joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d8be1
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, eax
cmp dword [edi + 0x13a0], 0
je 0x4d8d82
lea ecx, [edi + 0x664]
mov dword [ebp - 8], ecx
call fcn.00536545
push eax
mov dword [ebp - 0x10], eax
call fcn.0049e596
mov ecx, eax
call fcn.0049ea21
and dword [eax + 0x6770], 0
push dword [edi + 0x1550]
mov dword [ebp - 0xc], eax
call fcn.004ab9aa
mov ebx, eax
call fcn.004ac4cf
mov esi, eax
xor ebx, ebx
mov dword [ebp - 4], esi
cmp esi, ebx
jne 0x4d8c58
push 1
lea ecx, [edi + 0x1428]
call fcn.004bae85
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x4d8d6c
mov esi, eax
push 0x13
push ebx
push ebx
push ebx
push ebx
push 0xfffffffffffffffe
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
push ebx
push dword [edi + 4]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
call ebx
push 0
push 0xf060
push 0x112
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4d8c9b
push 9
jmp 0x4d8caa
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4d8caf
push 5
push dword [esi + 4]
call ebx
mov ebx, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
call fcn.00526ec6
push eax
mov eax, dword [ebp - 8]
call fcn.00535f16
mov edi, eax
test edi, edi
je 0x4d8d58
push 1
add esi, 0x1428
push 0xffffffffffffffff
call fcn.004ba80f
test esi, esi
je 0x4d8ce5
lea eax, [esi + 0x24]
jmp 0x4d8ce7
xor eax, eax
mov dword [edi + 0x114], eax
test esi, esi
je 0x4d8cf6
lea eax, [esi + 0x28]
jmp 0x4d8cf8
xor eax, eax
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov dword [ebx + 0x6634], eax
mov eax, dword [esi + 4]
mov ecx, dword [edi + 4]
mov esi, ebx
call fcn.00498423
push 1
mov eax, ebx
call fcn.00498976
mov ecx, dword [edi + 0x674]
sub ecx, dword [edi + 0x66c]
push 0
push ecx
mov ecx, dword [edi + 0x670]
sub ecx, dword [edi + 0x668]
lea esi, [edi + 0x664]
mov eax, dword [esi]
push ecx
push dword [edi + 0x66c]
mov ecx, esi
push dword [edi + 0x668]
call dword [eax + 0x28]
push 0
call fcn.00527218
mov esi, edi
push 0
mov eax, esi
call fcn.004d6e85
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor ebx, ebx
mov esi, dword [ebp - 0xc]
cmp dword [esi + 0x6658], ebx
je 0x4d8d82
push ebx
push 0x25a
call fcn.0049a4cf
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4d9ba2
Capabilities:
Check if file exists
Enumerate gui resources

Disassembly:
push 0x1c
mov eax, 0x5c1809
call fcn.00598f2b
mov ebx, ecx
call fcn.0051545f
push 0x208
xor edi, edi
push edi
mov esi, 0x637cc0
push esi
call fcn.00596530
add esp, 0xc
cmp ebx, edi
je 0x4d9bfb
cmp word [ebx], di
je 0x4d9bfb
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d9bfb
push 0x7ffffffe
mov eax, ebx
mov ecx, 0x104
mov edx, esi
call fcn.004054ba
push edi
push edi
call fcn.0051536d
pop ecx
pop ecx
call fcn.004d9879
push edi
push 0x4d9b62
call dword [sym.imp.USER32.dll_EnumWindows]
lea eax, [ebp - 0x28]
push eax
call fcn.00440517
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 4], edi
call fcn.004ab9aa
mov ebx, eax
call fcn.004ac52f
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], edi
sar eax, 2
test eax, eax
jbe 0x4d9c85
mov edi, dword [ebp - 0x10]
lea esi, [ebp - 0x28]
call fcn.004750c1
mov esi, dword [eax]
xor edi, edi
push edi
push str.caption_icon
call fcn.0051552e
pop ecx
pop ecx
push edi
push eax
push 0x890
lea ebx, [esi + 0xfc]
call fcn.00526f0a
push edi
mov eax, esi
mov dword [esi + 0x14a4], edi
call fcn.004d6e85
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
inc dword [ebp - 0x10]
sar eax, 2
cmp dword [ebp - 0x10], eax
jb 0x4d9c38
call fcn.004d63e1
lea esi, [ebp - 0x28]
call fcn.0047509e
call fcn.00599003
ret

Function at 0x4d9c98
Capabilities:
Check if file exists
Enumerate gui resources

Disassembly:
push 0x1c
mov eax, 0x5c1809
call fcn.00598f2b
xor edi, edi
cmp dword [0x6bb4a4], edi
je 0x4d9cc8
cmp dword [0x639514], edi
je 0x4d9cc8
push str.BINARY
push dword [0x639508]
mov ebx, str.IDR_IE6_SKIN
jmp 0x4d9cdf
mov ebx, 0x637cc0
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d9ce8
call fcn.0051545f
push edi
push edi
call fcn.0051536d
pop ecx
pop ecx
jmp 0x4d9ced
call fcn.0051545f
call fcn.004d9879
push edi
push 0x4d9b62
call dword [sym.imp.USER32.dll_EnumWindows]
lea eax, [ebp - 0x28]
push eax
call fcn.00440517
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 4], edi
call fcn.004ab9aa
mov ebx, eax
call fcn.004ac52f
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
sar eax, 2
test eax, eax
jbe 0x4d9d67
lea esi, [ebp - 0x28]
call fcn.004750c1
mov esi, dword [eax]
push 0
push str.caption_icon
call fcn.0051552e
pop ecx
pop ecx
push 0
push eax
push 0x890
lea ebx, [esi + 0xfc]
call fcn.00526f0a
and dword [esi + 0x14a4], 0
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
inc edi
sar eax, 2
cmp edi, eax
jb 0x4d9d27
lea esi, [ebp - 0x28]
call fcn.0047509e
call fcn.00599003
ret
Function at 0x4df994
Capabilities:
Reference cloudflare dns server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, eax
xor eax, eax
push esi
push edi
mov word [ebp - 0x10], ax
lea edi, [ebp - 0xe]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 2]
push eax
movzx eax, word [ebp - 4]
push eax
movzx eax, word [ebp - 6]
push eax
movzx eax, word [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
push eax
push str._04d_02d_02d_02d_02d_02d_03d
mov esi, 0x103
push esi
push ebx
call fcn.0058f42f
add esp, 0x28
mov edi, str.1.0.0.1
push edi
push ebx
push 0x5f6c54
call fcn.004040a8
push eax
push str._s_s_s_ver_s_.jzs
lea eax, [ebx + 0x208]
push esi
push eax
call fcn.0058f42f
push edi
push esi
add ebx, 0x410
push ebx
call fcn.0058f42f
add esp, 0x28
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret

Function at 0x4dfa2b
Capabilities:
Get file size

Disassembly:
push esi
push edi
xor edi, edi
push edi
push 0x20
push 3
push edi
push 3
push 0x80000000
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4dfa68
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, edi
je 0x4dfa61
cmp eax, 0xa00000
ja 0x4dfa61
inc edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret 4
Function at 0x4dfa6f
Capabilities:
Enumerate files on windows

Disassembly:
push 0xa88
mov eax, 0x5b966d
call fcn.00598f94
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa94], eax
xor eax, eax
mov esi, 0x206
xor ebx, ebx
push esi
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
mov edi, ecx
mov dword [ebp - 0xa90], ebx
call fcn.00596530
add esp, 0xc
cmp edi, ebx
je 0x4dfad5
cmp word [edi], bx
je 0x4dfad5
push edi
push str._s_ver_.jzs
lea eax, [ebp - 0x21c]
push 0x103
push eax
call fcn.0058f42f
add esp, 0x10
jmp 0x4dfaee
push str._ver_.jzs
lea eax, [ebp - 0x21c]
push 0x103
push eax
call fcn.0058f42f
add esp, 0xc
xor eax, eax
push esi
mov word [ebp - 0x424], ax
lea eax, [ebp - 0x422]
push ebx
push eax
call fcn.00596530
add esp, 0xc
push 0x5f6c54
call fcn.004040a8
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push eax
lea eax, [ebp - 0x424]
push eax
call edi
xor eax, eax
push esi
mov word [ebp - 0x62c], ax
lea eax, [ebp - 0x62a]
push ebx
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x62c]
push eax
call edi
push 0x24c
lea eax, [ebp - 0xa80]
push ebx
push eax
mov dword [ebp - 0xa84], ebx
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0xa84]
push eax
lea eax, [ebp - 0x62c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xa8c], eax
cmp eax, 0xffffffff
jne 0x4dfb94
xor eax, eax
jmp 0x4dfc71
lea eax, [ebp - 0xa58]
push 0x5e23ec
push eax
call fcn.0058f69a
pop ecx
pop ecx
test eax, eax
je 0x4dfc44
lea eax, [ebp - 0xa58]
push 0x5ed394
push eax
call fcn.0058f69a
pop ecx
pop ecx
test eax, eax
je 0x4dfc44
test byte [ebp - 0xa84], 0x10
jne 0x4dfc44
xor eax, eax
push esi
mov word [ebp - 0x834], ax
lea eax, [ebp - 0x832]
push ebx
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0xa58]
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x834]
push eax
call edi
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0xa88]
push eax
call fcn.00407b16
lea eax, [ebp - 0xa88]
push eax
mov eax, dword [ebp - 0xa94]
mov dword [ebp - 4], ebx
call fcn.004402ba
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xa88]
add eax, 0xfffffff0
call fcn.00407b6b
mov dword [ebp - 0xa90], 1
lea eax, [ebp - 0xa84]
push eax
push dword [ebp - 0xa8c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4dfb94
push dword [ebp - 0xa8c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0xa90]
call fcn.00599017
ret 4

Function at 0x4dfdf2
Capabilities:
Suspend thread
Terminate thread

Disassembly:
mov eax, dword [esi + 0xc]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x4dfe47
push edi
push ebx
push ebx
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
push dword [esi + 0xc]
push ebx
push 0x1f03ff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
cmp edi, ebx
je 0x4dfe43
push 0x3e8
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4dfe3c
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], ebx
pop edi
pop ebx
ret
Function at 0x4e1017
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x51c
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x51c], eax
xor eax, eax
push 0x7e
push eax
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x82]
push eax
mov dword [ebp - 0x518], 1
call fcn.00596530
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x514], ax
lea eax, [ebp - 0x512]
push eax
call fcn.00596530
add esp, 0x18
lea ebx, [ebp - 0x514]
call fcn.0047ff31
mov eax, ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push 0x3f
pop ebx
test eax, eax
je 0x4e10f8
lea esi, [ebp - 0x84]
lea edi, [ebp - 0x514]
call fcn.00475e02
test eax, eax
je 0x4e10f8
mov eax, esi
push str.10.0.0.0
push eax
call fcn.00475ebf
pop ecx
pop ecx
test eax, eax
jl 0x4e10f1
cmp dword [0x63a5a8], 0
je 0x4e10f8
cmp dword [0x63a5b0], 0
jne 0x4e1105
mov eax, esi
push str.11.3.0.0
push eax
call fcn.00475ebf
pop ecx
pop ecx
test eax, eax
jl 0x4e10f8
mov eax, esi
push str.11.3.300.268
push eax
call fcn.00475ebf
pop ecx
pop ecx
test eax, eax
jge 0x4e10f8
and dword [ebp - 0x518], 0
cmp dword [0x63a5b0], 0
je 0x4e11cd
lea eax, [ebp - 0x84]
push str.12.0.0.0
push eax
call fcn.00475ebf
pop ecx
pop ecx
test eax, eax
jge 0x4e11cd
xor eax, eax
push 0x7e
push eax
mov word [ebp - 0x104], ax
lea eax, [ebp - 0x102]
push eax
call fcn.00596530
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x30c], ax
lea eax, [ebp - 0x30a]
push eax
call fcn.00596530
add esp, 0x18
push str.Installer
push 0x63c268
lea eax, [ebp - 0x30c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.flash_flash.ocx
lea eax, [ebp - 0x30c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x30c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4e11cd
lea esi, [ebp - 0x104]
lea edi, [ebp - 0x30c]
call fcn.00475e02
test eax, eax
je 0x4e11cd
mov eax, esi
push str.10.0.0.0
push eax
call fcn.00475ebf
pop ecx
pop ecx
test eax, eax
jl 0x4e11cd
mov ecx, dword [ebp - 0x51c]
xor eax, eax
inc eax
mov dword [ebp - 0x518], eax
test ecx, ecx
je 0x4e11cd
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x518]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058f3cf
leave
ret
Function at 0x4e517a
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x104c]
mov eax, 0x104c
call fcn.005a41d0
push 0xffffffffffffffff
push 0x5b47c3
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp + 0x1048], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
cmp ax, word [0x63b6e0]
je 0x4e52ba
and dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0x5d43f8
mov esi, 0x63696c
mov eax, dword [0x63696c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push dword [ebp - 0x10]
xor edi, edi
push 0x63b6e0
push str.cookie:_s__s_
lea eax, [ebp - 0x14]
mov dword [ebp - 4], edi
call fcn.00404f66
add esp, 0xc
lea eax, [ebp - 0x14]
call fcn.004187e2
push 0x1047
lea eax, [ebp + 1]
push edi
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x20], 0x1048
mov dword [ebp], 0x1048
call dword [sym.imp.WININET.dll_GetUrlCacheEntryInfoW]
test eax, eax
je 0x4e5297
mov eax, dword [0x63696c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
mov eax, dword [0x63b8f0]
neg eax
sbb eax, eax
and eax, 3
add eax, dword [ebp - 0x18]
push eax
call fcn.004040a8
push eax
push str._suser_d.dat
lea eax, [ebp - 0x1c]
call fcn.00404f66
add esp, 0xc
push edi
mov edi, dword [ebp - 0x1c]
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 2
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [edi - 0x10]
call fcn.00407b6b
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00407b6b
add dword [ebp - 0x10], 0x20
inc dword [ebp - 0x18]
cmp dword [ebp - 0x10], 0x5d4458
jl 0x4e51d4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x1048]
xor ecx, ebp
call fcn.0058f3cf
add ebp, 0x104c
leave
ret
Function at 0x4e52dc
Capabilities:
Check if file exists
Copy file
Get session user name

Disassembly:
push 0x224
mov eax, 0x5b478b
call fcn.00598f94
call fcn.004e50a4
xor eax, eax
cmp ax, word [0x63b6e0]
jne 0x4e5326
lea eax, [ebp - 0x21c]
push eax
push 0x63b6e0
mov dword [ebp - 0x21c], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor eax, eax
cmp ax, word [0x63b6e0]
je 0x4e54aa
and dword [ebp - 0x21c], 0
mov dword [ebp - 0x220], 0x5d43f8
mov esi, 0x63696c
mov eax, dword [0x63696c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x228], eax
push dword [ebp - 0x220]
and dword [ebp - 4], 0
push 0x63b6e0
push str.cookie:_s__s_
lea eax, [ebp - 0x228]
call fcn.00404f66
add esp, 0xc
lea eax, [ebp - 0x228]
call fcn.004187e2
mov ebx, dword [ebp - 0x228]
push ebx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
mov eax, dword [0x63696c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x224], eax
mov byte [ebp - 4], 1
mov eax, dword [0x63b8f0]
neg eax
sbb eax, eax
and eax, 3
add eax, dword [ebp - 0x21c]
push eax
call fcn.004040a8
push eax
push str._suser_d.dat
lea eax, [ebp - 0x224]
call fcn.00404f66
mov edi, dword [ebp - 0x224]
add esp, 0xc
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4e5479
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.00596530
add esp, 0xc
push 0
lea eax, [ebp - 0x218]
push eax
push 0x5e9dac
push 0
push ebx
call dword [sym.imp.WININET.dll_CreateUrlCacheEntryW]
test eax, eax
je 0x4e5479
cmp word [ebp - 0x218], 0
je 0x4e5479
push 0
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
and dword [ebp - 0x230], 0
push ebx
xor eax, eax
push eax
push eax
push eax
push 0x100000
lea edi, [ebp - 0x22c]
stosd dword es:[edi], eax
push dword [ebp - 0x22c]
lea eax, [ebp - 0x218]
push dword [ebp - 0x230]
push dword [ebp - 0x22c]
push dword [ebp - 0x230]
push eax
push ebx
call dword [sym.imp.WININET.dll_CommitUrlCacheEntryW]
mov edi, dword [ebp - 0x224]
lea eax, [edi - 0x10]
call fcn.00407b6b
or dword [ebp - 4], 0xffffffff
lea eax, [ebx - 0x10]
call fcn.00407b6b
add dword [ebp - 0x220], 0x20
inc dword [ebp - 0x21c]
cmp dword [ebp - 0x220], 0x5d4458
jl 0x4e533c
call fcn.00599017
ret
Function at 0x4ebaf2
Capabilities:
Check if file exists

Disassembly:
push 8
mov eax, 0x5c09a4
call fcn.00598f2b
mov edi, ecx
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4ebb8c
push dword [ebp + 8]
lea esi, [edi + 8]
call fcn.0046ffa6
push ebx
mov eax, esi
call fcn.0046ffe2
test eax, eax
je 0x4ebb89
mov eax, dword [edi]
lea ecx, [ebp - 0x10]
push ecx
mov ecx, edi
call dword [eax + 0x20]
mov dword [ebp - 4], ebx
push dword [ebp - 0x10]
push esi
call fcn.0047016d
mov edi, eax
cmp edi, ebx
je 0x4ebb77
push edi
call fcn.004701be
test eax, eax
je 0x4ebb71
lea eax, [ebp + 8]
push eax
push ebx
push edi
mov dword [ebp + 8], ebx
call fcn.004701ef
test eax, eax
je 0x4ebb71
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ebp - 0x14], 1
push edi
call fcn.004701db
mov eax, esi
call fcn.00470045
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x14]
call fcn.00599003
ret 8

Function at 0x4ebb94
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 4], ebx
je 0x4ebc56
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4ebc56
push dword [ebp + 8]
lea esi, [edi + 8]
call fcn.0046ffa6
push ebx
mov eax, esi
call fcn.0046ffe2
test eax, eax
je 0x4ebc52
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x18]
or dword [esp + 0x10], 0xffffffff
lea ecx, [esp + 0x10]
mov dword [edi + 0x214], eax
mov eax, dword [edi]
push ecx
mov ecx, edi
call dword [eax + 0x24]
test eax, eax
je 0x4ebc0a
push dword [ebp + 0xc]
mov ecx, edi
push dword [esp + 0x14]
call fcn.004ebc61
test eax, eax
je 0x4ebc0a
inc ebx
push dword [ebp + 0xc]
mov ecx, edi
push dword [edi + 0x214]
call fcn.004ebc61
test eax, eax
je 0x4ebc21
xor ebx, ebx
inc ebx
mov eax, dword [edi]
or dword [esp + 0x14], 0xffffffff
lea ecx, [esp + 0x14]
push ecx
mov ecx, edi
call dword [eax + 0x28]
test eax, eax
je 0x4ebc4b
push dword [ebp + 0xc]
mov ecx, edi
push dword [esp + 0x18]
call fcn.004ebc61
test eax, eax
je 0x4ebc4b
xor ebx, ebx
inc ebx
mov eax, esi
call fcn.00470045
mov eax, ebx
jmp 0x4ebc58
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4ec34f
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
sub esp, 0x20c
lea ebp, [esp - 4]
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push 0xc
mov eax, 0x5bc951
call fcn.00598f2b
mov eax, dword [ebp + 0x218]
mov ebx, ecx
push ebx
mov dword [ebp - 0x14], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4ec390
xor eax, eax
jmp 0x4ec436
xor eax, eax
push 0x208
push eax
mov word [ebp], ax
lea eax, [ebp + 2]
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.dh_tmp_sg.bak
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040be27
mov esi, eax
and dword [ebp - 4], 0
push ebx
lea eax, [ebp - 0x18]
push eax
call fcn.0040be27
mov esi, dword [esi]
mov eax, dword [eax]
push esi
push eax
call fcn.004f6813
mov ebx, eax
mov eax, dword [ebp - 0x18]
neg ebx
pop ecx
sbb bl, bl
pop ecx
add eax, 0xfffffff0
inc bl
call fcn.00407b6b
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00407b6b
test bl, bl
jne 0x4ec389
push dword [ebp - 0x14]
lea eax, [ebp]
push eax
mov ecx, edi
call fcn.004ebaf2
mov esi, eax
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.0058f3cf
add ebp, 0x210
leave
ret 4

Function at 0x4eefe3
Capabilities:
Read file on windows

Disassembly:
push ebp
push esi
push edi
push 0x5dec58
push dword [esp + 0x14]
call fcn.00593076
pop ecx
pop ecx
mov edi, eax
xor esi, esi
push 3
pop ebp
cmp edi, esi
jne 0x4ef008
mov eax, ebp
jmp 0x4ef0a7
push ebx
push 2
push esi
push edi
call fcn.0059316a
push edi
call fcn.0059338c
push esi
push esi
push edi
mov ebx, eax
call fcn.0059316a
add esp, 0x1c
cmp ebx, esi
jle 0x4ef09d
lea ebp, [ebx + 2]
push ebp
call fcn.0058fc81
mov esi, eax
pop ecx
test esi, esi
jne 0x4ef03e
push 3
pop eax
jmp 0x4ef0a6
push ebp
push 0
push esi
call fcn.00596530
push edi
push 1
push ebx
push esi
call fcn.0059369a
movzx ax, byte [esi + 1]
movzx cx, byte [esi]
shl ax, 8
or ax, cx
movzx ebp, ax
mov eax, 0xbbef
add esp, 0x1c
cmp bp, ax
jne 0x4ef077
cmp byte [esi + 2], 0xbf
je 0x4ef082
push ebx
push esi
call fcn.004eef95
test eax, eax
je 0x4ef087
push 2
pop ebp
jmp 0x4ef096
xor ecx, ecx
mov eax, 0xfeff
cmp bp, ax
sete cl
mov ebp, ecx
push esi
call fcn.0058fd4b
pop ecx
push edi
call fcn.00593912
pop ecx
mov eax, ebp
pop ebx
pop edi
pop esi
pop ebp
ret 4
Function at 0x4ef0ad
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
call fcn.004eee83
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0xc], ebx
je 0x4ef1ff
push edi
push 0x5dec58
push dword [ebp + 0xc]
call fcn.00593076
mov edi, eax
pop ecx
pop ecx
mov dword [ebp - 0x14], edi
cmp edi, ebx
je 0x4ef1fe
push esi
push 2
push ebx
push edi
call fcn.0059316a
push edi
call fcn.0059338c
push ebx
mov esi, eax
push ebx
push edi
mov dword [ebp - 8], esi
call fcn.0059316a
inc esi
push esi
call fcn.0058e040
add esp, 0x20
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x4ef1f6
push esi
push ebx
push eax
call fcn.00596530
add esp, 0xc
xor esi, esi
cmp dword [ebp - 0xc], 2
jne 0x4ef165
push edi
push 1
lea eax, [ebp + 0xf]
push 1
push eax
call fcn.0059369a
add esp, 0x10
jmp 0x4ef15f
push edi
call fcn.00595a35
pop ecx
test eax, eax
jne 0x4ef165
push edi
push 1
lea eax, [ebp + 0xf]
push 1
push eax
call fcn.0059369a
add esp, 0x10
inc esi
cmp byte [ebp + 0xf], 0x3c
jne 0x4ef142
push ebx
push esi
push edi
call fcn.0059316a
mov eax, dword [ebp - 8]
push edi
push 1
sub eax, esi
push eax
push dword [ebp - 4]
call fcn.0059369a
mov esi, dword [ebp - 8]
imul esi, esi, 3
xor ecx, ecx
push 2
lea edi, [esi + 1]
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0058e040
add esp, 0x20
mov dword [ebp + 0xc], eax
cmp eax, ebx
je 0x4ef1ea
push edi
push ebx
push eax
call fcn.00596530
add esp, 0xc
cmp dword [ebp - 0xc], 2
push esi
push dword [ebp + 0xc]
push 0xffffffffffffffff
push dword [ebp - 4]
push ebx
jne 0x4ef1c9
push 0xfde9
jmp 0x4ef1ca
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004ee82d
push dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
call fcn.0058f807
pop ecx
push dword [ebp - 4]
call fcn.0058f807
mov edi, dword [ebp - 0x14]
pop ecx
push edi
call fcn.00593912
pop ecx
pop esi
pop edi
mov eax, dword [ebp - 0x10]
pop ebx
leave
ret 0xc