joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b098
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0043cf9a
and dword [ebp - 4], 0
cmp dword [0x468d10], 0
mov ebx, eax
jne 0x44b149
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x44b1fa
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x45abcc
push edi
call esi
test eax, eax
je 0x44b1fa
push eax
call fcn.0043cf28
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x468d10], eax
call esi
push eax
call fcn.0043cf28
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x468d14], eax
call esi
push eax
call fcn.0043cf28
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x468d18], eax
call esi
push eax
call fcn.0043cf28
pop ecx
mov dword [0x468d20], eax
test eax, eax
je 0x44b149
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0043cf28
pop ecx
mov dword [0x468d1c], eax
mov eax, dword [0x468d1c]
cmp eax, ebx
je 0x44b1a1
cmp dword [0x468d20], ebx
je 0x44b1a1
push eax
call fcn.0043cfa4
push dword [0x468d20]
mov esi, eax
call fcn.0043cfa4
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x44b1a1
test edi, edi
je 0x44b1a1
call esi
test eax, eax
je 0x44b198
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x44b198
test byte [ebp - 0xc], 1
jne 0x44b1a1
or dword [ebp + 0x10], 0x200000
jmp 0x44b1da
mov eax, dword [0x468d14]
cmp eax, ebx
je 0x44b1da
push eax
call fcn.0043cfa4
pop ecx
test eax, eax
je 0x44b1da
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x44b1da
mov eax, dword [0x468d18]
cmp eax, ebx
je 0x44b1da
push eax
call fcn.0043cfa4
pop ecx
test eax, eax
je 0x44b1da
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x468d10]
call fcn.0043cfa4
pop ecx
test eax, eax
je 0x44b1fa
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x44b1fc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4504e6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x450517
call fcn.00437d32
mov dword [eax], esi
call fcn.00437d1f
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00435ba4
add esp, 0x14
push 0x16
pop eax
jmp 0x45056c
test dword [ebp + 0xc], 0xfffffff9
jne 0x4504f3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x450544
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00437d45
pop ecx
call fcn.00437d1f
mov eax, dword [eax]
jmp 0x45056c
test al, 0x10
jne 0x45056a
test al, 1
je 0x45056a
test byte [ebp + 0xc], 2
je 0x45056a
call fcn.00437d32
mov dword [eax], 5
call fcn.00437d1f
mov dword [eax], 0xd
jmp 0x45053b
xor eax, eax
pop esi
pop ebp
ret
Function at 0x41b260
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
mov eax, dword [0x4d33b4]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [esp + 4]
push esi
mov dword [esp + 8], 0
push edi
mov edi, dword [0x4d8394]
mov ecx, edi
push eax
mov dword [esp + 0x10], 0x4182c8
mov dword [esp + 0x14], 1
call fcn.00421fd0
test al, al
jne 0x41b2cc
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x4182c0
push eax
mov ecx, edi
mov dword [esp + 0x14], 7
call fcn.00421fd0
test al, al
je 0x41b3a0
cmp dword [0x4d836c], 0
je 0x41b2e3
cmp byte [0x4d9358], 0
jne 0x41b469
int3
mov eax, dword [0x4d8388]
push 0x10
mov dword [0x4d836c], eax
call fcn.004aa0fc
mov esi, eax
mov dword [esp + 0x10], 0x4182c0
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 7
push eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x1c], 0x4182c8
push eax
mov ecx, edi
mov dword [esp + 0x24], 1
call fcn.004220d0
push eax
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
lea eax, [esp + 0x28]
push eax
call fcn.004220d0
push eax
mov ecx, esi
call fcn.00438ed0
mov dword [0x4d8388], eax
mov eax, dword [esp + 0x30]
cmp eax, 0x10
jb 0x41b35e
inc eax
lea ecx, [esp + 0x1c]
push eax
push dword [esp + 0x20]
call fcn.0041e500
mov eax, dword [esp + 0x48]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
cmp eax, 0x10
jb 0x41b38b
inc eax
lea ecx, [esp + 0x34]
push eax
push dword [esp + 0x38]
call fcn.0041e500
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], 0
mov byte [esp + 0x34], 0
mov eax, dword [ebx]
mov dword [0x4d3f10], eax
test al, 1
jne 0x41b3bf
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.004aab4c
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4d8380]
test eax, eax
je 0x41b3d9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4d8380], 0
mov edx, dword [0x4d8384]
test edx, edx
jne 0x41b408
push 0x18
call fcn.004aa0fc
mov edx, eax
add esp, 4
xor eax, eax
mov dword [0x4d8384], edx
mov dword [edx + 0x14], 7
mov dword [edx + 0x10], 0
mov word [edx], ax
mov esi, dword [ebx + 4]
cmp word [esi], 0
jne 0x41b415
xor ecx, ecx
jmp 0x41b42f
mov ecx, esi
lea edi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41b420
sub ecx, edi
sar ecx, 1
push ecx
push esi
mov ecx, edx
call fcn.0041db30
cmp dword [ebx + 0xc], 0
jne 0x41b452
mov eax, dword [0x4d8384]
cmp dword [eax + 0x14], 8
jb 0x41b44b
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.0041b0d0
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004aab4c
mov esp, ebp
pop ebp
ret
push 1
call fcn.004b94a2
int3
Function at 0x41b6f0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x43c
mov eax, dword [0x4d33b4]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
mov ebx, ecx
push esi
push edi
lea edi, [ebx + 8]
push edi
call fcn.00420560
add esp, 4
lea eax, [esp + 0x10]
lea esi, [ebx + 0xc]
mov ecx, esi
push eax
call fcn.0041e390
mov eax, dword [0x4d837c]
test eax, eax
je 0x41b759
lea ecx, [esp + 0x10]
push ecx
push dword [ebx + 0xa0]
push dword [ebx + 0xa8]
push dword [ebx + 0xa4]
push dword [ebx]
call eax
add esp, 0x14
test al, al
jne 0x41b881
test byte [0x4d3f10], 2
je 0x41b779
cmp dword [esp + 0x24], 0x10
lea eax, [esp + 0x10]
cmovae eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x41b77e
cmp dword [ebx], 2
jl 0x41b7bd
cmp dword [esp + 0x24], 0x10
lea edi, [esp + 0x10]
mov esi, dword [esp + 0x20]
cmovae edi, dword [esp + 0x10]
push 2
call fcn.004b5d4c
add esp, 4
push eax
push 1
push esi
push edi
call fcn.004b6d0b
push 2
call fcn.004b5d4c
add esp, 0x14
push eax
call fcn.004b61f3
lea edi, [ebx + 8]
add esp, 4
lea esi, [ebx + 0xc]
test byte [0x4d3f10], 1
je 0x41b7f5
call fcn.0041b0d0
test al, al
je 0x41b7f5
cmp dword [esp + 0x24], 0x10
lea ecx, [esp + 0xc]
push 0
push ecx
push dword [esp + 0x28]
lea eax, [esp + 0x1c]
cmovae eax, dword [esp + 0x1c]
push eax
push dword [0x4d8380]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebx], 3
jne 0x41b881
mov ecx, 0x400
lea eax, [esp + 0x10]
cmp dword [esp + 0x20], ecx
cmovb ecx, dword [esp + 0x20]
cmp dword [esp + 0x24], 0x10
cmovae eax, dword [esp + 0x10]
test ecx, ecx
je 0x41b82d
push ecx
push eax
lea eax, [esp + 0x48]
push eax
call fcn.004ad220
add esp, 0xc
lea eax, [esp + 0x40]
push eax
call fcn.00438ab0
add esp, 4
cmp dword [0x4d838c], 0
je 0x41b877
lea eax, [esp + 0x28]
mov ecx, esi
push eax
call fcn.0041e390
lea eax, [esp + 0x28]
push eax
call dword [0x4d838c]
mov eax, dword [esp + 0x40]
add esp, 4
cmp eax, 0x10
jb 0x41b881
inc eax
lea ecx, [esp + 0x28]
push eax
push dword [esp + 0x2c]
call fcn.0041e500
jmp 0x41b881
cmp byte [0x4d9358], 0
jne 0x41b8d3
int3
mov eax, dword [esp + 0x24]
cmp eax, 0x10
jb 0x41b899
inc eax
lea ecx, [esp + 0x10]
push eax
push dword [esp + 0x14]
call fcn.0041e500
push dword [ebx + 0xac]
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea esi, [edi + 0x50]
mov ecx, esi
call fcn.0041c340
push esi
mov dword [esi], 0x415e9c
call fcn.004abe9d
mov ecx, dword [esp + 0x448]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004aab4c
mov esp, ebp
pop ebp
ret
push 1
call fcn.004b94a2
int3
Function at 0x421a40
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x4d33b4]
xor eax, esp
mov dword [esp + 0x1c], eax
cmp dword [0x4d8394], 0
je 0x421a6e
xor al, al
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004aab4c
mov esp, ebp
pop ebp
ret
push 0x20
call fcn.004aa0fc
add esp, 4
mov ecx, eax
push 0
call fcn.00421680
mov dword [0x4d8394], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 8]
call fcn.0041c120
mov ecx, dword [0x4d8394]
lea eax, [esp + 4]
push eax
call fcn.00422af0
mov eax, dword [esp + 0x18]
cmp eax, 8
jb 0x421abe
inc eax
lea ecx, [esp + 4]
push eax
push dword [esp + 8]
call fcn.0041fc80
mov ecx, dword [esp + 0x1c]
mov al, 1
xor ecx, esp
call fcn.004aab4c
mov esp, ebp
pop ebp
ret

Function at 0x422af0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x4d33b4]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, ecx
mov dword [esp + 8], 0
mov ecx, 0x416888
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x422b32
sub ecx, edx
lea eax, [esp + 0xc]
sar ecx, 1
mov edx, 3
push ecx
push 0x416888
push eax
mov ecx, esi
call fcn.004289b0
add esp, 0xc
cmp dword [esp + 0x1c], 0
je 0x422b99
cmp dword [esp + 0x20], 8
lea ecx, [esp + 8]
lea eax, [esp + 0xc]
mov dword [esp + 8], 0
cmovae eax, dword [esp + 0xc]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov ecx, edi
push esi
push dword [esp + 0xc]
call fcn.00421b10
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x20]
cmp eax, 8
jb 0x422bb1
inc eax
lea ecx, [esp + 0xc]
push eax
push dword [esp + 0x10]
call fcn.0041fc80
mov ecx, dword [esp + 0x24]
pop edi
pop esi
xor ecx, esp
call fcn.004aab4c
mov esp, ebp
pop ebp
ret 4
Function at 0x427b30
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2d4
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], ebx
push dword [edi + 0x44]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [edi + 0x40], ebx
mov eax, dword [0x4d8398]
test eax, 0xfffffffe
jne 0x427b9e
push 0x4d8398
call fcn.0042d6a0
add esp, 4
test al, al
je 0x427b9e
mov ecx, 0x4d839c
call fcn.00428100
mov dword [0x4d8398], eax
mov eax, 0x4280d0
test eax, eax
je 0x427b9e
push 0x4d8398
push 0x4280d0
call fcn.0042a280
add esp, 8
mov eax, dword [0x4d8398]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x427bf1
cmp dword [0x4d8374], 3
jg 0x427be0
push 3
push 0x23
push 0x416758
lea ecx, [esp + 0x2c]
lea ebx, [eax + 0x10]
call fcn.0041b540
add eax, 8
push 0x4167a4
push eax
call fcn.004200c0
add esp, 8
test bl, 0x10
je 0x427bf1
lea ecx, [esp + 0x20]
and ebx, 0xffffffef
call fcn.0041b6f0
mov edx, dword [ebp + 8]
mov eax, 2
cmp dword [edx + 8], 0
mov esi, dword [edx]
cmovne esi, eax
mov eax, dword [edx + 4]
mov dword [edi + 0x4c], eax
sub esp, 0x20
mov ecx, dword [edx + 8]
mov eax, esp
mov dword [esp + 0x34], eax
mov dword [eax], ecx
test ecx, ecx
je 0x427c23
mov eax, 1
lock xadd dword [ecx], eax
mov eax, dword [edx + 0xc]
mov ecx, dword [esp + 0x34]
push 0xffffffffffffffff
push 0
mov dword [ecx + 4], eax
add ecx, 8
lea eax, [edx + 0x10]
push eax
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.0041dfd0
mov edx, esi
lea ecx, [esp + 0x38]
call fcn.0043a2f0
mov esi, dword [esp + 0x38]
add esp, 0x20
mov dword [edi + 0x48], esi
push dword [edi + 0x68]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
add edi, 0x28
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x2c]
mov ecx, dword [ecx + 0x28]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
lea edx, [eax + 0x24]
mov dword [esp + 0x18], edx
test bl, 0x20
je 0x427cb2
lea ecx, [esp + 0xd0]
and ebx, 0xffffffdf
call fcn.0041b6f0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push dword [esp + 0x1c]
push edx
mov edx, eax
call fcn.00438c10
add esp, 8
test al, al
jne 0x427cec
test bl, 4
je 0x427cd6
lea ecx, [esp + 0x180]
call fcn.0041b6f0
mov eax, dword [esp + 0x10]
push edi
mov dword [eax + 0x48], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor bl, bl
jmp 0x427d08
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor esi, esi
test bl, 8
je 0x427d06
lea ecx, [esp + 0x230]
call fcn.0041b6f0
mov bl, 1
test esi, esi
je 0x427d14
mov edx, dword [esi]
mov ecx, esi
push 1
call dword [edx]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42b5f0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5f0
mov eax, dword [0x4d33b4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov esi, edx
xor ebx, ebx
push esi
sub esp, 8
mov dword [ebp - 0x2ec], esi
mov dword [ebp - 0x2e8], ebx
push ecx
lea ecx, [ebp - 0x2e4]
call fcn.00436520
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x2e4]
call fcn.00436700
cmp dword [ebp - 0x10], ebx
je 0x42b75b
nop
cmp byte [ebp - 0x2e4], 0
jne 0x42b67a
test bl, 1
je 0x42b662
and ebx, 0xfffffffe
lea ecx, [ebp - 0x39c]
mov dword [ebp - 0x2e8], ebx
call fcn.0041b6f0
push 0x250
lea eax, [ebp - 0x5ec]
push 0
push eax
call fcn.0045ff61
add esp, 0xc
jmp 0x42b693
mov ecx, 0x94
lea esi, [ebp - 0x2e0]
lea edi, [ebp - 0x5ec]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x2ec]
mov ebx, dword [ebp - 0x5ec]
mov cl, byte [ebp + 8]
test bl, 1
je 0x42b6c9
test cl, cl
jne 0x42b6ae
mov eax, ebx
shr eax, 4
test al, 1
jne 0x42b6c9
cmp dword [ebp - 0xc], 8
lea ecx, [ebp - 0x20]
mov eax, ebx
cmovae ecx, dword [ebp - 0x20]
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov cl, byte [ebp + 8]
shr ebx, 4
test bl, 1
je 0x42b700
test cl, cl
je 0x42b716
push 1
mov edx, esi
lea ecx, [ebp - 0x20]
call fcn.0042b5f0
add esp, 4
test al, al
je 0x42b770
cmp dword [ebp - 0xc], 8
lea eax, [ebp - 0x20]
cmovae eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x42b712
cmp dword [ebp - 0xc], 8
lea eax, [ebp - 0x20]
cmovae eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x42b770
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x2e4]
call fcn.00436700
lea ecx, [ebp - 0x20]
cmp ecx, eax
je 0x42b736
push 0xffffffffffffffff
push 0
push eax
call fcn.0041dc30
mov eax, dword [ebp - 0x24]
cmp eax, 8
jb 0x42b74b
inc eax
lea ecx, [ebp - 0x38]
push eax
push dword [ebp - 0x38]
call fcn.0041fc80
cmp dword [ebp - 0x10], 0
mov ebx, dword [ebp - 0x2e8]
jne 0x42b640
mov eax, dword [ebp - 0xc]
cmp eax, 8
jb 0x42b7b5
mov ecx, dword [ebp - 0x20]
inc eax
cmp eax, 0x7fffffff
jbe 0x42b789
jmp 0x42b7d5
mov eax, dword [ebp - 0xc]
cmp eax, 8
jb 0x42b785
inc eax
lea ecx, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
call fcn.0041fc80
xor bl, bl
jmp 0x42b7b7
add eax, eax
cmp eax, 0x1000
jb 0x42b7ac
test cl, 0x1f
jne 0x42b7da
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x42b7df
sub ecx, eax
cmp ecx, 4
jb 0x42b7e4
cmp ecx, 0x23
ja 0x42b7e9
mov ecx, eax
push ecx
call fcn.004aa12f
add esp, 4
mov bl, 1
lea ecx, [ebp - 0x2e4]
call fcn.00436600
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aab4c
mov esp, ebp
pop ebp
ret
call fcn.004b1851
call fcn.004b1851
call fcn.004b1851
call fcn.004b1851
call fcn.004b1851
int3
Function at 0x42b8a0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x4d33b4]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x10], 0
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x42b8dd
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.004aab4c
mov esp, ebp
pop ebp
ret
cmp eax, 0x104
jae 0x42ba96
lea eax, [esp + 0x14]
mov ecx, edi
push eax
call fcn.00426d80
push 2
push ecx
push 0x41606c
mov ecx, eax
call fcn.00424230
cmp eax, 0xffffffff
mov eax, dword [esp + 0x28]
setne bl
cmp eax, 8
jb 0x42b921
inc eax
lea ecx, [esp + 0x14]
push eax
push dword [esp + 0x18]
call fcn.0041fc80
test bl, bl
je 0x42b9af
lea eax, [esp + 0x2c]
mov ecx, edi
push eax
call fcn.00426d80
push dword [ebp + 0xc]
mov esi, eax
mov ecx, edi
lea eax, [esp + 0x18]
push eax
call fcn.00426c40
mov edx, esi
mov ecx, eax
call fcn.0042b5f0
mov ecx, dword [esp + 0x2c]
add esp, 4
mov bl, al
cmp ecx, 8
jb 0x42b96c
inc ecx
push ecx
push dword [esp + 0x18]
lea ecx, [esp + 0x1c]
call fcn.0041fc80
xor eax, eax
mov dword [esp + 0x28], 7
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x24], 0
cmp eax, 8
jb 0x42b99b
inc eax
lea ecx, [esp + 0x2c]
push eax
push dword [esp + 0x30]
call fcn.0041fc80
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.004aab4c
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x14], 8
jb 0x42b9b9
mov eax, dword [edi]
jmp 0x42b9bb
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42b8c9
test bl, 1
je 0x42b9f3
cmp dword [edi + 0x14], 8
jb 0x42b9dc
mov ecx, dword [edi]
jmp 0x42b9de
mov ecx, edi
mov eax, ebx
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x42ba96
test bl, 0x10
jne 0x42ba1f
cmp dword [edi + 0x14], 8
jb 0x42ba00
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.004aab4c
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
je 0x42ba51
push 0x416074
lea ecx, [esp + 0x30]
call fcn.0041c120
mov ebx, 1
lea edx, [esp + 0x2c]
push ebx
mov ecx, edi
call fcn.0042b5f0
add esp, 4
test al, al
jne 0x42ba55
mov byte [esp + 0xf], al
jmp 0x42ba5a
mov ebx, dword [esp + 0x10]
mov byte [esp + 0xf], 1
test bl, 1
je 0x42ba68
lea ecx, [esp + 0x2c]
call fcn.0041c080
cmp byte [esp + 0xf], 0
je 0x42ba96
cmp dword [edi + 0x14], 8
jb 0x42ba77
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.004aab4c
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x44]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004aab4c
mov esp, ebp
pop ebp
ret
Function at 0x42beb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x42bebe
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
pop ebp
ret

Function at 0x42bed0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x42bede
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42bef2
shr eax, 4
and eax, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x42bf00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x4d33b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x218]
mov esi, ecx
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x42c02d
sub esp, 8
lea eax, [ebp - 0x218]
mov edx, esp
mov dword [edx], eax
cmp word [ebp - 0x218], 0
jne 0x42bf50
xor ecx, ecx
jmp 0x42bf6f
lea ecx, [ebp - 0x218]
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42bf60
sub ecx, edi
sar ecx, 1
mov dword [edx + 4], ecx
lea ecx, [ebp - 0x248]
call fcn.00426480
sub esp, 8
mov edx, esp
cmp dword [eax + 0x14], 8
jb 0x42bf8c
mov ecx, dword [eax]
jmp 0x42bf8e
mov ecx, eax
mov dword [edx], ecx
lea ecx, [ebp - 0x230]
mov eax, dword [eax + 0x10]
mov dword [edx + 4], eax
call fcn.00426480
lea ecx, [ebp - 0x230]
call fcn.004272b0
lea eax, [ebp - 0x230]
cmp esi, eax
je 0x42bfc2
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.0041dc30
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x42bfe0
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.0041fc80
xor eax, eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x220], 0
cmp eax, 8
jb 0x42c01b
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.0041fc80
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aab4c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.004aab4c
mov esp, ebp
pop ebp
ret
Function at 0x42c040
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4d33b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x210]
mov esi, ecx
push eax
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x42c0eb
cmp word [ebp - 0x210], 0
je 0x42c0eb
sub esp, 8
lea eax, [ebp - 0x210]
mov edx, esp
mov dword [edx], eax
cmp word [ebp - 0x210], 0
jne 0x42c0af
xor ecx, ecx
mov dword [edx + 4], ecx
mov ecx, esi
call fcn.00426480
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aab4c
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x210]
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42c0c0
sub ecx, edi
sar ecx, 1
mov dword [edx + 4], ecx
mov ecx, esi
call fcn.00426480
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aab4c
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0x214], 7
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x218], 0
mov word [ebp - 0x228], ax
call fcn.0042bf00
mov ecx, esi
test al, al
je 0x42c13d
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
mov dword [esi + 0x10], 0
push eax
mov word [esi], ax
lea eax, [ebp - 0x228]
push eax
call fcn.0041dc30
jmp 0x42c154
sub esp, 8
mov eax, esp
mov dword [eax], 0x4160bc
mov dword [eax + 4], 3
call fcn.00426480
mov eax, dword [ebp - 0x214]
cmp eax, 8
jb 0x42c172
inc eax
lea ecx, [ebp - 0x228]
push eax
push dword [ebp - 0x228]
call fcn.0041fc80
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004aab4c
mov esp, ebp
pop ebp
ret