joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100049c0
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xffffffffffffffff
push 0x100394e0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x1004f860]
xor eax, ebp
mov dword [ebp + 0x208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x214]
xor eax, eax
mov word [edi], ax
mov dword [ebp - 4], eax
lea ecx, [ebp]
push ecx
push eax
push eax
push 0x1a
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
jns 0x10004a38
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__szPath_
call fcn.10005b30
add esp, 8
push 0
push esi
call fcn.10030fd0
lea edx, [ebp]
push edx
lea ecx, [ebp - 0x18]
call fcn.10002e00
cmp dword [eax], 0
je 0x10004a4f
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x10004a51
xor eax, eax
push 0x104
push eax
mov eax, dword [ebp + 0x218]
push eax
push edi
call dword [sym.imp.MSVCR100.dll_wcsncpy_s]
add esp, 0x10
lea ecx, [ebp - 0x18]
call fcn.10002330
mov dword [ebp - 4], 0xffffffff
jmp 0x10004aa6
xor eax, eax
test esi, esi
setns al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.1003779c
lea esp, [ebp + 0x20c]
pop ebp
ret

Function at 0x10004ef0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x21c
mov eax, dword [0x1004f860]
xor eax, esp
mov dword [esp + 0x218], eax
push str.JAVA_REGDEPLOY_DEBUG
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.MSVCR100.dll__wdupenv_s]
add esp, 0xc
test eax, eax
jne 0x10004fba
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
cmp dword [0x1004fba4], 0
jne 0x10004fd6
lea eax, [esp + 0x10]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
cmp eax, 0x104
ja 0x10004fba
test eax, eax
je 0x10004fba
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 4]
call fcn.10002e00
push str.JavaDeployReg.log
lea ecx, [esp + 8]
call fcn.10002e00
lea edx, [esp + 4]
push edx
lea ecx, [esp + 4]
call fcn.10004760
lea ecx, [esp + 4]
call fcn.10002330
mov eax, dword [esp]
test eax, eax
je 0x10004f98
mov eax, dword [eax]
jmp 0x10004f9a
xor eax, eax
push 0x1003b100
push eax
push 0x1004fba4
call dword [sym.imp.MSVCR100.dll__wfopen_s]
add esp, 0xc
lea ecx, [esp]
test eax, eax
je 0x10004fd1
call fcn.10002330
xor eax, eax
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.1003779c
add esp, 0x21c
ret
call fcn.10002330
mov ecx, dword [esp + 0x218]
xor ecx, esp
mov eax, 1
call fcn.1003779c
add esp, 0x21c
ret
Function at 0x10005940
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x1044
call fcn.100378e0
mov eax, dword [0x1004f860]
xor eax, esp
mov dword [esp + 0x1040], eax
push esi
mov esi, dword [esp + 0x104c]
push edi
mov edi, dword [esp + 0x1054]
xor eax, eax
push 0x7fe
push eax
lea ecx, [esp + 0x852]
push ecx
mov word [esp + 0x854], ax
call sub.MSVCR100.dll_memset
push edi
push esi
push 0xffffffffffffffff
lea edx, [esp + 0x860]
push 0x400
push edx
call dword [sym.imp.MSVCR100.dll__vsnwprintf_s]
add esp, 0x20
test eax, eax
jns 0x100059ad
xor eax, eax
mov word [esp + 0x1046], ax
xor ecx, ecx
push 0x3e
push ecx
lea edx, [esp + 0x12]
push edx
mov word [esp + 0x14], cx
call sub.MSVCR100.dll_memset
lea eax, [esp + 0x14]
push 0x20
push eax
call fcn.100058a0
push 0x1003b988
lea ecx, [esp + 0x20]
push 0x20
push ecx
call dword [sym.imp.MSVCR100.dll_wcscat_s]
xor edx, edx
push 0x7fe
push edx
lea eax, [esp + 0x72]
push eax
mov word [esp + 0x74], dx
call sub.MSVCR100.dll_memset
mov eax, esi
add esp, 0x2c
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10005a00
sub eax, edx
sar eax, 1
cmp eax, 6
jbe 0x10005a54
mov ecx, str.__08x_
lea eax, [esi + eax*2 - 0xc]
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10005a46
test dx, dx
je 0x10005a42
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10005a46
add eax, 4
add ecx, 4
test dx, dx
jne 0x10005a20
xor eax, eax
jmp 0x10005a4b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10005a54
lea edi, [eax + 1]
jmp 0x10005a56
xor edi, edi
lea eax, [esp + 8]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10005a60
sub eax, edx
sar eax, 1
mov esi, eax
mov eax, str.Error:
test edi, edi
jne 0x10005a7f
mov eax, 0x1003a9fc
lea ecx, [esp + 0x848]
push ecx
push eax
lea edi, [esi + esi]
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
push 0x1003b940
mov edx, 0x3ff
push 0xffffffffffffffff
sub edx, esi
push edx
lea eax, [esp + edi + 0x64]
push eax
call dword [sym.imp.MSVCR100.dll__snwprintf_s]
add esp, 0x20
test eax, eax
jns 0x10005ad7
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x1003b938]
mov word [esp + eax + 0x83e], cx
add eax, 2
test cx, cx
jne 0x10005ac0
push edi
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x50]
push edx
call sub.MSVCR100.dll_memcpy
lea edi, [esp + 0x54]
add esp, 0xc
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10005af1
mov eax, dword [0x1003b934]
lea ecx, [esp + 0x48]
push ecx
mov dword [edi], eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [esp + 0x1048]
pop edi
pop esi
xor ecx, esp
call fcn.1003779c
add esp, 0x1044
ret

Function at 0x10005cb0
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 4]
push 4
lea eax, [esp + 0xc]
push eax
mov eax, dword [ecx]
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8
Function at 0x10005e70
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1870
call fcn.100378e0
mov eax, dword [0x1004f860]
xor eax, esp
mov dword [esp + 0x186c], eax
push 0x400
lea eax, [esp + 0x1070]
push eax
push 1
push 0x1003bb30
call fcn.10004030
add esp, 0x10
test eax, eax
je 0x10005f99
lea ecx, [esp + 0x106c]
push ecx
push str._s_ssvagent.exe
lea edx, [esp + 0x874]
push 0x400
push edx
call dword [sym.imp.MSVCR100.dll_swprintf_s]
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x880]
push ecx
call dword [sym.imp.MSVCR100.dll__wstat64i32]
add esp, 0x18
test eax, eax
jne 0x10005f99
xor edx, edx
mov word [esp + 0x6c], dx
cmp byte [esp + 0x187c], dl
je 0x10005f0b
push str.__forceinstall__register__new__high
push 0x104
lea eax, [esp + 0x74]
push eax
jmp 0x10005f1a
push str.__disablewebjava
push 0x104
lea ecx, [esp + 0x74]
push ecx
call dword [sym.imp.MSVCR100.dll_wcscat_s]
add esp, 0xc
push 0x3c
lea edx, [esp + 4]
push 0
push edx
call sub.MSVCR100.dll_memset
lea eax, [esp + 0x78]
add esp, 0xc
mov dword [esp], 0x3c
mov dword [esp + 0x14], eax
call fcn.100034e0
test eax, eax
je 0x10005f54
mov dword [esp + 0xc], str.runas
lea edx, [esp]
lea ecx, [esp + 0x86c]
push edx
mov dword [esp + 8], 0x40
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x10005f99
mov eax, dword [esp + 0x38]
test eax, eax
je 0x10005f99
push 0xffffffffffffffff
push eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x38]
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ecx, dword [esp + 0x186c]
xor ecx, esp
call fcn.1003779c
add esp, 0x1870
ret 0xc

Function at 0x10005fb0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov dword [esp + 4], 0
call fcn.100034e0
test eax, eax
jne 0x10005fc8
add esp, 0x10
ret
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000602d
mov eax, 4
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 4]
lea edx, [esp + 8]
push edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push 0
push str.EnableLUA
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [esp + 4], 1
sete al
add esp, 0x10
ret
mov eax, 1
add esp, 0x10
ret
Function at 0x10006060
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x1004f860]
xor eax, esp
mov dword [esp + 0x114], eax
cmp dword [0x1004fbf4], 0
je 0x10006097
mov eax, dword [0x1004fbf0]
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.1003779c
add esp, 0x118
ret
push 0x114
lea eax, [esp + 4]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.kernel32.dll_GetVersionExW]
cmp dword [esp + 4], 5
mov ecx, 1
jne 0x100060d3
cmp dword [esp + 8], ecx
jb 0x100060d3
mov eax, ecx
jmp 0x100060d5
xor eax, eax
mov dword [0x1004fbf4], ecx
mov ecx, dword [esp + 0x114]
xor ecx, esp
mov dword [0x1004fbf0], eax
call fcn.1003779c
add esp, 0x118
ret

Function at 0x10006100
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x20
mov eax, dword [0x1004f860]
xor eax, esp
mov dword [esp + 0x1c], eax
mov ecx, dword [str.Control_PanelDesktopWindowMetrics]
push esi
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push ecx
push SysReAllocStringLen
or esi, 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000619b
lea edx, [esp + 8]
push edx
mov edx, dword [0x1004f198]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x20], 8
mov dword [esp + 0x24], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000618d
mov eax, dword [esp + 8]
cmp eax, 8
jae 0x1000617b
xor ecx, ecx
mov word [esp + eax*2 + 0x10], cx
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.MSVCR100.dll__wtoi]
add esp, 4
mov esi, eax
jmp 0x10006190
or esi, 0xffffffff
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1003779c
add esp, 0x20
ret 8

Function at 0x100061b0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x1004f860]
xor eax, esp
mov dword [esp + 0x114], eax
cmp dword [0x1004fbfc], 0
je 0x100061e7
mov eax, dword [0x1004fbf8]
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.1003779c
add esp, 0x118
ret
push 0x114
lea eax, [esp + 4]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.kernel32.dll_GetVersionExW]
mov ecx, 2
cmp dword [esp + 0x10], ecx
jne 0x10006227
mov eax, dword [esp + 4]
cmp eax, 6
jne 0x1000624d
cmp dword [esp + 8], ecx
jae 0x1000624f
xor eax, eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
mov dword [0x1004fbf8], eax
mov dword [0x1004fbfc], 1
call fcn.1003779c
add esp, 0x118
ret
jbe 0x10006227
mov eax, 1
jmp 0x10006229
Function at 0x10006a70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100395c0
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x1004f860]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push eax
lea ecx, [ebp - 0x21a]
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
lea edx, [ebp - 0x21c]
push edx
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
jns 0x10006afa
push esi
push str.Error:_08x_in_::SHGetFolderPath_NULL__CSIDL_LOCAL_APPDATA__NULL__0__szLocalPath_
call fcn.10005b30
add esp, 8
push 0
push esi
call fcn.10030fd0
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCR100.dll_wcsnlen]
add esp, 8
mov ecx, dword [edi]
push eax
lea edx, [ebp - 0x21c]
push edx
push edi
mov eax, dword [ecx + 0x28c]
call eax
jmp 0x10006b50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1003779c
mov esp, ebp
pop ebp
ret 8

Function at 0x10006b70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100395f0
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x1004f860]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push eax
lea ecx, [ebp - 0x21a]
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
lea edx, [ebp - 0x21c]
push edx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
jns 0x10006bfa
push esi
push str.Error:_08x_in_::SHGetFolderPath_NULL__CSIDL_APPDATA__NULL__0__szLocalPath_
call fcn.10005b30
add esp, 8
push 0
push esi
call fcn.10030fd0
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCR100.dll_wcsnlen]
add esp, 8
mov ecx, dword [edi]
push eax
lea edx, [ebp - 0x21c]
push edx
push edi
mov eax, dword [ecx + 0x28c]
call eax
jmp 0x10006c50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1003779c
mov esp, ebp
pop ebp
ret 8
Function at 0x10006c70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10039620
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x1004f860]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push eax
lea ecx, [ebp - 0x21a]
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
lea edx, [ebp - 0x21c]
push edx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
jns 0x10006cfa
push esi
push str.Error:_08x_in_::SHGetFolderPath_NULL__CSIDL_COMMON_APPDATA__NULL__0__szPath_
call fcn.10005b30
add esp, 8
push 0
push esi
call fcn.10030fd0
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCR100.dll_wcsnlen]
add esp, 8
mov ecx, dword [edi]
push eax
lea edx, [ebp - 0x21c]
push edx
push edi
mov eax, dword [ecx + 0x28c]
call eax
jmp 0x10006d50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1003779c
mov esp, ebp
pop ebp
ret 8
Function at 0x10008190
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x1024
call fcn.100378e0
mov eax, dword [0x1004f860]
xor eax, esp
mov dword [esp + 0x1020], eax
mov eax, dword [esp + 0x1030]
mov ecx, dword [esp + 0x1028]
push ebx
mov bl, byte [esp + 0x1038]
push ebp
xor ebp, ebp
cmp eax, ebp
je 0x10008322
push esi
push edi
push eax
push ecx
lea eax, [esp + 0x18]
push eax
call fcn.10002e60
mov ecx, dword [str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall]
add esp, 0xc
xor edx, edx
cmp bl, 1
sete dl
push 0x2001f
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
add edx, 0x80000001
push edx
call fcn.10003190
test eax, eax
jne 0x100082d1
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
cmp eax, ebp
je 0x1000822a
mov eax, dword [eax]
jmp 0x1000822c
xor eax, eax
mov esi, dword [esp + 0x14]
push ebp
push ebp
push 0x2001f
push ebp
push ebp
push eax
push esi
lea ecx, [esp + 0x3c]
call fcn.10005c00
mov edi, dword [esp + 0x20]
test eax, eax
jne 0x100082b7
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x34]
push ecx
push ebp
push ebp
push str.UninstallString
push edi
mov dword [esp + 0x44], 0x800
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [esp + 0x30]
push 0x1003c394
push edx
call dword [sym.imp.MSVCR100.dll_wcsstr]
add esp, 8
test eax, eax
je 0x1000828a
mov ebx, 1
cmp edi, ebp
je 0x10008297
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
cmp ebx, ebp
je 0x100082b7
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x100082a7
mov eax, dword [eax]
jmp 0x100082a9
xor eax, eax
push eax
lea ecx, [esp + 0x18]
call fcn.10003d00
mov esi, dword [esp + 0x14]
cmp esi, ebp
je 0x100082c4
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
cmp edi, ebp
je 0x100082d5
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100082d5
mov esi, dword [esp + 0x14]
cmp esi, ebp
je 0x100082e0
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x10]
cmp esi, ebp
je 0x10008320
lea eax, [esi + 8]
push eax
call dword [sym.imp.kernel32.dll_InterlockedDecrement]
test eax, eax
jne 0x10008320
cmp esi, ebp
je 0x10008320
mov eax, dword [esi]
cmp eax, ebp
je 0x10008307
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
cmp eax, ebp
je 0x10008317
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
add esp, 4
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
pop esi
mov ecx, dword [esp + 0x1028]
pop ebp
pop ebx
xor ecx, esp
call fcn.1003779c
add esp, 0x1024
ret 0x10
Function at 0x100087a0
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x624
mov eax, dword [0x1004f860]
xor eax, esp
mov dword [esp + 0x620], eax
test byte [0x1004fc04], 1
jne 0x100087db
or dword [0x1004fc04], 1
push 0x10039ab0
mov dword [0x1004fc00], 0
call fcn.10030fd0
add esp, 4
mov eax, dword [0x1004fc00]
test eax, eax
je 0x100087f9
mov eax, dword [eax]
test eax, eax
je 0x100087f9
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
jne 0x10008946
lea eax, [esp + 0x210]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x10008946
push esi
push edi
lea ecx, [esp + 0x218]
push ecx
lea ecx, [esp + 0xc]
call fcn.10002e00
push str.jawshtml.html
lea ecx, [esp + 0x10]
call fcn.10006920
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0xc]
call fcn.10004760
lea ecx, [esp + 0xc]
call fcn.10002330
mov edi, dword [esp + 8]
test edi, edi
je 0x1000885c
mov eax, dword [edi]
jmp 0x1000885e
xor eax, eax
push 0x1003c434
push eax
call dword [sym.imp.MSVCR100.dll__wfopen]
mov esi, eax
push esi
push str._HTML___HTML_
call dword [sym.imp.MSVCR100.dll_fputws]
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
xor eax, eax
xor ecx, ecx
add esp, 0x14
mov word [esp + 0x10], ax
mov word [esp + 0x420], cx
test edi, edi
je 0x1000889b
mov edi, dword [edi]
jmp 0x1000889d
xor edi, edi
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x424]
push eax
push edi
call dword [sym.imp.SHELL32.dll_FindExecutableW]
cmp eax, 0x20
jle 0x1000892a
lea eax, [esp + 0x10]
xor ecx, ecx
lea esi, [eax + 2]
nop
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x100088c0
sub eax, esi
sar eax, 1
cmp word [esp + 0x10], cx
je 0x100088f3
lea edx, [esp + 0x10]
lea ebx, [ebx]
cmp word [edx], 0x20
jne 0x100088f3
inc ecx
cmp word [esp + ecx*2 + 0x10], 0
lea edx, [esp + ecx*2 + 0x10]
jne 0x100088e0
cmp eax, ecx
jle 0x1000892a
lea edx, [esp + eax*2 + 0xe]
jmp 0x10008900
cmp word [edx], 0x20
jne 0x10008910
dec eax
sub edx, 2
cmp eax, ecx
jg 0x10008900
jmp 0x1000892a
cmp eax, ecx
jle 0x1000892a
xor edx, edx
mov word [esp + eax*2 + 0x10], dx
lea eax, [esp + ecx*2 + 0x10]
push eax
mov ecx, 0x1004fc00
call fcn.10006f80
lea ecx, [esp + 0x218]
push ecx
call dword [sym.imp.MSVCR100.dll__wremove]
add esp, 4
lea ecx, [esp + 8]
call fcn.10002330
pop edi
pop esi
mov ecx, dword [esp + 0x620]
xor ecx, esp
mov eax, 0x1004fc00
call fcn.1003779c
add esp, 0x624
ret
Function at 0x10008c30
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
sub esp, 0x254
mov eax, dword [0x1004f860]
xor eax, esp
mov dword [esp + 0x250], eax
mov eax, dword [esp + 0x258]
push esi
push str.msvcrt.dll
mov dword [esp + 0xc], eax
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x10008c79
pop esi
mov ecx, dword [esp + 0x250]
xor ecx, esp
call fcn.1003779c
add esp, 0x254
ret 8
push ebx
push ebp
push edi
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str._wopen
push esi
call edi
push 0x1003c4b0
push esi
mov ebx, eax
call edi
push 0x1003c4a8
push esi
mov dword [esp + 0x24], eax
call edi
push 0x1003c4a0
push esi
mov ebp, eax
call edi
push str._fstat
push esi
mov dword [esp + 0x20], eax
call edi
push 0x1003c490
push esi
mov dword [esp + 0x28], eax
call edi
push 0x1003c488
push esi
mov dword [esp + 0x18], eax
call edi
mov dword [esp + 0x24], eax
test ebx, ebx
je 0x10008dde
cmp dword [esp + 0x1c], 0
je 0x10008dde
test ebp, ebp
je 0x10008dde
cmp dword [esp + 0x18], 0
je 0x10008dde
cmp dword [esp + 0x20], 0
je 0x10008dde
cmp dword [esp + 0x10], 0
je 0x10008dde
test eax, eax
je 0x10008dde
lea ecx, [esp + 0x58]
push ecx
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
lea edx, [esp + 0x58]
push 0
push edx
call dword [sym.imp.MSVCR100.dll__wtempnam]
push 0x1b6
push 0x102
push eax
call ebx
push 1
mov esi, eax
call dword [esp + 0x34]
push 1
push esi
mov ebx, eax
call ebp
add esp, 0x20
push str.jvm.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x10008d76
push str._JVM_DumpAllStacks_8
push eax
call edi
test eax, eax
je 0x10008d76
mov ecx, dword [esp + 0x14]
push 0
push ecx
call eax
push 1
push ebx
call ebp
push 0
push 0
push esi
call dword [esp + 0x2c]
lea edx, [esp + 0x3c]
push edx
push esi
call dword [esp + 0x3c]
mov ebp, dword [esp + 0x58]
add esp, 0x1c
xor edi, edi
test ebp, ebp
jle 0x10008db3
lea eax, [ebp + 1]
push 1
push eax
call dword [sym.imp.MSVCR100.dll_calloc]
mov edi, eax
push ebp
push edi
push esi
call dword [esp + 0x24]
add esp, 0x14
xor ebx, ebx
test edi, edi
je 0x10008dcb
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x29c]
push edi
push eax
call edx
mov ebx, eax
push edi
call dword [sym.imp.MSVCR100.dll_free]
push esi
call dword [esp + 0x2c]
add esp, 8
mov eax, ebx
jmp 0x10008de0
xor eax, eax
mov ecx, dword [esp + 0x260]
pop edi
pop ebp
pop ebx
pop esi
xor ecx, esp
call fcn.1003779c
add esp, 0x254
ret 8