joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10025a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10025f8
lea edx, [ebp - 4]
push edx
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10025ee
mov dword [ebp - 4], 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x1002610
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1002672
push 0
push 0
push 0
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x1002668
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x1002700
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x1002725
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x100272b
mov eax, dword [ebp - 4]
and eax, 0x10
mov esp, ebp
pop ebp
ret 4
Function at 0x1002880
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov ecx, dword [ebp + 0x10]
movsx edx, byte [ecx]
cmp edx, 0x23
jne 0x100298e
mov eax, dword [ebp + 0x10]
add eax, 1
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp + 0x10]
movsx edx, byte [ecx]
push edx
call dword [sym.imp.USER32.dll_CharUpperA]
mov byte [ebp - 4], al
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.USER32.dll_CharNextA]
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp + 0x10], eax
mov cl, byte [ebp - 4]
mov byte [ebp - 0x118], cl
cmp byte [ebp - 0x118], 0x53
je 0x10028ef
cmp byte [ebp - 0x118], 0x57
je 0x1002902
jmp 0x1002912
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x100298c
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x100298c
mov dword [ebp - 0xc], 0x104
push 0x1001318
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x114]
push edx
call fcn.01007d60
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x114]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100298c
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 0
push 0
push 0x10012a8
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1002982
mov dword [ebp - 8], 1
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100299c
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 8], 0
jne 0x10029af
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.01007d60
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002e30
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movsx ecx, byte [eax]
cmp ecx, 0x22
jne 0x1002e80
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x1002e6a
mov edx, dword [ebp - 8]
movsx eax, byte [edx]
cmp eax, 0x22
je 0x1002e6a
jmp 0x1002e4a
mov ecx, dword [ebp - 8]
movsx edx, byte [ecx]
cmp edx, 0x22
jne 0x1002e7e
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x1002e96
mov ecx, dword [ebp - 8]
movsx edx, byte [ecx]
cmp edx, 0x20
jle 0x1002e96
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x1002e80
mov ecx, dword [ebp - 8]
movsx edx, byte [ecx]
test edx, edx
je 0x1002eb6
mov eax, dword [ebp - 8]
movsx ecx, byte [eax]
cmp ecx, 0x20
jg 0x1002eb6
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jmp 0x1002e96
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov ecx, dword [ebp - 0x20]
and ecx, 1
test ecx, ecx
je 0x1002edf
mov edx, dword [ebp - 0x1c]
and edx, 0xffff
mov dword [ebp - 0x50], edx
jmp 0x1002ee6
mov dword [ebp - 0x50], 0xa
mov eax, dword [ebp - 0x50]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1004950
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov dword [ebp - 4], 1
cmp dword [ebp + 8], 0
jne 0x100496d
xor eax, eax
jmp 0x1004a96
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1004a43
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edx, [ebp - 0x218]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [0x100daa8], 0
jne 0x1004a01
mov ecx, dword [0x100e6cc]
and ecx, 1
test ecx, ecx
je 0x1004a01
mov edx, dword [0x100e6cc]
and edx, 2
test edx, edx
jne 0x1004a01
mov eax, dword [ebp - 0x218]
and eax, 0xff000000
cmp eax, 0xaa000000
jne 0x1004a01
mov ecx, dword [ebp - 0x218]
mov dword [0x100e6cc], ecx
mov edx, dword [ebp - 0x218]
push edx
call fcn.01004aa0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x100e6d4]
and edx, 0x400
test edx, edx
je 0x1004a41
cmp dword [ebp - 0x218], 0
jge 0x1004a41
mov dword [ebp - 4], 0
jmp 0x1004a93
call fcn.01007810
mov dword [0x100e704], eax
push 0
push 0x200
lea eax, [ebp - 0x214]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 0
push 0x10
lea ecx, [ebp - 0x214]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x4c4
push 0
call fcn.01004e90
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x1004be0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push str.SHELL32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x1004c6b
push str.SHBrowseForFolder
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1004c42
push 0xc3
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x1004c42
push str.SHGetPathFromIDList
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x1004c69
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
push 0x10
push 0
push 0
push 0x4c1
mov ecx, dword [ebp + 8]
push ecx
call fcn.01004e90
xor eax, eax
jmp 0x1004d79
jmp 0x1004c88
push 0
push 0x10
push 0
push 0
push 0x4c2
mov edx, dword [ebp + 8]
push edx
call fcn.01004e90
xor eax, eax
jmp 0x1004d79
movsx eax, byte [0x100e720]
test eax, eax
jne 0x1004cea
push 0x100e720
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x100e720
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0x100e720
push eax
push 0x100e720
call dword [sym.imp.USER32.dll_CharPrevA]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
movsx edx, byte [ecx]
cmp edx, 0x5c
jne 0x1004cea
mov eax, dword [ebp - 8]
push eax
push 0x100e720
call dword [sym.imp.USER32.dll_CharPrevA]
movsx ecx, byte [eax]
cmp ecx, 0x3a
je 0x1004cea
mov edx, dword [ebp - 8]
mov byte [edx], 0
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0x1004bb0
mov dword [ebp - 0x10], 0x100e720
lea eax, [ebp - 0x28]
push eax
call dword [ebp - 4]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x1004d5c
push 0x100e720
mov ecx, dword [ebp - 0x38]
push ecx
call dword [ebp - 0x34]
movsx edx, byte [0x100e720]
test edx, edx
je 0x1004d55
push 0x100e720
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0x38]
push ecx
call dword [ebp - 0x2c]
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp + 0x10]
movsx ecx, byte [eax]
test ecx, ecx
je 0x1004d77
mov eax, 1
jmp 0x1004d79
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1005040
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
push 0xa
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x10]
ja 0x1005070
cmp dword [ebp + 0xc], 0
jne 0x1005075
mov eax, dword [ebp - 4]
jmp 0x10050ce
cmp dword [ebp - 4], 0
jne 0x100507f
xor eax, eax
jmp 0x10050ce
push 0xa
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10050aa
xor eax, eax
jmp 0x10050ce
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 0xc]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10051b0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
push eax
call fcn.01007ce0
test eax, eax
jne 0x10051d4
mov eax, 1
jmp 0x100526b
cmp dword [0x100de7c], 0
jne 0x1005253
xor ecx, ecx
mov cx, word [0x100dab8]
and ecx, 1
test ecx, ecx
jne 0x1005253
mov edx, dword [ebp + 8]
mov dword [0x100e0a4], edx
push 6
push 0
push 0x1003920
mov eax, dword [0x100da78]
push eax
push 0x7d3
mov ecx, dword [0x100e6dc]
push ecx
call fcn.01007b80
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 6
je 0x1005230
cmp dword [ebp - 8], 7
je 0x100524c
cmp dword [ebp - 8], 0x839
je 0x1005239
jmp 0x1005253
mov dword [ebp - 4], 1
jmp 0x1005253
mov dword [0x100de7c], 1
mov dword [ebp - 4], 1
jmp 0x1005253
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x1005268
push 0x80
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x1005430
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x10054f9
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 1]
cmp eax, 0x3a
jne 0x100546e
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + 2]
cmp edx, 0x5c
jne 0x100546e
mov eax, dword [ebp + 8]
add eax, 3
mov dword [ebp - 8], eax
jmp 0x10054a0
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
cmp edx, 0x5c
jne 0x1005497
mov eax, dword [ebp + 8]
movsx ecx, byte [eax + 1]
cmp ecx, 0x5c
jne 0x1005497
mov edx, dword [ebp + 8]
add edx, 2
mov dword [ebp - 8], edx
mov dword [ebp - 4], 2
jmp 0x10054a0
mov eax, dword [ebp + 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
movsx edx, byte [ecx]
test edx, edx
je 0x10054f9
mov eax, dword [ebp - 8]
movsx ecx, byte [eax]
cmp ecx, 0x5c
jne 0x10054ea
mov edx, dword [ebp - 8]
movsx eax, byte [edx - 1]
cmp eax, 0x3a
je 0x10054ea
cmp dword [ebp - 4], 0
je 0x10054d2
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
jmp 0x10054ea
mov edx, dword [ebp - 8]
mov byte [edx], 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 8]
mov byte [ecx], 0x5c
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 8], eax
jmp 0x10054a0
mov esp, ebp
pop ebp
ret 4
Function at 0x1005dd0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 1
call fcn.01005fb0
test eax, eax
jne 0x1005ded
xor eax, eax
jmp 0x1005fa4
cmp dword [0x100da78], 0
je 0x1005e2b
push 0
push 0x842
mov eax, dword [0x100da78]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
push 0x841
mov ecx, dword [0x100da78]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x100dde0]
push edx
call fcn.01005ce0
test eax, eax
jne 0x1005e5f
push 0
push 0x10
push 0
push 0
push 0x4ba
mov eax, dword [0x100da78]
push eax
call fcn.01004e90
mov dword [ebp - 8], 0
jmp 0x1005f2a
push 0x100dde8
push 1
push 0x10058b0
push fcn.01005810
push 0x1005760
push 0x1005660
push fcn.01005500
push 0x1005a80
push 0x1005a60
call fcn.01007fa0
add esp, 0x24
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1005ec4
push 0
push 0x10
push 0
push 0
mov ecx, dword [0x100dde8]
add ecx, 0x514
push ecx
mov edx, dword [0x100da78]
push edx
call fcn.01004e90
mov dword [ebp - 8], 0
jmp 0x1005f2a
push 0x100dde0
push 0
push 0x1005aa0
push 0
push 0x10012a8
push str.MEMCAB
mov eax, dword [ebp - 4]
push eax
call fcn.01008180
add esp, 0x1c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1005ef3
jmp 0x1005f2a
mov ecx, dword [ebp - 4]
push ecx
call fcn.01008040
add esp, 4
test eax, eax
jne 0x1005f2a
push 0
push 0x10
push 0
push 0
mov edx, dword [0x100dde8]
add edx, 0x514
push edx
mov eax, dword [0x100da78]
push eax
call fcn.01004e90
mov dword [ebp - 8], 0
cmp dword [0x100dde0], 0
je 0x1005f4a
mov ecx, dword [0x100dde0]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov dword [0x100dde0], 0
cmp dword [ebp - 8], 0
jne 0x1005f6d
cmp dword [0x100de78], 0
jne 0x1005f6d
push 0
push 0x10
push 0
push 0
push 0x4f8
push 0
call fcn.01004e90
xor edx, edx
mov dx, word [0x100dab8]
and edx, 1
test edx, edx
jne 0x1005fa1
mov eax, dword [0x100e6d4]
and eax, 1
test eax, eax
jne 0x1005fa1
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0xfa1
mov edx, dword [0x100da78]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x10061d0
Capabilities:
Delete file
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x100de80]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 0
je 0x1006243
cmp dword [0x100daa4], 0
jne 0x100621c
cmp dword [0x100e6d0], 0
jne 0x100621c
push 0x80
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
jmp 0x10061e7
cmp dword [0x100daa0], 0
je 0x10062a0
cmp dword [0x100daa4], 0
jne 0x10062a0
cmp dword [0x100e6d0], 0
jne 0x10062a0
push 0x100de84
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [0x100e6d4]
and ecx, 0x20
test ecx, ecx
je 0x1006289
lea edx, [ebp - 0x10c]
push edx
call fcn.01007dd0
push 0x10012fc
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x10c]
push eax
call fcn.01002350
xor ecx, ecx
mov cx, word [0x100ec04]
cmp ecx, 1
je 0x10062bc
cmp dword [0x100daa0], 0
je 0x10062bc
call fcn.01001f20
mov dword [0x100daa0], 0
mov esp, ebp
pop ebp
ret

Function at 0x10062d0
Capabilities:
Check if file exists
Create directory
Delete directory
Delete file
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov dword [ebp - 0x10c], 0
mov dword [ebp - 4], 0
cmp dword [ebp - 0x10c], 0x190
jge 0x1006399
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
push ecx
push 0x1001450
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp - 0x10c]
add eax, 1
mov dword [ebp - 0x10c], eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.01007d60
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1006394
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x100638b
mov dword [0x100daa0], 1
mov dword [ebp - 4], 1
jmp 0x1006392
mov dword [ebp - 4], 0
jmp 0x1006399
jmp 0x10062ea
cmp dword [ebp - 4], 0
jne 0x10063d5
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0x100144c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x10063d5
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x10063e0
Capabilities:
Create directory
Delete directory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
cmp dword [ebp + 0xc], 0
je 0x10064ba
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.010062d0
test eax, eax
je 0x10064b1
lea edx, [ebp - 0x104]
push edx
push 0x100de84
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [0x100e6d4]
and eax, 0x20
test eax, eax
je case.default.0x1006457
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [ebp - 0x128]
and edx, 0xffff
mov dword [ebp - 0x12c], edx
cmp dword [ebp - 0x12c], 3
ja case.default.0x1006457
mov eax, dword [ebp - 0x12c]
jmp dword [eax*4 + 0x100654d]
push 0x1001470
push 0x100de84
call fcn.01007d60
jmp case.default.0x1006457
push 0x1001468
push 0x100de84
call fcn.01007d60
jmp case.default.0x1006457
push 0x1001460
push 0x100de84
call fcn.01007d60
jmp case.default.0x1006457
push 0x100145c
push 0x100de84
call fcn.01007d60
push 0x10012a8
push 0x100de84
call fcn.01007d60
jmp 0x10064b8
xor eax, eax
jmp 0x1006547
jmp 0x10064c9
mov ecx, dword [ebp + 8]
push ecx
push 0x100de84
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x100de84
call fcn.01006930
test eax, eax
jne 0x1006502
push 0
push 0x100de84
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x10064f4
mov dword [0x100daa0], 1
jmp 0x1006502
call fcn.01007810
mov dword [0x100e704], eax
xor eax, eax
jmp 0x1006547
push 0
mov edx, dword [ebp + 0x10]
push edx
push 0x100de84
call fcn.01006a20
test eax, eax
je 0x1006527
mov dword [0x100e704], 0
mov eax, 1
jmp 0x1006547
cmp dword [0x100daa0], 0
je 0x1006545
mov dword [0x100daa0], 0
push 0x100de84
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1006930
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0x14
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100697a
push 0
push 0x10
push 0
push 0
push 0x4b5
push 0
call fcn.01004e90
call fcn.01007810
mov dword [0x100e704], eax
xor eax, eax
jmp 0x1006a17
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x100148c
mov eax, dword [ebp - 4]
push eax
call fcn.01007d60
push 0
push 0x4000080
push 1
push 0
push 0
push 0x40000000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x10069d3
call fcn.01007810
mov dword [0x100e704], eax
xor eax, eax
jmp 0x1006a17
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x1006a0b
mov edx, dword [ebp - 8]
and edx, 0x10
test edx, edx
je 0x1006a0b
mov dword [0x100e704], 0
mov eax, 1
jmp 0x1006a17
call fcn.01007810
mov dword [0x100e704], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4