joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10011940
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push edi
mov edi, eax
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [edi], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100119c0
push esi
lea ecx, [esp + 0xc]
push ecx
push edi
lea edx, [esp + 0x18]
push edx
push eax
mov eax, dword [esp + 0x18]
push str.ProgramFilesDir
push eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 8]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x100119c0
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100119b5
sub eax, edx
jne 0x100119df
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.Program_Files
mov ecx, 0x104
mov byte [edi + 2], 0
call fcn.10003520
xor eax, eax
pop edi
add esp, 0xc
ret

Function at 0x10011c80
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x114
mov eax, dword [0x10023050]
xor eax, esp
mov dword [esp + 0x110], eax
push esi
push 0x104
lea eax, [esp + 0x11]
push 0
push eax
mov esi, ecx
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], 0x104
mov byte [esp + 0x18], 0
call sub.MSVCR90.dll_memset
mov esi, dword [esi]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0xc]
push eax
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
test eax, eax
je 0x10011d00
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.100192c6
add esp, 0x114
ret 4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x10011ce6
mov ecx, dword [esp + 0x11c]
push ecx
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x114]
pop esi
xor ecx, esp
call fcn.100192c6
add esp, 0x114
ret 4
Function at 0x10011d80
Capabilities:
Delete file
Get disk information
Read .ini file

Disassembly:
sub esp, 0x220
mov eax, dword [0x10023050]
xor eax, esp
mov dword [esp + 0x21c], eax
mov eax, dword [esp + 0x224]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x14], eax
xor eax, eax
push 0x104
push eax
lea ecx, [esp + 0x12d]
push ecx
mov byte [esp + 0x1c], 0
mov word [esp + 0x1d], ax
mov byte [esp + 0x1f], al
mov byte [esp + 0x130], al
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [esp + 0x124]
push edx
push 0x105
xor esi, esi
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov dword [esp + 0x18], eax
cmp ebp, dword [esp + 0x18]
jge 0x10011eb6
cmp byte [esp + ebp + 0x124], 0
jne 0x10011eac
push 3
lea eax, [esp + ebp + 0x125]
push eax
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.MSVCR90.dll_strncpy]
add esp, 0xc
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov esi, eax
cmp esi, 3
jne 0x10011eac
push 0x104
lea eax, [esp + 0x21]
push 0
push eax
mov byte [esp + 0x28], 0
call sub.MSVCR90.dll_memset
lea ecx, [esp + 0x1c]
push ecx
push str._sRsTest.ini
mov eax, 0x105
lea edi, [esp + 0x30]
call fcn.100032e0
add esp, 0x14
mov edx, edi
push edx
push 0x1001d474
push 0x1001e624
push 0x1001e628
call ebx
mov eax, edi
push eax
push 0
push 0x1001e624
push 0x1001e628
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
jne 0x10011e94
lea esi, [eax + 5]
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0
call ebx
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
inc ebp
cmp esi, 3
jne 0x10011df1
mov eax, dword [esp + 0x14]
test eax, eax
je 0x10011ed9
cmp esi, 3
jne 0x10011ed9
push 0x103
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.MSVCR90.dll_strncpy]
add esp, 0xc
jmp 0x10011ede
mov byte [esp + 0x10], 0
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100192c6
add esp, 0x220
ret 4
Function at 0x10011f90
Capabilities:
Create directory
Delete file

Disassembly:
sub esp, 0x158
mov eax, dword [0x10023050]
xor eax, esp
mov dword [esp + 0x154], eax
mov eax, dword [esp + 0x15c]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x18], eax
mov edi, ecx
test eax, eax
je 0x100120b5
test edi, edi
je 0x100120b5
push str.Shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
mov dword [esp + 0x14], ebx
test ebx, ebx
je 0x10012134
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SHGetFolderPathA
push ebx
call ebp
mov esi, eax
test esi, esi
jne 0x10012022
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.SHFolder.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp + 0x14], eax
test eax, eax
je 0x10012016
push str.SHGetFolderPathA
push eax
call ebp
mov esi, eax
mov ebx, dword [esp + 0x14]
test esi, esi
je 0x10012129
push edi
push 1
push 0
push 0x23
push 0
call esi
test eax, eax
jl 0x10012129
mov eax, edi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10012040
sub eax, edx
je 0x10012129
push str.Rising
mov ecx, 0x104
mov ebx, 1
call fcn.10003520
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea eax, [esp + 0x20]
push eax
push edi
call ebp
mov esi, eax
mov al, byte [esp + 0x20]
cmp esi, 0xffffffff
je 0x10012080
test al, 0x10
jne 0x10012096
test al, 0x10
jne 0x1001208b
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebx, eax
cmp esi, 0xffffffff
je 0x100120a2
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
jne 0x100120d0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x100120b5
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100192c6
add esp, 0x158
ret
push 0x1001caf0
mov ecx, 0x104
call fcn.10003520
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, 0x104
call fcn.10003520
lea edx, [esp + 0x20]
push edx
push edi
call ebp
mov esi, eax
mov al, byte [esp + 0x20]
cmp esi, 0xffffffff
je 0x10012105
test al, 0x10
jne 0x10012119
test al, 0x10
jne 0x10012110
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp esi, 0xffffffff
je 0x10012125
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x10012134
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x10012137
sub edi, ecx
mov eax, edi
jmp 0x100120b7
Function at 0x100125a0
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0xa4
mov eax, dword [0x10023050]
xor eax, esp
mov dword [esp + 0xa0], eax
push esi
lea eax, [esp + 0x10]
push eax
mov esi, ecx
mov dword [esp + 8], 0x208
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x20], 2
jne 0x10012600
mov eax, dword [esp + 4]
call fcn.10012af0
pop esi
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.100192c6
add esp, 0xa4
ret
lea ecx, [esp + 8]
push ecx
push 0x2001f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10012648
mov ecx, dword [esp + 8]
lea edx, [esp + 4]
push edx
push esi
lea eax, [esp + 0x14]
push eax
push 0
push str.Programs
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x10012679
mov eax, dword [esp + 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [esp + 4]
cmp ecx, 0x7fffffff
ja 0x10012679
push edi
push str.Start_MenuPrograms
mov edi, esi
call fcn.10003520
pop edi
mov ecx, dword [esp + 0xa4]
pop esi
xor ecx, esp
mov eax, 1
call fcn.100192c6
add esp, 0xa4
ret
Function at 0x10012910
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x118
mov eax, dword [0x10023050]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
push 0x104
lea eax, [esp + 0x15]
push 0
push eax
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], 0x104
mov byte [esp + 0x1c], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x1001299d
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 8]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push esi
push str.AppData
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
xor edx, edx
test eax, eax
setg dl
dec edx
test esi, edx
pop esi
je 0x100129fd
push 0x208
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, 0x105
lea eax, [esp + 0xc]
mov edi, edi
cmp byte [eax], 0
je 0x100129dd
inc eax
sub ecx, 1
jne 0x100129d0
jmp 0x100129fd
test ecx, ecx
je 0x100129fd
mov eax, 0x105
sub eax, ecx
mov ecx, 0x105
sub ecx, eax
lea edx, [esp + eax + 0xc]
mov eax, str.Application_Data
call fcn.100034e0
mov ecx, 0x105
lea eax, [esp + 0xc]
cmp byte [eax], 0
je 0x10012a13
inc eax
sub ecx, 1
jne 0x10012a06
jmp 0x10012a33
test ecx, ecx
je 0x10012a33
mov eax, 0x105
sub eax, ecx
mov ecx, 0x105
sub ecx, eax
lea edx, [esp + eax + 0xc]
mov eax, str.MicrosoftInternet_ExplorerQuick_Launch
call fcn.100034e0
push 0x208
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [esp + 0x114]
xor ecx, esp
mov eax, 1
call fcn.100192c6
add esp, 0x118
ret

Function at 0x10012a60
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push edi
mov edi, eax
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10012abe
push esi
lea ecx, [esp + 0xc]
push ecx
push edi
lea edx, [esp + 0x18]
push edx
push eax
mov eax, dword [esp + 0x18]
push str.Common_Programs
push eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 8]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x10012abe
cmp byte [edi], 0
jne 0x10012ae3
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x10012acf
pop edi
add esp, 0xc
ret
cmp ebx, 0x7fffffff
ja 0x10012ae3
push str.ProfilesAll_UsersStart_MenuPrograms
mov ecx, ebx
call fcn.10003520
mov eax, 1
pop edi
add esp, 0xc
ret
Function at 0x10012af0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea ecx, [esp]
push ecx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10012b44
mov ecx, dword [esp]
lea edx, [esp + 4]
push edx
push esi
lea eax, [esp + 0x10]
push eax
push 0
push str.Common_Programs
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov eax, 1
add esp, 0xc
ret

Function at 0x10013090
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x118
mov eax, dword [0x10023050]
xor eax, esp
mov dword [esp + 0x114], eax
xor eax, eax
cmp eax, 0x1001cb24
je 0x1001318e
test esi, esi
je 0x1001318e
push edi
push 0x103
push eax
lea ecx, [esp + 0x1d]
push ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 1
mov byte [esp + 0x20], al
call sub.MSVCR90.dll_memset
push 0x1001cb24
push str.SOFTWARERising_s
mov eax, 0x104
lea edi, [esp + 0x28]
call fcn.100032e0
add esp, 0x14
lea edx, [esp + 4]
push edx
push 0x20019
push 0
mov eax, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10013167
lea ecx, [esp + 8]
push ecx
push esi
lea edx, [esp + 0x14]
push edx
push eax
mov eax, dword [esp + 0x14]
push str.datapath
push eax
mov dword [esp + 0x20], 0x103
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10013140
sub eax, edx
je 0x1001315c
push 0x1001caf0
mov ecx, 0x103
mov edi, esi
call fcn.10003520
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
lea edx, [eax + 1]
pop edi
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10013170
sub eax, edx
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.100192c6
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor ecx, esp
xor eax, eax
call fcn.100192c6
add esp, 0x118
ret
Function at 0x100146d0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov ebx, eax
xor edi, edi
cmp ebx, edi
jne 0x10014725
cmp byte [ebp + 0x2c], 0
jne 0x1001471c
mov byte [ebp + 0x2c], 1
mov dword [ebp + 0x30], 2
mov ebx, dword [str.Failed_to_open_file]
mov eax, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014700
sub eax, edx
lea edi, [ebp + 0x34]
mov esi, eax
call fcn.10013590
or eax, 0xffffffff
mov dword [ebp + 0x40], eax
mov dword [ebp + 0x3c], eax
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 4
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x10014741
lea esp, [esp]
mov ecx, esi
mov eax, dword [ecx]
mov edx, dword [eax]
mov esi, dword [esi + 0x28]
push 1
call edx
cmp esi, edi
jne 0x10014730
mov esi, dword [sym.imp.MSVCR90.dll_fseek]
push 2
or eax, 0xffffffff
mov dword [ebp + 0x18], edi
mov dword [ebp + 0x1c], edi
push edi
push ebx
mov dword [ebp + 8], eax
mov dword [ebp + 4], eax
call esi
push ebx
call dword [sym.imp.MSVCR90.dll_ftell]
push 0
push 0
push ebx
mov edi, eax
call esi
add esp, 0x1c
test edi, edi
jg 0x1001479c
cmp byte [ebp + 0x2c], 0
jne 0x1001471c
mov byte [ebp + 0x2c], 1
mov dword [ebp + 0x30], 0xc
mov ebx, dword [str.Error_document_empty.]
mov eax, ebx
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014790
jmp 0x10014707
lea eax, [edi + 1]
push eax
call fcn.100193f0
push ebx
push 1
mov esi, eax
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.MSVCR90.dll_fread]
add esp, 0x14
cmp eax, 1
je 0x100147f2
push esi
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp byte [ebp + 0x2c], 0
jne 0x1001471c
mov byte [ebp + 0x2c], 1
mov dword [ebp + 0x30], 2
mov ebx, dword [str.Failed_to_open_file]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100147e6
jmp 0x10014707
mov byte [esi + edi], 0
cmp byte [esi], 0
mov eax, esi
mov ecx, esi
je 0x1001481c
nop
mov dl, byte [eax]
cmp dl, 0xd
jne 0x10014813
mov byte [ecx], 0xa
inc eax
inc ecx
cmp byte [eax], 0xa
jne 0x10014817
jmp 0x10014816
mov byte [ecx], dl
inc ecx
inc eax
cmp byte [eax], 0
jne 0x10014800
push 0
mov byte [ecx], 0
mov edx, dword [ebp]
mov eax, dword [edx + 8]
push 0
push esi
mov ecx, ebp
call eax
push esi
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
xor eax, eax
cmp byte [ebp + 0x2c], al
pop esi
pop ebp
sete al
pop ebx
ret 4
Function at 0x10017540
Capabilities:
Check if file exists
Copy file
Set file attributes

Disassembly:
sub esp, 0x108
mov eax, dword [0x10023050]
xor eax, esp
mov dword [esp + 0x104], eax
push 0x103
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call sub.MSVCR90.dll_memset
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10017572
sub eax, edx
cmp eax, 0x103
jbe 0x100175a1
push 0x6f
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.100192c6
add esp, 0x108
ret
push 0x103
lea ecx, [esp + 4]
push esi
push ecx
call dword [sym.imp.MSVCR90.dll__mbsnbcpy]
lea edx, [esp + 0xc]
push 0x5c
push edx
call dword [sym.imp.MSVCR90.dll__mbsrchr]
add esp, 0x14
test eax, eax
je 0x1001765e
mov byte [eax], 0
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 3
jge 0x100175ec
push 0x1001caf0
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push edi
call ebx
test eax, eax
jne 0x1001761a
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.100192c6
add esp, 0x108
ret
lea ecx, [esp + 4]
call fcn.10017680
test eax, eax
jne 0x1001762b
push 0x52
jmp 0x100175fc
push esi
call ebx
test eax, eax
je 0x1001763e
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.100192c6
add esp, 0x108
ret
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.100192c6
add esp, 0x108
ret
Function at 0x10017680
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x108
mov eax, dword [0x10023050]
xor eax, esp
mov dword [esp + 0x104], eax
push ebp
push esi
push edi
push 0x103
lea eax, [esp + 0x11]
push 0
push eax
mov esi, ecx
mov ebp, 1
mov byte [esp + 0x18], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
test esi, esi
je 0x100176da
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call edi
test eax, eax
jle 0x100176da
push esi
call edi
cmp eax, 0x104
jbe 0x100176f4
push 0x6f
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.100192c6
add esp, 0x108
ret
push ebx
push 0x103
push esi
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.SHLWAPI.dll_PathSkipRootA]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, dword [sym.imp.MSVCR90.dll__mbschr]
lea ecx, [ecx]
test eax, eax
je 0x1001778f
push 0x5c
push eax
call ebx
mov esi, eax
add esp, 8
test esi, esi
je 0x1001778f
lea eax, [esp + 0x10]
push eax
mov byte [esi], 0
call edi
cmp eax, 0xffffffff
je 0x10017745
test al, 0x10
jne 0x10017787
test al, 0x10
jne 0x10017764
push 0x80
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
and ebp, eax
jne 0x10017787
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10017787
mov ebp, 1
mov byte [esi], 0x5c
lea eax, [esi + 1]
jmp 0x10017720
lea ecx, [esp + 0x10]
push ecx
call edi
pop ebx
cmp eax, 0xffffffff
je 0x100177a0
test al, 0x10
jne 0x100177e2
test al, 0x10
jne 0x100177bf
push 0x80
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
and ebp, eax
jne 0x100177e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100177e2
mov ebp, 1
mov ecx, dword [esp + 0x110]
pop edi
pop esi
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.100192c6
add esp, 0x108
ret
Function at 0x10017800
Capabilities:
Create directory

Disassembly:
sub esp, 0x108
mov eax, dword [0x10023050]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push esi
push edi
push 0x103
lea eax, [esp + 0x11]
push 0
push eax
mov esi, ecx
mov edi, 1
mov byte [esp + 0x18], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
test esi, esi
je 0x1001785a
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call ebx
test eax, eax
jle 0x1001785a
push esi
call ebx
cmp eax, 0x104
jbe 0x10017874
push 0x6f
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.100192c6
add esp, 0x108
ret
push 0x103
push esi
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathSkipRootA]
mov esi, eax
push esi
call ebx
test eax, eax
je 0x10017908
mov ebx, dword [sym.imp.MSVCR90.dll__mbschr]
push ebp
push 0x5c
push esi
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
add esp, 8
test esi, esi
je 0x100178e8
push 0
lea eax, [esp + 0x14]
push eax
mov byte [esi], 0
call ebp
and edi, eax
jne 0x100178d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100178d6
mov edi, 1
mov byte [esi], 0x5c
push 0x5c
inc esi
push esi
call ebx
mov esi, eax
add esp, 8
test esi, esi
jne 0x100178b4
push 0
lea ecx, [esp + 0x14]
push ecx
call ebp
and edi, eax
pop ebp
jne 0x10017908
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10017908
mov edi, 1
mov ecx, dword [esp + 0x110]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100192c6
add esp, 0x108
ret
Function at 0x100192c6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10023050]
jne 0x100192d0
repz ret
jmp fcn.10019880
Function at 0x89e370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x89e38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x8c7074
push ecx
mov edi, eax
call fcn.008b2198
mov esi, eax
add esp, 8
test esi, esi
jne 0x89e3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.008b202e
push esi
call fcn.008b1fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret