joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10f8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.010f81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10f807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10f806a
add dl, dl
jne 0x10f8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10f80dc
xor eax, eax
add dl, dl
jne 0x10f8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10f817d
add dl, dl
jne 0x10f80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10f80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10f80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10f80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10f80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10f8075
mov eax, 1
add dl, dl
jne 0x10f80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10f80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10f80e1
sub eax, ebx
mov ebx, 1
jne 0x10f8128
mov ecx, 1
add dl, dl
jne 0x10f810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10f8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10f8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10f8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10f813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10f814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10f8136
cmp eax, 0x7d00
jae 0x10f816d
cmp eax, 0x500
jb 0x10f8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10f8075
cmp eax, 0x7f
ja 0x10f8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10f8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10f819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10f8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x9b2725
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x9b274c
call fcn.00954c18
mov dword [eax], esi
call fcn.00954c05
push 0x16
pop esi
mov dword [eax], esi
call fcn.0095585a
mov eax, esi
jmp 0x9b27a1
test dword [ebp + 0xc], 0xfffffff9
jne 0x9b2732
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9b2779
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00954c2b
pop ecx
call fcn.00954c05
mov eax, dword [eax]
jmp 0x9b27a1
test al, 0x10
jne 0x9b279f
test al, 1
je 0x9b279f
test byte [ebp + 0xc], 2
je 0x9b279f
call fcn.00954c18
mov dword [eax], 5
call fcn.00954c05
mov dword [eax], 0xd
jmp 0x9b2770
xor eax, eax
pop esi
pop ebp
ret

Function at 0x40b3e0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ebp, dword [edi]
or al, 0x8b
push ebp
or cl, dl
pushal
push edx
call 0x40b400
pop ebp
fmul qword [eax + eax]
nop
nop
nop
nop
not byte [eax + 0x78559090]
in al, dx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push ebx
push esi
invalid

Function at 0x40b400
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ebp, dword [edi]
or al, 0x8b
push ebp
or cl, dl
pushal
push edx
call 0x40b400
pop ebp
fmul qword [eax + eax]
nop
nop
nop
nop
not byte [eax + 0x78559090]
in al, dx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push ebx
push esi
invalid
Function at 0x407c10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46c280
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x495014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 4]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
test esi, esi
je 0x407d7a
cmp byte [esi + 0x54], 0
je 0x407d7a
add esi, 0x1c
xorps xmm0, xmm0
xor bl, bl
movlpd qword [ebp - 0x18], xmm0
mov dword [ebp - 0x18], esi
mov byte [ebp - 0x14], bl
test esi, esi
je 0x407c96
mov eax, dword [esi]
test eax, eax
je 0x407c93
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x407c8d
cmp eax, 0x80
je 0x407c8d
xor bl, bl
jmp 0x407c93
mov byte [esi + 4], 1
mov bl, 1
mov byte [ebp - 0x14], bl
mov dword [ebp - 4], 0
mov ecx, dword [edi + 4]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
call fcn.00403990
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x407d53
mov edx, dword [ebp - 0x38]
lea ecx, [ebp - 0x30]
push 0
call fcn.0041bcf0
add esp, 4
mov byte [ebp - 4], 1
push 2
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0x1c], 0x10
lea ecx, [ebp - 0x34]
push 0
push ecx
push dword [ebp - 0x20]
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x1c]
cmp edx, 0x10
jb 0x407d41
mov ecx, dword [ebp - 0x30]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x407d37
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407d98
push edx
push ecx
call fcn.00436e80
add esp, 8
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x407d73
test bl, bl
je 0x407d73
mov eax, dword [esi]
test eax, eax
je 0x407d6f
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [esi + 4], 0
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00436e3f
mov esp, ebp
pop ebp
ret 4
call fcn.00450759
int3
Function at 0x414d80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46ec38
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x495014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.00403bd0
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x414dc3
xor al, al
jmp 0x414f4f
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00403880
call fcn.00403910
mov dword [ebp - 4], 0
mov edx, esi
lea ecx, [ebp - 0x4c]
call fcn.004175e0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.00403ac0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x34]
mov ecx, esi
call fcn.00417d30
mov edx, 0x482324
lea ecx, [ebp - 0x34]
call fcn.00415e90
mov edx, 0x482324
lea ecx, [ebp - 0x34]
call fcn.00415f10
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x34]
call fcn.00418a20
add esp, 4
lea ecx, [ebp - 0x1c]
call fcn.004038a0
mov byte [ebp - 0x4d], al
call fcn.00403bd0
mov dword [ebp - 0x54], eax
mov esi, dword [eax]
call fcn.00403bc0
mov dword [ebp - 0x58], eax
xor edi, edi
mov ecx, dword [eax]
mov ebx, ecx
sub ebx, esi
xor eax, eax
add ebx, 3
shr ebx, 2
cmp esi, ecx
cmova ebx, eax
test ebx, ebx
je 0x414e80
nop
mov ecx, dword [esi]
call fcn.00434240
mov ecx, dword [esi]
call fcn.00434240
inc edi
lea esi, [esi + 4]
cmp edi, ebx
jne 0x414e60
mov esi, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x58]
mov esi, dword [esi]
mov ecx, dword [ecx]
mov ebx, ecx
xor eax, eax
sub ebx, esi
mov dword [ebp - 0x54], eax
add ebx, 3
xor edx, edx
shr ebx, 2
cmp esi, ecx
cmova ebx, edx
test ebx, ebx
je 0x414f25
nop
mov edi, dword [esi]
test edi, edi
je 0x414f03
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, edi
je 0x414f00
push edi
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x414f00
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, edi
jne 0x414ed4
mov byte [ebp - 0x4e], 0
jmp 0x414ef3
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne byte [ebp - 0x4e]
test eax, eax
je 0x414ef3
push 0x1388
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x4e], 0
jne 0x414f0f
mov eax, dword [ebp - 0x54]
cmp byte [ebp - 0x4d], 0
jne 0x414f0f
mov byte [ebp - 0x4d], 0
jmp 0x414f16
mov eax, dword [ebp - 0x54]
mov byte [ebp - 0x4d], 1
inc eax
add esi, 4
mov dword [ebp - 0x54], eax
cmp eax, ebx
jne 0x414ea0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.004039d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call fcn.004039d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.004038b0
mov al, byte [ebp - 0x4d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00436e3f
mov esp, ebp
pop ebp
ret 4
Function at 0x415210
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46ecc8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x495014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
lea ecx, [ebp - 0x18]
call fcn.00402aa0
call fcn.00408c50
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00404040
lea ecx, [ebp - 0x48]
push ecx
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x8c]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.00403990
push eax
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x415290
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
jmp 0x415335
mov eax, dword [0x49595c]
test eax, eax
je 0x415333
mov al, byte [eax + 0x64]
push ecx
mov ecx, 0x495958
mov byte [ebp - 0x49], al
call fcn.00406ac0
mov eax, dword [0x49595c]
xor ebx, ebx
cmp byte [eax + 0x54], bl
je 0x4152c7
cmp dword [eax + 0x58], 4
jb 0x4152c7
cmp byte [eax + 0x5c], bl
setne bl
inc ebx
cmp byte [ebp - 0x49], 0
je 0x415333
test ebx, ebx
je 0x415333
lea ecx, [ebp - 0x30]
call fcn.00403ac0
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x30]
push 0x4838d0
push eax
call fcn.00416120
add esp, 0xc
lea eax, [ebp - 0x30]
mov ecx, 0x495958
push 0x100
push str.RC::RCBusinessProcessMgr::IsMainUIProcessRunning
push str.d:jenkinsworkspacepc_qncleaner_buildqncleanerprojectslibbusiness_src_businessprocessmgr_rcbusinessprocessmgr.cpp
push eax
push 4
call fcn.00407900
cmp ebx, 1
jbe 0x415327
lea eax, [ebp - 0x30]
mov ecx, 0x495958
push eax
call fcn.00407c10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.004039d0
xor bl, bl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.004039d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00403930
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00436e3f
mov esp, ebp
pop ebp
ret
Function at 0x415370
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46ecc8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x495014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
lea ecx, [ebp - 0x18]
call fcn.00402aa0
call fcn.00408c50
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00404040
lea ecx, [ebp - 0x48]
push ecx
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x98]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.00403990
push eax
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x4153f0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
jmp 0x415495
mov eax, dword [0x49595c]
test eax, eax
je 0x415493
mov al, byte [eax + 0x64]
push ecx
mov ecx, 0x495958
mov byte [ebp - 0x49], al
call fcn.00406ac0
mov eax, dword [0x49595c]
xor ebx, ebx
cmp byte [eax + 0x54], bl
je 0x415427
cmp dword [eax + 0x58], 4
jb 0x415427
cmp byte [eax + 0x5c], bl
setne bl
inc ebx
cmp byte [ebp - 0x49], 0
je 0x415493
test ebx, ebx
je 0x415493
lea ecx, [ebp - 0x30]
call fcn.00403ac0
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x30]
push 0x48395c
push eax
call fcn.00416120
add esp, 0xc
lea eax, [ebp - 0x30]
mov ecx, 0x495958
push 0x112
push str.RC::RCBusinessProcessMgr::IsQncTrayProcessRunning
push str.d:jenkinsworkspacepc_qncleaner_buildqncleanerprojectslibbusiness_src_businessprocessmgr_rcbusinessprocessmgr.cpp
push eax
push 4
call fcn.00407900
cmp ebx, 1
jbe 0x415487
lea eax, [ebp - 0x30]
mov ecx, 0x495958
push eax
call fcn.00407c10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.004039d0
xor bl, bl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.004039d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00403930
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00436e3f
mov esp, ebp
pop ebp
ret
Function at 0x4159a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46edd8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x495014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
lea ecx, [ebp - 0x1c]
xor bh, bh
call fcn.00403880
call fcn.00403910
mov dword [ebp - 4], 0
mov eax, ecx
push eax
call fcn.00415b00
test al, al
je 0x415ac5
lea ecx, [ebp - 0x1c]
call fcn.00403bd0
mov dword [ebp - 0x24], eax
mov esi, dword [eax]
call fcn.00403bc0
mov ecx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x28], eax
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp esi, eax
je 0x415ac5
nop word [eax + eax]
mov edi, dword [esi]
call ecx
cmp edi, eax
je 0x415a2f
mov ecx, edi
call fcn.00434240
mov ecx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add esi, 4
cmp esi, dword [ebp - 0x20]
jne 0x415a20
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov esi, dword [esi]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp esi, eax
je 0x415ac5
nop
mov edi, dword [esi]
call ecx
cmp edi, eax
je 0x415ab7
test edi, edi
je 0x415ab1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, edi
je 0x415ab1
push edi
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x415ab1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, edi
jne 0x415a88
xor bl, bl
jmp 0x415aa6
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne bl
test eax, eax
je 0x415aa6
push 0x1388
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x415ab5
test bh, bh
je 0x415ab7
mov bh, 1
mov ecx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add esi, 4
cmp esi, dword [ebp - 0x20]
jne 0x415a50
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.004038b0
mov al, bh
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00436e3f
mov esp, ebp
pop ebp
ret
Function at 0x4167e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46eee8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x495014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00403bd0
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x416820
xor al, al
jmp 0x416944
push esi
lea ecx, [ebp - 0x28]
call fcn.00403ae0
mov dword [ebp - 4], 0
mov edx, 4
lea ecx, [ebp - 0x28]
call fcn.00419d40
lea ecx, [ebp - 0x28]
call fcn.00403990
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x416931
lea ecx, [ebp - 0x40]
call fcn.00403ac0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.00420b40
test al, al
je 0x416881
lea ecx, [ebp - 0x40]
call fcn.00403990
push eax
call edi
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004039d0
cmp esi, 0xffffffff
jne 0x416931
lea ecx, [ebp - 0x28]
call fcn.00403bd0
mov esi, dword [eax + 0x10]
cmp esi, 2
jbe 0x41692d
lea ecx, [ebp - 0x28]
call fcn.00403bd0
mov ecx, eax
mov edx, dword [eax + 0x14]
cmp edx, 8
jb 0x4168be
mov ecx, dword [eax]
cmp word [ecx + esi*2 - 2], 0x5c
je 0x4168d5
cmp edx, 8
jb 0x4168cd
mov eax, dword [eax]
cmp word [eax + esi*2 - 2], 0x2f
jne 0x41692d
mov edx, 0x20
lea ecx, [ebp - 0x28]
call fcn.00419d40
lea ecx, [ebp - 0x28]
call fcn.00403990
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x416931
lea ecx, [ebp - 0x40]
call fcn.00403ac0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.00420b40
test al, al
je 0x41691c
lea ecx, [ebp - 0x40]
call fcn.00403990
push eax
call edi
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004039d0
cmp esi, 0xffffffff
jne 0x416931
xor bl, bl
jmp 0x416933
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004039d0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00436e3f
mov esp, ebp
pop ebp
ret
Function at 0x416960
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46eee8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x495014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00403bd0
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x4169a0
xor al, al
jmp 0x416aca
push esi
lea ecx, [ebp - 0x28]
call fcn.00403ae0
mov dword [ebp - 4], 0
mov edx, 4
lea ecx, [ebp - 0x28]
call fcn.00419d40
lea ecx, [ebp - 0x28]
call fcn.00403990
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x416a0e
lea ecx, [ebp - 0x40]
call fcn.00403ac0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.00420b40
test al, al
je 0x4169fd
lea ecx, [ebp - 0x40]
call fcn.00403990
push eax
call edi
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004039d0
cmp ebx, 0xffffffff
je 0x416a17
test bl, 0x10
je 0x416ab7
lea ecx, [ebp - 0x28]
call fcn.00403bd0
mov esi, dword [eax + 0x10]
cmp esi, 2
jbe 0x416ab3
lea ecx, [ebp - 0x28]
call fcn.00403bd0
mov ecx, eax
mov edx, dword [eax + 0x14]
cmp edx, 8
jb 0x416a3f
mov ecx, dword [eax]
cmp word [ecx + esi*2 - 2], 0x5c
je 0x416a56
cmp edx, 8
jb 0x416a4e
mov eax, dword [eax]
cmp word [eax + esi*2 - 2], 0x2f
jne 0x416ab3
mov edx, 0x20
lea ecx, [ebp - 0x28]
call fcn.00419d40
lea ecx, [ebp - 0x28]
call fcn.00403990
push eax
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x416aae
lea ecx, [ebp - 0x40]
call fcn.00403ac0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.00420b40
test al, al
je 0x416a9d
lea ecx, [ebp - 0x40]
call fcn.00403990
push eax
call edi
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004039d0
cmp ebx, 0xffffffff
je 0x416ab3
test bl, 0x10
je 0x416ab7
xor bl, bl
jmp 0x416ab9
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004039d0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00436e3f
mov esp, ebp
pop ebp
ret
Function at 0x416af0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46ef20
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x495014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00403bd0
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x416b2f
xor al, al
jmp 0x416bb9
push esi
lea ecx, [ebp - 0x28]
call fcn.00403ae0
mov dword [ebp - 4], 0
mov edx, 4
lea ecx, [ebp - 0x28]
call fcn.00419d40
lea ecx, [ebp - 0x28]
call fcn.00403990
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x416b9d
lea ecx, [ebp - 0x40]
call fcn.00403ac0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.00420b40
test al, al
je 0x416b8c
lea ecx, [ebp - 0x40]
call fcn.00403990
push eax
call esi
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004039d0
cmp ebx, 0xffffffff
je 0x416ba6
test bl, 0x10
je 0x416ba6
mov bl, 1
jmp 0x416ba8
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004039d0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00436e3f
mov esp, ebp
pop ebp
ret
Function at 0x4171e0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46f070
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x495014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.00403bd0
mov edi, eax
cmp dword [edi + 0x10], 0
jne 0x417221
xor al, al
jmp 0x4173c6
mov ecx, ebx
call fcn.00416af0
test al, al
je 0x417233
mov al, 1
jmp 0x4173c6
push 0
mov ecx, ebx
call fcn.00403990
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push eax
call esi
test eax, eax
jne 0x417282
lea ecx, [ebp - 0x28]
call fcn.00403ac0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, ebx
call fcn.00420b40
test al, al
je 0x417273
push 0
lea ecx, [ebp - 0x28]
call fcn.00403990
push eax
call esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004039d0
mov ecx, ebx
call fcn.00416af0
test al, al
jne 0x41722c
mov eax, dword [edi + 0x10]
xor esi, esi
mov dword [ebp - 0x44], eax
test eax, eax
je 0x417365
nop dword [eax]
mov ecx, dword [edi + 0x14]
mov eax, edi
cmp ecx, 8
jb 0x4172ac
mov eax, dword [edi]
mov edx, 0x2f
cmp dx, word [eax + esi*2]
mov edx, 0x5c
je 0x4172cf
mov eax, edi
cmp ecx, 8
jb 0x4172c5
mov eax, dword [edi]
cmp dx, word [eax + esi*2]
jne 0x41735b
push esi
push 0
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
call fcn.00416370
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00403bd0
mov eax, dword [eax + 0x10]
test eax, eax
je 0x41734c
lea ecx, [ebp - 0x28]
call fcn.004167e0
test al, al
jne 0x41734c
push 0
lea ecx, [ebp - 0x28]
call fcn.00403990
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x41734c
lea ecx, [ebp - 0x40]
call fcn.00403ac0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.00420b40
test al, al
je 0x417340
push 0
lea ecx, [ebp - 0x40]
call fcn.00403990
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.004039d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004039d0
inc esi
cmp esi, dword [ebp - 0x44]
jb 0x4172a0
mov ecx, ebx
call fcn.004167e0
test al, al
jne 0x4173bf
push 0
mov ecx, ebx
call fcn.00403990
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push eax
call esi
test eax, eax
jne 0x4173bf
lea ecx, [ebp - 0x40]
call fcn.00403ac0
mov dword [ebp - 4], 3
lea edx, [ebp - 0x40]
mov ecx, ebx
call fcn.00420b40
test al, al
je 0x4173b0
push 0
lea ecx, [ebp - 0x40]
call fcn.00403990
push eax
call esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.004039d0
mov ecx, ebx
call fcn.00416af0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00436e3f
mov esp, ebp
pop ebp
ret