joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004da56
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x10099060]
xor eax, ebp
mov dword [ebp + 0x18c], eax
and dword [ebp - 0x80], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
call fcn.10062cf0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Logs_accelerator
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x7c]
mov ecx, esi
call fcn.10007820
mov ecx, dword [ebp + 0x18c]
xor ecx, ebp
mov eax, esi
call fcn.1005ebcb
add ebp, 0x190
leave
ret

Function at 0x1004dacc
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x10099060]
xor eax, ebp
mov dword [ebp + 0x18c], eax
and dword [ebp - 0x80], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
call fcn.10062cf0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Logsignored
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x7c]
mov ecx, esi
call fcn.10007820
mov ecx, dword [ebp + 0x18c]
xor ecx, ebp
mov eax, esi
call fcn.1005ebcb
add ebp, 0x190
leave
ret

Function at 0x1004e0e1
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x224
lea ebp, [esp - 4]
mov eax, dword [0x10099060]
xor eax, ebp
mov dword [ebp + 0x224], eax
push 4
mov eax, 0x10079697
call fcn.10060091
mov edi, dword [ebp + 0x230]
mov esi, dword [ebp + 0x238]
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp + 0x1c], ax
lea eax, [ebp + 0x1e]
push ebx
push eax
mov dword [ebp - 0x10], ebx
call fcn.10062cf0
add esp, 0xc
push 0x104
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp dword [ebp + 0x234], 1
jne 0x1004e14d
push str.projonepodlp
jmp 0x1004e15b
cmp dword [ebp + 0x234], 2
jne 0x1004e179
push str.projonepotcm
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp esi, ebx
je 0x1004e174
push esi
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp + 0x1c]
jmp 0x1004e1c9
cmp dword [ebp + 0x234], ebx
jne 0x1004e1c4
push ebx
lea eax, [ebp]
push 2
push eax
call fcn.1004e0e1
add esp, 0xc
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x1004e19f
lea eax, [ebp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
push esi
test eax, eax
je 0x1004e1c0
push 2
push edi
call fcn.1004e0e1
add esp, 0xc
lea esi, [ebp]
call fcn.1002fe50
jmp 0x1004e1d0
push 1
jmp 0x1004e1ad
mov eax, 0x10083c60
mov ecx, edi
call fcn.10007820
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.1005ebcb
add ebp, 0x228
leave
ret
Function at 0x1004ecf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [eax + 0x18], 0x10
jb 0x1004ed01
mov eax, dword [eax + 4]
jmp 0x1004ed04
add eax, 4
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push eax
push str.Softwareprojonepodlpkeyrule_secClass_
push 0x80000002
mov dword [ebp - 4], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x1004ed3a
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
call fcn.1003c5d0
leave
ret
xor eax, eax
leave
ret

Function at 0x1004f7b2
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1007c09a
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x10099060]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x14]
push eax
call fcn.1004f33c
pop ecx
and dword [esp + 0x38], 0
and dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x18]
push eax
push dword [ebp + 8]
lea ecx, [esp + 0x1c]
call fcn.10059773
add esp, 0xc
test esi, esi
je 0x1004f831
mov dword [esi], eax
test eax, eax
je 0x1004f831
cmp dword [esp + 0xc], 2
jne 0x1004f831
push str.CryptoMode
call fcn.100029a0
dec eax
dec eax
neg eax
sbb eax, eax
inc eax
pop ecx
mov dword [esi], eax
lea esi, [esp + 0x14]
call fcn.10050a68
push dword [esp + 0x14]
call fcn.1005f31a
mov eax, dword [esp + 0x14]
pop ecx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1004f859
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10099060]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 1
mov esi, ecx
push ebx
push esi
mov dword [ebp - 0x24], esi
call edi
test eax, eax
jne 0x1004f911
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1004f8a2
push 0
xor eax, eax
push ebx
inc eax
call fcn.1003a5fb
push 1
push ebx
push esi
call edi
jmp 0x1004f914
call fcn.1003ab67
push eax
push ebx
push str._s._08x
lea esi, [ebp - 0x20]
call fcn.1003c4c4
mov eax, dword [ebp - 0x1c]
add esp, 0xc
cmp dword [ebp - 8], 8
jae 0x1004f8c5
lea eax, [ebp - 0x1c]
push 1
push eax
push ebx
call edi
test eax, eax
je 0x1004f90d
push 1
push ebx
push dword [ebp - 0x24]
call edi
test eax, eax
je 0x1004f8fb
cmp dword [ebp - 8], 8
mov esi, dword [ebp - 0x1c]
jae 0x1004f8e7
lea esi, [ebp - 0x1c]
call fcn.1003a520
xor edi, edi
inc edi
lea esi, [ebp - 0x20]
call fcn.1002fe50
mov eax, edi
jmp 0x1004f914
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x1004f907
lea eax, [ebp - 0x1c]
push 1
push ebx
push eax
call edi
xor edi, edi
jmp 0x1004f8ef
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1005ebcb
leave
ret
Function at 0x1004f94c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10099060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
xor esi, esi
cmp ebx, esi
je 0x1004fa01
push esi
push ebx
call fcn.100500a5
pop ecx
pop ecx
test eax, eax
je 0x1004fa01
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push esi
push eax
call fcn.10062cf0
add esp, 0xc
call fcn.1003ab67
push eax
push ebx
push str._s._08x
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
push ebx
call fcn.1004f922
pop ecx
lea eax, [ebp - 0x210]
push eax
push ebx
call fcn.1004f6bf
pop ecx
pop ecx
test eax, eax
je 0x1004f9f4
lea ecx, [ebp - 0x210]
call fcn.1004f859
test eax, eax
jne 0x1004fa11
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 5
jl 0x1004f9d7
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1005ebcb
leave
ret
xor eax, eax
inc eax
jmp 0x1004fa03
Function at 0x1004fb19
Capabilities:
Delete file
Get common file path

Disassembly:
push 0x478
mov eax, 0x1007f2be
call fcn.100600fa
mov esi, ecx
push esi
mov dword [ebp - 0x42c], esi
call fcn.1004fa16
pop ecx
test eax, eax
je 0x1004fd73
push esi
call fcn.1004fa5c
pop ecx
test eax, eax
je 0x1004fd73
and dword [ebp - 0x428], 0
xor eax, eax
mov ebx, 0x206
push ebx
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
call fcn.10062cf0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.1003ab67
push eax
push str.___08x
lea esi, [ebp - 0x450]
call fcn.1003c4c4
cmp dword [eax + 0x18], 8
pop ecx
pop ecx
jb 0x1004fba9
mov eax, dword [eax + 4]
jmp 0x1004fbac
add eax, 4
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push eax
lea eax, [ebp - 0x21c]
push eax
call edi
lea esi, [ebp - 0x450]
call fcn.1002fe50
lea esi, [ebp - 0x21c]
call fcn.10039f65
test eax, eax
je 0x1004fd5f
mov ecx, dword [ebp - 0x42c]
mov edx, esi
call fcn.1005b764
test eax, eax
jne 0x1004fd5f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x434], eax
xor esi, esi
push esi
lea eax, [ebp - 0x428]
push esi
mov dword [ebp - 0x430], eax
lea eax, [ebp - 0x434]
push eax
push 0x1004fd7b
push 1
lea eax, [ebp - 0x21c]
push eax
call fcn.10039a23
cmp dword [ebp - 0x428], esi
je 0x1004fd5f
xor eax, eax
push ebx
mov word [ebp - 0x424], ax
lea eax, [ebp - 0x422]
push esi
push eax
call fcn.10062cf0
add esp, 0xc
push dword [ebp - 0x42c]
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 0x42c]
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov ebx, eax
cmp ebx, esi
je 0x1004fc82
push str..rar
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1004fc82
mov ebx, str..zip
push ebx
call fcn.1003ab67
push eax
push str..._08x._s
lea esi, [ebp - 0x450]
call fcn.1003c4c4
add esp, 0xc
cmp dword [eax + 0x18], 8
jb 0x1004fca7
mov eax, dword [eax + 4]
jmp 0x1004fcaa
add eax, 4
push eax
lea eax, [ebp - 0x424]
push eax
call edi
lea esi, [ebp - 0x450]
call fcn.1002fe50
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x468]
push eax
call fcn.10039dde
lea eax, [ebp - 0x484]
xor esi, esi
push eax
lea ecx, [ebp - 0x468]
mov dword [ebp - 4], esi
call fcn.10051773
add esp, 0xc
mov edx, eax
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 1
call fcn.1005b37c
mov ebx, eax
neg ebx
sbb bl, bl
lea eax, [ebp - 0x484]
inc bl
mov byte [ebp - 4], 0
call fcn.10021a30
test bl, bl
je 0x1004fd4a
mov ebx, dword [ebp - 0x42c]
lea ecx, [ebp - 0x424]
call fcn.1004f859
test eax, eax
jne 0x1004fd50
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 5
jl 0x1004fd18
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1004fd50
mov dword [ebp - 0x428], esi
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x468]
call fcn.10007d10
lea eax, [ebp - 0x21c]
push eax
call fcn.1003a54e
mov eax, dword [ebp - 0x428]
jmp 0x1004fd75
xor eax, eax
call fcn.1006017d
ret
Function at 0x1004fd9c
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x10099060]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
test ebx, ebx
je 0x1004fea1
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1004fea1
and dword [esp + 0x10], 0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x20], ax
lea eax, [esp + 0x22]
push eax
call fcn.10062cf0
add esp, 0xc
call fcn.1003ab67
push eax
push ebx
push str._s._08x
lea eax, [esp + 0x24]
push 0x104
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
push ebx
call fcn.1004f922
pop ecx
lea eax, [esp + 0x18]
push eax
push ebx
call fcn.1004f75b
xor esi, esi
pop ecx
inc esi
pop ecx
test eax, eax
je 0x1004fe74
and dword [esp + 0x14], 0
lea ecx, [esp + 0x18]
call fcn.1004f859
test eax, eax
jne 0x1004fe56
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 5
jl 0x1004fe34
jmp 0x1004fe74
cmp dword [ebp + 0xc], 2
mov dword [esp + 0x10], esi
jne 0x1004fe74
push 2
mov ecx, ebx
call fcn.1004fb19
pop ecx
test eax, eax
je 0x1004fe74
test edi, edi
je 0x1004fe74
mov dword [edi], esi
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp + 0xc], esi
jne 0x1004fe9b
push esi
mov ecx, ebx
call fcn.1004fb19
pop ecx
test eax, eax
je 0x1004fe9b
mov dword [esp + 0x10], esi
test edi, edi
je 0x1004fe9b
mov dword [edi], esi
mov eax, dword [esp + 0x10]
jmp 0x1004fea3
xor eax, eax
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1005ebcb
mov esp, ebp
pop ebp
ret
Function at 0x100527ca
Capabilities:
Check if file exists

Disassembly:
push 0xbc
mov eax, 0x1007f4b6
call fcn.100600fa
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x18]
mov dword [ebp - 0xac], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0xb0], edx
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0xb4], edx
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xc0], ecx
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xbc], edx
test edi, edi
je 0x10052a40
test eax, eax
je 0x10052a40
test ecx, ecx
je 0x10052a40
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1005283f
push 4
jmp 0x10052a42
push edi
call fcn.10025220
pop ecx
test eax, eax
jne 0x10052851
push 0xd
jmp 0x10052a42
push edi
call fcn.10039f7d
mov esi, edx
mov dword [ebp - 0xc8], eax
or eax, esi
jne 0x1005286a
push 7
jmp 0x10052a42
xor eax, eax
cmp esi, eax
ja 0x1005287c
cmp dword [ebp - 0xc8], 0x40000000
jbe 0x10052883
push 6
jmp 0x10052a42
push eax
push eax
push 3
push eax
push 7
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xa4], eax
test eax, eax
je 0x100528a5
cmp eax, 0xffffffff
jne 0x100528b7
lea ecx, [ebp - 0xa4]
call fcn.10001340
push 5
jmp 0x10052a42
lea ecx, [ebp - 0xa4]
call fcn.10001340
mov eax, dword [ebp - 0xc8]
shrd eax, esi, 0xb
mov dword [ebp - 0xa4], eax
shr esi, 0xb
mov eax, esi
mov esi, dword [ebp - 0xa4]
lea eax, [ebp - 0xa0]
push eax
add esi, 0x1388
call fcn.100519dc
and dword [ebp - 4], 0
lea eax, [ebp - 0x9c]
push eax
mov eax, edi
mov dword [ebp - 0xa0], 1
call fcn.10007890
lea eax, [ebp - 0x80]
push eax
mov eax, dword [ebp - 0xa8]
call fcn.10007890
push 0xffffffffffffffff
push 0
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x48]
call fcn.10008360
push 0xffffffffffffffff
push 0
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x2c]
call fcn.10008360
push edi
call fcn.100524f4
pop ecx
push dword [ebp - 0xa8]
call fcn.100524f4
pop ecx
push edi
call fcn.1005251e
pop ecx
push dword [ebp - 0xbc]
lea eax, [ebp - 0xa0]
push 0
push ebx
push esi
push eax
call fcn.10051f72
add esp, 0x14
push edi
mov dword [ebp - 0xa4], eax
call fcn.1005265d
xor esi, esi
pop ecx
cmp dword [ebp - 0xa4], esi
jne 0x10052a2d
push edi
call fcn.100524f4
pop ecx
push dword [ebp - 0xa8]
call fcn.100524f4
pop ecx
cmp dword [ebx + 0x14], esi
jne 0x100529c5
push 0xffffffffffffffff
push esi
push dword [ebp - 0xb4]
mov ecx, ebx
call fcn.10008360
push 0xffffffffffffffff
push esi
push dword [ebp - 0xb0]
lea ecx, [ebx + 0x1c]
call fcn.10008360
mov eax, dword [ebp - 0xb4]
mov edx, ebx
call fcn.1000ba20
cmp dword [ebp - 0xac], esi
jne 0x10052a08
push dword [ebp - 0xa8]
mov ebx, str..docwmtmp
call fcn.1003c47d
mov ebx, dword [ebp - 0xb8]
test eax, eax
je 0x100529fc
mov dword [ebp - 0xac], edi
jmp 0x10052a08
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xac], eax
mov ecx, dword [ebp - 0xb0]
lea eax, [ebx + 0x1c]
push eax
push ebx
push dword [ebp - 0xac]
push dword [ebp - 0xc0]
push dword [ebp - 0xa8]
call fcn.100520d6
add esp, 0x14
lea edi, [ebp - 0xa0]
call fcn.10051efc
mov eax, dword [ebp - 0xa4]
jmp 0x10052a43
push 3
pop eax
call fcn.1006017d
ret
Function at 0x10052b25
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push 0x40
mov eax, 0x1007f691
call fcn.100600fa
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x14]
mov edi, ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x18]
xor esi, esi
mov ebx, edx
mov dword [ebp - 0x48], eax
cmp edi, esi
je 0x10052cb5
cmp ebx, esi
je 0x10052cb5
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10052b77
push 4
jmp 0x10052cb7
push edi
call fcn.10025220
pop ecx
test eax, eax
jne 0x10052b89
push 0xd
jmp 0x10052cb7
push edi
mov dword [ebp - 0x34], esi
call fcn.1003a5da
test eax, eax
je 0x10052bb2
push esi
xor eax, eax
push edi
inc eax
call fcn.1003a5fb
test eax, eax
jne 0x10052bab
push 5
jmp 0x10052cb7
mov dword [ebp - 0x34], 1
push esi
push esi
push 3
push esi
push esi
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x30], eax
cmp eax, esi
je 0x10052bd0
cmp eax, 0xffffffff
jne 0x10052be9
cmp dword [ebp - 0x34], esi
je 0x10052bdf
push 1
push edi
xor eax, eax
call fcn.1003a5fb
lea ecx, [ebp - 0x30]
call fcn.10001340
jmp 0x10052ba4
lea ecx, [ebp - 0x30]
call fcn.10001340
lea esi, [ebp - 0x2c]
call fcn.10052aa4
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x10052c09
lea eax, [ebp - 0x28]
push dword [ebp - 0x48]
mov edx, dword [ebp - 0x40]
push dword [ebp - 0x38]
mov ecx, ebx
push dword [ebp - 0x44]
push dword [ebp - 0x3c]
push eax
push edi
call fcn.10052a49
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x10052c86
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [ebp - 0x14], 8
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
jae 0x10052c40
lea eax, [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 1
push edi
push eax
call esi
test eax, eax
jne 0x10052c76
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x10052c67
lea eax, [ebp - 0x28]
push 1
push edi
push eax
call esi
test eax, eax
jne 0x10052c76
push 8
pop ebx
jmp 0x10052c86
cmp dword [ebp - 0x30], 0xffffffff
je 0x10052c86
push dword [ebp - 0x30]
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x10052c92
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x34], 0
je 0x10052ca9
push 1
push edi
xor eax, eax
call fcn.1003a5fb
lea esi, [ebp - 0x2c]
call fcn.1002fe50
mov eax, ebx
jmp 0x10052cb8
push 3
pop eax
call fcn.1006017d
ret
Function at 0x10052d16
Capabilities:
Check if file exists

Disassembly:
push 0xd0
mov eax, 0x1007f661
call fcn.100600fa
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa8], ecx
mov ecx, dword [ebp + 0xc]
mov edi, edx
mov dword [ebp - 0xb0], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xac], ecx
test edi, edi
je 0x10052f27
test esi, esi
je 0x10052f27
test eax, eax
je 0x10052f27
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10052d72
push 4
jmp 0x10052f29
push edi
call fcn.10025220
pop ecx
test eax, eax
jne 0x10052d84
push 0xd
jmp 0x10052f29
push edi
call fcn.10039f7d
mov ebx, edx
mov dword [ebp - 0xc0], eax
or eax, ebx
jne 0x10052d9d
push 7
jmp 0x10052f29
xor eax, eax
cmp ebx, eax
ja 0x10052daf
cmp dword [ebp - 0xc0], 0x40000000
jbe 0x10052db6
push 6
jmp 0x10052f29
push eax
push eax
push 3
push eax
push 7
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xa4], eax
test eax, eax
je 0x10052dd8
cmp eax, 0xffffffff
jne 0x10052dea
lea ecx, [ebp - 0xa4]
call fcn.10001340
push 5
jmp 0x10052f29
lea ecx, [ebp - 0xa4]
call fcn.10001340
push edi
call fcn.10003460
pop ecx
test al, al
jne 0x10052e07
push 2
jmp 0x10052f29
mov eax, dword [ebp - 0xc0]
shrd eax, ebx, 0xb
shr ebx, 0xb
mov ebx, eax
mov eax, 0x7d0
cmp ebx, eax
jae 0x10052e21
mov ebx, eax
lea eax, [ebp - 0xa0]
push eax
call fcn.100519dc
and dword [ebp - 4], 0
lea eax, [ebp - 0x9c]
push eax
mov eax, edi
mov dword [ebp - 0xa0], 2
call fcn.10007890
lea eax, [ebp - 0x80]
push eax
mov eax, esi
call fcn.10007890
push edi
call fcn.100524f4
pop ecx
push esi
call fcn.100524f4
pop ecx
push edi
call fcn.1005251e
pop ecx
push dword [ebp - 0xb0]
lea eax, [ebp - 0xa0]
push 1
push dword [ebp - 0xac]
push ebx
push eax
call fcn.10051f72
add esp, 0x14
push edi
mov dword [ebp - 0xa4], eax
call fcn.1005265d
cmp dword [ebp - 0xa4], 0
pop ecx
jne 0x10052f14
push edi
call fcn.100524f4
pop ecx
push esi
call fcn.100524f4
cmp dword [ebp - 0xa8], 0
pop ecx
jne 0x10052ecf
push esi
mov ebx, str..docwmtmp
call fcn.1003c47d
mov dword [ebp - 0xa8], edi
test eax, eax
jne 0x10052ecf
mov dword [ebp - 0xa8], esi
push 0x10083c5f
lea ecx, [ebp - 0xdc]
call fcn.10007750
mov eax, dword [ebp - 0xac]
lea ecx, [eax + 0x1c]
push ecx
push eax
push dword [ebp - 0xa8]
lea ecx, [ebp - 0xdc]
push dword [ebp - 0xb4]
mov byte [ebp - 4], 1
push esi
call fcn.100520d6
add esp, 0x14
lea ecx, [ebp - 0xdc]
call fcn.100077c0
lea edi, [ebp - 0xa0]
call fcn.10051efc
mov eax, dword [ebp - 0xa4]
jmp 0x10052f2a
push 3
pop eax
call fcn.1006017d
ret
Function at 0x10052f85
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push 0x38
mov eax, 0x1007f706
call fcn.100600fa
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
mov edi, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x10]
xor esi, esi
mov ebx, edx
mov dword [ebp - 0x38], eax
cmp edi, esi
je 0x10053105
cmp ebx, esi
je 0x10053105
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10052fcb
push 4
jmp 0x10053107
push edi
call fcn.10025220
pop ecx
test eax, eax
jne 0x10052fdd
push 0xd
jmp 0x10053107
push edi
mov dword [ebp - 0x34], esi
call fcn.1003a5da
test eax, eax
je 0x10053006
push esi
xor eax, eax
push edi
inc eax
call fcn.1003a5fb
test eax, eax
jne 0x10052fff
push 5
jmp 0x10053107
mov dword [ebp - 0x34], 1
push esi
push esi
push 3
push esi
push esi
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x30], eax
cmp eax, esi
je 0x10053024
cmp eax, 0xffffffff
jne 0x1005303d
cmp dword [ebp - 0x34], esi
je 0x10053033
push 1
push edi
xor eax, eax
call fcn.1003a5fb
lea ecx, [ebp - 0x30]
call fcn.10001340
jmp 0x10052ff8
lea ecx, [ebp - 0x30]
call fcn.10001340
lea esi, [ebp - 0x2c]
call fcn.10052aa4
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x1005305d
lea eax, [ebp - 0x28]
push dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
push dword [ebp - 0x40]
mov edx, edi
push ebx
push eax
call fcn.10052f30
add esp, 0x10
mov dword [ebp - 0x30], eax
test eax, eax
jne 0x100530d5
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [ebp - 0x14], 8
mov ebx, eax
mov eax, dword [ebp - 0x28]
jae 0x1005308e
lea eax, [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 1
push edi
push eax
call esi
test eax, eax
jne 0x100530c8
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x100530b5
lea eax, [ebp - 0x28]
push 1
push edi
push eax
call esi
test eax, eax
jne 0x100530c8
mov dword [ebp - 0x30], 8
jmp 0x100530d5
cmp ebx, 0xffffffff
je 0x100530d5
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x100530e1
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x34], 0
je 0x100530f8
push 1
push edi
xor eax, eax
call fcn.1003a5fb
lea esi, [ebp - 0x2c]
call fcn.1002fe50
mov eax, dword [ebp - 0x30]
jmp 0x10053108
push 3
pop eax
call fcn.1006017d
ret