joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427410
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x44f1b2
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x468110]
xor eax, esp
mov dword [esp + 0x38], eax
push ebp
push esi
push edi
mov eax, dword [0x468110]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
push 0x20a
call fcn.00436761
mov ebp, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
add esp, 4
mov edi, eax
push edi
push 0x104
call ebp
mov esi, eax
test esi, esi
jne 0x427474
push edi
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 4
xor al, al
jmp 0x427550
cmp esi, 0x104
jbe 0x4274a8
push edi
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
xor ecx, ecx
lea eax, [esi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00436761
add esp, 8
mov edi, eax
push edi
push esi
call ebp
test eax, eax
je 0x427464
push edi
lea ecx, [esp + 0x14]
mov esi, edi
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x54], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
mov byte [esp + 0x54], 1
mov eax, dword [esp + 0x24]
test eax, eax
je 0x427524
mov ebp, 8
lea esp, [esp]
mov ecx, dword [esp + 0x14]
cmp dword [esp + 0x28], ebp
jae 0x4274ee
lea ecx, [esp + 0x14]
lea edx, [esp + 0x2c]
push edx
push eax
push ecx
call fcn.0043c531
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
mov ecx, ebx
call fcn.00406e70
mov ecx, dword [esp + 0x40]
lea esi, [esi + ecx*2 + 2]
push esi
lea ecx, [esp + 0x14]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x4274e0
push edi
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 4
lea ecx, [esp + 0x2c]
mov byte [esp + 0x54], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x10]
mov dword [esp + 0x54], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov al, 1
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00436772
add esp, 0x48
ret
Function at 0x4278c0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x44c719
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x468110]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x468110]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
lea ecx, [esp + 4]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov dword [esp + 0x2c], 0
test esi, esi
je 0x427928
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x427910
lea ecx, [esp + 4]
push ecx
sub eax, edx
push eax
push esi
call fcn.0043c5a6
add esp, 0xc
cmp dword [esp + 0x1c], 8
mov eax, dword [esp + 8]
jae 0x427937
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [esp + 4]
test eax, eax
je 0x42795b
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, 1
jmp 0x427963
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00436772
add esp, 0x2c
ret

Function at 0x427980
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x44c719
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x468110]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x468110]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
lea ecx, [esp + 4]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov eax, esi
mov dword [esp + 0x2c], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4279c5
lea ecx, [esp + 4]
push ecx
sub eax, edx
push eax
push esi
call fcn.0043c5a6
mov eax, dword [esp + 0x14]
add esp, 0xc
cmp dword [esp + 0x1c], 8
jae 0x4279ec
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [esp + 4]
test eax, eax
je 0x427a10
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, 1
jmp 0x427a18
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00436772
add esp, 0x2c
ret
Function at 0x428a80
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x44c7b4
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x468110]
xor eax, esp
mov dword [esp + 0x38], eax
push esi
mov eax, dword [0x468110]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x4c], 1
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov byte [esp + 0x4c], 2
mov eax, dword [esp + 0x58]
mov esi, 0x10
cmp dword [esp + 0x6c], esi
jae 0x428ad9
lea eax, [esp + 0x58]
mov edx, dword [esp + 0x68]
lea ecx, [esp + 0x24]
push ecx
push edx
push eax
call fcn.0043c5a6
add esp, 0xc
lea ecx, [esp + 8]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov byte [esp + 0x4c], 3
mov eax, dword [esp + 0x74]
cmp dword [esp + 0x88], esi
jae 0x428b0c
lea eax, [esp + 0x74]
mov edx, dword [esp + 0x84]
lea ecx, [esp + 8]
push ecx
push edx
push eax
call fcn.0043c5a6
mov ecx, dword [esp + 0x18]
mov eax, 8
add esp, 0xc
cmp dword [esp + 0x20], eax
jae 0x428b35
lea ecx, [esp + 0xc]
cmp dword [esp + 0x3c], eax
mov eax, dword [esp + 0x28]
jae 0x428b43
lea eax, [esp + 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [esp + 8]
mov esi, eax
mov byte [esp + 0x4c], 2
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 1
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x54]
mov byte [esp + 0x4c], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x70]
mov dword [esp + 0x4c], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00436772
add esp, 0x48
ret 0x38
Function at 0x428e20
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x468110]
xor eax, esp
mov dword [esp + 0x208], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xa]
push ecx
mov word [esp + 0xc], ax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 1
push 0x10
lea edx, [esp + 8]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x428e78
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00436772
add esp, 0x20c
ret
lea eax, [esp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [esp]
lea edx, [eax + 2]
jmp 0x428e90
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x428e90
sub eax, edx
sar eax, 1
push esi
push eax
lea ecx, [esp + 8]
push ecx
call fcn.0043c531
mov ecx, dword [esp + 0x214]
add esp, 0xc
xor ecx, esp
mov eax, 1
call fcn.00436772
add esp, 0x20c
ret

Function at 0x428ed0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x468110]
xor eax, esp
mov dword [esp + 0x208], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xa]
push ecx
mov word [esp + 0xc], ax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 1
push 5
lea edx, [esp + 8]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x428f28
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00436772
add esp, 0x20c
ret
lea eax, [esp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [esp]
lea edx, [eax + 2]
jmp 0x428f40
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x428f40
sub eax, edx
sar eax, 1
push esi
push eax
lea ecx, [esp + 8]
push ecx
call fcn.0043c531
mov ecx, dword [esp + 0x214]
add esp, 0xc
xor ecx, esp
mov eax, 1
call fcn.00436772
add esp, 0x20c
ret

Function at 0x428f80
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x44cf89
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x468110]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x468110]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 8]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov eax, esi
mov dword [esp + 0x30], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x428fc8
lea ecx, [esp + 8]
push ecx
sub eax, edx
push eax
push esi
call fcn.0043c5a6
mov eax, dword [esp + 0x18]
add esp, 0xc
cmp dword [esp + 0x20], 8
jae 0x428fef
lea eax, [esp + 0xc]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x30], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00436772
add esp, 0x2c
ret
Function at 0x4290f0
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x44c6d9
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x468110]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
push edi
mov eax, dword [0x468110]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0xc]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov eax, esi
mov dword [esp + 0x34], 0
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x429140
lea ecx, [esp + 0xc]
push ecx
sub eax, edx
push eax
push esi
call fcn.0043c5a6
mov eax, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x429179
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor al, al
jmp 0x42921d
mov edi, dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
cmp eax, 2
jae 0x42918a
call edi
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x10]
mov ecx, esi
cmp edx, 8
jae 0x42919d
lea ecx, [esp + 0x10]
cmp word [ecx + 4], 0x5c
je 0x4291c5
cmp eax, 2
jae 0x4291b3
call edi
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x10]
mov eax, esi
cmp edx, 8
jae 0x4291be
lea eax, [esp + 0x10]
cmp word [eax + 4], 0x2f
jne 0x429160
mov eax, esi
cmp edx, 8
jae 0x4291d0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x429209
cmp dword [esp + 0x24], 8
mov eax, dword [esp + 0x10]
jae 0x4291ea
lea eax, [esp + 0x10]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x429209
cmp eax, 0x50
je 0x429209
cmp eax, 0xb7
jne 0x429160
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov al, 1
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00436772
add esp, 0x2c
ret
Function at 0x42a130
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x44c5d2
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x468110]
xor eax, esp
mov dword [esp + 0x54], eax
push esi
mov eax, dword [0x468110]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x40]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov dword [esp + 0x68], 0
test esi, esi
je 0x42a198
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42a180
lea ecx, [esp + 0x40]
push ecx
sub eax, edx
push eax
push esi
call fcn.0043c5a6
add esp, 0xc
cmp dword [esp + 0x58], 8
mov eax, dword [esp + 0x44]
jae 0x42a1a7
lea eax, [esp + 0x44]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
push 0
push 0
push eax
push str.open
push 0
call esi
cmp eax, 0x20
ja 0x42a251
cmp eax, 2
je 0x42a251
cmp eax, 3
je 0x42a251
cmp eax, 0x1f
jne 0x42a23b
push str.Shell32.dll_OpenAs_RunDLL
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea edx, [esp + 0x40]
push edx
push eax
lea eax, [esp + 0x10]
push eax
mov byte [esp + 0x74], 1
call dword [sym.imp.MSVCP90.dll_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_std::operator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
add esp, 0xc
cmp dword [eax + 0x18], 8
jb 0x42a20c
mov eax, dword [eax + 4]
jmp 0x42a20f
add eax, 4
push 1
push 0
push eax
push str.rundll32.exe
push str.open
push 0
call esi
lea ecx, [esp + 8]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x24]
mov byte [esp + 0x68], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x40]
mov dword [esp + 0x68], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor eax, eax
jmp 0x42a268
lea ecx, [esp + 0x40]
mov dword [esp + 0x68], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, 1
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.00436772
add esp, 0x64
ret
Function at 0x42a640
Capabilities:
Enumerate processes
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x454
mov eax, dword [0x468110]
xor eax, esp
mov dword [esp + 0x450], eax
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0x104
lea ecx, [esp + 0x254]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, 0x4594cc
lea eax, [esp + 0x250]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42a6a9
test dx, dx
je 0x42a6a5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42a6a9
add eax, 4
add ecx, 4
test dx, dx
jne 0x42a683
xor eax, eax
jmp 0x42a6ae
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x42a7e4
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call esi
push 1
mov edi, eax
call esi
mov esi, dword [sym.imp.USER32.dll_WindowFromPoint]
mov ecx, 2
mov edx, ecx
push edx
add edi, 0xfffffffd
push ecx
lea ebx, [eax - 3]
mov dword [esp + 0x14], edi
call esi
mov edi, dword [sym.imp.USER32.dll_GetAncestor]
push 2
push eax
call edi
mov dword [esp + 0x1c], eax
push ebx
mov eax, 2
push eax
call esi
push 2
push eax
call edi
mov edx, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov eax, 2
push eax
push edx
call esi
push 2
push eax
call edi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc]
push ebx
push eax
call esi
push 2
push eax
call edi
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
cmp edx, ecx
jne 0x42a7e4
mov esi, dword [esp + 0x18]
cmp ecx, esi
jne 0x42a7e4
cmp esi, eax
jne 0x42a7e4
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [esp + 0x10], 0
je 0x42a7c3
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x42a7e4
lea edx, [esp + 0x20]
push edx
push esi
mov dword [esp + 0x28], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x42a7bc
mov edi, dword [sym.imp.MSVCR90.dll__wcsicmp]
lea esp, [esp]
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x28]
jne 0x42a7ad
lea ecx, [esp + 0x44]
push str.explorer.exe
push ecx
call edi
add esp, 8
test eax, eax
je 0x42a7dd
lea edx, [esp + 0x20]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x42a790
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x450]
xor ecx, esp
call fcn.00436772
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x45c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00436772
mov esp, ebp
pop ebp
ret
Function at 0x42d56c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp edi, ebx
je 0x42d610
xor eax, eax
cmp ax, word [edi]
je 0x42d610
push ebx
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp + 8], eax
cmp eax, ebx
je 0x42d60c
inc eax
push esi
push eax
call fcn.00436761
mov esi, eax
pop ecx
cmp esi, ebx
je 0x42d60b
push esi
push dword [ebp + 8]
push ebx
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x42d604
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x4572c4
push esi
mov dword [ebp - 4], ebx
mov dword [ebp + 8], 0x34
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x42d604
mov eax, dword [ebp - 4]
mov cx, word [eax + 0xa]
mov edx, dword [ebp + 0xc]
mov word [edx], cx
mov cx, word [eax + 8]
mov edx, dword [ebp + 0x10]
mov word [edx], cx
mov cx, word [eax + 0xe]
mov edx, dword [ebp + 0x14]
mov word [edx], cx
mov ax, word [eax + 0xc]
mov ecx, dword [ebp + 0x18]
mov word [ecx], ax
mov bl, 1
push esi
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
pop ecx
pop esi
mov al, bl
jmp 0x42d61d
push 0x132b3a1
call fcn.0042d89a
pop ecx
xor al, al
pop edi
pop ebx
leave
ret

Function at 0x42dad3
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x468110]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::clear_void_]
xor ebx, ebx
push 0x63
lea eax, [ebp - 0x7b]
push ebx
push eax
mov byte [ebp - 0x7c], bl
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x80]
push eax
push 0x64
lea eax, [ebp - 0x7c]
push eax
push 0x451a9c
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x42db28
xor al, al
jmp 0x42db6c
mov ecx, dword [ebp - 0x80]
push ebx
push ebx
mov eax, ecx
shr eax, 0x18
push eax
mov edx, ecx
shr edx, 0x10
mov eax, 0xff
and edx, eax
push edx
mov edx, ecx
shr edx, 8
and edx, eax
movzx eax, cl
push edx
push eax
lea eax, [ebp - 0x18]
push str._02X_02X_02X_02X_02X_02X
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0x20
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const__]
mov al, 1
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00436772
leave
ret 4
Function at 0x42ecdb
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x468110]
xor eax, ebp
mov dword [ebp + 0x8c], eax
mov eax, dword [ebp + 0x98]
push ebx
push esi
push edi
xor esi, esi
push 0x103
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x77]
push esi
push eax
mov dword [ebp - 0x80], esi
mov byte [ebp - 0x78], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
push 1
push 0x23
lea eax, [ebp - 0x78]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42ed3f
push str.c:windows_temp
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp dword [ebp + 0x9c], esi
je 0x42ed65
lea eax, [ebp - 0x78]
push eax
call edi
cmp eax, 0xffffffff
jne 0x42ed65
push esi
lea eax, [ebp - 0x78]
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.Thunder_Network
lea eax, [ebp - 0x78]
push eax
call esi
cmp dword [ebp + 0x9c], 0
je 0x42ed92
lea eax, [ebp - 0x78]
push eax
call edi
cmp eax, 0xffffffff
jne 0x42ed92
push 0
lea eax, [ebp - 0x78]
push eax
call ebx
push 0x451b78
lea eax, [ebp - 0x78]
push eax
call esi
cmp dword [ebp + 0x9c], 0
je 0x42edb9
lea eax, [ebp - 0x78]
push eax
call edi
cmp eax, 0xffffffff
jne 0x42edb9
push 0
lea eax, [ebp - 0x78]
push eax
call ebx
mov ecx, dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov ecx, dword [ebp + 0x8c]
mov eax, dword [ebp - 0x7c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00436772
add ebp, 0x90
leave
ret