joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436990
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
test esi, esi
je 0x436a1a
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x436a1a
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4369c1
shr eax, 4
pop esi
and eax, 1
pop ebx
pop ebp
ret 4
push edi
push esi
call fcn.0051bb56
mov edi, eax
push 0x5c
push edi
call fcn.004fd322
add esp, 0xc
test eax, eax
je 0x436a11
xor ecx, ecx
mov word [eax], cx
push edi
mov ecx, ebx
call fcn.00436990
push edi
test al, al
jne 0x4369fc
call fcn.004dbc6f
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 4
call fcn.004dbc6f
add esp, 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4369f3
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 4
pop esi
xor al, al
pop ebx
pop ebp
ret 4

Function at 0x436a80
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
jne 0x436ab0
xor al, al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
cmp eax, 1
sete bl
test bl, bl
je 0x436b17
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
shr eax, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
test eax, eax
setne bl
test bl, bl
je 0x436b17
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
setne bl
test bl, bl
je 0x436b17
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
setne bl
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x436b30
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebx]
mov eax, esi
xor eax, dword [ebp + 8]
mov ecx, dword [ebx + 8]
and eax, 0xff
shr esi, 8
mov eax, dword [edx + eax*4]
xor eax, esi
mov dword [ebx], eax
movzx eax, al
add eax, dword [ebx + 4]
pop esi
imul eax, eax, 0x8088405
inc eax
mov dword [ebx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [edx + eax*4]
mov eax, dword [ebp + 8]
mov dword [ebx + 8], ecx
pop ebx
pop ebp
ret
Function at 0x436b80
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, edx
push edi
mov edi, ecx
mov dword [esi], 0x12345678
mov dword [esi + 4], 0x23456789
mov dword [esi + 8], 0x34567890
mov cl, byte [edi]
mov dword [ebp - 4], esi
test cl, cl
je 0x436bff
push ebx
mov ebx, dword [esi + 4]
mov eax, 0x34567890
mov edx, dword [esi]
mov esi, dword [ebp + 8]
movsx ecx, cl
xor ecx, edx
and ecx, 0xff
shr edx, 8
mov ecx, dword [esi + ecx*4]
mov esi, dword [ebp - 4]
xor ecx, edx
mov dword [esi], ecx
mov edx, dword [ebp + 8]
movzx ecx, cl
add ebx, ecx
imul ebx, ebx, 0x8088405
inc ebx
mov ecx, ebx
shr ecx, 0x18
xor ecx, eax
and ecx, 0xff
shr eax, 8
mov dword [esi + 4], ebx
xor eax, dword [edx + ecx*4]
lea edi, [edi + 1]
mov dword [esi + 8], eax
mov cl, byte [edi]
test cl, cl
jne 0x436bb0
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x437da0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x437dab
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.00437dc0
Function at 0x438320
Capabilities:
Compress data via zlib inflate or deflate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, ecx
mov dword [ebp - 0x18], eax
test eax, eax
je 0x439930
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x439930
cmp dword [eax + 0xc], 0
je 0x439930
cmp dword [eax], 0
jne 0x43835a
cmp dword [eax + 4], 0
jne 0x439930
cmp dword [ecx], 0xb
jne 0x438365
mov dword [ecx], 0xc
mov edx, dword [eax + 0xc]
push ebx
mov ebx, dword [eax + 4]
mov dword [ebp - 0x24], edx
mov edx, dword [eax + 0x10]
push esi
mov esi, dword [ecx + 0x3c]
mov dword [ebp - 0x1c], edx
mov edx, dword [ecx + 0x38]
push edi
mov edi, dword [eax]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x30], eax
mov eax, dword [ecx]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x3c], ebx
cmp eax, 0x1e
ja 0x4397d0
mov dword [ebp - 0x40], 0x1f
jmp 0x4383b0
jmp dword [eax*4 + 0x43993c]
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0xfffffffe
mov esp, ebp
pop ebp
ret
Function at 0x443a60
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x38
push ebx
push edi
mov edi, ecx
cmp dword [edi + 4], 0
jne 0x443a9f
push 8
call fcn.004dafcb
add esp, 4
test eax, eax
je 0x443a89
mov dword [eax], vtable.adobe_ial::HTTPCommunicationAgent.0
jmp 0x443a8b
xor eax, eax
mov dword [edi + 4], eax
test eax, eax
jne 0x443a9f
mov eax, 5
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push dword [ebp + 0x10]
mov ecx, dword [edi + 4]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ecx]
push ebx
push dword [ebp + 8]
call dword [eax + 4]
mov edi, eax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x443b3f
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x443b3f
mov eax, dword [esp + 0x28]
or eax, dword [esp + 0x2c]
je 0x443b3f
mov ecx, dword [esp + 0x30]
sub ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
sbb eax, dword [esp + 0x3c]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
fild qword [esp + 0x20]
fstp qword [esp + 0x20]
fld qword [esp + 0x20]
fstp qword [esp + 0x20]
fild qword [esp + 0x28]
movsd xmm1, qword [esp + 0x20]
mulsd xmm1, qword [0x585118]
fstp dword [esp + 0x20]
fld dword [esp + 0x20]
fstp dword [esp + 0x20]
movss xmm0, dword [esp + 0x20]
cvtps2pd xmm0, xmm0
divsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
jmp 0x443b42
xorps xmm0, xmm0
cvtps2pd xmm0, xmm0
sub esp, 8
movsd qword [esp], xmm0
push dword [ebx + 0x10]
push edi
push str.HTTPCommunicationAgent__Return_Code:__d__response_size___d__time_taken___.2f_ms.
push 4
call fcn.00440b10
add esp, 0x18
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x447e90
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x554f90
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x59de30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push 0
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
push esi
mov dword [ebp - 0x14], edi
mov byte [edi], 0
call fcn.00401630
lea ecx, [edi + 0x18]
push 0xffffffffffffffff
mov dword [ebp - 4], 0
push 0
lea eax, [esi + 0x18]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00401630
push dword [ebp + 0xc]
lea ecx, [edi + 0x30]
mov dword [ebp - 4], 1
call fcn.00447f70
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x44b2f0
Capabilities:
Set http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x555690
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x59de30]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
mov edi, dword [0x5aed70]
xor eax, eax
mov esi, dword [edi]
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], eax
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 1
cmp esi, edi
je 0x44b42b
mov ebx, dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
lea ecx, [ecx]
cmp dword [esi + 0x24], 0x10
lea ecx, [esi + 0x10]
jb 0x44b36b
mov ecx, dword [ecx]
lea edx, [ebp - 0x40]
call fcn.0044aeb0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00403f60
push 2
push 0x5847e0
lea ecx, [ebp - 0x28]
call fcn.00403ad0
cmp dword [esi + 0x3c], 0x10
lea ecx, [esi + 0x28]
jb 0x44b39d
mov ecx, dword [ecx]
lea edx, [ebp - 0x40]
call fcn.0044aeb0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00403c60
cmp dword [ebp - 0x14], 8
push 0xa0000000
push dword [ebp - 0x18]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x44]
call ebx
cmp byte [esi + 0xd], 0
jne 0x44b412
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x44b3f3
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x44b412
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x44b3e7
jmp 0x44b412
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x44b410
lea esp, [esp]
cmp esi, dword [eax + 8]
jne 0x44b410
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x44b400
mov esi, eax
cmp esi, edi
jne 0x44b360
cmp dword [ebp - 0x14], 8
jb 0x44b42b
push dword [ebp - 0x28]
call fcn.004daf24
add esp, 4
xor eax, eax
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
jb 0x44b450
push dword [ebp - 0x40]
call fcn.004daf24
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004da4c1
mov esp, ebp
pop ebp
ret
Function at 0x44d6f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, ecx
mov ecx, 0x57d45a
sub ecx, edx
push ebx
mov dword [ebp - 4], ecx
push esi
mov ecx, 0x57d45b
sub ecx, edx
push edi
mov dword [ebp - 8], ecx
mov edi, 0x57d458
mov ebx, 0x57d459
mov ecx, 0x57d45c
sub edi, edx
sub ebx, edx
sub ecx, edx
mov byte [edx], 0xda
lea eax, [edx + 1]
mov dword [ebp - 0xc], ecx
mov esi, 0x33
movzx ecx, byte [edi + eax]
xor cl, byte [edx]
lea eax, [eax + 5]
mov byte [eax - 5], cl
movzx ecx, byte [ebx + eax - 5]
xor cl, byte [edx]
mov byte [eax - 4], cl
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + eax - 5]
xor cl, byte [edx]
mov byte [eax - 3], cl
mov ecx, dword [ebp - 8]
movzx ecx, byte [ecx + eax - 5]
xor cl, byte [edx]
mov byte [eax - 2], cl
mov ecx, dword [ebp - 0xc]
movzx ecx, byte [ecx + eax - 5]
xor cl, byte [edx]
mov byte [eax - 1], cl
dec esi
jne 0x44d732
pop edi
pop esi
mov eax, 0x100
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44d780
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.004dc520
mov eax, dword [0x59de30]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push ecx
push eax
test esi, esi
jne 0x44d7f5
lea eax, [ebp - 0x1004]
push 0xffd
push eax
call fcn.004db8a5
add esp, 0x10
test eax, eax
jle 0x44d7c8
lea eax, [ebp + eax - 0x1004]
jmp 0x44d7d0
cmp eax, 0xffffffff
jne 0x44d804
lea eax, [ebp - 7]
mov word [eax], 0xa0d
mov byte [eax + 2], 0
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004da4c1
mov esp, ebp
pop ebp
ret
push esi
call fcn.004db888
push esi
call fcn.004db603
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004da4c1
mov esp, ebp
pop ebp
ret

Function at 0x45718f
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x4571c8
cmp dword [ebp + 0x10], 0
je 0x4571c8
cmp dword [ebp + 0x14], 0
je 0x4571c8
cmp dword [ebp + 0x18], 0
je 0x4571c8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str.SELECT_value_FROM_domain_data_WHERE_domain___d_AND_subdomain___q_AND_key___q
push dword [ebp + 0x18]
push dword [eax]
call fcn.00458089
add esp, 0x18
pop ebp
ret
push 0xa
pop eax
pop ebp
ret

Function at 0x4571cd
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x4571fd
cmp dword [ebp + 0x10], 0
je 0x4571fd
cmp dword [ebp + 0x14], 0
je 0x4571fd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str.SELECT_key_FROM_domain_data_WHERE_domain___d_AND_subdomain___q
push dword [ebp + 0x14]
push dword [eax]
call fcn.00457ec3
add esp, 0x14
pop ebp
ret
push 0xa
pop eax
pop ebp
ret
Function at 0x457202
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x457229
cmp dword [ebp + 0x10], 0
je 0x457229
push dword [ebp + 0xc]
push str.SELECT_DISTINCT_subdomain_FROM_domain_data_WHERE_domain___d
push dword [ebp + 0x10]
push dword [eax]
call fcn.00457ec3
add esp, 0x10
pop ebp
ret
push 0xa
pop eax
pop ebp
ret

Function at 0x457bac
Capabilities:
Reference sql statements

Disassembly:
push 0x28
mov eax, 0x54c892
call fcn.004e0221
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0x30]
push eax
lea esi, [edi + 0x18]
push esi
mov dword [ebp - 4], ebx
call fcn.00458436
add esp, 0xc
test al, al
jne 0x457bec
push 0xa
pop esi
jmp 0x457d30
lea eax, [ebp - 0x28]
push eax
call fcn.0045839e
pop ecx
test al, al
jne 0x457c21
lea eax, [ebp - 0x28]
push eax
call fcn.0045852c
pop ecx
test al, al
je 0x457c10
xor esi, esi
inc esi
jmp 0x457d30
push esi
call fcn.00457a1c
mov esi, eax
pop ecx
test esi, esi
jne 0x457d30
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
lea esi, [edi + 4]
push esi
push eax
call fcn.0045de80
pop ecx
pop ecx
test eax, eax
je 0x457c4c
push eax
mov dword [esi], ebx
call fcn.00457a93
pop ecx
mov esi, eax
jmp 0x457d30
push 0x7d0
push dword [esi]
call fcn.0045d2f0
cmp byte [edi + 0x4c], 0
pop ecx
pop ecx
mov dword [edi], ebx
mov esi, ebx
je 0x457d30
mov eax, dword [edi + 0x50]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
sub eax, ebx
je 0x457c93
dec eax
je 0x457c8a
dec eax
jne 0x457c93
xor ebx, ebx
inc ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x34], 3
jmp 0x457c9a
mov dword [ebp - 0x34], 1
jmp 0x457c9a
mov dword [ebp - 0x34], 2
push str.SELECT_value_FROM_pcd_meta_WHERE_key__schema_version
lea eax, [ebp - 0x30]
push eax
push edi
call fcn.00458089
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x457ce2
push dword [ebp - 0x30]
call fcn.004db2c0
mov ebx, eax
lea eax, [ebp - 0x30]
mov dword [esp], str.SELECT_value_FROM_pcd_meta_WHERE_key__schema_compatibility_version
push eax
push edi
call fcn.00458089
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x457ce2
push dword [ebp - 0x30]
call fcn.004db2c0
pop ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x2c]
jge 0x457cef
push 0xd
pop esi
jmp 0x457d29
lea ecx, [ebx + 1]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
cmp ecx, eax
jg 0x457d25
mov ebx, dword [ebp - 0x34]
push ecx
mov ecx, edi
call fcn.00457d40
mov esi, eax
test esi, esi
jne 0x457d1a
mov ecx, dword [ebp - 0x2c]
inc ecx
mov dword [ebp - 0x2c], ecx
cmp ecx, ebx
jle 0x457cff
jmp 0x457d30
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp eax, dword [ebp - 0x2c]
cmove esi, ecx
test esi, esi
je 0x457d30
mov ecx, edi
call fcn.00457b7e
lea ecx, [ebp - 0x28]
call fcn.00401470
mov eax, esi
call fcn.004e01df
ret
Function at 0x458177
Capabilities:
Create directory

Disassembly:
push 0x1c
mov eax, 0x54c8e2
call fcn.004e0221
mov esi, dword [ebp + 8]
push 4
pop edi
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.004b9aee
xor ebx, ebx
push esi
mov dword [ebp - 4], ebx
call fcn.0045852c
add esp, 0xc
test al, al
jne 0x4581bf
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
neg eax
sbb eax, eax
and edi, eax
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.00403c00
mov eax, edi
call fcn.004e01df
ret

Function at 0x4581d2
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0x240
mov eax, 0x54c912
call fcn.004e0221
mov esi, dword [ebp + 8]
xor ecx, ecx
xor eax, eax
mov bl, cl
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], ecx
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x24c]
push eax
push ecx
push ecx
push 0x2b
push ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x24c], ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
lea eax, [ebp - 0x218]
push eax
js 0x458275
push dword [ebp - 0x24c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x458267
cmp word [ebp - 0x218], 0
jne 0x458245
xor eax, eax
jmp 0x458252
lea eax, [ebp - 0x218]
push eax
call fcn.004e17b8
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00403d70
mov bl, 1
push dword [ebp - 0x24c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x4582b7
push 0
push 0
push 0x2b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4582b7
cmp word [ebp - 0x218], 0
jne 0x458295
xor eax, eax
jmp 0x4582a2
lea eax, [ebp - 0x218]
push eax
call fcn.004e17b8
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00403d70
mov bl, 1
mov ecx, dword [ebp - 0x220]
test ecx, ecx
je 0x45832b
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
cmp word [eax + ecx*2 - 2], 0x5c
jne 0x4582ee
lea eax, [ecx - 1]
push 0
push eax
lea ecx, [ebp - 0x230]
call fcn.004588e7
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.004b9ba3
pop ecx
pop ecx
push eax
mov ecx, esi
call fcn.004280b0
lea ecx, [ebp - 0x248]
call fcn.00401470
mov edi, 0x55b88c
push edi
call fcn.004e0140
pop ecx
push eax
push edi
mov ecx, esi
call fcn.004139f0
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.00403c00
mov al, bl
call fcn.004e01df
ret

Function at 0x458342
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x59de30]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004b9aee
cmp dword [ebp - 8], 8
pop ecx
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x458381
test al, 0x10
jbe 0x458381
mov bl, 1
jmp 0x458383
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00403c00
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.004da4c1
leave
ret
Function at 0x45852c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x59de30]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004b9aee
cmp dword [ebp - 8], 8
pop ecx
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
pop ecx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ebx, [eax - 1]
neg ebx
push 0
sbb bl, bl
push 1
lea ecx, [ebp - 0x1c]
inc bl
call fcn.00403c00
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.004da4c1
leave
ret

Function at 0x471ef0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
mov eax, dword [0x59de30]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 8], 0x200
mov dword [ebp - 0x118], 0
lea eax, [ebp - 0x110]
push eax
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0045a180
add esp, 0x10
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x472076
lea eax, [ebp - 0x110]
push eax
call fcn.0046c3b0
add esp, 4
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x472066
call fcn.004737d0
test eax, eax
je 0x471fe6
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x124], eax
jmp 0x471f8e
mov eax, dword [ebp - 0x124]
add eax, 2
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x124]
movzx ecx, word [eax]
test ecx, ecx
je 0x471fb8
mov eax, dword [ebp - 0x124]
movzx ecx, word [eax]
cmp ecx, 0x5c
jne 0x471fb6
xor eax, eax
mov ecx, dword [ebp - 0x124]
mov word [ecx], ax
jmp 0x471fb8
jmp 0x471f7f
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x11c]
push eax
mov ecx, dword [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov dword [ebp - 0x118], eax
jmp 0x472057
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x128], eax
jmp 0x472003
mov eax, dword [ebp - 0x128]
add eax, 1
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
movsx ecx, byte [eax]
test ecx, ecx
je 0x47202b
mov eax, dword [ebp - 0x128]
movsx ecx, byte [eax]
cmp ecx, 0x5c
jne 0x472029
mov eax, dword [ebp - 0x128]
mov byte [eax], 0
jmp 0x47202b
jmp 0x471ff4
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x11c]
push eax
mov ecx, dword [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x120]
push eax
call fcn.004dbc6f
add esp, 4
cmp dword [ebp - 0x118], 0
jne 0x472076
mov dword [ebp - 8], 0x200
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004da4c1
mov esp, ebp
pop ebp
ret