joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000fc90
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c5ff8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x10264190]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
push 0x10
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x1000fd09
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10004e60
mov eax, dword [ebp - 0x3c]
jmp 0x1000fd89
push 4
lea ecx, [ebp + 8]
call sym.URDHelp_x86.dll_public:_void___thiscall_CURDHelp::constructor_void_
mov ecx, eax
call fcn.10039750
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x1000fd67
xor edx, edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1000fd5d
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x40], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10004e60
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1019110d
mov esp, ebp
pop ebp
ret 0x60

Function at 0x1000fdb0
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000fdeb
mov eax, dword [ebp - 0xc]
jmp 0x1000fe57
push 0xf01ff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000fe0c
mov eax, dword [ebp - 0xc]
jmp 0x1000fe57
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x1000fe25
mov eax, dword [ebp - 0xc]
jmp 0x1000fe57
mov dword [ebp - 0xc], 1
cmp dword [ebp - 4], 0
je 0x1000fe43
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x100103a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
push eax
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100103cd
cmp dword [ebp - 4], 0xffffffff
jne 0x10010486
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x57
jne 0x10010434
push 0x1021bcd8
push 0
push 3
lea ecx, [ebp - 0x40]
push ecx
call fcn.10009d30
mov edx, dword [eax]
mov dword [ebp - 0x1c], edx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [eax + 8]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x1021ae5c
sub esp, 0xc
mov edx, esp
mov eax, dword [ebp - 0x1c]
mov dword [edx], eax
mov ecx, dword [ebp - 0x18]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x14]
mov dword [edx + 8], eax
call fcn.10008d70
add esp, 0x18
mov eax, 1
jmp 0x100104f9
push 0x1021bd38
push 0
push 3
lea ecx, [ebp - 0x4c]
push ecx
call fcn.10009d30
mov edx, dword [eax]
mov dword [ebp - 0x28], edx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x24], ecx
mov edx, dword [eax + 8]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._tasp::library_KillProcessOfID__dwPID:_lu__err_lu._n
sub esp, 0xc
mov edx, esp
mov eax, dword [ebp - 0x28]
mov dword [edx], eax
mov ecx, dword [ebp - 0x24]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x20]
mov dword [edx + 8], eax
call fcn.10008d70
add esp, 0x18
xor eax, eax
jmp 0x100104f9
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x100104ec
push 0x1021bdd0
push 0
push 3
lea edx, [ebp - 0x58]
push edx
call fcn.10009d30
mov ecx, dword [eax]
mov dword [ebp - 0x34], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x30], edx
mov eax, dword [eax + 8]
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._tasp::library_TerminateProcess__dwPID:_lu__err_lu._n
sub esp, 0xc
mov edx, esp
mov eax, dword [ebp - 0x34]
mov dword [edx], eax
mov ecx, dword [ebp - 0x30]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x2c]
mov dword [edx + 8], eax
call fcn.10008d70
add esp, 0x18
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10010f10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10010f9d
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10010f91
push 0x1021cdc8
push 2
push 3
lea ecx, [ebp - 0x30]
push ecx
call fcn.10009d30
mov edx, dword [eax]
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x14], ecx
mov edx, dword [eax + 8]
mov dword [ebp - 0x10], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._tasp::library_TerminateProcess_err:_lu
sub esp, 0xc
mov eax, esp
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov edx, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x10]
mov dword [eax + 8], ecx
call fcn.10008d70
add esp, 0x14
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10010fea
push 0x1021ce48
push 2
push 3
lea eax, [ebp - 0x3c]
push eax
call fcn.10009d30
mov ecx, dword [eax]
mov dword [ebp - 0x24], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x20], edx
mov eax, dword [eax + 8]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._tasp::library_OpenProcess_err:_lu
sub esp, 0xc
mov ecx, esp
mov edx, dword [ebp - 0x24]
mov dword [ecx], edx
mov eax, dword [ebp - 0x20]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1c]
mov dword [ecx + 8], edx
call fcn.10008d70
add esp, 0x14
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x100116c0
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c60cb
mov eax, dword fs:[0]
push eax
mov eax, 0x105c
call fcn.10195e10
mov eax, dword [0x10264190]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x105c], ecx
mov dword [ebp - 0x1044], 0
lea ecx, [ebp - 0x1038]
call fcn.100387b0
mov dword [ebp - 4], 0
mov dword [ebp - 0x1048], 0
mov dword [ebp - 0x1058], 0
mov dword [ebp - 0x103c], 0
mov dword [ebp - 0x1014], 0
lea eax, [ebp - 0x1014]
push eax
lea ecx, [ebp - 0x103c]
push ecx
push 1
push 0
push 0
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateProcessesW]
mov dword [ebp - 0x1040], 0
jmp 0x1001176e
mov edx, dword [ebp - 0x1040]
add edx, 1
mov dword [ebp - 0x1040], edx
mov eax, dword [ebp - 0x1040]
cmp eax, dword [ebp - 0x1014]
jae 0x100118b7
mov ecx, dword [ebp - 0x1040]
shl ecx, 4
mov edx, dword [ebp - 0x103c]
mov eax, dword [edx + ecx + 4]
cmp eax, dword [ebp + 0xc]
jne 0x100118b2
mov dword [ebp - 0x1058], 1
mov dword [ebp - 0x1018], 0x3ff
mov dword [ebp - 0x101c], 0x3ff
push 0x800
push 0
lea ecx, [ebp - 0x1010]
push ecx
call fcn.10195c90
add esp, 0xc
push 0x800
push 0
lea edx, [ebp - 0x810]
push edx
call fcn.10195c90
add esp, 0xc
lea eax, [ebp - 0x1020]
push eax
lea ecx, [ebp - 0x1018]
push ecx
lea edx, [ebp - 0x1010]
push edx
lea eax, [ebp - 0x101c]
push eax
lea ecx, [ebp - 0x810]
push ecx
mov edx, dword [ebp - 0x1040]
shl edx, 4
mov eax, dword [ebp - 0x103c]
mov ecx, dword [eax + edx + 0xc]
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
lea edx, [ebp - 0x810]
push edx
lea ecx, [ebp - 0x1038]
call fcn.10018d80
lea ecx, [ebp - 0x1038]
call fcn.10018ed0
movzx eax, al
test eax, eax
jne 0x10011855
mov dword [ebp - 0x1048], 1
jmp 0x100118b0
push 0x1021d6e8
push 2
push 3
lea ecx, [ebp - 0x1068]
push ecx
call fcn.10009d30
mov edx, dword [eax]
mov dword [ebp - 0x1054], edx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1050], ecx
mov edx, dword [eax + 8]
mov dword [ebp - 0x104c], edx
push str._tasp::library_WTSEnumerateProcessesW_AccountNameNULL._n
sub esp, 0xc
mov eax, esp
mov ecx, dword [ebp - 0x1054]
mov dword [eax], ecx
mov edx, dword [ebp - 0x1050]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x104c]
mov dword [eax + 8], ecx
call fcn.10008d70
add esp, 0x10
jmp 0x100118b7
jmp 0x1001175f
cmp dword [ebp - 0x103c], 0
je 0x100118cd
mov edx, dword [ebp - 0x103c]
push edx
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
lea eax, [ebp - 0x1038]
push eax
mov ecx, dword [ebp + 8]
call fcn.10037e50
mov ecx, dword [ebp - 0x1044]
or ecx, 1
mov dword [ebp - 0x1044], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1038]
call fcn.100385b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1019110d
mov esp, ebp
pop ebp
ret 8
Function at 0x100125d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c623e
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x10264190]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 0
push 0x6c
call fcn.1007b883
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x18], 0
je 0x10012626
mov ecx, dword [ebp - 0x18]
call fcn.10012720
mov dword [ebp - 0x1c], eax
jmp 0x1001262d
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov dword [edx], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0x24]
mov dword [ecx + 4], edx
push 0
lea ecx, [ebp + 0xc]
call fcn.100397b0
push eax
lea eax, [ebp - 0x94]
push eax
mov ecx, 0x10270344
call fcn.10017230
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x30]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.10005130
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x94]
call fcn.10004e60
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x28]
mov dword [eax + 0x68], ecx
push 0
push 0
mov edx, dword [ebp - 0x10]
push edx
push 0x100124f0
push 0
push 0
call fcn.10194474
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0x2c], 0
je 0x100126ca
mov eax, dword [ebp + 0x2c]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
jmp 0x100126d4
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], 0
je 0x100126e3
mov dword [ebp - 0x20], 1
jmp 0x100126ea
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.100397d0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x28
Function at 0x10017d20
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c6a89
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
mov eax, dword [0x10264190]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x150], ecx
push str._:
lea ecx, [ebp - 0xd0]
call fcn.10004ea0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xd0]
call sym.URDHelp_x86.dll_public:_void___thiscall_CURDHelp::constructor_void_
mov ecx, eax
call fcn.10018b80
mov dword [ebp - 0x140], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x70]
call fcn.10005090
mov byte [ebp - 4], 1
mov dword [ebp - 0x138], 1
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x13c], 0
mov ecx, dword [ebp - 0x13c]
push ecx
lea ecx, [ebp - 0xd0]
call sym.URDHelp_x86.dll_public:_void___thiscall_CURDHelp::constructor_void_
mov ecx, eax
call fcn.10039750
push eax
lea ecx, [ebp - 0x70]
call sym.URDHelp_x86.dll_public:_void___thiscall_CURDHelp::constructor_void_
mov ecx, eax
call fcn.10018f00
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0xffffffff
je 0x10017e8f
mov edx, dword [ebp - 0x134]
push edx
push 0
lea eax, [ebp - 0x168]
push eax
lea ecx, [ebp - 0x70]
call sym.URDHelp_x86.dll_public:_void___thiscall_CURDHelp::constructor_void_
mov ecx, eax
call fcn.10018f60
mov dword [ebp - 0x14c], eax
mov ecx, dword [ebp - 0x14c]
mov dword [ebp - 0x144], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x144]
push edx
lea ecx, [ebp - 0x130]
call fcn.100051e0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x168]
call fcn.100385b0
mov eax, dword [ebp - 0x134]
add eax, dword [ebp - 0x140]
mov dword [ebp - 0x13c], eax
push 0
lea ecx, [ebp - 0x130]
call sym.URDHelp_x86.dll_public:_void___thiscall_CURDHelp::constructor_void_
mov ecx, eax
call fcn.10039750
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10017e7b
mov dword [ebp - 0x138], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x130]
call fcn.10004e60
jmp 0x10017dae
mov ecx, dword [ebp - 0x138]
mov dword [ebp - 0x148], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x70]
call fcn.10004e60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd0]
call fcn.10004e60
mov eax, dword [ebp - 0x148]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1019110d
mov esp, ebp
pop ebp
ret 4
Function at 0x10038890
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x100388b4
xor eax, eax
jmp 0x10038934
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100388cb
xor eax, eax
jmp 0x10038934
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x10038917
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x10038917
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x100388ee
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x10038923
xor eax, eax
jmp 0x10038934
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x10038931
xor eax, eax
jmp 0x10038934
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1003d7d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c8625
mov eax, dword fs:[0]
push eax
sub esp, 0x4e4
mov eax, dword [0x10264190]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x490], ecx
mov dword [ebp - 0x484], 0
lea ecx, [ebp - 0x480]
call fcn.10004dd0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x420]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x1003d84a
lea ecx, [ebp - 0x420]
push ecx
lea ecx, [ebp - 0x480]
call fcn.10004f30
jmp 0x1003d8a6
xor edx, edx
mov word [ebp - 0x218], dx
push 0x206
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.10195c90
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 3
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x480]
call sym.URDHelp_x86.dll_public:_void___thiscall_CURDHelp::constructor_void_
mov ecx, eax
call fcn.10018de0
push 0x102227bc
lea ecx, [ebp - 0x480]
call fcn.10004f60
push 0x1022274c
lea ecx, [ebp - 0x480]
call fcn.100057b0
push str.zs_isp_clientLogsMainUsbEnvLastError.log
lea eax, [ebp - 0x4f0]
push eax
push 0x10270344
call fcn.10017840
add esp, 0xc
mov dword [ebp - 0x48c], eax
mov ecx, dword [ebp - 0x48c]
mov dword [ebp - 0x488], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x488]
push edx
lea ecx, [ebp - 0x480]
call fcn.10005160
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4f0]
call fcn.10004e60
lea eax, [ebp - 0x480]
push eax
mov ecx, 0x10270344
call fcn.10017d20
lea ecx, [ebp - 0x480]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10005090
mov edx, dword [ebp - 0x484]
or edx, 1
mov dword [ebp - 0x484], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x480]
call fcn.10004e60
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1019110d
mov esp, ebp
pop ebp
ret 4
Function at 0x10047fd0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c9548
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x10264190]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x74], ecx
mov ecx, dword [ebp - 0x74]
add ecx, 0x1d8
call fcn.100052b0
push eax
mov ecx, 0x102703c4
call fcn.10008570
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], edx
cmp dword [ebp - 0x78], 0
jl 0x1004808e
jg 0x1004802b
cmp dword [ebp - 0x7c], 0xa00000
jb 0x1004808e
mov eax, dword [ebp - 0x74]
add eax, 0x1d8
push eax
lea ecx, [ebp - 0x70]
call fcn.10005090
mov dword [ebp - 4], 0
push 0x10228b84
lea ecx, [ebp - 0x70]
call fcn.10004f60
lea ecx, [ebp - 0x70]
call fcn.100052b0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x70]
call fcn.100052b0
push eax
mov ecx, dword [ebp - 0x74]
add ecx, 0x1d8
call fcn.100052b0
push eax
call fcn.10191974
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.10004e60
push 0x10228b8c
mov ecx, dword [ebp + 8]
call fcn.10018b80
push eax
mov ecx, dword [ebp + 8]
call fcn.100397b0
push eax
mov ecx, dword [ebp - 0x74]
add ecx, 0x1d8
push ecx
mov ecx, 0x102703c4
call fcn.10007fb0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1019110d
mov esp, ebp
pop ebp
ret 4
Function at 0x10054f90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ca750
mov eax, dword fs:[0]
push eax
sub esp, 0x4dc
mov eax, dword [0x10264190]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4e8], ecx
mov dword [ebp - 0x4e4], 0
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x480]
call fcn.10004dd0
mov byte [ebp - 4], 4
lea eax, [ebp - 0x420]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x1005500e
lea ecx, [ebp - 0x420]
push ecx
lea ecx, [ebp - 0x480]
call fcn.10004f30
jmp 0x1005506a
xor edx, edx
mov word [ebp - 0x218], dx
push 0x206
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.10195c90
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 3
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x480]
call sym.URDHelp_x86.dll_public:_void___thiscall_CURDHelp::constructor_void_
mov ecx, eax
call fcn.10018de0
push str.ProgramData
lea ecx, [ebp - 0x480]
call fcn.10004f60
push 0
push 0x10230e7c
push 0x10230eec
lea ecx, [ebp + 0xcc]
call fcn.10005cd0
push 0x10230ef0
lea ecx, [ebp - 0x480]
call fcn.100057b0
lea ecx, [ebp + 0xcc]
call sym.URDHelp_x86.dll_public:_void___thiscall_CURDHelp::constructor_void_
mov ecx, eax
call fcn.10039750
push eax
lea ecx, [ebp + 0x6c]
call sym.URDHelp_x86.dll_public:_void___thiscall_CURDHelp::constructor_void_
mov ecx, eax
call fcn.10039750
push eax
lea ecx, [ebp + 0xc]
call sym.URDHelp_x86.dll_public:_void___thiscall_CURDHelp::constructor_void_
mov ecx, eax
call fcn.10039750
push eax
push 0x10230ef4
lea eax, [ebp - 0x4e0]
push eax
push 0x10270344
call fcn.10017840
add esp, 0x18
mov byte [ebp - 4], 5
push 0
push str..:.
push 0x10230f34
lea ecx, [ebp - 0x4e0]
call fcn.10005cd0
push 0
push 0x10230f38
push 0x10230f3c
lea ecx, [ebp - 0x4e0]
call fcn.10005cd0
push 0
push 0x10230f40
push 0x10230f44
lea ecx, [ebp - 0x4e0]
call fcn.10005cd0
push 0
push 0x10230f48
push 0x10230f4c
lea ecx, [ebp - 0x4e0]
call fcn.10005cd0
lea ecx, [ebp - 0x4e0]
push ecx
lea ecx, [ebp - 0x480]
call fcn.10005160
lea edx, [ebp - 0x480]
push edx
mov ecx, 0x10270344
call fcn.10017d20
push 0x10230f50
lea ecx, [ebp - 0x480]
call fcn.10005570
lea eax, [ebp - 0x480]
push eax
mov ecx, dword [ebp + 8]
call fcn.10005090
mov ecx, dword [ebp - 0x4e4]
or ecx, 1
mov dword [ebp - 0x4e4], ecx
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x4e0]
call fcn.10004e60
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x480]
call fcn.10004e60
mov byte [ebp - 4], 2
lea ecx, [ebp + 0xc]
call fcn.10004e60
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x6c]
call fcn.10004e60
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xcc]
call fcn.10004e60
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1019110d
mov esp, ebp
pop ebp
ret 0x124