joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47a6c8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x47a6df
add esp, 0xfffffff0
call fcn.00403d4c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00425768
mov eax, dword [0x562c00]
cmp word [eax + 2], 0
jne 0x47a707
mov eax, dword [0x562c00]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0047be48
mov eax, dword [0x562d38]
cmp word [eax + 2], 0
jne 0x47a721
mov eax, dword [0x562d38]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0047c040
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41ab20]
call fcn.004039b8
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41ab20]
call fcn.004039b8
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x427d8c]
call fcn.0042fae4
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x47a8a8
mov eax, dword [0x562a88]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042feb4
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x47c5e0
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x562a88]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d778
test eax, eax
je 0x47a816
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409838
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d7a0
test eax, eax
je 0x47a82a
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004049f8
mov eax, dword [0x562868]
cmp byte [eax], 0
jne 0x47a85e
mov eax, ebx
call fcn.0047a9d0
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0047c7bc
mov eax, ebx
call fcn.0047d180
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x47a89e
call fcn.00403da4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47ac50
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x563bf0]
cmp dword [eax + 0x30], 0
je 0x47acfa
cmp dword [ebx + 0x94], 0
jne 0x47acf4
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x47abe0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x47acf4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
dec dword [ebx + 0x243489f0]
Function at 0x47b85c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x47b891
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404868
jmp 0x47b89e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004047cc
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x47c998
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x47c9d9
mov eax, esi
call fcn.00462e48
test al, al
je 0x47c9d9
mov eax, dword [ebx + 0x84]
call fcn.00462b44
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x47c9d9
push 0
mov eax, dword [ebx + 0x84]
call fcn.00462b44
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x481bac
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x41a0a0]
call fcn.00405234
xor eax, eax
push ebp
push 0x481cf0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x561318], 0
jne 0x481bff
mov ecx, dword [0x562894]
mov dl, 1
mov eax, dword [0x407f18]
call fcn.0040c964
call fcn.004041b4
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.004030d0
mov eax, ebx
call fcn.00405084
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x481d00
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406518
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00405094
test eax, eax
jle 0x481c97
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x481c90
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404a10
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.004049f8
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408dc4
test eax, eax
jne 0x481c90
mov ebx, 0x15
jmp 0x481c9c
mov ebx, 0x10
jmp 0x481c9c
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x561318]
call fcn.00481b04
mov eax, dword [ebp - 8]
call fcn.00481b04
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406530
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481cf7
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.0040479c
lea eax, [ebp - 0x10]
mov edx, dword [0x41a0a0]
call fcn.00405304
ret
Function at 0x4889e8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404c38
mov eax, dword [ebp - 8]
call fcn.00404c38
xor eax, eax
push ebp
push 0x488a85
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.004030d0
mov dword [ebp - 0x44], 0x3c
mov eax, 0x488a94
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
call fcn.00404c48
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.00404c48
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x40
cmp byte [ebp + 8], 0
je 0x488a5c
mov dword [ebp - 0x28], 5
jmp 0x488a61
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488a8c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040479c
ret

Function at 0x4905b4
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404c38
xor eax, eax
push ebp
push 0x49066f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00408e34
mov eax, dword [ebp - 8]
call fcn.00404a48
cmp eax, 1
jl 0x490630
mov edx, dword [ebp - 4]
mov dl, byte [edx + eax - 1]
and edx, 0xff
sub edx, 0x30
add edx, edx
cmp edx, 9
jle 0x490610
sub edx, 9
add ebx, edx
dec eax
cmp eax, 1
jl 0x490630
mov edx, dword [ebp - 4]
mov dl, byte [edx + eax - 1]
and edx, 0xff
add ebx, edx
sub ebx, 0x30
dec eax
cmp eax, 1
jge 0x4905f6
mov eax, ebx
mov ecx, 0xa
cdq
idiv ecx
mov eax, 0xa
sub eax, edx
mov ebx, eax
cmp ebx, 0xa
jne 0x49064a
xor ebx, ebx
mov eax, esi
lea edx, [ebx + 0x30]
call fcn.00404960
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x490676
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040479c
ret
Function at 0x523c98
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x523cc6
mov eax, ebx
call fcn.0052474c
cmp dword [ebx + 0x40], 0
je 0x523cbf
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x523d37
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x523d29
cmp dword [ebx + 8], 0
je 0x523ce8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x523cfa
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x523d29
cmp dword [ebx + 8], 0
je 0x523cdb
cmp eax, 3
je 0x523d0d
dec eax
jne 0x523cdb
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x523cdb
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x523cdb
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x523d55
cmp dword [ebx + 0x14], 0xcc
je 0x523d55
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00523d60
pop ebx
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00431219
Function at 0x41bec0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x53e754]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0xc8]
cmp eax, 5
je 0x41c003
mov ecx, dword [edi + 0x20]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov eax, dword [ecx + 8]
test eax, eax
jne 0x41bf05
mov eax, dword [ecx + 0xc]
push 0
lea ecx, [esp + 0x18]
push ecx
push 4
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 4
push dword [esp + 0x18]
lea edx, [esp + 0x18]
mov ecx, str.IPC::Read
call fcn.0045ff35
add esp, 8
cmp dword [esp + 0x14], 4
jne 0x41bfe7
push 8
call fcn.004a6611
mov esi, eax
xorps xmm0, xmm0
mov dword [esp + 0x1c], esi
add esp, 4
movq qword [esi], xmm0
mov ebx, dword [esp + 0x10]
mov dword [esi], 0
mov dword [esi + 4], 0
test ebx, ebx
je 0x41bf75
push ebx
push 1
call fcn.004cdead
add esp, 8
mov dword [esi], eax
mov edx, dword [esi]
mov dword [esi + 4], ebx
mov ecx, dword [edi + 0x20]
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], 0
mov eax, dword [ecx + 8]
test eax, eax
jne 0x41bf97
mov eax, dword [ecx + 0xc]
push 0
lea ecx, [esp + 0x1c]
push ecx
push ebx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x14]
mov ecx, str.IPC::Read
push ebx
push dword [esp + 0x1c]
call fcn.0045ff35
mov eax, dword [esp + 0x20]
add esp, 8
cmp eax, dword [esp + 0x10]
je 0x41c017
mov eax, dword [esi]
test eax, eax
je 0x41bfdc
push eax
call fcn.004c6d3f
add esp, 4
mov dword [esi], 0
push 8
push esi
call fcn.004a6603
add esp, 8
mov ecx, str.Null_buffer_received_over_IPC__disconnect_error_._Aborting_listen_loop.
call fcn.0041c7c0
mov ecx, edi
call fcn.0041be10
mov ecx, dword [edi + 0x10c]
mov eax, dword [ecx]
call dword [eax + 8]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.004a65f2
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 4]
cmp edx, 4
je 0x41c03d
mov ecx, str.Invalid_data_received__size__d
call fcn.0041c8b0
mov ecx, dword [esp + 0x1c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a65f2
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
mov ecx, edi
movzx eax, byte [eax]
push eax
call fcn.0041c2a0
mov ecx, dword [edi + 0x20]
mov eax, dword [ecx + 8]
test eax, eax
jne 0x41c029
mov eax, dword [ecx + 0xc]
test eax, eax
jne 0x41c029
mov ecx, str.IPC_pipe_disconnect_detected_
call fcn.00413a20
jmp 0x41bff1
Function at 0x422ee0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f00a1
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
mov eax, dword [0x53e754]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebx + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x20], 0
movq qword [esi], xmm0
mov dword [esi + 8], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x20], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
cmp edi, 2
jl 0x423058
mov ecx, dword [esi + 8]
mov eax, 0x2aaaaaab
sub ecx, dword [esi]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jbe 0x422fa9
cmp edi, 0xaaaaaaa
ja 0x423083
push edi
mov ecx, esi
call fcn.00423a90
mov edi, 1
cmp dword [ebp - 0x18], edi
jle 0x423058
nop word [eax + eax]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 7
mov edx, dword [eax + edi*4]
xor eax, eax
mov word [ebp - 0x3c], ax
mov eax, edx
lea ecx, [eax + 2]
mov dword [ebp - 0x24], ecx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x422fe2
sub eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x3c]
sar eax, 1
push eax
push edx
call fcn.004225a0
mov dword [ebp - 4], 1
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
je 0x423036
movups xmm0, xmmword [ebp - 0x3c]
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x2c]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [esi + 4], 0x18
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 7
mov word [ebp - 0x3c], ax
jmp 0x423042
lea ecx, [ebp - 0x3c]
push ecx
push eax
mov ecx, esi
call fcn.00423ef0
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0
call fcn.00419480
inc edi
cmp edi, dword [ebp - 0x18]
jl 0x422fc0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a65f2
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
call fcn.00414680
int3
Function at 0x42e8b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f143c
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xc
push esi
mov eax, dword [0x53e754]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov ecx, dword [ebx + 8]
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
movups xmm0, xmmword [ebx + 0x10]
mov dword [esi], vtable.spdlog::pattern_formatter.0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
movups xmmword [esi + 4], xmm0
mov byte [ebx + 0x10], 0
movq xmm0, qword [ebx + 0x20]
movq qword [esi + 0x14], xmm0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0xf
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0xf
mov byte [esi + 0x1c], 0
mov eax, dword [ebx + 0xc]
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
push ecx
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.0042eaf0
mov edx, dword [ebx + 0x24]
cmp edx, 0x10
jb 0x42e99d
mov ecx, dword [ebx + 0x10]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42e993
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42e9b4
push edx
push ecx
call fcn.004a6603
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x20
call fcn.004c6cef
int3
Function at 0x431d10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f1a30
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x53e754]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
call fcn.0048f5d2
cmp edx, dword [edi + 0x74]
jg 0x431d59
jl 0x431d51
cmp eax, dword [edi + 0x70]
jae 0x431d59
lea ebx, [edi + 0x84]
jmp 0x431d67
lea ebx, [edi + 0x84]
mov ecx, edi
push ebx
call fcn.00431bc0
mov eax, dword [esi + 0x224]
push dword [edi + 0x80]
mov esi, dword [eax + 8]
push esi
push 1
push dword [eax + 4]
call fcn.004cbda4
add esp, 0x10
cmp eax, esi
jne 0x431da6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a65f2
mov esp, ebp
pop ebp
ret 4
mov edx, ebx
lea ecx, [ebp - 0x4c]
call fcn.0042d020
push eax
lea eax, [ebp - 0x64]
mov dword [ebp - 4], 0
push str.Failed_writing_to_file
push eax
call fcn.00435110
add esp, 0xc
mov esi, eax
mov byte [ebp - 4], 1
call fcn.004cd5cb
lea ecx, [ebp - 0x34]
push dword [eax]
push esi
call fcn.0042ce50
push 0x53bac8
lea eax, [ebp - 0x34]
push eax
call fcn.004bdd3e
int3
Function at 0x436c70
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f218a
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x53e754]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
sub esp, 0x18
mov ecx, esp
push dword [ebp + 8]
call fcn.0041a4d0
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
call fcn.00436f40
mov dword [ebp - 4], 0
push 0x1f0
mov dword [esi], vtable.spdlog::async_logger.0
call fcn.004a6611
mov dword [ebp + 0x10], eax
sub esp, 0x24
mov edi, esp
mov dword [ebp + 0xc], esp
mov dword [ebp - 0x14], edi
mov dword [edi + 0x24], 0
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0x24]
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x436cf8
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [edi + 0x24], eax
sub esp, 0x28
mov edi, esp
mov dword [ebp + 0x24], esp
mov dword [ebp - 0x14], edi
mov dword [edi + 0x24], 0
mov byte [ebp - 4], 4
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x436d20
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [edi + 0x24], eax
sub esp, 0x28
mov edi, esp
mov dword [ebp + 0x1c], esp
mov dword [ebp - 0x14], edi
mov dword [edi + 0x24], 0
mov byte [ebp - 4], 6
mov ecx, dword [esi + 0x64]
test ecx, ecx
je 0x436d45
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [edi + 0x24], eax
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x14], esp
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov eax, dword [esi + 0x30]
test eax, eax
je 0x436d65
lock inc dword [eax + 4]
mov eax, dword [esi + 0x2c]
mov dword [ecx], eax
mov eax, dword [esi + 0x30]
mov dword [ecx + 4], eax
sub esp, 0x18
mov byte [ebp - 4], 8
mov ecx, esp
mov dword [ebp - 0x18], esp
push dword [ebp + 8]
call fcn.0041a4d0
push dword [ebp + 0x20]
lea eax, [esi + 0x20]
mov byte [ebp - 4], 9
push dword [ebp + 0x18]
push dword [ebp + 0x14]
sub esp, 0xc
mov ecx, esp
push eax
call fcn.00435880
mov ecx, dword [ebp + 0x10]
mov byte [ebp - 4], 1
call fcn.00430040
mov dword [esi + 0x78], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x20

Function at 0x439dd0
Capabilities:
Create directory

Disassembly:
push ebx
push edi
mov ebx, ecx
push 0x5c
push ebx
call fcn.004bda97
push 0x2f
push ebx
mov edi, eax
call fcn.004bda97
add esp, 0x10
cmp eax, edi
cmova edi, eax
test edi, edi
je 0x439e0f
push esi
movzx esi, word [edi]
xor eax, eax
mov ecx, ebx
mov word [edi], ax
call fcn.00439dd0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov word [edi], si
pop esi
pop edi
mov al, 1
pop ebx
ret
Function at 0x439e20
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f26a0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x53e754]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x439e56
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x439eb4
lea ecx, [ebp - 0x40]
call fcn.0043a4c0
mov edi, eax
mov edx, esi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00432fe0
mov byte [ebp - 4], 1
cmp dword [edi + 0x14], 8
jb 0x439e88
mov edi, dword [edi]
cmp dword [eax + 0x14], 8
jb 0x439e90
mov eax, dword [eax]
push edi
mov edx, eax
mov ecx, str.Couldnt_delete_file__file:__s__lastError:__s_
call fcn.004413c0
add esp, 4
lea ecx, [ebp - 0x28]
call fcn.00419480
lea ecx, [ebp - 0x40]
call fcn.00419480
xor al, al
jmp 0x439eb6
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a65f2
mov esp, ebp
pop ebp
ret

Function at 0x439ee0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, ecx
push edi
push eax
mov dword [ebp - 4], eax
call fcn.004ce204
mov ebx, eax
push 0x5c
push ebx
call fcn.004bda97
push 0x2f
push ebx
mov edi, eax
call fcn.004bda97
add esp, 0x14
cmp eax, edi
cmova edi, eax
test edi, edi
je 0x439f2e
push esi
movzx esi, word [edi]
xor eax, eax
mov ecx, ebx
mov word [edi], ax
call fcn.00439dd0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov word [edi], si
pop esi
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call fcn.004c6d3f
add esp, 4
mov al, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43a300
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.004a7840
mov eax, dword [0x53e754]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov esi, ecx
mov word [ebp - 0x2008], ax
lea eax, [ebp - 0x2008]
push eax
push 0
push 0
push 0x1a
mov dword [ebp - 0x200c], esi
push 0
mov dword [ebp - 0x200c], esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x43a368
lea ecx, [ebp - 0x2008]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43a351
sub ecx, edx
sar ecx, 1
cmp ecx, 0xf00
jbe 0x43a37e
mov eax, dword [0x51dd04]
mov dword [ebp - 0x2008], eax
mov eax, dword [0x51dd08]
mov dword [ebp - 0x2004], eax
xor eax, eax
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x2008]
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43a3a0
sub ecx, edx
lea eax, [ebp - 0x2008]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.004225a0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004a65f2
mov esp, ebp
pop ebp
ret
Function at 0x43a3d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.004a7840
mov eax, dword [0x53e754]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
mov word [ebp - 0x2004], ax
mov esi, ecx
lea eax, [ebp - 0x2004]
mov dword [ebp - 0x2008], esi
push eax
push 0xf00
mov dword [ebp - 0x2008], esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, dword [ebp - 0x2004]
test eax, eax
mov edx, 0x2e
lea eax, [ebp - 0x2004]
cmove ecx, edx
lea edx, [eax + 2]
mov dword [ebp - 0x2004], ecx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43a430
sub eax, edx
sar eax, 1
cmp word [ebp + eax*2 - 0x2006], 0x5c
je 0x43a468
push edi
lea edi, [ebp - 0x2004]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x43a454
mov eax, dword [0x51dc50]
mov dword [edi], eax
pop edi
xor eax, eax
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x2004]
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43a484
sub ecx, edx
lea eax, [ebp - 0x2004]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.004225a0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004a65f2
mov esp, ebp
pop ebp
ret