joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4990ee
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x56f97c
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x601328]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x601328]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp byte [ebp + 0xc], bl
je 0x49915a
mov ecx, esi
call fcn.00499272
test al, al
jne 0x49915a
xor al, al
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0054677c
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x18], 8
lea edi, [esi + 4]
jb 0x499167
mov eax, dword [edi]
jmp 0x499169
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x499178
mov al, 1
jmp 0x49913c
xor eax, eax
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], ax
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov dword [esp + 0x44], ebx
call fcn.004991f4
pop ecx
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.004990ee
pop ecx
pop ecx
test al, al
jne 0x4991b8
lea ecx, [esp + 0x14]
call fcn.00409c40
jmp 0x49913a
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [esi + 0x18], 8
jb 0x4991c7
mov edi, dword [edi]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4991f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4991f0
lea ecx, [esp + 0x14]
call fcn.00409c40
mov al, bl
jmp 0x49913c
mov bl, 1
jmp 0x4991e0
Function at 0x49c204
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
xor ebx, ebx
cmp dword [edi + 0x20], ebx
je 0x49c211
xor al, al
jmp 0x49c267
push esi
lea esi, [edi + 0x28]
mov eax, 0x20019
call fcn.00415cf0
test eax, eax
je 0x49c227
xor al, al
jmp 0x49c266
lea esi, [edi + 8]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x24], eax
lea eax, [esp + 8]
push eax
push ebx
push edi
push 0x49c26a
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push esi
mov dword [edi + 0x20], eax
mov byte [edi + 0xa0], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
pop esi
pop ebx
pop ecx
ret

Function at 0x4a51e1
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5760a3
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x601328]
xor eax, esp
mov dword [esp + 0x240], eax
push ebx
push esi
push edi
mov eax, dword [0x601328]
xor eax, esp
push eax
lea eax, [esp + 0x258]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
xor eax, eax
mov dword [esp + 0x260], ebx
mov word [esp + 0x44], ax
mov eax, 0x20019
mov ecx, str.SoftwareMicrosoftInternet_Explorer
mov edx, reloc.OLEAUT32.dll_SysReAllocString
lea esi, [esp + 0x14]
mov dword [esp + 0x10], 0x104
call fcn.00415cf0
cmp eax, ebx
jne 0x4a527b
mov eax, esi
push str.Version
push eax
lea edi, [esp + 0x18]
lea esi, [esp + 0x4c]
call fcn.00415d40
lea esi, [esp + 0x14]
call fcn.00415e50
lea eax, [esp + 0x44]
push eax
call fcn.00547a6d
pop ecx
mov dword [esp + 0x10], eax
cmp eax, 9
jne 0x4a535d
lea eax, [esp + 0x28]
push str.ProgramFiles
push eax
call fcn.0046af75
pop ecx
pop ecx
lea eax, [esp + 0x28]
push eax
mov eax, str.Internet_Exploreriexplore.exe
mov byte [esp + 0x264], 1
call fcn.00411970
cmp dword [esp + 0x40], 8
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x24], ebx
jae 0x4a52ce
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x24]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
jbe 0x4a5354
push esi
call fcn.00545b75
mov edi, eax
pop ecx
cmp edi, ebx
je 0x4a5354
push esi
push ebx
push edi
call fcn.0054ff70
mov eax, dword [esp + 0x38]
add esp, 0xc
cmp dword [esp + 0x40], 8
jae 0x4a5306
lea eax, [esp + 0x2c]
push edi
push esi
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4a534d
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
push 0x5952a8
push edi
mov dword [esp + 0x30], 0x104
mov dword [esp + 0x2c], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4a534d
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x4a534d
movzx eax, word [eax + 0xa]
cmp eax, 9
jle 0x4a534d
mov dword [esp + 0x10], eax
push edi
call fcn.00547866
pop ecx
lea ecx, [esp + 0x28]
call fcn.00409c40
lea esi, [esp + 0x14]
call fcn.00415e80
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.0054677c
mov esp, ebp
pop ebp
ret
Function at 0x4b1ea9
Capabilities:
Persist via run registry key

Disassembly:
push ebp
sub esp, 0x7d0
lea ebp, [esp - 4]
mov eax, dword [0x601328]
xor eax, ebp
mov dword [ebp + 0x7d0], eax
push 0x10
mov eax, 0x568d46
call fcn.0054d3d9
mov eax, dword [ebp + 0x7dc]
xor edi, edi
mov ebx, ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], edi
push SysReAllocString
mov eax, 0x20019
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea esi, [ebp - 0x18]
mov dword [ebp - 0x10], 0x3e8
call fcn.00415df0
cmp eax, edi
jne 0x4b1f92
mov eax, esi
push str.Local_AppData
push eax
lea edi, [ebp - 0x10]
lea esi, [ebp]
call fcn.00415d40
lea esi, [ebp - 0x18]
call fcn.00415e50
lea esi, [ebp - 0x10]
call fcn.00403ee0
mov byte [ebp - 4], 1
cmp dword [ebx + 0x78], 8
jb 0x4b1f3b
mov ebx, dword [ebx + 0x64]
jmp 0x4b1f3e
add ebx, 0x64
push ebx
push str._sDNT
lea edi, [ebp - 0x10]
call fcn.00405c00
mov eax, dword [ebp - 0x10]
pop ecx
pop ecx
mov edx, eax
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4b1f53
sub eax, edx
lea edi, [ebp]
dec edi
dec edi
mov cx, word [edi + 2]
inc edi
inc edi
test cx, cx
jne 0x4b1f64
push dword [ebp - 0x1c]
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp]
rep movsb byte es:[edi], byte [esi]
call fcn.00406690
lea ecx, [ebp - 0x10]
call fcn.00409cb0
lea esi, [ebp - 0x18]
call fcn.00415e80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x7d0]
xor ecx, ebp
call fcn.0054677c
add ebp, 0x7d4
leave
ret 4
Function at 0x4c0c33
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x57970e
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x601328]
xor eax, esp
mov dword [esp + 0x9c], eax
push ebx
push esi
mov eax, dword [0x601328]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x8c]
push eax
call fcn.004de4c2
pop ecx
xor ebx, ebx
mov dword [esp + 0xb8], ebx
xor eax, eax
mov dword [esp + 0xc], ebx
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], ax
mov byte [esp + 0xb8], 1
jmp 0x4c0de6
lea eax, [esp + 0x8c]
push eax
lea esi, [esp + 0x20]
call fcn.00406fb0
push ebx
lea eax, [esp + 0x3c]
push eax
or eax, 0xffffffff
mov byte [esp + 0xc0], 2
call fcn.004117d0
mov eax, esi
push eax
lea esi, [esp + 0x58]
call fcn.00406fb0
mov eax, esi
push eax
mov eax, str._search.json
mov byte [esp + 0xbc], 3
call fcn.00411970
lea eax, [esp + 0x1c]
push eax
mov eax, str._searchplugins_
call fcn.00411970
push ebx
push dword [esp + 0x14]
or eax, 0xffffffff
lea esi, [esp + 0x24]
call fcn.004117d0
cmp dword [esp + 0x34], 8
mov eax, dword [esp + 0x20]
jae 0x4c0d39
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x4c0dcc
cmp byte [ebp + 0x14], bl
je 0x4c0d7a
cmp dword [esp + 0x34], 8
mov eax, dword [esp + 0x20]
jae 0x4c0d5d
lea eax, [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call esi
cmp dword [esp + 0x6c], 8
mov eax, dword [esp + 0x58]
jae 0x4c0d75
lea eax, [esp + 0x58]
push eax
call esi
jmp 0x4c0dcc
mov eax, dword [esp + 0x14]
mov byte [eax], 1
cmp dword [edi + 0x14], ebx
je 0x4c0dcc
cmp dword [esp + 0x34], 8
mov ecx, dword [esp + 0x20]
jae 0x4c0d95
lea ecx, [esp + 0x20]
lea eax, [esp + 0x70]
push eax
mov edx, str.SearchPlugin_ShortName
call fcn.00465416
pop ecx
lea eax, [esp + 0x70]
mov ecx, edi
mov byte [esp + 0xb8], 4
call fcn.004117a0
test eax, eax
jne 0x4c0dc3
mov eax, dword [esp + 0x18]
mov byte [eax], 1
lea ecx, [esp + 0x70]
call fcn.00409c40
lea ecx, [esp + 0x54]
call fcn.00409c40
lea ecx, [esp + 0x1c]
mov byte [esp + 0xb8], 1
call fcn.00409c40
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x10]
call fcn.004de9d6
pop ecx
test al, al
jne 0x4c0cc2
lea ecx, [esp + 0x38]
call fcn.00409c40
lea ecx, [esp + 0x8c]
call fcn.00409c40
mov ecx, dword [esp + 0xb0]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.0054677c
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4c0e37
Capabilities:
Access peb ldr_data
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5796b2
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x601328]
xor eax, esp
mov dword [esp + 0x78], eax
push esi
mov eax, dword [0x601328]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
lea eax, [esp + 0x64]
push eax
call fcn.004de4c2
pop ecx
and dword [esp + 0x90], 0
and dword [esp + 0xc], 0
and dword [esp + 0x40], 0
xor eax, eax
mov dword [esp + 0x44], 7
mov word [esp + 0x30], ax
mov byte [esp + 0x90], 1
jmp 0x4c0f3c
lea eax, [esp + 0x64]
push eax
lea esi, [esp + 0x4c]
call fcn.00406fb0
push 0
lea eax, [esp + 0x30]
push eax
or eax, 0xffffffff
mov byte [esp + 0x98], 2
call fcn.004117d0
mov eax, esi
push eax
lea esi, [esp + 0x14]
call fcn.00406fb0
mov eax, esi
push eax
mov eax, str._search.json
mov byte [esp + 0x94], 3
call fcn.00411970
cmp dword [esp + 0x28], 8
mov eax, dword [esp + 0x14]
jae 0x4c0f00
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x4c0f22
cmp dword [esp + 0x28], 8
mov eax, dword [esp + 0x14]
jae 0x4c0f1b
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x10]
call fcn.00409c40
lea ecx, [esp + 0x48]
mov byte [esp + 0x90], 1
call fcn.00409c40
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x10]
call fcn.004de9d6
pop ecx
test al, al
jne 0x4c0eab
lea ecx, [esp + 0x2c]
call fcn.00409c40
lea ecx, [esp + 0x64]
call fcn.00409c40
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.0054677c
mov esp, ebp
pop ebp
ret
Function at 0x4cd3dc
Capabilities:
Check if file exists

Disassembly:
push 0x5c
mov eax, 0x569ed6
call fcn.0054d442
mov eax, dword [ebp + 8]
push eax
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x4c], ecx
call fcn.00406fb0
mov eax, esi
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004d4d3f
cmp eax, 0xffffffff
je 0x4cd4db
mov ecx, esi
push ecx
mov ecx, eax
xor edx, edx
lea esi, [ebp - 0x48]
call fcn.004069a0
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00406f00
mov ecx, esi
mov byte [ebp - 4], bl
call fcn.00409c40
lea eax, [ebp - 0x2c]
push eax
call fcn.004d4d3f
cmp eax, 0xffffffff
je 0x4cd4db
lea ecx, [eax + 1]
lea eax, [ebp - 0x2c]
push eax
xor edx, edx
lea esi, [ebp - 0x68]
call fcn.004069a0
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.00406f00
mov ecx, esi
mov byte [ebp - 4], bl
call fcn.00409c40
lea eax, [ebp - 0x2c]
push eax
mov eax, str.ProgData
call fcn.00411970
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x5952a8
call fcn.00411970
lea eax, [ebp - 0x2c]
push eax
lea esi, [ebp - 0x48]
call fcn.00406fb0
lea eax, [ebp - 0x2c]
push eax
mov eax, str.FireFoxSearchXml.tmp
mov byte [ebp - 4], 3
call fcn.00411970
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x4cd4b7
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4cd4eb
mov ecx, dword [ebp - 0x4c]
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x48]
call fcn.00406f00
lea ecx, [ebp - 0x48]
call fcn.00409c40
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x2c]
call fcn.00409c40
mov eax, ebx
call fcn.0054d4c5
ret
lea ecx, [ebp - 0x48]
call fcn.00409c40
jmp 0x4cd4db
Function at 0x4daed3
Capabilities:
Write file on windows

Disassembly:
push 0x4c
mov eax, 0x568400
call fcn.0054d442
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x4dafe1
cmp byte [esi + 0x42], bl
je 0x4dafe1
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 4]
movzx eax, ax
cmp di, ax
jne 0x4daf0f
xor al, al
jmp 0x4dafe3
push ebx
push 8
lea ecx, [ebp - 0x30]
call fcn.004dae06
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x30]
call fcn.004dae2c
mov ecx, eax
call fcn.004db061
mov edi, dword [ebp - 0x1c]
mov ebx, eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x30]
call fcn.004dae2c
mov ecx, eax
call fcn.004db061
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x34]
push eax
add edi, ebx
push edi
push dword [ebp - 0x38]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x4daf7b
dec eax
je 0x4daf7f
dec eax
dec eax
je 0x4dafdd
xor bl, bl
lea ecx, [ebp - 0x30]
call fcn.00408970
mov al, bl
jmp 0x4dafe3
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x30]
call fcn.004dae2c
mov ecx, eax
call fcn.004db061
mov edi, dword [ebp - 0x34]
sub edi, eax
je 0x4dafbf
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x30]
call fcn.004dae2c
mov ecx, eax
call fcn.004db061
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0054a21c
add esp, 0x10
cmp edi, eax
jne 0x4daf6d
cmp byte [esi + 0x42], 0
je 0x4dafdd
test edi, edi
jne 0x4daf1d
push edi
push 8
lea ecx, [ebp - 0x30]
call fcn.00405710
jmp 0x4daf1d
mov bl, 1
jmp 0x4daf6f
mov al, 1
call fcn.0054d4c5
ret
Function at 0x4dbe3b
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, eax
cmp byte [esi + 0x24], 0
je 0x4dbedc
cmp dword [esi + 0x1c], 8
jb 0x4dbe53
mov eax, dword [esi + 8]
jmp 0x4dbe56
lea eax, [esi + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4dbedc
push ebx
push edi
lea edi, [esi + 0x20]
mov eax, edi
xor bl, bl
call fcn.0052f937
test al, al
je 0x4dbed6
push 8
pop ebx
cmp dword [esi + 0x1c], ebx
jb 0x4dbe80
mov esi, dword [esi + 8]
jmp 0x4dbe83
add esi, 8
mov eax, dword [esp + 0x18]
cmp dword [eax + 0x18], ebx
jb 0x4dbe91
mov edx, dword [eax + 4]
jmp 0x4dbe94
lea edx, [eax + 4]
mov eax, dword [esp + 0x14]
cmp dword [eax + 0x18], ebx
jb 0x4dbea2
mov ecx, dword [eax + 4]
jmp 0x4dbea5
lea ecx, [eax + 4]
mov eax, dword [esp + 0x10]
cmp dword [eax + 0x18], ebx
jb 0x4dbeb3
mov eax, dword [eax + 4]
jmp 0x4dbeb6
add eax, 4
push esi
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ebx, eax
mov eax, dword [edi]
dec ebx
neg ebx
sbb bl, bl
inc bl
test eax, eax
je 0x4dbed6
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov al, bl
pop ebx
jmp 0x4dbede
xor al, al
pop esi
ret 0xc

Function at 0x4dbee2
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, eax
cmp byte [esi + 0x24], 0
je 0x4dbf5e
cmp dword [esi + 0x1c], 8
jb 0x4dbef6
mov eax, dword [esi + 8]
jmp 0x4dbef9
lea eax, [esi + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4dbf5e
push ebx
push edi
lea edi, [esi + 0x20]
mov eax, edi
xor bl, bl
call fcn.0052f937
test al, al
je 0x4dbf58
cmp dword [esi + 0x1c], 8
jb 0x4dbf21
mov esi, dword [esi + 8]
jmp 0x4dbf24
add esi, 8
mov eax, dword [esp + 0x10]
cmp dword [eax + 0x18], 8
jb 0x4dbf33
mov eax, dword [eax + 4]
jmp 0x4dbf36
add eax, 4
push esi
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ebx, eax
mov eax, dword [edi]
dec ebx
neg ebx
sbb bl, bl
inc bl
test eax, eax
je 0x4dbf58
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov al, bl
pop ebx
jmp 0x4dbf60
xor al, al
pop esi
ret 4
Function at 0x4dca06
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x568291
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x601328]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [esp + 0x10], ebx
cmp byte [esi + 0x24], bl
je 0x4dcb84
cmp dword [esi + 0x1c], 8
jb 0x4dca4f
mov eax, dword [esi + 8]
jmp 0x4dca52
lea eax, [esi + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4dcb84
lea eax, [esi + 0x20]
mov dword [esp + 0x20], eax
call fcn.0052f937
test al, al
je 0x4dcb84
lea esi, [esp + 0x14]
call fcn.00403ee0
mov esi, dword [ebp + 0x14]
mov dword [esp + 0x40], ebx
mov ebx, dword [esi + 0xc]
lea edi, [esp + 0x24]
call fcn.00415950
mov ebx, dword [esi + 0x10]
lea edi, [esp + 0x2c]
call fcn.00415950
mov esi, edi
lea edi, [esp + 0x24]
call fcn.00415930
test al, al
je 0x4dcb6a
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
add eax, 4
add ecx, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
jmp 0x4dcaca
mov eax, dword [esp + 0x1c]
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 0x18], 8
jb 0x4dcad5
mov eax, dword [eax]
push dword [esp + 0x10]
lea edi, [esp + 0x18]
push eax
push str._s_d
call fcn.00405c00
mov eax, dword [ebp + 8]
add esp, 0xc
cmp dword [eax + 0x1c], 8
jb 0x4dcaf9
mov ebx, dword [eax + 8]
jmp 0x4dcafc
lea ebx, [eax + 8]
lea esi, [esp + 0x24]
call fcn.0045aee0
cmp dword [eax + 0x18], 8
jb 0x4dcb10
mov eax, dword [eax + 4]
jmp 0x4dcb13
add eax, 4
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x18], 8
jb 0x4dcb24
mov ecx, dword [esp + 0x18]
mov edi, dword [ecx]
jmp 0x4dcb28
mov edi, dword [esp + 0x18]
push ebx
push eax
lea esi, [esp + 0x1c]
call fcn.0045acf0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
inc dword [esp + 0x10]
lea esi, [esp + 0x24]
call fcn.0045af10
mov esi, dword [ebp + 0x14]
mov ebx, dword [esi + 0x10]
lea edi, [esp + 0x2c]
call fcn.00415950
mov esi, edi
lea edi, [esp + 0x24]
call fcn.00415930
test al, al
jne 0x4dcac6
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x4dcb7b
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea ecx, [esp + 0x14]
call fcn.00409cb0
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4e2cf4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x568387
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x601328]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push esi
push edi
mov eax, dword [0x601328]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x4e2d57
xor eax, eax
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.0054677c
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
xor edi, edi
cmp ecx, edi
je 0x4e2d7f
mov eax, dword [esi + 0x34]
mov edx, dword [eax]
add edx, ecx
cmp ecx, edx
jae 0x4e2d7f
dec dword [eax]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 1]
mov dword [esi], ecx
mov byte [eax], bl
mov eax, ebx
jmp 0x4e2d37
mov eax, dword [esi + 0x4c]
cmp eax, edi
jne 0x4e2d8b
or eax, 0xffffffff
jmp 0x4e2d37
cmp dword [esi + 0x3c], edi
jne 0x4e2da3
push eax
movsx eax, bl
push eax
call fcn.0054b74c
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x4e2d86
jmp 0x4e2d7b
push edi
push 8
lea ecx, [esp + 0x4c]
mov byte [esp + 0x1b], bl
call fcn.004dae06
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 0x74], edi
call fcn.004dae2c
mov ecx, eax
call fcn.004db061
mov edi, dword [esp + 0x58]
mov ebx, eax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x48]
call fcn.004dae2c
mov ecx, eax
call fcn.004db061
lea edx, [esp + 0x18]
add edi, ebx
push edx
lea ebx, [esi + 0x44]
jmp 0x4e2eaf
cmp eax, 1
jg 0x4e2ee8
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x48]
call fcn.004dae2c
mov ecx, eax
call fcn.004db061
mov edi, dword [esp + 0x18]
sub edi, eax
je 0x4e2e48
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x48]
call fcn.004dae2c
mov ecx, eax
call fcn.004db061
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0054a21c
add esp, 0x10
cmp edi, eax
jne 0x4e2ed5
lea eax, [esp + 0x13]
mov byte [esi + 0x41], 1
cmp dword [esp + 0x1c], eax
jne 0x4e2f04
test edi, edi
ja 0x4e2e72
cmp dword [esp + 0x58], 0x20
jae 0x4e2ed5
push 0
push 8
lea ecx, [esp + 0x4c]
call fcn.00405710
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x48]
call fcn.004dae2c
mov ecx, eax
call fcn.004db061
mov edi, dword [esp + 0x58]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x48]
call fcn.004dae2c
mov ecx, eax
call fcn.004db061
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x24]
add edi, edx
mov ecx, dword [esi + 0x3c]
push edi
push eax
lea edx, [esp + 0x28]
push edx
lea edx, [esp + 0x24]
push edx
lea edx, [esp + 0x27]
push edx
mov dword [esp + 0x2c], eax
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
test eax, eax
jge 0x4e2df6
or esi, 0xffffffff
lea ecx, [esp + 0x44]
call fcn.00408970
mov eax, esi
jmp 0x4e2d37
cmp eax, 3
jne 0x4e2ed5
movsx eax, byte [esp + 0x13]
push dword [esi + 0x4c]
push eax
call fcn.0054b74c
or esi, 0xffffffff
pop ecx
pop ecx
cmp eax, esi
je 0x4e2ed8
mov esi, dword [ebp + 8]
jmp 0x4e2ed8
Function at 0x4e382e
Capabilities:
Write file on windows

Disassembly:
push 0x4c
mov eax, 0x568400
call fcn.0054d442
xor edi, edi
cmp dword [esi + 0x3c], edi
je 0x4e3936
cmp byte [esi + 0x41], 0
je 0x4e3936
mov eax, dword [esi]
push 0xffffffffffffffff
mov ecx, esi
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x4e3864
xor al, al
jmp 0x4e3938
push edi
push 8
lea ecx, [ebp - 0x30]
call fcn.004dae06
mov dword [ebp - 4], edi
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x30]
call fcn.004dae2c
mov ecx, eax
call fcn.004db061
mov edi, dword [ebp - 0x1c]
mov ebx, eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x30]
call fcn.004dae2c
mov ecx, eax
call fcn.004db061
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x34]
push eax
add edi, ebx
push edi
push dword [ebp - 0x38]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x4e38d0
dec eax
je 0x4e38d4
dec eax
dec eax
je 0x4e3932
xor bl, bl
lea ecx, [ebp - 0x30]
call fcn.00408970
mov al, bl
jmp 0x4e3938
mov byte [esi + 0x41], 0
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x30]
call fcn.004dae2c
mov ecx, eax
call fcn.004db061
mov edi, dword [ebp - 0x34]
sub edi, eax
je 0x4e3914
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x30]
call fcn.004dae2c
mov ecx, eax
call fcn.004db061
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0054a21c
add esp, 0x10
cmp edi, eax
jne 0x4e38c2
cmp byte [esi + 0x41], 0
je 0x4e3932
test edi, edi
jne 0x4e3872
push edi
push 8
lea ecx, [ebp - 0x30]
call fcn.00405710
jmp 0x4e3872
mov bl, 1
jmp 0x4e38c4
mov al, 1
call fcn.0054d4c5
ret