joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006760
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d26be
mov eax, dword fs:[0]
push eax
sub esp, 0x408
mov eax, dword [0x10109610]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1010f6b4]
test eax, eax
jne 0x1000680d
lea eax, [ebp - 0x410]
push eax
push 0x200
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x410]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100067c6
push eax
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.PDApp.log
lea eax, [ebp - 0x410]
push 0x200
push eax
call fcn.100b36fe
push 0x10
call fcn.100b33f2
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x414], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x10006806
lea eax, [ebp - 0x410]
call fcn.100066c0
jmp 0x10006808
xor eax, eax
mov dword [0x1010f6b4], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b2e5c
mov esp, ebp
pop ebp
ret

Function at 0x10006880
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x10109610]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push edi
lea ecx, [ebp - 0x80c]
push ecx
push 0x200
mov dword [ebp - 0x810], eax
mov edi, 4
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [ebp - 0x80c]
push edx
lea eax, [ebp - 0x40c]
push 0x200
push eax
call fcn.100b358f
add esp, 0xc
push str._asu.trace
lea ecx, [ebp - 0x40c]
push 0x200
push ecx
call fcn.100b36fe
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
lea edx, [ebp - 0x40c]
push edx
call ebx
test eax, eax
je 0x1000696e
mov edi, 6
mov byte [esi + 8], 1
mov byte [esi + 9], 1
cmp edi, 4
jl 0x10006912
mov byte [esi + 0xa], 1
cmp edi, 3
jl 0x1000691b
mov byte [esi + 0xb], 1
cmp edi, 2
jl 0x10006924
mov byte [esi + 0xc], 1
cmp edi, 1
jl 0x1000692d
mov byte [esi + 0xd], 1
mov ebx, dword [ebp - 0x810]
test ebx, ebx
je 0x1000695c
push 0x100dcf74
push str.Build_Version____s
mov ecx, ebx
mov eax, esi
call fcn.10006b20
push edi
push str.Logging_Level_verbosity_Set__to__d
mov ecx, ebx
mov eax, esi
call fcn.10006b20
add esp, 0x10
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop ebx
call fcn.100b2e5c
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x80c]
push eax
lea ecx, [ebp - 0x40c]
push 0x200
push ecx
call fcn.100b358f
add esp, 0xc
push str._asu.debug
lea edx, [ebp - 0x40c]
push 0x200
push edx
call fcn.100b36fe
add esp, 0xc
lea eax, [ebp - 0x40c]
push eax
call ebx
test eax, eax
je 0x1000690e
mov edi, 5
jmp 0x10006905
Function at 0x10006cc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
mov eax, dword [ebp + 8]
push edi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10006cd0
mov edi, dword [esi + 4]
sub eax, edx
sar eax, 1
mov ebx, eax
mov eax, dword [edi]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x10006d69
cmp eax, 0xffffffff
je 0x10006d69
cmp eax, 0x80
je 0x10006d69
push 2
push 0
mov byte [edi + 4], 1
mov ecx, dword [esi]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [ebp - 4]
push edx
mov edx, dword [esi]
lea eax, [ebx + ebx]
push eax
push ecx
push edx
call edi
mov ecx, dword [esi]
push 0
lea eax, [ebp - 4]
push eax
push 4
push 0x100dd004
push ecx
mov dword [ebp - 4], 0
call edi
mov esi, dword [esi + 4]
cmp byte [esi + 4], 0
je 0x10006d69
mov edx, dword [esi]
push 0
push 1
push edx
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x10006d69
mov byte [esi + 4], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000c590
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, eax
cmp dword [edi + 0x10], 0
jne 0x1000c5bd
push str.Invalid_Updater_inventory_path.
call fcn.10006760
mov ecx, 0x100dcd70
call fcn.10006b80
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
mov ebx, 8
cmp dword [edi + 0x14], ebx
jb 0x1000c5c9
mov eax, dword [edi]
push eax
push str.Updater_Inventory_location:_s
call fcn.10006760
mov ecx, 0x100dcd14
call fcn.10006de0
add esp, 8
cmp dword [edi + 0x14], ebx
jb 0x1000c5ea
mov eax, dword [edi]
jmp 0x1000c5ec
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000c637
push str.File_does_not_exist
call fcn.10006760
mov ecx, str.Utilities
call fcn.10006de0
add esp, 4
cmp dword [edi + 0x14], ebx
jb 0x1000c615
mov edi, dword [edi]
push edi
push str.updaterInventory.dll_is_not_present_at_Location_:_s
call fcn.10006760
mov ecx, 0x100dcd14
call fcn.10006e40
add esp, 8
mov eax, 0xffffffec
pop edi
pop esi
pop ebx
pop ebp
ret
push 0x18
call fcn.100b33f2
mov esi, eax
xor eax, eax
add esp, 4
cmp esi, eax
je 0x1000c676
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp eax, eax
jne 0x1000c680
cmp dword [edi + 0x14], ebx
jb 0x1000c65f
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
test eax, eax
jne 0x1000c680
push str.Failed_to_load_updaterInventory_Library
jmp 0x1000c6f9
push str.failed_to_create_memeory.
jmp 0x1000c5a3
mov ecx, dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor eax, eax
test ecx, ecx
je 0x1000c696
push str.UpdaterInventoryAddToMCLWithIcon
push ecx
call edi
mov ecx, dword [esi]
mov dword [esi + 8], eax
xor eax, eax
test ecx, ecx
je 0x1000c6a9
push str.UpdaterInventoryRelease
push ecx
call edi
mov ecx, dword [esi]
mov dword [esi + 0xc], eax
xor eax, eax
test ecx, ecx
je 0x1000c6bc
push str.UpdaterInventoryRemoveFromMCL
push ecx
call edi
mov ecx, dword [esi]
mov dword [esi + 0x10], eax
xor eax, eax
test ecx, ecx
je 0x1000c6cf
push str.UpdaterInventoryIsHigherUpdatePresent
push ecx
call edi
cmp dword [esi + 8], 0
mov dword [esi + 0x14], eax
je 0x1000c6f4
cmp dword [esi + 0xc], 0
je 0x1000c6f4
cmp dword [esi + 0x10], 0
je 0x1000c6f4
test eax, eax
je 0x1000c6f4
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push str.Failed_to_API_Handle_of_Updator_Inventory
call fcn.10006760
mov ecx, 0x100dcd70
call fcn.10006bb0
add esp, 4
call fcn.1000c550
pop edi
pop esi
mov eax, 0xffffffec
pop ebx
pop ebp
ret
Function at 0x1001f280
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x10109610]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x22c
lea eax, [ebp - 0x230]
push 0
push eax
call fcn.100b8f90
add esp, 0xc
push 0
push 2
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [ebp - 0x230]
mov edi, eax
push ecx
push edi
mov bl, 1
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x1001f3bf
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Process32NextW]
mov ecx, str.PDapp.exe
lea eax, [ebp - 0x20c]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1001f316
test dx, dx
je 0x1001f312
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1001f316
add eax, 4
add ecx, 4
test dx, dx
jne 0x1001f2f0
xor eax, eax
jmp 0x1001f31b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1001f333
lea edx, [ebp - 0x230]
push edx
push edi
call esi
cmp eax, 1
je 0x1001f2e1
jmp 0x1001f3be
mov eax, dword [ebp - 0x228]
push eax
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1001f399
push 0xffffffffffffffff
push str.PDapp.exe
push str.Waiting_for_the_process__s_to_complete__terminate__with_timeout:__lu_milliSeconds
call fcn.10006760
mov ecx, 0x100e1f10
call fcn.10006db0
add esp, 0xc
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.PDapp.exe
push str.Process__s_is_terminated._Now_procceding_AAM_Uninstallation
call fcn.10006760
mov ecx, 0x100e1f10
call fcn.10006db0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1001f3be
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.PDapp.exe
push str.Some_error_occured_in_getting_the_handle_for_the_process__s._Error:__d
call fcn.10006760
mov ecx, 0x100e1f10
call fcn.10006e40
add esp, 0xc
xor bl, bl
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.100b2e5c
mov esp, ebp
pop ebp
ret
Function at 0x100200a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d3838
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10109610]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x2c], cx
lea edx, [ebp - 0x2c]
push edx
push eax
mov dword [ebp - 4], esi
call fcn.1002aeb0
add esp, 8
test al, al
jne 0x10020129
push str.utilCreateDirectoryPath
push str.Unable_to_convert_path_to_widechar:_s
call fcn.10006760
mov ecx, 0x100dcd70
call fcn.10006b20
add esp, 8
cmp dword [ebp - 0x18], 8
jb 0x10020122
mov eax, dword [ebp - 0x2c]
push eax
call fcn.100b2e51
add esp, 4
xor al, al
jmp 0x100201da
mov eax, dword [ebp - 0x2c]
mov edi, 8
cmp dword [ebp - 0x18], edi
jae 0x10020139
lea eax, [ebp - 0x2c]
mov ebx, dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push esi
push eax
push esi
call ebx
cmp byte [ebp + 0xc], 0
mov esi, eax
je 0x10020192
cmp esi, 5
jne 0x10020192
cmp dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x2c]
jae 0x1002015c
lea edi, [ebp - 0x2c]
call fcn.1002ccc0
test al, al
je 0x100201a3
push edi
call fcn.10006760
mov ecx, str.ACQUIRED_PERMISSION:_for_folder_file__s
call fcn.10006de0
mov eax, dword [ebp - 0x2c]
add esp, 4
cmp dword [ebp - 0x18], 8
jae 0x10020184
lea eax, [ebp - 0x2c]
push 0
push eax
push 0
call ebx
mov esi, eax
mov edi, 8
test esi, esi
je 0x100201c7
cmp esi, 0xb7
je 0x100201c7
cmp esi, 0x50
je 0x100201c7
push esi
push str.Unable_to_create_directoryPath_at_desired_location._ErrorCode:__d
call fcn.10006760
mov ecx, 0x100dcd70
call fcn.10006b20
add esp, 8
lea esi, [ebp - 0x2c]
call fcn.10006640
xor al, al
jmp 0x100201da
cmp dword [ebp - 0x18], edi
jb 0x100201d8
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.100b2e51
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b2e5c
mov esp, ebp
pop ebp
ret
Function at 0x100203b0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d3808
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x10109610]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x2c], cx
lea edx, [ebp - 0x2c]
push edx
push eax
mov dword [ebp - 4], esi
call fcn.1002aeb0
add esp, 8
test al, al
jne 0x10020432
push str.Path_Conversion_to_UTF_8_failed.
call fcn.10006760
mov ecx, 0x100dcd70
call fcn.10006b20
add esp, 4
cmp dword [ebp - 0x18], 8
jb 0x1002042b
mov eax, dword [ebp - 0x2c]
push eax
call fcn.100b2e51
add esp, 4
xor al, al
jmp 0x100204dc
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
mov esi, 8
cmp dword [ebp - 0x18], esi
jae 0x10020454
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x1002049e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_get_disk_Space_error_:_d
call fcn.10006760
mov ecx, 0x100dcd70
call fcn.10006b80
add esp, 8
cmp dword [ebp - 0x18], esi
jb 0x1002042b
mov edx, dword [ebp - 0x2c]
push edx
call fcn.100b2e51
add esp, 4
xor al, al
jmp 0x100204dc
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp + 0x10]
ja 0x100204c9
jb 0x100204b0
mov ecx, dword [ebp - 0x38]
cmp ecx, dword [ebp + 0xc]
jae 0x100204c9
push str.Not_Enough_disk_space_on_System.
call fcn.10006760
mov ecx, 0x100dcd70
call fcn.10006bb0
add esp, 4
jmp 0x10020489
cmp dword [ebp - 0x18], esi
jb 0x100204da
mov eax, dword [ebp - 0x2c]
push eax
call fcn.100b2e51
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b2e5c
mov esp, ebp
pop ebp
ret
Function at 0x10021550
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d5bf8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10109610]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], cx
lea edx, [ebp - 0x2c]
push edx
push eax
mov dword [ebp - 4], ebx
call fcn.1002aeb0
add esp, 8
test al, al
jne 0x100215cf
push 0x100e3fac
call fcn.10006760
mov ecx, 0x100dcd70
call fcn.10006b80
add esp, 4
cmp dword [ebp - 0x18], 8
jb 0x100215cb
mov eax, dword [ebp - 0x2c]
push eax
call fcn.100b2e51
add esp, 4
xor al, al
jmp 0x10021615
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x100215db
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100215ff
push str.File_does_not_exist
call fcn.10006760
mov ecx, str.Utilities
call fcn.10006de0
add esp, 4
jmp 0x10021601
mov bl, 1
cmp dword [ebp - 0x18], 8
jb 0x10021613
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.100b2e51
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b2e5c
mov esp, ebp
pop ebp
ret
Function at 0x10021a10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x10109610]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
push 0x1c
lea eax, [ebp - 0x214]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x10021a6f
push str.utilGetPDAppUSFTemp
push str.Unable_to_retreive_Local_App_Data_Path_from_Win_library:_s
call fcn.10006760
mov ecx, 0x100dcd70
call fcn.10006b80
add esp, 8
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.100b2e5c
mov esp, ebp
pop ebp
ret
lea edi, [ebp - 0x214]
add edi, 0xfffffffe
jmp 0x10021a80
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10021a80
mov ecx, 0xb
mov esi, str.AdobeOOBEPDApptemp_
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x214]
movsw word es:[edi], word [esi]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10021aa3
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x214]
mov esi, ebx
call fcn.10001b30
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.100b2e5c
mov esp, ebp
pop ebp
ret
Function at 0x10023090
Capabilities:
Check if file exists
Copy file
Delete file
Set file attributes

Disassembly:
push ecx
cmp dword [edi + 0x14], 8
push ebx
push esi
mov esi, eax
jb 0x1002309f
mov eax, dword [edi]
jmp 0x100230a1
mov eax, edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call ebx
test eax, eax
jne 0x100230e2
push str.File_does_not_exist
call fcn.10006760
mov ecx, str.Utilities
call fcn.10006de0
add esp, 4
push str.Src_file_does_not_exist_in_utilCopySrcFileToDstFile_n
call fcn.10006760
mov ecx, 0x100dcd70
call fcn.10006b80
add esp, 4
xor al, al
pop esi
pop ebx
pop ecx
ret
cmp dword [esi + 0x14], 8
jb 0x100230ec
mov eax, dword [esi]
jmp 0x100230ee
mov eax, esi
push eax
call ebx
test eax, eax
jne 0x1002311a
push str.File_does_not_exist
call fcn.10006760
mov ecx, str.Utilities
call fcn.10006de0
add esp, 4
mov ebx, 8
cmp dword [esi + 0x14], ebx
jb 0x10023152
mov ecx, dword [esi]
jmp 0x10023154
mov ebx, 8
cmp dword [esi + 0x14], ebx
jb 0x10023128
mov eax, dword [esi]
jmp 0x1002312a
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10023111
push str.Failed_to_remove_the_existing_file_in_utilCopySrcFileToDstFile_n
call fcn.10006760
mov ecx, 0x100dcd70
call fcn.10006b80
add esp, 4
xor al, al
pop esi
pop ebx
pop ecx
ret
mov ecx, esi
cmp dword [edi + 0x14], ebx
jb 0x1002315d
mov eax, dword [edi]
jmp 0x1002315f
mov eax, edi
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne al
test al, al
jne 0x10023196
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_copy_file_at_the_destination:_d_n
call fcn.10006760
mov ecx, 0x100dcd70
call fcn.10006b80
add esp, 8
xor al, al
pop esi
pop ebx
pop ecx
ret
mov eax, esi
call fcn.1002c540
cmp dword [esi + 0x14], ebx
jb 0x100231a4
mov esi, dword [esi]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
mov al, 1
pop ebx
pop ecx
ret
Function at 0x10023790
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x10109610]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.100b8f90
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x10023805
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_determine_OS_version_info._GetLastError_____ld
call fcn.10006760
mov ecx, str.PIM_AAMDeploymentValidation
call fcn.10006e70
add esp, 8
mov eax, 0xfffffc19
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b2e5c
mov esp, ebp
pop ebp
ret
movzx edx, word [ebp - 0xc]
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x11c]
push edx
push eax
push ecx
push str.Current_Major_Version___ld_Current_Minor_Version___ld__Current_service_pack_Version_:_ld
call fcn.10006760
mov ecx, str.PIM_AAMDeploymentValidation
call fcn.10006de0
mov eax, dword [ebp - 0x11c]
add esp, 0x10
cmp eax, 5
jae 0x10023867
push 5
push eax
push str.current_major_version:_lu_is_less_than_required__major_version_:_lu
call fcn.10006760
mov ecx, str.PIM_AAMDeploymentValidation
call fcn.10006e40
add esp, 0xc
mov eax, 0xfffffffb
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b2e5c
mov esp, ebp
pop ebp
ret
jne 0x10023897
mov eax, dword [ebp - 0x118]
cmp eax, 1
jae 0x1002387e
push 1
push eax
push str.current_minor_version:_lu_is_less_than_required__minor_version_:_lu
jmp 0x10023842
jne 0x10023897
cmp word [ebp - 0xc], 2
jae 0x10023897
mov edx, dword [ebp - 0x114]
push 2
push edx
push str.current_build_version:_lu_is_less_than_required__build_version_:_lu
jmp 0x10023842
push str.Current_OS_version_is_supported
call fcn.10006760
mov ecx, str.PIM_AAMDeploymentValidation
call fcn.10006de0
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 4
xor eax, eax
call fcn.100b2e5c
mov esp, ebp
pop ebp
ret
Function at 0x10023f80
Capabilities:
Check if file exists
Move file

Disassembly:
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
push edi
mov edi, eax
je 0x10024076
cmp dword [edi + 0x10], 0
je 0x10024076
mov ebx, 8
cmp dword [esi + 0x14], ebx
jb 0x10023fa9
mov eax, dword [esi]
jmp 0x10023fab
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x10023ff1
cmp dword [esi + 0x14], ebx
jb 0x10023fbf
mov eax, dword [esi]
jmp 0x10023fc1
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10023ff1
cmp dword [esi + 0x14], ebx
jb 0x10023fd3
mov esi, dword [esi]
push esi
push str.src_File:_ls_does_not_exists_in_utilMovePathIfExistsToPath
call fcn.10006760
mov ecx, 0x100dcd14
call fcn.10006de0
add esp, 8
mov al, 1
pop edi
pop esi
pop ebx
ret
cmp dword [edi + 0x14], ebx
jb 0x10023ffa
mov ecx, dword [edi]
jmp 0x10023ffc
mov ecx, edi
cmp dword [esi + 0x14], ebx
jb 0x10024005
mov eax, dword [esi]
jmp 0x10024007
mov eax, esi
push 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x10024049
cmp dword [edi + 0x14], ebx
jb 0x1002401c
mov edi, dword [edi]
cmp dword [esi + 0x14], ebx
jb 0x10024023
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push esi
push str.Failed_to_Move_srcPath:_ls_destPath:_ls_error_:_d
call fcn.10006760
mov ecx, 0x100dcd14
call fcn.10006e40
add esp, 0x10
xor al, al
pop edi
pop esi
pop ebx
ret
cmp dword [edi + 0x14], ebx
jb 0x10024050
mov edi, dword [edi]
cmp dword [esi + 0x14], ebx
jb 0x10024057
mov esi, dword [esi]
push edi
push esi
push str.Successfully_moved_from__ls_to__ls
call fcn.10006760
mov ecx, 0x100dcd14
call fcn.10006d80
add esp, 0xc
mov al, 1
pop edi
pop esi
pop ebx
ret
push str.Invalid_arguments_to_utilMovePathIfExistsToPath
call fcn.10006760
mov ecx, 0x100dcd14
call fcn.10006e10
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x100240a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
push edi
push 0
push 0
call ebx
mov esi, eax
test esi, esi
jne 0x100240dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_get_temp_Path_error:_d
call fcn.10006760
mov ecx, 0x100dcd14
call fcn.10006e40
add esp, 8
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret
lea eax, [esi + esi + 2]
push eax
call fcn.100b349c
mov edi, eax
add esp, 4
test edi, edi
jne 0x10024115
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_allocate_memory_error:_d
call fcn.10006760
mov ecx, 0x100dcd14
call fcn.10006e70
add esp, 8
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret
push edi
push esi
call ebx
test eax, eax
jne 0x10024148
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_get_temp_Path_error:_d
call fcn.10006760
mov ecx, 0x100dcd14
call fcn.10006e40
push edi
call fcn.100b3773
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, edi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10024150
mov esi, dword [ebp + 8]
sub eax, edx
sar eax, 1
push eax
mov eax, edi
call fcn.10001b30
push edi
call fcn.100b3773
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret

Function at 0x10024260
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x10109610]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0x26
lea eax, [ebp - 0x210]
push eax
push 0
mov esi, ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x100242bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_retreive_drivePath__from_Win_library_error:_d
call fcn.10006760
mov ecx, 0x100dcd14
call fcn.10006e40
add esp, 8
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b2e5c
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x210]
push 0x100dc9f4
push ecx
call fcn.100b3c80
add esp, 8
test eax, eax
je 0x1002432e
push str.drivePath_retreived
call fcn.10006760
mov ecx, 0x100dcd14
call fcn.10006de0
lea eax, [ebp - 0x210]
add esp, 4
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100242f4
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x210]
call fcn.10001b30
push 1
push 0x100dc9f4
mov eax, esi
call fcn.10001a00
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b2e5c
mov esp, ebp
pop ebp
ret
push str.Failed_to_get_drivePath
call fcn.10006760
mov ecx, 0x100dcd14
call fcn.10006e40
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor al, al
pop esi
call fcn.100b2e5c
mov esp, ebp
pop ebp
ret