joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405c60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x405c84
push dword [ecx + 0x20]
push esi
push 2
push eax
call fcn.0046d70d
add esp, 0x14
jmp 0x405cb2
test esi, esi
jle 0x405cab
xor edi, edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov ebx, eax
movzx eax, word [eax + edi*2]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp ax, 0xffff
je 0x405cad
inc edi
mov eax, ebx
cmp edi, esi
jl 0x405c8d
jmp 0x405cad
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x405cc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x49c3bc]
movzx ebx, word [ebp + 8]
xor eax, ebp
cmp bx, 0xffff
mov dword [ebp - 0x10], eax
je 0x405d85
mov word [ebp - 0x1a], bx
mov edi, ecx
cmp byte [ecx + 0x2c], 0
je 0x405d0b
xor esi, esi
lea eax, [ebp - 0x1a]
inc esi
push dword [edi + 0x20]
push esi
push 2
push eax
call fcn.0046d70d
add esp, 0x10
cmp eax, esi
je 0x405d85
jmp 0x405d90
lea esi, [ebp - 0x1a]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
mov ecx, dword [edi + 0x24]
lea edx, [ebp - 0x20]
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x405d90
mov ebx, eax
cmp eax, 3
je 0x405d6c
cmp ebx, 1
ja 0x405d90
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.0046d70d
add esp, 0x10
cmp eax, esi
jne 0x405d90
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x405d16
jmp 0x405d81
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.0046d70d
add esp, 0x10
cmp eax, ebx
jne 0x405d90
movzx ebx, word [ebp + 8]
xor eax, eax
cmp bx, 0xffff
cmove ebx, eax
jmp 0x405d93
xor ebx, ebx
dec ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00459221
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x40b7e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
lea ecx, [esi + 0x38]
mov edi, dword [ebp + 0x10]
mov dword [ecx - 4], esp
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x419610
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
lea eax, [esi + 0x21]
xor ecx, ecx
mov dword [eax + 3], ecx
mov dword [eax - 1], 0x25
push dword [edi + 4]
push ecx
push 0x4825e6
push eax
call fcn.00408934
add esp, 0x10
mov ebx, dword [edi + 4]
mov dword [esi + 0x14], esp
shr ebx, 9
and ebx, 1
lea eax, [ebx + 0x16]
lea ecx, [eax + 1]
add eax, 4
and eax, 0xfffffffc
mov dword [esi + 4], ecx
call fcn.004595b0
mov edi, esp
lea eax, [esi + 0x28]
mov dword [esi + 0xc], edi
push eax
call fcn.00405e30
add esp, 4
lea eax, [esi + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push eax
lea eax, [esi + 0x28]
push dword [eax + 4]
push dword [eax]
push dword [esi + 4]
push edi
call fcn.0041bae9
add esp, 0x1c
mov edi, eax
mov eax, dword [esi + 0xc]
add edi, eax
push dword [ebp + 0x10]
push edi
push eax
call fcn.00408a48
add esp, 0xc
mov dword [esi + 4], eax
lea eax, [ebx + ebx + 0x2e]
and eax, 0xfffffffc
call fcn.004595b0
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 8]
mov ebx, esp
push eax
call fcn.004035a6
lea edx, [esi + 8]
lea eax, [esi + 0x38]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0x18]
lea ecx, [esi + 0x1c]
push edx
push eax
push ecx
mov dword [esi + 0x10], ebx
push ebx
push edi
push dword [esi + 4]
push dword [esi + 0xc]
call fcn.00413cc0
add esp, 0x1c
mov ecx, dword [esi + 8]
xor eax, eax
mov edi, dword [ebp + 8]
mov dl, byte [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x40b8ff
mov eax, dword [ecx]
call dword [eax + 4]
mov dl, byte [ebp + 0x14]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
movsx edx, dl
mov dword [esi + 0x40], 0xffffffff
push edx
push dword [ebp + 0x10]
push eax
push ecx
push dword [esi + 0x10]
push ebx
push edi
call fcn.00413f40
add esp, 0x1c
mov esp, dword [esi + 0x14]
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x40bac0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
lea ecx, [esi + 0x38]
mov edi, dword [ebp + 0x10]
mov dword [ecx - 4], esp
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x419630
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
lea eax, [esi + 0x21]
xor ecx, ecx
mov dword [eax + 3], ecx
xor ecx, ecx
mov dword [eax - 1], 0x25
inc ecx
push dword [edi + 4]
push ecx
push 0x4825e6
push eax
call fcn.00408934
add esp, 0x10
mov ebx, dword [edi + 4]
mov dword [esi + 0x14], esp
shr ebx, 9
and ebx, 1
lea eax, [ebx + 0x17]
mov dword [esi + 4], eax
sub esp, 0x18
mov edi, esp
lea eax, [esi + 0x28]
mov dword [esi + 0xc], edi
push eax
call fcn.00405e30
add esp, 4
lea eax, [esi + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push eax
lea eax, [esi + 0x28]
push dword [eax + 4]
push dword [eax]
push dword [esi + 4]
push edi
call fcn.0041bae9
add esp, 0x1c
mov edi, eax
mov eax, dword [esi + 0xc]
add edi, eax
push dword [ebp + 0x10]
push edi
push eax
call fcn.00408a48
add esp, 0xc
mov dword [esi + 4], eax
lea eax, [ebx + ebx + 0x2e]
and eax, 0xfffffffc
call fcn.004595b0
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 8]
mov ebx, esp
push eax
call fcn.004035a6
lea edx, [esi + 8]
lea eax, [esi + 0x38]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0x18]
lea ecx, [esi + 0x1c]
push edx
push eax
push ecx
mov dword [esi + 0x10], ebx
push ebx
push edi
push dword [esi + 4]
push dword [esi + 0xc]
call fcn.00413cc0
add esp, 0x1c
mov ecx, dword [esi + 8]
xor eax, eax
mov edi, dword [ebp + 8]
mov dl, byte [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x40bbd7
mov eax, dword [ecx]
call dword [eax + 4]
mov dl, byte [ebp + 0x14]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
movsx edx, dl
mov dword [esi + 0x40], 0xffffffff
push edx
push dword [ebp + 0x10]
push eax
push ecx
push dword [esi + 0x10]
push ebx
push edi
call fcn.00413f40
add esp, 0x1c
mov esp, dword [esi + 0x14]
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x40c7e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
lea ecx, [esi + 0x38]
mov edi, dword [ebp + 0x10]
mov dword [ecx - 4], esp
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x419690
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
lea eax, [esi + 0x21]
xor ecx, ecx
mov dword [eax + 3], ecx
mov dword [eax - 1], 0x25
push dword [edi + 4]
push ecx
push 0x4825e6
push eax
call fcn.00408934
add esp, 0x10
mov ebx, dword [edi + 4]
mov dword [esi + 0x14], esp
shr ebx, 9
and ebx, 1
lea eax, [ebx + 0x16]
lea ecx, [eax + 1]
add eax, 4
and eax, 0xfffffffc
mov dword [esi + 4], ecx
call fcn.004595b0
mov edi, esp
lea eax, [esi + 0x28]
mov dword [esi + 0xc], edi
push eax
call fcn.00405e30
add esp, 4
lea eax, [esi + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push eax
lea eax, [esi + 0x28]
push dword [eax + 4]
push dword [eax]
push dword [esi + 4]
push edi
call fcn.0041bae9
add esp, 0x1c
mov edi, eax
mov eax, dword [esi + 0xc]
add edi, eax
push dword [ebp + 0x10]
push edi
push eax
call fcn.00408a48
add esp, 0xc
mov dword [esi + 4], eax
lea eax, [ebx*4 + 0x58]
call fcn.004595b0
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 8]
mov ebx, esp
push eax
call fcn.004035a6
lea edx, [esi + 8]
lea eax, [esi + 0x38]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0x18]
lea ecx, [esi + 0x1c]
push edx
push eax
push ecx
mov dword [esi + 0x10], ebx
push ebx
push edi
push dword [esi + 4]
push dword [esi + 0xc]
call fcn.004144e0
add esp, 0x1c
mov ecx, dword [esi + 8]
xor eax, eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x40c901
mov eax, dword [ecx]
call dword [eax + 4]
movzx edx, word [ebp + 0x14]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
movzx edx, dx
mov dword [esi + 0x40], 0xffffffff
push edx
push dword [ebp + 0x10]
push eax
push ecx
push dword [esi + 0x10]
push ebx
push edi
call fcn.00414770
add esp, 0x1c
mov esp, dword [esi + 0x14]
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x40cad0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
lea ecx, [esi + 0x38]
mov edi, dword [ebp + 0x10]
mov dword [ecx - 4], esp
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x4196b0
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
lea eax, [esi + 0x21]
xor ecx, ecx
mov dword [eax + 3], ecx
xor ecx, ecx
mov dword [eax - 1], 0x25
inc ecx
push dword [edi + 4]
push ecx
push 0x4825e6
push eax
call fcn.00408934
add esp, 0x10
mov ebx, dword [edi + 4]
mov dword [esi + 0x14], esp
shr ebx, 9
and ebx, 1
lea eax, [ebx + 0x17]
mov dword [esi + 4], eax
sub esp, 0x18
mov edi, esp
lea eax, [esi + 0x28]
mov dword [esi + 0xc], edi
push eax
call fcn.00405e30
add esp, 4
lea eax, [esi + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push eax
lea eax, [esi + 0x28]
push dword [eax + 4]
push dword [eax]
push dword [esi + 4]
push edi
call fcn.0041bae9
add esp, 0x1c
mov edi, eax
mov eax, dword [esi + 0xc]
add edi, eax
push dword [ebp + 0x10]
push edi
push eax
call fcn.00408a48
add esp, 0xc
mov dword [esi + 4], eax
lea eax, [ebx*4 + 0x58]
call fcn.004595b0
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 8]
mov ebx, esp
push eax
call fcn.004035a6
lea edx, [esi + 8]
lea eax, [esi + 0x38]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0x18]
lea ecx, [esi + 0x1c]
push edx
push eax
push ecx
mov dword [esi + 0x10], ebx
push ebx
push edi
push dword [esi + 4]
push dword [esi + 0xc]
call fcn.004144e0
add esp, 0x1c
mov ecx, dword [esi + 8]
xor eax, eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x40cbe9
mov eax, dword [ecx]
call dword [eax + 4]
movzx edx, word [ebp + 0x14]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
movzx edx, dx
mov dword [esi + 0x40], 0xffffffff
push edx
push dword [ebp + 0x10]
push eax
push ecx
push dword [esi + 0x10]
push ebx
push edi
call fcn.00414770
add esp, 0x1c
mov esp, dword [esi + 0x14]
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x4158b4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
jmp 0x4158d9
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x4158d4
add eax, 2
mov dword [ecx + 0xc], eax
jmp 0x4158d9
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, edi
call fcn.00418ff4
mov ebx, eax
test esi, esi
je 0x415906
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x4158f3
movzx eax, word [eax]
jmp 0x4158fa
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
je 0x415906
test bl, bl
jne 0x41590c
jmp 0x415950
xor esi, esi
test bl, bl
jne 0x415941
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x41591b
movzx eax, word [eax]
jmp 0x415920
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [ebp + 0x14]
movzx eax, ax
mov edx, dword [ecx]
push eax
push 8
call dword [edx + 0xc]
test al, al
jne 0x4158c2
mov ecx, edi
call fcn.00418ff4
mov ebx, eax
test esi, esi
jne 0x415959
jmp 0x41594a
mov ecx, edi
call fcn.00418ff4
mov ebx, eax
test bl, bl
jne 0x415978
jmp 0x41597e
mov ecx, edi
call fcn.00418ff4
mov ebx, eax
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x415966
movzx eax, word [eax]
jmp 0x41596d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
sete al
xor bl, al
jne 0x41597e
mov eax, dword [ebp + 0x10]
or byte [eax], 2
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x41d820
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
cmp dword [0x49e820], 0
jne 0x41d8b6
push 0x1c
call fcn.00459168
add esp, 4
mov esi, eax
push 0xc
call fcn.00459168
add esp, 4
mov dword [esi], eax
lea ecx, [eax + 0xc]
mov dword [eax + 8], 0
mov dword [eax], 0
mov dword [eax + 4], 0
lea eax, [esi + 0x10]
mov dword [0x49e820], esi
mov dword [esi + 8], ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x18], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x41d8ab
cmp word [eax], 0
je 0x41d8ab
xor ebx, ebx
nop dword [eax]
cmp word [eax + ebx*2 + 2], 0
lea ebx, [ebx + 1]
jne 0x41d8a0
mov ecx, esi
push ebx
push eax
call fcn.0041d8c0
mov bl, 1
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x41fbf0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x49c3bc]
mov ebx, dword [ebp + 0xc]
lea esi, [ebp - 0x34]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x50
push str..._.._base_file_version_info_win.cc
push str.CreateFileVersionInfoWin
push esi
call fcn.0042e090
add esp, 0x10
lea ecx, [ebp - 0x24]
push 0
push esi
call fcn.0042e320
cmp byte [ebx + 0xb], 0
jns 0x41fc31
mov ebx, dword [ebx]
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x38]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x41fd48
mov edi, eax
test eax, eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
js 0x41fd6a
push edi
call fcn.00459168
add esp, 4
mov ecx, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], eax
add ecx, edi
mov dword [ebp - 0x2c], ecx
mov ecx, edi
nop dword [eax]
mov byte [eax], 0
mov eax, dword [ebp - 0x30]
inc eax
dec ecx
mov dword [ebp - 0x30], eax
jne 0x41fc80
push dword [ebp - 0x34]
push edi
push dword [ebp - 0x38]
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
xor edi, edi
test eax, eax
je 0x41fd31
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x14]
push ecx
push edx
push str.VarFileInfoTranslation
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x41fd31
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x41fd31
push 0x1c
call fcn.00459168
add esp, 4
mov edi, eax
mov eax, dword [ebx]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x14], 0
mov dword [edi], 0x483040
mov dword [edi + 4], ecx
mov dword [edi + 8], edx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4832f0
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x41fd2e
mov eax, dword [ebp - 0x14]
mov dword [edi + 0x18], eax
mov eax, dword [ebp - 0x34]
mov dword [esi], edi
test eax, eax
je 0x41fd4e
mov dword [ebp - 0x30], eax
push eax
call fcn.004591e8
add esp, 4
jmp 0x41fd4e
mov dword [esi], 0
lea ecx, [ebp - 0x24]
call fcn.0042e410
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00459221
mov eax, esi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [ebp - 0x34]
call fcn.0041b7dc
int3
Function at 0x4208d0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x224
mov eax, dword [0x49c3bc]
mov edi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov esi, ecx
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 0x16]
mov dword [ebp - 0x230], eax
call edi
mov word [ebp - 0x224], ax
movzx eax, word [esi + 0x16]
mov dword [ebp - 0x22c], eax
movzx eax, word [esi + 0x14]
mov dword [ebp - 0x228], eax
call edi
mov word [ebp - 0x222], ax
lea eax, [ebp - 0x218]
push dword [ebp + 8]
push ebx
push dword [ebp - 0x230]
mov edi, eax
push str.StringFileInfo_04x_04x_ls
push 0x104
push 0x104
push eax
call fcn.00420aa0
add esp, 0x1c
lea ebx, [ebp - 0x220]
mov dword [ebp - 0x21c], 0
lea eax, [ebp - 0x21c]
push ebx
push eax
push edi
push dword [esi + 0x10]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x42097f
mov eax, dword [ebp - 0x21c]
test eax, eax
jne 0x420a75
movzx eax, word [ebp - 0x224]
push dword [ebp + 8]
push dword [ebp - 0x22c]
push eax
push str.StringFileInfo_04x_04x_ls
push 0x104
push 0x104
push edi
call fcn.00420aa0
add esp, 0x1c
mov dword [ebp - 0x21c], 0
push ebx
lea eax, [ebp - 0x21c]
push eax
push edi
push dword [esi + 0x10]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4209d5
mov eax, dword [ebp - 0x21c]
test eax, eax
jne 0x420a75
push dword [ebp + 8]
push 0x4e4
push dword [ebp - 0x228]
push str.StringFileInfo_04x_04x_ls
push 0x104
push 0x104
push edi
call fcn.00420aa0
add esp, 0x1c
mov dword [ebp - 0x21c], 0
push ebx
lea eax, [ebp - 0x21c]
push eax
push edi
push dword [esi + 0x10]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x420a24
mov eax, dword [ebp - 0x21c]
test eax, eax
jne 0x420a75
movzx eax, word [ebp - 0x222]
push dword [ebp + 8]
push 0x4e4
push eax
push str.StringFileInfo_04x_04x_ls
push 0x104
push 0x104
push edi
call fcn.00420aa0
add esp, 0x1c
mov dword [ebp - 0x21c], 0
push ebx
lea eax, [ebp - 0x21c]
push eax
push edi
push dword [esi + 0x10]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x420a99
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x420a99
mov ecx, dword [ebp + 0xc]
push eax
call fcn.0041ad2e
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00459221
mov eax, ebx
add esp, 0x224
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor ebx, ebx
jmp 0x420a80
Function at 0x4224a0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [0x49c3bc]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea ebx, [ebp - 0x2c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x184
push str..._.._base_files_file_util_win.cc
push 0x4833fc
push ebx
call fcn.0042e090
add esp, 0x10
lea ecx, [ebp - 0x1c]
push 0
push ebx
call fcn.0042e320
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x4224e9
mov eax, dword [edi]
cmp byte [esi + 0xb], 0
mov ecx, esi
jns 0x4224f3
mov ecx, dword [esi]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov bl, 1
test eax, eax
jne 0x42255a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0042f520
add esp, 4
cmp byte [esi + 0xb], 0
mov dword [ebp - 0x30], eax
jns 0x42251b
mov esi, dword [esi]
cmp byte [edi + 0xb], 0
jns 0x422523
mov edi, dword [edi]
push 0
push 0
push 2
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
jne 0x42255a
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x422558
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0042f520
add esp, 4
mov ecx, dword [ebp - 0x30]
cmp eax, 0xfffffffc
cmovne ecx, eax
mov dword [esi], ecx
xor ebx, ebx
lea ecx, [ebp - 0x1c]
call fcn.0042e410
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00459221
mov eax, ebx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x422580
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [0x49c3bc]
mov edi, dword [ebp + 8]
lea ebx, [ebp - 0x2c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x1ab
push str..._.._base_files_file_util_win.cc
push str.PathExists
push ebx
call fcn.0042e090
add esp, 0x10
lea esi, [ebp - 0x1c]
mov ecx, esi
push 0
push ebx
call fcn.0042e320
cmp byte [edi + 0xb], 0
jns 0x4225c6
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov ecx, esi
setne bl
call fcn.0042e410
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00459221
mov eax, ebx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4225f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [0x49c3bc]
mov edi, dword [ebp + 8]
lea ebx, [ebp - 0x2c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x1bd
push str..._.._base_files_file_util_win.cc
push str.DirectoryExists
push ebx
call fcn.0042e090
add esp, 0x10
lea esi, [ebp - 0x1c]
mov ecx, esi
push 0
push ebx
call fcn.0042e320
cmp byte [edi + 0xb], 0
jns 0x422636
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
mov ecx, esi
setne al
and ebx, 0x10
shr ebx, 4
and bl, al
call fcn.0042e410
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00459221
mov eax, ebx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x422670
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x49c3bc]
lea esi, [ebp - 0x21a]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
xor ebx, ebx
cmp eax, 0x102
ja 0x4226f4
cmp word [ebp - 0x21a], 0
je 0x4226be
xor ebx, ebx
nop
cmp word [ebp + ebx*2 - 0x218], 0
lea ebx, [ebx + 1]
jne 0x4226b0
lea edi, [ebp - 0x234]
mov ecx, edi
push ebx
push esi
call fcn.00420ba0
lea ebx, [ebp - 0x228]
mov ecx, edi
push ebx
call fcn.00421cc0
mov ecx, dword [ebp + 8]
push ebx
call fcn.00420c50
mov ecx, ebx
call fcn.00420c10
mov ecx, edi
call fcn.00420c10
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00459221
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x422710
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x218
mov eax, dword [0x49c3bc]
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x214]
xor eax, ebp
mov dword [ebp - 0xc], eax
push edi
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x422769
movzx eax, word [ebp - 0x214]
test ax, ax
je 0x422769
xor eax, eax
nop
cmp word [ebp + eax*2 - 0x212], 0
lea eax, [eax + 1]
jne 0x422750
mov ecx, esi
push eax
push edi
call fcn.00420ba0
jmp 0x4227a4
lea edi, [ebp - 0x220]
mov ecx, edi
call fcn.00420b40
push edi
call fcn.00422670
add esp, 4
mov ecx, esi
test al, al
je 0x42278d
push edi
call fcn.00420b70
jmp 0x422799
push 3
push 0x483424
call fcn.00420ba0
lea ecx, [ebp - 0x220]
call fcn.00420c10
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00459221
mov eax, esi
add esp, 0x218
pop esi
pop edi
pop ebp
ret