joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000cf00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x10053060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
cmp edi, ebx
je 0x1000cffa
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jge 0x1000cffa
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.1002d190
add esp, 0xc
lea esi, [ebp - 0x210]
mov ecx, edi
call fcn.1000d77b
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1000cf77
shr eax, 4
not eax
and eax, 1
jmp 0x1000cffc
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea esi, [ebp - 0x418]
call fcn.1000d00a
test eax, eax
je 0x1000cffa
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x10000000
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x420], eax
cmp eax, ebx
je 0x1000cfdc
mov dword [ebp - 0x41c], 1
cmp eax, 0xffffffff
jne 0x1000cfe2
mov dword [ebp - 0x41c], ebx
lea eax, [ebp - 0x420]
call fcn.10004037
xor eax, eax
cmp byte [ebp - 0x41c], bl
setne al
jmp 0x1000cffc
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ada2
leave
ret
Function at 0x1000d3d6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10053060]
xor eax, ebp
mov dword [ebp - 4], eax
test esi, esi
je 0x1000d43c
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.1002d190
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1000d43c
push esi
push 0
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jbe 0x1000d43c
xor eax, eax
inc eax
jmp 0x1000d43e
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002ada2
leave
ret

Function at 0x1000d44a
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1000d461
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
ret
test al, 1
je 0x1000d470
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
ret

Function at 0x1000d5a8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, 0x179b06cc
xor ecx, ecx
push esi
mov edx, dword [esp + 8]
movzx edx, byte [ecx + edx]
movzx esi, al
xor edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x10055078]
inc ecx
cmp ecx, 0x24
jl 0x1000d5b0
not eax
pop esi
ret 4

Function at 0x1000d7de
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x10053060]
xor eax, ebp
mov dword [ebp - 4], eax
movsx eax, byte [ebp + 8]
push ebx
push esi
push eax
push str.__c:
lea esi, [ebp - 0x5c]
call fcn.1000e522
cmp dword [eax + 0x18], 0x10
pop ecx
pop ecx
jb 0x1000d80f
mov eax, dword [eax + 4]
jmp 0x1000d812
add eax, 4
xor esi, esi
push esi
push esi
push 3
push esi
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
mov ebx, eax
push 1
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x3c], ebx
call fcn.100026d5
cmp ebx, esi
je 0x1000d840
cmp ebx, 0xffffffff
jne 0x1000d859
lea eax, [ebp - 0x3c]
call fcn.10004037
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ada2
leave
ret
push edi
push 0x28
pop edx
push 9
pop ecx
xor eax, eax
push esi
mov dword [ebp - 0x38], edx
lea edi, [ebp - 0x34]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
lea edi, [ebp - 8]
stosd dword es:[edi], eax
lea eax, [ebp - 0x40]
push eax
push edx
lea eax, [ebp - 0x38]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x2d1400
push ebx
mov dword [ebp - 0x40], esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
pop edi
test eax, eax
jne 0x1000d8a7
or esi, 0xffffffff
lea eax, [ebp - 0x3c]
call fcn.10004037
mov eax, esi
jmp 0x1000d84b
mov esi, dword [ebp - 0x1c]
jmp 0x1000d89b
Function at 0x1000db02
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x434
mov eax, dword [0x10053060]
xor eax, esp
mov dword [esp + 0x430], eax
mov eax, fcn.1000de80
push esi
test eax, eax
je 0x1000db8f
push 0x424
lea eax, [esp + 0x10]
push 0
push eax
call fcn.1002d190
add esp, 0xc
push dword [ebp + 8]
mov dword [esp + 0xc], 0x428
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 4], esi
test esi, esi
je 0x1000db86
cmp esi, 0xffffffff
je 0x1000db86
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Module32FirstW
jmp 0x1000db82
push edi
lea eax, [esp + 0xc]
push eax
call fcn.1000de80
test eax, eax
je 0x1000db86
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x1000db68
lea eax, [esp + 4]
call fcn.10004037
mov ecx, dword [esp + 0x434]
pop esi
xor ecx, esp
call fcn.1002ada2
mov esp, ebp
pop ebp
ret 4

Function at 0x1000dba4
Capabilities:
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0x1b4]
sub esp, 0x234
mov eax, dword [0x10053060]
xor eax, ebp
mov dword [ebp + 0x1b0], eax
mov eax, fcn.1000de2e
test eax, eax
je 0x1000dc2b
push esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x80], esi
test esi, esi
je 0x1000dc22
cmp esi, 0xffffffff
je 0x1000dc22
push 0x228
lea eax, [ebp - 0x78]
push 0
push eax
mov dword [ebp - 0x7c], 0x22c
call fcn.1002d190
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x1000dc1e
push edi
lea eax, [ebp - 0x7c]
push eax
call fcn.1000de2e
test eax, eax
je 0x1000dc22
lea eax, [ebp - 0x7c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1000dc06
lea eax, [ebp - 0x80]
call fcn.10004037
pop esi
mov ecx, dword [ebp + 0x1b0]
xor ecx, ebp
call fcn.1002ada2
add ebp, 0x1b4
leave
ret
Function at 0x1000dd1b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x1000dd2d
xor eax, eax
jmp 0x1000dd4c
push edi
call fcn.1000dc40
lea edi, [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call fcn.1000dba4
cmp dword [ebp - 0x10], esi
jne 0x1000dd51
xor eax, eax
pop edi
pop esi
leave
ret 4
push dword [ebp - 0x14]
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x1000dd6c
cmp eax, 0xffffffff
jne 0x1000dd78
lea eax, [ebp - 0xc]
call fcn.10004037
mov eax, esi
jmp 0x1000dd4b
lea ecx, [ebp - 4]
push ecx
push 0xf01ff
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000dd6c
push ebx
push esi
push dword [ebp - 4]
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], esi
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1000de23
mov edi, dword [ebp + 8]
call fcn.1000cc69
push 0x40
mov dword [ebp + 8], eax
lea eax, [ebp - 0x5c]
push esi
push eax
mov dword [ebp - 0x60], 0x44
call fcn.1002d190
add esp, 0xc
push 5
pop eax
mov word [ebp - 0x30], ax
xor eax, eax
mov dword [ebp - 0x1c], esi
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push esi
push dword [ebp - 8]
mov dword [ebp - 0x34], 1
push 0x420
push esi
push esi
push esi
push dword [ebp + 8]
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x1000de12
push dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
call ebx
push dword [ebp + 8]
call fcn.1000cc96
push dword [ebp - 8]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
push dword [ebp - 4]
call ebx
pop ebx
jmp 0x1000dd6c
Function at 0x1000e6fe
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10041af4
mov eax, dword fs:[0]
push eax
mov eax, 0x2040
call fcn.10036910
mov eax, dword [0x10053060]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
push eax
mov dword [ebp - 0x2028], eax
mov esi, ecx
mov dword [ebp - 0x202c], edi
call fcn.1000eaaf
xor ebx, ebx
push esi
inc ebx
lea esi, [ebp - 0x2024]
mov dword [ebp - 0x202c], ebx
call fcn.1000ca43
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x2020], edi
je 0x1000e813
xor eax, eax
push 0x1ffe
mov word [ebp - 0x2014], ax
lea eax, [ebp - 0x2012]
push edi
push eax
mov dword [ebp - 0x2018], edi
call fcn.1002d190
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
add esp, 0xc
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x201c]
push eax
lea eax, [ebp - 0x2014]
push eax
push edi
jmp 0x1000e7fd
inc dword [ebp - 0x2018]
lea eax, [ebp - 0x2014]
push eax
lea esi, [ebp - 0x2048]
call fcn.10002214
mov eax, esi
mov byte [ebp - 4], 2
push eax
mov eax, dword [ebp - 0x2028]
call fcn.1000ec1e
push edi
push 1
mov byte [ebp - 4], 1
call fcn.100027cd
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x201c]
push eax
lea eax, [ebp - 0x2014]
push eax
push dword [ebp - 0x2018]
push dword [ebp - 0x2020]
mov dword [ebp - 0x201c], 0x1000
call ebx
test eax, eax
je 0x1000e7af
mov dword [ebp - method.RegHandleHolder.virtual_0], vtable.RegHandleHolder.0
cmp dword [ebp - 0x2020], edi
je 0x1000e831
push dword [ebp - 0x2020]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x2028]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1002ada2
leave
ret

Function at 0x1000e851
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push 1
push esi
push esi
push str.Softwareprojonepodlp_volatiledteProcessing_
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp edi, esi
jne 0x1000e8a0
push 8
push dword [ebp + 0xc]
push 0xb
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x1000e8dd
Capabilities:
Check if file exists

Disassembly:
push 0x678
mov eax, 0x10041a94
call fcn.1002bcea
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x680], edi
mov dword [ebp - 0x67c], eax
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
mov dword [ebp - 0x684], esi
mov word [esi + 4], ax
xor ebx, ebx
mov dword [ebp - 4], edi
inc ebx
push edi
mov dword [ebp - 0x680], ebx
mov dword [ebp - 0x674], edi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x674]
push eax
push 0x10047514
push ebx
push edi
push 0x10047524
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1000ea83
mov eax, dword [ebp - 0x674]
lea edx, [ebp - 0x678]
push edx
push 0x10047534
mov dword [ebp - 0x678], edi
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jl 0x1000ea77
mov eax, dword [ebp - 0x678]
mov ecx, dword [eax]
push edi
push dword [ebp - 0x67c]
push eax
call dword [ecx + 0x14]
test eax, eax
jl 0x1000ea6b
xor eax, eax
mov ebx, 0x206
push ebx
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.1002d190
mov eax, dword [ebp - 0x674]
mov ecx, dword [eax]
add esp, 0xc
push 4
lea edx, [ebp - 0x670]
push edx
push 0x104
lea edx, [ebp - 0x218]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x1000ea6b
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.100027a6
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000ea6b
call fcn.1000d5d3
test eax, eax
je 0x1000ea6b
push str.program_files__x86__
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1000ea6b
xor eax, eax
push ebx
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push edi
push eax
call fcn.1002d190
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
push str.program_files_
push str.program_files__x86__
mov eax, 0x104
lea ecx, [ebp - 0x218]
call fcn.1000e235
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000ea6b
lea eax, [ebp - 0x420]
push eax
push esi
call fcn.100027a6
mov eax, dword [ebp - 0x678]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x674]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
call fcn.1002bd6d
ret

Function at 0x1001d70a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push esi
push esi
push 3
push esi
push 3
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x1001d760
cmp eax, 0xffffffff
je 0x1001d760
push esi
lea ecx, [ebp - 4]
push ecx
push 4
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001d760
cmp dword [ebp - 4], 4
jne 0x1001d760
cmp dword [ebp - 8], 0x21726152
jne 0x1001d760
inc esi
lea eax, [ebp - 0xc]
call fcn.10004037
mov eax, esi
pop esi
leave
ret
Function at 0x1001daa9
Capabilities:
Check if file exists
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100419fa
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x10053060]
xor eax, esp
mov dword [esp + 0x64], eax
push esi
push edi
mov eax, dword [0x10053060]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
lea eax, [esp + 0x1c]
push eax
mov esi, ecx
call fcn.1000226c
and dword [esp + 0x80], 0
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
mov ecx, dword [esi]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x1001db54
lea esi, [esp + 0xc]
call fcn.10003c9c
cmp dword [eax + 0x18], 8
jb 0x1001db20
mov eax, dword [eax + 4]
jmp 0x1001db23
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001db4b
lea esi, [esp + 0xc]
call fcn.10003c9c
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x1c]
push ecx
push edx
push eax
lea edi, [esp + 0x28]
call fcn.10002839
lea esi, [esp + 0xc]
call fcn.10003cc7
lea edi, [esp + 0x14]
lea esi, [esp + 0xc]
call fcn.100023a3
test al, al
jne 0x1001db0c
cmp dword [esp + 0x34], 0
jne 0x1001dba3
mov esi, 0x44e
lea edi, [esp + 0x1c]
call fcn.100028c2
push dword [esp + 0x1c]
call fcn.1002b251
pop ecx
mov eax, esi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.1002ada2
mov esp, ebp
pop ebp
ret
mov edi, ebx
call fcn.1000cf00
mov esi, ebx
call fcn.1000d44a
push ebx
push 0x10049560
push 0x10049564
lea ecx, [esp + 0x60]
call fcn.1000e4c4
add esp, 0xc
mov byte [esp + 0x80], 1
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
jmp 0x1001dc47
lea esi, [esp + 0xc]
call fcn.10003c9c
cmp dword [eax + 0x18], 8
jb 0x1001dc00
mov eax, dword [eax + 4]
jmp 0x1001dc03
add eax, 4
push eax
push str.___s_
lea ecx, [esp + 0x40]
call fcn.1000e4c4
pop ecx
pop ecx
push 0xffffffffffffffff
push 0
lea esi, [esp + 0x5c]
mov byte [esp + 0x88], 2
call fcn.10003cf6
push 0
push 1
lea esi, [esp + 0x40]
mov byte [esp + 0x88], 1
call fcn.100027cd
lea esi, [esp + 0xc]
call fcn.10003cc7
lea edi, [esp + 0x14]
lea esi, [esp + 0xc]
call fcn.100023a3
test al, al
jne 0x1001dbec
mov esi, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push ebx
call esi
test eax, eax
je 0x1001dc87
push 0x10047958
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1001dc87
push str.__md1M
lea eax, [esp + 0x58]
push eax
call fcn.10008219
push 0
lea ecx, [esp + 0x3c]
mov dword [esp + 0x54], 0xf
call fcn.10002d35
mov byte [esp + 0x80], 4
cmp dword [esp + 0x6c], 8
mov eax, dword [esp + 0x58]
jae 0x1001dcb1
lea eax, [esp + 0x58]
lea ecx, [esp + 0x38]
push ecx
push eax
call fcn.1001d69e
pop ecx
pop ecx
push 0
push 1
lea ecx, [esp + 0x40]
mov edi, eax
call fcn.100026d5
test edi, edi
je 0x1001dcd8
mov esi, ebx
call fcn.1000d44a
push 0
push 1
lea esi, [esp + 0x5c]
call fcn.100027cd
mov esi, edi
jmp 0x1001db71
Function at 0x1001dcec
Capabilities:
Check if file exists

Disassembly:
push 0xa4
mov eax, 0x10042053
call fcn.1002bcea
mov esi, ecx
mov edi, edx
push esi
mov dword [ebp - 0x60], edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1001dd17
mov eax, 0x44f
jmp 0x1001dea1
push esi
call fcn.1001d70a
pop ecx
test eax, eax
je 0x1001dd30
mov edx, edi
mov ecx, esi
call fcn.1001d89e
jmp 0x1001dea1
push esi
push 0x10049560
push str.__s__l___s_
lea ecx, [ebp - 0x4c]
call fcn.1000e4c4
add esp, 0xc
xor edi, edi
mov dword [ebp - 4], edi
push edi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
call fcn.10002d35
mov byte [ebp - 4], 3
cmp dword [ebp - 0x34], 8
mov eax, dword [ebp - 0x48]
jae 0x1001dd6b
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x30]
push ecx
push eax
call fcn.1001d69e
pop ecx
pop ecx
mov dword [ebp - 0x5c], eax
cmp eax, edi
jne 0x1001de88
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x1001dd8e
lea eax, [ebp - 0x2c]
push 0x100495b0
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.1000e1f7
add esp, 0xc
mov byte [ebp - 4], 4
mov esi, dword [ebp - 0x6c]
mov dword [ebp - 0x50], edi
cmp esi, dword [ebp - 0x68]
jbe 0x1001ddb4
call fcn.1002b217
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], esi
mov esi, dword [ebp - 0x68]
cmp dword [ebp - 0x6c], esi
jbe 0x1001ddca
call fcn.1002b217
mov eax, dword [ebp - 0x58]
cmp eax, edi
je 0x1001ddd6
cmp eax, dword [ebp - 0x78]
je 0x1001dddb
call fcn.1002b217
cmp dword [ebp - 0x54], esi
je 0x1001de77
lea esi, [ebp - 0x58]
call fcn.100279d1
push eax
call fcn.1001e031
test eax, eax
jne 0x1001ddfb
inc dword [ebp - 0x50]
jmp 0x1001de6a
cmp dword [ebp - 0x50], 1
jne 0x1001de64
lea esi, [ebp - 0x58]
call fcn.100279d1
cmp dword [eax + 0x14], 0x35
jbe 0x1001de6a
call fcn.100279d1
push 0xffffffffffffffff
push 0x35
push eax
lea esi, [ebp - 0xb0]
call fcn.1001e04f
push eax
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 5
call fcn.1000ca96
pop ecx
push eax
mov eax, dword [ebp - 0x60]
mov byte [ebp - 4], 6
call fcn.1000ec1e
push edi
push 1
lea esi, [ebp - 0x94]
call fcn.100027cd
push edi
push 1
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 4
call fcn.100026d5
jmp 0x1001de6a
cmp dword [ebp - 0x50], 2
je 0x1001de77
lea esi, [ebp - 0x58]
call fcn.10002378
jmp 0x1001ddbd
lea esi, [ebp - 0x78]
call fcn.10002814
push dword [ebp - 0x78]
call fcn.1002b251
pop ecx
push edi
push 1
lea ecx, [ebp - 0x30]
call fcn.100026d5
push edi
push 1
lea esi, [ebp - 0x4c]
call fcn.100027cd
mov eax, dword [ebp - 0x5c]
call fcn.1002bd6d
ret
Function at 0x1001dea7
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebx + 0x18]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov eax, dword [ebx]
push esi
push edi
mov dword [ebp - 4], 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
lea edi, [ebp - 0x14]
lea esi, [ebp - 0xc]
mov dword [ebp - 0x14], eax
call fcn.100092c5
test al, al
jne 0x1001df4c
call fcn.1001ea4e
add eax, 0x1c
cmp dword [eax + 0x18], 8
jb 0x1001def0
mov eax, dword [eax + 4]
jmp 0x1001def3
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001df3b
lea esi, [ebp - 0xc]
call fcn.1001ea4e
cmp dword [eax + 0x18], 8
jb 0x1001df11
mov edi, dword [eax + 4]
jmp 0x1001df14
lea edi, [eax + 4]
lea esi, [ebp - 0xc]
call fcn.1001ea4e
add eax, 0x1c
cmp dword [eax + 0x18], 8
jb 0x1001df2a
mov eax, dword [eax + 4]
jmp 0x1001df2d
add eax, 4
push 1
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1001df3f
and dword [ebp - 4], 0
lea esi, [ebp - 0xc]
call fcn.1000fccd
jmp 0x1001dec3
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret

Function at 0x1001df53
Capabilities:
Check if file exists

Disassembly:
push 0x5c
mov eax, 0x10042768
call fcn.1002bcea
mov esi, ecx
push esi
mov edi, edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1001df78
mov eax, 0x44f
jmp 0x1001e02b
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x1001df8d
mov eax, 0x450
jmp 0x1001e02b
push esi
call fcn.1001d70a
pop ecx
test eax, eax
je 0x1001dfa6
push edi
mov ecx, esi
call fcn.1001d9cc
pop ecx
jmp 0x1001e02b
lea eax, [ebp - 0x68]
push eax
call fcn.1000ee4a
push edi
push esi
push 0x10049560
xor ebx, ebx
push str.__s__x___s___r__o__s___y
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.1000e4c4
add esp, 0x10
push ebx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x30], 0xf
call fcn.10002d35
mov byte [ebp - 4], 7
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x1001dfeb
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x48]
push ecx
push eax
call fcn.1001d69e
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x48]
mov edi, eax
call fcn.100026d5
cmp edi, ebx
je 0x1001e010
lea ebx, [ebp - 0x68]
call fcn.1001dea7
push 0
push 1
lea esi, [ebp - 0x2c]
call fcn.100027cd
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x68]
push eax
call fcn.1000ee80
mov eax, edi
call fcn.1002bd6d
ret

Function at 0x1001e4d6
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x10053060]
xor eax, ebp
mov dword [ebp + 0x18c], eax
and dword [ebp - 0x80], 0
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
mov esi, ecx
call fcn.1002d190
add esp, 0xc
push 0x104
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Logsignored
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x7c]
push eax
call fcn.10002214
mov ecx, dword [ebp + 0x18c]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1002ada2
add ebp, 0x190
leave
ret