joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409360
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x4cc8c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x128]
push edi
push 0x124
push 0
push eax
call fcn.00466ad0
add esp, 0xc
test esi, esi
je 0x4094f4
cmp byte [esi], 0
je 0x4094f4
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
or ebx, 0xffffffff
cmp edi, ebx
jne 0x4093cf
push str._GetLastError_
push dword [ebp + 0xc]
push esi
push str.:5:TerminateProcessByName__s___d__FAILED:_CreateToolhelp32Snapshot___FAILED:__s
call fcn.0040d511
add esp, 0x10
mov eax, ebx
jmp 0x4094f7
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0x128
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x409417
push str._GetLastError_
push dword [ebp + 0xc]
push esi
push str.:5:TerminateProcessByName__s___d__FAILED:_Process32First___FAILED:__s
call fcn.0040d511
add esp, 0x10
push 0x79c
push str.C:UsersOfficeDocumentsVisual_StudioPAULAConsole.c
push str.TerminateProcessByNameCaseSens
push edi
call fcn.0040eb13
jmp 0x4093c8
mov dword [ebp - 0x130], ebx
cmp dword [ebp + 0xc], 0
lea eax, [ebp - 0x108]
push esi
push eax
je 0x40944a
cmp dword [ebp + 0x10], 0
je 0x409438
call fcn.00470340
jmp 0x40943d
call fcn.00470487
pop ecx
pop ecx
test eax, eax
jne 0x409446
inc eax
jmp 0x40945e
xor eax, eax
jmp 0x40945e
cmp dword [ebp + 0x10], 0
je 0x409457
call fcn.00466c30
jmp 0x40945c
call fcn.004529d5
pop ecx
pop ecx
test eax, eax
je 0x4094ba
push dword [ebp - 0x124]
and dword [ebp - 0x130], 0
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x4094ba
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x4094a5
push str._GetLastError_
lea eax, [ebp - 0x108]
push eax
push str.:1:TerminateProcessByName___encountered_a_problem:_TerminateProcess___FAILED_to_terminate__s:__s:_trying_once_more_with_higher_privilege...
call fcn.0040d9e1
add esp, 0xc
push 0x7cd
push str.C:UsersOfficeDocumentsVisual_StudioPAULAConsole.c
push str.TerminateProcessByNameCaseSens
push ebx
call fcn.0040eb13
lea eax, [ebp - 0x12c]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40941d
push 0x826
push str.C:UsersOfficeDocumentsVisual_StudioPAULAConsole.c
push str.TerminateProcessByNameCaseSens
push edi
call fcn.0040eb13
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x130]
jmp 0x4094f7
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004654a8
leave
ret
Function at 0x4095d3
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x201c
call fcn.004654c0
mov eax, dword [0x4cc8c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x200c], eax
mov dword [ebp - 0x2010], edx
mov esi, ebx
mov eax, ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2008], edi
test ecx, ecx
je 0x409625
cmp byte [edx + eax], 0x20
jl 0x409622
inc eax
cmp eax, ecx
jb 0x409615
jmp 0x409625
xor esi, esi
inc esi
test esi, esi
je 0x4096c7
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 0x2014]
push eax
mov edi, 0x2000
lea eax, [ebp - 0x2004]
cmp ecx, edi
push esi
cmovb edi, ecx
push edi
push eax
push dword [ebp - 0x2008]
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputAttribute]
lea eax, [ebp - 0x2018]
push eax
lea eax, [ebp - 0x201c]
push eax
call fcn.004062c7
movsx eax, word [ebp + 0x16]
push eax
movsx eax, si
push eax
call fcn.00407b76
add esp, 0x10
push ebx
push dword [ebp - 0x200c]
push dword [ebp + 0x10]
push dword [ebp - 0x2010]
push dword [ebp - 0x2008]
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
lea eax, [ebp - 0x2014]
push eax
push esi
push edi
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 0x2008]
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputAttribute]
push dword [ebp - 0x2018]
push dword [ebp - 0x201c]
call fcn.00407b76
pop ecx
pop ecx
jmp 0x4096db
push dword [ebp - 0x200c]
push dword [ebp + 0x14]
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004654a8
leave
ret
Function at 0x40f35e
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xorps xmm0, xmm0
push edi
mov edi, dword [ebp + 8]
push edi
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0xc], xmm0
movlpd qword [ebp - 0x14], xmm0
call fcn.00451684
pop ecx
test eax, eax
jne 0x40f4ac
mov esi, dword [ebp + 0xc]
push esi
call fcn.00451684
pop ecx
test eax, eax
jne 0x40f4ac
push eax
push 0x20
push 3
push eax
push 7
push 0x80
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40f417
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x40f3db
mov dword [ebp - 4], 1
jmp 0x40f402
cmp dword [0x4bf4ac], 0
je 0x40f402
and dword [0x4bf4ac], 0
push str._GetLastError_
push dword [ebp + 0x10]
push esi
push edi
push str.:6:CopyFileWithDates___s_____s____d__encountered_a_problem:_GetFileTime___FAILED:__s
call fcn.0040d511
add esp, 0x14
push 0x9df
push str.C:UsersOfficeDocumentsVisual_StudioPAULAFile.c
push str.CopyFileWithDates
push ebx
call fcn.0040eb13
push dword [ebp + 0x10]
push esi
push edi
call fcn.004114e9
add esp, 0xc
test eax, eax
je 0x40f4ac
cmp dword [ebp - 4], 0
jne 0x40f437
xor eax, eax
inc eax
jmp 0x40f4ae
push 0
push SQLGetDiagRec
push 3
push 0
push 7
push 0x100
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40f432
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x40f495
mov eax, dword [0x4d5a94]
inc eax
mov dword [0x4d5a94], eax
cmp eax, 0xa
jge 0x40f495
push str._GetLastError_
push dword [ebp + 0x10]
push esi
push edi
push str.:6:_1_of_10:_CopyFileWithDates___s_____s____d__encountered_a_problem:_SetFileTime___FAILED:__s
call fcn.0040d511
add esp, 0x14
push 0xa05
push str.C:UsersOfficeDocumentsVisual_StudioPAULAFile.c
push str.CopyFileWithDates
push ebx
call fcn.0040eb13
jmp 0x40f432
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40fb2d
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x4cc8c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push edi
mov edi, 0x104
xor ebx, ebx
push edi
push ebx
push eax
call fcn.00466ad0
add esp, 0xc
mov dword [ebp - 0x10c], ebx
test esi, esi
je 0x40fc2a
cmp byte [esi], 0x30
je 0x40fc2a
mov eax, ebx
cmp eax, edi
jae 0x40fd10
mov byte [ebp + eax - 0x108], bl
inc eax
cmp eax, edi
jl 0x40fb79
push edi
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.00452b01
lea eax, [ebp - 0x108]
push 0x22
push eax
call fcn.00451bf6
mov ebx, dword [ebp + 0xc]
add esp, 0x14
test ebx, ebx
je 0x40fbf1
push 0xf83
push str.C:UsersOfficeDocumentsVisual_StudioPAULAFile.c
push str.CreateDirectorySuper
xor ecx, ecx
lea eax, [ebp - 0x108]
push ecx
push ecx
push eax
push 0x40fd16
push ecx
push ecx
call fcn.00410421
mov edi, eax
test edi, edi
jne 0x40fc3b
push str._GetLastError_
push eax
push esi
push str.:8:CreateDirectorySuper___FAILED_to_create_thread_to_create_directory___s_._NumThreads_d:__s
call fcn.0040d511
add esp, 0x10
push 0
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
test eax, eax
je 0x40fd08
cmp eax, 0x50
je 0x40fd08
cmp eax, 0xb7
je 0x40fd08
cmp eax, 0x4c7
je 0x40fd08
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004654a8
leave
ret
call fcn.004609ba
mov dword [ebp - 0x110], eax
jmp 0x40fc6b
cmp dword [ebp - 0x10c], 0x103
jne 0x40fcaa
call fcn.004609ba
sub eax, dword [ebp - 0x110]
cmp eax, ebx
ja 0x40fc7f
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x10c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x40fc48
jmp 0x40fcaa
push esi
call fcn.004609ba
sub eax, dword [ebp - 0x110]
push eax
push str.:5:CreateDirectorySuper___timed_out_after__ldms_while_creating___s_
call fcn.0040d9e1
add esp, 0xc
mov dword [0x4d57c8], 0x5b4
and dword [ebp - 0x10c], 0
push 0xfb7
push str.C:UsersOfficeDocumentsVisual_StudioPAULAFile.c
push str.CreateDirectorySuper
push edi
call fcn.0040eb13
push dword [0x4d57c8]
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
call edi
cmp dword [ebp - 0x10c], 0
jne 0x40fd08
push esi
call fcn.0041210b
pop ecx
test eax, eax
jne 0x40fcfb
push dword [0x4d57c8]
push str._GetLastError_
push ebx
push esi
push str.:3:FYI:_CreateDirectorySuper__s___lu___FAILED:__s_ld
call fcn.0040d9e1
add esp, 0x14
push dword [0x4d57c8]
call edi
jmp 0x40fc2a
xor eax, eax
inc eax
jmp 0x40fc2c
call fcn.0046565b
int3
Function at 0x4102fe
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x4cc8c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x148]
push 0x104
push 0
push eax
call fcn.00466ad0
push 0x40
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.00466ad0
add esp, 0x18
test esi, esi
je 0x4103c5
push esi
call fcn.00450a50
mov dword [esp], 0x21e88e
push 0xde
call fcn.00427108
push eax
push str.P2_Tmp__d
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.0045285b
add esp, 0x18
lea eax, [ebp - 0x148]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x41038d
push str._GetLastError_
push str.:2:CreateTempFile___FAILED:_GetTempPath___FAILED:__s
jmp 0x4103be
push esi
push 0
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x4103b4
push esi
call fcn.00451684
pop ecx
test eax, eax
jne 0x4103b4
mov eax, esi
jmp 0x4103c7
push str._GetLastError_
push str.:2:CreateTempFile___FAILED:_GetTempFileName___FAILED:__s
call fcn.0040d511
pop ecx
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004654a8
leave
ret
Function at 0x410421
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4cc8c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push ebx
mov dword [ebp - 0x110], eax
mov eax, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp + 0x20]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp + 0x24]
push 0x104
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x108]
push 0
push eax
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x118], edi
call fcn.00466ad0
push 0x1c8
push 1
call fcn.004701d4
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x4104a2
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4105c6
mov eax, dword [0x4d7370]
test eax, eax
jne 0x4104b5
call fcn.00443594
mov dword [0x4d7370], eax
push ebx
push eax
call fcn.00443a46
cmp dword [0x4d7370], 0
pop ecx
pop ecx
jne 0x4104da
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
call fcn.004701df
jmp 0x4105c5
mov dword [ebx], esi
lea eax, [ebx + 4]
test esi, esi
je 0x4104f6
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x114]
mov edi, dword [ebp - 0x118]
jmp 0x410503
push 0xc
push 0
push eax
call fcn.00466ad0
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x110]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp - 0x10c]
push 0x40
push dword [ebp - 0x11c]
mov dword [ebx + 0x20], eax
lea eax, [ebx + 0x24]
push eax
mov dword [ebx + 0x10], edi
call fcn.00452b01
push 0x104
push dword [ebp - 0x120]
lea eax, [ebp - 0x108]
push eax
call fcn.00452b01
lea eax, [ebp - 0x108]
push eax
call fcn.00451e92
push 0x40
lea eax, [ebp - 0x108]
push eax
lea eax, [ebx + 0x64]
push eax
call fcn.00452b01
mov eax, dword [ebp + 0x28]
and dword [ebx + 0xb0], 0
mov dword [ebx + 0xa4], eax
call fcn.004609ba
mov dword [ebx + 0xb4], eax
lea eax, [ebx + 0xb8]
push eax
call fcn.00450a50
and dword [ebx + 0xac], 0
add esp, 0x2c
push dword [ebp - 0x10c]
push dword [ebp - 0x110]
push ebx
push 0x4103d4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 0xa8], eax
test eax, eax
jne 0x4105c8
push ebx
call fcn.004105d9
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004654a8
leave
ret 0x24
Function at 0x410629
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4cc8c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push edi
mov ebx, 0x104
xor edi, edi
push ebx
push edi
push eax
call fcn.00466ad0
push ebx
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.00452b01
lea eax, [ebp - 0x108]
push eax
call fcn.00451f5e
push edi
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.00451ee4
add esp, 0x28
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x410729
test al, 0x10
je 0x410701
push edi
push 0x4116d1
push 1
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.004131eb
push edi
lea eax, [ebp - 0x108]
push 1
push eax
call fcn.00410868
add esp, 0x20
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test edi, edi
jne 0x4106fe
lea eax, [ebp - 0x108]
push eax
call fcn.00410961
pop ecx
test eax, eax
je 0x4106fe
push ebx
push str._GetLastError_
lea eax, [ebp - 0x108]
push eax
push esi
push str.:3:DeleteDirectory___s___FAILED:_DeleteFiles___s___1__0__FAILED:__s_ld
call fcn.0040d511
add esp, 0x14
push ebx
jmp 0x41072b
cmp eax, 0xffffffff
je 0x410729
push esi
call fcn.00410961
pop ecx
test eax, eax
je 0x410729
push esi
call fcn.00410944
pop ecx
test eax, eax
jne 0x410729
push esi
push str.:3:DeleteDirectory___s___FAILED:_The_given_file_is_not_a_directory_
call fcn.0040d511
pop ecx
pop ecx
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004654a8
leave
ret
Function at 0x410742
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4cc8c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 5
pop ecx
mov esi, str.ThisIsAFileLockxxxx
lea edi, [ebp - 0x18]
rep movsd dword es:[edi], dword [esi]
call fcn.004609ba
push ebx
mov dword [ebp - 0x1c], eax
call fcn.00451684
pop ecx
test eax, eax
jne 0x410857
push ebx
call fcn.00410961
pop ecx
test eax, eax
je 0x410852
push 0x1493
push str.C:UsersOfficeDocumentsVisual_StudioPAULAFile.c
push 0x489570
push ebx
call fcn.004137d1
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x4107cd
push 0x64
call edi
push 0x1497
push str.C:UsersOfficeDocumentsVisual_StudioPAULAFile.c
push 0x489570
push ebx
call fcn.004137d1
add esp, 0x10
mov esi, eax
lea eax, [ebp - 0x18]
push eax
call fcn.00450a50
pop ecx
test esi, esi
je 0x4107f2
push esi
push 1
lea eax, [ebp - 0x18]
push 0x14
push eax
call fcn.0046a8f7
push esi
call fcn.00413646
add esp, 0x14
lea eax, [ebp - 0x18]
push str.ThisIsAFileLockxxxx
push eax
call fcn.00470340
pop ecx
pop ecx
test eax, eax
jne 0x410857
push ebx
call fcn.0041165b
pop ecx
test eax, eax
jne 0x410852
push 0x64
call edi
call fcn.004609ba
mov esi, dword [ebp - 0x1c]
sub eax, esi
cmp eax, 0x2710
jae 0x410831
push ebx
call fcn.0041165b
pop ecx
test eax, eax
jne 0x410852
push 0x64
call edi
call fcn.004609ba
sub eax, esi
cmp eax, 0x2710
jae 0x410857
push ebx
call fcn.0041165b
neg eax
pop ecx
sbb eax, eax
neg eax
jmp 0x410859
xor eax, eax
inc eax
jmp 0x410859
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004654a8
leave
ret

Function at 0x410944
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41095d
shr eax, 4
and eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x410bca
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
mov eax, dword [0x4cc8c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
mov ebx, 0x104
push ebx
push 0
push eax
call fcn.00466ad0
push ebx
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00466ad0
push 0x140
lea eax, [ebp - 0x34c]
push 0
push eax
call fcn.00466ad0
add esp, 0x24
test esi, esi
je 0x410caf
cmp byte [esi], 0
je 0x410caf
push ebx
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00452b01
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00470240
lea eax, [ebp - 0x108]
push eax
call fcn.00451e92
mov eax, dword [0x4d57d0]
add esp, 0x18
mov ecx, dword [0x4d57cc]
add eax, 0xf
cmp ecx, eax
jle 0x410c87
push ecx
push str.:8:DoesFileExist_Helper___has_determined_that_over__d_helper_threads_may_be_stuck_
mov dword [0x4d57d0], ecx
call fcn.0040d9e1
pop ecx
pop ecx
mov ecx, dword [0x4d57cc]
lea eax, [ebp - 0x34c]
inc ecx
push eax
lea eax, [ebp - 0x20c]
mov dword [0x4d57cc], ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
dec dword [0x4d57cc]
mov esi, eax
cmp esi, 0xffffffff
jne 0x410d1f
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004654a8
leave
ret 4
cmp byte [ebp - 0x320], 0x2e
je 0x410d0d
lea eax, [ebp - 0x320]
push eax
call fcn.00451684
pop ecx
test eax, eax
jne 0x410d0d
cmp byte [ebp - 0x108], 0x2a
jne 0x410d28
cmp byte [ebp - 0x106], 0x2a
jne 0x410d28
mov al, byte [ebp - 0x107]
cmp al, 0x3f
je 0x410d28
movsx eax, al
push eax
lea eax, [ebp - 0x320]
push eax
call fcn.00467040
pop ecx
pop ecx
test eax, eax
jne 0x410d28
lea eax, [ebp - 0x34c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x410d37
cmp dword [0x4b0b4c], 0
jne 0x410cc1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
jmp 0x410cb1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x410caf
Function at 0x4114e9
Capabilities:
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4cc8c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00451684
pop ecx
test eax, eax
jne 0x41164a
push esi
call fcn.00451684
pop ecx
test eax, eax
jne 0x41164a
push edi
call fcn.00470560
mov ebx, 0x104
pop ecx
cmp eax, ebx
jae 0x411603
push esi
call fcn.00470560
pop ecx
cmp eax, ebx
jae 0x411603
mov ebx, dword [ebp + 0x10]
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x4115fe
push esi
call fcn.00410944
pop ecx
test eax, eax
je 0x4115cd
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00466ad0
push 0x104
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.00452b01
lea eax, [ebp - 0x108]
push eax
call fcn.00451e92
lea eax, [ebp - 0x108]
push eax
call fcn.00451684
add esp, 0x20
test eax, eax
jne 0x41164a
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.00451949
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x108]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
jmp 0x41164c
test ebx, ebx
jne 0x41164a
push esi
call fcn.00410961
pop ecx
test eax, eax
je 0x41164a
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 3
je 0x41164a
and eax, 0xfffffffc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push esi
jmp 0x4115c4
xor eax, eax
inc eax
jmp 0x41164c
push edi
call fcn.004503f2
push esi
mov ebx, eax
call fcn.004503f2
mov edi, eax
pop ecx
pop ecx
test ebx, ebx
je 0x41163f
test edi, edi
je 0x41163c
push dword [ebp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push ebx
mov esi, eax
call fcn.004701df
push edi
call fcn.004701df
pop ecx
pop ecx
mov eax, esi
jmp 0x41164c
push ebx
jmp 0x411644
test edi, edi
je 0x41164a
push edi
call fcn.004701df
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004654a8
leave
ret

Function at 0x41165b
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.00451684
pop ecx
test eax, eax
jne 0x4116af
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4116aa
push esi
call fcn.00410961
pop ecx
test eax, eax
je 0x4116aa
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 3
je 0x4116af
and eax, 0xfffffffc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4116b1
xor eax, eax
inc eax
jmp 0x4116b1
xor eax, eax
pop esi
pop ebp
ret
Function at 0x411717
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x4cc8c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x90], eax
call fcn.00451684
pop ecx
test eax, eax
je 0x41174d
xor eax, eax
jmp 0x41192c
push edi
call fcn.004609ba
push ebx
push esi
xor edi, edi
mov dword [ebp - 0x8c], eax
push edi
push 0x80
push 3
push edi
push 7
push closesocket
push dword [ebp - 0x90]
call fcn.0040fec4
add esp, 0x24
mov dword [ebp - 0x88], eax
cmp eax, 0xffffffff
jne 0x411854
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x94], eax
test ebx, ebx
je 0x41179e
cmp dword [ebx], edi
jne 0x4117b7
test esi, esi
je 0x4117bd
call fcn.004609ba
sub eax, dword [ebp - 0x8c]
cmp eax, esi
jb 0x4117bd
mov eax, dword [ebp - 0x94]
push eax
jmp 0x411849
push ebx
push esi
push edi
push 0x80
push 3
push edi
push 7
push 0x2000000
push dword [ebp - 0x90]
call fcn.0040fec4
add esp, 0x24
mov dword [ebp - 0x88], eax
cmp eax, 0xffffffff
jne 0x411854
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x88], eax
test ebx, ebx
je 0x4117fc
cmp dword [ebx], edi
jne 0x411843
test esi, esi
je 0x41180f
call fcn.004609ba
sub eax, dword [ebp - 0x8c]
cmp eax, esi
jae 0x411843
mov ebx, dword [ebp - 0x90]
push esi
push ebx
call fcn.00410a10
pop ecx
pop ecx
test eax, eax
je 0x411843
mov eax, dword [ebp - 0x88]
push eax
push str._GetLastError_
push eax
push dword [ebp - 0x94]
push ebx
push str.:8:GetFileSizeTimeOut___Seems_to_have_failed_because_of_an_access_rights_problem_:___s_:__u:_u:__s_ld
call fcn.0040d511
add esp, 0x18
push dword [ebp - 0x88]
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x411906
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x94], eax
cmp eax, 0xffffffff
jne 0x411894
test ebx, ebx
je 0x41186d
mov edi, dword [ebx]
push str._GetLastError_
push edi
push esi
push dword [ebp - 0x90]
push str.:7:GetFileSizeTimeOut___s____ld___d__FAILED:__s
call fcn.0040d9e1
mov edi, dword [ebp - 0x88]
add esp, 0x14
push 0x104f
jmp 0x4118f6
test eax, eax
je 0x41190a
push edi
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x8c], edi
mov edi, dword [ebp - 0x88]
push eax
push 0x80
lea eax, [ebp - 0x84]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4118cc
cmp dword [ebp - 0x8c], 0
jne 0x411910
push str._GetLastError_
push dword [ebp - 0x8c]
push dword [ebp - 0x94]
push esi
push dword [ebp - 0x90]
push str.:7:GetFileSizeTimeOut___s____ld__FAILED:_GetFileSize___returned__ld_but_ReadFile_____ldBytesRead__FAILED:__s
call fcn.0040d511
add esp, 0x18
push 0x105b
push str.C:UsersOfficeDocumentsVisual_StudioPAULAFile.c
push str.GetFileSizeTimeOut
push edi
call fcn.0040eb13
xor eax, eax
jmp 0x41192b
mov edi, dword [ebp - 0x88]
push 0x1060
push str.C:UsersOfficeDocumentsVisual_StudioPAULAFile.c
push str.GetFileSizeTimeOut
push edi
call fcn.0040eb13
mov eax, dword [ebp - 0x94]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004654a8
leave
ret