joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b1e0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x46380b
mov eax, dword fs:[0]
push eax
sub esp, 0x810
mov eax, dword [0x47eb18]
xor eax, esp
mov dword [esp + 0x80c], eax
push esi
mov eax, dword [0x47eb18]
xor eax, esp
push eax
lea eax, [esp + 0x818]
mov dword fs:[0], eax
mov esi, dword [esp + 0x828]
test esi, esi
je 0x41b2dd
push 0x800
lea eax, [esp + 0x18]
push 0
push eax
call fcn.00449530
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push esi
push str.SOFTWAREKasperskyLabSetupFolders
push 0x80000002
mov dword [esp + 0x28], 1
mov dword [esp + 0x24], 0x800
call dword [0x46836c]
test eax, eax
jne 0x41b2dd
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0xc]
call fcn.00418f10
lea ecx, [esp + 8]
mov dword [esp + 0x820], 0
call fcn.0041a900
push 0x22
lea ecx, [esp + 0xc]
call fcn.0041a9d0
lea ecx, [esp + 8]
call fcn.0041a960
push 0x22
lea ecx, [esp + 0xc]
call fcn.0041aa30
mov edx, dword [esp + 8]
push str.avp.exe
push edx
lea eax, [esp + 0x1c]
push eax
call dword [0x46839c]
lea ecx, [esp + 0x14]
push ecx
call dword [0x468398]
lea ecx, [esp + 8]
test eax, eax
jne 0x41b2e1
call fcn.004155d0
xor eax, eax
jmp 0x41b2eb
call fcn.004155d0
mov eax, 1
mov ecx, dword [esp + 0x818]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x80c]
xor ecx, esp
call fcn.0044951c
add esp, 0x81c
ret 4
Function at 0x41c5c0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4639a6
mov eax, dword fs:[0]
push eax
sub esp, 0x80c
mov eax, dword [0x47eb18]
xor eax, esp
mov dword [esp + 0x808], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x47eb18]
xor eax, esp
push eax
lea eax, [esp + 0x820]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [esp + 0x830]
push 0x800
lea eax, [esp + 0x20]
push 0
push eax
call fcn.00449530
mov ebp, dword [0x46839c]
add esp, 0xc
push str.360safe360move_
push esi
lea ecx, [esp + 0x24]
push ecx
call ebp
lea edx, [esp + 0x1c]
push edx
call dword [0x468398]
test eax, eax
je 0x41c713
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
call fcn.00418f10
push str.360safe_move
push esi
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x834], 0
call ebp
lea edx, [esp + 0x1c]
push edx
push 0
call dword [0x468350]
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push eax
push edi
mov ecx, ebx
call fcn.00419490
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x18]
call fcn.00418f10
push str.360safe
push esi
lea edx, [esp + 0x24]
push edx
mov byte [esp + 0x834], 1
call ebp
lea eax, [esp + 0x1c]
push eax
call fcn.00401dd0
add esp, 4
push edi
push 0
call dword [0x468350]
mov esi, dword [esp + 0x14]
push edi
push esi
mov ecx, ebx
call fcn.00419490
push esi
call fcn.00401dd0
mov ebx, dword [0x468284]
lea ecx, [esi - 0xc]
add esp, 4
cmp ecx, dword [0x47d060]
je 0x41c6f5
add esi, 0xfffffff4
push esi
call ebx
test eax, eax
jg 0x41c6f5
push esi
call fcn.00449df5
add esp, 4
lea edx, [edi - 0xc]
cmp edx, dword [0x47d060]
je 0x41c713
lea esi, [edi - 0xc]
push esi
call ebx
test eax, eax
jg 0x41c713
push esi
call fcn.00449df5
add esp, 4
mov ecx, dword [esp + 0x820]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.0044951c
add esp, 0x818
ret 4
Function at 0x41cf30
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x47eb18]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [0x468340]
lea eax, [esp + 0x10]
push eax
mov esi, ecx
call edi
mov ebp, dword [0x46833c]
mov ebx, dword [0x468338]
test eax, eax
jl 0x41cfab
lea ecx, [esp + 0x14]
push ecx
push 0x23
push 0
call ebp
test eax, eax
jl 0x41cf9f
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push eax
call ebx
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.0041c5c0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [eax]
mov edx, dword [edx + 0x14]
push ecx
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea eax, [esp + 0x10]
push eax
call edi
test eax, eax
jl 0x41cffa
lea ecx, [esp + 0x14]
push ecx
push 0x1a
push 0
call ebp
test eax, eax
jl 0x41cfee
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push eax
call ebx
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.0041c5c0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [eax]
mov edx, dword [edx + 0x14]
push ecx
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, dword [esp + 0x220]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0044951c
add esp, 0x214
ret

Function at 0x41d1b0
Capabilities:
Hide graphical window

Disassembly:
jmp method.CSetupPageBase.virtual_8
mov eax, dword [ecx + 4]
push 0
push eax
call dword [0x4683e8]
mov eax, 1
ret
Function at 0x41f100
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x24
push ebp
push esi
test ecx, ecx
je 0x41f10e
lea ebp, [ecx - 0x4c]
jmp 0x41f110
xor ebp, ebp
cmp dword [esp + 0x3c], 0
mov ecx, dword [ebp + 4]
je 0x41f197
mov eax, dword [esp + 0x30]
push ebx
push edi
push eax
push ecx
call dword [0x4684b8]
mov ebx, eax
push ebx
call dword [0x46849c]
mov esi, dword [esp + 0x3c]
mov edi, eax
push edi
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.00415a70
test eax, eax
je 0x41f18b
mov edx, dword [esi]
mov dword [edx - 8], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + edi*2], cx
mov eax, dword [esi]
test eax, eax
je 0x41f18b
lea edx, [edi + 1]
push edx
push eax
push ebx
call dword [0x4684a0]
mov ecx, esi
mov dword [esp + 0x10], eax
call fcn.00415af0
mov eax, dword [esi]
push eax
call dword [0x468280]
mov ecx, dword [esi]
mov dword [ecx - 8], eax
mov edx, dword [esi]
xor ecx, ecx
mov word [edx + eax*2], cx
cmp dword [esp + 0x10], edi
pop edi
pop ebx
jge 0x41f1e6
xor esi, esi
jmp 0x41f1b0
mov edx, dword [esp + 0x34]
mov eax, dword [edx]
push eax
mov eax, dword [esp + 0x34]
push eax
push ecx
call dword [0x4684bc]
mov esi, eax
test esi, esi
jne 0x41f1dc
push 0xffffffffffffffff
add ebp, 0x4c
call dword [0x4684a8]
test ebp, ebp
je 0x41f1c4
lea eax, [ebp - 0x4c]
jmp 0x41f1c6
xor eax, eax
mov edx, dword [esp + 0x30]
mov eax, dword [eax + 4]
push edx
push eax
call dword [0x4684b8]
push eax
call dword [0x4684ac]
mov eax, esi
pop esi
pop ebp
add esp, 0x24
ret 0x18
cmp dword [esp + 0x40], 0
je 0x41f219
mov ecx, dword [esi]
mov edx, dword [ecx - 8]
cmp edx, dword [esp + 0x44]
jle 0x41f219
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x30]
lea eax, [esp + 0xc]
push eax
push ecx
push edx
lea ecx, [ebp + 0x4c]
call fcn.0041eaf0
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret 0x18
pop esi
mov eax, 1
pop ebp
add esp, 0x24
ret 0x18
Function at 0x41fb90
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x463da0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x47eb18]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, ecx
xor ebp, ebp
push 0x5c
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], ebp
call fcn.0041a9d0
push 0x470d48
push 0x470d48
call dword [0x468280]
push eax
lea ecx, [esp + 0x30]
call fcn.004154f0
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx - 8]
cmp eax, ebp
jle 0x41fc9d
movzx eax, word [ecx + ebp*2]
cmp ax, 0x5c
jne 0x41fc8f
push ebp
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x30]
call fcn.0041b030
mov ecx, dword [esp + 0x14]
push ecx
mov byte [esp + 0x24], 1
call dword [0x468398]
test eax, eax
jne 0x41fc5d
mov edx, dword [esp + 0x14]
push edx
push eax
call dword [0x468350]
test eax, eax
jne 0x41fce1
mov esi, dword [ebx + 0x14]
mov ecx, dword [esi + 4]
lea eax, [esp + 0x14]
push eax
push ecx
push esi
mov ecx, ebx
call fcn.0041f980
push 1
mov ecx, ebx
mov edi, eax
call fcn.0041fa20
mov dword [esi + 4], edi
mov eax, dword [edi + 4]
mov dword [eax], edi
mov eax, dword [esp + 0x14]
lea edx, [eax - 0xc]
mov byte [esp + 0x20], 0
cmp edx, dword [0x47d060]
je 0x41fc8f
add eax, 0xfffffff4
push eax
call dword [0x468284]
test eax, eax
jg 0x41fc8f
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.00449df5
add esp, 4
mov ecx, dword [esp + 0x28]
inc ebp
cmp ebp, dword [ecx - 8]
jl 0x41fbf1
lea eax, [ecx - 0xc]
cmp eax, dword [0x47d060]
je 0x41fcc6
lea eax, [ecx - 0xc]
push eax
call dword [0x468284]
test eax, eax
jg 0x41fcc6
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff4
push ecx
call fcn.00449df5
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
mov eax, dword [esp + 0x14]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x47d060]
je 0x41fd0e
add eax, 0xfffffff4
push eax
call dword [0x468284]
test eax, eax
jg 0x41fd0e
mov edx, dword [esp + 0x14]
add edx, 0xfffffff4
push edx
call fcn.00449df5
add esp, 4
mov eax, dword [esp + 0x28]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x47d060]
je 0x41fd3b
add eax, 0xfffffff4
push eax
call dword [0x468284]
test eax, eax
jg 0x41fd3b
mov edx, dword [esp + 0x28]
add edx, 0xfffffff4
push edx
call fcn.00449df5
add esp, 4
xor eax, eax
jmp 0x41fccb
Function at 0x41fd40
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x463dd0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x47eb18]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov edi, ecx
call fcn.0042cb60
mov ebp, eax
test ebp, ebp
jne 0x41fd7e
mov eax, 8
jmp 0x41ff19
mov ecx, edi
call fcn.0042cb40
mov esi, eax
test esi, esi
je 0x41fd74
mov eax, dword [esp + 0x44]
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
jl 0x41fda7
mov dword [esp + 0x14], eax
add eax, 0xfffffff4
push eax
call dword [0x4681e4]
jmp 0x41fdbb
mov ecx, dword [0x47d064]
mov dword [esp + 0x14], ecx
push eax
lea ecx, [esp + 0x18]
call fcn.00416ef0
lea ecx, [esp + 0x14]
mov dword [esp + 0x3c], 0
call fcn.0041a900
lea ecx, [esp + 0x14]
call fcn.0041a960
mov ebx, dword [esp + 0x14]
cmp dword [ebx - 8], 0
jne 0x41fdf2
lea ecx, [esp + 0x14]
call fcn.004155d0
mov eax, 1
jmp 0x41ff19
mov edx, dword [esp + 0x44]
mov eax, dword [edx]
cmp dword [eax - 8], 0x80
jle 0x41fe14
lea ecx, [esp + 0x14]
call fcn.004155d0
mov eax, 9
jmp 0x41ff19
push ebx
call dword [0x4683a4]
test eax, eax
je 0x41fe32
lea ecx, [esp + 0x14]
call fcn.004155d0
mov eax, 3
jmp 0x41ff19
push ebx
call dword [0x468398]
test eax, eax
je 0x41fe5b
push ebx
call dword [0x468364]
test eax, eax
jne 0x41fe5b
lea ecx, [esp + 0x14]
call fcn.004155d0
mov eax, 2
jmp 0x41ff19
lea ecx, [esp + 0x14]
push ecx
mov ecx, edi
call fcn.0041eb50
test eax, eax
je 0x41fe7e
lea ecx, [esp + 0x14]
call fcn.004155d0
mov eax, 5
jmp 0x41ff19
movzx eax, word [ebx]
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x48]
push esi
call eax
mov ecx, dword [ebp]
mov esi, edx
mov edx, dword [ecx + 0x2c]
mov edi, eax
shrd edi, esi, 0x14
push ebp
shr esi, 0x14
call edx
cdq
cmp esi, edx
ja 0x41feb9
jb 0x41fea9
cmp edi, eax
jae 0x41feb9
lea ecx, [esp + 0x14]
call fcn.004155d0
mov eax, 6
jmp 0x41ff19
push ebx
call dword [0x468398]
test eax, eax
jne 0x41ff0e
lea ecx, [esp + 0x18]
call fcn.0041f910
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
mov byte [esp + 0x44], 1
call fcn.00418ed0
lea ecx, [esp + 0x1c]
call fcn.0041fb90
lea ecx, [esp + 0x18]
test eax, eax
jne 0x41ff09
call fcn.0041fac0
lea ecx, [esp + 0x14]
call fcn.004155d0
mov eax, 7
jmp 0x41ff19
call fcn.0041fac0
lea ecx, [esp + 0x14]
call fcn.004155d0
xor eax, eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 4

Function at 0x420f20
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
test ecx, ecx
je 0x420f2b
lea edi, [ecx - 0x2c]
jmp 0x420f2d
xor edi, edi
cmp byte [ecx + 0x1c], 0
mov esi, dword [esp + 0x10]
je 0x420f65
mov eax, dword [edi + 4]
push 0xe801
push eax
call dword [0x4684b8]
cmp esi, 2
jne 0x420f56
push 0
push eax
call dword [0x4683e8]
jmp 0x420f6a
test esi, esi
jne 0x420f65
push 5
push eax
call dword [0x4683e8]
jmp 0x420f6a
cmp esi, 1
je 0x420f81
mov eax, dword [esp + 0x14]
mov ecx, eax
shr ecx, 0x10
movsx edx, cx
cwde
push edx
push eax
lea ecx, [edi + 0x2c]
call fcn.00420910
pop edi
xor eax, eax
pop esi
ret 0x10
Function at 0x421120
Capabilities:
Check if file exists
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x463e38
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x47eb18]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0042cb00
mov ecx, esi
mov ebx, eax
call fcn.0042cbe0
mov edi, eax
test edi, edi
je 0x42118b
test ebx, ebx
je 0x42118b
mov eax, dword [0x47d064]
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, edi
mov dword [esp + 0x2c], 0
call fcn.00418dd0
test eax, eax
jne 0x4211a1
lea ecx, [esp + 0x14]
call fcn.004155d0
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov edx, dword [esp + 0x14]
push edx
call dword [0x468398]
test eax, eax
je 0x421182
mov eax, dword [esi + 4]
push eax
call dword [0x468480]
mov ebp, eax
test ebp, ebp
je 0x421182
mov ecx, esi
call fcn.0042cb40
mov esi, eax
test esi, esi
je 0x421289
mov eax, dword [0x47d064]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
mov byte [esp + 0x2c], 2
call fcn.004189b0
mov edx, dword [esp + 0x18]
cmp dword [edx - 8], 0
jne 0x421207
push 0x2711
lea ecx, [esp + 0x1c]
call fcn.004173a0
mov ecx, ebx
call fcn.0042f380
mov ecx, eax
call fcn.0041dd20
cmp dword [eax], 0
jne 0x4212ab
mov ecx, ebx
call fcn.0042f380
mov ecx, eax
call fcn.0041dd40
test eax, eax
jne 0x4212ab
mov edx, dword [esp + 0x18]
push edx
push str._PARTENER_s
lea eax, [esp + 0x24]
xor edi, edi
push eax
call fcn.00418f80
mov ebx, dword [0x4683e8]
add esp, 0xc
push 0
push ebp
call ebx
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x20]
push 0
push 1
push 1
push 5
push edx
push eax
push esi
call ecx
test edi, edi
jne 0x421277
push 5
push ebp
call ebx
lea ecx, [esp + 0x18]
call fcn.004155d0
lea ecx, [esp + 0x1c]
call fcn.004155d0
lea ecx, [esp + 0x14]
call fcn.004155d0
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov eax, dword [esp + 0x18]
push eax
push 0x46aae4
lea ecx, [esp + 0x24]
mov edi, 1
push ecx
jmp 0x421241
Function at 0x421750
Capabilities:
Set registry value

Disassembly:
mov eax, 0x1994
call fcn.00449f20
mov eax, dword [0x47eb18]
xor eax, esp
mov dword [esp + 0x1990], eax
push edi
mov edi, ecx
mov ecx, dword [0x4809b4]
test ecx, ecx
jne 0x42178d
xor eax, eax
pop edi
mov ecx, dword [esp + 0x1990]
xor ecx, esp
call fcn.0044951c
add esp, 0x1994
ret
push esi
call fcn.0042f200
mov esi, eax
test esi, esi
jne 0x4217b0
pop esi
pop edi
mov ecx, dword [esp + 0x1990]
xor ecx, esp
call fcn.0044951c
add esp, 0x1994
ret
mov eax, dword [esi]
mov ecx, dword [eax + 0x40]
push ebx
push esi
call ecx
push 0x800
lea edx, [esp + 0x1a0]
push 0
push edx
mov ebx, eax
call fcn.00449530
mov eax, dword [esi]
mov edx, dword [eax + 0x44]
add esp, 0xc
push 0x400
lea ecx, [esp + 0x1a0]
push ecx
push esi
call edx
cmp word [esp + 0x19c], 0
jne 0x42180c
pop ebx
pop esi
xor eax, eax
pop edi
mov ecx, dword [esp + 0x1990]
xor ecx, esp
call fcn.0044951c
add esp, 0x1994
ret
push ebp
push 0x800
lea eax, [esp + 0x11a4]
push 0
push eax
call fcn.00449530
mov ecx, dword [esi]
mov eax, dword [ecx + 0x48]
add esp, 0xc
push 0x400
lea edx, [esp + 0x11a4]
push edx
push esi
call eax
mov eax, dword [edi + 0x14]
mov ecx, dword [eax - 8]
mov ebp, dword [0x468368]
add ecx, ecx
push ecx
push eax
push 1
lea edx, [esp + 0x11ac]
push edx
lea eax, [esp + 0x1b0]
push eax
push ebx
call ebp
push 0x190
lea ecx, [esp + 0x14]
push 0
push ecx
call fcn.00449530
mov edx, dword [esi]
mov ecx, dword [edx + 0x38]
add esp, 0xc
push 0xc8
lea eax, [esp + 0x14]
push eax
push esi
call ecx
push 0x800
lea edx, [esp + 0x9a4]
push 0
push edx
call fcn.00449530
mov ecx, dword [edi + 0x14]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x9a8]
push edx
call dword [0x46839c]
lea eax, [esp + 0x9a0]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4218c0
sub eax, edx
sar eax, 1
add eax, eax
push eax
lea ecx, [esp + 0x9a4]
push ecx
push 1
push 0
lea edx, [esp + 0x1b0]
push edx
push ebx
call ebp
mov ecx, dword [esp + 0x19a0]
pop ebp
pop ebx
pop esi
pop edi
xor ecx, esp
mov eax, 1
call fcn.0044951c
add esp, 0x1994
ret
Function at 0x421980
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x463e9b
mov eax, dword fs:[0]
push eax
mov eax, 0x1008
call fcn.00449f20
mov eax, dword [0x47eb18]
xor eax, esp
mov dword [esp + 0x1004], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x47eb18]
xor eax, esp
push eax
lea eax, [esp + 0x101c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x102c]
mov esi, dword [esp + 0x1030]
mov edi, dword [esp + 0x1034]
test ebp, ebp
je 0x421bac
test esi, esi
je 0x421bac
push 0x800
xor ebx, ebx
lea eax, [esp + 0x81c]
push ebx
push eax
call fcn.00449530
push 0x800
lea ecx, [esp + 0x28]
push ebx
push ecx
call fcn.00449530
push 0x400
lea edx, [esp + 0x834]
push esi
push edx
call fcn.00449f8b
add esp, 0x24
lea eax, [esp + 0x818]
push eax
call dword [0x468380]
lea ecx, [esp + 0x818]
push ecx
push ebx
call dword [0x468350]
mov edx, dword [0x47d064]
mov dword [esp + 0x14], edx
mov ecx, dword [0x4809b4]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1028], ebx
call fcn.0042fca0
push esi
call dword [0x468398]
test eax, eax
je 0x421b0c
push esi
push str.File__s_exist
call fcn.00414ec0
add esp, 8
push esi
call dword [0x4681ec]
test eax, eax
jne 0x421b0c
push esi
push str.Delete_File__s_failed
call fcn.00414ec0
add esp, 8
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x469ff0
lea edx, [esp + 0x824]
push edx
call dword [0x468120]
lea eax, [esp + 0x18]
push eax
call dword [0x4681ec]
mov ecx, dword [esp + 0x14]
push ecx
push esi
call fcn.00421580
add esp, 8
test al, al
jne 0x421b5b
lea edx, [esp + 0x18]
push edx
push esi
call dword [0x468124]
test eax, eax
je 0x421b5b
push esi
push str.Move_File__s_to_temp_dir
call fcn.00414ec0
add esp, 8
push 4
push ebx
lea eax, [esp + 0x20]
push eax
call dword [0x468128]
test edi, edi
je 0x421b07
mov dword [edi], 4
mov ebx, 1
push 0
push esi
push ebp
call dword [0x46812c]
test ebx, ebx
je 0x421b27
mov ecx, dword [0x4809b4]
push 1
call fcn.0042f730
mov eax, dword [esp + 0x14]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x47d060]
je 0x421b54
add eax, 0xfffffff4
push eax
call dword [0x468284]
test eax, eax
jg 0x421b54
mov edx, dword [esp + 0x14]
add edx, 0xfffffff4
push edx
call fcn.00449df5
add esp, 4
mov eax, 1
jmp 0x421bae
push esi
push str.Move_File__s_failed__replace_until_reboot
call fcn.00414ec0
add esp, 8
push 0
lea ecx, [esp + 0x1c]
push ecx
push ebp
call dword [0x46812c]
push 5
push esi
lea edx, [esp + 0x20]
push edx
call dword [0x468128]
test edi, edi
je 0x421b8f
mov dword [edi], 5
mov ecx, dword [0x4809b4]
push 1
call fcn.0042f730
lea ecx, [esp + 0x14]
call fcn.004155d0
mov eax, 1
jmp 0x421bae
xor eax, eax
mov ecx, dword [esp + 0x101c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1004]
xor ecx, esp
call fcn.0044951c
add esp, 0x1014
ret
Function at 0x421c40
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x1104
call fcn.00449f20
mov eax, dword [0x47eb18]
xor eax, esp
mov dword [esp + 0x1100], eax
push ebx
mov ebx, dword [esp + 0x110c]
push ebp
push esi
push edi
push 0x800
lea eax, [esp + 0x914]
push 0
push eax
call fcn.00449530
push 0x800
lea ecx, [esp + 0x120]
push 0
push ecx
call fcn.00449530
add esp, 0x18
lea edx, [esp + 0x910]
push edx
push 0x400
call dword [0x46814c]
push 0x100
lea eax, [esp + 0x14]
push 0
push eax
call fcn.00449530
mov edi, dword [0x46839c]
mov ebp, dword [0x468398]
add esp, 0xc
xor esi, esi
lea ecx, [esp + 0x10]
push 0x80
push ecx
call fcn.004032b0
add esp, 8
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x914]
push eax
lea ecx, [esp + 0x118]
push ecx
call edi
lea eax, [esp + 0x110]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x421cf6
mov edx, dword [str..tmp]
mov ecx, dword [0x470aec]
mov dword [eax], edx
mov dx, word [0x470af0]
mov dword [eax + 4], ecx
mov word [eax + 8], dx
lea eax, [esp + 0x110]
push eax
call ebp
test eax, eax
je 0x421d4d
inc esi
cmp esi, 0xa
jl 0x421cc3
xor eax, eax
mov ecx, dword [esp + 0x1110]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044951c
add esp, 0x1104
ret
lea ecx, [esp + 0x110]
push ecx
call dword [0x468280]
mov esi, eax
mov eax, dword [ebx]
cmp dword [eax - 0xc], 1
lea ecx, [eax - 0xc]
jg 0x421d6d
cmp esi, dword [eax - 4]
jle 0x421da4
add eax, 0xfffffff4
cmp eax, dword [0x47d060]
je 0x421d98
push ecx
call dword [0x468284]
test eax, eax
jg 0x421d91
mov edx, dword [ebx]
sub edx, 0xc
push edx
call fcn.00449df5
add esp, 4
mov eax, dword [0x47d064]
mov dword [ebx], eax
push esi
mov ecx, ebx
call fcn.004153c0
test eax, eax
je 0x421dcf
lea edi, [esi + esi]
lea ecx, [edi + 2]
cmp ecx, edi
jb 0x421dc2
mov eax, dword [ebx]
push edi
lea edx, [esp + 0x114]
push edx
push eax
call fcn.00449a90
add esp, 0xc
mov ecx, dword [ebx]
mov dword [ecx - 8], esi
mov edx, dword [ebx]
xor eax, eax
mov word [edi + edx], ax
mov eax, 1
jmp 0x421d34
Function at 0x4240d0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi - 0x24]
push eax
call dword [0x4684b4]
test eax, eax
je 0x4240ed
mov ecx, dword [esi - 0x24]
push 0
push ecx
call dword [0x4683e8]
mov eax, dword [0x4809b8]
test eax, eax
je 0x424107
push eax
call dword [0x468074]
mov dword [0x4809b8], 0
push 0x7d0
call dword [0x468070]
mov edx, dword [esi - 0x24]
push edx
call dword [0x4683d0]
pop esi
jmp dword [0x468458]

Function at 0x424ae0
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x4640e0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x47eb18]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x848], 0
je 0x424c7f
lea edi, [esi + 0x48]
mov ecx, edi
call fcn.0042f1f0
test eax, eax
je 0x424c7f
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
mov dword [esp + 0x24], eax
test eax, eax
je 0x424c7f
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
mov edx, dword [esi + 0x28]
mov eax, dword [edx + 0xc]
lea ebp, [esi + 0x28]
mov ecx, ebp
call eax
cmp eax, 0x3eb
jne 0x424b64
mov ebx, 1
jmp 0x424c1a
mov edx, dword [ebp]
mov eax, dword [edx + 0xc]
mov ecx, ebp
call eax
push 0x96
test eax, eax
je 0x424bc3
lea ecx, [esp + 0x1c]
call fcn.00417490
mov ebx, eax
push 0x95
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], 0
call fcn.00417490
mov ebx, dword [ebx]
mov eax, dword [eax]
mov ecx, dword [esi + 4]
push 1
push 0x41
push ebx
push eax
push ecx
mov ecx, edi
mov byte [esp + 0x44], 1
call fcn.0042f390
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.004155d0
lea ecx, [esp + 0x18]
jmp 0x424c0d
lea ecx, [esp + 0x24]
call fcn.00417490
mov ebx, eax
push 0x94
lea ecx, [esp + 0x20]
mov dword [esp + 0x34], 2
call fcn.00417490
mov ebx, dword [ebx]
mov eax, dword [eax]
mov edx, dword [esi + 4]
push 6
push 0x41
push ebx
push eax
push edx
mov ecx, edi
mov byte [esp + 0x44], 3
call fcn.0042f390
lea ecx, [esp + 0x1c]
mov ebx, eax
call fcn.004155d0
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0xffffffff
call fcn.004155d0
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
cmp ebx, 1
jne 0x424c7f
mov ecx, edi
call fcn.0042f2d0
mov ecx, eax
call fcn.004150c0
mov eax, dword [ebp]
mov edx, dword [eax + 0xc]
mov ecx, ebp
call edx
mov ecx, edi
cmp eax, 0x3eb
jne 0x424c4f
push 8
jmp 0x424c51
push 4
call fcn.0042ff00
mov eax, dword [esi + 4]
push 0
push eax
call dword [0x4683e8]
push 0x7d0
call dword [0x468070]
mov ecx, dword [esi + 4]
push ecx
call dword [0x4683d0]
push 2
call dword [0x468458]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret