joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d41a0
Capabilities:
Delete registry key
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x121c
call fcn.0053f2e0
mov eax, dword [0x5f969c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x121c], ecx
push str._shellopencommand
mov eax, dword [ebp + 8]
push eax
push 0x588a6c
lea ecx, [ebp - 0x1010]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0x80c]
push edx
lea eax, [ebp - 0x1010]
push eax
push bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 0x810], eax
cmp dword [ebp - 0x810], 0
jne 0x4d4296
mov ecx, dword [ebp - 0x121c]
movzx edx, word [ecx + 0x20c]
test edx, edx
je 0x4d4233
mov eax, dword [ebp - 0x121c]
add eax, 0x20c
push eax
lea ecx, [ebp - 0x1218]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x4d4247
push 0x104
lea edx, [ebp - 0x1218]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.___1_
lea eax, [ebp - 0x1218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [ebp - 0x1218]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x1218]
push eax
push 1
push 0
mov ecx, dword [ebp - 0x80c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov dword [ebp - 0x810], eax
mov edx, dword [ebp - 0x80c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push str._shellPropertySheetHandlers
mov eax, dword [ebp + 8]
push eax
push 0x588ac0
lea ecx, [ebp - 0x1010]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push str._shellexopenddeexec
mov edx, dword [ebp + 8]
push edx
push 0x588afc
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x808]
push ecx
push bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push 0x588b08
mov edx, dword [ebp + 8]
push edx
push 0x588b18
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x808]
push ecx
push bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
xor eax, eax
cmp dword [ebp - 0x810], 0
sete al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053c85d
mov esp, ebp
pop ebp
ret 4

Function at 0x4d50c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], vtable.CReportInfo.0
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x50], 0
je 0x4d50f1
mov ecx, dword [ebp - 4]
add ecx, 0x24
call fcn.0043ad50
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
add ecx, 0x24
call fcn.004d5f30
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00438220
mov esp, ebp
pop ebp
ret
Function at 0x4d60f0
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x574cb4
mov eax, dword fs:[0]
push eax
sub esp, 0x28c
mov eax, dword [0x5f969c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00499480
test eax, eax
je 0x4d6269
push 0x11e
lea ecx, [ebp - 0x26c]
call fcn.0043aed0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4d61a7
push 0
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0
jne 0x4d61a7
mov dword [ebp - 0x274], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x26c]
call fcn.004a4750
mov eax, dword [ebp - 0x274]
jmp 0x4d6283
push str.ksis_setup.exe
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x21c]
push ecx
push 0x28
push 0x588e40
lea ecx, [ebp - 0x290]
call fcn.00408888
mov dword [ebp - 0x294], eax
mov edx, dword [ebp - 0x294]
mov dword [ebp - 0x298], edx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x298]
call fcn.0043e970
push eax
lea ecx, [ebp - 0x26c]
call fcn.0043b280
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x290]
call fcn.004088d3
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x248]
call fcn.004a4360
mov byte [ebp - 4], 2
push 0
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x248]
call fcn.004d62a0
push 0
lea edx, [ebp - 0x21c]
push edx
call fcn.004998e0
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x248]
call fcn.004a8d30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x26c]
call fcn.004a4750
jmp 0x4d627e
push 1
push 1
push 0
push 1
push str._download_kzNsis
call fcn.004997a0
add esp, 0x14
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053c85d
mov esp, ebp
pop ebp
ret
Function at 0x4d7190
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x588f70
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4d71d4
mov eax, dword [ebp - 4]
jmp 0x4d7259
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0xc]
sar ecx, 1
push ecx
mov edx, dword [ebp - 0xc]
push edx
lea ecx, [ebp - 0x10]
call fcn.0045e620
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
push 0x588f70
mov ecx, dword [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
call fcn.004dfdf0
push eax
push 0x588f60
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4d7246
jmp 0x4d7248
jmp 0x4d7203
mov edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
lea ecx, [ebp - 0x10]
call fcn.0044fc20
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x4d7c90
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x574e26
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5f969c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x48], 0
mov ecx, dword [ebp - 0x20]
call fcn.004d81e0
cmp dword [ebp + 0xc], 0
jl 0x4d7cec
push 0x588f9c
call fcn.0045f460
add esp, 4
push 0x588fa0
call fcn.0045f460
add esp, 4
jmp 0x4d7cf9
push 0x588fa8
call fcn.0045f460
add esp, 4
cmp dword [ebp + 0xc], 0
jl 0x4d7d7b
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x44], edx
push 0x48
call fcn.0053cf1e
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0
je 0x4d7d2f
mov ecx, dword [ebp - 0x14]
call fcn.004db7a0
mov dword [ebp - 0x24], eax
jmp 0x4d7d36
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
mov dword [ecx + 0x54], edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x54]
call fcn.004d8300
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x54]
push edx
mov ecx, dword [ebp - 0x20]
call fcn.004d8110
jmp 0x4d7dfe
push 0x4c
call fcn.0053cf1e
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x4d7da8
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004d8580
mov dword [ebp - 0x28], eax
jmp 0x4d7daf
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov dword [edx + 0x58], eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx + 0x58]
call fcn.004d83b0
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x58]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.004d8110
mov ecx, dword [ebp - 0x20]
add ecx, 0x3c
call fcn.004dfdf0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x4d7ee0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x5f969c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x220], ecx
cmp dword [ebp + 8], 0
je 0x4d807c
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.0053c870
add esp, 0xc
push 0x104
mov ecx, dword [ebp - 0x220]
add ecx, 0x38
call fcn.004dfdf0
push eax
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x588fac
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
lea ecx, [ebp - 0x218]
push ecx
mov ecx, dword [ebp - 0x220]
add ecx, 0x38
call fcn.004dfdf0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [ebp - 0x220]
add ecx, 0x38
call fcn.004dfdf0
push eax
mov ecx, dword [ebp - 0x220]
add ecx, 0x3c
call fcn.004dfdf0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov edx, dword [ebp - 0x220]
sub edx, 0x348
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 0x220]
add ecx, 0x40
call fcn.00401410
push eax
push 0
mov ecx, dword [ebp - 0x220]
add ecx, 0x38
call fcn.004dfdf0
push eax
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x42c
call fcn.0047feb0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4d7fef
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4d807a
mov ecx, dword [ebp - 0x220]
add ecx, 0x3c
call fcn.004dfdf0
push eax
mov ecx, dword [ebp - 0x220]
add ecx, 0x38
call fcn.004dfdf0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [ebp - 0x220]
add ecx, 0x38
call fcn.004dfdf0
push eax
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [ebp - 0x220]
add ecx, 0x40
call fcn.00401410
push eax
push 0
mov ecx, dword [ebp - 0x220]
add ecx, 0x38
call fcn.004dfdf0
push eax
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x42c
call fcn.0047feb0
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x220]
add ecx, 0x3c
call fcn.004dfdf0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4d8091
mov ecx, dword [ebp - 0x220]
add ecx, 0x3c
call fcn.004dfdf0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0053c85d
mov esp, ebp
pop ebp
ret 4
Function at 0x4d8ad0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x5f969c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x424], ecx
lea ecx, [ebp - 0x418]
call fcn.00452ff0
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0x588fe0
lea ecx, [ebp - 0x418]
call fcn.00453080
push 0x135
lea ecx, [ebp - 0x210]
push ecx
push 0x3ef
lea edx, [ebp - 0x41c]
push edx
mov ecx, dword [ebp - 0x424]
add ecx, 4
call fcn.00493e70
mov ecx, eax
call fcn.004dfdf0
push eax
mov ecx, dword [ebp - 0x424]
add ecx, 0x98
mov eax, dword [ebp - 0x424]
mov edx, dword [eax + 0x98]
mov eax, dword [edx + 0x10]
call eax
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push str.PauseBtn.bmp
lea ecx, [ebp - 0x418]
call fcn.00453080
push 0x83
lea edx, [ebp - 0x210]
push edx
push 0x3eb
lea eax, [ebp - 0x420]
push eax
mov ecx, dword [ebp - 0x424]
add ecx, 4
call fcn.00493e70
mov ecx, eax
call fcn.004dfdf0
push eax
mov ecx, dword [ebp - 0x424]
add ecx, 0xe0
mov edx, dword [ebp - 0x424]
mov eax, dword [edx + 0xe0]
mov edx, dword [eax + 0x10]
call edx
mov eax, dword [ebp - 0x424]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x70], ecx
push 0
push 0
mov edx, dword [ebp - 0x424]
push edx
push 0x4d9300
push 0
push 0
call fcn.0053ec8f
add esp, 0x18
push eax
mov ecx, dword [ebp - 0x424]
add ecx, 0x90
call fcn.00454da0
mov ecx, dword [ebp - 0x424]
call fcn.004d9050
push 0x3f9
mov ecx, dword [ebp - 0x424]
add ecx, 0x50
call fcn.004d9520
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053c85d
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4db820
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57521b
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5f969c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.CUpgradeSucceededDlg.0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x44], 0
jne 0x4db874
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0x40]
add ecx, 0x3c
call fcn.004dfdf0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.004db3f0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
call fcn.00484620
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4dc160
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5752b9
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x5f969c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x228], ecx
mov ecx, dword [ebp - 0x228]
call fcn.004dc730
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x228]
add ecx, 0x30
call fcn.00408982
mov byte [ebp - 4], 1
mov dword [ebp - 0x220], str.9EFE0473_AC32_4a6c_97A4_174509A51F78.txt
mov eax, dword [ebp - 0x220]
push eax
call fcn.004dc660
add esp, 4
xor ecx, ecx
mov word [ebp - 0x21c], cx
push 0x206
push 0
lea edx, [ebp - 0x21a]
push edx
call fcn.0053c870
add esp, 0xc
mov eax, dword [ebp - 0x220]
push eax
push 0x104
lea ecx, [ebp - 0x21c]
push ecx
call fcn.004dc590
add esp, 0xc
mov ecx, dword [ebp - 0x228]
add ecx, 0x30
call fcn.00406410
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4dc24c
mov edx, dword [ebp - 0x228]
add edx, 0x30
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x224], esp
push edx
call fcn.00408ba7
mov dword [ebp - 0x22c], eax
mov ecx, dword [ebp - 0x228]
call fcn.004dca00
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053c85d
mov esp, ebp
pop ebp
ret

Function at 0x4dc660
Capabilities:
Check if file exists
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x5f969c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.0053c870
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4dc6ca
xor eax, eax
jmp 0x4dc71d
xor eax, eax
mov word [ebp - 0x418], ax
push 0x206
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.0053c870
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 0x208
lea eax, [ebp - 0x418]
push eax
call fcn.004dc590
add esp, 0xc
test eax, eax
jne 0x4dc709
xor eax, eax
jmp 0x4dc71d
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053c85d
mov esp, ebp
pop ebp
ret
Function at 0x4dded0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x575711
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5f969c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x14]
call fcn.0045f300
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00476080
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x30
call fcn.00401410
push eax
call fcn.00476840
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jge 0x4ddf44
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00496090
mov eax, dword [ebp - 0x20]
jmp 0x4ddff9
cmp dword [ebp + 8], 0
je 0x4ddf55
mov ecx, dword [ebp + 8]
add ecx, 0x40
mov dword [ebp - 0x28], ecx
jmp 0x4ddf5c
mov dword [ebp - 0x28], 0
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x18], edx
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
push 0x4e1870
push 0
push 0
call fcn.0053ec8f
add esp, 0x18
push eax
lea ecx, [ebp - 0x10]
call fcn.004d7680
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.004dfdf0
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x18]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x14]
push edx
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x1c], eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004dfdf0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x28]
call eax
mov dword [ebp - 0x24], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0043f8e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00496090
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x4de420
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5f969c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
jge 0x4de468
push 0x104
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 8]
sub ecx, 0x40
call fcn.004e0470
push eax
call fcn.004d7190
add esp, 0xc
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4de4b6
push 0x104
lea edx, [ebp - 0x210]
push edx
mov ecx, dword [ebp + 8]
sub ecx, 0x40
call fcn.004e0470
push eax
call fcn.004d7190
add esp, 0xc
push 0
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 8]
sub ecx, 0x40
call fcn.004e0470
push eax
call fcn.00438fa0
add esp, 0xc
test eax, eax
jne 0x4de4b6
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053c85d
mov esp, ebp
pop ebp
ret 8
Function at 0x4dea70
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x575786
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x5f969c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x80], ecx
lea ecx, [ebp - 0x48]
call fcn.004513a0
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x4dead8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x78]
call fcn.004061d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x78]
push ecx
lea ecx, [ebp - 0x48]
call fcn.0044fd20
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x78]
call fcn.00406210
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x30]
call fcn.004061d0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x30]
push eax
call fcn.00494550
add esp, 4
test eax, eax
je 0x4deb06
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x48]
call fcn.0044fd20
jmp 0x4deae8
mov dword [ebp - 0x4c], 0
lea ecx, [ebp - 0x48]
call fcn.0044fcb0
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
sub edx, 1
mov dword [ebp - 0x50], edx
jmp 0x4deb2c
mov eax, dword [ebp - 0x50]
sub eax, 1
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jl 0x4debc8
mov ecx, dword [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x48]
call fcn.004560f0
mov ecx, eax
call fcn.00406410
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xffffffff
jne 0x4deb89
push 0
mov edx, dword [ebp - 0x50]
push edx
lea ecx, [ebp - 0x48]
call fcn.004560f0
mov ecx, eax
call fcn.00406410
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x4deb87
mov eax, dword [ebp - 0x4c]
add eax, 1
mov dword [ebp - 0x4c], eax
jmp 0x4debc3
mov ecx, dword [ebp - 0x54]
and ecx, 0x10
jne 0x4debc3
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x50]
push eax
lea ecx, [ebp - 0x48]
call fcn.004560f0
mov ecx, eax
call fcn.00406410
push eax
mov ecx, dword [ebp - 0x80]
call fcn.004dec10
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x4debc3
mov ecx, dword [ebp - 0x4c]
add ecx, 1
mov dword [ebp - 0x4c], ecx
jmp 0x4deb23
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 0x7c], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00406210
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00451490
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0053c85d
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4dec10
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5757b6
mov eax, dword fs:[0]
push eax
sub esp, 0x468
mov eax, dword [0x5f969c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x470], ecx
push 0x104
lea eax, [ebp - 0x42c]
push eax
mov ecx, dword [ebp - 0x470]
call fcn.004df480
lea ecx, [ebp - 0x42c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea edx, [ebp - 0x42c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax*2]
push edx
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x430], 0
jmp 0x4decb8
mov edx, dword [ebp - 0x430]
add edx, 1
mov dword [ebp - 0x430], edx
mov eax, dword [ebp - 0x430]
cmp eax, dword [ebp + 0xc]
jae 0x4dee1a
mov ecx, dword [ebp - 0x470]
add ecx, 0x30
call fcn.00401410
mov dword [ebp - 0x474], eax
lea ecx, [ebp - 0x46c]
push ecx
push 3
mov edx, dword [ebp - 0x430]
push edx
mov eax, dword [ebp - 0x474]
push eax
mov ecx, dword [ebp - 0x474]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
call eax
lea ecx, [ebp - 0x434]
call fcn.00401420
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x464]
push ecx
lea ecx, [ebp - 0x434]
call fcn.0045a0d0
lea edx, [ebp - 0x21c]
push edx
lea ecx, [ebp - 0x434]
call fcn.00401410
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4ded57
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x434]
call fcn.00401430
jmp 0x4deca9
mov dword [ebp - 0x458], 0
xor eax, eax
mov dword [ebp - 0x454], eax
mov dword [ebp - 0x450], eax
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x444], eax
mov dword [ebp - 0x440], eax
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x438], eax
lea ecx, [ebp - 0x458]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
cmp dword [ebp - 0x438], 0
jne 0x4dee01
cmp dword [ebp - 0x43c], 0
jne 0x4dee01
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jne 0x4dee01
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x470]
add ecx, 0xc
call fcn.004dfdf0
push eax
call fcn.0049c1a0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x434]
call fcn.00401430
jmp 0x4dee1a
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053c85d
mov esp, ebp
pop ebp
ret 8