joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402070
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov eax, dword [0x478050]
xor eax, esp
mov dword [esp + 0x48], eax
mov eax, dword [0x47ad68]
push ebx
mov ebx, dword [ebp + 8]
push esi
lea esi, [eax + 0x14]
mov dword [esp + 0xc], 0
mov dword [esp + 0xc], eax
mov ecx, esi
push edi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x473f50
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], 0
call fcn.0040bfc0
mov edi, eax
mov eax, dword [esi]
cmp edi, eax
je 0x4020e2
lea edx, [edi + 0x10]
lea ecx, [esp + 0x14]
call fcn.00408730
test al, al
jne 0x4020e0
mov dword [esp + 0x1c], edi
jmp 0x4020e4
mov eax, dword [esi]
mov edi, eax
cmp edi, dword [esi]
mov edi, dword [esp + 0x10]
jne 0x402100
push str.vmodule
mov ecx, edi
call fcn.00409a60
test al, al
je 0x4021d4
cmp dword [0x47ad3c], 0
je 0x402117
cmp byte [0x47bce8], 0
jne 0x402299
int3
mov eax, dword [0x47ad58]
push 0x10
mov dword [0x47ad3c], eax
call fcn.0044783a
mov esi, eax
mov dword [esp + 0x18], str.vmodule
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], 7
push eax
lea eax, [esp + 0x44]
mov dword [esp + 0x24], 0x473f50
push eax
mov ecx, edi
mov dword [esp + 0x2c], 1
call fcn.00409ae0
push eax
lea eax, [esp + 0x24]
mov ecx, edi
push eax
lea eax, [esp + 0x30]
push eax
call fcn.00409ae0
push eax
mov ecx, esi
call fcn.00413fb0
mov dword [0x47ad58], eax
mov eax, dword [esp + 0x38]
cmp eax, 0x10
jb 0x402192
inc eax
lea ecx, [esp + 0x24]
push eax
push dword [esp + 0x28]
call fcn.00405260
mov eax, dword [esp + 0x50]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
cmp eax, 0x10
jb 0x4021bf
inc eax
lea ecx, [esp + 0x3c]
push eax
push dword [esp + 0x40]
call fcn.00405260
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], 0
mov byte [esp + 0x3c], 0
mov eax, dword [ebx]
mov dword [0x478bb0], eax
test al, 1
jne 0x4021f3
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00447880
mov esp, ebp
pop ebp
ret
mov eax, dword [0x47ad50]
test eax, eax
je 0x40220d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x47ad50], 0
mov edx, dword [0x47ad54]
test edx, edx
jne 0x40223c
push 0x18
call fcn.0044783a
mov edx, eax
add esp, 4
xor eax, eax
mov dword [0x47ad54], edx
mov dword [edx + 0x14], 7
mov dword [edx + 0x10], 0
mov word [edx], ax
mov esi, dword [ebx + 4]
cmp word [esi], 0
jne 0x402249
xor ecx, ecx
jmp 0x40225f
mov ecx, esi
lea edi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402250
sub ecx, edi
sar ecx, 1
push ecx
push esi
mov ecx, edx
call fcn.004047d0
cmp dword [ebx + 0xc], 0
jne 0x402282
mov eax, dword [0x47ad54]
cmp dword [eax + 0x14], 8
jb 0x40227b
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.00401ee0
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00447880
mov esp, ebp
pop ebp
ret
push 1
call fcn.00453ee2
int3
Function at 0x402420
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x43c
mov eax, dword [0x478050]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
mov ebx, ecx
push esi
push edi
lea edi, [ebx + 8]
push edi
call fcn.004075c0
add esp, 4
lea eax, [esp + 0x10]
lea esi, [ebx + 0xc]
mov ecx, esi
push eax
call fcn.004050f0
mov eax, dword [0x47ad4c]
test eax, eax
je 0x402489
lea ecx, [esp + 0x10]
push ecx
push dword [ebx + 0xa0]
push dword [ebx + 0xa8]
push dword [ebx + 0xa4]
push dword [ebx]
call eax
add esp, 0x14
test al, al
jne 0x4025b1
test byte [0x478bb0], 2
je 0x4024a9
cmp dword [esp + 0x24], 0x10
lea eax, [esp + 0x10]
cmovae eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x4024ae
cmp dword [ebx], 2
jl 0x4024ed
cmp dword [esp + 0x24], 0x10
lea edi, [esp + 0x10]
mov esi, dword [esp + 0x20]
cmovae edi, dword [esp + 0x10]
push 2
call fcn.004515af
add esp, 4
push eax
push 1
push esi
push edi
call fcn.004525df
push 2
call fcn.004515af
add esp, 0x14
push eax
call fcn.00451a56
lea edi, [ebx + 8]
add esp, 4
lea esi, [ebx + 0xc]
test byte [0x478bb0], 1
je 0x402525
call fcn.00401ee0
test al, al
je 0x402525
cmp dword [esp + 0x24], 0x10
lea ecx, [esp + 0xc]
push 0
push ecx
push dword [esp + 0x28]
lea eax, [esp + 0x1c]
cmovae eax, dword [esp + 0x1c]
push eax
push dword [0x47ad50]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebx], 3
jne 0x4025b1
mov ecx, 0x400
lea eax, [esp + 0x10]
cmp dword [esp + 0x20], ecx
cmovb ecx, dword [esp + 0x20]
cmp dword [esp + 0x24], 0x10
cmovae eax, dword [esp + 0x10]
test ecx, ecx
je 0x40255d
push ecx
push eax
lea eax, [esp + 0x48]
push eax
call fcn.0044a2e0
add esp, 0xc
lea eax, [esp + 0x40]
push eax
call fcn.00412d80
add esp, 4
cmp dword [0x47ad5c], 0
je 0x4025a7
lea eax, [esp + 0x28]
mov ecx, esi
push eax
call fcn.004050f0
lea eax, [esp + 0x28]
push eax
call dword [0x47ad5c]
mov eax, dword [esp + 0x40]
add esp, 4
cmp eax, 0x10
jb 0x4025b1
inc eax
lea ecx, [esp + 0x28]
push eax
push dword [esp + 0x2c]
call fcn.00405260
jmp 0x4025b1
cmp byte [0x47bce8], 0
jne 0x402603
int3
mov eax, dword [esp + 0x24]
cmp eax, 0x10
jb 0x4025c9
inc eax
lea ecx, [esp + 0x10]
push eax
push dword [esp + 0x14]
call fcn.00405260
push dword [ebx + 0xac]
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea esi, [edi + 0x50]
mov ecx, esi
call fcn.00403040
push esi
mov dword [esi], 0x471e24
call fcn.00448dc6
mov ecx, dword [esp + 0x448]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00447880
mov esp, ebp
pop ebp
ret
push 1
call fcn.00453ee2
int3
Function at 0x4094a0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x478050]
xor eax, esp
mov dword [esp + 0x18], eax
cmp dword [0x47ad68], 0
push esi
je 0x4094d0
xor al, al
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00447880
mov esp, ebp
pop ebp
ret
push 0x20
call fcn.0044783a
mov ecx, eax
call fcn.00409210
mov dword [0x47ad68], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
mov dword [esp + 0x18], 7
xor eax, eax
mov dword [esp + 0x14], 0
mov word [esp + 4], ax
cmp word [edx], ax
jne 0x40950b
xor ecx, ecx
jmp 0x40951f
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409510
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0xc]
call fcn.004047d0
mov ecx, dword [0x47ad68]
lea eax, [esp + 4]
push eax
call fcn.0040a1a0
mov eax, dword [esp + 0x18]
cmp eax, 8
jb 0x409552
inc eax
lea ecx, [esp + 4]
push eax
push dword [esp + 8]
call fcn.00405f00
mov ecx, dword [esp + 0x1c]
mov al, 1
pop esi
xor ecx, esp
call fcn.00447880
mov esp, ebp
pop ebp
ret

Function at 0x40a1a0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x478050]
xor eax, esp
mov dword [esp + 0x1c], eax
mov edx, dword [ebp + 8]
xor eax, eax
push esi
push edi
mov edi, ecx
mov dword [esp + 8], 0
mov ecx, 0x472720
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a1e2
sub ecx, esi
lea eax, [esp + 0xc]
sar ecx, 1
push ecx
push 0x472720
push eax
mov ecx, edx
call fcn.00411f10
add esp, 0xc
cmp dword [esp + 0x1c], 0
je 0x40a244
cmp dword [esp + 0x20], 8
lea ecx, [esp + 8]
lea eax, [esp + 0xc]
mov dword [esp + 8], 0
cmovae eax, dword [esp + 0xc]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov ecx, edi
push esi
push dword [esp + 0xc]
call fcn.004095b0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x20]
cmp eax, 8
jb 0x40a25c
inc eax
lea ecx, [esp + 0xc]
push eax
push dword [esp + 0x10]
call fcn.00405f00
mov ecx, dword [esp + 0x24]
pop edi
pop esi
xor ecx, esp
call fcn.00447880
mov esp, ebp
pop ebp
ret 4
Function at 0x40e380
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [esp + 0xc], 0
push esi
mov esi, ecx
mov dword [esp + 8], esi
push edi
test ebx, ebx
jns 0x40e3ad
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [0x47adf8]
xor edi, edi
test ecx, ecx
je 0x40e3f3
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
test al, al
je 0x40e3f3
mov ecx, dword [0x47adf8]
lea edi, [esi + 0x1c]
mov eax, ebx
mov dword [esp + 0x10], str.File::Read
cdq
push edx
mov esi, dword [ecx]
push eax
mov eax, dword [esp + 0x14]
add eax, 4
push eax
push edi
push str.File::Read
call dword [esi + 0x10]
mov esi, dword [esp + 0xc]
jmp 0x40e3fb
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
movups xmmword [esp + 0x20], xmm0
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x20], 0
push eax
push ebx
push dword [ebp + 0x10]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40e439
mov esi, dword [esp + 0x14]
jmp 0x40e44b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
jne 0x40e448
xor esi, esi
jmp 0x40e44b
or esi, 0xffffffff
test edi, edi
je 0x40e463
mov ecx, dword [0x47adf8]
test ecx, ecx
je 0x40e463
mov edx, dword [ecx]
push edi
push dword [esp + 0x14]
call dword [edx + 0x14]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40e800
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
mov dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0xc]
test bl, 1
push esi
mov esi, ecx
mov ecx, 3
cmovne eax, ecx
test bl, 2
mov ecx, 1
cmovne eax, ecx
mov ecx, ebx
and ecx, 4
mov dword [ebp - 4], ecx
mov ecx, 4
cmovne eax, ecx
test bl, 8
mov ecx, 2
cmovne eax, ecx
mov dword [ebp + 0xc], eax
push edi
test bl, 0x10
je 0x40e857
mov dword [ebp + 0xc], 5
jmp 0x40e85f
test eax, eax
je 0x40e989
xor edx, edx
mov edi, 0x40000000
test bl, 0x40
mov eax, 4
cmovne edx, edi
test bl, 0x80
cmovne edx, eax
test bl, 0x20
je 0x40e882
or edx, 0x80000000
test ebx, 0x4000
je 0x40e890
or edx, 0x100
test ebx, 0x40000
je 0x40e89e
or edx, 0x20000000
mov ecx, ebx
shr ecx, 8
not ecx
and ecx, 1
test ebx, 0x200
jne 0x40e8b3
or ecx, 2
test ebx, 0x8000
je 0x40e8bd
or ecx, eax
xor eax, eax
test ebx, 0x400
cmovne eax, edi
test ebx, 0x800
je 0x40e8d5
or eax, 0x100
test ebx, 0x1000
je 0x40e8e0
or eax, 2
test ebx, 0x2000
je 0x40e8ed
or eax, 0x4000000
test ebx, 0x20000
je 0x40e8fa
or eax, 0x2000000
test ebx, 0x80000
je 0x40e907
or eax, 0x8000000
mov edi, dword [ebp + 8]
cmp dword [edi + 0x14], 8
jb 0x40e912
mov edi, dword [edi]
push 0
push eax
push dword [ebp + 0xc]
push 0
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
mov ecx, esi
call fcn.0040e120
mov eax, dword [esi]
test eax, eax
je 0x40e979
cmp eax, 0xffffffff
je 0x40e979
mov eax, ebx
mov dword [esi + 0x20], 0
shr eax, 0xa
and al, 1
cmp dword [ebp - 4], 0
mov byte [esi + 0x25], al
je 0x40e967
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne al
mov byte [esi + 0x24], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test bl, 0xa
je 0x40e989
mov byte [esi + 0x24], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0040e470
mov dword [esi + 0x20], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40e9a0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5f0
mov eax, dword [0x478050]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov esi, edx
xor ebx, ebx
push esi
sub esp, 8
mov dword [ebp - 0x2ec], esi
mov dword [ebp - 0x2e8], ebx
push ecx
lea ecx, [ebp - 0x2e4]
call fcn.0041a360
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x2e4]
call fcn.0041a540
cmp dword [ebp - 0x10], ebx
je 0x40eb67
nop
cmp byte [ebp - 0x2e4], 0
jne 0x40ea2a
test bl, 1
je 0x40ea12
and ebx, 0xfffffffe
lea ecx, [ebp - 0x39c]
mov dword [ebp - 0x2e8], ebx
call fcn.00402420
push 0x250
lea eax, [ebp - 0x5ec]
push 0
push eax
call fcn.0044a860
add esp, 0xc
jmp 0x40ea43
mov ecx, 0x94
lea esi, [ebp - 0x2e0]
lea edi, [ebp - 0x5ec]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x2ec]
mov ebx, dword [ebp - 0x5ec]
mov cl, byte [ebp + 8]
test bl, 1
je 0x40ea79
test cl, cl
jne 0x40ea5e
mov eax, ebx
shr eax, 4
test al, 1
jne 0x40ea79
cmp dword [ebp - 0xc], 8
lea ecx, [ebp - 0x20]
mov eax, ebx
cmovae ecx, dword [ebp - 0x20]
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov cl, byte [ebp + 8]
shr ebx, 4
test bl, 1
je 0x40eab0
test cl, cl
je 0x40eaca
push 1
mov edx, esi
lea ecx, [ebp - 0x20]
call fcn.0040e9a0
add esp, 4
test al, al
je 0x40eb4e
cmp dword [ebp - 0xc], 8
lea eax, [ebp - 0x20]
cmovae eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x40eac2
cmp dword [ebp - 0xc], 8
lea eax, [ebp - 0x20]
cmovae eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40eb4e
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x2e4]
call fcn.0041a540
lea ecx, [ebp - 0x20]
cmp ecx, eax
je 0x40eaea
push 0xffffffffffffffff
push 0
push eax
call fcn.004048d0
mov eax, dword [ebp - 0x24]
cmp eax, 8
jb 0x40eb3d
mov ecx, dword [ebp - 0x38]
inc eax
cmp eax, 0x7fffffff
ja 0x40ebc6
add eax, eax
cmp eax, 0x1000
jb 0x40eb34
test cl, 0x1f
jne 0x40ebc6
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x40ebc6
sub ecx, eax
cmp ecx, 4
jb 0x40ebc6
cmp ecx, 0x23
ja 0x40ebc6
mov ecx, eax
push ecx
call fcn.0044786d
add esp, 4
cmp dword [ebp - 0x10], 0
je 0x40eb67
mov ebx, dword [ebp - 0x2e8]
jmp 0x40e9f0
mov eax, dword [ebp - 0xc]
cmp eax, 8
jb 0x40eb63
inc eax
lea ecx, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
call fcn.00405f00
xor bl, bl
jmp 0x40eba8
mov eax, dword [ebp - 0xc]
cmp eax, 8
jb 0x40eba6
mov ecx, dword [ebp - 0x20]
inc eax
cmp eax, 0x7fffffff
ja 0x40ebc6
add eax, eax
cmp eax, 0x1000
jb 0x40eb9d
test cl, 0x1f
jne 0x40ebcb
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x40ebd0
sub ecx, eax
cmp ecx, 4
jb 0x40ebd5
cmp ecx, 0x23
ja 0x40ebda
mov ecx, eax
push ecx
call fcn.0044786d
add esp, 4
mov bl, 1
lea ecx, [ebp - 0x2e4]
call fcn.0041a440
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00447880
mov esp, ebp
pop ebp
ret
call fcn.0044e681
call fcn.0044e681
call fcn.0044e681
call fcn.0044e681
call fcn.0044e681
int3
Function at 0x40ec90
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x478050]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x10], 0
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x40eccd
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00447880
mov esp, ebp
pop ebp
ret
cmp eax, 0x104
jae 0x40ee86
lea eax, [esp + 0x14]
mov ecx, edi
push eax
call fcn.0040d720
push 2
push ecx
push 0x471f64
mov ecx, eax
call fcn.0040b580
cmp eax, 0xffffffff
mov eax, dword [esp + 0x28]
setne bl
cmp eax, 8
jb 0x40ed11
inc eax
lea ecx, [esp + 0x14]
push eax
push dword [esp + 0x18]
call fcn.00405f00
test bl, bl
je 0x40ed9f
lea eax, [esp + 0x2c]
mov ecx, edi
push eax
call fcn.0040d720
push dword [ebp + 0xc]
mov esi, eax
mov ecx, edi
lea eax, [esp + 0x18]
push eax
call fcn.0040d5c0
mov edx, esi
mov ecx, eax
call fcn.0040e9a0
mov ecx, dword [esp + 0x2c]
add esp, 4
mov bl, al
cmp ecx, 8
jb 0x40ed5c
inc ecx
push ecx
push dword [esp + 0x18]
lea ecx, [esp + 0x1c]
call fcn.00405f00
xor eax, eax
mov dword [esp + 0x28], 7
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x24], 0
cmp eax, 8
jb 0x40ed8b
inc eax
lea ecx, [esp + 0x2c]
push eax
push dword [esp + 0x30]
call fcn.00405f00
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00447880
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x14], 8
jb 0x40eda9
mov eax, dword [edi]
jmp 0x40edab
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40ecb9
test bl, 1
je 0x40ede3
cmp dword [edi + 0x14], 8
jb 0x40edcc
mov ecx, dword [edi]
jmp 0x40edce
mov ecx, edi
mov eax, ebx
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40ee86
test bl, 0x10
jne 0x40ee0f
cmp dword [edi + 0x14], 8
jb 0x40edf0
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00447880
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
je 0x40ee41
push 0x471f6c
lea ecx, [esp + 0x30]
call fcn.00402e20
mov ebx, 1
lea edx, [esp + 0x2c]
push ebx
mov ecx, edi
call fcn.0040e9a0
add esp, 4
test al, al
jne 0x40ee45
mov byte [esp + 0xf], al
jmp 0x40ee4a
mov ebx, dword [esp + 0x10]
mov byte [esp + 0xf], 1
test bl, 1
je 0x40ee58
lea ecx, [esp + 0x2c]
call fcn.00402d80
cmp byte [esp + 0xf], 0
je 0x40ee86
cmp dword [edi + 0x14], 8
jb 0x40ee67
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00447880
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x44]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00447880
mov esp, ebp
pop ebp
ret
Function at 0x40f2a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x40f2ae
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
pop ebp
ret

Function at 0x40f2c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x40f2c8
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40f2db
shr eax, 4
and eax, 1
ret
xor al, al
ret

Function at 0x40f2e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x478050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x218]
mov esi, ecx
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x40f40d
sub esp, 8
lea eax, [ebp - 0x218]
mov edx, esp
mov dword [edx], eax
cmp word [ebp - 0x218], 0
jne 0x40f330
xor ecx, ecx
jmp 0x40f34f
lea ecx, [ebp - 0x218]
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f340
sub ecx, edi
sar ecx, 1
mov dword [edx + 4], ecx
lea ecx, [ebp - 0x248]
call fcn.0040ce60
sub esp, 8
mov edx, esp
cmp dword [eax + 0x14], 8
jb 0x40f36c
mov ecx, dword [eax]
jmp 0x40f36e
mov ecx, eax
mov dword [edx], ecx
lea ecx, [ebp - 0x230]
mov eax, dword [eax + 0x10]
mov dword [edx + 4], eax
call fcn.0040ce60
lea ecx, [ebp - 0x230]
call fcn.0040db80
lea eax, [ebp - 0x230]
cmp esi, eax
je 0x40f3a2
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.004048d0
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x40f3c0
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00405f00
xor eax, eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x220], 0
cmp eax, 8
jb 0x40f3fb
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.00405f00
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447880
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.00447880
mov esp, ebp
pop ebp
ret
Function at 0x40f420
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x478050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x210]
mov esi, ecx
push eax
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x40f4cb
cmp word [ebp - 0x210], 0
je 0x40f4cb
sub esp, 8
lea eax, [ebp - 0x210]
mov edx, esp
mov dword [edx], eax
cmp word [ebp - 0x210], 0
jne 0x40f48f
xor ecx, ecx
mov dword [edx + 4], ecx
mov ecx, esi
call fcn.0040ce60
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447880
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x210]
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f4a0
sub ecx, edi
sar ecx, 1
mov dword [edx + 4], ecx
mov ecx, esi
call fcn.0040ce60
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447880
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0x214], 7
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x218], 0
mov word [ebp - 0x228], ax
call fcn.0040f2e0
mov ecx, esi
test al, al
je 0x40f51d
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
mov dword [esi + 0x10], 0
push eax
mov word [esi], ax
lea eax, [ebp - 0x228]
push eax
call fcn.004048d0
jmp 0x40f534
sub esp, 8
mov eax, esp
mov dword [eax], 0x471f70
mov dword [eax + 4], 3
call fcn.0040ce60
mov eax, dword [ebp - 0x214]
cmp eax, 8
jb 0x40f552
inc eax
lea ecx, [ebp - 0x228]
push eax
push dword [ebp - 0x228]
call fcn.00405f00
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00447880
mov esp, ebp
pop ebp
ret
Function at 0x40f570
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x478050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x20], 0
mov esi, edx
cmp dword [edi + 0x14], 8
jb 0x40f598
mov ebx, dword [edi]
jmp 0x40f59a
mov ebx, edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40f5da
test al, 0x10
je 0x40f5bd
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447880
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x40f5c7
mov dword [esi], 0xfffffff7
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447880
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.0040d5c0
cmp dword [edi + 0x14], 8
jb 0x40f5ef
mov eax, dword [edi]
jmp 0x40f5f1
mov eax, edi
push dword [edi + 0x10]
push eax
push dword [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.0040ba50
test eax, eax
jne 0x40f613
test esi, esi
je 0x40f65a
mov dword [esi], 0xfffffffc
xor bl, bl
jmp 0x40f660
mov edx, esi
lea ecx, [ebp - 0x1c]
call fcn.0040f570
test al, al
jne 0x40f625
xor bl, bl
jmp 0x40f660
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40f65e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0xb7
jne 0x40f64d
mov ecx, edi
call fcn.0040f2c0
test al, al
jne 0x40f65e
test esi, esi
je 0x40f65a
mov ecx, ebx
call fcn.0040e470
mov dword [esi], eax
xor bl, bl
jmp 0x40f660
mov bl, 1
mov ecx, dword [ebp - 8]
cmp ecx, 8
jb 0x40f675
inc ecx
push ecx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
call fcn.00405f00
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00447880
mov esp, ebp
pop ebp
ret