joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46cda0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fc650
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x53f030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0043ae40
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46cde4
push 0x80004005
call fcn.0043a9b0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
mov eax, dword [0x543c90]
mov ecx, 0x543c90
call dword [eax + 4]
or ebx, 0xffffffff
test eax, eax
je 0x46cf1f
push dword [ebp - 0x10]
call fcn.004dad74
add esp, 4
cmp eax, 0x22
jl 0x46cf1f
call fcn.0043ae40
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46ce44
push 0x80004005
call fcn.0043a9b0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 1
push dword [eax]
lea eax, [ebp - 0x14]
push dword [0x53e788]
push 0x509980
push eax
call fcn.0043ad30
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
add esp, 0x10
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x2001f
push esi
push reloc.WS2_32.dll_accept
call fcn.0043b290
test eax, eax
jne 0x46cef4
mov ebx, dword [ebp - 0x20]
lea eax, [ebp + 8]
push 4
push eax
push 4
push 0
push str.ff_rt_ds
push ebx
mov dword [ebp + 8], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
neg edi
sbb edi, edi
inc edi
test ebx, ebx
je 0x46ced2
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0xfffffff0
mov byte [ebp - 4], 0
or ebx, 0xffffffff
mov eax, ebx
lea ecx, [esi + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x46cf21
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x46cf21
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x46cf02
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0xfffffff0
mov byte [ebp - 4], 0
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46cf1f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor edi, edi
mov esi, dword [ebp - 0x10]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x46cf42
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46d120
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x504e08
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x53f030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0043ae40
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46d164
push 0x80004005
call fcn.0043a9b0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
push dword [eax]
lea eax, [ebp - 0x10]
push dword [0x53e788]
push 0x509980
push eax
call fcn.0043ad30
mov eax, dword [str.hpr_ff]
lea ecx, [ebp - 0x20]
mov esi, dword [ebp - 0x10]
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], 0
push 2
push esi
mov ebx, dword [eax]
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call fcn.0043b290
mov edi, dword [ebp - 0x20]
mov dword [ebp + 8], eax
test eax, eax
jne 0x46d1ef
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push ebx
push 1
push 0
push dword [ebp - 0x14]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp + 8], eax
test edi, edi
je 0x46d1fa
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp + 8], ebx
sete bl
add esi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46d223
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46d240
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x504e08
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x53f030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0043ae40
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46d284
push 0x80004005
call fcn.0043a9b0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
push dword [eax]
lea eax, [ebp - 0x10]
push dword [0x53e788]
push 0x509980
push eax
call fcn.0043ad30
add esp, 0x10
mov ecx, 0x50962c
cmp dword [ebp + 0xc], 0
mov eax, 0x509e64
cmove eax, ecx
lea ecx, [ebp + 0xc]
push eax
call fcn.0043a420
mov eax, dword [str.sa_ff]
lea ecx, [ebp - 0x20]
mov esi, dword [ebp - 0x10]
push 2
push esi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
push reloc.WS2_32.dll_accept
mov dword [ebp + 8], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call fcn.0043b290
mov edi, dword [ebp - 0x20]
mov ebx, eax
test ebx, ebx
jne 0x46d32b
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push ebx
push 1
push 0
push dword [ebp - 0x14]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test edi, edi
je 0x46d336
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 0xc]
test ebx, ebx
setne byte [ebp + 0xb]
add edx, 0xfffffff0
or edi, 0xffffffff
mov eax, edi
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x46d35b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor ebx, ebx
mov dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0xb], bl
sete bl
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x46d381
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46d3a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fbf08
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x53f030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0043ae40
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46d3e4
push 0x80004005
call fcn.0043a9b0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
push dword [eax]
lea eax, [ebp - 0x10]
push dword [0x53e788]
push 0x509980
push eax
call fcn.0043ad30
mov esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp + 0xc]
add esp, 0x10
mov ebx, dword [str.hpr_ff_set]
mov dword [ebp + 0xc], eax
mov dword [ebp - 0x1c], 0
push 2
push esi
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.0043b290
mov edi, dword [ebp - 0x1c]
mov dword [ebp + 8], eax
test eax, eax
jne 0x46d467
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp + 8], eax
test edi, edi
je 0x46d472
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp + 8], ebx
sete bl
add esi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46d49b
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46d4c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fbf08
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x53f030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0043ae40
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46d504
push 0x80004005
call fcn.0043a9b0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
push dword [eax]
lea eax, [ebp - 0x10]
push dword [0x53e788]
push 0x509980
push eax
call fcn.0043ad30
mov esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp + 0xc]
add esp, 0x10
mov ebx, dword [str.sa_ff_set]
mov dword [ebp + 0xc], eax
mov dword [ebp - 0x1c], 0
push 2
push esi
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.0043b290
mov edi, dword [ebp - 0x1c]
mov dword [ebp + 8], eax
test eax, eax
jne 0x46d587
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp + 8], eax
test edi, edi
je 0x46d592
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp + 8], ebx
sete bl
add esi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46d5bb
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46e660
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
call fcn.004d7790
test eax, eax
jne 0x46e675
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp dword [esi + 0x84], 0
mov dword [esi + 0x88], eax
jne 0x46e6ae
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x4d6a00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x84], eax
xor eax, eax
cmp dword [esi + 0x84], eax
pop esi
setne al
mov esp, ebp
pop ebp
ret
Function at 0x472a80
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fc570
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x53f030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 0xc]
call fcn.0043ac50
mov dword [ebp - 0x1c], 0
call fcn.0043ae40
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x472ad5
push 0x80004005
call fcn.0043a9b0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
xor esi, esi
mov ecx, edi
push eax
mov dword [ebp - 0x14], esi
xor ebx, ebx
call fcn.00471fc0
mov edi, dword [ebp - 0x18]
or ecx, 0xffffffff
cmp dword [edi - 0xc], ebx
jle 0x472b9a
call fcn.0043ae40
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
je 0x472acb
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push esi
mov byte [ebp - 4], 1
push dword [eax]
lea eax, [ebp - 0x10]
push edi
push str._sLocal_Storagechrome_extension__s__d.localstorage
push eax
call fcn.0043ad30
mov esi, dword [ebp - 0x10]
add esp, 0x14
cmp dword [esi - 0xc], 0
je 0x472b6a
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, eax
test ebx, ebx
je 0x472b6a
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
call fcn.0043a620
mov dword [ebp - 0x1c], 1
inc dword [ebp - 0x14]
add esi, 0xfffffff0
mov byte [ebp - 4], 0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x472b8b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, ebx
je 0x472b97
mov esi, dword [ebp - 0x14]
jmp 0x472b08
or ecx, 0xffffffff
add edi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x472bb8
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x474370
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fc7e8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x53f030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
call fcn.0043ae40
xor edx, edx
mov ecx, eax
test ecx, ecx
setne dl
test edx, edx
jne 0x4743b7
push 0x80004005
call fcn.0043a9b0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push dword [0x53e878]
push dword [0x53e870]
push reloc.WS2_32.dll_accept
call fcn.004b9fe0
mov edi, dword [ebp + 8]
add esp, 0x10
or ebx, 0xffffffff
test eax, eax
jne 0x474453
lea eax, [ebp - 0x10]
push eax
push dword [0x53e878]
push dword [0x53e870]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004b9fe0
add esp, 0x10
test eax, eax
jne 0x474453
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
push edi
call fcn.00471270
mov edi, eax
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0xc]
lock xadd dword [ecx], ebx
dec ebx
test ebx, ebx
jg 0x47443d
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
jl 0x474474
push 0x509c8c
push esi
call fcn.004d9e7e
add esp, 8
test eax, eax
je 0x474474
sub eax, esi
sar eax, 1
je 0x4744c9
push 0x5c
push esi
call fcn.004dae9b
add esp, 8
test eax, eax
jne 0x474488
or eax, 0xffffffff
jmp 0x47448c
sub eax, esi
sar eax, 1
push eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.0043b0a0
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0043a620
mov edx, dword [ebp + 8]
mov ecx, ebx
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4744c6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x10]
push str.User_Data
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
call fcn.004592f0
add esp, 0xc
push eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.0043a620
mov edx, dword [ebp + 8]
mov ecx, ebx
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x47450a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x474414
mov edi, 1
jmp 0x47441f
Function at 0x475520
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fffa8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x53f030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0043ae40
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x475561
push 0x80004005
call fcn.0043a9b0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 0x50ba48
push dword [0x53e874]
push reloc.WS2_32.dll_accept
call fcn.004b9fe0
add esp, 0x10
test eax, eax
je 0x4755a2
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
jge 0x475661
lea eax, [ebp - 0x10]
push eax
push 0x50ba48
push dword [0x53e874]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004b9fe0
add esp, 0x10
test eax, eax
je 0x4755cf
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
jge 0x475661
lea eax, [ebp - 0x10]
push eax
push dword [0x53e878]
push dword [0x53e870]
push reloc.WS2_32.dll_accept
call fcn.004b9fe0
add esp, 0x10
test eax, eax
je 0x4755f9
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
jge 0x47561d
lea eax, [ebp - 0x10]
push eax
push dword [0x53e878]
push dword [0x53e870]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004b9fe0
mov esi, dword [ebp - 0x10]
add esp, 0x10
cmp dword [esi - 0xc], 0
jle 0x47565d
push 1
push 0x509c8c
lea ecx, [ebp - 0x10]
call fcn.00452320
mov edx, dword [0x53e82c]
test edx, edx
jne 0x47563c
xor ecx, ecx
jmp 0x475650
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x475641
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x10]
call fcn.00452320
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
jle 0x475675
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x475675
mov edi, 1
jmp 0x475677
xor edi, edi
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x475698
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4756b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fffa8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x53f030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0043ae40
xor edx, edx
mov ecx, eax
test ecx, ecx
setne dl
test edx, edx
jne 0x4756f3
push 0x80004005
call fcn.0043a9b0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00471fc0
test eax, eax
je 0x475738
push 0xa
push str.Sync_Data
lea ecx, [ebp - 0x10]
call fcn.00452320
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47573b
mov edi, 1
jmp 0x47573d
mov esi, dword [ebp - 0x10]
xor edi, edi
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x47575e
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x476d80
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fcb0b
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x53f030]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea esi, [ecx + 0xc]
push esi
call fcn.00471ed0
test eax, eax
jne 0x476dc1
xor eax, eax
jmp 0x476e1c
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x476dbd
push 3
push dword [esi]
lea eax, [ebp - 0x90]
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x94], eax
call fcn.00465ce0
push dword [ebp - 0x94]
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.0045a670
neg eax
lea ecx, [ebp - 0x90]
sbb esi, esi
mov eax, dword [ebp - 0x94]
cmp eax, ecx
je 0x476e19
push eax
call fcn.004d92bb
add esp, 4
lea eax, [esi + 1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d89fb
mov esp, ebp
pop ebp
ret 4
Function at 0x4771e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x501ad0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x53f030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0043ae40
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x477224
push 0x80004005
call fcn.0043a9b0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], 0
call fcn.0043ac50
lea eax, [ebp - 0x10]
push eax
call fcn.00482b50
mov edi, dword [ebp - 0x10]
add esp, 4
or ebx, 0xffffffff
test eax, eax
je 0x477336
call fcn.0043ae40
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x477276
push 0x80004005
call fcn.0043a9b0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 1
mov ebx, 0x53c388
lea esp, [esp]
cmp ebx, 0x53c394
jge 0x477316
push dword [ebx]
lea eax, [ebp - 0x14]
push edi
push 0x509980
push eax
call fcn.0043ad30
mov esi, dword [ebp - 0x14]
add esp, 0x10
cmp dword [esi - 0xc], 0
je 0x4772ea
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4772ea
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.00477370
add esp, 0xc
test eax, eax
je 0x4772ea
push dword [ebp + 8]
call fcn.00475780
add esp, 4
test eax, eax
jne 0x4772ef
mov ecx, dword [ebp + 8]
call fcn.00462a50
add ebx, 4
jmp 0x477290
add esi, 0xfffffff0
mov byte [ebp - 4], 0
or ebx, 0xffffffff
mov eax, ebx
lea ecx, [esi + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x47730f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 1
jmp 0x477338
add esi, 0xfffffff0
mov byte [ebp - 4], 0
or ebx, 0xffffffff
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x477336
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
add edi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x477356
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x477370
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fcbe0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x53f030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x18], ebx
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push dword [ebp + 8]
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, 0xffffffff
je 0x477441
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x477441
push edi
call fcn.004d7faf
add esp, 4
mov dword [ebp - 0x14], eax
test eax, eax
je 0x477441
push 0
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push ecx
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x477441
cmp dword [ebp - 0x10], 0
jbe 0x477441
push edi
mov edi, dword [ebp - 0x14]
lea ecx, [ebp - 0x14]
push edi
call fcn.0046fa70
push dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00470430
push edi
call fcn.004d89f6
add esp, 4
lea ecx, [ebp - 0x14]
call fcn.00441080
mov edi, 1
jmp 0x47744e
push dword [ebp + 0x10]
call fcn.00472da0
add esp, 4
xor edi, edi
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x47745c
push esi
call ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret