joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40af20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f96e6
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x53f084]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
push 0x60
push 0
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x40afcc
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x40afcc
call fcn.0040a5f0
mov edi, eax
jmp 0x40b0eb
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x40afef
call fcn.0040a5f0
jmp 0x40b0de
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x40b00d
call fcn.0040a5f0
jmp 0x40b0de
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x40b02e
mov edi, 0x8007000e
jmp 0x40b0e0
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x40b124
jb 0x40b04c
cmp eax, 0xffffffff
ja 0x40b124
cmp eax, 0x400
jbe 0x40b061
push eax
lea ecx, [ebp - 0x418]
call fcn.0040d190
jmp 0x40b087
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x40b087
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
jne 0x40b09e
mov edi, 0x8007000e
jmp 0x40b0e0
push edi
push dword [ebp - 0x418]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x40b0be
call fcn.0040a5f0
jmp 0x40b0de
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.0040bcf0
mov edi, eax
test esi, esi
je 0x40b0eb
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x40b104
lea ecx, [ebp - 0x418]
call fcn.0040d180
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004d170a
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.0040a530
int3
Function at 0x40d1c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x53f084]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20a
lea eax, [ebp - 0x210]
mov esi, ecx
push 0
push eax
call fcn.004d43f0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40d247
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d210
sub eax, edx
lea ecx, [esi + 0x20]
push edi
sar eax, 1
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00405110
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x40d23a
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [esi + 0x20]
push eax
call fcn.0040a0d0
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004d170a
mov esp, ebp
pop ebp
ret

Function at 0x40d2c0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
cmp dword [ecx + 0x14], 8
push esi
push edi
mov esi, ecx
jb 0x40d2d5
mov esi, dword [ecx]
mov edi, dword [ecx + 0x10]
test edi, edi
je 0x40d2ee
mov edx, edi
mov eax, esi
cmp word [eax], 0x5c
je 0x40d2f8
add eax, 2
sub edx, 1
jne 0x40d2e0
or eax, 0xffffffff
inc eax
cmp edi, eax
jb 0x40d361
jmp 0x40d302
test eax, eax
je 0x40d2ee
sub eax, esi
sar eax, 1
jmp 0x40d2f1
mov dword [ecx + 0x10], eax
mov edx, ecx
cmp dword [ecx + 0x14], 8
jb 0x40d30f
mov edx, dword [ecx]
xor esi, esi
mov word [edx + eax*2], si
cmp dword [ecx + 0x14], 8
jb 0x40d31d
mov ecx, dword [ecx]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x40d357
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
test edx, edx
jg 0x40d35b
jl 0x40d349
test eax, eax
jae 0x40d35b
or eax, 0xffffffff
mov edx, SysReAllocString
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
xor edx, edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00405480
int3
Function at 0x40e060
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f98f6
mov eax, dword fs:[0]
push eax
sub esp, 0x470
mov eax, dword [0x53f084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov byte [ebp - 0x265], 1
mov dword [ebp - 0x26c], ebx
push ebx
push 2
mov dword [ebp - method.base::ProcessIterator.virtual_0], vtable.base::ProcessIterator.0
mov byte [ebp - 0x25c], bl
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x260], eax
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x28]
push esi
mov dword [ebp - method.base::NamedProcessIterator.virtual_0], vtable.base::NamedProcessIterator.0
call fcn.00404020
lea ecx, [ebp - 0x264]
mov dword [ebp - 4], 1
call fcn.0040e240
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40e1b3
nop word [eax + eax]
push dword [eax + 8]
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x40e134
mov dword [ebp - 4], 1
test bl, 1
je 0x40e130
lea ecx, [ebp - 0x31c]
and ebx, 0xfffffffe
call fcn.0040f1c0
xor al, al
jmp 0x40e19a
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne cl
mov byte [ebp - 0x266], cl
test eax, eax
je 0x40e173
push 0xea60
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40e191
mov dword [ebp - 4], 1
test bl, 2
je 0x40e191
and ebx, 0xfffffffd
lea ecx, [ebp - 0x3cc]
jmp 0x40e18c
test cl, cl
jne 0x40e191
mov dword [ebp - 4], 1
test bl, 4
je 0x40e191
and ebx, 0xfffffffb
lea ecx, [ebp - 0x47c]
call fcn.0040f1c0
push esi
call edi
mov al, byte [ebp - 0x266]
and byte [ebp - 0x265], al
lea ecx, [ebp - 0x264]
call fcn.0040e240
test eax, eax
jne 0x40e100
lea ecx, [ebp - 0x28]
mov dword [ebp - method.base::NamedProcessIterator.virtual_0], vtable.base::NamedProcessIterator.0
call fcn.00405080
push dword [ebp - 0x260]
mov dword [ebp - method.base::ProcessIterator.virtual_0], vtable.base::ProcessIterator.0
call edi
mov al, byte [ebp - 0x265]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d170a
mov esp, ebp
pop ebp
ret

Function at 0x40e240
Capabilities:
Enumerate processes

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Process32FirstW]
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xc]
nop
push 0x228
lea eax, [esi + 0x10]
push 0
push eax
call fcn.004d43f0
add esp, 0xc
mov dword [edi], 0x22c
cmp byte [esi + 8], 0
mov eax, dword [esi + 4]
push edi
push eax
jne 0x40e27c
mov byte [esi + 8], 1
call ebx
jmp 0x40e282
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
setne al
test al, al
je 0x40e29e
mov edx, dword [esi]
mov ecx, esi
mov edx, dword [edx + 4]
call edx
test al, al
je 0x40e250
mov eax, edi
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x40e6d0
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x53f084]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0x1c
lea eax, [ebp - 0x20c]
mov esi, ecx
push eax
mov dword [ebp - 0x210], esi
push 0
mov dword [ebp - 0x210], esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x513840
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40e736
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.debug.log
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor eax, eax
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x20c]
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e764
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00405110
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004d170a
mov esp, ebp
pop ebp
ret
Function at 0x40e9e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x288
mov eax, dword [0x53f084]
xor eax, esp
mov dword [esp + 0x284], eax
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
push edi
lea edi, [esi + 0x10]
je 0x40eb52
cmp byte [0x543fe8], 0
je 0x40eb52
push 0x104
lea eax, [esp + 0x84]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x80]
push 0x5c
push eax
call fcn.004d55b1
add esp, 8
test eax, eax
je 0x40ea49
xor ecx, ecx
mov word [eax + 2], cx
push str.debug_message.exe
lea eax, [esp + 0x84]
push 0x104
push eax
call fcn.004e0418
add esp, 0xc
cmp dword [esi + 0x14], 0x10
jb 0x40ea6b
mov esi, dword [esi]
mov eax, dword [edi]
lea edx, [esp + 8]
lea ecx, [esp + 0x68]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
call fcn.004114f0
cmp dword [esp + 0x78], 0
je 0x40eb49
cmp dword [esp + 0x7c], 8
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], 0x44
push ecx
push 0
push 0
push 0
push 0
push 0
xorps xmm0, xmm0
lea eax, [esp + 0x84]
cmovae eax, dword [esp + 0x84]
push 0
push eax
lea eax, [esp + 0xa4]
movlpd qword [esp + 0x48], xmm0
push eax
movlpd qword [esp + 0x54], xmm0
movlpd qword [esp + 0x5c], xmm0
movlpd qword [esp + 0x64], xmm0
movlpd qword [esp + 0x6c], xmm0
movlpd qword [esp + 0x74], xmm0
movlpd qword [esp + 0x7c], xmm0
movlpd qword [esp + 0x84], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40eb28
push 0xffffffffffffffff
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x10]
call esi
jmp 0x40eb49
cmp dword [esp + 0x7c], 8
lea eax, [esp + 0x68]
push 0x40010
cmovae eax, dword [esp + 0x6c]
push str.Fatal_error
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esp + 0x68]
call fcn.00405080
mov ecx, dword [esp + 0x28c]
pop edi
pop esi
xor ecx, esp
call fcn.004d170a
mov esp, ebp
pop ebp
ret
Function at 0x4108f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f9d7d
mov eax, dword fs:[0]
push eax
sub esp, 0x82c
mov eax, dword [0x53f084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x82c], esi
push 0x800
mov dword [ebp - 0x838], esi
lea eax, [ebp - 0x810]
mov dword [ebp - 0x834], 0
push 0
push eax
mov dword [ebp - 0x82c], 1
mov dword [ebp - 0x830], 0x800
call fcn.004d43f0
add esp, 0xc
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x82c]
push eax
push 0x51a9d8
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallExTab
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x410a24
mov dword [ebp - 0x818], eax
mov word [ebp - 0x828], ax
lea eax, [ebp - 0x810]
mov dword [ebp - 0x814], 7
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4109b0
sub eax, edx
lea ecx, [ebp - 0x828]
sar eax, 1
push eax
lea eax, [ebp - 0x810]
push eax
call fcn.00405110
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x828]
cmp dword [ebp - 0x814], 8
mov edx, dword [ebp - 0x818]
cmovae ecx, dword [ebp - 0x828]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
push esi
mov byte [esi], 0
mov dword [ebp - 0x834], 4
call fcn.00411200
add esp, 4
lea ecx, [ebp - 0x828]
call fcn.00405080
jmp 0x410a43
push 4
mov dword [esi + 0x10], 0
mov ecx, esi
mov dword [esi + 0x14], 0xf
push str.0000
mov byte [esi], 0
call fcn.00405250
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d170a
mov esp, ebp
pop ebp
ret
Function at 0x410a60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f9ddd
mov eax, dword fs:[0]
push eax
sub esp, 0x944
mov eax, dword [0x53f084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x948], esi
push 0x800
mov dword [ebp - 0x948], esi
lea eax, [ebp - 0x914]
mov dword [ebp - 0x950], 0
push 0
push eax
mov dword [ebp - 0x948], 1
mov dword [ebp - 0x94c], 0x800
call fcn.004d43f0
add esp, 0xc
lea eax, [ebp - 0x94c]
push eax
lea eax, [ebp - 0x914]
push eax
lea eax, [ebp - 0x948]
push eax
push 0x513a14
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallExTab
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x410bc9
lea ecx, [ebp - 0x914]
mov dword [ebp - 0x91c], eax
mov dword [ebp - 0x918], 7
lea edx, [ecx + 2]
mov word [ebp - 0x92c], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410b20
sub ecx, edx
lea eax, [ebp - 0x914]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x92c]
call fcn.00405110
mov dword [ebp - 4], 1
lea eax, [ebp - 0x944]
cmp dword [ebp - 0x918], 8
lea ecx, [ebp - 0x92c]
mov edx, dword [ebp - 0x91c]
cmovae ecx, dword [ebp - 0x92c]
push eax
mov dword [ebp - 0x934], 0
mov dword [ebp - 0x930], 0xf
mov byte [ebp - 0x944], 0
mov dword [ebp - 0x950], 4
call fcn.00411200
add esp, 4
lea ecx, [ebp - 0x92c]
call fcn.00405080
movups xmm0, xmmword [ebp - 0x944]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x934]
movq qword [esi + 0x10], xmm0
jmp 0x410c1f
push 0x104
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.004d43f0
add esp, 8
lea ecx, [ebp - 0x114]
call fcn.0041e110
lea ecx, [ebp - 0x114]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
lea edx, [ecx + 1]
add esp, 4
mov byte [esi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x410c07
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
mov ecx, esi
call fcn.00405250
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d170a
mov esp, ebp
pop ebp
ret
Function at 0x411060
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x53f084]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
lea eax, [ebp - 0x804]
push 0x800
mov dword [ebp - 0x808], esi
mov edi, edx
mov dword [ebp - 0x808], esi
push 0
push eax
mov dword [ebp - 0x808], 1
mov dword [ebp - 0x80c], 0x800
call fcn.004d43f0
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x4110b7
mov edi, dword [edi]
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x808]
push eax
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallExTab
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
test eax, eax
jne 0x411119
lea ecx, [ebp - 0x804]
mov word [esi], ax
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411100
sub ecx, edx
lea eax, [ebp - 0x804]
sar ecx, 1
push ecx
push eax
jmp 0x411124
xor eax, eax
push eax
mov word [esi], ax
push 0x513480
mov ecx, esi
call fcn.00405110
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004d170a
mov esp, ebp
pop ebp
ret
Function at 0x4133b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
cmp dword [0x543fdc], 1
push esi
push edi
mov esi, ecx
jne 0x413413
call fcn.00414650
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push str.this__current__
lea edx, [ebp - 4]
mov dword [ebp - 4], eax
lea ecx, [ebp - 8]
mov dword [ebp - 8], esi
call fcn.00414e00
add esp, 4
test eax, eax
je 0x413413
push eax
push 3
push 0x180
push str.f:my_lab_tabexplorerextab_masterlibrary_basemessage_loop.cpp
lea ecx, [ebp - 0xc8]
call fcn.0040ec90
lea ecx, [ebp - 0xc8]
call fcn.0040f1c0
mov ecx, esi
call fcn.00414000
mov eax, dword [esi + 0xb4]
mov eax, dword [eax + 8]
test eax, eax
je 0x413467
cmp dword [esi + 4], 1
jne 0x413467
mov edi, dword [esi + 0x4c]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
mov esi, dword [edi + 0x2c]
test esi, esi
je 0x41344a
mov eax, dword [esi + 0xc]
inc eax
mov dword [ebp - 0xc], eax
jmp 0x413451
mov dword [ebp - 0xc], 1
lea eax, [ebp - 0x18]
mov ecx, edi
mov dword [edi + 0x2c], eax
mov eax, dword [edi]
call dword [eax + 0x14]
mov dword [edi + 0x2c], esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x4c]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x416c00
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x53f084]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0x104
jae 0x416ce2
push 0x20a
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004d43f0
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x416c41
mov esi, dword [esi]
lea ecx, [ebp - 0x218]
sub ecx, esi
nop dword [eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x416c50
lea eax, [ebp - 0x218]
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x230], eax
xorps xmm0, xmm0
mov eax, 0x414
mov dword [ebp - 0x22c], 0
mov word [ebp - 0x228], ax
lea eax, [ebp - 0x238]
push eax
movlpd qword [ebp - 0x226], xmm0
mov dword [ebp - 0x21e], 0
mov dword [ebp - 0x234], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp dword [ebp - 0x226], 0
jne 0x416ce2
test eax, eax
je 0x416cd1
cmp eax, 2
je 0x416cd1
cmp eax, 0x402
jne 0x416ce2
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d170a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.004d170a
mov esp, ebp
pop ebp
ret

Function at 0x416d00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x416d08
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x416d1a
shr eax, 4
and al, 1
ret
xor al, al
ret
Function at 0x416ed0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fa6e0
mov eax, dword fs:[0]
push eax
sub esp, 0x180
mov eax, dword [0x53f084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2c], 0
mov ebx, esi
cmp dword [esi + 0x14], 8
jb 0x416f11
mov ebx, dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x416f8d
test al, 0x10
je 0x416f28
mov al, 1
jmp 0x41708d
push 1
push 0x2b0
push str.f:my_lab_tabexplorerextab_masterlibrary_base_file_util.cpp
lea ecx, [ebp - 0xdc]
call fcn.0040eda0
mov dword [ebp - 4], 1
lea ecx, [eax + 8]
mov edx, str.CreateDirectory_
mov dword [ebp - 0x2c], 2
call fcn.00405a30
mov edx, ebx
mov ecx, eax
call fcn.0040f5f0
mov edx, 0x51aecc
mov ecx, eax
call fcn.00405a30
mov edx, str.conflicts_with_existing_file.
mov ecx, eax
call fcn.00405a30
lea ecx, [ebp - 0xdc]
call fcn.0040f1c0
xor al, al
jmp 0x41708d
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.00415eb0
mov dword [ebp - 4], 2
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x416fa9
mov eax, dword [esi]
cmp dword [ebp - 0x14], 8
lea edi, [ebp - 0x28]
mov edx, dword [ebp - 0x18]
cmovae edi, dword [ebp - 0x28]
cmp edx, dword [esi + 0x10]
jne 0x416fde
test edx, edx
je 0x41707d
sub edi, eax
mov cx, word [edi + eax]
cmp cx, word [eax]
jne 0x416fde
add eax, 2
sub edx, 1
jne 0x416fc6
xor bl, bl
jmp 0x417083
lea ecx, [ebp - 0x28]
call fcn.00416ed0
test al, al
je 0x41707d
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x417081
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0xb7
jne 0x41701a
mov ecx, esi
call fcn.00416d00
test al, al
jne 0x417081
push 1
push 0x2d2
push str.f:my_lab_tabexplorerextab_masterlibrary_base_file_util.cpp
lea ecx, [ebp - 0x18c]
call fcn.0040eda0
mov byte [ebp - 4], 4
lea ecx, [eax + 8]
push edi
mov edx, str.Failed_to_create_directory
mov dword [ebp - 0x2c], 8
call fcn.00405a30
mov edx, ebx
mov ecx, eax
call fcn.0040f5f0
mov edx, str.__last_error_is
mov ecx, eax
call fcn.00405a30
mov ecx, eax
call fcn.0040e3a0
mov edx, 0x5134d8
mov ecx, eax
call fcn.00405a30
lea ecx, [ebp - 0x18c]
call fcn.0040f1c0
xor bl, bl
jmp 0x417083
mov bl, 1
lea ecx, [ebp - 0x28]
call fcn.00405080
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d170a
mov esp, ebp
pop ebp
ret
Function at 0x41b080
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4faf54
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x53f084]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x34], ebx
mov eax, dword [0x544014]
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
push ecx
mov ecx, esi
call fcn.0041e9a0
add esp, 8
cmp dword [ebp - 0x1c], ebx
je 0x41b17a
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x30], ebx
cmovae eax, dword [ebp - 0x2c]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
jne 0x41b150
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 4
push 0x19f
push str.f:my_lab_tabexplorerextab_masterlibrary_basecommand_line.cpp
lea ecx, [ebp - 0xf4]
call fcn.0040f430
mov byte [ebp - 4], 1
lea ecx, [eax + 0x10]
mov ebx, 1
mov edx, str.CommandLineToArgvW_failed_on_command_line:
mov dword [ebp - 0x34], ebx
call fcn.00405a30
cmp dword [esi + 0x14], 8
jb 0x41b147
mov esi, dword [esi]
mov edx, esi
mov ecx, eax
call fcn.0040f5f0
mov dword [ebp - 4], 0
test bl, 1
je 0x41b167
lea ecx, [ebp - 0xf4]
call fcn.0040f4d0
mov ecx, dword [ebp - 0x38]
push edi
push dword [ebp - 0x30]
call fcn.0041a860
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 0x2c]
call fcn.00405080
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004d170a
mov esp, ebp
pop ebp
ret 4