joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420e60
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x495621
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [0x4bdc98]
xor eax, esp
push ebx
push ebp
push esi
mov dword [esp + 0x14], eax
push edi
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov ebx, dword [esp + 0x2c]
lea ebp, [edi + edi + 2]
cmp ebp, esi
mov dword [esp + 0x24], 0
mov dword [esp + 0x10], edi
jge 0x420f14
jmp 0x420eb0
mov eax, ebp
imul eax, eax, 0xcc
mov ecx, dword [eax + ebx + 0xb8]
mov edx, dword [eax + ebx - 0x14]
add eax, ebx
cmp ecx, edx
jge 0x420eca
dec ebp
mov esi, ebp
imul edi, edi, 0xcc
imul esi, esi, 0xcc
add esi, ebx
add edi, ebx
push esi
mov ecx, edi
call fcn.00418a70
mov edx, dword [esi + 0xb8]
add esi, 0xbc
push esi
lea ecx, [edi + 0xbc]
mov dword [edi + 0xb8], edx
call fcn.0041f520
mov eax, dword [esp + 0x34]
mov edi, ebp
lea ebp, [ebp + ebp + 2]
cmp ebp, eax
jl 0x420eb0
mov esi, eax
cmp ebp, esi
jne 0x420f56
mov eax, esi
imul edi, edi, 0xcc
imul eax, eax, 0xcc
lea ebp, [eax + ebx - 0xcc]
add edi, ebx
push ebp
mov ecx, edi
call fcn.00418a70
mov ecx, dword [ebp + 0xb8]
add ebp, 0xbc
mov dword [edi + 0xb8], ecx
push ebp
lea ecx, [edi + 0xbc]
call fcn.0041f520
lea edi, [esi - 1]
sub esp, 0xcc
mov ebp, esp
mov dword [esp + 0xe0], esp
lea edx, [esp + 0x104]
push edx
mov ecx, ebp
mov dword [esp + 0xe4], ebp
call fcn.00418860
lea ecx, [esp + 0x1c0]
mov dword [ebp], 0x4a3ed4
mov eax, dword [esp + 0x1bc]
push ecx
lea ecx, [ebp + 0xbc]
mov byte [esp + 0xf4], 1
mov dword [ebp + 0xb8], eax
call fcn.0041e300
mov edx, dword [esp + 0xdc]
push edx
push edi
push ebx
mov byte [esp + 0xfc], 0
call fcn.0041f830
add esp, 0xd8
mov edi, dword [esp + 0xf8]
xor ebp, ebp
cmp edi, ebp
mov ebx, 2
mov dword [esp + 0x24], ebx
je 0x421025
mov esi, dword [esp + 0xfc]
cmp edi, esi
mov dword [esp + 0x10], edi
je 0x42101c
lea esp, [esp]
lea ecx, [edi + 0x1c]
mov byte [esp + 0x24], 3
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, edi
mov byte [esp + 0x24], bl
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
add edi, 0x38
cmp edi, esi
mov dword [esp + 0x10], edi
jne 0x420ff0
mov edi, dword [esp + 0xf8]
push edi
call sub.MFC71U.DLL_CNoTrackObject::operator_new
add esp, 4
lea ecx, [esp + 0x38]
mov dword [esp + 0xf8], ebp
mov dword [esp + 0xfc], ebp
mov dword [esp + 0x100], ebp
mov dword [esp + 0x24], 0xffffffff
call fcn.00417f90
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x10]
pop ebp
pop ebx
xor ecx, esp
call fcn.00491e29
add esp, 0x18
ret
Function at 0x4256c0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 0x18]
mov ebp, 8
cmp eax, ebp
lea esi, [edi + 4]
jb 0x4256db
mov eax, dword [esi]
jmp 0x4256dd
mov eax, esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call ebx
cmp eax, 0xffffffff
je 0x425754
cmp dword [edi + 0x18], ebp
jb 0x4256f4
mov eax, dword [esi]
jmp 0x4256f6
mov eax, esi
push eax
call ebx
test al, 1
je 0x42571a
mov ecx, dword [edi + 0x18]
and eax, 0xfffffffe
cmp ecx, ebp
jb 0x42570b
mov ecx, dword [esi]
jmp 0x42570d
mov ecx, esi
or eax, 0x80
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [edi + 0x18], ebp
jb 0x425721
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x425754
push 0x1f3
push str._views_br_LiveUpdate_Client_20090305_B044__tsp_product1.7_Code_srcLiveUpdateprocess_srcwin32PublicFunction.cpp
mov ecx, 0x4bfb40
call fcn.00441240
push str.Delete_file_failed.
push 1
push 0x4bfb40
call fcn.00442ba0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4259b0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x434
mov eax, dword [0x4bdc98]
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor eax, ebp
mov dword [esp + 0x438], eax
mov eax, dword [ebp + 8]
push edi
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x425a3f
xor eax, eax
mov ecx, 0x10a
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push ecx
push ebx
mov dword [esp + 0x18], 0x428
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x425a3f
mov edi, dword [sym.imp.MSVCR71.dll__wcsicmp]
lea esp, [esp]
cmp dword [esi + 0x18], 8
jb 0x425a1b
mov eax, dword [esi + 4]
jmp 0x425a1e
lea eax, [esi + 4]
lea edx, [esp + 0x230]
push edx
push eax
call edi
add esp, 8
test eax, eax
je 0x425a5d
lea eax, [esp + 0x10]
push eax
push ebx
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x425a10
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x430]
xor ecx, ebp
call fcn.00491e29
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x43c]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.00491e29
mov esp, ebp
pop ebp
ret

Function at 0x425a80
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x230
mov eax, dword [0x4bdc98]
xor eax, esp
push ebx
mov ebx, dword [esp + 0x23c]
push ebp
push esi
mov esi, dword [esp + 0x240]
push edi
xor ebp, ebp
push ebp
push 2
mov dword [esp + 0x244], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x425b29
lea eax, [esp + 0x10]
push eax
push edi
mov dword [esp + 0x18], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x425b22
mov edi, edi
cmp dword [esi + 0x18], 8
jb 0x425adb
mov eax, dword [esi + 4]
jmp 0x425ade
lea eax, [esi + 4]
push eax
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.MSVCR71.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x425b0d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
je 0x425b0d
push ebx
push ecx
call fcn.004259b0
add esp, 8
test al, al
jne 0x425b1e
lea edx, [esp + 0x10]
push edx
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x425ad0
jmp 0x425b22
mov ebp, dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x23c]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.00491e29
add esp, 0x230
ret
Function at 0x425e10
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x20
mov eax, dword [0x4bdc98]
xor eax, esp
push ebp
mov ebp, dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x24], eax
cmp dword [esi + 0x18], 8
push edi
lea edi, [esi + 4]
jb 0x425e36
mov eax, dword [edi]
jmp 0x425e38
mov eax, edi
push 0x180
push eax
call dword [sym.imp.MSVCR71.dll__wchmod]
mov eax, dword [esi + 0x18]
add esp, 8
cmp eax, 8
jb 0x425e51
mov edi, dword [edi]
push 0x4a4390
push edi
call dword [sym.imp.MSVCR71.dll__wfopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x425f08
push ebp
lea ecx, [esp + 0x10]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov edx, dword [esp + 0x24]
cmp edx, 0x10
mov eax, dword [esp + 0x10]
mov ecx, eax
jae 0x425e88
lea ecx, [esp + 0x10]
mov edi, dword [sym.imp.MSVCR71.dll_fwrite]
cmp byte [ecx], 0xef
jne 0x425eb5
cmp edx, 0x10
mov ecx, eax
jae 0x425e9e
lea ecx, [esp + 0x10]
cmp byte [ecx + 1], 0xbb
jne 0x425eb5
cmp edx, 0x10
mov ecx, eax
jae 0x425eaf
lea ecx, [esp + 0x10]
cmp byte [ecx + 2], 0xbf
je 0x425ecc
push esi
push 3
push 1
push 0x4a41fc
call edi
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x34]
add esp, 0x10
cmp edx, 0x10
jae 0x425ed5
lea eax, [esp + 0x10]
mov ecx, dword [esp + 0x20]
push esi
push ecx
push 1
push eax
call edi
push esi
call dword [sym.imp.MSVCR71.dll_fclose]
add esp, 0x14
lea ecx, [esp + 0xc]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00491e29
add esp, 0x20
ret
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
xor ecx, esp
or eax, 0xffffffff
call fcn.00491e29
add esp, 0x20
ret
Function at 0x427260
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x20fc
call fcn.00491fc0
mov eax, dword [0x4bdc98]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
xor eax, ebp
mov dword [esp + 0x20f8], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [esp + 8], eax
mov eax, dword [edx + 0x14]
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [esp + 0x14], ecx
je 0x427391
mov word [esp + 0x70], bx
xor eax, eax
mov ecx, 0x411
lea edi, [esp + 0x72]
rep stosd dword es:[edi], eax
push edx
lea edx, [esp + 0x58]
push edx
stosw word es:[edi], ax
call fcn.00432690
mov ecx, dword [eax + 0x18]
add esp, 8
cmp ecx, 8
jb 0x4272d1
mov eax, dword [eax + 4]
jmp 0x4272d4
add eax, 4
push 0x823
push eax
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.MSVCR71.dll_wcsncpy]
add esp, 0xc
lea ecx, [esp + 0x54]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor eax, eax
mov ecx, 0xf
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0x10]
mov eax, 0x824
push 0x2000000
lea edx, [esp + 0x10]
mov dword [esp + 0x30], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x10], eax
push edx
lea eax, [esp + 0x10c0]
mov dword [esp + 0x30], ecx
push eax
lea ecx, [esp + 0x7c]
mov word [esp + 0x10c2], bx
mov ebx, dword [sym.imp.WININET.dll_InternetCanonicalizeUrlW]
push ecx
mov dword [esp + 0x28], 0x3c
mov dword [esp + 0x54], esi
xor edi, edi
call ebx
test eax, eax
jne 0x4273aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x427391
mov edx, dword [esp + 0xc]
lea eax, [edx + edx]
push eax
call sub.MFC71U.DLL_SerializeElements
add esp, 4
push 0x2000000
lea ecx, [esp + 0x10]
push ecx
mov esi, eax
push esi
lea edx, [esp + 0x7c]
push edx
mov edi, 1
call ebx
test eax, eax
jne 0x4273b1
push esi
call sub.MFC71U.DLL_operator_new
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20f8]
xor ecx, ebp
call fcn.00491e29
mov esp, ebp
pop ebp
ret 0x14
lea esi, [esp + 0x10b8]
lea eax, [esp + 0x18]
push eax
push 0
push 0
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test edi, edi
mov ebx, eax
je 0x4273d0
push esi
call sub.MFC71U.DLL_operator_new
add esp, 4
test ebx, ebx
je 0x4273fd
movzx ecx, word [esp + 0x30]
mov eax, dword [esp + 0x24]
cmp eax, 4
mov edx, dword [esp + 0x14]
mov dword [edx], ecx
jne 0x4273f1
mov eax, dword [esp + 0x10]
mov byte [eax], 1
jmp 0x4273fd
cmp eax, 3
jne 0x427391
mov ecx, dword [esp + 0x10]
mov byte [ecx], 0
mov ecx, dword [esp + 0x2104]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00491e29
mov esp, ebp
pop ebp
ret 0x14
Function at 0x427910
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x496064
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x74
mov eax, dword [0x4bdc98]
xor eax, esp
push ebx
push ebp
push esi
lea esi, [ecx + 0xc8]
push str.UpdateDog_
mov dword [esp + 0x80], eax
lea eax, [esp + 0x2c]
push esi
push eax
call fcn.00402280
push 0x4c00fc
push eax
lea ecx, [esp + 0x58]
push ecx
mov dword [esp + 0xa0], 0
call fcn.00402180
add esp, 0x18
lea ecx, [esp + 0x28]
mov byte [esp + 0x88], 2
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
cmp dword [esp + 0x5c], 8
mov eax, dword [esp + 0x48]
jae 0x42798e
lea eax, [esp + 0x48]
push eax
push 0
push 0x4a4640
push str.UpdateSetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push str.UpdateDog_
lea edx, [esp + 0x10]
push esi
push edx
mov ebp, eax
xor bl, bl
call fcn.00402280
push 0x4a462c
push eax
lea eax, [esp + 0x74]
push eax
mov byte [esp + 0xa0], 3
call fcn.00402280
add esp, 0x18
lea ecx, [esp + 0xc]
mov byte [esp + 0x88], 5
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
cmp dword [esp + 0x78], 8
mov eax, dword [esp + 0x64]
jae 0x4279f1
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4279ff
mov bl, 1
cmp ebp, 1
je 0x427a08
test bl, bl
je 0x427a0a
mov bl, 1
lea ecx, [esp + 0x60]
mov byte [esp + 0x88], 2
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x44]
mov dword [esp + 0x88], 0xffffffff
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [esp + 0x80]
pop esi
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x74]
mov al, bl
pop ebx
xor ecx, esp
call fcn.00491e29
add esp, 0x80
ret
Function at 0x428ac0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4962bf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x27c
mov eax, dword [0x4bdc98]
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, ebp
mov edi, ecx
mov ecx, esi
mov dword [esp + 0x27c], eax
call fcn.0040f520
push str.UpdateDog_
add edi, 0xc8
lea eax, [esp + 0x3c]
push edi
push eax
call fcn.00402280
push 0x4c00fc
push eax
lea ecx, [esp + 0x68]
xor edi, edi
push ecx
mov dword [esp + 0x2a4], edi
call fcn.00402180
add esp, 0x18
lea ecx, [esp + 0x38]
mov byte [esp + 0x28c], 2
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov word [esp + 0x70], di
xor eax, eax
mov ecx, 0x81
lea edi, [esp + 0x72]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
cmp dword [esp + 0x6c], 8
mov eax, dword [esp + 0x58]
jae 0x428b64
lea eax, [esp + 0x58]
push eax
push 0x104
lea edx, [esp + 0x78]
push edx
push 0x4a5168
push 0x4a4714
push str.UpdateSetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x20]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
push 0x4a4710
push 0x4a4710
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x18]
push edx
mov byte [esp + 0x29c], 3
call fcn.00433370
add esp, 0x10
push eax
mov ecx, esi
mov byte [esp + 0x290], 4
call fcn.00428870
lea ecx, [esp + 0xc]
mov byte [esp + 0x28c], 3
call fcn.0040f520
lea ecx, [esp + 0x1c]
mov byte [esp + 0x28c], 2
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x54]
mov dword [esp + 0x28c], 0xffffffff
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [esp + 0x284]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x27c]
pop edi
xor ecx, ebp
pop esi
call fcn.00491e29
mov esp, ebp
pop ebp
ret 4
Function at 0x428c30
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4962bf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x27c
mov eax, dword [0x4bdc98]
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, ebp
push str.UpdateDog_
add ecx, 0xc8
mov dword [esp + 0x280], eax
push ecx
lea eax, [esp + 0x40]
push eax
call fcn.00402280
push 0x4c00fc
push eax
lea ecx, [esp + 0x68]
xor edi, edi
push ecx
mov dword [esp + 0x2a4], edi
call fcn.00402180
add esp, 0x18
lea ecx, [esp + 0x38]
mov byte [esp + 0x28c], 2
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov word [esp + 0x70], di
xor eax, eax
mov ecx, 0x81
lea edi, [esp + 0x72]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
cmp dword [esp + 0x6c], 8
mov eax, dword [esp + 0x58]
jae 0x428ccb
lea eax, [esp + 0x58]
push eax
push 0x104
lea edx, [esp + 0x78]
push edx
push 0x4a5168
push str.Encrypt
push str.UpdateSetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x20]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
push 0x4a4710
push 0x4a4710
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x18]
push edx
mov byte [esp + 0x29c], 3
call fcn.00433370
add esp, 0x10
push eax
mov ecx, esi
mov byte [esp + 0x290], 4
call fcn.00428870
lea ecx, [esp + 0xc]
mov byte [esp + 0x28c], 3
call fcn.0040f520
lea ecx, [esp + 0x1c]
mov byte [esp + 0x28c], 2
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, dword [esi + 4]
test eax, eax
je 0x428d75
mov ecx, dword [esi + 8]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
jae 0x428d8e
lea ecx, [esp + 0x54]
mov dword [esp + 0x28c], 0xffffffff
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor al, al
jmp 0x428da5
lea ecx, [esp + 0x54]
mov dword [esp + 0x28c], 0xffffffff
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov al, 1
mov ecx, dword [esp + 0x284]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x27c]
pop edi
xor ecx, ebp
pop esi
call fcn.00491e29
mov esp, ebp
pop ebp
ret 4
Function at 0x42df50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x496bb5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x10]
mov ecx, edi
mov dword [esp + 8], esi
mov dword [esi], 0x4a4c9c
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov eax, dword [esp + 0x38]
push 0
push 0
push 1
push 0
mov dword [esp + 0x40], 0
mov dword [esi + 4], eax
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0x4a1130
lea ecx, [esp + 0x10]
push 0x4bec28
push ecx
mov dword [esi + 0xc], eax
call fcn.00402280
add esp, 0xc
push eax
mov ecx, edi
mov byte [esp + 0x34], 1
call dword [sym.imp.MSVCP71.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [esp + 0x28]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 4

Function at 0x42e020
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x496bc9
push eax
mov al, byte [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x1c
test al, 1
push esi
mov esi, ecx
je 0x42e067
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
push eax
push ecx
call fcn.00425f20
add esp, 8
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 0xc
test al, 2
je 0x42e089
mov edx, dword [esp + 0x34]
push edx
mov ecx, esi
call fcn.0042d770
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 0xc
test al, 4
je 0x42e0ec
push 0x4a5168
lea ecx, [esp + 8]
mov dword [esp + 0x34], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
mov edx, dword [esp + 0x34]
lea eax, [esp + 0x30]
push eax
push 0
lea ecx, [esp + 0xc]
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x38], 0
call fcn.0042d960
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, esi
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 0xc
mov ecx, dword [esp + 0x20]
or eax, 0xffffffff
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 0xc
Function at 0x42e110
Capabilities:
Delete file
Move file

Disassembly:
push 0xffffffffffffffff
push 0x496c04
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x74
mov eax, dword [0x4bdc98]
xor eax, esp
push esi
mov esi, dword [esp + 0x88]
push 0x4a1130
mov dword [esp + 0x78], eax
lea eax, [esp + 0x24]
push esi
push eax
call fcn.00402280
push 0x4c02dc
push eax
lea ecx, [esp + 0x50]
push ecx
mov dword [esp + 0x98], 0
call fcn.00402180
add esp, 0x18
lea ecx, [esp + 0x20]
mov byte [esp + 0x80], 2
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
push 0x4a1130
lea edx, [esp + 8]
push esi
push edx
call fcn.00402280
push 0x4c0368
push eax
lea eax, [esp + 0x6c]
push eax
mov byte [esp + 0x98], 3
call fcn.00402180
add esp, 0x18
lea ecx, [esp + 4]
mov byte [esp + 0x80], 5
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, dword [esp + 0x54]
mov esi, 8
cmp eax, esi
mov eax, dword [esp + 0x40]
jae 0x42e1cd
lea eax, [esp + 0x40]
push 0
push eax
call dword [sym.imp.MSVCR71.dll__waccess]
add esp, 8
cmp eax, 0xffffffff
jne 0x42e241
call dword [sym.imp.MSVCR71.dll__errno]
cmp dword [eax], 2
jne 0x42e241
cmp dword [esp + 0x54], esi
mov ecx, dword [esp + 0x40]
jae 0x42e1f7
lea ecx, [esp + 0x40]
cmp dword [esp + 0x70], esi
mov eax, dword [esp + 0x5c]
jae 0x42e205
lea eax, [esp + 0x5c]
push ecx
push eax
call dword [sym.imp.MSVCR71.dll__wrename]
add esp, 8
cmp eax, 0xffffffff
jne 0x42e241
lea ecx, [esp + 0x58]
mov byte [esp + 0x80], 2
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x80], 0xffffffff
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
or eax, 0xffffffff
jmp 0x42e282
cmp dword [esp + 0x70], esi
mov eax, dword [esp + 0x5c]
jae 0x42e24f
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.MSVCR71.dll__wremove]
add esp, 4
lea ecx, [esp + 0x58]
mov byte [esp + 0x80], 2
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x80], 0xffffffff
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor eax, eax
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x74]
pop esi
xor ecx, esp
call fcn.00491e29
add esp, 0x80
ret 4