joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002a8c0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006adf0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x1008b008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.100028d8
test al, al
je 0x1002a8fd
xor al, al
jmp 0x1002aaa9
mov ecx, edi
call fcn.1002a7d0
test al, al
je 0x1002a90f
mov al, 1
jmp 0x1002aaa9
push 0
mov ecx, edi
call fcn.100028e0
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push eax
call ebx
test eax, eax
jne 0x1002a95e
lea ecx, [ebp - 0x28]
call fcn.10003c19
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.1003b020
test al, al
je 0x1002a94f
push 0
lea ecx, [ebp - 0x28]
call fcn.100028e0
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.100028eb
mov ecx, edi
call fcn.1002a7d0
test al, al
jne 0x1002a908
mov ecx, edi
call fcn.100029d1
xor esi, esi
mov dword [ebp - 0x44], eax
test eax, eax
je 0x1002aa4e
mov ecx, edi
call fcn.100029a0
mov ebx, eax
mov ecx, dword [ebx + 0x14]
mov eax, ebx
cmp ecx, 8
jb 0x1002a992
mov eax, dword [ebx]
mov edx, 0x2f
cmp dx, word [eax + esi*2]
mov edx, 0x5c
je 0x1002a9b5
mov eax, ebx
cmp ecx, 8
jb 0x1002a9ab
mov eax, dword [ebx]
cmp dx, word [eax + esi*2]
jne 0x1002aa3e
push esi
push 0
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.10005628
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.100028d8
test al, al
jne 0x1002aa2f
lea ecx, [ebp - 0x28]
call fcn.1002a4a0
test al, al
jne 0x1002aa2f
push 0
lea ecx, [ebp - 0x28]
call fcn.100028e0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1002aa2f
lea ecx, [ebp - 0x40]
call fcn.10003c19
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.1003b020
test al, al
je 0x1002aa23
push 0
lea ecx, [ebp - 0x40]
call fcn.100028e0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.100028eb
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.100028eb
inc esi
cmp esi, dword [ebp - 0x44]
jb 0x1002a986
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, edi
call fcn.1002a4a0
test al, al
jne 0x1002aaa2
push 0
mov ecx, edi
call fcn.100028e0
push eax
call ebx
test eax, eax
jne 0x1002aaa2
lea ecx, [ebp - 0x40]
call fcn.10003c19
mov dword [ebp - 4], 3
lea edx, [ebp - 0x40]
mov ecx, edi
call fcn.1003b020
test al, al
je 0x1002aa93
push 0
lea ecx, [ebp - 0x40]
call fcn.100028e0
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.100028eb
mov ecx, edi
call fcn.1002a7d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10045845
mov esp, ebp
pop ebp
ret
Function at 0x1002c590
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x140
mov eax, dword [0x1008b008]
xor eax, esp
mov dword [esp + 0x13c], eax
push esi
mov esi, ecx
push 0x118
push 0
lea eax, [esi + 4]
push eax
call fcn.10048ef0
add esp, 0xc
mov dword [esi], 0x11c
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1002c6d2
cmp dword [esi + 4], 6
push edi
ja 0x1002c5e6
jne 0x1002c66e
cmp dword [esi + 8], 2
jb 0x1002c66e
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x1002c66e
push 0x10
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1002c66e
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1002c66e
movups xmm0, xmmword [str.VS_VERSION_INFO]
push eax
movups xmmword [esp + 0x128], xmm0
movups xmm0, xmmword [0x1007ec20]
movups xmmword [esp + 0x138], xmm0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x1002c66e
lea eax, [esp + 0x124]
push eax
lea ecx, [edi + 6]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1002c66e
cmp word [edi + 2], ax
jbe 0x1002c66e
movzx edx, word [edi + 0x32]
movzx ecx, word [edi + 0x30]
movzx eax, word [edi + 0x36]
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1002c6b9
push 0x118
lea eax, [esp + 0x10]
push 0
push eax
call fcn.10048ef0
add esp, 0xc
mov dword [esp + 8], 0x11c
lea eax, [esp + 8]
push eax
call edi
test eax, eax
jne 0x1002c6b9
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x13c]
xor ecx, esp
call fcn.10045845
add esp, 0x140
ret
mov ecx, dword [esp + 0x140]
xor al, al
pop esi
xor ecx, esp
call fcn.10045845
add esp, 0x140
ret
Function at 0x1002c5a4
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x140
mov eax, dword [0x1008b008]
xor eax, esp
mov dword [esp + 0x13c], eax
push esi
mov esi, ecx
push 0x118
push 0
lea eax, [esi + 4]
push eax
call fcn.10048ef0
add esp, 0xc
mov dword [esi], 0x11c
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1002c6d2
cmp dword [esi + 4], 6
push edi
ja 0x1002c5e6
jne 0x1002c66e
cmp dword [esi + 8], 2
jb 0x1002c66e
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x1002c66e
push 0x10
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1002c66e
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1002c66e
movups xmm0, xmmword [str.VS_VERSION_INFO]
push eax
movups xmmword [esp + 0x128], xmm0
movups xmm0, xmmword [0x1007ec20]
movups xmmword [esp + 0x138], xmm0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x1002c66e
lea eax, [esp + 0x124]
push eax
lea ecx, [edi + 6]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1002c66e
cmp word [edi + 2], ax
jbe 0x1002c66e
movzx edx, word [edi + 0x32]
movzx ecx, word [edi + 0x30]
movzx eax, word [edi + 0x36]
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1002c6b9
push 0x118
lea eax, [esp + 0x10]
push 0
push eax
call fcn.10048ef0
add esp, 0xc
mov dword [esp + 8], 0x11c
lea eax, [esp + 8]
push eax
call edi
test eax, eax
jne 0x1002c6b9
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x13c]
xor ecx, esp
call fcn.10045845
add esp, 0x140
ret
mov ecx, dword [esp + 0x140]
xor al, al
pop esi
xor ecx, esp
call fcn.10045845
add esp, 0x140
ret
Function at 0x1002de30
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10068258
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x1008b008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x1002de6b
xor al, al
jmp 0x1002def2
add eax, 0x20
mov dword [ebp - 0x14], 0
push eax
lea ecx, [ebp - 0x14]
call fcn.10003e08
mov dword [ebp - 4], 0
mov eax, dword [esi + 8]
cmp dword [eax + 4], 0
je 0x1002dedf
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
lea edi, [esi + 4]
push 1
push edi
call ebx
mov eax, dword [esi + 8]
add eax, 0xc
push eax
push 4
push esi
push 0x1002da20
push 0
push 0
call fcn.10055eb6
mov ecx, dword [esi + 8]
add esp, 0x18
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 8]
cmp dword [eax + 0x10], 0
jne 0x1002df0e
push 0xffffffffffffffff
push edi
call ebx
sub eax, 1
jne 0x1002ded7
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [esi + 8]
call fcn.1002dba0
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10003e2b
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10045845
mov esp, ebp
pop ebp
ret
mov byte [eax + 8], 1
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x1002df26
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x1002dec6
mov bl, 1
jmp 0x1002dee1
Function at 0x1002e7b0
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x124]
sub esp, 0x124
push 0xffffffffffffffff
push 0x1006b62a
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1008b008]
xor eax, ebp
mov dword [ebp + 0x120], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi], 0
je 0x1002e7f5
call fcn.1002ea00
cmp byte [0x1008d734], 0
jne 0x1002e808
mov eax, 0x80000001
jmp 0x1002e9d1
mov eax, dword [esi]
test eax, eax
jne 0x1002e873
push 8
call fcn.10045a5f
mov edi, eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0
push 1
call fcn.10045a5f
mov dword [edi + 4], eax
push 0x118
push 0
mov byte [eax], 0
lea eax, [ebp + 8]
push eax
call fcn.10048ef0
add esp, 0x14
mov dword [ebp + 4], 0x11c
lea eax, [ebp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1002e862
cmp dword [ebp + 8], 6
mov eax, dword [edi + 4]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 0xffffffff
mov dword [esi], edi
mov dword [edi], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x1002e9c0
call fcn.100384d0
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test al, al
jne 0x1002e966
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x30]
mov eax, dword [esi]
add eax, 4
mov byte [ebp - 0xd], 0
push str.Advapi32.dll
mov dword [ebp - 0x14], eax
call fcn.100028f0
mov dword [ebp - 4], 2
lea eax, [ebp - 0x30]
push eax
call fcn.10030880
mov ecx, eax
call fcn.10030940
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.100028eb
test edi, edi
je 0x1002e9c0
push 0x10080338
push edi
call ebx
mov ebx, eax
test ebx, ebx
je 0x1002e9c0
push dword [ebp - 0x18]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x1002e9c0
lea eax, [ebp]
mov dword [ebp], 0
push eax
push 0x20008
push edi
call ebx
test eax, eax
je 0x1002e933
push dword [ebp]
mov ecx, dword [ebp - 0x14]
call fcn.10038640
mov bl, al
jmp 0x1002e936
mov bl, byte [ebp - 0xd]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov ecx, dword [ebp]
test ecx, ecx
je 0x1002e949
push ecx
call edi
test bl, bl
je 0x1002e9c0
mov ecx, dword [esi]
add ecx, 4
call fcn.10038030
call fcn.100384d0
test al, al
je 0x1002e9c0
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Advapi32.dll
lea ecx, [ebp - 0x30]
call fcn.100028f0
mov dword [ebp - 4], 3
lea eax, [ebp - 0x30]
push eax
call fcn.10030880
mov ecx, eax
call fcn.10030940
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.100028eb
test edi, edi
je 0x1002e9c0
push str.RegOpenCurrentUser
push edi
call ebx
test eax, eax
je 0x1002e9c0
push dword [esi]
push 0x20019
call eax
test eax, eax
je 0x1002e9c0
mov eax, dword [esi]
mov dword [eax], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x1002e9cf
mov dword [eax], 0x80000001
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x120]
xor ecx, ebp
call fcn.10045845
lea esp, [ebp + 0x124]
pop ebp
ret 4
Function at 0x10036ea0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x1008b008]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov dword [esp + 4], 0x114
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
call fcn.10048ef0
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x10036f37
cmp dword [esp + 8], 6
jb 0x10036f37
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.10045845
add esp, 0x118
ret

Function at 0x10036f60
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006c480
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x1008b008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.wintrust.dll
lea ecx, [ebp - 0x28]
call fcn.100028f0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.10030880
mov ecx, eax
call fcn.10030940
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.100028eb
push str.crypt32.dll
lea ecx, [ebp - 0x40]
call fcn.100028f0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
call fcn.10030880
mov ecx, eax
call fcn.10030940
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.100028eb
test ebx, ebx
je 0x10037075
test esi, esi
je 0x10037075
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push ebx
call esi
push str.CryptCATAdminAcquireContext
push ebx
mov dword [edi + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push ebx
mov dword [edi + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push ebx
mov dword [edi + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push ebx
mov dword [edi + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push ebx
mov dword [edi + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push ebx
mov dword [edi + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push ebx
mov dword [edi + 0x1c], eax
call esi
push str.WinVerifyTrust
push ebx
mov dword [edi + 0x20], eax
call esi
push str.CertNameToStrW
push dword [ebp - 0x10]
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10039c10
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x808]
sub esp, 0x808
push 0xffffffffffffffff
push 0x1006c840
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x1008b008]
xor eax, ebp
mov dword [ebp + 0x804], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
lea eax, [ebp + 4]
push eax
push 0x3fe
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
je 0x10039cd9
lea edx, [ebp + 4]
mov dword [ebp], 0
xor esi, esi
mov dword [ebp - 0x14], edx
mov dword [ebp], esi
mov dword [ebp - 4], esi
cmp edi, 0x3fe
jbe 0x10039cfe
xor ecx, ecx
lea eax, [edi + 2]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10045a56
add esp, 4
mov ebx, eax
mov esi, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp], esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x10039cc5
cmp eax, edi
ja 0x10039cc5
mov edx, ebx
xor ecx, ecx
mov edi, eax
mov dword [ebp - 0x10], edi
mov dword [edx + eax*2], ecx
jmp 0x10039d26
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x10039cd9
push ebx
call fcn.10045856
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x804]
xor ecx, ebp
call fcn.10045845
lea esp, [ebp + 0x808]
pop ebp
ret
lea eax, [edi + edi]
cmp eax, 0x800
jae 0x10039e1d
xor ecx, ecx
mov word [ebp + eax + 4], cx
add eax, 2
cmp eax, 0x800
jae 0x10039e1d
mov word [ebp + eax + 4], cx
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x18], ebx
test edi, edi
je 0x10039e02
mov eax, dword [ebp - 0x10]
mov edi, 2
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], edi
cmp word [edx + edi - 2], 0
jne 0x10039ded
cmp ecx, ebx
je 0x10039ded
lea eax, [edx + ecx*2]
push eax
lea ecx, [ebp - 0x38]
call fcn.100028f0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x38]
push eax
call fcn.10002bc4
add esp, 4
mov ecx, esi
mov edx, eax
call fcn.10002988
mov ecx, edx
test al, al
je 0x10039dc3
call fcn.100029a0
mov ecx, esi
mov edx, eax
call fcn.10002930
mov ecx, edx
mov ebx, eax
call fcn.100029a0
push dword [ebx]
mov edi, eax
push 0x18
call fcn.1000235c
add esp, 8
mov ecx, edi
mov edx, eax
call fcn.100029a0
push eax
mov ecx, edx
call fcn.10002ee7
add dword [ebx], 0x18
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
jmp 0x10039dd8
call fcn.100029a0
push eax
mov ecx, esi
call fcn.10002930
mov eax, dword [eax]
push eax
call fcn.10002bcc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.100028eb
mov eax, dword [ebp - 0x10]
lea ecx, [ebx + 1]
mov edx, dword [ebp - 0x14]
inc ebx
add edi, 2
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], edi
cmp ebx, eax
jb 0x10039d43
mov esi, dword [ebp]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10039e16
push esi
call fcn.10045856
add esp, 4
mov al, 1
jmp 0x10039cdb
call fcn.1004597c
int3
Function at 0x1003a110
Capabilities:
Get common file path

Disassembly:
sub esp, 0x224
mov eax, dword [0x1008b008]
xor eax, esp
mov dword [esp + 0x220], eax
push ebp
push 0x20c
lea eax, [esp + 0x1c]
mov ebp, ecx
push 0
push eax
call fcn.10048ef0
add esp, 0xc
lea eax, [esp + 0x18]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x103
ja 0x1003a314
push ebx
xor eax, eax
push esi
mov word [esp + 0x22a], ax
lea eax, [esp + 0x20]
push edi
push eax
call fcn.10002ab7
add esp, 4
mov ecx, ebp
mov ebx, eax
call fcn.100029a0
mov edi, eax
mov eax, dword [edi + 0x14]
mov dword [esp + 0x20], eax
cmp ebx, eax
ja 0x1003a1bd
mov esi, edi
cmp eax, 8
jb 0x1003a190
mov esi, dword [edi]
push ebx
lea eax, [esp + 0x28]
mov dword [edi + 0x10], ebx
push eax
push esi
call fcn.10002a85
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.10002a74
add esp, 0x14
jmp 0x1003a2f9
mov ecx, ebp
call fcn.10002ee1
cmp ebx, eax
ja 0x1003a32c
mov ecx, ebp
call fcn.10002ee1
mov ecx, ebx
mov esi, eax
or ecx, 7
mov dword [esp + 0x18], ecx
cmp ecx, esi
ja 0x1003a213
mov ecx, ebp
call fcn.100029a0
mov edx, dword [eax + 0x14]
mov ecx, edx
shr ecx, 1
mov eax, esi
sub eax, ecx
cmp edx, eax
ja 0x1003a213
lea eax, [ecx + edx]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.10002a23
add esp, 8
mov esi, dword [eax]
lea eax, [esi + 1]
lea ecx, [eax + eax]
cmp eax, 0x7fffffff
jbe 0x1003a225
or ecx, 0xffffffff
jmp 0x1003a22d
cmp ecx, 0x1000
jb 0x1003a256
lea eax, [ecx + 0x23]
or edx, 0xffffffff
cmp eax, ecx
cmovbe eax, edx
push eax
call fcn.10045a5f
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x1003a331
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x1003a267
test ecx, ecx
je 0x1003a265
push ecx
call fcn.10045a5f
add esp, 4
jmp 0x1003a267
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x24]
push ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], esi
mov esi, dword [esp + 0x14]
push eax
push esi
call fcn.10002a9e
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.10002a74
mov ecx, dword [esp + 0x34]
add esp, 0x14
cmp ecx, 8
jb 0x1003a2d8
mov eax, dword [edi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x1003a2c6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003a331
mov eax, edx
push ecx
push eax
call fcn.10045a8f
mov eax, dword [esp + 0x18]
add esp, 8
mov dword [edi], eax
jmp 0x1003a2f9
lea eax, [esp + 0x10]
push eax
call fcn.10002bc4
push edi
mov esi, eax
call fcn.10002bc4
push eax
push 4
call fcn.1000235c
mov ecx, dword [esi]
add esp, 0x10
mov dword [eax], ecx
pop edi
pop esi
pop ebx
mov al, 1
pop ebp
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.10045845
add esp, 0x224
ret
mov ecx, dword [esp + 0x224]
xor al, al
pop ebp
xor ecx, esp
call fcn.10045845
add esp, 0x224
ret
call fcn.10002e9f
call fcn.1004eec7
int3
Function at 0x1003a340
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10068668
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x1008b008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov ebx, ecx
and esi, 0xffffb1af
push esi
call fcn.100028e0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1003a389
mov al, 1
jmp 0x1003a3d1
lea ecx, [ebp - 0x28]
call fcn.10003c19
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, ebx
call fcn.1003b020
test al, al
je 0x1003a3be
push esi
lea ecx, [ebp - 0x28]
call fcn.100028e0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1003a3be
mov bl, 1
jmp 0x1003a3c0
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.100028eb
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10045845
mov esp, ebp
pop ebp
ret

Function at 0x1003a3f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10068668
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x1008b008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.100028e0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1003a46e
lea ecx, [ebp - 0x28]
call fcn.10003c19
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, ebx
call fcn.1003b020
test al, al
je 0x1003a45d
lea ecx, [ebp - 0x28]
call fcn.100028e0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.100028eb
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10045845
mov esp, ebp
pop ebp
ret