joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10095192
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b5256
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
mov eax, dword [0x100e13e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x30], 0
jne 0x100951c9
xor eax, eax
inc eax
jmp 0x1009536c
mov eax, dword [ebp + 8]
and dword [eax + 0x30], 0
mov ecx, dword [ebp + 8]
add ecx, 0x80
call fcn.10034f24
mov eax, dword [ebp + 8]
cmp dword [eax + 0x54], 0
je 0x100951fa
mov eax, dword [ebp + 8]
push dword [eax + 0x54]
call fcn.10091130
pop ecx
mov eax, dword [ebp + 8]
and dword [eax + 0x54], 0
mov eax, dword [ebp + 8]
cmp dword [eax + 0x58], 0
je 0x10095215
mov eax, dword [ebp + 8]
mov esi, dword [eax + 0x58]
call fcn.1004ece0
mov eax, dword [ebp + 8]
and dword [eax + 0x58], 0
mov eax, dword [ebp + 8]
cmp dword [eax + 0x5c], 0
je 0x1009524f
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x5c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x10095244
push 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x28], eax
jmp 0x10095248
and dword [ebp - 0x28], 0
mov eax, dword [ebp + 8]
and dword [eax + 0x5c], 0
mov ecx, dword [ebp + 8]
add ecx, 0x60
call fcn.10040416
mov ecx, dword [ebp + 8]
add ecx, 0x70
call fcn.10040416
mov ecx, dword [ebp + 8]
add ecx, 0x98
call fcn.1003f416
mov ecx, dword [ebp + 8]
add ecx, 0x18
call fcn.100a3f75
mov ecx, dword [ebp + 8]
call fcn.10093306
call fcn.10011c08
mov ecx, eax
call fcn.1009e388
call fcn.10056ac0
lea eax, [ebp - 0x18]
push eax
call fcn.10093c76
pop ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
push 0x100c356c
push dword [ebp - 0x30]
lea eax, [ebp - 0x1c]
push eax
call fcn.10010ab6
add esp, 0xc
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
call fcn.10010f80
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x1c]
call fcn.10003e5d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.10003e5d
lea eax, [ebp - 0x20]
push eax
call fcn.100ac81d
pop ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 4], 1
push 0x100c3584
push dword [ebp - 0x3c]
lea eax, [ebp - 0x24]
push eax
call fcn.10010ab6
add esp, 0xc
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
call fcn.10010f80
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x24]
call fcn.10003e5d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.10003e5d
mov ecx, dword [ebp + 8]
add ecx, 0x50
call fcn.10010f80
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp + 8]
call fcn.10093ef5
mov ecx, dword [ebp + 8]
call fcn.100943a2
call fcn.10037cf6
mov ecx, eax
call fcn.10037409
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret 4
Function at 0x1009597d
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b5616
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x100e13e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x24]
call fcn.100107ef
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100ac81d
pop ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 1
push dword [ebp - 0x38]
lea ecx, [ebp - 0x24]
call fcn.10003e6e
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10003e5d
lea eax, [ebp - 0x24]
push eax
call fcn.10093048
pop ecx
push str.Download_
lea ecx, [ebp - 0x24]
call fcn.1000a113
push 0
lea ecx, [ebp - 0x24]
call fcn.10010f80
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push dword [ebp + 0xc]
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x30]
call fcn.100955b5
mov byte [ebp - 4], 2
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.10003f6d
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
call fcn.10010f80
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str..tdl
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10010ab6
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x14]
call fcn.10010f80
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str..xfd
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10010ab6
add esp, 0xc
mov byte [ebp - 4], 5
push str..xftp
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10010ab6
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.10010f80
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x2c], 1
lea ecx, [ebp - 0x10]
call fcn.10003e5d
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1c]
call fcn.10003e5d
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.10003e5d
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.10003e5d
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.10003e5d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.10003e5d
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret 8
Function at 0x10095b08
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b5649
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x100e13e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
call fcn.10093306
lea ecx, [ebp - 0x1c]
call fcn.100107ef
and dword [ebp - 4], 0
push 0x100be7fe
push 0x100c3ebc
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
call fcn.100b2795
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 1
push 0
push 0x100c3eb0
mov eax, dword [ebp + 8]
push dword [eax + 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
call dword [eax + 0x18]
push eax
mov ecx, dword [ebp - 0x38]
call fcn.10010f80
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10016117
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.10003e5d
lea eax, [ebp - 0x18]
push eax
call fcn.100ac81d
pop ecx
mov byte [ebp - 4], 2
lea eax, [ebp - 0x18]
push eax
call fcn.10093048
pop ecx
push 0x100c3ec0
lea ecx, [ebp - 0x18]
call fcn.1000a113
push 0
lea ecx, [ebp - 0x18]
call fcn.10010f80
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push 0x100c3ed4
lea ecx, [ebp - 0x18]
call fcn.1000a113
lea ecx, [ebp - 0x18]
call fcn.10010f80
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1438
call fcn.1006ec7d
pop ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
push 0x1438
push 0
push dword [ebp - 0x10]
call fcn.10071bb0
add esp, 0xc
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 2
push 0xe0
call fcn.1006ec7d
pop ecx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x10095c46
mov ecx, dword [ebp - 0x2c]
call fcn.1003f1ed
mov dword [ebp - 0x3c], eax
jmp 0x10095c4a
and dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
and dword [eax + 8], 0
lea ecx, [ebp - 0x1c]
call fcn.10010f80
push eax
mov ecx, dword [ebp - 0x14]
call fcn.1000a156
lea ecx, [ebp - 0x18]
call fcn.10010f80
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x1c
call fcn.1000a156
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x34
call fcn.100402f6
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push dword [ebp + 8]
call dword [eax + 0x2c]
and dword [ebp - 0x30], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.10003e5d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.10003e5d
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret 4
Function at 0x1009601b
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b583f
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x23c], ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x22c]
call fcn.1001901e
and dword [ebp - 4], 0
lea ecx, [ebp - 0x22c]
call fcn.1004053d
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x228]
call fcn.1004050c
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x22c]
call fcn.1003095a
push eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0x23c]
call fcn.1009537c
test eax, eax
jne 0x100960cd
and dword [ebp - 0x230], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x228]
call fcn.1002370d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.1002370d
mov eax, dword [ebp - 0x230]
jmp 0x100961d0
push 0x100c4b48
lea ecx, [ebp - 0x22c]
call fcn.1003807a
lea ecx, [ebp - 0x22c]
call fcn.10040525
test eax, eax
jne 0x1009611c
and dword [ebp - 0x234], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x228]
call fcn.1002370d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.1002370d
mov eax, dword [ebp - 0x234]
jmp 0x100961d0
and word [ebp - 0x224], 0
push 0x208
push 0
lea eax, [ebp - 0x222]
push eax
call fcn.10071bb0
add esp, 0xc
lea ecx, [ebp - 0x22c]
call fcn.1003095a
push eax
push 0x104
lea eax, [ebp - 0x224]
push eax
push str.setup.exe
push str.PacketExe
push str.setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x228]
call fcn.1003807a
lea ecx, [ebp - 0x228]
call fcn.1003095a
push eax
push 0x104
mov eax, dword [ebp + 0xc]
add eax, 0x90
push eax
call fcn.1007298c
add esp, 0xc
lea ecx, [ebp - 0x228]
call fcn.10040525
mov dword [ebp - 0x238], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x228]
call fcn.1002370d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.1002370d
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006ef11
leave
ret 8
Function at 0x100978a5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b5af0
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
call fcn.10093306
lea ecx, [ebp - 0x22c]
call fcn.100107ef
and dword [ebp - 4], 0
push str.8.1.2967.301
lea ecx, [ebp - 0x238]
call fcn.10003df2
mov byte [ebp - 4], 1
push 0x100bdeaf
push 0x100c3e84
lea eax, [ebp - 0x234]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
call fcn.100b2795
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x254], eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x254]
push 0
push 0x100c3e88
mov eax, dword [ebp + 8]
push dword [eax + 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
call dword [eax + 0x18]
push eax
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp + 8]
call fcn.10097692
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x234]
call fcn.10003e5d
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x238]
call fcn.10003e5d
and word [ebp - 0x224], 0
push 0x208
push 0
lea eax, [ebp - 0x222]
push eax
call fcn.10071bb0
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x23c]
call fcn.10003df2
mov byte [ebp - 4], 3
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp + 8]
call fcn.1009381c
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x23c]
call fcn.10003e5d
push 0x1438
call fcn.1006ec7d
pop ecx
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x10], eax
push 0x1438
push 0
push dword [ebp - 0x10]
call fcn.10071bb0
add esp, 0xc
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x186a0
push 0xe0
call fcn.1006ec7d
pop ecx
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
je 0x10097a4e
mov ecx, dword [ebp - 0x248]
call fcn.1003f1ed
mov dword [ebp - 0x258], eax
jmp 0x10097a55
and dword [ebp - 0x258], 0
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x228], eax
lea ecx, [ebp - 0x22c]
call fcn.10010f80
push eax
mov ecx, dword [ebp - 0x228]
call fcn.1000a156
lea ecx, [ebp - 0x230]
call fcn.10010f80
push eax
mov ecx, dword [ebp - 0x228]
add ecx, 0x1c
call fcn.1000a156
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x34
call fcn.100402f6
mov ecx, dword [ebp - 0x228]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
call fcn.100938d0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x100]
inc eax
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x100], eax
and dword [ebp - 0x24c], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.10003e5d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.10003e5d
mov eax, dword [ebp - 0x24c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1006ef11
leave
ret 4
Function at 0x10097b14
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
call fcn.1005b3cd
movzx eax, al
test eax, eax
je 0x10097b3d
push str.CTxdlControllerImp::DownloadNext
push 0xd2
push 0x100c3698
call fcn.1005b25c
add esp, 0xc
mov ecx, dword [ebp + 8]
call fcn.100961e9
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10097b58
mov eax, 0x80004005
jmp 0x10097d28
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x34
call fcn.10013c9c
jmp 0x10097b77
push 0
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0xc]
call fcn.1003bb96
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x34
call fcn.10013cbf
push eax
lea ecx, [ebp - 0xc]
call fcn.100404ee
movzx eax, al
test eax, eax
je 0x10097d23
lea ecx, [ebp - 0xc]
call fcn.10017123
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0xc]
call fcn.10017123
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 0
je 0x10097bc1
cmp dword [ebp - 0x14], 0
jne 0x10097bc3
jmp 0x10097b69
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 4
ja 0x10097d1e
mov ecx, dword [ebp - 0x14]
add ecx, 0x1c
call fcn.10004ff5
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
call dword [eax + 4]
test eax, eax
je 0x10097c8b
mov eax, dword [ebp + 8]
and dword [eax + 0xc4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], 5
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0xc4]
mov dword [eax + 0xc], ecx
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x60
call fcn.10039356
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x60
call fcn.10040460
push eax
lea ecx, [ebp - 0x1c]
call fcn.100404ee
movzx eax, al
test eax, eax
je 0x10097c7b
lea ecx, [ebp - 0x1c]
call fcn.100405a9
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x10097c71
push 0
push 0
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
push dword [ebp - 0x20]
call dword [eax + 0x10]
lea ecx, [ebp - 0x1c]
call fcn.100404da
jmp 0x10097c2d
xor eax, eax
jne 0x10097c1e
xor eax, eax
jmp 0x10097d28
mov eax, dword [ebp + 8]
mov dword [eax + 0xc4], 0x12
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], 7
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0xc4]
mov dword [eax + 0xc], ecx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x60
call fcn.10039356
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x60
call fcn.10040460
push eax
lea ecx, [ebp - 0x28]
call fcn.100404ee
movzx eax, al
test eax, eax
je 0x10097d13
lea ecx, [ebp - 0x28]
call fcn.100405a9
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x10097d09
mov eax, dword [ebp + 8]
push dword [eax + 0xc4]
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
push dword [ebp - 0x2c]
call dword [eax + 0x14]
lea ecx, [ebp - 0x28]
call fcn.100404da
jmp 0x10097cc0
xor eax, eax
jne 0x10097cb1
mov eax, 0x80004005
jmp 0x10097d28
jmp 0x10097b69
mov eax, 0x80004005
leave
ret 4
Function at 0x1009860a
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
call fcn.100961e9
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10098629
jmp 0x100986e5
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x34
call fcn.10013c9c
jmp 0x10098648
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0xc]
call fcn.1003bb96
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x34
call fcn.10013cbf
push eax
lea ecx, [ebp - 0xc]
call fcn.100404ee
movzx eax, al
test eax, eax
je 0x100986e5
lea ecx, [ebp - 0xc]
call fcn.10017123
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0xc]
call fcn.10017123
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 0
je 0x1009868e
cmp dword [ebp - 0x14], 0
jne 0x10098690
jmp 0x1009863a
mov eax, dword [ebp - 0x10]
cmp dword [eax + 4], 0x186a0
je 0x100986e0
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 4
ja 0x100986e0
mov ecx, dword [ebp - 0x14]
add ecx, 0x1c
call fcn.10004ff5
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
call dword [eax + 4]
test eax, eax
je 0x100986e0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x40
call fcn.1004038f
jmp 0x1009863a
leave
ret
Function at 0x10098e84
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b5e76
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x240], ecx
lea ecx, [ebp - 0x10]
call fcn.100107ef
and dword [ebp - 4], 0
push 0
push str.KvNoCmdline
mov eax, dword [ebp - 0x240]
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x240]
mov ecx, dword [ecx + 0x10]
mov eax, dword [eax]
push ecx
call dword [eax + 0x20]
test eax, eax
je 0x10098f02
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x320], 0
jne 0x10098f02
push 0x100c4294
lea ecx, [ebp - 0x10]
call fcn.10003e87
jmp 0x10098fd6
and word [ebp - 0x22c], 0
push 0x208
push 0
lea eax, [ebp - 0x22a]
push eax
call fcn.10071bb0
add esp, 0xc
push 0
push 0x26
lea eax, [ebp - 0x22c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.Kingsoft
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x230]
call fcn.100107ef
mov byte [ebp - 4], 1
lea eax, [ebp - 0x22c]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._silence1handle_dsupply_dinstallpath__s_
lea eax, [ebp - 0x230]
push eax
call fcn.10016117
add esp, 0x14
mov eax, dword [ebp + 0x10]
add eax, 0x3a8
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.10010ab6
add esp, 0xc
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x248], eax
mov byte [ebp - 4], 2
push dword [ebp - 0x248]
lea ecx, [ebp - 0x10]
call fcn.10003e6e
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x234]
call fcn.10003e5d
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.10003e5d
mov eax, dword [ebp + 0x10]
add eax, 0x328
push eax
call fcn.1006eefb
pop ecx
test eax, eax
jne 0x10098ff5
mov dword [ebp - 0x24c], 0x100c4314
jmp 0x10099003
mov eax, dword [ebp + 0x10]
add eax, 0x328
mov dword [ebp - 0x24c], eax
push dword [ebp - 0x24c]
lea ecx, [ebp - 0x18]
call fcn.10003df2
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x240]
push dword [eax + 0x10]
mov eax, dword [ebp + 0x10]
push dword [eax + 4]
mov eax, dword [ebp + 0x10]
push dword [eax + 0x428]
lea ecx, [ebp - 0x18]
call fcn.10010f80
push eax
mov eax, dword [ebp + 0x10]
add eax, 0x90
push eax
call fcn.10011c08
mov ecx, eax
call fcn.100a2ce2
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10099094
lea ecx, [ebp - 0x10]
call fcn.10010f80
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
call dword [eax]
test eax, eax
je 0x10099094
and dword [ebp - 0x238], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.10003e5d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10003e5d
mov eax, dword [ebp - 0x238]
jmp 0x100990d6
mov dword [ebp - 0x23c], 9
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.10003e5d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10003e5d
mov eax, dword [ebp - 0x23c]
jmp 0x100990d6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1006ef11
leave
ret 0xc
Function at 0x10099134
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b5ea6
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x100e13e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
and dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x1c]
add ecx, 0x50
call fcn.10010f80
push eax
lea ecx, [ebp - 0x18]
call fcn.1002081f
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x24]
call fcn.10010f80
push eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx + 0x10]
mov eax, dword [eax]
push ecx
call dword [eax + 0x10]
xor ecx, ecx
test eax, eax
setge cl
mov byte [ebp - 0x11], cl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.1000abe4
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x100991c5
mov ecx, dword [ebp - 0x1c]
call fcn.100990ef
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x50
call fcn.10010f80
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret