joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x40c7d0
nop
mov ecx, 0x67dd2bbe
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x67b77dea
nop
nop
nop
nop
test eax, eax
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401750
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47561d
mov eax, dword fs:[0]
push eax
sub esp, 0x274
mov eax, dword [0x48d034]
xor eax, esp
mov dword [esp + 0x26c], eax
push esi
push edi
mov eax, dword [0x48d034]
xor eax, esp
push eax
lea eax, [esp + 0x280]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 4]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [esi + 4]
and eax, 0xff3fffff
push eax
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [esi + 4]
lea edi, [esi + 0x1c]
push eax
mov dword [edi + 0x144], eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [edi + 0x148], eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], edi
call fcn.00429300
lea ecx, [esp + 0x1c]
push ecx
call fcn.00410db0
push edi
push 0x4780fc
push 3
push str.GameUnpackerWnd
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x29c], 0
lea ecx, [esp + 0x24]
mov edx, 0x66
mov dword [esp + 0x24], vtable.GameMgr::GMDialogBuilderCallbackEx.0
call fcn.0042e4a0
push eax
mov eax, edi
call fcn.00425c60
lea eax, [esi + 0x18]
push eax
push edi
call fcn.00425100
mov eax, dword [esi + 0x128]
mov ecx, dword [esi + 0x124]
push 6
push eax
push ecx
push 0
mov edx, eax
push 0
mov dword [esp + 0x2c], edx
mov edx, dword [esi + 4]
push 0
push edx
mov dword [esp + 0x30], ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
push esi
call fcn.0042d2a0
push 0x206
lea eax, [esp + 0x72]
push 0
push eax
mov word [esp + 0x78], 0
call fcn.0045e940
add esp, 0xc
push 0x104
lea ecx, [esp + 0x70]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x6c]
push edx
lea eax, [esi + 0x198]
push eax
call fcn.00407eb0
push 1
push 0x2712
mov ecx, esi
call fcn.00402100
push 2
push 0x2713
mov ecx, esi
call fcn.00402100
push 5
push 0x2714
mov ecx, esi
call fcn.00402100
push 4
push 0x2717
mov ecx, esi
call fcn.00402100
push esi
call fcn.00402690
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x28c], 0xffffffff
call fcn.0042db20
xor eax, eax
mov ecx, dword [esp + 0x280]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x26c]
xor ecx, esp
call fcn.0045ca6b
mov esp, ebp
pop ebp
ret 0x10
Function at 0x402d20
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x60
push esi
push 0x40
mov esi, eax
lea eax, [esp + 0x20]
push 0
push eax
mov dword [esp + 0x24], 0x44
call fcn.0045e940
xor eax, eax
add esp, 0xc
cmp dword [esi + 0x18], 8
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
jb 0x402d60
mov esi, dword [esi + 4]
jmp 0x402d63
add esi, 4
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x402d9a
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
pop esi
add esp, 0x60
ret
Function at 0x402f60
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x472548
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebp
push esi
push edi
mov eax, dword [0x48d034]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x50], 0
cmp dword [eax + 0x18], 8
jb 0x402f9d
mov eax, dword [eax + 4]
jmp 0x402fa0
add eax, 4
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x403054
lea eax, [esp + 0x58]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x402fe5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40304d
mov ecx, dword [esp + 0x58]
push 1
push 0
push 0
push ecx
call fcn.00464de0
mov edi, eax
xor eax, eax
add edi, esi
adc edx, eax
push edi
mov dword [esp + 0x24], edx
call fcn.0045ca66
mov esi, eax
add esp, 4
test esi, esi
je 0x40304d
push edi
push 0
push esi
call fcn.0045e940
add esp, 0xc
push 0
lea ecx, [esp + 0x1c]
push ecx
push edi
push esi
push ebp
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403044
cmp dword [esp + 0x18], 0
seta al
test al, al
jne 0x40306b
push esi
call fcn.0045cf4a
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x44
ret 8
push edi
call fcn.0045ca66
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x4030a3
push esi
call fcn.0045cf4a
add esp, 4
lea esi, [esp + 0x14]
call fcn.00408800
xor al, al
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x44
ret 8
push edi
push 0
push ebp
call fcn.0045e940
add esp, 0xc
lea eax, [esp + 0x28]
call fcn.0040b130
push 0
push ebp
mov edx, eax
push esi
push edx
mov eax, edi
call fcn.0040b1b0
test al, al
push esi
jne 0x4030f9
call fcn.0045cf4a
push ebp
call fcn.0045cf4a
add esp, 8
lea esi, [esp + 0x14]
call fcn.00408800
xor al, al
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x44
ret 8
call fcn.0045cf4a
add esp, 4
push 2
push 0
push 0x40000000
lea eax, [esp + 0x64]
push eax
mov eax, dword [esp + 0x6c]
mov ecx, 0x80
mov dword [esp + 0x68], 0xffffffff
call fcn.00408820
test al, al
jne 0x40315b
push ebp
call fcn.0045cf4a
add esp, 4
lea esi, [esp + 0x58]
call fcn.00408800
lea esi, [esp + 0x14]
call fcn.00408800
xor al, al
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x44
ret 8
lea ecx, [esp + 0x58]
push ecx
lea esi, [esp + 0x1c]
mov ecx, ebp
call fcn.004088a0
test al, al
push ebp
je 0x40312a
call fcn.0045cf4a
add esp, 4
lea esi, [esp + 0x58]
call fcn.00408800
lea esi, [esp + 0x14]
call fcn.00408800
mov al, 1
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x44
ret 8
Function at 0x4043b0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x472b78
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push edi
mov eax, dword [0x48d034]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
xor edi, edi
push 0xffffffffffffffff
push edi
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], di
call fcn.00403490
mov eax, ebx
mov dword [esp + 0x34], edi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x404410
sub eax, edx
sar eax, 1
push eax
push ebx
lea ecx, [esp + 0x18]
call fcn.004047a0
push 0xffffffffffffffff
push edi
push eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
mov eax, esi
mov word [esi + 4], di
call fcn.00403490
cmp dword [esp + 0x28], 8
jb 0x404457
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0045ca7a
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x2c
ret

Function at 0x405120
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4733b8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48d034]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [esp + 0x38]
xor ecx, ecx
cmp dword [esi + 0x18], 8
mov dword [esp + 0x38], ecx
mov dword [esp + 0x18], ecx
lea edi, [esi + 4]
jb 0x405164
mov eax, dword [edi]
jmp 0x405166
mov eax, edi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [esp + 0x38]
push edx
push ecx
push ecx
push ecx
push eax
mov eax, dword [ebx]
push eax
call ebp
test eax, eax
jne 0x405249
mov ecx, dword [esp + 0x38]
push ecx
call fcn.0045ca66
add esp, 4
mov byte [esp + 0x1c], 0
mov edx, dword [esp + 0x1c]
push edx
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x28], eax
call fcn.004052a0
mov dword [esp + 0x30], 0
cmp dword [esi + 0x18], 8
jb 0x4051b7
mov edi, dword [edi]
mov esi, dword [esp + 0x20]
mov edx, dword [ebx]
lea eax, [esp + 0x38]
push eax
push esi
lea ecx, [esp + 0x20]
push ecx
push 0
push edi
push edx
call ebp
test eax, eax
jne 0x40520f
cmp dword [esp + 0x18], 1
jne 0x40520f
mov eax, esi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4051e0
sub eax, edx
sar eax, 1
push eax
push esi
mov esi, dword [esp + 0x44]
call fcn.00403990
lea eax, [esp + 0x20]
mov dword [esp + 0x30], 0xffffffff
call fcn.00408190
mov al, 1
jmp 0x40524b
mov dword [esp + 0x30], 0xffffffff
mov esi, dword [esp + 0x24]
test esi, esi
je 0x405249
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x405249
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
lea ecx, [esi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x405249
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8
Function at 0x406da0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x473388
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x48d034]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x3c], ebx
push 0x29
push 0x4788c8
lea esi, [esp + 0x20]
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], bx
call fcn.00403990
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x406e04
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x1c]
mov edi, 8
cmp dword [esp + 0x30], edi
jae 0x406e17
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x14]
push ecx
push 0xf003f
push ebx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
setne byte [esp + 0x13]
cmp dword [esp + 0x30], edi
jb 0x406e48
mov edx, dword [esp + 0x1c]
push edx
call fcn.0045ca7a
add esp, 4
cmp byte [esp + 0x13], bl
jne 0x406ebe
push 0xa
push str.Start_Page
lea esi, [esp + 0x20]
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], bx
call fcn.00403990
cmp dword [0x48e8f0], edi
mov ecx, dword [0x48e8dc]
jae 0x406e82
mov ecx, 0x48e8dc
cmp dword [esp + 0x30], edi
mov eax, dword [esp + 0x1c]
jae 0x406e90
lea eax, [esp + 0x1c]
mov edx, dword [0x48e8ec]
lea edx, [edx + edx + 2]
push edx
push ecx
push 1
push ebx
push eax
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [esp + 0x30], edi
jb 0x406ebe
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0045ca7a
add esp, 4
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x406ecd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x408950
Capabilities:
Get file size

Disassembly:
push ecx
mov eax, dword [eax]
cmp eax, 0xffffffff
jne 0x40895c
xor al, al
pop ecx
ret
push esi
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40897f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40897f
xor al, al
pop esi
pop ecx
ret
mov edx, dword [esp + 4]
push 1
push 0
push 0
push edx
call fcn.00464de0
xor ecx, ecx
add eax, esi
adc edx, ecx
mov dword [edi], eax
mov dword [edi + 4], edx
mov al, 1
pop esi
pop ecx
ret
Function at 0x409110
Capabilities:
Create thread
Resume thread

Disassembly:
push edi
mov edi, eax
mov eax, dword [edi]
test eax, eax
jne 0x40911d
xor al, al
pop edi
ret
cmp dword [eax + 4], 0
je 0x409119
push esi
lea ecx, [eax + 0xc]
push ecx
push 4
push eax
push 0x409010
push 0
push 0
call fcn.0046843c
mov edx, dword [edi]
mov dword [edx + 0x10], eax
mov eax, dword [edi]
add esp, 0x18
cmp dword [eax + 0x10], 0
jne 0x409172
or esi, 0xffffffff
mov dword [eax + 0x10], esi
mov edi, dword [edi]
mov eax, dword [edi + 0x10]
cmp eax, esi
je 0x409162
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x10], esi
pop esi
mov byte [edi + 8], 0
mov dword [edi + 0xc], 0
xor al, al
pop edi
ret
mov byte [eax + 8], 1
mov eax, dword [edi]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x409194
mov esi, dword [edi]
call fcn.004090a0
mov edx, dword [edi]
mov byte [edx + 8], 0
pop esi
mov al, 1
pop edi
ret

Function at 0x409200
Capabilities:
Delete file
Set file attributes

Disassembly:
sub esp, 0x1c
push ebp
mov ebp, dword [esp + 0x24]
cmp dword [ebp + 0x18], 8
push esi
push edi
lea edi, [ebp + 4]
jb 0x409217
mov edx, dword [edi]
jmp 0x409219
mov edx, edi
push ebx
xor ebx, ebx
mov eax, edx
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], bx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x409232
sub eax, esi
sar eax, 1
push eax
push edx
lea esi, [esp + 0x18]
call fcn.00403990
mov eax, dword [esp + 0x14]
mov esi, 8
cmp dword [esp + 0x28], esi
jae 0x40925f
lea eax, [esp + 0x14]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
sete bl
cmp dword [esp + 0x28], esi
jb 0x40927f
mov eax, dword [esp + 0x14]
push eax
call fcn.0045ca7a
add esp, 4
test bl, bl
pop ebx
je 0x40928d
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x1c
ret
cmp dword [ebp + 0x18], esi
jb 0x4092a7
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
test eax, eax
pop esi
setne al
pop ebp
add esp, 0x1c
ret
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
test eax, eax
pop esi
setne al
pop ebp
add esp, 0x1c
ret
Function at 0x4092c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x624
mov eax, dword [0x48d034]
xor eax, esp
mov dword [esp + 0x620], eax
push esi
push edi
xor edi, edi
cmp dword [0x48e924], edi
mov esi, ecx
je 0x40930a
push 0xffffffffffffffff
push edi
push 0x48e910
mov eax, esi
call fcn.00403490
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x620]
xor ecx, esp
call fcn.0045ca6b
add esp, 0x624
ret
push 0x20a
lea eax, [esp + 0xe]
push edi
push eax
mov word [esp + 0x14], di
call fcn.0045e940
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
add eax, 0xffffffff
cmp eax, 0x103
ja 0x4093f3
push 0x410
lea edx, [esp + 0x21a]
push edi
push edx
mov word [esp + 0x21e], di
mov word [esp + 0x220], di
call fcn.0045e940
add esp, 0xc
push 0x208
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x4093b7
cmp eax, edi
je 0x4093b7
push esi
lea edx, [esp + 0x218]
mov word [esp + eax*2 + 0x218], di
call fcn.00405270
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x620]
xor ecx, esp
call fcn.0045ca6b
add esp, 0x624
ret
lea eax, [esp + 8]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4093c0
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0xc]
push edx
call fcn.00403990
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x620]
xor ecx, esp
call fcn.0045ca6b
add esp, 0x624
ret
mov ecx, dword [esp + 0x628]
pop edi
pop esi
xor ecx, esp
xor al, al
call fcn.0045ca6b
add esp, 0x624
ret

Function at 0x409410
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x48d034]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
mov ebx, dword [esp + 0x218]
push esi
push edi
push 0x20a
lea eax, [esp + 0x12]
push 0
push eax
mov edi, ecx
mov esi, edx
mov word [esp + 0x18], 0
call fcn.0045e940
mov eax, 8
add esp, 0xc
cmp dword [edi + 0x18], eax
jb 0x40945c
mov edi, dword [edi + 4]
jmp 0x40945f
add edi, 4
cmp dword [ebx + 0x18], eax
jb 0x409469
mov ebx, dword [ebx + 4]
jmp 0x40946c
add ebx, 4
lea ecx, [esp + 0xc]
push ecx
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jbe 0x4094c4
lea eax, [esp + 0xc]
mov word [esp + 0x216], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409490
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x10]
push edx
call fcn.00403990
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.0045ca6b
add esp, 0x210
ret
mov ecx, dword [esp + 0x218]
pop edi
pop esi
pop ebx
xor ecx, esp
xor al, al
call fcn.0045ca6b
add esp, 0x210
ret
Function at 0x409740
Capabilities:
Get common file path

Disassembly:
sub esp, 0x420
mov eax, dword [0x48d034]
xor eax, esp
mov dword [esp + 0x41c], eax
push edi
mov eax, esi
call fcn.004097f0
push 0x410
lea eax, [esp + 0xa]
push 0
push eax
mov word [esp + 0x10], 0
call fcn.0045e940
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add esp, 0xc
push 0
push 0
call edi
test eax, eax
jne 0x40979f
xor al, al
pop edi
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.0045ca6b
add esp, 0x420
ret
cmp eax, 0x208
jae 0x409787
lea ecx, [esp + 4]
push ecx
push 0x209
call edi
test eax, eax
je 0x409787
cmp eax, 0x208
jae 0x409787
push esi
lea edx, [esp + 8]
mov word [esp + 0x418], 0
call fcn.00405270
mov ecx, dword [esp + 0x420]
pop edi
xor ecx, esp
mov al, 1
call fcn.0045ca6b
add esp, 0x420
ret

Function at 0x409a00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4732a8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x48d034]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x48d034]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
xor esi, esi
push 0xffffffffffffffff
push esi
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], esi
mov word [esp + 0x18], si
call fcn.00403490
lea eax, [esp + 8]
push 0x24
push eax
mov dword [esp + 0x38], esi
call fcn.0040c0c0
mov eax, dword [esp + 0x14]
mov esi, 8
add esp, 8
cmp dword [esp + 0x20], esi
jae 0x409a79
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x409a9c
cmp dword [esp + 0x20], esi
jb 0x409a98
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0045ca7a
add esp, 4
mov al, 1
jmp 0x409ab1
cmp dword [esp + 0x20], esi
jb 0x409aaf
mov edx, dword [esp + 0xc]
push edx
call fcn.0045ca7a
add esp, 4
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0045ca6b
add esp, 0x2c
ret
Function at 0x409ad0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4732a8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x48d034]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x48d034]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
xor esi, esi
push 0xffffffffffffffff
push esi
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], esi
mov word [esp + 0x18], si
call fcn.00403490
lea eax, [esp + 8]
push 0x24
push eax
mov dword [esp + 0x38], esi
call fcn.0040c0c0
mov eax, dword [esp + 0x14]
mov esi, 8
add esp, 8
cmp dword [esp + 0x20], esi
jae 0x409b49
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x409b70
test al, 0x10
jne 0x409b70
cmp dword [esp + 0x20], esi
jb 0x409b6c
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0045ca7a
add esp, 4
mov al, 1
jmp 0x409b85
cmp dword [esp + 0x20], esi
jb 0x409b83
mov edx, dword [esp + 0xc]
push edx
call fcn.0045ca7a
add esp, 4
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0045ca6b
add esp, 0x2c
ret

Function at 0x409bb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4732a8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x48d034]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x48d034]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
xor esi, esi
push 0xffffffffffffffff
push esi
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], esi
mov word [esp + 0x18], si
call fcn.00403490
lea eax, [esp + 8]
push 0x24
push eax
mov dword [esp + 0x38], esi
call fcn.0040c0c0
mov eax, dword [esp + 0x14]
mov esi, 8
add esp, 8
cmp dword [esp + 0x20], esi
jae 0x409c29
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x409c50
test al, 0x10
je 0x409c50
cmp dword [esp + 0x20], esi
jb 0x409c4c
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0045ca7a
add esp, 4
mov al, 1
jmp 0x409c65
cmp dword [esp + 0x20], esi
jb 0x409c63
mov edx, dword [esp + 0xc]
push edx
call fcn.0045ca7a
add esp, 4
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0045ca6b
add esp, 0x2c
ret

Function at 0x409d70
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
cmp dword [edi + 0x18], 8
push esi
lea esi, [edi + 4]
jb 0x409d7e
mov eax, dword [esi]
jmp 0x409d80
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
cmp dword [edi + 0x18], 8
jb 0x409d94
mov ecx, dword [esi]
jmp 0x409d96
mov ecx, esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [edi + 0x18], 8
jb 0x409da6
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub eax, 1
neg eax
sbb eax, eax
add eax, 1
pop esi
ret