joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002d5c0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
test edi, edi
je 0x1002d656
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1002d656
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1002d5fa
and al, 0x10
xor ecx, ecx
cmp al, 0x10
sete cl
pop edi
pop ebx
mov eax, ecx
pop ebp
ret 4
push esi
push edi
call fcn.100b160d
mov esi, eax
push 0x5c
push esi
call fcn.100b155d
add esp, 0xc
test eax, eax
je 0x1002d64a
xor edx, edx
push esi
mov ecx, ebx
mov word [eax], dx
call fcn.1002d5c0
push esi
test eax, eax
jne 0x1002d635
call fcn.100b0326
add esp, 4
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret 4
call fcn.100b0326
add esp, 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1002d62c
pop esi
pop edi
mov eax, 1
pop ebx
pop ebp
ret 4
pop edi
xor eax, eax
pop ebx
pop ebp
ret 4

Function at 0x1002d6a0
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
test edi, edi
jne 0x1002d6d1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x2c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea esi, [eax - 1]
neg esi
sbb esi, esi
inc esi
je 0x1002d72b
lea ecx, [ebp - 0x14]
push ecx
push ebx
shr ebx, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
mov esi, eax
test esi, esi
je 0x1002d72b
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
mov esi, eax
test esi, esi
je 0x1002d72b
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x1c]
push edx
mov eax, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1002ded0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [esi + 0x2c]
mov dword [ebp - 0xc], edi
jmp 0x1002dee3
mov edi, dword [ebp - 0xc]
mov ebx, dword [esi + 0x3c]
sub ebx, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub ebx, eax
lea edx, [edi + ecx - 0x106]
mov dword [ebp - 4], ebx
cmp eax, edx
jb 0x1002df5d
mov eax, dword [esi + 0x38]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call fcn.100b2fc0
mov edx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], edi
sub dword [esi + 0x6c], edi
add esp, 0xc
sub dword [esi + 0x5c], edi
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x1002df31
sub eax, edi
jmp 0x1002df33
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x1002df22
mov ecx, dword [esi + 0x40]
mov edx, edi
lea ecx, [ecx + edi*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x1002df50
sub eax, edi
jmp 0x1002df52
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x1002df41
add ebx, edi
mov dword [ebp - 4], ebx
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x1002e013
mov edx, dword [esi + 0x74]
add edx, dword [esi + 0x6c]
mov eax, dword [edi + 4]
add edx, dword [esi + 0x38]
mov ecx, dword [ebp - 4]
mov ebx, eax
mov dword [ebp - 8], edx
cmp ebx, ecx
jbe 0x1002df83
mov ebx, ecx
test ebx, ebx
je 0x1002dfd7
sub eax, ebx
mov dword [edi + 4], eax
mov eax, dword [edi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x1002dfa4
mov eax, dword [edi]
mov ecx, dword [edi + 0x30]
push ebx
call fcn.1002d740
jmp 0x1002dfbc
cmp eax, 2
jne 0x1002dfc5
mov ecx, dword [edi]
mov eax, dword [edi + 0x30]
test ecx, ecx
jne 0x1002dfb6
xor eax, eax
jmp 0x1002dfc2
push ebx
call fcn.1002d9c0
mov edx, dword [ebp - 8]
add esp, 4
mov dword [edi + 0x30], eax
mov ecx, dword [edi]
push ebx
push ecx
push edx
call fcn.100b2fc0
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
add dword [esi + 0x74], ebx
mov edi, dword [esi + 0x74]
cmp edi, 3
jb 0x1002dfff
mov edx, dword [esi + 0x6c]
add edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x58]
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edi, 0x106
jae 0x1002e013
mov edx, dword [esi]
cmp dword [edx + 4], 0
jne 0x1002dee0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100377b0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test ecx, ecx
jle 0x100377dd
push esi
push edi
jmp 0x100377c0
movzx esi, byte [edx]
movzx esi, byte [esi + 0x100e3dc8]
lea edi, [eax*8]
xor esi, edi
dec ecx
xor eax, esi
inc edx
test ecx, ecx
jg 0x100377c0
pop edi
pop esi
ret

Function at 0x10037840
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [esi*8]
push edi
mov edi, dword [ebp + 8]
cmp eax, 0x400
jbe 0x10037862
mov esi, 0x80
cmp esi, dword [edi]
jne 0x1003786f
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x1010a708]
test eax, eax
je 0x1003787a
call eax
lea ecx, [esi*8]
push ecx
call fcn.10034620
mov esi, eax
mov eax, dword [0x1010a70c]
add esp, 4
mov dword [ebp - 4], esi
test eax, eax
je 0x1003789a
call eax
test esi, esi
je 0x10037866
mov edx, dword [edi + 0xc]
push edx
call fcn.10034920
add esp, 4
push esi
mov dword [edi + 0xc], esi
call dword [0x101058bc]
mov ebx, eax
shr ebx, 3
add esp, 4
lea eax, [ebx*8]
push eax
push 0
push esi
mov dword [ebp + 0xc], ebx
mov dword [edi], ebx
call fcn.100b5b30
mov ecx, dword [edi + 8]
add esp, 0xc
mov dword [edi + 8], 0
test ecx, ecx
je 0x1003797f
mov edx, dword [ecx + 0x10]
mov esi, dword [ecx + 0xc]
xor eax, eax
test edx, edx
jle 0x10037913
movzx edi, byte [esi]
movzx edi, byte [edi + 0x100e3dc8]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc esi
test edx, edx
jg 0x100378f2
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
xor edx, edx
div ebx
mov eax, dword [ebp - 4]
lea eax, [eax + edx*8]
test eax, eax
je 0x1003795b
mov esi, dword [eax]
test esi, esi
je 0x10037931
mov edx, dword [eax + 4]
jmp 0x10037933
xor edx, edx
inc esi
mov dword [eax], esi
mov dword [eax + 4], ecx
test edx, edx
je 0x1003795b
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x10037953
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x10037974
mov dword [edi + 8], ecx
mov dword [edx + 4], ecx
jmp 0x10037974
mov edx, dword [edi + 8]
mov dword [ecx], edx
mov eax, dword [edi + 8]
test eax, eax
je 0x1003796a
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edi + 8], ecx
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x100378e6
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10038e50
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x10104610]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
lea ecx, [ebp - 0x110]
push ecx
push 0x104
push eax
push edx
mov dword [ebp - 0x118], 0x200
call fcn.10038cf0
add esp, 0x10
test eax, eax
jne 0x10038f3d
lea ecx, [ebp - 0x110]
call fcn.10038580
mov esi, eax
test esi, esi
je 0x10038f28
call fcn.10037be0
test eax, eax
mov eax, esi
je 0x10038ee7
cmp word [esi], 0
je 0x10038ecc
cmp word [eax], 0x5c
je 0x10038ec7
add eax, 2
cmp word [eax], 0
jne 0x10038eb6
jmp 0x10038ecc
xor ecx, ecx
mov word [eax], cx
lea edx, [ebp - 0x114]
push edx
mov eax, edx
push eax
lea ecx, [ebp - 0x118]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x10038f19
cmp byte [esi], 0
je 0x10038f00
lea esp, [esp]
cmp byte [eax], 0x5c
je 0x10038efd
inc eax
cmp byte [eax], 0
jne 0x10038ef0
jmp 0x10038f00
mov byte [eax], 0
lea eax, [ebp - 0x114]
push eax
mov ecx, eax
push ecx
lea edx, [ebp - 0x118]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push esi
mov edi, eax
call fcn.100b0326
add esp, 4
test edi, edi
jne 0x10038f3d
mov eax, 0x200
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100afa0c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x118]
pop edi
xor ecx, ebp
pop esi
call fcn.100afa0c
mov esp, ebp
pop ebp
ret
Function at 0x10056dc0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ebx, ebx
jne 0x10056dda
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
mov ecx, 0x44
call fcn.10034ba0
mov edi, eax
test edi, edi
je 0x10056dd1
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebx]
or eax, 2
push eax
push ecx
push esi
call fcn.10056950
mov edx, dword [ebp + 0x10]
add esp, 0xc
mov dword [edi], eax
mov eax, dword [ebx + 8]
push edx
push eax
push esi
call fcn.10056a80
mov ecx, dword [ebp + 0x10]
add esp, 0xc
push 0
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
push ecx
push eax
push esi
call fcn.100565e0
mov edx, dword [ebp + 0x10]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x10]
push edx
push eax
push esi
call fcn.10056950
mov ecx, dword [ebp + 0x10]
add esp, 0x1c
push 0
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x14]
push ecx
push eax
push esi
call fcn.100565e0
mov edx, dword [ebp + 0x10]
mov dword [edi + 0x14], eax
mov eax, dword [ebx + 0x18]
push edx
push eax
push esi
call fcn.10056950
mov edx, dword [ebp + 0x10]
mov dword [edi + 0x18], eax
mov cl, byte [ebx + 4]
add esp, 0x1c
mov byte [edi + 4], cl
mov eax, dword [ebx + 0x1c]
push edx
push eax
push esi
call fcn.10056dc0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
push 0
mov dword [edi + 0x1c], eax
mov eax, dword [ebx + 0x28]
push ecx
push eax
push esi
call fcn.100565e0
mov edx, dword [ebp + 0x10]
push 0
mov dword [edi + 0x28], eax
mov eax, dword [ebx + 0x2c]
push edx
push eax
push esi
call fcn.100565e0
mov dword [edi + 0x2c], eax
add esp, 0x20
xor eax, eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
mov cx, word [ebx + 6]
mov edx, 0xfff7
mov dword [edi + 0x24], eax
and cx, dx
or eax, 0xffffffff
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], eax
mov word [edi + 6], cx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1005df00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, edx
cmp byte [edx], al
je 0x1005df19
inc ecx
cmp byte [ecx], al
jne 0x1005df14
sub ecx, edx
and ecx, 0x3fffffff
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 4]
push esi
xor esi, esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], ecx
test ecx, ecx
jle 0x1005e016
push edi
nop
cmp esi, 2
jge 0x1005df48
xor esi, 1
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1005df99
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
lea edx, [esi + esi*2]
mov edi, dword [eax + edx*8]
mov dl, byte [ecx]
test dl, dl
je 0x1005df7e
movzx eax, byte [edi]
movzx edx, dl
mov dl, byte [edx + 0x100e3dc8]
cmp dl, byte [eax + 0x100e3dc8]
jne 0x1005df7e
mov dl, byte [ecx + 1]
inc ecx
inc edi
test dl, dl
jne 0x1005df61
movzx ecx, byte [ecx]
movzx edx, byte [edi]
movzx edx, byte [edx + 0x100e3dc8]
movzx ecx, byte [ecx + 0x100e3dc8]
sub ecx, edx
mov eax, dword [ebp - 4]
jne 0x1005e005
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
lea edx, [esi + esi*2]
mov esi, dword [ecx + edx*8 + 0x14]
cmp dword [esi + 0x10], 0
je 0x1005dfe5
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, ebx
test ebx, ebx
jle 0x1005dfde
jmp 0x1005dfc0
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x100e3dc8]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x1005dfc0
mov ebx, dword [ebp - 0xc]
xor edx, edx
div dword [esi + 4]
jmp 0x1005dfe7
xor edx, edx
mov eax, dword [ebp + 0xc]
push ebx
push eax
lea eax, [esi + 4]
call fcn.10037990
add esp, 8
test eax, eax
je 0x1005e01c
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
test eax, eax
jne 0x1005e015
mov esi, dword [ebp - 8]
inc esi
mov dword [ebp - 8], esi
cmp esi, dword [ebp - 0x10]
jl 0x1005df40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x1005e005
Function at 0x1005e0d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp byte [eax], 0
mov dword [ebp - 8], esi
mov ecx, eax
je 0x1005e0ed
inc ecx
cmp byte [ecx], 0
jne 0x1005e0e7
sub ecx, eax
and ecx, 0x3fffffff
mov ebx, ecx
mov ecx, dword [edx + 4]
xor eax, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
jle 0x1005e1ff
mov ecx, dword [edx + 8]
mov dword [ebp - 0xc], ecx
push edi
mov ecx, eax
cmp eax, 2
jge 0x1005e11e
xor ecx, 1
lea edx, [ecx + ecx*2]
mov ecx, dword [ebp - 0xc]
mov edi, dword [ecx + edx*8 + 0x14]
lea ecx, [ecx + edx*8]
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x1005e178
mov esi, dword [ecx]
mov cl, byte [edx]
test cl, cl
je 0x1005e160
lea ebx, [ebx]
movzx eax, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x100e3dc8]
cmp cl, byte [eax + 0x100e3dc8]
jne 0x1005e15d
mov cl, byte [edx + 1]
inc edx
inc esi
test cl, cl
jne 0x1005e140
mov eax, dword [ebp - 4]
movzx edx, byte [edx]
movzx ecx, byte [esi]
movzx ecx, byte [ecx + 0x100e3dc8]
movzx edx, byte [edx + 0x100e3dc8]
sub edx, ecx
jne 0x1005e1d9
test edi, edi
je 0x1005e1d2
cmp dword [edi + 0x20], 0
lea esi, [edi + 0x14]
je 0x1005e1b4
mov ecx, dword [ebp + 8]
xor eax, eax
mov edx, ebx
test ebx, ebx
jle 0x1005e1ae
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x100e3dc8]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x1005e190
mov ebx, dword [ebp - 0x10]
xor edx, edx
div dword [esi]
jmp 0x1005e1b6
xor edx, edx
mov eax, dword [ebp + 8]
push ebx
push eax
mov eax, esi
call fcn.10037990
add esp, 8
test eax, eax
je 0x1005e1f0
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x1005e1fc
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ebp - 0x14]
jl 0x1005e114
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov dword [ebp - 8], 0
jmp 0x1005e1d9
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100633a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [eax]
mov cl, byte [edi]
mov dword [ebp - 0x14], edi
mov eax, edi
mov byte [ebp - 1], cl
test cl, cl
je 0x100633c6
lea esp, [esp]
inc eax
cmp byte [eax], 0
jne 0x100633c0
mov ebx, dword [ebp + 8]
mov edx, dword [ebx + 0x190]
sub eax, edi
and eax, 0x3fffffff
add ebx, 0x184
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], edx
jmp 0x100633f6
mov cl, byte [ebp - 1]
mov eax, dword [ebp - 0xc]
mov esi, eax
test eax, eax
jns 0x10063411
mov eax, edi
test cl, cl
je 0x10063408
inc eax
cmp byte [eax], 0
jne 0x10063402
sub eax, edi
and eax, 0x3fffffff
mov esi, eax
cmp dword [ebp - 0x10], 0
je 0x10063448
xor eax, eax
mov edx, esi
mov ecx, edi
test esi, esi
jle 0x10063442
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x100e3dc8]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x10063421
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
xor edx, edx
div dword [ebx]
jmp 0x1006344a
xor edx, edx
push esi
push edi
mov eax, ebx
call fcn.10037990
add esp, 8
test eax, eax
je 0x1006345f
mov eax, dword [eax + 8]
jmp 0x10063461
xor eax, eax
test eax, eax
je 0x10063476
mov ecx, dword [ebp - 8]
movzx ecx, byte [ecx + 0x100e44bc]
lea edx, [ecx + ecx*4]
lea eax, [eax + edx*4 - 0x14]
cmp dword [eax + 0xc], 0
jne 0x10063498
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, 3
jl 0x100633f0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [eax]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov edx, dword [eax + 0xc]
pop edi
pop esi
mov dword [ecx + 0xc], edx
mov dword [ecx + 0x10], 0
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10086470
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100d1928
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x10104610]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov eax, dword [0x10104610]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov edi, 4
call fcn.10086020
mov eax, dword [esp + 0x14]
add esp, 4
cmp dword [esp + 0x24], 8
jae 0x100864cd
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
sete bl
cmp dword [esp + 0x24], 8
jb 0x100864ee
mov ecx, dword [esp + 0x10]
push ecx
call fcn.100afa01
add esp, 4
test bl, bl
je 0x10086545
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.10086020
mov eax, dword [esp + 0x14]
mov esi, 8
add esp, 4
cmp dword [esp + 0x24], esi
jae 0x10086514
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10086528
test al, 0x10
jbe 0x10086528
mov bl, 1
jmp 0x1008652a
xor bl, bl
cmp dword [esp + 0x24], esi
jb 0x1008653d
mov eax, dword [esp + 0x10]
push eax
call fcn.100afa01
add esp, 4
test bl, bl
je 0x1008659e
xor eax, eax
jmp 0x100865a0
xor ebx, ebx
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
lea ecx, [esp + 0x2c]
push ecx
mov ecx, esi
mov dword [esp + 0x5c], ebx
call fcn.10087ee0
add esp, 4
test al, al
je 0x1008658a
lea edx, [esp + 0x2c]
push edx
call fcn.10086470
mov edi, eax
add esp, 4
cmp edi, ebx
jne 0x1008658a
mov ecx, esi
call fcn.10088260
mov edi, eax
cmp dword [esp + 0x40], 0x10
jb 0x1008659e
mov eax, dword [esp + 0x2c]
push eax
call fcn.100afa01
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.100afa0c
mov esp, ebp
pop ebp
ret
Function at 0x10087bd0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cfe26
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x10104610]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edi, edi
xor ecx, ecx
mov dword [ebp - 0x258], eax
xor bl, bl
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], edi
mov word [ebp - 0x234], cx
lea edx, [ebp - 0x254]
push edx
push edi
push edi
push 0x2b
mov dword [ebp - 4], edi
push edi
mov dword [ebp - 0x254], edi
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
cmp eax, edi
lea eax, [ebp - 0x218]
push eax
jl 0x10087c96
mov ecx, dword [ebp - 0x254]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x10087c87
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x10087c64
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
lea esi, [ebp - 0x234]
call fcn.10001b60
mov bl, 1
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x10087cd3
push edi
push edi
push 0x2b
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x10087cd3
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x10087cb0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
lea esi, [ebp - 0x234]
call fcn.10001b60
mov bl, 1
mov eax, dword [ebp - 0x224]
cmp eax, edi
je 0x10087d6d
cmp dword [ebp - 0x220], 8
mov ecx, dword [ebp - 0x234]
jae 0x10087cf6
lea ecx, [ebp - 0x234]
cmp word [ecx + eax*2 - 2], 0x5c
jne 0x10087d1d
lea ecx, [eax - 1]
lea esi, [ebp - 0x234]
cmp ecx, eax
ja 0x10087d15
or eax, 0xffffffff
call fcn.10001c50
jmp 0x10087d1d
sub ecx, eax
push ecx
call fcn.10088820
lea ecx, [ebp - 0x250]
push ecx
lea ecx, [ebp - 0x234]
call fcn.10085f30
add esp, 4
mov esi, dword [ebp - 0x258]
mov edi, eax
mov byte [ebp - 4], 1
call fcn.10005050
mov byte [ebp - 4], 0
cmp dword [ebp - 0x23c], 0x10
jb 0x10087d5f
mov edx, dword [ebp - 0x250]
push edx
call fcn.100afa01
add esp, 4
push 6
push str.Adobe
mov eax, esi
call fcn.10018590
cmp dword [ebp - 0x220], 8
jb 0x10087d85
mov eax, dword [ebp - 0x234]
push eax
call fcn.100afa01
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100afa0c
mov esp, ebp
pop ebp
ret
Function at 0x10087db0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10104610]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x20]
push edi
push eax
mov ecx, esi
call fcn.10086020
mov eax, dword [ebp - 0x20]
mov edi, 8
add esp, 4
cmp dword [ebp - 0xc], edi
jae 0x10087de0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
sete bl
cmp dword [ebp - 0xc], edi
jb 0x10087dfe
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.100afa01
add esp, 4
test bl, bl
je 0x10087e5b
lea edx, [ebp - 0x20]
push edx
mov ecx, esi
call fcn.10086020
mov eax, dword [ebp - 0x20]
add esp, 4
cmp dword [ebp - 0xc], edi
jae 0x10087e1b
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10087e2f
test al, 0x10
jbe 0x10087e2f
mov bl, 1
jmp 0x10087e31
xor bl, bl
cmp dword [ebp - 0xc], edi
jb 0x10087e42
mov eax, dword [ebp - 0x20]
push eax
call fcn.100afa01
add esp, 4
test bl, bl
jne 0x10087e5b
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100afa0c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.100afa0c
mov esp, ebp
pop ebp
ret

Function at 0x10087e70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10104610]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.10086020
mov eax, dword [ebp - 0x20]
add esp, 4
cmp dword [ebp - 0xc], 8
jae 0x10087e99
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10087ead
test al, 0x10
jbe 0x10087ead
mov bl, 1
jmp 0x10087eaf
xor bl, bl
cmp dword [ebp - 0xc], 8
jb 0x10087ec1
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.100afa01
add esp, 4
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.100afa0c
mov esp, ebp
pop ebp
ret
Function at 0x10088260
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d18f8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x10104610]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x48]
push eax
mov esi, ecx
mov edi, 4
call fcn.10086020
add esp, 4
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.10086020
mov eax, dword [ebp - 0x2c]
mov esi, 8
add esp, 4
cmp dword [ebp - 0x18], esi
jae 0x100882c3
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
sete bl
cmp dword [ebp - 0x18], esi
jb 0x100882e1
mov edx, dword [ebp - 0x2c]
push edx
call fcn.100afa01
add esp, 4
test bl, bl
jne 0x10088301
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x34], esi
jae 0x100882f0
lea eax, [ebp - 0x48]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
jne 0x10088301
xor edi, edi
cmp dword [ebp - 0x34], esi
jb 0x10088312
mov eax, dword [ebp - 0x48]
push eax
call fcn.100afa01
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100afa0c
mov esp, ebp
pop ebp
ret