joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005586d
Capabilities:
Check mutex on windows

Disassembly:
push 0
mov eax, 0x1008d874
call fcn.10086e1a
mov edi, ecx
mov ebx, dword [ebp + 8]
and dword [ebx], 0
lea esi, [ebx + 4]
mov ecx, 0x100aee70
call fcn.10078e54
and dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebx + 8], ecx
mov byte [ebx + 0x14], 0
mov dword [ebx + 0x18], eax
cmp byte [edi + 8], 0
je 0x10055920
add edi, 4
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
test eax, eax
push 0x10011478
lea eax, [ebp + 0xc]
push eax
je 0x100558d4
call fcn.10058cd5
mov byte [ebp - 4], 1
jmp 0x100558df
mov edi, ecx
call fcn.10058cd5
mov byte [ebp - 4], 2
mov edi, esi
call fcn.100584b9
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.10078f0e
push dword [esi]
xor edi, edi
push edi
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebx], eax
cmp eax, edi
jne 0x10055924
push dword [esi]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10055924
mov byte [ebx + 0x14], 1
mov eax, ebx
call fcn.10086f06
ret 0x14

Function at 0x10055f6a
Capabilities:
Delete file

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push dword [esi + 4]
mov dword [esi], 0x1001a77c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi + 4]
sub eax, 0x10
pop esi
jmp fcn.10078f0e
Function at 0x100576a7
Capabilities:
Accept command line arguments

Disassembly:
push 0x20
mov eax, 0x10097425
call fcn.10086e1a
mov esi, dword [ebp + 8]
mov dword [esi], 0x1001a7e8
xor ebx, ebx
mov dword [esi + 4], 0x1001888c
mov dword [esi + 8], ebx
mov byte [esi + 0xc], bl
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x24], ebx
mov byte [esi + 0x28], bl
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x20], 0x100188dc
mov byte [ebp - 4], 1
push 0xc00
mov dword [esi + 0x3c], ebx
call fcn.1007c0aa
pop ecx
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
cmp eax, ebx
je 0x10057718
push eax
call fcn.10027c6e
jmp 0x1005771a
xor eax, eax
mov byte [ebp - 4], 1
mov dword [0x100b8468], eax
call fcn.100277af
push 4
call fcn.1007c0aa
pop ecx
cmp eax, ebx
je 0x1005773c
mov dword [eax], 0x1001a7f0
jmp 0x1005773e
xor eax, eax
push 0x1001a9f4
mov dword [0x100b8474], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x1005776f
push 0x100146a4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], 0x20000
cmp eax, ebx
je 0x1005776f
lea ecx, [ebp - 0x14]
push ecx
call eax
push 0x1006416a
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.10023e77
mov byte [ebp - 4], 3
call fcn.10069293
mov edi, eax
lea eax, [ebp - 0x2c]
call fcn.1002420c
mov ecx, dword [0x100b8468]
neg al
sbb al, al
inc al
mov byte [ecx], al
mov eax, dword [0x100b8468]
push ebx
mov dword [eax + 0x990], edi
push 0x10003bd0
lea eax, [ebp - 0x28]
push eax
call fcn.10023a16
mov byte [ebp - 0xd], al
lea eax, [ebp - 0x2c]
call fcn.100241d6
mov ecx, dword [0x100b8468]
mov dword [ecx + 0xbf0], 1
cmp byte [ebp - 0xd], bl
je 0x100577ef
mov dword [ecx + 0xbf0], 3
cmp al, bl
je 0x100577fd
mov dword [ecx + 0xbf0], 2
lea ecx, [ebp - 0x2c]
call fcn.100241a9
mov eax, esi
call fcn.10086f06
ret 4
Function at 0x10057b40
Capabilities:
Accept command line arguments

Disassembly:
push 0xc4
mov eax, 0x1009132b
call fcn.10086e8d
mov ebx, 0x10003b0c
push ebx
lea eax, [ebp - 0xc4]
push eax
call fcn.1005833e
and dword [ebp - 4], 0
mov edi, 0x10011b8c
push edi
lea eax, [ebp - 0xd0]
push eax
call fcn.1005833e
mov byte [ebp - 4], 1
lea eax, [ebp - 0xc4]
push ebx
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], esi
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 8]
mov byte [ebp - 4], 2
mov eax, dword [0x100aee70]
mov ecx, 0x100aee70
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xc0], eax
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [ebp - 0xc0]
push 0x10011bb4
push eax
call fcn.10078b7a
mov edi, dword [ebp - 0xc0]
mov eax, dword [esi]
add esp, 0xc
push edi
push 7
mov ecx, esi
call dword [eax + 4]
and dword [ebp - 0xbc], 0
push 0xa8
lea eax, [ebp - 0xb8]
push 0
push eax
call fcn.1007e770
add esp, 0xc
lea eax, [ebp - 0xbc]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
cmp eax, 1
jne 0x10057c16
lea eax, [ebp - 0xb8]
jmp 0x10057c1e
cmp eax, 2
jne 0x10057c6d
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0xc0]
push 0x10011bd8
push eax
call fcn.10078b7a
mov eax, dword [esi]
add esp, 0xc
push dword [ebp - 0xc0]
mov ecx, esi
push 7
call dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push eax
lea eax, [ebp - 0xc0]
push 0x10011bf4
push eax
call fcn.10078b7a
mov edi, dword [ebp - 0xc0]
mov eax, dword [esi]
add esp, 0xc
push edi
push 7
mov ecx, esi
call dword [eax + 4]
lea eax, [edi - 0x10]
call fcn.10078f0e
lea eax, [ebp - 0xd0]
push eax
mov byte [ebp - 4], 0
call fcn.1002395e
mov eax, dword [ebp - 0xc4]
add eax, 0xfffffff0
call fcn.10078f0e
call fcn.10086f1f
ret

Function at 0x10059540
Capabilities:
Accept command line arguments

Disassembly:
push 0x18
mov eax, 0x10093a3f
call fcn.10086e1a
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.10023e77
and dword [ebp - 4], 0
lea eax, [ebp - 0x24]
call fcn.1002420c
test al, al
je 0x100595a2
cmp dword [esi + 4], 0
je 0x100595a2
mov eax, dword [esi + 8]
cmp eax, 3
je 0x10059581
cmp eax, 2
jne 0x10059590
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
jne 0x10059590
mov eax, dword [esi + 8]
mov esi, eax
lea ecx, [ebp - 0x24]
call fcn.100241a9
mov eax, esi
call fcn.10086f06
ret
mov esi, dword [esi + 8]
jmp 0x10059592
Function at 0x1005a9ac
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1009302f
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x100ae210]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push esi
push edi
mov eax, dword [0x100ae210]
xor eax, esp
push eax
lea eax, [esp + 0x240]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov ebx, edx
xor edi, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], edi
call dword [eax + 8]
test al, al
je 0x1005ab44
call fcn.10060702
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
lea ecx, [esp + 0x24]
mov dword [esp + 0x248], edi
call fcn.100281d5
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.1005833e
mov byte [esp + 0x248], 1
cmp dword [esp + 0x24], edi
je 0x1005aa55
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x24], edi
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [esi + 0x3c]
mov eax, dword [edi]
push 2
push 0xa
push dword [esp + 0x18]
mov ecx, edi
push dword [edi + 4]
call dword [eax + 8]
mov ebx, 0xffff
mov esi, 0x80070000
test eax, eax
jne 0x1005aa95
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1005aa93
and eax, ebx
or eax, esi
test eax, eax
js 0x1005aadb
mov eax, dword [edi]
push 0
push 1
push 0
push 0x10006b20
push dword [esp + 0x20]
mov ecx, edi
call dword [eax + 0xc]
test eax, eax
jne 0x1005aabf
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1005aad5
and eax, ebx
or eax, esi
jmp 0x1005aad3
mov eax, dword [edi]
push 2
push 0xea60
mov ecx, edi
call dword [eax + 0x10]
test eax, eax
je 0x1005aaaf
xor eax, eax
test eax, eax
js 0x1005aadb
mov byte [edi + 8], 1
mov esi, eax
push 0x10012238
lea eax, [esp + 0x18]
push eax
call fcn.1005833e
push esi
push dword [esp + 0x1c]
lea edi, [esp + 0x1c]
mov byte [esp + 0x250], 2
call fcn.10061236
mov byte [esp + 0x248], 1
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.10078f0e
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
call fcn.10078eab
mov edi, dword [esp + 0x1c]
add eax, 0x10
mov dword [edi], eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
call fcn.10078f0e
lea esi, [esp + 0x24]
call fcn.100281a5
mov eax, edi
jmp 0x1005ab51
push 0x1001ab18
push ebx
call fcn.1005833e
mov eax, ebx
mov ecx, dword [esp + 0x240]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.1007b091
mov esp, ebp
pop ebp
ret

Function at 0x1005b722
Capabilities:
Get common file path

Disassembly:
push 0x214
mov eax, 0x10092fe1
call fcn.10086e8d
and dword [ebp - 4], 0
and dword [ebp - 0x21c], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
mov dword [ebp - 0x220], esi
call fcn.1007e770
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.1005833e
and dword [ebp - 4], 0
mov eax, esi
mov dword [ebp - 0x21c], 1
call fcn.1005fffa
mov eax, esi
call fcn.10086f1f
ret
Function at 0x1005b7a1
Capabilities:
Get common file path

Disassembly:
push 4
mov eax, 0x1008e269
call fcn.10086e1a
and dword [ebp - 0x10], 0
push 0x1000c5c0
lea eax, [ebp - 0x10]
push eax
call fcn.1005833e
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov edx, dword [eax - 8]
xor ecx, ecx
inc ecx
sub ecx, dword [eax - 4]
mov esi, 0x104
sub edx, esi
or ecx, edx
jge 0x1005b7e7
mov eax, esi
lea ecx, [ebp - 0x10]
call fcn.10078d3a
mov eax, dword [ebp - 0x10]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
or eax, 0xffffffff
lea esi, [ebp - 0x10]
call fcn.10078afc
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.1005833e
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.10078f0e
mov eax, dword [ebp + 8]
call fcn.10086f06
ret 4
Function at 0x1005ea74
Capabilities:
Get hostname

Disassembly:
push 0xc
mov eax, 0x1008e628
call fcn.10086e1a
mov eax, dword [0x100aee70]
mov ecx, 0x100aee70
call dword [eax + 0xc]
lea ecx, [eax + 0x10]
mov dword [ebp - 0x10], ecx
xor edx, edx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, 0x104
inc edx
mov dword [ebp - 0x14], eax
sub edx, dword [ecx - 4]
mov ecx, dword [ecx - 8]
sub ecx, eax
or ecx, edx
jge 0x1005eab7
lea ecx, [ebp - 0x10]
call fcn.10078d3a
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push 7
call dword [sym.imp.Secur32.dll_GetComputerObjectNameW]
test al, al
je 0x1005eb2d
or eax, 0xffffffff
lea esi, [ebp - 0x10]
call fcn.10078afc
push 0x2f
xor ecx, ecx
call fcn.10058863
cmp eax, 0xffffffff
je 0x1005eb08
mov ecx, eax
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.10058aed
mov edi, esi
mov byte [ebp - 4], 1
call fcn.100584b9
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.10078f0e
lea eax, [ebp - 0x10]
call fcn.10058901
push 0x10013608
xor ecx, ecx
lea esi, [ebp - 0x10]
call fcn.10058897
cmp eax, 0xffffffff
je 0x1005eb2d
call fcn.10062a3f
test al, al
je 0x1005eb40
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.10078f0e
mov al, bl
call fcn.10086f06
ret
mov bl, 1
jmp 0x1005eb2d
Function at 0x1005f821
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x100ae210]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [esi + 4]
push eax
mov dword [esi], 0x1001a828
call fcn.100576a7
xor eax, eax
push 0x1fe
push eax
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x202]
push eax
call fcn.1007e770
add esp, 0xc
push 0xff
lea eax, [ebp - 0x204]
push eax
push 0x10013914
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jle 0x1005f8be
mov edx, 0x1001162c
lea eax, [ebp - 0x204]
mov cx, word [eax]
cmp cx, word [edx]
jne 0x1005f8af
test cx, cx
je 0x1005f8ab
mov cx, word [eax + 2]
cmp cx, word [edx + 2]
jne 0x1005f8af
add eax, 4
add edx, 4
test cx, cx
jne 0x1005f889
xor eax, eax
jmp 0x1005f8b4
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1005f8be
call dword [sym.imp.KERNEL32.dll_DebugBreak]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, esi
call fcn.1007b091
leave
ret
Function at 0x10060076
Capabilities:
Get system information on windows

Disassembly:
push 0x50
mov eax, 0x10090e6f
call fcn.10086e1a
mov esi, ecx
mov edi, edx
lea eax, [ebp + 8]
xor ebx, ebx
push eax
mov ecx, 0x10011ec0
mov dword [ebp - 4], ebx
call fcn.100585bc
test eax, eax
je 0x100601d0
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], ebx
je 0x100601d0
lea eax, [ebp + 8]
push eax
mov ecx, 0x10013940
call fcn.100585bc
test eax, eax
jne 0x100600c3
push 2
jmp 0x100600d7
lea eax, [ebp + 8]
push eax
mov ecx, 0x10013954
call fcn.100585bc
test eax, eax
jne 0x100600dd
push 3
pop esi
jmp 0x100601dc
lea eax, [ebp + 8]
push eax
mov ecx, 0x10013974
call fcn.100585bc
test eax, eax
jne 0x1006013f
mov byte [edi + 0x11], 1
cmp byte [edi + 0x10], bl
jne 0x100600d5
push 9
pop ecx
mov dword [ebp - 0x5c], 0x10018760
lea edi, [ebp - 0x58]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.10024da1
test al, al
je 0x10060137
call dword [sym.imp.sqmapi.dll_SqmIsWindowsOptedIn]
mov esi, eax
neg esi
sbb esi, esi
neg esi
add esi, 2
jmp 0x100601dc
xor esi, esi
inc esi
jmp 0x100601dc
push 0x10013990
lea eax, [ebp - 0x14]
push eax
call fcn.1005833e
push 0x10005e9c
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 2
call fcn.1005833e
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x28]
push ecx
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.1002838a
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.10078f0e
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.10078f0e
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x28]
call fcn.10028415
mov byte [ebp - 4], 7
mov eax, dword [eax]
mov edx, dword [esi]
push eax
push ebx
mov ecx, esi
call dword [edx + 4]
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.10078f0e
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x34]
call fcn.1002a378
push 0x1009bdc8
lea eax, [ebp - 0x34]
push eax
call fcn.100814aa
xor eax, eax
cmp byte [edi + 0x10], bl
setne al
lea esi, [eax + eax + 1]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.10078f0e
mov eax, esi
call fcn.10086f06
ret 4
Function at 0x100608ee
Capabilities:
Accept command line arguments

Disassembly:
push 0x30
mov eax, 0x10092e18
call fcn.10086e1a
mov edi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call edi
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.10023e77
and dword [ebp - 4], 0
call edi
push eax
lea eax, [ebp - 0x18]
mov esi, 0x10018750
push eax
mov dword [ebp - 0x1c], esi
call fcn.1005833e
push 0
mov ebx, 0x10013d50
push ebx
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 1
call fcn.10023a16
mov byte [ebp - 0x11], al
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
mov dword [ebp - 0x1c], esi
call fcn.10078f0e
cmp byte [ebp - 0x11], 0
je 0x100609ce
call edi
push eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x24], esi
call fcn.1005833e
push ebx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.10023c8f
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
mov dword [ebp - 0x24], esi
call fcn.10078f0e
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x3c]
lea eax, [ebp - 0x18]
push eax
push 0x1ee
call fcn.1002c5d4
mov edi, eax
push 0x10013d08
lea eax, [ebp + 8]
push eax
call fcn.1005833e
push edi
push esi
lea edi, [ebp + 8]
mov byte [ebp - 4], 5
call fcn.10061236
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.10078f0e
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.10078f0e
lea ecx, [ebp - 0x3c]
call fcn.100241a9
call fcn.10086f06
ret 4
Function at 0x10062c16
Capabilities:
Check if file exists
Copy file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1009894e
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
mov eax, dword [0x100ae210]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
xor ebx, ebx
lea eax, [edi + 0x10]
mov dword [esp + 0x28], ebx
push eax
lea esi, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], eax
call fcn.10028168
cmp dword [esp + 0x20], ebx
ja 0x10062dc6
jb 0x10062c79
cmp dword [esp + 0x1c], 2
ja 0x10062dc6
lea eax, [esp + 0x1c]
push eax
call fcn.1006401f
mov dword [esp + 0x40], ebx
push dword [eax]
lea eax, [esp + 0x1c]
push eax
call fcn.1005833e
mov byte [esp + 0x40], 2
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
call fcn.10078f0e
push dword [esp + 0x18]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10062cec
push 0x100145e8
lea eax, [esp + 0x2c]
push eax
call fcn.1005833e
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x48], 3
call fcn.10028329
mov dword [esp + 0x2c], 0x10018838
push 0x1009c014
lea eax, [esp + 0x30]
push eax
call fcn.100814aa
mov ecx, edi
call fcn.10054029
lea eax, [esp + 0x14]
push eax
mov ecx, edi
call fcn.1005405d
mov byte [esp + 0x40], 4
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.10078eab
push ebx
push dword [esp + 0x18]
lea esi, [eax + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x10062d43
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], ebx
je 0x10062d3c
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x10062d43
mov byte [esp + 0x13], 1
jmp 0x10062d47
mov byte [esp + 0x13], bl
lea eax, [esi - 0x10]
call fcn.10078f0e
cmp byte [esp + 0x13], bl
je 0x10062d8d
push 1
push edi
call fcn.10054513
mov ecx, dword [esp + 0x28]
mov dword [ecx], eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.10078f0e
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.10078f0e
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10014628
lea eax, [esp + 0x2c]
push eax
call fcn.1005833e
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x48], 5
call fcn.10028329
mov dword [esp + 0x2c], 0x10018838
push 0x1009c014
lea eax, [esp + 0x30]
jmp 0x10062ce6
mov ecx, edi
call fcn.10063e97
test al, al
jne 0x10062d7b
push 0x10014660
lea eax, [esp + 0x2c]
push eax
call fcn.1005833e
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x48], 6
call fcn.10028329
mov dword [esp + 0x2c], 0x10018844
push 0x1009c060
lea eax, [esp + 0x30]
jmp 0x10062ce6
Function at 0x100636ba
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
push ebx
push esi
mov esi, eax
mov ecx, esi
call fcn.100666e5
push esi
push dword [ebp + 8]
call fcn.10066782
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ecx, ax
mov eax, dword [esi + 4]
xor ebx, ebx
mov dword [esp + 0xc], ecx
test eax, eax
jle 0x100636fc
mov edx, dword [esi]
cmp dword [edx], ecx
je 0x100636ff
inc ebx
add edx, 4
cmp ebx, eax
jl 0x100636f0
or ebx, 0xffffffff
cmp ebx, 0xffffffff
jne 0x1006370d
lea ebx, [esp + 0xc]
call fcn.1005bc6d
mov eax, dword [esi + 4]
xor edx, edx
mov ebx, 0x409
test eax, eax
jle 0x10063729
mov ecx, dword [esi]
cmp dword [ecx], ebx
je 0x1006372c
inc edx
add ecx, 4
cmp edx, eax
jl 0x1006371d
or edx, 0xffffffff
cmp edx, 0xffffffff
jne 0x1006373e
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0xc]
call fcn.1005bc6d
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1006374b
Capabilities:
Check if file exists

Disassembly:
push 0xc
mov eax, 0x10092c24
call fcn.10086e1a
lea eax, [ebp - 0x14]
push eax
call fcn.10025d3f
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.10078eab
add eax, 0x10
mov dword [ebp - 0x10], eax
push edi
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.1002c259
mov byte [ebp - 4], 2
push dword [eax]
lea eax, [ebp - 0x10]
call fcn.10058e4a
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.10078f0e
push 0x10014918
lea eax, [ebp - 0x10]
call fcn.10058e4a
mov ebx, dword [ebp - 0x10]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push ebx
call esi
test eax, eax
jne 0x100637ef
push edi
push 0x10014940
push eax
mov eax, dword [ebp + 8]
mov esi, dword [eax + 4]
call fcn.100239ad
add esp, 0xc
lea eax, [ebx - 0x10]
call fcn.10078f0e
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.10078f0e
xor al, al
call fcn.10086f06
ret 8
cmp byte [ebp + 0xc], 0
je 0x10063890
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.10078eab
add eax, 0x10
mov dword [ebp + 0xc], eax
push edi
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 3
call fcn.1002c259
mov byte [ebp - 4], 4
push dword [eax]
lea eax, [ebp + 0xc]
call fcn.10058e4a
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.10078f0e
push 0x100094c8
lea eax, [ebp + 0xc]
call fcn.10058e4a
mov ebx, dword [ebp + 0xc]
push ebx
call esi
test eax, eax
jne 0x10063888
push edi
push 0x100149a0
push eax
mov eax, dword [ebp + 8]
mov esi, dword [eax + 4]
call fcn.100239ad
add esp, 0xc
lea eax, [ebx - 0x10]
call fcn.10078f0e
xor bl, bl
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.10078f0e
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.10078f0e
mov al, bl
jmp 0x100637e7
lea eax, [ebx - 0x10]
call fcn.10078f0e
mov bl, 1
jmp 0x1006386b
Function at 0x10063e97
Capabilities:
Get file size

Disassembly:
push 0x2c
mov eax, 0x10092bdc
call fcn.10086e1a
mov esi, ecx
mov eax, dword [esi]
mov dword [ebp - 0x20], esi
call dword [eax + 0x1c]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 1
call fcn.1006401f
push ebx
push 0x80
push 3
push 1
push SysReAllocStringLen
mov byte [ebp - 4], 2
push dword [ebp - 0x10]
lea edi, [ebp - 0x28]
call fcn.1002809d
cmp eax, ebx
jge 0x10063f48
mov eax, dword [0x100aee70]
mov ecx, 0x100aee70
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 3
push dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push 0x10014ac4
push eax
call fcn.10078b7a
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.10028329
mov esi, 0x10018808
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 4
call fcn.1002a3bc
push 0x1009befc
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x38], esi
call fcn.100814aa
push ebx
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.10078f0e
mov byte [ebp - 4], bl
cmp dword [ebp - 0x28], ebx
je 0x10063f70
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
lea eax, [ebp - 0x18]
push eax
call fcn.1006401f
push ecx
mov byte [ebp - 4], 5
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
mov ecx, esp
push eax
push ecx
call fcn.1005833e
lea eax, [ebp - 0x1c]
push eax
call fcn.10066d61
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.10078f0e
mov eax, dword [esi]
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push ecx
mov ecx, esi
call dword [eax + 0x10]
lea eax, [ebp - 0x14]
push eax
call fcn.10066d61
xor eax, eax
cmp dword [ebp - 0x14], ebx
setne al
cmp eax, ebx
jne 0x10063fd3
push 0x80004005
call fcn.10078e8c
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call fcn.1007cdff
cmp eax, ebx
mov eax, dword [ebp - 0x14]
pop ecx
sete bl
pop ecx
add eax, 0xfffffff0
call fcn.10078f0e
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.10078f0e
or dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18]
mov al, bl
call fcn.10086f06
ret