joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4016e0
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x40aa21
mov eax, dword fs:[0]
push eax
sub esp, 0x184
mov eax, dword [0x40f2f8]
xor eax, esp
mov dword [esp + 0x17c], eax
push ebx
push esi
mov eax, dword [0x40f2f8]
xor eax, esp
push eax
lea eax, [esp + 0x190]
mov dword fs:[0], eax
call fcn.00401370
lea eax, [esp + 0x7c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x7c]
push ecx
call fcn.00401230
add esp, 4
xor ebx, ebx
lea eax, [esp + 0x7c]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401760
sub eax, edx
push eax
lea edx, [esp + 0x80]
push edx
lea ecx, [esp + 0x30]
call fcn.00401bc0
lea eax, [esp + 0x28]
push eax
mov eax, 0x40d9a0
lea esi, [esp + 0x64]
mov dword [esp + 0x19c], ebx
call fcn.00401f70
add esp, 4
mov esi, eax
mov byte [esp + 0x198], 1
call fcn.004011a0
push esi
lea esi, [esp + 0x48]
call fcn.00401f70
add esp, 4
push eax
mov eax, str..mentah
lea esi, [esp + 0x10]
mov byte [esp + 0x19c], 2
call fcn.00401f70
mov esi, 0x10
add esp, 4
cmp dword [esp + 0x58], esi
jb 0x4017e6
mov ecx, dword [esp + 0x44]
push ecx
call fcn.00402ba8
add esp, 4
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
cmp dword [esp + 0x74], esi
jb 0x401809
mov edx, dword [esp + 0x60]
push edx
call fcn.00402ba8
add esp, 4
mov dword [esp + 0x74], 0xf
mov dword [esp + 0x70], ebx
mov byte [esp + 0x60], bl
cmp dword [esp + 0x3c], esi
jb 0x40182c
mov eax, dword [esp + 0x28]
push eax
call fcn.00402ba8
add esp, 4
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x20], esi
jae 0x40183a
lea eax, [esp + 0xc]
push ebx
push eax
push str.CBs.cbm
call dword [sym.imp.KERNEL32.dll_CopyFileA]
call fcn.004010d0
cmp eax, ebx
jg 0x40188a
je 0x401847
cmp dword [esp + 0x20], esi
jb 0x401865
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00402ba8
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x190]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x17c]
xor ecx, esp
call fcn.0040201c
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0xc]
cmp dword [esp + 0x20], esi
jae 0x401898
lea ecx, [esp + 0xc]
push ecx
mov ecx, eax
call fcn.00401530
add esp, 4
push ebx
call fcn.00402f68
int3

Function at 0x40201c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40f2f8]
jne 0x402026
repz ret
jmp fcn.004031e6
Function at 0x406c9a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40f2f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405a73
and dword [ebp - 0x14], 0
cmp dword [0x410d48], 0
mov dword [ebp - 0x18], eax
jne 0x406d4d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406df5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x406df5
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x410d48], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x410d4c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x410d50], eax
call edi
push eax
call esi
mov dword [0x410d58], eax
test eax, eax
je 0x406d4d
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x410d54], eax
mov eax, dword [0x410d54]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x406da6
cmp dword [0x410d58], ecx
je 0x406da6
push eax
call esi
push dword [0x410d58]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x406da6
test ebx, ebx
je 0x406da6
call edi
test eax, eax
je 0x406d9d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x406d9d
test byte [ebp - 8], 1
jne 0x406da6
or dword [ebp + 0x10], 0x200000
jmp 0x406dd9
mov eax, dword [0x410d4c]
cmp eax, dword [ebp - 0x18]
je 0x406dd9
push eax
call esi
test eax, eax
je 0x406dd9
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x406dd9
mov eax, dword [0x410d50]
cmp eax, dword [ebp - 0x18]
je 0x406dd9
push eax
call esi
test eax, eax
je 0x406dd9
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x410d48]
call esi
test eax, eax
je 0x406df5
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406df7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040201c
leave
ret
Function at 0x30008883
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
and dword [ebp - 4], 0
and dword [ebp - 0xc], 0
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 4]
push ecx
push eax
mov dword [ebp - 8], eax
call fcn.30014354
mov edi, eax
test edi, edi
jl 0x30008931
push ebx
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call fcn.30014354
mov edi, eax
test edi, edi
jne 0x3000892b
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
xor ebx, ebx
inc ebx
mov edi, dword [ebp - 4]
movzx eax, word [edi]
cmp ax, 0x2f
je 0x300088ea
cmp ax, 0x2d
jne 0x3000894e
add edi, 2
push edi
push 0x30001994
call esi
test eax, eax
jne 0x300088fe
mov eax, dword [ebp + 0x10]
jmp 0x3000890d
push edi
push 0x30001974
call esi
test eax, eax
jne 0x30008946
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call fcn.30014354
mov edi, eax
test edi, edi
je 0x300088d8
test edi, edi
jl 0x3000892f
xor edi, edi
pop esi
pop ebx
cmp dword [ebp - 4], 0
je 0x3000893f
push dword [ebp - 4]
call fcn.300113ed
mov eax, edi
pop edi
leave
ret 0x10
push edi
push 0x30001950
call esi
mov edi, 0x80070057
jmp 0x3000892f
Function at 0x3000ccc4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor esi, esi
mov edi, ecx
cmp dword [edi + 0x44], esi
mov dword [ebp - 8], esi
je 0x3000cce1
xor ebx, ebx
inc ebx
jmp 0x3000cec7
cmp dword [ebp + 8], esi
jne 0x3000cd2f
mov eax, dword [edi + 0xc]
mov ecx, dword [eax]
lea edx, [ebp - 0xc]
push edx
push eax
call dword [ecx + 0x40]
mov ebx, eax
cmp ebx, esi
jl 0x3000cec7
lea eax, [ebp + 8]
push eax
push 2
push esi
push dword [edi + 0x14]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jle 0x3000cd1e
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
cmp ebx, esi
jl 0x3000cec7
mov dword [ebp - 8], 1
mov eax, dword [edi + 0x48]
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x30001fa0
push dword [ebp + 8]
call esi
test eax, eax
jle 0x3000cd5c
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x3000ceb8
mov eax, dword [edi + 0x50]
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0x30001f8c
push dword [ebp + 8]
call esi
test eax, eax
jle 0x3000cd8e
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x3000ceb8
push 4
lea eax, [edi + 0x74]
push eax
push 4
push 0
push 0x30001f6c
push dword [ebp + 8]
call esi
test eax, eax
jle 0x3000cdba
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x3000ceb8
push 4
lea eax, [edi + 0x70]
push eax
push 4
push 0
push 0x30001f4c
push dword [ebp + 8]
call esi
test eax, eax
jle 0x3000cde6
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x3000ceb8
push 4
lea eax, [edi + 0x6c]
push eax
push 4
push 0
push 0x30002018
push dword [ebp + 8]
call esi
test eax, eax
jle 0x3000ce12
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x3000ceb8
push 4
lea eax, [edi + 0x5c]
push eax
push 4
push 0
push 0x30002000
push dword [ebp + 8]
call esi
test eax, eax
jle 0x3000ce3e
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x3000ceb8
push 4
lea eax, [edi + 0x60]
push eax
push 4
push 0
push 0x30001fe4
push dword [ebp + 8]
call esi
test eax, eax
jle 0x3000ce66
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x3000ceb8
push 4
lea eax, [edi + 0x64]
push eax
push 4
push 0
push 0x30001fcc
push dword [ebp + 8]
call esi
test eax, eax
jle 0x3000ce8e
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jl 0x3000ceb8
push 4
add edi, 0x68
push edi
push 4
push 0
push 0x30001fac
push dword [ebp + 8]
call esi
test eax, eax
jle 0x3000ceb6
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x3000cec7
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x3000fbcb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x116c
call fcn.30014c94
mov eax, dword [0x30020490]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov dword [ebp - 0x1164], eax
mov eax, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x1168], eax
mov eax, dword [ebp + 0x14]
xor ebx, ebx
mov esi, 0x1154
push esi
mov dword [ebp - 0x116c], eax
lea eax, [ebp - 0x1158]
push ebx
push eax
mov dword [ebp - 0x115c], ebx
mov dword [edi], ebx
call fcn.30014b52
add esp, 0xc
push dword [ebp + 8]
lea eax, [ebp - 0x1150]
push 0x80
push eax
mov dword [ebp - 0x1158], esi
mov dword [ebp - 0x1154], 7
call fcn.30005abb
lea eax, [ebp - 0x1160]
push eax
lea eax, [ebp - 0x1050]
push eax
push ebx
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x300021f8
push dword [ebp - 0x1164]
mov dword [ebp - 0x1160], 0x1048
call ebx
mov esi, eax
test esi, esi
jle 0x3000fc88
and esi, 0xffff
or esi, 0x80070000
test esi, esi
jl 0x3000fcff
lea eax, [ebp - 0x1160]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x300018a4
push dword [ebp - 0x1164]
mov dword [ebp - 0x1160], 4
call ebx
mov esi, eax
test esi, esi
jle 0x3000fcc4
and esi, 0xffff
or esi, 0x80070000
test esi, esi
jl 0x3000fcff
lea eax, [ebp - 0x115c]
push eax
push dword [ebp - 0x116c]
lea eax, [ebp - 0x1158]
push eax
push dword [ebp - 0x1168]
call fcn.3000fb56
mov esi, eax
test esi, esi
jl 0x3000fcff
mov eax, dword [ebp - 0x115c]
mov dword [edi], eax
xor eax, eax
mov dword [ebp - 0x115c], eax
xor esi, esi
jmp 0x3000fd05
mov eax, dword [ebp - 0x115c]
test eax, eax
je 0x3000fd19
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
lea eax, [ecx + eax + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.30014af0
leave
ret 0x14
Function at 0x3001042e
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x250]
push edi
xor edi, edi
cmp eax, 0xffffffff
mov dword [ebp - 4], edi
jne 0x30010452
mov dword [ebp - 4], 1
jmp 0x30010534
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esi + 0x250], 0xffffffff
cmp dword [ebp + 8], edi
je 0x30010534
cmp dword [esi + 0x14], edi
jne 0x30010534
push ebx
push edi
push edi
push 3
push edi
push edi
push 0xc0000000
lea eax, [esi + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x250], eax
jne 0x300104b4
call ebx
cmp eax, edi
mov dword [ebp - 4], eax
jle 0x300104af
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edi
jl 0x30010533
mov ecx, dword [esi + 0x244]
mov eax, dword [esi + 0x240]
push edi
push edi
push ecx
push eax
push dword [esi + 0x250]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x300104ef
call ebx
cmp eax, edi
mov dword [ebp - 4], eax
jle 0x300104ea
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edi
jl 0x30010533
push dword [esi + 0x250]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x3001051a
call ebx
cmp eax, edi
mov dword [ebp - 4], eax
jle 0x30010515
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edi
jl 0x30010533
mov edx, dword [esi + 0x244]
mov ecx, dword [esi + 0x240]
mov eax, dword [esi + 0x20]
mov edi, dword [eax]
push edx
push ecx
push edx
push ecx
push eax
call dword [edi + 0x50]
pop ebx
mov eax, dword [esi + 0x250]
cmp eax, 0xffffffff
je 0x3001054d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esi + 0x250], 0xffffffff
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 4
Function at 0x30010e59
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 8], 0
push esi
push edi
push 0x44
pop edi
push 1
push edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], 0xff
call fcn.3001d932
test eax, eax
mov dword [ebp - 4], eax
jne 0x30010e8b
mov esi, 0x8007000e
jmp 0x30010f81
push dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
call fcn.300111a2
mov esi, eax
test esi, esi
jl 0x30010f81
push ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x30010f73
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x7a
jne 0x30010f5f
cmp dword [ebp - 0x10], edi
jbe 0x30010f0c
push 1
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.3001d954
mov edi, eax
test edi, edi
jne 0x30010f09
call ebx
mov esi, eax
test esi, esi
jle 0x30010f07
and esi, 0xffff
or esi, 0x80070000
test esi, esi
jl 0x30010f80
mov dword [ebp - 4], edi
cmp dword [ebp - 0xc], 0xff
jbe 0x30010f27
push dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
call fcn.300111a2
mov esi, eax
test esi, esi
jl 0x30010f80
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x30010f73
call ebx
mov esi, eax
test esi, esi
jle 0x30010f71
and esi, 0xffff
or esi, 0x80070000
jmp 0x30010f6f
test eax, eax
jle 0x30010f6d
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jl 0x30010f80
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
xor esi, esi
mov dword [eax], ecx
mov dword [ebp - 4], esi
pop ebx
cmp dword [ebp - 8], 0
je 0x30010f8f
push dword [ebp - 8]
call fcn.300113ed
cmp dword [ebp - 4], 0
je 0x30010f9d
push dword [ebp - 4]
call fcn.3001d979
pop edi
mov eax, esi
pop esi
leave
ret 0xc
Function at 0x30011071
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 8]
push ebx
xor edx, edx
cmp ecx, edx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, 0x80070000
je 0x300110a5
lea eax, [ebp - 4]
push eax
push ecx
push edx
call fcn.30010e59
mov esi, eax
jmp 0x300110e4
lea ecx, [ebp - 4]
push ecx
push dword [eax + 0x30]
movzx ecx, byte [eax + 0x12]
push dword [eax + 0x2c]
add eax, 0xc
push dword [eax + 0x1c]
push dword [eax + 0x18]
push dword [eax + 0x14]
push dword [eax + 0x10]
push dword [eax + 0xc]
push dword [eax + 8]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x300110e8
call edi
mov esi, eax
test esi, esi
jle 0x300110e6
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x3001111a
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x30011110
call edi
mov esi, eax
test esi, esi
jle 0x3001110e
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x3001111a
xor eax, eax
cmp dword [ebp - 8], eax
sete al
mov esi, eax
cmp dword [ebp - 4], 0
je 0x30011129
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x30011aee
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x30011b90
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x30011b90
movzx eax, word [ebx]
push esi
xor esi, esi
test ax, ax
mov ecx, ebx
je 0x30011b3d
movzx eax, ax
cmp ax, 0x5c
jne 0x30011b2f
mov esi, ecx
inc ecx
inc ecx
movzx eax, word [ecx]
test ax, ax
jne 0x30011b27
test esi, esi
jne 0x30011b44
mov edi, 0x80070003
jmp 0x30011b8f
push dword [ebp + 0xc]
and word [esi], di
push ebx
call fcn.30011aee
mov edi, eax
test edi, edi
mov word [esi], 0x5c
jl 0x30011b8f
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x30011b8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x30011b7b
xor edi, edi
inc edi
jmp 0x30011b8f
test eax, eax
jle 0x30011b89
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x30011b8f
xor edi, edi
pop esi
mov eax, edi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x30011c0e
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov ebx, 0x80070000
jne 0x30011c58
call edi
mov esi, eax
test esi, esi
jle 0x30011c52
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x30011ce7
push dword [ebp - 8]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [ebp - 4], eax
jne 0x30011c71
mov esi, 0x8007000e
jmp 0x30011cd8
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x30011c98
call edi
mov esi, eax
test esi, esi
jle 0x30011c96
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x30011cd8
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x3000190c
push dword [ebp - 4]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x30011cc5
call edi
mov esi, eax
test esi, esi
jle 0x30011cc3
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x30011cd8
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
cmp dword [ebp - 4], 0
je 0x30011ce7
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc

Function at 0x30011d5f
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x30011e04
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 5
jne 0x30011df3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x30011d9a
mov esi, 0x80070005
jmp 0x30011e03
test al, 0x10
je 0x30011da5
mov esi, 0x8000ffff
jmp 0x30011e03
test al, 7
je 0x30011e03
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
mov ebx, 0x80070000
jne 0x30011dd4
call edi
mov esi, eax
test esi, esi
jle 0x30011dd2
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x30011e03
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x30011e03
call edi
mov esi, eax
test esi, esi
jle 0x30011e03
and esi, 0xffff
or esi, ebx
jmp 0x30011e03
test eax, eax
jle 0x30011e01
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x30011e0c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
or dword [ebp - 4], 0xffffffff
push ebx
push esi
push edi
mov esi, 0x104
push esi
lea eax, [ebp - 0xc]
xor ebx, ebx
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call fcn.300111ec
mov edi, eax
cmp edi, ebx
jl 0x30011f16
push dword [ebp - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 4], 0xffffffff
jne 0x30011edb
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push dword [ebp - 0x10]
push dword [ebp + 8]
push dword [ebp - 0xc]
push 0x3000237c
push eax
call fcn.300119e2
mov edi, eax
add esp, 0x18
cmp edi, ebx
jl 0x30011f16
push ebx
push 0x80
push 1
push ebx
push 1
push 0x40000000
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x30011ecb
call esi
test eax, eax
jg 0x30011eab
call esi
mov edi, eax
jmp 0x30011ebb
call esi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
cmp edi, 0x80070050
jne 0x30011ec7
xor edi, edi
jmp 0x30011ecb
cmp edi, ebx
jl 0x30011f16
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x3e8
jl 0x30011e4d
cmp dword [ebp + 0x10], ebx
je 0x30011ef3
push 0xfde9
push ebx
push dword [ebp - 8]
push dword [ebp + 0x10]
call fcn.300112f9
mov edi, eax
mov eax, dword [ebp + 0x14]
cmp eax, ebx
je 0x30011eff
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
cmp edi, ebx
jl 0x30011f07
cmp eax, ebx
jne 0x30011f16
cmp dword [ebp - 4], 0xffffffff
je 0x30011f16
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], ebx
je 0x30011f23
push dword [ebp - 8]
call fcn.300113ed
cmp dword [ebp - 0xc], ebx
je 0x30011f30
push dword [ebp - 0xc]
call fcn.300113ed
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10