - 0x6e4], edx
mov eax, dword [ebp - 0x6e0]
sub eax, 1
mov dword [ebp - 0x6e0], eax
cmp dword [ebp - 0x6e4], 0
jle 0x100891ee
push 0x208
push 0
lea ecx, [ebp - 0x20c]
push ecx
call fcn.1026c0f0
add esp, 0xc
lea edx, [ebp - 0x61c]
push edx
lea eax, [ebp - 0x20c]
push eax
call fcn.1008b0c0
add esp, 8
push 0x10321a00
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x1008907e
lea eax, [ebp - 0x61c]
push eax
push 0x10321a10
push str.package
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHELL32.dll_PathMakeUniqueName]
lea edx, [ebp - 0x20c]
push edx
call fcn.100886e0
add esp, 4
lea eax, [ebp - 0x310]
push eax
lea ecx, [ebp - 0x634]
call fcn.10051590
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x634]
push edx
lea eax, [ebp - 0x694]
push eax
call fcn.1004ce80
add esp, 8
mov ecx, eax
call fcn.10050770
push eax
call fcn.100e2ab0
add esp, 8
mov dword [ebp - 0x6e8], eax
lea ecx, [ebp - 0x694]
call fcn.100508c0
lea ecx, [ebp - 0x634]
call fcn.100513c0
cmp dword [ebp - 0x6e8], 0
je 0x10089144
lea ecx, [ebp - 0x20c]
push ecx
lea ecx, [ebp - 0x64c]
call fcn.10050a20
lea edx, [ebp - 0x64c]
push edx
lea eax, [ebp - 0x6ac]
push eax
call fcn.1004cd10
add esp, 8
mov ecx, eax
call fcn.10050dd0
push eax
call fcn.10088790
add esp, 4
lea ecx, [ebp - 0x6ac]
call fcn.100513c0
lea ecx, [ebp - 0x64c]
call fcn.100508c0
jmp 0x10088fe4
lea ecx, [ebp - 0x414]
push ecx
lea ecx, [ebp - 0x664]
call fcn.10051590
lea edx, [ebp - 0x664]
push edx
lea eax, [ebp - 0x6c4]
push eax
call fcn.1004ce80
add esp, 8
mov ecx, eax
call fcn.10050770
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.10088bf0
add esp, 8
lea ecx, [ebp - 0x6c4]
call fcn.100508c0
lea ecx, [ebp - 0x664]
call fcn.100513c0
lea edx, [ebp - 0x20c]
push edx
lea ecx, [ebp - 0x67c]
call fcn.10050a20
lea eax, [ebp - 0x67c]
push eax
lea ecx, [ebp - 0x6dc]
push ecx
call fcn.1004cd10
add esp, 8
mov ecx, eax
call fcn.10050dd0
push eax
call fcn.10088790
add esp, 4
lea ecx, [ebp - 0x6dc]
call fcn.100513c0
lea ecx, [ebp - 0x67c]
call fcn.100508c0
jmp 0x100891ee
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ff9df
mov esp, ebp
pop ebp
ret