joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10035ad0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
push ebx
mov ebx, eax
push esi
push edi
test ebx, ebx
jne 0x10035aeb
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
test eax, eax
je 0x10035ae2
mov eax, ebx
call fcn.1000a880
test eax, eax
je 0x10035ae2
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10035b06
mov ecx, dword [ebp + 8]
sub eax, edx
sar eax, 1
test ecx, ecx
je 0x10035b31
lea esi, [ecx + 2]
nop
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x10035b20
sub ecx, esi
sar ecx, 1
jmp 0x10035b33
xor ecx, ecx
lea edi, [ecx + eax + 4]
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
push 0x100c5a78
neg ecx
or ecx, eax
push ecx
call fcn.1008589d
mov esi, eax
add esp, 8
test esi, esi
je 0x10035ae2
mov eax, dword [ebp + 8]
test eax, eax
je 0x10035b77
push eax
push ebx
push 0x100ab5cc
push edi
push esi
call fcn.10084751
add esp, 0x14
jmp 0x10035b87
push ebx
push 0x100ab5e0
push edi
push esi
call fcn.10084751
add esp, 0x10
push 0x40
lea eax, [esp + 0x28]
push 0
push eax
call fcn.10087b80
mov cx, word [ebp + 0xc]
add esp, 0xc
xor eax, eax
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x48], 0x44
mov word [esp + 0x78], cx
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
mov edi, eax
test edi, edi
je 0x10035c0b
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x10035bf7
mov ecx, dword [esp + 0x10]
push eax
push ecx
call dword [sym.imp.USER32.DLL_WaitForInputIdle]
mov edx, dword [esp + 0x14]
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edx
call ebx
mov eax, dword [esp + 0x10]
push eax
call ebx
push esi
call fcn.1008441c
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10037b60
Capabilities:
Check if file exists

Disassembly:
push ecx
push ebx
mov ebx, 1
push esi
push edi
test byte [0x100c7b94], bl
jne 0x10037b8e
mov eax, dword [0x100bc66c]
or dword [0x100c7b94], ebx
push 0x100a35f0
mov dword [0x100c7b90], eax
call fcn.1008416d
add esp, 4
mov esi, 0x100ab6bc
lea ecx, [esp + 0xc]
call fcn.1005e310
mov edi, dword [esp + 0xc]
push edi
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
test eax, eax
je 0x10037bec
test byte [0x100c7ab8], bl
jne 0x10037bc6
or dword [0x100c7ab8], ebx
push 0x100a3620
call fcn.1008416d
add esp, 4
push 0x100ab6e8
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.DLL_OpenEventW]
mov esi, eax
test esi, esi
je 0x10037bec
push esi
call dword [sym.imp.KERNEL32.DLL_PulseEvent]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea ecx, [edi - 0xc]
cmp ecx, 0x100bc65c
je 0x10037c0e
lea esi, [edi - 0xc]
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jg 0x10037c0e
push esi
call fcn.1008441c
add esp, 4
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10039650
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a1950
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x100bb300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], 3
mov dword [ebp - 0x14], 0x10
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x18]
push edx
push 0x100ab0dc
push 0x100a8880
push reloc.OLEAUT32.DLL_SysReAllocString
call dword [sym.imp.SHLWAPI.DLL_SHGetValueW]
test eax, eax
jne 0x10039762
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x38]
lea esi, [ebp - 0x28]
call fcn.100395c0
lea eax, [ebp - 0x48]
lea esi, [ebp - 0x20]
call fcn.100395c0
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x28]
call fcn.10039630
push 0
push 0x15180
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.100943a0
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
cdq
xor eax, edx
sub eax, edx
xor edx, edx
cmp eax, 0x1e
setge dl
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10039920
Capabilities:
Check if file exists

Disassembly:
push ecx
test esi, esi
je 0x100399cd
push ebx
push edi
mov ebx, 0x100ab858
lea edi, [esp + 8]
call fcn.100036f0
mov eax, edi
lea ebx, [esi + 0x14]
push eax
mov eax, ebx
call fcn.10039780
mov eax, dword [esp + 8]
lea ecx, [eax - 0xc]
cmp ecx, 0x100bc65c
je 0x1003996c
lea edi, [eax - 0xc]
push edi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jg 0x1003996c
push edi
call fcn.1008441c
add esp, 4
mov eax, dword [esi + 0xc]
cmp eax, 1
jne 0x100399a2
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
test eax, eax
je 0x100399cb
mov eax, dword [esi + 0x10]
call fcn.1000a880
test eax, eax
je 0x100399cb
mov edx, dword [ebx]
push edx
mov edx, dword [esi + 0x10]
xor ecx, ecx
call fcn.1001e400
add esp, 4
pop edi
pop ebx
pop ecx
ret
cmp eax, 2
jne 0x100399cb
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
test eax, eax
je 0x100399cb
mov eax, dword [esi + 0x10]
call fcn.1000a880
test eax, eax
je 0x100399cb
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
pop edi
pop ebx
pop ecx
ret
Function at 0x10039bf0
Capabilities:
Check if file exists

Disassembly:
push ecx
mov eax, dword [0x100bc66c]
push ebx
push esi
push edi
push 0x100ab928
push 0x100ab928
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax - 8]
push eax
push ecx
lea eax, [esp + 0x1c]
call fcn.10011280
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
mov ebx, dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
lea edx, [esi - 0xc]
mov edi, eax
cmp edx, 0x100bc65c
je 0x10039c51
add esi, 0xfffffff4
push esi
call ebx
test eax, eax
jg 0x10039c51
push esi
call fcn.1008441c
add esp, 4
mov eax, dword [esp + 0x14]
lea ecx, [eax - 0xc]
cmp ecx, 0x100bc65c
je 0x10039c7a
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x10039c7a
mov edx, dword [esp + 0x14]
add edx, 0xfffffff4
push edx
call fcn.1008441c
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x10039c90
Capabilities:
Check if file exists

Disassembly:
push ecx
mov eax, dword [0x100bc66c]
push ebx
push esi
push edi
push 0x100ab8fc
push 0x100ab8fc
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax - 8]
push eax
push ecx
lea eax, [esp + 0x1c]
call fcn.10011280
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
mov ebx, dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
lea edx, [esi - 0xc]
mov edi, eax
cmp edx, 0x100bc65c
je 0x10039cf1
add esi, 0xfffffff4
push esi
call ebx
test eax, eax
jg 0x10039cf1
push esi
call fcn.1008441c
add esp, 4
mov eax, dword [esp + 0x14]
lea ecx, [eax - 0xc]
cmp ecx, 0x100bc65c
je 0x10039d1a
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x10039d1a
mov edx, dword [esp + 0x14]
add edx, 0xfffffff4
push edx
call fcn.1008441c
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x1003c6a0
Capabilities:
Check if file exists

Disassembly:
push ecx
lea eax, [esi + 4]
push eax
call fcn.1005ff00
add esp, 4
test eax, eax
jne 0x1003c6ec
cmp dword [esi + 0x14], eax
je 0x1003c6ec
mov eax, dword [esi + 0x18]
push eax
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
test eax, eax
je 0x1003c6ec
mov eax, dword [esi + 0x18]
call fcn.1000a880
test eax, eax
je 0x1003c6ec
mov eax, dword [esi + 0x14]
cmp eax, 1
jne 0x1003c6da
pop ecx
ret
cmp eax, 2
jne 0x1003c6ec
mov ecx, dword [esi + 0x20]
xor eax, eax
cmp dword [ecx - 8], eax
setne al
pop ecx
ret
xor eax, eax
pop ecx
ret

Function at 0x1003cb20
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x80c
mov eax, dword [0x100bb300]
xor eax, esp
mov dword [esp + 0x808], eax
push esi
test ebx, ebx
jne 0x1003cb53
xor eax, eax
pop esi
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.10083dbb
add esp, 0x80c
ret 0x14
push 0x800
lea eax, [esp + 0xc]
push 0
push eax
call fcn.10087b80
mov edx, dword [0x100c6764]
add esp, 0xc
push 0x400
lea ecx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.DLL_PathRemoveFileSpecW]
lea eax, [esp + 8]
push eax
call esi
lea ecx, [esp + 8]
push ecx
call esi
push 0x100ab818
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.DLL_PathAppendW]
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
test eax, eax
je 0x1003cb39
push edi
lea ecx, [esp + 0xc]
call fcn.1003beb0
mov ecx, dword [esp + 0x814]
push 1
push 0
push 9
push 0x100a9370
lea esi, [esp + 0x14]
mov dword [edi + 0x48], ecx
call fcn.1003e2a0
mov eax, dword [eax]
mov esi, dword [edi + 0x4c]
add esp, 0x10
cmp esi, eax
je 0x1003cc00
mov dword [edi + 0x4c], eax
test eax, eax
je 0x1003cbf4
mov edx, dword [eax]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x1003cc00
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push esi
call edx
mov eax, dword [esp + 4]
test eax, eax
je 0x1003cc10
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push 0
push 0x888888
push 9
push 0x100a9394
lea esi, [esp + 0x14]
call fcn.1003e2a0
mov eax, dword [eax]
mov esi, dword [edi + 0x50]
add esp, 0x10
cmp esi, eax
je 0x1003cc4e
mov dword [edi + 0x50], eax
test eax, eax
je 0x1003cc42
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
test esi, esi
je 0x1003cc4e
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov eax, dword [esp + 4]
test eax, eax
je 0x1003cc5e
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov ecx, dword [esp + 0x818]
mov edx, dword [esp + 0x81c]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x830]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x834]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
push edi
mov eax, ebx
call fcn.1003ccb0
mov ecx, dword [esp + 0x80c]
pop esi
xor ecx, esp
call fcn.10083dbb
add esp, 0x80c
ret 0x14
Function at 0x1003cf90
Capabilities:
Check if file exists

Disassembly:
push ecx
push ebx
push esi
lea esi, [esp + 8]
call fcn.10060990
test byte [0x100c7b48], 1
mov esi, dword [eax]
mov ebx, dword [edi + 0x1c]
jne 0x1003cfc8
or dword [0x100c7b48], 1
push 0x100a3320
mov dword [0x100c7b44], 0
call fcn.1008416d
add esp, 4
push esi
lea ecx, [ebx + 0x12]
push 0x100c7b44
mov edx, 0x100a7638
mov eax, 0x100aaf00
call fcn.10006000
mov eax, dword [esp + 8]
lea ecx, [eax - 0xc]
cmp ecx, 0x100bc65c
je 0x1003d00d
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jg 0x1003d00d
mov edx, dword [esp + 8]
add edx, 0xfffffff4
push edx
call fcn.1008441c
add esp, 4
mov eax, dword [edi + 0x14]
cmp eax, 1
jne 0x1003d044
mov eax, dword [edi + 0x18]
push eax
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
test eax, eax
je 0x1003d06d
mov eax, dword [edi + 0x18]
call fcn.1000a880
test eax, eax
je 0x1003d06d
mov eax, dword [edi + 0x1c]
mov edx, dword [edi + 0x18]
push eax
xor ecx, ecx
call fcn.1001e400
add esp, 4
pop esi
pop ebx
pop ecx
ret
cmp eax, 2
jne 0x1003d06d
mov eax, dword [edi + 0x18]
push eax
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
test eax, eax
je 0x1003d06d
mov eax, dword [edi + 0x18]
call fcn.1000a880
test eax, eax
je 0x1003d06d
mov ecx, dword [edi + 0x18]
push ecx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
pop esi
pop ebx
pop ecx
ret
Function at 0x1003f8d0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x818
mov eax, dword [0x100bb300]
xor eax, esp
mov dword [esp + 0x810], eax
mov eax, dword [esp + 0x820]
push ebx
push ebp
mov ebp, dword [esp + 0x824]
push esi
mov esi, edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
test edi, edi
je 0x1003fa04
test esi, esi
je 0x1003fa04
xor edx, edx
push 0x7fe
push edx
lea eax, [esp + 0x22]
push eax
mov word [esp + 0x24], dx
call fcn.10087b80
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.DLL_PathIsRelativeW]
lea ecx, [esp + 0x18]
test eax, eax
je 0x1003f96d
mov edx, dword [0x100c6764]
push 0x400
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov ebx, dword [sym.imp.SHLWAPI.DLL_PathRemoveFileSpecW]
lea eax, [esp + 0x18]
push eax
call ebx
lea ecx, [esp + 0x18]
push ecx
call ebx
push esi
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.SHLWAPI.DLL_PathAppendW]
jmp 0x1003f9ac
mov edx, 0x3ff
lea eax, [esp + 0x18]
sub esi, ecx
jmp 0x1003f980
lea ecx, [edx + 0x7ffffbff]
test ecx, ecx
je 0x1003f9a0
movzx ecx, word [esi + eax]
test cx, cx
je 0x1003f9a0
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1003f980
jmp 0x1003f9a4
test edx, edx
jne 0x1003f9a7
sub eax, 2
xor edx, edx
mov word [eax], dx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
test eax, eax
je 0x1003fa04
lea eax, [esp + 0x18]
call fcn.1000a880
test eax, eax
je 0x1003fa04
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
test eax, eax
je 0x1003fa04
mov edx, dword [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x1003fa04
mov ecx, dword [esp + 0x10]
mov edx, dword [0x100c7490]
push ecx
push edi
push edx
call eax
xor ecx, ecx
test eax, eax
setne cl
mov dword [ebp], eax
mov eax, ecx
jmp 0x1003fa06
xor eax, eax
mov ecx, dword [esp + 0x81c]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10083dbb
add esp, 0x818
ret 8
Function at 0x10040a20
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
cmp dword [ecx], 0
push ebx
push esi
push edi
mov edi, eax
sete al
mov esi, edx
test al, al
jne 0x10040b9c
cmp dword [edi], 0
sete al
test al, al
jne 0x10040b9c
mov eax, dword [ebp + 8]
push eax
push edi
push ecx
push esi
call fcn.10046170
test eax, eax
je 0x10040b9c
call fcn.100456c0
mov eax, dword [edi]
test eax, eax
jne 0x10040a75
push 0x80004003
call fcn.100830f0
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push eax
mov eax, dword [ecx + 0x40]
call eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.USER32.DLL_CopyRect]
mov eax, dword [esi + 0x34]
test eax, eax
jne 0x10040aa3
push 0x80004003
call fcn.100830f0
mov ecx, dword [eax]
push 1
lea edx, [esp + 0x24]
push edx
push eax
mov eax, dword [ecx + 0x44]
call eax
push esi
call fcn.10042250
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
mov ebx, eax
lea edi, [esp + 0xc]
call fcn.100036f0
mov edi, dword [esp + 0xc]
cmp dword [edi - 8], 0
sete al
mov byte [esi + 0x1b0], al
test al, al
jne 0x10040ae5
mov eax, esi
call fcn.10042cf0
mov ebx, esi
call fcn.100420a0
mov eax, esi
call fcn.10040270
cmp dword [esi + 0x19c], 0xffffffff
jne 0x10040b1b
call fcn.1003e950
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
push 0x10043560
push 0
push 0
push esi
push 0x64
push eax
call edx
mov dword [esi + 0x19c], eax
cmp dword [esi + 0x4c], 0
je 0x10040b6c
mov eax, dword [esi + 0xd0]
mov dword [esi + 0x4c], 0
test eax, eax
je 0x10040b3a
push eax
xor ebx, ebx
call fcn.1000f950
mov ecx, dword [esi + 0xc4]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push 0x100ac558
call edx
mov esi, dword [esi + 0x50]
push ecx
mov ebx, eax
mov eax, esp
mov dword [eax], esi
test esi, esi
je 0x10040b62
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push esi
call ecx
mov edx, ebx
call fcn.1003f5a0
add esp, 4
lea edx, [edi - 0xc]
cmp edx, 0x100bc65c
je 0x10040b8e
lea esi, [edi - 0xc]
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jg 0x10040b8e
push esi
call fcn.1008441c
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10041c00
Capabilities:
Check if file exists
Get common file path

Disassembly:
sub esp, 0x418
mov eax, dword [0x100bb300]
xor eax, esp
mov dword [esp + 0x414], eax
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0xa]
push ecx
mov word [esp + 0xc], ax
call fcn.10087b80
add esp, 0xc
lea edx, [esp]
push edx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.DLL_SHGetFolderPathW]
push 0x100ac360
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHLWAPI.DLL_PathAppendW]
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x216]
push edx
mov word [esp + 0x218], cx
call fcn.10087b80
add esp, 0xc
push 0x100ac380
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x214]
push ecx
call dword [sym.imp.SHLWAPI.DLL_PathCombineW]
lea edx, [esp + 0x20c]
push edx
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
mov ecx, dword [esp + 0x414]
neg eax
sbb eax, eax
xor ecx, esp
inc eax
call fcn.10083dbb
add esp, 0x418
ret

Function at 0x10041cb0
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
test eax, eax
jne 0x10041d1c
mov eax, dword [esp + 8]
mov esi, dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, 0x100bc65c
je 0x10041cef
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x10041cef
mov edx, dword [esp + 8]
add edx, 0xfffffff4
push edx
call fcn.1008441c
add esp, 4
mov eax, dword [esp + 0xc]
lea ecx, [eax - 0xc]
cmp ecx, 0x100bc65c
je 0x10041d18
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x10041d18
mov edx, dword [esp + 0xc]
add edx, 0xfffffff4
push edx
call fcn.1008441c
add esp, 4
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
call fcn.100612a0
mov esi, dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
mov eax, dword [esp + 8]
lea ecx, [eax - 0xc]
je 0x10041ccd
cmp ecx, 0x100bc65c
je 0x10041d5c
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x10041d5c
mov edx, dword [esp + 8]
add edx, 0xfffffff4
push edx
call fcn.1008441c
add esp, 4
mov eax, dword [esp + 0xc]
lea ecx, [eax - 0xc]
cmp ecx, 0x100bc65c
je 0x10041d85
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x10041d85
mov edx, dword [esp + 0xc]
add edx, 0xfffffff4
push edx
call fcn.1008441c
add esp, 4
mov eax, 1
pop esi
ret
Function at 0x10041d90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x24]
push edx
push 0x100ac3a8
push 0x100ac3b8
push reloc.OLEAUT32.DLL_SysReAllocString
mov dword [esp + 0x2c], 0
call dword [sym.imp.SHLWAPI.DLL_SHGetValueW]
cmp dword [esp + 0x14], 0
jne 0x10041e85
call fcn.10041c00
test eax, eax
je 0x10041e85
mov eax, 1
test byte [0x100c7b94], al
jne 0x10041e17
or dword [0x100c7b94], eax
mov eax, dword [0x100bc66c]
push 0x100a35f0
mov dword [0x100c7b90], eax
call fcn.1008416d
add esp, 4
push ecx
mov ebx, 0x100ac3e4
mov edi, esp
call fcn.100036f0
push ecx
mov edi, esp
mov esi, 0x100c7b90
call fcn.1005dc80
push 0x100ac3fc
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
test eax, eax
je 0x10041e4c
push 0x100ac3fc
mov esi, eax
call fcn.10011310
call fcn.10041cb0
add esp, 8
test eax, eax
je 0x10041e85
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x100abef8
call fcn.1005f540
mov edi, dword [esp + 0x14]
add esp, 4
mov ecx, 0x100ac42c
call fcn.10061330
test eax, eax
jne 0x10041e8e
lea esi, [esp + 0x10]
call fcn.100072c0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea esi, [esp + 0x20]
call fcn.1005f200
mov ecx, 0xc
mov edi, ecx
lea esi, [esp + 0x28]
call fcn.1005ef80
mov ecx, dword [eax]
mov edx, dword [esp + 0x20]
cmp edx, ecx
jne 0x10041eb8
mov edx, dword [esp + 0x24]
cmp edx, dword [eax + 4]
setl al
test al, al
je 0x10041ef6
mov ecx, 6
lea edi, [ecx + 5]
lea esi, [esp + 0x30]
call fcn.1005ef80
mov edx, eax
lea esi, [esp + 0x20]
call fcn.1005f1e0
test al, al
je 0x10041ef6
lea esi, [esp + 0x10]
mov edi, 1
call fcn.100072c0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea esi, [esp + 0x10]
xor edi, edi
call fcn.100072c0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10044160
Capabilities:
Check if file exists

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push esi
push eax
mov ecx, 0x100ac104
call fcn.1005f540
mov esi, dword [esp + 0xc]
add esp, 4
push esi
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
test eax, eax
je 0x1004419e
mov eax, esi
call fcn.1000a880
test eax, eax
je 0x1004419e
push 0
mov edx, esi
xor ecx, ecx
call fcn.1001e400
add esp, 4
lea ecx, [esi - 0xc]
cmp ecx, 0x100bc65c
je 0x100441c0
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jg 0x100441c0
push esi
call fcn.1008441c
add esp, 4
xor eax, eax
pop esi
add esp, 8
ret
Function at 0x100450f0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x10
push 0
call fcn.100863d2
mov ecx, eax
mov eax, 0x88888889
mul ecx
add esp, 4
shr edx, 5
mov dword [esp + 8], edx
lea edx, [esp + 4]
push edx
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0x100ac8ec
push 0x100ad100
push SysReAllocString
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 4
mov dword [esp + 0x24], 4
call dword [sym.imp.SHLWAPI.DLL_SHGetValueW]
mov eax, dword [esp]
mov ecx, dword [esp + 8]
lea edx, [eax + 0x5a0]
cmp ecx, edx
ja 0x10045169
add eax, 0xfffffd30
cmp ecx, eax
jb 0x10045169
xor eax, eax
add esp, 0x10
ret
mov eax, dword [esp + 4]
push eax
lea ecx, [esp + 0xc]
push ecx
push 4
push 0x100ac8ec
push 0x100ad100
push SysReAllocString
call dword [sym.imp.SHLWAPI.DLL_SHSetValueW]
mov eax, 1
add esp, 0x10
ret

Function at 0x10045540
Capabilities:
Set registry value

Disassembly:
sub esp, 0x28
push ebx
push esi
push edi
mov edi, eax
mov eax, dword [edi + 0x34]
test eax, eax
jne 0x10045559
push 0x80004003
call fcn.100830f0
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
push 1
push 0x4aa
push eax
mov eax, dword [ecx + 0x108]
mov dword [esp + 0x1c], 0
call eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, esp
mov ebx, eax
mov dword [ecx], eax
mov eax, dword [esp + 0x10]
lea esi, [edi + 0x7c]
test eax, eax
je 0x10045596
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
call fcn.1000a140
test eax, eax
jge 0x100455ac
cmp eax, 0x80004002
je 0x100455ac
push eax
call fcn.100830f0
test ebx, ebx
je 0x100455b8
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
push ebx
call ecx
mov eax, dword [esi]
test eax, eax
jne 0x100455c8
push 0x80004003
call fcn.100830f0
mov edx, dword [eax]
mov edx, dword [edx + 0x40]
lea ecx, [esp + 0x10]
push ecx
push eax
call edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.USER32.DLL_CopyRect]
lea eax, [esp + 0x20]
mov ebx, esi
call fcn.1001a2f0
mov ebx, eax
mov dword [edi + 0x1a8], ebx
test ebx, ebx
je 0x100456ae
mov edx, dword [edi + 0x44]
mov eax, dword [edx + 8]
mov dword [edi + 0x138], eax
push 0
cmp eax, 0xfffffffe
jne 0x1004562d
push 1
mov dword [edi + 0x138], 0x64
mov dword [edi + 0x13c], 1
push 0x64
jmp 0x1004563a
push 0
mov dword [edi + 0x13c], 0
push eax
call fcn.1001d650
cmp dword [edi + 0x138], 0
jl 0x100456ae
call fcn.10048990
mov edi, dword [edi + 0x138]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call fcn.100648f0
cmp edi, 0x64
ja 0x10045688
cmp edi, 0x5a
jl 0x1004566d
xor edi, edi
jmp 0x1004567a
xor ecx, ecx
cmp edi, 0x3c
setl cl
add ecx, 2
mov edi, ecx
cmp edi, dword [eax + 0x14]
je 0x10045688
push esi
mov dword [eax + 0x14], edi
call fcn.10064ec0
push 4
lea edx, [esp + 0x10]
push edx
push 4
push 0x100ad244
push 0x100ad214
push reloc.OLEAUT32.DLL_SysReAllocString
mov dword [esp + 0x24], 1
call dword [sym.imp.SHLWAPI.DLL_SHSetValueW]
pop edi
pop esi
pop ebx
add esp, 0x28
ret