joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4014c4
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x631350]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ecx, ecx
xor esi, esi
xor ebx, ebx
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], 0x24
mov dword [ebp - 0xc], 0x26
mov dword [ebp - 8], 0x2a
cmp dword [0x63aca0], ecx
jne 0x401565
mov edi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 3
push 0x20
push 3
push 1
push 3
push 2
push ecx
push ecx
call edi
push edx
push eax
call edi
push edx
push eax
call edi
push edx
push eax
push 0x23
xor ecx, ecx
push 0x63aca0
mov dword [0x63aca0], 0x11c
mov dword [0x63aca4], 6
mov dword [0x63aca8], 1
mov word [0x63adb4], cx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
neg eax
sbb eax, eax
inc eax
mov dword [0x632abc], eax
xor ecx, ecx
jmp 0x40156a
mov eax, dword [0x632abc]
cmp eax, ecx
je 0x401576
xor eax, eax
inc eax
jmp 0x4016a0
cmp dword [ebp - 0x14], ecx
je 0x401690
push ecx
push ecx
push ecx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov edi, eax
test edi, edi
je 0x401690
lea eax, [edi + edi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x401690
push 0
push eax
push edi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp edi, eax
jbe 0x401690
and dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x10]
cmp eax, 0x26
jne 0x401643
push 0
push 0
push 0x5c8a5c
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
test edi, edi
je 0x401690
lea eax, [edi + edi + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x401690
push edi
push esi
push 0x5c8a5c
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp edi, eax
jne 0x401690
push esi
push 0x5c8a5c
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x40162c
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x26
jmp 0x401644
cmp word [esi + edi*2 - 4], 0x5c
je 0x401650
push 0x5c8a58
inc edi
mov ebx, esi
call section..text
jmp 0x401650
push eax
call fcn.004012e8
mov esi, eax
pop ecx
test esi, esi
je 0x401690
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401655
sub eax, edx
sar eax, 1
push eax
push esi
push dword [ebp - 0x18]
call fcn.0055cc8f
add esp, 0xc
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
jne 0x401690
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor esi, esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x4015c4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
push dword [ebp - 0x18]
call esi
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0055c9d4
leave
ret
Function at 0x4088d8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x354
mov eax, 0x5a4017
call fcn.0056beab
mov ebx, ecx
cmp dword [ebx + 0x10], 0
jne 0x408926
mov dword [ebp - 0x2bc], str.Path_cannot_be_empty
lea eax, [ebp - 0x2bc]
push eax
lea ecx, [ebp - 0x2c8]
call fcn.0055d255
push 0x607704
lea eax, [ebp - 0x2c8]
push eax
mov dword [ebp - method.std::logic_error.virtual_0], vtable.std::invalid_argument.0
call fcn.00566ed2
push ebx
lea esi, [ebp - 0x48]
call fcn.0040dc52
and dword [ebp - 4], 0
mov eax, esi
call fcn.004806a2
mov edi, dword [ebx + 0x10]
push 8
pop esi
cmp dword [ebx + 0x14], esi
jb 0x408949
mov eax, dword [ebx]
jmp 0x40894b
mov eax, ebx
push eax
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x48]
call fcn.00410bac
test eax, eax
je 0x408967
mov dword [ebp - 0x2bc], str.Path_contains_invalid_separators
jmp 0x4088f9
mov edx, dword [ebx + 0x14]
cmp edx, esi
jb 0x408972
mov ecx, dword [ebx]
jmp 0x408974
mov ecx, ebx
mov eax, dword [ebx + 0x10]
lea ecx, [ecx + eax*2]
cmp word [ecx - 2], 0x5c
jne 0x408990
mov dword [ebp - 0x2bc], str.Path_cannot_have_trailing_path_separator.
jmp 0x4088f9
cmp eax, 0x104
jbe 0x4089a6
mov dword [ebp - 0x2bc], str.Path_is_too_long
jmp 0x4088f9
cmp edx, esi
jb 0x4089ae
mov eax, dword [ebx]
jmp 0x4089b0
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x408a0b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [ebp - 0x360]
push eax
call fcn.00403aba
mov esi, eax
push str.GetFileAttributes_failed_with
push esi
mov byte [ebp - 4], 1
call fcn.0040635f
pop ecx
pop ecx
push edi
push esi
call fcn.004109e7
lea eax, [ebp - 0x2c]
push eax
mov eax, esi
call fcn.00403b24
mov byte [ebp - 4], 2
push 0x20d
mov ecx, str.srcApplicationDetector.cpp
lea eax, [ebp - 0x2c]
call fcn.0040277f
test al, 0x10
jne 0x408a27
push str.Path_is_not_a_directory.
lea esi, [ebp - 0x2c]
call fcn.004037ae
mov byte [ebp - 4], 3
push 0x212
jmp 0x4089fe
lea eax, [ebp - 0x64]
push 0x5ca7ec
push eax
call fcn.00410581
push 0x24c
lea eax, [ebp - 0x2b4]
push 0
mov byte [ebp - 4], 4
and dword [ebp - 0x2b8], 0
push eax
call fcn.0055fda0
mov eax, dword [ebp - 0x64]
add esp, 0x14
cmp dword [ebp - 0x50], esi
jae 0x408a61
lea eax, [ebp - 0x64]
lea ecx, [ebp - 0x2b8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x408abb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [ebp - 0x360]
push eax
call fcn.00403aba
mov esi, eax
push str.FindFirstFile_failed_with
push esi
mov byte [ebp - 4], 5
call fcn.0040635f
pop ecx
pop ecx
push edi
push esi
call fcn.004109e7
lea eax, [ebp - 0x2c]
push eax
mov eax, esi
call fcn.00403b24
mov byte [ebp - 4], 6
push 0x222
jmp 0x4089fe
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 1
xor edi, edi
lea esi, [ebp - 0x64]
call fcn.00404589
push 1
lea esi, [ebp - 0x48]
call fcn.00404589
call fcn.0056bf2e
ret
Function at 0x40aab5
Capabilities:
Get common file path
Get program files directory
Query environment variable

Disassembly:
push 0x59c
mov eax, 0x5b5b2e
call fcn.0056bee1
xor eax, eax
push 0x206
mov word [ebp - 0x430], ax
xor ebx, ebx
lea eax, [ebp - 0x42e]
mov edi, ecx
push ebx
push eax
mov dword [ebp - 0x470], edi
call fcn.0055fda0
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
push ebx
push ebx
push 0x26
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x40abcb
lea eax, [ebp - 0x430]
push eax
lea esi, [ebp - 0x44c]
mov dword [ebp - 4], ebx
call fcn.004037ae
mov edx, esi
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.00408ade
push 1
xor edi, edi
call fcn.00404589
or dword [ebp - 4], 0xffffffff
jmp 0x40ac3c
lea eax, [ebp - 0x510]
push eax
call fcn.00403aba
mov esi, eax
push str.Cannot_get_CSIDL_PROGRAM_FILES_path.
push esi
mov dword [ebp - 4], 5
call fcn.0040635f
pop ecx
pop ecx
lea eax, [ebp - 0x44c]
push eax
mov eax, esi
call fcn.00403b24
mov byte [ebp - 4], 6
cmp dword [ebp - 0x438], 8
mov eax, dword [ebp - 0x44c]
jae 0x40ac14
lea eax, [ebp - 0x44c]
push eax
push 2
pop ecx
call fcn.0047feaf
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x44c]
call fcn.00404589
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x510]
call fcn.004027ed
lea eax, [ebp - 0x46c]
push eax
mov dword [ebp - 0x46c], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
jne 0x40ac60
mov dword [ebp - 0x46c], ebx
cmp dword [ebp - 0x46c], 1
jne 0x40acd5
xor eax, eax
push 0x208
mov word [ebp - 0x228], ax
lea eax, [ebp - 0x226]
push ebx
push eax
call fcn.0055fda0
add esp, 0xc
push 0x105
lea eax, [ebp - 0x228]
push eax
push 0x5c8a5c
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x40acd5
lea eax, [ebp - 0x228]
push eax
lea esi, [ebp - 0x44c]
mov dword [ebp - 4], 7
call fcn.004037ae
mov ecx, dword [ebp - 0x470]
mov edx, esi
mov byte [ebp - 4], 8
call fcn.00408ade
push 1
xor edi, edi
call fcn.00404589
call fcn.0056bf3d
ret

Function at 0x40b05d
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b5a77
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x631350]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, ecx
mov dword [esp + 0x18], eax
lea esi, [esp + 0x1c]
call fcn.0040ae20
and dword [esp + 0x30], 0
mov edi, dword [esp + 0x20]
lea ebx, [ebp + 8]
lea eax, [esp + 0x14]
mov ecx, edi
call fcn.0040e42f
mov esi, dword [esp + 0x14]
cmp esi, dword [edi + 4]
push 0x521
setne al
movzx eax, al
push eax
mov edi, str.srcApplicationDetector.cpp
call fcn.0047f69c
mov edi, dword [ebp + 0xc]
pop ecx
pop ecx
push dword [esp + 0x18]
mov ecx, dword [ebp + 8]
mov edx, edi
call fcn.0040ba27
add esi, 0x10
call fcn.0040b10c
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40b0f7
push dword [eax]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x413123
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5acc9c
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
mov eax, dword [0x631350]
xor eax, esp
mov dword [esp + 0xd8], eax
push ebx
push esi
push edi
mov eax, dword [0x631350]
xor eax, esp
push eax
lea eax, [esp + 0xf0]
mov dword fs:[0], eax
lea ebx, [esp + 0xb0]
call fcn.004130e1
and dword [esp + 0xf8], 0
mov eax, ebx
call fcn.00483248
test al, al
je 0x413231
cmp dword [esp + 0xc4], 8
mov eax, dword [esp + 0xb0]
jae 0x413199
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x413231
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [esp + 0x14]
push eax
call fcn.00403aba
mov esi, eax
push str.Cannot_delete_ApplicationLaunchInfoStatistics_file:
push esi
mov byte [esp + 0x100], 1
call fcn.0040635f
pop ecx
pop ecx
push edi
push esi
call fcn.004109e7
lea eax, [esp + 0xcc]
push eax
mov eax, esi
call fcn.00403b24
push 2
pop ecx
mov byte [esp + 0xf8], cl
cmp dword [esp + 0xe0], 8
mov eax, dword [esp + 0xcc]
jae 0x413209
lea eax, [esp + 0xcc]
push eax
call fcn.0047feaf
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0xd0]
call fcn.00404589
lea eax, [esp + 0x14]
mov byte [esp + 0xf8], 0
call fcn.004027ed
push 1
xor edi, edi
lea esi, [esp + 0xb4]
call fcn.00404589
mov ecx, dword [esp + 0xf0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd8]
xor ecx, esp
call fcn.0055c9d4
mov esp, ebp
pop ebp
ret
Function at 0x418f05
Capabilities:
Delete file

Disassembly:
push 0xec
mov eax, 0x5b25e6
call fcn.0056beab
mov edi, ecx
push edi
lea eax, [ebp - 0x60]
push eax
mov esi, edx
call fcn.00482edd
xor ebx, ebx
push 0xa
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], ebx
call fcn.00482f81
test al, al
jne 0x418f7e
lea eax, [ebp - 0xf8]
push eax
call fcn.00403aba
mov esi, eax
push str.Cannot_open_file_for_writing:
push esi
mov byte [ebp - 4], 1
call fcn.0040635f
push esi
mov ecx, edi
call fcn.00411d36
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
mov eax, esi
call fcn.00403b24
mov byte [ebp - 4], 2
push 0x265
mov ecx, str.srcApplicationUsageCollector.cpp
lea eax, [ebp - 0x48]
call fcn.0040277f
push 0x2e
push str.__xml_version1.0_encodingUTF_8___n_Data__n
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.00404788
mov byte [ebp - 4], 3
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 0x49], bl
jae 0x418fad
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x49]
push ecx
push ebx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x60]
push eax
mov eax, dword [ebp - 0x60]
call dword [eax + 0x24]
cmp byte [ebp - 0x49], bl
je 0x419052
lea ecx, [ebp - 0x60]
call fcn.0048303b
cmp dword [edi + 0x14], 8
jb 0x418fd8
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x418ffe
push str.Cannot_write_file_header.
lea esi, [ebp - 0x48]
call fcn.004037ae
mov byte [ebp - 4], 4
push 0x26f
jmp 0x418f71
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [ebp - 0xf8]
push eax
call fcn.00403aba
mov esi, eax
push str.Cannot_write_file_header_and_delete_incomplete_file__ec
push esi
mov byte [ebp - 4], 5
call fcn.0040635f
pop ecx
pop ecx
push edi
push esi
call fcn.004109e7
push 0x5cd46c
push esi
call fcn.0040635f
pop ecx
pop ecx
lea eax, [ebp - 0x48]
push eax
mov eax, esi
call fcn.00403b24
mov byte [ebp - 4], 6
push 0x274
jmp 0x418f71
mov ecx, dword [esi]
mov eax, dword [esi + 4]
sub eax, ecx
mov edi, 0x1c8
mov dword [ebp - 0x50], ebx
cdq
mov ebx, edi
idiv ebx
test eax, eax
je 0x419092
and dword [ebp - 0x54], 0
add ecx, dword [ebp - 0x54]
lea eax, [ebp - 0x60]
push eax
call fcn.00415eea
mov eax, dword [esi + 4]
pop ecx
mov ecx, dword [esi]
sub eax, ecx
cdq
mov ebx, edi
idiv ebx
inc dword [ebp - 0x50]
add dword [ebp - 0x54], edi
cmp dword [ebp - 0x50], eax
jb 0x41906e
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040443a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.00482f34
call fcn.0056bf2e
ret
Function at 0x419fc5
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5aee89
mov eax, dword fs:[0]
push eax
sub esp, 0xf4
mov eax, dword [0x631350]
xor eax, esp
mov dword [esp + 0xec], eax
push esi
push edi
mov eax, dword [0x631350]
xor eax, esp
push eax
lea eax, [esp + 0x100]
mov dword fs:[0], eax
lea eax, [esp + 0xdc]
push eax
mov esi, ecx
call fcn.00475d77
pop ecx
and dword [esp + 0x108], 0
lea ecx, [esp + 0xa4]
push esi
push ecx
mov ecx, eax
call fcn.00410706
pop ecx
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0xe0]
mov byte [esp + 0x10c], 2
call fcn.00404589
lea eax, [esp + 0xa4]
call fcn.00483248
test al, al
je 0x41a126
cmp dword [esp + 0xb8], 8
mov eax, dword [esp + 0xa4]
jae 0x41a072
lea eax, [esp + 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x41a126
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [esp + 0xc]
push eax
call fcn.00403aba
mov esi, eax
push str.Cannot_delete_
push esi
mov byte [esp + 0x110], 3
call fcn.0040635f
push esi
lea ecx, [esp + 0xb0]
call fcn.00411d36
add esp, 0xc
push 0x5ca510
push esi
call fcn.0040635f
pop ecx
pop ecx
push edi
push esi
call fcn.004109e7
lea eax, [esp + 0xc0]
push eax
mov eax, esi
call fcn.00403b24
mov byte [esp + 0x108], 4
cmp dword [esp + 0xd4], 8
mov eax, dword [esp + 0xc0]
jae 0x41a0fb
lea eax, [esp + 0xc0]
push eax
push 2
pop ecx
call fcn.0047feaf
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0xc4]
call fcn.00404589
lea eax, [esp + 0xc]
mov byte [esp + 0x108], 2
call fcn.004027ed
push 1
xor edi, edi
lea esi, [esp + 0xa8]
call fcn.00404589
mov ecx, dword [esp + 0x100]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xec]
xor ecx, esp
call fcn.0055c9d4
mov esp, ebp
pop ebp
ret
Function at 0x41cbe9
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b785e
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x631350]
xor eax, esp
mov dword [esp + 0x5c], eax
push esi
push edi
mov eax, dword [0x631350]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov edx, ebx
lea esi, [esp + 0x28]
mov edi, ecx
call fcn.00421915
xor esi, esi
mov dword [esp + 0x78], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
lea eax, [esp + 0x10]
push eax
push ebx
lea ecx, [esp + 0x30]
mov edx, edi
mov byte [esp + 0x80], 1
call fcn.00421454
mov eax, dword [esp + 0x20]
cmp eax, esi
jne 0x41cc8b
push str.Cannot_choose_recommended_settings
lea esi, [esp + 0x50]
call fcn.004037ae
push 0x17b
mov ecx, str.srcAppManager.cpp
mov eax, esi
mov byte [esp + 0x7c], 2
call fcn.0040277f
push dword [ebp + 8]
mov eax, dword [eax]
lea ecx, [esp + 0x2c]
push ecx
push eax
push eax
lea eax, [esp + 0x20]
call fcn.0042680e
push eax
push ebx
mov ecx, edi
call fcn.0042346d
lea eax, [esp + 0x10]
call fcn.0041cbc3
push 1
xor edi, edi
lea esi, [esp + 0x34]
call fcn.00404589
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.0055c9d4
mov esp, ebp
pop ebp
ret 4
Function at 0x42a7c1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push dword [esi]
call fcn.0055e04c
push dword [esi]
mov ebx, eax
push 1
push edi
push dword [ebp + 8]
call fcn.0055eaea
add esp, 0x14
cmp eax, 1
jne 0x42a7f2
lea eax, [ebx + edi]
cmp eax, dword [esi + 8]
jbe 0x42a7ee
mov dword [esi + 8], eax
mov al, 1
jmp 0x42a7f4
xor al, al
pop ebx
pop ebp
ret 4
Function at 0x42ab3e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a3a99
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x631350]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
push esi
mov eax, dword [0x631350]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, ecx
mov esi, dword [ebx]
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x20], eax
cmp esi, eax
jne 0x42ab96
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
jmp 0x42ac5f
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
call fcn.0042b9f3
mov esi, dword [esp + 0x1c]
xor ecx, ecx
push ecx
mov dword [esp + 0x54], ecx
mov eax, dword [ebx + 0xc]
push ecx
push eax
push dword [esi + 0x40]
call fcn.0055e3f2
add esp, 0x10
test eax, eax
je 0x42abee
push str.Cannot_seek_to_data_position
lea esi, [esp + 0x28]
call fcn.004037ae
mov byte [esp + 0x50], 1
push 0x105
mov ecx, str.srcBlobStorage.cpp
mov eax, esi
call fcn.0040277f
push dword [esi + 0x40]
mov ebx, dword [ebx]
push 1
push ebx
mov ebx, dword [esp + 0x18]
push ebx
call fcn.0055e976
add esp, 0x10
cmp eax, 1
je 0x42ac29
push str.Cannot_read_blob_data
lea esi, [esp + 0x28]
call fcn.004037ae
mov byte [esp + 0x50], 2
push 0x109
mov ecx, str.srcBlobStorage.cpp
mov eax, esi
jmp 0x42abe9
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
lea eax, [esp + 0xc]
cmp edi, eax
je 0x42ac54
mov esi, edi
call fcn.0043460f
mov eax, dword [esp + 0x10]
mov dword [edi + 4], eax
mov eax, dword [esp + 0x14]
mov dword [edi], ebx
mov dword [edi + 8], eax
xor ebx, ebx
test ebx, ebx
je 0x42ac5f
push ebx
call fcn.0055da69
pop ecx
mov eax, edi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.0055c9d4
mov esp, ebp
pop ebp
ret 4

Function at 0x42c1e9
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a6905
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x631350]
xor eax, esp
mov dword [esp + 0xb4], eax
push esi
push edi
mov eax, dword [0x631350]
xor eax, esp
push eax
lea eax, [esp + 0xc8]
mov dword fs:[0], eax
push 0x190
mov esi, ecx
push 0
push esi
call fcn.0055fda0
add esp, 0xc
push esi
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov edi, eax
test edi, edi
je 0x42c29e
lea eax, [esp + 0xc]
push eax
call fcn.00403aba
mov esi, eax
and dword [esp + 0xd0], 0
push str.WSAStartup_failed_with
push esi
call fcn.0040635f
pop ecx
pop ecx
push edi
push esi
call fcn.004050f8
lea eax, [esp + 0xa4]
push eax
mov eax, esi
call fcn.00403b24
push 0x1b
mov ecx, 0x5d0b14
lea eax, [esp + 0xa8]
mov byte [esp + 0xd4], 1
call fcn.0040277f
mov eax, esi
mov ecx, dword [esp + 0xc8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xb4]
xor ecx, esp
call fcn.0055c9d4
mov esp, ebp
pop ebp
ret
Function at 0x42c2c9
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b1d0c
mov eax, dword fs:[0]
push eax
sub esp, 0xf8
mov eax, dword [0x631350]
xor eax, esp
mov dword [esp + 0xf0], eax
push ebx
push esi
push edi
mov eax, dword [0x631350]
xor eax, esp
push eax
lea eax, [esp + 0x108]
mov dword fs:[0], eax
lea ebx, [esp + 0xac]
call fcn.00476297
and dword [esp + 0x110], 0
lea eax, [esp + 0xc8]
push str..bak
push eax
call fcn.00410581
pop ecx
pop ecx
push 8
mov byte [esp + 0x114], 1
mov eax, dword [esp + 0xcc]
pop esi
cmp dword [esp + 0xdc], esi
jae 0x42c353
lea eax, [esp + 0xc8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0xc8]
cmp dword [esp + 0xdc], esi
jae 0x42c371
lea ecx, [esp + 0xc8]
mov eax, dword [esp + 0xac]
cmp dword [esp + 0xc0], esi
jae 0x42c388
lea eax, [esp + 0xac]
push ecx
push eax
call fcn.00562d5a
pop ecx
pop ecx
push 3
pop edi
lea ebx, [esp + 0x10]
mov dword [esp + 0x10], 4
call fcn.004771ea
test al, al
je 0x42c3ad
mov edi, dword [esp + 0x10]
push edi
call fcn.0047fd46
pop ecx
push esi
call fcn.0055db17
mov ebx, eax
pop ecx
mov dword [esp + 0x10], ebx
test ebx, ebx
je 0x42c3f7
mov byte [esp + 0x110], 3
and dword [ebx + 4], 0
mov dword [ebx], vtable.GFE::FileTraceHandler.0
mov edi, dword [esp + 0xac]
cmp dword [esp + 0xc0], esi
jae 0x42c3ee
lea edi, [esp + 0xac]
mov ecx, ebx
call fcn.00480090
jmp 0x42c3f9
xor ebx, ebx
push ebx
mov byte [esp + 0x114], 1
call fcn.0047fe38
pop ecx
lea eax, [esp + 0x14]
push eax
call fcn.00403aba
mov edi, eax
push str.Running
push edi
mov byte [esp + 0x118], 4
call fcn.0040635f
push 0x5d0b90
push edi
call fcn.00406513
push str._version
push edi
call fcn.0040635f
push 0x5d0bb4
push edi
call fcn.00406513
add esp, 0x20
lea eax, [esp + 0xe4]
push eax
mov eax, edi
call fcn.00403b24
mov byte [esp + 0x110], 5
mov eax, dword [esp + 0xe4]
cmp dword [esp + 0xf8], esi
jae 0x42c479
lea eax, [esp + 0xe4]
push eax
push 3
pop ecx
call fcn.0047feaf
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0xe8]
call fcn.00404589
lea eax, [esp + 0x14]
mov byte [esp + 0x110], 1
call fcn.004027ed
push 1
lea esi, [esp + 0xcc]
call fcn.00404589
push 1
lea esi, [esp + 0xb0]
call fcn.00404589
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x108]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf0]
xor ecx, esp
call fcn.0055c9d4
mov esp, ebp
pop ebp
ret 4