joyce8/EMBER2024-capa huggingface dataset:
Function at 0x803550
Capabilities:
Copy file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x847d95
mov eax, dword fs:[0]
push eax
sub esp, 0x414
mov eax, dword [0x85f690]
xor eax, esp
mov dword [esp + 0x410], eax
mov eax, dword [0x85f690]
xor eax, esp
push eax
lea eax, [esp + 0x418]
mov dword fs:[0], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x216]
mov dword [esp + 0x428], 0
push ecx
mov word [esp + 0x218], ax
call fcn.00834280
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0xe]
push eax
mov word [esp + 0x10], dx
call fcn.00834280
add esp, 0xc
push 0x104
lea ecx, [esp + 0x210]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 4]
push edx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x851410
lea eax, [esp + 8]
push 0x104
push eax
call fcn.0083247f
lea ecx, [esp + 0x10]
add esp, 0xc
push ecx
call fcn.00832cbc
add esp, 4
push str.GameLogin
lea edx, [esp + 8]
push 0x104
push edx
call fcn.0083247f
lea eax, [esp + 0x10]
add esp, 0xc
push eax
call fcn.00832cbc
add esp, 4
lea ecx, [esp + 0x20c]
push 0x5c
push ecx
call fcn.00832453
push eax
lea edx, [esp + 0x10]
push 0x104
push edx
call fcn.0083247f
add esp, 0x14
lea eax, [esp + 0x20c]
push eax
lea ecx, [esp + 8]
push ecx
call fcn.008329cc
add esp, 8
test eax, eax
je 0x803694
push 0
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [esp + 4]
call fcn.00806b30
push 0
lea edx, [esp + 8]
mov ecx, str.33wan
call fcn.00806d90
push str._uninst
lea edx, [esp + 8]
mov ecx, 0x85145c
call fcn.00806d90
push str._SjsgD
lea edx, [esp + 8]
mov ecx, str.33wan
call fcn.00806d90
lea ecx, [esp + 4]
call fcn.00803af0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
mov ecx, dword [esp + 0x418]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.008321db
add esp, 0x420
ret
Function at 0x803710
Capabilities:
Create process on windows
Get common file path
Self delete

Disassembly:
sub esp, 0xd88
mov eax, dword [0x85f690]
xor eax, esp
mov dword [esp + 0xd80], eax
push esi
push 0x44
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00834280
add esp, 0xc
lea edx, [esp + 0x168]
push edx
xor ecx, ecx
push 0x104
mov dword [esp + 0x20], 0x44
mov dword [esp + 0x4c], 1
mov word [esp + 0x50], cx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [esp + 0x168]
push eax
push 0
push str.DelSelf
mov ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push str..bat
lea edx, [esp + 0x16c]
push 0x104
push edx
call fcn.00832cee
add esp, 0xc
push 0x104
lea eax, [esp + 0x64]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x803900
lea ecx, [esp + 0x60]
push 0x5c
push ecx
call fcn.00832d70
add esp, 8
test eax, eax
je 0x8037d8
lea edx, [esp + 0x60]
sub eax, edx
push eax
mov eax, edx
push eax
push 0x104
lea ecx, [esp + 0x27c]
push ecx
jmp 0x8037fc
lea eax, [esp + 0x60]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x8037e0
sub eax, edx
push eax
lea edx, [esp + 0x64]
push edx
push 0x104
lea eax, [esp + 0x27c]
push eax
call fcn.00832d9d
add esp, 0x10
push 0x104
lea ecx, [esp + 0x37c]
push ecx
push 0xffffffffffffffff
lea edx, [esp + 0x27c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esp + 0x378]
push eax
call fcn.008058a0
add esp, 4
cmp eax, 1
push 0
jle 0x80386a
lea ecx, [esp + 0x16c]
push ecx
lea edx, [esp + 0x68]
push edx
mov eax, edx
push eax
push 1
push str.cd_r_n:delexe_r_nping__n__d_127.0.0.1_r_ndel___s__r_nif_exist___s__goto_:delexe_r_ndel___s__r_n
lea ecx, [esp + 0x598]
push 0x800
push ecx
call fcn.00832e52
add esp, 0x20
jmp 0x8038a1
lea edx, [esp + 0x16c]
push edx
lea eax, [esp + 0x278]
push eax
mov ecx, eax
push ecx
lea edx, [esp + 0x70]
push edx
mov eax, edx
push eax
push 1
push str.cd_r_n:delexe_r_nping__n__d_127.0.0.1_r_ndel___s__r_nif_exist___s__goto_:delexe_r_ndel___s___Q__F__A_r_nrd___s__r_ndel___s__r_n
lea ecx, [esp + 0x5a0]
push 0x800
push ecx
call fcn.00832e52
add esp, 0x28
lea edx, [esp + 0x580]
push edx
lea eax, [esp + 0x16c]
call fcn.00803920
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x188]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x803900
mov eax, dword [esp + 0xc]
push 0xfffffffffffffff1
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 8]
push edx
call esi
mov ecx, dword [esp + 0xd84]
pop esi
xor ecx, esp
call fcn.008321db
add esp, 0xd88
ret
Function at 0x803920
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push 0
push 0
push 4
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x803946
or eax, eax
pop esi
pop ecx
ret 4
mov eax, dword [esp + 0xc]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x803950
push ebx
push ebp
push edi
push 2
push 0
push 0
sub eax, edx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x803997
call ebp
mov ebx, eax
test ebx, ebx
je 0x803997
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop ebp
pop ebx
or eax, 0xffffffff
pop esi
pop ecx
ret 4
mov edx, dword [esp + 0x18]
push 0
lea ecx, [esp + 0x14]
push ecx
push edi
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x8039cc
call ebp
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop ebp
pop ebx
or eax, 0xffffffff
pop esi
pop ecx
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret 4

Function at 0x8039e0
Capabilities:
Delete directory
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x847d55
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x85f690]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov eax, dword [0x85f690]
xor eax, esp
push eax
lea eax, [esp + 0x218]
mov dword fs:[0], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
xor eax, eax
mov dword [esp + 0x220], 0
cmp eax, str.33wan
je 0x803a43
mov esi, str.33wan
call fcn.00806ce0
call fcn.00806ed0
xor ecx, ecx
cmp ecx, 0x85145c
je 0x803a57
mov esi, 0x85145c
call fcn.00806ed0
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x16]
push eax
mov word [esp + 0x18], dx
call fcn.00834280
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0x17
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.33wan
lea edx, [esp + 0x10]
push 0x104
push edx
call fcn.0083247f
lea eax, [esp + 0x18]
add esp, 0xc
push eax
call fcn.008058a0
add esp, 4
test eax, eax
jne 0x803ab7
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.008321db
add esp, 0x21c
ret
Function at 0x803af0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x270
mov eax, dword [0x85f690]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x6a]
push ecx
mov word [esp + 0x6c], ax
call fcn.00834280
add esp, 0xc
test esi, esi
jne 0x803b38
push 0x104
lea edx, [esp + 0x64]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x803b4b
push esi
lea eax, [esp + 0x64]
push 0x104
push eax
call fcn.00832e70
add esp, 0xc
push 0x44
lea ecx, [esp + 0x1c]
push 0
push ecx
call fcn.00834280
add esp, 0xc
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0x40
push 0
push 0
mov edx, 1
mov word [esp + 0x64], dx
push 0
lea edx, [esp + 0x80]
push edx
push 0
mov dword [esp + 0x6c], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x803bac
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.008321db
add esp, 0x270
ret
Function at 0x8049e0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x1b0
mov eax, dword [0x85f690]
xor eax, esp
mov dword [esp + 0x1ac], eax
push ebp
mov ebp, dword [esp + 0x1b8]
mov eax, dword [ebp + 0x20]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov ecx, ebp
test eax, eax
je 0x804a2e
push 0
call fcn.008139f3
push 0
call fcn.00801a80
mov ecx, dword [0x863de4]
test ecx, ecx
je 0x804a74
cmp dword [ecx + 0x20], 0
je 0x804a74
push 0
jmp 0x804a6f
push 5
call fcn.008139f3
push 1
call fcn.00801a80
mov ecx, dword [ebp + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x804a53
push 9
mov ecx, ebp
call fcn.008139f3
mov edx, dword [ebp + 0x20]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [0x863de4]
test ecx, ecx
je 0x804a74
cmp dword [ecx + 0x20], 0
je 0x804a74
push 5
call fcn.008139f3
cmp dword [esp + 0x1bc], 0
je 0x804bbf
xor eax, eax
push esi
push edi
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push 5
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
je 0x804b9b
mov edi, dword [sym.imp.USER32.dll_GetClassNameW]
lea eax, [esp + 0x10]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [esp + 0x10], eax
push 0x40
lea ecx, [esp + 0x40]
push ecx
push esi
call edi
push 0x80
lea edx, [esp + 0xc0]
push edx
push esi
call ebx
mov ecx, 0x851374
lea eax, [esp + 0xbc]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x804b2c
test dx, dx
je 0x804b28
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x804b2c
add eax, 4
add ecx, 4
test dx, dx
jne 0x804b06
xor eax, eax
jmp 0x804b31
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x804b87
mov ecx, str.32770
lea eax, [esp + 0x3c]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x804b66
test dx, dx
je 0x804b62
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x804b66
add eax, 4
add ecx, 4
test dx, dx
jne 0x804b40
xor eax, eax
jmp 0x804b6b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x804b87
mov ecx, ebp
call fcn.00801d50
cmp esi, eax
je 0x804b87
mov eax, dword [esp + 0x10]
mov dword [eax], esi
add eax, 4
mov dword [esp + 0x10], eax
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
jne 0x804ae0
pop ebx
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
xor esi, esi
mov eax, dword [esp + esi*4 + 0x10]
test eax, eax
je 0x804bbd
push 0
push 0
push 0x403
push eax
call edi
inc esi
cmp esi, 0xa
jl 0x804ba3
pop edi
pop esi
mov ecx, dword [esp + 0x1b0]
pop ebp
xor ecx, esp
call fcn.008321db
add esp, 0x1b0
ret 8
Function at 0x8058a0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x66c
mov eax, dword [0x85f690]
xor eax, esp
mov dword [esp + 0x668], eax
push ebp
push esi
mov esi, dword [esp + 0x678]
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x26a]
push ecx
xor edi, edi
mov word [esp + 0x26c], ax
call fcn.00834280
add esp, 0xc
push 0x250
lea edx, [esp + 0x14]
push edi
push edx
call fcn.00834280
add esp, 0xc
push esi
lea eax, [esp + 0x264]
push 0x104
push eax
call fcn.00832e70
lea eax, [esp + 0x26c]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x805913
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x25e], 0x5c
je 0x805947
push 0x851b18
lea ecx, [esp + 0x264]
push 0x104
push ecx
call fcn.0083247f
add esp, 0xc
push 0x851b1c
lea edx, [esp + 0x264]
push 0x104
push edx
call fcn.0083247f
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x264]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x805998
mov eax, 1
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x668]
xor ecx, esp
call fcn.008321db
add esp, 0x66c
ret
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, edi
mov ecx, 0x851b20
lea eax, [esp + 0x3c]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x8059d6
test dx, dx
je 0x8059d2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x8059d6
add eax, 4
add ecx, 4
test dx, dx
jne 0x8059b0
xor eax, eax
jmp 0x8059db
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x805abd
mov ecx, 0x851b24
lea eax, [esp + 0x3c]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x805a16
test dx, dx
je 0x805a12
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x805a16
add eax, 4
add ecx, 4
test dx, dx
jne 0x8059f0
xor eax, eax
jmp 0x805a1b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x805abd
test byte [esp + 0x10], 0x10
je 0x805abc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x472]
push eax
mov word [esp + 0x474], dx
call fcn.00834280
add esp, 0xc
lea ecx, [esp + 0x260]
push ecx
lea edx, [esp + 0x46c]
push 0x104
push edx
call fcn.00832e70
lea eax, [esp + 0x474]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x805a75
sub eax, edx
sar eax, 1
lea edx, [esp + 0x3c]
xor ecx, ecx
push edx
mov word [esp + eax*2 + 0x46a], cx
lea eax, [esp + 0x46c]
push 0x104
push eax
call fcn.0083247f
lea ecx, [esp + 0x474]
add esp, 0xc
push ecx
call fcn.008058a0
add esp, 4
add edi, eax
jmp 0x805abd
inc edi
lea edx, [esp + 0x10]
push edx
push esi
call ebp
test eax, eax
jne 0x8059a0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x674]
mov eax, edi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.008321db
add esp, 0x66c
ret
Function at 0x805af0
Capabilities:
Delete internet cache
Enumerate internet cache
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x85f690]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
push edi
mov edi, dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryW]
lea eax, [esp + 8]
push eax
push 0
push 0
mov dword [esp + 0x14], 0
call edi
mov eax, dword [esp + 8]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.008122d4
add esp, 4
mov esi, eax
lea eax, [esp + 8]
push eax
push esi
push 0
call edi
mov edi, eax
test edi, edi
je 0x805bad
push ebp
mov ebp, dword [sym.imp.WININET.dll_FindNextUrlCacheEntryW]
test dword [esi + 0xc], 0x100000
jne 0x805b68
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
lea edx, [esp + 0xc]
push edx
push 0
push edi
mov dword [esp + 0x18], 0
call ebp
push esi
call fcn.008122c9
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.008122d4
add esp, 8
mov esi, eax
lea eax, [esp + 0xc]
push eax
push esi
push edi
call ebp
test eax, eax
jne 0x805b55
pop ebp
test esi, esi
je 0x805bba
push esi
call fcn.008122c9
add esp, 4
push 0
push 0x20
lea ecx, [esp + 0x14]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
pop edi
pop esi
test eax, eax
je 0x805bf3
lea edx, [esp + 4]
push edx
call fcn.00805520
add esp, 4
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.008321db
add esp, 0x210
ret
mov ecx, dword [esp + 0x20c]
xor ecx, esp
xor eax, eax
call fcn.008321db
add esp, 0x210
ret

Function at 0x805c10
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings5.0CacheContent
push 0x80000001
mov dword [esp + 0x18], 0x100000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x805c40
xor eax, eax
add esp, 8
ret
mov edx, dword [esp]
push 4
lea ecx, [esp + 8]
push ecx
push 4
push 0
push str.CacheLimit
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x805c3a
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg eax
sbb eax, eax
inc eax
add esp, 8
ret
Function at 0x806b30
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x640
mov eax, dword [0x85f690]
xor eax, esp
mov dword [esp + 0x63c], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp esi, ebx
je 0x806b86
xor eax, eax
cmp ax, word [esi]
je 0x806b86
xor ecx, ecx
cmp ecx, str.33wan
je 0x806b86
lea edx, [esp + 8]
push edx
push esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call fcn.00820e56
test eax, eax
jne 0x806b9f
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x63c]
xor ecx, esp
call fcn.008321db
add esp, 0x640
ret
push edi
push 0x206
lea ecx, [esp + 0x23e]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x244], ax
call fcn.00834280
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
add esp, 0xc
lea edx, [esp + 0x238]
push edx
push ebx
push ebx
push 0x19
push ebx
call edi
test eax, eax
jl 0x806cbd
push 0x206
lea ecx, [esp + 0x446]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x44c], ax
call fcn.00834280
add esp, 0xc
lea edx, [esp + 0x440]
push edx
push ebx
push ebx
push 5
push ebx
call edi
lea eax, [esp + 0x440]
push 0x5c
push eax
call fcn.00832453
lea ecx, [esp + 0x240]
push 0x5c
push ecx
mov edi, eax
call fcn.00832453
add esp, 0x10
cmp edi, ebx
je 0x806c6d
cmp eax, ebx
je 0x806c6d
push str.33wan
push eax
lea eax, [esp + 0x448]
push eax
push str._s_s_s.lnk
mov ecx, eax
xor edx, edx
push 0x104
push ecx
mov word [edi], dx
call fcn.00833827
add esp, 0x18
lea edx, [esp + 0x440]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.33wan
lea eax, [esp + 0x23c]
push eax
push str._s_s.lnk
mov ecx, eax
push 0x104
push ecx
call fcn.00833827
add esp, 0x14
push str._SjsgD
mov edi, str.33wan
lea ebx, [esp + 0x23c]
call fcn.00806fa0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x63c]
xor ecx, esp
call fcn.008321db
add esp, 0x640
ret
mov ecx, dword [esp + 0x648]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.008321db
add esp, 0x640
ret

Function at 0x806ce0
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x85f690]
xor eax, esp
mov dword [esp + 0x208], eax
xor eax, eax
cmp ax, word [esi]
je 0x806d6b
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0xa]
push edx
mov word [esp + 0xc], cx
call fcn.00834280
add esp, 0xc
lea eax, [esp]
push eax
push 0
push 0
push 0x19
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x806d6b
push esi
lea ecx, [esp + 4]
push ecx
push str._s_s.lnk
mov edx, ecx
push 0x104
push edx
call fcn.00833827
add esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.008321db
add esp, 0x20c
ret
mov ecx, dword [esp + 0x208]
xor ecx, esp
xor eax, eax
call fcn.008321db
add esp, 0x20c
ret
Function at 0x806d90
Capabilities:
Get common file path

Disassembly:
sub esp, 0x438
mov eax, dword [0x85f690]
xor eax, esp
mov dword [esp + 0x434], eax
push ebx
mov ebx, dword [esp + 0x440]
push ebp
push esi
mov esi, edx
xor ebp, ebp
push edi
mov edi, ecx
cmp esi, ebp
je 0x806ea4
xor eax, eax
cmp ax, word [esi]
je 0x806ea4
cmp edi, ebp
je 0x806ea4
xor ecx, ecx
cmp cx, word [edi]
je 0x806ea4
lea edx, [esp + 0x10]
push edx
push esi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call fcn.00820e56
test eax, eax
je 0x806ea4
push 0x206
lea ecx, [esp + 0x242]
xor eax, eax
push ebp
push ecx
mov word [esp + 0x248], ax
call fcn.00834280
add esp, 0xc
lea edx, [esp + 0x23c]
push edx
push ebp
push ebp
push 0x17
push ebp
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x806ea4
xor eax, eax
cmp eax, str.33wan
je 0x806e75
push str.33wan
lea ecx, [esp + 0x240]
push ecx
push str._s_s
mov edx, ecx
push 0x104
push edx
call fcn.00833827
lea eax, [esp + 0x250]
push eax
call fcn.00832cbc
add esp, 0x18
push edi
lea ecx, [esp + 0x240]
push ecx
push str._s_s.lnk
mov edx, ecx
push 0x104
push edx
call fcn.00833827
add esp, 0x14
push ebx
xor edi, edi
lea ebx, [esp + 0x240]
call fcn.00806fa0
jmp 0x806ea6
xor eax, eax
mov ecx, dword [esp + 0x444]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.008321db
add esp, 0x438
ret 4

Function at 0x806ed0
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x85f690]
xor eax, esp
mov dword [esp + 0x20c], eax
xor eax, eax
cmp ax, word [esi]
jne 0x806f02
xor eax, eax
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.008321db
add esp, 0x214
ret
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0xa]
push edx
mov word [esp + 0xc], cx
call fcn.00834280
add esp, 0xc
lea eax, [esp]
push eax
push 0
push 0
push 0x17
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x806eeb
xor ecx, ecx
cmp ecx, str.33wan
je 0x806f5b
push str.33wan
lea edx, [esp + 4]
push edx
push str._s_s
mov eax, edx
push 0x104
push eax
call fcn.00833827
add esp, 0x14
push esi
lea ecx, [esp + 4]
push ecx
push str._s_s.lnk
mov edx, ecx
push 0x104
push edx
call fcn.00833827
add esp, 0x14
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x20c]
neg eax
sbb eax, eax
xor ecx, esp
neg eax
call fcn.008321db
add esp, 0x214
ret