joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003b6e7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax]
cmp eax, 0xe0434f4d
je 0x1003b712
cmp eax, 0xe06d7363
jne 0x1003b72c
call fcn.10033e9c
and dword [eax + 0x90], 0
jmp fcn.1003a16a
call fcn.10033e9c
cmp dword [eax + 0x90], 0
jle 0x1003b72c
call fcn.10033e9c
add eax, 0x90
dec dword [eax]
xor eax, eax
pop ebp
ret

Function at 0x1003d9ef
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10033c47
and dword [ebp - 4], 0
cmp dword [0x10075730], 0
mov ebx, eax
jne 0x1003daa0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1003db51
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1003db51
push eax
call fcn.10033bd5
mov dword [esp], 0x1005d998
push edi
mov dword [0x10075730], eax
call esi
push eax
call fcn.10033bd5
mov dword [esp], 0x1005d984
push edi
mov dword [0x10075734], eax
call esi
push eax
call fcn.10033bd5
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10075738], eax
call esi
push eax
call fcn.10033bd5
pop ecx
mov dword [0x10075740], eax
test eax, eax
je 0x1003daa0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10033bd5
pop ecx
mov dword [0x1007573c], eax
mov eax, dword [0x1007573c]
cmp eax, ebx
je 0x1003daf8
cmp dword [0x10075740], ebx
je 0x1003daf8
push eax
call fcn.10033c50
push dword [0x10075740]
mov esi, eax
call fcn.10033c50
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1003daf8
test edi, edi
je 0x1003daf8
call esi
test eax, eax
je 0x1003daef
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1003daef
test byte [ebp - 0xc], 1
jne 0x1003daf8
or dword [ebp + 0x10], 0x200000
jmp 0x1003db31
mov eax, dword [0x10075734]
cmp eax, ebx
je 0x1003db31
push eax
call fcn.10033c50
pop ecx
test eax, eax
je 0x1003db31
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1003db31
mov eax, dword [0x10075738]
cmp eax, ebx
je 0x1003db31
push eax
call fcn.10033c50
pop ecx
test eax, eax
je 0x1003db31
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10075730]
call fcn.10033c50
pop ecx
test eax, eax
je 0x1003db51
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1003db53
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10042fb0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1006dd60]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.1002c440
add esp, 0xc
push 0x104
lea edx, [ebp - 0x210]
push edx
push 0x1004
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x10043009
call dword [sym.imp.KERNEL32.dll_GetACP]
jmp 0x10043018
lea ecx, [ebp - 0x210]
push ecx
call fcn.100309f4
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002ac1f
mov esp, ebp
pop ebp
ret
Function at 0x10043080
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100566f8
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x1006dd60]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x434], 0
mov eax, dword [0x10075ba8]
and eax, 1
jne 0x100430e5
mov ecx, dword [0x10075ba8]
or ecx, 1
mov dword [0x10075ba8], ecx
mov ecx, 0x10075ba4
call fcn.1000fea0
push 0x100585f0
call fcn.1002cbcd
add esp, 4
mov ecx, 0x10075ba4
call fcn.10005270
movzx edx, al
test edx, edx
jne 0x1004311a
push 0x10075ba4
mov ecx, dword [ebp + 8]
call fcn.1000f400
mov eax, dword [ebp - 0x434]
or eax, 1
mov dword [ebp - 0x434], eax
mov eax, dword [ebp + 8]
jmp 0x100432a1
lea ecx, [ebp - 0x14]
push ecx
call fcn.10047300
add esp, 4
mov dword [ebp - 4], 0
push str.translations.ini
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
push eax
call fcn.100051c0
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.1000d230
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100431fb
xor ecx, ecx
mov word [ebp - 0x224], cx
push 0x206
push 0
lea edx, [ebp - 0x222]
push edx
call fcn.1002c440
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.1000d230
push eax
push 0x104
lea eax, [ebp - 0x224]
push eax
push 0
push str.Path
push 0x1005eacc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movzx ecx, word [ebp - 0x224]
test ecx, ecx
je 0x100431fb
xor edx, edx
mov word [ebp - 0x42c], dx
push 0x206
push 0
lea eax, [ebp - 0x42a]
push eax
call fcn.1002c440
add esp, 0xc
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x14]
call fcn.1000d230
push eax
lea edx, [ebp - 0x42c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x42c]
push eax
mov ecx, 0x10075ba4
call fcn.1000fce0
mov ecx, 0x10075ba4
call fcn.10005270
movzx ecx, al
test ecx, ecx
je 0x1004325a
push str.translations_
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x430]
push eax
call fcn.100051c0
add esp, 0xc
mov dword [ebp - 0x438], eax
mov ecx, dword [ebp - 0x438]
mov dword [ebp - 0x43c], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x43c]
push edx
mov ecx, 0x10075ba4
call fcn.1000f560
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x430]
call fcn.1000fd80
push 0x10075ba4
call fcn.10045830
add esp, 4
push 0x10075ba4
mov ecx, dword [ebp + 8]
call fcn.1000f400
mov eax, dword [ebp - 0x434]
or eax, 1
mov dword [ebp - 0x434], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.1000fd80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1000fd80
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1002ac1f
mov esp, ebp
pop ebp
ret
Function at 0x100432c0
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005673e
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x1006dd60]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x228], 0
mov eax, dword [0x10075bb0]
and eax, 1
jne 0x10043325
mov ecx, dword [0x10075bb0]
or ecx, 1
mov dword [0x10075bb0], ecx
mov ecx, 0x10075bac
call fcn.1000fea0
push 0x100585e0
call fcn.1002cbcd
add esp, 4
mov ecx, 0x10075bac
call fcn.10005270
movzx edx, al
test edx, edx
jne 0x1004335a
push 0x10075bac
mov ecx, dword [ebp + 8]
call fcn.1000f400
mov eax, dword [ebp - 0x228]
or eax, 1
mov dword [ebp - 0x228], eax
mov eax, dword [ebp + 8]
jmp 0x100434b8
lea ecx, [ebp - 0x220]
push ecx
call fcn.10047300
add esp, 4
mov dword [ebp - 0x22c], eax
mov edx, dword [ebp - 0x22c]
mov dword [ebp - 0x230], edx
mov dword [ebp - 4], 0
push 0x1005e9b0
mov eax, dword [ebp - 0x230]
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.100051c0
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x220]
call fcn.1000fd80
lea ecx, [ebp - 0x10]
call fcn.1000d230
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1004341e
xor edx, edx
mov word [ebp - 0x21c], dx
push 0x206
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.1002c440
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.1000d230
push eax
push 0x104
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 0x1005e9d4
push 0x1005e9ec
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movzx edx, word [ebp - 0x21c]
test edx, edx
je 0x1004341e
lea eax, [ebp - 0x21c]
push eax
mov ecx, 0x10075bac
call fcn.1000fce0
mov ecx, 0x10075bac
call fcn.10005270
movzx ecx, al
test ecx, ecx
je 0x1004348a
call fcn.1004dc20
mov dword [ebp - 0x234], eax
lea edx, [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x234]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x234]
mov eax, dword [edx + 0x10]
call eax
mov dword [ebp - 0x238], eax
mov ecx, dword [ebp - 0x238]
mov dword [ebp - 0x23c], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x23c]
push edx
mov ecx, 0x10075bac
call fcn.1000f560
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x224]
call fcn.1000fd80
push 0x10075bac
mov ecx, dword [ebp + 8]
call fcn.1000f400
mov eax, dword [ebp - 0x228]
or eax, 1
mov dword [ebp - 0x228], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.1000fd80
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1002ac1f
mov esp, ebp
pop ebp
ret
Function at 0x10043600
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10056b70
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1006dd60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.100434e0
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x1004365a
mov ecx, dword [ebp + 8]
call fcn.1000fea0
mov ecx, dword [ebp - 0x24]
or ecx, 1
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp + 8]
jmp 0x10043751
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.10043080
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
push ecx
call fcn.10046b30
add esp, 8
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x20]
push edx
call fcn.10005110
add esp, 0xc
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 2
push 0x1005eaf8
mov ecx, dword [ebp - 0x34]
push ecx
lea edx, [ebp - 0x14]
push edx
call fcn.100051c0
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x20]
call fcn.1000fd80
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1c]
call fcn.1000fd80
lea ecx, [ebp - 0x14]
call fcn.1000d230
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1004371e
mov ecx, dword [ebp + 8]
call fcn.1000fea0
mov eax, dword [ebp - 0x24]
or eax, 1
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.1000fd80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.1000fd80
mov eax, dword [ebp + 8]
jmp 0x10043751
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 8]
call fcn.1000f400
mov edx, dword [ebp - 0x24]
or edx, 1
mov dword [ebp - 0x24], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.1000fd80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.1000fd80
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x10043860
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
neg eax
sbb eax, eax
add eax, 1
pop ebp
ret
Function at 0x10043880
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100438d2
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp - 4], 0
je 0x1004390b
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
push 4
lea ecx, [ebp - 0xc]
push ecx
push 4
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x10043901
mov dword [ebp - 8], 1
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x10043920
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10043972
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp - 4], 0
je 0x100439b4
mov eax, dword [ebp + 0x14]
push eax
call fcn.1002ac2e
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 1
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x100439aa
mov dword [ebp - 8], 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x100439c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10043a3f
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10043a35
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x14]
mov dword [edx], eax
mov dword [ebp - 8], 1
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x10043a50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10043ab9
mov dword [ebp - 0xc], 1
lea eax, [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10043aaf
mov dword [ebp - 8], 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x10043ac0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret

Function at 0x10043d80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100557b0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1006dd60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
cmp dword [ebp + 0x10], 0
je 0x10043dd0
mov dword [ebp - 0x24], 0x1005ec04
jmp 0x10043dd7
mov dword [ebp - 0x24], 0x1005ec0c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x18]
push eax
call fcn.1002c77c
add esp, 0xc
test eax, eax
jne 0x10043e65
cmp dword [ebp + 0x14], 0
je 0x10043e1b
mov byte [ebp - 0x20], 0xef
mov byte [ebp - 0x1f], 0xbb
mov byte [ebp - 0x1e], 0xbf
mov ecx, dword [ebp - 0x18]
push ecx
push 1
push 3
lea edx, [ebp - 0x20]
push edx
call fcn.1002c931
add esp, 0x10
cmp dword [ebp + 0x10], 0
je 0x10043e42
mov eax, dword [ebp - 0x18]
push eax
push 1
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1002c3b0
add esp, 4
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.1002c931
add esp, 0x10
jmp 0x10043e52
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.100309ff
add esp, 8
mov edx, dword [ebp - 0x18]
push edx
call fcn.1002ca2a
add esp, 4
mov dword [ebp - 0x14], 1
jmp 0x10043e74
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10043ee0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10043ef5
xor eax, eax
jmp 0x10043f0d
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0x10
je 0x10043f08
xor eax, eax
jmp 0x10043f0d
mov eax, 1
pop ebp
ret

Function at 0x10044f60
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x1006dd60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10044f85
xor eax, eax
jmp 0x10044fba
mov ecx, dword [ebp + 8]
push ecx
call fcn.10043ee0
add esp, 4
test eax, eax
jne 0x10044f99
xor eax, eax
jmp 0x10044fba
lea edx, [ebp - 0x258]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10043e90
add esp, 8
test eax, eax
jne 0x10044fb4
xor eax, eax
jmp 0x10044fba
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002ac1f
mov esp, ebp
pop ebp
ret

Function at 0x100450d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
push eax
call fcn.10044f60
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
ja 0x100450f5
mov eax, 1
jmp 0x100451f8
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0
push 0x1005ebf4
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 8]
push edx
call fcn.1002c77c
add esp, 0xc
test eax, eax
jne 0x100451f5
cmp dword [ebp - 8], 0
je 0x100451f5
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x13], 0
mov byte [ebp - 0x12], 0
mov eax, dword [ebp - 8]
push eax
push 1
push 3
lea ecx, [ebp - 0x14]
push ecx
call fcn.1002e17e
add esp, 0x10
lea edx, [ebp - 0x14]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0xc], 2
jb 0x1004517b
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax]
cmp ecx, 0xff
jne 0x1004517b
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 1]
cmp eax, 0xfe
jne 0x1004517b
mov dword [ebp - 0x1c], 1
jmp 0x10045182
mov dword [ebp - 0x1c], 0
mov cl, byte [ebp - 0x1c]
mov byte [ebp - 0x16], cl
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx]
cmp eax, 0xef
jne 0x100451bc
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 1]
cmp edx, 0xbb
jne 0x100451bc
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 2]
cmp ecx, 0xbf
jne 0x100451bc
mov dword [ebp - 0x20], 1
jmp 0x100451c3
mov dword [ebp - 0x20], 0
mov dl, byte [ebp - 0x20]
mov byte [ebp - 0x15], dl
movzx eax, byte [ebp - 0x15]
test eax, eax
je 0x100451da
mov dword [ebp - 4], 2
jmp 0x100451e9
movzx ecx, byte [ebp - 0x16]
test ecx, ecx
je 0x100451e9
mov dword [ebp - 4], 3
mov edx, dword [ebp - 8]
push edx
call fcn.1002ca2a
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10045de0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10055f86
mov eax, dword fs:[0]
push eax
sub esp, 0x82c
mov eax, dword [0x1006dd60]
xor eax, ebp
mov dword [ebp - 0x30], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x838]
call fcn.1000fd00
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x838]
push ecx
call fcn.10045830
add esp, 4
push 0x1005efb0
lea ecx, [ebp - 0x838]
call fcn.10004be0
push 0x400
push 0
lea edx, [ebp - 0x834]
push edx
call fcn.1002c440
add esp, 0xc
lea ecx, [ebp - 0x838]
call fcn.1000d230
push eax
push 0x400
lea eax, [ebp - 0x834]
push eax
call fcn.1002c5f6
add esp, 0xc
lea ecx, [ebp - 0x838]
call fcn.1000f890
xor ecx, ecx
mov word [ebp + eax*2 - 0x832], cx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 3
lea edx, [ebp - 0x834]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], 0
mov eax, 0x14
mov word [ebp - 0x1c], ax
mov dword [ebp - 0x1a], 0
mov dword [ebp - 0x16], 0
mov dword [ebp - 0x12], 0
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x838]
call fcn.1000fd80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x30]
xor ecx, ebp
call fcn.1002ac1f
mov esp, ebp
pop ebp
ret

Function at 0x10045f00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10055fb9
mov eax, dword fs:[0]
push eax
sub esp, 0x810
mov eax, dword [0x1006dd60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x81c], 0
xor eax, eax
mov word [ebp - 0x814], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x812]
push ecx
call fcn.1002c440
add esp, 0xc
lea edx, [ebp - 0x814]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0x818]
call fcn.1000fd00
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x818]
push ecx
call fcn.10045830
add esp, 4
lea edx, [ebp - 0x818]
push edx
mov ecx, dword [ebp + 8]
call fcn.1000f400
mov eax, dword [ebp - 0x81c]
or eax, 1
mov dword [ebp - 0x81c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x818]
call fcn.1000fd80
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002ac1f
mov esp, ebp
pop ebp
ret
Function at 0x10047590
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10056771
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x1006dd60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x224], 0
mov eax, dword [0x10075bb8]
and eax, 1
jne 0x100475f5
mov ecx, dword [0x10075bb8]
or ecx, 1
mov dword [0x10075bb8], ecx
mov ecx, 0x10075bb4
call fcn.1000fea0
push 0x100585d0
call fcn.1002cbcd
add esp, 4
mov ecx, 0x10075bb4
call fcn.10005270
movzx edx, al
test edx, edx
je 0x100476c7
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.1002c440
add esp, 0xc
lea edx, [ebp - 0x21c]
push edx
push 0
push 0
push 0x8005
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x1004767c
movzx eax, word [ebp - 0x21c]
push eax
call fcn.100304c8
add esp, 4
mov word [ebp - 0x21c], ax
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea edx, [ebp - 0x21c]
push edx
mov ecx, 0x10075bb4
call fcn.1000fce0
jmp 0x100476c7
lea eax, [ebp - 0x220]
push eax
call fcn.10047300
add esp, 4
mov dword [ebp - 0x228], eax
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x22c]
push edx
mov ecx, 0x10075bb4
call fcn.1000f560
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.1000fd80
push 0x10075bb4
mov ecx, dword [ebp + 8]
call fcn.1000f400
mov eax, dword [ebp - 0x224]
or eax, 1
mov dword [ebp - 0x224], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002ac1f
mov esp, ebp
pop ebp
ret