joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cb2cc
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4cb304
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004c92b6
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004c928e
jmp 0x4cb310
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4cc9ba
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4cc9fc
call fcn.004d2961
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4cc9fc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4cc9f3
xor eax, eax
jmp 0x4cca04
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004cca0a
pop edi
pop esi
pop ebx
ret 4

Function at 0x4d2e91
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4d2ebf
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4d2edd
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004d2df7
jmp 0x4d2edd
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4d2edd
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004d2df7
test edi, edi
mov eax, edi
jne 0x4d2ec7
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100024dd
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov esi, ecx
push 0x104
push dword [esp + 0x10]
lea eax, [esi + 0x54]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
push dword [esp + 0xc]
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push dword [esi + 0x18]
call edi
push 5
push dword [esi + 0x14]
call edi
and byte [esi + 0x158], 0
pop edi
pop esi
ret 4

Function at 0x100025b8
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push 0x80
push 3
push ebx
push ebx
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
mov dword [ebp - 4], ebx
jne 0x100025e8
push 0xfffffffffffffffe
jmp 0x1000261d
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea eax, [esi + 1]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov edi, eax
lea eax, [ebp - 4]
push ebx
push eax
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10002620
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfffffffffffffffd
pop eax
jmp 0x1000263f
push dword [ebp + 8]
mov byte [edi + esi], bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetWindowTextA]
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10002ed4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, 0x104
push edi
mov esi, ecx
push ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push dword [ebp + 8]
mov dword [esi + 0x54], eax
call sub.MSVCRT.dll_strlen
pop ecx
test eax, eax
pop ecx
jne 0x10002f51
mov edi, dword [ebp + 0xc]
push edi
call fcn.1000d3cb
test eax, eax
pop ecx
jne 0x10002f28
push edi
call fcn.1000d2d7
test eax, eax
pop ecx
jne 0x10002f28
push edi
call fcn.1000d396
test eax, eax
pop ecx
jne 0x10002f28
push dword [esi + 0x54]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x10002f5e
push edi
call fcn.1000de5c
push ebx
push 0
push dword [esi + 0x54]
mov edi, eax
call sub.MSVCRT.dll_memset
sub edi, dword [ebp + 0xc]
inc edi
push edi
push dword [ebp + 0xc]
push dword [esi + 0x54]
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0x1c
jmp 0x10002f5e
push dword [ebp + 8]
push dword [esi + 0x54]
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push dword [esi + 0x54]
call sub.MSVCRT.dll_strlen
mov ecx, dword [esi + 0x54]
mov al, byte [eax + ecx - 1]
push eax
call fcn.1000de47
pop ecx
test al, al
pop ecx
je 0x10002f8a
push dword [esi + 0x54]
call sub.MSVCRT.dll_strlen
pop ecx
mov ecx, dword [esi + 0x54]
and byte [eax + ecx - 1], 0
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10004261
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push 0x80
push 3
push ebx
push ebx
push SysReAllocString
push dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x100042b7
call fcn.10001686
lea eax, [ebp + 8]
push 0x100105d0
push eax
mov dword [ebp + 8], 0xfffffc18
call sub.MSVCRT.dll__CxxThrowException
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov dword [ebp - 0x18], ebx
lea eax, [ebx + 1]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
and byte [eax + ebx], 0
lea ecx, [ebp - 0x14]
push 0
push ecx
push ebx
push eax
push edi
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000430d
push dword [ebp - 0x10]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp + 8]
push 0x100105d0
push eax
mov dword [ebp + 8], 0xfffffc17
call sub.MSVCRT.dll__CxxThrowException
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 3]
shr eax, 1
inc eax
push eax
mov dword [esi + 0x8c], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [esi + 0x88], eax
mov esi, dword [ebp - 0x10]
pop ecx
mov dword [ebp + 8], eax
push 1
pop edx
cmp dword [ebp - 0xc], edx
jne 0x10004373
push esi
call sub.MSVCRT.dll_strlen
pop ecx
push 0xe
pop edi
cmp eax, edi
jbe 0x10004362
push edi
push str.__BDECOMMAND3:
push esi
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x10004362
add esi, edi
add dword [ebp - 4], edi
add dword [ebp - 4], 3
and dword [ebp - 8], 0
add esi, 3
and dword [ebp - 0xc], 0
jmp 0x10004333
mov al, byte [esi]
cmp al, 0xa
je 0x100043df
cmp al, 0x3e
jne 0x1000438a
mov cl, byte [esi + 1]
cmp cl, 0xd
je 0x100043df
cmp cl, 0xa
je 0x100043df
test al, al
je 0x100043fe
cmp dword [ebp - 4], ebx
jae 0x100043fe
mov bl, al
mov eax, dword [ebp - 8]
mov cl, byte [esi + 1]
inc esi
cdq
sub eax, edx
inc esi
sar eax, 1
test al, 3
jne 0x100043ae
add bl, 0x9b
add cl, 0xcf
jmp 0x100043b4
add bl, 0xce
add cl, 0x9c
push 0x2f
add dword [ebp - 8], 2
cdq
pop edi
idiv edi
shl cl, 4
add cl, bl
mov ebx, dword [ebp - 0x18]
mov al, byte [edx + 0x10013320]
xor al, cl
mov ecx, dword [ebp + 8]
inc dword [ebp + 8]
add dword [ebp - 4], 2
mov byte [ecx], al
jmp 0x10004333
cmp al, 0x3e
mov dword [ebp - 0xc], edx
jne 0x100043ec
inc esi
inc esi
add dword [ebp - 4], 2
mov eax, dword [ebp + 8]
inc dword [ebp + 8]
inc esi
inc dword [ebp - 4]
mov byte [eax], 0xa
jmp 0x10004333
mov eax, dword [ebp + 8]
push dword [ebp - 0x10]
and byte [eax], 0
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1000b082
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
push ebx
xor ebx, ebx
push ebx
push 1
push 0x10014da0
call fcn.1000b8f8
cmp eax, ebx
mov dword [ebp - 0xc], eax
jne 0x1000b1d8
push esi
push edi
push 9
mov esi, str.Controls_that_are_safely_scriptable
pop ecx
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
push 0xc
mov esi, str.Controls_safely_initializable_from_persistent_data
pop ecx
lea edi, [ebp - 0x64]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x264]
push str.Component_Categories7DD95801_9882_11CF_9FA9_00AA006C42C4
push eax
movsb byte es:[edi], byte [esi]
call sub.MSVCRT.dll_strcpy
pop ecx
lea eax, [ebp - 8]
pop ecx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0xf003f
push ebx
mov ebx, str.REG_SZ
lea eax, [ebp - 0x264]
push ebx
push 0
mov edi, SysReAllocString
push eax
push edi
call esi
lea eax, [ebp - 0x30]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x30]
push eax
push 1
push 0
push 0x10014454
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0x264]
push str.Component_Categories7DD95802_9882_11CF_9FA9_00AA006C42C4
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
lea eax, [ebp - 8]
pop ecx
push eax
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push 0xf003f
push eax
push ebx
push eax
lea eax, [ebp - 0x264]
push eax
push edi
call esi
lea eax, [ebp - 0x64]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x64]
push eax
push 1
push 0
push 0x10014454
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push str.CLSIDC6EE11C9_0FFE_4567_9EB3_BFD9ECBC561FImplemented_Categories7DD95801_9882_11CF_9FA9_00AA006C42C4
lea eax, [ebp - 0x264]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
lea eax, [ebp - 8]
pop ecx
push eax
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push 0xf003f
push eax
push ebx
push eax
lea eax, [ebp - 0x264]
push eax
push edi
call esi
lea eax, [ebp - 0x264]
push str.CLSIDC6EE11C9_0FFE_4567_9EB3_BFD9ECBC561FImplemented_Categories7DD95802_9882_11CF_9FA9_00AA006C42C4
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
lea eax, [ebp - 8]
pop ecx
push eax
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push 0xf003f
push eax
push ebx
push eax
lea eax, [ebp - 0x264]
push eax
push edi
call esi
pop edi
pop esi
mov eax, dword [ebp - 0xc]
pop ebx
leave
ret
Function at 0x1000d3ff
Capabilities:
Create directory

Disassembly:
mov eax, 0x1000fe14
call fcn.1000f3a0
sub esp, 0x240
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
je 0x1000d5f6
push dword [ebp + 8]
lea eax, [ebp - 0x148]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x148]
push eax
call sub.MSVCRT.dll_strlen
add esp, 0xc
cmp byte [ebp + eax - 0x148], 0x5c
je 0x1000d458
lea eax, [ebp - 0x148]
push 0x10013400
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push 0x104
lea eax, [ebp - 0x24c]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
call fcn.1000d293
push 1
mov dword [ebp - 0x14], eax
pop edi
cmp eax, edi
jne 0x1000d4cd
push 0x14
lea eax, [ebp - 0x44]
push ebx
push eax
call sub.MSVCRT.dll_memset
push 0xc
lea eax, [ebp - 0x30]
pop esi
push esi
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
lea eax, [ebp - 0x44]
mov dword [ebp - 0x30], esi
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x1000d5f6
push ebx
push ebx
lea eax, [ebp - 0x44]
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x1000d5f6
lea eax, [ebp - 0x44]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x148]
lea esi, [ebp - 0x148]
push eax
mov dword [ebp - 0x10], ebx
call fcn.1000d2d7
test eax, eax
pop ecx
je 0x1000d4ea
mov dword [ebp - 0x10], edi
mov edi, dword [sym.imp.MSVCRT.dll_strchr]
lea eax, [ebp - 0x148]
push 0x5c
push eax
call edi
pop ecx
cmp eax, ebx
pop ecx
je 0x1000d5d9
jmp 0x1000d509
xor ebx, ebx
mov cl, byte [ebp + 0xb]
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x24], cl
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
lea ebx, [eax + 1]
cmp esi, ebx
je 0x1000d530
mov eax, esi
lea ecx, [ebp - 0x24]
push eax
inc esi
call fcn.1000a6e3
jmp 0x1000d51e
and byte [ebp + 0xb], 0
lea eax, [ebp + 0xb]
push eax
lea ecx, [ebp - 0x24]
call fcn.1000a6e3
push dword [ebp - 0x20]
lea eax, [ebp - 0x24c]
push eax
call sub.MSVCRT.dll_strcat
cmp dword [ebp - 0x10], 0
pop ecx
pop ecx
je 0x1000d56e
cmp dword [ebp - 0x10], 1
jne 0x1000d5bc
lea eax, [ebp - 0x24c]
push eax
call fcn.1000d2d7
test eax, eax
pop ecx
je 0x1000d5bc
cmp dword [ebp - 0x14], 1
jne 0x1000d596
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1000d5bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x1000d5bc
jmp 0x1000d5b5
cmp dword [ebp - 0x14], 2
jne 0x1000d5bc
lea eax, [ebp - 0x24c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1000d5bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1000d5ea
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.1000a66e
mov esi, ebx
push 0x5c
push esi
call edi
pop ecx
test eax, eax
pop ecx
jne 0x1000d507
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.1000a66e
or eax, 0xffffffff
jmp 0x1000d5db
Function at 0x1000d5fb
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
jne 0x1000d614
or eax, 0xffffffff
jmp 0x1000d6a6
lea eax, [ebp - 0x208]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x104]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 0x10
cmp eax, ebx
je 0x1000d64d
mov byte [eax], bl
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x104]
push edi
push eax
call esi
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
jne 0x1000d674
or ebx, 0xffffffff
jmp 0x1000d699
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push str.DllRegisterServer
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
jne 0x1000d690
or ebx, 0xffffffff
jmp 0x1000d692
call eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x208]
push eax
call esi
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret

Function at 0x1000d6a9
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
cmp dword [ebp + 8], 0
push esi
push edi
je 0x1000d732
lea eax, [ebp - 0x208]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x104]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 0x10
test eax, eax
je 0x1000d6f4
and byte [eax], 0
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x104]
push eax
call esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1000d729
push str.DllUnregisterServer
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1000d737
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x208]
push eax
call esi
or eax, 0xffffffff
jmp 0x1000d742
call eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x1000d746
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Get common file path
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x1000d80e
push ebx
call sub.MSVCRT.dll_strlen
cmp eax, 3
pop ecx
jbe 0x1000d80e
push esi
lea eax, [ebp - 0x244]
push edi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push ebx
call esi
test eax, eax
je 0x1000d7ef
lea eax, [ebp - 0x140]
push eax
push 0x100132f8
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000d7ef
cmp byte [ebp - 0x114], 0x2e
je 0x1000d7d6
test byte [ebp - 0x140], 1
je 0x1000d7c9
lea eax, [ebp - 0x114]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x140]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1000d7a5
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x244]
push eax
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
pop esi
test eax, eax
jne 0x1000d80a
call fcn.10001686
xor eax, eax
jmp 0x1000d811
or eax, 0xffffffff
pop ebx
leave
ret

Function at 0x1000d8e9
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
cmp dword [ebp + 8], 0
push esi
je 0x1000d90b
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x1000d913
or eax, 0xffffffff
jmp 0x1000d9b3
push edi
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov edi, eax
push edi
push esi
push dword [ebp - 0xc]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x1000d9a6
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1000d9a6
cmp dword [ebp - 8], 0
je 0x1000d9a6
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
movzx eax, word [eax]
shr ecx, 0x10
push ecx
push eax
lea eax, [ebp - 0x210]
push str.StringFileInfo_04hX_04hXFileVersion
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x210]
push eax
push edi
call sub.VERSION.dll_VerQueryValueA
push dword [ebp - 4]
call fcn.1000d814
pop ecx
push dword [ebp - 4]
push 0x10013cac
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
xor esi, esi
jmp 0x1000d9a9
or esi, 0xffffffff
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x1000db99
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
or eax, 0xffffffff
cmp dword [ebp + 8], 0
je 0x1000dc25
push str.GetDiskFreeSpaceExA
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000dbe8
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp + 8]
call eax
test eax, eax
je 0x1000dc05
cmp dword [ebp - 0x14], 0
mov ecx, SysReAllocString
ja 0x1000dc23
mov eax, dword [ebp - 0x18]
jmp 0x1000dc1f
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x1000dc0f
call fcn.10001686
or eax, 0xffffffff
leave
ret
mov eax, dword [ebp + 8]
mov ecx, SysReAllocString
imul eax, dword [ebp - 4]
imul eax, dword [ebp - 0xc]
cmp eax, ecx
jbe 0x1000dc25
mov eax, ecx
leave
ret
Function at 0x1000dc5b
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
xor eax, eax
push ebx
cmp dword [ebp + 8], eax
push esi
push edi
je 0x1000de0a
mov ebx, dword [ebp + 0xc]
cmp ebx, eax
je 0x1000de0a
cmp dword [ebp + 0x10], eax
je 0x1000de0a
lea ecx, [ebp + 0xc]
push ecx
push 0x10010510
push 1
push eax
push 0x10010500
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x1000dca8
push 0xfffffffffffffffd
jmp 0x1000dd8b
mov eax, dword [ebp + 0xc]
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
mov edi, dword [sym.imp.MSVCRT.dll_strrchr]
push 0x5c
push ebx
call edi
mov esi, eax
pop ecx
test esi, esi
pop ecx
jne 0x1000dcd8
push 0x2f
push ebx
call edi
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x1000de0a
mov edi, 0x10013f28
lea eax, [ebp - 0x108]
push edi
push eax
call sub.MSVCRT.dll_strcpy
sub esi, ebx
lea eax, [ebp - 0x108]
push esi
push ebx
push eax
call dword [sym.imp.MSVCRT.dll_strncat]
lea eax, [ebp - 0x108]
push edi
push eax
call sub.MSVCRT.dll_strcat
mov eax, dword [ebp + 0xc]
add esp, 0x1c
lea edx, [ebp - 0x108]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov edi, 0x104
lea eax, [ebp - 0x108]
push edi
push eax
push ebx
call esi
test eax, eax
jne 0x1000dd39
push 0xfffffffffffffffe
jmp 0x1000dd8b
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x108]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
xor ebx, ebx
cmp dword [ebp + 0x14], ebx
je 0x1000dd74
lea eax, [ebp - 0x20c]
push edi
push eax
push dword [ebp + 0x14]
call esi
test eax, eax
je 0x1000dd74
mov eax, dword [ebp + 0xc]
push dword [ebp + 0x18]
lea edx, [ebp - 0x20c]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 4]
push edx
push 0x10010550
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jge 0x1000dd8e
push 0xfffffffffffffffc
pop eax
jmp 0x1000de0d
mov edi, dword [ebp + 8]
push edi
call sub.MSVCRT.dll_strlen
lea eax, [eax + eax + 2]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push edi
mov esi, eax
call sub.MSVCRT.dll_strlen
lea eax, [eax + eax + 2]
push eax
push ebx
push esi
call sub.MSVCRT.dll_memset
push edi
call sub.MSVCRT.dll_strlen
add esp, 0x1c
push eax
push esi
push 0xffffffffffffffff
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 4]
push 1
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edi, eax
cmp edi, ebx
jne 0x1000dde7
mov eax, dword [ebp - 4]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, edi
pop ecx
neg eax
sbb eax, eax
and al, 0xfe
jmp 0x1000de0d
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret