joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b4340
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a58fe
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x608554]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
push ecx
push str.CBaseDlgMgr::CreateSetupProgress
lea ecx, [ebp - 0x4c]
call fcn.0040a480
mov dword [ebp - 4], 0
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4b43c5
test byte [ecx + 0x1c], 1
je 0x4b43c5
cmp dword [0x608f68], 8
mov eax, 0x608f54
mov edx, 0x5d6224
cmovae eax, dword [0x608f54]
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x34
call fcn.00401840
add esp, 0xc
push 0x470
mov byte [ebp - 4], 1
call fcn.0055070f
mov esi, eax
add esp, 4
mov dword [ebp - 0x54], esi
mov byte [ebp - 4], 2
test esi, esi
je 0x4b44b4
push dword [edi + 0x40]
mov ecx, esi
push 0xbe9
call fcn.00558cc1
lea ebx, [esi + 0xa8]
mov byte [ebp - 4], 3
mov ecx, ebx
mov dword [esi], vtable.CBaseDlgSetupProgress.0
mov dword [ebp - 0x50], ebx
call fcn.0055247d
mov dword [ebx], vtable.CStatic.0
lea ebx, [esi + 0x128]
mov byte [ebp - 4], 4
mov ecx, ebx
mov dword [ebp - 0x50], ebx
call fcn.0055247d
mov dword [ebx], vtable.CProgressCtrl.0
lea ecx, [esi + 0x1b0]
mov byte [ebp - 4], 5
call fcn.004a2a90
lea ecx, [esi + 0x238]
mov byte [ebp - 4], 6
call fcn.004a2a90
lea ebx, [esi + 0x2c0]
mov byte [ebp - 4], 7
mov ecx, ebx
mov dword [ebp - 0x50], ebx
call fcn.0055247d
mov dword [ebx], vtable.CStatic.0
lea ecx, [esi + 0x340]
mov byte [ebp - 4], 8
call fcn.004a2330
lea ebx, [esi + 0x3f0]
mov byte [ebp - 4], 9
mov ecx, ebx
mov dword [ebp - 0x50], ebx
call fcn.0055247d
push 0xfa0
mov dword [ebx], vtable.CStatic.0
push dword [0x61850c]
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [esi + 0x1ac], eax
mov dword [esi + 0x1a8], 0
jmp 0x4b44b6
xor esi, esi
mov dword [edi + 0x4c], esi
test esi, esi
je 0x4b4506
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], 0
push eax
push 0
push esi
push 0x4b45a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x38], eax
xor esi, esi
mov eax, dword [edi + 0x4c]
cmp dword [eax + 0x1a8], esi
jne 0x4b4506
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call ebx
inc esi
cmp esi, 0x32
jg 0x4b4506
mov eax, dword [edi + 0x4c]
cmp dword [eax + 0x1a8], 0
je 0x4b44f0
mov byte [ebp - 0x48], 1
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4b454d
test byte [ecx + 0x1c], 1
je 0x4b454d
cmp dword [0x608f68], 8
mov eax, 0x608f54
push dword [edi + 0x4c]
cmovae eax, dword [0x608f54]
mov edx, 0x5d6224
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x35
call fcn.004018a0
add esp, 0x10
mov esi, dword [edi + 0x4c]
lea ecx, [ebp - 0x4c]
call fcn.0040a570
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0056d977
mov esp, ebp
pop ebp
ret
Function at 0x4b9b00
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push edi
push 0
mov edi, ecx
mov dword [ebp - 0x3c], 0xd
push 0
push 0x1004
mov dword [ebp - 0x34], 0
push dword [edi + 0x1e0]
mov dword [ebp - 0x28], 0x5c6930
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], 0xf000
mov dword [ebp - 0x30], 0x1000
call esi
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x3c]
push eax
push 0
push 0x104d
push dword [edi + 0x1e0]
call esi
push dword [ebp + 8]
push 0
push 0
push 0
push 0x1004
push dword [edi + 0x1e0]
call esi
dec eax
lea ecx, [edi + 0x1c0]
push eax
call fcn.0055af02
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4c0940
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x608554]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
mov edi, ecx
call fcn.005569bd
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x214]
cmp dword [ebx + 4], 0xf
mov esi, eax
jne 0x4c0a0c
mov eax, dword [ebx]
cmp eax, dword [edi + 0x20]
je 0x4c09c0
cmp eax, dword [edi + 0x250]
je 0x4c09c0
lea ecx, [edi + 0xa8]
call fcn.0055d3a3
lea ecx, [eax + 0x20]
mov eax, dword [ebx]
cmp eax, dword [ecx]
je 0x4c09c0
lea ecx, [edi + 0x128]
call fcn.0055d3a3
lea ecx, [eax + 0x20]
mov eax, dword [ebx]
cmp eax, dword [ecx]
je 0x4c09c0
lea ecx, [edi + 0x1a8]
call fcn.0055d3a3
lea ecx, [eax + 0x20]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x4c0a0c
mov dword [ebp - 0x30], 0x2c
test esi, esi
jne 0x4c09d3
lea ecx, [edi + 0xa8]
jmp 0x4c09eb
cmp esi, 1
jne 0x4c09e0
lea ecx, [edi + 0x128]
jmp 0x4c09eb
cmp esi, 2
jne 0x4c09f4
lea ecx, [edi + 0x1a8]
lea eax, [ebp - 0x30]
push eax
call fcn.005545fb
push 0
lea eax, [ebp - 0x14]
push eax
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [edi]
xorps xmm0, xmm0
mov esi, eax
movq qword [ebp - 0x44], xmm0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x34], 0
mov edx, dword [ecx + 0x214]
mov ecx, edi
call edx
mov dword [ebp - 0x38], eax
and esi, 0x8000
je 0x4c0b01
cmp dword [ebx + 4], 0x100
jne 0x4c0b01
cmp dword [ebx + 8], 9
jne 0x4c0b01
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov esi, dword [edi + 0x250]
mov edx, eax
mov eax, dword [ebp - 0x38]
and edx, 0x8000
push 0
test eax, eax
jne 0x4c0a88
xor ecx, ecx
test edx, edx
setne cl
inc ecx
push ecx
jmp 0x4c0aa3
cmp eax, 1
jne 0x4c0a9b
xor ecx, ecx
mov eax, 2
test edx, edx
cmovne eax, ecx
jmp 0x4c0aa2
xor eax, eax
test edx, edx
setne al
push eax
push 0x130c
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
call esi
lea eax, [ebp - 0x34]
mov ecx, edi
push eax
push 0xbc4
call fcn.00558889
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x4c0ae9
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x44]
push eax
push 0xbc4
push 0x4e
push dword [edi + 0x20]
mov dword [ebp - 0x3c], 0xfffffdd9
mov dword [ebp - 0x40], 0xbc4
call esi
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056d977
mov esp, ebp
pop ebp
ret 4
push ebx
mov ecx, edi
call fcn.0055989f
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056d977
mov esp, ebp
pop ebp
ret 4
Function at 0x4cce90
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59cee8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x608554]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push ecx
push str.CBaseInfoAddIn::DeleteRestoreFile
lea ecx, [ebp - 0x48]
call fcn.0040a480
mov dword [ebp - 4], 0
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4ccf12
test byte [ecx + 0x1c], 1
je 0x4ccf12
cmp dword [0x608f68], 8
mov eax, 0x608f54
mov edx, 0x5d8b50
cmovae eax, dword [0x608f54]
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x14
call fcn.00401840
add esp, 0xc
mov ecx, esi
call fcn.004d3390
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4ccf41
push 0x20
lea eax, [esi + 0x10]
push eax
call edi
lea eax, [esi + 0x10]
push eax
call ebx
lea eax, [esi + 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4ccf66
push 0x20
lea eax, [esi + 0x218]
push eax
call edi
lea eax, [esi + 0x218]
push eax
call ebx
add esi, 0x420
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4ccf7f
push 0x20
push esi
call edi
push esi
call ebx
mov byte [ebp - 0x44], 1
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4ccfc5
test byte [ecx + 0x1c], 1
je 0x4ccfc5
cmp dword [0x608f68], 8
mov eax, 0x608f54
push 0
cmovae eax, dword [0x608f54]
mov edx, 0x5d8b50
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x15
call fcn.004018a0
add esp, 0x10
lea ecx, [ebp - 0x48]
call fcn.0040a570
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056d977
mov esp, ebp
pop ebp
ret
Function at 0x4e04c0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a110b
mov eax, dword fs:[0]
push eax
sub esp, 0x44c
mov eax, dword [0x608554]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
push ecx
push str.CBaseInfoCustomDrv::GetBackUpFolderPath
lea ecx, [ebp - 0x458]
call fcn.0040a480
mov dword [ebp - 4], 0
mov esi, dword [0x608f30]
cmp esi, 0x608f30
je 0x4e0551
test byte [esi + 0x1c], 1
je 0x4e0551
cmp dword [0x608f68], 8
mov eax, 0x608f54
mov edx, 0x5d9bd8
mov ecx, 0x3b
cmovae eax, dword [0x608f54]
push eax
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.00401840
mov esi, dword [0x608f30]
add esp, 0xc
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00571c00
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00571c00
add esp, 0x18
test ebx, ebx
jne 0x4e058f
mov edi, 0x80010001
mov dword [0x6183ec], 1
jmp 0x4e0602
lea eax, [ebp - 0x218]
push eax
push ecx
push 1
call fcn.004f2130
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x420]
mov ecx, edi
push eax
push 0x104
call fcn.004e0740
mov edi, eax
test edi, edi
jne 0x4e05fc
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push eax
push 0x5c70f4
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
call fcn.00437f50
add esp, 0x18
test eax, eax
jns 0x4e066f
mov edi, 0x80010041
mov dword [0x6183ec], 0x41
mov esi, dword [0x608f30]
mov byte [ebp - 0x454], 1
cmp esi, 0x608f30
je 0x4e0644
test byte [esi + 0x1c], 1
je 0x4e0644
cmp dword [0x608f68], 8
mov eax, 0x608f54
push edi
cmovae eax, dword [0x608f54]
mov edx, 0x5d9bd8
push eax
push dword [esi + 0x14]
mov ecx, 0x3e
push dword [esi + 0x10]
call fcn.004018a0
add esp, 0x10
lea ecx, [ebp - 0x458]
call fcn.0040a570
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056d977
mov esp, ebp
pop ebp
ret 8
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4e05fc
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4e06bb
test byte [ecx + 0x1c], 4
je 0x4e06bb
cmp dword [0x608f68], 8
mov eax, 0x608f54
push ebx
cmovae eax, dword [0x608f54]
mov edx, 0x5d9bd8
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x3c
call fcn.00405920
add esp, 0x10
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4e05fc
mov esi, dword [0x608f30]
cmp esi, 0x608f30
je 0x4e0723
test byte [esi + 0x1c], 2
je 0x4e0723
cmp dword [0x608f68], 8
lea ecx, [ebp - 0x458]
mov esi, 0x608f54
cmovae esi, dword [0x608f54]
call fcn.0040a830
push eax
mov eax, dword [0x608f30]
mov edx, 0x5d9bd8
push esi
mov ecx, 0x3d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00405920
mov esi, dword [0x608f30]
add esp, 0x10
mov edi, 0x80010009
mov dword [0x6183ec], 9
jmp 0x4e0602
Function at 0x4e0880
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a9286
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
mov eax, dword [0x608554]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
push ecx
push str.CBaseInfoCustomDrv::DeleteCustomCodeOfReg
lea ecx, [ebp - 0x48]
call fcn.0040a480
mov dword [ebp - 4], 0
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4e090c
test byte [ecx + 0x1c], 1
je 0x4e090c
cmp dword [0x608f68], 8
mov eax, 0x608f54
mov edx, 0x5d9bd8
cmovae eax, dword [0x608f54]
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x41
call fcn.00401840
mov ecx, dword [0x608f30]
add esp, 0xc
xor esi, esi
test edi, edi
jne 0x4e0926
mov esi, 0x80010001
mov dword [0x6183ec], 1
jmp 0x4e0a13
lea ecx, [ebp - 0xc4]
call fcn.004066e0
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 1
call fcn.004068b0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0xc4]
push eax
push 0xf003f
push 0
push str.SystemCurrentControlSetControlPrintPrinters
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x4e0a02
lea ecx, [ebp - 0x9c]
call fcn.004066e0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x4c], eax
test eax, eax
je 0x4e09f7
lea ecx, [ebp - 0x9c]
call fcn.004068b0
lea eax, [ebp - 0x9c]
push eax
push 0xf003f
push 0
push edi
push dword [ebp - 0x4c]
call ebx
test eax, eax
jne 0x4e09f7
lea ecx, [ebp - 0x74]
call fcn.004066e0
mov byte [ebp - 4], 3
mov edi, dword [ebp - 0x9c]
test edi, edi
je 0x4e09ef
lea ecx, [ebp - 0x74]
call fcn.004068b0
lea eax, [ebp - 0x74]
push eax
push 0xf003f
push 0
push str.PrinterDriverData
push edi
call ebx
test eax, eax
jne 0x4e09ef
mov eax, dword [ebp - 0x74]
test eax, eax
je 0x4e09ef
push str.CustomCode
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x74]
call fcn.004067f0
lea ecx, [ebp - 0x9c]
call fcn.004067f0
lea ecx, [ebp - 0xc4]
call fcn.004067f0
mov ecx, dword [0x608f30]
mov byte [ebp - 0x44], 1
cmp ecx, 0x608f30
je 0x4e0a52
test byte [ecx + 0x1c], 1
je 0x4e0a52
cmp dword [0x608f68], 8
mov eax, 0x608f54
push esi
cmovae eax, dword [0x608f54]
mov edx, 0x5d9bd8
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x42
call fcn.004018a0
add esp, 0x10
lea ecx, [ebp - 0x48]
call fcn.0040a570
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056d977
mov esp, ebp
pop ebp
ret 4
Function at 0x4e0a80
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a9286
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
mov eax, dword [0x608554]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
push ecx
push str.CBaseInfoCustomDrv::DeleteCustomCommentOfReg
lea ecx, [ebp - 0x48]
call fcn.0040a480
mov dword [ebp - 4], 0
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4e0b0c
test byte [ecx + 0x1c], 1
je 0x4e0b0c
cmp dword [0x608f68], 8
mov eax, 0x608f54
mov edx, 0x5d9bd8
cmovae eax, dword [0x608f54]
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x43
call fcn.00401840
mov ecx, dword [0x608f30]
add esp, 0xc
xor esi, esi
test edi, edi
jne 0x4e0b26
mov esi, 0x80010001
mov dword [0x6183ec], 1
jmp 0x4e0c13
lea ecx, [ebp - 0xc4]
call fcn.004066e0
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 1
call fcn.004068b0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0xc4]
push eax
push 0xf003f
push 0
push str.SystemCurrentControlSetControlPrintPrinters
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x4e0c02
lea ecx, [ebp - 0x9c]
call fcn.004066e0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x4c], eax
test eax, eax
je 0x4e0bf7
lea ecx, [ebp - 0x9c]
call fcn.004068b0
lea eax, [ebp - 0x9c]
push eax
push 0xf003f
push 0
push edi
push dword [ebp - 0x4c]
call ebx
test eax, eax
jne 0x4e0bf7
lea ecx, [ebp - 0x74]
call fcn.004066e0
mov byte [ebp - 4], 3
mov edi, dword [ebp - 0x9c]
test edi, edi
je 0x4e0bef
lea ecx, [ebp - 0x74]
call fcn.004068b0
lea eax, [ebp - 0x74]
push eax
push 0xf003f
push 0
push str.PrinterDriverData
push edi
call ebx
test eax, eax
jne 0x4e0bef
mov eax, dword [ebp - 0x74]
test eax, eax
je 0x4e0bef
push str.CustomComment
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x74]
call fcn.004067f0
lea ecx, [ebp - 0x9c]
call fcn.004067f0
lea ecx, [ebp - 0xc4]
call fcn.004067f0
mov ecx, dword [0x608f30]
mov byte [ebp - 0x44], 1
cmp ecx, 0x608f30
je 0x4e0c52
test byte [ecx + 0x1c], 1
je 0x4e0c52
cmp dword [0x608f68], 8
mov eax, 0x608f54
push esi
cmovae eax, dword [0x608f54]
mov edx, 0x5d9bd8
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x44
call fcn.004018a0
add esp, 0x10
lea ecx, [ebp - 0x48]
call fcn.0040a570
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056d977
mov esp, ebp
pop ebp
ret 4
Function at 0x4e7ef0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x599fd8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x608554]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push ecx
push str.CBaseInfoPrinterEx::IsExistRestoreFile
lea ecx, [ebp - 0x48]
call fcn.0040a480
mov dword [ebp - 4], 0
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4e7f70
test byte [ecx + 0x1c], 1
je 0x4e7f70
cmp dword [0x608f68], 8
mov eax, 0x608f54
mov edx, 0x5daec4
cmovae eax, dword [0x608f54]
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x12
call fcn.00401840
add esp, 0xc
lea eax, [esi + 8]
mov dword [ebp - 0x4c], 0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
test esi, esi
je 0x4e7fb7
mov ecx, dword [0x6184f0]
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ecx + 0x2c]
call fcn.004f8d40
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x4e7fb5
cmp eax, 0x3e8
je 0x4e7fb5
cmp eax, 0x270f
je 0x4e7fb5
mov esi, 1
jmp 0x4e7fb7
xor esi, esi
mov byte [ebp - 0x44], 1
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4e7ffc
test byte [ecx + 0x1c], 1
je 0x4e7ffc
cmp dword [0x608f68], 8
mov eax, 0x608f54
push esi
cmovae eax, dword [0x608f54]
mov edx, 0x5daec4
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x13
call fcn.004018a0
add esp, 0x10
lea ecx, [ebp - 0x48]
call fcn.0040a570
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056d977
mov esp, ebp
pop ebp
ret
Function at 0x4e8020
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a9a13
mov eax, dword fs:[0]
push eax
sub esp, 0xec
mov eax, dword [0x608554]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push ecx
push str.CBaseInfoPrinterEx::OpenRestoreFile
lea ecx, [ebp - 0x48]
call fcn.0040a480
mov dword [ebp - 4], 0
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4e80a5
test byte [ecx + 0x1c], 1
je 0x4e80a5
cmp dword [0x608f68], 8
mov eax, 0x608f54
mov edx, 0x5daec4
cmovae eax, dword [0x608f54]
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x14
call fcn.00401840
add esp, 0xc
mov ecx, dword [0x6184f0]
xor edi, edi
push 3
mov ecx, dword [ecx + 4]
call fcn.004feca0
xor ebx, ebx
test eax, eax
setne bl
add esi, 0x210
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4e80df
push 0x20
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test ebx, ebx
je 0x4e8161
push ecx
lea ecx, [ebp - 0xf8]
call fcn.004f3840
sub esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xf8]
push esi
call fcn.004f37e0
cmp dword [ebp - 0xa8], 0
jne 0x4e811c
mov edi, 0x80010005
mov dword [0x6183ec], 5
jmp 0x4e8156
lea ecx, [ebp - 0xf4]
call fcn.0042b530
test eax, eax
jne 0x4e8156
mov eax, dword [ebp - 0xf8]
lea ecx, [ebp - 0xf8]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.004133b0
lea ecx, [ebp - 0xf8]
call fcn.004cce00
mov byte [ebp - 0x44], 1
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4e81a6
test byte [ecx + 0x1c], 1
je 0x4e81a6
cmp dword [0x608f68], 8
mov eax, 0x608f54
push edi
cmovae eax, dword [0x608f54]
mov edx, 0x5daec4
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x15
call fcn.004018a0
add esp, 0x10
lea ecx, [ebp - 0x48]
call fcn.0040a570
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056d977
mov esp, ebp
pop ebp
ret
Function at 0x4f6d80
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59a128
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x608554]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push ecx
push str.CBaseInfoProperty::DeletePropertyInfoFile
lea ecx, [ebp - 0x48]
call fcn.0040a480
mov dword [ebp - 4], 0
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4f6e00
test byte [ecx + 0x1c], 1
je 0x4f6e00
cmp dword [0x608f68], 8
mov eax, 0x608f54
mov edx, 0x5db7e4
cmovae eax, dword [0x608f54]
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x18
call fcn.00401840
add esp, 0xc
mov ecx, esi
call fcn.004f8140
add esi, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4f6e25
push 0x20
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 0x44], 1
mov ecx, dword [0x608f30]
cmp ecx, 0x608f30
je 0x4f6e6b
test byte [ecx + 0x1c], 1
je 0x4f6e6b
cmp dword [0x608f68], 8
mov eax, 0x608f54
push 0
cmovae eax, dword [0x608f54]
mov edx, 0x5db7e4
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
mov ecx, 0x19
call fcn.004018a0
add esp, 0x10
lea ecx, [ebp - 0x48]
call fcn.0040a570
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056d977
mov esp, ebp
pop ebp
ret