joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10023960
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1f0]
sub esp, 0x270
mov eax, dword [0x10098428]
xor eax, ebp
mov dword [ebp + 0x1ec], eax
mov eax, dword [ebp + 0x1f8]
push ebx
push esi
push edi
xor ebx, ebx
push 0x208
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x1e]
push ebx
push eax
mov word [ebp - 0x20], bx
call fcn.10053710
add esp, 0xc
lea esi, [ebp - 0x20]
call fcn.10023a42
push 0x10085c44
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x40
lea eax, [ebp - 0x7c]
push ebx
push eax
call fcn.10053710
xor eax, eax
mov dword [ebp - 0x3c], ebx
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov eax, esi
push eax
push ebx
mov dword [ebp - 0x80], 0x44
mov dword [ebp - 0x54], 0x80
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, ebx
mov dword [ebp - 0x28], eax
je 0x10023a25
mov eax, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x2c]
add esi, 0x44
lea edi, [ebp - 0x24]
mov dword [ebp - 0x24], eax
call fcn.10022409
cmp dword [ebp - 0x24], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x10023a20
push dword [ebp - 0x24]
call esi
push dword [ebp - 0x38]
call esi
mov ecx, dword [ebp + 0x1ec]
mov eax, dword [ebp - 0x28]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10053191
add ebp, 0x1f0
leave
ret 4

Function at 0x10023a7c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov ebx, ecx
lea esi, [ebx + 0x48]
call fcn.1000927b
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
push ebx
push 0x10023ae8
push eax
push eax
mov dword [ebx + 0x68], eax
mov dword [ebp - 4], eax
call fcn.1005671f
add esp, 0x18
lea esi, [ebx + 0x44]
lea edi, [ebp + 8]
mov dword [ebp + 8], eax
call fcn.10022409
cmp dword [ebp + 8], 0
je 0x10023aca
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x10023adf
push 0xffffffffffffffff
push dword [ebx + 0x64]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebx + 0x68]
jmp 0x10023ae1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10023cb5
Capabilities:
Check if file exists
Delete file
Write file on windows

Disassembly:
push 0x14
mov eax, 0x10075898
call fcn.1005a354
call dword [0x1009960c]
push dword [ebp + 8]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x10023cde
xor edi, edi
jmp 0x10023cf6
lea edi, [eax + eax]
mov eax, edi
call fcn.10064570
mov esi, esp
push ebx
push edi
push dword [ebp + 8]
call fcn.10015d90
mov edi, eax
push edi
call fcn.100530f0
mov edx, edi
mov esi, eax
call fcn.1002e75d
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], eax
call fcn.1000915c
xor ebx, ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x14]
mov dword [esp], str.TxdlService.dat
push ecx
mov ecx, eax
call fcn.1000d4ab
mov eax, dword [ebp - 0x1c]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.10003389
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10023d4a
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x10085c40
push dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], ebx
call fcn.10058198
add esp, 0xc
cmp dword [ebp - 0x18], ebx
je 0x10023d8e
push dword [ebp - 0x18]
lea eax, [ebp - 0x20]
push 1
push 4
push eax
call fcn.10058347
push dword [ebp - 0x18]
inc esi
push esi
push 1
push edi
call fcn.10058347
push dword [ebp - 0x18]
call fcn.1005843b
add esp, 0x24
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.10003389
xor eax, eax
inc eax
lea esp, [ebp - 0x30]
call fcn.1005a3d7
ret 4

Function at 0x10023dbd
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x10098428]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x10023de7
xor eax, eax
jmp 0x10023e30
lea eax, [ebp - 0x230]
push eax
push esi
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x10023e23
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.1005762b
test eax, eax
pop ecx
pop ecx
jne 0x10023e16
xor edi, edi
inc edi
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10023e00
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10053191
leave
ret
Function at 0x10023e65
Capabilities:
Delete file

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebp, ebp
cmp dword [edi + 0x44], ebp
mov dword [edi], vtable.Txdl::CServiceLauncher.0
je 0x10023e9b
cmp dword [edi + 0x94], ebp
je 0x10023e9b
lea eax, [edi + 0x80]
cmp dword [eax + 0x18], 8
jb 0x10023e91
mov eax, dword [eax + 4]
jmp 0x10023e94
add eax, 4
push eax
call fcn.100093d5
pop ecx
lea ebx, [edi + 0x64]
cmp dword [ebx + 0x18], 8
jb 0x10023ea9
mov eax, dword [ebx + 4]
jmp 0x10023eac
lea eax, [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebp
push 1
lea esi, [edi + 0x80]
call fcn.10001efb
push ebp
push 1
mov esi, ebx
call fcn.10001efb
push ebp
push 1
lea esi, [edi + 0x48]
call fcn.10001efb
mov dword [edi], vtable.Txdl::CComSvcLauncherBase.0
mov ecx, edi
pop edi
pop esi
pop ebp
pop ebx
jmp fcn.10022d5f
Function at 0x100246fb
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
call fcn.100434e4
test al, al
mov esi, 0x1009d4a0
mov ebx, 0xd2
mov edi, str..PackageLauncher.cpp
je 0x1002472c
push esi
push str.EntryPoint__g_szCmdline_s
push ebx
push edi
call fcn.10043373
add esp, 0x10
push esi
call fcn.1005317b
test eax, eax
pop ecx
jne 0x10024751
call fcn.100434e4
test al, al
je 0x100247a9
push str.EntryPoint__g_szCmdline_is_empty
push ebx
push edi
call fcn.10043373
add esp, 0xc
jmp 0x100247a9
push 0x40
xor ebx, ebx
lea eax, [ebp - 0x50]
push ebx
push eax
call fcn.10053710
xor eax, eax
mov dword [ebp - 0x10], ebx
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
push ebx
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 0x81
mov word [ebp - 0x24], bx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x100247a9
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x100247b0
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x42c
lea ebp, [esp - 4]
mov eax, dword [0x10098428]
xor eax, ebp
mov dword [ebp + 0x42c], eax
push 4
mov eax, 0x10077a58
call fcn.1005a2eb
mov eax, dword [ebp + 0x438]
mov dword [ebp - 0x10], eax
mov edi, 0x100846e4
push edi
lea eax, [ebp]
mov esi, ecx
call fcn.1000189d
xor ebx, ebx
push 0xffffffffffffffff
lea eax, [esi + 4]
push ebx
lea esi, [ebp]
mov dword [ebp - 4], ebx
call fcn.10002207
push edi
mov eax, esi
push eax
call fcn.10006aa8
push 0x1007dc68
mov eax, esi
push eax
call fcn.10006aa8
push dword [ebp - 0x10]
mov eax, esi
push eax
call fcn.10006aa8
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x1002482d
lea eax, [ebp + 4]
push eax
push 0x208
push 0x1009d4a0
call fcn.10058053
mov edi, 0x206
push edi
lea eax, [ebp + 0x226]
push ebx
push eax
mov word [ebp + 0x224], bx
call fcn.10053710
add esp, 0x18
mov esi, 0x104
push esi
lea eax, [ebp + 0x224]
push eax
push dword [0x1009d49c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp + 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
push str._EntryPoint
lea eax, [ebp + 0x224]
push esi
push eax
call fcn.10057b8d
push edi
lea eax, [ebp + 0x1e]
push ebx
push eax
mov word [ebp + 0x1c], bx
call fcn.10053710
add esp, 0x18
push esi
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.rundll32.exe
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp + 0x1c]
push eax
xor edx, edx
lea ecx, [ebp + 0x224]
call fcn.10015e3c
pop ecx
push ebx
push 1
lea esi, [ebp]
mov edi, eax
call fcn.10001efb
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x42c]
xor ecx, ebp
call fcn.10053191
add ebp, 0x430
leave
ret 4
Function at 0x10024978
Capabilities:
Get session user name
Schedule task via itaskscheduler

Disassembly:
push ebp
lea ebp, [esp - 0x1a4]
sub esp, 0x224
mov eax, dword [0x10098428]
xor eax, ebp
mov dword [ebp + 0x1a0], eax
mov eax, dword [ebp + 0x1ac]
push edi
xor edi, edi
push edi
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x74], edi
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x10024b03
push esi
lea eax, [ebp - 0x70]
push eax
push 0x10085b60
push 1
push edi
push 0x10085b80
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
cmp esi, edi
jl 0x10024acc
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
mov esi, str.qminstall_task
push esi
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
lea edx, [ebp - 0x6c]
push edx
push 0x10085b50
push 0x10085b70
push esi
push eax
call dword [ecx + 0x20]
mov esi, eax
cmp esi, edi
jl 0x10024acc
cmp dword [ebx + 0x1c], 8
jb 0x10024a15
mov ecx, dword [ebx + 8]
jmp 0x10024a18
lea ecx, [ebx + 8]
mov eax, dword [ebp - 0x6c]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x80]
cmp dword [ebp - 0x78], edi
je 0x10024a46
push dword [ebp - 0x78]
call fcn.1005317b
test eax, eax
pop ecx
jbe 0x10024a46
mov eax, dword [ebp - 0x6c]
push dword [ebp - 0x78]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x88]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
push 0x2002
push eax
call dword [ecx + 0x70]
push 0x206
lea eax, [ebp - 0x66]
push edi
push eax
mov word [ebp - 0x68], di
call fcn.10053710
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x7c], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
push edi
lea edx, [ebp - 0x68]
push edx
push eax
call dword [ecx + 0x78]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
lea edx, [ebp - 0x74]
push edx
push 0x1007b6ec
push eax
call dword [ecx]
mov esi, eax
cmp esi, edi
jl 0x10024acc
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
push 1
push edi
push eax
call dword [ecx + 0x18]
mov esi, eax
cmp esi, edi
jl 0x10024acc
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x30]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
lea edx, [ebp - 0x80]
push edx
push eax
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x74]
cmp eax, edi
je 0x10024ad9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x6c]
cmp eax, edi
je 0x10024ae6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x70]
cmp eax, edi
je 0x10024af3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
cmp esi, edi
setge al
pop esi
jmp 0x10024b05
xor eax, eax
mov ecx, dword [ebp + 0x1a0]
xor ecx, ebp
pop edi
call fcn.10053191
add ebp, 0x1a4
leave
ret 4
Function at 0x1002665f
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10098428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [0x1009d49c]
push edi
push str.RT_RCDATA
push eax
xor ebx, ebx
push esi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, ebx
jne 0x100266a7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10053191
leave
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x10026696
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
cmp edi, ebx
je 0x10026696
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x10026696
push ebx
push 0x80
push 2
push ebx
push 1
push 0x10000000
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100266fb
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x10026696
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10026726
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x10026698
xor ebx, ebx
inc ebx
jmp 0x10026718

Function at 0x10026a78
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor ebx, ebx
push ebx
mov edi, eax
mov eax, dword [edi + 0x10]
mov ecx, dword [eax]
push str.target
push eax
call dword [ecx + 0x18]
push ebx
lea esi, [edi + 0x14]
mov edi, dword [edi + 0x10]
push str.supplyid
mov dword [ebp - 4], eax
mov eax, dword [edi]
push edi
call dword [eax + 0x18]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 4]
mov dword [esi + 0x14], eax
lea eax, [ebp - 0xc]
push eax
push eax
push eax
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push ebx
push ebx
push esi
push 0x100220d2
push ebx
push ebx
call fcn.1005671f
add esp, 0x18
lea edi, [ebp - 4]
mov dword [ebp - 4], eax
call fcn.10022409
cmp dword [ebp - 4], ebx
pop edi
pop esi
pop ebx
je 0x10026af7
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret
Function at 0x10026af9
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, eax
mov eax, ebx
cdq
push 3
pop ecx
idiv ecx
mov eax, ebx
xor esi, esi
sub eax, edx
lea eax, [eax*4 + 0xc]
cdq
idiv ecx
inc eax
push eax
call fcn.10055ae7
pop ecx
mov ecx, eax
test ecx, ecx
je 0x10026c0a
cmp ebx, 2
jle 0x10026ba3
lea eax, [ebx - 3]
xor edx, edx
push 3
pop ebx
div ebx
inc eax
mov dword [ebp - 4], eax
imul eax, eax, 0xfffffffd
add dword [ebp + 8], eax
movzx edx, byte [edi]
mov eax, edx
shr eax, 2
mov al, byte [eax + 0x100999a0]
mov byte [ecx + esi], al
movzx eax, byte [edi + 1]
and edx, 3
shl edx, 4
mov ebx, eax
shr ebx, 4
mov dl, byte [ebx + edx + 0x100999a0]
inc esi
mov byte [ecx + esi], dl
movzx edx, byte [edi + 2]
and eax, 0xf
mov ebx, edx
shr ebx, 6
mov al, byte [ebx + eax*4 + 0x100999a0]
inc esi
mov byte [ecx + esi], al
and edx, 0x3f
mov al, byte [edx + 0x100999a0]
inc esi
mov byte [ecx + esi], al
inc esi
add edi, 3
dec dword [ebp - 4]
jne 0x10026b48
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x10026bfb
movzx eax, byte [edi]
mov edx, eax
shr edx, 2
mov dl, byte [edx + 0x100999a0]
and eax, 3
mov byte [ecx + esi], dl
inc esi
shl eax, 4
cmp ebx, 1
jle 0x10026be7
movzx edx, byte [edi + 1]
mov edi, edx
shr edi, 4
mov al, byte [edi + eax + 0x100999a0]
mov byte [ecx + esi], al
inc esi
and edx, 0xf
mov al, byte [edx*4 + 0x100999a0]
mov byte [ecx + esi], al
jmp 0x10026bf5
mov al, byte [eax + 0x100999a0]
mov byte [ecx + esi], al
inc esi
mov byte [ecx + esi], 0x3d
inc esi
mov byte [ecx + esi], 0x3d
inc esi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10026c04
mov dword [eax], esi
mov byte [ecx + esi], 0
mov eax, ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100272dd
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100779c8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10098428]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor esi, esi
cmp dword [edi + 0x2c], esi
jne 0x1002731b
xor eax, eax
inc eax
jmp 0x10027481
lea eax, [edi + 0x68]
mov dword [edi + 0x2c], esi
call fcn.1002b577
mov eax, dword [edi + 0x40]
cmp eax, esi
je 0x10027337
push eax
call fcn.100734e0
pop ecx
mov dword [edi + 0x40], esi
mov ebx, dword [edi + 0x44]
cmp ebx, esi
je 0x1002735b
push str.DestoryDownloader.
push 3
call fcn.1003a124
cmp ebx, esi
pop ecx
pop ecx
je 0x10027358
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax]
mov dword [edi + 0x44], esi
lea ebx, [edi + 0x48]
call fcn.1002b522
lea ebx, [edi + 0x58]
call fcn.1002b522
lea ebx, [edi + 0x84]
mov eax, dword [ebx]
cmp eax, esi
je 0x10027380
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [ebx], esi
lea esi, [edi + 0x14]
call fcn.10022097
push edi
call fcn.100298e3
call fcn.1002b6dd
call fcn.100233f9
call fcn.1003edc0
lea ecx, [esp + 0x18]
call fcn.1002672b
and dword [esp + 0x30], 0
lea ecx, [esp + 0x14]
push str.dlcore.dll
push ecx
mov ecx, eax
call fcn.1000d4ab
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop ecx
pop ecx
push dword [eax]
call ebx
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.10003389
or dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.10003389
lea esi, [esp + 0x14]
call fcn.10009079
lea ecx, [esp + 0x18]
push str.TxdlProxy.exe
push ecx
mov ecx, eax
mov dword [esp + 0x38], 1
call fcn.1000d4ab
pop ecx
pop ecx
push dword [eax]
call ebx
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.10003389
or dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.10003389
lea ecx, [esp + 0x20]
call fcn.1000915c
lea ecx, [esp + 0x1c]
push str.TxdlCom.exe
push ecx
mov ecx, eax
mov dword [esp + 0x38], 2
call fcn.1000d4ab
pop ecx
pop ecx
push dword [eax]
call ebx
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
call fcn.10003389
or dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
call fcn.10003389
push dword [edi + 0x3c]
call ebx
call fcn.1002a000
push edi
call fcn.1002b178
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10027496
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp dword [ebx + 0x40], 0
push esi
push edi
jne 0x100274ae
xor al, al
jmp 0x100275dd
lea eax, [ebx + 0x30]
mov ecx, dword [eax + 4]
mov ecx, dword [ecx]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x34]
lea edi, [esp + 0x10]
lea esi, [esp + 8]
mov dword [esp + 0x14], eax
call fcn.1004a229
test al, al
jne 0x100275db
mov esi, dword [esp + 8]
test esi, esi
jne 0x100274eb
call fcn.10053094
mov edi, dword [esp + 0xc]
cmp edi, dword [esi + 4]
jne 0x100274f9
call fcn.10053094
mov esi, dword [edi + 0xc]
test esi, esi
je 0x10027561
cmp dword [esi + 8], 4
ja 0x10027561
cmp dword [esi + 4], 0x186a0
jne 0x10027561
mov eax, dword [esp + 8]
cmp edi, dword [eax + 4]
jne 0x1002751d
call fcn.10053094
mov edi, dword [edi + 0x10]
test edi, edi
je 0x10027561
cmp dword [edi + 0x34], 8
jb 0x1002752f
mov eax, dword [edi + 0x20]
jmp 0x10027532
lea eax, [edi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebx + 0x40]
mov eax, dword [ecx]
push esi
push edi
call dword [eax + 4]
test eax, eax
je 0x1002756f
mov eax, dword [esi]
mov dword [ebx + 0x78], eax
lea eax, [ebx + 0xac]
and dword [eax], 0
mov dword [esi + 8], 5
mov eax, dword [eax]
mov dword [esi + 0xc], eax
lea esi, [esp + 8]
call fcn.1002b764
jmp 0x100274c2
mov dword [ebx + 0xac], 2
mov dword [esi + 8], 7
mov eax, dword [ebx + 0xac]
mov dword [esi + 0xc], eax
lea edi, [ebx + 0x48]
lea esi, [esp + 8]
call fcn.1002b508
jmp 0x100275bb
lea esi, [esp + 8]
call fcn.1002b7b1
mov eax, dword [eax]
test eax, eax
je 0x100275b2
push dword [ebx + 0xac]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
lea esi, [esp + 8]
call fcn.1002b7ce
lea esi, [esp + 0x10]
lea edi, [ebx + 0x48]
call fcn.1002b59f
mov edi, eax
lea esi, [esp + 8]
call fcn.1002b7ee
test al, al
jne 0x10027597
jmp 0x100274a7
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10027610
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100434e4
test al, al
je 0x1002763c
push str.CTxdlControllerImp::DownloadNext
push 0xd2
push str..TxdlController.cpp
call fcn.10043373
add esp, 0xc
mov edi, dword [ebp + 8]
call fcn.10029e0c
test eax, eax
mov dword [esp + 0xc], eax
je 0x100277d8
lea eax, [edi + 0x30]
mov ecx, dword [eax + 4]
mov ebx, dword [ecx]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
lea eax, [edi + 0x30]
mov eax, dword [eax + 4]
lea edi, [esp + 0x18]
lea esi, [esp + 0x10]
mov dword [esp + 0x1c], eax
call fcn.1004a229
test al, al
jne 0x100277d8
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x10027690
call fcn.10053094
cmp ebx, dword [esi + 4]
jne 0x1002769a
call fcn.10053094
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cmp esi, dword [eax + 4]
mov ebx, dword [ebx + 0xc]
jne 0x100276af
call fcn.10053094
test ebx, ebx
mov esi, dword [esi + 0x10]
je 0x100276c0
test esi, esi
je 0x100276c0
cmp dword [ebx + 8], 4
jbe 0x100276d2
lea esi, [esp + 0x10]
call fcn.1002b764
mov edi, dword [ebp + 8]
mov ebx, dword [esp + 0x14]
jmp 0x10027664
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
push ebx
push esi
call dword [eax + 4]
test eax, eax
je 0x10027767
cmp dword [esi + 0x34], 8
jb 0x100276f0
mov esi, dword [esi + 0x20]
jmp 0x100276f3
add esi, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp + 8]
lea eax, [ecx + 0xac]
and dword [eax], 0
mov dword [ebx + 8], 5
mov eax, dword [eax]
lea edi, [ecx + 0x48]
lea esi, [esp + 0x10]
mov dword [ebx + 0xc], eax
mov dword [esp + 0xc], edi
call fcn.1002b508
jmp 0x1002774b
lea esi, [esp + 0x10]
call fcn.1002b7b1
mov eax, dword [eax]
test eax, eax
je 0x1002773e
mov ecx, dword [eax]
push 0
push 0
push ebx
push eax
call dword [ecx + 0x10]
lea esi, [esp + 0x10]
call fcn.1002b7ce
mov edi, dword [esp + 0xc]
lea esi, [esp + 0x18]
call fcn.1002b59f
mov edi, eax
lea esi, [esp + 0x10]
call fcn.1002b7ee
test al, al
jne 0x10027724
xor eax, eax
jmp 0x100277dd
mov eax, dword [ebp + 8]
mov dword [eax + 0xac], 0x12
mov dword [ebx + 8], 7
mov ecx, dword [eax + 0xac]
lea edi, [eax + 0x48]
lea esi, [esp + 0x10]
mov dword [ebx + 0xc], ecx
call fcn.1002b508
jmp 0x100277ba
lea esi, [esp + 0x10]
call fcn.1002b7b1
mov eax, dword [eax]
test eax, eax
je 0x100277b1
mov edx, dword [ebp + 8]
push dword [edx + 0xac]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x14]
lea esi, [esp + 0x10]
call fcn.1002b7ce
mov edi, dword [ebp + 8]
lea esi, [esp + 0x18]
add edi, 0x48
call fcn.1002b59f
mov edi, eax
lea esi, [esp + 0x10]
call fcn.1002b7ee
test al, al
jne 0x10027792
mov eax, 0x80004005
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4