joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403bc5
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1804
call fcn.0040d7f0
mov eax, dword [0x283b71c]
mov ecx, dword [0x283b1a8]
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x403c99
mov edi, ecx
mov ebx, eax
cmp dword [0x283b71c], 0x959
jne 0x403c89
push esi
lea eax, [ebp - 0x1000]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push esi
push esi
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x403760
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push 0x40377c
push esi
call dword [sym.imp.KERNEL32.dll_FatalAppExitA]
push 0x403794
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push esi
lea eax, [ebp - 0x1800]
push eax
push esi
push 0x4037b8
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
call fcn.00403a57
add edi, 8
dec ebx
jne 0x403bf1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403f52
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1404
call fcn.0040d7f0
push ebx
mov ebx, dword [sym.imp.GDI32.dll_GetCharWidthI]
push esi
push edi
xor esi, esi
xor edi, edi
cmp edi, 0x9a4
jge 0x403f93
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.USER32.dll_SetClipboardViewer]
push esi
push esi
push esi
push esi
push esi
call ebx
push esi
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp edi, 0x4f47acc
jg 0x403fb5
inc edi
cmp edi, 0x3361729
jl 0x403f6f
cmp dword [0x283b71c], 0x400
jne 0x4040b4
push esi
call dword [sym.imp.USER32.dll_GetDC]
push esi
lea eax, [esp + 0x414]
push eax
push esi
push 0x403930
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push esi
push esi
lea eax, [esp + 0xc18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push esi
lea eax, [esp + 0x14]
push eax
push 0x403944
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0x403960
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
call fcn.00404644
pop ecx
push esi
push esi
call fcn.0040477a
push esi
call fcn.00404d49
add esp, 0xc
push esi
call fcn.00404f6a
fldz
sub esp, 0xc
fst qword [esp + 8]
fstp qword [esp]
call fcn.00404120
add esp, 8
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00404200
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.004048c0
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00404330
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00404a40
fstp st(0)
push esi
push esi
call fcn.00404b94
push esi
call fcn.00404fde
add esp, 0x14
push esi
push esi
call fcn.0040467e
push esi
push esi
call fcn.004045d4
push esi
call fcn.00404dae
add esp, 0x14
xor edi, edi
cmp edi, 0x16d2a
jge 0x4040c5
push esi
push esi
push esi
push esi
push esi
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, 0x12e82fe
jg 0x4040e3
inc edi
cmp edi, 0x3011b
jl 0x4040b6
mov eax, dword [0x443b84]
mov dword [0x283b71c], eax
call fcn.00403c9e
mov edi, 0x2ec37
cmp dword [0x283b71c], 0x51f
jne 0x40410f
push esi
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
dec edi
jne 0x4040f7
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x407408
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4401f8]
jne 0x407412
repz ret
jmp fcn.0040c190
Function at 0x40d24f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4401f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00409031
and dword [ebp - 0x14], 0
cmp dword [0x458708], 0
mov dword [ebp - 0x18], eax
jne 0x40d302
push 0x402f04
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40d3aa
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402ef8
push ebx
call edi
test eax, eax
je 0x40d3aa
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x402ee8
push ebx
mov dword [0x458708], eax
call edi
push eax
call esi
push 0x402ed4
push ebx
mov dword [0x45870c], eax
call edi
push eax
call esi
push 0x402eb8
push ebx
mov dword [0x458710], eax
call edi
push eax
call esi
mov dword [0x458718], eax
test eax, eax
je 0x40d302
push 0x402ea0
push ebx
call edi
push eax
call esi
mov dword [0x458714], eax
mov eax, dword [0x458714]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40d35b
cmp dword [0x458718], ecx
je 0x40d35b
push eax
call esi
push dword [0x458718]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40d35b
test ebx, ebx
je 0x40d35b
call edi
test eax, eax
je 0x40d352
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40d352
test byte [ebp - 8], 1
jne 0x40d35b
or dword [ebp + 0x10], 0x200000
jmp 0x40d38e
mov eax, dword [0x45870c]
cmp eax, dword [ebp - 0x18]
je 0x40d38e
push eax
call esi
test eax, eax
je 0x40d38e
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40d38e
mov eax, dword [0x458710]
cmp eax, dword [ebp - 0x18]
je 0x40d38e
push eax
call esi
test eax, eax
je 0x40d38e
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x458708]
call esi
test eax, eax
je 0x40d3aa
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40d3ac
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407408
leave
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x431072
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x43c75b58
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x431060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x44e409e9
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4586dc
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x4586f5
mov esi, edi
mov edi, eax
jmp 0x4586f7
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x458707
mov eax, ebx
jmp 0x458711
push eax
push ebx
call fcn.0043f4ac
add esp, 8
test eax, eax
jne 0x458719
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x458737
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [edi + 4]
jl 0x458720
cmp eax, dword [esi + 4]
jge 0x45874e
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [esi + 4]
jl 0x45873c
mov eax, dword [esi + 4]
test eax, eax
mov dword [ebx + 4], eax
jle 0x458771
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x45876e
sub eax, 1
test eax, eax
jg 0x45875e
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x4bc11c
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
mov edx, dword [ecx]
mov ebx, 0x20
mov esi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 8], edx
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
push edi
mov edi, 0xc6ef3720
mov dword [ebp + 0xc], edx
mov dword [ebp - 0xc], ecx
mov edx, esi
dec ebx
shr edx, 5
add edx, ecx
mov ecx, esi
shl ecx, 4
add ecx, dword [ebp + 0xc]
xor edx, ecx
lea ecx, [edi + esi]
xor edx, ecx
sub eax, edx
mov edx, eax
mov ecx, eax
shr edx, 5
add edx, dword [ebp - 4]
shl ecx, 4
add ecx, dword [ebp - 8]
xor edx, ecx
lea ecx, [edi + eax]
xor edx, ecx
lea edi, [edi + 0x61c88647]
mov ecx, dword [ebp - 0xc]
sub esi, edx
test ebx, ebx
jg 0x4bc151
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx], esi
pop esi
mov dword [ecx + 4], eax
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4bc58c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
mov edx, dword [ecx]
mov ebx, 0x20
mov esi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 4], edx
mov edx, dword [ecx + 4]
mov dword [ebp + 0xc], edx
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
push edi
xor edi, edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
mov edx, eax
lea edi, [edi - 0x61c88647]
shr edx, 5
mov ecx, eax
add edx, dword [ebp + 0xc]
dec ebx
shl ecx, 4
add ecx, dword [ebp - 4]
xor edx, ecx
lea ecx, [edi + eax]
xor edx, ecx
add esi, edx
mov edx, esi
mov ecx, esi
shr edx, 5
add edx, dword [ebp - 8]
shl ecx, 4
add ecx, dword [ebp - 0xc]
xor edx, ecx
lea ecx, [edi + esi]
xor edx, ecx
add eax, edx
test ebx, ebx
jg 0x4bc5be
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx], esi
pop esi
mov dword [ecx + 4], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c5a9c
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1012014c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x28], esi
push edi
mov edi, dword [ebp + 0xc]
cmp ebx, 0x40
jle 0x4c5ad6
lea eax, [ebp - 0x24]
push eax
push ebx
push edi
call fcn.004c56dc
add esp, 0xc
lea edi, [ebp - 0x24]
mov ebx, 0x20
push 0x40
lea eax, [esi + 0x68]
push 0x36
push eax
call fcn.004d107c
push 0x40
add esi, 0xa8
push 0x5c
push esi
call fcn.004d107c
add esp, 0x18
test ebx, ebx
jle 0x4c5b14
nop
movzx eax, byte [edi]
lea edi, [edi + 1]
xor byte [esi - 0x40], al
lea esi, [esi + 1]
movzx eax, byte [edi - 1]
xor byte [esi - 1], al
sub ebx, 1
jne 0x4c5afc
mov esi, dword [ebp - 0x28]
push 0
push esi
call fcn.004c5b5c
push 0x40
lea eax, [esi + 0x68]
push eax
push esi
call fcn.004c5b9c
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004cdbb9
mov esp, ebp
pop ebp
ret

Function at 0x4cce4c
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
mov edx, dword [ecx]
mov ebx, 0x20
mov esi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 8], edx
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
push edi
mov edi, 0xc6ef3720
mov dword [ebp + 0xc], edx
mov dword [ebp - 0xc], ecx
mov edx, esi
dec ebx
shr edx, 5
add edx, ecx
mov ecx, esi
shl ecx, 4
add ecx, dword [ebp + 0xc]
xor edx, ecx
lea ecx, [edi + esi]
xor edx, ecx
sub eax, edx
mov edx, eax
mov ecx, eax
shr edx, 5
add edx, dword [ebp - 4]
shl ecx, 4
add ecx, dword [ebp - 8]
xor edx, ecx
lea ecx, [edi + eax]
xor edx, ecx
lea edi, [edi + 0x61c88647]
mov ecx, dword [ebp - 0xc]
sub esi, edx
test ebx, ebx
jg 0x4cce81
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx], esi
pop esi
mov dword [ecx + 4], eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4cd01c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
mov edx, dword [ecx]
mov ebx, 0x20
mov esi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 4], edx
mov edx, dword [ecx + 4]
mov dword [ebp + 0xc], edx
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
push edi
xor edi, edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
mov edx, eax
lea edi, [edi - 0x61c88647]
shr edx, 5
mov ecx, eax
add edx, dword [ebp + 0xc]
dec ebx
shl ecx, 4
add ecx, dword [ebp - 4]
xor edx, ecx
lea ecx, [edi + eax]
xor edx, ecx
add esi, edx
mov edx, esi
mov ecx, esi
shr edx, 5
add edx, dword [ebp - 8]
shl ecx, 4
add ecx, dword [ebp - 0xc]
xor edx, ecx
lea ecx, [edi + esi]
xor edx, ecx
add eax, edx
test ebx, ebx
jg 0x4cd04e
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx], esi
pop esi
mov dword [ecx + 4], eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x51572a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00515311
Function at 0x515735
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005154a0

Function at 0x52d7ec
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x52d819
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x52d819
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x406740
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x446201
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
mov eax, dword [0x4551a0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x3c]
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x24], eax
mov word [esp + 0x14], ax
push 0xffffffffffffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x48]
xor ebx, ebx
mov dword [esp + 0x30], 7
call fcn.00401709
mov dword [esp + 0x34], 1
mov eax, edi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4067a0
sub eax, edx
sar eax, 1
mov ebx, eax
push edi
lea eax, [esp + 0x14]
call fcn.00403a55
xor ecx, ecx
push 0xffffffffffffffff
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ecx
push esi
xor ebx, ebx
mov word [esi + 4], cx
call fcn.00401709
mov dword [esp + 0xc], 1
mov byte [esp + 0x34], bl
cmp dword [esp + 0x28], 8
jb 0x4067f5
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0043004e
add esp, 4
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], bx
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x2c
ret

Function at 0x406840
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esi + 4]
test eax, eax
je 0x406859
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
mov byte [esi + 9], 0
cmp dword [edi + 0x14], 0
je 0x40686f
cmp dword [edi + 0x18], 8
jb 0x40686a
mov eax, dword [edi + 4]
jmp 0x406871
lea eax, [edi + 4]
jmp 0x406871
xor eax, eax
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
mov dword [esi + 4], eax
je 0x4068a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0xb7
neg eax
sbb eax, eax
and eax, 0xfffffffe
add eax, 2
cmp dword [esi + 4], 0
mov dword [esi], eax
setne al
ret
cmp dword [esi + 4], 0
mov dword [esi], 1
setne al
ret

Function at 0x406bc0
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 0xffffffff
jne 0x406bcc
xor al, al
ret
and eax, 0xffffb1af
cmp dword [ecx + 0x18], 8
jb 0x406be8
mov ecx, dword [ecx + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret
add ecx, 4
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret
Function at 0x406db0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x447738
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4551a0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
mov eax, dword [0x4551a0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x3c]
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
xor esi, esi
push ecx
xor ebx, ebx
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], esi
mov word [esp + 0x18], si
call fcn.00401709
mov dword [esp + 0x34], esi
push 0x24
lea ecx, [esp + 0x10]
call fcn.00406110
mov eax, dword [esp + 0x14]
add esp, 4
cmp dword [esp + 0x24], 8
jae 0x406e26
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x406e52
mov dword [esp + 0x34], 0xffffffff
cmp dword [esp + 0x24], 8
jb 0x406e4e
mov edx, dword [esp + 0x10]
push edx
call fcn.0043004e
add esp, 4
mov al, 1
jmp 0x406e70
mov dword [esp + 0x34], 0xffffffff
cmp dword [esp + 0x24], 8
jb 0x406e6e
mov eax, dword [esp + 0x10]
push eax
call fcn.0043004e
add esp, 4
xor al, al
mov word [esp + 0x10], si
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 7
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0042fe0e
add esp, 0x2c
ret

Function at 0x406ea0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x447738
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4551a0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
mov eax, dword [0x4551a0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x3c]
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
xor esi, esi
push ecx
xor ebx, ebx
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], esi
mov word [esp + 0x18], si
call fcn.00401709
mov dword [esp + 0x34], esi
push 0x24
lea ecx, [esp + 0x10]
call fcn.00406110
mov eax, dword [esp + 0x14]
add esp, 4
cmp dword [esp + 0x24], 8
jae 0x406f16
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x406f46
test al, 0x10
jne 0x406f46
mov dword [esp + 0x34], 0xffffffff
cmp dword [esp + 0x24], 8
jb 0x406f42
mov edx, dword [esp + 0x10]
push edx
call fcn.0043004e
add esp, 4
mov al, 1
jmp 0x406f64
mov dword [esp + 0x34], 0xffffffff
cmp dword [esp + 0x24], 8
jb 0x406f62
mov eax, dword [esp + 0x10]
push eax
call fcn.0043004e
add esp, 4
xor al, al
mov word [esp + 0x10], si
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 7
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0042fe0e
add esp, 0x2c
ret
Function at 0x406fa0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x447738
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4551a0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
mov eax, dword [0x4551a0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x3c]
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
xor esi, esi
push ecx
xor ebx, ebx
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], esi
mov word [esp + 0x18], si
call fcn.00401709
mov dword [esp + 0x34], esi
push 0x24
lea ecx, [esp + 0x10]
call fcn.00406110
mov eax, dword [esp + 0x14]
add esp, 4
cmp dword [esp + 0x24], 8
jae 0x407016
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x407046
test al, 0x10
je 0x407046
mov dword [esp + 0x34], 0xffffffff
cmp dword [esp + 0x24], 8
jb 0x407042
mov edx, dword [esp + 0x10]
push edx
call fcn.0043004e
add esp, 4
mov al, 1
jmp 0x407064
mov dword [esp + 0x34], 0xffffffff
cmp dword [esp + 0x24], 8
jb 0x407062
mov eax, dword [esp + 0x10]
push eax
call fcn.0043004e
add esp, 4
xor al, al
mov word [esp + 0x10], si
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 7
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0042fe0e
add esp, 0x2c
ret
Function at 0x4075a0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x446e68
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4551a0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4551a0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x48]
mov eax, dword [ebp + 0x14]
xor edi, edi
test eax, eax
mov dword [esp + 0x14], eax
jbe 0x4076d1
cmp edi, dword [ebp + 0x14]
jbe 0x4075f1
call fcn.00430697
mov ebx, 8
cmp dword [ebp + 0x18], ebx
lea esi, [ebp + 4]
jb 0x407602
mov eax, dword [esi]
jmp 0x407604
mov eax, esi
cmp word [eax + edi*2], 0x2f
je 0x40762b
cmp edi, dword [ebp + 0x14]
jbe 0x407615
call fcn.00430697
cmp dword [ebp + 0x18], ebx
jb 0x40761e
mov eax, dword [esi]
jmp 0x407620
mov eax, esi
cmp word [eax + edi*2], 0x5c
jne 0x4076c4
push edi
push ebp
xor ebx, ebx
lea esi, [esp + 0x20]
call fcn.004036cb
xor esi, esi
mov dword [esp + 0x40], esi
cmp dword [esp + 0x2c], esi
jne 0x407653
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x30], 8
jmp 0x4076a4
lea ecx, [esp + 0x18]
push ecx
call fcn.00406db0
add esp, 4
test al, al
mov ebx, 8
jne 0x407698
cmp dword [esp + 0x30], ebx
mov eax, dword [esp + 0x1c]
jae 0x407677
lea eax, [esp + 0x1c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x407698
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x30], ebx
jb 0x4076b3
mov edx, dword [esp + 0x1c]
push edx
jmp 0x4076ab
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x30], ebx
jb 0x4076b3
mov eax, dword [esp + 0x1c]
push eax
call fcn.0043004e
add esp, 4
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], esi
mov word [esp + 0x1c], si
add edi, 1
cmp edi, dword [esp + 0x14]
jb 0x4075e7
push ebp
call fcn.00406db0
add esp, 4
test al, al
jne 0x4076f5
cmp dword [ebp + 0x18], 8
jb 0x4076e9
mov eax, dword [ebp + 4]
jmp 0x4076ec
lea eax, [ebp + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebp
call fcn.00406fa0
add esp, 4
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0042fe0e
add esp, 0x30
ret

Function at 0x408fe0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x4551a0]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
push 0x20a
lea eax, [esp + 0xa]
push 0
push eax
mov esi, ecx
mov word [esp + 0x10], 0
call fcn.004323d0
add esp, 0xc
push 0x105
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
add eax, 0xffffffff
cmp eax, 0x103
ja 0x409057
lea eax, [esp + 4]
mov word [esp + 0x20e], 0
call fcn.00401625
mov al, 1
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.0042fe0e
add esp, 0x210
ret
mov ecx, dword [esp + 0x210]
pop esi
xor ecx, esp
xor al, al
call fcn.0042fe0e
add esp, 0x210
ret