joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407480
Capabilities:
Delete file
Get common file path
Get startup folder

Disassembly:
sub esp, 8
push ebx
push esi
mov bl, 1
call fcn.00407200
test al, al
je 0x40754b
push 0x208
call fcn.00433608
mov esi, eax
add esp, 4
test esi, esi
jne 0x4074af
pop esi
xor al, al
pop ebx
add esp, 8
ret
lea eax, [esp + 8]
push eax
push 7
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x4074c4
xor bl, bl
mov eax, dword [esp + 8]
test eax, eax
jne 0x4074df
push esi
xor bl, bl
call fcn.004335c0
add esp, 4
mov al, bl
pop esi
pop ebx
add esp, 8
ret
test bl, bl
je 0x407542
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x407510
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 3
jle 0x407510
push str.AOM.lnk
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x407512
xor bl, bl
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x407542
mov eax, dword [esp + 0xc]
test eax, eax
je 0x407542
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x40753c
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x14]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call fcn.004335c0
add esp, 4
mov al, bl
pop esi
pop ebx
add esp, 8
ret
Function at 0x407e40
Capabilities:
Set current directory

Disassembly:
sub esp, 0x12c
push ebp
push esi
push edi
mov edi, 0x48c6f4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov eax, ecx
mov esi, edi
mov edi, edx
mov byte [esp + 0x14], 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
sub esp, 0x20
and ecx, 3
lea eax, [esp + 0x2c]
rep movsb byte es:[edi], byte [esi]
mov ecx, 8
lea esi, [esp + 0x34]
mov edi, esp
mov dword [esp + 0x2c], 0x104
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x15c]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 4]
push ecx
push edx
lea ecx, [esp + 0x5c]
push eax
push ecx
call fcn.0040b460
add esp, 0x30
test eax, eax
jne 0x408002
mov edx, dword [esi + 0x30]
push edx
call fcn.00401800
add esp, 4
test eax, eax
jle 0x407fa7
lea eax, [esp + 0x34]
push eax
call fcn.00401800
mov cl, byte [esp + eax + 0x37]
add esp, 4
cmp cl, 0x5c
je 0x407ef9
mov ecx, dword [esi + 0x30]
cmp byte [ecx], 0x5c
je 0x407ef9
lea edx, [esp + 0x34]
push 0x483d38
push edx
call fcn.00401820
add esp, 8
mov eax, dword [esi + 0x30]
lea ecx, [esp + 0x34]
push eax
push ecx
call fcn.00401820
add esp, 8
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ebp, dword [esp + 0x148]
test eax, eax
jne 0x407f3c
lea eax, [esp + 0x34]
push eax
call fcn.0040a030
add esp, 4
neg al
sbb eax, eax
and al, 0x98
add eax, 0x68
mov dword [esp + 0x10], eax
jne 0x407fad
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [esp + eax + 0x33], 0x5c
je 0x407f60
lea edx, [esp + 0x34]
push 0x483d38
push edx
call fcn.00401820
add esp, 8
mov eax, dword [esi + 0x10]
lea ecx, [esp + 0x34]
push eax
push ecx
call fcn.00401820
add esp, 8
mov ecx, esi
push ebp
call sym.AOM.exe_public:_unsigned_char____thiscall_AODB_inventory_item::GetName_void_
push eax
call fcn.00405930
mov eax, dword [esi + 0x10]
lea edx, [esp + 0x3c]
push ebp
push edx
push eax
call fcn.00405bd0
mov edx, dword [esp + 0x154]
lea ecx, [esp + 0x48]
push ecx
push edx
call fcn.0040bea0
add esp, 0x1c
test eax, eax
jne 0x407fad
push 0x10
push 0x20
jmp 0x407ffb
mov edi, dword [esp + 0x144]
push 0x104
push edi
push 0x8d
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x483e18
push edi
call fcn.00401820
add esp, 8
mov ecx, esi
call sym.AOM.exe_public:_unsigned_char____thiscall_AODB_inventory_item::GetName_void_
push eax
push edi
call fcn.00401820
push ebp
push edi
call fcn.00405b40
add esp, 0x10
push 0x10
push 0x80
mov ecx, esi
call sym.AOM.exe_public:_void___thiscall_AODB_inventory_item::ChangeStatus_unsigned_long_int__unsigned_long_int_
mov byte [esi + 0x48], 0
pop edi
pop esi
mov al, 1
pop ebp
add esp, 0x12c
ret
Function at 0x40b0d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x620
mov edx, dword [esp + 0x62c]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea eax, [esp + 8]
push edi
lea ecx, [esp + 0x218]
push eax
push ecx
mov edi, 0x105
push edx
push SysReAllocStringLen
xor ebx, ebx
mov dword [esp + 0x1c], edi
call esi
test eax, eax
jne 0x40b20b
lea eax, [esp + 0x218]
push 0x208
lea ecx, [esp + 0x424]
push eax
push ecx
call fcn.004321f0
push 0x208
lea edx, [esp + 0x430]
push str._shellopencommand
push edx
call fcn.00433ce0
add esp, 0x18
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x420]
push eax
push ecx
push edx
push SysReAllocStringLen
mov dword [esp + 0x1c], edi
call esi
test eax, eax
jne 0x40b191
mov eax, dword [esp + 0x634]
mov ecx, dword [esp + 0x630]
mov edx, dword [esp + 0xc]
push eax
push ecx
lea eax, [esp + 0x18]
push edx
push eax
call fcn.0040b220
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x620
ret
cmp eax, 0xd
jne 0x40b20b
lea ecx, [esp + 0x320]
lea edx, [esp + 0x118]
push ecx
push edx
push 0
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00433b90
lea ecx, [esp + 0x334]
lea edx, [esp + 0x12c]
push ecx
push edx
lea eax, [esp + 0x2c]
push str._s_s
push eax
call fcn.00432370
mov ecx, dword [esp + 0x658]
lea edi, [esp + 0x34]
push ecx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x658]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push edx
lea eax, [esp + 0x3c]
push ecx
push eax
call fcn.0040b220
add esp, 0x34
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x620
ret
pop edi
pop esi
mov eax, 0x71
pop ebx
add esp, 0x620
ret
Function at 0x40b270
Capabilities:
Create directory
Set current directory

Disassembly:
mov al, byte [0x48c8e8]
push ebp
xor ebp, ebp
push esi
test al, 1
jne 0x40b362
or al, 1
push ebx
mov byte [0x48c8e8], al
mov al, byte [esp + 0x14]
push edi
mov byte [0x48c8f0], al
mov edi, str.Web
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
xor esi, esi
mov dword [0x48c8f4], edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [0x48c8f8], ebp
mov ebx, ecx
mov dword [0x48c8fc], esi
cmp ebx, 0xfffffffd
jbe 0x40b2f5
call fcn.00443243
mov edx, dword [0x48c8f4]
cmp edx, ebp
je 0x40b2ef
mov al, byte [edx - 1]
test al, al
je 0x40b2ef
cmp al, 0xff
je 0x40b2ef
cmp ebx, ebp
jne 0x40b31c
dec al
push ebp
mov ecx, 0x48c8f0
mov byte [edx - 1], al
call fcn.00409470
jmp 0x40b353
mov esi, dword [0x48c8fc]
cmp ebx, ebp
jne 0x40b307
push 1
mov ecx, 0x48c8f0
call fcn.00409470
jmp 0x40b353
cmp esi, 0x1f
ja 0x40b310
cmp esi, ebx
jae 0x40b32d
push 1
mov ecx, 0x48c8f0
call fcn.00409470
push ebx
mov ecx, 0x48c8f0
call fcn.00409720
mov edx, dword [0x48c8f4]
mov ecx, ebx
mov edi, edx
mov edx, ecx
mov esi, str.Web
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x48c8f4]
mov dword [0x48c8f8], ebx
mov byte [eax + ebx], 0
push 0x40b3b0
call fcn.00431d88
add esp, 4
pop edi
pop ebx
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
push 0x48c8f0
push ecx
push esi
call fcn.0040a370
add esp, 0xc
test al, al
je 0x40b3a9
mov edx, dword [str.Web]
push edx
push esi
call fcn.00401820
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x40b3a9
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
mov eax, 0x68
je 0x40b3ab
mov eax, ebp
pop esi
pop ebp
ret

Function at 0x40b400
Capabilities:
Create directory
Set current directory

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push edi
push eax
push esi
call fcn.0040b270
mov edi, eax
add esp, 8
test edi, edi
jne 0x40b455
push 0x483d38
push esi
call fcn.00401820
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.004018c0
push eax
push esi
call fcn.00401820
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x40b455
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
mov eax, 0x68
je 0x40b457
mov eax, edi
pop edi
pop esi
ret
Function at 0x40b5d0
Capabilities:
Create directory
Query or enumerate registry value
Set current directory
Set registry value

Disassembly:
sub esp, 0x15c
push ebx
push esi
mov esi, dword [esp + 0x168]
mov dword [esp + 0xc], 0
test esi, esi
mov byte [esp + 0xb], 0
jne 0x40b5fe
pop esi
mov eax, 2
pop ebx
add esp, 0x15c
ret
mov ebx, dword [esp + 0x16c]
test ebx, ebx
jne 0x40b628
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x104
push eax
push esi
call fcn.0040b270
add esp, 8
pop esi
pop ebx
add esp, 0x15c
ret
push ebp
push 0x105
call fcn.00433608
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x40b723
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.SoftwareAdobe_
push ebp
call edi
push ebx
call fcn.004018c0
add esp, 4
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x1c]
push ecx
push ebp
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40b711
lea edx, [esp + 0x24]
push str.OnlineDownloadPath
push edx
mov dword [esp + 0x20], 0x104
call edi
lea eax, [esp + 0x18]
lea ecx, [esp + 0x64]
push eax
lea edx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
lea eax, [esp + 0x30]
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40b6bc
lea edx, [esp + 0x64]
push edx
push esi
call edi
jmp 0x40b701
lea eax, [esp + 0x18]
push ebx
push eax
push esi
mov dword [esp + 0x24], 0x104
call fcn.0040b400
add esp, 0xc
mov dword [esp + 0x14], eax
test eax, eax
jne 0x40b706
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x1c]
not ecx
push ecx
mov dword [esp + 0x1c], ecx
push esi
push 1
lea ecx, [esp + 0x30]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40b706
mov byte [esp + 0x13], 1
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.004335c0
mov al, byte [esp + 0x17]
add esp, 4
test al, al
pop edi
jne 0x40b73c
mov byte [esi], 0
pop ebp
mov dword [esp + 0xc], 0x6b
mov eax, dword [esp + 0xc]
pop esi
pop ebx
add esp, 0x15c
ret
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x40b75b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40b75b
mov dword [esp + 0x10], 0x68
mov eax, dword [esp + 0x10]
pop ebp
pop esi
pop ebx
add esp, 0x15c
ret
Function at 0x40b850
Capabilities:
Get file version info

Disassembly:
sub esp, 8
lea eax, [esp]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push eax
push ebp
xor edi, edi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x40b922
lea ecx, [esi + 1]
push ebx
push ecx
call fcn.00453048
add esp, 4
mov ebx, eax
push ebx
push esi
push edi
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x40b90f
lea edx, [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x483d38
push ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40b90f
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov edi, dword [ecx + 8]
mov edx, edi
shr edx, 0x10
push edx
push 0x484320
push esi
call fcn.00432370
and edi, 0xffff
push edi
push esi
push str._s_d.
push esi
call fcn.00432370
mov eax, dword [esp + 0x38]
mov edi, dword [eax + 0xc]
mov ecx, edi
shr ecx, 0x10
push ecx
push esi
push str._s_d.
push esi
call fcn.00432370
and edi, 0xffff
push edi
push esi
push str._s_d
push esi
call fcn.00432370
add esp, 0x3c
mov edi, 1
push ebx
call fcn.00453071
add esp, 4
mov eax, edi
pop ebx
pop edi
pop esi
pop ebp
add esp, 8
ret
mov edx, dword [esp + 0x1c]
push 0x48c6f4
push edx
call fcn.00432370
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
add esp, 8
ret

Function at 0x40bdb0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x44
push ebx
push esi
push 0x104
xor ebx, ebx
call fcn.00433608
mov esi, eax
add esp, 4
test esi, esi
jne 0x40bdd5
pop esi
mov eax, 7
pop ebx
add esp, 0x44
ret
mov eax, dword [esp + 0x54]
test eax, eax
je 0x40be3d
mov edx, dword [esp + 0x58]
test edx, edx
je 0x40be3d
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x40be3d
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x64]
lea ecx, [esp + 0xc]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push edx
push 0
mov dword [esp + 0x34], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
jne 0x40be2c
mov ebx, 0x77
push esi
call fcn.004335c0
add esp, 4
mov eax, ebx
pop esi
pop ebx
add esp, 0x44
ret
push esi
call fcn.004335c0
add esp, 4
mov eax, 2
pop esi
pop ebx
add esp, 0x44
ret

Function at 0x40bea0
Capabilities:
Delete file

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
call fcn.0040be60
add esp, 4
test al, al
je 0x40bee2
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x40becf
push esi
push edi
call fcn.00433e03
add esp, 8
pop edi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
call fcn.00433e03
add esp, 8
pop edi
pop esi
ret
mov eax, dword [esp + 0xc]
pop edi
pop esi
ret
Function at 0x40c000
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
push ebx
push ebp
push esi
mov esi, dword [esp + 0x12c]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x48c6f4
push esi
xor ebp, ebp
call edi
mov ebx, dword [esp + 0x124]
cmp ebx, 0xffffffff
jne 0x40c03b
lea eax, [esp + 0x1c]
push str.SoftwareAdobeRegistrationUser
push eax
call edi
jmp 0x40c053
lea ecx, [esp + 0x1c]
push str.SoftwareAdobe_
push ecx
call edi
lea edx, [esp + 0x1c]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
push 0x20019
push 0
push ecx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40c0cf
mov ebx, dword [esp + 0x12c]
mov dword [esp + 0x14], pe_nt_image_headers32
push ebx
push esi
call edi
mov ecx, dword [esp + 0x128]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40c0ae
push ebx
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
Function at 0x40d9f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
push ebx
push ebp
mov ebp, dword [esp + 0x5c]
push esi
mov edx, dword [esp + 0x6c]
push edi
mov ecx, 0x13
xor eax, eax
lea edi, [esp + 0x14]
xor ebx, ebx
rep stosd dword es:[edi], eax
movsx eax, word [esp + 0x68]
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], ecx
mov ecx, ebp
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], edx
call sym.AOM.exe_public:_void___thiscall_AODB_InventoryArray::destructor_void_
push 0x4c
call fcn.00453048
add esp, 4
test eax, eax
je 0x40da47
mov ecx, eax
call sym.AOM.exe_public:_void___thiscall_AODB_inventory_item::constructor_void_
mov esi, eax
jmp 0x40da49
xor esi, esi
lea eax, [esp + 0x14]
push eax
call fcn.00416870
add esp, 4
test eax, eax
jne 0x40dac7
mov edi, dword [esp + 0x78]
mov ebx, dword [esp + 0x74]
jne 0x40dab2
test dword [esp + 0x30], 0x100036
jne 0x40dab2
mov al, byte [esp + 0x3b]
test al, al
jne 0x40dab2
mov al, byte [esp + 0x3c]
test al, al
jne 0x40dab2
test esi, esi
je 0x40daaa
lea ecx, [esp + 0x14]
push ecx
push esi
call fcn.0040e8b0
add esp, 8
mov ecx, ebp
push edi
push ebx
push esi
call sym.AOM.exe_public:_enum__AODB_error_code___thiscall_AODB_InventoryArray::AddInventoryItemWithCopy_class_AODB_inventory_item___long_int__long_int_
cmp eax, 4
je 0x40daa4
cmp eax, 5
jne 0x40dab2
mov dword [esp + 0x10], eax
jmp 0x40dab2
mov dword [esp + 0x10], 4
lea edx, [esp + 0x14]
push edx
call fcn.00416940
add esp, 4
test eax, eax
je 0x40da64
mov ebx, dword [esp + 0x10]
test esi, esi
je 0x40dadb
mov ecx, esi
call sym.AOM.exe_public:_void___thiscall_AODB_inventory_item::destructor_void_
push esi
call fcn.00453071
add esp, 4
lea eax, [esp + 0x14]
push eax
call fcn.00417940
add esp, 4
test ebx, ebx
je 0x40daf8
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x50
ret 0x18
mov ecx, ebp
call sym.AOM.exe_public:_class_AODB_InventoryListElement____thiscall_AODB_InventoryListElement::GetNext_void_
neg eax
sbb eax, eax
pop edi
and al, 0xfe
pop esi
pop ebp
add eax, 2
pop ebx
add esp, 0x50
ret 0x18
Function at 0x418280
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
cmp word [edi], 0
je 0x41829e
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x41829e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [esi], 0xffffffff
mov word [edi], 0
pop edi
mov eax, 9
pop esi
ret
Function at 0x41ec10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x14]
push edi
mov di, word [esp + 0x14]
cmp di, 1
je 0x41ec36
cmp di, 3
jne 0x41ec61
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
cmp eax, ecx
je 0x41ec61
push esi
call fcn.004209e0
add esp, 4
cmp word [eax + 0x44], 2
jne 0x41ec53
mov ecx, dword [esp + 0x20]
push ecx
push esi
call fcn.0042a9a0
jmp 0x41ec5e
mov edx, dword [esp + 0x20]
push edx
push esi
call fcn.0042b3a0
add esp, 8
mov eax, dword [esp + 0x1c]
dec eax
test ax, ax
jl 0x41ee25
movsx eax, ax
movsx ecx, si
shl ecx, 2
lea edx, [eax + eax]
inc eax
push ebx
push ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x10], eax
jmp 0x41ec95
mov di, word [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov eax, dword [0x48f640]
mov edx, dword [eax + 0xc24]
mov eax, dword [edx + ecx]
mov ecx, dword [esp + 0x20]
mov si, word [eax + ecx]
push esi
call fcn.004209e0
add esp, 4
mov ebp, eax
cmp di, 1
mov dword [esp + 0x24], ebp
jne 0x41ecf9
push esi
call fcn.0041ee30
add esp, 4
test eax, eax
je 0x41ee09
mov edx, dword [esp + 0x28]
push edx
push eax
push esi
call fcn.0042b6a0
add esp, 0xc
test ax, ax
je 0x41ee09
mov eax, dword [0x48f640]
mov word [eax + 0x78], 0x69
jmp 0x41ee09
push 0
cmp di, 2
push 0
push esi
jne 0x41ed33
call fcn.00429f00
add esp, 0xc
test eax, eax
je 0x41ee09
mov ecx, dword [esp + 0x2c]
push 0
push ecx
push eax
push esi
call fcn.0042dcf0
add esp, 0x10
test ax, ax
je 0x41ee09
jmp 0x41edfd
call fcn.00429f00
push esi
mov edi, eax
call fcn.0041ee30
mov ecx, dword [esp + 0x3c]
mov ebx, eax
mov eax, dword [esp + 0x38]
add esp, 0x10
cmp ecx, eax
jne 0x41ed6c
test edi, edi
je 0x41edab
test ebx, ebx
je 0x41ed6c
push ebp
push ebx
push edi
call fcn.0042c480
add esp, 0xc
test eax, eax
je 0x41ee09
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
xor ebp, ebp
cmp ecx, eax
je 0x41edb1
mov eax, dword [esp + 0x24]
mov cl, byte [eax + 0x3e]
test cl, cl
jne 0x41edb1
test edi, edi
je 0x41edb1
test ebx, ebx
je 0x41edb1
push eax
push ebx
push edi
call fcn.0042c480
add esp, 0xc
test eax, eax
jne 0x41edb1
mov dword [esp + 0x24], 1
mov ebp, 0x40
jmp 0x41edb9
test ebx, ebx
je 0x41ee09
jmp 0x41ed6c
mov dword [esp + 0x24], 0
test edi, edi
je 0x41eddd
mov edx, dword [esp + 0x2c]
push ebp
push edx
push edi
push esi
call fcn.0042dcf0
add esp, 0x10
test ax, ax
je 0x41eddd
mov eax, dword [0x48f640]
mov word [eax + 0x78], 0x69
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x41ee09
test ebx, ebx
je 0x41ee09
mov ecx, dword [esp + 0x28]
push ecx
push ebx
push esi
call fcn.0042b6a0
add esp, 0xc
test ax, ax
je 0x41ee09
mov edx, dword [0x48f640]
mov word [edx + 0x78], 0x69
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
sub ecx, 2
dec eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], eax
jne 0x41ec8c
pop ebp
pop ebx
pop edi
pop esi
add esp, 8
ret
Function at 0x41f450
Capabilities:
Get file size

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
cmp byte [esi + 0x110], 0x76
jne 0x41f47b
push esi
call fcn.0042c530
add esp, 4
test eax, eax
je 0x41f47b
push 0x24ef
call fcn.00422ff0
add esp, 4
mov ecx, dword [esi + 0xe4]
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
pop esi
add esp, 8
ret

Function at 0x41f500
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
push ebx
xor ebx, ebx
push ebp
cmp eax, ebx
push edi
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebx
jne 0x41f528
mov eax, dword [esp + 0x20]
mov edi, dword [eax + 0xe4]
jmp 0x41f52c
mov edi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x28]
push ebp
push edi
call fcn.0041f4a0
add esp, 8
test ax, ax
je 0x41f54a
pop edi
pop ebp
mov ax, 0x23
pop ebx
add esp, 0xc
ret
mov ax, word [esp + 0x1c]
push esi
mov esi, dword [esp + 0x34]
cmp ax, bx
je 0x41f55f
cmp ax, 1
jne 0x41f5a8
push ebx
push esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LockFile]
push ebp
push edi
call ebx
test eax, eax
jne 0x41f5a0
mov ecx, dword [esp + 0x14]
mov edx, ecx
inc ecx
cmp edx, 0xbb8
mov dword [esp + 0x14], ecx
jge 0x41f59c
push 0x32
call fcn.0041fd80
add esp, 4
push 0
push esi
push 0
push ebp
push edi
call ebx
test eax, eax
je 0x41f570
jmp 0x41f5a0
test eax, eax
je 0x41f5a8
mov dword [esp + 0x18], 1
mov ebx, dword [esp + 0x38]
cmp word [esp + 0x20], 0
push 0
push ebx
push esi
jne 0x41f5ef
mov eax, dword [esp + 0x3c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebx], esi
je 0x41f624
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x48f640]
mov word [ecx + 0x76], ax
mov eax, dword [ebx]
cmp eax, 0xffffffff
jne 0x41f5e5
mov dword [ebx], 0
mov dword [esp + 0x10], 0x24
jmp 0x41f624
mov edx, dword [esp + 0x3c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebx], esi
je 0x41f624
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x48f640]
mov word [ecx + 0x76], ax
mov eax, dword [ebx]
cmp eax, 0xffffffff
jne 0x41f61c
mov dword [ebx], 0
mov dword [esp + 0x10], 0x25
mov eax, dword [esp + 0x18]
test eax, eax
je 0x41f639
push 0
push esi
push 0
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
mov ax, word [esp + 0x10]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x41f7f0
Capabilities:
Delete file

Disassembly:
sub esp, 0x100
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp]
push esi
push edi
mov edi, dword [esp + 0x10c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x48f640]
pop edi
pop esi
cmp dword [ecx + 0x608], 3
jne 0x41f854
lea edx, [esp]
push edx
call fcn.0041f720
add esp, 4
test ax, ax
jle 0x41f854
mov ecx, dword [0x48f640]
mov word [ecx + 0x74], ax
add esp, 0x100
ret
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x41f889
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x48f640]
mov word [ecx + 0x76], ax
mov edx, dword [0x48f640]
mov eax, 0x37
mov word [edx + 0x74], ax
add esp, 0x100
ret
xor ax, ax
add esp, 0x100
ret

Function at 0x420210
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]