joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4076c6
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x492840]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x128]
push edi
push 0x124
push 0
push eax
call fcn.0043dc10
add esp, 0xc
test esi, esi
je 0x40785a
cmp byte [esi], 0
je 0x40785a
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
or ebx, 0xffffffff
cmp edi, ebx
jne 0x407735
push str._GetLastError_
push dword [ebp + 0xc]
push esi
push str.:5:TerminateProcessByName__s___d__FAILED:_CreateToolhelp32Snapshot___FAILED:__s
call fcn.0040906e
add esp, 0x10
mov eax, ebx
jmp 0x40785d
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0x128
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40777d
push str._GetLastError_
push dword [ebp + 0xc]
push esi
push str.:5:TerminateProcessByName__s___d__FAILED:_Process32First___FAILED:__s
call fcn.0040906e
add esp, 0x10
push 0x7a9
push str.C:UsersOfficeDocumentsVisual_StudioHoodSoftUpdateConsole.c
push str.TerminateProcessByNameCaseSens
push edi
call fcn.0040a58b
jmp 0x40772e
mov dword [ebp - 0x130], ebx
cmp dword [ebp + 0xc], 0
lea eax, [ebp - 0x108]
push esi
push eax
je 0x4077b0
cmp dword [ebp + 0x10], 0
je 0x40779e
call fcn.00447480
jmp 0x4077a3
call fcn.004475c7
pop ecx
pop ecx
test eax, eax
jne 0x4077ac
inc eax
jmp 0x4077c4
xor eax, eax
jmp 0x4077c4
cmp dword [ebp + 0x10], 0
je 0x4077bd
call fcn.0043dd70
jmp 0x4077c2
call fcn.0042ecfe
pop ecx
pop ecx
test eax, eax
je 0x407820
push dword [ebp - 0x124]
and dword [ebp - 0x130], 0
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x407820
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x40780b
push str._GetLastError_
lea eax, [ebp - 0x108]
push eax
push str.:1:TerminateProcessByName___encountered_a_problem:_TerminateProcess___FAILED_to_terminate__s:__s:_trying_once_more_with_higher_privilege...
call fcn.0040953d
add esp, 0xc
push 0x7da
push str.C:UsersOfficeDocumentsVisual_StudioHoodSoftUpdateConsole.c
push str.TerminateProcessByNameCaseSens
push ebx
call fcn.0040a58b
lea eax, [ebp - 0x12c]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x407783
push 0x833
push str.C:UsersOfficeDocumentsVisual_StudioHoodSoftUpdateConsole.c
push str.TerminateProcessByNameCaseSens
push edi
call fcn.0040a58b
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x130]
jmp 0x40785d
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043c5ec
leave
ret
Function at 0x407939
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2024
call fcn.0043c600
mov eax, dword [0x492840]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x2010], eax
mov dword [ebp - 0x2008], ecx
mov esi, edi
mov dword [ebp - 0x2014], edx
mov eax, edi
test ebx, ebx
je 0x40798b
cmp byte [edx + eax], 0x20
jl 0x407988
inc eax
cmp eax, ebx
jb 0x40797b
jmp 0x40798b
xor esi, esi
inc esi
test esi, esi
je 0x407a5d
mov esi, dword [ebp + 0x14]
lea edx, [ebp - 0x2018]
mov eax, 0x2000
mov dword [ebp - 0x200c], edi
push edx
cmp ebx, eax
push esi
cmovb eax, ebx
push eax
mov dword [ebp - 0x201c], eax
lea eax, [ebp - 0x2004]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputAttribute]
lea eax, [ebp - 0x2020]
push eax
lea eax, [ebp - 0x2024]
push eax
call fcn.00404d63
movsx eax, word [ebp + 0x16]
push eax
movsx eax, si
push eax
call fcn.00406042
add esp, 0x10
push edi
push dword [ebp - 0x2010]
push ebx
push dword [ebp - 0x2014]
mov ebx, dword [ebp - 0x2008]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov dword [ebp - 0x2008], eax
test eax, eax
jne 0x407a18
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x200c], eax
lea eax, [ebp - 0x2018]
push eax
push esi
push dword [ebp - 0x201c]
lea eax, [ebp - 0x2004]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputAttribute]
push dword [ebp - 0x2020]
push dword [ebp - 0x2024]
call fcn.00406042
pop ecx
pop ecx
cmp dword [ebp - 0x2008], edi
jne 0x407a71
push dword [ebp - 0x200c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x407a71
push dword [ebp - 0x2010]
push dword [ebp + 0x14]
push ebx
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043c5ec
leave
ret
Function at 0x40ad2a
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xorps xmm0, xmm0
push edi
mov edi, dword [ebp + 8]
push edi
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0xc], xmm0
movlpd qword [ebp - 0x14], xmm0
call fcn.0042da83
pop ecx
test eax, eax
jne 0x40ae78
mov esi, dword [ebp + 0xc]
push esi
call fcn.0042da83
pop ecx
test eax, eax
jne 0x40ae78
push eax
push 0x20
push 3
push eax
push 7
push 0x80
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40ade3
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x40ada7
mov dword [ebp - 4], 1
jmp 0x40adce
cmp dword [0x4854f0], 0
je 0x40adce
and dword [0x4854f0], 0
push str._GetLastError_
push dword [ebp + 0x10]
push esi
push edi
push str.:6:CopyFileWithDates___s_____s____d__encountered_a_problem:_GetFileTime___FAILED:__s
call fcn.0040906e
add esp, 0x14
push 0x9e3
push str.C:UsersOfficeDocumentsVisual_StudioHoodSoftUpdateFile.c
push str.CopyFileWithDates
push ebx
call fcn.0040a58b
push dword [ebp + 0x10]
push esi
push edi
call fcn.0040c761
add esp, 0xc
test eax, eax
je 0x40ae78
cmp dword [ebp - 4], 0
jne 0x40ae03
xor eax, eax
inc eax
jmp 0x40ae7a
push 0
push SQLGetDiagRec
push 3
push 0
push 7
push 0x100
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40adfe
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x40ae61
mov eax, dword [0x49bea4]
inc eax
mov dword [0x49bea4], eax
cmp eax, 0xa
jge 0x40ae61
push str._GetLastError_
push dword [ebp + 0x10]
push esi
push edi
push str.:6:_1_of_10:_CopyFileWithDates___s_____s____d__encountered_a_problem:_SetFileTime___FAILED:__s
call fcn.0040906e
add esp, 0x14
push 0xa09
push str.C:UsersOfficeDocumentsVisual_StudioHoodSoftUpdateFile.c
push str.CopyFileWithDates
push ebx
call fcn.0040a58b
jmp 0x40adfe
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b065
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x492840]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push edi
mov edi, 0x104
xor ebx, ebx
push edi
push ebx
push eax
call fcn.0043dc10
add esp, 0xc
mov dword [ebp - 0x10c], ebx
test esi, esi
je 0x40b162
cmp byte [esi], 0x30
je 0x40b162
mov eax, ebx
cmp eax, edi
jae 0x40b248
mov byte [ebp + eax - 0x108], bl
inc eax
cmp eax, edi
jl 0x40b0b1
push edi
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.0042ee2a
lea eax, [ebp - 0x108]
push 0x22
push eax
call fcn.0042df54
mov ebx, dword [ebp + 0xc]
add esp, 0x14
test ebx, ebx
je 0x40b129
push 0xf87
push str.C:UsersOfficeDocumentsVisual_StudioHoodSoftUpdateFile.c
push str.CreateDirectorySuper
xor ecx, ecx
lea eax, [ebp - 0x108]
push ecx
push ecx
push eax
push 0x40b24e
push ecx
push ecx
call fcn.0040b888
mov edi, eax
test edi, edi
jne 0x40b173
push str._GetLastError_
push eax
push esi
push str.:8:CreateDirectorySuper___FAILED_to_create_thread_to_create_directory___s_._NumThreads_d:__s
call fcn.0040906e
add esp, 0x10
push 0
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
test eax, eax
je 0x40b240
cmp eax, 0x50
je 0x40b240
cmp eax, 0xb7
je 0x40b240
cmp eax, 0x4c7
je 0x40b240
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043c5ec
leave
ret
call fcn.00438ea7
mov dword [ebp - 0x110], eax
jmp 0x40b1a3
cmp dword [ebp - 0x10c], 0x103
jne 0x40b1e2
call fcn.00438ea7
sub eax, dword [ebp - 0x110]
cmp eax, ebx
ja 0x40b1b7
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x10c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x40b180
jmp 0x40b1e2
push esi
call fcn.00438ea7
sub eax, dword [ebp - 0x110]
push eax
push str.:5:CreateDirectorySuper___timed_out_after__ldms_while_creating___s_
call fcn.0040953d
add esp, 0xc
mov dword [0x49bbd8], 0x5b4
and dword [ebp - 0x10c], 0
push 0xfbb
push str.C:UsersOfficeDocumentsVisual_StudioHoodSoftUpdateFile.c
push str.CreateDirectorySuper
push edi
call fcn.0040a58b
push dword [0x49bbd8]
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
call edi
cmp dword [ebp - 0x10c], 0
jne 0x40b240
push esi
call fcn.0040d49e
pop ecx
test eax, eax
jne 0x40b233
push dword [0x49bbd8]
push str._GetLastError_
push ebx
push esi
push str.:3:FYI:_CreateDirectorySuper__s___lu___FAILED:__s_ld
call fcn.0040953d
add esp, 0x14
push dword [0x49bbd8]
call edi
jmp 0x40b162
xor eax, eax
inc eax
jmp 0x40b164
call fcn.0043c79b
int3
Function at 0x40b765
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x492840]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x148]
push 0x104
push 0
push eax
call fcn.0043dc10
push 0x40
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.0043dc10
add esp, 0x18
test esi, esi
je 0x40b82c
push esi
call fcn.0042d010
mov dword [esp], 0x21e88e
push 0xde
call fcn.004172b2
push eax
push str.P2_Tmp__d
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.0042eb84
add esp, 0x18
lea eax, [ebp - 0x148]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x40b7f4
push str._GetLastError_
push str.:2:CreateTempFile___FAILED:_GetTempPath___FAILED:__s
jmp 0x40b825
push esi
push 0
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x40b81b
push esi
call fcn.0042da83
pop ecx
test eax, eax
jne 0x40b81b
mov eax, esi
jmp 0x40b82e
push str._GetLastError_
push str.:2:CreateTempFile___FAILED:_GetTempFileName___FAILED:__s
call fcn.0040906e
pop ecx
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043c5ec
leave
ret
Function at 0x40b888
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x492840]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push ebx
mov dword [ebp - 0x110], eax
mov eax, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp + 0x20]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp + 0x24]
push 0x104
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x108]
push 0
push eax
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x118], edi
call fcn.0043dc10
push 0x1c8
push 1
call fcn.00447314
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x40b909
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x40ba2d
mov eax, dword [0x49d780]
test eax, eax
jne 0x40b91c
call fcn.00426b31
mov dword [0x49d780], eax
push ebx
push eax
call fcn.00426e93
cmp dword [0x49d780], 0
pop ecx
pop ecx
jne 0x40b941
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
call fcn.0044731f
jmp 0x40ba2c
mov dword [ebx], esi
lea eax, [ebx + 4]
test esi, esi
je 0x40b95d
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x114]
mov edi, dword [ebp - 0x118]
jmp 0x40b96a
push 0xc
push 0
push eax
call fcn.0043dc10
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x110]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp - 0x10c]
push 0x40
push dword [ebp - 0x11c]
mov dword [ebx + 0x20], eax
lea eax, [ebx + 0x24]
push eax
mov dword [ebx + 0x10], edi
call fcn.0042ee2a
push 0x104
push dword [ebp - 0x120]
lea eax, [ebp - 0x108]
push eax
call fcn.0042ee2a
lea eax, [ebp - 0x108]
push eax
call fcn.0042e1f0
push 0x40
lea eax, [ebp - 0x108]
push eax
lea eax, [ebx + 0x64]
push eax
call fcn.0042ee2a
mov eax, dword [ebp + 0x28]
and dword [ebx + 0xb0], 0
mov dword [ebx + 0xa4], eax
call fcn.00438ea7
mov dword [ebx + 0xb4], eax
lea eax, [ebx + 0xb8]
push eax
call fcn.0042d010
and dword [ebx + 0xac], 0
add esp, 0x2c
push dword [ebp - 0x10c]
push dword [ebp - 0x110]
push ebx
push 0x40b83b
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 0xa8], eax
test eax, eax
jne 0x40ba2f
push ebx
call fcn.0040ba40
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043c5ec
leave
ret 0x24
Function at 0x40ba90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x492840]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push edi
mov ebx, 0x104
xor edi, edi
push ebx
push edi
push eax
call fcn.0043dc10
push ebx
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.0042ee2a
lea eax, [ebp - 0x108]
push eax
call fcn.0042e2bc
push edi
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.0042e242
add esp, 0x28
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40bb90
test al, 0x10
je 0x40bb68
push edi
push 0x40c949
push 1
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.0040e1e7
push edi
lea eax, [ebp - 0x108]
push 1
push eax
call fcn.0040bba9
add esp, 0x20
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test edi, edi
jne 0x40bb65
lea eax, [ebp - 0x108]
push eax
call fcn.0040bca2
pop ecx
test eax, eax
je 0x40bb65
push ebx
push str._GetLastError_
lea eax, [ebp - 0x108]
push eax
push esi
push str.:3:DeleteDirectory___s___FAILED:_DeleteFiles___s___1__0__FAILED:__s_ld
call fcn.0040906e
add esp, 0x14
push ebx
jmp 0x40bb92
cmp eax, 0xffffffff
je 0x40bb90
push esi
call fcn.0040bca2
pop ecx
test eax, eax
je 0x40bb90
push esi
call fcn.0040bc85
pop ecx
test eax, eax
jne 0x40bb90
push esi
push str.:3:DeleteDirectory___s___FAILED:_The_given_file_is_not_a_directory_
call fcn.0040906e
pop ecx
pop ecx
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043c5ec
leave
ret

Function at 0x40bc85
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40bc9e
shr eax, 4
and eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40bf0b
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
mov eax, dword [0x492840]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
mov ebx, 0x104
push ebx
push 0
push eax
call fcn.0043dc10
push ebx
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.0043dc10
push 0x140
lea eax, [ebp - 0x34c]
push 0
push eax
call fcn.0043dc10
add esp, 0x24
test esi, esi
je 0x40bff0
cmp byte [esi], 0
je 0x40bff0
push ebx
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0042ee2a
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00447380
lea eax, [ebp - 0x108]
push eax
call fcn.0042e1f0
mov eax, dword [0x49bbe0]
add esp, 0x18
mov ecx, dword [0x49bbdc]
add eax, 0xf
cmp ecx, eax
jle 0x40bfc8
push ecx
push str.:8:DoesFileExist_Helper___has_determined_that_over__d_helper_threads_may_be_stuck_
mov dword [0x49bbe0], ecx
call fcn.0040953d
pop ecx
pop ecx
mov ecx, dword [0x49bbdc]
lea eax, [ebp - 0x34c]
inc ecx
push eax
lea eax, [ebp - 0x20c]
mov dword [0x49bbdc], ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
dec dword [0x49bbdc]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40c060
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0043c5ec
leave
ret 4
cmp byte [ebp - 0x320], 0x2e
je 0x40c04e
lea eax, [ebp - 0x320]
push eax
call fcn.0042da83
pop ecx
test eax, eax
jne 0x40c04e
cmp byte [ebp - 0x108], 0x2a
jne 0x40c069
cmp byte [ebp - 0x106], 0x2a
jne 0x40c069
mov al, byte [ebp - 0x107]
cmp al, 0x3f
je 0x40c069
movsx eax, al
push eax
lea eax, [ebp - 0x320]
push eax
call fcn.0043e180
pop ecx
pop ecx
test eax, eax
jne 0x40c069
lea eax, [ebp - 0x34c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x40c078
cmp dword [0x4778ac], 0
jne 0x40c002
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
jmp 0x40bff2
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40bff0
Function at 0x40c761
Capabilities:
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x492840]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.0042da83
pop ecx
test eax, eax
jne 0x40c8c2
push esi
call fcn.0042da83
pop ecx
test eax, eax
jne 0x40c8c2
push edi
call fcn.004476a0
mov ebx, 0x104
pop ecx
cmp eax, ebx
jae 0x40c87b
push esi
call fcn.004476a0
pop ecx
cmp eax, ebx
jae 0x40c87b
mov ebx, dword [ebp + 0x10]
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x40c876
push esi
call fcn.0040bc85
pop ecx
test eax, eax
je 0x40c845
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.0043dc10
push 0x104
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.0042ee2a
lea eax, [ebp - 0x108]
push eax
call fcn.0042e1f0
lea eax, [ebp - 0x108]
push eax
call fcn.0042da83
add esp, 0x20
test eax, eax
jne 0x40c8c2
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.0042dce1
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x108]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
jmp 0x40c8c4
test ebx, ebx
jne 0x40c8c2
push esi
call fcn.0040bca2
pop ecx
test eax, eax
je 0x40c8c2
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 3
je 0x40c8c2
and eax, 0xfffffffc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push esi
jmp 0x40c83c
xor eax, eax
inc eax
jmp 0x40c8c4
push edi
call fcn.0042ca0e
push esi
mov ebx, eax
call fcn.0042ca0e
mov edi, eax
pop ecx
pop ecx
test ebx, ebx
je 0x40c8b7
test edi, edi
je 0x40c8b4
push dword [ebp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push ebx
mov esi, eax
call fcn.0044731f
push edi
call fcn.0044731f
pop ecx
pop ecx
mov eax, esi
jmp 0x40c8c4
push ebx
jmp 0x40c8bc
test edi, edi
je 0x40c8c2
push edi
call fcn.0044731f
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043c5ec
leave
ret

Function at 0x40c8d3
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0042da83
pop ecx
test eax, eax
jne 0x40c927
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40c922
push esi
call fcn.0040bca2
pop ecx
test eax, eax
je 0x40c922
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 3
je 0x40c927
and eax, 0xfffffffc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x40c929
xor eax, eax
inc eax
jmp 0x40c929
xor eax, eax
pop esi
pop ebp
ret
Function at 0x40c98f
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x492840]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x90], eax
call fcn.0042da83
pop ecx
test eax, eax
je 0x40c9c5
xor eax, eax
jmp 0x40cba4
push edi
call fcn.00438ea7
push ebx
push esi
xor edi, edi
mov dword [ebp - 0x8c], eax
push edi
push 0x80
push 3
push edi
push 7
push connect
push dword [ebp - 0x90]
call fcn.0040b32b
add esp, 0x24
mov dword [ebp - 0x88], eax
cmp eax, 0xffffffff
jne 0x40cacc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x94], eax
test ebx, ebx
je 0x40ca16
cmp dword [ebx], edi
jne 0x40ca2f
test esi, esi
je 0x40ca35
call fcn.00438ea7
sub eax, dword [ebp - 0x8c]
cmp eax, esi
jb 0x40ca35
mov eax, dword [ebp - 0x94]
push eax
jmp 0x40cac1
push ebx
push esi
push edi
push 0x80
push 3
push edi
push 7
push 0x2000000
push dword [ebp - 0x90]
call fcn.0040b32b
add esp, 0x24
mov dword [ebp - 0x88], eax
cmp eax, 0xffffffff
jne 0x40cacc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x88], eax
test ebx, ebx
je 0x40ca74
cmp dword [ebx], edi
jne 0x40cabb
test esi, esi
je 0x40ca87
call fcn.00438ea7
sub eax, dword [ebp - 0x8c]
cmp eax, esi
jae 0x40cabb
mov ebx, dword [ebp - 0x90]
push esi
push ebx
call fcn.0040bd51
pop ecx
pop ecx
test eax, eax
je 0x40cabb
mov eax, dword [ebp - 0x88]
push eax
push str._GetLastError_
push eax
push dword [ebp - 0x94]
push ebx
push str.:8:GetFileSizeTimeOut___Seems_to_have_failed_because_of_an_access_rights_problem_:___s_:__u:_u:__s_ld
call fcn.0040906e
add esp, 0x18
push dword [ebp - 0x88]
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x40cb7e
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x94], eax
cmp eax, 0xffffffff
jne 0x40cb0c
test ebx, ebx
je 0x40cae5
mov edi, dword [ebx]
push str._GetLastError_
push edi
push esi
push dword [ebp - 0x90]
push str.:7:GetFileSizeTimeOut___s____ld___d__FAILED:__s
call fcn.0040953d
mov edi, dword [ebp - 0x88]
add esp, 0x14
push 0x1053
jmp 0x40cb6e
test eax, eax
je 0x40cb82
push edi
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x8c], edi
mov edi, dword [ebp - 0x88]
push eax
push 0x80
lea eax, [ebp - 0x84]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40cb44
cmp dword [ebp - 0x8c], 0
jne 0x40cb88
push str._GetLastError_
push dword [ebp - 0x8c]
push dword [ebp - 0x94]
push esi
push dword [ebp - 0x90]
push str.:7:GetFileSizeTimeOut___s____ld__FAILED:_GetFileSize___returned__ld_but_ReadFile_____ldBytesRead__FAILED:__s
call fcn.0040906e
add esp, 0x18
push 0x105f
push str.C:UsersOfficeDocumentsVisual_StudioHoodSoftUpdateFile.c
push str.GetFileSizeTimeOut
push edi
call fcn.0040a58b
xor eax, eax
jmp 0x40cba3
mov edi, dword [ebp - 0x88]
push 0x1064
push str.C:UsersOfficeDocumentsVisual_StudioHoodSoftUpdateFile.c
push str.GetFileSizeTimeOut
push edi
call fcn.0040a58b
mov eax, dword [ebp - 0x94]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0043c5ec
leave
ret