joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417310
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.QCYiaatN
lea edi, [esi - 0xe000]
mov dword [edi + 0xe6f8], 0x58b40b67
push edi
or ebp, 0xffffffff
jmp 0x41733a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x417341
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x417330
mov eax, 1
add ebx, ebx
jne 0x417353
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x417348
jne 0x417364
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417348
xor ecx, ecx
sub eax, 3
jb 0x417378
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4173ea
mov ebp, eax
add ebx, ebx
jne 0x417383
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x417390
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4173b4
inc ecx
add ebx, ebx
jne 0x4173a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x417395
jne 0x4173b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417395
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4173d4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4173c5
jmp 0x417336
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4173d4
add edi, ecx
jmp 0x417336
pop esi
mov edi, esi
mov ecx, 0x446
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4173f2
cmp byte [edi], 5
jne 0x4173f2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4173f7
lea edi, [esi + 0x15000]
mov eax, dword [edi]
or eax, eax
je 0x417466
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x17704]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x17784]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x417424
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1778c]
or eax, eax
je 0x417460
mov dword [ebx], eax
add ebx, 4
jmp 0x417441
call dword [esi + 0x17788]
mov ebp, dword [esi + 0x17790]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41749a
sub esp, 0xffffff80
jmp 0x40d86c

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x37ea10be
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0xf816fac
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x408922
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
call fcn.00408943
add esi, esi
xor dword [eax], ecx
inc esi
inc eax
cmp eax, edi
jne fcn.00408922
push edx
mov esi, dword [esp]
add esp, 4
sub edx, esi
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
jmp int.00401219
Function at 0x1001a080
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
lea ebp, [esp - 0x604]
sub esp, 0x604
push 0xffffffffffffffff
push 0x1004a5b8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x1004f8f4]
xor eax, ebp
mov dword [ebp + 0x600], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [0x10050ff0], 0
mov esi, dword [ebp + 0x60c]
mov edi, dword [ebp + 0x618]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x24], edi
jne 0x1001a0e4
push 0
push 0x10018820
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 0x10050ff4
call fcn.100369a0
test eax, eax
je 0x1001a2cc
inc dword [0x10050ff0]
lea eax, [ebp + 0x400]
push 0x100
push eax
push 0x1ff
lea eax, [ebp]
push eax
push 0
push 0
push 0
push 0
push esi
call fcn.1003bfe3
add esp, 0x24
lea eax, [ebp + 0x400]
push eax
push 0x1ff
lea eax, [ebp]
push eax
call fcn.10018df0
mov ecx, dword [0x10050ff4]
lea eax, [ebp]
push eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0
call fcn.10036850
mov esi, eax
jmp 0x1001a1a0
mov ecx, 0x10050ff4
mov dword [ebp - 4], 0xffffffff
mov dword [edi + 0xc], esi
call fcn.10036ad0
lea ecx, [ebp - 0x20]
mov dword [edi + 4], eax
call fcn.10035b00
mov dword [ebp - 4], 4
mov ecx, esi
mov dword [ebp - 0x18], 0
mov byte [ebp - 4], 5
call fcn.10037210
mov esi, eax
lea ecx, [ebp - 0x20]
push esi
mov dword [ebp - 0x18], esi
call fcn.10036700
test esi, esi
je 0x1001a1fa
mov ecx, esi
call fcn.10035ba0
push esi
call fcn.10038fa0
add esp, 4
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 4
call fcn.10036b90
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
je 0x1001a24d
mov ecx, esi
mov byte [ebp - 4], 7
call fcn.10036b50
mov ebx, eax
push ebx
push edi
call fcn.100186f0
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x1001a1ea
push 0x14
call fcn.10032330
mov esi, eax
test esi, esi
jne 0x1001a270
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.10035b80
mov eax, 0xfffffffe
jmp 0x1001a2d1
lea eax, [esi + 8]
push eax
push 0x10053320
push 0x100019c8
call fcn.1002c790
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
test eax, eax
jne 0x1001a264
mov dword [esi + 4], eax
mov dword [edi + 0x4c], esi
call fcn.10035b80
xor eax, eax
jmp 0x1001a2d1
mov eax, 0xfffffffa
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x600]
xor ecx, ebp
call fcn.1003a853
lea esp, [ebp + 0x604]
pop ebp
ret 0x10
Function at 0x1001dfc0
Capabilities:
Enumerate pe sections

Disassembly:
mov edx, dword [esp + 8]
push esi
push edi
cmp word [edx + 0xc], 0xffff
movzx eax, byte [edx + 6]
je 0x1001dfea
mov eax, dword [esp + 0x14]
or word [eax], 2
movsd xmm0, qword [edx + 6]
movsd qword [eax + 0x10], xmm0
xor eax, eax
pop edi
pop esi
ret 0x10
sub eax, 0
je 0x1001e027
dec eax
je 0x1001e011
dec eax
jne 0x1001dfe3
mov esi, dword [esp + 0x14]
or word [esi], 8
movzx eax, byte [edx + 8]
push eax
call fcn.1001aaf0
mov dword [esi + 0x10], eax
xor eax, eax
pop edi
pop esi
ret 0x10
mov ecx, dword [esp + 0x14]
pop edi
pop esi
or word [ecx], 4
movzx eax, byte [edx + 8]
mov dword [ecx + 0x10], eax
xor eax, eax
ret 0x10
test byte [esp + 0x18], 1
je 0x1001dfe3
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push esi
call fcn.1001c5e0
test eax, eax
jne 0x1001dfe5
mov eax, dword [esp + 0x10]
mov ecx, 0x221
cmp ax, cx
je 0x1001e059
mov ecx, 0x4bc
cmp ax, cx
jne 0x1001e07b
lea eax, [esp + 0x10]
push eax
push esi
call fcn.1001d580
lea eax, [esp + 0x10]
push eax
push esi
call fcn.1001c5e0
test eax, eax
jne 0x1001dfe5
mov eax, dword [esp + 0x10]
mov ecx, 0x207
cmp ax, cx
jne 0x1001dfe3
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push eax
or word [edi], 0x10
push esi
call fcn.1001c650
test eax, eax
jne 0x1001dfe5
mov eax, dword [esp + 0x18]
movzx ecx, word [eax]
add eax, 2
push ecx
push eax
lea eax, [esp + 0x1c]
push eax
push dword [esi + 0x18]
push dword [esi + 4]
call fcn.1001b6c0
test eax, eax
js 0x1001dfe5
push ebx
mov ebx, dword [esp + 0x18]
push 1
shr eax, 1
push eax
push ebx
push dword [esi + 0x10]
call fcn.10030f40
mov dword [edi + 0x10], eax
cmp ebx, 0x100528e0
je 0x1001e0f1
push ebx
call fcn.100324b0
cmp dword [edi + 0x10], 0xffffffff
pop ebx
jne 0x1001dfe3
pop edi
mov eax, 0xfffffffe
pop esi
ret 0x10
Function at 0x10021ec0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x14
mov eax, dword [0x1004f8f4]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x20]
push 8
push eax
push 0x1b
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add eax, eax
cmp eax, 0x10
jae 0x10022008
xor ecx, ecx
mov word [esp + eax + 8], cx
lea eax, [esp + 8]
push eax
call fcn.1003a862
add esp, 4
cmp eax, 3
jge 0x10021f1f
lea eax, [esp + 8]
push eax
call fcn.1003a862
add esp, 4
jmp 0x10021f24
mov eax, 3
mov dword [edi + 0x14], eax
lea eax, [esp + 8]
push 8
push eax
push 0x1c
call esi
push eax
call fcn.10039b30
add eax, eax
cmp eax, 0x10
jae 0x10022008
xor ecx, ecx
mov word [esp + eax + 8], cx
lea eax, [esp + 8]
push eax
call fcn.1003a862
add esp, 4
cmp eax, 0xf
jge 0x10021f6b
lea eax, [esp + 8]
push eax
call fcn.1003a862
add esp, 4
jmp 0x10021f70
mov eax, 0xf
movsx eax, word [eax*2 + 0x1004e6c0]
mov dword [edi + 0x18], eax
lea eax, [esp + 8]
push 8
push eax
push 0x14
call esi
push eax
call fcn.10039b30
add eax, eax
cmp eax, 0x10
jae 0x10022008
xor ecx, ecx
lea esi, [esp + 8]
mov word [esp + eax + 8], cx
mov edx, 8
mov ecx, edi
sub esi, edi
jmp 0x10021fb0
lea eax, [edx + 0x7ffffff6]
test eax, eax
je 0x10021fce
movzx eax, word [esi + ecx]
test ax, ax
je 0x10021fce
mov word [ecx], ax
add ecx, 2
dec edx
jne 0x10021fb0
jmp 0x10021fd2
test edx, edx
jne 0x10021fd5
sub ecx, 2
xor eax, eax
mov word [ecx], ax
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10021fe0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
mov ecx, dword [esp + 0x18]
mov dword [edi + 0x10], eax
pop edi
pop esi
xor ecx, esp
call fcn.1003a853
add esp, 0x14
ret 4
call fcn.1003b3c8
int3
Function at 0x1002e3a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0x18]
xor ecx, ecx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x28]
mov eax, edi
cdq
xor eax, edx
sub eax, edx
mov dword [esp + 0x24], eax
lea ebp, [eax + 1]
cmp ebp, dword [esp + 0x18]
jle 0x1002e3cf
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x20
test edi, edi
js 0x1002e3ff
jle 0x1002e3f2
mov edx, edi
movzx eax, word [ebx]
test ax, ax
jne 0x1002e3e6
mov eax, 0x30
jmp 0x1002e3e9
add ebx, 2
mov word [esi], ax
add esi, 2
dec edx
jne 0x1002e3d7
mov eax, 0x2e
mov word [esi], ax
add esi, 2
jmp 0x1002e433
mov edx, dword [esp + 0x14]
mov esi, 0x2e
mov word [edx], si
lea esi, [edx + 2]
test eax, eax
jle 0x1002e42d
mov ecx, eax
mov edi, esi
shr ecx, 1
mov eax, 0x300030
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, dword [esp + 0x24]
xor ecx, ecx
lea esi, [esi + eax*2]
xor edi, edi
mov dword [esp + 0x28], edi
movzx edx, word [ebx]
test dx, dx
je 0x1002e45e
sub ebx, esi
lea ecx, [ecx]
inc ebp
cmp ebp, dword [esp + 0x18]
jg 0x1002e3c6
mov word [esi], dx
inc ecx
movzx eax, word [ebx + esi + 2]
add esi, 2
mov edx, eax
test ax, ax
jne 0x1002e440
mov ebx, dword [esp + 0x20]
xor eax, eax
mov word [esi], ax
cmp ecx, ebx
jge 0x1002e4b6
mov edx, ebx
sub edx, ecx
add ebp, edx
cmp ebp, dword [esp + 0x18]
jg 0x1002e3c6
mov esi, dword [esp + 0x14]
mov ecx, esi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002e484
sub ecx, edi
sar ecx, 1
lea esi, [esi + ecx*2]
test edx, edx
jle 0x1002e4af
mov ecx, edx
mov edi, esi
shr ecx, 1
lea esi, [esi + edx*2]
mov eax, 0x300030
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
xor eax, eax
mov word [esi], ax
jmp 0x1002e4cc
jle 0x1002e4cc
push ebx
push ecx
push dword [esp + 0x1c]
call fcn.1002e6c0
test eax, eax
je 0x1002e4cc
inc edi
mov dword [esp + 0x28], edi
mov ecx, dword [esp + 0x2c]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
mov dword [ecx], 0
cmp eax, esi
jge 0x1002e546
sub esi, eax
lea eax, [esi + ebp]
cmp eax, dword [esp + 0x18]
jg 0x1002e3c6
mov ebp, dword [esp + 0x14]
mov ecx, ebp
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002e500
sub ecx, edx
sar ecx, 1
lea eax, [ecx + esi]
lea edx, [ebp + eax*2]
lea edi, [ebp + ecx*2]
js 0x1002e52e
sub edi, edx
inc ecx
nop
mov ax, word [edi + edx]
lea edx, [edx - 2]
mov word [edx + 2], ax
dec ecx
jne 0x1002e520
test esi, esi
jle 0x1002e550
mov ecx, esi
mov eax, 0x300030
shr ecx, 1
mov edi, ebp
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
jmp 0x1002e550
mov ebp, dword [esp + 0x14]
jle 0x1002e550
sub eax, esi
mov dword [ecx], eax
mov ecx, ebp
xor edx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002e557
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 - 2]
movzx ecx, word [eax + ebp]
add eax, ebp
cmp ecx, 0x2e
je 0x1002e592
jmp 0x1002e580
lea eax, [eax - 2]
cmp cx, 0x30
jne 0x1002e592
movzx ecx, word [eax]
inc edx
cmp ecx, 0x2e
jne 0x1002e580
mov eax, dword [esp + 0x30]
sub ebx, edx
pop edi
pop esi
pop ebp
mov dword [eax], ebx
mov eax, 1
pop ebx
ret 0x20
Function at 0x10032830
Capabilities:
Delete file

Disassembly:
jmp 0x10039610
sub esp, 0x218
mov eax, dword [0x1004f8f4]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x100512c4], 0
mov eax, dword [esp + 0x21c]
je 0x10039652
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1003a853
add esp, 0x218
ret 4
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.100391c0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
lea ecx, [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x100396a0
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x100396a0
cmp dword [esp + 4], 0xffffffff
je 0x100396a0
push eax
call fcn.1003d94d
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1003a853
add esp, 0x218
ret 4
Function at 0x10039450
Capabilities:
Create directory

Disassembly:
sub esp, 0x218
mov eax, dword [0x1004f8f4]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x100512c4], 0
mov eax, dword [esp + 0x21c]
push esi
mov esi, dword [esp + 0x224]
je 0x1003949c
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop esi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1003a853
add esp, 0x218
ret 8
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.100391c0
cmp dword [esp + 0x214], 0x104
jl 0x100394d4
push 0xa1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x100394e1
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
cmp edx, eax
je 0x10039506
mov ecx, edx
shr ecx, 0x10
test ecx, ecx
je 0x10039506
cmp dword [esp + 4], 0xffffffff
je 0x10039506
push edx
call fcn.1003d94d
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1003a853
add esp, 0x218
ret 8

Function at 0x10039610
Capabilities:
Delete file

Disassembly:
jmp 0x10039610
sub esp, 0x218
mov eax, dword [0x1004f8f4]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x100512c4], 0
mov eax, dword [esp + 0x21c]
je 0x10039652
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1003a853
add esp, 0x218
ret 4
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.100391c0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
lea ecx, [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x100396a0
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x100396a0
cmp dword [esp + 4], 0xffffffff
je 0x100396a0
push eax
call fcn.1003d94d
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1003a853
add esp, 0x218
ret 4

Function at 0x10039880
Capabilities:
Get common file path

Disassembly:
sub esp, 0x21c
mov eax, dword [0x1004f8f4]
xor eax, esp
mov dword [esp + 0x218], eax
cmp dword [0x100512c4], 0
mov eax, dword [esp + 0x220]
mov ecx, dword [esp + 0x224]
je 0x100398ca
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.1003a853
add esp, 0x21c
ret 8
push esi
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.10038fb0
mov eax, dword [esp + 0x218]
push dword [esp + 8]
add eax, eax
shr eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 4]
mov esi, eax
call fcn.10039150
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
cmp edx, eax
je 0x1003991c
mov ecx, edx
shr ecx, 0x10
test ecx, ecx
je 0x1003991c
cmp dword [esp + 4], 0xffffffff
je 0x1003991c
push edx
call fcn.1003d94d
add esp, 4
mov ecx, dword [esp + 0x21c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1003a853
add esp, 0x21c
ret 8
Function at 0x10039940
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x218
mov eax, dword [0x1004f8f4]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x100512c4], 0
mov eax, dword [esp + 0x21c]
je 0x10039982
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1003a853
add esp, 0x218
ret 4
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.100391c0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
lea ecx, [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x100399d0
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x100399d0
cmp dword [esp + 4], 0xffffffff
je 0x100399d0
push eax
call fcn.1003d94d
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1003a853
add esp, 0x218
ret 4

Function at 0x10039b30
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x21c
mov eax, dword [0x1004f8f4]
xor eax, esp
mov dword [esp + 0x218], eax
cmp dword [0x100512c4], 0
mov eax, dword [esp + 0x228]
mov ecx, dword [esp + 0x22c]
je 0x10039b88
push ecx
push eax
push dword [esp + 0x22c]
push dword [esp + 0x22c]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.1003a853
add esp, 0x21c
ret 0x10
push esi
push ecx
push eax
lea ecx, [esp + 0xc]
call fcn.10038fb0
mov eax, dword [esp + 0x218]
add eax, eax
shr eax, 1
push eax
push dword [esp + 0xc]
push dword [esp + 0x230]
push dword [esp + 0x230]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea ecx, [esp + 4]
call fcn.10039150
lea ecx, [esp + 4]
mov esi, eax
call fcn.10039150
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
cmp eax, ecx
je 0x10039bf1
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x10039bf1
cmp dword [esp + 4], 0xffffffff
je 0x10039bf1
push eax
call fcn.1003d94d
add esp, 4
mov ecx, dword [esp + 0x21c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1003a853
add esp, 0x21c
ret 0x10

Function at 0x10039ce0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x21c
mov eax, dword [0x1004f8f4]
xor eax, esp
mov dword [esp + 0x218], eax
cmp dword [0x100512c4], 0
mov eax, dword [esp + 0x220]
mov ecx, dword [esp + 0x224]
je 0x10039d2a
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.1003a853
add esp, 0x21c
ret 8
push esi
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.10038fb0
mov eax, dword [esp + 0x218]
push dword [esp + 8]
add eax, eax
shr eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 4]
call fcn.10039150
mov esi, eax
test esi, esi
jle 0x10039d5c
dec esi
lea ecx, [esp + 4]
call fcn.10039150
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
cmp eax, ecx
je 0x10039d8a
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x10039d8a
cmp dword [esp + 4], 0xffffffff
je 0x10039d8a
push eax
call fcn.1003d94d
add esp, 4
mov ecx, dword [esp + 0x21c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1003a853
add esp, 0x21c
ret 8
Function at 0x1003a170
Capabilities:
Delete directory

Disassembly:
sub esp, 0x218
mov eax, dword [0x1004f8f4]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x100512c4], 0
mov eax, dword [esp + 0x21c]
je 0x1003a1b2
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1003a853
add esp, 0x218
ret 4
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.100391c0
cmp dword [esp + 0x214], 0x104
jl 0x1003a1eb
push 0xa1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x1003a1f7
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov esi, eax
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
cmp edx, eax
je 0x1003a21c
mov ecx, edx
shr ecx, 0x10
test ecx, ecx
je 0x1003a21c
cmp dword [esp + 4], 0xffffffff
je 0x1003a21c
push edx
call fcn.1003d94d
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1003a853
add esp, 0x218
ret 4

Function at 0x1003a240
Capabilities:
Set current directory

Disassembly:
sub esp, 0x218
mov eax, dword [0x1004f8f4]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x100512c4], 0
mov eax, dword [esp + 0x21c]
je 0x1003a282
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1003a853
add esp, 0x218
ret 4
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.100391c0
cmp dword [esp + 0x214], 0x104
jl 0x1003a2bb
push 0xa1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x1003a2c7
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, eax
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
cmp edx, eax
je 0x1003a2ec
mov ecx, edx
shr ecx, 0x10
test ecx, ecx
je 0x1003a2ec
cmp dword [esp + 4], 0xffffffff
je 0x1003a2ec
push edx
call fcn.1003d94d
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1003a853
add esp, 0x218
ret 4