joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459194
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push 0x144
mov eax, 0x535f28
call fcn.0049bb92
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 0x14]
or edi, 0xffffffff
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x120], 0xf
mov dword [ebp - 0x124], ebx
mov byte [ebp - 0x134], bl
push 0x104
push ebx
push 0x105
mov dword [ebp - 4], ebx
push eax
mov dword [esi], ebx
call fcn.004b16e0
push 0x105
lea eax, [ebp - 0x11c]
push ebx
push eax
call fcn.0049e130
add esp, 0x1c
lea eax, [ebp - 0x11c]
push eax
push ebx
push ebx
push 0x801a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x459219
mov dword [esi], 3
jmp 0x4593d3
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x134]
call fcn.00406270
push 0x57fc38
lea edx, [ebp - 0x134]
lea ecx, [ebp - 0x14c]
call fcn.0045a7d4
pop ecx
push eax
lea ecx, [ebp - 0x134]
call fcn.0042d8a0
lea ecx, [ebp - 0x14c]
call fcn.004062b0
cmp dword [ebp - 0x120], 0x10
lea eax, [ebp - 0x134]
push ebx
cmovae eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x459293
call ebx
cmp eax, 0xb7
je 0x459293
call ebx
cmp eax, 5
jne 0x45920e
push str.DeskUpdate
lea edx, [ebp - 0x134]
lea ecx, [ebp - 0x14c]
call fcn.0045a7d4
pop ecx
push eax
lea ecx, [ebp - 0x134]
call fcn.0042d8a0
lea ecx, [ebp - 0x14c]
call fcn.004062b0
cmp dword [ebp - 0x120], 0x10
lea eax, [ebp - 0x134]
push 0
cmovae eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4592f6
call ebx
cmp eax, 0xb7
je 0x4592f6
call ebx
cmp eax, 5
jne 0x45920e
push str.GlobalMgr.db
lea edx, [ebp - 0x134]
lea ecx, [ebp - 0x14c]
call fcn.0045a7d4
pop ecx
push eax
lea ecx, [ebp - 0x134]
call fcn.0042d8a0
lea ecx, [ebp - 0x14c]
call fcn.004062b0
cmp dword [ebp - 0x120], 0x10
lea eax, [ebp - 0x134]
push 0
cmovae eax, dword [ebp - 0x134]
push 0x80
push 3
push 0
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x459360
mov dword [esi], 0x50
jmp 0x4593a1
call ebx
cmp eax, 2
jne 0x45939b
cmp dword [ebp - 0x120], 0x10
lea eax, [ebp - 0x134]
push 0
cmovae eax, dword [ebp - 0x134]
push 0x80
push 2
push 0
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4593a6
mov dword [esi], 0x65f
cmp edi, 0xffffffff
je 0x4593d3
cmp dword [ebp - 0x120], 0x10
lea eax, [ebp - 0x134]
push 0x104
cmovae eax, dword [ebp - 0x134]
push eax
push 0x105
push dword [ebp - 0x150]
call fcn.004b075b
add esp, 0x10
lea ecx, [ebp - 0x134]
call fcn.004062b0
mov eax, edi
call fcn.0049bb4d
ret 0x10
Function at 0x45a04d
Capabilities:
Copy file
Delete file
Get file size
Read file on windows

Disassembly:
push 0x38
mov eax, 0x536141
call fcn.0049bb92
xor dl, dl
lea ecx, [ebp - 0x40]
xor ebx, ebx
call fcn.0045a280
push ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
push ebx
cmovae eax, dword [ebp - 0x40]
xor ecx, ecx
push 3
push ebx
inc ecx
push ecx
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x45a11a
xor eax, eax
lea ecx, [ebp - 0x28]
lea edx, [eax + 1]
call fcn.0045a280
lea ecx, [ebp - 0x40]
call fcn.0045a6cf
test al, al
jne 0x45a0ed
lea ecx, [ebp - 0x28]
call fcn.0045a6cf
test al, al
je 0x45a0ed
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
push ebx
cmovae ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x45a0ed
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ebx
cmovae eax, dword [ebp - 0x28]
push ebx
push 3
push ebx
push 1
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.00403110
cmp esi, 0xffffffff
je 0x45a155
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x10
jb 0x45a14e
push ebx
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], ebx
push eax
push 0x10
push section..QMGuid
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45a14e
cmp dword [ebp - 0x44], 0x10
push 1
movzx ebx, bl
pop ecx
cmove ebx, ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x40]
call fcn.00403110
mov al, bl
call fcn.0049bb4d
ret 4

Function at 0x45a167
Capabilities:
Write file on windows

Disassembly:
push 0x38
mov eax, 0x536141
call fcn.0049bb92
xor dl, dl
lea ecx, [ebp - 0x40]
xor ebx, ebx
call fcn.0045a280
push ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
push ebx
cmovae eax, dword [ebp - 0x40]
xor ecx, ecx
push 2
push ebx
inc ecx
push ecx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x45a1e3
xor eax, eax
lea ecx, [ebp - 0x28]
lea edx, [eax + 1]
call fcn.0045a280
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ebx
cmovae eax, dword [ebp - 0x28]
push ebx
push 2
push ebx
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.00403110
cmp esi, 0xffffffff
je 0x45a20e
push ebx
lea eax, [ebp - 0x44]
push eax
push 0x10
push section..QMGuid
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x45a207
cmp dword [ebp - 0x44], 0x10
push 1
movzx ebx, bl
pop ecx
cmove ebx, ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x40]
call fcn.00403110
mov al, bl
call fcn.0049bb4d
ret 4
Function at 0x45a280
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0x234
mov eax, 0x536193
call fcn.0049bb92
mov bl, dl
mov esi, ecx
mov dword [ebp - 0x23c], esi
xor eax, eax
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x238], eax
mov dword [esi + 0x10], eax
push eax
mov dword [esi + 0x14], 7
call fcn.00403070
and dword [ebp - 4], 0
lea eax, [ebp - 0x21c]
push 0x208
xor edi, edi
push 0
inc edi
push eax
mov dword [ebp - 0x238], edi
call fcn.0049e130
add esp, 0xc
test bl, bl
push edi
push 0x23
pop eax
push 0x1a
pop ecx
cmovne eax, ecx
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x45a35f
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x234]
call fcn.00404170
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.00404530
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 0
call fcn.00403110
mov ecx, esi
test bl, bl
je 0x45a337
push 0x57fcc0
jmp 0x45a33c
push 0x57fc9c
call fcn.00404070
mov ecx, esi
call fcn.0045a367
test al, al
jne 0x45a353
mov ecx, esi
call fcn.0045a429
push 0x57fc84
mov ecx, esi
call fcn.00404070
mov eax, esi
call fcn.0049bb4d
ret
Function at 0x45a429
Capabilities:
Create directory

Disassembly:
push 0x6a4
mov eax, 0x53624b
call fcn.0049bb92
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x10], ebx
sete al
test al, al
je 0x45a44d
xor al, al
jmp 0x45a6bc
push esi
lea ecx, [ebp - 0x67c]
call fcn.00402120
mov dword [ebp - 4], ebx
cmp dword [esi + 0x14], 8
mov eax, dword [esi + 0x10]
jb 0x45a467
mov esi, dword [esi]
push 0x5c
pop ecx
cmp word [esi + eax*2 - 2], cx
je 0x45a4a2
push 0x57fbec
lea ecx, [ebp - 0x664]
call fcn.00404170
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x67c]
mov byte [ebp - 4], 1
call fcn.00404530
lea ecx, [ebp - 0x664]
mov byte [ebp - 4], bl
call fcn.00403110
cmp dword [ebp - 0x668], 8
lea ecx, [ebp - 0x41c]
mov edx, 0x100
lea eax, [ebp - 0x67c]
cmovae eax, dword [ebp - 0x67c]
push edx
push ecx
push edx
lea ecx, [ebp - 0x61c]
push ecx
push edx
lea ecx, [ebp - 0x21c]
push ecx
push 3
lea ecx, [ebp - 0x1c]
push ecx
push eax
call fcn.004b0a2e
add esp, 0x24
lea ecx, [ebp - 0x694]
push 0x57fbec
call fcn.00404170
mov esi, eax
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x664]
call fcn.00404170
push esi
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x64c]
call fcn.00410c70
pop ecx
lea ecx, [ebp - 0x664]
call fcn.00403110
lea ecx, [ebp - 0x694]
mov byte [ebp - 4], 6
call fcn.00403110
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x634]
call fcn.00404170
lea ecx, [ebp - 0x64c]
mov byte [ebp - 4], 7
call fcn.0045a367
test al, al
je 0x45a699
cmp dword [ebp - 0x624], 0
sete al
test al, al
jne 0x45a699
cmp dword [ebp - 0x620], 8
lea eax, [ebp - 0x634]
push 0x5c
cmovae eax, dword [ebp - 0x634]
pop ecx
cmp word [eax], cx
jne 0x45a5b2
cmp dword [ebp - 0x620], 8
lea eax, [ebp - 0x634]
lea ecx, [ebp - 0x634]
cmovae eax, dword [ebp - 0x634]
push eax
lea eax, [ebp - 0x6b0]
push eax
call fcn.0045a79c
push ecx
push ecx
lea ecx, [ebp - 0x634]
call fcn.0045a725
mov esi, eax
jmp 0x45a68e
push esi
push ebx
lea eax, [ebp - 0x664]
push eax
lea ecx, [ebp - 0x634]
call fcn.00404000
lea eax, [esi + 1]
mov byte [ebp - 4], 8
push eax
push ebx
lea ecx, [ebp - 0x634]
call fcn.00402630
push 0x57fbec
lea ecx, [ebp - 0x6ac]
call fcn.00404170
push eax
lea edx, [ebp - 0x664]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x694]
call fcn.0045a837
pop ecx
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x64c]
mov byte [ebp - 4], 0xa
call fcn.00404530
lea ecx, [ebp - 0x694]
call fcn.00403110
lea ecx, [ebp - 0x6ac]
mov byte [ebp - 4], 8
call fcn.00403110
lea ecx, [ebp - 0x64c]
call fcn.0045a367
test al, al
jne 0x45a670
cmp dword [ebp - 0x638], 8
lea eax, [ebp - 0x64c]
cmovae eax, dword [ebp - 0x64c]
push eax
call fcn.004b0c88
pop ecx
test eax, eax
jne 0x45a6c2
push ecx
push ecx
lea ecx, [ebp - 0x634]
call fcn.0045a725
lea ecx, [ebp - 0x664]
mov byte [ebp - 4], 7
mov esi, eax
call fcn.00403110
cmp esi, 0xffffffff
jne 0x45a5c6
mov bl, 1
lea ecx, [ebp - 0x634]
call fcn.00403110
lea ecx, [ebp - 0x64c]
call fcn.00403110
lea ecx, [ebp - 0x67c]
call fcn.00403110
mov al, bl
call fcn.0049bb4d
ret
lea ecx, [ebp - 0x664]
call fcn.00403110
jmp 0x45a699
Function at 0x45aeb2
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd40
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor bl, bl
mov dword [ebp - 0xd3c], edx
push edi
mov dword [ebp - 0xd38], ecx
xor esi, esi
mov dword [ebp - 0xd40], eax
test bl, bl
jne 0x45b0fc
push 0x200
lea eax, [ebp - 0x50c]
push 0
push eax
call fcn.0049e130
add esp, 0xc
lea eax, [ebp - 0x50c]
push esi
push 0x57fd50
push 0xffffffffffffffff
push 0xff
push eax
call fcn.00401560
add esp, 0x14
xor eax, eax
push eax
push eax
push 3
push eax
push 3
push eax
lea eax, [ebp - 0x50c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x45b0f2
and dword [ebp - 0xd34], 0
lea eax, [ebp - 0xd18]
push 0xc
push 0
push eax
call fcn.0049e130
add esp, 0xc
xor eax, eax
mov dword [ebp - 0xd18], eax
mov dword [ebp - 0xd14], eax
push 0x800
push eax
lea eax, [ebp - 0xd0c]
push eax
call fcn.0049e130
add esp, 0xc
lea eax, [ebp - 0xd34]
push 0
push eax
push 0x800
lea eax, [ebp - 0xd0c]
push eax
push 0xc
lea eax, [ebp - 0xd18]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x45b0e5
push 0x100
lea eax, [ebp - 0x10c]
push 0
push eax
call fcn.0049e130
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x100
push 0
push eax
call fcn.0049e130
add esp, 0xc
lea eax, [ebp - 0x30c]
push 0x100
push 0
push eax
call fcn.0049e130
mov edx, dword [ebp - 0xcfc]
lea eax, [ebp - 0x20c]
add esp, 0xc
lea ecx, [ebp - 0xd0c]
push eax
push 0
call fcn.0045a968
mov edx, dword [ebp - 0xcf8]
lea eax, [ebp - 0x30c]
push eax
push 0
lea ecx, [ebp - 0xd0c]
call fcn.0045a968
mov edx, dword [ebp - 0xcf4]
lea eax, [ebp - 0x10c]
push eax
push 1
lea ecx, [ebp - 0xd0c]
call fcn.0045a968
movsx eax, byte [ebp - 0x10c]
push eax
call fcn.004b1a75
add esp, 0x1c
test eax, eax
jne 0x45b066
movsx eax, byte [ebp - 0xf9]
push eax
call fcn.004b1a75
pop ecx
test eax, eax
je 0x45b0eb
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0xd30]
call fcn.00409230
mov ecx, dword [ebp - 0xd38]
push eax
call fcn.0042d8a0
lea ecx, [ebp - 0xd30]
call fcn.004062b0
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0xd30]
call fcn.00409230
mov ecx, dword [ebp - 0xd3c]
push eax
call fcn.0042d8a0
lea ecx, [ebp - 0xd30]
call fcn.004062b0
lea eax, [ebp - 0x30c]
push eax
lea ecx, [ebp - 0xd30]
call fcn.00409230
mov ecx, dword [ebp - 0xd40]
push eax
call fcn.0042d8a0
lea ecx, [ebp - 0xd30]
call fcn.004062b0
mov bl, 1
jmp 0x45b0eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, 0x10
jl 0x45aee1
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049aa22
mov esp, ebp
pop ebp
ret
Function at 0x45b7b7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor eax, eax
push 3
pop esi
inc eax
mov dword [ebp - 0x10c], 0x104
mov dword [ebp - 0x110], eax
mov ebx, ecx
lea eax, [ebp - 0x11c]
xor ecx, ecx
push eax
push 0x20019
push ecx
push 0x57fd90
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x114], ecx
call edi
test eax, eax
jne 0x45b972
push ebx
push 0x57fd7c
push 0xffffffffffffffff
lea eax, [ebp - 0x108]
push 0x103
push eax
call fcn.00459000
add esp, 0x14
lea eax, [ebp - 0x118]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x11c]
call edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x45b96a
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 4
pop eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push 0x57fe28
push dword [ebp - 0x118]
call ebx
test eax, eax
jne 0x45b962
push 0x104
push eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x110], 1
push eax
mov dword [ebp - 0x10c], 0x103
call fcn.0049e130
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push 0x57fe18
push dword [ebp - 0x118]
call ebx
test eax, eax
jne 0x45b962
mov eax, dword [ebp - 0x114]
cmp eax, 1
jne 0x45b959
mov ebx, 0x57fe14
push ebx
call fcn.004b0770
push eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.004b0c10
add esp, 0x10
test eax, eax
jne 0x45b928
xor esi, esi
jmp 0x45b962
mov eax, dword [ebp - 0x114]
cmp eax, 1
jne 0x45b959
push ebx
call fcn.004b0770
push eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.004b0c10
add esp, 0x10
test eax, eax
je 0x45b953
push 2
pop esi
jmp 0x45b962
mov eax, dword [ebp - 0x114]
cmp eax, 2
push 1
pop eax
cmove esi, eax
push dword [ebp - 0x118]
call edi
push dword [ebp - 0x11c]
call edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049aa22
mov esp, ebp
pop ebp
ret
Function at 0x45d472
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 0x14
mov eax, 0x53651f
call fcn.0049bb5e
mov esi, ecx
push esi
lea ecx, [ebp - 0x10]
xor edi, edi
call fcn.0045ceb5
mov dword [ebp - 4], edi
mov eax, dword [0x59b040]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0x10
je 0x45d598
mov esi, dword [ebp - 0x10]
mov eax, dword [esi - 8]
cmp word [esi + eax*2 - 2], 0x5c
je 0x45d4d2
mov esi, 0x57fbec
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.0045d27c
mov esi, dword [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x10]
call fcn.0045cfc9
cmp eax, 0xffffffff
je 0x45d598
lea ebx, [esi - 8]
mov dword [ebp - 0x1c], ebx
lea esi, [eax + 1]
push esi
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x10]
call fcn.0045cf52
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
mov eax, dword [eax]
push eax
push dword [eax - 8]
call fcn.0045d27c
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.0045d163
mov ebx, dword [ebx]
test esi, esi
jle 0x45d567
test ebx, ebx
jle 0x45d567
cmp esi, ebx
lea ecx, [ebp - 0x10]
cmovg esi, ebx
mov dword [ebp - 0x18], esi
call fcn.0045d30f
mov eax, ebx
sub eax, esi
mov esi, dword [ebp - 0x10]
lea eax, [eax*2 + 2]
push eax
mov eax, dword [ebp - 0x18]
lea eax, [esi + eax*2]
push eax
mov eax, dword [esi - 4]
lea eax, [eax*2 + 2]
push eax
push esi
call fcn.00403da0
add esp, 0x10
lea eax, [esi - 8]
sub ebx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov dword [eax], ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x45d583
push edi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x45d59b
push ecx
lea ecx, [ebp - 0x10]
call fcn.0045cfc9
mov ebx, dword [ebp - 0x1c]
cmp eax, 0xffffffff
jne 0x45d4ea
xor edi, edi
inc edi
lea ecx, [ebp - 0x14]
call fcn.0045d163
lea ecx, [ebp - 0x10]
call fcn.0045d163
mov eax, edi
call fcn.0049bb38
ret
Function at 0x45d8cd
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Get file attributes

Disassembly:
push 0x54
mov eax, 0x536615
call fcn.0049bb92
mov edi, ecx
lea ecx, [ebp - 0x44]
xor ebx, ebx
call fcn.004635dc
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x2c]
push ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 7
call fcn.00403070
mov byte [ebp - 4], 1
cmp dword [edi + 0x10], ebx
sete al
test al, al
je 0x45d937
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x44]
call fcn.00463324
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
cmp ecx, eax
je 0x45d929
push 0xffffffffffffffff
push ebx
push eax
call fcn.004026e0
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.00403110
jmp 0x45d949
lea eax, [ebp - 0x2c]
cmp eax, edi
je 0x45d949
push 0xffffffffffffffff
push ebx
push edi
mov ecx, eax
call fcn.004026e0
lea ecx, [ebp - 0x2c]
call fcn.004633d0
push 0x580144
lea ecx, [ebp - 0x5c]
call fcn.00404170
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x2c]
call fcn.004634f5
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.00403110
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmovae eax, dword [ebp - 0x2c]
push eax
call esi
cmp eax, 0xffffffff
je 0x45d99b
mov dword [edi + 0x18], ebx
jmp 0x45da66
lea ecx, [ebp - 0x44]
mov dword [edi + 0x18], 1
call fcn.00463255
push 0x58013c
lea ecx, [ebp - 0x5c]
call fcn.00404170
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x44]
call fcn.00463478
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.00403110
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push eax
call esi
cmp eax, 0xffffffff
je 0x45d9fb
lea ecx, [edi + 0x5c]
lea eax, [ebp - 0x44]
cmp ecx, eax
je 0x45da64
push 0xffffffffffffffff
push ebx
push eax
call fcn.004026e0
jmp 0x45da64
push str.SKIN
push str.IDR_QMUI_DAT
push dword [0x59e5dc]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x45da66
push esi
push dword [0x59e5dc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x45da66
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x60], eax
test eax, eax
je 0x45da66
push esi
push dword [0x59e5dc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ecx
mov esi, eax
lea ecx, [edi + 0x84]
push esi
call fcn.0045f34b
push esi
push dword [ebp - 0x60]
push dword [edi + 0x84]
call fcn.0049dbb0
add esp, 0xc
mov bl, 1
lea ecx, [ebp - 0x2c]
call fcn.00403110
lea ecx, [ebp - 0x44]
call fcn.00403110
mov al, bl
call fcn.0049bb4d
ret
Function at 0x45db4b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x1b4
mov eax, 0x536650
call fcn.0049bb92
mov ebx, ecx
xor eax, eax
mov dword [ebp - 0x13c], 0xf
mov dword [ebp - 0x140], eax
mov byte [ebp - 0x150], al
mov dword [ebp - 4], eax
lea edx, [ebx + 0x5c]
lea ecx, [ebp - 0x168]
mov dword [ebp - 0x138], 0x462ec6
mov dword [ebp - 0x134], 0x462f4e
mov dword [ebp - 0x130], 0x462f94
mov dword [ebp - 0x12c], 0x462fda
mov dword [ebp - 0x128], 0x463013
mov dword [ebp - 0x124], 0x46306c
mov dword [ebp - 0x120], 0x463097
mov dword [ebp - 0x11c], eax
call fcn.00461e6f
push eax
lea ecx, [ebp - 0x150]
call fcn.0042d8a0
lea ecx, [ebp - 0x168]
call fcn.004062b0
cmp dword [ebp - 0x13c], 0x10
lea ecx, [ebp - 0x150]
lea edx, [ebp - 0x138]
cmovae ecx, dword [ebp - 0x150]
call fcn.004623f4
mov dword [ebx + 0x7c], eax
test eax, eax
jne 0x45dcfb
lea edi, [ebx + 0x84]
push edi
call fcn.004b0770
pop ecx
test eax, eax
jne 0x45dc96
push str.SKIN
push str.IDR_QMUI_DAT
push dword [0x59e5dc]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x45ddc2
push esi
push dword [0x59e5dc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x45ddc2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x16c], eax
test eax, eax
je 0x45ddc2
push esi
push dword [0x59e5dc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ecx
mov esi, eax
mov ecx, edi
push esi
call fcn.0045f34b
push esi
push dword [ebp - 0x16c]
push dword [edi]
call fcn.0049dbb0
add esp, 0xc
and dword [ebp - 0x11c], 0
lea edx, [ebp - 0x138]
mov ecx, edi
mov dword [ebp - 0x138], 0x45d38c
mov dword [ebp - 0x134], 0x45d394
mov dword [ebp - 0x130], 0x45d3de
mov dword [ebp - 0x12c], 0x45d44c
mov dword [ebp - 0x128], 0x45d426
mov dword [ebp - 0x124], 0x45d462
mov dword [ebp - 0x120], fcn.004080f0
call fcn.004623f4
mov dword [ebx + 0x7c], eax
test eax, eax
je 0x45ddc2
mov ecx, eax
call fcn.00462872
jmp 0x45ddba
mov ecx, dword [ebx + 0x7c]
lea eax, [ebp - 0x118]
sub esp, 0x10
lea edx, [ebp - 0x1c0]
push 0x104
push eax
push 0
call fcn.00462627
add esp, 0x1c
test eax, eax
jne 0x45ddc2
mov eax, dword [ebx + 0x7c]
test eax, eax
jne 0x45dd3d
push 0xffffffffffffff9a
pop edi
jmp 0x45dd5e
cmp dword [eax + 0x38], 0
jne 0x45dd47
xor edi, edi
jmp 0x45dd5e
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x45dd5b
cmp ecx, 0xffff
je 0x45dd5b
cmp dword [eax + 0x30], ecx
je 0x45dd43
mov edi, dword [eax + 0x34]
mov esi, dword [ebp - 0x1a4]
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x138]
call fcn.00409230
mov dword [ebp - 0x120], edi
mov dword [ebp - 0x11c], esi
mov byte [ebp - 4], 1
lea eax, [ebp - 0x138]
push dword [ebp - 0x16c]
push eax
push ecx
lea eax, [ebp - 0x170]
push eax
lea ecx, [ebx + 0x1c]
call fcn.0045f416
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 0
call fcn.004062b0
mov ecx, dword [ebx + 0x7c]
call fcn.004628ac
test eax, eax
je 0x45dd07
lea ecx, [ebp - 0x150]
call fcn.004062b0
xor al, al
call fcn.0049bb4d
ret