joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415e6c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9a8
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x41606a
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x18], 2
mov word [ebp - 0x16], bx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
push 0x10
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_connect
test eax, eax
je 0x415ec6
call fcn.00402fc0
jmp 0x416071
push 0
push 0x89
push 0x417dac
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_send
cmp eax, 0x89
je 0x415eec
call fcn.00402fc0
jmp 0x416071
push 0
push 0x640
lea eax, [ebp - 0x658]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_recv
test eax, eax
jg 0x415f11
call fcn.00402fc0
jmp 0x416071
push 0
push 0xa8
push 0x417e38
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_send
cmp eax, 0xa8
je 0x415f37
call fcn.00402fc0
jmp 0x416071
push 0
push 0x640
lea eax, [ebp - 0x658]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_recv
test eax, eax
jg 0x415f5c
call fcn.00402fc0
jmp 0x416071
push 0
push 0xde
push 0x417ee0
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_send
cmp eax, 0xde
je 0x415f82
call fcn.00402fc0
jmp 0x416071
push 0
push 0x640
lea eax, [ebp - 0x658]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_recv
cmp eax, 0x45
jge 0x415fa8
call fcn.00402fc0
jmp 0x416071
mov al, byte [ebp - 0x614]
sub al, 0x30
je 0x415feb
dec al
jne 0x416053
xor eax, eax
push ebp
push 0x415fdf
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00415a3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x416053
xor eax, eax
push ebp
push 0x416010
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 2
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00415a3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41601a
push 0x3e8
call fcn.00406070
xor eax, eax
push ebp
push 0x416049
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00415a3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x416053
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416071
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_closesocket
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100497c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x100497d7
pop dword [ebp - 0x4c]
mov eax, 0x100497d7
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x85fca6bd
add dword [ebp - 0x5c], 0xc8559e8e
mov dword [ebp - 0x58], 0xb0b04607
add dword [ebp - 0x58], 0x8183063e
mov dword [ebp - 0x54], 0xfc94832b
add dword [ebp - 0x54], 0x4fb7c103
mov dword [ebp - 0x50], 0xa3d24712
add dword [ebp - 0x50], 0x5c2db8ee
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x9514f781
sub dword [ebp - 0x5c], 0x20a28e2b
mov dword [ebp - 0x58], 0x4724c69b
sub dword [ebp - 0x58], 0x5b86526
mov dword [ebp - 0x54], 0x35a089da
sub dword [ebp - 0x54], 0xd2311d6e
mov dword [ebp - 0x50], 0xe511cc0f
sub dword [ebp - 0x50], 0xe511cc0f
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x5741f12c
sub eax, 0x473bf118
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x565a0
push 0
call eax
mov ecx, 0x312472b8
sub ecx, 0x31242872
xor ebx, ebx
add ebx, eax
mov edi, 0x95f7e54a
sub edi, 0x85ef294a
add edi, dword [ebp - 0x4c]
mov edx, 0x93384854
add dword [ebp - 4], edx
mov esi, dword [edi]
xor dword [ebp - 0x24], edx
add esi, edx
sub dword [ebp - 0x2c], 0x42e4008a
mov dword [ebx], esi
sub dword [ebp - 0x28], 0xe751129c
add ebx, 0xdc6e0332
sub ebx, 0xdc6e032e
add edi, 4
loop 0x100498eb
add eax, 0x11beb
mov ebx, eax
add eax, 5
mov ecx, 0xe606ad18
sub ecx, 0xd606ad18
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x572008], 0x8088405
inc edx
mov dword [ebx + 0x572008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf00
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf31
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf19
add dl, dl
jne 0x41cf3c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf8d
xor eax, eax
add dl, dl
jne 0x41cf49
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d02a
add dl, dl
jne 0x41cf58
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf63
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf6e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf79
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cf83
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf28
mov eax, 1
add dl, dl
jne 0x41cf9b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cf92
sub eax, ebx
mov ebx, 1
jne 0x41cfd9
mov ecx, 1
add dl, dl
jne 0x41cfbf
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cfca
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfb6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cff0
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cffb
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfe7
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d04b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf28
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f05c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x55654a
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f0ab
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f0ca
mov ecx, edx
add ecx, ebx
jmp 0x41f0ca
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f0ca
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f13c
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f125
test esi, esi
jbe 0x41f13c
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ec
test eax, eax
jne 0x41f117
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f13c
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f0f4
jmp 0x41f13c
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f13c
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x556551
ret
Function at 0x420294
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x5578af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4202cf
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4202e8
lea eax, [ebp - 0x10]
mov edx, dword [0x574348]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x4202fb
lea eax, [ebp - 0x10]
mov edx, dword [0x574348]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x420307
adc edx, 0
mov edx, dword [edx*4 + 0x573178]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x420481
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420474
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420474
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420412
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420412
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420412
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420412
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420474
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420474
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420474
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420474
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420499
inc ebx
cmp ebx, 0x19
jne 0x4202c1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5578b6
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x10004550
Capabilities:
Get common file path

Disassembly:
sub esp, 0x414
mov eax, dword [0x1004f860]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
mov esi, dword [esp + 0x41c]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xe]
push ecx
mov word [esp + 0x10], ax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x104
lea edx, [esp + 8]
push edx
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
test eax, eax
je 0x100045fd
cmp eax, 0x104
ja 0x100045fd
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x216]
push ecx
mov word [esp + 0x218], ax
call sub.MSVCR100.dll_memset
push esi
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x220]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
lea ecx, [esp + 0x20c]
push ecx
call fcn.10028240
pop esi
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.1003779c
add esp, 0x414
ret
mov ecx, dword [esp + 0x414]
pop esi
xor ecx, esp
xor eax, eax
call fcn.1003779c
add esp, 0x414
ret
Function at 0x100049c0
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xffffffffffffffff
push 0x100394e0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x1004f860]
xor eax, ebp
mov dword [ebp + 0x208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x214]
xor eax, eax
mov word [edi], ax
mov dword [ebp - 4], eax
lea ecx, [ebp]
push ecx
push eax
push eax
push 0x1a
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
jns 0x10004a38
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__szPath_
call fcn.10005b30
add esp, 8
push 0
push esi
call fcn.10028240
lea edx, [ebp]
push edx
lea ecx, [ebp - 0x18]
call fcn.10002e00
cmp dword [eax], 0
je 0x10004a4f
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x10004a51
xor eax, eax
push 0x104
push eax
mov eax, dword [ebp + 0x218]
push eax
push edi
call dword [sym.imp.MSVCR100.dll_wcsncpy_s]
add esp, 0x10
lea ecx, [ebp - 0x18]
call fcn.10002330
mov dword [ebp - 4], 0xffffffff
jmp 0x10004aa6
xor eax, eax
test esi, esi
setns al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.1003779c
lea esp, [ebp + 0x20c]
pop ebp
ret

Function at 0x10004ef0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x21c
mov eax, dword [0x1004f860]
xor eax, esp
mov dword [esp + 0x218], eax
push str.JAVA_REGDEPLOY_DEBUG
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.MSVCR100.dll__wdupenv_s]
add esp, 0xc
test eax, eax
jne 0x10004fba
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
cmp dword [0x1004fba4], 0
jne 0x10004fd6
lea eax, [esp + 0x10]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
cmp eax, 0x104
ja 0x10004fba
test eax, eax
je 0x10004fba
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 4]
call fcn.10002e00
push str.JavaDeployReg.log
lea ecx, [esp + 8]
call fcn.10002e00
lea edx, [esp + 4]
push edx
lea ecx, [esp + 4]
call fcn.10004760
lea ecx, [esp + 4]
call fcn.10002330
mov eax, dword [esp]
test eax, eax
je 0x10004f98
mov eax, dword [eax]
jmp 0x10004f9a
xor eax, eax
push 0x1003b100
push eax
push 0x1004fba4
call dword [sym.imp.MSVCR100.dll__wfopen_s]
add esp, 0xc
lea ecx, [esp]
test eax, eax
je 0x10004fd1
call fcn.10002330
xor eax, eax
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.1003779c
add esp, 0x21c
ret
call fcn.10002330
mov ecx, dword [esp + 0x218]
xor ecx, esp
mov eax, 1
call fcn.1003779c
add esp, 0x21c
ret
Function at 0x10006a70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100395c0
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x1004f860]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push eax
lea ecx, [ebp - 0x21a]
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
lea edx, [ebp - 0x21c]
push edx
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
jns 0x10006afa
push esi
push str.Error:_08x_in_::SHGetFolderPath_NULL__CSIDL_LOCAL_APPDATA__NULL__0__szLocalPath_
call fcn.10005b30
add esp, 8
push 0
push esi
call fcn.10028240
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCR100.dll_wcsnlen]
add esp, 8
mov ecx, dword [edi]
push eax
lea edx, [ebp - 0x21c]
push edx
push edi
mov eax, dword [ecx + 0x28c]
call eax
jmp 0x10006b50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1003779c
mov esp, ebp
pop ebp
ret 8

Function at 0x10006b70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100395f0
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x1004f860]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push eax
lea ecx, [ebp - 0x21a]
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
lea edx, [ebp - 0x21c]
push edx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
jns 0x10006bfa
push esi
push str.Error:_08x_in_::SHGetFolderPath_NULL__CSIDL_APPDATA__NULL__0__szLocalPath_
call fcn.10005b30
add esp, 8
push 0
push esi
call fcn.10028240
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCR100.dll_wcsnlen]
add esp, 8
mov ecx, dword [edi]
push eax
lea edx, [ebp - 0x21c]
push edx
push edi
mov eax, dword [ecx + 0x28c]
call eax
jmp 0x10006c50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1003779c
mov esp, ebp
pop ebp
ret 8
Function at 0x10006c70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10039620
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x1004f860]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push eax
lea ecx, [ebp - 0x21a]
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
lea edx, [ebp - 0x21c]
push edx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
jns 0x10006cfa
push esi
push str.Error:_08x_in_::SHGetFolderPath_NULL__CSIDL_COMMON_APPDATA__NULL__0__szPath_
call fcn.10005b30
add esp, 8
push 0
push esi
call fcn.10028240
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCR100.dll_wcsnlen]
add esp, 8
mov ecx, dword [edi]
push eax
lea edx, [ebp - 0x21c]
push edx
push edi
mov eax, dword [ecx + 0x28c]
call eax
jmp 0x10006d50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1003779c
mov esp, ebp
pop ebp
ret 8
Function at 0x100087a0
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x624
mov eax, dword [0x1004f860]
xor eax, esp
mov dword [esp + 0x620], eax
test byte [0x1004fc04], 1
jne 0x100087db
or dword [0x1004fc04], 1
push 0x10039ab0
mov dword [0x1004fc00], 0
call fcn.10028240
add esp, 4
mov eax, dword [0x1004fc00]
test eax, eax
je 0x100087f9
mov eax, dword [eax]
test eax, eax
je 0x100087f9
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
jne 0x10008946
lea eax, [esp + 0x210]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x10008946
push esi
push edi
lea ecx, [esp + 0x218]
push ecx
lea ecx, [esp + 0xc]
call fcn.10002e00
push str.jawshtml.html
lea ecx, [esp + 0x10]
call fcn.10006920
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0xc]
call fcn.10004760
lea ecx, [esp + 0xc]
call fcn.10002330
mov edi, dword [esp + 8]
test edi, edi
je 0x1000885c
mov eax, dword [edi]
jmp 0x1000885e
xor eax, eax
push 0x1003c434
push eax
call dword [sym.imp.MSVCR100.dll__wfopen]
mov esi, eax
push esi
push str._HTML___HTML_
call dword [sym.imp.MSVCR100.dll_fputws]
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
xor eax, eax
xor ecx, ecx
add esp, 0x14
mov word [esp + 0x10], ax
mov word [esp + 0x420], cx
test edi, edi
je 0x1000889b
mov edi, dword [edi]
jmp 0x1000889d
xor edi, edi
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x424]
push eax
push edi
call dword [sym.imp.SHELL32.dll_FindExecutableW]
cmp eax, 0x20
jle 0x1000892a
lea eax, [esp + 0x10]
xor ecx, ecx
lea esi, [eax + 2]
nop
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x100088c0
sub eax, esi
sar eax, 1
cmp word [esp + 0x10], cx
je 0x100088f3
lea edx, [esp + 0x10]
lea ebx, [ebx]
cmp word [edx], 0x20
jne 0x100088f3
inc ecx
cmp word [esp + ecx*2 + 0x10], 0
lea edx, [esp + ecx*2 + 0x10]
jne 0x100088e0
cmp eax, ecx
jle 0x1000892a
lea edx, [esp + eax*2 + 0xe]
jmp 0x10008900
cmp word [edx], 0x20
jne 0x10008910
dec eax
sub edx, 2
cmp eax, ecx
jg 0x10008900
jmp 0x1000892a
cmp eax, ecx
jle 0x1000892a
xor edx, edx
mov word [esp + eax*2 + 0x10], dx
lea eax, [esp + ecx*2 + 0x10]
push eax
mov ecx, 0x1004fc00
call fcn.10006f80
lea ecx, [esp + 0x218]
push ecx
call dword [sym.imp.MSVCR100.dll__wremove]
add esp, 4
lea ecx, [esp + 8]
call fcn.10002330
pop edi
pop esi
mov ecx, dword [esp + 0x620]
xor ecx, esp
mov eax, 0x1004fc00
call fcn.1003779c
add esp, 0x624
ret
Function at 0x1000b160
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x410
mov eax, dword [0x1004f860]
xor eax, esp
mov dword [esp + 0x40c], eax
mov eax, dword [esp + 0x414]
push ebx
mov ebx, dword [esp + 0x420]
push esi
mov esi, dword [esp + 0x420]
push edi
push 2
push 0
push eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
call fcn.10028240
mov edi, eax
test edi, edi
jne 0x1000b1bc
call fcn.100095a0
mov esi, eax
jmp 0x1000b25a
push ebx
push esi
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x1000b1d2
call fcn.100095a0
jmp 0x1000b251
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x1000b1e7
call fcn.100095a0
jmp 0x1000b251
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x1000b1ff
mov esi, 0x8007000e
jmp 0x1000b253
push eax
lea ecx, [esp + 0x18]
call fcn.1000a400
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x1000b218
mov esi, 0x8007000e
jmp 0x1000b253
push esi
push eax
push esi
push ebx
push 0
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1000b231
call fcn.100095a0
jmp 0x1000b251
mov edx, dword [esp + 0x14]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [esp + 0x42c]
mov ecx, dword [esp + 0x14]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.1000afd0
mov esi, eax
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea edx, [esp + 0x18]
cmp dword [esp + 0x14], edx
je 0x1000b270
lea ecx, [esp + 0x14]
call fcn.10009d00
lea ecx, [ecx]
mov ecx, dword [esp + 0x418]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.1003779c
add esp, 0x410
ret 0x10

Function at 0x1000c100
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x1004f860]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
mov esi, dword [esp + 0x214]
push 0x104
lea eax, [esp + 8]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x102
ja 0x1000c15a
lea ecx, [esp + 4]
push ecx
push esi
call fcn.10002b30
add esp, 8
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.1003779c
add esp, 0x20c
ret 8
mov ecx, dword [esp + 0x20c]
pop esi
xor ecx, esp
xor eax, eax
call fcn.1003779c
add esp, 0x20c
ret 8