joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10024c99
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x100598e8]
xor eax, ebp
mov dword [ebp + 0x194], eax
push ebx
mov ebx, dword [ebp + 0x1a0]
push edi
xor eax, eax
push 0x206
mov word [ebp - 0x74], ax
xor edi, edi
lea eax, [ebp - 0x72]
push edi
push eax
call fcn.10031310
add esp, 0xc
push 0x2001f
push 0x1004af28
push 0x80000002
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x80], 0x208
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x78], edi
call fcn.1000da6a
lea ecx, [ebp - 0x7c]
test eax, eax
je 0x10024d0a
call fcn.1000d9f5
xor eax, eax
jmp 0x10024d60
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
push edi
call fcn.1000daab
test eax, eax
je 0x10024d21
lea ecx, [ebp - 0x7c]
jmp 0x10024d01
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x74]
push eax
call esi
test eax, eax
je 0x10024d55
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x1004b474
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x74]
push eax
call esi
test eax, eax
jne 0x10024d79
lea ecx, [ebp - 0x7c]
call fcn.1000d9f5
xor eax, eax
pop esi
mov ecx, dword [ebp + 0x194]
pop edi
xor ecx, ebp
pop ebx
call fcn.10031770
add ebp, 0x198
leave
ret 4
lea eax, [ebp - 0x74]
push eax
mov esi, 0x104
push esi
push ebx
push edi
push 0x1004b460
push 0x1004b454
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, esi
jne 0x10024da5
lea ecx, [ebp - 0x7c]
call fcn.1000d9f5
mov eax, edi
jmp 0x10024d5f
xor edi, edi
inc edi
jmp 0x10024d99

Function at 0x10024daa
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x100598e8]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.10031310
add esp, 0xc
push 0x1005bd1c
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.10009101
push 0x1004aa28
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.10031770
leave
ret

Function at 0x10024e22
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x100598e8]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.10031310
add esp, 0xc
push 0x1005bd1c
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.10009101
push 0x1004e254
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.10031770
leave
ret
Function at 0x10024e9a
Capabilities:
Check if file exists

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x100598e8]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x10048641
call fcn.1003177f
mov ebx, dword [ebp + 0x214]
xor eax, eax
push 0x206
mov word [ebp], ax
xor edi, edi
lea eax, [ebp + 2]
push edi
push eax
call fcn.10031310
add esp, 0xc
mov dword [ebp - 0x18], 0x208
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
push 0x2001f
push 0x1004b0b8
push 0x80000002
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
call fcn.1000da6a
lea ecx, [ebp - 0x14]
test eax, eax
je 0x10024f38
call fcn.1000d9f5
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.10031770
add ebp, 0x20c
leave
ret 4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp]
push eax
push edi
call fcn.1000daab
test eax, eax
je 0x10024f4f
lea ecx, [ebp - 0x14]
jmp 0x10024f0c
mov esi, 0x104
lea eax, [ebp]
push esi
push eax
push eax
call fcn.1000ec07
add esp, 0xc
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10024f7c
lea ecx, [ebp - 0x14]
call fcn.1000d9f5
mov eax, edi
jmp 0x10024f13
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp]
push eax
push esi
push ebx
call fcn.10009101
xor edi, edi
inc edi
jmp 0x10024f70

Function at 0x1002514b
Capabilities:
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x100598e8]
xor eax, ebp
mov dword [ebp + 0x188], eax
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x80], ax
lea eax, [ebp - 0x7e]
push eax
mov esi, ecx
call fcn.10031310
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov ecx, esi
call fcn.10024e9a
test eax, eax
je 0x100251cd
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push edi
push 0x1004ee4c
lea eax, [ebp - 0x80]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x80]
push eax
call edi
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x1004edf0
lea eax, [ebp - 0x80]
push eax
call esi
lea eax, [ebp - 0x80]
push eax
call edi
xor eax, eax
inc eax
pop edi
mov ecx, dword [ebp + 0x188]
xor ecx, ebp
pop esi
call fcn.10031770
add ebp, 0x18c
leave
ret
Function at 0x100251e3
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x5a4]
sub esp, 0x624
mov eax, dword [0x100598e8]
xor eax, ebp
mov dword [ebp + 0x5a0], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp + 0x398], ax
xor ebx, ebx
lea eax, [ebp + 0x39a]
push ebx
push eax
mov dword [ebp - 0x80], ecx
call fcn.10031310
xor eax, eax
push esi
mov word [ebp - 0x78], ax
lea eax, [ebp - 0x76]
push ebx
push eax
mov dword [ebp - 0x7c], 1
call fcn.10031310
xor eax, eax
push esi
mov word [ebp + 0x190], ax
lea eax, [ebp + 0x192]
push ebx
push eax
call fcn.10031310
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0x24
push 0x1004e254
mov edi, 0x1005bd1c
push edi
lea eax, [ebp + 0x398]
push eax
call esi
cmp dword [ebp + 0x5ac], ebx
je 0x10025287
lea eax, [ebp + 0x398]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100252fe
push 0x1004aa28
push edi
lea eax, [ebp - 0x78]
push eax
call esi
push 0x1004ee9c
push edi
lea eax, [ebp + 0x190]
push eax
call esi
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100252fb
mov ecx, dword [ebp - 0x80]
lea eax, [ebp + 0x190]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.1002412e
test eax, eax
je 0x100252fb
mov ecx, dword [ebp - 0x80]
lea eax, [ebp + 0x398]
push eax
call fcn.10023556
lea eax, [ebp + 0x398]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp + 0x398]
push eax
lea eax, [ebp + 0x190]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x100252fe
mov dword [ebp - 0x7c], ebx
push 0x1004ed90
push edi
lea eax, [ebp + 0x398]
push eax
call esi
cmp dword [ebp + 0x5ac], ebx
je 0x10025326
lea eax, [ebp + 0x398]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10025396
push 0x1004ee84
push edi
lea eax, [ebp - 0x78]
push eax
call esi
push 0x1004ee68
push edi
lea eax, [ebp + 0x190]
push eax
call esi
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10025396
mov ecx, dword [ebp - 0x80]
lea eax, [ebp + 0x190]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.1002412e
test eax, eax
je 0x10025396
mov ecx, dword [ebp - 0x80]
lea eax, [ebp + 0x398]
push eax
call fcn.10023556
lea eax, [ebp + 0x398]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp + 0x398]
push eax
lea eax, [ebp + 0x190]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [ebp + 0x5a0]
mov eax, dword [ebp - 0x7c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10031770
add ebp, 0x5a4
leave
ret 4
Function at 0x10025410
Capabilities:
Delete registry value

Disassembly:
push ebp
lea ebp, [esp - 0x5a8]
sub esp, 0x628
mov eax, dword [0x100598e8]
xor eax, ebp
mov dword [ebp + 0x5a4], eax
push ebx
push edi
xor edi, edi
mov ebx, ecx
cmp dword [0x1005d6b0], edi
jne 0x10025576
call fcn.100253b3
test eax, eax
jne 0x10025460
push 0x1004ecd4
push 0x1004cbb8
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
jmp 0x10025576
push esi
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp + 0x194], ax
lea eax, [ebp + 0x196]
push edi
push eax
call fcn.10031310
add esp, 0xc
lea eax, [ebp + 0x194]
push eax
mov ecx, ebx
call fcn.10024c99
test eax, eax
je 0x10025575
xor eax, eax
push esi
mov word [ebp + 0x39c], ax
lea eax, [ebp + 0x39e]
push edi
push eax
call fcn.10031310
add esp, 0xc
push 0x1004adc4
mov ebx, 0x104
push ebx
lea eax, [ebp + 0x39c]
push eax
call fcn.10009101
lea eax, [ebp + 0x194]
push eax
push ebx
lea eax, [ebp + 0x39c]
push eax
call fcn.1000e449
push 0x1004e240
lea eax, [ebp + 0x39c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push edi
push edi
push 0x2001f
push edi
push edi
push 0x1004cbb8
push 0x80000002
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x78], edi
call fcn.1000da10
test eax, eax
jne 0x1002556d
push esi
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push edi
push eax
call fcn.10031310
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
mov esi, 0x1004ecd4
push esi
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x80], 0x208
call fcn.1000daab
test eax, eax
jne 0x1002555b
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x39c]
push eax
call fcn.10032b93
pop ecx
pop ecx
test eax, eax
je 0x1002556d
push 1
lea eax, [ebp + 0x39c]
push eax
push esi
lea ecx, [ebp - 0x7c]
call fcn.1000db34
lea ecx, [ebp - 0x7c]
call fcn.1000d9f5
pop esi
mov ecx, dword [ebp + 0x5a4]
pop edi
xor ecx, ebp
pop ebx
call fcn.10031770
add ebp, 0x5a8
leave
ret

Function at 0x1002558d
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x100598e8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov edi, ecx
call fcn.10031310
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call fcn.10024b05
test eax, eax
je 0x10025661
push ebx
xor eax, eax
push esi
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.10031310
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push 0x1004b4c4
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x414]
push eax
call ebx
test eax, eax
je 0x10025660
xor eax, eax
push esi
push eax
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push eax
call fcn.10031310
add esp, 0xc
push 0x1004eeb0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push eax
call edi
lea eax, [ebp - 0x61c]
push eax
call ebx
neg eax
sbb eax, eax
neg eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10031770
leave
ret
Function at 0x1002566f
Capabilities:
Delete registry value

Disassembly:
push ebp
lea ebp, [esp - 0x5a8]
sub esp, 0x628
mov eax, dword [0x100598e8]
xor eax, ebp
mov dword [ebp + 0x5a4], eax
push ebx
push edi
xor edi, edi
mov ebx, ecx
cmp dword [0x1005d6b0], edi
jne 0x1002583d
push esi
call fcn.1002558d
test eax, eax
jne 0x100256cd
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push 0x1004eee4
mov ebx, 0x1004cbb8
push ebx
mov edi, 0x80000002
push edi
call esi
push 0x1004eec4
push ebx
push edi
call esi
jmp 0x1002583c
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp + 0x39c], ax
lea eax, [ebp + 0x39e]
push edi
push eax
call fcn.10031310
xor eax, eax
push esi
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push edi
push eax
call fcn.10031310
add esp, 0x18
lea eax, [ebp - 0x74]
push eax
mov ecx, ebx
call fcn.10024b05
test eax, eax
je 0x1002583c
push 0x1004e228
lea eax, [ebp - 0x74]
push eax
push 0x1004ee38
mov ebx, 0x104
lea eax, [ebp + 0x39c]
push ebx
push eax
call fcn.1000e4b8
add esp, 0x14
push edi
push edi
push 0x2001f
push edi
push edi
push 0x1004cbb8
push 0x80000002
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x78], edi
call fcn.1000da10
test eax, eax
jne 0x10025834
push esi
mov word [ebp + 0x194], ax
lea eax, [ebp + 0x196]
push edi
push eax
call fcn.10031310
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x194]
lea edi, [esi + 2]
push eax
mov esi, 0x1004eee4
push esi
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x80], edi
call fcn.1000daab
test eax, eax
jne 0x100257b0
lea eax, [ebp + 0x194]
push eax
lea eax, [ebp + 0x39c]
push eax
call fcn.10032b93
pop ecx
pop ecx
test eax, eax
je 0x100257c2
push 1
lea eax, [ebp + 0x39c]
push eax
push esi
lea ecx, [ebp - 0x7c]
call fcn.1000db34
push 0x1004eda8
lea eax, [ebp - 0x74]
push eax
push 0x1004ee38
lea eax, [ebp + 0x39c]
push ebx
push eax
call fcn.1000e4b8
xor eax, eax
add esp, 0x14
mov word [ebp + 0x194], ax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x194]
push eax
mov esi, 0x1004eec4
push esi
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x80], edi
call fcn.1000daab
test eax, eax
jne 0x10025822
lea eax, [ebp + 0x194]
push eax
lea eax, [ebp + 0x39c]
push eax
call fcn.10032b93
pop ecx
pop ecx
test eax, eax
je 0x10025834
push 1
lea eax, [ebp + 0x39c]
push eax
push esi
lea ecx, [ebp - 0x7c]
call fcn.1000db34
lea ecx, [ebp - 0x7c]
call fcn.1000d9f5
pop esi
mov ecx, dword [ebp + 0x5a4]
pop edi
xor ecx, ebp
pop ebx
call fcn.10031770
add ebp, 0x5a8
leave
ret

Function at 0x10025854
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x100598e8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov esi, ecx
call fcn.10031310
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.10024c99
pop esi
test eax, eax
je 0x100258bd
push 0x1004e240
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10031770
leave
ret
Function at 0x100258c9
Capabilities:
Check if file exists
Delete file
Delete registry value
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x7ac]
sub esp, 0x82c
mov eax, dword [0x100598e8]
xor eax, ebp
mov dword [ebp + 0x7a8], eax
push ebx
push esi
push edi
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp + 0x398], ax
xor ebx, ebx
lea eax, [ebp + 0x39a]
push ebx
push eax
mov dword [ebp - 0x80], ecx
call fcn.10031310
mov ecx, dword [ebp - 0x80]
add esp, 0xc
lea eax, [ebp + 0x398]
push eax
call fcn.10024e9a
test eax, eax
jne 0x10025947
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push 0x1004ee14
mov ebx, 0x1004cbb8
push ebx
mov edi, 0x80000002
push edi
call esi
push 0x1004edc4
push ebx
push edi
call esi
xor eax, eax
jmp 0x10025afc
xor eax, eax
push edi
mov word [ebp + 0x5a0], ax
lea eax, [ebp + 0x5a2]
push ebx
push eax
mov dword [ebp - 0x7c], 1
call fcn.10031310
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push 0x1004ee4c
lea eax, [ebp + 0x398]
push eax
lea eax, [ebp + 0x5a0]
push eax
call esi
cmp dword [ebp + 0x7b4], ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
je 0x100259a2
lea eax, [ebp + 0x5a0]
push eax
call ebx
test eax, eax
jne 0x10025a55
xor eax, eax
push edi
push eax
mov word [ebp + 0x190], ax
lea eax, [ebp + 0x192]
push eax
call fcn.10031310
add esp, 0xc
push 0x1004ef60
lea eax, [ebp + 0x398]
push eax
lea eax, [ebp + 0x190]
push eax
call esi
xor eax, eax
push edi
mov word [ebp - 0x78], ax
xor edi, edi
lea eax, [ebp - 0x76]
push edi
push eax
call fcn.10031310
add esp, 0xc
push 0x1004ef40
lea eax, [ebp + 0x398]
push eax
lea eax, [ebp - 0x78]
push eax
call esi
lea eax, [ebp + 0x190]
push eax
call ebx
test eax, eax
je 0x10025a1d
mov ecx, dword [ebp - 0x80]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x190]
push eax
call fcn.1002412e
test eax, eax
jne 0x10025a22
mov dword [ebp - 0x7c], edi
jmp 0x10025a57
mov ecx, dword [ebp - 0x80]
lea eax, [ebp + 0x5a0]
push eax
call fcn.10023556
lea eax, [ebp + 0x5a0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp + 0x5a0]
push eax
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x10025a57
jmp 0x10025a1d
xor edi, edi
push 0x1004edf0
lea eax, [ebp + 0x398]
push eax
lea eax, [ebp + 0x5a0]
push eax
call esi
cmp dword [ebp + 0x7b4], edi
je 0x10025a81
lea eax, [ebp + 0x5a0]
push eax
call ebx
test eax, eax
jne 0x10025af9
push 0x1004ef20
lea eax, [ebp + 0x398]
push eax
lea eax, [ebp + 0x190]
push eax
call esi
push 0x1004eefc
lea eax, [ebp + 0x398]
push eax
lea eax, [ebp - 0x78]
push eax
call esi
lea eax, [ebp + 0x190]
push eax
call ebx
test eax, eax
je 0x10025af9
mov ecx, dword [ebp - 0x80]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x190]
push eax
call fcn.1002412e
test eax, eax
je 0x10025af9
mov ecx, dword [ebp - 0x80]
lea eax, [ebp + 0x5a0]
push eax
call fcn.10023556
lea eax, [ebp + 0x5a0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp + 0x5a0]
push eax
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp + 0x7a8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10031770
add ebp, 0x7ac
leave
ret 4
Function at 0x10025eb4
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x5a4]
sub esp, 0x624
mov eax, dword [0x100598e8]
xor eax, ebp
mov dword [ebp + 0x5a0], eax
push esi
push edi
xor edi, edi
push edi
lea ecx, [ebp - 0x79]
call fcn.100258c9
lea ecx, [ebp - 0x79]
mov esi, eax
call fcn.10024f96
xor eax, eax
cmp esi, edi
je 0x10025fd1
mov esi, 0x206
push esi
mov word [ebp + 0x398], ax
lea eax, [ebp + 0x39a]
push edi
push eax
call fcn.10031310
xor eax, eax
push esi
mov word [ebp - 0x78], ax
lea eax, [ebp - 0x76]
push edi
push eax
call fcn.10031310
add esp, 0x18
lea eax, [ebp + 0x398]
push eax
lea ecx, [ebp - 0x79]
call fcn.10024e9a
test eax, eax
je 0x10025fd1
push ebx
push 0x1004ee4c
lea eax, [ebp + 0x398]
push eax
mov ebx, 0x1004ee38
push ebx
mov edi, 0x104
lea eax, [ebp - 0x78]
push edi
push eax
call fcn.1000e4b8
lea eax, [ebp - 0x78]
push eax
call fcn.100234e2
mov dword [ebp - 0x80], eax
xor eax, eax
push esi
push eax
mov word [ebp + 0x190], ax
lea eax, [ebp + 0x192]
push eax
call fcn.10031310
add esp, 0x24
mov esi, 0x1004edf0
push esi
lea eax, [ebp + 0x398]
push eax
lea eax, [ebp + 0x190]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp + 0x190]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10025fcd
push esi
lea eax, [ebp + 0x398]
push eax
push ebx
lea eax, [ebp + 0x190]
push edi
push eax
call fcn.1000e4b8
lea eax, [ebp + 0x190]
push eax
call fcn.100234e2
add esp, 0x18
mov eax, dword [ebp - 0x80]
pop ebx
mov ecx, dword [ebp + 0x5a0]
pop edi
xor ecx, ebp
pop esi
call fcn.10031770
add ebp, 0x5a4
leave
ret
Function at 0x10025fe8
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x7ac]
sub esp, 0x82c
mov eax, dword [0x100598e8]
xor eax, ebp
mov dword [ebp + 0x7a8], eax
mov dword [ebp - 0x80], ecx
call fcn.1002558d
test eax, eax
je 0x10026206
push ebx
push edi
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp + 0x398], ax
xor ebx, ebx
lea eax, [ebp + 0x39a]
push ebx
push eax
call fcn.10031310
mov ecx, dword [ebp - 0x80]
add esp, 0xc
lea eax, [ebp + 0x398]
push eax
call fcn.10024b05
test eax, eax
je 0x10026204
push esi
xor eax, eax
push edi
mov word [ebp + 0x5a0], ax
lea eax, [ebp + 0x5a2]
push ebx
push eax
mov dword [ebp - 0x7c], 1
call fcn.10031310
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push 0x1004e228
lea eax, [ebp + 0x398]
push eax
lea eax, [ebp + 0x5a0]
push eax
call esi
cmp dword [ebp + 0x7b4], ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
je 0x100260a9
lea eax, [ebp + 0x5a0]
push eax
call ebx
test eax, eax
jne 0x1002615c
xor eax, eax
push edi
push eax
mov word [ebp + 0x190], ax
lea eax, [ebp + 0x192]
push eax
call fcn.10031310
add esp, 0xc
push 0x1004eeb0
lea eax, [ebp + 0x398]
push eax
lea eax, [ebp + 0x190]
push eax
call esi
xor eax, eax
push edi
mov word [ebp - 0x78], ax
xor edi, edi
lea eax, [ebp - 0x76]
push edi
push eax
call fcn.10031310
add esp, 0xc
push 0x1004f024
lea eax, [ebp + 0x398]
push eax
lea eax, [ebp - 0x78]
push eax
call esi
lea eax, [ebp + 0x190]
push eax
call ebx
test eax, eax
je 0x10026124
mov ecx, dword [ebp - 0x80]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x190]
push eax
call fcn.1002412e
test eax, eax
jne 0x10026129
mov dword [ebp - 0x7c], edi
jmp 0x1002615e
mov ecx, dword [ebp - 0x80]
lea eax, [ebp + 0x5a0]
push eax
call fcn.10023556
lea eax, [ebp + 0x5a0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp + 0x5a0]
push eax
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x1002615e
jmp 0x10026124
xor edi, edi
push 0x1004eda8
lea eax, [ebp + 0x398]
push eax
lea eax, [ebp + 0x5a0]
push eax
call esi
cmp dword [ebp + 0x7b4], edi
je 0x10026188
lea eax, [ebp + 0x5a0]
push eax
call ebx
test eax, eax
jne 0x10026200
push 0x1004f008
lea eax, [ebp + 0x398]
push eax
lea eax, [ebp + 0x190]
push eax
call esi
push 0x1004efe8
lea eax, [ebp + 0x398]
push eax
lea eax, [ebp - 0x78]
push eax
call esi
lea eax, [ebp + 0x190]
push eax
call ebx
test eax, eax
je 0x10026200
mov ecx, dword [ebp - 0x80]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x190]
push eax
call fcn.1002412e
test eax, eax
je 0x10026200
mov ecx, dword [ebp - 0x80]
lea eax, [ebp + 0x5a0]
push eax
call fcn.10023556
lea eax, [ebp + 0x5a0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp + 0x5a0]
push eax
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov eax, dword [ebp - 0x7c]
pop esi
pop edi
pop ebx
mov ecx, dword [ebp + 0x7a8]
xor ecx, ebp
call fcn.10031770
add ebp, 0x7ac
leave
ret 4
Function at 0x1002622d
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x5a4]
sub esp, 0x624
mov eax, dword [0x100598e8]
xor eax, ebp
mov dword [ebp + 0x5a0], eax
push esi
push edi
push dword [0x1005cbc4]
mov ecx, 0x1005bb10
call fcn.100187d0
xor edi, edi
push edi
lea ecx, [ebp - 0x79]
call fcn.10025fe8
lea ecx, [ebp - 0x79]
mov esi, eax
call fcn.1002566f
xor eax, eax
cmp esi, edi
je 0x1002635a
mov esi, 0x206
push esi
mov word [ebp + 0x398], ax
lea eax, [ebp + 0x39a]
push edi
push eax
call fcn.10031310
xor eax, eax
push esi
mov word [ebp - 0x78], ax
lea eax, [ebp - 0x76]
push edi
push eax
call fcn.10031310
add esp, 0x18
lea eax, [ebp + 0x398]
push eax
lea ecx, [ebp - 0x79]
call fcn.10024b05
test eax, eax
je 0x1002635a
push ebx
push 0x1004e228
lea eax, [ebp + 0x398]
push eax
mov ebx, 0x1004ee38
push ebx
mov edi, 0x104
lea eax, [ebp - 0x78]
push edi
push eax
call fcn.1000e4b8
lea eax, [ebp - 0x78]
push eax
call fcn.100234e2
mov dword [ebp - 0x80], eax
xor eax, eax
push esi
push eax
mov word [ebp + 0x190], ax
lea eax, [ebp + 0x192]
push eax
call fcn.10031310
add esp, 0x24
mov esi, 0x1004eda8
push esi
lea eax, [ebp + 0x398]
push eax
lea eax, [ebp + 0x190]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp + 0x190]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10026356
push esi
lea eax, [ebp + 0x398]
push eax
push ebx
lea eax, [ebp + 0x190]
push edi
push eax
call fcn.1000e4b8
lea eax, [ebp + 0x190]
push eax
call fcn.100234e2
add esp, 0x18
mov eax, dword [ebp - 0x80]
pop ebx
mov ecx, dword [ebp + 0x5a0]
pop edi
xor ecx, ebp
pop esi
call fcn.10031770
add ebp, 0x5a4
leave
ret