joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d180
Capabilities:
Delete file

Disassembly:
mov ecx, 0x5529c8
call fcn.00416e40
mov eax, dword [0x5b6ed4]
test eax, eax
je 0x41d1ab
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x5b6ed4], 0
mov eax, dword [0x5afa74]
push esi
cmp eax, 7
push edi
jne 0x41d1f0
push 0x3a
call fcn.0046a9d0
mov esi, dword [sym.imp.USER32.dll_SetDlgItemTextW]
add esp, 4
push eax
mov eax, dword [0x5b6ed0]
push 2
push eax
call esi
push 0xc358
call fcn.0046a9d0
mov ecx, dword [0x5b6ed0]
add esp, 4
push eax
push 0x421
push ecx
call esi
jmp 0x41d210
push 0xc359
call fcn.0046a9d0
mov edx, dword [0x5b6ed0]
add esp, 4
push eax
push 0x421
push edx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 0x5afa98
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0x5b6ed0]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push 2
push eax
call esi
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call edi
mov ecx, dword [0x5b6ed0]
push 1
push 4
push ecx
call esi
push eax
call edi
mov ecx, 0x5529c8
call fcn.00416b10
pop edi
pop esi
ret
Function at 0x41d2f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x830
mov al, byte [0x54ea08]
push ebx
push ebp
push esi
push edi
mov byte [esp + 0x1c], al
mov ecx, 0x208
xor eax, eax
lea edi, [esp + 0x1d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x854]
test eax, eax
je 0x41d456
mov esi, dword [esp + 0x850]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov ecx, dword [esp + 0x84c]
push eax
push ecx
push str.___________________________7d9114302a0cb6
push str.___s_r_nContent_Disposition:_form_data__name__s___filename__s__r_nContent_Type:_application_octet_stream_r_n_r_n
lea edx, [esp + 0x2c]
push 0x823
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
lea edi, [esp + 0x34]
or ecx, 0xffffffff
xor eax, eax
push 0x4d001c
repne scasb al, byte es:[edi]
not ecx
dec ecx
push esi
mov ebp, ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, eax
add esp, 0x20
test ebx, ebx
je 0x41d43e
mov esi, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push 0
push ebx
call esi
push ebx
call dword [sym.imp.MSVCRT.dll_ftell]
push 0
mov edi, eax
push 0
push ebx
mov dword [esp + 0x34], edi
call esi
mov ecx, dword [esp + 0x864]
add edi, ebp
add esp, 0x1c
mov dword [esp + 0x10], edi
mov edx, dword [ecx]
lea eax, [edi + 2]
cmp eax, edx
mov dword [esp + 0x14], eax
jae 0x41d423
mov eax, dword [esp + 0x844]
mov ecx, ebp
mov edx, ecx
lea esi, [esp + 0x1c]
mov edi, eax
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 1
and ecx, 3
add ebp, eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x20]
push ecx
push ebp
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x854]
mov dx, word [0x4d0018]
add esp, 0x10
mov word [eax + ecx], dx
mov eax, dword [esp + 0x848]
mov edx, dword [esp + 0x14]
push ebx
mov dword [eax], edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x830
ret
push ebx
mov dword [ecx], 0
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x830
ret
mov ecx, dword [esp + 0x848]
pop edi
pop esi
pop ebp
mov dword [ecx], 0
pop ebx
add esp, 0x830
ret
mov edx, dword [esp + 0x850]
mov eax, dword [esp + 0x84c]
push edx
push eax
push str.___________________________7d9114302a0cb6
push str.___s_r_nContent_Disposition:_form_data__name__s__r_n_r_n_s_r_n
lea ecx, [esp + 0x2c]
push 0x823
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
lea edi, [esp + 0x34]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x848]
not ecx
dec ecx
mov eax, ecx
mov ecx, dword [edx]
cmp eax, ecx
jae 0x41d4c8
mov edi, dword [esp + 0x844]
mov ecx, eax
mov ebx, ecx
lea esi, [esp + 0x1c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
mov dword [edx], eax
pop ebx
add esp, 0x830
ret
pop edi
pop esi
pop ebp
mov dword [edx], 0
pop ebx
add esp, 0x830
ret
Function at 0x41db30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
push ebx
push esi
lea eax, [ebp - 4]
push edi
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0041d4e0
add esp, 4
cmp eax, ebx
mov dword [0x5b6ed4], eax
je 0x41dcf4
mov dx, word [0x4e6b30]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x412]
mov word [ebp - 0x414], dx
mov word [ebp - 0x20c], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x20c]
push ecx
push 0x103
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x20c]
push 0x4ce840
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ecx, 0x5529c8
call fcn.00416b10
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
push str.http:__doctor.se.360.cn_index.php_doadderrorlog
mov ecx, 0x412
xor eax, eax
mov edi, 0x5afea8
push 0x4ce4dc
push 0x824
push 0x5afea8
rep stosd dword es:[edi], eax
call esi
mov ecx, 0x82
xor eax, eax
mov edi, 0x5afa98
add esp, 0x10
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x414]
push ecx
push 0x4ce4dc
push 0x104
push 0x5afa98
call esi
mov dx, word [0x4e6b30]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x61a]
mov word [ebp - 0x61c], dx
add esp, 0x10
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, str.___________________________7d9114302a0cb6
mov dword [0x55506c], 0x2710
test eax, eax
mov dword [0x555064], 0x41dd10
mov dword [0x555060], ebx
je 0x41dc96
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
lea eax, [edi + edi]
add eax, 3
and al, 0xfc
call fcn.004b7a60
mov ebx, esp
push edi
push ebx
push 0xffffffffffffffff
push str.___________________________7d9114302a0cb6
push 0
push 0
mov word [ebx], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push str.multipart_form_data__boundary_s
lea ecx, [ebp - 0x61c]
push 0x103
push ecx
call esi
mov eax, dword [ebp - 4]
mov edx, dword [0x5b6ed4]
mov dword [0x554e48], eax
mov ecx, 0x82
xor eax, eax
mov edi, 0x554e4c
mov dword [0x554e44], edx
add esp, 0x10
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x61c]
push ecx
push 0x4ce4dc
push 0x104
push 0x554e4c
call esi
add esp, 0x10
mov ecx, 0x5529c8
call fcn.00416a40
lea esp, [ebp - 0x628]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41dd50
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
push ebp
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebp, eax
test ebp, ebp
je 0x41de47
push ebx
push esi
push str.MiniDumpWriteDump
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x41de3e
mov ax, word [0x4e6b30]
push edi
mov word [esp + 0x1c], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1e]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1c]
push ecx
push 0x103
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x5b6cc8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea edx, [esp + 0x24]
push 0x4ce840
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x5b6cc8
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
pop edi
cmp esi, 0xffffffff
je 0x41de3e
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [esp + 0x224]
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
push esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
pop ebx
pop ebp
add esp, 0x214
ret
Function at 0x41de50
Capabilities:
Delete file
Get common file path

Disassembly:
mov eax, 0x1458
call fcn.004b7a60
push esi
push edi
mov ecx, 0x411
xor eax, eax
lea edi, [esp + 0x41a]
mov word [esp + 0x418], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x4e6b6c]
push eax
push str.3.1.0.8
call fcn.0046a750
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
push eax
push str.http:__pvstat.qihoo.com_dimana.gif__pdt360sebq_dim_kpid__guid__ver_dim_v360se___s___sm_d
lea eax, [esp + 0x428]
push 0x823
push eax
call esi
mov ecx, 0x412
xor eax, eax
mov edi, 0x5afea8
add esp, 0x18
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x418]
push ecx
push 0x4ce4dc
push 0x824
push 0x5afea8
call esi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x222]
mov word [esp + 0x220], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], 0
rep stosd dword es:[edi], eax
add esp, 0x10
lea edx, [esp + 0x210]
stosw word es:[edi], ax
push edx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea ecx, [esp + 0x218]
push 0x4d024c
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea edx, [esp + 8]
mov ecx, 0x82
push edx
xor eax, eax
mov edi, 0x5afa98
push 0x4ce4dc
push 0x104
push 0x5afa98
rep stosd dword es:[edi], eax
call esi
add esp, 0x10
mov ecx, 0x5529c8
mov dword [0x554e2c], 1
mov dword [0x55506c], 0x1388
call fcn.00416a40
mov ecx, 0x5529c8
call fcn.00416e40
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0x5529c8
call fcn.00416b10
pop edi
pop esi
add esp, 0x1458
ret
Function at 0x41fba0
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0xa28
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov ebx, dword [esp + 0xa3c]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x21a]
mov word [esp + 0x218], bp
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
push ebx
stosw word es:[edi], ax
push 0x4ce4dc
lea eax, [esp + 0x220]
push 0x103
push eax
call esi
mov edi, dword [sym.imp.MSVCRT.dll_wcsrchr]
lea ecx, [esp + 0x228]
push 0x5c
push ecx
call edi
add esp, 0x18
test eax, eax
je 0x41fc16
add eax, 2
lea edx, [esp + 0x218]
push eax
push edx
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
lea eax, [esp + 0x218]
push 0x2e
push eax
call edi
xor edx, edx
add esp, 8
cmp eax, edx
je 0x41fc2e
mov word [eax], dx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x62a]
mov word [esp + 0x628], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], dx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x628]
push ecx
push 0x103
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [esp + 0x218]
lea eax, [esp + 0x628]
push edx
push eax
push str._sTheWorld_skin_s_
lea ecx, [esp + 0x1c]
push 0x103
push ecx
call esi
lea edx, [esp + 0x24]
push edx
call fcn.0042c500
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.004b6a10
mov cx, word [0x4e6b30]
xor eax, eax
mov word [esp + 0x440], cx
mov ecx, 0x81
lea edi, [esp + 0x442]
add esp, 0x20
rep stosd dword es:[edi], eax
push str.Skin
push 0x4e6d94
push 0x4cea74
lea edx, [esp + 0x42c]
push 0x103
push edx
stosw word es:[edi], ax
call esi
lea eax, [esp + 0x434]
push eax
call fcn.0042c500
mov cx, word [0x4e6b30]
xor eax, eax
mov word [esp + 0x848], cx
mov ecx, 0x81
lea edi, [esp + 0x84a]
add esp, 0x18
rep stosd dword es:[edi], eax
lea edx, [esp + 0x10]
stosw word es:[edi], ax
push edx
push str._sskin.ini
lea eax, [esp + 0x838]
push 0x103
push eax
call esi
lea ecx, [esp + 0x840]
push 0
push ecx
call fcn.0042bc40
add esp, 0x18
test eax, eax
je 0x41fd63
lea edx, [esp + 0x420]
push 1
lea eax, [esp + 0x14]
push edx
push eax
call fcn.0042cd60
add esp, 0xc
mov ebp, 1
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [esp + 0x10]
push edx
call esi
push 0
push ebx
call fcn.0042cbb0
add esp, 8
push ebx
call esi
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0xa28
ret 4
Function at 0x41fe20
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bae70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x668
push ebx
push esi
mov dword [ebp - 0x14], ecx
push edi
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x672]
mov word [ebp - 0x674], bx
mov dword [ebp - 0x10], esp
rep stosd dword es:[edi], eax
mov ecx, dword [0x5c01a4]
push ebx
stosw word es:[edi], ax
lea eax, [ebp - 0x674]
push 0x103
push eax
push ecx
call fcn.0042bc50
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x46a]
mov word [ebp - 0x46c], bx
mov edx, dword [ebp + 8]
add esp, 0x10
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x4d049c
lea eax, [ebp - 0x674]
push edx
push eax
push 0x4ce9f4
lea ecx, [ebp - 0x46c]
push 0x103
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x18
lea edx, [ebp - 0x264]
lea eax, [ebp - 0x46c]
mov word [ebp - 0x266], bx
push edx
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp + 8], edi
je 0x41ff49
mov esi, dword [sym.imp.MSVCRT.dll_wcscmp]
lea ecx, [ebp - 0x238]
push 0x4d0498
push ecx
call esi
add esp, 8
test eax, eax
je 0x41ff30
lea edx, [ebp - 0x238]
push 0x4d0490
push edx
call esi
add esp, 8
test eax, eax
je 0x41ff30
test byte [ebp - 0x264], 0x10
je 0x41ff30
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x238]
push eax
push ebx
call fcn.0041eb70
lea ecx, [ebp - 0x264]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41feed
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x424460
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x208
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x158]
test eax, eax
jne 0x424566
mov eax, dword [esi + 0x12c]
mov dword [esi + 0x158], 1
test eax, eax
jne 0x424566
mov eax, dword [esi + 0x138]
dec eax
je 0x424523
dec eax
jne 0x424566
mov ecx, dword [esi + 0xd90]
lea eax, [esi + 0xb84]
push 0x4d0324
push eax
call fcn.0041fff0
mov edx, eax
test edx, edx
je 0x424566
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
push edx
lea ecx, [esp + 0xc]
push 0x103
push ecx
push 0x4e6b30
push str.Type
push str.Global
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 8], 0
je 0x424566
mov ecx, dword [esi + 0xd90]
lea edx, [esi + 0x128]
lea eax, [esp + 8]
push edx
push eax
call fcn.004241c0
pop edi
pop esi
add esp, 0x208
ret
mov edi, dword [esi + 0xd8c]
test edi, edi
jne 0x42453a
mov ecx, esi
call fcn.004243b0
mov edi, eax
test edi, edi
je 0x424566
push str.Ext_GetExtensionType
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x5b6ef4], eax
je 0x424557
call eax
mov dword [esi + 0x128], eax
cmp edi, dword [esi + 0xd8c]
je 0x424566
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
add esp, 0x208
ret
Function at 0x424ae0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [ecx + 0x128]
sub esp, 0xa2c
cmp eax, 0x2000
push ebp
push esi
jne 0x424c93
lea eax, [ecx + 0xb84]
mov ecx, dword [ecx + 0xd90]
push 0x4d0324
push eax
mov dword [esp + 0x10], eax
call fcn.0041fff0
mov esi, eax
xor ebp, ebp
cmp esi, ebp
je 0x424c93
push ebx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x836]
mov word [esp + 0x834], bp
rep stosd dword es:[edi], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
stosw word es:[edi], ax
lea eax, [esp + 0x838]
push 0x103
push eax
push 0x4e6b30
push str.Text
push str.SideWeb
call ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x62e]
mov word [esp + 0x62c], bp
rep stosd dword es:[edi], eax
push esi
lea ecx, [esp + 0x630]
push 0x103
push ecx
push 0x4e6b30
push 0x4d0614
push str.SideWeb
stosw word es:[edi], ax
call ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x21e]
mov word [esp + 0x21c], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], bp
rep stosd dword es:[edi], eax
push esi
lea edx, [esp + 0x220]
push 0x103
push edx
push 0x4e6b30
push str.Icon
push str.SideWeb
stosw word es:[edi], ax
call ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x426]
mov word [esp + 0x424], bp
rep stosd dword es:[edi], eax
push 0x5c
push esi
stosw word es:[edi], ax
call dword [sym.imp.MSVCRT.dll_wcsrchr]
add esp, 8
cmp eax, ebp
pop edi
pop ebx
je 0x424c53
sub eax, esi
sar eax, 1
cmp eax, 0x103
jbe 0x424c23
mov eax, 0x103
push eax
lea eax, [esp + 0x420]
push esi
push eax
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0xc
lea ecx, [esp + 0x214]
lea edx, [esp + 0x41c]
lea eax, [esp + 0xc]
push ecx
push edx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
jmp 0x424c69
lea ecx, [esp + 0x214]
lea edx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
lea eax, [esp + 0xc]
lea ecx, [esp + 0x624]
push eax
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x830]
push ecx
mov ecx, dword [esp + 0xa40]
push edx
push eax
push ecx
call fcn.00473860
add esp, 0x14
pop esi
pop ebp
add esp, 0xa2c
ret 4
Function at 0x4258b0
Capabilities:
Delete directory

Disassembly:
sub esp, 0x620
push ebx
push ebp
lea eax, [esp + 8]
push edi
push eax
xor ebx, ebx
push str.Count
mov dword [esp + 0x18], ecx
push str.UnInstallExt
mov dword [esp + 0x18], ebx
call fcn.00408b20
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x22a]
mov word [esp + 0x228], bx
rep stosd dword es:[edi], eax
mov cx, word [0x4e6b30]
mov word [esp + 0x430], bx
stosw word es:[edi], ax
mov word [esp + 0x20], cx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x22]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x432]
add esp, 0xc
rep stosd dword es:[edi], eax
mov ecx, 0x4e6b38
stosw word es:[edi], ax
call fcn.00407c80
mov ebp, dword [sym.imp.MSVCRT.dll__snwprintf]
push eax
lea edx, [esp + 0x428]
push 0x103
push edx
call ebp
lea eax, [esp + 0x430]
push ebx
push eax
call fcn.0042bc40
add esp, 0x14
test eax, eax
je 0x425a20
cmp dword [esp + 0xc], ebx
jbe 0x425a13
push esi
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x18]
push ebx
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esp + 0x224]
rep stosd dword es:[edi], eax
push str.ext_d
lea ecx, [esp + 0x20]
push 0x103
push ecx
call ebp
lea edx, [esp + 0x230]
push 0x104
lea eax, [esp + 0x2c]
push edx
push eax
push str.UnInstallExt
call fcn.004089d0
add esp, 0x20
lea ecx, [esp + 0x220]
push 0x4d032c
push ecx
call fcn.0041dfb0
mov ecx, eax
call fcn.0041fff0
mov esi, eax
push 0
push esi
call fcn.0042bc40
add esp, 8
test eax, eax
je 0x425a05
mov ecx, dword [esp + 0x14]
push 0
lea edx, [esp + 0x42c]
push esi
push edx
call fcn.004264f0
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, dword [esp + 0x10]
inc ebx
cmp ebx, eax
jb 0x42596d
pop esi
push str.UnInstallExt
call fcn.00408410
add esp, 4
pop edi
pop ebp
pop ebx
add esp, 0x620
ret
Function at 0x425a30
Capabilities:
Delete directory

Disassembly:
sub esp, 0xa30
push ebx
push esi
mov esi, dword [esp + 0xa3c]
xor ebx, ebx
push 1
mov dword [esp + 0x10], ecx
push esi
mov dword [esp + 0x10], ebx
call fcn.0042bc40
add esp, 8
test eax, eax
je 0x425c46
push ebx
lea eax, [esp + 0xc]
push esi
push eax
call fcn.00467980
add esp, 0xc
cmp eax, 1
je 0x425c46
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x425c46
push ebp
push edi
push ebx
push str.Count
push str.UnInstallExt
push eax
call fcn.00468010
mov ebp, eax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x84a]
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
mov word [esp + 0x848], bx
add esp, 0x10
rep stosd dword es:[edi], eax
push ebp
push 0x4ceabc
lea ecx, [esp + 0x840]
push 0x104
push ecx
stosw word es:[edi], ax
call esi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x232]
mov word [esp + 0x230], bx
rep stosd dword es:[edi], eax
mov dx, word [0x4e6b30]
mov ecx, 0x81
stosw word es:[edi], ax
xor eax, eax
lea edi, [esp + 0x43a]
mov word [esp + 0x438], dx
add esp, 0x10
rep stosd dword es:[edi], eax
test ebp, ebp
stosw word es:[edi], ax
jbe 0x425c35
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x428]
push ebx
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esp + 0x224]
rep stosd dword es:[edi], eax
push str.ext_d
lea eax, [esp + 0x430]
push 0x103
push eax
call esi
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x230]
push 0x103
lea edx, [esp + 0x43c]
push ecx
push edx
push str.UnInstallExt
push eax
call fcn.00467ec0
mov dx, word [0x4e6b30]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x3e]
mov word [esp + 0x3c], dx
mov word [esp + 0x654], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, dword [0x5c01a4]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x656]
rep stosd dword es:[edi], eax
push 0
lea ecx, [esp + 0x658]
push 0x104
push ecx
push edx
stosw word es:[edi], ax
call fcn.0042bc50
add esp, 0x34
lea eax, [esp + 0x220]
lea ecx, [esp + 0x220]
lea edx, [esp + 0x630]
push eax
push ecx
push str.Extensions
push edx
push str._s_s_s_s.dll
lea eax, [esp + 0x2c]
push 0x103
push eax
call esi
lea ecx, [esp + 0x34]
push 0
push ecx
call fcn.0042bc40
add esp, 0x24
test eax, eax
je 0x425c2c
mov eax, dword [esp + 0xa44]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
push 1
push edx
push eax
call fcn.004264f0
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
inc ebx
cmp ebx, ebp
jb 0x425b13
lea eax, [esp + 0x10]
push 0
push eax
call fcn.00467b80
add esp, 8
pop edi
pop ebp
pop esi
pop ebx
add esp, 0xa30
ret 4