joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10201cc
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x1077400]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, dword [0x1077004]
mov esi, 0x1077004
cmp eax, esi
je 0x102020f
test byte [eax + 0x1c], 2
je 0x102020f
cmp byte [eax + 0x19], 5
jb 0x102020f
push 0x1005730
push 0x30
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015bb9
xor eax, eax
xor ebx, ebx
push 0x7e
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x82]
push ebx
push eax
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x88], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x88]
push eax
push 0x20019
push ebx
push 0x100fde0
push 0x80000002
mov dword [ebp - 0x90], 0x7e
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x102029d
mov eax, dword [0x1077004]
cmp eax, esi
je 0x1020296
test byte [eax + 0x1c], 2
je 0x1020296
cmp byte [eax + 0x19], 2
jb 0x1020296
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x1077004]
push 0x1005730
push 0x31
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101e0d7
xor eax, eax
jmp 0x1020334
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x94]
push eax
push ebx
push ebx
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10202f9
mov eax, dword [0x1077004]
cmp eax, esi
je 0x1020322
test byte [eax + 0x1c], 2
je 0x1020322
cmp byte [eax + 0x19], 2
jb 0x1020322
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x1077004]
push 0x1005730
push 0x32
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101e0d7
jmp 0x1020322
xor esi, esi
inc esi
cmp dword [ebp - 0x94], esi
jne 0x1020322
lea eax, [ebp - 0x84]
push 0x1005958
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1020322
mov dword [ebp - 0x8c], esi
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0101d9bb
leave
ret
Function at 0x1020b70
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
mov eax, dword [0x1077004]
mov esi, 0x1077004
mov edi, 0x1005b34
cmp eax, esi
je 0x1020ba8
test byte [eax + 0x1c], 2
je 0x1020ba8
cmp byte [eax + 0x19], 5
jb 0x1020ba8
push edi
push 0x29
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015bb9
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jae 0x1020bba
push 0x78
pop eax
jmp 0x1020c78
push 0x1005b94
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x1020c06
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [0x1077004]
cmp eax, esi
je 0x1020c76
test byte [eax + 0x1c], 2
je 0x1020c76
cmp byte [eax + 0x19], 2
jb 0x1020c76
push ebx
push edi
push 0x2a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101e0d7
jmp 0x1020c76
push 0x1005bac
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1020c39
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [0x1077004]
cmp eax, esi
je 0x1020c6d
test byte [eax + 0x1c], 2
je 0x1020c6d
cmp byte [eax + 0x19], 2
jb 0x1020c6d
push ebx
push edi
push 0x2b
jmp 0x1020c62
push 1
call eax
test eax, eax
jne 0x1020c6d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [0x1077004]
cmp eax, esi
je 0x1020c6d
test byte [eax + 0x1c], 2
je 0x1020c6d
cmp byte [eax + 0x19], 2
jb 0x1020c6d
push ebx
push edi
push 0x2c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101e0d7
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1021051
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1077400]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebp - 0x2c], eax
xor esi, esi
mov eax, dword [0x1077004]
cmp eax, 0x1077004
je 0x102109d
test byte [eax + 0x1c], 2
je 0x102109d
cmp byte [eax + 0x19], 5
jb 0x102109d
push 0x1005bd0
push 0x1e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015bb9
test byte [ebp + 0xc], 0x30
mov ebx, dword [ebp + 8]
jne 0x1021117
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0x10
pop esi
push esi
lea eax, [ebp - 0x24]
push eax
push 0x58
push ebx
call edi
test eax, eax
je 0x1021116
test dword [ebp - 0x16], 0x800
je 0x1021116
push 2
lea eax, [ebp - 0x28]
push eax
push 0x20001009
push ebx
call edi
test eax, eax
je 0x1021116
mov eax, ebx
and eax, 0x3ff
cmp ax, 0xd
jne 0x10210f2
test byte [ebp + 0xc], 1
je 0x1021113
cmp dword [ebp - 0x28], 8
jmp 0x1021111
mov eax, dword [ebp - 0x28]
cmp eax, 1
je 0x1021113
cmp eax, 6
je 0x1021113
cmp eax, 0x17
je 0x1021113
cmp eax, 0xa
je 0x1021113
cmp eax, 0xb
je 0x1021113
cmp eax, 0xc
jne 0x1021116
push 0x20
pop esi
pop edi
push dword [ebp + 0x18]
or esi, dword [ebp + 0xc]
push dword [ebp - 0x2c]
push 0
push dword [ebp - 0x30]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0101d9bb
leave
ret 0x14
Function at 0x1021142
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1077400]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x28], 0x10
mov eax, dword [0x1077004]
mov edi, 0x1077004
cmp eax, edi
je 0x102118c
test byte [eax + 0x1c], 2
je 0x102118c
cmp byte [eax + 0x19], 5
jb 0x102118c
push 0x1005bd0
push 0x29
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015bb9
test esi, esi
jne 0x1021198
xor eax, eax
inc eax
jmp 0x102123e
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x102119d
sub eax, edx
sar eax, 1
je 0x1021190
mov ecx, esi
mov eax, 0x1005be4
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10211da
test dx, dx
je 0x10211d6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10211da
add eax, 4
add ecx, 4
test dx, dx
jne 0x10211b4
xor eax, eax
jmp 0x10211df
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1021190
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x102122c
mov eax, dword [0x1077004]
cmp eax, edi
je 0x1021228
test byte [eax + 0x1c], 2
je 0x1021228
cmp byte [eax + 0x19], 2
jb 0x1021228
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x1077004]
push 0x1005bd0
push 0x2a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101e0d7
xor eax, eax
jmp 0x102123e
lea eax, [ebp - 0x24]
push esi
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0101d9bb
leave
ret 4
Function at 0x1021611
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
mov eax, dword [0x1077004]
mov edi, 0x1077004
cmp eax, edi
je 0x1021644
test byte [eax + 0x1c], 2
je 0x1021644
cmp byte [eax + 0x19], 5
jb 0x1021644
push 0x1005bd0
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015bb9
push 0x25
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x1021693
push dword [ebp + 8]
call fcn.0102139e
test eax, eax
jne 0x1021773
mov eax, dword [0x1077004]
cmp eax, edi
je 0x102168c
test byte [eax + 0x1c], 2
je 0x102168c
cmp byte [eax + 0x19], 2
jb 0x102168c
push 0x1005bd0
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015bb9
xor eax, eax
jmp 0x1021773
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0
push dword [ebp + 8]
call esi
mov ebx, eax
test ebx, ebx
jne 0x10216ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x1077004]
cmp ecx, edi
je 0x102176f
test byte [ecx + 0x1c], 2
je 0x102176f
cmp byte [ecx + 0x19], 2
jb 0x102176f
push eax
push 0x1005bd0
push 0x19
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0101e0d7
jmp 0x102176f
inc ebx
lea eax, [ebx + ebx]
push eax
call fcn.0101e8e4
mov dword [ebp - 4], eax
test eax, eax
jne 0x1021724
mov eax, dword [0x1077004]
cmp eax, edi
je 0x102176f
test byte [eax + 0x1c], 2
je 0x102176f
cmp byte [eax + 0x19], 2
jb 0x102176f
push 0x1005bd0
push 0x1a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015bb9
jmp 0x102176f
push ebx
push eax
push dword [ebp + 8]
call esi
test eax, eax
je 0x1021738
cmp eax, ebx
ja 0x1021738
mov eax, dword [ebp - 4]
jmp 0x1021771
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x1077004]
cmp ecx, edi
je 0x1021767
test byte [ecx + 0x1c], 2
je 0x1021767
cmp byte [ecx + 0x19], 2
jb 0x1021767
push eax
push 0x1005bd0
push 0x1b
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0101e0d7
push dword [ebp - 4]
call fcn.0101e9ef
xor eax, eax
pop esi
pop ebx
pop edi
leave
ret 4
Function at 0x1021a35
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1077400]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov eax, dword [0x1077004]
mov esi, 0x1077004
mov edi, 0x1005c04
cmp eax, esi
je 0x1021a79
test byte [eax + 0x1c], 2
je 0x1021a79
cmp byte [eax + 0x19], 5
jb 0x1021a79
push edi
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015bb9
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1021add
mov eax, dword [0x1077004]
cmp eax, esi
je 0x1021ad9
test byte [eax + 0x1c], 2
je 0x1021ad9
cmp byte [eax + 0x19], 2
jb 0x1021ad9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x1077004]
push edi
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101e0d7
xor eax, eax
jmp 0x1021ae7
cmp dword [ebp - 0x114], 6
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0101d9bb
leave
ret

Function at 0x1021b46
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x1005c2c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1021b71
xor eax, eax
leave
ret
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x1005c14
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1021b9e
cmp dword [ebp - 0x10], 4
je 0x1021ba2
and dword [ebp - 8], 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret

Function at 0x1021bf1
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x1077400]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x802]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [0x1078f1c], 0
jne 0x1021c41
call fcn.01021b46
mov dword [0x1077424], eax
and al, 0x74
pop es
add edi, eax
add eax, 0x1078f1c
add dword [eax], eax
add byte [eax], al

Function at 0x1021d22
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x1077400]
xor eax, ebp
mov dword [ebp - 4], eax
Function at 0x1021e93
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1077400]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push edi
mov edi, dword [ebp + 0xc]
jne 0x1021eb6
xor eax, eax
jmp 0x1021f11
push 0x40
call fcn.0101e78c
test eax, eax
je 0x1021eb2
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x210]
push eax
push 0x1005d3c
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x1021ef9
cmp eax, esi
ja 0x1021ef9
push dword [ebp + 8]
lea eax, [ebp - 0x210]
push 8
push eax
push edi
call dword [sym.imp.USER32.dll_WinHelpW]
xor eax, eax
jmp 0x1021f10
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push 0x1005cf0
call fcn.01021bf1
pop ecx
pop ecx
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0101d9bb
leave
ret 8

Function at 0x1021f25
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1077400]
xor eax, ebp
mov dword [ebp - 4], eax
cld

Function at 0x1022068
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1077400]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x210], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, dword [0x1077004]
mov esi, 0x1077004
mov ebx, 0x1005c68
cmp eax, esi
je 0x10220d5
test byte [eax + 0x1c], 2
je 0x10220d5
cmp byte [eax + 0x19], 5
jb 0x10220d5
push ebx
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015bb9
lea eax, [ebp - 0x20c]
push eax
xor eax, eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x214], eax
test eax, eax
jge 0x1022126
mov eax, dword [0x1077004]
cmp eax, esi
je 0x102211d
test byte [eax + 0x1c], 2
je 0x102211d
cmp byte [eax + 0x19], 2
jb 0x102211d
push dword [ebp - 0x214]
push ebx
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101e0d7
movzx eax, word [ebp - 0x214]
jmp 0x1022166
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x10]
push edi
call fcn.0101f089
mov edi, eax
test edi, edi
jge 0x102216f
mov eax, dword [0x1077004]
cmp eax, esi
je 0x1022163
test byte [eax + 0x1c], 2
je 0x1022163
cmp byte [eax + 0x19], 2
jb 0x1022163
movzx ecx, di
push ecx
push ebx
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101e0d7
movzx eax, di
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1022179
mov dword [ebp - 0x210], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0101d9bb
leave
ret 0xc
Function at 0x1022195
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x1077400]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov esi, 0x208
push esi
mov word [ebp - 0x41c], ax
xor ebx, ebx
lea eax, [ebp - 0x41a]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x206
mov word [ebp - 0x624], ax
lea eax, [ebp - 0x622]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x24
xor eax, eax
mov dword [ebp - 0x630], 0x20a
cmp edi, ebx
je 0x10223a1
push 1
push 1
push 0x10054a8
push 0x80000001
mov word [edi], ax
call fcn.0101fb88
mov esi, eax
cmp esi, ebx
je 0x102239f
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x62c]
push eax
push ebx
push 0x1005cd4
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x1005274
test ebx, ebx
je 0x1022280
cmp ebx, 2
jne 0x102239f
mov dword [ebp - 0x628], 0x1005e1c
jmp 0x10222df
cmp dword [ebp - 0x62c], 1
je 0x1022296
cmp dword [ebp - 0x62c], 2
jne 0x102239f
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x628], ecx
lea ecx, [eax - 1]
cmp ecx, 0x103
ja 0x10222df
cmp word [ebp + eax*2 - 0x212], 0x5c
je 0x10222df
push esi
push 0x105
lea eax, [ebp - 0x210]
push eax
call fcn.0101e5fc
test eax, eax
jl 0x1022395
push 0x105
lea eax, [ebp - 0x41c]
push eax
push 5
call fcn.01022068
test eax, eax
jne 0x102230e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1005de0
call fcn.01021bf1
pop ecx
pop ecx
jmp 0x102239f
lea eax, [ebp - 0x41c]
push eax
push dword [ebp + 0xc]
push edi
call fcn.0101f089
xor ebx, ebx
cmp eax, ebx
jl 0x1022395
mov eax, dword [ebp - 0x628]
cmp word [eax], 0x5c
je 0x102233e
push esi
push dword [ebp + 0xc]
push edi
call fcn.0101e5fc
cmp eax, ebx
jl 0x1022395
push dword [ebp - 0x628]
push dword [ebp + 0xc]
push edi
call fcn.0101e5fc
cmp eax, ebx
jl 0x1022395
lea eax, [ebp - 0x624]
push eax
push 0x1005dac
push ebx
push ebx
push 0x8005
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathAndSubDirW]
cmp eax, ebx
jl 0x1022395
push 0x93d
push 0x1005d68
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.SHELL32.dll_SHSetLocalizedName]
cmp eax, ebx
jl 0x1022395
push edi
call fcn.0102177d
xor eax, eax
inc eax
jmp 0x10223a1
movzx eax, ax
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0101d9bb
leave
ret 8
Function at 0x102308d
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
and dword [ebp - 8], 0
mov eax, dword [0x1077004]
cmp eax, 0x1077004
je 0x10230c6
test byte [eax + 0x1c], 2
je 0x10230c6
cmp byte [eax + 0x19], 5
jb 0x10230c6
push 0x1005ebc
push 0x25
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015bb9
push esi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov esi, eax
test esi, esi
jl 0x1023115
lea eax, [ebp - 4]
push eax
push 4
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov esi, eax
test esi, esi
jl 0x102310c
push 0
push dword [ebp - 4]
push 0x3000
push 0x2000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov eax, dword [ebp - 8]
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
pop esi
leave
ret

Function at 0x102545e
Capabilities:
Delete file

Disassembly:
push 0x18
mov eax, 0x106a407
call fcn.0101d9d0
mov edi, ecx
mov eax, dword [0x1077004]
cmp eax, 0x1077004
je 0x1025499
test dword [eax + 0x1c], 0x100
je 0x1025499
cmp byte [eax + 0x19], 4
jb 0x1025499
push 0x1006220
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015bb9
xor esi, esi
mov dword [ebp - 0x18], esi
cmp dword [edi + 0x730], esi
je 0x10255bf
cmp dword [edi + 0x734], esi
je 0x10255bf
push esi
push 0x10776c4
mov ebx, 0x10770dc
push ebx
push esi
lea eax, [ebp - 0x24]
push eax
push esi
lea ecx, [edi + 0x1b4]
push esi
call fcn.010148a0
push eax
call sub.msvcrt.dll___RTDynamicCast
mov ecx, eax
add esp, 0x14
mov dword [ebp - 0x20], ecx
cmp ecx, esi
je 0x10255ba
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], esi
call fcn.01030631
push esi
push 0x107736c
push ebx
push esi
push dword [edi + 0x4ac]
lea ecx, [edi + 0x1b4]
call fcn.01014869
push eax
call sub.msvcrt.dll___RTDynamicCast
add esp, 0x14
mov dword [ebp - 0x1c], eax
cmp eax, esi
je 0x10255ba
lea ebx, [edi + 0x76c]
push ebx
lea ecx, [ebp - 0x14]
call fcn.0101d2ce
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], esi
cmp ecx, esi
je 0x1025544
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
jmp 0x1025550
push 0x10027e4
mov ecx, ebx
call fcn.0101cb36
mov ebx, dword [ebx]
push esi
push esi
push ebx
mov ebx, dword [ebp - 0x1c]
mov ecx, ebx
call fcn.0105422b
push 0x10027e4
lea ecx, [ebp - 0x14]
call fcn.01024d42
test eax, eax
je 0x1025579
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, edi
call fcn.01017adb
xor edi, edi
inc edi
push edi
push esi
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [ebp - 0x10]
cmp ecx, esi
je 0x10255ab
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0xac]
push esi
push eax
push esi
push 0x4000
call fcn.0103ddc7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], edi
call sub.MFC42u.dll_CString::CString
mov eax, dword [ebp - 0x18]
jmp 0x10255c2
xor eax, eax
inc eax
call fcn.0101dabc
ret
Function at 0x102aa9d
Capabilities:
Get common file path

Disassembly:
push 0xa1c
mov eax, 0x106a8ee
call fcn.0101da7e
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0xa24], eax
mov eax, dword [0x1077004]
mov esi, 0x1077004
cmp eax, esi
je 0x102aae7
test dword [eax + 0x1c], 0x100
je 0x102aae7
cmp byte [eax + 0x19], 4
jb 0x102aae7
push 0x1007300
push 0x1b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015bb9
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x102ab3c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x1077004]
cmp eax, esi
je 0x102ab35
test dword [eax + 0x1c], 0x100
je 0x102ab35
cmp byte [eax + 0x19], 2
jb 0x102ab35
push edi
push 0x100746c
push 0x1007300
push 0x1c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101ea0b
mov eax, edi
jmp 0x102ac6f
mov esi, dword [sym.imp.msvcrt.dll_rand]
call esi
mov edi, eax
call esi
imul edi, eax
call esi
mov esi, eax
imul esi, edi
lea edi, [esi + 1]
cmp edi, esi
je 0x102ac6c
push dword [ebp - 0xa24]
and dword [ebp - 4], 0
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x100564c
lea eax, [ebp - 0x21c]
push eax
push 0x100744c
push ebx
call sub.MFC42u.dll_CString::Format
mov eax, dword [ebx]
or dword [ebp - 4], 0xffffffff
add esp, 0x1c
push 0
push 0x180
push 1
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x102ac01
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xa20], eax
cmp eax, 0x50
jne 0x102abc1
inc edi
jmp 0x102ab55
mov eax, dword [0x1077004]
cmp eax, 0x1077004
je 0x102abf9
test dword [eax + 0x1c], 0x100
je 0x102abf9
cmp byte [eax + 0x19], 2
jb 0x102abf9
push dword [ebp - 0xa20]
push 0x1007434
push 0x1007300
push 0x1e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101ea0b
mov eax, dword [ebp - 0xa20]
jmp 0x102ac6f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x102ac6f
push 0x1f
pop eax
call fcn.0101dae9
ret 8
Function at 0x102ac7c
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1077004]
mov esi, 0x1077004
mov edi, 0x1007300
mov ebx, 0x100
cmp eax, esi
je 0x102acb7
test dword [eax + 0x1c], ebx
je 0x102acb7
cmp byte [eax + 0x19], 4
jb 0x102acb7
push edi
push 0x1f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015bb9
push dword [ebp + 0x18]
push 0x1005610
call fcn.0102aa9d
mov dword [ebp - 4], eax
test eax, eax
je 0x102ad06
mov eax, dword [0x1077004]
cmp eax, esi
je 0x102ada4
test dword [eax + 0x1c], ebx
je 0x102ada4
cmp byte [eax + 0x19], 2
jb 0x102ada4
push dword [ebp - 4]
push 0x10074ec
push edi
push 0x20
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101ea0b
jmp 0x102ada4
mov ecx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
call fcn.0103c068
mov dword [ebp - 4], eax
test eax, eax
je 0x102ad3a
mov eax, dword [0x1077004]
cmp eax, esi
je 0x102ad93
test dword [eax + 0x1c], ebx
je 0x102ad93
cmp byte [eax + 0x19], 2
jb 0x102ad93
push dword [ebp - 4]
push 0x10074a8
push edi
push 0x21
jmp 0x102ad88
mov eax, dword [ebp + 0x18]
push dword [eax]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.FXSAPI.dll_FaxGetMessageTiffW]
test eax, eax
jne 0x102ada4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
push 1
push eax
mov dword [ebp - 4], eax
call fcn.01038f31
mov eax, dword [0x1077004]
cmp eax, esi
je 0x102ad93
test dword [eax + 0x1c], ebx
je 0x102ad93
cmp byte [eax + 0x19], 2
jb 0x102ad93
push dword [ebp - 4]
push 0x1007484
push edi
push 0x22
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101ea0b
cmp dword [ebp - 4], 0
je 0x102ada4
mov eax, dword [ebp + 0x18]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x14