joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423f00
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, eax
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [esi + 0x24]
push edi
mov edi, dword [esp + 0x18]
mov eax, 0xffff
sub eax, ecx
add ecx, edi
lea edi, [esi + 0x10]
push edi
lea ebx, [esp + 0x14]
push ebx
push eax
push ecx
mov dword [esp + 0x20], 0
mov ecx, dword [edx]
push ecx
mov ebp, 1
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
cmp ebx, ebp
je 0x423f67
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x423f67
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ERROR_npPipe::read_err_code_d__n
push 0
call fcn.00417220
add esp, 0xc
test ebx, ebx
jne 0x423fbb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x423f90
push str._ERROR_npPipeClient::read_n
push ebx
call fcn.00417220
add esp, 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
mov eax, dword [esi + 0x24]
mov eax, dword [eax]
push 1
lea edx, [esp + 0x14]
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov esi, dword [esi + 0x20]
test esi, esi
mov ebp, eax
je 0x423f86
cmp dword [esp + 0x10], 0
je 0x423f86
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
add dword [eax], ecx
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 8

Function at 0x425150
Capabilities:
Create pipe

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4aaeb0]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
mov esi, ecx
mov eax, str..PIPE_
lea ecx, [esp + 4]
call fcn.004230d0
push esi
lea esi, [esp + 8]
call fcn.00425460
mov eax, dword [esp + 0x218]
mov ecx, dword [esp + 0x214]
push ebx
push 1
push 0xffff
push 0xffff
push eax
push 4
push ecx
mov edx, esi
push edx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov dword [edi], eax
mov esi, ecx
cmp esi, 1
je 0x4251ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ERROR_npPipe::create_err_code_d__n
push 0
call fcn.00417220
add esp, 0xc
mov ecx, dword [esp + 0x20c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00452816
add esp, 0x20c
ret 8
Function at 0x425f10
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x47478b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4aaeb0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov edi, edx
push 0x104b4
call fcn.00452880
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x20], 0
je 0x425f79
mov ecx, dword [edi + 4]
push edi
push ecx
mov ecx, dword [edi]
lea edx, [esi + 0x20c]
push edx
mov edx, dword [edi + 0x21c]
add esi, 4
push esi
push eax
call fcn.004234b0
mov esi, eax
jmp 0x425f7b
xor esi, esi
mov dword [esp + 0x20], 0xffffffff
add dword [edi + 0x29c], 1
test esi, esi
je 0x425fd1
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push esi
mov ebx, eax
call fcn.00423810
test eax, eax
jne 0x425fb7
call edi
sub eax, ebx
cmp eax, 0x2710
push esi
ja 0x425fc3
call fcn.00423810
test eax, eax
je 0x425fa2
mov eax, esi
call fcn.00423750
test eax, eax
jne 0x425fe6
push esi
call fcn.00423660
push esi
call fcn.00452ad1
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x4269d0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x472046
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x4aaeb0]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push ebp
push esi
mov eax, dword [0x4aaeb0]
xor eax, esp
push eax
lea eax, [esp + 0x23c]
mov dword fs:[0], eax
xor ebp, ebp
push 0x206
lea eax, [esp + 0x36]
push ebp
mov dword [esp + 0x18], ebp
push eax
mov esi, ecx
mov word [esp + 0x3c], bp
call fcn.0045a220
mov edx, dword [esp + 0x258]
add esp, 0xc
lea ecx, [esp + 0x30]
push ecx
push ebp
push esi
push edx
push ebp
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jge 0x426ad5
push 0x45
push str.._srcutil_npPathUtil.cpp_78__:__npz::cmn::npPathUtil::getFolderPath_
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebp
mov word [esp + 0x20], bp
call fcn.00401540
mov dword [esp + 0x244], ebp
mov dword [esp + 0x10], ebp
push 0xffffffffffffffff
lea esi, [esp + 0x14]
mov byte [esp + 0x248], 1
call fcn.00417410
mov ebx, dword [esp + 0x1c]
add esp, 4
cmp dword [esp + 0x2c], 8
jae 0x426a99
lea ebx, [esp + 0x18]
mov esi, dword [esp + 0x10]
push esi
mov ecx, 2
call fcn.0041aaa0
push esi
call fcn.0045332d
add esp, 8
cmp dword [esp + 0x2c], 8
jb 0x426ac5
mov eax, dword [esp + 0x18]
push eax
call fcn.00452ad1
add esp, 4
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebp
mov word [edi + 4], bp
jmp 0x426b0c
lea eax, [esp + 0x30]
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebp
mov word [edi + 4], bp
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x426af0
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x34]
push ecx
mov ecx, edi
call fcn.00401540
mov eax, edi
mov ecx, dword [esp + 0x23c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.00452816
add esp, 0x238
ret
Function at 0x427610
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x471f96
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x4aaeb0]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4aaeb0]
xor eax, esp
push eax
lea eax, [esp + 0x240]
mov dword fs:[0], eax
xor ebx, ebx
push 0x206
lea eax, [esp + 0x3a]
push ebx
push eax
mov edi, ecx
mov word [esp + 0x40], bx
call fcn.0045a220
mov ebp, dword [edi + 0x14]
add esp, 0xc
xor esi, esi
cmp dword [edi + 0x18], 8
jb 0x427677
mov edi, dword [edi + 4]
jmp 0x42767a
add edi, 4
cmp ebp, ebx
jl 0x4276f0
mov edi, edi
lea esi, [edi + esi*2]
push 0x5c
push esi
call fcn.00453b58
add esp, 8
cmp eax, ebx
je 0x42769d
sub eax, edi
sar eax, 1
add eax, 1
mov esi, eax
jmp 0x4276ba
push 0x2f
push esi
call fcn.00453b58
add esp, 8
cmp eax, ebx
je 0x4276b7
sub eax, edi
sar eax, 1
add eax, 1
mov esi, eax
jmp 0x4276ba
lea esi, [ebp + 1]
push esi
lea ecx, [esp + 0x38]
push edi
push ecx
call fcn.00453efc
lea edx, [esp + 0x40]
push ebx
push edx
call fcn.00454591
add esp, 0x14
cmp eax, 0xffffffff
jne 0x4276e9
push ebx
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x42771a
add esi, 1
cmp esi, ebp
jle 0x427680
xor eax, eax
mov ecx, dword [esp + 0x240]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.00452816
add esp, 0x238
ret
push 0x48
push str.._srcutil_npPathUtil.cpp_328__:__npz::cmn::npPathUtil::createDirectory_
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], bx
call fcn.00401540
mov dword [esp + 0x248], ebx
mov dword [esp + 0x14], ebx
push 0xffffffffffffffff
lea esi, [esp + 0x18]
mov byte [esp + 0x24c], 1
call fcn.00417410
mov ebx, dword [esp + 0x20]
mov edi, 8
add esp, 4
cmp dword [esp + 0x30], edi
jae 0x42776f
lea ebx, [esp + 0x1c]
mov esi, dword [esp + 0x14]
push esi
mov ecx, 2
call fcn.0041aaa0
push esi
call fcn.0045332d
add esp, 8
cmp dword [esp + 0x30], edi
jb 0x42779a
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00452ad1
add esp, 4
mov eax, 1
jmp 0x4276f2
Function at 0x429180
Capabilities:
Get session user name

Disassembly:
push 0xffffffffffffffff
push 0x471d91
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x4aaeb0]
xor eax, esp
mov dword [esp + 0x268], eax
push ebx
push esi
mov eax, dword [0x4aaeb0]
xor eax, esp
push eax
lea eax, [esp + 0x278]
mov dword fs:[0], eax
xor ebx, ebx
push 0x206
lea eax, [esp + 0x72]
push ebx
push eax
mov dword [esp + 0x20], 0x104
mov word [esp + 0x78], bx
call fcn.0045a220
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x70]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x42927d
push 0x49
push str.._srcutil_npProcUtil.cpp_1825__:__npz::cmn::npProcUtil::isSystemAccount_
lea ecx, [esp + 0x3c]
mov dword [esp + 0x54], 7
mov dword [esp + 0x50], ebx
mov word [esp + 0x40], bx
call fcn.00401540
mov dword [esp + 0x280], ebx
mov dword [esp + 0x10], ebx
push 0xffffffffffffffff
lea esi, [esp + 0x14]
mov byte [esp + 0x284], 1
call fcn.00417410
mov ebx, dword [esp + 0x3c]
add esp, 4
cmp dword [esp + 0x4c], 8
jae 0x429244
lea ebx, [esp + 0x38]
mov esi, dword [esp + 0x10]
push esi
mov ecx, 2
call fcn.0041aaa0
add esp, 4
push esi
call fcn.0045332d
add esp, 4
cmp dword [esp + 0x4c], 8
jb 0x429273
mov eax, dword [esp + 0x38]
push eax
call fcn.00452ad1
add esp, 4
mov eax, 1
jmp 0x429334
push 6
mov esi, 7
push str.SYSTEM
lea ecx, [esp + 0x58]
mov dword [esp + 0x70], esi
mov dword [esp + 0x6c], ebx
mov word [esp + 0x5c], bx
call fcn.00401540
mov dword [esp + 0x280], 2
lea eax, [esp + 0x6c]
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], bx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4292c0
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x70]
push ecx
lea ecx, [esp + 0x20]
call fcn.00401540
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x1c]
call fcn.00418250
add esp, 4
cmp al, 1
sete byte [esp + 0xf]
cmp dword [esp + 0x30], 8
jb 0x42930a
mov eax, dword [esp + 0x1c]
push eax
call fcn.00452ad1
add esp, 4
cmp dword [esp + 0x68], 8
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], bx
jb 0x42932b
mov ecx, dword [esp + 0x54]
push ecx
call fcn.00452ad1
add esp, 4
xor eax, eax
cmp byte [esp + 0xf], bl
sete al
mov ecx, dword [esp + 0x278]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x268]
xor ecx, esp
call fcn.00452816
add esp, 0x278
ret
Function at 0x42ac60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x440
mov eax, dword [0x4aaeb0]
xor eax, esp
mov dword [esp + 0x43c], eax
mov eax, dword [esp + 0x444]
push esi
push edi
push 0x206
lea ecx, [esp + 0x36]
push 0
push ecx
mov dword [esp + 0x1c], eax
mov word [esp + 0x3c], 0
call fcn.0045a220
add esp, 0xc
mov dword [esp + 0xc], 0x104
call fcn.00429180
test eax, eax
jne 0x42ad78
lea edi, [esp + 0x14]
call fcn.0042c3c0
push 0x206
lea edx, [esp + 0x23e]
push 0
push edx
mov word [esp + 0x244], 0
call fcn.0045a220
mov eax, dword [esp + 0x24]
add esp, 0xc
cmp dword [esp + 0x2c], 8
jae 0x42acea
lea eax, [esp + 0x18]
push str.Control_PanelDesktop_
push eax
push str._s_s
mov ecx, 0x104
lea edi, [esp + 0x244]
call fcn.004181e0
add esp, 0xc
test eax, eax
je 0x42ad3d
cmp dword [esp + 0x2c], 8
jb 0x42ad21
mov eax, dword [esp + 0x18]
push eax
call fcn.00452ad1
add esp, 4
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x43c]
xor ecx, esp
call fcn.00452816
add esp, 0x440
ret
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x34]
push edx
push str.PreferredUILanguages
lea ecx, [esp + 0x244]
mov edx, 0x80000003
call fcn.00418a80
add esp, 0xc
cmp dword [esp + 0x2c], 8
mov esi, eax
jb 0x42adcb
mov eax, dword [esp + 0x18]
push eax
call fcn.00452ad1
add esp, 4
jmp 0x42adcb
lea ecx, [esp + 8]
push ecx
push 0x20019
push 0
push str.Control_PanelDesktop_
push 0x80000001
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x42adc0
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x34]
push eax
push esi
push esi
push str.PreferredUILanguages
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x42ad21
lea eax, [esp + 0x30]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42ade0
mov ecx, dword [esp + 0x10]
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x34]
push eax
call fcn.00401540
mov ecx, dword [esp + 0x444]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00452816
add esp, 0x440
ret
Function at 0x42b0c0
Capabilities:
Identify system language via api

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x4ac688
mov edi, eax
call fcn.00418250
add esp, 4
cmp al, 1
jne 0x42b212
xor ebp, ebp
mov dword [esp + 0x10], ebp
call fcn.00419c10
test eax, eax
jne 0x42b12a
call fcn.00429180
test eax, eax
jne 0x42b12a
lea esi, [esp + 0x10]
call fcn.0042ae20
test eax, eax
jne 0x42b12a
cmp dword [edi + 0x18], 8
jb 0x42b10c
mov eax, dword [edi + 4]
jmp 0x42b10f
lea eax, [edi + 4]
push eax
push 0x48ae50
xor ecx, ecx
mov ebx, str.._srcutil_npWinLanguage.cpp_398__:__npz::cmn::npWinLanguage::getSetSelectLang_
call fcn.0041aaa0
mov esi, dword [esp + 0x18]
add esp, 8
jmp 0x42b143
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
movzx eax, ax
mov esi, eax
and esi, 0x3ff
shr eax, 0xa
mov ebp, eax
cmp esi, 7
jg 0x42b181
je 0x42b176
cmp esi, 4
jne case.0x42b19a.9
cmp ebp, 1
je 0x42b16b
cmp ebp, 3
je 0x42b16b
push 0xffffffffffffffff
push 0
push 0x4ac6f8
jmp 0x42b1ec
push 0xffffffffffffffff
push 0
push 0x4ac714
jmp 0x42b1ec
push 0xffffffffffffffff
push 0
push 0x4ac784
jmp 0x42b1ec
cmp esi, 0x7c04
jg case.0x42b19a.9
je 0x42b16b
lea eax, [esi - 9]
cmp eax, 0x10
ja case.0x42b19a.9
movzx eax, byte [eax + 0x42b340]
jmp dword [eax*4 + 0x42b320]
push 0xffffffffffffffff
push 0
push 0x4ac6c0
jmp 0x42b1ec
push 0xffffffffffffffff
push 0
push 0x4ac6a4
jmp 0x42b1ec
push 0xffffffffffffffff
push 0
push 0x4ac730
jmp 0x42b1ec
push 0xffffffffffffffff
push 0
push 0x4ac74c
jmp 0x42b1ec
push 0xffffffffffffffff
push 0
push 0x4ac768
jmp 0x42b1ec
push 0xffffffffffffffff
push 0
push 0x4ac7a0
jmp 0x42b1ec
push 0xffffffffffffffff
push 0
push 0x4ac6dc
mov ecx, edi
call fcn.004016a0
cmp dword [edi + 0x18], 8
jb 0x42b1fe
mov eax, dword [edi + 4]
jmp 0x42b201
lea eax, [edi + 4]
push eax
push esi
push str.._srcutil_npWinLanguage.cpp_455__:__npz::cmn::npWinLanguage::getSetSelectLang__d____s
push 1
call fcn.00417220
add esp, 0x10
push 0x4ac6a4
mov eax, edi
call fcn.00418250
add esp, 4
cmp al, 1
je 0x42b315
push 0x4ac6c0
mov eax, edi
call fcn.00418250
add esp, 4
cmp al, 1
je 0x42b315
push 0x4ac6dc
mov eax, edi
call fcn.00418250
add esp, 4
cmp al, 1
je 0x42b315
push 0x4ac6f8
mov eax, edi
call fcn.00418250
add esp, 4
cmp al, 1
je 0x42b315
push 0x4ac714
mov eax, edi
call fcn.00418250
add esp, 4
cmp al, 1
je 0x42b315
push 0x4ac730
mov eax, edi
call fcn.00418250
add esp, 4
cmp al, 1
je 0x42b315
push 0x4ac74c
mov eax, edi
call fcn.00418250
add esp, 4
cmp al, 1
je 0x42b315
push 0x4ac768
mov eax, edi
call fcn.00418250
add esp, 4
cmp al, 1
je 0x42b315
push 0x4ac784
mov eax, edi
call fcn.00418250
add esp, 4
cmp al, 1
je 0x42b315
push 0x4ac7a0
mov eax, edi
call fcn.00418250
add esp, 4
cmp al, 1
je 0x42b315
cmp dword [edi + 0x18], 8
jb 0x42b2ef
mov edi, dword [edi + 4]
jmp 0x42b2f2
add edi, 4
push edi
push 0x48ae50
mov ecx, 2
mov ebx, str.._srcutil_npWinLanguage.cpp_473__:__npz::cmn::npWinLanguage::getSetSelectLang_
call fcn.0041aaa0
add esp, 8
mov eax, 0x22110402
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x42cf40
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x471ad8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push ebp
push esi
mov eax, dword [0x4aaeb0]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
push edi
push str.._srcutil_npFileUtil.cpp_35__:__npz::cmn::npFileUtil::deleteFile_____s
push 1
call fcn.00417220
add esp, 0xc
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
push edi
jne 0x42cfab
push str.no_file_exist_:__s
xor ecx, ecx
mov ebx, str.._srcutil_npFileUtil.cpp_40__:__npz::cmn::npFileUtil::deleteFile_
call fcn.0041aaa0
add esp, 8
xor eax, eax
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x42cfe5
push edi
push str.path_is_not_file_:__s
mov ecx, 2
mov ebx, str.._srcutil_npFileUtil.cpp_47__:__npz::cmn::npFileUtil::deleteFile_
call fcn.0041aaa0
add esp, 8
mov eax, 1
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
or esi, 0xffffffff
test eax, eax
lea ebp, [esi + 9]
jne 0x42d038
push str.._srcutil_npFileUtil.cpp_53__:__npz::cmn::npFileUtil::deleteFile_
lea ecx, [esp + 0x14]
call fcn.004014d0
push esi
lea eax, [esp + 0x14]
push 1
push eax
mov dword [esp + 0x5c], 0
call fcn.004175f0
add esp, 0xc
mov dword [esp + 0x50], esi
cmp dword [esp + 0x28], ebp
jb 0x42d038
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00452ad1
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x42cf96
push str.._srcutil_npFileUtil.cpp_58__:__npz::cmn::npFileUtil::deleteFile_
lea ecx, [esp + 0x14]
call fcn.004014d0
push esi
lea edx, [esp + 0x14]
push 1
push edx
mov dword [esp + 0x5c], 1
call fcn.004175f0
add esp, 0xc
mov dword [esp + 0x50], esi
cmp dword [esp + 0x28], ebp
jb 0x42d084
mov eax, dword [esp + 0x14]
push eax
call fcn.00452ad1
add esp, 4
call fcn.004035a0
mov eax, dword [eax + 8]
push eax
mov ecx, 0x22110001
lea esi, [esp + 0x30]
call fcn.00412d30
mov ecx, 2
mov dword [esp + 0x50], ecx
cmp dword [eax + 0x18], ebp
jb 0x42d0ae
mov eax, dword [eax + 4]
jmp 0x42d0b1
add eax, 4
push edi
push eax
mov ebx, str.._srcutil_npFileUtil.cpp_59__:__npz::cmn::npFileUtil::deleteFile_
call fcn.0041aaa0
add esp, 8
cmp dword [esp + 0x44], ebp
jb 0x42d0d3
mov ecx, dword [esp + 0x30]
push ecx
call fcn.00452ad1
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
Function at 0x42d870
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x471a58
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4aaeb0]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [esp + 0x64]
mov eax, dword [edi + 0x30]
xor esi, esi
push esi
lea ecx, [esp + 0x68]
push ecx
push ebx
push edx
push eax
mov dword [esp + 0x78], esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, esi
je 0x42d8c6
cmp ebx, dword [esp + 0x64]
jne 0x42d8c6
xor eax, eax
jmp 0x42d9ac
push 0x3e
push str.._src_file_npFileImpl.cpp_108__:__npz::cmn::npFileImpl::write_
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], esi
mov word [esp + 0x28], si
call fcn.00401540
mov dword [esp + 0x5c], esi
mov dword [esp + 0x18], esi
push 0xffffffffffffffff
lea esi, [esp + 0x1c]
mov byte [esp + 0x60], 1
call fcn.00417410
mov ebx, dword [esp + 0x24]
mov ebp, 8
add esp, 4
cmp dword [esp + 0x34], ebp
jae 0x42d915
lea ebx, [esp + 0x20]
mov esi, dword [esp + 0x18]
push esi
mov ecx, 2
call fcn.0041aaa0
add esp, 4
push esi
call fcn.0045332d
add esp, 4
mov dword [esp + 0x5c], 0xffffffff
cmp dword [esp + 0x34], ebp
jb 0x42d94b
mov eax, dword [esp + 0x20]
push eax
call fcn.00452ad1
add esp, 4
call fcn.004035a0
mov eax, dword [eax + 8]
push eax
mov ecx, 0x22110001
lea esi, [esp + 0x3c]
call fcn.00412d30
mov ecx, 2
mov dword [esp + 0x5c], ecx
cmp dword [edi + 0x1c], ebp
jb 0x42d975
mov edi, dword [edi + 8]
jmp 0x42d978
add edi, 8
cmp dword [eax + 0x18], ebp
jb 0x42d982
mov eax, dword [eax + 4]
jmp 0x42d985
add eax, 4
push edi
push eax
mov ebx, str.._src_file_npFileImpl.cpp_109__:__npz::cmn::npFileImpl::write_
call fcn.0041aaa0
add esp, 8
cmp dword [esp + 0x50], ebp
jb 0x42d9a7
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.00452ad1
add esp, 4
mov eax, 0x22110605
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret 4
Function at 0x42df30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x472a28
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push esi
mov eax, dword [0x4aaeb0]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, 8
cmp dword [edi + 0x18], ebx
lea eax, [edi + 4]
mov dword [esp + 0xc], eax
jb 0x42df70
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42e07c
push 0x40
xor esi, esi
push str.._src_nsConvenience.cpp_115__:__npz::cmn::nsConvenience::isAuth_
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], esi
mov word [esp + 0x20], si
call fcn.00401540
mov dword [esp + 0x58], esi
mov dword [esp + 0x10], esi
push 0xffffffffffffffff
lea esi, [esp + 0x14]
mov byte [esp + 0x5c], 1
call fcn.00417410
add esp, 4
cmp dword [esp + 0x2c], ebx
mov ebx, dword [esp + 0x18]
jae 0x42dfcb
lea ebx, [esp + 0x18]
mov esi, dword [esp + 0x10]
push esi
mov ecx, 2
call fcn.0041aaa0
add esp, 4
push esi
call fcn.0045332d
mov ebx, 8
add esp, 4
mov dword [esp + 0x58], 0xffffffff
cmp dword [esp + 0x2c], ebx
jb 0x42e006
mov eax, dword [esp + 0x18]
push eax
call fcn.00452ad1
add esp, 4
call fcn.004035a0
mov eax, dword [eax + 8]
push eax
mov ecx, 0x22110001
lea esi, [esp + 0x34]
call fcn.00412d30
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x58], 2
cmp dword [edi + 0x18], ebx
jb 0x42e030
mov ecx, dword [ecx]
cmp dword [eax + 0x18], ebx
jb 0x42e03a
mov eax, dword [eax + 4]
jmp 0x42e03d
add eax, 4
push ecx
push eax
mov ecx, 2
mov ebx, str.._src_nsConvenience.cpp_116__:__npz::cmn::nsConvenience::isAuth_
call fcn.0041aaa0
add esp, 8
cmp dword [esp + 0x48], 8
jb 0x42e065
mov edx, dword [esp + 0x34]
push edx
call fcn.00452ad1
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x42e09b
push edi
call fcn.0042e0e0
add esp, 4
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 1
jne 0x42e065
push edi
call fcn.0042e0e0
add esp, 4
test eax, eax
jne 0x42e0bf
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.0042e260
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret