joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c460
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x588790]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41c4cf
lea ecx, [ebp - 0x10]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [ebp - 0x18]
push 0
push 0
push 0x10
lea edx, [ebp - 0x14]
push edx
push 0
push eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41c4cf
push eax
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00503edf
mov esp, ebp
pop ebp
ret
Function at 0x41c4e0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52ac48
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x588790]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov edi, str._ZProgram::CheckDiskFreeSpace_Start
mov dword [ebp - 4], ebx
call fcn.00408b90
push 1
push 0x53b218
lea eax, [ebp + 0x10]
call fcn.00404670
inc eax
push eax
xor ecx, ecx
lea esi, [ebp - 0x4c]
lea edx, [ebp + 0x10]
call fcn.004043c0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x58], esp
push 0xffffffffffffffff
mov byte [ebp - 4], 1
push ebx
mov eax, esi
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push eax
mov byte [ecx], bl
call fcn.00404580
lea ecx, [ebp - 0x30]
push ecx
call fcn.00420700
add esp, 0x20
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x30]
mov esi, 8
cmp dword [ebp - 0x1c], esi
jae 0x41c57b
lea eax, [ebp - 0x30]
lea edx, [ebp - 0x54]
push edx
lea ecx, [ebp - 0x64]
push ecx
lea edx, [ebp - 0x6c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
shld ecx, eax, 0x14
shl eax, 0x14
cmp dword [ebp - 0x50], ecx
ja 0x41c614
jb 0x41c5a7
cmp dword [ebp - 0x54], eax
ja 0x41c614
mov edi, 0x53b21c
call fcn.00408b90
mov edi, str._ZProgram::CheckDiskFreeSpace_End
call fcn.00408b90
cmp dword [ebp - 0x1c], esi
jb 0x41c5cc
mov edx, dword [ebp - 0x30]
push edx
call fcn.004ad85d
add esp, 4
xor eax, eax
mov edi, 0x10
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], ax
cmp dword [ebp - 0x38], edi
jb 0x41c5f2
mov ecx, dword [ebp - 0x4c]
push ecx
call fcn.004ad85d
add esp, 4
mov dword [ebp - 0x38], 0xf
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 0x4c], bl
cmp dword [ebp + 0x24], edi
jb 0x41c610
mov edx, dword [ebp + 0x10]
push edx
call fcn.004ad85d
add esp, 4
xor al, al
jmp 0x41c67f
mov edi, str._DiskFreeSpace___InstallSizeofBytes
call fcn.00408b90
mov edi, str._ZProgram::CheckDiskFreeSpace_End
call fcn.00408b90
cmp dword [ebp - 0x1c], esi
jb 0x41c639
mov eax, dword [ebp - 0x30]
push eax
call fcn.004ad85d
add esp, 4
xor ecx, ecx
mov edi, 0x10
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], cx
cmp dword [ebp - 0x38], edi
jb 0x41c65f
mov edx, dword [ebp - 0x4c]
push edx
call fcn.004ad85d
add esp, 4
mov dword [ebp - 0x38], 0xf
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 0x4c], bl
cmp dword [ebp + 0x24], edi
jb 0x41c67d
mov eax, dword [ebp + 0x10]
push eax
call fcn.004ad85d
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00503edf
mov esp, ebp
pop ebp
ret
Function at 0x41d280
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52abc8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x588790]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, str._ZRegedit::DeleteSubKey_Start
mov dword [ebp - 4], 1
call fcn.00408b90
mov esi, dword [ebp + 0x18]
mov eax, esi
cmp esi, 0x12
jb 0x41d2cb
mov eax, 0x12
cmp dword [ebp + 0x1c], 0x10
mov edx, dword [ebp + 8]
jae 0x41d2d7
lea edx, [ebp + 8]
push eax
mov ecx, str.HKEY_LOCAL_MACHINE
call fcn.00402130
add esp, 4
test eax, eax
jne 0x41d2fd
cmp esi, 0x12
jae 0x41d2f3
or eax, 0xffffffff
jmp 0x41d2fb
xor eax, eax
cmp esi, 0x12
setne al
test eax, eax
sete al
test al, al
je 0x41d30b
mov esi, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x41d36c
mov ecx, str.HKEY_CLASSES_ROOT
lea edi, [ebp + 8]
call fcn.00404da0
test al, al
je 0x41d323
mov esi, SysReAllocStringLen
jmp 0x41d36c
mov ecx, str.HKEY_CURRENT_USER
lea edi, [ebp + 8]
call fcn.00404da0
test al, al
je 0x41d33b
mov esi, SysReAllocStringLen
jmp 0x41d36c
mov ecx, str.HKEY_USERS
lea edi, [ebp + 8]
call fcn.00404da0
test al, al
je 0x41d353
mov esi, SysReAllocStringLen
jmp 0x41d36c
mov ecx, str.HKEY_CURRENT_CONFIG
lea edi, [ebp + 8]
call fcn.00404da0
mov esi, VariantClear
test al, al
jne 0x41d36c
mov esi, dword [ebp - 0x30]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x30], esp
push 0xffffffffffffffff
push 0
lea eax, [ebp + 0x24]
mov edi, 0xf
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00404580
lea ecx, [ebp - 0x2c]
push ecx
call fcn.00420700
add esp, 0x20
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x2c]
mov ebx, 8
cmp dword [ebp - 0x18], ebx
jae 0x41d3b3
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x41d425
mov edi, str._ZRegedit::DeleteSubKey_End
call fcn.00408b90
cmp dword [ebp - 0x18], ebx
jb 0x41d3da
mov edx, dword [ebp - 0x2c]
push edx
call fcn.004ad85d
add esp, 4
xor esi, esi
xor eax, eax
mov edi, 0x10
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x2c], ax
cmp dword [ebp + 0x1c], edi
jb 0x41d402
mov ecx, dword [ebp + 8]
push ecx
call fcn.004ad85d
add esp, 4
mov dword [ebp + 0x1c], 0xf
mov dword [ebp + 0x18], esi
mov byte [ebp + 8], 0
cmp dword [ebp + 0x38], edi
jb 0x41d421
mov edx, dword [ebp + 0x24]
push edx
call fcn.004ad85d
add esp, 4
mov al, 1
jmp 0x41d47b
cmp dword [ebp - 0x18], ebx
jb 0x41d436
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004ad85d
add esp, 4
xor esi, esi
xor ecx, ecx
mov ebx, 0x10
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x2c], cx
cmp dword [ebp + 0x1c], ebx
jb 0x41d45e
mov edx, dword [ebp + 8]
push edx
call fcn.004ad85d
add esp, 4
mov dword [ebp + 0x1c], edi
mov dword [ebp + 0x18], esi
mov byte [ebp + 8], 0
cmp dword [ebp + 0x38], ebx
jb 0x41d479
mov eax, dword [ebp + 0x24]
push eax
call fcn.004ad85d
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00503edf
mov esp, ebp
pop ebp
ret
Function at 0x41eb50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5293a8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x588790]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x41ec71
cmp byte [edi + 0x49], bl
je 0x41ec71
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
je 0x41ec65
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x41ebc5
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x41ebdd
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
push edx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x41ec06
dec eax
je 0x41ec0a
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x41ec60
jmp 0x41ec6c
mov byte [edi + 0x49], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x41ec1a
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x41ec43
cmp ebx, 0x10
jae 0x41ec29
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.00504f22
add esp, 0x10
cmp esi, eax
jne 0x41ec5d
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x41ec69
test esi, esi
jne 0x41ebd1
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.0041e8d0
jmp 0x41ebcb
lea ecx, [ebp - 0x2c]
call fcn.00404390
xor al, al
jmp 0x41ec73
lea ecx, [ebp - 0x2c]
call fcn.00404390
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00503edf
mov esp, ebp
pop ebp
ret
Function at 0x41eeb0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52810b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x588790]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004efaa8
push 4
mov dword [ebp - 4], 0
call fcn.004a47f3
mov edi, eax
add esp, 4
test edi, edi
je 0x41ef30
call fcn.004ef980
mov dword [edi], eax
call fcn.004ef7fb
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.004efa69
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x41ef26
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.004efa91
jmp 0x41ef32
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x422080
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x588790]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
movzx edx, byte [eax + 1]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 2]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 3]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 4]
movzx esi, byte [eax + 5]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 6]
movzx ebx, byte [eax + 0xd]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 7]
movzx edi, byte [eax + 9]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 8]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 0xa]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 0xb]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 0xc]
shl edi, 8
or edi, ebx
movzx ebx, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl edi, 8
or edi, ebx
shl edi, 8
or edi, eax
xor esi, 0x677d9197
xor edx, 0x56aa3350
xor ecx, 0xa3b1bac6
xor edi, 0xb27022dc
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x8c], esi
mov esi, dword [ebp - 0x98]
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x88], edi
xor edx, edx
jmp 0x422160
mov eax, dword [edx + 0x539bc0]
xor eax, dword [ebp + edx - 0x90]
add edx, 4
xor eax, dword [ebp + edx - 0x8c]
xor eax, dword [ebp + edx - 0x90]
mov ecx, eax
shr ecx, 0x18
movzx ecx, cl
movzx ecx, byte [ecx + 0x539ac0]
mov ebx, eax
shr ebx, 0x10
mov byte [ebp - 0x98], cl
mov byte [ebp - 0x9b], bl
movzx ecx, byte [ebp - 0x9b]
mov cl, byte [ecx + 0x539ac0]
mov ebx, eax
movzx eax, al
mov al, byte [eax + 0x539ac0]
mov byte [ebp - 0x95], al
movzx eax, byte [ebp - 0x98]
movzx ecx, cl
shl eax, 8
or eax, ecx
shr ebx, 8
movzx edi, bl
movzx ecx, byte [edi + 0x539ac0]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 0x95]
shl eax, 8
or eax, ecx
mov ecx, eax
rol ecx, 0xd
mov edi, eax
ror edi, 9
xor ecx, edi
xor ecx, dword [ebp + edx - 0x98]
xor ecx, eax
mov dword [ebp + edx - 0x88], ecx
mov dword [edx + esi - 4], ecx
cmp edx, 0x80
jb 0x422160
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00503edf
mov esp, ebp
pop ebp
ret
Function at 0x4245f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x4245fe
xor eax, eax
pop ebp
ret
push esi
not eax
cmp edx, 8
jb 0x4246cd
mov esi, edx
shr esi, 3
push edi
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5396c0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5396c0]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5396c0]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5396c0]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5396c0]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5396c0]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5396c0]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5396c0]
add ecx, 8
sub edx, 8
dec esi
jne 0x424610
pop edi
test edx, edx
je 0x4246ea
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x5396c0]
inc ecx
dec edx
jne 0x4246d1
not eax
pop esi
pop ebp
ret

Function at 0x4246f0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5396c0]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x5396c0]
mov dword [edx + 8], ecx
ret

Function at 0x424740
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x5396c0]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x5396c0]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret
Function at 0x424f10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ebx
imul esi, dword [ebp + 0x10]
cmp byte [edi], 0
je 0x424f4b
mov ecx, dword [ebp + 8]
mov edx, dword [edi + 4]
push 0
lea eax, [ebp + 0xc]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x424f40
mov byte [edi + 8], 1
mov eax, dword [ebp + 0xc]
xor edx, edx
pop esi
div ebx
pop ebx
pop ebp
ret
mov ecx, dword [edi + 0x1c]
mov eax, dword [edi + 0x18]
lea edx, [ecx + esi]
cmp edx, eax
jbe 0x424f5c
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x14]
add eax, ecx
mov ecx, dword [ebp + 8]
push esi
push eax
push ecx
call fcn.00509040
add dword [edi + 0x1c], esi
add esp, 0xc
mov eax, esi
xor edx, edx
pop esi
div ebx
pop ebx
pop ebp
ret
Function at 0x425160
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp byte [esi], 0
je 0x4251a7
cmp byte [esi + 1], 0
je 0x4251af
mov eax, dword [esi + 4]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [esi], 0
push ebx
je 0x4251c2
cmp byte [esi + 1], 0
je 0x4251b6
mov edx, dword [esi + 4]
push 1
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
sub ebx, dword [esi + 0xc]
mov dword [ebp - 4], ebx
jmp 0x4251ca
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x1c], ecx
jmp 0x425181
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0
mov ebx, dword [ebp - 4]
jmp 0x4251ca
mov eax, dword [esi + 0x1c]
mov dword [ebp - 4], eax
mov ebx, eax
push edi
mov edi, 0xffff
mov dword [ebp - 8], edi
cmp ebx, edi
jae 0x4251dc
mov dword [ebp - 8], ebx
mov edi, ebx
push 0x404
call fcn.005056b6
add esp, 4
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x4251f9
pop edi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 4
mov dword [ebp - 0x14], 0xffffffff
cmp edi, eax
jbe 0x42530d
jmp 0x425219
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
add eax, 0x400
mov dword [ebp - 0xc], edi
cmp eax, edi
ja 0x425228
mov dword [ebp - 0xc], eax
mov eax, ebx
sub eax, dword [ebp - 0xc]
sub ebx, eax
mov dword [ebp - 0x1c], eax
cmp ebx, 0x404
jbe 0x42523f
mov ebx, 0x404
cmp byte [esi], 0
je 0x425264
cmp byte [esi + 1], 0
je 0x42530d
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push 0
push 0
add ecx, eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x425267
mov dword [esi + 0x1c], eax
cmp byte [esi], 0
mov edi, ebx
je 0x425290
mov ecx, dword [ebp - 0x10]
mov edx, dword [esi + 4]
push 0
lea eax, [ebp - 0x18]
push eax
push ebx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42528b
mov byte [esi + 8], 1
mov eax, dword [ebp - 0x18]
jmp 0x4252b9
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea edx, [eax + ebx]
cmp edx, ecx
jbe 0x4252a1
sub ecx, eax
mov edi, ecx
mov ecx, dword [esi + 0x14]
mov edx, dword [ebp - 0x10]
push edi
add ecx, eax
push ecx
push edx
call fcn.00509040
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div ebx
cmp eax, 1
jne 0x42530d
lea eax, [ebx - 3]
test eax, eax
js 0x4252fb
lea esp, [esp]
mov ecx, dword [ebp - 0x10]
dec eax
cmp byte [eax + ecx], 0x50
jne 0x4252ef
cmp byte [eax + ecx + 1], 0x4b
jne 0x4252ef
cmp byte [eax + ecx + 2], 5
jne 0x4252ef
cmp byte [eax + ecx + 3], 6
je 0x4252f5
test eax, eax
jns 0x4252d0
jmp 0x4252fb
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x42530d
mov edx, dword [ebp - 8]
cmp dword [ebp - 0xc], edx
jb 0x425210
mov eax, dword [ebp - 0x10]
push eax
call fcn.0050567c
mov eax, dword [ebp - 0x14]
add esp, 4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426070
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
cmp dword [esi], 0
push ebx
mov ebx, dword [ebp + 8]
push edi
jne 0x426137
cmp dword [esi + 4], 0xffffffff
jne 0x426137
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4260a2
sub eax, edx
sar eax, 1
movzx eax, word [esi + eax*2 + 0x242]
cmp eax, 0x5c
je 0x4260d9
cmp eax, 0x2f
je 0x4260d9
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4260c6
mov eax, dword [0x536fac]
mov dword [edi], eax
mov edi, dword [ebp + 0x10]
cmp edi, 1
jne 0x4260fd
push edi
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4260fd
mov eax, 0x2000000
pop edi
pop ebx
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
lea ecx, [ebp + 8]
push ecx
push edi
push edx
push ebx
call fcn.00424e00
add esp, 0x10
test eax, eax
jne 0x42611c
mov eax, dword [ebp + 8]
pop edi
pop ebx
pop ebp
ret 0xc
call fcn.00425330
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
add eax, 0x200
pop edi
pop ebx
pop ebp
ret 0xc
pop edi
mov eax, 0x1000000
pop ebx
pop ebp
ret 0xc

Function at 0x4268c0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x588790]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4268f4
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4268f4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x4269de
mov ecx, ebx
mov edx, ebx
cmp ax, 0x2f
je 0x426910
cmp ax, 0x5c
jne 0x426912
mov ecx, edx
movzx eax, word [edx + 2]
add edx, 2
test ax, ax
jne 0x426904
push edi
cmp ecx, ebx
je 0x426952
sub ecx, ebx
sar ecx, 1
lea edi, [ecx + ecx]
push edi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00509040
lea edx, [ebp - 0x414]
push edx
xor ecx, ecx
push esi
mov word [ebp + edi - 0x414], cx
call fcn.004268c0
add esp, 0x14
xor eax, eax
mov word [ebp - 0x20c], ax
test esi, esi
je 0x42697f
lea edx, [ebp - 0x20c]
mov eax, esi
sub edx, esi
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x426970
mov eax, ebx
mov edx, ebx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x426983
lea edi, [ebp - 0x20c]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4269a0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop edi
cmp eax, 0xffffffff
jne 0x4269de
push 0
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00503edf
mov esp, ebp
pop ebp
ret